# Task Manager has been disabled + SVCHSOT.exe



## Micheal John (Oct 24, 2007)

I am using Windows 2000 in my home and Windows XP in office. I have noticed that in both my machined Task Manager are disabled and it is displaying as "Task Manager has been disabled by administrator" and also "Registry Editing has been disabled by administrator".Some how by searching in net I was able to enable the task manager and registry in Windows XP machine, but couldn't do the same in my Windows 2000 machine.

After enabling the task manager in Windows Xp, I have opened it and noticed that SVCHSOT.exe is running in as many process. I have searched in net and I came to know that it is malware.

I can able to enable the registry and task manager thru' Group Policy >> System >> Ctrl+Alt+Del, but after restarting the machine once again the task manager and registry became disabled(not able to access) and I couldn't open some of my application.

How to remove this?

Now, both my home and office machine has been affected. In my home machine, I can do the formatting. Whether formatting will do the needful. However, I can't do the same in my office machine. Please give some solutions for this to delete it permantely

Some of the Efforts Taken to Clean Up:
===========================

Got from: http://www.daniweb.com/blogs/entry1746.html

Solution
~~~~~~
Enable Regedit, Task Manager, Regedit, Hidden Files, etc.

Enable Task Manager
-------
1. Start> run
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f
2. Start> run
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f

Enable Regedit
-----
1. Start> run
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f
2. Start> run
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f

Folder Option & Hidden Files
----------
1. Start> run
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /t REG_DWORD /d 0 /f
2. Start> run
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /t REG_DWORD /d 0 /f
3. Start> run
reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Hidden /t REG_DWORD /d 1 /f
4. Start>run
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL /v CheckedValue /t REG_DWORD /d 1 /f

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL /v DefaultValue /t REG_DWORD /d 2 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN /v CheckedValue /t REG_DWORD /d 2 /f

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN /v DefaultValue /t REG_DWORD /d 2 /f

Other steps
------

Delete the files
C:\WINDOWS\SCVHSOT.exe
C:\WINDOWS\hinhem.scr
C:\WINDOWS\system32\SCVHSOT.exe
C:\WINDOWS\system32\blastclnnn.exe
C:\WINDOWS\system32\autorun.ini
C:\Documents and Settings\All Users\Documents\SCVHSOT.exe

*******************************************

Got from Symantec Site:

[Version]
Signature="$Chicago$"
Provider=Symantec

[DefaultInstall]
AddReg=UnhookRegKey

[UnhookRegKey]
HKLM, Software\CLASSES\batfile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\comfile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\exefile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\piffile\shell\open\command,,,"""%1"" %*"
HKLM, Software\CLASSES\regfile\shell\open\command,,,"regedit.exe ""%1"""
HKLM, Software\CLASSES\scrfile\shell\open\command,,,"""%1"" %*"
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System,DisableRegistryTools,0x00000020,0

After this efforts, I can able to open the task manager, but if type regedit in run, it open and close in a fraction of a second.... and also task manager are also open and close in a fraction of a second... I couldn't able to see anything

Regards,
Micheal


----------

