PCTechNotes :: PC Tips, Tricks and Tweaks » registry entries

A Great Application To Easily Fix Your Registry

slavezero — Wed, 26 Aug 2009 16:51:53 +0000

When was the last time you experience using your computer perform at an optimal speed? I guess you miss those times when your computer are still running at light speed. Well, the main reason why your computer is now turtle slow is because you have problems with your registry. The registry is your computer’s Windows system’s heart and soul. It holds all the information that controls how your system appears and performs.

Almost all Windows users gradually experiences the downfall in their PC’s performance. Registry Problems can make your Windows system slower, less reliable and in worst cases it can only be fixed by reformating and reinstalling the operating system. But what if you don’t have the knowledge to do that or don’t have enough budget to pay for a technician to fix your almost dying PC? But what if I tell you that you can bring back the life of your crawling computer back to it’s optimal days without the calling and paying for super geek to fix your computer.

I share to you this great application that I am personally using that can easily fix all your windows registry problems without breaking a sweat. I am talking about RegistryFix.

Registryfix can easily scan and fix invalid registry entries. It will tell you where are the errors and the possible damage it might cause. RegistryFix scans for errors related to ActiveX controls, DLL issues, Windows explorer errors, Windows installer issues, Internet Explorer errors, Iexpore and System32 errors, Runtime errors, Outlook and Outlook Express Errors, EXE errors, Svchost errors and a wide variety of other system issues.

Download this great registry tool to have a faster highly reliable system that runs perfectly all the time.

DOWNLOAD REGISTRYFIX

How to remove SCVHOST.exe (W32/YahLover.Worm.gen or Win32/Autorun.R.worm)

slavezero — Wed, 03 Dec 2008 04:20:54 +0000

This type of worm hides itself as SCVHOST.EXE or SCVHOSTS.EXE so it will look like the legitimate Windows program SVCHOST.EXE. This type of virus usually spread through Yahoo Messenger. This virus is also known as W32/YahLover.Worm.gen and Win32/Autorun.R.worm. One way to avoid infection from this virus is to ignore any invites from unknown friends.

This virus/worm installs itself in autorun.inf and once double click it will spread itself unto your system. Furthermore, it copies itself through all the shared folders on your computers throughout the network and installs itself in the registry entries remotely.

Here are indication that your computer is infected with this virus.

This virus/worm blocks the task manager.(way to fix your task manager)

The worm changes the registry to prevent running task manager and editing registry for harder detection. (way to enable registry editor)

It automatically restarts the computer when you try to go to the command prompt.

It duplicates itself to different locations of the shared folders. The duplicated virus/worm uses a FOLDER icon with an .exe file extension. WARNING! DO NOT double click these folders.

It autostart via registry keys Windows->Run and add itself to WinNT->WinLogon->Explorer.exe

How to remove the virus

You can use NOD32 or any strong antovirus programs to remove this virus but if you don’t have a anti-virus or your antivirus can’t remove this virus try following the steps below to remove it manually.

Boot your system in Safe Mode Command Prompt Only (How to start Windows in safe mode)

After you log-in the command prompt will be opened (LOG-IN AS ADMINISTRATOR).

Type CD C:\WINDOWS\SYSTEM32 (I assume that your Windows System files are located at Drive C)

Type DIR /ah, this will display all hidden files on this directory folder. You will see the following files which is used by the virus to spread itself: AUTORUN.INI, BLASTCLNNN.EXE, and SCVHOST.EXE

Type ATTRIB -H -R -S SCVHOST.EXE

Type ATTRIB -H -R -S BLASTCLNNN.EXE

Type ATTRIB -H -R -S AUTORUN.INI

Type DEL SCVHOST.EXE

Type DEL BLASTCLNNNN.EXE

Type DEL AUTORUN.INI

Type CD\

Type ATTRIB -H -R -S AUTORUN.INF

Type DEL AUTORUN.INF

After following the steps on removing the virus/worm files, the virus should now be removed from the registry of your system.

At the command prompt type REGEDIT and press ENTER key. This will run the Registry Editor

From the registry, look for the keys: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, you will see an entry Yahoo! Messengger (it’s spelled like this) with a value c:\windows\system32\scvhost.exe, Delete this entry.

Look again for the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, there’s an entry named: SHELL, it has a value = Explorer.exe SCVHOST.EXE , DON’T delete this entry!!! Just edit this entry and REMOVE the SCVHOST.EXE so that Explorer.exe will be the only value that remains from this registry entry.

After carefully following all the steps restart your computer on normal mode and the virus should now be gone.

How to fix “Registry editing has been disabled by your administrator”

slavezero — Tue, 02 Dec 2008 03:11:14 +0000

One of my reader just emailed me and he wants to remove the virus from his computer manually but his problem was he cannot open his registry editor it say’s that “Registry Editing Has Been Disabled By Your Administrator”. This type of problem usually also happens to me when I am working on a virus, trojan or spyware infected computer. Regedit is one of the most important command of Windows that is also why virus makers love’s to disable the Registry Editor so it makes solving the problem and removing the issue difficult.

Viruses are not always the reason for this issue sometimes administrators in I.T. departments place a restrictions on using the regedit command to keep employees from changes things on company computers, on his case his registry is disabled by a virus.

Below are the different ways that I recommend to enable his Registry Editor.(the #1 method successfully worked for him). Although there are a few other ways, the four ways below are the way that I have used with great success in re-enabling the REGEDIT command.

#1 Using a registry tool.

You can use regtools.vbs to enable your registry. This is a VBscript that enables or disables the Registry Editor based on the following location in the registry. Of course, since the registry editor is disabled, you can’t change it manually. Visit the site for more information http://www.dougknox.com/security/scripts_desc/regtools.htm

After downloading regtools double-click on it to run it, then reboot your computer and try to open the Registry Editor.

This works best but If this fix didn’t solve your problem, try the other ways below.

#2 Using Symantec’s tool to reset shell\open\command registry keys

Sometimes worms and trojans will make changes to the shell\open\command registry entries as part of their infections. This will cause the virus to run each time you try to run an .exe file such as the Registry Editor. In these cases, visit Symantec’s website and download the UnHookExec.inf file to your desktop. Right-click on it and choose Install. Restart your computer and then try to open the Registry Editor.

#3 Renaming Regedit.com to Regedit.exe

Some viruses and other malware will load a regedit.com file that is many times a zero byte dummy file. Because .com files have preference over .exe files when executed if you type REGEDIT in the run line, it will run the regedit.com instead of the real regedit.exe file.

Delete the regedit.com file if its a zero byte file to restore access to REGEDIT. In some cases, such as the W32.Navidad worm, you’ll need to rename the REGEDIT file to get it to work.

#4 Changing Windows XP Professional and Group Policy Editor

If you have Windows XP Professional and access to an administrative user account, you could change the registry editor options in the Group Policy Editor.

Click on Start then Run

Type GPEDIT.MSC and Press Enter

Go to the following location

User Configuration

Administrative Templates

System

In the Settings Window, find the option for “Prevent Access to Registry Editing Tools” and double-click on it to change.

Select Disabled or Not Configured and choose OK

Close the Group Policy Editor and restart your computer

Try opening REGEDIT again