unable to access task manager and regedit

I am unable to access task manager and regedit. When i
hit ctl-alt-del and select task manager, it flickers and
then closes everytime. same with regedit. I feel I
probably have a virus. But, I have Mcafee activated and up
to date and have scanned using Mcafee, spybot, cwshredder
and adawar and also pandasoftware and trend micro. I am
using XP pro. Any help would be greatly appreciated. I
can access task manager in safe mode but obviously the
virus program is not loading in safe mode.

http://www.dougknox.com/xp/utils/xp_emerutils.htm
Creates usable copies of REGEDIT, MSCONFIG and Task Manager

You could be infected with one of these worms:

W32.Spybot.Worm
http://securityresponse.symantec.co...pybot.worm.html
W32.Klez.Worm
http://securityresponse.symantec.co...lez.gen@mm.html
W32.Yaha.Worm
http://securityresponse.symantec.co....yaha.e@mm.html

These viruses terminate Regedit.exe and taskmgr.exe
W32.HLLW.Kefy:
http://securityresponse.symantec.co....hllw.kefy.html
W32.HLLW.Cydog@mm:
http://securityresponse.symantec.co...w.cydog@mm.html
Backdoor.IRC.Yoink.A:
http://securityresponse.symantec.co...rc.yoink.a.html
Backdoor.Volac.dr:
http://securityresponse.symantec.co...r.volac.dr.html
W32.Kwbot.R.Worm:
http://www.symantec.com/avcenter/ve...bot.r.worm.html

These viruses delete the Regedit.exe, Regedt32.exe, Msconfig.exe, Taskmgr.exe
W32.Petch.B:
http://www.symantec.com/avcenter/ve...32.petch.b.html
W32.HLLW.Maax.B@mm:
http://securityresponse.symantec.co....maax.b@mm.html


Perhaps an online security/virus check
Symantec
http://security.norton.com/sscv6/de...id=ie&venid=sym
Trend Micro House Call:
http://housecall.trendmicro.com/
Panda ActiveScan;
http://www.pandasoftware.com/active...n_principal.htm
McAfee FreeScan:
http://us.mcafee.com/root/mfs/default.asp
Kaspersky Labs On-line Virus Checker:
http://www.kaspersky.com/remoteviruschk.html
BitDefender Online Scan:
http://www.bitdefender.com/scan/licence.php



"Joyce Hunnex" <anonymous@discussions.microsoft.com> wrote in message
news:2fda01c46162$74e747a0$7d02280a@phx.gbl...
> I am unable to access task manager and regedit. When i
> hit ctl-alt-del and select task manager, it flickers and
> then closes everytime. same with regedit. I feel I
> probably have a virus. But, I have Mcafee activated and up
> to date and have scanned using Mcafee, spybot, cwshredder
> and adawar and also pandasoftware and trend micro. I am
> using XP pro. Any help would be greatly appreciated. I
> can access task manager in safe mode but obviously the
> virus program is not loading in safe mode.

i have already run many virus checkers, all say I have no
virus. the dougknox.com utility errored out on me but I
copied the files and renamed them and can now run both
task manager and regedit. However, I have no idea what I
am looking for. I saw nothing suspicious in the task
manager. Any other suggestions. thanks for your help thus
far.
>-----Original Message-----
>http://www.dougknox.com/xp/utils/xp_emerutils.htm
>Creates usable copies of REGEDIT, MSCONFIG and Task
Manager
>
>You could be infected with one of these worms:
>
>W32.Spybot.Worm
>http://securityresponse.symantec.co...er/venc/data/w3
2.spybot.worm.html
>W32.Klez.Worm
>http://securityresponse.symantec.co...er/venc/data/w3
2.klez.gen@mm.html
>W32.Yaha.Worm
>http://securityresponse.symantec.co...er/venc/data/w3
2.yaha.e@mm.html
>
>These viruses terminate Regedit.exe and taskmgr.exe
>W32.HLLW.Kefy:
>http://securityresponse.symantec.co...er/venc/data/w3
2.hllw.kefy.html
>W32.HLLW.Cydog@mm:
>http://securityresponse.symantec.co...er/venc/data/w3
2.hllw.cydog@mm.html
>Backdoor.IRC.Yoink.A:
>http://securityresponse.symantec.co...er/venc/data/ba
ckdoor.irc.yoink.a.html
>Backdoor.Volac.dr:
>http://securityresponse.symantec.co...er/venc/data/ba
ckdoor.volac.dr.html
>W32.Kwbot.R.Worm:
>http://www.symantec.com/avcenter/ve...w32.kwbot.r.wor
m.html
>
>These viruses delete the Regedit.exe, Regedt32.exe,
Msconfig.exe, Taskmgr.exe
>W32.Petch.B:
>http://www.symantec.com/avcenter/ve...w32.petch.b.htm
l
>W32.HLLW.Maax.B@mm:
>http://securityresponse.symantec.co...er/venc/data/w3
2.hllw.maax.b@mm.html
>
>
>Perhaps an online security/virus check
>Symantec
>http://security.norton.com/sscv6/default.asp?
langid=ie&venid=sym
>Trend Micro House Call:
>http://housecall.trendmicro.com/
>Panda ActiveScan;
>http://www.pandasoftware.com/active.../activescan_pri
ncipal.htm
>McAfee FreeScan:
>http://us.mcafee.com/root/mfs/default.asp
>Kaspersky Labs On-line Virus Checker:
>http://www.kaspersky.com/remoteviruschk.html
>BitDefender Online Scan:
>http://www.bitdefender.com/scan/licence.php
>
>
>
>"Joyce Hunnex" <anonymous@discussions.microsoft.com>
wrote in message
>news:2fda01c46162$74e747a0$7d02280a@phx.gbl...
>> I am unable to access task manager and regedit. When i
>> hit ctl-alt-del and select task manager, it flickers and
>> then closes everytime. same with regedit. I feel I
>> probably have a virus. But, I have Mcafee activated and
up
>> to date and have scanned using Mcafee, spybot,
cwshredder
>> and adawar and also pandasoftware and trend micro. I
am
>> using XP pro. Any help would be greatly appreciated. I
>> can access task manager in safe mode but obviously the
>> virus program is not loading in safe mode.
>
>.
>

