from Tammy (PUM.Hijack.StartMenu problem)

[tammysterling]

Hi, I've got a problem on my laptop.. Strange things happen, and when I run my scan it finds PUM.Hijack.StartMenu. I delete it, but then it comes back again, and the scan finds it again. Help, please!!...........thanx, Tammy

[AdvancedSetup]

Please post your recent scan log here so that we can see what it's finding. You may also want to review the post here as an example only.

http://forums.malwarebytes.org/index.php?s...st&p=356600

Thanks

[tammysterling]

Ron: Here's the log. Thanx...Tammy

Malwarebytes' Anti-Malware 1.50

www.malwarebytes.org

Database version: 5243

Windows 5.1.2600 Service Pack 2

Internet Explorer 8.0.6001.18702

12/6/2010 3:36:14 PM

mbam-log-2010-12-06 (15-36-14).txt

Scan type: Quick scan

Objects scanned: 120169

Time elapsed: 18 minute(s), 27 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogoff (PUM.Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

[AdvancedSetup]

This is just a registry setting that says if you want to show the logoff on the Start Menu. If it keeps coming back it's probably being restored by some other product such as an Anti-Virus suite or tools like Spybot's Tea Timer that monitors registry changes and puts them back or prevents them.

You can safely add this to your ignored items in the program if you like or review your other security programs to determine which one is stopping the change or is putting it back.

On another note your rules database is a few versions behind. Not a lot but we do recommend keeping the rules up to date frequently as new malware is released every day.

The current version of the rules are: 5257

Thanks.