False Positives?

[xbj13]

Trojan.BHO

Hijack.StartMenu

I have tried to research these but am still unsure. I have made modifications to my start menu which I've read can cause the Hijack.StartMenu entry.

Thanks

Malwarebytes' Anti-Malware 1.44

Database version: 3858

Windows 5.1.2600 Service Pack 2

Internet Explorer 6.0.2900.2180

3/12/2010 12:58:17 AM

mbam-log-2010-03-12 (00-58-11).txt

Scan type: Full Scan (C:\|)

Objects scanned: 143209

Time elapsed: 18 minute(s), 47 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{376892ae-1825-4e5f-9f85-23f9640051cc} (Trojan.BHO) -> No action taken.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

[Raid]

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.

This isn't false, and if you don't want to be bothered about it again, since you made the changes on purpose... Just tell mbam to ignore it.

The other one is probably just some left overs, nothing to worry about.

[xbj13]

This isn't false, and if you don't want to be bothered about it again, since you made the changes on purpose... Just tell mbam to ignore it.

The other one is probably just some left overs, nothing to worry about.

Thank you. If the first positive is, in fact, caused by a change I made and not malware (which I don't know 100%), then why would it not be considered a false positive?

[xbj13]

Anyone??

[nosirrah]

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\

This is a trace location , if you had this infection cleaned up in the past it may still have had this left over . This is a marker location only and will have no impact if you leave or remove the detection there .

[xbj13]

Very helpful, thank you. And regarding the other positive, how can I discern whether it is being caused by start menu tweaks I've made or not?