Registry keys locked.

[HARTNETT]

I have WinXP PRO that I cannot install SPYBOT without getting Registry Key errors. It will not allow Spybot to create subkeys under the Spybot keys.
HKCR\SPYBOTSD.DisableFile, SbeFile, SbiFile,SbsFile, TinfoFile, UtiFile, & UtsFile

When I try to delete these keys, to start over, it tells me - access denied you do not have permission. I tried changing the permissions, but it still will not let me delete the keys. Any suggestions?
Thanks.

 

[linney]

I take it you are doing all this as an Administrator?

Can you uninstall it using the uninstaller with Spybot and start again? See if the uninstaller will run in Safe Mode.

With any Registry permissions, start with the permissions at the top of the Hive as they are probably being passed down (inherited permissions) to the keys you are working on.

 

[HARTNETT]

Yes, I am the Administrator.
Yes, I tried uninstalling in Normal & Safe Mode.
I can create & delete keys in the Hive, but not these.

 

[linney]

I don't seem to have trouble deleting and creating any Spybot keys. Is there some third party malware at work here? Is this a beta version of Spybot?

Removing adware & spyware
faq608-4650

Microsoft (GIANT Antispyware) Beta available
Thread779-979113

 

[HARTNETT]

The registry entries that I could not delete had an owner that is no longer in the users list. I had to go to each subkey and change the owner to Administrators before I could delete it.
I don't know why I could not change the owner of the top key and check "Replace owners on subcontainers or objects".
This would give me an error message.

I haven't seen this problem since my Novell days. If the owner of a file was removed the file's attribute would be changed to read only.

Is there a way to change the owner at a top key so that it will propagate down to the subkeys?

 

[linney]

Has this departed owner's profile been removed from the machine?

It seems like you have already tried passing down the Ownership and got an "Accessed Denied" message, is that correct or was it some other strange error?

Look for the check box at the bottom of the Owner tab Properties page.

Quoting from MSKB and Help and Support......

"To change the owner of all subcontainers and objects within the tree, select the Replace owner on subcontainers and objects check box.


You can take ownership of a registry key if you are logged on as an administrator or if you have been specifically assigned the permission to take ownership of the registry key by the current owner.

You can permit another user to take ownership of a registry key only if you are the current owner of the key. To permit a user to take ownership of a registry key, you must first grant the user Full Control of the key. You can take ownership of a registry key if you are logged on as an administrator, or if you have been specifically assigned the permission to take ownership of the registry key by the current owner."

How To Use the Windows XP and Windows Server 2003 Registry Editor Features

http://support.microsoft.com/default.aspx?scid=kb;en-us;310426&FR=1&PA=1&SD=HSCH

How To Reset Security Settings Back to the Defaults

http://support.microsoft.com/default.aspx?scid=kb;en-us;313222&FR=1&PA=1&SD=HSCH

 

[HARTNETT]

Yes, the owners profile is gone.
I am logged on as an Administrator.
I changed the owner of the key from the deleted user to the Administrators group. I checked the "Replace owners on subcontainers or objects" check box, and I immediately get - Registry Editor could not set owner on the key currently selected or some of it's subkey.

 

[linney]

Perhaps one of the keys has a Deny permission set somewhere down the line?

http://www.petri.co.il/list_all_users_and_groups_in_domain.htm

http://groups-beta.google.com/group...ission+ownership+xp+registry#8b1018ba8afda2c2

You can hunt through the rest of these if you like.

http://groups-beta.google.com/group...en&q=windows+permission+ownership+xp+registry

SUBINACL.exe (Resource kit)

http://www.ss64.com/nt/subinacl.html

Security Explorer is a powerful and intuitive utility to search for and modify Windows NT/2000/XP security on NTFS drives, the Registry, and Shares.

http://www.amtsoft.com/secexplorer/