• All Community
    • All Community
    • Forums
    • Ideas
    • Blogs
Advanced

Not what you are looking for? Ask the experts!

Kudos0

Is PUP.Optional.Ask.A part of NS?

I had not run a Malwarebytes scan on my Windows 7 64 bit laptop in many months.  When I now run a scan (after updating MBAM) the only thing it found was PUP.Optional.Ask.A.  One instance as a registry key and one as a registry value.  I did not have it removed because I'd read threads on the Norton forums regarding Ask being a part of Norton.  I was afraid that removing it would nuke the Norton Toolbar or corrupt Norton altogether.  Another reason I thought it might have something to do with Norton is because the only thing I've installed since I last ran a Malwarebytes scan was Norton Security.  (installed over N360)  Other than that, I've only installed updates of Windows and automatic Adobe updates.

I've noticed nothing odd with the laptop in it's performance or behavior.

Does anyone know if this has anything to do with Norton and would it be safe to remove this PUP?  Any insight or advice appreciated!

Replies

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

hi Orioness1

Malwarebytes has never picked up the infection you mention on any of my devices. It does not appear to be on any of my devices. When reading about it there is no mention of Norton products.

It would appear not to be part of the Norton installation.

Many downloads seem to have the "option" of installing the Ask Toolbar so it could have come from many sources.

Michael

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

FWIW ~ every time HitmanPro detects Ask registry remnants.  I delete.
Do you run Chrome..?

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

Thanks for the quick replies Michael and bjm.

My first instinct was that it could be Norton related for the reasons mentioned, but I thought it odd I hadn't seen any threads about it if that was the case.  I've truly not downloaded anything since my last MBAM scan other than NS. The only option it had was to opt in or out for auto-renewals.  I wonder if it could have come from an ad on a website?  I do remember an ad for Ask on 800notes.

I run IE, not Chrome or FF.

I guess I'll let the scan run again later tonight and see what happens when it's removed.

Thank you both!

Accepted Solution
Kudos2 Stats

Re: Is PUP.Optional.Ask.A part of NS?

Hello

Malwarebytes picked it up on my computer a couple of months ago. I let it fix the problem. I then noticed that the Safe Search was gone. I keep Safe Search on so I can see the Safe Web Icons. So it is a part of Norton since the Safe Search is powered by Ask. If you do not want the Safe Search, then you can delete those registry entry.  It was gone from my Add-ons for IE 11 when I let Malwarebytes fix it. I then put it into the Do not scan section of Malwarebytes.  Thanks.

Success always occurs in private and failure in full view. Windows 10 Pro 64 bit Norton Core Security Plus 22.17.3.50 Core Firmware 282 I E 11 Chrome latest version.
Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

floplot:  I keep Safe Search on so I can see the Safe Web Icons.

Do you really need Safe Search On to see Safe Web Icons....? 

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

Floplot,

I decided to check this thread again before I did the scan to delete the PUP. I'm glad I did.  Thank you for relaying your experience.  It helped me and hopefully it will help someone else as well!  I'm amazed I couldn't find a thread on the matter.

Now if I could just see the Safe Web Icons on Google with IE again....

Thank you!

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

PUP.Optional.ASK.A is deemed as potentially unwanted program that performs malicious actions once installed on the computer. This detection by Malwarebytes Anti-Malware program is given to specific software that user may optionally install together with third-party application. However, due to lack of notification during the install process, PUP.Optional.ASK.A often gets into the PC without user's knowledge.

You may confirm MBAM False Positives <here>

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

Hi bjm,

Malicious is certainly not good. After I saw Floplot's account of her experience, it surely seemed to be a part of Norton.  After learning that it affected the toolbar function of Safe Search I checked the Norton Toolbar Forum and found a thread "I lost my Norton Toolbar" where Floplot (in early June) said that she had just had the MBAM detection of Ask.A and upon deletion lost her Safe Search.  That cause and effect is a pretty good indication that it's Norton related.  There was also a post in the thread by OUgrad that indicated Floplot's suggestion of removing the files from quarantine solved his problem.

I myself have Safe Search turned off, so if that's all I lost I'd be okay. I still get the Safe Web icons when I search on Google.  I did notice that they're actually back today. (Yay)

Out of curiosity I ran a MBAM scan on my Vista desktop that has the same version of Norton which is set up the same as the laptop.  The scan came up clean with no Ask.A.  Curiouser and curiouser.

Later today when I have more time I'll probably scan, delete and see what happens.

