Editing/Deleting virus registry entries--won't allow?

[TroyMcClure]

I'm trying to stop a virus/spyware by taking out it's registry key, but I get the error "error deleting key" or "can't modify key". I've explicitly set permissions for myself for this key and all child keys--the intruder had given my user read-only access when it installed itself.

Why can't I still delete this? And, on a related note--the files in question can't be deleted while they're in use--and they dont' show up in task mgr or Process Explorer so I can't kill the process.

I think there must be a way--no matter how 'dangerous'--for a machine admin to delete a file even though it's in use. Damn the torpedos--I don't care if the machine crashes--I just want that file deleted and I'm willing to deal with any corruption that may follow--the worst it can do is misallocate the file. Big deal. I want it gone and I can't log on in Safe Mode to do it (for other reasons). Can this be done? Thanks.
--T

 

[gcw1]

Try booting into savemode then deleting the registry entry. Hit F8 during startup to access the safemode menu.

 

[linney]

How To Use the Windows XP and Windows Server 2003 Registry Editor Features

http://support.microsoft.com/default.aspx?scid=kb;en-us;310426&FR=1&PA=1&SD=HSCH

HOW TO: Take Ownership of a File or Folder in Windows XP (Q308421)

http://support.microsoft.com/support/kb/articles/q308/4/21.asp

The above is also available for Registry Keys, also look at the Inheritance (coming from above) from the beginning of the Hive in question.

Removing adware & spyware
faq608-4650

There is some nasty stuff out there, for example -

http://www.lavasoftsupport.com/index.php?showtopic=54511&st=0

 

[TroyMcClure]

gwc,
As I'd said, I can't log in in safe mode, so that's not an option right now.

linney,
Thanks, I'll read through those. The faq looks good, and it looks like I'll have to install some of those programs to supplement the ad-aware that I've been using.

The file deletion issue does not appear to be a permissions issue--it's that the windows has the file in use. And I know that windows locks files from being deleted so you're not pulling the rug out from under a running process, but this is really what I want to do.
--T

 

[linney]

Deleting in use files.

DelLater

http://www.diamondcs.com.au/index.php?page=dellater

DrDelete (More GUI type of thing)

http://www.broadbandreports.com/forum/remark,7374516~root=sware~mode=flat

And "Bcastner's" personal freeware weapon of choice:

http://www.jrtwine.com/Products/DelFXPFiles/index.htm