AdwCleaner Scan Result?

Andrew129260 · 12 Mar 2020

Bree said:

I get just one detection on a recent clean install of 1909, it says it's the...

PUP.Optional.SearchBoxDS        HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

That key is for Microsoft's Bing search, apparently.

Code:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}]
"DisplayName"="Bing"
"FaviconURLFallback"="http://www.bing.com/favicon.ico"
"FaviconURL"="http://www.bing.com/favicon.ico"
"URL"="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"
"SuggestionsURLFallback"="http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IESS02&market={language}"
"SuggestionsURL"="http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IESS02&market={language}"
"NTURL"="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR"
"NTTopResultURL"="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR"
"NTSuggestionsURL"="http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IENTSS"
"NTLogoPath"="C:\\Users\\Owner\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\"
"NTLogoURL"="http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}"

Ah. Probably a false positive then.

1PW · 13 Mar 2020

A few minutes ago, the Malwarebytes AdwCleaner developer has declared that GUID as a false positive and has corrected the database:

https://forums.malwarebytes.com/topi...omment=1367034

Please rerun AdwCleaner 8.0.3 to see if the detection has cleared with the updated database.

Thank you.

f14tomcat · 13 Mar 2020

Yes. I removed it from exclusions and re-ran the scan. Not detected. Thanks.

Bree · 13 Mar 2020

Bree said:

I get just one detection on a recent clean install of 1909, it says it's the...

PUP.Optional.SearchBoxDS        HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}

That key is for Microsoft's Bing search, apparently.

Steve C said:

Thanks - I get the impression this is a false positive detected by AdwCleaner v 8.0.3

I have just re-run AdwCleaner 8.0.3 on that same machine, it now no longer detects that key. The FP has been fixed, just as @1PW said.

Steve C · 14 Mar 2020

I had already deleted those detections but note they have now been restored after running sfc / scannow