reg3dit

This one looks like and feels like the popular "Microsoft ® Registry Editor" (A.K.A. regedit.exe Eye-wink ), specifically one that comes from Win2k default installation.
It only has one (significative) difference... It will never prompt you with following message box, when started:

"Registry editing has been disabled by your administrator."

This restriction is supposed to save users from themselves. Well, if you've successfully located an override (like mine Smiling

), I hope you really know what's you're doing! My regedit clone will ignore administrator's restriction, which consist in the following registry patch:

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000001

Then, you may use reg3dit to make all the changes you need (note that on Windows NT/2k/XP & superiors some keys would still give you "Access denied", as such OSes use per-user security policies). For example, you can unpatch that DisableRegistryTools thing and simply turn back to use default regedit.exe

P.S. - reg3dit has nothing to do with the leaked Win2k source!!! I've created it by my own.

Filename/Title	Size
reg3dit.exe	30.5 KB

tavares exclusividade tenis quadras africana

stas » April 20, 2006 » 01:16

C » database » GUI » hack » software » windows

6056 reads

Funciona pra

Funciona pra 98?

tailerteilor@gmail.com

Anonymous (not verified) » July 8, 2007 » 17:45

sim!

Já testei uma vez, funciona, sim! O problema é que Windows 98 raramente tem esse tipo de restrição, pois ela só pode ser introduzida via próprio Regedit (ou uns programas "de terceiros"; ou seja, eles não vêm pré-instalados).

stas » July 8, 2007 » 21:04

"Downadup" = "Conficker" and reg3dit

Worm infected my PC 01/17/2009

I monitor & kill trojan.exe added to C: temp folder with
1. Process Explorer v11.32, replaces TaskMgr and no permissions needed.
http://technet.microsoft.com/en-us/sysinternals/default.aspx

I fix disabled regedit, taskmgr, tweakUI with no-permissions editor
"reg3dit" at http://sysd.org/stas/node/18

As of late 2/8/9, reg3dit is no longer able to correct
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
i.e., the editor runs but changes don't last.
Keys of form "DisableRegistryTools"=dword:00000001

Suggestions?

By the way, MS Windows Update trashed my PC, so I had to backlevel some weeks
with Acronis TrueImage.

Microsoft Windows Defender and latest Microsoft Malicious Software Removal Tool
are worthless.

Anonymous (not verified) » February 9, 2009 » 14:41

.SYS hook (RootKit)

It may be the kind of worm that uses .SYS hook to hide itself and reinstall every time you erase the files while booting another system... This might help: http://www.pcsupportadvisor.com/rootkits.htm
As long as I remember, I once used IceSword to kick W32/Bagle variation out of my system. Good luck!

stas » February 12, 2009 » 11:05

Navigation

CamSense

Advertising

Friends & relatives

Search site

Similar entries

Recent blog posts

my last del.icio.us links

reg3dit

Comment viewing options

Funciona pra

sim!

"Downadup" = "Conficker" and reg3dit

.SYS hook (RootKit)

Post new comment