Register has been disabled by Admin.

Priapus · 23 May 2007 at 14:47

Hi Guys.

I have a system here that has some sort of virus. However I am unable to remove it. I tried getting a HiJack this log, but when I go to Program files, the pc restarts it self.

.

When ever a program or I try open/edit the regitery, a message pops up, saying, Registery has been disabled by your admin. Then PC restarts itself!

Any ideas how to get.fix this one?

Thanks guys!

Deception · 23 May 2007 at 14:49

Tried doing it in safemode, at all?

Trifid · 23 May 2007 at 14:50

Tried opening the .exe that you want to open by browsing my computer for it?

Safe mode should stop it from loading and allow you to edit the registry and run scans from there.

Priapus · 23 May 2007 at 14:58

Safe mode makes no difference at all.

TheDean · 23 May 2007 at 15:45

kick it to death - then you'll win

Deception · 23 May 2007 at 15:47

I had a virus like this before, although it made my computer seem like it was always in safemode and I couldnt do anything.. In the end, I just had to format. Try disconnecting from the internet while scans are being performed etc.. Every little helps.

Priapus · 23 May 2007 at 16:35

It won't allow scan. If I try save a HiJackThis! Log file it restarts. If I run AV..it restarts.

.

Looking like a format...., but I don't want to go that route just yet. I want to beat this stupid virus. :mad:

Thank you guys.

Ladforce · 23 May 2007 at 16:58

download and burn Knoppix linux to a cd then use an online antivirus program to remove the virus from the filesystem once it has booted off the cd.

Deception · 23 May 2007 at 17:20

Ladforce said:
download and burn Knoppix linux to a cd then use an online antivirus program to remove the virus from the filesystem once it has booted off the cd.

I know places like the bitdefender do an online scan. Pretty good Anti-Virus too.

Priapus · 24 May 2007 at 06:52

Thanks, will try that.

bikes · 24 May 2007 at 07:17

Just out of intrest, what AV are you running?

The_KiD · 24 May 2007 at 08:20

Download HiJackThis from here: http://www.majorgeeks.com/download3155.html

Dont install it to the program files directory, rename it to something like winword.exe instead of hijackthis, then try running it.

What you will be looking for in the log is one of the lines that begins with "023" (services).

If it is doing it in Safe Mode too it must be a service.

Priapus · 24 May 2007 at 08:39

The guy is running Norton AV. :rolleyes:

The Kid: Will do that now. Thanks. Can I post the log here?

Priapus · 24 May 2007 at 08:52

TYhe PC just restarts as soon as I open HiJackThis.

|Ric| · 24 May 2007 at 09:42

google for reg3dit.exe

The thing stopping you opening the registry is just a registry key that the microsoft version checks for. If you use reg3dit.exe it ignores it

Priapus · 24 May 2007 at 09:58

Thanks, will look now. But not really a solution. I need to fix this thing!

swinnie · 24 May 2007 at 10:07

You could try salving the Hard Drive and do a scan on the hard drive with an old computer?

Used to do it with my clients, they just bring their computer, I remove hard drive and slave it on an old computer and run an AV scan and stuff from there.

Good luck

Priapus · 24 May 2007 at 10:12

Actually a very good idea!

Thanks!

The_KiD · 24 May 2007 at 10:12

swinnie said:
You could try salving the Hard Drive and do a scan on the hard drive with an old computer?

Used to do it with my clients, they just bring their computer, I remove hard drive and slave it on an old computer and run an AV scan and stuff from there.

Good luck

That would be my next option to be honest.

If you put it in as a slave, you can scan it for viruses, but also connect to the registry on the slave disk using regedt32.

Priapus · 24 May 2007 at 10:18

It's scanning now on another PC. I've got a USB to IDE converter so just using that, saves taking the whole PC apart. But also shows up as a local disk, rather then a removable disk.