DelphiFAQ Home Search:

The registry editor does not work - it closes itself!

 

comments63 comments. Current rating: 4 stars (11 votes). Leave comments and/ or rate it.

Question:

I believe to have a virus or malware on my computer and want to clean it up in the registry. But I cannot open the registry editor - the registry editor closes upon about 5 seconds to opening it. So I keep opening registry editor and every time I opened it, about 5 seconds later it closes itself.

Answer:

Many trojan horses, viruses and other malwares make changes to the registry. They may one or more of the shellopencommand keys. By changing these keys they can make themselves be executed each time that you 'open' a certain type of file e.g. if they modified the exefileshellopencommand key then the trojan will be invoked every time you start any (!) executable file.

One common trick is to disable the registry editor, so that it is more difficult for you to get rid of the trojan horse. Yes, Microsoft provides such a key in the registry - under

HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System

you will find an entry DisableRegistryTools which can be 0 or 1. By default this entry does not even exist which means you are allowed to edit the registry.

Here is an installer script which you can download and have it execute and it should restore your original settings. It does not do any magic. It will simply reset the shell open command for executable files:
.exe, .com, .bat, .pif, .scr (screensavers!)
and also for .reg files (registry data files).

Further on it will re-enable editing the registry alltogether and make sure that the application associated with registry batch files (*.reg) is indeed the official registry editor and not some trojan horse.

Instructions:
  1. download this file by right-clicking on the link and save it to your desktop
  2. right-click on the file and select 'install'

It will not display any success message but your registry editor will work now again.

Note:
It is important that you right-click on the link and save the file as described. If you just click on it, it will probably open in Notepad. (You could save it from there to the desktop though.)



Content-type: text/html

Comments:

You are on page 1 of 5, other pages: [1] 2 3 4 5
2006-01-11, 11:48:11
from United States  
hello,
i got the spy sheriff removed and i downld the 'this file' for regedit followed instr but it still will not me to access the RegEdit.exe could you please help
2006-01-16, 04:10:11
anonymous from United States  
to anonymous:

1) you need to save the file to the desktop
2) then RIGHT-CLICK on it and select option 'INSTALL' (NOT 'open' - which would bring notepad)

2006-01-26, 02:10:46
anonymous from United States  
it dosent say install it says open and save now what plz help me
2006-01-26, 02:28:54
anonymous from United States  
i put it on my desktop but when i click on install it dosent do n e thing
could u help me
2006-01-27, 17:09:02
anonymous from United States  
Possibly you can get it to run if you open it from the RUN window? Go to START and then select RUN. Browse from there and find the location where you downloaded the file and try to run it from there.
2006-02-05, 12:25:56
anonymous from France  
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersioolicies\ Explorer
HKEY_CURRENT_USER\Software\Microsoft\Windowdows\CurrentVersion\Policies\ActiveDeskt
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersionion\Policies\System
neither Explorer nor Active Desktop nor System can be found in my regitery editor and i can not follow any of the advises below
Can you please hHKEY_CURRENT_USER\ Software\Microsoft\Windows\CurrentVersion\P
2006-02-22, 19:13:11
[hidden] from United States  
rating
Your script file
http://www.delphifa..cOpen.inf
is missing. I need it to restore my
exe and other files.
Thanks
Fred
2006-02-22, 20:14:47
Peter (Admin) from United States  
the script and other files in this folder have been restored.
delphifaq.com moved this month to a new webhost and somehow this folder was ignored during the move.

My apologies.
2006-03-01, 15:17:09
anonymous from Canada  
rating
this doesnt do anything
2006-03-17, 19:54:59
anonymous from United States  
how can i fix my regeedit the unhookexecopen isnot working what shld i do
2006-04-15, 00:43:33
anonymous from United States  
Wow, thnk u so much i appreciate ur help ALLOT.
2006-05-13, 21:41:50
anonymous from United States  
how can i fix my regeedit the unhookexecopen isnot working what shld i do ??
2006-05-13, 21:44:17
[hidden] from United States  
how can i fix my regeedit the unhookexecopen isnot working what shld i do ??
2006-05-17, 15:48:53
anonymous from Australia  
hi look it goes to work then just stops this spy sheriff really suxs is there anything else i could try
2006-05-25, 21:22:01
anonymous from Australia  
Hi, my computer got infected with spy sheriff just yesterday. My regedit and my task manager wouldn't open. I tried your file 'UnHookExecOpen.inf' - saving it and installing it, but my regedit still wouldn't open. Any idea what I should do? Please help me.
You are on page 1 of 5, other pages: [1] 2 3 4 5

 

 

NEW: Optional: Register   Login
Email address (not necessary):

Rate as
Hide my email when showing my comment.
Please notify me once a day about new comments on this topic.
Please provide a valid email address if you select this option, or post under a registered account.
 

Show city and country
Show country only
Hide my location
You can mark text as 'quoted' by putting [quote] .. [/quote] around it.
Please type in the code:

Please do not post inappropriate pictures. Inappropriate pictures include pictures of minors and nudity.
The owner of this web site reserves the right to delete such material.

photo Add a picture: