Regedit Tutorial Disabling MSN,TaskMgr,CMD ++

I've posted this under keylogger section and i thought i'll repost it here, hope it doesn't bother you guys =)

- Original link : http://www.hackforums.net/showthread.php?tid=63896

Below are some of the lists of ways to manipulate regedit that i just compiled from searches online... its not neat im sorry bout that.

List
________________________________________________________________________________​​___________________

1.) Disabling MSN
2.) Disabling task manager
3.) How to run a file at startup
4.) How to delete a key
5.) How to enable Registry Editing again if it has been disabled by admin
6.) How to hide Control Panel Applets
7.) How to display legal notice on startup
8.) How to enter administrator login automatically in XP(untested)
9.) How to shutdown immediately after startup
10.) Disabling CMD
11.) Change/ Add Restrictions and Features
12.) Removing Open, Explore & Find from Start Button
13.) Disabling My Computer
14.) Protection on system files
________________________________________________________________________________​​___________________

1.) Disabling MSN
==================
I’m a Trillian user so I have no use for the MSN Messenger program that runs by default in Windows XP. Here’s how to stop it from starting, saving memory, and more importantly to me clearing my system tray.

# Start -> Run -> regedit
# Navigate to HKEY_LOCAL_MACHINE -> Software -> Policies -> Microsoft
# Create a new key by selecting Edit -> New -> Key, starting from the top bar, and naming it Messenger
# Below Messenger, create another key named Client
# Now you’re done making keys, almost there… Next we have to make a DWORD by right clicking on the newly created Client -> New -> DWORD, naming it PreventRun
# Finally, double click on PreventRun and Value data entry of 0 to 1.

Close up regedit and after you restart, MSN Messenger should be out of your life.


http://www.buzolich.com/techtips/disable-msn-messenger

2.) Disabling task manager
===========================
Goto HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System

Note: if there is no System, create it under Policies.
Next, Add a DWORD 32bit value.
Value name: DisableTaskMgr
Value data: 1(disable) 0(enable)

Code in cmd:
reg add HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM /v DisableTaskMgr /t reg_dword /d 1 /f
Note: requires administrator rights


3.) How to run a file at startup
=================================
Goto HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Next, add a String value.
Value name: Up to you(doesn't affect much)
Value data: File location.

Purpose: Startup folder is not needed.
Code in cmd:
reg add HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /v "value name" /t reg_sz /d "value data" /f


4.) How to delete a key
========================
Code in cmd:
reg delete path\ /f
Note: if no value is selected, it will delete the key itself.


5.) How to enable Registry Editing again if it has been disabled by admin
==========================================================================
Website i got this from: http://wiki.answers.com/Q/How_do_you_ena...inistrator

i. HaXxOr Simple

The way to get into registry editing is simple. Open your start menu click Run and paste in the folowing command:
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f

Submited By HaXxOr.

ii. http://www.dougknox.com/security/scripts...gtools.htm

[code]
'Enable/Disable Registry Editing tools
'© Doug Knox - rev 12/06/99

Option Explicit

'Declare variables
Dim WSHShell, n, MyBox, p, t, mustboot, errnum, vers
Dim enab, disab, jobfunc, itemtype

Set WSHShell = WScript.CreateObject("WScript.Shell")
p = "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\"
p = p & "DisableRegistryTools"
itemtype = "REG_DWORD"
mustboot = "Log off and back on, or restart your pc to" & vbCR & "effect the changes"
enab = "ENABLED"
disab = "DISABLED"
jobfunc = "Registry Editing Tools are now "

'This section tries to read the registry key value. If not present an
'error is generated. Normal error return should be 0 if value is
'present
t = "Confirmation"
Err.Clear
On Error Resume Next
n = WSHShell.RegRead (p)
On Error Goto 0
errnum = Err.Number

if errnum <> 0 then
'Create the registry key value for DisableRegistryTools with value 0
WSHShell.RegWrite p, 0, itemtype
End If

