delete a key in the registry

i tried that in safe mode, and i have full rights, and i am logged in as admin

then look if not some program is still accessing the registry key. Just try regmon

http://www.sysinternals.com/ntw2k/source/regmon.shtml

Hi :-) nobus

Ok here it is. Fix ur regitry for any duplicate entries and functions in it :-

find and correct invalid file and folder references in Windows 9x/NT/ME/2000/XP Registry;
find and delete empty registry keys;
find and correct invalid font entries;
find and delete obsolete Start Menu items;
find and correct invalid application paths;
find and correct invalid registered help files;
find and correct invalid shared DLL references;
search for matches of invalid entries on user's computer;
open folders to which invalid registry keys refer;
open Windows RegEdit at invalid registry entries;
full registry backup before any changes;
backup only modified registry entries as RegEdit4 files, so you are always able to restore certain registry changes;
save the list of found invalid entries into text file;
print the list of found invalid entries;

download it from the following link :-
http://www.fixregistry.com/download.htm

Tx
SP

>>>after deleting some malware, i

Are you sure you have deleted all malware processes from ur system ? If no then try running the followings :-

running sfc from the run box, and if virus or malware is suspected, run all those, preferably in safe mode :

CWshredder     http://www.majorgeeks.com/download4086.html
     Spybot :        http://www.download.com/3000-8022-10122137.html
     adaware :      http://www.lavasoftusa.com/
     STINGER  :   http://vil.nai.com/vil/stinger/  
http://housecall.trendmicro.com/                                       online scan for trojans
http://www.ravantivirus.com/scan/
http://www.spychecker.com/program/coolwebshredder.html          CWshredder
http://www.spychecker.com/program/hijackthis.html                        download
http://www.hijackthis.de/index.php?langselect=english                         check the log

hey there; i would like an answer to my question : how do i delete that key?
SystmProg, you keep feeding me my own answer ! i still don't mind, but it does not help !

just look what programm is accessing the registry key and kill it with the Task Manager (Str+Alt+Del) and then try to delete the key.

but which key you can't delete ?

i said it in my first post, but ok, here goes again : (2 times for 1 cent)
Wintools is the key i cannot delete in several places

and how must i see which program is accessing the key? Task manager shows nothing special

What error message do u get ?

Access is Deniend ?

>>>    i get an error saying it cannot be deleted.   <<<  
   

Have you logged in as Administrator ?

read my post dated as per today 03:35 please

Any malware process is blocking you from deleting this registry key and this process is running in Task Manager.

Can you post Task Manager process ?

>>> am looking for a solution for this problem :
after deleting some malware, i have some wintools keys left in the registry.
when i try to delete them, i get an error saying it cannot be deleted.

Do u think that i am making you fool and struggling here for points ?

"Can't delete WinTools" because any process it may be a malware or not is blocking u from deleting this key.

If not process then any service is running.

It will be helpful for me if you post all task manager processes running in background.

Thank U
SystmProg

rindi, read my post dated per 3:35 please !

Systmprog  >>   Do u think that i am making you fool and struggling here for points ?   <<< i certainly hope not, because you were always willing to respond; i will post the results from Task Manager asap, but i do not see anything suspicious. But i take it another person can sse things i don't.  I just would be happy resolving this; i am learning from every problem i had, and of course, i can do fresh install, but since i cannot delete these keys, it is kinda stinging me, and i would want to solve it - i would have learned something again!

and i tried your link to fix your registry, but this does not let me go to a key and delete it; they simply scan, and let you do things to the selected keys (it was not among them)

OK
Cool

As a professional i have exp. in Microsoft Products and how they interact with each other. So please post a log of processes.

i'm sorry, but how would i post a process list from task manager? i see no possibility to save it in a txt file.  The only thing i see is taking a screen picture, and save it.

the exact error i get is :

cannot remove wintools an error occured at the removal of the key   (...translated)

no translated

please provide the exact error message

and post the log of process tlist.exe command

Have you tried to delete all the sub-keys of that key individually?

Ok

here it is, a step by step guide follow it carefully :-
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/199762382617?OpenDocument&src=sec_doc_nam

Sorry posted wrong

Ok update :

exact error in dutch :  kan Wintools niet verwijderen : er is een fout opgetreden bij het verwijderen van de sleutel

rindi, i have followed your suggestion, but if i try to delete a subkey, i get the message : cannot delete all entries (even on a single one)

tlist.exe command is not recognised in a dos box - how do i run it? or do i miss something?

Sorry :-) its my fault that i forced you to sumbit exact error. I don't know this is in dutch.

