It's back...

[kcazzie]

HKEY_CLASSES_ROOT\scrfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: ("%1" /S) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: (NOTEPAD.EXE %1) Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

Running Pro - Malwarebytes' Anti-Malware 1.50.1.1100

I had this a couple of years ago on the another PC and once you updated you defs all I did was follow your direction and it went away...

Well it's not going away this time... I found the old 'Thread' followed the directions and it keeps coming back...

Any help would be wonderful...

Happy Holidays everyone...

kcazzie

Here's a link to the old thread -> http://forums.malwarebytes.org/index.php?s...c=6196&st=0 and http://forums.malwarebytes.org/index.php?showtopic=6195

[miekiemoes]

Hi,

This is no false positive. Malwarebytes restores the default associations for scr files and regfiles again.

System Mechanics breaks these associations and sets them to open in notepad instead.

So, either, you ignore the detection in malwarebytes and add it to your ignore list, or you don't let system mechanics deal with it. I don't know what option exactly changes/breaks these associations in System mechanics, but I am sure someone else here can answer this question.

[Jimbo]

mbam_log_2010_12_24__10_13_29_.txt

Happy Holidays,

I'm getting the same again with the upgrade on 2 PC's. Based on the other forum, it looks like due to the fact that I'm running Dell PC TuneUp created by iolo software.

However, I choose to ignore, they continue to come back in my scan results and I'm not sure why.

Thanks in advance for a great product!

[miekiemoes]

Just let mbam fix the entries (which will restore them to Windows default) and don't use the "Fix security vulnerabilities" in iolo. This because this option breaks the default association and mbam cannot know if it's broken by malware (in order to launch a malicious app instead) or by a legit app ( in this case iolo). Iolo is the only app I know that changes these associations though, while it's done in the 90% other cases by malware. That's why we have chosen to detect & fix this, also to protect our users.

If you have malwarebytes, there's no need for the "iolo - Fix security vulnerabilities" anyway as malwarebytes fixes this already and restores to default instead.

Also, if you let iolo handle this, then you won't be able to run any screensavers anymore + you won't be able to merge registry fixes either.

Plus on top.. Always be careful with such tools like registry cleaners / tweakers etc.. - they can break more than it fixes. Also see here