Unable to delete a Registry Key carrying the origin to a web site.

geomazo · Oct 28, 2024

This is the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageFamily\Data\86.
The key’s Owner is: System.
Full control is with System and All Applications Packages and Trusted Installer.
The Administrator can only read, not modify. Deleting not allowed.
What file and where located is the file that is connected with such Registry Key?

Seeking for assistance and help to get rid of that. Thank You.

Bree · Oct 28, 2024

geomazo said:
Full control is with System and All Applications Packages and Trusted Installer.
The Administrator can only read, not modify. Deleting not allowed.

To delete such a key, first you need to take ownership of it, then you can change permissions to allow you to modify or delete it.

Change Owner of File, Folder, Drive, or Registry Key in Windows 10

How to Change Owner of File, Folder, Drive, or Registry Key in Windows 10 and Windows 11

www.tenforums.com

geomazo · Oct 28, 2024

Thanks. I tried that it. The System does not allow me to do it, even operating with administrative power................. error while deleting key......cannot delete 86.
I did it one more time after having changed the ownership to administrator

the key is deleted and ........ graphically disappears from the sequence........ 85....... then 87........ OK? NO!
by rebooting and re-checking the 86 is STILL there with all its child keys.....as before

I thought is a malware from the site that originated from.

Fabler2 · Oct 28, 2024

Try Regownit,

RegOwnit: Take full control & ownership of Windows registry keys

If you get mesage Error Creating Key – Cannot create key, take ownership & full control of Windows registry keys easily with freeware RegOwnit.

www.thewindowsclub.com

Bree · Oct 28, 2024

geomazo said:
Thanks. I tried that it. The System does not allow me to do it, even operating with administrative power................. error while deleting key......cannot delete 86

Did you successfully take ownership of the key? If so, did you then take the next step and change its permissions to allow you to delete it?

Change Permissions of Objects for Users and Groups in Windows 10

Change Permissions of File, Folder, Drive, or Registry Key for Users and Groups in Windows 10

www.tenforums.com

antspants · Oct 28, 2024

You can use Power Run.

It’s portable.
Open it, click on the spanner, select registry editor.
It will open Reg edit with the highest privilages (Higher than run as admin) delete the key.

PowerRun v1.7 (Run with highest privileges)

PowerRun is a tool to launch any program/script files with the same privileges as the TrustedInstaller /SYSTEM. it is a Portable and free

www.sordum.org

geomazo · Oct 28, 2024

Hello, I religiously followed your instruction, Power Run deleted 85....... 87 ...... OFF.
NOT Really, it reappears when rebooting: 86 again with all its subkeys as before.
It must be a MALWARE that has to have a root in some file/folder of Windows or of Edge the browser that was used.
Avast is now blocking the the access to the web site where it was collected with the indication..... HTML Script-inf [susp]
Thanking you very much

garlin · Oct 28, 2024

The registry cache mirrors the StateRepository database, which manages all of the installed UWP (or Store) Apps. If there's an objectionable item, then you should try removing the offending App that owns the key.

Otherwise Windows will recreate the cache every time it reboots. Can you share what are the key's contents that you're concerned about?

Jacee · Oct 28, 2024

I have the same reg key and there's nothing 'dodgy' about it.

garlin · Oct 28, 2024

Jacee said:
I have the same reg key and there's nothing 'dodgy' about it.

This is a cache, so your "86" key will be different from someone else's.

For example, I have a newly installed 24H2 in a VM. It doesn't have anything past "6C" in the cache because I haven't installed any new UWP apps.

Jacee · Oct 29, 2024

@geomazo this may be a false/positive from Avast. Download 'free' Malwarebytes and scan your computer. Free Antivirus 2024 | Download Free Antivirus & Virus Scan | 100% Free & Easy Install
Also, if you use Chrome browser, clear your browsing data: Delete browsing data in Chrome - Computer - Google Chrome Help

Jacee · Oct 29, 2024

I looked back and I see you're using Edge browser.... from Microsoft:

In Microsoft Edge, select Settings and more > Settings > Privacy, search, and services .
Under Clear browsing data, select Choose what to clear.
Under Time range, choose a time range.
Select the check box next to each data type you’d like to clear, and then select Clear now.
If you’d like, you can select Choose what to clear every time you close the browser and choose which data types should be cleared.

Learn more about what gets deleted for each browser history item.

geomazo · Oct 30, 2024

Hello and Thanks.
I did what kindly Jacee suggested. No positive result though.
QUESTION: Does the Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\StateRepository\Cache\PackageFamily\Data
have a file in System associated with itself ?
Or the CACHE is the sole materialization in the PC of the Data that governs ?
Is the CACHE updated ? or - I don't believe that - is permanent and unmodifiable throughout the life of the System?
The Package family has 3 entries in DATA, INDEX and PACKEGE SID.
Thank You.

brotherboard · Oct 30, 2024

I have, in the past, successfully used a programme called 'RegAssassin' originally from Malwarebytes team to remove stubborn Registry Keys, its old but runs ok on Win 11. It can be downloaded from 'majorgeeks'
Now this may very well remove said entry but I have no knowledge of the entries purpose so beware.

garlin · Oct 30, 2024

The shared advice to modify or delete StateRepository keys is not helpful. When there are default Window Apps (ie. NotePad, Terminal, Media Player, Photos, etc.), Windows tracks the installation of these apps in the StateRepository database.

Some of the database data is mirrored in this Cache. There is no useful reason for anyone to touch this data, the keys have special security permissions to prevent tampering. This data is fairly static, because it stays the same until you install or remove default Apps, or install new Apps from Windows Store. If Avast is flagging it as malware, then it's being stupid.

csun · Oct 30, 2024

geomazo said:
What file and where located is the file that is connected with such Registry Key?

Don't know about the file, but I have the exact key on 23H2. Don't think any cause for alarm.

geomazo · Oct 31, 2024

Hello, It not causing alarm now, however it it disturbing the fact not not being able to control an entry in the Registry.
Regards

Torus · Oct 31, 2024

geomazo said:
it it disturbing the fact not not being able to control an entry in the Registry.

Why? There's hundreds of registry keys which can't be modified unless you're the SYSTEM or TrustedInstaller user. Most of the permissions are set for security reasons and to ensure system stability.

geomazo · Oct 31, 2024

Hello. Correct. However that entry in particular refers to a web site, has nothing to do with system stability; so, wrongly or rightly I thought that an Administrator could modify it. YES it is matter of how the system was conceived. There has been a logic behind, that in the particular case appears less compelling.

Unable to delete a Registry Key carrying the origin to a web site.

Active member

My Computer

Well-known member

My Computers

Active member

My Computer

Well-known member

My Computers

Well-known member

My Computers

Like a rolling drone.

My Computers

Active member

My Computer

Well-known member

My Computer

Accroche-toi à ton rêve

My Computers

Well-known member

My Computer

Accroche-toi à ton rêve

My Computers

Accroche-toi à ton rêve

My Computers

Active member

Attachments

My Computer

Well-known member

My Computer

Well-known member

My Computer

Well-known member

My Computer

Active member

My Computer

Active member

My Computer

Active member

My Computer