hkey_classes_root]magnet\url pregvalue

[Orrymain]

I actually found this forum from searching for solutions to a problem so I'm hoping I can get some help here.

Though it doesn't show up as a problem in my McAfee or CCleaner, my NoAdware program is finding this one problem:

hkey_classes_root]magnet\url pregvalue

I delete it but then it comes back every couple of days. It says it's associated with something called Bearshare, but I don't have this program (I've searched for the name to see if it downloaded with something else but nothing by the name comes up).

I'd like to get rid of this hkey thing so that it never comes up again. I have Win7.

I am not a computer expert, but can usually get around things if given detailed instructions.

Help would be appreciated.

 

[Lemur]

Bearshare is a peer-to-peer file sharing application. So is Kazaa. You probably had installed this at one time. How did you find this registry value? You could very well have a trojan, virus or malware.

First, uninstall your peer to peer software if you have it installed.

Download Hijackthis
HijackThis - Trend Micro USA

Follow these instructions...
Virus/Trojan/Malwer nesting on my system?? - Tech Support Forum

 

[Orrymain]

I don't have Bearshare on my computer though, and the real problem is that the HKEY registry isn't showing up in CCleaner, which I have and ran last night. It's only showing up when NoAdware does its scans, usually after a reboot or startup of the computer. It's like something is causing it to regenerate. I don't have Limewire. The only thing like that that I have is bittorrent, but I've had it for ages without problems or this HKEY registry. It's really strange.

 

[Tews]

These are registry keys for magnet links to p2p programs that use various networks (for example: Kazaa Media Desktop, Limewire, Morpheus, Shareaza, Bearshare, Xolox)

These keys may be used by malware to find installed p2p application and spread files. I would run a complete scan with your antivirus/anti malware program to make sure that it is totally removed..

If you are torrenting programs, it's likely where this is coming from..

 

[Dinesh]

First of all, I dont trust NoAdware.

 

[Orrymain]

Thanks both of you. I have definitely pinned it down now to the torrent client, which has never had this before. I just did a lot of experimenting, uninstalling, re-installing, and it's always after opening the torrent that this HKEY thing is coming up. I even tried getting a fresh copy of the torrent and it still happened. It also happened on the original .exe that I have on my hard drive, so I don't know what this is. However, it only shows up as an issue on NoAdware. I did download Hijack This and ran it a couple of times in the course of my experimenting over the past hour or so. It doesn't show that HKEY problem at all. Neither does CCleaner or my virusscan program. It's only NoAdware. The other thing I noticed is that if I delete the file, it won't come back until after I reboot and then reopen the torrent. For example, on this current boot of my computer, I opened the torrent client, ran all the scans, deleted the file, and closed the torrent program. Then I reopened the client and ran the scan again -- nothing. It won't come back until I reboot. So, is that still the program or is there something else going on?

 

[Tews]

The 100% sure fix is delete the program and stop torrenting software..

 

[Orrymain]

I just read something about denying programs from being able to open at startup. Is there a way to tell the computer not to allow this HKEY to run?

 

[Tews]

No... a registry setting is not a program...

 

[Orrymain]

Since I need the torrent program, any other suggestions?

 

[Tews]

More of a question... what do you need that you have to use a torrrent client program for?

 

[Orrymain]

Thanks for the responses. I've received the additional help that I needed elsewhere. All is well.

 

[pacinitaly]

busted