Member Avatar for firekid1239

Well first and foremost my problem is that I'm an idiot and I love to download pirated software, been doing it for years and never caught anything. I always check what I'm downloading very carefully and read comments about the specific torrent to make sure that it has good reviews and plenty of seeds.

However, the other night I went on sort of a downloading frenzy and failed to give the torrents I download the typical scrutiny. I am almost certain one of the torrents contained a virus.

I HAD one account on my windows XP Pro system, the Administrator. It seems that all of the privileges hve been set to that of a guest or "user" account. For example, I cannot run things like Dos (cmd.exe), devmgmt.msc, services.msc, msconfig, regedt, task manager, etc...

It tells me that all of these have been disabled by the administrator. Also, the run option on my start menu has been removed and I can't seem to get it back.

I created a second administrator account which I simply called "admin2" on the PC to see if the same things would happen. Everything seems to work fine with the second administrator account and in the primary admin account I can run the items listed above if I select "run as" and select Admin2


Now for my futile efforts in repairing the problem.....

I uninstalled every program that I downloaded (winamp pro, nero, adobe audition) others. I ran AVG 9.0 (updated with latest defs) both in the primary admin account, admin2, and safe mode. It detected most of the original exe files for the apps I downloaded as various trojans and quite a few registry keys associated with said trojans.

Everything seems to have been removed but the privilege problem still exists.

I would like to see if I can fix this problem without a reinstall, if at all possible. I just did a full OS reinstall a few weeks ago, and it would be such a pain to have to do it again, but I am prepared for the worst.

  • 2 Contributors
  • 2 Replies
  • 181 Views
  • 11 Hours Discussion Span
  • Latest Post Latest Post by nwilliams

Dani AI

Generated

Quick diagnosis and why the second admin is the clue: when one local admin account can run everything but another cannot, the most common cause is that per-user or machine Group Policy / registry policy entries have been changed (malware often does this to block recovery tools). That pattern — disabling Task Manager, Regedit, Run, etc. via policy keys — is documented by Microsoft. As noted, the fact that your newly created admin account behaves normally is the key to repairing the broken profile. (learn.microsoft.com)

Practical, low-risk next steps (try these from the working admin account): back up the registry first (export or use a registry-backup tool), then inspect and restore policy keys. Check HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System and HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System (and the corresponding Explorer Policies) for values such as DisableTaskMgr, DisableRegistryTools, NoRun, NoViewOnDrive, NoControlPanel — set them to 0 or remove them after exporting the key. If you have XP Pro, also check Local Group Policy (gpedit.msc). Always export keys or use a registry backup utility before making changes. (learn.microsoft.com)

If manual registry fixes revert briefly or tools remain blocked, treat it as a persistent infection/rootkit: scan and clean from outside the OS. Bootable rescue media (for example Kaspersky Rescue Disk) or an offline scanner (Microsoft Defender Offline) will scan without the malware running; then re-run an up-to-date on-demand scanner such as the Microsoft Safety Scanner. After cleaning, re-check the policy keys and test. If you are not comfortable creating rescue media, get help — incorrect edits can make things worse. (support.kaspersky.com)

Final notes: if policies keep returning or the system behaves rootkit-like, the fastest safe option is a full wipe and reinstall, restoring only known-clean data. After recovery change all important passwords and inspect other devices and backups for infection. Run a single real-time AV and use on-demand scanners for second opinions. Community removal helpers (FRST/fixlists) are widely used if you seek forum help — collect logs before posting. (support.microsoft.com)

Member Avatar for firekid1239

Also, when I start "control userpasswords2", it shows the only 2 accounts that are active on the system are the primary admin account and the admin2 I created.

Member Avatar for nwilliams

Administrative Privileges can make changes with Administrative Privileges. But You must need to know that it is alerted by the virus. Therefore it might not have control on the PC.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.