what does it mean for MalwareBytes to find malicious registry keys but nothing else?

Question

I have a machine that is obviously infected, and when I ran MalwareBytes it told me that it found some "malicious" registry keys (surprisingly enough these contained file path to currently non-existent javascript files). But, that's it. Full scan did not uncover any malicious files, or malicious hidden processes in memory. Like, maybe the (hidden?) process that for whatever reason periodically injects keystrokes (hotkeys?) into whatever currently open window.

Then on another, not obviously infected, machine it found a "malware.trace" registry key but again no files or processes etc.

How does this jive with people's experience with MalwareBytes? Does it usually find registry key symptoms of an infection but nothing else? Or is it a common thing to have no infection but some malicious registry keys in place anyway?

Solution

It might be the case that another program (like your antivirus, CCleaner, or some other anti-malware app you've used) already deleted the files but left the Registry keys behind. It might also be the case that the malware relocated itself one or more times while trying to evade detection, or created decoy registry keys.

I've had good luck with MalwareBytes; it has detected and removed a lot of malware that other antivirus and anti-malware apps have failed to detect or remove. Every time someone I know gets tricked into installing one of those socially-engineered malware apps, like Microsoft Antivirus [insert year], MalwareBytes has had no problem removing it. That said, I don't trust any single program to catch everything. When someone gives me an infected computer, I usually run MalwareBytes, Spybot S&D or Ad-Aware, and Microsoft Security Essentials.

If you're still suspicious of an infection after running several detection and removal programs, BleepingComputer has some very helpful resources for identifying and removing malware, including instructions on how to use HijackThis to identify suspicious activity on your computer.

Comments

[EKW]

MWB will also detect some 'normal' keys, such as disabling the Windows Firewall or Security Center notifications, as malicious, since those are commonly set by spyware.