What is Deleting this Registry Key?

Discussion in 'other software & services' started by Krusty, Mar 8, 2018.

  1. kaljukass

    kaljukass Registered Member

    Joined:
    Apr 27, 2011
    Posts:
    244
  2. Cutting_Edgetech

    Cutting_Edgetech Registered Member

    Joined:
    Mar 30, 2006
    Posts:
    5,694
    Location:
    USA
    You could also be having a conflict where two applications are trying to access the registry key at the same time, and causing it to be lost. I would at least backup that registry key so you can easily restore when needed.
     
  3. Azure Phoenix

    Azure Phoenix Registered Member

    Joined:
    Nov 22, 2014
    Posts:
    1,556
    Are you using Malwarebytes Premium? Perhaps its settings for registering on the Windows Security Center are causing the issue.

    If you haven't already, try setting it to never register.
     
    Last edited: Mar 8, 2018
  4. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,209
    Location:
    Among the gum trees
    It is set to never register on all machines.
     
  5. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,209
    Location:
    Among the gum trees
  6. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    8,592
    Location:
    U.S.A.
    What @mood suggested previously or using another security solution that can selectively monitor registry modification activity is the only way you're going to be able to definitively find out what app is deleting the registry key.
     
  7. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,209
    Location:
    Among the gum trees
    I'm inclined to agree.
    I also agree with you itman, but for now I'm not sure I need anymore programs installed.

    I've just found that bleepingcomputer have created the required registry key if anyone needs it.

    https://www.bleepingcomputer.com/ne...curity-updates-unless-avs-set-a-registry-key/

    You'll find it right at the bottom of that page (before the comments). I'm downloading to all machines in case I need it in the future.
     
    Last edited: Mar 8, 2018
  8. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,209
    Location:
    Among the gum trees
    Hi @mood , I've taken your advice. I trust you and I certainly trust the dev' so I guess I've got nothing to lose. Thanks for your advice as always. :thumb:

    As suggested, I deleted EVERYTHING in the Rules.DB, pasted your code and saved as Rules.DB.

    I guess the culprit will show up before long. Now we wait. :ninja:
     
  9. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,209
    Location:
    Among the gum trees
    Well that did not work! The key has been deleted once again and nothing shows in the log.

    Grrr!
     
  10. stapp

    stapp Global Moderator

    Joined:
    Jan 12, 2006
    Posts:
    23,933
    Location:
    UK
  11. 142395

    142395 Guest

    @stapp , the same thing is mentioned in #19 by Cutting_Edgetech. I personally also recommend registry audit.
     
  12. stapp

    stapp Global Moderator

    Joined:
    Jan 12, 2006
    Posts:
    23,933
    Location:
    UK
    I knew I'd seen it somewhere but overlooked that post.

    (note to self..get new glasses :D )
     
  13. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,209
    Location:
    Among the gum trees
    The key comes and goes all by itself. It is back again on this machine at the moment. If the key is only needed for Windows updates I have a copy if and when I need it.

    I'm over trying to sort it. My head hurts. :confused:

    Thanks again for all the suggestions.
     
  14. Minimalist

    Minimalist Registered Member

    Joined:
    Jan 6, 2014
    Posts:
    14,881
    Location:
    Slovenia, EU
    I wouldn't bother with it, if OS updates run OK. Maybe system is doing something by itself, especially if you have WD enabled and running.
     
  15. itman

    itman Registered Member

    Joined:
    Jun 22, 2010
    Posts:
    8,592
    Location:
    U.S.A.
    Per the bleepingcomputer.com link posted above:
    It is possible the Window Defender Security Center on Win 10 1709 "does something" with the key when WD is the active realtime AV employed. Also I believe you keep switching back and forth between Norton and WD which I am sure not helping in regards to this issue.
     
  16. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,209
    Location:
    Among the gum trees
    Actually, I only reinstalled Norton because this issue has been bugging me while using WD. The key is currently present on this machine once again.
     
  17. Callender

    Callender Registered Member

    Joined:
    Jan 9, 2015
    Posts:
    172
    Location:
    London UK
    FYI: I use CCEnhancer and have no issues with that registry key.

    You might try MJ RegWatcher and add key to be monitored.

    https://jacobsm.com/mjsoft.htm#rgwtchr

    I launch it from an elevated shortcut.

    If performance suffers you can adjust these settings:

    MJRegWatcher_Engine_Tuning.jpg

    Use additional keys editor to add key:

    MJ RegWatcher Add Keys.jpg

    MJ RegWatcher Additional Keys Editor.jpg

    Then back in the main window prefix keys like this:

    $hkey_lmus\software\microsoft\windows\currentversion\qualitycompat
    $hkey_lmus\software\microsoft\windows\currentversion\qualitycompat\cadca5fe-87d3-4b96-b7fb-a231484277cc

    So you end up with:

    MJ RegWatcher Add.jpg

    Then save changes and relaunch MJ RegWatcher.

    If the key(s) get modified or deleted you should get a time stamped alert.

    MJ RegWatcher Alert.jpg

    Hopefully you get the process name but if not check the log viewer for process launches at that time or maybe additionally run ProcessLoggerService and compare logs.

    https://www.wilderssecurity.com/threads/process-logger-service.392757/
     

    Attached Files:

    Last edited: Mar 10, 2018
  18. Krusty

    Krusty Registered Member

    Joined:
    Feb 3, 2012
    Posts:
    10,209
    Location:
    Among the gum trees
  19. The_PrivaZer_Team

    The_PrivaZer_Team Developer

    Joined:
    Feb 14, 2013
    Posts:
    1,077
    Location:
    France
    PrivaZer does not delete the qualitycompat key.
     
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.