Author’s Note: We at Malwarebytes continue to do our part in educating our product users and constant blog readers about day-to-day online threats and how they can avoid falling prey to them. “PUP Friday”, our latest attempt at getting users acquainted with files they may need to watch out for in the Wild Web, offers an in-depth look at some interesting and quite notable potentially unwanted programs (PUPs). Expect to see this type of content pushed out twice a month at the end of a work week.
Malwarebytes Anti-Malware has been removing the Ask toolbar from many computers (about 60,000 for PUP.Optional.APNToolBar.Gen in the last 24 hours at the time of writing), but recently we found it bundled with an application that made us chuckle.
Well, actually it wasn’t the application that made us chuckle, but the fact that the Ask software might seem counter-productive to some with regard to the intention of the software it came bundled with.
Imagine selling an application that promises to speed up your computer and having to bundle it with a PUP to make a living. Apparently that is what happened to the people at “Improve Speed PC”.
As you can see from the screenshots below the application promised to fix 75 issues for me.
Looking at what it revealed that turned out to be mostly registry keys and files related to older Microsoft.NET/Framework versions.
In return it offered to install the Ask Toolbar for me on two browsers. A quick count showed me that added up to 270 registry keys and files that I feel were unneeded. This is without counting the “Improve Speed PC” software installation itself.
How we found out about this situation? We were wondering why their installer was stopped by Malwarebytes Anti-Malware Premium, so we investigated and gave it a test run. The program itself seems like one of 13 in a dozen that promise to optimize your computers performance by making futile changes.
However, we were unable to test its efficacy because that would have required a registration.
I am fully aware that the comparison of numbers I made above is unfair, but let’s have a closer look.
As you can see the applications are listed separately in your list of installed software:
Both find it necessary to start automatically when your computer boots:
O4 - HKLM\..\Run: [ImproveSpeedPC] C:\Program Files (x86)\ImproveSpeedPC\ImproveSpeedPC.exe
O4 - HKLM\..\Run: [ApnTBMon] "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe"
O23 - Service: Ask Update Service (APNMCP) - APN LLC. - C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
And it seems logical that more running processes will gobble up more of my resources than some orphaned registry keys. Still not saying that the program is not useful since we were unable to test it.
But no matter what you are installing, stay clear of these:
We can’t say this enough dear readers. Pay attention to what you are clicking on. The “Improve Speed PC” program will install just the same if you “Decline” and “Cancel” the offers.
The program will also be fully functional after you used Malwarebytes Anti-Malware to remove the potentially unwanted “Search App by Ask” but it’s even better to save yourself the hassle. This is far from the only software that makes these or similar "recommended offers", but the irony in this case did not go unnoticed.
A removal guide for the Search App by Ask can be found on our forums.