Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a machine that is obviously infected, and when I ran MalwareBytes it told me that it found some "malicious" registry keys (surprisingly enough these contained file path to currently non-existent javascript files). But, that's it. Full scan did not uncover any malicious files, or malicious hidden processes in memory. Like, maybe the (hidden?) process that for whatever reason periodically injects keystrokes (hotkeys?) into whatever currently open window.

Then on another, not obviously infected, machine it found a "malware.trace" registry key but again no files or processes etc.

How does this jive with people's experience with MalwareBytes? Does it usually find registry key symptoms of an infection but nothing else? Or is it a common thing to have no infection but some malicious registry keys in place anyway?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

It might be the case that another program (like your antivirus, CCleaner, or some other anti-malware app you've used) already deleted the files but left the Registry keys behind. It might also be the case that the malware relocated itself one or more times while trying to evade detection, or created decoy registry keys.

I've had good luck with MalwareBytes; it has detected and removed a lot of malware that other antivirus and anti-malware apps have failed to detect or remove. Every time someone I know gets tricked into installing one of those socially-engineered malware apps, like Microsoft Antivirus [insert year], MalwareBytes has had no problem removing it. That said, I don't trust any single program to catch everything. When someone gives me an infected computer, I usually run MalwareBytes, Spybot S&D or Ad-Aware, and Microsoft Security Essentials.

If you're still suspicious of an infection after running several detection and removal programs, BleepingComputer has some very helpful resources for identifying and removing malware, including instructions on how to use HijackThis to identify suspicious activity on your computer.

share|improve this answer
2  
MWB will also detect some 'normal' keys, such as disabling the Windows Firewall or Security Center notifications, as malicious, since those are commonly set by spyware. –  EKW Mar 19 '12 at 18:25

Don't panic, anything that MalwareBytes finds, please trust in them and remove whatever it finds, put it in Quarantined.

I just did a scan with Avast & all clear, then after I did a Quick scan with MalwareBytes, it found a registry key. Seems you can't trust just a single service. That's why I also use spybot.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.