0

I run a program called Registry Mechanic, every night. Every single time, it picks up like 8 Microsoft Antimalware entries, which it identifies as the highest kind of security threats.

I feel like Registry Mechanic is a good software--it was recommended to me at #computerhelp on irc.undernet.org, a long time ago, by an op that never steered me wrong, otherwise--, so I feel like I should give the issue due attention.

The entries are: 4x "HKEY_LOCAL_MACHINE\software\Microsoft Antimalware" and 4x "HKEY_LOCAL_MACHINE\software\Microsoft Antimalware\setup\RememberedProperties"

10
  • Do you have any Microsoft's anti-malware tools installed? If so, RM might be just identifying a false positive. False positives always happen – especially because many anti-malware tools use various obscure tricks to protect themselves from being deleted by viruses, and this itself might be confused with malicious behavior. Sep 16, 2012 at 11:51
  • I can't find a program called "Microsoft Antimalware" on the internet, and I haven't installed one. If it has been installed, it's the result of a security update. Sep 16, 2012 at 12:33
  • @grawity, I checked add/remove programs, including windows components, and it's not showing up there. I believe it's only malware and not a false positive. Sep 16, 2012 at 12:40
  • 1
    @Wolfpack'08 Its a leftover from Microsoft Security Essentials, or Windows Defender is running on that PC, check control panel for Windows defender. Knowing your Operating System would be nice and if you have any other active AV software installed. I would not remove those entries.
    – Moab
    Sep 16, 2012 at 16:57
  • 2
    @Wolfpack'08 Defender is installed by default in Windows Vista and W7 and W8, its part of the installation. Please edit your question to include the OS.
    – Moab
    Sep 17, 2012 at 0:10

1 Answer 1

1

Under your circumstances that you have it looks like malware. The only way to truly get rid of malware is to format and reinstall Windows. You of course can try software like Malware Bytes to get rid of the malware but that doesn't guaranty it isn't still on your system. Before you format and install Windows again make sure to check your backups.

8
  • NStorm, Thanks for the response. Actually, I've been experiencing some very unusual issues. For example, when I start the machine, there's a 2-minute delay before I can open any programs. When I double-click something, it never opens, even though the signal is sent.... Also, the computer has begun to lag a lot more. I've already given Malware Bytes and several other softwares a shot.... Sep 17, 2012 at 6:31
  • It's kind of obvious to me that the other posters have been wrong in their responses. I don't have any reason to believe that these keys are associated with authentic Microsoft software, and they haven't posted any sources verifying that they are associated with them. I spoke with the other people who use the PC, and they have no memory of having ever installed Windows Defender or Microsoft Security Essentials. There's no Add/Remove Programs entry, even under Windows Components. I'm sure I would have seen it if it had come in, and I haven't found any resolved issue like this on the net. Sep 17, 2012 at 6:33
  • @Wolfpack'08 Yup, it defiantly looks like you need to format your hard drive and start again.
    – NStorm
    Sep 17, 2012 at 6:34
  • Still, I doubt I need to format the PC. While formatting isn't a huge issue, seeing as how I already have backups, I like to learn how to cure the PC of a problem, if possible, so I can save other victims some time. There are missing steps I have yet to perform. For example, running anti-malware programs in Safe Mode. I'm not sure why StackExchange is hard selling Malware Bytes. Must be sponsored.... Sep 17, 2012 at 6:36
  • @Wolfpack'08 Running a boot time scan (you can do that with Avast!) may put the virus in a 'vault' but it is known that the only way to be 100% sure of a removal is to format at do a clean install. Anyone who tells you otherwise is probably getting money from an anti-virus company or is not sure how that sort of stuff works.
    – NStorm
    Sep 22, 2012 at 4:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .