worm disabled regedit 4

[JustinEzequiel]

got hit by Worm.Brontok.E.1 yesterday.
I seem to have removed all infected files.
however, I cannot get into the registry to clean up all traces.
I need to be able to reset or delete the "DisableRegistryTools" key under
HKCU|HKLM/software/microsoft/windows/currentversion/policies/system
Worm added the key (or changed the value)

am trying a system restore now...
if that does not work, will try coding a script

any help much appreciated

 

[firewolfrl]

load the drive as a second drive in another computer with a good antivirus....scan for virus
then load the Hive from the second drive

http://www.jsifaq.com/SF/Tips/Tip.aspx?id=0182

the link above is better than the link below

http://www.dougknox.com/xp/tips/xp_adv_reg_editing.htm

you have to edit the Hive file that you need to get into to change the settings

this should help

 

[smah]

See if this info will help:

http://windowsxp.mvps.org/ToolsQuit.htm

http://www.dougknox.com/xp/utils/xp_emerutils.htm

 

[Rick998]

For XP Pro:-

1) Start > Run > enter gpedit.msc and press RETURN.
2) Navigate to User Configuration > Administrative Templates > System.
3) In the right-hand pane, double-click on Prevent access to registry editing tools.
4) Change the option to Not configured then click on the Apply button then the OK button.
5) Close the Group Policy Editor.

Regedit should now work again. Hope this helps...

 

[linney]

This page has several suggestions if System Restore or Group Policy are of no use to you.

Locking and Restricting the Registry in Windows XP

http://www.geocities.com/kilian0072002/registry/lockreg2.htm

 

[JustinEzequiel]

thanks lots.
gpedit.msc did it.

for whatever reason System Restore could not restore to a recent restore point.

(I should have mentioned that this is a laptop and I have no idea how to load its drive on another machine)

 

[linney]

JustinEzequiel.

Should you ever need to have a look at this thread. See the information on a Laptop Adapter.

Mount an unbootable NTFS drive? !!HELP!! Tough one.
thread779-738178

 

[JustinEzequiel]

> Mount an unbootable NTFS drive? !!HELP!! Tough one.
> thread779-738178

thanks linney,

have archived said thread for future reference