Quick Question

[Enraged Dingo]

Yah I am back - I am sorta the "Hey he knows a lil about comps, lets take it to him once we jack **** up" guy in my little town here.

So, a friend of mine who is infected with Doly called me up, I talked em through deleting all of the files, restoring msconfig.exe and regedit.exe.

One thing is throwing me though - maybe I did something wrong, I dont know , but registry editing is still disabled, so I cant fix that part. I looked it up on the net and followed a different set of instructions to fix this, still no good. All of the files it creates are gone, I cleaned out the autoexec.bat file all that is left is the registry, as I understood it - once the files were deleted, and autoexec.bat restored - all I had to do was extract msconfig and regedit.exe once again and it was resolved - cleary, I was mistaken.
Cant find any help sites that cover that part - they just say "take out these keys yhatta yhatta" well I'd do that if I could open registry , I know what key disables it, what I dont know is how to delete it from the registry, w/o starting the registry.

 

[Rollin' Rog]

There is a little reg patch here called unlock.reg that usually does the job:

http://registry.winguides.com/display.php/190/

If it's something other than the standard key for disabling the registry editor, and it's been less than 5 days since the infection occured, a scanreg /restore should fix it.

And just thought I'd post this, in case anyone wants to check out 'doly', first time I've seen it; sure looks like a mean one.


http://www.symantec.com/avcenter/venc/data/backdoor.doly.html

 

[eddie5659]

Darn, Rollin' beat me

I have found this, that shows what the attacker will have set up on his system when attacking:

http://www.commodon.com/threat/threat-doly.htm

eddie

 

[Enraged Dingo]

Yah I was gonna restore reg from a backup but only as a last resort, ill check the util out and see what happens

and yah it is pretty mean, ive been beating it with a stick for a while now gotten this far, almost done heh

ahah - its the same idea i was working on, just right a .reg file and runnin it to change DisableRegistryTools from 1 to 0
wasnt sure it would work but thats the same thing they have up to unlock , thx =)