Virus disabled CMD, RegEdit, and Task Manager

Mirri · 02-05-2007, 09:59 PM

How can I re-enable these? The virus is now removed, but I still cannot access these functions, and I am on an administrator account.

Cricket57 · 02-06-2007, 02:02 AM

If these functions are still disabled then that signals the malware you were infected with has not been totally removed. You may not have any symptoms anymore / if may no longer be active, but it is still compromising your machine.

This is a regular occurence with the latest infections, which disable these processes in order to avoid detection & deletion. Another favourite of late is to modify the hostfile to stop the infected user from visiting sites that could offer help or fix the infection.

Most security suites now offer "advanced options" in order to restore system settings (e.g. re-enable task manager, regedit, desktop wallpapers, etc), or alternatively if may be worthwhile posting a HijackThis log to delete any rogue files missed?

Mirri · 02-06-2007, 04:57 AM

The virus was completely removed, I have run a virus scan in both safe and normal mode multiple times. I just had to edit the registry, which I was able to re-enable with HiJackThis, then using a few websites with some things to copy and paste to re-enable registry edit, task manager, and command prompt, I was able to completely resolve the problem.

tetonbob · 02-06-2007, 07:08 PM

These types of infections usually come with quite a few 'buddies'.

Unless you're well versed in malware removal, you may want to have a HJT log reviewed by the staff.

Please download HijackThis to your desktop - this program will help us determine if there are any spyware/malware on your computer. Double-click on the file you just downloaded.
Click on the "Unzip" button to install. It will by default install to the directory - C:\PROGRAM FILES\HIJACKTHIS\

Double click on HijackThis.exe to run the program.

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3. Post the hijackthis.log file in the HijackThis Log Help forum. Do not fix anything in HijackThis since they may be harmless.

02-05-2007, 09:59 PM	#1 (permalink)
Mirri Registered User Join Date: Feb 2007 Posts: 7 OS: Windows XP Service Pack 2	Virus disabled CMD, RegEdit, and Task Manager How can I re-enable these? The virus is now removed, but I still cannot access these functions, and I am on an administrator account.

02-06-2007, 07:08 PM	#4 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 39,463 OS: 2000 Pro; XP Pro; XP Home	These types of infections usually come with quite a few 'buddies'. Unless you're well versed in malware removal, you may want to have a HJT log reviewed by the staff. Please download HijackThis to your desktop - this program will help us determine if there are any spyware/malware on your computer. Double-click on the file you just downloaded. Click on the "Unzip" button to install. It will by default install to the directory - C:\PROGRAM FILES\HIJACKTHIS\ Double click on HijackThis.exe to run the program. 1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'. 2. If you don't get the intro screen, just hit Scan and then click on Save log. 3. Post the hijackthis.log file in the HijackThis Log Help forum. Do not fix anything in HijackThis since they may be harmless. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

02-06-2007, 02:02 AM	#2 (permalink)
Cricket57 Registered User Join Date: May 2006 Posts: 19 OS: Win XP	If these functions are still disabled then that signals the malware you were infected with has not been totally removed. You may not have any symptoms anymore / if may no longer be active, but it is still compromising your machine. This is a regular occurence with the latest infections, which disable these processes in order to avoid detection & deletion. Another favourite of late is to modify the hostfile to stop the infected user from visiting sites that could offer help or fix the infection. Most security suites now offer "advanced options" in order to restore system settings (e.g. re-enable task manager, regedit, desktop wallpapers, etc), or alternatively if may be worthwhile posting a HijackThis log to delete any rogue files missed?

02-06-2007, 04:57 AM	#3 (permalink)
Mirri Registered User Join Date: Feb 2007 Posts: 7 OS: Windows XP Service Pack 2	The virus was completely removed, I have run a virus scan in both safe and normal mode multiple times. I just had to edit the registry, which I was able to re-enable with HiJackThis, then using a few websites with some things to copy and paste to re-enable registry edit, task manager, and command prompt, I was able to completely resolve the problem.