topic Re: Malware has locked me out of registry in Norton Internet Security / Norton AntiVirus

Malware has locked me out of registry

Socom71 — Sun, 26 Oct 2008 21:47:16 GMT

I was recently infected with some sort of malware that started with a notifcation in the system tray with a red x . I ran spysweeper and norton scans and they both found and removed items and the red x and notifcation were gone . My computer than started hanging up and could no longer access norton or access the registry editor. downloaded malwarebytes and ran scan found and removed more items. Computer seems to be working fine now but i can still can not access the registry editor and norton will not launch . Need some help please!!

Re: Malware has locked me out of registry

Quads — Sun, 26 Oct 2008 22:24:47 GMT

which operating system, Vista or XP,

Also are you able to use the "run" feature?? if yes I can give you what to write.

In the box type

"REG DELETE HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools" without ""

and

"REG DELETE HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools" without ""

If lucky Hijackthis shows that Regedit is disabled, and the Run Hijackthis and tick the box beside this line

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

or one saying (there is a difference between the 2)

O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

once fixed click the fix button.

Quads

Re: Malware has locked me out of registry

Dieselman743 — Sun, 26 Oct 2008 22:26:40 GMT

First of all lets try to fix Norton. Which version of Norton are you using? Try doing a complete uninstall of Norton and reboot. Run the Norton removal toll and reboot. Reinstall Norton . BTW Norton 2009 does not get along with Spy Sweeper.

Re: Malware has locked me out of registry

Socom71 — Mon, 27 Oct 2008 02:44:49 GMT

Thanks for such a quick reply I am using windows xp home edition. I can use the run command it works for MSCONFIG I know I have tried that command but I get a can not import file or disk error when I try REGEDIT. I have uninstalled NIS2007 already but when I try to reinstall it goes fine untill I try to open it then nothing happens. I also tried to download a registry reset tool off of a thread from here called UnHookedExec.inf that is supposed to fix registry issues caused by this malware but download link did not seem to be working . I am currently using my desktop computer to use the internet to try to find out how to fix my laptop. also will I not be able to use spysweeper with NIS2009 once I get this resolved or will I need to switch to something else or will NIS 2009 cover me on everything. Thanks for all your help!!

Re: Malware has locked me out of registry

mijcar — Mon, 27 Oct 2008 02:58:42 GMT

Before you leap too deeply into fixing the registry, you might want to make sure that the problem isn't with the program regedit. Both scenarios might lead to the problems you are describing. Since Norton does scan the registry, it might invoke the same subroutines invoked by regedit; and both may fail if that subroutine is defective.

If you are sure you have removed all malware from your computer and if you don't have a recent image of your system you wish to put back for complete peace-of-mind, then I'd suggest you rebuild windows.

It it were myself in this predicament, I would save everything of importance, then restore my computer to its original state and build it back up to a much slicker, faster system without the accumulated debris of a couple of years.

Re: Malware has locked me out of registry

Socom71 — Mon, 27 Oct 2008 03:24:03 GMT

I am not 100% sure I have removed everything dealing with the malware but all the scans I have done as of today using spysweeper, malwarebytes and norton before I uninstalled it came back clean. I just did not want to jump straight to reloading windows. I am going to try to download hijackthis and see what it comes up with. Please keep the help coming thanks

Re: Malware has locked me out of registry

Quads — Mon, 27 Oct 2008 03:36:03 GMT

Also you could do a seach and see how many files by the name regedit exist with any extension, why some infections who disable regedit also rename "regedit.exe" as "regedit.com" there is a backup in the "dllcache" folder.

Quads

Re: Malware has locked me out of registry

Dieselman743 — Mon, 27 Oct 2008 03:58:47 GMT

Have a look here. There are over 400 fixes for things.

http://www.kellys-korner-xp.com/xp_tweaks.htm

Re: Malware has locked me out of registry

hammerman84 — Fri, 07 Nov 2008 07:02:49 GMT

Quads wrote:
which operating system, Vista or XP,

Also are you able to use the "run" feature?? if yes I can give you what to write.

In the box type

"REG DELETE HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools" without ""
and
"REG DELETE HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools" without ""

If lucky Hijackthis shows that Regedit is disabled, and the Run Hijackthis and tick the box beside this line

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

or one saying (there is a difference between the 2)

O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

once fixed click the fix button.

