2

I found a strange entry in Windows registry on two of my PCs, and posted it as a question on Stack Overflow, here: https://stackoverflow.com/questions/27716746/hklm-system-currentcontrolset-control-timezoneinformation-timezonekeyname-corrup

One of the top gurus there, a guy I highly respect, says it's probably the result of malware.

I know very, very little about malware, and would appreciate it if someone takes a look at my question at Stack Overflow and tells me what I should do.

So far I've run a full scan with Microsoft Security Essentials. On one PC it says "no threats were detected", on the other PC it's still running - 8 hours so far and only about 50% done. :-(

EDIT - beginning to think that this is "normal"

After running several of the suggested malware detection programs (one of which was so cryptic and ruthless that it scared me), and doing a lot more Googling, I'm beginning to suspect that my "corrupt" registry entry is actually normal. I've found two indications that the the TimeZoneKeyName entry in the registry is supposed to be 256 bytes, or 128 WCHAR REG_SZ, as it's called here: https://support.microsoft.com/kb/KbView/2001086

See also figure 7.13 in this book extract: https://books.google.dk/books?id=V9tgQI1QQyQC&pg=PA340&lpg=PA340&dq=regedit+timezonekeyname&source=bl&ots=jisKBTTO_s&sig=1uzMOn1RSpvkaNoun_-Q85h4zBE&hl=en&sa=X&ei=ghGlVKCsEuLNygOv1YKICw&redir_esc=y#v=onepage&q=regedit%20timezonekeyname&f=false

Just to confirm, I'd appreciate it if one or two people here would do me the favor of firing up regedit.exe, and navigating to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation, and right-clicking on TimeZoneKeyName, and selecting "Modify Binary Data...", and tell me how many bytes you see. I'm seeing hex 100, i.e., 256, on the three Windows 7 computers I have, and I'm beginning to think this is the way it's supposed to be.

Thanks in advance.

  • 1
    The value is also 256 bytes long on my machine (Vista SP2 x86) so you may be right that this is normal. Carelessness on Microsoft's part, I'd guess. – Harry Johnston Jan 2 '15 at 0:45
  • @HarryJohnston: Thank you. Please post something as an answer and I'll accept it. – RenniePet Jan 2 '15 at 8:02
1

As you suggested, it seems that this value is always malformed. If you remove the extra data, and then change the timezone, the extra data reappears. So it appears to be Windows itself that is doing this, not third-party software (malicious or otherwise).

I don't think it is likely to have been intentional, it is more likely to have been due to carelessness on Microsoft's part. (However, it might be being intentionally left as-is due to compatibility constraints.)

| improve this answer | |
1

You should try running a scan with Malwarebytes Antimalware. (Here - https://www.malwarebytes.org/mwb-download/) Its much better than Microsoft Security Essentials.

| improve this answer | |
  • Thanks for the recommendation. It's certainly much, much faster than Microsoft Security Essentials! I've run it on one of the two PCs, and it did not find any malware. Other recommendations, and especially any opinions about my specific registry problem, are still very welcome. – RenniePet Dec 31 '14 at 20:23
  • try using adwcleaner as well: bleepingcomputer.com/download/adwcleaner it finds other ones – Jeff Clayton Dec 31 '14 at 20:31
  • @JeffClayton: Thanks for the recommendation. AdwCleaner found two things it didn't like, Microsoft Bing Browser Helper Object and Microsoft Bing Bar. Still hoping for an opinion as to whether my modified registry entry is a sign of malware or not. – RenniePet Dec 31 '14 at 21:03
  • The Microsoft Bing stuff is probably not malware. I would assume its for the bing bar (in IE). You could get rid of it anyway. – TheKB Dec 31 '14 at 21:05
  • Very likely. The slash-zero is another way of saying 'end of string' -- in SQL Injection attacks on web database servers for example, they will issue a slash-zero and then a damaging command after it. The machine will think it is a real command after the other one has finished. If it is a real line of code in the Bing bar, as @TheKB mentioned, Microsoft should be ashamed... – Jeff Clayton Dec 31 '14 at 21:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.