Question

任务管理器被禁

在网上找了一个防病毒的注册表.导入后,任务管理器被禁.研究半天,硬是没看到哪项是跟禁用任务管理器有关的.求大侠指点小弟.
以下是原文(太长了发到回答中去):

Answer 1

任务管理器是taskmgr.exe。把这个去掉
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{070fc60a-c6c4-43af-90a6-560b7e402e86}]
"LastModified"=hex(b):56,87,c9,1e,c2,80,c8,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemData"=".exe"

Answer 2

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{27d1571f-8428-4d31-b6ce-414c403382f9}]
"LastModified"=hex(b):de,58,38,38,a5,f3,c7,01
"Description"="机器狗2007-09-10"
"FriendlyName"="机器狗"
"SaferFlags"=dword:00000000
"ItemSize"=hex(b):74,2d,00,00,00,00,00,00
"ItemData"=hex:e0,13,88,a7,5b,67,0d,9c,be,54,03,8e,ec,8f,5e,cb
"HashAlg"=dword:00008003

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}]
"Description"="Stop the download of this file"
"FriendlyName"="Mdac11.cab"
"SaferFlags"=dword:00000000
"HashAlg"=dword:00008003
"ItemData"=hex:5e,ab,30,4f,95,7a,49,89,6a,00,6c,1c,31,15,40,15
"LastModified"=hex(b):85,c4,34,dc,19,a2,c2,01
"ItemSize"=hex(b):0b,03,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}]
"Description"="Stop the download of this file"
"FriendlyName"="mdac20.cab"
"SaferFlags"=dword:00000000
"HashAlg"=dword:00008003
"ItemData"=hex:67,b0,d4,8b,34,3a,3f,d3,bc,e9,dc,64,67,04,f3,94
"LastModified"=hex(b):03,8a,39,dc,19,a2,c2,01
"ItemSize"=hex(b):05,02,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}]
"Description"="Stop the download of this file"
"FriendlyName"="mdac20_a.cab"
"SaferFlags"=dword:00000000
"HashAlg"=dword:00008003
"ItemData"=hex:32,78,02,dc,fe,f8,c8,93,dc,8a,b0,06,dd,84,7d,1d
"LastModified"=hex(b):be,77,45,dc,19,a2,c2,01
"ItemSize"=hex(b):96,03,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}]
"Description"="Stop the download of this file"
"FriendlyName"="_msadc10.cab"
"SaferFlags"=dword:00000000
"HashAlg"=dword:00008003
"ItemData"=hex:bd,9a,2a,db,42,eb,d8,56,0e,25,0e,4d,f8,16,2f,67
"LastModified"=hex(b):81,4f,3e,dc,19,a2,c2,01
"ItemSize"=hex(b):e5,00,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}]
"Description"="Stop the download of this file"
"FriendlyName"="msadc11.cab"
"SaferFlags"=dword:00000000
"HashAlg"=dword:00008003
"ItemData"=hex:38,6b,08,5f,84,ec,f6,69,d3,6b,95,6a,22,c0,1e,80
"LastModified"=hex(b):40,b2,40,dc,19,a2,c2,01
"ItemSize"=hex(b):72,01,00,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{0041323f-9ca4-41ea-b25b-a7afbb4313e7}]
"LastModified"=hex(b):0a,bb,7f,ab,c2,b5,c7,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemData"="system.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{021dea67-c08d-4bc4-8bd8-e2fd48a78493}]
"LastModified"=hex(b):cc,dd,0a,d4,a2,ec,c7,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemData"=hex(2):25,00,77,00,69,00,6e,00,64,00,69,00,72,00,25,00,5c,00,53,00,\
79,00,73,00,74,00,65,00,6d,00,5c,00,2a,00,2e,00,2a,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{02993634-bdbc-4c36-92d3-314afb623c54}]
"LastModified"=hex(b):d8,15,ec,58,3c,3a,c8,01
"Description"="**禁止根目录下运行vbe或vbs程序,主要是防止u盘上的"
"SaferFlags"=dword:00000000
"ItemData"="?:\\*.vb?"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{0308baa1-b774-4162-a7f1-10456a5c2d37}]
"LastModified"=hex(b):52,9a,11,26,61,33,c8,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemData"=hex(2):25,00,54,00,4d,00,50,00,25,00,5c,00,2a,00,2e,00,65,00,78,00,\
65,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{06109a1d-a8e7-492f-a523-9bdd8952ac6c}]
"LastModified"=hex(b):54,b4,0b,fd,3f,3a,c8,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemData"="C:\\WINDOWS\\downloaded program files\\hgstartcn18.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{070fc60a-c6c4-43af-90a6-560b7e402e86}]
"LastModified"=hex(b):56,87,c9,1e,c2,80,c8,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemData"=".exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{076bc921-72ce-462c-81c9-fdb94be26169}]
"LastModified"=hex(b):f6,a2,13,a4,61,33,c8,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemData"=hex(2):25,00,55,00,53,00,45,00,52,00,50,00,52,00,4f,00,46,00,49,00,\
4c,00,45,00,25,00,5c,00,4c,00,6f,00,63,00,61,00,6c,00,20,00,53,00,65,00,74,\
00,74,00,69,00,6e,00,67,00,73,00,5c,00,54,00,65,00,6d,00,70,00,6f,00,72,00,\
61,00,72,00,79,00,20,00,49,00,6e,00,74,00,65,00,72,00,6e,00,65,00,74,00,20,\
00,46,00,69,00,6c,00,65,00,73,00,5c,00,2a,00,2e,00,2a,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{082a8a60-432f-42ef-b51c-76a7fac47789}]