'If the key is present, or was created, it is toggled
'Confirmations can be disabled by commenting out
'the two MyBox lines below

If n = 0 Then
n = 1
WSHShell.RegWrite p, n, itemtype
Mybox = MsgBox(jobfunc & disab & vbCR & mustboot, 4096, t)
ElseIf n = 1 then
n = 0
WSHShell.RegWrite p, n, itemtype
Mybox = MsgBox(jobfunc & enab & vbCR & mustboot, 4096, t)
End If
[end of code, save as .vbs]


6.) How to hide Control Panel Applets
======================================
Go to HKEY_CURRENT_USER\Control Panel\don't load

Add name.cpl as Value name,
Add "no" as Value data for disable,
Type Reg_sz

code in cmd:
reg add hkcu\\"control panel\don't load" /v name.cpl /d "no"

Bottom are the lists-

access.cpl - Accessibility Applet
appwiz.cpl - Add/Remove Programs Applet
console.cpl - Console Applet
timedate.cpl - Date and Time Applet
desk.cpl - Display Applet
fax.cpl - Fax Applet
hdwwiz.cpl - Hardware Wizard Applet
irprops.cpl - Infrared Port Applet
intl.cpl - International and Regional Applet
inetcpl.cpl - Internet Settings Applet
joy.cpl - Joystick Applet
liccpa.cpl - Licensing Applet
main.cpl - Mouse and Keyboard Applet
mlcfg32.cpl - Mail Applet
mmsys.cpl - Sound and Multimedia Applet
modem.cpl - Modem and Phone Applet
ncpa.cpl - Network and connectivity Applet
netcpl.cpl - Network and Dial-up Connectivity Applet
nwc.cpl - Netware Client Applet
odbccp32.cpl - ODBC Applet
devapps.cpl - PC Card Applet
ports.cpl - Ports Applet
powercfg.cpl - Power Management Applet
sticpl.cpl - Scanner and Camera Applet
srvmgr.cpl - Server Manager Applet
sapi.cpl - Speech Properties Applet
sysdm.cpl - System Applet
telephon.cpl - Telephony Applet
tweakui.cpl - TweakUI Applet
nusrmgr.cpl - User Manager Applet
wspcpl32.cpl - WSP Client Applet
quicktime.cpl - QuickTime Applet
S32LUCP1.cpl - Norton Live Update Applet
cpqmgmt.cpl - Compaq Insight Agents Applet

End of lists. LINK: http://www.pctools.com/guides/registry/detail/522/


7.) Display legal notice on startup
====================================
Display legal notice on startup:
Wanna tell your friends about the do's and dont's in your computer when they login in your absence. Well you can do it pretty easily by displaying a legal notice at system start up.
REGEDIT
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\policies\system]
"legalnoticecaption"="enter your notice caption"
"legalnoticetext"="enter your legal notice text"

LINK: http://www.friendster.com/group-discussi...5&start=0&


8.) How to enter administrator login automatically in XP
=========================================================
Well here's the trick which you can use to prove that Windows XP is not at all secure as multi-user operating system. Hacking the system registry from any account having access to system registry puts you in to the administrator account.
REGEDIT 4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"AutoAdminLogon"="1"


9.) How to shutdown immediately after startup
==============================================
Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

String-
Value name: any
Value data: "%windir%\\SYSTEM32\\SHUTDOWN.EXE -p -f"


10.) Disabling CMD
===================
Go to HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM

Dword
Value name: DisableCMD
Value data: 1

Code in cmd:
reg add HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM /v DisableCMD /t reg_Dword /d 1 /f
Note: requires admin rights


11.) Change/ Add Restrictions and Features
===========================================
Go to HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER

