Not able to open regedit or regedt32

[Andy]

Due to W32.Randex virus,I have been advised by Symantec
site to delete the registry keys having the virus mention
by going to Run and typing regedit etc.When I try to do
that an error message saying 'This operation has been
cancelled due to restrictions in effect on this
computer.Please contact your system administrator'. It is
a stand alone PC but I am using Win2K with SP4 and latest
updates.When I try to logon as administrator,I could open
regedit once but after that I am getting the same message
as administrator.

Please help.

 

[Dave Patrick]

Use the Group policy editor
%windir%\system32\gpedit.msc
User Config\Admin Templates\System\Prevent Access To registry Editing
Tools="Not Configured"

(usually spyware/ junkware that sets this Reg_Dword decimal value to 1)
DisableRegistryTools
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


:
| Due to W32.Randex virus,I have been advised by Symantec
| site to delete the registry keys having the virus mention
| by going to Run and typing regedit etc.When I try to do
| that an error message saying 'This operation has been
| cancelled due to restrictions in effect on this
| computer.Please contact your system administrator'. It is
| a stand alone PC but I am using Win2K with SP4 and latest
| updates.When I try to logon as administrator,I could open
| regedit once but after that I am getting the same message
| as administrator.
|
| Please help.

 

[Andy]

Thanks Dave.But the value was already set to "Not
configured" Shall I change it to Disabled ?

 

[Dave Patrick]

Also check;
%windir%\system32\gpedit.msc
User Config\Admin Templates\System\
'Don't run specified Windows applications'
'Run only allowed Windows applications'


--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


:
| Thanks Dave.But the value was already set to "Not
| configured" Shall I change it to Disabled ?

 

[Howard Kaikow]

AS I recall, somebody once suggested that a way around such a virus was to
use a 3rd party registry editor.
Would that work in this case?

 

[Dave Patrick]

Possibly but probably not necessary.

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


| AS I recall, somebody once suggested that a way around such a virus was to
| use a 3rd party registry editor.
| Would that work in this case?
|
| --
| http://www.standards.com/; See Howard Kaikow's web site.
| | > Also check;
| > %windir%\system32\gpedit.msc
| > User Config\Admin Templates\System\
| > 'Don't run specified Windows applications'
| > 'Run only allowed Windows applications'
| >
| >
| > --
| > Regards,
| >
| > Dave Patrick ....Please no email replies - reply in newsgroup.
| > Microsoft Certified Professional
| > Microsoft MVP [Windows]
| > http://www.microsoft.com/protect
| >
| >
| > "Andy" wrote:
| > | Thanks Dave.But the value was already set to "Not
| > | configured" Shall I change it to Disabled ?
| >
| >
|
|

 

[infested]

dave,

ive got exactly the same problem that andy wrote you about, and hav
exactly the same question that he asks you below. should "no
configured" be changed to "disabled"? if not, would you have any othe
ideas?

by the way, i get exactly the same error message when i try launchin
norton av that andy and i both get when trying to run/regedit: "thi
operation has been cancelled due to restrictions..." and my hosts file
is written to (blocking access to antivirus company web addresses) whe
i reboot.

thanks.

*Thanks Dave.But the value was already set to "Not
configured" Shall I change it to Disabled ?

-----Original Message-----
Use the Group policy editor
%windir%\system32\gpedit.msc
User Config\Admin Templates\System\Prevent Access To registry Editing
Tools="Not Configured"

(usually spyware/ junkware that sets this Reg_Dword decimal value to 1)
DisableRegistryTools
HKCU\Soeftware\Microsoft\Windows\CurrentVersion\Policies\Sy stem

--
Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect


:
| Due to W32.Randex virus,I have been advised by Symantec
| site to delete the registry keys having the virus mention
| by going to Run and typing regedit etc.When I try to do
| that an error message saying 'This operation has been
| cancelled due to restrictions in effect on this
| computer.Please contact your system administrator'. It is
| a stand alone PC but I am using Win2K with SP4 and latest
| updates.When I try to logon as administrator,I could open
| regedit once but after that I am getting the same message
| as administrator.
|
| Please help.


.

-
infeste