False positive detection after immunization with Spybot S&D

[IzNoGud78]

I have noticed that whenever I use the Spybot Search & Destroy immunization tool, AdwCleaner detects the registry entries in the attached log file as PUPs.

I'm not sure of the actual usefulness of these items, but I'm sure they are entries created by Spybot S&D because if I run the immunization check again after removing or quarantining these entries, the immunization status comes back incomplete.

After several detections and being sure that these entries are somehow related to the use of Spybot S&D's immunization tool, I considered adding these entries to the exclusion rules.

AdwCleaner[S11].txt

[Malwarebytes]

***This is an automated reply***

Hi,

Thanks for posting in the AdwCleaner Help forum.
In order to help us assist you to resolve your issue, please post or attach your latest AdwCleaner log files with your post. https://support.malwarebytes.com/hc/en-us/articles/360039021593

Someone will reply shortly, but in the meantime here are a few resources which may help resolve your issue:

• Malwarebytes AdwCleaner guide
• A malicious element isn't being detected? Submit the sample here!
• Need help with another Malwarebytes product or malware removal?
  • Click here for home support
  • Click here for business support
  • Click here for malware removal help

Thanks in advance for your patience.

-The Malwarebytes Forum Team

 

 

 

 

[JSntgRvr]

Welcome.

 

Go to the Internet Options in your computer, and under Security, check the sites added as Trusted Sites.  If any of these appear, you should remove it. They are considered as Browser Hijackers. I have no idea why Spybot Immunization is adding these to the Trusted Sites settings.

[IzNoGud78]

On 1/22/2023 at 10:03 PM, JSntgRvr said:

Welcome.

 

Go to the Internet Options in your computer, and under Security, check the sites added as Trusted Sites.  If any of these appear, you should remove it. They are considered as Browser Hijackers. I have no idea why Spybot Immunization is adding these to the Trusted Sites settings.

Neither of the domains appear among the trusted sites. I tried to ask for explanations on the Spybot forum as well, but i still haven't received a response at the moment.

[tashi]

1 hour ago, IzNoGud78 said:

Neither of the domains appear among the trusted sites. I tried to ask for explanations on the Spybot forum as well, but i still haven't received a response at the moment.

Thread at Safer Networking (Spybot) https://forums.spybot.info/showthread.php?77729-AdwCleaner-detects-some-elements-of-immunization-as-PUPs

[IzNoGud78]

3 hours ago, tashi said:

Thread at Safer Networking (Spybot) https://forums.spybot.info/showthread.php?77729-AdwCleaner-detects-some-elements-of-immunization-as-PUPs

I just saw now the responses on the Spybot forum. What is sure is that the domains have not been added among the trusted sites, so the false positive report remains plausible.

[JSntgRvr]

For a Domain be included in the restricted zone, it should read as follows:

 

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\malwarebytes.com]
"*"=dword:00000004

 

Perhaps AdwCleaner is not reading the value. If that is the case, then it is a bug that should be attended.

Edited January 25, 2023 by JSntgRvr
Typo

[IzNoGud78]

19 hours ago, JSntgRvr said:

For a Domain be included in the restricted zone, it should read as follows:

 

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\malwarebytes.com]
"*"=dword:00000004

 

Perhaps AdwCleaner is not reading the value. If that is the case, then it is a bug that should be attended.

I think the problem might occur because the dword value is present, but in underlying paths:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dospop.com]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dospop.com\google]
"*"=dword:00000004

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dospop.com\www.google]
"*"=dword:00000004

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\incredibar.com]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\incredibar.com\mystart]
"*"=dword:00000004

Windows Registry Editor Version 5.00

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dospop.com]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dospop.com\google]
"*"=dword:00000004

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dospop.com\www.google]
"*"=dword:00000004

Windows Registry Editor Version 5.00

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\incredibar.com]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\incredibar.com\mystart]
"*"=dword:00000004

Windows Registry Editor Version 5.00

[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dospop.com]

[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dospop.com\google]
"*"=dword:00000004

[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\dospop.com\www.google]
"*"=dword:00000004

Windows Registry Editor Version 5.00

[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\incredibar.com]

[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\incredibar.com\mystart]
"*"=dword:00000004