Hi,

I recently went into regedit and I noticed this strange key:
HKEY_CURRENT_USER\S\P\4213549280 which has only two values MsgPrivacy and
Prompt both REG_DWORD and both 0s.

I did a search on the internet and only found one person who was complaining
about a similar entry. I have an updated antivirus (OneCare) and antispyware
(windows defender) and I haven't downloaded anything that could be suspicios
in the past month (other than IE7 Beta and Messenger Live Beta). Does anyone
know where this key is coming from? Thank you.

This is related to Windows Messenger. The number portion will vary from computer to computer. I haven't been able to determine what settings in Messenger these two values apply to.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display\Security
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"giovanni" <(E-Mail Removed)> wrote in message news:A2E8C6D3-A1A1-44B1-817C-(E-Mail Removed)...
> Hi,
>
> I recently went into regedit and I noticed this strange key:
> HKEY_CURRENT_USER\S\P\4213549280 which has only two values MsgPrivacy and
> Prompt both REG_DWORD and both 0s.
>
> I did a search on the internet and only found one person who was complaining
> about a similar entry. I have an updated antivirus (OneCare) and antispyware
> (windows defender) and I haven't downloaded anything that could be suspicios
> in the past month (other than IE7 Beta and Messenger Live Beta). Does anyone
> know where this key is coming from? Thank you.

"giovanni" <(E-Mail Removed)> wrote in message
news:A2E8C6D3-A1A1-44B1-817C-(E-Mail Removed)...
> Hi,
>
> I recently went into regedit and I noticed this strange key:
> HKEY_CURRENT_USER\S\P\4213549280 which has only two values MsgPrivacy and
> Prompt both REG_DWORD and both 0s.
>
> I did a search on the internet and only found one person who was
> complaining
> about a similar entry. I have an updated antivirus (OneCare) and
> antispyware
> (windows defender) and I haven't downloaded anything that could be
> suspicios
> in the past month (other than IE7 Beta and Messenger Live Beta). Does
> anyone
> know where this key is coming from? Thank you.

Reminded me of a thread we had on this a couple of years ago
http://groups.google.com/group/micro...7900e5211249f2

Someone called O Shah posted a good analysis
http://groups.google.com/group/micro...7cbb3a19d79465

Jon

Here's a *little* more info

HKEY_CURRENT_USER\S

http://www.msghelp.net/showthread.ph...003&pid=415992

http://forums.wugnet.com/Mystery-Reg...ict181773.html

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:A2E8C6D3-A1A1-44B1-817C-(E-Mail Removed),
giovanni <(E-Mail Removed)> hunted and pecked:
> Hi,
>
> I recently went into regedit and I noticed this strange key:
> HKEY_CURRENT_USER\S\P\4213549280 which has only two values MsgPrivacy and
> Prompt both REG_DWORD and both 0s.
>
> I did a search on the internet and only found one person who was
> complaining about a similar entry. I have an updated antivirus (OneCare)
> and antispyware (windows defender) and I haven't downloaded anything that
> could be suspicios in the past month (other than IE7 Beta and Messenger
> Live Beta). Does anyone know where this key is coming from? Thank you.

Thank you all for your reply. After searching the web some more, I found some
similar information. I am still not clear why Windows Messenger should create
this key (some of the answers were a little technical for me), but I guess I
will leave it alone for now. The important thing is that is is not spyware.
Thank you

"Wesley Vogel" wrote:

> Here's a *little* more info
>
> HKEY_CURRENT_USER\S
>
> http://www.msghelp.net/showthread.ph...003&pid=415992
>
> http://forums.wugnet.com/Mystery-Reg...ict181773.html
>
> --
> Hope this helps. Let us know.
>
> Wes
> MS-MVP Windows Shell/User
>
> In news:A2E8C6D3-A1A1-44B1-817C-(E-Mail Removed),
> giovanni <(E-Mail Removed)> hunted and pecked:
> > Hi,
> >
> > I recently went into regedit and I noticed this strange key:
> > HKEY_CURRENT_USER\S\P\4213549280 which has only two values MsgPrivacy and
> > Prompt both REG_DWORD and both 0s.
> >
> > I did a search on the internet and only found one person who was
> > complaining about a similar entry. I have an updated antivirus (OneCare)
> > and antispyware (windows defender) and I haven't downloaded anything that
> > could be suspicios in the past month (other than IE7 Beta and Messenger
> > Live Beta). Does anyone know where this key is coming from? Thank you.
>

Did I go blind or there is no more botton "This post was helpful, Yes, No?"

I am using IE 7 Beta, is there an issue with this browser or did I forget a
setting?

