False positive - "HiJack.Zones"

[Hanger]

PASSWORD = infected

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZonesSecurityUpgradereg

http://www.virscan.org/report/8cb29e1c874f87ce7fa6c6c7d21243e1.html

MD5: e3c0b417bb0426183cac678df7fc1f8c

[nosirrah]

Please post a full scan log.

[Hanger]

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 5762

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.19019

14.2.2011 19:31:14

mbam-log-2011-02-14 (19-31-08).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 305043

Time elapsed: 56 minute(s), 52 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CURRENT_USER\SOFTWARE\VXEG3ZNNE5 (Trojan.FakeAlert) -> No action taken.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ (Hijack.Zones) -> No action taken.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

[shadowwar]

What makes you think this is a false positive? Did you get that reg file from somewhere?

It was most likely set when you had the fakealert infection. The other key is a remnant of that.