Registry Problems

In the past few days I noticed something added to the registry. Such as
HKey_Current_User\112946753
I have never had this before so I delete it and it reappears when I go
online the next day. Is this a virus? I have Defender Pro 20008 installed
with Windows XP Home SP3
--
SW

HapiCampr wrote:

In the past few days I noticed something added to the registry. Such as
HKey_Current_User\112946753
I have never had this before so I delete it and it reappears when I go
online the next day. Is this a virus? I have Defender Pro 20008 installed
with Windows XP Home SP3

Do more thorough scanning for viruses and malware.

Go through these general malware removal steps systematically -
http://www.elephantboycomputers.com/...moving_Malware

Include scanning with David Lipman's Multi_AV and follow instructions to do
all scans in Safe Mode. Please see the special Notes regarding using
Multi_AV in Vista.

http://www.elephantboycomputers.com/page2.html#Multi-AV - instructions
http://tinyurl.com/yoeru3 - download link and more instructions

When all else fails, get guided help. Choose one of the specialty forums
listed at the first link. Register and read its posting FAQ. PLEASE DO NOT
POST LOGS IN THE MS NEWSGROUPS.

Malke
--
MS-MVP
Elephant Boy Computers - Don't Panic!
FAQ - http://www.elephantboycomputers.com/#FAQ

Download, install, update and scan your System in Safe Mode with these 2
Programs.
Also, scan with your AV whilst in SM
All info below.

http://www.spybot.info/en/index.html

Spybot Search & Destroy 1.6 is a very good, FREE Anti-Spyware Program.
Download, install, update, and immunize your System with it.
Then SCAN with it.
Update it, and scan your System once a fortnight.

http://www.malwarebytes.org/mbam.php

Malwarebytes is as the name says, a Malware Remover!
For the Free version scroll down their page to either download from
Download.com, or Major Geeks.com

Download, install, and update.

Important Safe Mode
If you happen to find a problem that you can’t uninstall / delete, reboot
the computer, and go into Safe Mode.
To get into Safe mode, tap F8 right at Power On / Startup, and use UP arrow
key to get to Safe Mode from list of options, then hit ENTER.
RESCAN your computer with your Anti-Virus, Malwarebytes and Spybot S & D
while in Safe Mode.

--
Mad Mike


"HapiCampr" wrote:

In the past few days I noticed something added to the registry. Such as
HKey_Current_User\112946753
I have never had this before so I delete it and it reappears when I go
online the next day. Is this a virus? I have Defender Pro 20008 installed
with Windows XP Home SP3
--
SW

Download, install, update and scan your System in Safe Mode with these 2
Programs.
Also, scan with your AV whilst in SM
All info below.

http://www.spybot.info/en/index.html

Spybot Search & Destroy 1.6 is a very good, FREE Anti-Spyware Program.
Download, install, update, and immunize your System with it.
Then SCAN with it.
Update it, and scan your System once a fortnight.

http://www.malwarebytes.org/mbam.php

Malwarebytes is as the name says, a Malware Remover!
For the Free version scroll down their page to either download from
Download.com, or Major Geeks.com

Download, install, and update.

Important Safe Mode
If you happen to find a problem that you can’t uninstall / delete, reboot
the computer, and go into Safe Mode.
To get into Safe mode, tap F8 right at Power On / Startup, and use UP arrow
key to get to Safe Mode from list of options, then hit ENTER.
RESCAN your computer with your Anti-Virus, Malwarebytes and Spybot S & D
while in Safe Mode.

--
Mad Mike


"HapiCampr" wrote:

In the past few days I noticed something added to the registry. Such as
HKey_Current_User\112946753
I have never had this before so I delete it and it reappears when I go
online the next day. Is this a virus? I have Defender Pro 20008 installed
with Windows XP Home SP3
--
SW

Download, install, update and scan your System in Safe Mode with these 2
Programs.
Also, scan with your AV whilst in SM
All info below.

http://www.spybot.info/en/index.html

Spybot Search & Destroy 1.6 is a very good, FREE Anti-Spyware Program.
Download, install, update, and immunize your System with it.
Then SCAN with it.
Update it, and scan your System once a fortnight.

http://www.malwarebytes.org/mbam.php

Malwarebytes is as the name says, a Malware Remover!
For the Free version scroll down their page to either download from
Download.com, or Major Geeks.com

Download, install, and update.

Important Safe Mode
If you happen to find a problem that you can’t uninstall / delete, reboot
the computer, and go into Safe Mode.
To get into Safe mode, tap F8 right at Power On / Startup, and use UP arrow
key to get to Safe Mode from list of options, then hit ENTER.
RESCAN your computer with your Anti-Virus, Malwarebytes and Spybot S & D
while in Safe Mode.

--
Mad Mike


"HapiCampr" wrote:

In the past few days I noticed something added to the registry. Such as
HKey_Current_User\112946753
I have never had this before so I delete it and it reappears when I go
online the next day. Is this a virus? I have Defender Pro 20008 installed
with Windows XP Home SP3
--
SW

Download, install, update and scan your System in Safe Mode with these 2
Programs.
Also, scan with your AV whilst in SM
All info below.

http://www.spybot.info/en/index.html

Spybot Search & Destroy 1.6 is a very good, FREE Anti-Spyware Program.
Download, install, update, and immunize your System with it.
Then SCAN with it.
Update it, and scan your System once a fortnight.

http://www.malwarebytes.org/mbam.php

Malwarebytes is as the name says, a Malware Remover!
For the Free version scroll down their page to either download from
Download.com, or Major Geeks.com

Download, install, and update.

Important Safe Mode
If you happen to find a problem that you can’t uninstall / delete, reboot
the computer, and go into Safe Mode.
To get into Safe mode, tap F8 right at Power On / Startup, and use UP arrow
key to get to Safe Mode from list of options, then hit ENTER.
RESCAN your computer with your Anti-Virus, Malwarebytes and Spybot S & D
while in Safe Mode.

--
Mad Mike


"HapiCampr" wrote:

In the past few days I noticed something added to the registry. Such as
HKey_Current_User\112946753
I have never had this before so I delete it and it reappears when I go
online the next day. Is this a virus? I have Defender Pro 20008 installed
with Windows XP Home SP3
--
SW

Download, install, update and scan your System in Safe Mode with these 2
Programs.
Also, scan with your AV whilst in SM
All info below.

http://www.spybot.info/en/index.html

Spybot Search & Destroy 1.6 is a very good, FREE Anti-Spyware Program.
Download, install, update, and immunize your System with it.
Then SCAN with it.
Update it, and scan your System once a fortnight.

http://www.malwarebytes.org/mbam.php

Malwarebytes is as the name says, a Malware Remover!
For the Free version scroll down their page to either download from
Download.com, or Major Geeks.com

Download, install, and update.

Important Safe Mode
If you happen to find a problem that you can’t uninstall / delete, reboot
the computer, and go into Safe Mode.
To get into Safe mode, tap F8 right at Power On / Startup, and use UP arrow
key to get to Safe Mode from list of options, then hit ENTER.
RESCAN your computer with your Anti-Virus, Malwarebytes and Spybot S & D
while in Safe Mode.

--
Mad Mike


"HapiCampr" wrote:

In the past few days I noticed something added to the registry. Such as
HKey_Current_User\112946753
I have never had this before so I delete it and it reappears when I go
online the next day. Is this a virus? I have Defender Pro 20008 installed
with Windows XP Home SP3
--
SW

Download, install, update and scan your System in Safe Mode with these 2
Programs.
Also, scan with your AV whilst in SM
All info below.

http://www.spybot.info/en/index.html

Spybot Search & Destroy 1.6 is a very good, FREE Anti-Spyware Program.
Download, install, update, and immunize your System with it.
Then SCAN with it.
Update it, and scan your System once a fortnight.

http://www.malwarebytes.org/mbam.php

Malwarebytes is as the name says, a Malware Remover!
For the Free version scroll down their page to either download from
Download.com, or Major Geeks.com

Download, install, and update.

Important Safe Mode
If you happen to find a problem that you can’t uninstall / delete, reboot
the computer, and go into Safe Mode.
To get into Safe mode, tap F8 right at Power On / Startup, and use UP arrow
key to get to Safe Mode from list of options, then hit ENTER.
RESCAN your computer with your Anti-Virus, Malwarebytes and Spybot S & D
while in Safe Mode.

--
Mad Mike


"HapiCampr" wrote:

In the past few days I noticed something added to the registry. Such as
HKey_Current_User\112946753
I have never had this before so I delete it and it reappears when I go
online the next day. Is this a virus? I have Defender Pro 20008 installed
with Windows XP Home SP3
--
SW

Download, install, update and scan your System in Safe Mode with these 2
Programs.
Also, scan with your AV whilst in SM
All info below.

http://www.spybot.info/en/index.html

Spybot Search & Destroy 1.6 is a very good, FREE Anti-Spyware Program.
Download, install, update, and immunize your System with it.
Then SCAN with it.
Update it, and scan your System once a fortnight.

http://www.malwarebytes.org/mbam.php

Malwarebytes is as the name says, a Malware Remover!
For the Free version scroll down their page to either download from
Download.com, or Major Geeks.com

Download, install, and update.

Important Safe Mode
If you happen to find a problem that you can’t uninstall / delete, reboot
the computer, and go into Safe Mode.
To get into Safe mode, tap F8 right at Power On / Startup, and use UP arrow
key to get to Safe Mode from list of options, then hit ENTER.
RESCAN your computer with your Anti-Virus, Malwarebytes and Spybot S & D
while in Safe Mode.

