New
#1
AdwCleaner Scan Result?
I just upgraded to the latest version of AdWCleaner and all my PCs give the detection shown below whereas they scanned clean a few days ago. What's the detection due to?
Attachment 269990
I just upgraded to the latest version of AdWCleaner and all my PCs give the detection shown below whereas they scanned clean a few days ago. What's the detection due to?
Attachment 269990
It's quite old (2014), but looks like it might be this bad addon: (or traces of it)
Remove SearchScopes | MalwareFixes
or it could be this slightly updated variant:
https://forums.malwarebytes.com/topi...search-option/
Install or update any free new software lately? If you have chrome or firefox it would have synced the extension which would explain how it ended up on all your pc's.
Does it show under extensions in any of your web browsers?
Kind of ironic defender did not find this, unless it's a false positive.
Hello @Steve C
Other Malwarebytes AdwCleaner 8.0.3.0 users have briefly under reported the registry PUP detection.
However, no users have provided the complete follow-up requested data with which to definitively investigate the detection.
The required data may be derived by following the procedure within https://forums.malwarebytes.com/topi...omment=1366505
If you would like to contribute the necessary troubleshooting report, please open your own Malwarebytes forum topic at:
https://forums.malwarebytes.com/foru...leaner/?do=add
You may always choose to quarantine the detection, and later restore at your discretion if the detection is a false positive.
Thank you in advance.
I get just one detection on a recent clean install of 1909, it says it's the...
PUP.Optional.SearchBoxDS HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
That key is for Microsoft's Bing search, apparently.
Code:Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}] "DisplayName"="Bing" "FaviconURLFallback"="http://www.bing.com/favicon.ico" "FaviconURL"="http://www.bing.com/favicon.ico" "URL"="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02" "SuggestionsURLFallback"="http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" "SuggestionsURL"="http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IESS02&market={language}" "NTURL"="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" "NTTopResultURL"="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" "NTSuggestionsURL"="http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" "NTLogoPath"="C:\\Users\\Owner\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" "NTLogoURL"="http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}"
Then let it clean it if you have not already done so. If you already did and it keeps coming back then that is different. But as you said it might be a FP. We will have to wait and see.
Side note, Even though I am a MB user seller and supporter, I have never had a reason to run ADW cleaner on any machine I touch and do not plan to. It has its purpose but I have never felt the need especially since the addition of OEM bloatware detection. I have other means of dealing with that.
I have tagged a staff member over on the MB forum to look into the issue. Let's wait till then.