Unable to Run TaskManager and Regedit in Win XP

Today i had a strange symptoms with my Win XP OS. The symptoms were as below.
1. Unable to Run TaskManager, MS Config, RegEdit.Whenever you run these programs, the window would flash for a second and disappear and prompt with a dialog box stating "Task Manager is disabled by the Administrator".
2. Accessing the drives was a issue. Overall the system was very slow.
3. unable to bring up local Computer Policy (GPEdit.msc).
4. Virus scanning was consuming lot of system memory.

Since the taskmanager was not showing up, it was very difficult to find out if there were any illegal process running.

The first thing was to bring up the task manager. I googled and found few website that gave satisfactory answers. One of them was "http://www.dougknox.com/xp/utils/xp_emerutils.htm".This website provides with a emergency utility called "xp_emegencyutil.exe". This utility copies correct version of MSConfig, Regedit, Taskmanger programs to a folder, which can then be copied to c:\windows\system32 directory. Best use when you dont have a copy of windows XP CD/DVD.


Then i tried running the following command from the Start > Run window.
"REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f"

Immediately the task manager was enabled but yet ran into same problem.I was sure there was either a virus / trojan that had disabled or renamed or infact deleted the regedit.exe and taskmanager.exe. So checked for the file in c:\windows\system32 and learnt that these files were renamed and missing. I copied these files back to c:\windows\system32\ and re-ran the following commands

  1. "REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f"

  2. "REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f"

Hoorray!!! I was able to get the TaskManager, MSConfig and RegEdit programs up and running.

On running taskmanager i saw 5-7 instance of "ssvichosst" program running. I checked in the net and found that this was a Dangeous Spyware which had infected Autorun.in and many important files.Quickly i went to startup's in the MSConfig utility and disabled this exe. My system is better and working fine..!!

About ssvichosst : Click here to know about ssvichosst.exe

Important URL's:
1. http://windowsxp.mvps.org/tweakuirest.htm
2. http://windowsxp.mvps.org/ToolsQuit.htm