How to stop auto-changing registry values?
My computer (Windows XP Home Edition SP3) is changing registry values by itself.
Under HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem, I have DisableRegistryTools and DisableTaskMgr set to 0:
However, for some reason, the values jump back to 1 after a couple of seconds. And regardless of how many times I set it to 0, it will soon jump back to 1 after a while.
Thinking that it may be some rogue program, I downloaded Process Explorer and took a look at the running processes:
All the processes are from Microsoft, Apple, NVIDIA, and Oracle, and they look pretty authentic.
Next, as suggested, I killed rundll32.exe and ran Process Monitor. In Regedit I queried HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools (it returns 1). Then I changed the value to 0, as shown:
... (there's alot of entries, I was searching for the string "disableregistrytools") ...
12:25:34.8264490 AM regedit.exe 3192 RegQueryValue HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
12:25:34.8264696 AM regedit.exe 3192 RegQueryValue HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
12:25:35.9547009 AM regedit.exe 3192 RegSetValue HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 0
...
I waited for roughly 2 minutes. Process Monitor is constantly updating its values, yet searching for the string "disableregistrytools" yields no furthur results. Then at 12:27:35, I performed a double-click in the Registry Editor program on the value DisableRegistryTools so that I can read its updated value:
The value jumped from 0 to 1.
Returning back to Process Monitor, now I see two additional entries when searching for the string "disableregistrytools":
...
12:27:35.6996148 AM regedit.exe 3192 RegQueryValue HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
12:27:35.6996148 AM regedit.exe 3192 RegQueryValue HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
...
For some reason Process Monitor seems to fail to log the registry change.
What may be causing the problem?
windows windows-xp windows-registry
edited May 24 '17 at 9:43
karel
9,34493239
asked Jun 2 '13 at 14:30
PacerierPacerier
11.3k63156243
add a comment |
My computer (Windows XP Home Edition SP3) is changing registry values by itself.
Under HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem, I have DisableRegistryTools and DisableTaskMgr set to 0:
However, for some reason, the values jump back to 1 after a couple of seconds. And regardless of how many times I set it to 0, it will soon jump back to 1 after a while.
Thinking that it may be some rogue program, I downloaded Process Explorer and took a look at the running processes:
All the processes are from Microsoft, Apple, NVIDIA, and Oracle, and they look pretty authentic.
Next, as suggested, I killed rundll32.exe and ran Process Monitor. In Regedit I queried HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools (it returns 1). Then I changed the value to 0, as shown:
... (there's alot of entries, I was searching for the string "disableregistrytools") ...
12:25:34.8264490 AM regedit.exe 3192 RegQueryValue HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
12:25:34.8264696 AM regedit.exe 3192 RegQueryValue HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
12:25:35.9547009 AM regedit.exe 3192 RegSetValue HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 0
...
I waited for roughly 2 minutes. Process Monitor is constantly updating its values, yet searching for the string "disableregistrytools" yields no furthur results. Then at 12:27:35, I performed a double-click in the Registry Editor program on the value DisableRegistryTools so that I can read its updated value:
The value jumped from 0 to 1.
Returning back to Process Monitor, now I see two additional entries when searching for the string "disableregistrytools":
...
12:27:35.6996148 AM regedit.exe 3192 RegQueryValue HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
12:27:35.6996148 AM regedit.exe 3192 RegQueryValue HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
...
For some reason Process Monitor seems to fail to log the registry change.
What may be causing the problem?
windows windows-xp windows-registry
edited May 24 '17 at 9:43
karel
9,34493239
asked Jun 2 '13 at 14:30
PacerierPacerier
11.3k63156243
1
Use Process Monitor to see what's changing the key.
– David Marshall
Jun 2 '13 at 15:37
@DavidMarshall, it doesn't show... (see update)
– Pacerier
Jun 2 '13 at 16:49
How did you search for the results? What happens if you add the filterPathends withDisableRegistryToolsInclude. It should then only show records where that registry key was involved (Also be extra sure you are running it as an admin, I think it automatically self elevates, but just make sure).
– Scott Chamberlain
Jun 2 '13 at 16:58
@ScottChamberlain, I've found the culprit, but I think it may have been a scape goat. Every 27 seconds Explorer.EXE will set the values back to1: screenshoot.me/GAjlFj and screenshoot.me/xGI2P0 . Since Explorer.EXE is from microsoft it couldn't have been the culprit right.. how do we know who is the real culprit?
