Failing PUP test

[share3141]

A recent article on ghacks.net (https://www.ghacks.net/2018/08/20/how-to-enable-windows-defenders-potentially-unwanted-programs-protection/) discusses "Setting How to enable Windows Defender's potentially unwanted programs protection"  As part of that process a test site is referenced to attempt to download a PUP.  https://www.amtso.org/feature-settings-check-potentially-unwanted-applications/.  This page not only lets you download a test file but also mentions vendors that support this feature.  Malwarebytes is not among those vendors.  I have no idea if this is an issue - I make no judgement - I am sharing some information in case you were unaware of it.  Thanks.   

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the Malwarebytes 3 Help forum.

 

If you are having technical issues with our Windows product, please do the following: 

Spoiler

If you haven’t already done so, please run the Malwarebytes Support Tool and then attach the logs in your next reply:

NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download Malwarebytes Support Tool
• Once the file is downloaded, open your Downloads folder/location of the downloaded file
• Double-click mb-support-X.X.X.XXXX.exe to run the program
  • You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
• Place a checkmark next to Accept License Agreement and click Next
• You will be presented with a page stating, "Welcome to the Malwarebytes Support Tool!"
• Click the Advanced Options link
  
  
   
• Click the Gather Logs button
  
  
   
• A progress bar will appear and the program will proceed to gather troubleshooting information from your computer
• Upon completion, click OK
• A file named mbst-grab-results.zip will be saved to your Desktop
• Please attach the file in your next reply. Before submitting your reply, be sure to enable "Notify me of replies" like so:
  
     
  
  
  Click "Reveal Hidden Contents" below for details on how to attach a file:
   
  Spoiler

  To save attachments, please click the link as shown below. You can click and drag the files to this bar or you can click the choose files, then browse to where your files are located, select them and click the Open button.

  
   

One of our experts will be able to assist you shortly.

 

If you are having licensing issues, please do the following: 

Spoiler

For any of these issues:

• Renewals
• Refunds (including double billing)
• Cancellations
• Update Billing Info
• Multiple Transactions
• Consumer Purchases
• Transaction Receipt

Please contact our support team at https://support.malwarebytes.com/community/consumer/pages/contact-us to get help

If you need help looking up your license details, please head here: https://support.malwarebytes.com/docs/DOC-1264 

 

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[exile360]

Greetings,

Just as with EICAR which is used for testing antivirus, synthetic tests like this don't really do anything except inform you whether or not PUA/PUP detection is active in your product if the test is supported.  It doesn't determine anything with regards to the product's effectiveness at actually detecting real PUPs in the wild.

With that said, I can recommend some files to test with if you wish to verify your product's PUP detection capabilities are active and you don't even have to execute them, you can just download and scan them with your product and as long as it detects them then PUP detection is enabled (I mention this since some products do not use on-access scanning in real-time in order to avoid conflicts with other products, and this includes Malwarebytes so you'd have to actually attempt to execute a PUP for Malwarebytes to flag and quarantine the item which you might not want to do if you aren't confident that PUP detection is functioning properly, though since it is a PUP it's relatively benign anyway so it won't actually do anything harmful to your system).

If you'd like some suggestions on files to test with let me know and I will provide some links for you.

[share3141]

I'm ok - just more curious than anything else.  MB has informed me of many PUPs - like a few utilities from Sysinternals or NirSoft.  It seems to be doing a great job at doing what it is supposed to.  I just wasn't sure if there was an issue as many other AV vendors were represented on the amtso site.  Thank you for your response!   

[lock]

exile360 is absolutely right; such test doesn't mean ANYTHING!!!!

The participant will simply add the signature to their detection list and that's it!

The same is valid for so called "mbae-test.exe" from Malwarebytes which is supposed to show you that the antiexploit shield works; is just a simply signature added to their list and not an exploit .

No other antivirus which has an antiexploit shield would detect "mbae-test.exe " as an exploit, so we can say that is nothing else than an ordinary fake!

[exile360]

I honestly don't know how the Malwarebytes exploit test works, but it is my understanding that it does actually replicate exploit behavior to test exploit detection, but with that said, you can also use the HitmanPro.Alert Exploit Test Tool to test it if you don't trust the Malwarebytes tool.  All you have to do is add a custom shield to the Exploit Protection settings in Malwarebytes for the test EXE then run the various tests to see which ones it blocks (I don't believe it blocks all of them, but it does block most of them and I've used it myself in the past to test this very thing).  The manual for the tool can be found here.