Windows – How to stop auto-changing registry values

windowswindows xpwindows-registry

My computer (Windows XP Home Edition SP3) is changing registry values by itself.

Under HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, I have DisableRegistryTools and DisableTaskMgr set to 0:

enter image description here

However, for some reason, the values jump back to 1 after a couple of seconds. And regardless of how many times I set it to 0, it will soon jump back to 1 after a while.

Thinking that it may be some rogue program, I downloaded Process Explorer and took a look at the running processes:

enter image description here

All the processes are from Microsoft, Apple, NVIDIA, and Oracle, and they look pretty authentic.

Next, as suggested, I killed rundll32.exe and ran Process Monitor. In Regedit I queried HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools (it returns 1). Then I changed the value to 0, as shown:

... (there's alot of entries, I was searching for the string "disableregistrytools") ...
12:25:34.8264490 AM regedit.exe 3192    RegQueryValue   HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
12:25:34.8264696 AM regedit.exe 3192    RegQueryValue   HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
12:25:35.9547009 AM regedit.exe 3192    RegSetValue HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 0
...

I waited for roughly 2 minutes. Process Monitor is constantly updating its values, yet searching for the string "disableregistrytools" yields no furthur results. Then at 12:27:35, I performed a double-click in the Registry Editor program on the value DisableRegistryTools so that I can read its updated value:

enter image description here

The value jumped from 0 to 1.

Returning back to Process Monitor, now I see two additional entries when searching for the string "disableregistrytools":

...
12:27:35.6996148 AM regedit.exe 3192    RegQueryValue   HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
12:27:35.6996148 AM regedit.exe 3192    RegQueryValue   HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools SUCCESS Type: REG_DWORD, Length: 4, Data: 1
...

For some reason Process Monitor seems to fail to log the registry change.

What may be causing the problem?

Best Answer

Use the Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

enter image description here

More informations, read this page: http://technet.microsoft.com/en-us/sysinternals/bb896645

Related Question