-Dword
value name:
NoDeletePrinter (Disables Deletion of Printers) untested
NoAddPrinter (Disables Addition of Printers) untested
NoClose (Disables shutdown)
NoDesktop (Hides all icons on the desktop as well as mouse clicks)
NoRun (Disables Run Command)
NoSetFolders (Removes Folders from Settings on Start Menu) untested
NoSetTaskbar (Removes Taskbar from Settings on Start Menu) untested
NoFind (Removes the Find Command) untested
NoDrives (Hides Drives in My Computers)
-value type: 3FFFFFF
NoNetHood (Hides the Network Neighborhood) untested
NoSaveSettings (Don't save settings on exit) untested
DisableRegistryTools (Disable Registry Editting Tools) untested, should be inside System instead of Explorer
NoRecentDocsMenu (Hides the Documents shortcut at the Start button) untested
NoRecentDocsHistory (Clears history of Documents) untested
NoFileMenu (Hides the Files Menu in Explorer) untested
NoActiveDesktop (No active desktop) untested
NoActiveDesktopChanges (No changes allowed) untested
NoInternetIcon (No internet Explorer Icon on the Desktop) untested
NoFavouritesMenu (Hides the favourites menu) untested
NoChangeStartMenu (Disables changes to the Start Menu) untested
NoFolderOptions (Hides the Folder Options in the explorer) untested
ClearRecentDocsOnExit (Empty the recent Docs folder on reboot) untested
NoLogOff (Hides the Log Off in start menu)

ShowInfoTip
NoTrayContextMenu
NoStartMenuSubFolders
NoWindowsUpdate
NoViewContextMenu
EnforceShellExtensionSecurity
LinkResolveIgnoreLinkInfo
NoDriveAutoRun
NoStartBanner
NoSetActiveDesktop
EditLevel
NoNetConnectDisconnect
RestrictRun (Disables all exe programs except those listen in the RestrictRun) untested

Go to HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM

-Dword
NoDispCPL (Disable Display Control Panel) can't work
NoDispBackgroundPage (Hide Background Page) untested
NoDispScrSavPage (Hide Screen Saver Page) untested
NoDispAppearancePage (Hide Appearance Page) untested
NoDispSettingPage (Hide Settings Page) untested
NoSecCPL (Disable Password Control Panel) untested
NoPwdPage (Hide Password Change Page) untested
NoAdminPage (Hide Remote Administration Page) untested
NoProfilePage (Hide User PRofiles Page) untested
NoDevMgrPage (Hides Device Manager Page) untested
NoConfigPage (Hides Hardware Profiles Page) untested
NoFileSysPage (Hide File System Button) untested
NoVirtMemPage (Hide Virtual Memory Button) untested

Go to HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\NETWORK

-Dword
NoNetSetup (Disable the Network Control Panel) untested
NoNetSetupIDPage (Hide Identification Page) untested
NoNetSetupSecurityPage (Hide Access Control Page) untested
NoFileSharingControl (Disable File Sharing Controls) untested
NoPrintSharing (Disable Print Sharing Controls) untested

Go to HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\WINOLDAPP

-Dword
Disabled (Disable MS DOS PROMPT) untested
NoRealMode (Disables Single Mode MS DOS) untested

LINK: http://www.scribd.com/doc/5205171/Regist...and-Tricks


12.) Removing Open, Explore & Find from Start Button
=====================================================
-Go to HKEY_CLASSES_ROOT\Directory\Shell\Find
Delete Find
-Go to HKEY_CLASSES_ROOT\Folder\Shell\Explore
Delete Explore
-Go to HKEY_CLASSES_ROOT\Folder\Shell\Open
Delete Open

Note: If you remove open, you cannot open any folders.


13.) Disabling My Computer
===========================
Find for {20D04FE0-3AEA-1069-A2D8-08002B30309D}
Delete entire section.
Note: Just delete the upper key since the subkeys are so many... untested


14.) Protection on system files
================================
Go to HKLM\System\CurrentControlSet\Control\SessionManager
Create a Dword value and name it "Protection Mode"
Set the value to 1

---