False positives at PUP.Optional.MailRu on Google Chrome

[peatprey]

Hello. My malwarebytes indicates that 15 PUP.Optional.MailRu viruses were found.  If you open these files in Explorer and scan, the antivirus will not swear. Other antiviruses also do not swear, as the site virustotal.com does not say that these 15 files contain a virus. I opened files and found nothing that looked like a virus. As I understand it, MailRu is listed in the file as part of the Google Chrome search engine. The files themselves are located in its folders. On a clean windows system, if you download Google Chrome and scan Malwarebytes, it will find this virus, although there is no virus.   

P.S There are no viral extensions in my browser    

[peatprey]

File scan in virustotal https://www.virustotal.com/gui/file/47369479bd54f3d4e60b3cec4a4fa4fe35747f9839fb5498ff39de4537741b04/detection

[peatprey]

It seems to me that antirus does not like mailru so much that even an ordinary inscription is considered a virus xD

 

[miekiemoes]

Hi,

We don't detect this as a Virus but as a PUP (Potentially Unwanted Application) which has changed some settings in your browser: https://blog.malwarebytes.com/detections/pup-optional-mailru/

This is not a false positive, but Potentially Unwanted, so if you want to keep it, you can add exclusions for it.

Thanks!

[peatprey]

However, there is no program there. Nobody changed my browser settings. Your antivirus is wrong

[peatprey]

2 hours ago, miekiemoes said:

Hi,

We don't detect this as a Virus but as a PUP (Potentially Unwanted Application) which has changed some settings in your browser: https://blog.malwarebytes.com/detections/pup-optional-mailru/

This is not a false positive, but Potentially Unwanted, so if you want to keep it, you can add exclusions for it.

Thanks!

Maybe I don't understand something, but where could the program be there? Antivirus swears at files and one folder, but these are not applications. How can this be PUP?

[miekiemoes]

It are settings in your Chrome preferences file that are pointing to mail.ru. In most cases, this is installed by bundled software (you might have had in the past), or per your choice, if you are a user of mail.ru.

Given you are probably Russian, you can ignore this detection if you are actually using it. 

You'll see in the search result below how many users see it as unwanted and want it gone:

https://www.google.com/search?q=mail.ru+chrome&ie=UTF-8&oe=

[peatprey]

2 hours ago, miekiemoes said:

Это настройки в вашем файле настроек Chrome, которые указывают на mail.ru. В большинстве случаев это устанавливается с помощью связанного программного обеспечения (которое могло быть у вас раньше) или по вашему выбору, если вы являетесь пользователем mail.ru.

Если вы, вероятно, русский, вы можете игнорировать это обнаружение, если вы действительно его используете. 

Вы увидите в результатах поиска ниже, сколько пользователей считают его нежелательным и хотят, чтобы он исчез:

https://www.google.com/search?q=mail.ru+chrome&ie=UTF-8&oe=

I don't use mailru in any way. I even have it removed from search engines. Is there a way to clear my Google Chrome data so that the antivirus no longer swears and I never see anything related to this terrible company?

[miekiemoes]

Hi,

First of all, let Malwarebytes remove what it found. (close Chrome). Note, Malwarebytes won't remove the preferences files, it will just "restore" it again.

In case it's still detected after malwarebytes removal, please see here: 

If that still didn't help, I suggest you start a new thread in the following forum: https://forums.malwarebytes.com/forum/7-windows-malware-removal-help-support/ - so someone from support can help you with this.

Thx!

[peatprey]

2 hours ago, miekiemoes said:

Hi,

First of all, let Malwarebytes remove what it found. (close Chrome). Note, Malwarebytes won't remove the preferences files, it will just "restore" it again.

In case it's still detected after malwarebytes removal, please see here: 

If that still didn't help, I suggest you start a new thread in the following forum: https://forums.malwarebytes.com/forum/7-windows-malware-removal-help-support/ - so someone from support can help you with this.

Thx!

Thank you very much! It turned out that this program was really in my Google sync data, I followed the instructions and was able to get rid of it forever. I toiled with this program for several days, reinstalled windows 2 times, and now my suffering is over. All thanks to you

[miekiemoes]

Glad to hear

There's a possibility it might come back though, especially Russian Chrome users, as we have noticed that some Russian sites actually re-add this to the search engine again.

Mail.ru isn't malware, it's rather annoying it adds "unwanted", so for the future, you can always add an exclusion for this detection as well, in case it comes back.

[peatprey]

2 hours ago, miekiemoes said:

Glad to hear

There's a possibility it might come back though, especially Russian Chrome users, as we have noticed that some Russian sites actually re-add this to the search engine again.

Mail.ru isn't malware, it's rather annoying it adds "unwanted", so for the future, you can always add an exclusion for this detection as well, in case it comes back.

Henceforth, I will be very careful on the Internet. This unwanted program may have been supplied by Utorrent. I sometimes use it to download movies. Unfortunately, Russia is a very poor country and not everyone can afford to buy content. So, utorrent has already been caught installing viruses on its users' computers. It was 2015 and they built a bitcoin miner into their program. Then they were removed after the scandal. 

Even before reinstalling Windows, I had such an extension in my browser. Perhaps it was also put by Utorrent

[miekiemoes]

That's correct. The uTorrent installer is also often bundled with additional software which might change the searchengine settings as well.

In either way, good you found the culprit.

 

[peatprey]

I formatted the SSD and hard drive. I installed the latest version of Windows from the official site. Not logged into chrome account. Installed your antivirus and it still finds this "virus". This is complete nonsense. False alarm. I opened files marked with antivirus in notepad and all I saw there were lines with the mention of the search engine MailRu. All my friends have the same thing. Please correct your program.

[peatprey]

On 9/23/2020 at 1:09 PM, miekiemoes said:

That's correct. The uTorrent installer is also often bundled with additional software which might change the searchengine settings as well.

In either way, good you found the culprit.

Marked a random message so you can see

 

 

[peatprey]

If you remove MailRu from the search engine, the program will not find anything. Definitely a false threat

virus not found.txt

[Porthos]

KMS is a hack tool to steal Windows or Microsoft Office. You should remove and stop using hacks like that to get software for free.

[peatprey]

Kms has nothing to do with it. The program just found it. Let me decide for myself what to use and what notKms has nothing to do with it. The program just found it. Let me decide for myself what to use and what not

[Porthos]

10 minutes ago, peatprey said:

Let me decide for myself what to use and what not

Then you have to add it to exclusions at your own risk.

If any of the items being detected are registry keys or other items not directly accessible through the Allow List functions in Malwarebytes then you should perform a scan by returning to the main dashboard and clicking the Scan button, and once the scan completes either uncheck the box next to each item you wish to keep, or if they are all items belonging to the program you wish to exclude then click the empty checkbox at the top left of the list to clear all checkboxes then click Next and when prompted on what to do with the remaining items simply select the option to always ignore them and they will be added to your Allow List so that they will no longer be detected by scans or the Malware Protection component.

Add to the Allow List in Malwarebytes for Windows v4

That is all that can be said. Malwarebytes does condone piracy.

 

Edited January 18, 2021 by Porthos

[peatprey]

Okay. I just wanted to say that this antivirus is misleading peopleMy comments were about something else