– Pacerier
Jun 2 '13 at 18:39
@ScottChamberlain, I've tried killing Explorer.EXE. True enough, the real culprit simply finds a new scapegoat. Now Process Monitor is showing itself (ProceMon.exe) as the culprit!
– Pacerier
Jun 2 '13 at 18:47
add a comment |
My computer (Windows XP Home Edition SP3) is changing registry values by itself.
Under HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem, I have DisableRegistryTools and DisableTaskMgr set to 0:
However, for some reason, the values jump back to 1 after a couple of seconds. And regardless of how many times I set it to 0, it will soon jump back to 1 after a while.
Thinking that it may be some rogue program, I downloaded Process Explorer and took a look at the running processes:
All the processes are from Microsoft, Apple, NVIDIA, and Oracle, and they look pretty authentic.
Next, as suggested, I killed rundll32.exe and ran Process Monitor. In Regedit I queried HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools (it returns 1). Then I changed the value to 0, as shown:
... (there's alot of entries, I was searching for the string "disableregistrytools") ...
12:25:34.8264490 AM regedit.exe 3192 RegQueryValue HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
12:25:34.8264696 AM regedit.exe 3192 RegQueryValue HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
12:25:35.9547009 AM regedit.exe 3192 RegSetValue HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 0
...
I waited for roughly 2 minutes. Process Monitor is constantly updating its values, yet searching for the string "disableregistrytools" yields no furthur results. Then at 12:27:35, I performed a double-click in the Registry Editor program on the value DisableRegistryTools so that I can read its updated value:
The value jumped from 0 to 1.
Returning back to Process Monitor, now I see two additional entries when searching for the string "disableregistrytools":
...
12:27:35.6996148 AM regedit.exe 3192 RegQueryValue HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
12:27:35.6996148 AM regedit.exe 3192 RegQueryValue HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
...
For some reason Process Monitor seems to fail to log the registry change.
What may be causing the problem?
windows windows-xp windows-registry
edited May 24 '17 at 9:43
karel
9,34493239
asked Jun 2 '13 at 14:30
PacerierPacerier
11.3k63156243
My computer (Windows XP Home Edition SP3) is changing registry values by itself.
Under HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem, I have DisableRegistryTools and DisableTaskMgr set to 0:
However, for some reason, the values jump back to 1 after a couple of seconds. And regardless of how many times I set it to 0, it will soon jump back to 1 after a while.
Thinking that it may be some rogue program, I downloaded Process Explorer and took a look at the running processes:
All the processes are from Microsoft, Apple, NVIDIA, and Oracle, and they look pretty authentic.
Next, as suggested, I killed rundll32.exe and ran Process Monitor. In Regedit I queried HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools (it returns 1). Then I changed the value to 0, as shown:
... (there's alot of entries, I was searching for the string "disableregistrytools") ...
12:25:34.8264490 AM regedit.exe 3192 RegQueryValue HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
12:25:34.8264696 AM regedit.exe 3192 RegQueryValue HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
12:25:35.9547009 AM regedit.exe 3192 RegSetValue HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 0
...
I waited for roughly 2 minutes. Process Monitor is constantly updating its values, yet searching for the string "disableregistrytools" yields no furthur results. Then at 12:27:35, I performed a double-click in the Registry Editor program on the value DisableRegistryTools so that I can read its updated value:
The value jumped from 0 to 1.
Returning back to Process Monitor, now I see two additional entries when searching for the string "disableregistrytools":
...
12:27:35.6996148 AM regedit.exe 3192 RegQueryValue HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
12:27:35.6996148 AM regedit.exe 3192 RegQueryValue HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciessystemDisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
...
For some reason Process Monitor seems to fail to log the registry change.
What may be causing the problem?
windows windows-xp windows-registry
windows windows-xp windows-registry
edited May 24 '17 at 9:43
karel
9,34493239
asked Jun 2 '13 at 14:30
PacerierPacerier
11.3k63156243
edited May 24 '17 at 9:43
karel
9,34493239
asked Jun 2 '13 at 14:30
PacerierPacerier
11.3k63156243
edited May 24 '17 at 9:43
karel
9,34493239
edited May 24 '17 at 9:43
karel
9,34493239
edited May 24 '17 at 9:43
karel
9,34493239
9,34493239
asked Jun 2 '13 at 14:30
PacerierPacerier
11.3k63156243
asked Jun 2 '13 at 14:30
PacerierPacerier
11.3k63156243
asked Jun 2 '13 at 14:30
PacerierPacerier
11.3k63156243
11.3k63156243
1
Use Process Monitor to see what's changing the key.
