Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

PUP.NetworkPasswordTool


  • Please log in to reply
15 replies to this topic

#1 crlamb

crlamb

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:04 PM

Posted 08 June 2011 - 04:49 PM

Malwarebytes isolated this file during scan. What is it ?.....Do I delete it ?

BC AdBot (Login to Remove)

 


#2 odin88

odin88

  • Members
  • 97 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:NorthEast England U.K
  • Local time:01:04 AM

Posted 08 June 2011 - 05:24 PM

Hi,
PUP stands for Potentially Unwanted Programs, usually these are quite harmless, but just off the wording of it "password tool" and if it wasn't installed by you I would definatly let MBam get rid of it. I would also be running through the rest of the malware removal procedures on this forum, a moderator will no doubt instruct on how to go about this.

Iain.
our attitude toward life determins lifes attitude towards us.

#3 hamluis

hamluis

    Moderator


  • Moderator
  • 55,866 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:08:04 PM

Posted 09 June 2011 - 09:57 AM

Is there an entry to install such in Add/Remove Programs?

What is the full path for netpass.exe on your system?

Related Google Links

Louis

#4 crlamb

crlamb
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:04 PM

Posted 09 June 2011 - 02:00 PM

C:\Users\Bob\Documents\Unzipped\64xTools\netpass.exe (PUP.NetworkPasswordTool)

Edited by crlamb, 09 June 2011 - 02:01 PM.


#5 Union_Thug

Union_Thug

    Bleeps with the fishes...


  • Members
  • 2,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:is everything
  • Local time:09:04 PM

Posted 09 June 2011 - 02:41 PM

Found this doing a "Google" for netpass.exe: http://www.nirsoft.net/utils/network_password_recovery.html

Network Password Recovery v1.32 - Recover Windows XP/Vista network passwords (Credentials file)

Using Network Password Recovery

This utility doesn't require any installation process or additional DLLs. In order to start using it, just extract the zip file to any folder you like, and run the executable file - netpass.exe .

When you run this utility, the main window displays all network passwords found on your system. You can select one or more items, and then copy them to the clipboard, or save them to text/HTML/XML file.


Known Problems

False Alert Problems: Some Antivirus programs detect this utility as infected with Trojan/Virus. Click here to read more about false alerts in Antivirus programs

http://blog.nirsoft.net/2009/05/17/antivirus-companies-cause-a-big-headache-to-small-developers/

Antivirus companies cause a big headache to small developers

Antivirus is essential tool that most people need to protect their Windows operating system from Viruses, Trojans, and other bad stuff.

Unfortunately, most Antivirus companies goes too far with their Virus/Trojan protection, and in many times they classify completely legit software as Virus/Trojan infection.
One good example for that is my own password recovery tools: Most people need these tools to recover their own lost password. These password tools, like many other utilities out there, can also be used by hackers for bad purposes.


Long story made short, have you used this utility? Could this be what MBAM is flagging? FWIW, I've used many programs by NirSoft including MyUninstaller, BlueScreenView, WinUpdatesList, ShellExView, RegScanner & CleanAfterMe and never had a problem with any. AAMOF, I recommend NirSoft utilities.

Hope this helps.

Edited by Union_Thug, 09 June 2011 - 02:44 PM.


#6 crlamb

crlamb
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:04 PM

Posted 09 June 2011 - 03:07 PM

Does this mean that this is not a problem ? - I use the free version of MBAM and it states in the log file that the file was "Not Selected For Removal". I do not believe that this is a "new" file. and I rum MBAM about every two weeks and this has not been detected on prior scans, but the recent scan was run after an update and a new install of MBAM where they offer the "two week trial" of the "pay" version. I refused the two week trial. I assume that the wording " This fi;e not selected for removal" means that the file was not removed ?

#7 Union_Thug

Union_Thug

    Bleeps with the fishes...


