Advice Request Kaspersky and PUP detection

[Ahmed Uchiha]

Hello there,
I noticed that many users complaint about Kaspersky's low detection of PUP but after contacting Kaspersky support and report some of the known PUP apps that are detected on Virustotal here is their response.
Although many of them detected by reputable AV engines, Kaspersky says that these apps have end-user license agreements that allow showing ads and promote their products so, they can't classify them as PUP and remove them.

 

[Freud2004]

Hello there,
I noticed that many users complaint about Kaspersky's low detection of PUP but after contacting Kaspersky support and report some of the known PUP apps that are detected on Virustotal here is their response.
Although many of them detected by reputable AV engines, Kaspersky says that these apps have end-user license agreements that allow showing ads and promote their products so, they can't classify them as PUP and remove them.

"low detection of PUP", this is one of the reasons I like Kaspersky, it just detects real treats. I hate applications that alert you because you are using a crack or other application that don't represent a danger to the user. I hate moralist applications, that alert the user because that applications is not complete legal.
Tanks Kaspersky to be the real deal...

A good example:

 

[Ahmed Uchiha]

Yes, that's the point Kaspersky also doesn't detect test tools or exploit simulators as they are not real threat.

 

[harlan4096]

Advice Request - How good is Kaspersky against PUPs/adware?

It's very solid in terms of protection but I heard it's not as strong (or does it care about) in protection against PUPs that are not actually malicious but annoying. For example, I just saw this topic...

malwaretips.com

 

[Ahmed Uchiha]

Advice Request - How good is Kaspersky against PUPs/adware?

It's very solid in terms of protection but I heard it's not as strong (or does it care about) in protection against PUPs that are not actually malicious but annoying. For example, I just saw this topic...

malwaretips.com

I am sorry I forgot that there is an already open thread about this topic please accept my apologies.

 

[Minimalist]

I expected more detections on VT. When only 3 or 4 vendors detect something (except it's a less known and possibly zero day sample) I usually don't trust that detections. In most cases it's FP from some vendors (although it's sometimes hard to distinguish one from another when it comes to PUA).

 

[Ahmed Uchiha]

I expected more detections on VT. When only 3 or 4 vendors detect something (except it's a less known and possibly zero day sample) I usually don't trust that detections. In most cases it's FP from some vendors (although it's sometimes hard to distinguish one from another when it comes to PUA).

I really don't know but, they are reputable AV engines like ESET, Gdata, and Malwarebytes

 

[Divine_Barakah]

I really don't know but, they are reputable AV engines like ESET, Gdata, and Malwarebytes

These are among the best at detecting PUPs

 

[Ahmed Uchiha]

I reported these apps to Kaspersky as PUP but, they said they are legitimate apps and they don't depend on Virus total detection to put their judgment.

 

[cliffspab]

Kaspersky is already like a puppy with its first bone with far too many of my 'legitimate' programs. Don't encourage them! That's why I'm on WiseVector now, even though KTS only costs $20 for a year.

 

[Ahmed Uchiha]

Kaspersky is already like a puppy with its first bone with far too many of my 'legitimate' programs. Don't encourage them! That's why I'm on WiseVector now, even though KTS only costs $20 for a year.

But, I think that Kaspersky and ESET the lowest false positive among all AV.

 

[Minimalist]

I really don't know but, they are reputable AV engines like ESET, Gdata, and Malwarebytes

Yes, but each of them detected only one sample while missing other two... For me 4/66 detection is not something to worry about.

 

[Minimalist]

But, I think that Kaspersky and ESET the lowest false positive among all AV.

Yes they are known for low FP rate.

 

[cliffspab]

But, I think that Kaspersky and ESET the lowest false positive among all AV.

Norton was far, far worse. I hated Lifelock with a passion. It's more that Kaspersky's UI makes undoing things such a ball ache. WiseVector picks out a lot of stuff too, but it's very quick and easy for me to get it to put them back, or have it obey instructions not to poke it's nose in certain folders. And it's light as air.

I love tinkering, but i just can't justify another AV at the moment.

 

[Freud2004]

I reported these apps to Kaspersky as PUP but, they said they are legitimate apps and they don't depend on Virus total detection to put their judgment.

Yes I agree with them, let me judge what is a PUP for me, and the AV judge what is treat for the PC.

 

[Ahmed Uchiha]

Yes I agree with them, let me judge what is a PUP for me, and the AV judge what is treat for the PC.

I thought them PUP as they are detected on Virus total also some of them bundle other apps like driver updater and defrag software or even tune-up software.

 

[MacDefender]

To what extent are these apps PUPs? There's a lot of largely useless sorta free "clean your computer" sort of apps that mainly just try to get you to pay them money for even more useless apps, but I think it's hard for AV vendors to start marking apps like that as PUPs. In the examples, very few vendors and basically no mainstream vendors (except for an ESET hit in one case) is willing to mark those apps as PUPs.

