It gives you a Disk Diagnostics box asking you about scanning the disk and selecting options. So far this looks legit. It will scan the computer and come back with errors. It will say Windows Detected a hard disk problem:
"A problem with the hard drive has been detected. It is strongly recommended that you download and install the following certified software to fix detected hard drive errors. Do you want to download recommended software?"
You can click ether yes or no. If you click no, it takes you back to the Disk Diagnostics box. Funny thing here is if you just keep hitting cancel it will still get to the ad-ware. If you click yes, it opens a program called Windows Safemode. It analyses your pc and then tells you that you have errors. It will fix them if you buy the software.
This is impressive because you can't alt+F4 out of it. You can't control+alt+delete to bring up task manager.
Your next step is to reboot and press F8 after the bios logo appears. The option you want to select is Safe Mode. The first time I booted in to this I was able to get into it and it worked fine. I had to reboot and when I came back in to safemode I was unable to use safe mode because the same issues were happening like booting normally into windows. You couldn't alt+F4 or control+alt+delete. So reboot and press F8 again. This time select Safe Mode with Command Prompt. You will only be given a command prompt. At the command prompt type explorer.exe. This will start explorer and give you control of windows. At this point you should be logged in as the user that has this installed on. Click start run and type regedit. Navigate to the following locations:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\]
"DisableTaskMgr"=dword:00000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"DisableCAD"=dword:00000000
Now I found mine to be located in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ and DisableTaskMg was set to 1.
Reboot and boot into windows. I was then able to hit control+alt+delete and kill the all the prompts that kept coming up. At this point click start new process and type explorer.exe. At this point you want to install all the tools you need to scan the PC.
Tools I used:
Malwarebytes Link
Microsoft Security Essentials Link
Spyware Doctor (Google Pack version) Link
Here is a pictures of the final one that actually what it was...
Fix selected and reboot. Things booted fine, but I still had that weird background. When trying to change the background the selection was greyed out. Here is how to fix that.
Click start-> Run -> type regedit -> Navigate to:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
There is a key called NoChangingWallPaper REG_DWORD Data 0x00000001
Change the key from 1 to 0.
Sources I used to help:
"Task Manager has been disabled by your administrator" error message
How to remove Check Disk (Uninstall Guide)
Remove HDD Defragmenter with Its Fake Safe Mode and Fake Errors
roadzy-
ReplyDeletei have the same issue....but i can't seem to get into safe mode with command prompt. i hit f8, select safe mode (i've tried all 3 safe mode options) and all that shows up is "multi(0)disk(0)rdisk(0)partition(1)\Windows...and then list my drivers...and freezes up....
at one point i was able to get into safemode....not anymore from so many reboots trying to fix this issue. any ideas on what i can do? thanks so much for any help you can offer...
I've had the same problem with other virus/spyware/ad-ware before and if it locks up at that point, only option is to reinstall windows. Everything should be accessible still that you can boot from a boot disk to save off any data you want to backup.
ReplyDeleteThanks a lot Roadzy, you have save my day!
ReplyDeleteThis solution has fixed similar problem in my laptop. I don't have Spyware Doctor but I used free version of Super Antispyware (from superantispyware.com) to clean my laptop.
For resolving weird background issue, I found registry at following location:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop
There is a key called NoChangingWallPaper REG_DWORD Data 0x00000001
Change the key from 1 to 0.
I hope it will help others.
Once again thanks a lot.
Regards
Chirag
Glad this post helped you! Spyware doctor is part of the google pack that is free. That is why I listed it. You can download it at http://www.google.com/pack
ReplyDeleteI added links so you know where to download those tools at. All tools are free. The spyware doctor that costs money has more signatures, but the free one works just fine.
ReplyDeleteI had the same problem, this is how i solved it.
ReplyDeleteWent to SuperAntispyware.com and downloaded the PORTABLE antispyware program and copied it to a USB memory stick.(I tried malwarebytes also). I then booted the infected machine into safemode with command prompt. I then change the prompt from C: to the USB drive letter, for me it was F.
then, "F: dir" to find the name of the program. (the program randomly generates a file name such as SAS_329824.com) I ran it and at the completion i was able to reboot and have access to my desktop and the web. I then uploaded AVG and ran it. That finished it off. I still had background issue but i just changed it to another background. I might fix it as the guy above did tonight.