New answers tagged

0

Autoruns is one of the best startup tools for any version of windows. Start run and services.msc There is a delayed startup option, but windows decides what the delay is. The simpliest safe guard against you mucking something up your self is system restore points. Create one before you change anything, so you can revert easily. If the change has the ...


0

You can try Registry Workshop (not free, but trial available). Registry Workshop is an advanced registry editor. It is a perfect replacement for RegEdit and RegEdt32 which shipped with Windows.


1

Check out the Microsoft tool for fixing this Windows problem located for download via the Fix problems that block programs from being installed or removed site via the download link. Just download and install the MicrosoftProgram_Install_and_Uninstall.meta.diagcab utility once the download completes and then run to fix the related problems. Fix problems ...


1

Drag and Drop from a standard user process (Medium integrity level) to an elevated process (High integrity) never works because it could be used in a Privilege escalation attack. A normal user could open a file in an elevated process and potentially execute some code with higher privilege than he holds. Running Visual Studio as admin is sometimes required ...


2

Is there any way to remove the registry entries for the non-existent applications? You can use CCleaner by Pirifom to do this: System Requirements Windows 10, 8.1, 8, 7, Vista and XP. Including both 32-bit and 64-bit versions. ... We also offer a portable version for installing on USB thumb drives. Visit the builds page to download. It ...


2

Check the (default) value data here: HKEY_CLASSES_ROOT\exefile\shell\open\command Must be set to "%1" %* And, select the following key. HKEY_CLASSES_ROOT\exefile\shell\open Right-click (default) and choose Delete. It should now read value not set. That fixes the menu caption - setting it to Open. REG file to automate the above Windows Registry ...


0

To view list of revoked certificates run certmgr.msc. Revoked certificates show under folder named Certificate Revocation List. https://technet.microsoft.com/en-us/library/cc730795%28v=ws.11%29.aspx?f=255&MSPPError=-2147217396


0

For the benefit of others: I could not reach a DOS command prompt by pressing F5 or F8 when windows tried to load, so I had to create a start-up disc using the working Windows 7 installation on my work laptop. I used this to boot from, and was able to open a command prompt window, and type in the sequence of commands listed. On re-booting everything ...


0

First of all, I can't imagine registry plays any role in browser startup tabs. I just Changed my Google Chrome startup tab, and it updated this file: %localAppData%\Google\Chrome\User Data\Default\Preferences To modify it, Press Windows+R to open run, paste this line, then press enter: notepad "%localAppData%\Google\Chrome\User Data\Default\Preferences" ...


1

Here is a REG file that sets IE as the default browser (except for HTM and HTML file types), and then associates HTM HTML and CSS files with Notepad++ Note: This registry edit won't work if you're using Windows 10.. as Windows 10 imposes strict rules pertaining file type associations - with the hashing algorithm in place to detect any tampering with User ...


0

For static context menu items, not powered by context menu handler shell extension, you can remove the icon from the registry. For example, to remove the icon for Personalize, remove the value named Icon in this registry key: HKEY_CLASSES_ROOT\DesktopBackground\Shell\Personalize Note that you need to take ownership of the key first. For Display ...


0

Found the answer here https://sdmsoftware.com/forums/topic/escaping-env-variable-while-using-gpp/ You can insert <> between the variable name to prevent auto resolution, so instead of using %userprofile%, I used %<userprofile>% and it worked!


0

See if this helps: "%<userprofile>%\Shares"


0

Start Regedit.exe and select the HKEY_USERS branch. From the File menu, click Load Hive... Select the following file: C:\users\default\ntuser.dat Assign a Name for the loaded hive (eg. defaultuser) Browse to the Software\Microsoft\Internet Explorer\Main branch of the loaded hive, and make the modifications as required. Select the defaultuser hive. ...


2

If you're not able to use Group Policies to get this configured, then check these registry keys, create them if they don't exist, and adjust accordingly for your needs. Locate and then check the following three registry subkeys, and then change the values of the Default_Page_URL and Start Page entry to your desired website. HKEY_CURRENT_USER\...


0

Actually there already existed a takeaway powershell script to you can make use of. You can easily find them in How to switch UAC level Hopefully, it can help.


1

Configuring the IE Home Page Solutions. . . Fortunately there are several workarounds for this issue. First, if you want to force users to use a particular home page for IE on their corporate users, you can use the following Group Policy setting to do this: Disable changing home page settings This policy setting is found under this ...


2

Edit the .reg in Notepad or any other text editor. The first thing in a .reg file is the path, example: Windows Registry Editor Version 5.00 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer] "NoDriveTypeAutoRun"=dword:00000091 You'll see something similar to this, the first part is the path and the second line is the key it'...


2

Go to the .reg file > Right Click > Edit with Notepad View the key there and the location.


