Problem beim Löschen eines Reg Keys

[Andi Reisenhofer]

Hallo,

Ich versuche einen Key von einem Programm (www.winhound.com) zu entfernen
das sich immer wieder bei mir
"einnistet".

Der Schlüssel
HKEY_LOCAL_MACHINE\SOFTWARE\WinHound.com\WinHound\WinHound\License lässt
sich
mit regdit auch nicht öffnen. Fehlermeldung "Fehler beim Öffnen des
Schlüssels" License kann nicht geöffnet werden.

Wenn ich mit folgendem Programmcode den Schlüssel zu löschen versuche
bekomme ich
"Ein Unterschlüssel kann nicht gelöscht werden, da der Unterschlüssel nicht
vorhanden ist"


RegistryPermission regPerm;
RegistryPermission perm = new RegistryPermission (
RegistryPermissionAccess.AllAccess,
@"HKEY_LOCAL_MACHINE\SOFTWARE\WinHound.com\WinHound\WinHound\License");
perm.Demand ();
RegistryKey rkHKLM = Registry.LocalMachine;
RegistryKey rkEncryptionKey = null;
rkEncryptionKey = rkHKLM.OpenSubKey
(@"SOFTWARE\WinHound.com\WinHound\WinHound",true);
rkEncryptionKey.DeleteSubKey (@"License");
rkEncryptionKey.Close ();

Unlogisch da der Key mit regedit gesehen wird.
Ist das möglich das der zu löschende Key gesperrt wird oder korrupt ist?

VD.
GR. Andreas

 

[Ignacio Machin \( .NET/ C# MVP \)]

Hi,

This is an english group , most of the people (me included) knows no german

 

[Willy Denoyette [MVP]]

Hallo,

Ich versuche einen Key von einem Programm (www.winhound.com) zu entfernen
das sich immer wieder bei mir
"einnistet".

Der Schlüssel
HKEY_LOCAL_MACHINE\SOFTWARE\WinHound.com\WinHound\WinHound\License lässt
sich
mit regdit auch nicht öffnen. Fehlermeldung "Fehler beim Öffnen des
Schlüssels" License kann nicht geöffnet werden.

Wenn ich mit folgendem Programmcode den Schlüssel zu löschen versuche
bekomme ich
"Ein Unterschlüssel kann nicht gelöscht werden, da der Unterschlüssel
nicht
vorhanden ist"


RegistryPermission regPerm;
RegistryPermission perm = new RegistryPermission (
RegistryPermissionAccess.AllAccess,
@"HKEY_LOCAL_MACHINE\SOFTWARE\WinHound.com\WinHound\WinHound\License");
perm.Demand ();
RegistryKey rkHKLM = Registry.LocalMachine;
RegistryKey rkEncryptionKey = null;
rkEncryptionKey = rkHKLM.OpenSubKey
(@"SOFTWARE\WinHound.com\WinHound\WinHound",true);
rkEncryptionKey.DeleteSubKey (@"License");
rkEncryptionKey.Close ();

Unlogisch da der Key mit regedit gesehen wird.
Ist das möglich das der zu löschende Key gesperrt wird oder korrupt ist?

VD.
GR. Andreas

The reason that you can't delete the sub-key is that it's 'protected',
that's also the reason why you can't open it with regedit. Guess that the
key has an ACL that gets set by the program to protect it from deletion,
what are you trying to achieve here?

Willy.


Willy.

 

[Andi Reisenhofer]

Hallo Willy Denoyette,

Sorry I posted it to the wrong newsgroup.
Nevertheless I will try explain in English.
First thanks for your lines, you nearly found out what the situation I have.

The Winhound Anti Spyware Software from www.winhound.com got installed on 2
of my
PC's like a Trojan or Back Door. I told the Winhound company but they told
that it is not their
practice to do so.
Fact is that their Setup (WinHoundInstaller.exe) is creating a Key in the
HKEY_LOCAL_MACHINE\SOFTWARE registry path.

