Cannot modify/delete/change permissions on a registry key

[langis]

A few weeks ago, my cousin's machine (Windows XP SP3), using an outdated version of Java, was hit by a rather nasty Virtumonde infection. Tackling this when my schedule allowed, it took a good week for me to finally find out what Virtumonde is (I used to do IT work but moved on years ago) and how to best destroy it. I used HijackThis, AVG, HouseCall, Panda ActiveScan (which left a sour taste in my mouth), Combofix, Spybot, Smitrem (as Spybot told me it found a Smitfraud variant), AntiMalware, AdAware, SDFix, and a bunch of manual deleting of files in safe mode command prompt. Finally got to the point where no infections are found scanning with AVG and Spybot, though HouseCall still finds some sort of "generic" infection that it has no additional info for (and won't remove) and ActiveScan says that there's a "latent" Virtumonde file on my machine, but wants money to remove it. Money I'm not paying.

(EDIT - Oh, and I completely removed Java (first) and installed the latest version.)

Anywho, a few days ago, my cousin wanted to play Phantasy Star Online Blue Burst. AVG 7.5 (kept up to date) says it's a threat. It's said this before, and given that I've seen other players get this warning online but run the program anyway with no ill effects, I assume it's a false positive (the executable is psobb.exe). Regardless, scanning the file on my own machine with AVG 8, it seems not to see psobb.exe as a threat. So, as a matter of convenience, I have my cousin uninstall AVG 7.5 and install 8.

However, the installation process stops midway, as the installer cannot write a key to HKLM/Software/Microsoft/Windows NT/CurrentVersion/Windows. So I try to view this key and I'm told I don't have permissions. My cousin has two accounts on her machine; hers and the default XP admin account. Both are administrators. I try to view the key on either, and I can't. I can't add to it, modify it, or delete it. At all. I try, with both accounts, to add permissions to each branch leading to that key; I give Full Control to admins, power users, the Everyone account, and add the two machine accounts to the list as well. No luck.

So I do a search online and find that I'm not alone in encountering this issue. I try a tool from AVG meant to completely destroy past installations of its software; no luck after running that.

I tried this, both in normal and safe mode: http://freeforum.avg.com/read.php?12,149708,149709#msg-149709. No luck.
I tried this, after, again in both modes: http://freeforum.avg.com/read.php?13,160321,162947. No luck.

I tried another bout of scans with Spybot and HouseCall, and neither finds anything other than HouseCall's cryptic "generic" infection.

One thing I didn't do is run another HijackThis scan, and I'm having my cousin run one and send me the log file. Otherwise, I'm completely out of ideas. Any help would be greatly appreciated and, if my plans to take over the solar system ever do come to fruition, the planet Mercury belongs to whoever can help me.

 

[techdeuce]

Looking at the permissions on the key can you not hit the "advanced" button? then click the "owner" tab put a check in the bottom box, then highlight the administrators group, then click "take ownership". This should push the rights down into the subkeys and let you view them.
Make sure you got a backup of everything, cause you can do a bunch of damage in the registry. If that fails, it might be time for a format and reload. Good luck.

 

[langis]

Attempted to change the owner to Administrator. Reboot and still no luck. Changed it back to my cousin's user, rebooted... still cannot modify the key.

Thank you for the advice regardless.

 

[techdeuce]

definately a weird one. Good luck. If it is a weird superspyware, might be time for a format.

 

[Guest]

Had the same problem...
This way worked for me:
1) Right click the registry key and select Permissions.
2) Click on the Advanced button
3) If there is any rule prohibiting control to the Everyone group in the Permissions list, just delete it!

I hope it can help someone.

 

[deadlywave]

I've had this problem multiple times and in the first instance it was a result of windows installer files. To fix this, i managed to find what files where the culprit and removed them using the Windows installer cleanup utility. I've uploaded it here should you want it - http://www.megaupload.com/?d=8JACEOCY.

Now I just managed to fix my Error1402 issue with VCRedist, installing for a steam game. Hopefully this works for you guys.

1.Run regedit.exe.
2.Browse to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18 [This may be different on your computer, just the biggest folder I assume]\Components
3. Right click on the components folder, click permissions.
4. On all the users there, tick full control (allow) and then apply. At some points it may say it failed to set permissions for some keys, just keep going.
5. Click advanced, go to the owner tab.
6. Select whichever user you are, or administrators, tick "replace owner on subcontainers and objects" and click apply.
7. Click OK, go back to the window from beforehand and try to reapply full control settings for each user just to make sure.
8. Try your installer again

If it doesn't work keep trying to play with the permissions to make your user the owner and get all the child keys to come under your authority. If still no luck, you can manually find every key mentioned after Error1402 and manually force ownership on it.

Hopefully this helps. I'll paste this around the other sites with people having trouble with this so that hopefully the issue no longer becomes a mystery. I have an inkling it has to do with Windows Installer registry items being locked and preventing modification during other Windows Installers operating.

 

[shjacobs]

I've had this problem multiple times and in the first instance it was a result of windows installer files. To fix this, i managed to find what files where the culprit and removed them using the Windows installer cleanup utility. I've uploaded it here should you want it - http://www.megaupload.com/?d=8JACEOCY.

Now I just managed to fix my Error1402 issue with VCRedist, installing for a steam game. Hopefully this works for you guys.

1.Run regedit.exe.
2.Browse to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18 [This may be different on your computer, just the biggest folder I assume]\Components
3. Right click on the components folder, click permissions.
4. On all the users there, tick full control (allow) and then apply. At some points it may say it failed to set permissions for some keys, just keep going.
5. Click advanced, go to the owner tab.
6. Select whichever user you are, or administrators, tick "replace owner on subcontainers and objects" and click apply.
7. Click OK, go back to the window from beforehand and try to reapply full control settings for each user just to make sure.
8. Try your installer again

If it doesn't work keep trying to play with the permissions to make your user the owner and get all the child keys to come under your authority. If still no luck, you can manually find every key mentioned after Error1402 and manually force ownership on it.

Hopefully this helps. I'll paste this around the other sites with people having trouble with this so that hopefully the issue no longer becomes a mystery. I have an inkling it has to do with Windows Installer registry items being locked and preventing modification during other Windows Installers operating.

This is the one thing that worked for me after trying all the other crazy tricks posted in other places. The replace owner on subcontainers and objects is what did the trick, thank you.