Malwarebytes detects PUPs in Google Chrome files everytime on every scan

[Mizgal]

Good day, 
everytime I perform scan with Malwarebytes it founds PUPs in Chrome files. I suspect that this is an error, however I am not sure. 
Is my computer safe? Were this files dangerous to my data or they were just false positives? 
What should I do in order to get rid of this problem? I would like to add that this is new issue - last week scanning with Malwarebytes did not revveal any traubles. 

Is it possible that my problem is described here: 

 ? 

I sincerly ask for your help! 

Addition.txt FRST.txt malware21-07-20v2.txt malware21-07-20.txt

[Mizgal]

malware21-07-20 and malware21-07-20v2 are scans from Malwarebytes. 

[AdvancedSetup]

Hello @Mizgal

I notice that you have the following notifications enabled in Chrome.

CHR Notifications: Default -> hxxp://forum.cdaction.pl; hxxps://forums.malwarebytes.com; hxxps://forums.malwarebytes.org; hxxps://tomato-timer.com

Can you try disabling that for now and see if it helps after cleaning up Google Chrome

https://blog.malwarebytes.com/security-world/technology/2019/01/browser-push-notifications-feature-asking-abused/

Turn notifications on or off - Google Chrome

Web Push notifications in Firefox

 

 

Please follow the directions from the following topic and let us know if that corrects your issue or not.

https://forums.malwarebytes.com/topic/258886-chrome-secure-preferences-detection-always-returns/

Thank you

 

[AdvancedSetup]

Can you please provide the requested logs from the following article.

Upload Malwarebytes Support Tool logs offline

Thanks

 

[Mizgal]

IIt has alleviated the problem: only 2 PUPs were found this time:
 

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 7/22/20
Scan Time: 12:21 AM
Log File: 87e6f4c6-cba0-11ea-b598-b42e994d9793.json

-Software Information-
Version: 4.1.2.73
Components Version: 1.0.979
Update Package Version: 1.0.27183
License: Free

-System Information-
OS: Windows 10 (Build 18362.959)
CPU: x64
File System: NTFS
User: ALEKSANDERLAND\Olek

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 367674
Threats Detected: 2
Threats Quarantined: 2
Time Elapsed: 3 min, 14 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 2
PUP.Optional.PushNotifications.Generic, C:\USERS\OLEK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 201, 841288, 1.0.27183, , ame, 
PUP.Optional.PushNotifications.Generic, C:\USERS\OLEK\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 201, 841288, 1.0.27183, , ame, 

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

I was not sent any email after creating this zip file with Malwarebytes Support Tool. 
Should I attach logs from this file here? 

[Mizgal]

BTW
The issue I am facing originates from some incompatibility between MB and Google Chrome, not an real infection?

[AdvancedSetup]

Yes, please attach the log. I'll review it and speak with our Research Team tomorrow and see if I can find the specific cause.

 

The following brute force clean up of Google Chrome should clear it but then you'd have to reinstall all of your Extensions again and losing preferences from everything including history and passwords. So, if you can wait until tomorrow hopefully Research can help me to help you more surgically remove the detection.

 

Chrome
Reset Chrome back to defaults to completely clear out issues with Chrome.

• Open Chrome and at the top right, click  More tools  Extensions
• Write down the list of Extensions installed.
• Next, go to >> Google Sync << and sign in to your account. Make sure you know your password as this will clear it from the browser.
• Scroll down until you see the   "reset sync" button to clear your data from the server and remove your passphrase.
• Now, close all Chrome windows. Chrome cannot be running for the next step. If needed, print this information or use another browser to read the information.
• Press the Windows key + R at the same time, to bring up the Run dialog box.
   
  • 
     
• Type in (or copy/paste) the following and press Enter:     %localappdata%\Google\Chrome\User Data\Default\

1. Press Ctrl + A to select all the files and folders.
2. Hold down Ctrl + A and click once on the files "Bookmarks" and "Bookmarks.bak". This will unselect them.
3. With all the files selected (except for your Bookmarks), press the Delete key and click Yes to delete the files and folders.
4. Example of all files and folders selected, except Bookmarks

 

 

 

 

[Mizgal]

I can wait, 
These files will do? or do I have to send the entire .zip folder?

Thank you for helping me. 

mbst-check-results.txt Addition_21-07-2020 17.10.46.txt FRST_21-07-2020 17.10.46.txt Addition.txt FRST.txt Addition_22-07-2020 00.34.21.txt FRST_22-07-2020 00.34.21.txt mbst-stub-results.txt mb-support-log.txt

[AdvancedSetup]

I'd like to get the entire zip file please.

 

[Mizgal]

Can I send this as private message to you? I  don't know what kind of information is there so I am hesitant about uploading it publicly.

[AdvancedSetup]

Yes, no probblem

And you're sure that Google Sync is OFF ?

[Mizgal]

I've sent it you. 

Now it is on since the instruction told me to turn it on:  

Weirdly, the scan with MB performed right now revealed no detections. So, it seems to be clear now. 

[AdvancedSetup]

I'm researching with one of the Research Team members now.

Go ahead and leave Sync alone then for now. Restart the computer. Then run a new threat scan and post back the new log

 

[Mizgal]

Done, after restart nothing was found in MB scan. 

[Mizgal]

Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 7/22/20
Scan Time: 2:25 AM
Log File: ce035cd6-cbb1-11ea-83e0-b42e994d9793.json

-Software Information-
Version: 4.1.2.73
Components Version: 1.0.979
Update Package Version: 1.0.27189
License: Free

-System Information-
OS: Windows 10 (Build 18362.959)
CPU: x64
File System: NTFS
User: ALEKSANDERLAND\Olek

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 367743
Threats Detected: 0
Threats Quarantined: 0
Time Elapsed: 2 min, 56 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

[AdvancedSetup]

Excellent. That's what should happen.

Sorry for all the trouble with this one but thank you for helping me to help you too.

Is there anything else I can assist you with at this time?

 

[Mizgal]

If my PC is safe and there is nothing else to attend to, I can say: No, thank you. 

I appreciate all what you have done for my case. 

[AdvancedSetup]

Thank you again. You're computer should be clean. If you do run into any further issues though please don't hesitate to let me know.

Take care and stay safe out there

 

[AdvancedSetup]

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread.

Please review the following for Tips to help protect from infection

Thank you