Hijack.Regedit

[hassan329]

I removed these two viruses and when i restart my pc two times it comes back and disable my task manager and regedit and command prompt.

Malwarebytes' Anti-Malware 1.44
Database version: 3828
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

07/03/2010 1:26:26 AM
mbam-log-2010-03-07 (01-26-23).txt

Scan type: Quick Scan
Objects scanned: 136603
Time elapsed: 8 minute(s), 20 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[fletch]

Group Policy" or "Domain Group Policy".

RESOLUTION:-

XP Home Edition:-

1]Start>Run>Regedit>OK

2]Now navigate to the following location:-Software\Microsoft\Windows\CurrentVersion\Policies\System.Double click on DisableTaskMgr. If it is not present then Create a new DWORD valued named "DisableTaskMgr"
0 = default, 1 = disable Task Manager. Set the value data zero.

3]Restart computer.

XP Professional:-

1]Start>Run>gpedit.msc>ok

2]Double click on Administrative Templates under the User Configuration.

3] Now double click on System. Select Ctrl+Alt+Del options. Double click on it.

4]Select Remove Task Manager. Right click on it and select Properties. If this setting is enabled and users try to start Task Manager, a message appears explaining that a policy prevents the action. So by disabling the policy, you are enabling the Task Manager.( (Click Setting>Select Disabled radio button>Apply/OK)

[hassan329]

Thanks. it is solved