Solved Malwarebytes free detects a Nero shortcut as a PUP

BrianInEngland · Jul 2, 2023

I recently purchased the 2023 version of Nero Platinum, I've installed the apps I need/use. For some reason Malwarebytes is detecting the desktop shortcut to Nero TuneItUp as a Potentially unwanted program.

Deleting the shortcut shows no detections. Nero was downloaded from their official site and is licenced (yearly renewal).

I've never had any detections with any A/V scanner

OAT · Jul 2, 2023

BrianInEngland said:
I recently purchased the 2023 version of Nero Platinum, I've installed the apps I need/use. For some reason Malwarebytes is detecting the desktop shortcut to Nero TuneItUp as a Potentially unwanted program.

Deleting the shortcut shows no detections. Nero was downloaded from their official site and is licenced (yearly renewal).

I've never had any detections with any A/V scanner

Hey Brian,
Surely, you must have an exclusion setting option enabling you to exclude that Nero TuneItUp shortcut & path from Malwarebytes scans?

BrianInEngland · Jul 2, 2023

OAT said:
Hey Brian,
Surely, you must have an exclusion setting option enabling you to exclude that Nero TuneItUp shortcut & path from Malwarebytes scans?

Probably, to be honest I've never had to look at exclusions, it's the first time I've ever had any detections. I only started using the Nero app recently. It's only the shortcut that is flagged, not even the Nero program is detected. Weird.

OAT · Jul 2, 2023

BrianInEngland said:
Probably, to be honest I've never had to look at exclusions, it's the first time I've ever had any detections. I only started using the Nero app recently. It's only the shortcut that is flagged, not even the Nero program is detected. Weird.

That is a bit drastic, isn't it? And re-creating a new shortcut yields the same result?

BrianInEngland · Jul 2, 2023

OAT said:
That is a bit drastic, isn't it? And re-creating a new shortcut yields the same result?

Yep. Nero Tune ItUp is an optional program in the Nero suite, but technically so is Burning ROM which I've also got installed.

BobOmb · Jul 2, 2023

Per Malwarebytes: PUP.Optional | Malwarebytes Labs

"Detections categorized as PUPs are not considered as malicious as other forms of malware, and may even be regarded by some as useful. Malwarebytes detects potentially unwanted programs for several reasons, including:

They may have been installed without the user's consent. They may be supported by aggressive advertisements. They may be bundlers or part of a bundle. They may be misleading or offer a false sense of security."

I haven't seen Nero in a long time but it used to come bundled with a lot of machines. But maybe its that last line.

glasskuter · Jul 2, 2023

I have a couple of items that MWB sees as PUPs but I find them to be clean, useful programs. You can exclude items from detection at the file or folder level. https://support.malwarebytes.com/hc...xclude-detections-in-Malwarebytes-for-Windows

Porthos · Jul 3, 2023

BrianInEngland said:
For some reason Malwarebytes is detecting the desktop shortcut to Nero TuneItUp as a Potentially unwanted program.

That happens with many "tune-up programs"
If you wish to exclude it,
To exclude these items you need to perform a scan (a normal scan should do) and then at the end when it shows the list of detections, uncheck any item that you do not want to be removed and click Next. When prompted on what to do with the remaining unchecked items, select Ignore Always and they will be added to your exclusions and will no longer be detected by future scans.

BrianInEngland · Jul 3, 2023

Porthos said:
That happens with many "tune-up programs"
If you wish to exclude it,
To exclude these items you need to perform a scan (a normal scan should do) and then at the end when it shows the list of detections, uncheck any item that you do not want to be removed and click Next. When prompted on what to do with the remaining unchecked items, select Ignore Always and they will be added to your exclusions and will no longer be detected by future scans.

Yes I'll do that. It's not a problem, it's just the first time I've ever seen a detection with MWB, and it's only the desktop shortcut that's detected, not the program itself!

Porthos · Jul 3, 2023

BrianInEngland said:
it's only the desktop shortcut that's detected, not the program itself!

Has tune it up actually been installed yet?
It might be detecting the shortcut if the program is not fully installed and the link does that for you.

Porthos · Jul 3, 2023

PUP.Optional.NeroTuneItUp | Malwarebytes Labs

PUP.Optional.NeroTuneItUp is Malwarebytes' detection name for a potentially unwanted program called Nero TuneItUp, a system optimzer aimed at Windows system and published by Nero.

www.malwarebytes.com

BrianInEngland · Jul 3, 2023

Porthos said:
Has tune it up actually been installed yet?
It might be detecting the shortcut if the program is not fully installed and the link does that for you.

Yes I installed it along with Burning ROM and the photo duplicate finder. All the apps have desktop shortcuts

Porthos · Jul 3, 2023

BrianInEngland said:
All the apps have desktop shortcuts

Are they in the program files folder?

BrianInEngland · Jul 3, 2023

Porthos said:
Are they in the program files folder?

Yes all in Program Files\Nero Platinum Suite

Porthos · Jul 3, 2023

Guess you have to exclude it.

BrianInEngland · Jul 4, 2023

Porthos said:
Guess you have to exclude it.

Well I tried that. After a scan I selected the shortcut to exclude it, but MWB wants to exclude the actual program in Program Files and NOT the shortcut that is being flagged! I did that but it still detected the shortcut as a PUP!
Only thing I can do is remove the desktop shortcut.

Wisewiz · Jul 4, 2023

I'm sure MWB is only finding the shortcut because the name suggests a pre-installed app you didn't actually install yourself. I'll bet that if you simply change the name of the desktop shortcut to something like MyNeroApp, it'll be ignored. MWB has a long list of PUPs that are recognized by name, rather than by file contents. It spotted one of my shortcuts recently, and I had only to change the name to avoid the spotting. Then I changed the name back and excluded it.

My shortcut was "Start Menu," and a PUP called something like "Pokki Start Menu" was on their list.

BrianInEngland · Jul 4, 2023

Wisewiz said:
I'm sure MWB is only finding the shortcut because the name suggests a pre-installed app you didn't actually install yourself. I'll bet that if you simply change the name of the desktop shortcut to something like MyNeroApp, it'll be ignored. MWB has a long list of PUPs that are recognized by name, rather than by file contents. It spotted one of my shortcuts recently, and I had only to change the name to avoid the spotting. Then I changed the name back and excluded it.

My shortcut was "Start Menu," and a PUP called something like "Pokki Start Menu" was on their list.

That fixed it! It really was as simple as changing the shortcut name, I renamed it as 'TIU' and it didn't flag.
As Nero is a suite of programs, some of them are additional optional installs

KWEB · Jul 4, 2023

False positive Report it

Wisewiz · Jul 4, 2023

I hoped that would work. There really IS a program-name list that both MWB and AdwCleaner use (same company, ofc).

I use my Start Menu shortcut to jump into the AppData > Roaming .. Programs file quickly, to change an icon name, icon, or any such thing. Nothing at all PUP about it.