– David Marshall
Jun 2 '13 at 15:37
@DavidMarshall, it doesn't show... (see update)
– Pacerier
Jun 2 '13 at 16:49
How did you search for the results? What happens if you add the filterPathends withDisableRegistryToolsInclude. It should then only show records where that registry key was involved (Also be extra sure you are running it as an admin, I think it automatically self elevates, but just make sure).
– Scott Chamberlain
Jun 2 '13 at 16:58
@ScottChamberlain, I've found the culprit, but I think it may have been a scape goat. Every 27 seconds Explorer.EXE will set the values back to1: screenshoot.me/GAjlFj and screenshoot.me/xGI2P0 . Since Explorer.EXE is from microsoft it couldn't have been the culprit right.. how do we know who is the real culprit?
– Pacerier
Jun 2 '13 at 18:39
@ScottChamberlain, I've tried killing Explorer.EXE. True enough, the real culprit simply finds a new scapegoat. Now Process Monitor is showing itself (ProceMon.exe) as the culprit!
– Pacerier
Jun 2 '13 at 18:47
add a comment |
1
Use Process Monitor to see what's changing the key.
– David Marshall
Jun 2 '13 at 15:37
@DavidMarshall, it doesn't show... (see update)
– Pacerier
Jun 2 '13 at 16:49
How did you search for the results? What happens if you add the filterPathends withDisableRegistryToolsInclude. It should then only show records where that registry key was involved (Also be extra sure you are running it as an admin, I think it automatically self elevates, but just make sure).
– Scott Chamberlain
Jun 2 '13 at 16:58
@ScottChamberlain, I've found the culprit, but I think it may have been a scape goat. Every 27 seconds Explorer.EXE will set the values back to1: screenshoot.me/GAjlFj and screenshoot.me/xGI2P0 . Since Explorer.EXE is from microsoft it couldn't have been the culprit right.. how do we know who is the real culprit?
– Pacerier
Jun 2 '13 at 18:39
@ScottChamberlain, I've tried killing Explorer.EXE. True enough, the real culprit simply finds a new scapegoat. Now Process Monitor is showing itself (ProceMon.exe) as the culprit!
– Pacerier
Jun 2 '13 at 18:47
1
1
Use Process Monitor to see what's changing the key.
– David Marshall
Jun 2 '13 at 15:37
Use Process Monitor to see what's changing the key.
– David Marshall
Jun 2 '13 at 15:37
@DavidMarshall, it doesn't show... (see update)
– Pacerier
Jun 2 '13 at 16:49
@DavidMarshall, it doesn't show... (see update)
– Pacerier
Jun 2 '13 at 16:49
How did you search for the results? What happens if you add the filter
Path ends with DisableRegistryTools Include. It should then only show records where that registry key was involved (Also be extra sure you are running it as an admin, I think it automatically self elevates, but just make sure).– Scott Chamberlain
Jun 2 '13 at 16:58
How did you search for the results? What happens if you add the filter
Path ends with DisableRegistryTools Include. It should then only show records where that registry key was involved (Also be extra sure you are running it as an admin, I think it automatically self elevates, but just make sure).– Scott Chamberlain
Jun 2 '13 at 16:58
@ScottChamberlain, I've found the culprit, but I think it may have been a scape goat. Every 27 seconds Explorer.EXE will set the values back to
1: screenshoot.me/GAjlFj and screenshoot.me/xGI2P0 . Since Explorer.EXE is from microsoft it couldn't have been the culprit right.. how do we know who is the real culprit?– Pacerier
Jun 2 '13 at 18:39
@ScottChamberlain, I've found the culprit, but I think it may have been a scape goat. Every 27 seconds Explorer.EXE will set the values back to
1: screenshoot.me/GAjlFj and screenshoot.me/xGI2P0 . Since Explorer.EXE is from microsoft it couldn't have been the culprit right.. how do we know who is the real culprit?– Pacerier
Jun 2 '13 at 18:39
@ScottChamberlain, I've tried killing Explorer.EXE. True enough, the real culprit simply finds a new scapegoat. Now Process Monitor is showing itself (ProceMon.exe) as the culprit!
