I got hit

[John Hanson]

One of my machines was hit by the swen virus last night. I deleted
the randomly generated file which was substituting itself for regedit.
Now I can't run regedit or most anything else. When I try to run the
registry fix, I get the same error saying that registry editing has
been disabled by the administrator. Is there anyway to fix this?
I've tried logging in as administrator in safe mode and I get a
different error. Something like "unable to write to file" or
something similar.

 

[Nicholas]

Please visit the Virus experts in this newsgroup:
news://msnews.microsoft.com/microsoft.public.security.virus

--
Nicholas

---------------------------------------------------------------------------------


| One of my machines was hit by the swen virus last night. I deleted
| the randomly generated file which was substituting itself for regedit.
| Now I can't run regedit or most anything else. When I try to run the
| registry fix, I get the same error saying that registry editing has
| been disabled by the administrator. Is there anyway to fix this?
| I've tried logging in as administrator in safe mode and I get a
| different error. Something like "unable to write to file" or
| something similar.
|

 

[Larry Samuels MS-MVP XP \(Shell/User\)]

Special thanks go to Doug Knox MS-MVP for the following workaround:

Do the following:

Click Start, Run and enter CMD to open a Command Prompt window.
Then copy and paste the following commands into the Command Prompt window.

COPY %WINDIR%\System32\Taskmgr.exe %WINDIR%\System32\Taskmgr1.exe
COPY %WINDIR%\REGEDIT.EXE %WINDIR%\REGEDIT.COM
COPY %WINDIR%\PCHealth\HelpCtr\Binaries\MSCONFIG.EXE
%WINDIR%\PCHealth\HelpCtr\Binaries\MSCONFIG1.EXE

Then you can use the new file names to get into these utilities to use them
to help your troubleshooting.

--
Larry Samuels MS-MVP (Windows-Shell/User)
Associate Expert
Unofficial FAQ for Windows Server 2003 at
http://home.earthlink.net/~larrysamuels/WS2003FAQ.htm
Expert Zone -