Forensics: Hotmail Registry Entries

I am performing a Forensics Investigation.  On a few servers I noticed the following registry entries related to hotmail.  

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Hotmail\Protocols\mailto\DefaultIcon
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Hotmail\Protocols\mailto\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Hotmail\shell\open\command
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Hotmail
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Hotmail|DLLPath

   This does not strike me as normal.  I am trying to determine if this is innocent or not.  I am grepping through other logs and know the other sources to look for things, but I want to find out if anyone has any thoughts in relation to these registry entries.

Thanks,

Awakenings
awakeningsAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

abelenkiyCommented:
This is normal.
0
stevebradburyCommented:
These registry keys are there by default on a fresh windows 2003.  I also see them in a fresh windows 7 install and I'm sure I would see the same on a server 2008 install.

I would say they are innocent.
0
awakeningsAuthor Commented:
Hmm...  The strange thing is that I don't see them on all servers.  I only see them on a few select servers.  It makes me curious.  Any ideas why?  Are these installed if SMTP is used?  There has to be more.

Thanks for your replies though...
0
ON-DEMAND: 10 Easy Ways to Lose a Password

Learn about the methods that hackers use to lift real, working credentials from even the most security-savvy employees in this on-demand webinar. We cover the importance of multi-factor authentication and how these solutions can better protect your business!

awakeningsAuthor Commented:
Maybe they are installed if outlook is installed then not installed if outlook isn't installed (at least through add / remove windows components.
0
abelenkiyCommented:
I have a feeling they are part of Outlook Express or an IE version that contains it when updated.
0
awakeningsAuthor Commented:
Can anyone find any sources of information?  The conflicting information is bothering me.
0
awakeningsAuthor Commented:
Ya...  I saw those links and I googled before I posted.  They don't really tell me exactly what causes those registry entries.  The servers where I see this are not configured for email (and should not be).  Very few of our other servers have these registry entries.  This is why I am so puzzled.

Thanks,

Awakenings
0
abelenkiyCommented:
http://msdn.microsoft.com/en-us/library/dd203067(VS.85).aspx
http://en.wikipedia.org/wiki/Hotmail
Hotmail is tied into windows as it belongs to microsoft now.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
awakeningsAuthor Commented:
Abelenkiy,

    That is exactly what I was looking for.

Thanks,

Awakenings
0
abelenkiyCommented:
No problem
Glad it worked out.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
OS Security

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.