PUP.Optional.SearchFF

Short bio

PUP.Optional.SearchFF is Malwarebytes’ generic detection name for search hijackers targeting the Firefox browser.

Symptoms

Users may notice that their searches are redirected or that promoted search results get added to the regular results. These add-ons are normally blocked pretty quickly by Mozilla after they surface, but unfortunately they always manage to infect some systems.

Firefox blocks PUP.Optional.SearchFF

Type and source of infection

PUP.Optional.SearchFF are Firefox add-ons that where found to override search behavior without user consent or control.
PUP.Optional.SearchFF add-ons are usually promoted by ad-rotators as search enhancers for certain popular content like movies, music, and games. Other promise to keep your searches private.

Protection

PUP.Optional.SearchFF is a removal detection name. But we do protect our users by blocking the ad-rotators that promote them.

Malwarebytes blocks certain ad-rotators

Remediation

Malwarebytes can detect and remove PUP.Optional.SearchFF without further user interaction.

Please download Malwarebytes to your desktop.
Double-click MBSetup.exe and follow the prompts to install the program.
When your Malwarebytes for Windows installation completes, the program opens to the Welcome to Malwarebytes screen.
Click on the Get started button.
Click Scan to start a Threat Scan.
Click Quarantine to remove the found threats.
Reboot the system if prompted to complete the removal process.

Add an exclusion

Should users wish to keep this program and exclude it from being detected in future scans, they can add the program to the exclusions list. Here’s how to do it.

Open Malwarebytes for Windows.
Click the Detection History
Click the Allow List
To add an item to the Allow List, click Add.
Select the exclusion type Allow a file or folder and use the Select a folder button to select the main folder for the software that you wish to keep.
Repeat this for any secondary files or folder(s) that belong to the software.

Associated threats

Often these Firefox add-ons will have associated Chrome extensions, but these are detected by less generic detection names.