TechSpot

Can't run regedit after malware infection. Please help!

By alexsomma
Oct 18, 2008
  1. Hi

    I was stupid enough to doubleclick what looked liked a rar file to get a archive password. I've always managed to stay out of trouble before but that one error was more than enough to screw everything up.


    initial symptoms:
    In addition to giving me fake trojan warnings (that looked like defender warnings) leading me to fake anti-malware sites, it installed some extra toolbar in internet explorer and disabled ctrl+alt+del and also regedit i think.

    remaining problem:
    I think I've managed to fix most of it, but I still cant get regedit to run.
    When I try to run regedit I get the user account control prompt, but when I click continue, nothing happens.


    Here's what I've done so far:

    - I've downloaded ad-aware, spybot search & destory, malwarebyte's anti-malware and run them all. Both adaware and malware found and fixed some stuff, but spybot didnt find anything after that.

    - I then purchased and downloaded BitDefender Antivirus 2009 and run deep system scan, and it too removed something.

    - I've downloaded cc cleaner and fixed all the issues it listed.

    - I've used killbox to clear all temp files.

    - And finally I've used Hijackthis to get rid of some other stuff.


    I still cant run regedit, so there has to be something wrong.

    I've attached my hijack log, hope you guys can help me!!
     
  2. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    Download RatsCheddar

    It contains a program written by Rathat, and it is a Policy Controller.
    Save and extract this program to the desktop.
    Once extracted, Double click on the RatsCheddar.exe file.
    Enable everything, then click Exit
    Reboot your Computer.
     
  3. alexsomma

    alexsomma TS Rookie Topic Starter

    I tried using ratscheddar like you said, but regedit still wont run.
     
  4. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    Your HJT log contains 23 file missing lines

    Please tick and fix all of them (it's very difficult to read with all of these)

    Then run IE Reset:

    How to use Reset Internet Explorer Settings (RIES)

    To use RIES in Internet Explorer 7, follow these steps:

    1. Click the Tools menu, and then click Internet Options.
    2. On the Advanced tab, click Reset.
    3. In the Reset Internet Explorer Settings dialog box, click Reset.
    4. When Internet Explorer 7 finishes restoring the default settings, click Close, and then click OK two times.
    5. Close Internet Explorer 7. The changes take effect the next time that you open Internet Explorer 7.



    Then run CCleaner

    Then Restart

    Then re-attach a new HJT log, to a new reply
     
  5. alexsomma

    alexsomma TS Rookie Topic Starter

    I fixed the 23 lines with missing file in them, and then did the IE reset.
    I then ran CC cleaner and restarted.

    The 23 lines are still there when i run hijack this tho...

    what next?

    heres is the new hijack log:
     
  6. alexsomma

    alexsomma TS Rookie Topic Starter

    Btw...Do you have any idea why all those files are missing? They seem like important files right?
     
  7. tw0rld

    tw0rld TS Maniac Posts: 572   +6

    To enable regedit do the following

    1. Open the Start Menu.
    2. In the white line (Start Search) area, type gpedit.msc and press Enter.
    3. Click Continue for the UAC prompt.
    4. In the left pane, click on User Configuration, Administrative Templates, and System.
    5. In the right pane, right click on Prevent acces to registry editing tools and click on Properties.
    6.Select Not configured or disabled(if Not configured is already selected then selecte disabled), then click apply, and ok to exit.
    Now try to run regedit again. If that doesn't work let me know as there is another way of getting this done
     
  8. alexsomma

    alexsomma TS Rookie Topic Starter

    I set it to disabled as you suggested. Still doesn't work.

    Just to be clear, when I try starting regedit, I get the user account control prompt, and when i click continue, nothing happens. I think its strange that I get the user account prompt and then nothing. Wouldnt it be more logical if i got nothing at all?

    what now?
     
  9. Tedster

    Tedster Techspot old timer..... Posts: 6,000   +15

    boot in safe mode then remove the infection. ensure you turn off system restore before removal as you can end up with a zombie virus.
     
  10. alexsomma

    alexsomma TS Rookie Topic Starter

    Can you explain a bit more. None of my programs find any viruses. Should I run them all in safe mode or are you thinking about one in particular.

    Im running vista 64bit, is disabling system restore necessary on vista systems?

    Whats a zombie virus?
     
  11. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    Well I had a look at your 2nd HJT log
    And see that the "file missing" entries are still there (as you stated they came back)

    But then I saw you have Spybot - Search & Destroy installed, and thought if that is stopping any change whatsoever to your system (Possibly I feel)



    Can you please un-install Spybot - Search & Destroy and anyother live protection program (other than your Antivirus) This includes any personal firewall you may have as well.

    Once fully uninstalled, you could either start at the top ^^ or possibly a better option, go here, and complete all steps:

    Viruses/Spyware/Malware Preliminary Removal Instructions
     
  12. BlkHeartWolf

    BlkHeartWolf TS Rookie Posts: 151

    I am confused since i see no spyware in the log's only possible bad install's or things installed without uninstalling previous versions. Much like Adobe Reader * willnot install untill user uninstalls version 7.
    I would remove / uninstall the related programs, clean the REG and get a clean install of these and make sure you removed the related config files if asked, "you can always make a copy somewhere"

    looks to me as if you only have bad reg keys vsserv.exe is missing from the system32 folder but loads from the install folder under Program files. They come back from system restore or because it is protected by another service.
    my hunch anyways
     
  13. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...