5 replies to this topic

[QWERTYWI]

I run a scan daily and this just showed up in my system... It appears that it just showed up based on the signature file update and online (first occurrence on Malwarebytes was 4/28)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPropertiesMyComputer (Disable.MCProperties) -> No action taken.

is this a false positive, or do I just IGNORE?

Thanks!

[miekiemoes]

Hi,

This is no false positive. This policy means that properties of "My computer" are disabled. If you have set it that way, then ignore it. The reason why it's now targetted by mbam is because recent malware sets this policy in order to disable the My computer Properties.

[QWERTYWI]

But I can currently right-click on the MY COMPUTER icon and bring up the properties just fine now... So that is how it should be, right?

miekiemoes, on Apr 29 2009, 10:33 AM, said:

Hi,

This is no false positive. This policy means that properties of "My computer" are disabled. If you have set it that way, then ignore it. The reason why it's now targetted by mbam is because recent malware sets this policy in order to disable the My computer Properties.

[QWERTYWI]

I looked at my registry:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer]
"NoCDBurning"=dword:00000000
"NoResolveTrack"=dword:00000000
"NoPropertiesMyComputer"=dword:00000000
"NoViewContextMenu"=dword:00000000
"NoFileAssociate"=dword:00000000
"NoFind"=dword:00000000
"NoRun"=dword:00000000
"NoClose"=dword:00000000
"StartMenuLogoff"=dword:00000000
"NoSMHelp"=dword:00000000
"HonorAutoRunSetting"=dword:00000001

The NoPropertiesMyComputer is set for 0 so I CAN view the MYComputer Properties... When I change it to 1 I can longer view them.

Shouldn't Malwarebytes detect it if it is set to 1 and not 0? For me it detected it as listed above.

Thanks!

[miekiemoes]

Hi,

Yes, but NoPropertiesMyComputer is not a default policy, so you can remove it with mbam. Most probably you are using a registry tweaking tool which has created these policies. No need to have these policies anyway if you don't enable it.

Quote

Shouldn't Malwarebytes detect it if it is set to 1 and not 0? For me it detected it as listed above.

I already requested to filter that - so this should be "fixed" in next update

[QWERTYWI]

Gotcha.... thanks!