Malwarebytes gets tougher on PUPs | Malwarebytes Labs

We are getting even more critical about what we call a PUP, and what what we are going to be detecting and removing from user systems.

blog.malwarebytes.com

FWIW MalwareBytes and a few other vendors (including Microsoft) are starting to take a very aggressive view on PUPs. But this is still not an industry trend. Overall I'd rather AVs focus on detecting software that causes harm rather than borderline "uselessware".



EDIT: Hilariously, I have a copy of AusLogic's disk defrag tool on my Windows Server. It works. It was annoying in that the installer and everything else was really insistent on asking you to buy the Pro version with a few more features, but it actually did work as a defrag tool. A lot of the "legit" defrag tools refuse to run on Windows Server and instead ask you to buy a really expensive enterprise version of the tool, so maybe we need a moment of self reflection on which is the PUP

 

[struppigel]

Yes I agree with them, let me judge what is a PUP for me, and the AV judge what is treat for the PC.

AV products usually allow to disable PUP detections. That's why they are PUP and not malware, because you can indeed decide about that.

"low detection of PUP", this is one of the reasons I like Kaspersky, it just detects real treats. I hate applications that alert you because you are using a crack or other application that don't represent a danger to the user.

Illegal software is a different topic than PUP (it's actually grayware, not PUP). Policy for most AV vendors is to either ignore them, which means these will be shown as clean even if they contain malware, or to flag them as a risk regardless whether they contain malware. Both ways are not helpful for you determine whether they are safe.

Why these policies? Mainly for two reasons:

1) Flagging illegal software and files correctly may result in legal trouble and poses an ethical issue as well because AVs are helping to navigate and use these files. Where does it stop anyways? E.g. what about stalkerware? What about files that contain child abuse? These are not malware either. And yes, people send these to us. Should we distinguish between illegal files that are okay and those that are not? Because by law, none of them are okay. So actually, we already have the law as a guideline here.

2) It makes unproportionally more work if we attempt to analyse illegal files properly. Since they inherently pose a higher risk, people send those in on-masse. We would have to double our work-force to be able to analyse them all, whereas there is little benefit from it.

To what extent are these apps PUPs? There's a lot of largely useless sorta free "clean your computer" sort of apps that mainly just try to get you to pay them money for even more useless apps, but I think it's hard for AV vendors to start marking apps like that as PUPs.

I am not speaking about those specific samples because I did not analyse them, but generally, many system cleaners and optimizers are considered PUP because:

• They exaggerate scan results and show hundrets of problems/issues/warnings, even on a freshly installed system --> this is regarded as scare tactic, they use fear to make the user buy the product. Most of the time the demo product cannot fix those issues, only the paid version.
• Sometimes it is hard to uninstall them.
• A lot of them have strong VM detection mechanisms, and will not show any exaggerated warnings or tone them down if executed in a VM, they will also be less annoying and may refrain from nagging pop-ups and warning pop-ups after trying to close the application if executed in a VM. --> this is to prevent proper analysis in the hopes that vendors will not flag them as PUP. But it's even more a reason to flag them if the analyst detects this behaviour.
• A lot of them do not improve anything at all. Windows is fully capable to take care of its own registry and also defragging by now.

 

[SeriousHoax]

this is regarded as scare tactic, they use fear to make the user buy the product. Most of the time the demo product cannot fix those issues, only the paid version.

This reminded me of Avast which is a great product, brilliant protection, but they actually do this in their free AV. But I guess no one is bold enough to flag them as a PUP because the legal consequences will be huge.

 

[Ahmed Uchiha]

To what extent are these apps PUPs? There's a lot of largely useless sorta free "clean your computer" sort of apps that mainly just try to get you to pay them money for even more useless apps, but I think it's hard for AV vendors to start marking apps like that as PUPs. In the examples, very few vendors and basically no mainstream vendors (except for an ESET hit in one case) is willing to mark those apps as PUPs.

Malwarebytes gets tougher on PUPs | Malwarebytes Labs

We are getting even more critical about what we call a PUP, and what what we are going to be detecting and removing from user systems.

blog.malwarebytes.com

FWIW MalwareBytes and a few other vendors (including Microsoft) are starting to take a very aggressive view on PUPs. But this is still not an industry trend. Overall I'd rather AVs focus on detecting software that causes harm rather than borderline "uselessware".



EDIT: Hilariously, I have a copy of AusLogic's disk defrag tool on my Windows Server. It works. It was annoying in that the installer and everything else was really insistent on asking you to buy the Pro version with a few more features, but it actually did work as a defrag tool. A lot of the "legit" defrag tools refuse to run on Windows Server and instead ask you to buy a really expensive enterprise version of the tool, so maybe we need a moment of self reflection on which is the PUP

but, in my opinion, a useless app that just wants your money and doesn't do anything that kind of scam and potentially damage PC stability or may corrupt registry keys is in my opinion is PUP cause of course no one would like to see this kind of apps on his computer or Adware apps that show Ads on your desktop.