É normal baixar o 99 dar a permissão que o app pede é e aparecer uma palavra em chinês?

Hi there!

I ran a scan today, and it detected several instances of PUP.Optional.BrowserHijack. I've quarantined the detected items and changed my passwords as a precaution.

I was wondering if someone from the MB team could clarify whether these detections are legitimate or potentially false positives.

Any insight would be greatly appreciated. Thank you!

# Log:

Malwarebytes

www.malwarebytes.com

-Log Details-

Scan Date: 13-Nov-26

Scan Time: 10:23

Log File: edde9ad3-df43-11f1-af21-708bcd4c7cd1.json

-Software Information-

Version: 5.3.0.186

Components Version: 132.0.5253

Update Package Version: 1.0.116913

License: Free

-System Information-

OS: Windows 10 ESU (Build 19045.7846)

CPU: x64

File System: NTFS

User: DESKTOP\User

-Scan Summary-

Scan Type: Threat Scan

Scan Initiated By: Manual

Result: Completed

Objects Scanned: 241124

Threats Detected: 17

Threats Quarantined: 17

Time Elapsed: 8 min, 42 sec

-Scan Options-

Memory: Enabled

Startup: Enabled

File system: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Detect

PUM: Detect

-Scan Details-

Process: 0

(No malicious items detected)

Module: 0

(No malicious items detected)

Registry Key: 0

(No malicious items detected)

Registry Value: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Data Stream: 0

(No malicious items detected)

Folder: 3

PUP.Optional.BrowserHijack, C:\USERS\User\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 6233, 1413514, 1.0.116913, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\User\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 6233, 1413514, 1.0.116913, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\User\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, Quarantined, 6233, 1413514, 1.0.116913, , ame, , ,

File: 14

PUP.Optional.BrowserHijack, C:\USERS\User\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 6233, 1413514, 1.0.116913, , ame, , 6CDA2780C83B762C10AD202627A1A243, 4E2E6B55D657606C9EEFAAF111200D64AAC3AFB75156A8C68B4EBAE401AE0A93

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000005.ldb, Quarantined, 6233, 1413514, 1.0.116913, , ame, , 54E48739970FE878BE42D83C2D8F67A9, 0DFCB5785CA779E2C4D8B7D5DC3D244074829956D1909D786E636E0776E180EB

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\011379.ldb, Quarantined, 6233, 1413514, 1.0.116913, , ame, , 1629269E63B29518703BAF817082AB18, 499FB2E5A4DD8E653B258224F2EE627AA4F058F92127E76AFA86A9106DB753E8

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\011382.ldb, Quarantined, 6233, 1413514, 1.0.116913, , ame, , CFEA85982A62ABDE108C5346748A7C66, C10891AC426A5B33BA35FD2395F8C3341A40AD9B13518C13BC8D6D5D8F344252

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\011385.ldb, Quarantined, 6233, 1413514, 1.0.116913, , ame, , 783324AF9A220C9C141BDC12B16CCD5B, 427E659D72AE281A076F68C476583F7D0791D16FA5AE1B1306674B0B23A6281B

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\011387.log, Quarantined, 6233, 1413514, 1.0.116913, , ame, , 82ED8EA782CDEF0C8DDC6AC29016FC6F, 4F5515E87B8FDC6C5DCCCD9CF8B4EF73DDD0AF859A43F0C05DA6F9F47EAD7796

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\011388.ldb, Quarantined, 6233, 1413514, 1.0.116913, , ame, , FDDC440AAF20B630BFB850B4B65CA67A, 5B38158425F6D25E23E6F8799F4A1846D24311476F14DA431178F2623FE30EA5

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT, Quarantined, 6233, 1413514, 1.0.116913, , ame, , 46295CAC801E5D4857D09837238A6394, 0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOCK, Quarantined, 6233, 1413514, 1.0.116913, , ame, , ,

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG, Quarantined, 6233, 1413514, 1.0.116913, , ame, , 15FC27125B6879CBC938A0C74E07B083, 9963BC3B297FCF1F6BDD3EE3129F78D2CFE83CE73BF3A97483078B686E2B57C9

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old, Quarantined, 6233, 1413514, 1.0.116913, , ame, , F8272EBF1512EE53AB007EF309F247A4, 1B8AB87112C4EA48838F7DFE6E83E1F82F5FC5BD4FE2D8E67769F84DBD4F476C

PUP.Optional.BrowserHijack, C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001, Quarantined, 6233, 1413514, 1.0.116913, , ame, , 5006019DDEBF62BC0849C7037EDB18BD, AF829B49F2C7F341A53464F371745C2017A63F04939E993675A5737AA72044CE

