Possible malware modification of Windows registry entry

Question

I found a strange entry in Windows registry on two of my PCs, and posted it as a question on Stack Overflow, here: https://stackoverflow.com/questions/27716746/hklm-system-currentcontrolset-control-timezoneinformation-timezonekeyname-corrup

One of the top gurus there, a guy I highly respect, says it's probably the result of malware.

I know very, very little about malware, and would appreciate it if someone takes a look at my question at Stack Overflow and tells me what I should do.

So far I've run a full scan with Microsoft Security Essentials. On one PC it says "no threats were detected", on the other PC it's still running - 8 hours so far and only about 50% done. :-(

EDIT - beginning to think that this is "normal"

After running several of the suggested malware detection programs (one of which was so cryptic and ruthless that it scared me), and doing a lot more Googling, I'm beginning to suspect that my "corrupt" registry entry is actually normal. I've found two indications that the the TimeZoneKeyName entry in the registry is supposed to be 256 bytes, or 128 WCHAR REG_SZ, as it's called here: https://support.microsoft.com/kb/KbView/2001086

See also figure 7.13 in this book extract: https://books.google.dk/books?id=V9tgQI1QQyQC&pg=PA340&lpg=PA340&dq=regedit+timezonekeyname&source=bl&ots=jisKBTTO_s&sig=1uzMOn1RSpvkaNoun_-Q85h4zBE&hl=en&sa=X&ei=ghGlVKCsEuLNygOv1YKICw&redir_esc=y#v=onepage&q=regedit%20timezonekeyname&f=false

Just to confirm, I'd appreciate it if one or two people here would do me the favor of firing up regedit.exe, and navigating to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation, and right-clicking on TimeZoneKeyName, and selecting "Modify Binary Data...", and tell me how many bytes you see. I'm seeing hex 100, i.e., 256, on the three Windows 7 computers I have, and I'm beginning to think this is the way it's supposed to be.

Thanks in advance.

Answer 1

You should try running a scan with Malwarebytes Antimalware. (Here - https://www.malwarebytes.org/mwb-download/) Its much better than Microsoft Security Essentials.

Answer 2

As you suggested, it seems that this value is always malformed. If you remove the extra data, and then change the timezone, the extra data reappears. So it appears to be Windows itself that is doing this, not third-party software (malicious or otherwise).

I don't think it is likely to have been intentional, it is more likely to have been due to carelessness on Microsoft's part. (However, it might be being intentionally left as-is due to compatibility constraints.)