MS Antispyware and Cydoor

[Vel]

I recently (Friday) posted a message regarding MS
Antispyware and a problem I've been having with Cydoor. I
learned of this particular NG and figured it would be a
good place to reiterate my question. Note that my computer
completely locks up if I continue to let MS Antispyware run
as described below. Here is the text, along with the
initial response, of my original post:

BY VEL:
Hello,

I recently downloaded and installed MS Antispyware. I also
have Ad-Aware
and Spybot installed on my computer. Whenever I run MS
Antispyware it
discovers a Registry Key for Cydoor, then hangs there and
subsequently eats
up my ram until I crash. I tried to go into the Registry
Editor to remove
the key, but an error that reads something like: Cannot
Delete: Error while
deleting key. I've tried restarting in safe mode,
completely uninstalling
Spybot and Ad-Aware and deleting their old quarantine
files, running those
two programs (which never find the Reg Key BTW), etc. I
just can't seem to
get rid of it. It doesn't seem to be doing anything, no
running processes or
anything (I removed much else to do with Cydoor long ago
using one of the
other programs).

I quite like the MS Antispyware program (I've used it on my
work PC), and
would rather not uninstall, but as it stands its useless as
it always locks
up my system when it discovers Cydoor. Anybody have any
recommendations?

Vel

RESPONSE BY TEJAS PATEL
Provide more information on what kind of registry entries
do you see
detected.

What are the programs that are installed on your system
which are
integrated with Internet Explorer?

Here is the list of registry entries that you might want to
delete
(make sure you know what you are doing):

HKEY_USERS\.DEFAULT\Software\Cydoor
HKEY_USERS\.DEFAULT\Software\Cydoor Services
HKEY_CURRENT_USER\Software\Cydoor
HKEY_CURRENT_USER\Software\Cydoor Services
HKEY_LOCAL_MACHINE\Software\Cydoor

If the problem still persists, provide more details.

Tejas Patel

RESPONSE BY VEL
I know I have the following Registry Keys:

HKEY_CURRENT_USER\Software\Cydoor
HKEY_LOCAL_MACHINE\Software\Cydoor

I may also have the key:
HKEY_USERS\.Default\Software\Cydoor
I haven't checked for it.

However, when I try to delete them I get an error that reads:

"Cannot Delete: Error while deleting key"

or something very similar, and nothing happens.

When discovered by MS Antispyware the program hangs when it
finds the cydoor
key and just continuously runs, scanning the same spot in
the registry, and
creating a slow memory leak that eventually overwhelms my
computer and causes
a crash. The keys are not discovered by AdAware or Spybot
(which makes me
wonder if they were at some point quarantined by one of
these programs).

I have attempted to log on in safe mode under
administrator, but I still get
the same message. It reminds me of when attempting to
delete a file that is
"in use", but it isn't a file, and it isn't in use. By the
way, there is
nothing listed under the Cydoor key other than (Default),
REG_SZ, (value not
set); so I imagine that the key isn't harming my computer
in any way, other
than by causing MS Antispyware to crash my computer... and
annoying me for
not allowing itself to be deleted.

Any more suggestions on how I might get rid of this
particularly bothersome
little reg key?

 

[Bill Sanderson]

You need to take ownership of the key, so that you can remove it.

If this is XP Home, you'll need to be signed in a administrator in safe mode
to do this.

In XP Pro, you may need to turn off simple file sharing--not sure about that
detail.

In XP Pro, to take ownership of such a key, you would

run regedit
navigate to the key and right click it
choose permissions,
click on advanced,
click on the owner tab, check off Replace owner on subcontainers and objects
click on a listed owner to change the ownership to, and click apply.