Endpoint Protection

Hi..

  I had a virus in the computer and it was successfully removed by Symantec endpoint, MBAM, hijack this and other such programs that i used.

I found that insipte of removing the viruses completely from the computer i am not able to open the registry editor.

" registry has been disabled by your administrator"

WELL I RAN THE UNHOOKEXEC.inf from symantec now i am not even able to see anything happening when i type regedit in the runline. nothing happens no popup, no hourglass.

Also tried runing regedit from c:\windows and also regedt32 from system32, yet nothing happens.

I am able to use the RDP and open the registry that way (Yeah because it uses the remote registry")

What is the solution?

I dont want to blame unhookexec.inf to be the cause of this issue.

But i want to know how to re-enable the registry

Hope that is not in palce a local policy to block the registry modification. But try a different registry editor like O&O RegEditor.

This tool is a portable freeware software that allows to open and modify the registry.

Here the link :  O&O RegEditor

Try running the following command at the run line, if registry editing has been disabled, it should allow you access again

"reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /t Reg_dword /v DisableRegistryTools /f /d 0" 

Probably that will not work as well if the registry editing has been disabled.

Your best bet will be to get to the system account and make the changes.

Type this at the command prompt.

at 13:30 /interactive cmd.exe

13:30 is the time, It has to be in military format. You can put in anything. Once the task is set, Goto c:\windows\tasks and right click on the task and run. It will open svchost.exe(cmd in system account). Make the changes what Paul suggested though you would be able to do anything at the system level.

To enable regedit go to this site,

http://www.patheticcockroach.com/mpam4/index.php?p=28

on item 1: copy and paste to notepad and save a .reg file

then run the file. after it will prompt that it will make changes to your registry then click ok then you will be able to use regedit.