Ok

http://www.spychecker.com/program/hijackthis.html
download this a small program
save log and post it here.

How are the permissions set for that single key? Does the administrator have the right to delete that key?

Administrator has rights to delete anything on the system.

ok try to delete using the Safe Mode

if not success then post the log

I don't agree. The administrator doesn't always have all rights. and even if he has Full control, that still doesn't mean he has the right to delete a key. Full Control only means he can delegate other rights. For certain things only the system has delete rights and not the admin.

I am talking about the File Folders and Registry permission set

not about the System Services which runs under System Account.

Sorry, I didn't notice.

:-)

systmProg, the hijackThis file is clean, but if you want to look at it, :

Logfile of HijackThis v1.98.2
Scan saved at 15:33:47, on 08/01/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Eelen Katrin\Mijn documenten\Mijn eBooks\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\Program Files\Mpath\Assets\Blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.skynet.be:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [GhostStartTrayApp] C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Besturing) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9A54032D-31F7-400D-B184-83B33BDE65FA} (MSN File Upload Control) - http://sc.groups.msn.com/controls/FileUC/MsnUpld.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab

Kill those processes and then try :-

C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\Messenger\msmsgs.exe

and using Hijack Fix the following and restart ur computer

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.be/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

and they try ?

>>>wintools keys

Tell me the registry location for this key

nobus, try this
take ownership of the key and sub keys
from the advanced button of permissions
also check the effective permissions

HKey_Local_Machine\Software\Wintools
HKey_Local_Machine\System\ControlSet001\Enum\Root\Legacy_WintoolsSVC
HKey_Local_Machine\System\ControlSet002\Enum\Root\Legacy_WintoolsSVC
HKey_Local_Machine\System\ControlSet002\Services\WintoolsSVC
HKey_Local_Machine\System\ControlSet003\Enum\Root\Legacy_WintoolsSVC
HKey_Local_Machine\System\ControlSet003\Services\WintoolsSVC
HKey_Local_Machine\System\CurrentControlSet\Enum\Root\Legacy_WintoolsSVC
HKey_Local_Machine\System\CurrentControlSet\Services\WintoolsSVC
and in the value Last key

See my post for
<<<If not process then any service is running>>>

HKey_Local_Machine\System\CurrentControlSet\Services\WintoolsSVC

Stop this service from Services.msc snap-in and then try to delete the registry

Tx
SP

a service named "WintoolsSVC" or some similar name is running in the background and it is used by the svchost.exe process running in ur Task Manager.

i can not find a Wintools service in the services list

who is shown as the owner of the reg key?

the owner is the administrator

make yourself (your logon name) the owner

i logon automatically as administrator; there are no other accounts, but i'll make another one for testing

Tou can export the registry and work on it offline and then import it from the recovery console

or for the faint of heart and lazy (like myself)

This is the best reg tool I have found and use  http://www.tucows.com/preview/195992.html

To delete certain registry keys you need to assign permissions for them to get deleted. For example: The Legacy registry keys.

OK - my standard answer for deleting IMPOSIBLE entries in the registry:  it's actually easy if you know the routine!  Some entries in the registry can only be deleted by the SYSTEM.  Not even the administrator can do that!

Open a DOS window.  Type in:  at 12:00 interactive regedit.exe

This means that at 12:00 the registry will be opened with SYSTEM privileges!  Change the time however you will - you should be able to delete anything at this time - even system drivers and services.

Just be careful what you delete - use the export function before you try anything if you're not 100% sure.  That way, you can always go back to the beginning.

Hope this helps.
Rick

HKey_Local_Machine\Software\Wintools      
This is the software entry, you will be able to delete it when you stop the service.

HKey_Local_Machine\System\ControlSet001\Enum\Root\Legacy_WintoolsSVC
HKey_Local_Machine\System\ControlSet002\Enum\Root\Legacy_WintoolsSVC
HKey_Local_Machine\System\ControlSet002\Services\WintoolsSVC
HKey_Local_Machine\System\ControlSet003\Enum\Root\Legacy_WintoolsSVC
HKey_Local_Machine\System\ControlSet003\Services\WintoolsSVC
HKey_Local_Machine\System\CurrentControlSet\Enum\Root\Legacy_WintoolsSVC
This controlSet is not used currently in ur system. You have restarted ur system many times so it is cloned to CurrentControlSet.

