1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Registry Probs -Windows 7x64 Home premium

Discussion in 'Windows 7' started by artinusa, 2010/09/27.

Page 1 of 4
  1. 2010/09/27
    artinusa

    artinusa Inactive Thread Starter

    Joined:
    2009/12/07
    Messages:
    42
    Likes Received:
    0
    Help Please-
    There are several H_classes-Root registry keys that will not allow in any way deletion. I am not an expert on these matters but I do not know any more procedures to remove these entries.

    After removing Nero 10 in the control panel using add-remove manner and also using the nero clean tool and then trying to reinstall Nero 10 the installer tells me windows install that is..that the configuration is not working

    On Googling and using regedit and searching I found loads of nero keys some of which I could remove via owner and permission. for many more I get 'error is preventing opening then the key name' and then access denied. If I try to change permission or owner they are greyed out totally. When trying to alter and save changes to the keys I am told unable to save permissions access denied. I don't need these key but cam not get rid of them

    Below is a small sample of keys with access denied

    HKEY_CLASSES_ROOT\.ape, , Nero.MediaHub.10.ape.1
    HKEY_CLASSES_ROOT\.ape\Nero.MediaHub.10.ape.1
    HKEY_CLASSES_ROOT\.bmp, , NeroPhotoSnap.Files9.bmp
    HKEY_CLASSES_ROOT\.FLV\Nero.MediaHub.10.flv.1
    HKEY_CLASSES_ROOT\.neroserial
    HKEY_CLASSES_ROOT\.oga\Nero.MediaHub.10.oga.1
    HKEY_CLASSES_ROOT\.ogv\Nero.MediaHub.10.ogv.1
    HKEY_CLASSES_ROOT\AdvrCnt0.NeroApplication
    HKEY_CLASSES_ROOT\AdvrCnt0.NeroApplication.2
    HKEY_CLASSES_ROOT\Nero.BackItUp.10.nba.1
    HKEY_CLASSES_ROOT\Nero.BackItUp.10.nbi.1
    HKEY_CLASSES_ROOT\Nero.BackItUp.10.nc_.1


    Anyone help me?
     
    artinusa,
    #1
  2. 2010/09/27
    markmadras

    markmadras Banned

    Joined:
    2010/08/23
    Messages:
    1,529
    Likes Received:
    105
    I have the same problem and was not happy with nero 10 so want to go back to nero 9.

    I'll be watching the progress here, I haven't tried to delete mine yet and Nero don't seem to have made a clean tool for nero 10.

    When you tried to delete the registry entries did you use 'run as administrator'.
     
    markmadras,
    #2


  3. to hide this advert.

  4. 2010/09/27
    artinusa

    artinusa Inactive Thread Starter

    Joined:
    2009/12/07
    Messages:
    42
    Likes Received:
    0
    Nero 10 Registry probs

    I sure did....totally granted full admin controls etc...seems the keys are just dead.. Perhaps this is not the real issue and something else is preventing me from re-installing or completely removing these keys..

    Anyone please
     
    artinusa,
    #3
  5. 2010/09/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Firstly, make sure, you create new restore point before making any registry changes!

    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2
    64-bit users go HERE
    • Double-click SystemLook.exe to run it.
    • Vista users:: Right click on SystemLook.exe, click Run As Administrator
    • Copy the content of the following box into the main textfield:
      Code:
      :regfind
*nero*
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt
     
    broni,
    #4
  6. 2010/09/27
    artinusa

    artinusa Inactive Thread Starter

    Joined:
    2009/12/07
    Messages:
    42
    Likes Received:
    0
    Nero reistrations

    Thannk you Broni

    as per request this is the whole log as a txt file and pasted

    SystemLook 04.09.10 by jpshortstuff
    Log created at 13:16 on 27/09/2010 by art
    Administrator - Elevation successful

    ========== regfind ==========

    Searching for "*nero* "
    No data found.

    -= EOF =-


    But if I go into regedit I can find many occurrences where nero has been given opening rights..neromeadiahub seems to be common

    If I use registry workshop I see maybe 80-90 such occurrences..strange eh

    I tried giving the CLASSES_ROOT files permission to everyone...still could not delete
     
    Last edited: 2010/09/27
    artinusa,
    #5
  7. 2010/09/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    It doesn't look like you have any registry keys including word "Nero ".
     
    broni,
    #6
  8. 2010/09/27
    artinusa

    artinusa Inactive Thread Starter

    Joined:
    2009/12/07
    Messages:
    42
    Likes Received:
    0
    Nero Registry

    I guess from that scan..but I can assure you that what I posted and have since checked a few seconds ago is real..and they are there in the ROOT keys

    Its very strange and seems to apply to extension that Nero was allowed to open..

