Results 1 to 5 of 5

Thread: AdwCleaner detects some elements of immunization as PUPs

  1. #1
    Junior Member IzNoGud78's Avatar
    Join Date
    Jan 2023
    Location
    Italy
    Posts
    2

    Default AdwCleaner detects some elements of immunization as PUPs

    I ran scans on several occasions with the AdwCleaner tool and each time it detected the following registry entries as PUPs

    Code:
    PUP.Optional.Legacy             HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\zonemap\domains\dospop.com
    PUP.Optional.Legacy             HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\zonemap\domains\incredibar.com
    PUP.Optional.Legacy             HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\zonemap\domains\dospop.com
    PUP.Optional.Legacy             HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\zonemap\domains\incredibar.com
    PUP.Optional.Legacy             HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\zonemap\domains\dospop.com
    PUP.Optional.Legacy             HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\zonemap\domains\incredibar.com
    I believe there is a correlation between the detection of these items and the immunization tool, also because they are always detected following the application of immunization and if removed or quarantined via AdwCleaner, doing a subsequent scan with the immunization tool results in incomplete immunization.

    I'm so sure of this that I decided to add the items to the list of AdwCleaner exclusions (also making a report as likely false positives on their forum), but I would be more comfortable if I had confirmation of this, thanks.

  2. #2
    Spybot Advisor Team Zenobia's Avatar
    Join Date
    Oct 2005
    Posts
    5,414

    Default

    I see you received a reply there:
    https://forums.malwarebytes.com/topi...ith-spybot-sd/
    Spybot would add those entries to the registry shown in your logfile as part of immunization, but they would be given a dword value of 4 to place them in the Restricted Sites Zone, and not the Trusted Sites Zone.
    https://learn.microsoft.com/en-us/tr...gistry-entries

    You could contact Spybot support for further clarification, if you like.
    https://www.safer-networking.org/support/#contactform
    You might like to include a link to this topic to help with explanation.

  3. #3
    Member of Team Spybot PepiMK's Avatar
    Join Date
    Oct 2005
    Location
    Planet Earth
    Posts
    3,587

    Default

    Both are entries that are indeed blocked by the immunization, since around 2012.

    It's like Zenobia said - it all depends on the value inside these registry keys. I have no idea why AdwCleaner does not check the content, since entries like these are a constant source of false positives.

    You could simply run regedit (or RegAlyzer) to verify the actual value.

    Not sure if this is documented inside RegAlyzer, will update the RegAlyzer database with useful information and post again
    Last edited by PepiMK; 2023-01-23 at 11:01.
    Just remember, love is life, and hate is living death.
    Treat your life for what it's worth, and live for every breath
    (Black Sabbath: A National Acrobat)

  4. #4
    Member of Team Spybot PepiMK's Avatar
    Join Date
    Oct 2005
    Location
    Planet Earth
    Posts
    3,587

    Default

    Not sure why exactly you wrote on the MalwareBytes forums that you haven't received a comment yet?
    Just remember, love is life, and hate is living death.
    Treat your life for what it's worth, and live for every breath
    (Black Sabbath: A National Acrobat)

  5. #5
    Junior Member IzNoGud78's Avatar
    Join Date
    Jan 2023
    Location
    Italy
    Posts
    2

    Default

    Quote Originally Posted by PepiMK View Post
    Not sure why exactly you wrote on the MalwareBytes forums that you haven't received a comment yet?
    I apologize but I just saw now the reply on this forum. Anyway, I thank you all for the replies, at least I'm sure I did the right thing by adding the detections among the eclusion rules and reporting the false positive.

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •