Can not make changes to registry.

[Guest]

I have never seen one like this. No matter what I do, I can not delete or
modify in the registry. It has been hit with virus and spyware but now shows
clean according to Trend Micro. After I say delete, if I go back to the
folder, the item is right back. I have also gone to MSCONFIG and tried
unchecking in startup. It comes right back. I have System restore turned
off. Any ideas??????

 

[Mark Dormer]

Yes, you haven't actually removed the virus.

You say you can't delete in the registry, but it sounds like you can.
What your seeing is a program replacing it's keys/values.
If you really can't delete/modify you would be getting a message telling you
that access is denied.
Do you get that?

You need to find the process that is running and kill it.
Try using http://www.xmlsp.com/pview/prcview.htm to kill the process
Then remove the keys

Regards
Mark Dormer

 

[Li'l Roberto]

Sounds like you have a variant of the CWS trojan.
Typically there is a hidden shield DLL that keeps recreating the
file you delete, it needs to be located and removed, it places a
value in the following key:
HK_Local_Machine\Software\Microsoft\windowsNT\ Current Version\Windows,
you will see it in the R\H pane in the appinit_DLLs value.
Removal can be difficult, I suggest you post details here you will
need to register .
http://forum.aumha.org/ they have experts who can advise you how
to locate and remove it.

rgds
Li'l Roberto

 

[Kelly]

Hi,

Is common. In most cases without using third party, this takes three steps.

1. Start/Run/Regedit

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Gain the exact path.
Note: Save these two to regedit favorites.

2. Start/Run/Msconfig/Startup

Gain the exact path.

3. Follow the path via Windows Explorer.

Leave/have all three windows opened, now open the Task Manager.

Once knowing the exact path, end the process via the Task Manager, then
delete the entry via Windows Explorer. From there, delete the run command
from both regedit and msconfig. With regedit still open, hit F5. If it
replaces itself, you didn't do it in a timely manner or you didn't follow
the exact placement path.

Note: In some cases, depending, you will be allowed to rename the .exe via
safe mode and then delete.

If the above hasn't helped:

Run Ad-Aware SE, Spybot, CWShredder and HijackThis:
http://www.majorgeeks.com/downloads31.html

Note: Update the first two programs, once installed, before running.

Free Online Virus Scan
http://housecall.trendmicro.com/housecall/start_corp.asp

Good luck and keep us posted!

--

All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com