pup.optional.ask won't go away—possible false-positive?

[Bob_Blaylock]

  Some time about a week or two ago, MalwareBytes started claiming, on each full threat scan, to detect and quarantine pup.optional.ask, in the file “C:\USERS\BOB\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data”.  I have MalwareBytes set to automatically do a full threat scan every night, while I am sleeping, and every morning, I get this same report.  I clear the quarantine each day.

 

  I've also used your Junk Removal Tool, and your AdwCleaner tool as well.  Each claims to find and remove pup.optional.ask, every time I run them.  No matter what I do, with any of your software having claimed to remove or quarantine pup.optional.ask, they still claim to find it the next time they are run.

  Shortly after this began, I made a point of downloading and installing the latest version of MalwareBytes,and making sure that it is as up-to-date as possible.  I currently am running version 3.3.1.2183 with Components Version 1.0.236 and Update Package Version 1.0.3293.

  I've also recently downloaded and installed Avast, and have run the most intense scans that it offers.  It does not claim to find pup.optional.ask at all.  I am experiencing no symptoms that indicate the presence of this PUP, other than that malwareBytes keeps claiming to find it.  There is no unexpected behavior on the part of Chrome, such as this PUP is supposed to cause, and nothing suspicious appears among the extensions that I can see installed in Chrome.

  I'm wondering is this is some bizarre form of a false-positive.  The specific file that MalwareBytes keeps identifying and quarantining doesn't seem like a likely place for such an infestation to be hiding.  If it's deleted (either by MalwareBytes quarantining it or me manually deleting it), Chrome creates a new instance.  If there really is an instance of this PUP infesting my machine, then it needs to be hiding somewhere other than in this file, but it is only this file that malwareBytes ever thinks is infected.

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 11/19/17
Scan Time: 1:00 AM
Log File: 05f2a711-cd08-11e7-ab8f-001a4bca3f50.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.236
Update Package Version: 1.0.3293
License: Premium

-System Information-
OS: Windows 10 (Build 15063.726)
CPU: x64
File System: NTFS
User: System

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 513580
Threats Detected: 1
Threats Quarantined: 1
Time Elapsed: 32 min, 8 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 1
PUP.Optional.ASK, C:\USERS\BOB\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, [526], [454825],1.0.3293

Physical Sector: 0
(No malicious items detected)


(end)

 

 

pup.optional.ask.20171119.zip

[Aura]

Hi Bob_Blaylock

Follow the instructions in the thread below. It should help with your issue.

https://forums.malwarebytes.com/topic/214325-chrome-secure-preferences-detection-always-comes-back/

 

[Aura]

Hi Bob_Blaylock,

Are you still with me?

[Bob_Blaylock]

4 hours ago, Aura said:

Hi Bob_Blaylock,

Are you still with me?

  Still here.  My problem seems to have been solved.  Part of the solution was posted here by someone else, but almost immediately deleted, but not before I was able to see it and act on it.

[Aura]

That's good news  Glad to see that your issue has been solved.

Stay safe Bob!

[Aura]

Glad we could help. :)If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks!