① Copy the following file to notepad and save it as a file with the extension reg!
REGEDIT4
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
"DisableRegistryTools" = dword: 00000000
② Copy the following file to notepad and save it as a file with the extension reg!
REGEDIT4
[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
"DisableRegistryTools" =-
③ Copy the following file to notepad and save it as a file with the extension reg!
REGEDIT4
[-HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]
④ Copy the following file to notepad and save it as a file with the extension vbs. (Note: after super solution is installed, the vbs file opening method has been changed. You can reinstall WSH )!
Dim WSHShell
Set WSHShell = WScript. CreateObject ("WScript. Shell ")
WSHShell. RegDelete "HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem"
⑤ Copy the following file to notepad and save it as an htm file!
<Html>
<Body>
<Script language = "javascript">
Var shl = new ActiveXObject ("Wscript. shell ");
Shl. RegWrite ("HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System \ DisableRegistryTools", 0, "REG_DWORD ");
Window. alert ("your registry editor has been disabled! ")
</Script>
</Body>
</Html>
6. Copy the following file to notepad and save it as a file with the extension inf (right-click and choose "Install )!
[Version]
Signature = "$ Chicago $"
[Defainstall install]
DelReg = DeleteMe
[DeleteMe]
HKCU, "SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem", "DisableRegistryTools"
7. Unlock the Registry under dos:
Regedit/d KEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
⑧ Copy the following file to notepad and save it as a file with the js extension!
Var WSHShell = WScript. CreateObject ("WScript. Shell ");
WSHShell. RegWrite ("HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System \ DiableRegistryTools", 0, "REG_DWORD ");
WSHShell. RegDelete ("HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System \");
For windows2000/XP
In the "Start" menu, "Run" "gpedit. msc open "Group Policy Editor", select "Local Computer Policy"> "user configuration"> "manage module version"> "system", and right-click "Disable registry editing tool" (2000) in the right window) or "prevent access to the registry tool" (XP). If it is set to "disabled", the Registry Editor will be disabled. If it is unlocked, the opposite will be disabled.
An amazing way to unlock the Registry: System Policy Editor
Many people browse malicious websites, causing the registry to be locked. Related newspapers and periodicals introduce various solutions, such as editing registry files or using Super Rabbit tools to modify them. But what if you don't have such tools and can't remember the contents of the Registry file? In fact, you can use the System Policy Editor (Poledit), another powerful tool provided by Microsoft in the system installation disc, to easily solve this problem. In addition, you can also use the System Policy Editor to implement functions that can only be implemented by modifying the registry.
We will use Windows 9x as an example. Run the System Policy Editor. (If you are prompted that the template file cannot be found, select "template" from the "options" menu of the System Policy Editor, click "Open template", and then select Admin. adm file ). Select "open registry" in the "file" menu, and then you will find two icons in the original blank panel: "Local Computer ", one is a "Local User ".
We will mainly use "Local Users" ("Local Computer" mainly involves network and system settings. If you are interested, you can try it on your own ). Double-click "Local User" to bring up the "local user attributes" interface, where you can see a tree directory, the options include "Control Panel", "desktop", "network", "shell", and "system.
Let's take a look at the power of the System Policy Editor! For the Registry lock example mentioned above, we only need to select the "System> limit" option to see four options. If your registry is locked, the check box before "Disable Registry Editor" is selected. Cancel the selection of this option and return it to the main interface according to "OK. Don't worry. The work is not finished yet! Select "File> Save" to make the changes take effect. Then try to Run Regedit. Can it be used? In fact, you can also implement many frequently-used personalized settings in these five basic directories. Here we will not talk much about it. Let Readers discover it slowly.
Tip: in Windows 2000/XP/2003, click Start> Run, enter Gpedit. msc, and press enter to open the Group Policy ". Expand "user configuration> management template> System", double-click "Disable registry editing tools" in the right window, and select "disabled" in the displayed window ", "OK" and then exit the "Group Policy" to unlock the registry.
Why registry repair fails
The mean means of malicious web pages is "new. After some simple registry repair methods are used, the problem cannot be completely solved. If your registry is changed again after it is restored, check if it is caused by the following reasons?