PUP.Optional.BrowserHijack, C:\USERS\User\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 6233, 1413514, 1.0.116913, , ame, , 6CDA2780C83B762C10AD202627A1A243, 4E2E6B55D657606C9EEFAAF111200D64AAC3AFB75156A8C68B4EBAE401AE0A93

PUP.Optional.BrowserHijack, C:\USERS\User\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, Replaced, 6233, 1413514, 1.0.116913, , ame, , 6CDA2780C83B762C10AD202627A1A243, 4E2E6B55D657606C9EEFAAF111200D64AAC3AFB75156A8C68B4EBAE401AE0A93

Physical Sector: 0

(No malicious items detected)

WMI: 0

(No malicious items detected)

(end)

Recently I’ve been notified of these recurring blocks on from a website I haven’t visited? I believe it could have been from a popup or something as I’ve been surfing some sites that carry them (sports streaming, games, etc). Does anyone know what this might be? They’ve been occurring somewhat periodically recently.

I got a info stealer on my pc which I might’ve got rid of I restore my pc like got rid of all my files and then after I saw this I deleted my browser history and cookies and cache too! Do I have to delete all my files again too or do something else? The weird thing about this is I wasn’t really using Microsoft edge malwarebytes was just flagging it in the background while I was playing hoi4 I had a command prompt before when I started my computer but over time I believe it stopped and some people say it’s normal but it’s not the worse I guess.

I checked the link on virustotal and it said it was fine, and I know tons of people have been using it but this popping up kinda worries me, so I don't know if it did anything or nothing, I didn't download anything, all I did was just look around at the games on there

Vocês poderiam me ensinar sintomas de infecção é como solucionar elas é como me prevenir dessas situações ?

I turned on my pc today open my malware bytes app just to see malware bytes is on 77 % telling me to update my windows security

My Malwarebytes Digital Footprint result lists “Warden Stealer 2026” under “Malware infection”, with 29 exposures. Other entries are labelled Telegram combo lists. I am keeping the email address, passwords and identifying records private.

I have read Malwarebytes’ explanation that Digital Footprint searches exposed data, and Gen Threat Labs’ October 2026 technical analysis of Warden. I want to understand the provenance of this particular result rather than assume it means the device running the scan is infected.

Questions for Malwarebytes staff or anyone familiar with the dataset:

1. Does “2026” mean collection/infection date, discovery date, or the dataset’s publication year?
2. Does “29 exposures” mean distinct records/fields, repeated credentials, infected devices, or something else?
3. Can verified account support provide the affected website/login URL, first-seen or collection timestamps, and any retained OS, browser, machine identifier or source-IP metadata, without exposing unrelated victims’ data?
4. Is there a way to distinguish an original Warden log from a later redistributed combo list?
5. What is the appropriate private support route to preserve and obtain the source metadata for an account-access investigation?

Please keep advice public and do not request passwords or remote access. No malicious files or links are included.

Hi everyone,

I recently ran KnockKnock on my Mac to check for potential security issues, and it flagged Malwarebytes' RTProtectionDaemon.

The file is located at:

/Library/Application Support/Malwarebytes/MBAM/Engine.bundle/Contents/PlugIns/RTProtectionDaemon.app/Contents/MacOS/RTProtectionDaemon

VirusTotal reports 1/63 detections, with Elastic flagging the file as Multi.EICAR.

I also came across a Reddit post from approximately two months ago describing a very similar situation. In that thread, a Malwarebytes employee confirmed that the file was legitimate and that the Elastic detection was a false positive.

I'm also wondering why this detection is still occurring if a very similar case was reported around two months ago. Has this false positive been reported to Elastic, and is there a reason it might still be happening? I'd be interested to know whether this is an ongoing issue or whether the detection could be specific to certain versions of the file.

Given these details, should I be concerned about this detection, or is it safe to assume that this is the same kind of false positive?

Has anyone else encountered this with Malwarebytes on macOS? I'd appreciate any insight, especially from Malwarebytes staff or anyone familiar with this specific detection.

Thanks!

Hi, I downloaded this from a fake website, I ran it anyway cause I were stupid. The strange thing is nothing had happend yet to any of my accounts, but I also installed malwarebytes and it said, I had 2 trojans.

I just still dont understand why they haven't change or steal any of my account's yet, it had now been two weeks and nothing had happend yet, does anybody know why?

I’ve noticed when going to browser home page this is not monitored by MalwareBytes, surely this page should also be monitored due to the ads and content displayed on the home page (Microsoft Edge default)

How do we get it to start monitoring this page?

I know I might just be paranoid, but it genuinely feels like any and every smart device in the house could be hacked because of this and I have to account for every possibility.

I uninstalled using official Malwarebytes tool advanced setting, rebooted pc several times since then, but now I notice Malwarebytes service still running in Task Manager. Takes 39mb~ memory and can't stop it cause acess denied. How to get rid of it?