Windows 7 Forums
Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: What is the strange registry entry and how can I delete it?

24 Oct 2011   #1

Win7-64
 
 
What is the strange registry entry and how can I delete it?

I have the following registry key that appears to do nothing but keeps re-creating itself:

HKEY_CURRENT_USER\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon

This key contains a Shell value that points to an empty directory on my system:

C:\Users\Birk\AppData\Local\bc53345c\X

If I delete this value it immediately gets recreated. If I use Autoruns to disable it, it still gets recreated. The specified folder in AppData\Local does not exist. I did a registry search for bc53345c and could not find any other instances of it, so how is it getting recreated?

I am reluctant to delete the Winlogon key because I don't know how critical it is.

My System SpecsSystem Spec
.

24 Oct 2011   #2

Windows 7 Pro x86
 
 

You have some variant of a ZeroAccess rootkit on your machine.

You need this...

Anti-rootkit utility TDSSKiller
My System SpecsSystem Spec
24 Oct 2011   #3

Win7-64
 
 

Thanks Murmatron - tried that but it found nothing. I'll check out a couple of other rootkit killers and see if they find something.
My System SpecsSystem Spec
.


24 Oct 2011   #4

Win7-64
 
 

I tried a couple of other rootkit killers. My system is Windows 7-64 so several of them did not run. But ComboFIx did run and found the problem....and fixed it.

Running ComboFIx is a bit odd...it puts up a DOS-like window while it runs more than 50 separate checks. Then it reboots and puts up another DOS window that says "wait until the report is produced." The report shows all sorts of odd things, including files that ComboFix deletes, some of which it apparently puts back (like MSCONFIG.EXE).

After that I did a manual reboot and things appear to be OK now.

I also ran Stinger after completing ComboFix and it reported a trojan in the QuickBooks Patch.exe program. I have never run this so I don't know if the Patch program is really bugged or not, but Stinger deleted it anyway.

Thanks for the tip. I hadn't suspected a rootkit.
My System SpecsSystem Spec
Reply

 What is the strange registry entry and how can I delete it?




Thread Tools



Similar help and support threads for2: What is the strange registry entry and how can I delete it?
Thread Forum
Default program registry entry Software
Solved Unable to delete empty registry entry General Discussion
Cannot delete Registry entry System Security
Help with determining the registry entry/process causing my problems General Discussion
How do I add Registry entry under HKEY_USERS\ for the current user General Discussion
CBS.Log strange entry BSOD Help and Support
Framework 1.1 sp1 - manual registry entry? Software

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 02:58 AM.
Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App
  

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33