Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

In HKEY_USERS\S-1-5-21-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxxx\Software\Microsof\TATrial and HKEY_LOCAL_MACHINE\SOFTWARE\Microsof\TATrial there are entries Default (no value set) InstallDate (733998) and UseCount (3). I do not have an antivirus on this machine because it's slow and am wondering if there is reason to be concerned?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

If I were to take a guess, I'd say that it had to do with some sort of software (possibly from Microsoft, but just as likely not) that you had installed a trial version of. The registry contents don't appear to be malicious; an install date and usage count isn't particularly insidious. If you're to be concerned, I'd think it would be for some other reason than this.

You're bound to find LOTS of registry entries you can't immediately place off-hand. That's sort of the nature of the registry.

share|improve this answer
    
just to point out it wasn't a typo that the key is in Microsof no Microsoft –  Celeritas Jan 16 '13 at 22:43
    
Or at least not your typo :) -- Companies will frequently try to hide their own registry keys under Microsoft's name. This particularly makes sense in the context of tracking product trials, since deleting the key would probably allow you to re-trial the software. –  tylerl Jan 16 '13 at 22:56

I would guess it could be a malware. I have very little to go off of, but I found a spanish forum (google translated below):

http://translate.google.com/translate?hl=en&sl=es&u=http://www.taringa.net/posts/info/3543215/Eliminar-Virus-Manualmente-y-Optimizar-la-PC.html&prev=/search%3Fq%3DHKEY_LOCAL_MACHINE%255CSOFTWARE%255CMicrosof%255CTATrial%26hl%3Den%26safe%3Dactive%26tbo%3Dd%26rls%3Dcom.microsoft:en-us:IE-Address%26biw%3D1280%26bih%3D706&sa=X&ei=i6L2UOyENpLW8gTs5YDoAg&ved=0CEcQ7gEwAg

Note specifically:

@ abinadar Hace 2 años

to me the folder appears inside RUN, reg_Z default value not set. and renunce, aparace the super antispyware you install. in the other there is nothing. but before the Microsoft folder, there is one called microsof (without the t at the end) this is bad? one says the other tatrial210 tareloc200

This person was noting the registry key called TATRIAL210 inside of "microsof" registry folder. A misspelling would more than likely be some form of malware.

EDIT: http://forum.sysinternals.com/microsof-reg-entrys-3_topic4953.html Possibly not virus. Are you using software called "Text aloud?"

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.