Microsoft Windows

Today, one of the Windows XP machines in the network got compromised by a fake antivirus. I was able to get rid of this malware, which hid itself under C:Documents and SettingsAll UsersApplication DataMicrosoft, however I wasn't able to run taskmgr.exe. I googled for solutions on how to enable taskmgr.exe, some said that it was in the Group Policy. However, I couldn't find the entry.

Apparently, this fake antivirus also created a whole bunch of registry entries under [HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Image File Execution Options].

To fix it, first delete the whole key and then merge the registry entry in this zipped file. Please note that this has only been tested with Windows XP 32-bit. Windows Vista and Windows 7 users, please don't use the registry file to fix your system.