Registry corruption SecurityProviders value

[AnnMarie]

I and others on the CTH team have noticed this in a number of logs in the past few weeks (the difference depends on what utility you use for creatings logs and I have posted a couple of variations so that Helpers may know what to look for).

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders]

"msapsspc.dll schannel.dll digest.dll msnsspc.dll" - File not found

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

It appears that MBAM is causing this. The logs were fine prior to running this software and the corruption appeared afterwards in at least three instances that I can personally vouch for. Example below:

http://www.cybertechhelp.com/forums/showthread.php?t=186979

If you need more information I am happy to provide it.

[AdvancedSetup]

Hi AnnMarie thanks for the information and feedback. This was previously reported and should now be fixed.

Please download the new version and test it out.

http://www.malwarebytes.org/mbam.php

September 2nd, 2008 Malwarebytes' Anti-Malware version 1.26 released.

Recent Changes

* (FIXED) Problem repairing certain registry keys.

* (FIXED) Converted log file names to ISO standard.

* (FIXED) False positives on limited user accounts.

* (ADDED) Safeguard to prevent users from losing scan results.

* (ADDED) Brand new header logo.

[AnnMarie]

Excellent. Our site was down yesterday so I havent yet seen the results of running the latest version. I'll check it out later today.

[AnnMarie]

I forgot to ask, does the new version repair the corruption on systems where the users are unaware their SecurityProviders value has been corrupted? We have been doing this manually so asking these users to run the new version will not make any difference.

[RubbeR DuckY]

No, version 1.27 will repair these registry values. Due to lack of time and a need to release the fix we did not have time to fix this.

[AnnMarie]

Ok. Thanks for the clarification.

[GT500]

Ok. Thanks for the clarification.

I would believe that Marcin has an automated fix, but as he said he did not have time to add it to MBAM. Please check this topic.

[RubbeR DuckY]

It will be added in the next version. Right now it is a temporary fix.