– Pacerier
Jun 2 '13 at 18:47
@ScottChamberlain, I've tried killing Explorer.EXE. True enough, the real culprit simply finds a new scapegoat. Now Process Monitor is showing itself (ProceMon.exe) as the culprit!
– Pacerier
Jun 2 '13 at 18:47
add a comment |
3 Answers
3
active
oldest
votes
Use the Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.
More informations, read this page: http://technet.microsoft.com/en-us/sysinternals/bb896645
answered Jun 2 '13 at 15:54
stderrstderr
8,96722044
For some reason Process Monitor seems to fail to log the registry change. (see update). What may be causing the problem?
– Pacerier
Jun 2 '13 at 16:50
Try that: Click Start, Run and typegpedit.mscand press ENTER. Go to following location:User Configuration>Administrative Templates>System. Double-click Disable registry editing tools and set it toNot Configured.
– stderr
Jun 2 '13 at 17:22
1
I'm on Windows XP Home Edition. There's no gpedit.msc.
– Pacerier
Jun 2 '13 at 18:28
add a comment |
I don't know if you still need this, but I had the same problem as you. It took me 3 days to find out to fix it.
Just go to
HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
Then change the values to 0.
Then, quickly, right click the 'system folder', go to permissions and REMOVE ALL THE PERMISSIONS (Admin, SYSTEM and everything else), then apply and ok. It may ask you if you are sure about this, just click ok.
Now that no one (neither you nor the system) has the permition to change those values, it'll keep as 0 forever.
edited Sep 29 '13 at 16:29
Mokubai♦
58.1k16139157
answered Sep 29 '13 at 15:57
ighorighor
11
2
What do you mean by "System folder"? C:WindowsSystem?
– nixda
Sep 29 '13 at 16:14
1
@ighor Can you explain what does this do? It seems to make my system weaker and more susceptible to attacks right?
– Pacerier
Sep 30 '13 at 3:03
add a comment |
Dont change the permissions. It will corrupt your system. You will have to reinstall windows to correct the issue.
answered Feb 15 at 15:25
Raj BharmalRaj Bharmal
1
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f602790%2fhow-to-stop-auto-changing-registry-values%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
3 Answers
3
active
oldest
votes
3 Answers
3
active
oldest
votes
active
oldest
votes
active
oldest
votes
Use the Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.
More informations, read this page: http://technet.microsoft.com/en-us/sysinternals/bb896645
answered Jun 2 '13 at 15:54
stderrstderr
8,96722044
For some reason Process Monitor seems to fail to log the registry change. (see update). What may be causing the problem?
– Pacerier
Jun 2 '13 at 16:50
Try that: Click Start, Run and typegpedit.mscand press ENTER. Go to following location:User Configuration>Administrative Templates>System. Double-click Disable registry editing tools and set it toNot Configured.
– stderr
Jun 2 '13 at 17:22
1
I'm on Windows XP Home Edition. There's no gpedit.msc.
– Pacerier
Jun 2 '13 at 18:28
add a comment |
Use the Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.
More informations, read this page: http://technet.microsoft.com/en-us/sysinternals/bb896645
answered Jun 2 '13 at 15:54
stderrstderr
8,96722044
For some reason Process Monitor seems to fail to log the registry change. (see update). What may be causing the problem?
– Pacerier
Jun 2 '13 at 16:50
Try that: Click Start, Run and typegpedit.mscand press ENTER. Go to following location:User Configuration>Administrative Templates>System. Double-click Disable registry editing tools and set it toNot Configured.
– stderr
Jun 2 '13 at 17:22
1
I'm on Windows XP Home Edition. There's no gpedit.msc.
– Pacerier
Jun 2 '13 at 18:28
add a comment |
Use the Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.
More informations, read this page: http://technet.microsoft.com/en-us/sysinternals/bb896645
answered Jun 2 '13 at 15:54
stderrstderr
8,96722044
Use the Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.
More informations, read this page: http://technet.microsoft.com/en-us/sysinternals/bb896645
answered Jun 2 '13 at 15:54
stderrstderr
8,96722044
edited Jun 2 '13 at 16:02
answered Jun 2 '13 at 15:54
stderrstderr
8,96722044
answered Jun 2 '13 at 15:54
stderrstderr
8,96722044
answered Jun 2 '13 at 15:54
stderrstderr
8,96722044
8,96722044
For some reason Process Monitor seems to fail to log the registry change. (see update). What may be causing the problem?
