Task Manager and Regedit Disabled

[WTFsandwich]

Well, I know this is caused by malware, unfortunately. I've gotten rid of the malware itself, but I have no idea how to re enable the Task Manager or regedit. Each says "Disabled by administrator", but I'm the only account on the computer, and it's an admin account.

What should I do?

I'm on Win7 Pro x64

Thanks

 

[seavixen32]

I'd stab at a guess and say you haven't got rid of all the malware.

Did you carry out a scan in Safe Mode? If not, it would be advisable to do so.

Malwarebytes is a great tool to use in these cases.

You might want to check these tutorials:

Regedit - Enable or Disable - Vista Forums

Task Manager - Enable or Disable - Vista Forums

 

[Maguscreed]

I'd stab at a guess and say you haven't got rid of all the malware.

Did you carry out a scan in Safe Mode? If not, it would be advisable to do so.

Malwarebytes is a great tool to use in these cases.

You might want to check these tutorials:

Regedit - Enable or Disable - Vista Forums

Task Manager - Enable or Disable - Vista Forums

I approve of this post. If you use malwarebytes in safe mode with networking (so it can update if it needs too) you may even negate having to do the other stuff.

 

[WTFsandwich]

I did scan in safe mode, with Malwarebytes, AVG and MSE. It all came up clean. I've tried to manually fix the registry with a .reg file that has

REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000000
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000000

in it.

That didn't work. Nor did running

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f

in the run box.

I did just find a program called QuickFix7 on here though, I'm going to try that out and see if it works.

 

[Maguscreed]

Am I to understand you have both AVG and MSE installed at the same time?

 

[WTFsandwich]

Is that particularly bad? I know anti-viruses can interfere with one another, but I keep MSE disabled most of the time. I only use it to scan. I prefer to leave live protection up to AVG.

Either way, that QuickFix7 worked.

Found it here: http://www.sevenforums.com/general-discussion/99924-task-manager-disabled.html

 

[Maguscreed]

It's best to pick one security and go with it. The free version of mbam doesn't really count as it doesn't run active at all. Both the other two are attempting to gain control of certain processes and system components though and can lead to trouble down the road.

I personally prefer MSE because it's generally more stable with windows 7, though admittedly AVG has more features. In fact I'm wondering if AVG didn't decide to block access to those two items as a security measure. As some apps have that option.

 

[seavixen32]

I use MSE and am happy with it. That and a regular scan with Malwarebytes has kept my system free from nasties.

Anyway, pleased to read you've managed to clean your system.

 

[WTFsandwich]

Unfortunately, I spoke too soon. I guess you all were correct in assuming it's not completely gone. Task manager and regedit became disabled as soon as I restarted my computer. I removed AVG in an attempt to see if that was indeed what was stopping TM and RE. Unfortunatley, it seems they're still locked. QuickFix worked again, however, I'd like to completely remove this malware, as I'm sure it can do more damage than simply blocking these two utilities.

What do you all suggest I try?

 

[seavixen32]

Other than another full scan in Safe Mode or a complete re-install I'm out of ideas.

You could use different anti-virus scanners such as:

Malwarebytes Anti-Malware - Free software downloads and software reviews - CNET Downloads

Microsoft Safety Scanner - Remove Spyware, Malware, Viruses Free

 

[WTFsandwich]

I might have only done a quick scan, now that I think about it. I'll make sure to try a full one.

I'll be back with some results (hopefully)

EDIT: It seems that the malware has hijacked svchost.exe I'm fairly sure that's a difficult or impossible removal, and I have a feeling that if I were to scan again it wouldnt be gone. Is my only other option really a full reinstall?