Unable to access registry in XP Pro

[G Mulcaster]

Hi folks,

I'm infected with the W32.Spybot.worm. Part of the removal process,
according the Symantec Security Response website, involves editing the
registry.

When I activate Start/Run/regedit, the registry screen shows for about
one second then disappears.

Is my access turned off? If so, how do I make the switch? (It's my
computer, so I should have full administrator priviledges.)

Or, could it be the worm causing the lack of registry access?

The infected file is wincfg.scr in the C:\windows\system32 folder. I
have tried to delete it without success, likely because the file is
locked (in use?) by the worm. Any ideas for getting rid of a file
when access is denied?

Thanks, Gary
Please remove XXX in email address if email reply is desired.

 

[Kelly]

Hi,

Rename regedit.exe to regedit.com. Then you will be able to access it.
BTW, you should also turn off system restore while cleaning. Good luck!

Once all is done, run these two edits.

EXE Fix for Windows XP - Line 12 (Restores EXE association)
http://www.kellys-korner-xp.com/xp_tweaks.htm

Restore lnk association: (Line 12) Link File Fix for Windows XP
http://www.kellys-korner-xp.com/xp_tweaks.htm

To use the Regedits: Save the REG File to your hard disk. Double click it
and answer yes to the import prompt. REG files can be viewed in Notepad by
right clicking on the file and selecting Edit.

/xp_tweaks.htm

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm

 

[G Mulcaster]

Hi folks,

I'm infected with the W32.Spybot.worm. Part of the removal process,
according the Symantec Security Response website, involves editing the
registry.

When I activate Start/Run/regedit, the registry screen shows for about
one second then disappears.

Kelly and Raoul,

Thanks for the help. The regedit.com worked, but I still couldn't
delete the infected file (wincfg.scr) from the registry. That is,
after a few moments it would return.

In addition, I saved the Regedits, but could not keep the import
prompt on the screen long enough to select yes. Also other problems
were manifest; for example, the ctrl/alt/delete function would only
stay on the screen for a split second. Meanwhile, Norton AV was very
unhappy.

So, I spent the afternoon doing a clean install of XP. Now everything
is working fine!

Regards, Gary
Please remove XXX in email address if email reply is desired.

 

[Peter Hutchison]

Kelly and Raoul,

Thanks for the help. The regedit.com worked, but I still couldn't
delete the infected file (wincfg.scr) from the registry. That is,
after a few moments it would return.

The virus must be still in memory, load up TaskManager and End Process
for the virus task. Also you need to delete all the infected files as
well.

Peter Hutchison
Windows FAQ
http://www.pcguru.plus.com/