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

Orioness1,
Hi, I cannot see your machine.  I can however speculate.  You've had a MBAM detection.  All detections are either True or False.  If False then why would item affect Toolbar.  If True then I'd want to pursue with MBAM = maintain quarantine.   Either way I'd want MBAM / Norton to know that a MBAM detection True or False is affecting Toolbar.  Which hopefully shouldn't happen either way.  And if it is.  Someone should follow up.  So, as safe practice.  Just me. I'd delve into the detection.  If it's MBAM False Positive then MBAM will fix.  If it's a real detection then why would I exclude item from MBAM scans.  Something doesn't add up based upon my grasp of the scenario.   I don't know why flo needs SafeSearch On in Toolbar to render SafeWeb Icons.   Something, perhaps malware is making a change that needs exploring not excluding.
If I ever have a MBAM detection and it breaks something.  I'm gonna' delve.  I'm certainly not going to exclude wo first finding out it's a true False Positive.  I'm just curious.  Respectful to you and flo.  Absolutely, you are best umpire re your machine. 
Regarding IE SafeWeb search results Icons.  A WAX rules update has been released.  Please run LiveUpdate.
https://community.norton.com/en/forums/norton-toolbar-update-safeweb-annotations-issue

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

hi Orioness1

I have used MBAM free version and Norton in some form or other for many years.

MBAM does not detect PUP.Optional.ASK.A on any of my 5 devices with it and Norton installed.

If in the past MBAM has found any PUP I allow it to be deleted, I have found in the past an Ask Toolbar in my programs list which I uninstalled. I use Revo Uninstaller to remove programs from my devices.

I have today rechecked 2 of my devices with MBAM on neither has PUP.Optional.ASK.A been detected.

I have Norton Safe Search turned off however, I did turn it on today tried some searches, all of them returned results properly with the symbols saying Norton Safe Search powered by Ask.

Just as a matter of interest I use Bing for searches the Norton "Trusted" and OK symbols are showing and have never disappeared.

Michael 

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

I can verify this PUP is related to Norton Safe Search.  Like Floplot, my MBAM started picking up this PUP a few months ago.  When I deleted the PUP, Norton Safe Search was broken and removed as IE add-on ... and Safe Search runs via ASK.

But, even though my Safe Search was gone (I don't use it anyway), I was still getting the Safe Web icons.

I don't know why some combinations of MBAM and Norton are detecting it vs not, but I keep a very clean computer and after reinstalling NIS v21x after this detection, the PUP showed back up ... so it was indeed related to NIS

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

I went ahead and let MBAM quarantine the two entries.  Then immediately checked Manage Add-ons and sure enough Safe Search was gone.

I did find something interesting though.  Before I scanned and quarantined, I checked the differences in Manage Add-ons between my Win7 laptop and the Vista desktop on which MBAM found no Ask PUPs.  On the Win7, when I clicked on Safe Search in Manage Add-ons, there were two web addresses.  One was for search address and one for search suggestions.  I disabled the search suggestions before I ran the scan. It made no difference and the Ask PUP(s) were found.  On the Vista machine, when I clicked on Safe Search, search suggestions said "not available".  There was nothing to disable or enable.  There was no second web address for search suggestions.

Interestingly, in the MBAM log, the second of the two Ask PUP entries (the Registry Value) ended with "Suggestions URL_JSON".  This leads me to believe that it has something to do with that suggestions address.

I won't delete those entries yet and just keep them in quarantine just in case I need them back. I'm now convinced it is indeed part of Norton Safe Search for some systems.

Many thanks to all.  I do appreciate you!

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

Quarantine is secure free space.   No rent to pay.  No check out time. 
You may confirm MBAM False Positives <here> (link is external)

Vista box with IE9 = no MBAM detections
W8.1 box with IE11 = no MBAM detections
FWIW ~ I think someone, somewhere would be interested that Quarantine breaks Safe Search. 

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

Hello Orioness1

I'm glad you have had your question answered satisfactorily in your opinion. Thanks for marking the thread as solved. Thanks for helping to make the Search feature more usable.

Success always occurs in private and failure in full view. Windows 10 Pro 64 bit Norton Core Security Plus 22.17.3.50 Core Firmware 282 I E 11 Chrome latest version.
Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

Well, appears MBAM breaks Norton for some users, some of the time. 

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

Hi bjm

Maybe it's something to do with Win7?  I know that Norton employees peruse the forums.  I would think that they would take notice of a thread connecting Norton to a PUP.  Hopefully they can sort something out with Malwarebytes.  I'll look into the reporting to MBAM link tomorrow when I'm "fresher".

