Deleted Registry Entries Come Right Back....Help :)

[Kirk]

I can't understand this and have never seen it before. I can't delete or
edit registry entries manually....as soon as I do, then go to another folder
in the registry and back again then the deleted entries are back. What the
hell is going on...........I did have some spyware that I finally got rid
of, but maybe I didn't. Adaware and Norton antivirus come back clean. As
far as I can tell Permissions are set high for me to be able to edit the
registry....I right-clicked on the run folder to check. What I'm trying to
delete is a spyware entry for SM1BG.EXE. I have deleted the .exe file from
the system, but I can't delete this entry from the registry......I also
can't get MS Money to not load Money Express at startup. I have reinstalled
and updated MS Money 2002. The problem seems to be the registry is write
protected or something agaist manual editing....as far as I know programs
are installing and uninstalling correctly....so they must be editing the
registry.

Does anyone have any help to offer on this? I have never had to change any
settings for this before.....I am logged in as the Adminstrator....actually
only 1 user setup on this system. Please email back also besides
posting....thanks

 

[Wesley Vogel]

To stop Money Express from running:

Open MS Money
On the Tools menu, click Options.
Click the Bills and Deposits tab.
Clear the Use Money Express check box, and then click OK.
Quit Money

SM1bg.exe is used by Napster. It is a
USB driver that connects to mp3 players.

SM1bg.exe is the "Cypress USB Mass Storage Adapter" from "Cypress
Semiconductor". I'm not sure when it was installed on my computer but I have
a feeling it came with either iTunes or Napster (the NEW Napster). If you
have either of these installed that might be where you installed it. It also
could have been installed with any sort of external usb storage like a usb
hd or usb flash memory reader

 

[Kirk]

I've tried that a bunch of times....after a reboot it still starts and I go
back in Money and it's checked off again,
It's weird....I'm close to reformatting and reinstalling. This still
doesn't explain not being able to edit the registry?
Is there a security setting that controls this?



Is there a worm or Trojan that does things like this

 

[Kirk]

Never mind I figured it out....since I got the spyware infection, I started
running that ad-watch program that comes with adaware....well it has a
setting to lock startup sections of the registry........problem
solved.....thank god I didn't start that format.

 

[Wesley Vogel]

Kirk,

Try this:

Open Registry Editor.
Start | Run | regedit | OK

Navigate to >>
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
MoneyAgent REG_SZ "C:\Program Files\Microsoft Money\System\mnyexpr.exe"

Right click: MoneyAgent in the right hand pane | Delete | Answer YES to:
Are you sure you want to delete this value?

Close Registry Editor.

Read up on Registry Permissions and check yours.

To assign permissions to a registry key
http://www.microsoft.com/resources/...xp/all/proddocs/en-us/regedit_permit_key.mspx