False Postive

[Ronyx]

Malwarebytes Management Server Notification

--------------------------------------------

 

Alert Time: 2/20/2016 7:25:22 AM

Server Hostname: *****

Server Domain/Workgroup:******* Server IP: 192.168.1.2 Notification Catalog: Client

Description:

Malware threat detected, see details below:

 

2/20/2016 7:24:36 AM WIN76P30FH1 192.168.1.223 PUM.Optional.DisabledWarnOnBadCertificate Quarantined HKU\S-1-5-21-172414119-77166388-4138614235-1002\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|WarnonBadCertRecving

2/20/2016 7:24:36 AM WIN76P30FH1 192.168.1.223 PUM.Optional.DisabledWarnOnBadCertificate Quarantined HKU\S-1-5-21-408842448-1576231836-1103500926-2853\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|WarnonBadCertRecving

2/20/2016 7:24:36 AM WIN76P30FH1 192.168.1.223 PUM.Optional.DisabledWarnOnBadCertificate Quarantined HKU\S-1-5-21-408842448-1576231836-1103500926-3194\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS|WarnonBadCertRecving

 

Total count: 3.

 

--------------------------------------------

Comment: This email was generated by Malwarebytes Management Server. Please do not reply to this message.

 

[shadowwar]

Is it only this one machine or is this a policy you set in your environment? This is saying the the machine is set not to warn when a site has a bad certificate. A lot of malware and pups set this setting.

[Guardian7]

I received a PUM warning today when I logged in. (pum.optional.disabledwarnonbadcertificate).

What am I dealing with here?

 

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 2/20/2016
Scan Time: 2:11 AM
Logfile:
Administrator: Yes

Version: 0.0.0.0000
Malware Database: v2016.02.19.07
Rootkit Database: v2016.02.17.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Michael

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 391088
Time Elapsed: 16 min, 29 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Warn
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

[Laurie2016]

This showed up today in my scan also... and was removed by Anti-malware. Has never showed up before.  Would appreciate any additional information especially if there is anything else I need to do to make sure it is gone.....  Windows 7 machine, all updates current.

[Ronyx]

wide-spread started at  2:33 PM this am.

[shadowwar]

@ronyx

 

Is this a policy you have set in your domain?

 

With this set to disabled its very easy for a malicous site to impersonate another site.

 

This is a new definition we have added to the database. So if it first comes up but after removal it doesnt come back then everything should be ok.

[Ronyx]

it's set to disabled on active directory.

[shadowwar]

Ok we are going to fix this next update.

 

Thanks for reporting.

[statman]

My wife had this same thing on her computer this morning.  Malwarebytes was doing a scan when I looked at it and quarantined this PUM but its still happening. I cant get malwarebytes to update for some reason.