0
I have now this very strange issue:
Suddenly I cannot start taskmgr.exe
and regedit.exe
.
I get the error message that it has been disabled by the Administrator but I am working with the Administrator account and I disabled it [Apart from that I don't even know how to do it without Google].
As you can see the Task-Manager is disabled
This is the error messages I receive when I start these programs by entering their program names [it is in German but it is clear what it means]:
The setting in the group policy gpedit.msc
for Task Manager is this [but I think it is for the clients which are working on the domain and does not apply for the SBS it self]:
I don't really remember what I should have done wrong:
- I was cleaning up the User folder [only the temp directories].
- I was restarting the Exchange Information Store service because I changed the maximal RAM from 12 to 10 GB.
- I installed the Patch cleaner but this cannot be a malware. I ran it on several other Servers without any problem!
Few minutes before it worked and suddenly it stopped.
Any idea how I messed up the SBS?
This doesn't just happen. This is an old school malware trick. You can use the
reg query
command from command prompt and checkHKEY_CURRENT_USER\Software\Microsoft\ Windows\Current Version\Policies\System
for the malicious policy. You can runREG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d /0 /f
to enable task manager. Your system is probably crawling with malware though. – Appleoddity – 2017-12-19T17:30:52.043You'll have to do it in "offline" mode then. You can boot a live Windows CD/USB drive and mount the registry and make the changes. This is the least of your problems though if your server is infected. – Appleoddity – 2017-12-19T17:37:56.827
Both "User Configuration -> Administrative Templates -> System -> CTRL+ALT+DEL options" and "Computer Configuration -> Administrative Templates -> System -> CTRL+ALT+DEL options". – Justin Krejcha – 2017-12-19T18:26:31.503