1. Modify the forbidden command form of the registry to prevent users from repairing it through the registry.
The most common modification is to lock the registry and corrupt associations such as. reg,. vbs, And. inf.
The methods for unlocking the Registry have been described earlier. As for the Association to be modified, any of them can be used as long as the association in the method of modifying the registry can be used, however, if. reg ,. vbs ,. the inf has been modified. What should I do ?, Don't worry. Change the. exe suffix to the. com suffix. I can edit the registry and change. com. What should I do? Not that cool. OK. I will change the suffix to. scr. Hey, you can also modify it.
The best and easiest way is to immediately restart the system, press F8 to enter DOS, input SCANREG/RESTORE, and select the previous normal registry to RESTORE, select the Registry when it is not modified! If you find that even scanreg has been deleted (some websites are so cruel, you just need to copy a scanreg.exe file to COMMAN.
It is necessary to talk about the common default values of file association here.
The normal exe is associated with [HKEY_CLASSES_ROOTexefileshellopencommand]
The default key value is "% 1% *". You can use the exe file by modifying the association back.
2. Leave a backdoor after you modify the Registry to make it seem that you have successfully modified the Registry. After the registry is restarted, It is restored to the modified status.
This is mainly because a backdoor is left in the startup Item. You can open the Registry (you can also use some tools such as the optimization master to check it)
HKCUSoftwareMicrosoftWindowsCurrentVersionRun
HKCUSoftwareMicrosoftWindowsCurrentVersionRunOnce
HKCUSoftwareMicrosoftWindowsCurrentVersionRunServices
HKCUSoftwareMicrosoftWindowsCurrentVersionRun-
Check whether there are any suspicious startup projects. Which of the following are ignored by my friends?
I want to give a few tips, and the key value in the startup item has the .hmland .htm suffixes. It is best to remove them, as well as the startup item with the. vbs suffix. There is also a very important one. If there is a startup Item, there are similar key values, for example:
The system key value is regedit-s c: windows ...... Please note that this regedit-s is a backdoor parameter of the Registry and is used to import the Registry. This option must be removed.
Another type of modification will generate a. vbs suffix file or a. dll file in c: windows. In fact, the. dll file is actually a. reg file (a malicious webpage virus installed as a DLL file)
Now you need to check c: windowswin. INI file, check whether load =, run =, these two options should be empty behind, if there are other programs to modify load =, run =, Will = after the program is deleted, before deletion, check the path and file name. After deletion, delete the corresponding file under system.
Another method is to search for all the files in drive C if you repeatedly modify, restart, and restore them. the vbs file may be hidden. Use the notebook to open it. You can see that all the items in the file that modify the Registry delete it or change the suffix for the sake of insurance, you can search for files by virus time on a malicious webpage :)
The following vulnerability deserves your attention. Many friends have said that I have tried all the methods you mentioned. There is absolutely no suspicious content in the startup item, and there is no vbs file, there is another trap when you start IE, that is, the advertisement in the tool menu on the main IE interface must be removed, because these will be started when you start IE, so do not try to open the IE window before modifying the other items. Otherwise, it will be a waste of effort. Method: Open the Registry HKEY_LOCAL_MACHINESoftwareMicrosoftInternet assumerextensions and delete the advertisement!
An important issue is that you must first clear all temporary IE files after the trap of malicious web pages. Remember!
How can we defend against such malicious web pages?
A permanent way to delete the F935DC22-1CF0-11D0-ADB9-00C04FD58A0B ID in the Registry path to HKEY_CLASSES_ROOTCLSID {F935DC22-1CF0-11D0-ADB9-00C04FD58A0B}
Remember to delete the file after reading it clearly. Never delete the file. Removing this F935DC22-1CF0-11D0-ADB9-00C04FD58A0B does not affect the system.
In the IE menu bar, select "Tools"> "Internet Options". In the displayed dialog box, switch to the "Security" tab, select "Internet", and click "Custom Level, in the "Security Settings" dialog box, select "Disable" or "prompt" for all options in "ActiveX Control and plug-in" and "script. However, if you select "Disable", some websites that normally use ActiveX and scripts may not be completely displayed. Suggestion: prompt. When a warning occurs, check the original code of the website. If any Shl occurs. do not go to RegWrite or other code. If the original code is encrypted, do not go to websites that are not familiar with it.
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