    What is the 'neromediahub' any idea..

    how can I copy and past the offending keys for examination...can I do it in regedit..HOW.?


    I appreciate your help sir..
     
    artinusa,
    #7
  9. 2010/09/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Re-run SystemLook with following code:

     
    broni,
    #8
  10. 2010/09/27
    artinusa

    artinusa Inactive Thread Starter

    Joined:
    2009/12/07
    Messages:
    42
    Likes Received:
    0
    SystemLook 04.09.10 by jpshortstuff
    Log created at 14:57 on 27/09/2010 by art
    Administrator - Elevation successful

    ========== reg ==========

    [HKEY_CLASSES_ROOT\.ape]
    "PerceivedType "= "audio "
    @= "Nero.MediaHub.10.ape.1 "

    [HKEY_CLASSES_ROOT\.ape\Nero.MediaHub.10.ape.1]
    (Unable to open key)


    I feel it may be windows Installer its behaving rather poorly on my system..nothing definite just a thought..


    -= EOF =-
     
    Last edited: 2010/09/27
    artinusa,
    #9
  11. 2010/09/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Let's see, if we can remove those keys....

    Please download OTM

    • Save it to your desktop.
    • Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
    • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    Code:
    :Processes

:Services

:Reg
[HKEY_CLASSES_ROOT\.ape]
@=-
[-HKEY_CLASSES_ROOT\.ape\Nero.MediaHub.10.ape.1]

:Files
      
:Commands
[purity]
[resethosts]
[emptytemp]
[Reboot]
    • Return to OTM, right click in the Paste Instructions for Items to be Movedwindow (under the yellow bar) and choose Paste.
    • Click the red Moveit! button.
    • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
    • Close OTM and reboot your PC.

    Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

    Re-run System Look with the very same script as in my reply #8.
     
    broni,
    #10
  12. 2010/09/27
    artinusa

    artinusa Inactive Thread Starter

    Joined:
    2009/12/07
    Messages:
    42
    Likes Received:
    0
    Received message
    All processes killed
    ========== PROCESSES ==========
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    Registry value HKEY_CLASSES_ROOT\.ape\\@ not found.
    Registry delete failed. HKEY_CLASSES_ROOT\.ape\Nero.MediaHub.10.ape.1\ scheduled to be deleted on reboot.
    ========== FILES ==========
    ========== COMMANDS ==========
    File move failed. C:\Windows\System32\drivers\etc\Hosts scheduled to be moved on reboot.


    Will this remove my Hosts file contents?
     
    artinusa,
    #11
  13. 2010/09/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    It'll rebuild it. No harm done...
     
    broni,
    #12
  14. 2010/09/27
    artinusa

    artinusa Inactive Thread Starter

    Joined:
    2009/12/07
    Messages:
    42
    Likes Received:
    0
    I have a load of 127.0 type files in there...I use/them it to prevent invasion issues....I will back it up first.. Thanks is it likely I would need to do this for the other 80 or so keys?
     
    artinusa,
    #13
  15. 2010/09/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I don't know yet.
    I have to see, if my script works, first.

    BTW, did you download 64-bit, or 32-bit version of SystemLook?
     
    broni,
    #14
  16. 2010/09/27
    artinusa

    artinusa Inactive Thread Starter

    Joined:
    2009/12/07
    Messages:
    42
    Likes Received:
    0
    Nero Issues

    OK I rebooted looking for log...

    I used the 64 bit..hope that was correct..!


    There is no log file to be seen..I have searched with 'everything' ..just a PF file
     
    Last edited: 2010/09/27
    artinusa,
    #15
  17. 2010/09/27
    artinusa

    artinusa Inactive Thread Starter

    Joined:
    2009/12/07
    Messages:
    42
    Likes Received:
    0
    Nero Issyes

    I have looked for the log..cant find it yet ..will search

    I have suddenly lost the USB device letters..Drive g and h are no longer..wow...just called the USB's (2) new volumes...never ever happened before..any idea..so sorry..

    I used regedit and the key is still there and still access denied..I give in..
     
