[eXceed69]

I had my partition for file desregation..something..i uninstall some program but we all know all uninstall program had to register on the the drive..i want to delete their registry by regedit..but my problem is i couldn't run regedit on run engine of my OS ..it always prompt me with some program are using regedit, what should I do to fix this...

[William_Wilson]

try:
start\run\cmd

if you can do that, then it's probably not a virus. But humour me and try renaming regedit.exe, to regedit.com and try running it.

Let me know what happens.

[eXceed69]

Renaming regedit.exe is that crucial to my OS??could my crash for that action

[William_Wilson]

if you are uncomfortable with this, just make a copy. Regedit is not your actual registry, simply an application to view it in GUI form

[eXceed69]

Quote

Regedit is not your actual registry, simply an application to view it in GUI form

but where i could find regedit?....and then my problem is i can't view the GUI form of it, it keeps me prompting that thing

[born2c0de]

I've had this problem before.
It's some virus.

William_Wilson is right, the registry is intact, only the viewer is infected.

Here's what I did to remove it:

The Virus has infected the Registry so that removing it from the Startup Key becomes difficult.
So here's what you gotta do:

• Download a Freeware Registry Viewer/Editor.
  
• Use it and Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run and remove any suspicious entry. Also navigate to HKEY_CURRENT_USER\...same as above...\Run and do the same.
  
• Once that is done, try to remove regedit.exe. You should get an Access Denied Error, which means that the program is running in memory.
  
• Restart and Boot in Safe Mode (Not necessary, but do it). Delete the regedit.exe file and the file that was mentioned in the Registry Startup Key.
  
• Goto www.filesearching.com and download a copy of regedit.exe or install it from your Windows CD.
  
• Restart and you're back to normal.

[eXceed69]

Thankz I'll try does things back at home...If any scenario might happen i'll pop this thread again

[eXceed69]

It's confirm all you had been right...I cannot run the cmd on run...so probably right..I currently following whats born2code said...daownloading a freeware...hope i search it soon..

I see nPad2

What file i should download..it is so many

There so many regedit here

I hope some one had a specific software for that

This post has been edited by eXceed69: 26 November 2006 - 05:27 PM

[eXceed69]

just for the record if someone will be having the same problem...

I follow all Born2code had said...

but the virus is already infected my station.

Quote

here some what i found:
win32:Ircbot-ABQ
win32:Ircbot-ABP [Trj]

avast had detected that and i already deleted those infected file.

Thanks it's now okey...