Mosaic1 's Fix,. ,..

hi all,. I saw this fix written by mosaic1,.,.. I don't understand how it works,,. ,. . Could it be explained a bit please,. …..I also saw one such fix for the msconfd.dll problem,. . Why does the fix contain hex values,. .,..

QUOTE

Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager] "PendingFileRenameOperations"=hex(7):5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,\   77,00,69,00,6e,00,64,00,6f,00,77,00,73,00,5c,00,73,00,79,00,73,00,74,00,65,\   00,6d,00,33,00,32,00,5c,00,63,00,74,00,72,00,6c,00,70,00,61,00,6e,00,2e,00,\   64,00,6c,00,6c,00,00,00,00,00,00,00

Mo knows really a lot about the inner workings of Windows. Maybe we can get her to do a Topic for Operating Systems. Freeatlast has magic powers.

well,.. MO does magic with scripts ,.. and FAL does magic with REG edits,. .but they both do wonders,. But freeatlast doesn't come to the classroom,.. may be you can invite her also to come here cnm ,. .It would be great to learn from her too,.. Would really like to learn from both of them ,,, . I like writing scripts,…but i,m just a beginner,..MO could give some tips on that in the OS section of the classroom,.

This is a pest which won't go away. The file is always loaded in memory. It is loaded through a value called APPINIT_DLLs. The file is present in the System32 folder. And the CWS files are monitoring APPINIT_DLLs so we cannot remove that entry, reboot and delete the file. That's the usual method to remove one of these. Legitimate Apps do use this method to load too. So what we have to do here is delete the file before it loads. And it does load early. As soon as USER32.dll has loaded. There is a special Value in the registry(win2k and XP) we can write to in order to remove in-use files. (files currently in use by Windows and which Windows will not allow you to remove) It is used by uninstallers, updaters and other legitimate programs. This value does not normally exist and so we create it first in this Key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Value Type is REG_MULTI_SZ Value name is : PendingFileRenameOperations Here's how the data looks if you open the registry and look at it. This will remove msconfd.dll from my system during a Reboot. (XP installed on the D: drive) \??\D:\WINDOWS\system32\msconfd.dll But exported, it is in hex. And if I want to give this to someone, it must be written in hex. I created the key and exported it. I did this for each possible system32 location. We tell the system which files to delete on next reboot. A complete Restart of the computer is needed or this will not execute. On reboot, the value removes itself from the registry and deletes the file(s) listed. Regedit is an interface between you, the User, and the Database we call the Registry. In Windows NT there are a few more data types than in Win9x. You'll notice they are always exported in hex. It is necessary to import the registry file for this value type in its hex format or it will not import as the correct value type if at all. In this case the value type is a Multi String Value. If you look in the NT registry you will see it as REG_MULTI_SZ What I did was use a utility to create these registry files for import. The formatting of this key is special. You can write directly to it by opening the registry. But you do not merely write a filepath and name into it as you can see from the example. I am currently working with a problem poster. He is having trouble following an updated method to remove. The filename is not msconfd.dll and so one of the pre made registry files is not going to be used. I have written a new script to simplify this further. We'll see how it works. If you would like to follow the thread it is here: http://forums.spywareinfo.com/index.php?showtopic=23934 I bet it is not going to be a smooth one. So far he has had difficulty. That's why I started writing the scripts to automate some of these things. The less struggle, the better.

In this example: "PendingFileRenameOperations"=hex(7):5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00,\ 77,00,69,00,6e,00,64,00,6f,00,77,00,73,00,5c,00,73,00,79,00,73,00,74,00,65,\ 00,6d,00,33,00,32,00,5c,00,63,00,74,00,72,00,6c,00,70,00,61,00,6e,00,2e,00,\ 64,00,6c,00,6c,00,00,00,00,00,00,00 The hex(7) signals that this value type is a Multi String Value.

Hello mosaic1,. sorry I couldn't reply to this thread for a long time,…i don't have access to my pc now for somtime,…. That's great info on removing msconfd.dll and registry,,..I,m trying to learn more of the registry , so i'll post back as soon as i learn more,.. I do have few more doubts,.. Thanks,…