    Last edited: 2010/09/27
    artinusa,
    #16
  18. 2010/09/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    That's fine.
    Re-run SystemLook with the same code as in my reply #8.
     
    broni,
    #17
  19. 2010/09/27
    artinusa

    artinusa Inactive Thread Starter

    Joined:
    2009/12/07
    Messages:
    42
    Likes Received:
    0
    Thanks for sticking by..sorry for delay we had company///had to leave..I apologise for this.



    rerun of look-up:


    SystemLook 04.09.10 by jpshortstuff
    Log created at 20:46 on 27/09/2010 by art
    Administrator - Elevation successful

    ========== reg ==========

    [HKEY_CLASSES_ROOT\.ape]
    "PerceivedType "= "audio "
    @= "Nero.MediaHub.10.ape.1 "

    [HKEY_CLASSES_ROOT\.ape\Nero.MediaHub.10.ape.1]
    (No values found)

    [HKEY_CLASSES_ROOT\.ape\Nero.MediaHub.10.ape.1\ShellNew]
    (Unable to open key)


    -= EOF =-



    This is part of the lookup done on and from my Root class


    ystemLook 04.09.10 by jpshortstuff
    Log created at 21:06 on 27/09/2010 by art
    Administrator - Elevation successful

    ========== reg ==========

    [HKEY_CLASSES_ROOT\]
    @=" "

    [HKEY_CLASSES_ROOT\\*]


    [HKEY_CLASSES_ROOT\\Nero.BackItUp.10.nba.1]

    [HKEY_CLASSES_ROOT\\Nero.BackItUp.10.nbi.1]

    [HKEY_CLASSES_ROOT\\Nero.BackItUp.10.nco.1]

    [HKEY_CLASSES_ROOT\\Nero.BackItUp.10.nc_.1]

    [HKEY_CLASSES_ROOT\\Nero.BackItUp.10.nda.1]

    [HKEY_CLASSES_ROOT\\Nero.BackItUp.10.nji.1]

    [HKEY_CLASSES_ROOT\\Nero.BurningROM.10.AutoPlay]

    [HKEY_CLASSES_ROOT\\Nero.BurningROM.10.cue.1]

    [HKEY_CLASSES_ROOT\\Nero.BurningROM.10.img.1]

    [HKEY_CLASSES_ROOT\\Nero.BurningROM.10.iso.1]

    [HKEY_CLASSES_ROOT\\Nero.BurningROM.10.nbs.1]

    [HKEY_CLASSES_ROOT\\Nero.BurningROM.10.nbv.1]

    [HKEY_CLASSES_ROOT\\Nero.BurningROM.10.ncp.1]

    [HKEY_CLASSES_ROOT\\Nero.BurningROM.10.nds.1]

    [HKEY_CLASSES_ROOT\\Nero.BurningROM.10.nhb.1]

    [HKEY_CLASSES_ROOT\\Nero.BurningROM.10.nhd.1]

    [HKEY_CLASSES_ROOT\\Nero.BurningROM.10.nra.1]

    [HKEY_CLASSES_ROOT\\Nero.BurningROM.10.nrb.1]

    [HKEY_CLASSES_ROOT\\Nero.BurningROM.10.nrc.1]

    [HKEY_CLASSES_ROOT\\Nero.BurningROM.10.nrd.1]

    [HKEY_CLASSES_ROOT\\Nero.BurningROM.10.nre.1]

    [HKEY_CLASSES_ROOT\\Nero.BurningROM.10.nrg.1]

    [HKEY_CLASSES_ROOT\\Nero.BurningROM.10.nri.1]

    [HKEY_CLASSES_ROOT\\Nero.BurningROM.10.nrm.1]

    [HKEY_CLASSES_ROOT\\Nero.BurningROM.10.nru.1]

    [HKEY_CLASSES_ROOT\\Nero.ControlCenter.10.neroserial.1]

    [HKEY_CLASSES_ROOT\\Nero.CoverDesigner.10.cdc.1]

    [HKEY_CLASSES_ROOT\\Nero.CoverDesigner.10.ncd.1]

    [HKEY_CLASSES_ROOT\\Nero.CoverDesigner.10.nct.1]

    [HKEY_CLASSES_ROOT\\Nero.CoverDesigner.10.ncw.1]

    [HKEY_CLASSES_ROOT\\Nero.Express.10.AutoPlay]

    [HKEY_CLASSES_ROOT\\Nero.Express.10.cue.2]

