SYSTEM key missing in registry

[Guest]

Does anyone know why my SYSTEM key would be missing from under
HKEY_LOCAL_MACHINE? All of a sudden it has disappeared and I can't figure
out how to get it back.

 

[George Hester]

Have you tied looking at in regedt32? It has to be there (maybe unseen) for the System wouldn't work without it.

Start | Run | regedt32 | OK | Window | HKEY_LOCAL_MACHINE on Local Machine Check the permissions on it. Just check.

 

[Guest]

Thanks for your help. Yes, I did check regedt32 and there are no branches at
all under HKEY_LOCAL_MACHINE in there. I checked the permissions on the
HKEY_LOCAL_MACHINE entity and the administrators group has read and full
control. I am logged in as the administrator. This is very confusing...any
other help would be appreciated.

 

[George Hester]

It just can't be. I have heard of this happening due to virus activity, hacking or spyware. Let me give you an
example:

One time I went to the command prompt and typed in cscript. I knew full well I had that on the system. The
result was command unknown. That was very disconcerting. I went into C:\WINNT\system32 looking for it and
it was there but it wasn't working. It turned out files had been introduced into the system by a hacker in Austria
or some such place one called hidden32.exe. After I removed all the files this creep put on my system and tried
cscript.exe again it was working.

So maybe something has gotten into your system which is hideing this branch from you? The system will not work
at all without it. All your devices are in here as well as your services. If your services have started and are
running you have that key and its branches. Furthermore note than no virus scan caught these files. No spyware
catcher nothing did. I found them because I was looking for unusual files in C:\WINNT\system32.

 

[Guest]

I'm aware of some hacker activity on this server. However, I have cleaned up
everything and have verified that there are no rogue files installed in the
system32 folder and no running processes and/or services that should not be
there. Is there anything a hacker could do to prevent me from getting to
these registry settings by effecting group policies or something?

 

[George Hester]

I suggest you go into system32 in the command prompt and run attrib or dir /b /o:d /a:h That will show you all (or
hidden) files in there. Believe me, I didn't have anything running either. There was nothing fishy going on in Task
Manager; nothing in the software keys in the registry; nothing. The file itself was easy to move so it wasn't running. But yes they can do this and it has been talked about in the Security group here as well as elsewhere.

Something is hiding that key. Something is. If you have running Services then that's the only thing it can be.
Maybe a valid process but a process.

 

[Guest]

I did't find anything in the system32 folder but I found a service called
"defence" and I also ran the free online virus scan at www.antivirus.com
(even though I run Symantec on the box) and it found WORM_AGOBOT.DG. After
cleaning up those items the SYSTEM key returned! Thanks for pushing me to
look harder.