Regedit and Task Manager Disabled by Administrator

Question

There was a time when I was the Administrator. Woke up one day and had been demoted. I want to dethrone the current administrator. Can anyone help me?   Logfile of Trend Micro HijackThis v2.0.4Scan saved at 9:56:02 AM, on 4/19/2011Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\PROGRA~1\AVG\AVG10\avgchsvx.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\AVG\AVG10\avgtray.exeC:\WINDOWS\system32
etdde.exeC:\Program Files\AVG\AVG10\avgfws.exeC:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exeC:\Program Files\AVG\AVG10\avgwdsvc.exeC:\Program Files\Cepstral\bin\CepstralLicSrv.exeC:\WINDOWS\system32\cisvc.exeC:\WINDOWS\system32\clipsrv.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\AVG\AVG10\avgam.exeC:\Program Files\AVG\AVG10\avgnsx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\System32\vssvc.exeC:\WINDOWS\system32\wbem\wmiapsrv.exeC:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exeC:\WINDOWS\system32\dllhost.exeC:\Program Files\AVG\AVG10\avgemcx.exeC:\Program Files\AVG\AVG10\avgcsrvx.exeC:\Program Files\AVG\AVG10\avgscanx.exeC:\Program Files\AVG\AVG10\avgcsrvx.exeC:\Documents and Settings\Mason.LAPTOP\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Mason.LAPTOP\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Mason.LAPTOP\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\PROGRA~1\AVG\AVG10\avgrsx.exeC:\Program Files\AVG\AVG10\avgcsrvx.exeC:\WINDOWS\system32\cidaemon.exeC:\Documents and Settings\Mason.LAPTOP\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Mason.LAPTOP\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Mason.LAPTOP\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\WINDOWS\system32\msiexec.exeC:\Documents and Settings\Mason.LAPTOP\My Documents\Downloads\HijackThis.exeC:\Program Files\AVG\AVG10\avgmfapx.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\plugin-container.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.qword.com/?s=1R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mbox.devictormason.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dllO4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exeO4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exeO7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1O15 - Trusted Zone: *.qword.comO18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dllO18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLLO22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dllO22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dllO23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgfws.exeO23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exeO23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exeO23 - Service: Cepstral License Server - Cepstral, LLC - C:\Program Files\Cepstral\bin\CepstralLicSrv.exe--End of file - 4500 bytes

kevinf80_1d0ac6 · Answer

Hiya studentintern

I'm kevinf80 and I will be helping with any malware issues you may have with your system.

Please be aware that some of the logs I may ask for can be very complex and can take a long time to decipher. I am a volunteer here with a job and family so I ask that you be patient when waiting for replies.
Please DO NOT run any scans/tools/fixes on your own as this will conflict with the tools we are going to use.
Either print or Save to Notepad all instructions and please follow them carefully, if there's something you don't understand or that will not work please let me know and we will go through it together.
Malware is often buggy and can be very unstable, with that in mind it is advisable to backup any important data before we begin.
If you do not reply within 72 hours the thread will be closed, if you need more time let me know. Likewise if I do not respond within 48 hours feel free to PM me.
If you have any P2P applications installed such as BitTorrent, uTorrent, Limewire etc etc, please uninstall them before we begin.
If you are using Cracked or Illegal software your thread will be locked and all help will cease.

Please proceed as follows :-

Step 1

Please re-open HiJackThis and scan only. Check the boxes (tick) next to the entries listed below.

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.qword.com/?s=1
O15 - Trusted Zone: *.qword.com

Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis. Reboot

Step 2

Download user posted image

TFC to your desktop, from either of the following links
Link 1
Link 2

Make sure any open work is saved. TFC will close all open application windows.
Double-click TFC.exe to run the program.
If prompted, click "Yes" to reboot.

TFC will automatically close any open programs, let it run uninterrupted. It shouldn't take longer take a couple of minutes, and may only take a few seconds. It should re-boot your OS on completion, if not re-boot yourself please. <---Very important

Step 3

user posted image

Please download Malwarebytes Anti-Malware and save it to your desktop.
Alernative D/L mirror
Alternative D/L mirror

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
Please save the log to a location you will remember.
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

Let me see the log from Malwarebytes and a fresh HJT log, also give update on any current/new issues

Kevin

studentIntern · Answer

Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 4:08:52 PM, on 4/20/2011 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal   Running processes: C:\WINDOWS\System32\smss.exe C:\PROGRA~1\AVG\AVG10\avgchsvx.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AVG\AVG10\avgtray.exe C:\Program Files\Real\RealPlayer\updateealsched.exe C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe C:\WINDOWS\system32
etdde.exe C:\Program Files\AVG\AVG10\avgfws.exe C:\Program Files\AVG\AVG10\avgwdsvc.exe C:\Program Files\Cepstral\bin\CepstralLicSrv.exe C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\system32\clipsrv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\AVG\AVG10\avgam.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\AVG\AVG10\avgnsx.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\System32\vssvc.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\AVG\AVG10\avgemcx.exe C:\Program Files\AVG\AVG10\avgcsrvx.exe C:\PROGRA~1\AVG\AVG10\avgrsx.exe C:\Program Files\AVG\AVG10\avgcsrvx.exe C:\WINDOWS\system32\cidaemon.exe C:\Documents and Settings\Mason.LAPTOP\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Mason.LAPTOP\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Mason.LAPTOP\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Mason.LAPTOP\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Mason.LAPTOP\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe   R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =  O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Real\RealPlayer\updateealsched.exe'  -osboot O4 - HKLM\..\Run: [Adobe ARM] 'C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe' O4 - HKCU\..\Run: [cdloader] 'C:\Documents and Settings\Mason.LAPTOP\Application Data\mjusbsp\cdloader2.exe' MAGICJACK O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgfws.exe O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe O23 - Service: Cepstral License Server - Cepstral, LLC - C:\Program Files\Cepstral\bin\CepstralLicSrv.exe   -- End of file - 4241 bytes

studentIntern · Answer

Malwarebytes' Anti-Malware 1.50.1.1100 www.malwarebytes.org Database version: 6397 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 4/20/2011 4:01:42 PM mbam-log-2011-04-20 (16-01-42).txt Scan type: Quick scan Objects scanned: 194761 Time elapsed: 11 minute(s), 39 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Looks to me as if your knowledge and experience has solved the problem. Will post the HJT log soon. Many many thanks for your help.

Student Interns

kevinf80_1d0ac6 · Answer

Your log is OK, let me know if there are any remaining issues/concerns.....   Kevin

kevinf80_1d0ac6 · Answer

Since this issue appears to be resolved the topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

The fixes and advice in this thread are for this System only. Do not apply the instructions from this thread to your own System. Please start a new thread describing your issue and someone will be along to assist you.

Virus & Spyware

Regedit and Task Manager Disabled by Administrator

Was this post helpful?