    [HKEY_CLASSES_ROOT\\Nero.Express.10.img.2]

    [HKEY_CLASSES_ROOT\\Nero.Express.10.iso.2]

    [HKEY_CLASSES_ROOT\\Nero.Express.10.nbs.2]

    [HKEY_CLASSES_ROOT\\Nero.Express.10.nbv.2]

    [HKEY_CLASSES_ROOT\\Nero.Express.10.nhb.2]

    [HKEY_CLASSES_ROOT\\Nero.Express.10.nhd.2]

    [HKEY_CLASSES_ROOT\\Nero.Express.10.nra.2]

    [HKEY_CLASSES_ROOT\\Nero.Express.10.nrc.2]

    [HKEY_CLASSES_ROOT\\Nero.Express.10.nrd.2]

    [HKEY_CLASSES_ROOT\\Nero.Express.10.nre.2]

    [HKEY_CLASSES_ROOT\\Nero.Express.10.nrg.2]

    [HKEY_CLASSES_ROOT\\Nero.Express.10.nri.2]

    [HKEY_CLASSES_ROOT\\Nero.Express.10.nrj.2]

    [HKEY_CLASSES_ROOT\\Nero.Express.10.nru.2]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.aac.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.ac3.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.ape.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.avs.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.bsf.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.divx.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.dvsd.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.flac.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.flv.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.ljp.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.m2ts.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.mka.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.mkv.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.mmv.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.mod.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.mov.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.mp4.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.mpa.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.mpa2.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.mpeg.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.mts.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.oga.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.ogg.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.ogm.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.ogv.1]

    [HKEY_CLASSES_ROOT\\Nero.MediaHub.10.wtv.1]

    [HKEY_CLASSES_ROOT\\Nero.Recode.10.nd.1]

    [HKEY_CLASSES_ROOT\\Nero.Recode.10.nvavi.1]

    [HKEY_CLASSES_ROOT\\Nero.SoundTrax.10.npf.1]

    [HKEY_CLASSES_ROOT\\Nero.StartSmart.10.nrg.3]

    [HKEY_CLASSES_ROOT\\Nero.Vision.10.Autoplay]

    [HKEY_CLASSES_ROOT\\Nero.Vision.7.nvc.1]

    [HKEY_CLASSES_ROOT\\Nero.WaveEditor.10.nwf.1]

    [HKEY_CLASSES_ROOT\\NeroShellExt.NeroShellExt]

    [HKEY_CLASSES_ROOT\\NeroShellExt.NeroShellExt.1]

    [HKEY_CLASSES_ROOT\\NeroShellExt.NeroShellExtRegistration]

    [HKEY_CLASSES_ROOT\\NeroShellExt.NeroShellExtRegistration.1]
     
    Last edited: 2010/09/27
    artinusa,
    #18
  20. 2010/09/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Hmmm....it didn't work.

    Let's try some stronger program...

    1. Please download [color= "#CC0000"]The Avenger[/color] by Swandog46 to your Desktop.
    - Right click on the Avenger.zip folder and select Extract All...
    - Follow the prompts and extract the avenger folder to your desktop

    Double click on avenger.exe.
    Click OK in pop-up window.

    Avenger window will open.

    2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

    Code:
    Begin copying here:
Registry Keys to delete:
[HKEY_CLASSES_ROOT\.ape]
@=-
[-HKEY_CLASSES_ROOT\.ape\Nero.MediaHub.10.ape.1]

    3. In Avenger window
    * Right click on the window under Input script here:, and select Paste.
    * You can also click on this window and press (Ctrl+V) to paste the contents of the clipboard.
    * Click on Execute
    * Answer "Yes" twice when prompted.


    4. The Avenger will automatically do the following:

    * It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete ", The Avenger will actually restart your system twice.)
    * On reboot, it will briefly open a black command window on your desktop, this is normal.
    * After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
    * The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.

    5. Please copy/paste the content of c:\avenger.txt into your reply
     
    broni,
    #19
  21. 2010/09/27
    artinusa

    artinusa Inactive Thread Starter

    Joined:
    2009/12/07
    Messages:
    42
    Likes Received:
    0
    Its will not execute cant copy detail

    Say this is illegal - invalid registry syntax
    @=-



    Its says only work Local machine hive keys

    skipping line registry deletion mode

    What do I do?
     
    artinusa,
    #20
Page 1 of 4

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...