registry editor disabled!!!

[satbir]

hey ALL!!
I'm using a HCL lappy with windows XP SP2,ZAP and AVG
actually i stay in a hostel and i am on a wireless network.......... there was some virus on d network and my system got infected...... i was facing weird probs..........l so i installed AVG and it detected 70 infected files.......... i removed all those files

1) after few days i noticed that my folder options were missing.......... from explorer as well as from the control pannel......... so i tried accessing the registry editor(to enable folder options).......... but regedit is not opening up.......... it says registry editor is disabled by ur administrator.... i am have only one account on my system.

Please tell me a way how i can re-enable my registry editor...........
dnt ask me to format the system cuz the coll guys hav installed an orignal copy of WINDOWS on my system but they hav not given us the CD...... and i dnt wanna giv my lappy to d coll ppl for reinstallation of windows...........



2) whenever i switch on my system it shows that black screen which says safe mode and all.......... i click start windows normally and the OS loads without any issues........(y am i getting this screen every time???)

thanx in advance........

[Vishal Gupta]

1.) type gpedit.msc in RUN dialog box and goto:

User Configuration -> Administrative Templates -> System

in right-side pane, set "Prevent access to Registry editing tools[/b] to either Not Configured or Disabled.

2.) Try to run scandisk for drives.

[Ksquare]

k...ur comp. has been infected by a virus called 'brontok'.
wat u do is use a task manager, but most probably the windows task manager wont' be working.
So download the trial version of System Mechanic 6 and use the manage running programs task to go to the running programs directory, once there disable " isass, winlogon, and services which are marked in red." in system mechanic. then go back to the browser which opened and delete those files.
Now. you can use regedit.

To delete the keys which brontok uses. which are both in the hkey current user and local machine in the directory ---- software-microsoft-windows-current-run and run once.

next and last step is to delete the dos based executable file which is located in documents and settings - (user) templates folder. and you're done.

Hey, man best of luck! though most probably this thing will work....i am not 100% sure abou it.
And do tell me if it worx.

[satbir]

thanks gius i'll try these things today n tell u the results asap

[sridatta]

You can follow this alternative

To enable regedit remotely, type the following in a single line in start->run

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f


To enable Task Manager, either you can do it in regedit now or use the following key and follow the same procedure above

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System
/v DisableTaskMgr /t REG_DWORD /d 0 /f

Next, Enable the folder options either using registry or Group Policy.

[satbir]

@vishal............. thankx.......
thats wat i needed......... my folder options is back......... i've removed
@sridatta...... thanks for ur efforts.......

ok i've rewmoved the virus and all the infected files......... but this virus planted a file(c:\windows\kesenjanganSosial.exe) onto my startup......... the AV removed this file n now whenever i start my system, it shows an error......
windows cannot find the specified file(c:\windows\kesenjanganSosial.exe)........ this error is really pissing me..... how do i remove this file from starup........... i tried msconfig........ but this file was not there in the startup tab..... is there some way how i could solve this prob??

[sakumar79]

1. Try Startup Control Panel (comes with Autopatcher)
2. Try a registry cleaner software such as CCleaner
3. Manually hunt and find the registry entry - here, hijackthis log will help you out

Arun

[Vishal Gupta]

Did u try to find the file in Startup folder?

[satbir]

yup......... i checked the startup folder.........i didn't find it there and i cleaned my sys using a reg cleaner........... it didn't help

i'll try startup conrtol pannel ....... is there something else that i can do??
__________
hey guys thanx very much.............. i installed speed optimisor( a startup manager) and it removed that faulty entry from registry............ thanx alot............

i still hav an unsolved prob.............

2) whenever i switch on my system it shows that black screen which says safe mode and all.......... i click start windows normally and the OS loads without any issues........(y am i getting this screen every time???)

PS: i didn't install any new hardware...........

type C:\boot.ini on run dialog box. And remove the line which has /safemode written. ( leave the other one intact)

Alternate solution

type msconfig, now under boot.ini tab remove the entry with /safemode written.


In any case your Boot.ini should look like
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Professional" /noexecute=optin /fastdetect

[JGuru]

Backup your 'boot.ini' file before making any changes!!! So even if something
goes wrong, you can always restore the original file.

implement guru's idea first then mine or else you'll end up getting back-up of modified bot.ini *LOL*

[satbir]

hey this is wat my boot.ini file looks like

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Professional" /noexecute=optin /fastdetect


and in msconfig........ the safe mode checkbox is uchecked..........

and it still shows "Safemode" option while booting?
Did you try going to the "safemode"? Did it boot into windows' safemode or linux etc?

[sakumar79]

Right-click on My Computer and go to Properties. Select Advanced and go for settings button under Startup and recovery.

Here, the first checkbox reads "Time to display operating systems" and is probably got a value of 30 next to it. Uncheck the box... Click OK...

Arun

@ sakumar: thats okey but I wonder why he is getting a "safe mode" option when his boot.ini doesn't have anything as such.

[satbir]

could it be cuz of some faulty driver or somethin??

@si><ie........... i booted into safe mode.......

now windows is loading in safe mode as well as normal mode without any issues........ but why am i getting this black screen(showing safe mode,safe mode with networking,start windows normally etc) everytime i start my system??

@sakumar......unchecking tht box didn't help!!!

[sakumar79]

Oops, I am sorry, that option is for menu that comes before safe/normal booting menu...

Anyways, for this problem... According to some discussions in google group, it is possible that "BootMenu=1" in "C:\msdos.sys" can cause this. If it's there,
remove the hidden, read-only and system attributes and insert a
semicolon in front of the line.

Arun

@stabir: that maybe cuz you had turned-off your PC without shutting it down or you pressed the restart button before windows could finnsh booting.

anyways, changeing the "timeout=30" to "timeout=0" should solve the problem. Actually it will just decrease the timeout to 0, so you won't be able to see the menu.

[satbir]

@sakumar... i'll try ur trick.......

@se><ie.......... i tried changing time out to 0 but it says the minimum timeout can't b less than 3 secs...... n i think that timeout is for the menu that comes before that safe menu screen(in case u have 2 operating systems)

[Kiran.dks]

c:\windows\kesenjanganSosial.exe is added by the W32/Brontok-K mass-mailing worm.

Download: Sophos Brontok removal

Run this exe file and click go.

[Mahesh Kurade]

go to windows run dialog box copy the following command in it and press enter your problen is solved

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f

Mahesh Kurade

[ico]

^^ 1 year old thread bumped...... lol.....