Hidden Objects

[hwedin]

Hi

My last Avira security suite scan found these 8 hidden objects:

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\parseautoexec

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\AspNetMMCExt, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1\imagelist

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\niusagemask

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index36b\niusagemask

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index36b\ilusagemask

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index36c\niusagemask

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index36c\ilusagemask

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NtmsSvc\Config\Standalone\drivelist

[NOTE] The registry entry is invisible.

Are they dangerous or normal?

My last scan didn't show any, but could these have appeared in today's windows update.

Regards

(Would have posted in Avira forum but replies are faster here)

[exile360]

Greetings

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\parseautoexec

[NOTE] The registry entry is invisible.

This entry apparently allows Windows to read environmental variables (such as %PROGRAMFILES% instead of C:\Program Files and %WINDIR% instead of C:\Windows) in AutoExec.bat, a file used to launch processes at boot that is generally not used in modern Windows versions (like XP, Vista and 7) but was used in 98 etc.

HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\v2.0.50727\NGenService\Roots\AspNetMMCExt, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\1\imagelist

[NOTE] The registry entry is invisible.

This entry is for the Microsoft .NET Framework 2.0, so it's safe.

HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\niusagemask

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index36b\niusagemask

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index36b\ilusagemask

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index36c\niusagemask

[NOTE] The registry entry is invisible.

HKEY_LOCAL_MACHINE\Software\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\index36c\ilusagemask

[NOTE] The registry entry is invisible.

These appear to be part of the software KeePass, so if you have that installed, that's why they're there.

HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NtmsSvc\Config\Standalone\drivelist

[NOTE] The registry entry is invisible.

I couldn't find much info on this one, but pretty much every reference I did find was just where a user was asking about it after an Avira scan, and I haven't seen anyone saying that it was an infection, but you can post on their official support forums if you'd like a second opinion from someone more experienced with such detections.

[hwedin]

Hi

Thanks for your help, glad to know that everything is OK. Don't have keepass installed but I might install, it looks useful. I may go to Avira about the last one.

Thanks Again