Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Returning Registry Keys that Disable stuff....


  • Please log in to reply
3 replies to this topic

#1 Caiden

Caiden

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:36 AM

Posted 12 July 2010 - 12:37 PM

So I've had this on going problem that I've had a quick solution to but I can't seem to be rid of it for good. It started out as me being blocked by something telling me that the administrator wasn't allowing me to access task manager or the registry editor. However, I came across away to fix this by downloading hijackthis and fixing an HKCU registry item that had set DisableRegedit = 1. But when I tried to run regedit.exe it still gave me the error. So I went back to hijackthis and did yet another scan, the file appeared again.. So this time as soon as I deleted it I quickly ran regedit.exe and was able to get the registry editor open before the malware had a chance to disable my access to it again. Once I was into the registry I navigated to HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System and found two REG_DWORD files there. One was called DisableTskMgr, the other was DisableRegistryTools. So I deleted both of them and tried to open up my task manager, but it still said no access. So I clicked on another folder within the registry and then back to the system folder again (to refresh the list), and to my surprise, the same two files had returned. So i tried setting their values to 0, the files quickly reset them back to 1. I tried renaming them, two new ones were created in their stead. Finally I just went into permissions for this folder and denied "Read" access to the "Administrators". Once I did that the files disappeared, but as soon as I re-enabled "Read", the files returned.

So I've run heaps of different legitimate scans, even some super secret one that Microsoft gave me the URL to over the phone. The scans managed to find and eliminate some stuff, but new problems always appeared... Now I've finally gotten it to the point where these returning registry keys are the only thing that seem to be wrong with my computer right now. Well, them and I'll get a random ass pop-up that creates its own installation of Firefox when I click a link (The address bar reads googlesyndication.com, then results.google.com, and finally a random site.. one of them even brought me to Yahoo.com *shrug*).

I've done a fair bit of research across a number of websites and can't seem to find anyone who has had this same problem of returning registry keys. So I figured I'd make my own post and hopefully someone would know what to do. Any help would be greatly appreciated.

BC AdBot (Login to Remove)

 


#2 Caiden

Caiden
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:36 AM

Posted 13 July 2010 - 05:18 PM

Bump

#3 trollocks

trollocks

  • Members
  • 369 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:England
  • Local time:03:36 PM

Posted 13 July 2010 - 06:10 PM

Follow these instructions and run TDSSKiller
http://www.bleepingcomputer.com/virus-remo...sing-tdsskiller

Next


Please download Malwarebytes from Here or Here
  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    Posted Image
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the log please

#4 Caiden

Caiden
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:10:36 AM

Posted 14 July 2010 - 11:58 AM

The link to download TDSSKiller is either broken or is being blocked by whatever is on my computer. I read through your link and what I have doesn't seem to fit that description. I never had any anti-virus software that pops up and starts a scan but requires me to pay to fix it. Also, I've run Malwarebytes several times and the problems persist. Though I haven't been able to update it because I get an error "MBAM_ERROR_UPDATING (12007, 0, WinHttpSendRequest)"




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users