PUM.Optional.NoDrives, HKU - a false positive

[gopala]

after each scan MB 3 detects and removes this:

PUM.Optional.NoDrives, HKU\S-1-5-21-1116684213-2481401632-3605678218-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER|NODRIVES, Ersetzt, [19435], [293343],1.0.1223

is this a false positive? Can I include it to exclusions?

Thank you for your help

[miekiemoes]

Hi,

This isn't a false positive - however this isn't malware either. PUM means, Potentially Unwanted Modification.

In this case, a policy was set that removes the icons representing selected drives from My Computer and from Windows Explorer. In a lot of cases, this is set by malware (especially autorun worms), but in other cases, it's set by yourself or IT department/administrator. This is why Malwarebytes alerts here as potentially unwanted, as it can't know by who/what this policy was set.

So you can indeed always add it to the exclusions if you are aware of this policy.

[gopala]

thank you !