Reg entry.....what is it?

I found this in the reggie:

HKEY_LOCAL_MACHINE\Software\c0BP43OAgALypU3Sm-rPQCWW

anyone have any idea what this is???

Thx
k

 

is it something to do with internet explorer?

give us a clue?

 

Hummm, thats why i'm asking here....?

I don't have the slightest idea and wondered if someone here has the same reg entry and maybe did know?

CU8er
k

 

Knucles

That my friend looks very suspicious to me!

Local Machine software is where the names of installed programs are listed. Software vendors do not use cryptic names like this! Some of the other registry hives do have very cryptic entrys.

But not HKLM software! And if they did it would normally (but not always) show up in the add/remove in control panel!

I believe it is probably spyware/adware at least or a Virus at worst.

Let me know what you find. I administer close to 1000 workstations in 61 different networks. So for my advantage let me know what you find! I have never seen this one!

My advice. Update your Virus scanner to the latest defs. Setup the Virus program to do it's deepest and most through scan and do all! If you happen to have more than 1 virus scanner do the same with both even if the 1st does or does not find anything!

Next Download Adaware newest ver and confirm newest dat files and do a full deep scan!

Next run a Trojan/worm scanner like Tfak or Cleaner3 or Wormfree!

Even if you find it with the 1st thing run all of these one after the other.

If you don't find anything let me know and we will go into it deeper. But I think you will find something!

Do you have anything in add/remove you do not know about?
Do you use Kazza or Morpheus, Bonzi buddy, Gator, Webshots?
All of these either contain or are spyware/adware!

Do you have any other suspicious symptom?

Mike

 

I've never used Kazza, Morpheus, Bonzi buddy, Gator, or Webshots and my virus is upto date and doesn't show anything but i'll try anything u suggest. I've never had any funny stuff happen now or before.

What worm thing would u suggest.....?

thx
k

 

Thats surprising!

Some spy/adware only invade privacy! Or invite trouble in later! May not show symtoms.

So download Aadware at http://www.lavasoft.de/ install and do a deep scan!

Let us just do this before we proceed!

Let me know I am ready to continue!

Mike

 

I just ran it and it found this:

Started extended registry scan
===============================
BrilliantDigital key:HKEY_CLASSES_ROOT\.b3d\
Alexa key:HKEY_LOCAL_MACHINE\software\microsoft\internet explorer\extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}\


Registry scan result:
Suspicious keys found : 2


Started folder scan
====================
Folder scan result:
Folders processed:4488
Suspicious folders found:0

I had it remove them and i'll check to see if it's still around tomm.

Thx
k

 

Alexa (harmless) but uless too!


But BrilliantDigital B3D was probably our boy!

Normally comes with Kazaa but is bundled with other products also!

What have you downloaded and installed lately?

You didn't mention the strange Reg entry, did this remove it?

Hope this got it!


Mike

 

It didn't remove the reg entry.....so i did, with no ill effects

I seem to try a trial d/l 2-3 times a week. install/remove but don't have any idea which cos it. I don't do file sharing and never have so it's a mystery.

Thx All
k

 

WOW! That's the exact same line that my AdAware found yesterday! Same system name and the Type was Regkey. I had AA remove it and save it to a file. Is it still sitting in my registry? Do I need to manually remove it? Sounds like a sneaky one here.

 

WOW! That's the exact same line that my AdAware found yesterday! Same system name and the Type was Regkey. I had AA remove it and save it to a file. Is it still sitting in my registry? Do I need to manually remove it? Sounds like a sneaky one here.

 

Panda

Yes!

I should have had Knucles do this, but go to to the registry entry highlight it and export it say to your desktop!

Then edit the reg file with wordpad and copy everything then past it back in a message to me. I would like to see this thing.

I think we are dealing with 2 things here!

The Brilliant and alexa (I know about them) are being found by Adaware and is removing them.

Normally Adaware would remove this other (cryptic entry entry if it dectected it. So this thing is maybe something else!

After export mannually delete this entry! I don't think so but you can reenter it later from the export if needed. Knucles has had no problem since deleting it!

Mike

 

I just looked in my registry and it's not there any more. I guess AA removed it. I can only assume that it's really not there any more and it won't cause any problems. I wonder what it is. Never heard of Alexa. Don't remember downloading anything special lately that would make it come up. I usually do an AA scan about once a week or more and I was gone for 2 weeks. My last two scans were clean, so I must have picked this one up just before I left or while I was surfing after I got back.

(ADMIN...can you delete that double post please? Sorry!)

 

OK!

Thanks Panda!

I droped the ball on that one! Shoula let Knucles send it to me!

Later,
Mike

 

AA found a suspicious key during a scan. AlexaKey\HKLM\IE\extensions with the indentical numbers but it is not listed as a BrilliantDigital key; however after reviewing this thread and relying on the info, I am confident a deletion is not a problem. Thanks.

 

Actually Ken this one (Alexa) comes from Microsoft! Brilliant is something else get rid of it too if you do get it!

It is not a microsoft product but is included with IE!

After a windows update it will come back! Harmless! I don't know what it does (nobody does!) Smile! Some kind of search utility! But is a type of adware/spyware!

Most get rid of it simply because it is hidden not documented!

I remove it!

Mike

 

I finally gave up and told Ad-Aware to ignore Alexa. Because everytime I take it out and even do a repair if IE it comes back.

This may be just onother one of BillyBob's ways but he says "Clean up the reg. Then cleanup the backups of same once you find all is going to be OK. "

I have in the past removed keys such as mentioned and others, only to find that they were right back in place ( some even causing errors ) when I had to do a scanreg /restore to fix one of my Skrewups.

Backups are nice. But they can also undo any repairs we may have made.

BillyBob

 

Thanks for the additional input and the heads up to alexa and Brilliant.