I got 30 detection after scanning, is this false postive?

Malwarebytes

[www.malwarebytes.com\](https://www.malwarebytes.com)

-Log Details-

Scan Date: 10/16/2026

Scan Time: 6:16 PM

Log File: a83ff58e-c94a-11f1-b77b-18c04ddf7d21.json

-Software Information-

Version: 5.7.1.346

Components Version: 165.0.5751

Update Package Version: 1.0.115799

License: Free

-System Information-

OS: Windows 11 (Build 26300.9711)

CPU: x64

File System: NTFS

User: Liebert\JOHAN

-Scan Summary-

Scan Type: Threat Scan

Scan Initiated By: Manual

Result: Completed

Objects Scanned: 214,014

Threats Detected: 30

Threats Quarantined: 0

Scan Duration: 8 min, 14 sec

-Scan Options-

Memory: Enabled

Startup: Enabled

File system: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Detect

PUM: Detect

-Scan Details-

Process: 0

(No malicious items detected)

Module: 0

(No malicious items detected)

Registry Key: 0

(No malicious items detected)

Registry Value: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Data Stream: 0

(No malicious items detected)

Folder: 8

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Profile 1\Sync Data\LevelDB, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Profile 1\Sync Data\LevelDB, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Profile 1\Sync Data\LevelDB, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Sync Data\LevelDB, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Profile 1\Sync Data\LevelDB, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

File: 22

PUP.Optional.BrowserHijack, C:\USERSJOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000005.ldb, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 16FB1F2368DDA06741683D6C80A95475, 0E9DD4DC498DE6285695DB270D8FE72695B7B467576BBF6A5393C586DACBF2C8

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000215.ldb, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 7A96BFBBA581C04A16B76217B13AA62B, 8C14D74A5186E4FCBE9EE9ABECFF78188BFC9BC16C82068D5718B57DC82481EB

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000217.ldb, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 669D24425472ADE2D48EDDFD7E70340C, 961B44A967847F18634BF5703F94280A106186CFF4557D5015C7837C617AA9D1

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000219.log, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000220.ldb, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 2F41F19A16B86D7C659E385622B9951B, F283C2F69AA7EDE48421BCDC3C6F36B7C2AE873AC9880A6DB0BAC49FAADAF648

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 46295CAC801E5D4857D09837238A6394, 0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOCK, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 438C85FC3813357D78EF47224EE311C6, 63BF713647573518DD6A2AA44C91FCCF914867882EC35F36F0980458C9FE146C

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\MANIFEST-000001, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Profile 1\Sync Data\LevelDB\000005.ldb, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 90A600CE80F264CF6E651D65E22599FA, 0C5E8F94EB6A334E6B4D7758860E5405BE97FAB6CB6BBB9E7FFF5A2DFC5DF0D8

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Profile 1\Sync Data\LevelDB\000007.log, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 14DD8F17C5E32EBCCA161BFB77CAAEA3, DE8400021BBFB96FDAFBB575A8B3CEE9743B5D0B63FFB29AF8C7103465AB564A

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Profile 1\Sync Data\LevelDB\000008.ldb, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 8115F29E590CDC6530D1F3DC90065427, BDCC35115659F1469F73730892013048D73DDC7E94B01343F11ECD7122ED57F4

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Profile 1\Sync Data\LevelDB\CURRENT, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 46295CAC801E5D4857D09837238A6394, 0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Profile 1\Sync Data\LevelDB\LOCK, No Action By User, 6814, 1413516, 1.0.115799, , ame, , D41D8CD98F00B204E9800998ECF8427E, E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Profile 1\Sync Data\LevelDB\LOG, No Action By User, 6814, 1413516, 1.0.115799, , ame, , DB71579FA6B388A3B5217D0D9B0830F8, 2D3B28BA165460500B12C0AC84339A7F85799549ED6EB097597EF169302D46CC

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Profile 1\Sync Data\LevelDB\LOG.old, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 1BBCB2DD1C072FC3740719E1E147127C, 0E28F54AC50BD776BE753362C6B8062F54A4CCF5AA47265C849A7DF25DCEFF15

PUP.Optional.BrowserHijack, C:\Users\JOHAN\AppData\Local\Google\Chrome\User Data\Profile 1\Sync Data\LevelDB\MANIFEST-000001, No Action By User, 6814, 1413516, 1.0.115799, , ame, , 755AA48FB13DADF7054C1844357CB138, 7B3CB8CABEB11C6A2B9F9EA2EFA0E134862C01887BC011B4443F8EDB327CF3B5

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

PUP.Optional.BrowserHijack, C:\USERS\JOHAN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\Default\Web Data, No Action By User, 6814, 1413516, 1.0.115799, , ame, , ,

Physical Sector: 0

(No malicious items detected)

WMI: 0

(No malicious items detected)

(end)

Scam links are getting harder to spot, and one wrong click can put your personal information at risk. That’s why we’re introducing Malwarebytes Scam Link Check.

