ANTIVIRUS. Useful registry tips

1. Вернуть Реестр: В "Пуск" - "Выполнить" вставить следующую команду:

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f

2. Вернуть Диспетчер Задач: В "Пуск" - "Выполнить" вставить следующую команду:
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f

3. Проверить:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Shell=Explorer.exe
вместо
Shell=VirusName

4. Проверить:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"PersistBrowsers"=dword:00000000

5. Disable Software Restriction Policy:
    SRP_Disable – включает уровень политики в Unrestricted:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers]

"authenticodeenabled"=dword:00040000

6. Disable Windows Installer
System Key: [HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Installer]
Value Name: DisableMSI
Data Type: REG_DWORD (DWORD Value)
Value Data: (0 = default, 1 = admin only, 2 = disabled)

7. AutoRUN keys

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup

http://support.microsoft.com/kb/137367

8. Delete everything in:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs

9...

Restore MsOffice user settings

In order to restore corrupted Ms Office 2007 user settings, remove the following key from the registry:

HKEY_CURRENT_USER\Software\Microsoft\Office\12.0

More info here: http://support.microsoft.com/kb/822005

TIP: Installing SQL Server 2008 reboot required check fails

When installing SQL Server 2008 one can run into “Reboot required check failed” situation.

After seeing it few times already, I think a solution is worth mentioning.

“Why don’t you just reboot?”, you say… Well, most likely it would not help you, but try it first.
If this would not help, then try the following:

1. Start regedit.exe
2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
3. Locate PendingFileRenameOperations
4. Remove any data associated with the value (you may want to export the value for later review)
5. Reboot and rerun installation, check should pass.

Update. As a respond to some comments about solution above not always work you may consider the following:

* Make sure that after you reboot entry in the registry does not reappear.
If it does, remove it again, but do not reboot, just go ahead with installation process and click “ReRun”. Most likely you would be fine now.
* You may also try and see that other ControlSet001, ControlSet002, etc do not suffer from the same problem (solution mentioned by Mike Hills below).
* There was mentioning that some installations of Visual Studio 2008 could cause check to fail as well. So if nothing from above helped, uninstall Visual Studio (comes with light version of SQL Server), install SQL Server and then reinstall Visual Studio again.

Lets see why would entry reappear… This may happen if there is a driver or application which supports “recovery” mode or plain virus is around and after reboot it is trying to finish the deployment process again. In any situation try and look closer: what app file belongs to, if there are other solutions to the problem so that original process would finish properly, etc.