MajorGeeks Support Forums

Go Back   MajorGeeks Support Forums > ----------= PC, Desktop and Laptop Support =---------- > Software
Register FAQ Members List Calendar Casino Mark Forums Read

Software Software such as operating systems like Windows XP, Windows Vista, Windows 7 etc., or specific programs.


Reply
 
Thread Tools Display Modes
  #1  
Old 10-06-06, 19:26
mondrawy mondrawy is offline
Private First Class
 
Join Date: Aug 2006
Location: Egypt
Posts: 89
Thanks: 0
Thanked 1 Time in 1 Post
Default Task Manager Disabled By administrator

I have a PC that has its task manager & registry editor disabled, I'm not quite sure what caused it, most probable reason is spyware but I have my PC well protected.

Anyhow, I can't seem to be able to unlock the task manager again. Whatever it is that caused this has also disabled registry editing. I've tried running scripts that re-open the registry but its quickly closed again, which led me to believe that something is running on the PC ensuring that the registry remains closed.

Spyware and antivirus scans didn't work, so I tried using Hijack this to isolate the problem and finally found the culprit. It turned out to be a file masquerading as REGSVR running out of C:\windows. When I kill this process I can re-open the registry editor and from there open up the task manager.

Now the problem is, this file keeps running every time I restart windows. I've tried every trick I can think off to stop it but I can't seem to get anything to work. Its not listed under msconfig's startup. Its not listed in the Registry editor under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run or any of the users. My attempts at deleting the file or corrupting it don't seem to be doing any good, everytime I restart the PC this malicious file reappears and runs itself, shutting down the registry and task manager. Its not being picked up by updated spyware or antivirus scans (different programs) and there is little left I haven't tried.

Any ideas how to get rid of it ?
Reply With Quote
Sponsored links
  #2  
Old 10-06-06, 20:46
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,701
Thanks: 449
Thanked 4,652 Times in 4,391 Posts
Default Re: Task Manager Disabled By administrator

Read and run first - Malware section
http://forums.majorgeeks.com/showthread.php?t=35407
Reply With Quote
  #3  
Old 10-16-06, 07:59
mondrawy mondrawy is offline
Private First Class
 
Join Date: Aug 2006
Location: Egypt
Posts: 89
Thanks: 0
Thanked 1 Time in 1 Post
Default Re: Task Manager Disabled By administrator

thats wierd, I remember replying some time earlier. Looks like my post didn't get posted. Anyways, I didn't exactly follow this list but I ran my own comparable set of diagnostics with several of the same applications and I couldn't find anything funny, ALL start up keys have no Regsvr.exe in them or anything else out of the ordinary. I've exhausted all the tests I can think off, perhaps you have some specific test in mind ?
Reply With Quote
  #4  
Old 10-16-06, 11:11
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,701
Thanks: 449
Thanked 4,652 Times in 4,391 Posts
Default Re: Task Manager Disabled By administrator

There was a system glitch on Sunday so posts that day got deleted ....so to carry on ...try this:
To reinstall the Microsoft Task Manager:

NOTE: You must be logged on as Administrator or as a member of the Administrators group in order to perform this procedure.

1. Click Start , click Run , and then type the following command:

%systemroot%\inf

NOTE : There are no spaces at all in the preceding command line.

2. Click OK to open the INF folder.
3. Locate the file mstask.inf

Right-click the file, and then click Install . This will reinstall the files that Search needs to proceed normally.

You will be asked to place your windows XP cd rom in the drive.
Reply With Quote
  #5  
Old 10-16-06, 11:25
Mada_Milty's Avatar
Mada_Milty Mada_Milty is offline
Major Geek
 
Join Date: Aug 2005
Location: Ontario, Canada
Posts: 4,878
Thanks: 4
Thanked 52 Times in 48 Posts
Default Re: Task Manager Disabled By administrator

Are we certain that a computer administrator hasn't applied group policies to restrict access to the task manager? This is the ONLY time I've seen the symptoms you describe.

Is this computer part of a domain? If so, it may have inherited this restriction from the domain controller. You'll have to talk to the network administrator if this is the case.

Otherwise, it should be a policy defined on the local computer. Here's how we can check:

1. Hit windows key + r (or click Start --> Run)
2. Type 'gpedit.msc' (without the quotes)
3. Hit enter (or click 'OK')

The group policy editor will now launch. I'm willing to bet that there is a setting in here (ie, "Restrict Access to Task Manager") that has been enabled.

Even better, please see this link on how to enable/disable task manager
__________________
A+, Project+ Certified Network Engineering Grad
5 years Sys Admin exp. 11 years web dev exp.
Reply With Quote
Sponsored links
  #6  
Old 10-16-06, 11:34
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,701
Thanks: 449
Thanked 4,652 Times in 4,391 Posts
Default Re: Task Manager Disabled By administrator

regsvr
regsvr.exe
Added by the WEBMONEY-G TROJAN! .
Would suggest a bitscan.
Reply With Quote
  #7  
Old 10-16-06, 11:43
hopperdave2000's Avatar
hopperdave2000 hopperdave2000 is offline
Major Geek
 
Join Date: Apr 2006
Posts: 2,203
Thanks: 0
Thanked 6 Times in 6 Posts
Default Re: Task Manager Disabled By administrator

Boot in safe mode. Run regedit. Navigate to HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System and look for DisableTaskMgr in the right-hand pane. It's probably set to a value of 1, and it should be set to 0 (zero). Right click on it, choose the appropriate option to change the value to 0, and exit regedit and reboot.

hopperdave2000
Reply With Quote
  #8  
Old 10-16-06, 20:28
tmiller67 tmiller67 is offline
Private First Class
 
Join Date: Sep 2006
Posts: 36
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Task Manager Disabled By administrator

I had this problem a while back and tried all of the things suggested here and more with no luck. System restore was the only thing that fixed it for me after cleaning out the trojan.
Reply With Quote
  #9  
Old 10-17-06, 08:31
mondrawy mondrawy is offline
Private First Class
 
Join Date: Aug 2006
Location: Egypt
Posts: 89
Thanks: 0
Thanked 1 Time in 1 Post
Default Re: Task Manager Disabled By administrator

I'm the system administrator and I didn't disable the task manager.

