Please help - Regedit and I.E homepage locked

[eewgnoy]

Hello, my system is currently plagued by the problem of having the I.E homepage locked to cuteworm.com and when I try to run regedit it says "Registry editing has been disabled by your administrator" even though I'm on an administrator account myself. This happened only after I ran the programs from cuteworm.com and I'm clueless in getting the locks removed.
Please help me out with this, many thanks in advance and my apologies if I missed out important information.

[commach]

Try this:
http://www.pchell.com/support/registryeditordisabled.shtml

[eewgnoy]

Thanks for the link commach! The regedit lock is resolved but the I.E homepage is still locked though, at least that's one hurdle passed. =D Btw, does anyone have any idea if cuteworm is now laden with malware or anything of the sort? The stuff it offers used to be free from these issues.

[commach]

After this, you need to update the lastest antivirus defination, disable system restore, dicconect the system from internet and restart it in safe mode.

Perform full system scan in safe mode, you might need to scan more than 1 time to get rid of the worm.

Check the content of the host file in c:\windows\system32\driver\etc.

[eewgnoy]

Ok, I'll go try it out, thanks for the help!

[ryouma]

just tried the above method and regedit problem is solved. But for those that uses mIRC and found that it's locked. Do the following method:

Head on to http://www.mirc.co.uk/help/password.html and follow the instruction to get rid of the mIRC lock. Remove the numbers completely if you do not want any password.

Hope that helps :)

[WaterRain]

Try this - http://javier.sg/HomePageUnlock.reg

Let me know when you're done then I'll remove the file (:

[stupid123456]

i have this problem too, can someone help me?

[stupid123456]

i managed to unlock regedit and homepage, trying mirc unlock. i realised that my access to www.zincplay.com is barred how do i remove it? thanks:s12:

edit: i am also worried taht there may be a keylogger. how do i search for it?

[wweixian]

i managed to unlock regedit and homepage, trying mirc unlock. i realised that my access to www.zincplay.com is barred how do i remove it? thanks:s12:

edit: i am also worried taht there may be a keylogger. how do i search for it?

heya all, i also tio this problem....this stupid cuteworm thing. I can't access www.zincplay.com too. How do I solve this? thanks!

[hlots123]

probably ur HOSTS file affected. anyway, if u trust the fix below....

but i suggest u open & edit the HOSTS file urself (google for instructions) instead of replacing with another from the download link below.
Solution is up ( DONE BY MERLIN83 NOT ME )
Symptoms:
- Zion is unable to access any channels other than #EggYolk and #CuteWorm
- IE defaults to hxxp://www.cuteworm.com/
- Unable to access zincplay.com or any of its related sites
Fix:
- Replace HOSTS file in both C:\WINDOWS\system32 AND C:\WINDOWS\system32\drivers\etc with =link removed=
- Run the following commands in "Command Prompt" as Administrator:
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableRegistryTools" /f
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /va /f
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /va /f
reg delete "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /f
reg delete "HKLM\Software\Microsoft\Internet Explorer\Main\Start Page" /v "Start Page" /f
reg delete "HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel" /v "HomePage" /f
reg delete "HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel" /v "HomePage" /f
- Uninstall Zion completely (infected files are "scripts\mirc" and "script\settings", for the technically competent, removing them from mirc.ini should do the trick)
- Reinstall Zion from =link removed=hxxp://zincplay.com/forum/archiver/tid-4734-page-2.html

[hlots123]

ok, i just checked the HOSTS file download link above - contents don't seem right. suggest u open & edit ur existing HOSTS file.

OR to create a new one - open notepad, paste the one line below & save file as "HOSTS" (filename has no extension). then copy "HOSTS" file to "C:\WINDOWS\system32\drivers\etc"
127.0.0.1 localhost

[wweixian]

THANKS! solvd!

[hlots123]

congrats! n jus in time for xmas season gaming :)