Go Back   Technibble Forums > Technical Discussions > Security, Viruses and Trojans

  Technibble Sponsor

Reply
 
Thread Tools Display Modes
  #1  
Old 05-28-2011, 08:21 AM
COB COB is offline
 
Join Date: Mar 2011
Location: Dublin, Ireland
Posts: 69
COB is an unknown quantity at this point
Default Registry changes not sticking

Hi Guys,

I would appreciate a bit of help on this one. i got a computer in recently and removed in excess of hundreds of instances of malware, trojans etc. The only problem is it is still bluescreening when rebott in normal mode.

When I reboot in safe mode it is fine but I cannot implement startup
changes etc. I do se edit the registry etc but when I reboot all my changes have been reversed. I have just fininshed a scan with the Kaspersky rescue disk so I'm pretty sure I got everything. It did have Mcafee and Norton and I think I have removed the lions share of these manually but can't be certain as the uninstallers won't run in safe mode.

Is it possible the registry is being sandboxed somehow? Does anyone know if this can be checked or what programs might do such a thing?

All help appreciated.

Cathal
Reply With Quote
  #2  
Old 05-28-2011, 08:59 AM
TLE's Avatar
TLE TLE is offline
 
Join Date: May 2009
Location: UK
Posts: 1,239
TLE is on a distinguished road
Default

Quote:
Originally Posted by COB View Post
Hi Guys,

I would appreciate a bit of help on this one. i got a computer in recently and removed in excess of hundreds of instances of malware, trojans etc. The only problem is it is still bluescreening when rebott in normal mode.

When I reboot in safe mode it is fine but I cannot implement startup
changes etc. I do se edit the registry etc but when I reboot all my changes have been reversed. I have just fininshed a scan with the Kaspersky rescue disk so I'm pretty sure I got everything. It did have Mcafee and Norton and I think I have removed the lions share of these manually but can't be certain as the uninstallers won't run in safe mode.

Is it possible the registry is being sandboxed somehow? Does anyone know if this can be checked or what programs might do such a thing?

All help appreciated.

Cathal
What message does the Blue Screen give? You can disable the restart on a stop message so that you have time to read the error. You can do this in the start up options when you press F8.

Sounds to me as though a driver has been deleted. I doubt the sanbox would be running in Safe mode.
Reply With Quote
  #3  
Old 05-28-2011, 05:45 PM
Xander's Avatar
Xander Xander is online now
 
Join Date: Oct 2008
Location: Niagara region, Ontario
Posts: 6,695
Xander is a jewel in the roughXander is a jewel in the roughXander is a jewel in the roughXander is a jewel in the rough
Default

It does nobody any good to mention a bluescreen error and provide no details about it. Nobody can help if you don't provide the right information.
__________________
Xander St Catharines Computer Repairs

New here? Watch this and read this. Remember, it's not our problem, it's yours so ask your questions well.
e.g. Make/Model#, Win version/SP#, BSOD 0x#. Consider posting Event Viewer logs, Autoruns exports or Speccy reports.
More info means better answers and less snark.

Don't be parasitic and only pose your own questions. Help others.

D7 question/idea/etc? Bring it to the D7 Forums.
Reply With Quote
  #4  
Old 05-28-2011, 08:32 PM
Vicenarian's Avatar
Vicenarian Vicenarian is offline
 
Join Date: Jan 2010
Posts: 1,932
Vicenarian has a spectacular aura aboutVicenarian has a spectacular aura about
Default

Quote:
Originally Posted by COB View Post
Hi Guys,

I would appreciate a bit of help on this one. i got a computer in recently and removed in excess of hundreds of instances of malware, trojans etc. The only problem is it is still bluescreening when rebott in normal mode.

When I reboot in safe mode it is fine but I cannot implement startup
changes etc. I do se edit the registry etc but when I reboot all my changes have been reversed. I have just fininshed a scan with the Kaspersky rescue disk so I'm pretty sure I got everything. It did have Mcafee and Norton and I think I have removed the lions share of these manually but can't be certain as the uninstallers won't run in safe mode.

Is it possible the registry is being sandboxed somehow? Does anyone know if this can be checked or what programs might do such a thing?

All help appreciated.

Cathal
Random guess: Are you running regedit as Administrator?
__________________
2 Corinthians 5:21 "For God made Christ, who never sinned, to be the offering for our sin (by dying in our place), so that we could be made right with God through Christ."
Reply With Quote
  #5  
Old 05-30-2011, 06:40 AM
COB COB is offline
 
Join Date: Mar 2011
Location: Dublin, Ireland
Posts: 69
COB is an unknown quantity at this point
Default

Hi guys,

The bluescreen error doesn't stay on the screen long enough for me to get any details. Using the microsoft debugging tool doesn't give me any relevant information either. I'm not really interested in the blue screen at the moment though.

