Member Avatar for PC_Nerd

Hi,

I recently discovered a few small changes to my systen:
explorer: tools -> options was missing. re-enabled through a registry edit
taskmgr: file -> new task (run...) is still missing. Cannot find how to re enable.

ive donea bit of reading, and Trend Micro ( here: ) shows what i suspect to be a form of the virus ive got. however i can still run regedit through command line. *** also, run has dissapeared from start menun withought me touchign anything, so i suspect it may hav esomethign to do with the virus.


IVe full scanned with norton, latest virus definitions etc, and it doesnt find anything. Can anyoen recomend how I can figure out if it is this virus, and how i can get rid of it completely?

Thanks

  • 5 Contributors
  • 7 Replies
  • 202 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by Member #225258

Dani AI

Generated

Short expert summary and a practical plan tied to the replies above.

The combination of: Explorer’s Tools->Options hidden (already re-enabled), Start->Run missing, and Task Manager’s File -> New Task missing is frequently caused by the same registry/Group Policy flags rather than only an active process. The common flags are NoRun (hides Run and removes Task Manager’s New Task) and NoFolderOptions (hides Folder Options); check both HKCU and HKLM locations and whether the machine is domain-joined (domain Group Policy will reapply settings). Also check for a DisableTaskMgr entry under Policies\System if Task Manager itself is restricted. (learn.microsoft.com)

Safe, quick registry check/fix (backup first)

  • Back up the registry or create an image before changes.
  • Save the block below as fix.reg and merge it to set the policy values back to 0 (or delete the values in regedit if preferred). Log off/reboot to apply.
Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoRun"=dword:00000000
"NoFolderOptions"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoRun"=dword:00000000
"NoFolderOptions"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000

Hunting persistence and rootkits

  • Follow ’s advice: run Process Explorer and use Autoruns to inspect running processes and every autostart location (look for unsigned or unfamiliar entries). (learn.microsoft.com)
  • Run up-to-date second-opinion scanners (Malwarebytes) and a dedicated removal/rescue tool (Kaspersky Virus Removal Tool or rescue media) from Safe Mode or bootable rescue media if a rootkit is suspected. ’s rootkit point is valid: rootkits need offline or low-level scanners. (malwarebytes.com)

System Restore caution

  • Infected restore points can re-infect a cleaned system. After confirmed cleanup, turn System Restore off (this deletes all old restore points), reboot, then re-enable and create a clean restore point. (learn.microsoft.com)

Notes and cautions

  • Back up important data and the registry. If the registry keys keep returning, the system is either domain-managed or still reinfected—reimaging is often the most reliable final option. Mentioned community tools (Combofix, online scanners) can help, but prefer official tools and rescue media and proceed with caution.

Recommended Answers

All 7 Replies

Member Avatar for PC_Nerd

Ive downloaded the program as instructd, hwoever i not a trend micro user, and their online scan thign didnt work just hung at reading browser setup etc.

Ill try those scannes now thanks

Member Avatar for PC_Nerd

ok, couldnt get the online scan working - im not using a remotely recent version of IE ( and i hate teh damn thign as well all hail FF)

downloaded the spyware program, ran it, it scanned removed and thenrestarted my cmputer.. howevebr the issue is still there:

Does anyone know why the new task might be missing... and if not through a virus, can it be repared/restored through a registry entry?

Thanks

Member Avatar for dyamond

Norton is notoriously crappy in detection, You've ran superantispyware, (which I heard was good but I've never used it.. I've only used Lavasoft Ad-Aware + my AV) which detected and deleted but you still have the same problem.

Possibilities..
1. It might be a rootkit like brundle said.. I use Sophos anti-rootkit detector, it scans deep and find almost any hidden thing. http://www.sophos.com/products/free-tools/sophos-anti-rootkit.html

2. Try running Combofix (I've seen it fix oodles of stuff on mine and others pc's)

3. You might have gotten rid of the baddie but its infected your system restore which means you could keep getting re-infected unless you flush your restore points. (if you run combofix.. I think it does this for you) where did superantispyware say it was deleting the virus from?

4. If your familiar with Hijack this.. run it and see if you notice anything odd. If your not familiar with it.. they have a forum here dedicated to spyware, run it and let them give it a good look.

There is usually more then 1 program needed to completely fix all issues.. I am NO expert but have seen dozens of infected computers that need several steps till they were clean and clear.. Hope this helps!

Member Avatar for Member #225258

This tool may work for you:

Member Avatar for selfhelpebooks

Sometimes it takes more than 1 antivirus program to do the trick.
Find the ones you like (AVG, Avast, etc.) and give those a try as well.
Good luck!

Member Avatar for Member #225258

I have had excellent results with housecall.trendmicro.com (online scanner)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.