How do u remove this registry key?

[Paul]

Hey all,

I'm a member of an online PC forum.

A guy from the UK, was having probs, with this entry, which popped up in a
Hijackthis log.

HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System,
DisableRegedit=1

I've been told that the System bit in the above registry entry doesn't exist
(well it doesn't exist on my system).

And the Policies entry above, isn't 1 word

(It's spaced. ie: Pol icies, not Policies, which is unusual).

(It's like a fake registry key).

He had:

mssearchnet.exe and nvctrl.exe on his system, which
I think are trojans.

He also had usbn.exe, (a dialler), intell32.exe,
Xhrmy.exe, and PSGuard.

He managed too get these files out of his system / the HJT log, but the
above registry remained. He also had to replace Wininet.dll.

He also ticked the above registry, entry in HJT, but it kept coming back!

He has now reformatted, and the above registry entry
has returned!

So, would anyone know, what this registry does, and what its part of.

According to one of his posts, even tho this registry entry, was still
there, he could still open task manager and regedit (I thought this entry
may have disabled these).

BUT it didn't.

Any info on how to get rid of:

HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System,
DisableRegedit=1 once and for all would be appreciated.

Thanx

 

[Trax]

|>Hey all,
|>
|>I'm a member of an online PC forum.
|>
|>A guy from the UK, was having probs, with this entry, which popped up in a
|>Hijackthis log.
|>
|>HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System,
|>DisableRegedit=1
|>
|>I've been told that the System bit in the above registry entry doesn't exist
|>(well it doesn't exist on my system).
|>
|>And the Policies entry above, isn't 1 word
|>
|>(It's spaced. ie: Pol icies, not Policies, which is unusual).
|>
|>(It's like a fake registry key).
|>
|>He had:
|>
|>mssearchnet.exe and nvctrl.exe on his system, which
|>I think are trojans.
|>
|>He also had usbn.exe, (a dialler), intell32.exe,
|>Xhrmy.exe, and PSGuard.
|>
|>He managed too get these files out of his system / the HJT log, but the
|>above registry remained. He also had to replace Wininet.dll.
|>
|>He also ticked the above registry, entry in HJT, but it kept coming back!
|>
|>He has now reformatted, and the above registry entry
|>has returned!
|>
|>So, would anyone know, what this registry does, and what its part of.
|>
|>According to one of his posts, even tho this registry entry, was still
|>there, he could still open task manager and regedit (I thought this entry
|>may have disabled these).
|>
|>BUT it didn't.
|>
|>Any info on how to get rid of:
|>
|>HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System,
|>DisableRegedit=1 once and for all would be appreciated.

Duct tape approach would be to download Spybot, it comes with tea
timer that would prevent the entry from being replaced once it's
removed.

Unless you know what's re writing it, and delete that.