For now I just want to figure out why my registry changes aren't sticking. I've edited it both directly and indirectly as admin using regedit, autoruns and msconfig. None of the changes I applied stuck. For example I disabled a string of autoruns and also tried to disable all drivers using msconfig. I closed the program and when I reopened my changes were present. When I reboot the machine the changes have disappeared. Thus, I cannot isolate the root cause any further.

Cathal
Reply With Quote
  #6  
Old 05-30-2011, 02:43 PM
Xander's Avatar
Xander Xander is online now
 
Join Date: Oct 2008
Location: Niagara region, Ontario
Posts: 6,695
Xander is a jewel in the roughXander is a jewel in the roughXander is a jewel in the roughXander is a jewel in the rough
Default

Quote:
Originally Posted by COB View Post
The bluescreen error doesn't stay on the screen long enough for me to get any details.


You do know that you can change that setting from the F8 screen, right? That's a basic tech skill.
__________________
Xander St Catharines Computer Repairs

New here? Watch this and read this. Remember, it's not our problem, it's yours so ask your questions well.
e.g. Make/Model#, Win version/SP#, BSOD 0x#. Consider posting Event Viewer logs, Autoruns exports or Speccy reports.
More info means better answers and less snark.

Don't be parasitic and only pose your own questions. Help others.

D7 question/idea/etc? Bring it to the D7 Forums.
Reply With Quote
  #7  
Old 05-30-2011, 02:50 PM
SmithFamilyDesigns's Avatar
SmithFamilyDesigns SmithFamilyDesigns is offline
 
Join Date: Apr 2011
Location: Phoenix
Posts: 289
SmithFamilyDesigns is an unknown quantity at this point
Default

With the symptoms, I would say there a rootkit. Have you tried editing the registry offline? Have you done offline scans?

Quote:
Originally Posted by COB View Post
Hi guys,

The bluescreen error doesn't stay on the screen long enough for me to get any details. Using the microsoft debugging tool doesn't give me any relevant information either. I'm not really interested in the blue screen at the moment though.

For now I just want to figure out why my registry changes aren't sticking. I've edited it both directly and indirectly as admin using regedit, autoruns and msconfig. None of the changes I applied stuck. For example I disabled a string of autoruns and also tried to disable all drivers using msconfig. I closed the program and when I reopened my changes were present. When I reboot the machine the changes have disappeared. Thus, I cannot isolate the root cause any further.

Cathal
__________________
"Never argue with a fool; onlookers may not be able to tell the difference."

http://www.SmithFamilyDesigns.com
Reply With Quote
  #8  
Old 05-30-2011, 03:14 PM
TLE's Avatar
TLE TLE is offline
 
Join Date: May 2009
Location: UK
Posts: 1,239
TLE is on a distinguished road
Default

Quote:
Originally Posted by eHousecalls.ca View Post


You do know that you can change that setting from the F8 screen, right? That's a basic tech skill.
+1

Personally, the BSOD would be my first priority. No point making Registry changes if you still can't get into windows.

What are you trying to change in the registry? May be you could provide a little more background information!

If you also have ERD commander, boot into that and run SFC tool.
Reply With Quote
  #9  
Old 05-30-2011, 03:24 PM
joydivision's Avatar
joydivision joydivision is online now
 
Join Date: Jul 2009
Location: Manchester, UK
Posts: 3,309
joydivision will become famous soon enough
Default

Sounds like a rootkit to me, no matter what changing you make when you rooboot it will edit the registry.

The blue screen is probably due to a deleted or corrupt driver which was infected.

I take it you've replaced the MBR?

In these situations I would not spend too much longer on it, of course if you have time on your hands then it will be a great education, but don't let other jobs get delayed because you're spending too much time on this.
Reply With Quote
  #10  
Old 05-30-2011, 03:53 PM
ZenTree ZenTree is offline
 
Join Date: Aug 2010
Location: UK
Posts: 616
ZenTree will become famous soon enough
Default

Quote:
Originally Posted by TLE View Post
+1

Personally, the BSOD would be my first priority. No point making Registry changes if you still can't get into windows.

What are you trying to change in the registry? May be you could provide a little more background information!

If you also have ERD commander, boot into that and run SFC tool.
+1 You've got it backwards, fix the bsod first. Gives you more info on what was/is wrong with the system and might be the missing piece for your registry issue.
Reply With Quote
Reply

Tags
corrupted profile?

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT. The time now is 06:34 PM.


Powered by vBulletin®
Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Technibble.com is based out of MELBOURNE, AUSTRALIA.