Tuesday, August 04, 2009

How to Access Blocked Regedit .

Many times when working on a computer that has been infected with a virus, trojan, or piece of spyware I find myself with my most important command, Regedit, the Windows Registry Editor being disabled. Virus creators like to disable the Registry Editor so it makes solving the problem and removing the issue difficult.
Sometimes administrators in IT departments may place restrictions on using the regedit command to keep employees from changes things on company computers, but viruses and other issues may also try to disable it.
Listed below you will find the different ways to enable regedit, the Registry Editor.

Method 1: Use Symantec’s tool to reset

Sometimes worms and trojans will make changes to the shell\open\command registry entries as part of their infections. This will cause the virus to run each time you try to run an .exe file such as the Registry Editor. In these cases, visit Symantec’s website and download the UnHookExec.inf file to your desktop. Right-click on it and choose Install. Restart your computer and then try to open the Registry Editor.



Method 2: Rename Regedit.com to Regedit.exe

Some viruses and other malware will load a regedit.com file that is many times a zero byte dummy file. Because .com files have preference over .exe files when executed if you type REGEDIT in the run line, it will run the regedit.com instead of the real regedit.exe file.
Delete the regedit.com file if its a zero byte file to restore access to REGEDIT. In some cases, such as the W32.Navidad worm, you’ll need to rename the REGEDIT file to get it to work.

Method 3: Windows XP Professional and Group Policy

If you have Windows XP Professional and access to an administrative user account, you could change the registry editor options in the Group Policy Editor.
Click Start, Run
Type GPEDIT.MSC and Press Enter
Go to the following location
User Configuration
Administrative Templates
System
In the Settings Window, find the option for “Prevent Access to Registry Editing Tools” and double-click on it to change.
Select Disabled or Not Configured and choose OK
Close the Group Policy Editor and restart your computer
Try opening REGEDIT again





If you enjoyed this post, make sure you Subscribe to the Blog to receive new posts in a reader or via email.
Digg Google Bookmarks reddit Mixx StumbleUpon Technorati Yahoo! Buzz DesignFloat Delicious BlinkList Furl

0 comments: on "How to Access Blocked Regedit ."

Post a Comment