Jump to content

Process Explorer as default Task manager?


Recommended Posts


Ok, look like nobody want to reply to this post (maybe they are lost in shrinking office .... :D )

So here is how i do :

1 - Don't try replacing taskmgr.exe, there is a far better way to make process explorer your default task manager.

2 - tell your install script to copy process explorer to a path smaller than 400 caracteres (or maybe it's even less, i can't remember...) . Something like %systemdrive%\WINNT (Win2000) or %systemdrive%\WINDOWS(WinXp) is a good choice.

3 - then, it's time to apply that tricky trick of hell, the reg key who make all dreams come true :

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe]
"Debugger"="C:\\WINDOWS\\procexp.exe"

download the reg file :taskxp.reg

and tell your script to add it to the reg database. something like :

REGEDIT /S 'YourPath'\taskxp.reg

to make it short this key can be used to replace any executable by the one of your choice (ex : replacing notepad by notepad++ or what ever...)

Et Voila...

Bonus Part :

to make process explorer start with your favorite columms, and windows view, do like this :

- customize it the way you want

- export key with all subkeys of HKEY_CURRENT_USER\Software\Sysinternals\Process Explorer

- tell your script to import the key ( REGEDIT /S )

- Et revoila...

Edited by Diagg
Link to comment
Share on other sites

Yes, thats the way Mark made Process Explorer default task manager. I spoke with him about it, the problem is he revealed one security hole, that all (security guys) didnt wanted to speak of... Using non-debugger with image profiles :(

Link to comment
Share on other sites

  • 5 months later...

I was looking for such a trick to remove the crappy TaskManager! ;)

BTW, the taskxp.reg was full of garbage character, seems Suspicious!

EDIT

I tried it out, works like hell, but there was a message window when I first press Ctrl+Alt+Del telling me to download some kinda of Microsft Debugger tool! how can I disblae this very first message window?

EDIT 2

sorry the problem was from win32pad! it acting weird these days with reg and ini files :)

Edited by Wesmosis
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...