I know that this is off topic, but I have a question that pertains to this thread in specific.  I noticed in Floplot's last post that my screen name is a link to my profile page.  I don't recall ever seeing that before.  Is that something weird?  I clicked on it and it was a long list of information which I assume only I can see because I'm logged in and it's my page.  But then I clicked on Floplot's name and it too was a long page with information pretty much like I can see on my own page.  I clicked on everyone else's name and it's only 5, 6, 7 lines of innocuousness.  Please tell me that's all someone sees when someone clicks on my name....

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

Orioness1
When you click your name.  You can see your Community Account page.  Only you can see your full account page.   Your mini-profile name is a link to your account full-profile.   When I click your name I see the abridged version. 
flo probably does a copy paste of your name but does not break the link.   When I click on floplot I can see her full-profile.  I'll have to mention that to flo.  Thanks  @floplot

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

Hello

I do a copy, paste because I can't always see the names so clearly. That way I know I have spelled someone's name correctly.

Success always occurs in private and failure in full view. Windows 10 Pro 64 bit Norton Core Security Plus 22.17.3.50 Core Firmware 282 I E 11 Chrome latest version.
Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

Thanks bjm.  I'd never noticed it before and it sort of creeped me out.  Glad to know I'm not oversharing!

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

Orioness1:

Thanks bjm.  I'd never noticed it before and it sort of creeped me out.  Glad to know I'm not oversharing!

I hear ya'

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

Hi Floplot,

You posted after I last looked.  It was just different, that's all.  Then I got paranoid about what I could see and wondered what others could see.

Thanks again for your help.

Kudos1 Stats

Re: Is PUP.Optional.Ask.A part of NS?

Can someone share with me information about what is specifically quarantined by MB?

Thanks,

Matt Powers

Symantec Corp.

Kudos1 Stats

Re: Is PUP.Optional.Ask.A part of NS?

The following is copied from the MB scan log.  I removed a link to malwarebytes and the computer's name.  Hopefully there's nothing left that identifies my computer.  The PUP information is actually much more specific once I copied to clipboard and pasted here than what I could see before on the MB log.  The website for search suggestions is exactly what I saw in Manage Add-ons in IE before the quarantine.

Malwarebytes Anti-Malware
Scan Date: 7/29/2015
Scan Time: 4:25 PM
Logfile:
Administrator: Yes

Version: 2.1.8.1057
Malware Database: v2015.07.29.06
Rootkit Database: v2015.07.29.02
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 345490
Time Elapsed: 18 min, 16 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 1
PUP.Optional.Ask.A, HKU\S-1-5-21-2478312556-3502470524-599891092-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}, Quarantined, [04868f58ed9db68086db0399e61e1ee2],

Registry Values: 1
PUP.Optional.Ask.A, HKU\S-1-5-21-2478312556-3502470524-599891092-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}|SuggestionsURL_JSON, http://ss.websearch.ask.com/query?qsrc=2922&li=ff&sstype=prefix&q={searchTerms}, Quarantined, [04868f58ed9db68086db0399e61e1ee2]

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)

Kudos3 Stats

Re: Is PUP.Optional.Ask.A part of NS?

Thank you!  I shared information with MalwareBytes as a false positive dispute and they said they have corrected it earlier today, with database version: 2015.07.31.04.

Regards,

Matt Powers

Symantec Corp.

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

Thank you MJP.

I guess now I have to do what Floplot mentioned in the I Lost my Norton Toolbar thread and release the files from quarantine and restart my computer.

Thanks to all.

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

Hello

Yes, I will take them out of the do not scan or what ever they call it, the next time I use the program and restart my computer. I have already thanked Mat in another thread where this issue had come up also. Thanks.

Success always occurs in private and failure in full view. Windows 10 Pro 64 bit Norton Core Security Plus 22.17.3.50 Core Firmware 282 I E 11 Chrome latest version.
Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

FYI, I restored the files, reran the scan and no more detection. 

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

Hello

Good to hear that.

Success always occurs in private and failure in full view. Windows 10 Pro 64 bit Norton Core Security Plus 22.17.3.50 Core Firmware 282 I E 11 Chrome latest version.
Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

Happy to report that I am also no longer getting these MBAM detections since the recent database update.

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

Brocktoon:

Happy to report that I am also no longer getting these MBAM detections since the recent database update.

~ for reference as I posted earlier > 
You may confirm MBAM detection True or False Positives <here> (link is external)

Kudos0

Re: Is PUP.Optional.Ask.A part of NS?

Thank you for the confirmation.

-Gayathri

Gayathri R | Norton Forums Global Community Administrator | Symantec Corporation

This thread is closed from further comment. Please visit the forum to start a new thread.