Quote:
1. Hit windows key + r (or click Start --> Run)
2. Type 'gpedit.msc' (without the quotes)
3. Hit enter (or click 'OK')
Group policy editor is disabled because registry editing is disabled, the editor runs but has very little policies that can be changed (I'm assuming those are the policies that don't require registry).

Booting in safe mode or killing regsvr.exe to open the registry works and indeed the task manager is disabled in the registry, after fixing it and rebooting, my changes are apparently undone. Regsvr.exe runs again on startup and I'm assuming it shuts down regedit and the task manager as well.

I've ran several anti-(you name it) programs and they all came out blank. I suppose I'll try bitscan as well but I doubt it'll catch anything.

Also, I had system restore disabled so I can't restore to anything prior to the problem (which has existed for quite some time anyways)
Reply With Quote
  #10  
Old 10-19-06, 00:01
hopperdave2000's Avatar
hopperdave2000 hopperdave2000 is offline
Major Geek
 
Join Date: Apr 2006
Posts: 2,203
Thanks: 0
Thanked 6 Times in 6 Posts
Default Re: Task Manager Disabled By administrator

Try regedit in safe mode or try a 3rd party regedit. Several good free ones are available right here at majorgeeks...

hopperdave2000
Reply With Quote
Sponsored links
  #11  
Old 10-19-06, 01:30
ŽViPeRŽ's Avatar
ŽViPeRŽ ŽViPeRŽ is offline
Private E-2
 
Join Date: Oct 2006
Posts: 15
Thanks: 0
Thanked 0 Times in 0 Posts
Default Re: Task Manager Disabled By administrator

Quote:
Originally Posted by tmiller67
I had this problem a while back and tried all of the things suggested here and more with no luck. System restore was the only thing that fixed it for me after cleaning out the trojan.
Same here how ever there is a article in the microsoft help section about this they say its as a result of an incompatibility with sp2 and previously installed security patches but the fail to mention which ones and as usual the problem runs much deper than they suspect the long and the short of it is the only thing i found that fixed it was back up all my needed files email addies etc etc etc and reinstall
Reply With Quote
  #12  
Old 10-23-06, 18:48
mondrawy mondrawy is offline
Private First Class
 
Join Date: Aug 2006
Location: Egypt
Posts: 89
Thanks: 0
Thanked 1 Time in 1 Post
Default Re: Task Manager Disabled By administrator

Quote:
Originally Posted by hopperdave2000
Try regedit in safe mode or try a 3rd party regedit. Several good free ones are available right here at majorgeeks...
In safe mode the registry and task manager are enabled, but I can't find anything that calls regsvr on startup whatsoever. I've even done a complete search through the registry for regsvr.exe and nothing came up. All other "tools" have come up clean as well.

Looks like I might have to reinstall, which is a very drastic measure but I seem to have run out of options here
Reply With Quote
  #13  
Old 10-23-06, 19:55
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,701
Thanks: 449
Thanked 4,652 Times in 4,391 Posts
Default Re: Task Manager Disabled By administrator

Ever run the bitscan?
Reply With Quote
  #14  
Old 10-24-06, 21:22
mondrawy mondrawy is offline
Private First Class
 
Join Date: Aug 2006
Location: Egypt
Posts: 89
Thanks: 0
Thanked 1 Time in 1 Post
Default Re: Task Manager Disabled By administrator

Quote:
Originally Posted by TimW
Ever run the bitscan?
Unfortunatly I didn't try that earlier, I thought since all the tests I've tried and all the applications I've installed failed to detect the problem that some online scan would probably fail too. But I was sorely mistaken, FINALLY the damn thing was identified as trojan.PSW.Agent.B and was subsequently removed, there doesn't seem to be much information online about this trojan though. But from what I gather it apparently stashes another copy of regsvr.exe in 'c:\program files' as well as what appears to be a master file with a different name in c:\windows\system32. Those files seem to have returned again after a restart though. But I could probably give it another try while shutting off system restore again (i turned it back on after losing hope).
Reply With Quote
  #15  
Old 10-24-06, 21:27
TimW's Avatar
TimW TimW is offline
MajorGeeks Administrator - Jedi Malware Expert
 
Join Date: Jan 2005
Location: The recesses of my mind!
Posts: 46,701
Thanks: 449
Thanked 4,652 Times in 4,391 Posts
Default Re: Task Manager Disabled By administrator

Now do the read and run first sticky in the malware section ....
Reply With Quote
Sponsored links
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT -5. The time now is 18:59.

MajorGeeks.Com Menu

MajorGeeks.Com \ All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ NEW! PC Games \ System Tools \ Macintosh \ Demonews.Com \ Top Downloads

MajorGeeks.Com \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds


All content Copyright Š MajorGeeks.com source code Powered by vBulletin® Version 3.8.4
Copyright © 2009 vBulletin Solutions, Inc. All rights reserved.
Ad Management by RedTyger