2

I found a strange entry in Windows registry on two of my PCs, and posted it as a question on Stack Overflow, here: https://stackoverflow.com/questions/27716746/hklm-system-currentcontrolset-control-timezoneinformation-timezonekeyname-corrup

One of the top gurus there, a guy I highly respect, says it's probably the result of malware.

I know very, very little about malware, and would appreciate it if someone takes a look at my question at Stack Overflow and tells me what I should do.

So far I've run a full scan with Microsoft Security Essentials. On one PC it says "no threats were detected", on the other PC it's still running - 8 hours so far and only about 50% done. :-(

EDIT - beginning to think that this is "normal"

After running several of the suggested malware detection programs (one of which was so cryptic and ruthless that it scared me), and doing a lot more Googling, I'm beginning to suspect that my "corrupt" registry entry is actually normal. I've found two indications that the the TimeZoneKeyName entry in the registry is supposed to be 256 bytes, or 128 WCHAR REG_SZ, as it's called here: https://support.microsoft.com/kb/KbView/2001086

See also figure 7.13 in this book extract: https://books.google.dk/books?id=V9tgQI1QQyQC&pg=PA340&lpg=PA340&dq=regedit+timezonekeyname&source=bl&ots=jisKBTTO_s&sig=1uzMOn1RSpvkaNoun_-Q85h4zBE&hl=en&sa=X&ei=ghGlVKCsEuLNygOv1YKICw&redir_esc=y#v=onepage&q=regedit%20timezonekeyname&f=false

Just to confirm, I'd appreciate it if one or two people here would do me the favor of firing up regedit.exe, and navigating to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation, and right-clicking on TimeZoneKeyName, and selecting "Modify Binary Data...", and tell me how many bytes you see. I'm seeing hex 100, i.e., 256, on the three Windows 7 computers I have, and I'm beginning to think this is the way it's supposed to be.

Thanks in advance.

Improve this question
2
  • 1
    The value is also 256 bytes long on my machine (Vista SP2 x86) so you may be right that this is normal. Carelessness on Microsoft's part, I'd guess.
    – Harry Johnston
    Jan 2, 2015 at 0:45
  • @HarryJohnston: Thank you. Please post something as an answer and I'll accept it.
    – RenniePet
    Jan 2, 2015 at 8:02

2 Answers 2

Reset to default
1

As you suggested, it seems that this value is always malformed. If you remove the extra data, and then change the timezone, the extra data reappears. So it appears to be Windows itself that is doing this, not third-party software (malicious or otherwise).

I don't think it is likely to have been intentional, it is more likely to have been due to carelessness on Microsoft's part. (However, it might be being intentionally left as-is due to compatibility constraints.)

Improve this answer
1

You should try running a scan with Malwarebytes Antimalware. (Here - https://www.malwarebytes.org/mwb-download/) Its much better than Microsoft Security Essentials.

Improve this answer
7
  • Thanks for the recommendation. It's certainly much, much faster than Microsoft Security Essentials! I've run it on one of the two PCs, and it did not find any malware. Other recommendations, and especially any opinions about my specific registry problem, are still very welcome.
    – RenniePet
    Dec 31, 2014 at 20:23
  • try using adwcleaner as well: bleepingcomputer.com/download/adwcleaner it finds other ones
    – Jeff Clayton
    Dec 31, 2014 at 20:31
  • @JeffClayton: Thanks for the recommendation. AdwCleaner found two things it didn't like, Microsoft Bing Browser Helper Object and Microsoft Bing Bar. Still hoping for an opinion as to whether my modified registry entry is a sign of malware or not.
    – RenniePet
    Dec 31, 2014 at 21:03
  • The Microsoft Bing stuff is probably not malware. I would assume its for the bing bar (in IE). You could get rid of it anyway.
    – TheKB
    Dec 31, 2014 at 21:05
  • Very likely. The slash-zero is another way of saying 'end of string' -- in SQL Injection attacks on web database servers for example, they will issue a slash-zero and then a damaging command after it. The machine will think it is a real command after the other one has finished. If it is a real line of code in the Bing bar, as @TheKB mentioned, Microsoft should be ashamed...
    – Jeff Clayton
    Dec 31, 2014 at 21:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .