![[H]ard|Forum](/styles/hardforum/xenforo/logo_dark.png){kind=logo}
I've been removing spyware on an increasing number of PCs every day at work, and so far the Spybot/HijackThis/CWShredder trio has cleaned up pretty much everything I've had to deal with. Recently, however, I've come across a few PCs that aren't cooperating with my efforts to clean them. Nearly every time when I scan with Spybot, it has to reboot to clean the rest of the spyware. On a few PCs, when I reboot, Spybot doesn't run a second time.
After experimenting for a while, I discovered that something is cleaning out any key that's entered into the HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce key. Whenever a key is added, the name stays there, but the data is cleared.
I've seen this on probably half a dozen machines now, and so far I haven't been able to fix it on any of them. I've scanned them all for viruses, using the latest defs at the time, and none were infected. I scanned for spyware using the latest updates there as well. Using Bazooka and AdAware did find and remove a few other things that Spybot missed, but the registry problem is still there.
I've checked the permissions on the registry key, and nothing's changed there. Booting into safe mode has no effect, the data is cleared there as well. I've been banging my head against the wall for a week now trying to figure this out, and it has me stumped. Have any of you come across this problem before? Any ideas on how to fix it? I'm fresh out. Thanks in advance.
After experimenting for a while, I discovered that something is cleaning out any key that's entered into the HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce key. Whenever a key is added, the name stays there, but the data is cleared.
I've seen this on probably half a dozen machines now, and so far I haven't been able to fix it on any of them. I've scanned them all for viruses, using the latest defs at the time, and none were infected. I scanned for spyware using the latest updates there as well. Using Bazooka and AdAware did find and remove a few other things that Spybot missed, but the registry problem is still there.
I've checked the permissions on the registry key, and nothing's changed there. Booting into safe mode has no effect, the data is cleared there as well. I've been banging my head against the wall for a week now trying to figure this out, and it has me stumped. Have any of you come across this problem before? Any ideas on how to fix it? I'm fresh out. Thanks in advance.