My computer is infected with the fake virus called “System Antivirus 2008″ that has turned off my task manager and when I left click the blue task bar at the bottom of the screen the “task manager” option is grayed out.
When I follow the instructions (see below) the Ctl+Alt+Del option shows that the setting is “Remove Task Manager” is set to “enable”.
When I dbl click the “Remove Task Manager” option is shows that setting is “not configured”. The “explain” tab says “Prevents users from starting Task Manager (Taskmgr.exe). If this setting is enabled and users try to start Task Manager, a message appears explaining that a policy prevents the action.”
Given that the Ctl+Alt+Del selection lists Remove Task Manager the question is how do I turn “task manager back on”.
These are your suggestions
By studying, your problem it looks like your “Task Manager” option is disable by the Administrator.
If u want to enable the “Task Manager” follow the given below
steps:
1. Click on Start.
2. Select the Run option. in the textbox type “gpedit.msc”
3. A global policy editor will opened. try to locate the option
User Configuration–>Administrative Templates–>System–>Ctrl+Alt+Del Option.
From there u have to enable the task manager option
Related posts:
11 responses so far ↓
1 Dave S // Sep 15, 2008
Use this link to remove Antivirus 2008 …forget your task manager
http://www.xp-vista.com/spyware-removal/antivirus2008-antivirus-2008-removal-instructions
2 Incredulicous // Sep 15, 2008
Let’s face it. All of us have been infected by virus before. Even if you have anti-virus installed, you can still be infected by a new or custom virus that is not recognized by your anti-virus. Sometimes after removing the virus completely from our system, you’ll face new problems such as you can no longer bring up Windows Task Manager from CTRL+ALT+DEL. You get the error message saying “Task Manager has been disabled by your administrator”.
You think that it’s easy to fix this problem by going to Registry Editor but you can’t! You get the error message “Registry editing has been disabled by your administrator“
.
Folder Options and even Show Hidden Files & Folder is disabled! How frustrating! Don’t worry, here’s how to restore your Windows Task Manager, Registry Editor, Folder Options and Show hidden files & folders.
This problem is most commonly caused by a virus called “Brontok“. Brontok virus will make some changes to the system restrictions in order to hide itself from easy detection and also from easy cleaning.
Here’s a free tool called Remove Restrictions Tool (RRT) which is able to re-enables all what the virus had previously disabled, and gives you back the control over your own computer.
Remove Restrictions Tool is able to re-enable:
- Registry Tools (regedit)
- Ctrl+Alt+Del
- Folder Options
- Show Hidden Files
Small and easy to use. Make sure you boot in to Safe Mode to use Remove Restrictions Tool (RRT). Just click on the buttons and it’ll do it’s job.
Luckily that has never happened to me before, but if an
application stops processing, the best method is to disable all the software processes from your registry, go to boot.ini, start up on safe mode and than enable them, try opening it, if it works, save the settings and reboot on normal startup, it should work.
If not try the following…
Try runing System File Checker (You'll need the CD). It will do kind of what you did, but on a more thorough scale.
Start / Run / SFC
If that does not work, then perhaps your registry is corrupted or has been tampered with. Open regedit (Start / Run / regedit) and check this setting first:
[HKEY_CURRENT_USER\ Software\ Microsoft\ Windows\ CurrentVersion\ Policies\ System\DisableTaskMgr]
Make sure it is not set to 1. If it is set to 1, set it to 0.
Another idea is.. Do you have permission to use it? Since XP has many advanced user policies and services, it is possible that something has been muddled. If you login as administator or an account with equal power, can you still not use it? It might be kind of farfetched, but I'm sure it is possible to disable the taskmanager via the policy manager for lesser-users such as "guests" and "users".
