Strange registry entries

[Bryan Glennon]

I had deleted a PST file and was going to remove the registry entries
for it when I noticed the following entries in a cslid key:

MSPAB: ']gAVn-}f(ZXfeAR6.jiWORDAddressBookFiles>muT]jI{jf(=1&L[-81-]
Personal Address Book\pab
OUTLOOK: ']gAVn-}f(ZXfeAR6.jiWORDAddressBookFiles>muT]jI{jf(=1&L[-
81-]Outlook Address Book\olk
SPLUS: ']gAVn-}f(ZXfeAR6.jiWORDAddressBookFiles>muT]jI{jf(=1&L[-81-]
Schedule+ Contacts\scd


They struck me as very odd. Any ideas as to where they originated?

Thanks,
Bryan

 

[Guest]

I had deleted a PST file and was going to remove the registry entries
for it when I noticed the following entries in a cslid key:

MSPAB:
']gAVn-}f(ZXfeAR6.jiWORDAddressBookFiles>muT]jI{jf(=1&L[-81-]
Personal Address Book\pab
OUTLOOK: ']gAVn-}f(ZXfeAR6.jiWORDAddressBookFiles>muT]jI{jf(=1&L[-
81-]Outlook Address Book\olk
SPLUS:
']gAVn-}f(ZXfeAR6.jiWORDAddressBookFiles>muT]jI{jf(=1&L[-81-]
Schedule+ Contacts\scd


They struck me as very odd. Any ideas as to where they originated?

Search the registry on the CLSID key's name. You might find it is used
by a firewall, intrusion protection software (IDS), anti-virus software,
or something else that encrypts its registry keys to prevent malware
from altering those values without the product detecting the change due
to a change in the hash value for it. As I recall, Norton Anti-Virus
encrypts most of its registry keys to prevent tampering of them by
malware. So unless you know WHAT uses that CLSID key then you don't
know if it should be encrypted or not or if it might simply be
corrupted.