Registry Editor Prompt Keeps Popping Up

[PiberiusWilde]

Windows registry editor just keeps popping up every time I booted my computer and even after that it kept popping up every 15 minutes or so. Upon further examination, I think the it changes the default boot option to safe mode.

 

 

EDIT:

WTF! it also locks the task manager. I can't open the task manager.

[Murasaki]

Uuuh thats odd. WHICH app is doing this?

[PiberiusWilde]

23 minutes ago, Murasaki said:

Uuuh thats odd. WHICH app is doing this?

I don't exactly know. I can't open the task manager.

 

Basically I turned my computer off 'cause I was going somewhere, but after I came back and booted it, this happened.

[demonix00]

Do a scan for malware as only something like that will lock out task manager (and the UAC notifications for registry editor is likely related to it).

 

If nothing is found, or scans can't be done then just back up any critical files and TFN the whole install and start from scratch as it the only way to be 100% sure that the system is free of any malware.

[Murasaki]

Considering what you described I would start with checking whats starting on boot with https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

This program can also disable startup entries so even a blocked Task Manager is no problem!

[PiberiusWilde]

19 minutes ago, Murasaki said:

Considering what you described I would start with checking whats starting on boot with https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns

This program can also disable startup entries so even a blocked Task Manager is no problem!

Okay, so what I supposed to look for here?

[Murasaki]

Anything that looks suspicious or out of place.

 

First make sure you run it as admin, then on the top make sure Options > Hide Microsoft Entries is checked and finally make sure Options > Scan options > Check VirusTotal.com is enabled. This should narrow down the search to files that arent signed by microsoft. Also whatever is marked as red in the VirusTotal column (wait up to a minute for the scan to complete) could be potentially bad but ofcourse false-positives can happen.

 

[PiberiusWilde]

22 minutes ago, Murasaki said:

Anything that looks suspicious or out of place.

 

First make sure you run it as admin, then on the top make sure Options > Hide Microsoft Entries is checked and finally make sure Options > Scan options > Check VirusTotal.com is enabled. This should narrow down the search to files that arent signed by microsoft. Also whatever is marked as red in the VirusTotal column (wait up to a minute for the scan to complete) could be potentially bad but ofcourse false-positives can happen.

 

I haven't done anything yet. Now once enter my log-in pin the desktop is just blank, nothing.

 

At this point I'm willing to do a reinstall but I just want to get some of the data off of it. I do have a backup of those the data, but it's not the most up-to-date version of them.

[Murasaki]

Oh. Sorry to hear that, guess it really was malware. Hope you can get all your stuff back.

Of course you can still use Autoruns for a quick glance from time to time, its much faster than a whole system scan considering the fact if nothing suspicious is at startup, theres virtually no chance of something bad like this happening.

[PiberiusWilde]

14 hours ago, Murasaki said:

Oh. Sorry to hear that, guess it really was malware. Hope you can get all your stuff back.

Of course you can still use Autoruns for a quick glance from time to time, its much faster than a whole system scan considering the fact if nothing suspicious is at startup, theres virtually no chance of something bad like this happening.

Update:

 

I've managed to recover all of the data using mint and I've reinstalled windows. Though before it went into black screen I've scanned with Kaspersky and it did not find anything.