Possible FP - PUP.Optional.ASK Detection for Norton Safe Search?

[lmacri]

A Malwarebytes v3.2.2 Threat Scan (database v1.0.3104) flagged registry entries associated with my IE9 browser today for PUP.Optional.ASK.  I don't normally use IE9 (my default browser is currently FF ESR v52.4.0) but I suspect MB incorrectly detected registry entries for Norton Safe Search (a feature bundled with my Norton Toolbar v2015.12.0.5) as PUP.Optional.Ask, since Norton Safe Search uses the Ask.com search engine.

Here's the scan log:  MB v3_2_2 Threat Scan PUP_Optional_ASK 26 Oct 2017.txt

Registry Key: 1
PUP.Optional.ASK, HKU\S-1-5-21-3086198521-800258848-3831315664-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{104390CA-E40C-43BF-A771-26DE9E4121CC}, No Action By User, [525], [450494],1.0.3104

Registry Value: 1
PUP.Optional.ASK, HKU\S-1-5-21-3086198521-800258848-3831315664-1001\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{104390CA-E40C-43BF-A771-26DE9E4121CC}|URL, No Action By User, [525], [450494],1.0.3104

----------
32-bit Vista Home Premium SP2 * NS Premium v22.11.0.41 * Firefox ESR v52.4.0 * IE9 * MB Premium v3.2.2.2018-1.0.212

Edited October 26, 2017 by lmacri

[Fatdcuk]

Hi lmacri

Thanks for reporting this and confirmed it is a f/p.

 

We will get this fixed on the next update cycle.

[thisisu]

Fixed in: 

MBAM2 Version: v2017.10.27.01

MBAM3 Version: 1.0.3105

[lmacri]

Fix confirmed.  I ran another MB v3.2.2 Threat Scan this morning with database v1.0.3112 and had 0 threats detected.

Cheers!
----------
32-bit Vista Home Premium SP2 * NS Premium v22.11.0.41 * Firefox ESR v52.4.0 * IE9 * MB Premium v3.2.2.2018-1.0.212

[Clang]

Had the same thing I think . This A FP?

 

Registry Key: 1
PUP.Optional.ASK, HKU\S-1-5-21-3846363274-3381774146-412316661-1007\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{1ED1E7E6-28B7-4DD8-8C5B-9005C0ED7FAF}, Quarantined, [525], [450494],1.0.3103

Registry Value: 1
PUP.Optional.ASK, HKU\S-1-5-21-3846363274-3381774146-412316661-1007\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{1ED1E7E6-28B7-4DD8-8C5B-9005C0ED7FAF}|URL, Quarantined, [525], [450494],1.0.3103

 

-Software Information-
Version: 3.2.2.2029
Components Version: 1.0.212
Update Package Version: 1.0.3103

 

 

Edited October 28, 2017 by Clang

[Fatdcuk]

Hi Clang

 

Yes it is and it got fixed the other day.

 

Your scan log is showing an older database => Update Package Version: 1.0.3103

 

If you update in the software then the detections should no longer persist.

[lmacri]

3 hours ago, Clang said:

...
Registry Key: 1
PUP.Optional.ASK, HKU\S-1-5-21-3846363274-3381774146-412316661-1007\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{1ED1E7E6-28B7-4DD8-8C5B-9005C0ED7FAF}, Quarantined, [525], [450494],1.0.3103
...

Hi Clang:

I always have Norton Safe Search disabled in my Norton Security Toolbar (I'm not a fan of Ask.com and don't know why Norton chose them as a partner for their Safe Search feature in the first place) but I noticed your scan log shows that MB v3.2.2 quarantined the Safe Search registry entries.  If you use the Norton Safe Search search engine in your browser(s) and find it's not working correctly it's safe to restore these registry entries from the Quarantine tab on the right-hand menu pane of your your Malwarebytes interface since these PUP.Optional.ASK detections were confirmed as false positives.

Just FYI, I prefer to review lower-risk detections like PUP.Optional.Ask, PUP.Optional.Legacy, etc. before they are quarantined so I've change the options for PUP and PUM detections in Malwarebytes (Settings | Protection | Potential Threat Protection) from Always Detect (automatic removal) to Warn User.  That's why my scan log in post # 1 states No Action By User instead of Quarantined.
----------
32-bit Vista Home Premium SP2 * NS Premium v22.11.0.41 * Firefox ESR v52.4.0 * IE9 * MB Premium v3.2.2.2018-1.0.212

Edited October 28, 2017 by lmacri

[Clang]

Ok thanks .my browser is ok but I keep your advice is mind.