P
peg2009
I'm running WinXP Pro, SP2. I messed up while trying to remove a trojan with
instructions in an article from Symantec. Article said to remove changes in a
list of registry keys, if required. Some of the keys in my registry had the
same value as on the list in Symantec's article, some did not. I started
changing the ones that differed from the values in the Symantec article. Then
I realized the article must be showing the "bad" values that might have been
assigned by the trojan. So I was changing to the wrong values.
I had made a backup of the registry before doing any editing, but when I
tried to import it, I got the message that it could not be imported because
some keys were in use. ("All data was not written.")
I had changed maybe 8 keys, all in
HK_Local_Machine\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\
I went back after trying to import the registry backup file and checked
these keys against the values in the Symantec article. Some do appear to have
gone back to a previous value, but I can't be sure now if all of them are
changed back. Also, most of them had the same value as the potentially "bad"
value in the Symantec writeup. In short, now I don't know what would be the
right values for any of these registry keys.
Of course, the first thing I did was to disable System Restore per the
Symantec instructions, so I can't go to a restore point.
My questions:
1. What did the original error message I got when importing the backup
registry file mean? That the backup wasn't good, or that it just couldn't be
restored because programs were running?
2. Would other parts of the registry have been affected/corrupted by my
attempting to import a file unsuccessfully?
3. Is there any other way to correct these keys such as through Internet
Settings?
4. Is there anything else I can do? Is there a way to diagnose what other
problems I might have caused?
The method I used to create a registry backup was to run a tool on
Symantec's site, linked in their writeup.
I really appreciate any help.
instructions in an article from Symantec. Article said to remove changes in a
list of registry keys, if required. Some of the keys in my registry had the
same value as on the list in Symantec's article, some did not. I started
changing the ones that differed from the values in the Symantec article. Then
I realized the article must be showing the "bad" values that might have been
assigned by the trojan. So I was changing to the wrong values.
I had made a backup of the registry before doing any editing, but when I
tried to import it, I got the message that it could not be imported because
some keys were in use. ("All data was not written.")
I had changed maybe 8 keys, all in
HK_Local_Machine\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\
I went back after trying to import the registry backup file and checked
these keys against the values in the Symantec article. Some do appear to have
gone back to a previous value, but I can't be sure now if all of them are
changed back. Also, most of them had the same value as the potentially "bad"
value in the Symantec writeup. In short, now I don't know what would be the
right values for any of these registry keys.
Of course, the first thing I did was to disable System Restore per the
Symantec instructions, so I can't go to a restore point.
My questions:
1. What did the original error message I got when importing the backup
registry file mean? That the backup wasn't good, or that it just couldn't be
restored because programs were running?
2. Would other parts of the registry have been affected/corrupted by my
attempting to import a file unsuccessfully?
3. Is there any other way to correct these keys such as through Internet
Settings?
4. Is there anything else I can do? Is there a way to diagnose what other
problems I might have caused?
The method I used to create a registry backup was to run a tool on
Symantec's site, linked in their writeup.
I really appreciate any help.
