Malwarebytes finds all PUPs

[Nisko555]

I just ran Malwarebytes and the only things it found were lots of PUPs.  How do I determine what each one is so I can decide which to delete and which to keep?

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download Malwarebytes Support Tool
• Once the file is downloaded, open your Downloads folder/location of the downloaded file
• Double-click mb-support-X.X.X.XXXX.exe to run the program
  • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
• Place a checkmark next to Accept License Agreement and click Next
• You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!"
• Click the Advanced Options link
  
• Click the Gather Logs button
  
• A progress bar will appear and the program will proceed to gather troubleshooting information from your computer
• Upon completion, click OK
• A file named mbst-grab-results.zip will be saved to your Desktop
• Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
     
  
  Click "Reveal Hidden Contents" below for details on how to attach a file:
  Spoiler

  To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

  

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[dcollins]

Each detection should have a name, many of them probably share the name. You can search for the name on Malwarebytes Labs and see more information about it: https://blog.malwarebytes.com/threats/

[Nisko555]

Thank you for responding!  It will take me a while to do this - but I will do it.

[Nisko555]

Thank you for responding!  It will take me a while to do this - but I will do it.

[exile360]

You can usually identify what's been detected based on the vendor name as dcollins mentioned above, but you also might be able to identify it further by looking at the details/path which will also be listed in the scan report.  For example, the name and/or company that made the program should be identified by the name of the folder the files are stored in if they are detected under a common program installation path such as C:\Program Files\name of software or company or C:\Program Files (x86)\name of software or company.  When the items being detected are registry keys and/or values you can do the same thing.  For example, you might be able to identify it if a key being detected is under HKLM\SOFTWARE\name of software or company or HKCU\SOFTWARE\name of software or company and you might find similar entries identified under startup locations such as the RUN keys in the registry and/or STARTUP folder in the START menu as well as the Uninstall keys in the registry.  Even file names might help you to identify what's been detected, especially if you navigate to the location of the file and check its properties (right-click on the file and select Properties then look under the General, Details as well as the Digital Signatures tab (if it has one; not all files are digitally signed so that last one may not exist) and it may reveal the name of the program and/or the company that made it.

All of these things can help you to identify what the program is that's been detected, and since PUPs tend to be programs, not just random individual files which is usually the case for actual malware detections, you should be able to identify the program that's being detected and who made it.  Once you identify it, you can also check under Programs and Features to find out when it was installed (click once on the entry for the software once you've identified it then click on the Installed On column header to sort the list by the date of installation) and this can help you to determine what may have installed it if for example it was bundled with some other software that you intentionally installed as they'll have the same install date.  Once you determine that, you can then be cautious in the future if you ever update/upgrade that program to read the installer carefully and make sure that you uncheck/opt out of installing any additional software that it may wish to load onto your system (this is how many PUPs end up on computers is by being bundled with other programs).

[Nisko555]

My opinion:  It would be appropriate if Malwarebytes performed the lookup for the user with a description of what the PUP does.   It would be a nice enhancement to Malwarebytes.  BTW, thank you for the detailed response. Since the feature I suggest for Malwarebytes isn't available (yet), I will use your suggestions to learn how to identify each PUP.  Great information!!!

Edited June 1, 2018 by Nisko555

[exile360]

As dcollins mentioned, you may be able to identify it more easily if it's been cataloged in Malwarebytes online threat database located here.  Just search for the vendor name and if it is listed it should provide you extensive details on what it is and the reason it's being detected.  Here is an example.

The same goes for actual malware detections and blocked websites.  If the Research team has added an entry for it then you should be able to find out lots of detailed info on the detection, including what it does and the reason it is detected.

Edited June 1, 2018 by exile360