This new tool helps you check whether a link may be a scam before you visit the website. Simply check the link first, so you can make a more informed decision about whether it’s safe to click.

Whether it’s a suspicious domain or a link that just feels off, a quick check can help you stay one step ahead of scammers.

Hi everyone,

Yesterday I fell victim to a session-hijacking attack after downloading a fake GoXLR utility executable (.exe). The malware extracted browser cookies and Discord tokens, bypassing 2FA on a couple of my accounts before I caught it.

I have already done a complete format and clean reinstall of Windows 11, changed all my passwords, revoked active sessions,

Before doing the format, I managed to run the file/site through VirusTotal. I’d like to share the details here so experienced members or researchers can take a look at the behavior logs and confirm what the payload was doing.

• Malware Type / Name: Infostealer disguised as a GoXLR utility tool
• Website : https://goxlr.live/
• File Type: .exe (Windows Executable)
• VirusTotal Link: https://www.virustotal.com/gui/file/2ec338cb60cd6451bb5a59d001404a73ddd1606d29cde9f154a0a792cc217c8f/behavior

i have 3 gmail 2 got taken and deleted (still trying to get them back) the 1 gmail they didnt get was my main gmail idk why but im thankful but they were trying to get it yesterday and i manage to change password and signedout all devices they also got my discord even tho it has 2fa and ive done full reformat i've reformat all my harddrivers now my concern is i hope this is not bios level and i just wanna know if im safe so i can sleep with a little bit a peace of mind i still havent sleep

Upvote0Downvote1Go to comments1RepostShare

Hello, im not sure if this is the appropriate place to ask this (i dont really use reddit and all) but does anyone know whats happening? Im pretty freaked out, and not sure if this a me only problem or something that appeared to other people too. I tried opening and closing the app and clearing cache but sometimes IT still appears 😓 Any help appreciated, thanks.

i accidentally clicked a link on discord, these people put me into a gc and said they had all my info. they showed proof of it by logging into my discord account and instagram accounts. they have locked my gmails into a family thing on google and i can't get those 3 accounts back.

they've also showed that they were watching me on my pc as well, they have logged me out of my discord account and i can't log back in.

they have most of my personal info like my name and such, they don't have access to my bank info thankfully. i know there's definitely malware in my laptop now and i'm unsure what to do...

any help is appreciate!!!

Really hoping to get a response to this. I’m heavily considering a full usb wipe.

TIA

Malware.AI.4281255896
Wasn't able to find anything about this specific file or the specific .AI designation.

Hi, Im just wondering if yall know how. I was using the 15 days free trial of malwarebytes to find an infostealer. It was able to block a malicious connection to cosmicsky[.]xyz, but on repeated scans it never found the malware til i found the dd.bat file in my %temp% folder that was highly malicious. Nor did it flag its connection to the malicious site phucoasian[.]com which was downloading an exe and hijacking vscode and stuff. This is despite the exe being recognized by BitDefender in VirusTotal with a 7/70 score with the other 6 also using BitDefender tools as a Pantera family infostealer. And the dd.bat file was recognized 2/70 as a bat downloader. So my question is, is this a known vulnerability or flaw? And if so is it being wormed on? Cause both malwarebytes and windows defender missed it causing me to have to factory reset my laptop with a fresh windows install.

typically, a full scan on my C drive is relatively fast and would use all my cores/threads etc..

today after an hour, i notice it has slowed down significantly. Is this normal? it wasn't like this earlier in the scan and months ago.

cpu is 7950x3d, 870 EVO SSD, and windows 11 25h2 (just updated today, before I was using 23h2)

p.s. those detection is from a game trainer lol

edit: drive temps:

Hello everyone i bought new gaming pc i have changed it sinse 2023. So I installed amd graphics as usual and I got to check digital signature of the file just to be sure.

And from what I remember the correct digital signature is

Advanced Micro Devices. Inc

Bur the current one I have only says Advanced Micro devices. No Inc at the end and im getting worried didi they change the name ?

Hi,

I was listening to a playlist on spotify's website when I got a notification that RTP intercepted a connection. I've managed to re-create it and found its from an ad, however it's blocked before It can load the preview so I have no idea what the ad is.

It detected it a few days before, however I was in a game and it did not notify me of the block until I alt tabbed. Has this happened to anyone else?

i want to disable malwarebytes on startup so my pc would boot faster and not have to wait for extra services to load, i dont need malwarebytes 24/7 since i only use it to scan files and other stuff. i takes up my ram usage and memory which i dont need. but it doesnt work it still boots up on windows. any help, do i have to make kill scripts to kill the process before boot like i dont want to do that that sound unnecessary