unknown registry keys

  • Thread starter Thread starter slr2002
  • Start date Start date
S

slr2002

I recently was bombarded with a few Trojans. I have
everything fairly cleaned up but I noticed two executables
running in the taskmanager that are unfamiliar. I have
tried in vain to find any information about them. They are
wshntz.exe and wpnctfrm.exe. In the regisrty they reside
in
Hkey_local_machine\software\microsoft\windows\currentversio
n\run (the registry value appears as rF6W3qW Reg_SZ
wpnctfrm.exe) and
Hkey_Current_user\software\microsoft\windows\currentversion
\run (the registry value appears as aop6RkapQ Reg_SZ
wshntz.exe

I am fairly certain that these values do not belong in the
registry but as stated before I can not find any
information on these and do not want to err and erase
something I shouldn't. If anyone has had any dealings with
these or knows what they are I would greatly appreciate
it.
 
Not part of the operating system. Almost without question spyware/junkware.
Export the keys prior to deleting the values.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

:
|I recently was bombarded with a few Trojans. I have
| everything fairly cleaned up but I noticed two executables
| running in the taskmanager that are unfamiliar. I have
| tried in vain to find any information about them. They are
| wshntz.exe and wpnctfrm.exe. In the regisrty they reside
| in
| Hkey_local_machine\software\microsoft\windows\currentversio
| n\run (the registry value appears as rF6W3qW Reg_SZ
| wpnctfrm.exe) and
| Hkey_Current_user\software\microsoft\windows\currentversion
| \run (the registry value appears as aop6RkapQ Reg_SZ
| wshntz.exe
|
| I am fairly certain that these values do not belong in the
| registry but as stated before I can not find any
| information on these and do not want to err and erase
| something I shouldn't. If anyone has had any dealings with
| these or knows what they are I would greatly appreciate
| it.
 
You're welcome.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

|I was failry certain this was the case. Thank you for the
| confirmation.
 
Back
Top