--
Mad Mike


"HapiCampr" wrote:

In the past few days I noticed something added to the registry. Such as
HKey_Current_User\112946753
I have never had this before so I delete it and it reappears when I go
online the next day. Is this a virus? I have Defender Pro 20008 installed
with Windows XP Home SP3
--
SW

"HapiCampr" wrote:

In the past few days I noticed something added to the registry. Such as
HKey_Current_User\112946753
I have never had this before so I delete it and it reappears when I go
online the next day. Is this a virus? I have Defender Pro 20008 installed
with Windows XP Home SP3
--
SW


Run a thorough scan by doing the following steps:
1... First, try to clean up your caches, Internet files and delete cookies
by doing this:
Click Start Control Panel Double click Network and Internet
Connections Double click Internet Options.
On the IE properties windows you will see these Tabs:
General | Security | Privacy | Content | Connections | Programs |
Advanced
Under General Tab clear your History, Internet Files and Cookies.
Then click on Advanced tab and scroll down to under the Browsing Option:
[&] Browsing
[ ] Enable Third-Party browser extensions (Req Rest) uncheck this box.
Then click on Programs Tab and click Manage Add-Ons and Disable all non
Verified Add-Ons (You should Renable them later one-by-one and see the
culprit and update it or remove it.
How to manage Add-Ons:
http://support.microsoft.com/kb/883256
Scan for malware from he
Download and Update SuperAntispyware and run a complete scan - Free
http://www.superantispyware.com/supe...freevspro.html
http://www.malwarebytes.org/rr-update/rr-free-setup.exe
http://onecare.live.com/site/en-gb/d....htm?s_cid=sah

Run a scan from here on-line:
http://security.symantec.com/sscv6/d...d=ie&venid=sym
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
Download Avast Cleaner (offline scanner) from he
http://www.avast.com/eng/avast-virus-cleaner.html
Comodo BOClean : Anti-Malware Version 4.27
http://www.comodo.com/boclean/boclean.html

Download Hijackthis and analysis the log or send to one of many forums on
the internet!
Download Hijackthis.
(http://www.trendsecure.com/portal/en...hijackthis.php)

Run disk clean up on your Drive.
You can download this tool o run clean up:
http://www.ccleaner.com/download/bui...wnloading-slim

HTH,
nass
---
http://www.nasstec.co.uk

In the past few days I noticed something added to the registry. Such
as HKey_Current_User\112946753
I have never had this before so I delete it and it reappears when I go
online the next day. Is this a virus? I have Defender Pro 20008
installed with Windows XP Home SP3

lol, I imagine you might be going nuts with 3 different sets of advice
to scan things differently like that, but ... in reality they are all
perfectly good suggestions. My advice would be to start with Malke and
nass's suggestions, then Mick's if neither of the first two fix
anything.
I'm sure it sounds like a lot of hassle, but with spyware and other
malicious programs, it seems there is no single program that can catch
everything. Amongst the three of them you have had recommended about
the best sets of malware detectors you could find. I'm tempted to add
to that list, but I'll resist it for the momentg; those should serve
you well.

I am assuming that the occurrence of this registry key did not occur at
the same time you installed any programs or updates, or changed system
settings, right? If it was coincident with a program install, then the
first thing to try would be to uninstall that program or revert the
system setting and see if it goes away.

IMO you should come back and explain if any of them make a difference
but do not actually fix it.
The hive entry you show does sound suspicious and that's whey they
made the recommendations they did.

If none of them work, also come back of course, and explain what did
happen. There are still quite a few possibilities to consider to take
care of the issue.

You should minimize the use of that computer until you have it sorted
out, I'd think. It may be harmless or it might be perparing to eat
files or something else malicious; it's hard to tell.
I would recommend however that you do a complete backup of ALL of
your valuable data NOW. Any pictures, letters, spreadsheets,
presentations, etc., that you would have a hard time replacing should be
backd up so you won't lose t hem. Best case you'll never need them but
worst case you will, plus you'll have the problem of one of them
possibly containing the malicious program and you'll need to sort that
out. But it's bettern than losing everything. Don't worry about your
operating system and programs: Those you cna always reinstall if you
have to. Remember, I suggested you try to minimize use of the computer
so, beyond the backup, try to stop using it except for the
trouble-shooting efforts.

My 2 ¢, anyway,


Twayne

From: "HapiCampr"

| In the past few days I noticed something added to the registry. Such as
| HKey_Current_User\112946753
| I have never had this before so I delete it and it reappears when I go
| online the next day. Is this a virus? I have Defender Pro 20008 installed
| with Windows XP Home SP3
| --
| SW

I'm sorry but you haven't provided any REAL information.

How did you notice something was added toi the Registry ?
What is the EXACT key that was added ?

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp