My computer (Windows XP Home Edition SP3) is changing registry values by itself.
Under HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, I have DisableRegistryTools
and DisableTaskMgr
set to 0
:
However, for some reason, the values jump back to 1
after a couple of seconds. And regardless of how many times I set it to 0
, it will soon jump back to 1
after a while.
Thinking that it may be some rogue program, I downloaded Process Explorer and took a look at the running processes:
All the processes are from Microsoft, Apple, NVIDIA, and Oracle, and they look pretty authentic.
Next, as suggested, I killed rundll32.exe and ran Process Monitor. In Regedit I queried HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools (it returns 1
). Then I changed the value to 0
, as shown:
... (there's alot of entries, I was searching for the string "disableregistrytools") ...
12:25:34.8264490 AM regedit.exe 3192 RegQueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
12:25:34.8264696 AM regedit.exe 3192 RegQueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
12:25:35.9547009 AM regedit.exe 3192 RegSetValue HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 0
...
I waited for roughly 2 minutes. Process Monitor is constantly updating its values, yet searching for the string "disableregistrytools" yields no furthur results. Then at 12:27:35, I performed a double-click in the Registry Editor program on the value DisableRegistryTools
so that I can read its updated value:
The value jumped from 0 to 1.
Returning back to Process Monitor, now I see two additional entries when searching for the string "disableregistrytools":
...
12:27:35.6996148 AM regedit.exe 3192 RegQueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
12:27:35.6996148 AM regedit.exe 3192 RegQueryValue HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
...
For some reason Process Monitor seems to fail to log the registry change.
What may be causing the problem?
Best Answer
Use the Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.
More informations, read this page: http://technet.microsoft.com/en-us/sysinternals/bb896645