– Pacerier
Jun 2 '13 at 16:50
Try that: Click Start, Run and typegpedit.mscand press ENTER. Go to following location:User Configuration>Administrative Templates>System. Double-click Disable registry editing tools and set it toNot Configured.
– stderr
Jun 2 '13 at 17:22
1
I'm on Windows XP Home Edition. There's no gpedit.msc.
– Pacerier
Jun 2 '13 at 18:28
add a comment |
For some reason Process Monitor seems to fail to log the registry change. (see update). What may be causing the problem?
– Pacerier
Jun 2 '13 at 16:50
Try that: Click Start, Run and typegpedit.mscand press ENTER. Go to following location:User Configuration>Administrative Templates>System. Double-click Disable registry editing tools and set it toNot Configured.
– stderr
Jun 2 '13 at 17:22
1
I'm on Windows XP Home Edition. There's no gpedit.msc.
– Pacerier
Jun 2 '13 at 18:28
For some reason Process Monitor seems to fail to log the registry change. (see update). What may be causing the problem?
– Pacerier
Jun 2 '13 at 16:50
For some reason Process Monitor seems to fail to log the registry change. (see update). What may be causing the problem?
– Pacerier
Jun 2 '13 at 16:50
Try that: Click Start, Run and type
gpedit.msc and press ENTER. Go to following location: User Configuration > Administrative Templates > System. Double-click Disable registry editing tools and set it to Not Configured.– stderr
Jun 2 '13 at 17:22
Try that: Click Start, Run and type
gpedit.msc and press ENTER. Go to following location: User Configuration > Administrative Templates > System. Double-click Disable registry editing tools and set it to Not Configured.– stderr
Jun 2 '13 at 17:22
1
1
I'm on Windows XP Home Edition. There's no gpedit.msc.
– Pacerier
Jun 2 '13 at 18:28
I'm on Windows XP Home Edition. There's no gpedit.msc.
– Pacerier
Jun 2 '13 at 18:28
add a comment |
I don't know if you still need this, but I had the same problem as you. It took me 3 days to find out to fix it.
Just go to
HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
Then change the values to 0.
Then, quickly, right click the 'system folder', go to permissions and REMOVE ALL THE PERMISSIONS (Admin, SYSTEM and everything else), then apply and ok. It may ask you if you are sure about this, just click ok.
Now that no one (neither you nor the system) has the permition to change those values, it'll keep as 0 forever.
edited Sep 29 '13 at 16:29
Mokubai♦
58.1k16139157
answered Sep 29 '13 at 15:57
ighorighor
11
2
What do you mean by "System folder"? C:WindowsSystem?
– nixda
Sep 29 '13 at 16:14
1
@ighor Can you explain what does this do? It seems to make my system weaker and more susceptible to attacks right?
– Pacerier
Sep 30 '13 at 3:03
add a comment |
I don't know if you still need this, but I had the same problem as you. It took me 3 days to find out to fix it.
Just go to
HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
Then change the values to 0.
Then, quickly, right click the 'system folder', go to permissions and REMOVE ALL THE PERMISSIONS (Admin, SYSTEM and everything else), then apply and ok. It may ask you if you are sure about this, just click ok.
Now that no one (neither you nor the system) has the permition to change those values, it'll keep as 0 forever.
edited Sep 29 '13 at 16:29
Mokubai♦
58.1k16139157
answered Sep 29 '13 at 15:57
ighorighor
11
2
What do you mean by "System folder"? C:WindowsSystem?
– nixda
Sep 29 '13 at 16:14
1
@ighor Can you explain what does this do? It seems to make my system weaker and more susceptible to attacks right?
– Pacerier
Sep 30 '13 at 3:03
add a comment |
I don't know if you still need this, but I had the same problem as you. It took me 3 days to find out to fix it.
Just go to
HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
Then change the values to 0.
Then, quickly, right click the 'system folder', go to permissions and REMOVE ALL THE PERMISSIONS (Admin, SYSTEM and everything else), then apply and ok. It may ask you if you are sure about this, just click ok.
Now that no one (neither you nor the system) has the permition to change those values, it'll keep as 0 forever.
edited Sep 29 '13 at 16:29
Mokubai♦
58.1k16139157
answered Sep 29 '13 at 15:57
ighorighor
11
I don't know if you still need this, but I had the same problem as you. It took me 3 days to find out to fix it.