I deinstalled with their Uninstall.exe Programm but it didn't remove
the HKEY_LOCAL_MACHINE\SOFTWARE\WinHound.com key.
Also their WinHound.exe is not removed from the HKLM\...\Run Key.
What makes me crazy is that if I try to remove the
HKEY_LOCAL_MACHINE\SOFTWARE\WinHound.com key than
it is not possible because
HKEY_LOCAL_MACHINE\SOFTWARE\WinHound.com\WinHound\WinHound\License
cannot be opened or deleted. My trial with the C# Code also didn't work, so
I try to get some informations from
the C# gurus to accomplish this. It is a shame that a company doesn't create
a good Uninstall.exe Programm
and now waste my time (days). I wrote that company many mails with all
details be no answer.

You can try yourself if you want. You only have to donwload
http://download.winhound.com/WinHoundInstaller.exe
and than install and uninstall it and than you will see that the registry
key:
HKEY_LOCAL_MACHINE\SOFTWARE\WinHound.com\WinHound\WinHound\License
cannot be opened or removed.

Thanks f. any hints, to get "winhound" out of my registry.
Regards Andreas

 

[Willy Denoyette [MVP]]

Did you try to remove the WinHound.exe from HKLM\..\Run? Note that you
should kill the WinHound process (if it's running) before doing so. Once
this is done you could try to remove the key.
If this all fails again, you will have to kill the process and run regedit
in a SYSTEM logon session.

Willy.

 

[Andi Reisenhofer]

Hallo Willy,

- Yes I removed WinHound.exe from HKLM\..\Run key
- No process from WinHound is running
- I put a cleanup.bat to
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
with content:
regedit C:\temp\winnhound.reg
winnhound.reg:
REGEDIT4
[-HKEY_LOCAL_MACHINE\Software\WinHound.com]

- I stopped all systemstarts and Systemservices with msconfig.

Nothing helped, no success (

any ideas left?
Regards Andras

 

[Andi Reisenhofer]

Hallo Willy,

After fideling around serveral hours I found the reason why the key

was not deleteable. It had NULL's on the end.
With the VERY GOOD tool from Mark Russinovich
http://www.sysinternals.com/Utilities/RegDelNull.html
I could delete the key with the following command:

RegDelNull hklm\SOFTWARE -s

RegDelNull v1.00 - Delete Registry keys with embedded Nulls
Copyright (C) 2005 Mark Russinovich
Sysinternals - www.sysinternals.com

Null-embedded key (Nulls are replaced by '*'):

HKLM\SOFTWARE\WinHound.com\WinHound\WinHound\License*

Delete? (y/n) y
Scan complete.

I am so happy now, to found
Reg. Andreas

 

[Denoyette Willy [MVP]]

Hello Andi,

Hallo Willy,

After fideling around serveral hours I found the reason why the key

was not deleteable. It had NULL's on the end.
With the VERY GOOD tool from Mark Russinovich
http://www.sysinternals.com/Utilities/RegDelNull.html
I could delete the key with the following command:
RegDelNull hklm\SOFTWARE -s

RegDelNull v1.00 - Delete Registry keys with embedded Nulls
Copyright (C) 2005 Mark Russinovich
Sysinternals - www.sysinternals.com
Null-embedded key (Nulls are replaced by '*'):

HKLM\SOFTWARE\WinHound.com\WinHound\WinHound\License*

Delete? (y/n) y
Scan complete.
I am so happy now, to found
Reg. Andreas

Great, this trick is often used by malware.

Willy.

 

[Abubakar]

translation using altavista babel fish (http://babelfish.altavista.com/tr):

Hello, I try to remove a key from a program (www.winhound.com) again and
again with me "einnistet". The key
HKEY_LOCAL_MACHINE\SOFTWARE\WinHound.com\WinHound\WinHound\License cannot be
opened with regdit also. Error message "error when opening the key" License
cannot be opened. If I try to delete with the following program code the key
get I "a Unterschluessel can am not deleted, there the Unterschluessel is
missing"
after the code:

The key illogically there is seen with regedit. Is that possible the key
which can be deleted closed becomes or is corrupt?

Ab.
http://joehacker.blogspot.com