Registry changes by itself

In XP Home SP2, a friend said he got a message while online something like "Ad-Aware has discovered a change to (something), Do you want to go back to the original settings? He clicked Yes and all his shortcuts and exe files stopped working. He can't tell me exactly what the message said or even what he was doing when this happened. First, I ran sfc but no problems were found.

I tracked the problem to the following registry keys:

HKCR\.exe\(Default) - changed from exefile to blank,
HKCR\.exe\Content Type\application/x-msdownload - deleted,
HKCR\.lnk\(Default) - changed from shortcut to blank.

When I restore them to the correct values in safe mode and reboot into normal, the shortcuts are okay, but after about a minute or so they change to generic icons and stop functioning. A check of the registry shows the above keys have been altered again. I disabled all the startup programs and it still happens.

I am getting clean virus scans in nod32 and clean spyware scans in Ad-Aware and Spybot. This is really making me nuts.

 

I recommend that you post a HiJackThis log in the Security forum. Some gremlin has evidently come on board and is able to hide from you. The things that you reset are only the effects while the cause is still aboard to reverse your actions. I'm sure the experts in Security can sort it out for you.

Don't be afraid to try System Restore in the meantime, if it was enabled.