Keeping an open mind, this could also be a virus. So run a virus scanner if you have one (preferable updated as recently as possible).
question
- are you comfortable with regedit
(if not don't bother, try system restore instead)
runbox command
- press keyboard buttons: winkey + r
- paste this in slot: regedit
- press: enter
- press keyboard button: left arrow
(continue until al folders are neatly closed)
- open each folder in turn: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
- right hand click: reg dword
- choose modify
(give it a value of 0 to enable it)
(give it a vaule of 1 to disable it)
If all this doesnt work then download the task manager fix from http://www.taskmanagerfix.com/ and it should do it all for you.
P.S. Hope this helps!!!
3 SecurityExpert // Sep 15, 2008
Your computer is infected with rogue antispyware program. Download and run rogue antispyware removal tool from http://www.spywaregeeks.com to remove the rogue software from your computer.
4 The Phlebob // Sep 15, 2008
This fix assumes you still have access to the Start->Run command and to regedit.exe. The virus may have been smart enough to shut either or both of those down.
This entails going into the Registry, and that's always risky. Some ground rules for using it:
1.Do NOTHING in Regedit other than what I detail here.
2.Commands in Regedit take effect immediately and have no Undo capability. We'll create a backup file, but some mistakes in editing the Registry can prevent successful booting up, making that file useless.
3.If you think you made a boo-boo during the editing, IMMEDIATELY, WITHOUT GETTING OUT OF Regedit, click on File->Import, find the backup file and import it. That will put the registry back to the way it was before you edited it.
The procedure:
1.Click the Start->Run menu item.
2.In the text box, enter
regedit.exe
and press Enter.
3.For safety, we're going to backup the registry in a .reg file. This will be a BIG file (think 60+ megabytes). Click the My Computer icon in Regedit’s left-hand pane.
4.Click the File->Export menu item.
5.Give the file a name and save it as a Registration (.reg) File somewhere you'll be able to find it again if you need it.
6.Using the left-hand pane, navigate to each of these keys (don't worry if any of them aren't there).
7.In the right-hand pane of each there might be a value named DisableTaskMgr. If so, set it to zero.
HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies\ System
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ policies \ system \
HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Group PolicyObjects \ LocalUser \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System
8.Navigate to this key:
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon
9.In the right-hand pane there might be a value named DisableCAD. If so, set it to zero.
10.Try to bring up Task Manager. If it still doesn’t come up, restart the computer and try again.
Good luck.
5 Jim W // Sep 15, 2008
The easiest fix is to do a system restore back to the time before you downloaded it. It will get rid of it.
6 Kelly Wright // Sep 15, 2008
Well, I think enabling Task Manager before removing the malware is pretty useless.
A better approach with more chances to success is running a command-line anti-malware scanner in Windows Safe Mode. This ensures that System Antivirus will be caugh “sleeping”. It’s easier to get rid of malware when it’s not loaded in system memory - that’s what Safe Mode is meant for.
a-squared released a nice tool that doesn’t need to be installed.
The commands that you need to type in are shown on screenshots in the hubpage below.
7 malware_expert // Sep 15, 2008
try manual removal instructions
8 JustinD // Sep 15, 2008
http://www.pcthreat.com/parasitebyid-6906en.html
SystemAntivirus2008 (System Antivirus 2008, SystemAntivirus 2008, Antivirus2008, Antivirus 2008) is a latest rogue anti-spyware. SystemAntivirus2008 is a clone of WindowsAntivirus2008, XPAntivirus, Antivirus2008Pro. SystemAntivirus2008 can seriously damage user’s computer. This program gives fake scan results, fake error messages to trick users into purchasing “full” version of SystemAntivirus2008 to “fix” those errors. It is very difficult to detect and remove SystemAntivirus2008 program, because this rogue program will not remove through a convenient “uninstall” feature. SystemAntivirus2008 can even recreate itself if it wasn’t removed properly. SystemAntivirus2008 will open security holes in browser, it can install additional malware or other spyware to users PC without his permission. It’s recommended to delete SystemAntivirus2008 as soon as possible from your computer so safe your privacy and data!
