Jump to content

Malwarebytes

RegAssassin didn't work ?


9 replies to this topic

#1
lbdyck

    New Member

  • Members
  • Pip
  • 5 posts
I downloaded RegAssassin and tried to delete this key:

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows Media Device ManagerPluginsSPMSPMSPKBDeviceList

And was told that it was not visible to RegAssassin. It then said after a click (or 2) that it had deleted it yet it is still there.

This key is locked and using regedit I get a message that it can not be opened. I've tried in SafeMode using Admin with the same lack of succcess.

This is a windows xp home sp2 laptop.

Thanks

This is not the proper forum for RegASSASSIN support. Have you tried resetting the permissions manually?

I'm sorry - didn't know which is the proper forum.

I've tried resetting permissions in both normal and safe mode. tried using various registry cleaners. performed full anti-spyware/malware scans and anti-virus scans.

Thanks

If you can't reset permissions manually, RegASSASSIN will not be able to do it either unfortunately. What kind of permissions did you try to give the key?

I gave administrator and my account full privileges.

thx

This is a very interesting problem. Is this on Vista?

Windows XP Home SP2.

Happened after install of windows media player 11

tried to backout wmp11 and that didn't work - followed a suggestion to delete the wmp11 files/etc. and that didn't help. now if i try to rollback it asks for the install media where the eula.txt is (I created a dummy eula.txt in a folder but that didn't work). the wmp11 install log indicates it could not update that registry key.

Have you tried following these steps to reset the key permissions?

http://support.microsoft.com/kb/310426

#2
JeanInMontana

    Delete this account!!

  • Honorary Members
  • PipPipPipPipPipPip
  • 3,867 posts
  • Interests:would love to see some honesty around this site.
What is this? It looks like someone has given answers somewhere and you added them to your post. Why are you trying to delete the key?

#3
Hardhead

    Elite Member

  • Experts
  • PipPipPipPipPip
  • 795 posts
  • Location:Blue Ridge, Va.

View PostJeanInMontana, on Apr 21 2008, 06:32 PM, said:

What is this? It looks like someone has given answers somewhere and you added them to your post. Why are you trying to delete the key?
My goof up Jean as I was trying to move the post and merge it in help forum here.

Sorry :angry:

Posted Image
Member Since 2004
Calendar of Updates?Posted Image
Posted Image


#4
nosirrah

    Forum Deity

  • Administrators
  • PipPipPipPipPipPip
  • 5,158 posts
  • Location:Northampton, MA USA
This could be from the bug in regassin I found the other day . If it is then the reason it did not work is that below this key are keys that are also locked .

From the permissions tab I would first claim ownership and set everyone as a full access user .

Then click advanced and tell this key to push its permissions onto the keys under it .

Close regedit and open it again .

See if that key has any keys under it , if it does try to delete them . If deleting them fails then claim ownership and set everyone as a full access user .

You may have ti tinker for a while before you find the actual key where things are hung up .

It could also be a case of a embedded null or corrupt key , this will be a little harder to solve .
Bruce Harrison
Vice President of Research

Posted Image

Follow us: Twitter, Become a fan: Facebook

#5
lbdyck

    New Member

  • Members
  • Pip
  • 5 posts
Thanks - I have tried to change permissions and push it down with no success. I'm traveling this week and won't be home to try anything until this weekend. Thanks for all the suggestions. I noticed somewhere a tool to clean up registry entries with nulls - perhaps I'll give that a try too.

Thanks again

#6
AdvancedSetup

    Forum Deity

  • Administrators
  • PipPipPipPipPipPip
  • 22,570 posts
  • Gender:Male
  • Location:US
RegDelNull v1.1
By Mark Russinovich
Published: November 1, 2006

RegDelNull v1.1
Ron Lewis
Manager, Online Support

Posted Image

Follow us: Twitter, Become a fan: Facebook

If you've posted to the HJT forum and it has been over 5 days without a response please send a Private Message asking for assistance.

#7
lbdyck

    New Member

  • Members
  • Pip
  • 5 posts
Thanks AdvancedSetup - I tried that tool without success. It ran but found nothing.

At this point I'm truly baffled.

#8
JeanInMontana

    Delete this account!!

  • Honorary Members
  • PipPipPipPipPipPip
  • 3,867 posts
  • Interests:would love to see some honesty around this site.

View PostHardhead, on Apr 21 2008, 04:36 PM, said:

My goof up Jean as I was trying to move the post and merge it in help forum here.

Sorry :angry:

^_^ NP just sorting, so we can help.

#9
lbdyck

    New Member

  • Members
  • Pip
  • 5 posts
The solution was provided to me by Phil Han of Microsoft. It was to download a file Reset_Subinacl.zip and run the reset.cmd within. Then boot into safe mode and rename \windows\system32\spupdsvc.exe to spupdsvc.old. After a reboot to normal I was able to view the problem registry entry and then install windows media player 11.

Thanks for all the suggestions.

#10
AdvancedSetup

    Forum Deity

  • Administrators
  • PipPipPipPipPipPip
  • 22,570 posts
  • Gender:Male
  • Location:US
Here is further information for those interested.

Download subinacl

SubInACL documentation

Using the Command Line to Edit Multiple Subdirectory Permissions

This works but is not really the Microsoft approved method (but less dangerous than the approved method)
Solving setup errors by using the SubInACL tool to repair file and registry permissions

This is the more approved method from Microsoft
How to reset security settings back to the defaults
Ron Lewis
Manager, Online Support

Posted Image

Follow us: Twitter, Become a fan: Facebook

If you've posted to the HJT forum and it has been over 5 days without a response please send a Private Message asking for assistance.





1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users

Follow Us