Task manager has been disabled by administrator

[wilson snow]

For up to four weeks now,i have been trying to solve this mess "task manager has been disabled by administator" many a time when i install a fresh copy of window xp, the next day, if i try to access the task manager, the instruction "task manager has been disabled by administrator" will come out. basically i am looking for way to enable the task manager. any one with usefull information should help please for i am desperately in need of help. big up to all daniweb member and a big thank you in advance.

[smsmcp]

might be a gpo setting do you log in as admin, or with a admin account.

Check reg setting.
Start, run type regedit

User Key: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\
System]
System Key: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\
System]
Name: DisableTaskMgr
Type: REG_DWORD
Value: 1=Enablethis key, that is DISABLE TaskManager
Value: 0=Disablethis key, that is Don't Disable, Enable TaskManager

Back up reg before you make any changes. Hope this helps

[john.cooper]

Thanks nice tip really helpful.

[wilson snow]

i got your reply. but please i want you to make it a bit plain to my own understanding. thak you very much

[gerbil]

Quite often, malwares disable Task Manager via registry settings to prevent simple detection and termination of their own processes.
smsmcp gave you the steps to correct those registry settings, a detailed guide to writing new key values and data content.

If you have XP Pro, then click Start, click Run and type in gpedit.msc
In the Group Policy Editor that pops, expand:
User Configuration, Administrative Templates, System, Ctrl+Alt+Del Options.
Dclick Remove Task Manager to change its setting.

Else, if you have XP Home, or also, you can delete the key value instead of disabling it as smsmcp showed; I think deletion is better:
Paste or type this into the Start > Run box:
reg delete HKCU\software\microsoft\windows\currentversion\policies\system /v disabletaskmgr /f
And all should be fine.
You could also run this:
reg delete HKLM\software\microsoft\windows\currentversion\policies\system /v disabletaskmgr /f

[wilson snow]

thanks man! this is really helpful. once again thanks a million

[gerbil]

Glad to help.
Paste these two lines into the Start > Run box, pressing Enter after each, and agreeing to query in cmd window [press y].
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0
REG add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0
Most likely you were hit by some malware. It would pay to run this as a check:
==Please download Malwarebytes' Anti-Malware
from: http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html
or: http://www.besttechie.net/tools/mbam-setup.exe
=Dclick that file, mbam-setup.exe, to install the application,
-ensure that it is set to update and start, else start it via the icon, and UPDATE it.
Select "Perform QUICK Scan", then click Scan; the application will guide you through the remaining steps.
ENSURE that EVERYTHING found has a CHECKMARK against it, then click Remove Selected.
If malware has been found [and removed] MBAM will automatically produce a log for you when it completes... do not click the Save Logfile button.
Examine the log: if some files are listed as Delete on Reboot then restart your machine before continuing.
Copy and post that log [it is also saved under Logs tab in MBAM].
Merry Christmas...

[wilson snow]

i have downloaded and installed the malwarebyte and these are the result from the scan

Scan type: Quick scan
Objects scanned: 128911
Time elapsed: 8 minute(s), 28 second(s)

Memory Processes Infected: 3
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
c:\WINDOWS\Temp\winusxijs.exe (Trojan.Dropper) -> 2968 -> Unloaded process successfully.
c:\WINDOWS\Temp\pkloq.exe (Trojan.Spy) -> 3656 -> Unloaded process successfully.
f:\rdxsr.exe (Malware.Packer.Gen) -> 2664 -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AMSINT32 (Virus.Sality) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\amsint32 (Virus.Sality) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\Temp\winusxijs.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
c:\WINDOWS\Temp\pkloq.exe (Trojan.Spy) -> Quarantined and deleted successfully.
f:\rdxsr.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.
c:\piyspf.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.