Help! May have a hidden registry key - how to fix?

I've been working on this PC for several days (which may have had CWS on it, but can't find it now with multiple tools) and I have used several rootkit detectors (sophos and rootkit shark), etc. Sophos finds a hidden registry key:

HKEY_USERS\S-1-5-21-436374069-1897051121-839522115-500\ (broken to ease reading) Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dll

and RKShark doesn't.

The long alphanumeric after the first slash isn't the same on that machine, but it's the same key. When you use regedit to look at their registry, you don't see the .dll entry listed, while sophos shows that this big long string is in there. And as I said, RKShark says the registry is clean.

Questions:
1- Which one should I believe?
2- How does one fix such a thing (when RK Shark which promises to detect and fix such things can't see it)?

I know the .dll entry is pretty empty on my machine and is quite visible in regedit.

Thanks for giving it a look!

bh

 

Sounds like a possible rootkit infection, please follow our standard cleaning procedures:

http://www.majorgeeks.com/images/grenade.gif Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

• Make sure you check version numbers and get all updates.

http://www.majorgeeks.com/images/grenade.gif Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

http://www.majorgeeks.com/images/grenade.gifAfter doing ALL of the above and you still have a problem, make sure you have booted to normal mode and run the steps in the below thread to properly use HijackThis and attach the log:

http://www.majorgeeks.com/images/grenade.gif Downloading, Installing, and Running HijackThis

• Make sure you also rename HijackThis.exe as suggested in the procedures. Use analyse.exe for the new name. This is very important due to some new infections going around..

http://www.majorgeeks.com/images/grenade.gifWhen you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too:

• CounterSpy
• AVG Antispyware log - ONLY IF NEEDED you were not able to run CounterSpy
• Bitdefender - from step 6
• Panda Scan - from step 6
• runkeys.txt - the log from GetRunKey.bat
• newfiles.txt - the log from ShowNew.bat
• HijackThis

NOTE: You can only attach 3 files in a single message so it will require that you use two messages to attach all of these logs!