1

I was looking into this same thing and found this (emphasis mine): If the value contains the sequence tilde [~], then the value is interpreted as a Null-delimited list of strings (REG_MULTI_SZ). For example, to specify a list containing the three strings a, b and c, use "a[~]b[~]c". The sequence [~] within the value separates the individual strings ...


0

(on hindsight, you can only change combination keys aka shortcuts via AutoHotKey software. But if you want to delete the AltGr key, do this:) Always back up your registry via the File|Export command create a text file and call it DisableAltKey.reg and paste this into it: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\...


0

No. The Cached Logons Count in registry defines how many logins should be cached locally, and thus allow you to login if you can't reach your DC. With default configuration cached logins never expire. Check out Microsoft Technet for further explanation


0

You will reverse these changes the same way - only numbers at the end of every row will be different. So please, plan good and carefully! (I always advise everyone to take pen and draw design on sheet of paper) 1) when you are making blocking, you must left at least one user/group with suficient, not blocked rights (full rights e.g.) 2) when you are ...


1

How I can reverse these changes? You can reverse the changes by setting the permission entry is set to [1 17] which is Administrators Full Access and SYSTEM Full Access. Create a file (for example unblock.txt) with the following contents: HKEY_CLASSES_ROOT\Applications\cmd.exe [1 17] HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\cmd.exe [1 17] ...


1

I need to block this key to prevent deletion or modification by malware. HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe What command line can help me to do this? As per the answers in the link in your question, the easiest way to do this is to remove the Edit permissions from SYSTEM and the Administrators ...


0

It seems based on your example that you just need to set the 0th bit (zero based) of the first byte. So, in essence, just add 1 to the first hex byte (or right most nibble, if that makes it easier to think about) to disable (i.e., deactivate the app during startup). So if the first byte is: X0, X2, X4, or X6, it becomes X1, X3, X5, or X7, respectively, ...


0

Here is a sample mail client registration - To register with Default Programs / modern Default Apps. You can modify it accordingly, leaving out non-essential parts. Windows Registry Editor Version 5.00 ;RegisteredApplications ;---------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\RegisteredApplications] "MyMail"="Software\\Clients\\Mail\\MyMail\\Capabilities"...


1

I know this is a long-time later, but this may be a simpler way to do it; a one-liner that toggles the value on or off: set-itemproperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -name ProxyEnable -value (-not ([bool](get-itemproperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings' -name ProxyEnable)....


2

Double-question mark paths are NT Object Manager object names. The Object Manager is a system that organizes lots of different kinds of system resources (e.g. devices, memory sections, window stations, events) into one tree-like structure. You can explore that tree with the WinObj tool. The \??\ pseudo-directory's contents can be seen in the GLOBAL?? ...


0

I have seen the \?\C:\... path used a lot to get access to files/paths longer than 260 characters. At least when dealing with Win32 API calls. Although the structure in your screenshot varies slightly, I would feel safe assuming it is similar in behavior. Or, it could also be that the Win32 API (when reading values from this Registry key) will automatically ...


0

Another solution is to use Sandboxie. This program can execute any process inside sandbox, so that any change to the system made by that process can be undone.


-1

The easiest way to add a variable to the path without rebooting is to open the command prompt and type: PATH=(VARIABLE);%path% and press enter. To check if your variable loaded, type PATH and press enter.


0

If you really want to tamper the registry you do so the following, but at your own risk @echo off set new_value=;P:/SQL ::set the new value here set key="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" for /F "delims= skip=2" %%r in ('reg query %key% /v "Path"') do set old_value=%%r set old_value=%old_value: Path ...


0

How do I add a value to my PATH? My PATH has a value that includes "c:\Program Files\Microsoft SQL Server\100\Tools\Binn\", and I'd like to add "P:\SQL" to it Why are you reading/writing the registry? Just use setx to add a value to your PATH: setx PATH "%PATH%;P:\SQL" /m Note: /m Set the variable in the system environment HKLM. (The default is ...


0

For creating a custom context menu command to move audio files to a specific Dropbox folder, create the following files. dropbox.reg (run this) Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\SystemFileAssociations\audio\Shell\Dropbox] @="Move to Dropbox Folder" "Icon"="C:\\Program Files (x86)\\Dropbox\\Client\\Dropbox.exe" [HKEY_CLASSES_ROOT\...


2

Sorry, that's not possible, at least not to the extent you seem to want. As mentioned in the comments by Ƭᴇcʜιᴇ007, all of Windows access control is based on users. Every process has a token attached to it, which determines what user it's running as. There is no difference between you performing an action and a program running under your account performing ...


5

There seems to be a new strand of the virus that places itself in a slightly different location and uses different registry keys. You should be able to find the virus under %AppData%\{7DD25B43-EDEC-C6A2-4E97-EB6E11BD11CD3}. Especially interesting: The virus can only access the registry of it's current user. It accordingly has nested into the HKEY_USERS/[.....



Top 50 recent answers are included