Windows 7 Where do I locate a script running that re-writes registry values?

[winpigler]

Right now I am running on Windows 7 home premium 64-bit. There is a legalnoticecaption and legalnoticetext enabled in the registry, and when I delete these values and restart, they re-appear! I've even tried deleting them altogether. I'm guessing there is some sort of script enabled that re-writes the registry values upon deletion, and I need some help identifying and getting rid of said script. Or, if you have any suspicions on what else it may be, please do not hesitate to tell me to check it out.


Thanks!

 

[Trouble]

Hello and welcome to the forum.
There are actually two locations within the Windows Registry that you may have to attend to.
The most common one which you likely already know about and have probably edited
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon->(LegalNoticeCaption and LegalNoticeText)
and the other less well known location
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System->(legalnoticecaption and legalnoticetext)
Let us know if that does it for you.
Regards
Randy