Immunization - 3 IE (32/64bit) that won't immunize

[SnowBum]

I've done some screen shots of a few of the registry keys relating to the entries in the last 2 text files i've attached.

You say that i have to basically delete the entries, i've attached another screen shot called "delete_which_one", in that screen shot which folder/s do you mean to delete? The root folder for that entry (i've arrowed it red in the screen shot) or the sub-folders (i've arrowed them green in the screen shot).

Do i have to delete all of the enteries that were in the last 2 text files i've attached or just one lot. I'm just making absolutely sure what i have to delete before i dive in.

[SnowBum]

Post for to attach the 2 files i couldn't attach to the last post, reached the attachment limit.

[Greyfox]

Snowbum,

Unfortunately the screen shots are not clear enough to pick out the details I was hoping to see, however:-

Can you logon in Safe mode as Administrator. If you haven't changed it from the default leave the password blank.

Using regedit, goto
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains

From there goto the entry for trenitalisa. Right click on it, select delete. If it deletes OK, do the same thing for each of the other 5 entries that were left in the last Domains.txt file you posted.

Also if that set of deletes works, then goto
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains
and then delete the two entries that were in the last EscDomains.txt file you posted.

To be clear, do not delete the Domains or EscDomains "folder", but all 5 specific entries in Domains that have been identified, and also the 2 in EscDomains that have been identified.

If for any reason you are not able to delete an entry, can you write down the permissions for it and include them in your post. (you need only do this for one entry at this stage). The information should include the type, name, permission inherited from and apply to, from the permissions tab, the current owner of the item from the owner tab, and what ever names are listed in the change owner to area.

As you have previously indicated that you have prior experience with editing the registry and are comfortable doing it, I guess I don't need to remind you that you should have a backup.

[Greyfox]

My last post was prepared fairly quickly because of a time constraint. Having since had a closer look at the screen shot "delete_which_one" that you posted:-

Whilst the resolution is not good enough to read which item this is (the one pointed to by the red arrow), the two sub-items (the ones you indicated by the green lines) are probably significant. They are normally not present for a simple "immunisation" entry, and may well prevent you from deleting the main item (the one with the red arrow). If you can't delete the main item, try deleting each of the sub-items first. If you can't do this, have a look at their permissions. If necessary, post back the details of these.

In the hope of making it clearer for you, I have attached a screen show to show the items that need to be manually deleted - if any or all of these have additional sub-items then these should be deleted also.

[SnowBum]

I've tried in safe mode logged in as administrator to delete the folders and the subfolders but get the error "Cannot delete www: Error while deleting key"

I've attached screenshots (BMP this time) for the deletion error, the folder permissions and the sub-folder permissions (or lack of)

Notice that in the permissions for the folder and the sub-folder screen shots you see the sub-folder key hasn't any data in it. On other valid folders that also have this sub-folder the key does have data in it and you can look at the permissions for this sub-folder.


I couldn't upload the screen shots here as they were too big and i wanted to keep the resolution clear, so i uploaded them to an image host:-

http://img.photobucket.com/albums/v7...r_deleting.jpg

http://img.photobucket.com/albums/v7...ermissions.jpg

http://img.photobucket.com/albums/v7...permssions.jpg

[md usa spybot fan]

SnowBum:

It appears that there are "Special Permissions" set on:

[….\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\trenitalias.it]

Suggestion: Using the following as a guide, see if you can remove the "Special Permissions" from that registry key:

• Set, view, change, or remove special permissions
  http://technet.microsoft.com/en-us/l.../cc786378.aspx

[SnowBum]

From what i can see in the permissions for that registry key there are no special permissions. The permissions of that registry key are exactly the same as the other registry keys around it.

I have tried the "Remove an existing group or user and its special permissions" from the article you've linked but i still can't delete the folder or the sub-folder for "trenitalias.it" i still get the message "error while deleting key."

For that key i now have no inherited permissions, only permissions set locally at that key. There are only 2 permissions set and they're for the Administrator (full control) and for user-KELLY (full control).

Is it possible for the structure of those key enteries to be damaged?

[Greyfox]

Snowbum,

Can you go to the trenitalisa.it key, right click on it, select permissions, click on advanced. It should now be on the permissions tab. Can you please post a screen shot of that, then click on owner and post a screen shot of that.

[Greyfox]

Snowbum,

Once you have done the two screen shots.

In safe mode, logged in as Administrator,

Go to the trenitalisa.it key, right click on it, select permissions, click on advanced, then select the owner tab. In the "change to" area there should be two possible owners, one that starts with "Administrators.." and one that starts with your name. Highlight the one starting with "Administrators..." then click on apply.

Now click on the Permissions tab. Underneath the permissions entries box there are two tick boxes, the top one which would normally be ticked is "inherit from parent the permission entries that apply to child objects...."
Remove the tick from that box. A security dialogue will appear, click on "Remove". Now retick the box for "inherit from parent the permission entries that apply to child objects....", then click on Apply. This will set up the correct permissions for the trenitalisa.it key (it will inherit them from the Domains key.

Now tick the second box "Replace permission entries on all child objects with the entries show here.." then click Apply. On the serurity dialogue that appears, click on Yes, then OK, then OK to exit the permissions for the trenitalisa.it key.

This should replace the permissions of the www subkey with those of its parent (the trenitalisa.it key), and you should now be able to delete the www subkey, and then delete the parent trenitalisa.it key

If this works as planned, do the same thing to each of the 5 problem keys in the Domains group. You can use the same procedure to remove the two problem entries in the EscDomains group, however in the first step (changing the owner) change it to your user ID.

Please post back and let me know whether this was successful

[SnowBum]

Attachment 2674

Snowbum,

Can you go to the trenitalisa.it key, right click on it, select permissions, click on advanced. It should now be on the permissions tab. Can you please post a screen shot of that, then click on owner and post a screen shot of that.

I meant to post these yesterday after i'd removed the inherited permissions.
Weird it let me upload one JPG but not the other, i had to upload that one as a GIF