hijack.startmenu: Observation, Comment & Question

[Chas]

I ran the MBAM scanner for the first time today after a nice recommendation from "Windows Secrets". The scan completed with one alert: "hijack.startmenu". I wanted to learn what this was before I took any action, I went looking. I ran through numerous web discussions asking the same question, i.e., is this a FP? It seems it could be.

The advice usually tendered is: ".....This is a common hijack point for a common infection. There is no way for MBAM to determine if the user has done this or malware is at fault ...." The first question comes to mind that if this was an infection caused by another client, wouldn't also that (malware) client show up as well, in the same scan?? In other words, if "hijack.startmenu" is present by itself, then it should be ok, but if present with something else, then it's "bad"?????

Seems to make sense to me, but would anyone else care to comment??

[exile360]

Though that's certainly possible, it's also possible that it is caused by malware and the cause of it is too new to be detected, or that it was altered by a past infection that has since been removed by your AV or another tool, but the start menu entry was never corrected. Honestly, the only way I'd ignore it is if you know that you're the one who changed the setting (like not showing the Help link, My Music or whatever the detection was).

[Chas]

Though that's certainly possible, it's also possible that it is caused by malware and the cause of it is too new to be detected, or that it was altered by a past infection that has since been removed by your AV or another tool, but the start menu entry was never corrected. Honestly, the only way I'd ignore it is if you know that you're the one who changed the setting (like not showing the Help link, My Music or whatever the detection was).

I understand what you are saying, but I guess the real point that also seems to be missing, is that I have no idea if it was me setting it. Probably the same question for the bulk of the folks getting this alert. I also don't have the foggiest notion for what it's used for, and furthermore, I don't know if I can do "bad" by removing it. And, and, what happens if it pops back??

So, out of complete ignorance, I will follow your advice and remove it. God help us if the world ends.........

[manifest.joy]

I understand what you are saying, but I guess the real point that also seems to be missing, is that I have no idea if it was me setting it. Probably the same question for the bulk of the folks getting this alert. I also don't have the foggiest notion for what it's used for, and furthermore, I don't know if I can do "bad" by removing it. And, and, what happens if it pops back??

So, out of complete ignorance, I will follow your advice and remove it. God help us if the world ends.........

I hate to start a new thread on the same subject, so I'm going to piggyback on this one...Chas seems to have summed it up.

I'm running Vista home prem. and I'm a heavy duty tweaker.

I got two of these this morning. One good, one bad, which is kind of confusing me, actually and why I'm searching for answers. One falls under the Hijack.StartMenu Start_ShowMyComputer reg entry (+1 Good!) and the other is NoStartMenuMorePrograms reg entry (-1 bad) under the same vendor.

The Command Prompt does appear in my start menu (not standard for Vista) because I use it occasionally; My Computer does not because the shortcut is on my dock.

Could this be the reason I got these two Hijacking messages in my results? I created a restore point and I'm ready to alter the reg keys with a good renaming if it isn't, but I'd like to know if this is possible first.

(BTW, these are the only results I got on Malwarebytes.)