Quads

Thank you so much for this post. I have been searching for hours for something to open my registry but to no avail. You are awesome. Out of the hundreds of posts I read, (most of which basically said the same thing) and trying to use the Symatec tool to fix my problem, I finally found a solution! Now if I could only figure out how to turn my automatic updates back on....ugh. Kudos!!!!

Re: Malware has locked me out of registry

ialexandra73 — Sat, 08 Nov 2008 05:06:20 GMT

try this
1. Download this file -{link removed}, save it to desktop

go in safemode 2. Double click combofix.exe 3. jes all the message .
wait until is finisch

- for the updates from windows try

-check first -Open the command run -type sercives.msc andn check if is running and automaticly the

-windows update

-Open the command prompt or run box and execute the following commands:

regsvr32 wuapi.dll
regsvr32 wuaueng.dll
regsvr32 wuaueng1.dll
regsvr32 wucltui.dll
regsvr32 wups.dll
regsvr32 wuweb.dll

and tell

[edit: link removed, please link only web pages and not directly to downloadable files.]

Message Edited by Allen_K on 11-07-2008 11:06 PM

Re: Malware has locked me out of registry

johna — Fri, 07 Nov 2008 07:40:55 GMT

Hi Socom71

You may want to try this from Symantec Knowledge Base:

Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Security Response has developed a tool to resolve this problem. Download and run this tool, and then continue with the removal.

Let us know

Thanks

Re: Malware has locked me out of registry

ialexandra73 — Fri, 07 Nov 2008 08:05:21 GMT

Socom71 wrote:
I am not 100% sure I have removed everything dealing with the malware but all the scans I have done as of today using spysweeper, malwarebytes and norton before I uninstalled it came back clean. I just did not want to jump straight to reloading windows. I am going to try to download hijackthis and see what it comes up with. Please keep the help coming thanks

so , in this case , will help , just try it

Re: Malware has locked me out of registry

Tech0utsider — Fri, 07 Nov 2008 21:19:47 GMT

ComboFix corrupts 1 in 100 computers. It simply deletes an infected file, unlike Norton, which attempts to repair the file. I would suggest removing spysweeper first of all. Then, run an XP repair install, which should fix your issue and overwrite 90% of the existing malware, while preserving your files.

Re: Malware has locked me out of registry

Socom71 — Sat, 08 Nov 2008 03:04:49 GMT

I have been over at the bleeping computer forum and have got my laptop almost fixed. Everything seems back to normal except that I cant run disk defrag. Have been able to reinstall my NIS 2008 software and have updated it seems to be working fine. Had some nasty root kits not sure if I can trust my laptop again without a complete reinstallation of everything. Not really wanting to have to do that what do you think? Why would you remove Spysweeper?

Re: Malware has locked me out of registry

Dieselman743 — Sat, 08 Nov 2008 03:15:53 GMT

You don't need 2 real time antispyware programs. Running NIS and Spy Sweeper together is called overlapping security and it can actually make you more prone to infections since 2 programs are fighting over which one is going to cure it.

Re: Malware has locked me out of registry

Socom71 — Sat, 08 Nov 2008 03:30:06 GMT

Also not sure on how to do a repair install. The only discs I have are the ones that my laptop had me make when I first turned it on.

Re: Malware has locked me out of registry

johna — Sat, 08 Nov 2008 03:33:54 GMT

Hi Socom71

Did you try running the Norton tool I mentioned a few posts up, it should get you back into the registry.

Thanks

Re: Malware has locked me out of registry

Socom71 — Sat, 08 Nov 2008 03:59:32 GMT

I did try to use the Norton tool but did not have any luck. What finally got me back into the regedit was a tool called SDFIX that I got from Bleeping Computer forum. Since then my laptop has been working normal except that I get a access denied message whan I try to use disk defrag.

Re: Malware has locked me out of registry

Dieselman743 — Sat, 08 Nov 2008 04:11:04 GMT

Have you look here yet? There are over 400 fixes.The BleepingComputer site has not been updated since Sept. Not sure how reliable it is.

http://www.kellys-korner-xp.com/xp_tweaks.htm

Message Edited by Dieselman743 on 11-07-2008 08:11 PM

Re: Malware has locked me out of registry

Socom71 — Sat, 08 Nov 2008 04:33:59 GMT

Looked thru Kellys Korner did not find anything to get disk defrag to work message still says acess denied.