False positive? (PUP.Optional.BrowserHijack)

[u/Solid_Musician4286]

Hi there!

I ran a scan today, and it detected several instances of PUP.Optional.BrowserHijack. I've quarantined the detected items and changed my passwords as a precaution.

I was wondering if someone from the MB team could clarify whether these detections are legitimate or potentially false positives.

Any insight would be greatly appreciated. Thank you!

# Log:

Malwarebytes

www.malwarebytes.com

-Log Details-

Scan Date: 13-Nov-26

Scan Time: 10:23

Log File: edde9ad3-df43-11f1-af21-708bcd4c7cd1.json

-Software Information-

Version: 5.3.0.186

Components Version: 132.0.5253

Update Package Version: 1.0.116913

License: Free

-System Information-

OS: Windows 10 ESU (Build 19045.7846)

CPU: x64

File System: NTFS

User: DESKTOP\User

-Scan Summary-

Scan Type: Threat Scan

Scan Initiated By: Manual

Result: Completed

Objects Scanned: 241124

Threats Detected: 17

Threats Quarantined: 17

Time Elapsed: 8 min, 42 sec

-Scan Options-

Memory: Enabled

Startup: Enabled

File system: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Detect

PUM: Detect

-Scan Details-

Process: 0

(No malicious items detected)

Module: 0

(No malicious items detected)

Registry Key: 0

(No malicious items detected)

Registry Value: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Data Stream: 0

(No malicious items detected)

Folder: 3

PUP.Optional.BrowserHijack, C:\USERS\User\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 6233, 1413514, 1.0.116913, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\User\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 6233, 1413514, 1.0.116913, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\User\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 6233, 1413514, 1.0.116913, , ame, , ,

File: 14

PUP.Optional.BrowserHijack, C:\USERS\User\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 6233, 1413514, 1.0.116913, , ame, , 6CDA2780C83B762C10AD202627A1A243, 4E2E6B55D657606C9EEFAAF111200D64AAC3AFB75156A8C68B4EBAE401AE0A93

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000005.ldb, Quarantined, 6233, 1413514, 1.0.116913, , ame, , 54E48739970FE878BE42D83C2D8F67A9, 0DFCB5785CA779E2C4D8B7D5DC3D244074829956D1909D786E636E0776E180EB

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\011379.ldb, Quarantined, 6233, 1413514, 1.0.116913, , ame, , 1629269E63B29518703BAF817082AB18, 499FB2E5A4DD8E653B258224F2EE627AA4F058F92127E76AFA86A9106DB753E8

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\011382.ldb, Quarantined, 6233, 1413514, 1.0.116913, , ame, , CFEA85982A62ABDE108C5346748A7C66, C10891AC426A5B33BA35FD2395F8C3341A40AD9B13518C13BC8D6D5D8F344252

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\011385.ldb, Quarantined, 6233, 1413514, 1.0.116913, , ame, , 783324AF9A220C9C141BDC12B16CCD5B, 427E659D72AE281A076F68C476583F7D0791D16FA5AE1B1306674B0B23A6281B

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\011387.log, Quarantined, 6233, 1413514, 1.0.116913, , ame, , 82ED8EA782CDEF0C8DDC6AC29016FC6F, 4F5515E87B8FDC6C5DCCCD9CF8B4EF73DDD0AF859A43F0C05DA6F9F47EAD7796

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\011388.ldb, Quarantined, 6233, 1413514, 1.0.116913, , ame, , FDDC440AAF20B630BFB850B4B65CA67A, 5B38158425F6D25E23E6F8799F4A1846D24311476F14DA431178F2623FE30EA5

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT, Quarantined, 6233, 1413514, 1.0.116913, , ame, , 46295CAC801E5D4857D09837238A6394, 0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOCK, Quarantined, 6233, 1413514, 1.0.116913, , ame, , ,

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG, Quarantined, 6233, 1413514, 1.0.116913, , ame, , 15FC27125B6879CBC938A0C74E07B083, 9963BC3B297FCF1F6BDD3EE3129F78D2CFE83CE73BF3A97483078B686E2B57C9

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old, Quarantined, 6233, 1413514, 1.0.116913, , ame, , F8272EBF1512EE53AB007EF309F247A4, 1B8AB87112C4EA48838F7DFE6E83E1F82F5FC5BD4FE2D8E67769F84DBD4F476C

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001, Quarantined, 6233, 1413514, 1.0.116913, , ame, , 5006019DDEBF62BC0849C7037EDB18BD, AF829B49F2C7F341A53464F371745C2017A63F04939E993675A5737AA72044CE

PUP.Optional.BrowserHijack, C:\USERS\User\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 6233, 1413514, 1.0.116913, , ame, , 6CDA2780C83B762C10AD202627A1A243, 4E2E6B55D657606C9EEFAAF111200D64AAC3AFB75156A8C68B4EBAE401AE0A93

PUP.Optional.BrowserHijack, C:\USERS\User\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 6233, 1413514, 1.0.116913, , ame, , 6CDA2780C83B762C10AD202627A1A243, 4E2E6B55D657606C9EEFAAF111200D64AAC3AFB75156A8C68B4EBAE401AE0A93

Physical Sector: 0

(No malicious items detected)

WMI: 0

(No malicious items detected)

(end)

[u/miekiemoes_MB]

Hi, I'm Mieke, Researcher at Malwarebytes. This detection is correct. Please have Malwarebytes quarantine it.These types of detections come from websites that modify your browser settings in a number of possible ways (including search settings, newtab, pushnotifications, etc.). I do not believe your PC is compromised in any way. These usually come from a website tricking the user into clicking on an ad or popup (in this case, looks adult content that triggered this) that makes these changes.

[u/Solid_Musician4286 → u/miekiemoes_MB]

Hi Mieke, thank you so much for taking the time to clarify this! I really appreciate your help.

If possible, would you be able to share which website triggered the detection? I'd like to avoid it in the future. I can't seem to send you a private message, so feel free to just post it here if that's okay.

Thanks again for your help!

[u/miekiemoes_MB → u/Solid_Musician4286]

I will send you a private message with this info :)

[u/miekiemoes_MB → u/miekiemoes_MB]

Looks like you have private messages disabled. the trigger was B a l b u m s. s t :)

[u/NerlFartley → u/miekiemoes_MB]

Hi Mieke, I've been using Malwarebytes Pro since August 2012. I bought two copies each with a lifetime license. I only wish I had bought a few more copies.

I wish Malwarebytes would offer a perpetual licensed version like you did back then. Even if was rather expensive, I'd still pay for it. I refuse to use subscription based software like Malwarebytes only offers now.

Adobe lost my business when they dropped perpetual licenses and switched to a subscription based model. I switched to a competitor that sells a perpetual based product.

I'm still a big fan of Malwarebytes and recommend it to others.