HKey_Local_Machine\System\CurrentControlSet\Services\WintoolsSVC
and in the value Last key

Here it is :-
HKey_Local_Machine\System\CurrentControlSet\Services\WintoolsSVC

See the following value in the Right Pane

"Description"= "something"
DisplayName"="Application Management or something
"ImagePath"="will be a file name , something.DLL"

Find the service in services.msc snap-in shown "DisplayName" and stop it.

If can not find then
Use HighJackThis utility to remove this file (in ImagePath) at reboot.

Thank U
SystmProg

Try it and let us know.

I believe you can directly access the registry from the recovery console...

update :

- spiderfix : i tried your suggestion, but none of these entries exist
---------------------
- SystmProg :   HKey_Local_Machine\System\CurrentControlSet\Services\WintoolsSVC

See the following value in the Right Pane

"Description"= "something"
DisplayName"="Application Management or something
"ImagePath"="will be a file name , something.DLL"

no such values in right pane, only : standard - Reg_SZ - no value set
There is a Enum subfolder with following values :
standard         - Reg_SZ        - no value set
0                    - Reg_SZ        - Root\Legacy_wintoolssvc\0000
Count              - Reg_Dword   - 0x0000001(1)
NextInstance    - Reg_Dword   - 0x0000001(1)
-----------------------------

huntersvc : i set the at command for 1 min later, no error, nothing happened; but does that stay active or how can i take that command out again?
--------------------------------------------
manth :  will try the recovery console now

Ok

You have this much keys and subkeys created in ur Registry :-


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINTOOLSSVC]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINTOOLSSVC\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINTOOLSSVC\0000]
"Service"="WinToolsSvc"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_WINTOOLSSVC\0000]
"DeviceDesc"="WinTools for IE service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\System\CurrentControlSet\Enum\ROOT\LEGACY_WINTOOLSSVC]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\System\CurrentControlSet\Enum\ROOT\LEGACY_WINTOOLSSVC\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\Current\System\CurrentControlSet\Enum\ROOT\LEGACY_WINTOOLSSVC]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\Current\System\CurrentControlSet\Enum\ROOT\LEGACY_WINTOOLSSVC\0000 ]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINTOOLSSVC]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINTOOLSSVC\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINTOOLSSVC\0000]
"Service"="WinToolsSvc"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_WINTOOLSSVC\0000]
"DeviceDesc"="WinTools for IE service"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Hardware Profiles\0001\System\CurrentControlSet\Enum\ROOT\LEGACY_WINTOOLSSVC]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Hardware Profiles\0001\System\CurrentControlSet\Enum\ROOT\LEGACY_WINTOOLSSVC\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINTOOLSSVC]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINTOOLSSVC\00 00]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINTOOLSSVC\00 00]
"Service"="WinToolsSvc"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINTOOLSSVC\00 00]
"DeviceDesc"="WinTools for IE service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Enum\ROOT\LEGACY_WINTOOLSSVC]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Enum\ROOT\LEGACY_WINTOOLSSVC\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet\Enum\ROOT\LEGACY_WINTOOLSSVC]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current\System\CurrentControlSet\Enum\ROOT\LEGACY_WINTOOLSSVC\0000 ]

If yes then post quick i will give you a good solution !!!

Tx
SP

and this is a SPYWARE

In safe mode you delete this folders:

C:\Program Files\Common files\WinTools
C:\PROGRA~1\Toolbar

Reboot and run HighJackThis again and fix and post a new log.

Create another administrator user and log in to that. Try the reg delete.

sipderfix
>>>Create another administrator user and log in to that. Try the reg delete.

8 Comments already posted :-)

SystmProg,

Yes, I know.

will try it and post back tomorrow.

Hi nobus,

I also use the "at" command to delete legacy keys!

Nobus

Deleting only registry entry is not the solution because this is a spyware and it could spread some other day if don't delete all files listed in my post.

:-)

Dude, I'm feeling your pain. I've installed no telling how many programs to clean wintools. I discovered my problem because MS / Giant Antispyware hung when checking this registry key. Safe Mode and other other mode didn't help. Even ran Registry Compact, Registry Healer, Registry ... None fixed it.

Here's what I did.
1. Run Regedt32 (not regedit)
2. Goto the key HKLM/software\microsoft\windows\CurrentVersion\uninstall\wintools
3. highlight it
4. click security
5. click permissions
6. click add
7. if you get the security box, enter a domain\username and password for a domain admin
8. add the user you are logged in as (assuming that the account is admin or domain admin)
9. Check the full control box
10. Click OK
11. Press the delete key and kiss that sucker goodbye.

Oh, and don't forget to thank Win-Tools for your happiness that it caused.

Robert Haviland
Hickman County Tennessee Schools