"LastModified"=hex(b):56,86,99,3d,88,b8,c8,01
"Description"="5月18病毒"
"SaferFlags"=dword:00000000
"ItemData"="Domino.EXE"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{0b414112-906b-46d0-961f-070fad2afe5f}]
"LastModified"=hex(b):cc,cb,a3,25,d4,33,c8,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemData"="rund??32.*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{0b69f78d-7b8a-4461-8a6f-af4606cf8c6a}]
"LastModified"=hex(b):8e,ba,a2,42,3c,3a,c8,01
"Description"="**禁止在C盘中新建CMD文件(防范某些蠕虫) C:\\\\**\\\\*.cmd 防止在c根目录下建立cmd"
"SaferFlags"=dword:00000000
"ItemData"="?:\\*.cmd"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{0c0c1672-84db-42b2-acd0-7659838b32ad}]
"LastModified"=hex(b):f4,fa,b4,8a,d4,33,c8,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemData"="svch*st.*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{0dc62c5b-5ef4-479f-8ae2-b902ec628ab9}]
"LastModified"=hex(b):c6,18,ab,4e,3c,3a,c8,01
"Description"="**禁止在C盘中新建,修改任何DOT文件(防范宏病毒) C:\\\\**\\\\*.dot 这个只是防止c盘根目录下"
"SaferFlags"=dword:00000000
"ItemData"="?:\\*.dot"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{11197a97-a710-4560-8455-bbdbb5e94232}]
"LastModified"=hex(b):e8,82,dc,dd,5f,33,c8,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemData"="*.d*.*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{1184a2db-aca6-42f3-ab96-227088f73351}]
"LastModified"=hex(b):9a,b0,80,3c,89,b8,c8,01
"Description"="5月17图片病毒 机器狗"
"SaferFlags"=dword:00000000
"ItemData"="4.jpg"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{13f55920-02c2-4807-9303-f68d09e461b7}]
"LastModified"=hex(b):e4,11,9d,22,61,33,c8,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemData"=hex(2):25,00,54,00,4d,00,50,00,25,00,5c,00,2a,00,2e,00,63,00,3f,00,\
3f,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{16f45656-3c6c-438b-ab01-8e9b9777fe54}]
"LastModified"=hex(b):82,08,ed,20,60,33,c8,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemData"="*.s*.*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{16f509d3-647b-4968-927f-824aac49bab5}]
"LastModified"=hex(b):18,9f,d6,3e,88,b8,c8,01
"Description"="5月18病毒"
"SaferFlags"=dword:00000000
"ItemData"="fmsiocps.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{1a1b6780-c155-4726-9c3b-8171e1431cef}]
"LastModified"=hex(b):ac,de,45,73,d3,33,c8,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemData"="exp??rer*.*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{1a793296-31ec-4cef-a2cd-4589ac7d47e5}]
"LastModified"=hex(b):2c,bd,c6,43,89,b8,c8,01
"Description"="5月17图片病毒 机器狗"
"SaferFlags"=dword:00000000
"ItemData"="9.jpg"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{1bfcab39-3015-4dff-9238-e684f55ce6d8}]
"LastModified"=hex(b):50,96,9b,8d,b3,8b,c8,01
"Description"="3月20日毒"
"SaferFlags"=dword:00000000
"ItemData"="test.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{1f8082e2-9f12-4e0c-91a7-7e2c0cde51b1}]
"LastModified"=hex(b):e8,14,31,6b,44,3a,c8,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemData"="e:\\Program Files\\Real\\RealPlayer\\RealPlay.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{1fd8f9b4-cc8e-40d9-ae02-04f750b34ddf}]
"LastModified"=hex(b):9e,7a,13,75,3c,3a,c8,01
"Description"="禁止从备份文件夹执行文件"
"SaferFlags"=dword:00000000
"ItemData"="?:\\System Volume Information\\**\\*.*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{210efc0c-211f-4b31-85ad-240c49f06490}]
"LastModified"=hex(b):aa,02,39,6b,3c,3a,c8,01
"Description"="路径,不允许的,禁止从回收站执行文件"
"SaferFlags"=dword:00000000
"ItemData"="?:\\Recycled\\*.*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{247362b5-5758-4f58-8bfb-3af363d7ca31}]
"LastModified"=hex(b):46,bc,fb,e8,ef,b4,c7,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemData"="TIMPIatf0rm.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{248ca26f-5ada-423f-962c-cb39d143ff70}]
"LastModified"=hex(b):b4,41,3a,78,d3,33,c8,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemData"="csrss*.*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{289b7908-84f9-454f-8371-605644e8256b}]
"LastModified"=hex(b):84,2c,2b,d6,5f,33,c8,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemData"="*.b*.*"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{29e37cf9-fc62-497b-80f8-c827d8e88c6c}]
"LastModified"=hex(b):16,0c,b3,cf,73,e6,c7,01
"Description"=""
"SaferFlags"=dword:00000000
"ItemData"="?:\\Recycle?\\*\\*\\*.*"

Answer 3

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
"DisableTaskmgr"=dword:00000000