Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Spybot S & D continually notifies me of attempted registry change


  • This topic is locked This topic is locked

#1
colorful

colorful

    New Member

  • Member
  • Pip
  • 2 posts
Dear forum users,

I recently was concerned that I may have been infected with a worm/ virus, etc, so I have been researching and trying to take some steps against it.

I have SPySweeper anvtivirus/ antispyware installed, and I also have ZoneAlarm installed as my firewall.

On the advice of some other forums I decided to install also other anti-spyware and run them. Yesterday I was having troub;e connecting to the wireless connection and when I put my computer on "sleep" I could not resume the computer. When I forced shutdown, which the computer asked me if I want to open in Safe Mode, which I did, with networking.

In safe mode, I installed Spybot S & D and ran a check. It found several things which Spysweeper had not detected. I removed them all.

It also notified my that Spysweeper was attempting to change its own registry setting. The change seemed to involved a change from the normal registry entry to one that has quotes "" wrapped around it. I refused this change.

Then when I re-opened Vista in normal mode, I am continually (every few seconds) getting notice from Spybot S & D that it is automatically refusing the registry change.

Then today when I open Windows media Player I get the same notice of a change to the registry - involving adding or removing quotes to the registry entry.

Spybot entry reads:

Current filename: C:\Program Files\Windows Media Player\WMPNSCFG.exe

Database status: Necessity depends on users preferences
Value: WMPNSCFG
Filename: wmpnscfg.exe

Description
"Microsoft Windows uses wmpnscfg.exe to alert users when media rendering devices are found on the network. Wmpnscfg starts the Windows Media Player Network Sharing Service (NSS) and then waits for notifications from the service. When wmpnscfg is notified that a new media device is available on the network, it displays a popup in the system tray that informs the user about the availability of the new device. If the user clicks the popup, wmpnscfg launches Windows Media Player, which displays a dialog box that asks the user to either allow or deny sharing with the new device."


Is this a sign that some Malware is trying to change my registry entries, or is it a conflict between the two programs?

It is really strange to me to have these notices from Spybot continually coming up every few seconds, and I think it cannot be normal.

Please help! Thanks...
  • 0

Advertisements


#2
fenzodahl512

fenzodahl512

  • Malware Removal
  • 9,863 posts
Hello colorful, my name is fenzodahl512 and welcome to Geekstogo..

Please have a read at this topic and do all the preliminary steps given.

If you are using Windows Vista, or if you are using XP and already have Service Pack 1a or later, please ignore Step Three: Windows Updates and continue with Step Four: Reboot - Test

It should handle about 70% of your malware problem.. Should the problem still exist, please post a fresh HijackThis log here as shown in the Step Five: Posting a Hijack This Log.. Thank you :)

Regards
fenzodahl512
  • 0

#3
colorful

colorful

    New Member

  • Topic Starter
  • Member
  • Pip
  • 2 posts
Thanks, I will try the steps in the link.

I had to uninstall Spybot because it was driving me crazy, and I was having problems with my wireless connection, as well as extremely slow browsing.

Maybe I will reinstall it but disable Teatime.

Thanks very much for your reply...
  • 0

#4
fenzodahl512

fenzodahl512

  • Malware Removal
  • 9,863 posts
Ok, will wait for you :)
  • 0

#5
fenzodahl512

fenzodahl512

  • Malware Removal
  • 9,863 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP