System startup entry confuses

[safesite]

Hi,

I am running XP with Spybot S&D as one of my security programs. I'm very satisfied with the program. Especially with the system startup list and the toggle features.

Recently I got a new pc and installed XP and all the protection first. But after reviewing the startup list I found this entry.

Located: HK_LM:Run, (DISABLED)
command:
file:
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

I can't figure out what this is and there is no info text next to the entry as with any of the other entries. I somewhere read about that this is the "hash of nothing" but why is it there at all if so??? And what is it if it's malware or bad?

Anybody here that can shed a light on this one?

Thanks in advance for any help.

[honda12]

Hi,

From what I know (heh, not much!) - there is no need to worry! It is not bad

From Wikipedia: http://en.wikipedia.org/wiki/MD5

MD5 hashes

The hash of the zero-length string is:
MD5("")
= d41d8cd98f00b204e9800998ecf8427e

This explains the 0 byte size and confirms this 'hash of nothing', but I have no idea why it would appear though

[drragostea]

Sorry, to push in. honda12... this "MD5" or hash thing is confusing me! Can you explain it in detail? I've read the Wikipedia articles and heck I no idea what it is talking about. Thanks .

[honda12]

Sorry, to push in. honda12... this "MD5" or hash thing is confusing me! Can you explain it in detail? I've read the Wikipedia articles and heck I no idea what it is talking about. Thanks .

Yeah sorry, it is a little hard to explain but I think it is a software algorithm used to “fingerprint” a file or contents of a disk. It used to verify the integrity of data - so you can use it to check if a program installer is the legitimate .exe not some fake malware lol

[md usa spybot fan]

safesite

From the startup entry you posted, it looks like just a blank entry or a glitch in the format of the contents of the following registry key that causes Spybot to show that entry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run-

Since the item is listed as "DISABLED" in Spybot's Startup list, it is in the "…\Run-" registry key. Items in the "…\Run-" registry key are disabled and do not get loaded at system startup. Therefore the entry should not affect the running of any actual processes in your system. You can safely just ignore the entry. In other word that entry should not be affecting your system.

If you wish to pursue the matter further and clean up that registry key so that Spybot's Startup no longer shows that entry, that will take additional time for me to instruct you how to do that. Please let me know what you like to do. If you what to pursue the matter and clean up that registry entry, please answer the following:

1. What Windows operating system you are running.
2. Are you familiar with Registry Editor and a confident in using it.

[drragostea]

@honda12. Thanks, so these "hash" things are more like "fingerprints"? Where can I find them? Is it just like hovering it over the item or something? Thanks so much.

[honda12]

Heh, just look at under the download Spybot S&D link: http://www.spybot.info/en/download/index.html

[md usa spybot fan]

drragostea:

This thread was started by safesite about a startup entry problem.

I would sincerely appreciate it (and I'm sure safesite would too), if did not continue to hijack threads with your curiosity about MD5 hash values.

I attempted to explain MD5 hash values in this thread that you also hijacked on the subject:

• Cannot install Spybot 1.5.2
  http://forums.spybot.info/showthread.php?t=28052

If you would like to know about MD5 hash values and the above thread does not explain them to your satisfaction, please feel free to start your own thread in the Tavern forum and maybe someone else can explain it to you.

[drragostea]

@honda12. Thank you.
@md. I sincerely, apologize. I didn't realize that. This won't happen in the future. I won't continue posting irrelevant posts.

Regards.

[safesite]

safesite

From the startup entry you posted, it looks like just a blank entry or a glitch in the format of the contents of the following registry key that causes Spybot to show that entry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run-

Since the item is listed as "DISABLED" in Spybot's Startup list, it is in the "…\Run-" registry key. Items in the "…\Run-" registry key are disabled and do not get loaded at system startup. Therefore the entry should not affect the running of any actual processes in your system. You can safely just ignore the entry. In other word that entry should not be affecting your system.

If you wish to pursue the matter further and clean up that registry key so that Spybot's Startup no longer shows that entry, that will take additional time for me to instruct you how to do that. Please let me know what you like to do. If you what to pursue the matter and clean up that registry entry, please answer the following:

1. What Windows operating system you are running.
2. Are you familiar with Registry Editor and a confident in using it.

Hi MD,

and thanks for your reply.

I am currently not having any trouble with my Windows or other programs due to this entry (except one tiny problem which is my logging out of Hotmail - escpecially in Firefox and sometimes in Explorer - but I don't know if that could be related to this problem. Don't think so though).

If it's not a problem it may stay as it doesn't matter so much to me in that case. I got it disabled anyhow. The only thing I was really curious about is why it's there and what it's use is.

You stated that you think it's a corruption in the "Run key" that you were mentioning in your last post. But what is this "Run key" used for? What does it do? Where does it belong to?

If you could enlighten me on this one I'd really appreciate it.

Thanks in advance.

To your questions:

1. XP SP3
2. Familiar with: yes. Running it: yes but might need some help.

Ah and by the way..., yes I appreciate it as well...