locked
HKCU@S-1-5-21- RRS feed

  • Question

  • on my windows defender i keep seeing. permitted HKCU@S-1-5-21 etc..... then, warning can cause unwanted behaviour.

    why is defender allowing this, how can i stop it, how do i tell defender to do so. i believe this HKCU may be the cause of my IE disconnecting, not sure.

    no spyware/malware scans pick it up.

    any help for me.

     

    alan.

    Thursday, January 11, 2007 10:55 PM

All replies

  • I recall seeing a similar question on a blog site and I'm sure it had something to do with spyware having changed the registry hkey current user security level value in IE. try resetting security zones to default level and see if that works
    Sunday, January 21, 2007 1:44 PM
  • thanks eddie for your very welcome time. how can i access the security settings to reset at default in IE. alan.
    Sunday, January 21, 2007 11:38 PM
  • If you're already on internet explorer go to tools>internet options>security>at bottom of page reset all zones to default settings> select> apply >ok > it should now be at a medium-high setting> alternatively you can access same through control panel >internet options. It's a reasonably good level of security and will thereafter prompt you whether or not you wish to download any files that may be harmful. Hopefully it will work,if not I'll try to find the blog I saw it on and direct you there.
    Monday, January 22, 2007 12:24 AM
  • eddie

    yes of course, internet options, sorry about the daft question but you do get a little frustrated when our little boxes of torture we call a computor decides to have a sulk. reset as suggested thanks, i'll let you know how i get on. the disconnection problems isnt consistent so ill have to see. alan.

    Monday, January 22, 2007 11:58 AM
  • what you've got there is a Security Identifier (SID)

    s-1-5-21-746137067-492894223-854245398-1003

    I found it in my registry

    HKEY_CURRENT_USER\Software\Microsoft\Protected Storage System Provider\S-1-5-21-746137067-492894223-854245398-1003

     

    however, the prefix 's-1-5-nn' is for a 'well-known SID', but the MS list of such SIDs

     

    http://support.microsoft.com/kb/243330/en-us

     

    does not list it.  The list stops at 's-1-5-20'.

     

    So, it is either a new SID not yet listed by MS or it is a...

    Friday, February 2, 2007 11:41 PM
  • i was having the same warnings in windows defender. i have found the offending files in drivers. i have no idea what the files do and it is a little surprising to find that they are windows files. they were installed by me at some time as the installation date is after i bought the computer. i have deleted them and confined them to the recycle bin. i will know what they did when something stops working. if this happens i will let you know. if you wish to locate the files on your machine then key S-1-5-21 into an advanced search. hope this helps.

     

     

    I have restored the items as they appear to relate to Xcel files, applications and shortcuts on my desktop. Oops!

    Sunday, February 10, 2008 9:17 PM
  •  

    Monday, August 25, 2008 1:27 PM