Andy, five will get you ten that it is the permissions that are mangled, not the key itself. Run RegEdit.exe and right-click on the Run key, then choose "Permissions". Go into the "Advanced" button and choose to "Inherit from parent..." and the permissions should get fixed up. You should see: Allow Users (local machine name) Read Allow Power Users (local machine name) Special Allow Administrators (local machine name) Full Control Allow SYSTEM Full Control Allow CREATOR OWNER Full Control Aside from administrative error, the only times I've seen the permissions modified on this part of the registry is if the bad guys are trying to retain control of a 'bot. Andrew 8)
________________________________ From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Andy Schmidt Sent: Monday, December 18, 2006 3:01 PM To: declude.junkmail@declude.com Subject: [Declude.JunkMail] WAY OT: Registry Repair Hi, noticed today that HKLM\Software\Microsoft\Windows\CurrentVersion\Run no longer opens (while logged on as the workstation's admin). I can export the parent key - which will contain everything EXCEPT the "run" key. But, then I can neither delete or rename the "run" key. Renaming/deleting the parent will appear to work at first - until it reaches the Run "subkey" - then it will again report that it cannot access that key. So - I am suspecting that the Run key is corrupt. It can't be read, edited, deleted or renamed. I looked at some "registry repair" tools, but they all seem to be Registry Optimizing tools in disguise that fix logical "problems" in the registry (registries with too much or supposedly bad information). Does anyone know of a tool (for XP) that will allow me to eliminate this bad key from the registry "index" somehow so that I can just reimport the rest of the parent key? Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax: +1 201 934-9206 --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.