PUM.Optional.ExpNoClose

Short bio

This detection is for a potentially unwanted modification (PUM) in the Windows registry where the Shut Down option in the Windows Start menu and the Shut Down button in the Windows Security dialog box, which appears when you press ALT+CTRL+DEL at the same time. As a result, users won’t be able to turn off the system via the Windows interface.

System modifications

The following registry value data is modified:

Under HKEY_CURRENT_USER\Software\Microsoft\Windows\ CurrentVersion\Policies\Explorer

From: NoClose=0

To: NoClose=1

Remediation

Malwarebytes can modify this registry value data back to its Windows default setting without user interaction.

Also, we advise users to do a full system scan as PUM.Optional.ExpNoClose could have been added to the system by malware or PUP.

Add an exclusion

When a Potentially Unwanted Modification (PUM) is detected on your computer, Malwarebytes for Windows does not know whether it was authorized. Optimization software, malware, and Potentially Unwanted Programs (PUPs) are known to make these types of changes, hence they are regarded as potentially unwanted by design. To have Malwarebytes for Windows ignore a PUM, you must add the PUM to the Allow list. Here’s how to do it.

1. When a PUM appears in the list of Scan results.
   
2. Uncheck the entry or entries related to the PUM.
   
3. Then click on Next.
4. You will see a prompt giving you several options.
   
5. Choosing Always ignore will add the PUM to the Allow List.
   
6. You can remove them there when you decide they should no longer be ignored.
7. When the PUM is on the Allow list it will no longer show up in your Scan results.