  • Members
  • 2,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:is everything
  • Local time:09:04 PM

Posted 09 June 2011 - 03:29 PM

>>>Does this mean that this is not a problem ?<<<

Network Password Recovery v1.32 - Recover Windows XP/Vista network passwords http://www.nirsoft.net/utils/network_password_recovery.html

....have you used this utility? (IF SO) Could this be what MBAM is flagging?



Is this the program MBAM is detecting? If so, then you have 3 options as I see it. 1) Delete the netpass.exe file. 2) Let MBAM remove it. 3) Change your scan settings in MBAM Settings>>Scanner Settings>> Change from dropdown menu-- Action for potentially unwanted programs (PUP)

[attachment=99383:pup_MBAM.PNG]

ETA 4th option: Keep the program and change the MBAM PUP settings OR set an Ignore or exception rule (or whatever it's called in MBAM)

Edited by Union_Thug, 09 June 2011 - 03:36 PM.


#8 Union_Thug

Union_Thug

    Bleeps with the fishes...


  • Members
  • 2,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:is everything
  • Local time:09:04 PM

Posted 09 June 2011 - 03:44 PM

Is there an entry to install such in Add/Remove Programs?
Louis



#9 Union_Thug

Union_Thug

    Bleeps with the fishes...


  • Members
  • 2,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:is everything
  • Local time:09:04 PM

Posted 09 June 2011 - 03:58 PM

I just downloaded Network Password Recovery v1.32 by NirSoft & scanned with MBAM...sure enough MBAM flagged it as a PUP NetworkPasswordTool.

Posted Image.

Go to your file @ C:\Users\Bob\Documents\Unzipped\64xTools\netpass.exe >> Rt click >>Properties>> Details. What does it say?

Posted Image

Edited by Union_Thug, 09 June 2011 - 04:39 PM.


#10 crlamb

crlamb
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:04 PM

Posted 09 June 2011 - 05:49 PM

Mine reads the same except...File Version is 1.2.0.0 -- Product Version 1.20 -- Copyright 2005-2008 Nir Sofer - 103 KB - 10/17 2008

#11 Union_Thug

Union_Thug

    Bleeps with the fishes...


  • Members
  • 2,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:is everything
  • Local time:09:04 PM

Posted 09 June 2011 - 05:53 PM


Is there an entry to install such in Add/Remove Programs?
Louis



#12 crlamb

crlamb
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:04 PM

Posted 09 June 2011 - 06:08 PM

I searched "Add or Remove Programs" and there is no such entry

#13 Union_Thug

Union_Thug

    Bleeps with the fishes...


  • Members
  • 2,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:is everything
  • Local time:09:04 PM

Posted 09 June 2011 - 06:24 PM

>>>Mine reads the same except...File Version is 1.2.0.0 -- Product Version 1.20 -- Copyright 2005-2008 Nir Sofer - 103 KB - 10/17 200<<<

Likely the 64 bit version (new ver is 107 kb) If you dont need the program, delete the file(s) associated with it.
MBAM should give an all clear, as it did on my machine after deleting it. :)

Edited by Union_Thug, 09 June 2011 - 06:26 PM.


#14 crlamb

crlamb
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:08:04 PM

Posted 09 June 2011 - 07:41 PM

My problem is that, to my knowledge, I did not install it, so it must have been part of windows 7 when I did the clean install to upgrade from Vista.
I figure that if it was already there, there must be some purpose for it.

#15 Union_Thug

Union_Thug

    Bleeps with the fishes...


  • Members
  • 2,355 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:is everything
  • Local time:09:04 PM

Posted 09 June 2011 - 08:06 PM

Dunno what else I can tell you. AFAIK, it's not "part of windows " which is also supported by the info/links previously posted. Keep it, delete it, ignore it, seek another member's/staff's opinion, post in the Am I Infected? forum...

The choice is yours.

>>>to my knowledge, I did not install it<<<

Perhaps another user downloaded it? :unsure:

Good luck & happy computing!

Edited by Union_Thug, 09 June 2011 - 08:08 PM.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users