PUP.Optional.Catalina is Malwarebytes' detection name for a family of adware related potentially unwanted programs published by Catalina Group Ltd. for Windows and MacOS.
Users my notice this type of screen during install:
they may notice this type of entry in their list of installed Programs and Features:
and they may notice these Scheduled Tasks:
PUP.Optional.Catalina gains persistence by installing Scheduled Tasks and a Run registry key. These processes are designed to "update" the application without user consent. Some of these updates were connected to privacy issues.
PUP.Optional.Catalina downloads and installs extensions on the affected system that have no benefit for the user. PUP.Optional.Catalina comes bundled with the applications published by the Catalina Group like the Citrio browser (a Chromium project).
Malwarebytes can detect and remove PUP.Optional.Catalina without further user interaction.
A Malwarebytes log of removal will look similar to this:
Malwarebytes www.malwarebytes.com-Log Details- Scan Date: 2/13/19 Scan Time: 10:34 AM Log File: 99374b67-2f72-11e9-8ffc-00ffdcc6fdfc.json
-Software Information- Version: 3.6.1.2711 Components Version: 1.0.527 Update Package Version: 1.0.9238 License: Premium
-System Information- OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: {computername}\{username}
-Scan Summary- Scan Type: Threat Scan Scan Initiated By: Manual Result: Completed Objects Scanned: 236076 Threats Detected: 26 Threats Quarantined: 26 Time Elapsed: 4 min, 27 sec
-Scan Options- Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Detect PUM: Detect
-Scan Details- Process: 1 PUP.Optional.Catalina, C:\USERS\{username}\APPDATA\LOCAL\CATALINAGROUP\UPDATE\1.3.25.225\CATALINACRASHHANDLER.EXE, Quarantined, [500], [635491],1.0.9238
Module: 2 PUP.Optional.Catalina, C:\USERS\{username}\APPDATA\LOCAL\CATALINAGROUP\UPDATE\1.3.25.225\GOOPDATE.DLL, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, C:\USERS\{username}\APPDATA\LOCAL\CATALINAGROUP\UPDATE\1.3.25.225\CATALINACRASHHANDLER.EXE, Quarantined, [500], [635491],1.0.9238
Registry Key: 6 PUP.Optional.Catalina, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\CatalinaGroupUpdateTaskUserS-1-5-21-{userCLSID}Core, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{467A2CF4-D247-447D-9C6F-0F2E9E5F9BB6}, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\PLAIN\{467A2CF4-D247-447D-9C6F-0F2E9E5F9BB6}, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TREE\CatalinaGroupUpdateTaskUserS-1-5-21-{userCLSID}UA, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\TASKS\{18948E4E-B2F0-4193-BCD3-984AB9734C95}, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\SCHEDULE\TASKCACHE\PLAIN\{18948E4E-B2F0-4193-BCD3-984AB9734C95}, Quarantined, [500], [635491],1.0.9238
Registry Value: 1 PUP.Optional.Catalina, HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|CatalinaGroup Update, Quarantined, [500], [635491],1.0.9238
Registry Data: 0 (No malicious items detected)
Data Stream: 0 (No malicious items detected)
Folder: 0 (No malicious items detected)
File: 16 PUP.Optional.Catalina, C:\USERS\{username}\APPDATA\LOCAL\CATALINAGROUP\UPDATE\1.3.25.225\GOOPDATE.DLL, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, C:\USERS\{username}\APPDATA\LOCAL\CATALINAGROUP\UPDATE\1.3.25.225\CATALINACRASHHANDLER.EXE, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, C:\WINDOWS\TASKS\CatalinaGroupUpdateTaskUserS-1-5-21-{userCLSID}Core.job, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, C:\WINDOWS\SYSTEM32\TASKS\CatalinaGroupUpdateTaskUserS-1-5-21-{userCLSID}Core, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, C:\WINDOWS\TASKS\CatalinaGroupUpdateTaskUserS-1-5-21-{userCLSID}UA.job, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, C:\WINDOWS\SYSTEM32\TASKS\CatalinaGroupUpdateTaskUserS-1-5-21-{userCLSID}UA, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, C:\USERS\{username}\APPDATA\LOCAL\CATALINAGROUP\UPDATE\CATALINAUPDATE.EXE, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, C:\USERS\{username}\DESKTOP\CATALINAUPDATESETUP.EXE, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, C:\USERS\{username}\APPDATA\ROAMING\Microsoft\Internet Explorer\Quick Launch\Citrio.lnk, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, C:\USERS\{username}\APPDATA\ROAMING\MICROSOFT\INTERNET EXPLORER\QUICK LAUNCH\User Pinned\TaskBar\Citrio.lnk, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, C:\USERS\{username}\APPDATA\ROAMING\Microsoft\Windows\Start Menu\Programs\Citrio.lnk, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, C:\USERS\{username}\DESKTOP\Chrome Web Store.lnk, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, C:\USERS\{username}\DESKTOP\Citrio.lnk, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, C:\USERS\{username}\DESKTOP\Facebook.lnk, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, C:\USERS\{username}\DESKTOP\YouTube.lnk, Quarantined, [500], [635491],1.0.9238 PUP.Optional.Catalina, C:\USERS\{username}\APPDATA\LOCAL\CATALINAGROUP\CITRIO\APPLICATION\CITRIO.EXE, Quarantined, [500], [635491],1.0.9238
Physical Sector: 0 (No malicious items detected)
WMI: 0 (No malicious items detected)
(end)
Should users wish to keep this program and exclude it from being detected in future scans, they can add the program to the exclusions list. Here’s how to do it.
You may see these entries in FRST logs:
HKCU\...\Run: [CatalinaGroup Update] => C:\Users\{username}\AppData\Local\CatalinaGroup\Update\CatalinaUpdate.exe [132104 2019-02-13] (Catalina Group Limited -> Catalina Group Ltd.) <==== ATTENTION C:\Windows\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-{userCLSID}UA.job C:\Windows\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-{userCLSID}Core.job C:\Users\{username}\AppData\Local\CatalinaGroup C:\Windows\System32\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-{userCLSID}UA C:\Windows\System32\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-{userCLSID}Core C:\Users\{username}\AppData\Local\CatalinaGroup\Update\CatalinaUpdate.exeTask: {18948E4E-B2F0-4193-BCD3-984AB9734C95} - System32\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-{userCLSID}UA => C:\Users\{username}\AppData\Local\CatalinaGroup\Update\CatalinaUpdate.exe (Catalina Group Limited -> Catalina Group Ltd.) [File not signed] <==== ATTENTION Task: {467A2CF4-D247-447D-9C6F-0F2E9E5F9BB6} - System32\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-{userCLSID}Core => C:\Users\{username}\AppData\Local\CatalinaGroup\Update\CatalinaUpdate.exe (Catalina Group Limited -> Catalina Group Ltd.) [File not signed] <==== ATTENTION Task: C:\Windows\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-{userCLSID}Core.job => C:\Users\{username}\AppData\Local\CatalinaGroup\Update\CatalinaUpdate.exe <==== ATTENTION Task: C:\Windows\Tasks\CatalinaGroupUpdateTaskUserS-1-5-21-{userCLSID}UA.job => C:\Users\{username}\AppData\Local\CatalinaGroup\Update\CatalinaUpdate.exe <==== ATTENTION
Select your language