Jump to content
AnnMarie

Registry corruption SecurityProviders value

Recommended Posts

I and others on the CTH team have noticed this in a number of logs in the past few weeks (the difference depends on what utility you use for creatings logs and I have posted a couple of variations so that Helpers may know what to look for).

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders]

"msapsspc.dll schannel.dll digest.dll msnsspc.dll" - File not found

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

It appears that MBAM is causing this. The logs were fine prior to running this software and the corruption appeared afterwards in at least three instances that I can personally vouch for. Example below:

http://www.cybertechhelp.com/forums/showthread.php?t=186979

If you need more information I am happy to provide it.

Share this post


Link to post
Share on other sites

Hi AnnMarie thanks for the information and feedback. This was previously reported and should now be fixed.

Please download the new version and test it out.

http://www.malwarebytes.org/mbam.php

September 2nd, 2008 Malwarebytes' Anti-Malware version 1.26 released.

Recent Changes

* (FIXED) Problem repairing certain registry keys.

* (FIXED) Converted log file names to ISO standard.

* (FIXED) False positives on limited user accounts.

* (ADDED) Safeguard to prevent users from losing scan results.

* (ADDED) Brand new header logo.

Share this post


Link to post
Share on other sites

Excellent. Our site was down yesterday so I havent yet seen the results of running the latest version. I'll check it out later today. ;)

Share this post


Link to post
Share on other sites

I forgot to ask, does the new version repair the corruption on systems where the users are unaware their SecurityProviders value has been corrupted? We have been doing this manually so asking these users to run the new version will not make any difference.

Share this post


Link to post
Share on other sites
Ok. Thanks for the clarification.

I would believe that Marcin has an automated fix, but as he said he did not have time to add it to MBAM. Please check this topic.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.