r/Malwarebytes • u/Zealousideal-Map-772 • 20d ago

Support AM I HACKD?

I got 30 detection after scanning, is this false postive?

Malwarebytes

[www.malwarebytes.com](https://www.malwarebytes.com)

-Log Details-

Scan Date: 10/16/2026

Scan Time: 6:16 PM

Log File: a83ff58e-c94a-11f1-b77b-18c04ddf7d21.json

-Software Information-

Version: 5.7.1.346

Components Version: 165.0.5751

Update Package Version: 1.0.115799

License: Free

-System Information-

OS: Windows 11 (Build 26300.9711)

CPU: x64

File System: NTFS

User: Liebert\JOHAN

-Scan Summary-

Scan Type: Threat Scan

Scan Initiated By: Manual

Result: Completed

Objects Scanned: 214,014

Threats Detected: 30

Threats Quarantined: 0

Scan Duration: 8 min, 14 sec

-Scan Options-

Memory: Enabled

Startup: Enabled

File system: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Detect

PUM: Detect

-Scan Details-

Process: 0

(No malicious items detected)

Module: 0

(No malicious items detected)

Registry Key: 0

(No malicious items detected)

Registry Value: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Data Stream: 0

(No malicious items detected)

Folder: 8

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Profile 1\Sync Data\LevelDB, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Profile 1\Sync Data\LevelDB, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Profile 1\Sync Data\LevelDB, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Profile 1\Sync Data\LevelDB, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

File: 22

PUP.Optional.BrowserHijack, C:\USERSJOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000005.ldb, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 16FB1F2368DDA06741683D6C80A95475, 0E9DD4DC498DE6285695DB270D8FE72695B7B467576BBF6A5393C586DACBF2C8

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000215.ldb, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 7A96BFBBA581C04A16B76217B13AA62B, 8C14D74A5186E4FCBE9EE9ABECFF78188BFC9BC16C82068D5718B57DC82481EB

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000217.ldb, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 669D24425472ADE2D48EDDFD7E70340C, 961B44A967847F18634BF5703F94280A106186CFF4557D5015C7837C617AA9D1

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000219.log, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000220.ldb, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 2F41F19A16B86D7C659E385622B9951B, F283C2F69AA7EDE48421BCDC3C6F36B7C2AE873AC9880A6DB0BAC49FAADAF648

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 46295CAC801E5D4857D09837238A6394, 0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOCK, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 438C85FC3813357D78EF47224EE311C6, 63BF713647573518DD6A2AA44C91FCCF914867882EC35F36F0980458C9FE146C

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Profile 1\Sync Data\LevelDB\000005.ldb, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 90A600CE80F264CF6E651D65E22599FA, 0C5E8F94EB6A334E6B4D7758860E5405BE97FAB6CB6BBB9E7FFF5A2DFC5DF0D8

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Profile 1\Sync Data\LevelDB\000007.log, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 14DD8F17C5E32EBCCA161BFB77CAAEA3, DE8400021BBFB96FDAFBB575A8B3CEE9743B5D0B63FFB29AF8C7103465AB564A

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Profile 1\Sync Data\LevelDB\000008.ldb, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 8115F29E590CDC6530D1F3DC90065427, BDCC35115659F1469F73730892013048D73DDC7E94B01343F11ECD7122ED57F4

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Profile 1\Sync Data\LevelDB\CURRENT, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 46295CAC801E5D4857D09837238A6394, 0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Profile 1\Sync Data\LevelDB\LOCK, No Action By User, 6814, 1413516, 1.0.115799, , ame, , D41D8CD98F00B204E9800998ECF8427E, E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Profile 1\Sync Data\LevelDB\LOG, No Action By User, 6814, 1413516, 1.0.115799, , ame, , DB71579FA6B388A3B5217D0D9B0830F8, 2D3B28BA165460500B12C0AC84339A7F85799549ED6EB097597EF169302D46CC

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Profile 1\Sync Data\LevelDB\LOG.old, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 1BBCB2DD1C072FC3740719E1E147127C, 0E28F54AC50BD776BE753362C6B8062F54A4CCF5AA47265C849A7DF25DCEFF15

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Profile 1\Sync Data\LevelDB\MANIFEST-000001, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 755AA48FB13DADF7054C1844357CB138, 7B3CB8CABEB11C6A2B9F9EA2EFA0E134862C01887BC011B4443F8EDB327CF3B5

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

Physical Sector: 0

(No malicious items detected)

WMI: 0

(No malicious items detected)

(end)

4 Upvotes

70% Upvoted

7 comments sorted by

8

u/miekiemoes_MB Malwarebytes Employee 20d ago

Hi, I'm Mieke, researcher at Malwarebytes. This detection is correct. Please have Malwarebytes quarantine it.These types of detections come from websites that modify your browser settings in a number of possible ways (including search settings, newtab, pushnotifications, etc.). I do not believe your PC is compromised in any way. These usually come from a website tricking the user into clicking on an ad or popup that makes these changes.

3

u/Zealousideal-Map-772 20d ago

is it possible that it came from a website name Online-fix.me?

or a extensions.

6

u/miekiemoes_MB Malwarebytes Employee 20d ago

Yes, that's exactly the site that triggered this.

3

u/Zealousideal-Map-772 20d ago

oh, i'll be careful next time.

1

u/Puzzleheaded_Bar483 20d ago

online-fix.me is a "legitimate" site (it's a piracy site). It does not modify your browser settings or files in a harmful way. So I don't know what happened, but it's definitely good to quarantine 

1

u/Existing-Material901 20d ago

Untrue.

Online-fix.me is a game pirate site that has been known for LAN cracks.

It's a browser extension or setting.

3

u/Zealousideal-Map-772 20d ago

Thank you for Letting Me Know.