weird registry noticed in FRST

Lotan · 2017-03-03T19:41:22.000Z

so i did a random scan using FRST to look over and i noticed a registry that wasnt on the last scan i did.
HKU\S-1-5-21-3804374118-1414672728-3398495541-1002.…\MountPoints2: {896d96ed-ffa5-11e5-85c6-806e6f6e6963} - “Explorer.exe” monitor.htm
added the results here

i also did a adwcleaner scan and found something called "AdvinstAnalytics in my appdata\local\temp folder

malwarebytes didnt show anything

Eddy · 2017-03-03T19:45:51.000Z

Please also run Mbam and attach the log to your next post here.

Lotan · 2017-03-03T20:18:11.000Z

i used Adwcleaner and that issue it found is gone now
uploaded the malwarebytes scan but shows everything as clean

Lotan · 2017-03-03T21:45:51.000Z

i have now disconnected my pc from the internet

shortly after i saw it on frst i went into the regedit and saw there was only that explorer monitor.htm thing now i checked it again and found more folders one named " shell/autoplay/droptarget" so now im pretty sure my pc is infected

Lotan · 2017-03-03T22:05:19.000Z

ok so i think ive just transfered it to my windows tablet through a usb thumb drive as there wasnt any sign in reg edit but as soon as i connected the drive i got a droptaget show up so mcshield isnt picking it up

edit i think i stopped the spread to my tablet by removing the registry quick enough as nothng else has showed up there yet

Lotan · 2017-03-03T22:33:14.000Z

ive found that this "mountpoints2 folder that they are all in is connected to the USB and am wondering if its safe to just remove the whole folder and that will fix it all

Lotan · 2017-03-03T23:38:20.000Z

looked over some older frst logs (mainly ones ive uploaded here and found that the monitor.htm thing was there since atleast 22nd feb during the whole false positive issue but wasnt there in the 16th november scan i uploaded.
Is there a way to find out when a registry item was created?

Lotan · 2017-03-04T00:55:41.000Z

have run additional scans with EEK, Eset and tdsskiller online scanners and they all came back with no threats.

did a avast boot scan which came back clean

Lotan · 2017-03-04T08:54:38.000Z

ive read other posts on the net about mountpints 2 issues and they all asked for the regedit section exported for diagnostic so i thought i would do the same here

Lotan · 2017-03-04T14:56:28.000Z

update: just found out that the “explorer.exe” monitor.htm registry was the driver disk from my BenQ monitor,once i took the disk out the registry entry vanished , i feel stupid.

still dont know what these “shell/autoplay/droptarget” entries are though

Announcements