Search This Blog

Friday, August 16, 2013

Enable Registry Editor disabled by Administrator or Virus or Trojan or RAT

Registry Editor is a useful utility in Windows which allows users to easily change advanced Windows settings by altering registry keys present in a hierarchical arrangement called the Windows Registry. Despite being such a powerful tool, Registry Editor is not totally error-proof.

A simple virus infection is all it takes to render it useless. Or, there are times when your administrator has actually disabled Registry Editing. When you try to open the Registry Editor in one such computer, you are likely to receive the“Registry editing has been disabled by your administrator” error. Due to this error, it is impossible to remove this restriction using Registry Editor itself.

Enable Registry Editor
Windows Registry Editor

This article suggests some workarounds for re-enabling Registry editing in a computer running Windows XP, Windows Vista, Windows Server 2003/ 2008, Windows 7 or Windows 8.

Enable Registry Editor Using Group Policy Editor

  1. Click on Start. Go to Run. Users running Windows 8, Windows 7 or Vista, go to Search.
  2. Type gpedit.msc and press Enter.
  3. Navigate to User Configuration/ Administrative Templates / System.
  4. In the work area, double click on "Prevent Access to registry editing tools".
  5. In the popup window, encircle Disabled and click on OK.
  6. Normally, Registry Editor will be immediately accessible. If it is not, restart your PC.
Group Policy Editor is not available on home editions of Windows.

Enable Registry Editor
Getting access to Registry Editing

Enabling Registry Editor using UnHookExec.inf from Symantec

Symantec has created a small .inf file which can be installed to remove restrictions on modifying registry keys at the click of a mouse. Most viruses, spywares, Trojans or worms normally affect the shell\open\command keys which allows them to run each time when a file of specific type is executed. Normally, they associate their execution with .exe files. UnHookExec.inf not only enables registry editing but also removes such associations.

Just save UnHookExec.inf and install it by right clicking and selecting install. Installing the file will not show any popup or notice box.

Enable Regedit by simply running a CMD Command

  1. Open Notepad.
  2. Copy the code given below and paste it.
  3. reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /t Reg_dword /v DisableRegistryTools /f /d 0
  4. Save the file as EnableRegistry.bat. Run this file as Administrator if you use Windows 8, Windows 7 or Windows Vista. In Windows XP, simply open the file. CMD will flash for a second and then disappear. This indicates successful execution.
  5. Log Off and Log Back On.

Visual Basic Script to Enable/ Disable Registry Editor

Doug Knox has created a VBS Script which allows users  to easily enable and disable Registry Editor. Just download regedit tools.vbs and double click on it. This script reverses the current state of Registry Editor. If registry editing is set to enabled, this script will disable it and if it is disabled, it will enable it.

If the above link does not work, copy the code given below in Notepad and save the file as *.vbs or Registry Editor.vbs.

Option Explicit
Dim WSHShell, n, MyBox, p, t, mustboot, errnum, vers
Dim enab, disab, jobfunc, itemtype
Set WSHShell = WScript.CreateObject("WScript.Shell")
p = "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\"
p = p & "DisableRegistryTools"
itemtype = "REG_DWORD"
mustboot = "Log off and back on, or restart your pc to" & vbCR & "effect the changes"
enab = "ENABLED"
disab = "DISABLED"
jobfunc = "Registry Editing Tools are now "
t = "Confirmation"
Err.Clear
On Error Resume Next
n = WSHShell.RegRead (p)
On Error Goto 0
errnum = Err.Number
if errnum <> 0 then
WSHShell.RegWrite p, 0, itemtype
End If
If n = 0 Then
n = 1
WSHShell.RegWrite p, n, itemtype
Mybox = MsgBox(jobfunc & disab & vbCR & mustboot, 4096, t)
ElseIf n = 1 then
n = 0
WSHShell.RegWrite p, n, itemtype
Mybox = MsgBox(jobfunc & enab & vbCR & mustboot, 4096, t)
End If
After running the VBS file, if Registry Editing is not enabled, try restarting your PC.

other methods:-

First Method: 
Click Start -> Run -> gpedit.msc -> User Configuration -> Administrative Templates -> System -> Prevent access to registry editing tools -> Right Click Properties -> Set it to Not Configured. 


Second Method: 
Click Start -> Run. Type this command in Run box and press Ok. 

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 

Then a prompt will come up with this question: Value DisableRegistryTools exists, overwrite (Y/N)? Type yes and hit Enter. 

After u did that also type this command in the run box and hit enter. 

REG add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 

Then it will also come up with the question: Value DisableRegistryTools exists, overwrite (Y/N)? Type yes and hit Enter. 


Third Method: 
STEP1. Disable as much as you can from your startup. Remove programs from your startup folder and such, so as not to lag down the bootup process. 

STEP2.Create a new shortcut on your desktop, point it to "C:\Windows\regedit.exe" 

STEP3.Log off, then log back on. 

STEP4.As soon as you see your desktop, double click on the shortcut. The system does not check for policies until a few seconds after it booted up. If you click on the icon fast enough, it should let you get in. 

After you close it though, it will not open unless you redo step 3 and 4. 


Fourth Method: 
Getting into the registry editor by making a vbs script in notepad: 

Open Notepad and copy this script into it. And save it as regtool.vbs on your desktop. 

VBS SCRIPT(select everything and copy into notepad and save as regtool.vbs): 

Option Explicit 
'Declare variables 
Dim WSHShell, rr, rr2, MyBox, val, val2, ttl, toggle 
Dim jobfunc, itemtype 
On Error Resume Next 
Set WSHShell = WScript.CreateObject("WScript.Shell") 
val = "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" 
val2 = "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" 
itemtype = "REG_DWORD" 
jobfunc = "Registry Editing Tools are now " 
ttl = "Result" 
'reads the registry key value. 
rr = WSHShell.RegRead (val) 
rr2 = WSHShell.RegRead (val2) 
toggle=1 
If (rr=1 or rr2=1) Then toggle=0 
If toggle = 1 Then 
WSHShell.RegWrite val, 1, itemtype 
WSHShell.RegWrite val2, 1, itemtype 
Mybox = MsgBox(jobfunc & "disabled.", 4096, ttl) 
Else 
WSHShell.RegDelete val 
WSHShell.RegDelete val2 
Mybox = MsgBox(jobfunc & "enabled.", 4096, ttl) 
End If 

Open regtool.vbs And there you go!

Add To Google BookmarksStumble ThisFav This With TechnoratiAdd To Del.icio.usDigg ThisAdd To RedditTwit ThisAdd To FacebookAdd To Yahoo

0 comments:

Post a Comment