How to edit registry?

czgu · Post by **czgu** » Fri Apr 18, 2003 8:03 pm

I help my friend to cleanup his IE.Everytime when he start IE, his IE somehow goes to XXX website, but home page is not that web page. I try to edit his registry, I get "Registry editing has been disabled by your administrator". How can I un-lock it? The system is win98.

JawZ · Post by **JawZ** » Fri Apr 18, 2003 9:05 pm

Again, this sounds like the work of a virus or some browser hijack script.

I would scan his system and disbale activex in his browser settings...it's in security.

czgu · Post by **czgu** » Fri Apr 18, 2003 9:48 pm

No that doesn't work. In windows directory, two registry files, user.dat and system.dat, are locked up. They are all forced to be read only. There is no way I can change!! If I un-check the read only, it'll be setted back to read-only. There is something running in background to check these two files' attributes. That is nothing to do with internet settings.

JawZ · Post by **JawZ** » Fri Apr 18, 2003 11:30 pm

when he start IE, his IE somehow goes to XXX website, but home page is not that web page

That's called a browser hijack. That is why I suggested you do a virus scan AND do a scan with both AdAware and Spybot S&D.

You can play all day in the registry but unless you rid the computer of the offending program...it will continue to be changed.

the internet settings which you said have nothing to do with this is EXACTLY the reason why the browser hijack was able to take place. You need to up the security level of active x so that it won't happen again.

Maybe if you do these things...you'll probably find that you don't need to go back in the registry and risk further corruption.

MadDoctor · Post by **MadDoctor** » Fri Apr 18, 2003 11:37 pm

Originally posted by UOD
That's called a browser hijack. That is why I suggested you do a virus scan AND do a scan with both AdAware and Spybot S&D.

You can play all day in the registry but unless you rid the computer of the offending program...it will continue to be changed.

the internet settings which you said have nothing to do with this is EXACTLY the reason why the browser hijack was able to take place. You need to up the security level of active x so that it won't happen again.

Maybe if you do these things...you'll probably find that you don't need to go back in the registry and risk further corruption.

What he said.

czgu · Post by **czgu** » Fri Apr 18, 2003 11:52 pm

OK, now I un-locked the registry and deleted the sex website in registry. But Home page is still locked. It is very strange. Because IE6.0 should fixed this problem. How come the home page still be locked.

JawZ · Post by **JawZ** » Sat Apr 19, 2003 12:10 am

Close Internet Explorer and Outlook Express.

Copy the bold to Notepad. Save as Homepage. reg, and doubleclick it.
Answer 'yes' to have it imported into the registry.

REGEDIT4

[HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"Homepage"=dword:00000000

This should unlock your Home page.

Now go to Control Panel/Internet Options, and clear your temporary Internet files.
Click Settings/show files, and delete your cookies.
Or, if you're running IE 6.0, click 'delete cookies.
Empty your Recycle Bin, and delete everyting in your C:\Windows\Temp folder.

Now go to Control Panel/Internet (options)
Go to the 'Programs' tab, and click 'reset Web Settings'.
Go to the 'Security' tab, and set all ActiveX options that are now set to 'allow', to 'prompt'.
Also uncheck 'Enable install on demand' on the 'advanced' tab.

Now open Internet Explorer, and go to your favorite Start Page.
Go to Internet Options, General tab, and click 'Use current'.

That should do it.
It's important, however to make suree there's nothing in startup that could revert this situation:

Go to Start/run, and type Msconfig. On the Startup tab, look to see if you can find one or more of the following entries:
SWPortal, SWCaller, Sp.dll, winn32.html, runme.hta, reg.hta, adshow.exe , OPQfile, and/or MSKernel32 (Win32.hta).
If you should find one or more of these, uncheck them.
Also anything that has 'regedit.exe/s' in its path.

Now click OK, close Msconfig, and reboot.

Also have your computer virus scanned.
There are malicious scripts like JS.Exception.Exploit which can do that as well.

czgu · Post by **czgu** » Sat Apr 19, 2003 7:57 am

Thanks. The homepage is un-locked now. This system has 6 viruses (he doesn't install anti-virus software, I did online checking). Ad-aware found 45 enties in registry and more than 350 files, folders of spywares..... what a f.... Thats it, I give up. His wife said she just don't want see that sex website from IE browser which I've done.