JayIor Posted June 23, 2014 ID:845232 Share Posted June 23, 2014 Hello, Malwarebytes has found two registry values that it marks as a security hijack. Here are the logs: Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 23/06/2014Scan Time: 1:27:47 PMLogfile: malwarebyteslog.txtAdministrator: YesVersion: 2.00.2.1012Malware Database: v2014.06.23.11Rootkit Database: v2014.06.20.01License: FreeMalware Protection: DisabledMalicious Website Protection: DisabledSelf-protection: DisabledOS: Windows 7 Service Pack 1CPU: x64File System: NTFSUser: xScan Type: Threat ScanResult: CompletedObjects Scanned: 341232Time Elapsed: 3 min, 20 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: DisabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 0(No malicious items detected)Modules: 0(No malicious items detected)Registry Keys: 0(No malicious items detected)Registry Values: 2Security.Hijack, HKU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\DISALLOWRUN|1, msnmsgr.exe, , [e9fea7d4601b3ef87e98d2d26e95758b]Security.Hijack, HKU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\DISALLOWRUN|1, msnmsgr.exe, , [d01749324c2fe74f51c55f4518eb24dc]Registry Data: 0(No malicious items detected)Folders: 0(No malicious items detected)Files: 0(No malicious items detected)Physical Sectors: 0(No malicious items detected)(end)MSN has never been installed on this (it doesn't even exist anymore, does it). Quarantining doesn't seem to do anything, as running the scan again finds the values again.Adwcleaner didn't help, nor did spybot.Finding the reg values manually shows that they can't be modified or deleted.Do we know what this is? What's the point of blocking that application to run, or what is this doing in the background?Thanks Link to post Share on other sites More sharing options...
Staff gringo_pr Posted July 23, 2014 Staff ID:856676 Share Posted July 23, 2014 Hello I would like to apologize for the delay and ask if you still need help with this? Gringo Link to post Share on other sites More sharing options...
JayIor Posted July 23, 2014 Author ID:856717 Share Posted July 23, 2014 The machine has since been reformatted, but any insight on this you could give would be useful Link to post Share on other sites More sharing options...
Staff gringo_pr Posted July 24, 2014 Staff ID:857111 Share Posted July 24, 2014 Hello JayIor As it is only in the registry keys I Would say it was something leftover. Gringo Link to post Share on other sites More sharing options...
Staff gringo_pr Posted July 28, 2014 Staff ID:859016 Share Posted July 28, 2014 Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you. Link to post Share on other sites More sharing options...
Recommended Posts