Question about Registry Entry in logs

[dbreeze]

In a user's log there is the following entry:
 

PUP.Optional.RewardsArcade.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\RewardsArcade, , [54e383e55d1f52e4633d5a33d033d828],

Can someone explain the CLSID -0 in the key path? A subsequent search of the registry with other tools does not find this key path as listed.

[daledoc1]

Hello:
 
That detection is a PUP -- more information may be found here: What are the 'PUP' detections, are they threats, and should they be deleted?
 
I wouldn't want any of those on my computers.
But, if you're not sure what to keep/ignore and what to remove/quarantine, then you might want to have a malware expert assist you.

We are not permitted to work on possible malware-related issues here in this section of the forum.

So, for expert assistance, I suggest that you please follow the advice in this pinned topic: Available Assistance For Possibly Infected Computers.
It explains the options for free, expert help >>AND<< the suggested preliminary steps to expedite the process.
A malware analyst will assist you with looking into your issue.

Thanks,

[dbreeze]

Thank you for the answer; I appreciate your time and concern.  However, there are some points I will clear up.

 

This is not on my machine nor do I have physical access to it.

 

I am a "Malware Removalist" on a different forum but I will keep in mind the kind offer of assistance should it ever be needed.

 

I just needed to understand what the line in the log actually was telling someone.  All other searches for the exact key path listed in the log turn up negative (no data / key not found or listed).

 

Thank you for your time and consideration in this matter.

[daledoc1]

Hi:

 

Well, then we'll need to wait for one of the forum staff or experts to reply, as that is a technical question that exceeds my pay grade.

 

Cheers,

[David H. Lipman]

A subsequent search of the registry with other tools does not find this key path as listed.

This is not on my machine nor do I have physical access to it.

Well there 'ya go.  It is in the Current User's Hive [ HKEY_CURRENT_USER ] which you do not have physical access to.

[daledoc1]

 

Well there 'ya go.  It is in the Current User's Hive [ HKEY_CURRENT_USER ] which you do not have physical access to.

 

 

<Face palm>

 

Thanks for catching that, David!

[David H. Lipman]

Actually I made a mistake.  It isn't the Current User's Hive [ HKEY_CURRENT_USER ],  It is HKEY_USERS

HKCU is for a particular User Profile.  HKEY_USERS is for all User Profiles that users inherit.

 

HKEY_USERS\S-1-5-18 references the Security IDentifier  (SID) for the LocalSystem account.  That is a predefined "local account" used by the Service Control Manager which in turn represents;   NT AUTHORITY\SYSTEM   and   BUILTIN\Administrators.

 

However, it still is a case of the user not having physical access to.

 

My apologies for the error.

[dbreeze]

Thank you for the information and corrections.  Let's take this a step further; suppose one wanted to write a batch / script file to delete these entries.  If I am properly reading what you advisers are telling me, then the {ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 part of the key path address should be removed?

 

To simplify -

 

This would be wrong => delete HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\RewardsArcade

 

This would be correct => delete HKU\S-1-5-18\SOFTWARE\APPDATALOW\SOFTWARE\RewardsArcade

 

?

[David H. Lipman]

Honestly...  I do not think I am allowed to discuss this subject matter in "Malwarebytes Anti-Malware Help".
 
It is for discussing MBAM product support and not for malware removal.  As a member of "Experts" I am allowed to provide the information but just not "here".