Just go to
HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
Then change the values to 0.
Then, quickly, right click the 'system folder', go to permissions and REMOVE ALL THE PERMISSIONS (Admin, SYSTEM and everything else), then apply and ok. It may ask you if you are sure about this, just click ok.
Now that no one (neither you nor the system) has the permition to change those values, it'll keep as 0 forever.
edited Sep 29 '13 at 16:29
Mokubai♦
58.1k16139157
answered Sep 29 '13 at 15:57
ighorighor
11
edited Sep 29 '13 at 16:29
Mokubai♦
58.1k16139157
edited Sep 29 '13 at 16:29
Mokubai♦
58.1k16139157
edited Sep 29 '13 at 16:29
Mokubai♦
58.1k16139157
58.1k16139157
answered Sep 29 '13 at 15:57
ighorighor
11
answered Sep 29 '13 at 15:57
ighorighor
11
answered Sep 29 '13 at 15:57
ighorighor
11
11
2
What do you mean by "System folder"? C:WindowsSystem?
– nixda
Sep 29 '13 at 16:14
1
@ighor Can you explain what does this do? It seems to make my system weaker and more susceptible to attacks right?
– Pacerier
Sep 30 '13 at 3:03
add a comment |
2
What do you mean by "System folder"? C:WindowsSystem?
– nixda
Sep 29 '13 at 16:14
1
@ighor Can you explain what does this do? It seems to make my system weaker and more susceptible to attacks right?
– Pacerier
Sep 30 '13 at 3:03
2
2
What do you mean by "System folder"? C:WindowsSystem?
– nixda
Sep 29 '13 at 16:14
What do you mean by "System folder"? C:WindowsSystem?
– nixda
Sep 29 '13 at 16:14
1
1
@ighor Can you explain what does this do? It seems to make my system weaker and more susceptible to attacks right?
– Pacerier
Sep 30 '13 at 3:03
@ighor Can you explain what does this do? It seems to make my system weaker and more susceptible to attacks right?
– Pacerier
Sep 30 '13 at 3:03
add a comment |
Dont change the permissions. It will corrupt your system. You will have to reinstall windows to correct the issue.
answered Feb 15 at 15:25
Raj BharmalRaj Bharmal
1
add a comment |
Dont change the permissions. It will corrupt your system. You will have to reinstall windows to correct the issue.
answered Feb 15 at 15:25
Raj BharmalRaj Bharmal
1
add a comment |
Dont change the permissions. It will corrupt your system. You will have to reinstall windows to correct the issue.
answered Feb 15 at 15:25
Raj BharmalRaj Bharmal
1
Dont change the permissions. It will corrupt your system. You will have to reinstall windows to correct the issue.
answered Feb 15 at 15:25
Raj BharmalRaj Bharmal
1
answered Feb 15 at 15:25
Raj BharmalRaj Bharmal
1
answered Feb 15 at 15:25
Raj BharmalRaj Bharmal
1
answered Feb 15 at 15:25
Raj BharmalRaj Bharmal
1
1
add a comment |
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f602790%2fhow-to-stop-auto-changing-registry-values%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
Use Process Monitor to see what's changing the key.
– David Marshall
Jun 2 '13 at 15:37
@DavidMarshall, it doesn't show... (see update)
– Pacerier
Jun 2 '13 at 16:49
How did you search for the results? What happens if you add the filter
Pathends withDisableRegistryToolsInclude. It should then only show records where that registry key was involved (Also be extra sure you are running it as an admin, I think it automatically self elevates, but just make sure).– Scott Chamberlain
Jun 2 '13 at 16:58
@ScottChamberlain, I've found the culprit, but I think it may have been a scape goat. Every 27 seconds Explorer.EXE will set the values back to
1: screenshoot.me/GAjlFj and screenshoot.me/xGI2P0 . Since Explorer.EXE is from microsoft it couldn't have been the culprit right.. how do we know who is the real culprit?– Pacerier
Jun 2 '13 at 18:39
@ScottChamberlain, I've tried killing Explorer.EXE. True enough, the real culprit simply finds a new scapegoat. Now Process Monitor is showing itself (ProceMon.exe) as the culprit!
– Pacerier
Jun 2 '13 at 18:47