Fake antivirus disabling Taskmgr.exe

Posted on 2010-10-23 at 18:42:47. Last updated on 2010-10-23 at 18:42:47.

Today, one of the Windows XP machines in the network got compromised by a fake antivirus. I was able to get rid of this malware, which hid itself under C:Documents and SettingsAll UsersApplication DataMicrosoft, however I wasn't able to run taskmgr.exe. I googled for solutions on how to enable taskmgr.exe, some said that it was in the Group Policy. However, I couldn't find the entry.

Apparently, this fake antivirus also created a whole bunch of registry entries under [HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Image File Execution Options].

Extra debugger entry for Taskmgr.exe

To fix it, first delete the whole key and then merge the registry entry in this zipped file. Please note that this has only been tested with Windows XP 32-bit. Windows Vista and Windows 7 users, please don't use the registry file to fix your system.

Comments

  • 2011-11-04 19:06:27 Bobbie

    If you're looking to buy these atricels make it way easier.

  • 2011-11-19 02:05:31 Shiela Buescher

    I like the look of your blog! It looks really amazing.

  • 2011-11-25 06:37:37 Dottie Desalle

    Nice website! How can I subscribe to it?

Post your comment

E-mail & website are optional.

Name
E-mail
Website
Comment