Unchecky see MWP standard install as a PUP

[genegold]

Something I've noticed with these last two updates is that the utility Unchecky shows MWP as a PUP when the installation choice is standard, but not with Custom. The install is defaulting to Custom, so I hadn't noticed it until I ran my cursor over the other. I notified Unchecky, but their report procedure is funky and I'm not sure it got into their system. In any case, Custom installs in the same place, unless told otherwise. Unchecky is a program that unchecks unrelated offers that often come with programs. https://unchecky.com/

[TrustFire]

It's a false positive.

[Digerati]

Yes, it is a false positive - sort of.

First, I never heard of Unchecky before so I had to do some homework. I note there are reports of several security programs tagging Unchecky as a PUP and even malicious. Understand, there is a difference. "Unwanted" (potentially or not) does NOT imply "malicious".

I personally don't see a need for Unchecky. If you always choose the Custom install option whenever you install any program (including updates) and carefully look at the options, opting out of those you don't want, you can make sure nothing unwanted gets installed without the need for a 3rd party application, like Unchecky.

It is odd that you get this warning only with the Custom install option. Do you have MailWasher installed in one of Windows' primary system folders?

Last, it is important to note what "PUP" means - it means Unchecky is claiming the program is "potentially" "unwanted". It is not saying it "is" unwanted. Nor is it saying it is "malicious", or even might be malicious.

It is just saying you, "might not want it".

I have seen my security programs, Microsoft Defender (formally Windows Defender) and Malwarebytes tag absolutely "wanted" and totally safe programs I was intentionally installing as PUPs before too. Not always, but typically this happens with new programs or new program updates where the general public has yet to download and install it enough times for the security program to learn about it. Typically, after a couple weeks, the PUP warnings stop.

One thing you might want to do is make sure Unchecky and your other security programs don't automatically quarantine or remove programs and files you install that it thinks is potentially unwanted. They still need to alert you to them, but then give you the choice of what you want done with them.

[TrustFire]

VirusTotal . . . a site I find useful for threat analysis — here's the analysis report for the latest MailWasher:—

VirusTotal_Analysis__(Undetected).jpg (429.1 KiB) Viewed 4204 times

[genegold]

Hey guys, I know what a PUP is and know that it doesn’t mean malware/virus. And I know that if one installs enough programs over the years it’s likely that occasionally one of those unwanted add-on programs will be missed. Unchecky has served a useful purpose as an insurance policy. The simple purpose of my post was to let Firetrust know about this odd behavior — something very recent that I had never seen before with any program — just in case there’s something about MWP’s installation code that’s kicking it in (well, presumably there must be). C’est tout.

[Digerati]

I gathered from your opening post you know what a PUP is. I was just adding my 2 cents in case other readers are unclear.