Seeing PUP.Optional.Legacy on a fresh system install

[Steve1982]

Hi, I just did a fresh Windows 10 Pro install and after loading MalwareBytes and Chrome and updating both to the latest versions I ran AdwCleaner.

Much to my dismay, it came back with two entries!

PUP.Optional.Legacy
  - Chrome Search Provider      Ask
  - Chrome Search Provider      Ask

That has to be false positives right? See attached files for details. I have two Chrome profiles, hence the two detections. I went to Chrome > Settings > Manage search engines and removed the Ask entries and now AdwCleaner comes up clean.

Is there any reason to be worried at all? I'm pretty sure these are installed by the official Chrome installer but I would love to hear from others who have Chrome installed if they're also seeing this.

Thanks!!

AdwCleaner[S00].txt

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the AdwCleaner Help forum.

Someone will reply shortly, but in the meantime here are a few resources which may help resolve your issue:

• AdwCleaner user guide
• A malicious element isn't being detected? Submit the sample here!
• Need help with another Malwarebytes product or malware removal?
  • Click here for home support
  • Click here for business support
  • Click here for malware removal help

Thanks in advance for your patience.

-The Malwarebytes Forum Team

[jboursier]

Hello,

Yes, we're not advising about using Ask search engine, whether it's offered in Chrome in the default setup, so this isn't a FP.

Regards,

[Steve1982]

Hi, thanks for the reply.

So just to clarify ... what you're saying is that, even though the Ask search engine is installed by Chrome by default and not "real" malware, you still advise against having it which is why it's reported by AdwCleaner, is that right?

I just want to make sure I don't have anything to worry about (other than the fact that Ask search is installed by Chrome).

Thanks!

[Steve1982]

@fr33tux @Elisabeth @exile360

Sorry forgot to tag the right people for a response. Since the Ask toolbar is installed by the latest versions(s) of Chrome by default most (if not all) users of AdwCleaner will probably see that detection so a little more clarity around this will be great.

[Steve1982]

Oops, wish I could edit posts ... I meant to say in the previous message "Since the Ask search is installed by the latest versions(s) of Chrome by default ..."

[Steve1982]

Just to make sure there is no confusion, here is a screenshot of what is installed by Google Chrome by default (AdwCleaner detects the Ask search entry). 

 

 

[jboursier]

Hello,

Sorry for the delay.

On 10/1/2018 at 5:20 PM, Steve1982 said:

Since the Ask toolbar is installed by the latest versions(s) of Chrome by default most (if not all) users of AdwCleaner will probably see that detection so a little more clarity around this will be great. 

You're right.

Ask has been well-known to have grey-ish practices, which led us to detect them as they were considered as PUP and I let you refer to the Wikipedia history for more details.

Very often, grey-ish companies try to bundle their software with widely used software (Java was Ask's case for instance) as an installation option, or as a browser setting (search engine, extension...) in a browser to generate views, collect data, and thus get revenue.

This (AdwCleaner restricted) detection triggers only on the search engine that is a subset of the Ask toolbar, thus the detection.

We'll elaborate more about that in the coming weeks.