Andy, five will get you ten that it is the permissions that are mangled,
not the key itself.
Run RegEdit.exe and right-click on the Run key, then choose
"Permissions".
Go into the "Advanced" button and choose to "Inherit from parent..." and
the permissions should get fixed up.
You should see:
Allow Users (local machine name) Read
Allow Power Users (local machine name) Special
Allow Administrators (local machine name) Full Control
Allow SYSTEM Full Control
Allow CREATOR OWNER Full Control
Aside from administrative error, the only times I've seen the
permissions modified on this part of the registry is if the bad guys are
trying to retain control of a 'bot.
Andrew 8)
________________________________
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf
Of Andy Schmidt
Sent: Monday, December 18, 2006 3:01 PM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] WAY OT: Registry Repair
Hi,
noticed today that
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
no longer opens (while logged on as the workstation's admin). I
can export the parent key - which will contain everything EXCEPT the
"run" key. But, then I can neither delete or rename the "run" key.
Renaming/deleting the parent will appear to work at first - until it
reaches the Run "subkey" - then it will again report that it cannot
access that key.
So - I am suspecting that the Run key is corrupt. It can't be
read, edited, deleted or renamed. I looked at some "registry repair"
tools, but they all seem to be Registry Optimizing tools in disguise
that fix logical "problems" in the registry (registries with too much or
supposedly bad information).
Does anyone know of a tool (for XP) that will allow me to
eliminate this bad key from the registry "index" somehow so that I can
just reimport the rest of the parent key?
Best Regards
Andy Schmidt
Phone: +1 201 934-3414 x20 (Business)
Fax: +1 201 934-9206
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
