Jump to content

HKLM/SOFTWARE/SPROVIDE it does not disappear from the PC


Recommended Posts

  • Replies 97
  • Created
  • Last Reply

Top Posters In This Topic

  • Root Admin

Open regedit
Right-click on the key "HKEY_LOCAL_MACHINE\SOFTWARE\SProvide" and select Permissions.
From the dialog box opened above, click on the Advanced button.
Go to the Auditing tab and click on the Add button.
Enter your user account that has admin rights to configure auditing for and click OK.
Select the kind of access you want to audit (success - this key and sub-keys) and click OK.

image.png

Then open GPEDIT.MSC and browse the the following key and enable Audit object access Success

 

image.png

 

Once both of those are set. Then open Regedit, go to this key:  "HKEY_LOCAL_MACHINE\SOFTWARE\SProvide"

Then delete that key.

Then restart the computer.

Then after the restart open Event Viewer and go to Windows Logs -> Security

Then look for that entry for the registry key and it should show what account or process created it

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.