Cannot get into Regedit!!

[PhotoOpp]

I just tried to get into Regedit and got the following message "Registry editing has been disabled by your administrator"!!

My OS is WinXP Pro SP2. Is there parameter that I may have set that does this?

I am the administrator of this computer.

 

[franklin97355]

Are you logging on as the "administrator"?

 

[PhotoOpp]

Yes... I logged in as ADMINISTRATOR and the same result!

 

[bcastner]

Open notepad and copy/paste the below. Save the file as registry_fix.vbs:

******* start copy/paste below this line
On Error Resume Next

Set WshShell = WScript.CreateObject("WScript.Shell")

WshShell.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools"

WshShell.RegDelete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools"

Set WshShell = Nothing

******** end copy/paste above this line

Save the file. Then Start, Run, cscript registry_fix.vbs

Now that you can access the registry again, scan your system for malware, as this is the likely source of this problem.

See this FAQ: Faq608-4650

 

[PhotoOpp]

Thanks for the ideas... I am guessing that you are right that I must have some form of malware or virus!

Before I followed your advice on the registry fix I decided to follow the steps in the FAQ608-4650 and went to the on-line virus checking sites... I ran the Trend Micro & Panda checks and found numerous problems on each. The Trend Micro indicated that the numerous items found were not fixable (is that a word?) and therefore I deleted them!

I am now wondering if I deleted some key Windows files because I cannot run any programs from the RUN command... e.g. CMD.exe brings up the 'Open With' window asking me to choose the program to open this with!!! I tried numerous other commands all with the same result. For example, when I doubleclick on CWShredder.exe I get the same window opening!

Any suggestions on a next step... reinstall windows???

 

[bcastner]

First try to repair the .EXE file association. See Doug Knox's site:

http://www.dougknox.com/xp/file_assoc.htm

See also:

http://www.mvps.org/sramesh2k/ToolsQuit.htm

 

[bcastner]

See also: thread779-931595

 

[PhotoOpp]

Unfortunately, Doug Knox's repair for the EXE file association means that I need to use Regedit to run the reg file... but that was my original problem I can't get access to regedit!

Your second link is about the trojan file Netstatt.exe... but I can still run Task Manager and I don't see that file there!

Any other ideas??

 

[bcastner]

Look at the second link again: you can use regedit if you make a copy with Explorer, and rename the copy regedit.com. You can run Task Manger with the same trick.

 

[Mike2287]

If you can't get explorer open do it from the DOS Prompt.


Start>Run> Command

That will get you to a DOS Prompt. Then you can go to to windows directory and copy regedit.exe to regedit.com and run it from DOS.


Mike

 

[bcastner]

While you can rename regedit.exe to regedit.com, you have to be more creative with Task Manager and MSCONFIG.

Rename copies of these utilities as shown below and run them or use MS-MVP Doug Knox's Emergency Msconfig, Regedit, Task Manager utility:

http://www.dougknox.com/xp/utils/xp_emerutils.htm.

This utility creates usable copies of MSCONFIG, REGEDIT AND TASK MANAGER by creating copies of the actual files to C:\EmergencyUtils folder. The alternate copies will have the following file names: MSCONFIG1.EXE, TASKMGR1.EXE and REGEDIT.COM.

Online Virus Scanners and Security tests:

http://www.mvps.org/sramesh2k/Scanners.htm

 

[PhotoOpp]

Clearly I have something that is really affecting my system!!

I went into Explorer (right click on start/explore) and renamed Regedit.exe to Regedit.com and tried to run it... however like the exe files the com files also get the 'Open With' window!

So... I can't run any exe or com programs. I also now can only get into the Administrator account! And, I just exited Explorer and tried to reenter and got a window saying "C:\windows\explorer.exe Application not found"!!! It's like something is following my moves and closing things down!!!

Just for clarity... I CAN still get into Task Manager.

I should mention that one of the files that the Trend Micro virus check identified was something called SPOOLLD.EXE which I deleted. I notice that whenever I reboot my computer the system tries to reload this file... Since I can't access MSConfig I can't delete this startup item. Does anyone have experience with this file? My searches have found nothing on it!

My current thought is that I should do a complete reinstall of windows (and SP2)... Any thoughts as to whether or not this will work? Should I do a repair of new install? Is there something else I should do instead?

 

[bcastner]

Is it the case you cannot run any .EXE or .COM file, or just mstask.exe, regedit.*, etc.?

 

[joemck2004]

Mike, exe!=com. Com files are raw x86 code and have an entry point of 0x100. They're DOS-only and are limited to 64k combined code and data. Exe files have a header on them to allow multiple segments, bypassing the 64k limit. You have to create a header to convert a COM to an EXE. To convert the other way (as you're suggesting), you have to remove the header and pray that the code doesn't use multiple segments.

 

[bcastner]

joemck2004,

What you describe about COM vs. EXE is generally true. But it absolutely true that you can rename regedit.exe regedit.com and use it.

I do not know of other exceptions.

 

[PhotoOpp]

I can't run any EXE or COM file from the RUN command line or when I double click them!

 

[bcastner]

And if you use Safe Mode with Networking?

 

[PhotoOpp]

Same problem in safe mode... I can't run any EXE or COM file from the RUN command line or when I double click them!

Should I reinstall Windows (as new install or repair)or do you have any other ideas?

 

[bcastner]

Try a repair reinstallation:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;315341

If the issue is essentially missing or damaged files, this will sort it.

 

[PhotoOpp]

An update...

I tried the repair installation and it didn't work!! So... I bit the bullet and did a completely new install! Oh well, at least now I am up and running well again.

Unfortunately, I was not able to run any programs (because of the problem) and therefore unable to uninstall applications before I did the new install. After the install, I found myself with the sub-directory 'C:\Program Files' full of my previously installed programs! Of course, none of these were properly registered and therefore would not function! It has been somewhat of a pain having to go through and delete them selectively! In hindsight I perhaps should have renamed Program Files to something else and then let the new install setup a new Program Files directory.

Given that I am now happy with the set up what would be the recommended approach to keeping a copy of my instance? I ask this because if I run into a similar problem, I could then completely restore this instance to what I have today and then only have to update forward...

Any thoughts?