Type: Rogue Anti-Spyware
Common infection sympthoms:
* Slow Computer
* Annoying pop-up’s
* System crashes
* Slow internet connection
* Shows commercial adverts
* Connects to the internet without permision
Other mutations known as:
AntiVirus2008, Antivirus 2008, XPAntivirus, Antivirus2008Pro, Trojan Zlob, Zlob, SystemAntivirus 2008
9 Catahoula // Sep 15, 2008
I had your exact problem and finally, after 6 hours, have completely resolved the problem.
Quick answer, I downloaded the free Spyware Doctor that comes with Google packs - and then paid for the upgrade to the full program, and ran Full Scan and then Inteli-Scan. It took about 5 hours to scan (which the Spyware Docter FAQ's say is normal), but now the System Antivirus 2008 is gone and my Task Manager is back to normal.
FYI - I first tried the manual remove that you can find all over the net, and that is when the task manager went. So - screw the manual remove.
Long Answer (if you want to repeat my steps - the one that worked at least): After finding out that I had System Antivirus 2008 and that it was not a real program and was indeed a spyware/malware or whatever that some scum bag people created (and when they are caught should be forced to - okay, I can't say - but I hope they suffer). Anyway - upon doing searches and finding the same "manual" solution posted everywhere, I tried it. Like you, the Malware kept popping up and staying atop every other window. Anyway, I tried the manual remove and by Step 2 - had my Task Manager disabled. As all the instructions said that manual remove is dangerous for anyone except IT professionals, I stopped at this point.
Next, all other links seem to be a sales point for Spyware Doctor (and a few other similar programs). Having never heard of Spyware Docter and not wanting more problems I researched it and it seems to be legit.
So I downloaded the most current version from PCtools.com, version 6. something (today is 9/9/08 when I downloaded it). It was free. I ran it. It did not work. But it said if I had such problems, to try a different version, such as you can find with Google Packs, which is free.
I downloaded it via Google packs. It showed the Bad files and I removed them. Or so I thought. Upon reboot, the scumbag file still opened and took over the computer. So I ran the Spyware Doctor again. And I ran every possible scan they had. And it found 4 more files. Poof - I removed them via the legit Program and rebooted. AND STILL the Virus program opened and took over. Not willing to give up, I opened the free Google Pack Spyware Doctor and paid for the full upgrade Plus the Virus addon. It was $34. I see you can get it cheaper at Amazon and in stores, but I had spent hours already and wanted it done.
I did this paid upgrade. Then I opened the file and clicked the program's update button which added in current virus information. And then Ran the Full Scan (which took 4.5 hours) and found 6 threats (about 30 files) and then ran the Intelli-Scan (which did not find anything). I rebooted and the Virus is gone.
You can upgrade to version 6.x from your account, but as it did not work before, I wanted to try 5.x, which is what worked.
One last piece of advice: For those with this problem, one of the frustrating issues is the Virus program opens its windows on the top level. You can still operate whatever program is below this window. And let the virus program complete it's scan of your files (or whatever it looks like it is doing) and when it is done, close the window. You get a much longer break from it reappearing than if you close it part-way through it's scan.
10 ^ray of light^ // Sep 15, 2008
the suggestions you found are not quite right. if you choose to delete System Antivirus 2008 manually, you need to delete all the files that belong to System Antivirus. here’s a tutorial on how you do that http://www.2-spyware.com/remove-system-antivirus-2008.html
11 Peter H // Sep 15, 2008
This is not just a nuisance but also a very dangerous Trojan horse called ZLOB, it got passed my Norton and Microsoft malicious removal tool didnt even see it and then Ii ended up reformatting my hard drive!! BUT what I should have done was downloaded a great malware programme as recommended by Microsoft helpdesk. go to
http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe
then dump norton and load AVG 8.0 free
Leave a Comment