"Wesley Vogel" wrote:

> Here's a *little* more info
>
> HKEY_CURRENT_USER\S
>
> http://www.msghelp.net/showthread.ph...003&pid=415992
>
> http://forums.wugnet.com/Mystery-Reg...ict181773.html
>
> --
> Hope this helps. Let us know.
>
> Wes
> MS-MVP Windows Shell/User
>
> In news:A2E8C6D3-A1A1-44B1-817C-(E-Mail Removed),
> giovanni <(E-Mail Removed)> hunted and pecked:
> > Hi,
> >
> > I recently went into regedit and I noticed this strange key:
> > HKEY_CURRENT_USER\S\P\4213549280 which has only two values MsgPrivacy and
> > Prompt both REG_DWORD and both 0s.
> >
> > I did a search on the internet and only found one person who was
> > complaining about a similar entry. I have an updated antivirus (OneCare)
> > and antispyware (windows defender) and I haven't downloaded anything that
> > could be suspicios in the past month (other than IE7 Beta and Messenger
> > Live Beta). Does anyone know where this key is coming from? Thank you.
>

giovanni wrote:

> Did I go blind or there is no more botton "This post was helpful,
> Yes, No?"
>
> I am using IE 7 Beta, is there an issue with this browser or did I
> forget a setting?


You are using the web interface to read this newsgroup--it's the slowest,
clunkiest, most error-prone method there is. Do yourself a favor and switch
to a newsreader, such as Outlook Express, which comes with Windows. See
http://www.michaelstevenstech.com/ou...snewreader.htm

--
Ken Blake - Microsoft MVP Windows: Shell/User
Please reply to the newsgroup




> "Wesley Vogel" wrote:
>
>> Here's a *little* more info
>>
>> HKEY_CURRENT_USER\S
>>
>> http://www.msghelp.net/showthread.ph...003&pid=415992
>>
>> http://forums.wugnet.com/Mystery-Reg...ict181773.html
>>
>> --
>> Hope this helps. Let us know.
>>
>> Wes
>> MS-MVP Windows Shell/User
>>
>> In news:A2E8C6D3-A1A1-44B1-817C-(E-Mail Removed),
>> giovanni <(E-Mail Removed)> hunted and pecked:
>>> Hi,
>>>
>>> I recently went into regedit and I noticed this strange key:
>>> HKEY_CURRENT_USER\S\P\4213549280 which has only two values
>>> MsgPrivacy and Prompt both REG_DWORD and both 0s.
>>>
>>> I did a search on the internet and only found one person who was
>>> complaining about a similar entry. I have an updated antivirus
>>> (OneCare) and antispyware (windows defender) and I haven't
>>> downloaded anything that could be suspicios in the past month
>>> (other than IE7 Beta and Messenger Live Beta). Does anyone know
>>> where this key is coming from? Thank you.

Mmm don't troll about enough to use a newsreader, plus it alwasy worked
before. But maybe you are right, I will give it a though.

"Ken Blake, MVP" wrote:

> giovanni wrote:
>
> > Did I go blind or there is no more botton "This post was helpful,
> > Yes, No?"
> >
> > I am using IE 7 Beta, is there an issue with this browser or did I
> > forget a setting?
>
>
> You are using the web interface to read this newsgroup--it's the slowest,
> clunkiest, most error-prone method there is. Do yourself a favor and switch
> to a newsreader, such as Outlook Express, which comes with Windows. See
> http://www.michaelstevenstech.com/ou...snewreader.htm
>
> --
> Ken Blake - Microsoft MVP Windows: Shell/User
> Please reply to the newsgroup
>
>
>
>
> > "Wesley Vogel" wrote:
> >
> >> Here's a *little* more info
> >>
> >> HKEY_CURRENT_USER\S
> >>
> >> http://www.msghelp.net/showthread.ph...003&pid=415992
> >>
> >> http://forums.wugnet.com/Mystery-Reg...ict181773.html
> >>
> >> --
> >> Hope this helps. Let us know.
> >>
> >> Wes
> >> MS-MVP Windows Shell/User
> >>
> >> In news:A2E8C6D3-A1A1-44B1-817C-(E-Mail Removed),
> >> giovanni <(E-Mail Removed)> hunted and pecked:
> >>> Hi,
> >>>
> >>> I recently went into regedit and I noticed this strange key:
> >>> HKEY_CURRENT_USER\S\P\4213549280 which has only two values
> >>> MsgPrivacy and Prompt both REG_DWORD and both 0s.
> >>>
> >>> I did a search on the internet and only found one person who was
> >>> complaining about a similar entry. I have an updated antivirus
> >>> (OneCare) and antispyware (windows defender) and I haven't
> >>> downloaded anything that could be suspicios in the past month
> >>> (other than IE7 Beta and Messenger Live Beta). Does anyone know
> >>> where this key is coming from? Thank you.
>
>
>

[ronoray]

I posted this recently in Annoyances.org and only 1 user pointed it out that it had something to do with MSN Messenger.

You guys are talking about the key only in HKEY_CURRENT_USER

I found the key also in HKEY_USERS\S-1-5-21-1202660629-1580436667-854245398-500

My folders were:
S>P>3256059692

Inside which there are two REG_DWORDs which you guys have already mentioned:
The first one is called:
MsgPrivacy: On clicking Modify you get Value Data = 1 and
on clicking Modify Binary Data you get 0000 01 00 00 00 ....
and the second one is
Prompt: On clicking Modify you get Value Data = 0 and
on clicking Modify Binary Data you get 0000 00 00 00 00 ....

So as all of you mention this has something to do with the msngr program and I think that's true bcos I got worried about the folders and ran SuperantiSpyware and Malwarebytes and they did not come up with anything or deleted the folders.

So just relax these are harmless folders and the last folder comes up with different nos. for different comps.... as some of u are saying that it is a UNIX timestamp. don't know whether that's right.