Hijack.StartMenu Malwarebytes Anti-Malware is a false positive?

Question

I just ran the Malwarebytes Anti-Malware quick scan for the first time and it found:

Registry Data Items Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> No action taken.

I just wanted to double check (and provide a top Google result for people in the future that might have the same issue) that this was a false positive and can be safely right-click ignored.

Solution

If you disabled options from appearing in the start menu (e.g. run, search, etc), then you can safely ignore this warning. Otherwise, malware might have disabled these settings for you and you might want to restore them.

You can modify these settings using the Windows GUI by following these steps:

1. Right click the Start Menu > Properties
2. In the Start Menu tab, click the top most Customize button (Start menu must be checked)
3. Go to the Advanced tab in the Customize Start Menu window
4. In the Start menu items list, check or uncheck any items you want to show or hide (e.g. "Search" in this case).

Here's a post where someone explains that disabling this setting is a symptom of some trojan, which is the reason they warn you even though it may be legitimately disabled (e.g. if you disabled it yourself). Here's another post that says something similar.

Comments

[jsuprr]

Note that Malwarebytes identifies this as "PUM.Hijack.Startmenu". The "PUM" means "Potentially Unwanted Modification". So it's not saying "Warning, we found malware!" It's saying, "Hey, we noticed something unusual that's sometimes a sign of malware being present, but is also sometimes benign." I got this warning this morning and am multiple-scanning my system to be safe, but so far so good.