Re: adware installed as a trusted certificate in registry

From: Diggy (jamesOU812_at_hotmail.com)
Date: 01/01/04 

Date: Thu, 1 Jan 2004 13:51:54 +0900

Hey Phonedaddy! Glad to see this post! On my comp also, Pest Patrol found
two reg entries in the Trusted Certificate key, and the entries were said to
be from Claria, which raised a red flag. However, I have not seen any
strange behavior. I also have Zone Alarm, and have not seen any unusual
outgoing activity, except OSE.EXE (this may or may not be related to the
Claria reg entries).

Here are the reg entries:
Pest Detected in
HKEY_CURRENT_USER\software\microsoft\systemcertificates\trustedpublisher\crl
s
Pest: Claria
User Action: registry entry ignored, NOT Quarantined

Pest Detected in
HKEY_CURRENT_USER\software\microsoft\systemcertificates\trustedpublisher\ctl
s
Pest: Claria
User Action: registry entry ignored, NOT Quarantined

So what's the deal with this stuff? Is it a mistake by PP? And do these
reg entries mean that there are, in fact, certificates from Claria on my
computer? If so, how the heck can you remove them? (I tried looking at the
list of certificates viewable from IE, but I can't see any with the name
Claria or Gator. Most of the certificates there have names that mean
nothing to me.) 

-- 
ICQ#
"phonedaddy" <anonymous@discussions.microsoft.com> wrote in message
news:BFE35283-2AE5-40EC-96B3-190381A82789@microsoft.com...
| I have an issue concerning registry settings for trusted certificates in
my XP Home Edition PC. My spyware/malware utility Pest Patrol reports that
Claria Corporation has installed a trusted certififcate in my registry. Pest
Patrol is able to temporarily remove this annoyance, however it seems to
reinstall itself after a few browses on the internet. SpyBot S and D,
AdAware 6.0 and Mcafee VirusScan do not report this adware annoyance since
it is registered in the PC as a trusted certificate. When the adware is
active it affects the browser web pages with a 404 Server cannot be found
error or a page that doesnt load properly, incomplete or not at all. I also
get an error message stating that my system clock setting is incorrect and
needs to changed when trying to login from MSN Explorer. I try synchronizing
the clock and that doesnt help. When I clean the Claria adware with Pest
Patrol everything works fine again until the adware updates or reinstalls
itself. I am not able to view this trusted certificate in IE 6, however I
have noticed some suspicious registry settings that have meaningless symbols
under the HKEY_CURRENT_USER/SOFTWARE/MICROSOFT/SYSTEM CERTIFICATES. How can
I refresh the system certificates without getting this adware certificate
back in?  I am not comfortable with editing this part of the registry and
also not comfortable with an adware companie's certificate in my PC. Please
advise. Thanks.
Loading