If renaming the files worked you ARE infected with something, most likely
one of the spybot worm variants.

Go to http://vil.nai.com/vil/stinger/ and download Stinger.


--
Larry Samuels MS-MVP (Windows-Shell/User)
Associate Expert
Expert Zone - www.microsoft.com/windowsxp/expertzone
Unofficial FAQ for Windows Server 2003 at
http://pelos.us/SERVER.htm

<anonymous@discussions.microsoft.com> wrote in message
news:256a701c4617a$b2036d90$a601280a@phx.gbl...
>i have already run many virus checkers, all say I have no
> virus. the dougknox.com utility errored out on me but I
> copied the files and renamed them and can now run both
> task manager and regedit. However, I have no idea what I
> am looking for. I saw nothing suspicious in the task
> manager. Any other suggestions. thanks for your help thus
> far.
>>-----Original Message-----
>>http://www.dougknox.com/xp/utils/xp_emerutils.htm
>>Creates usable copies of REGEDIT, MSCONFIG and Task
> Manager
>>
>>You could be infected with one of these worms:
>>
>>W32.Spybot.Worm
>>http://securityresponse.symantec.co...er/venc/data/w3
> 2.spybot.worm.html
>>W32.Klez.Worm
>>http://securityresponse.symantec.co...er/venc/data/w3
> 2.klez.gen@mm.html
>>W32.Yaha.Worm
>>http://securityresponse.symantec.co...er/venc/data/w3
> 2.yaha.e@mm.html
>>
>>These viruses terminate Regedit.exe and taskmgr.exe
>>W32.HLLW.Kefy:
>>http://securityresponse.symantec.co...er/venc/data/w3
> 2.hllw.kefy.html
>>W32.HLLW.Cydog@mm:
>>http://securityresponse.symantec.co...er/venc/data/w3
> 2.hllw.cydog@mm.html
>>Backdoor.IRC.Yoink.A:
>>http://securityresponse.symantec.co...er/venc/data/ba
> ckdoor.irc.yoink.a.html
>>Backdoor.Volac.dr:
>>http://securityresponse.symantec.co...er/venc/data/ba
> ckdoor.volac.dr.html
>>W32.Kwbot.R.Worm:
>>http://www.symantec.com/avcenter/ve...w32.kwbot.r.wor
> m.html
>>
>>These viruses delete the Regedit.exe, Regedt32.exe,
> Msconfig.exe, Taskmgr.exe
>>W32.Petch.B:
>>http://www.symantec.com/avcenter/ve...w32.petch.b.htm
> l
>>W32.HLLW.Maax.B@mm:
>>http://securityresponse.symantec.co...er/venc/data/w3
> 2.hllw.maax.b@mm.html
>>
>>
>>Perhaps an online security/virus check
>>Symantec
>>http://security.norton.com/sscv6/default.asp?
> langid=ie&venid=sym
>>Trend Micro House Call:
>>http://housecall.trendmicro.com/
>>Panda ActiveScan;
>>http://www.pandasoftware.com/active.../activescan_pri
> ncipal.htm
>>McAfee FreeScan:
>>http://us.mcafee.com/root/mfs/default.asp
>>Kaspersky Labs On-line Virus Checker:
>>http://www.kaspersky.com/remoteviruschk.html
>>BitDefender Online Scan:
>>http://www.bitdefender.com/scan/licence.php
>>
>>
>>
>>"Joyce Hunnex" <anonymous@discussions.microsoft.com>
> wrote in message
>>news:2fda01c46162$74e747a0$7d02280a@phx.gbl...
>>> I am unable to access task manager and regedit. When i
>>> hit ctl-alt-del and select task manager, it flickers and
>>> then closes everytime. same with regedit. I feel I
>>> probably have a virus. But, I have Mcafee activated and
> up
>>> to date and have scanned using Mcafee, spybot,
> cwshredder
>>> and adawar and also pandasoftware and trend micro. I
> am
>>> using XP pro. Any help would be greatly appreciated. I
>>> can access task manager in safe mode but obviously the
>>> virus program is not loading in safe mode.
>>
>>.
>>

Not really, perhaps there's something else you should be looking for.
Please note that some malware may kill the internet connection when it is
removed, the program on the link below will enable you to regain the internet
connection.
http://www.cexx.org/lspfix.htm

Spyware Programs links:-
www.lavasoftusa.com Ad-Aware
www.security.kolla.de Spybot



<anonymous@discussions.microsoft.com> wrote in message
news:256a701c4617a$b2036d90$a601280a@phx.gbl...

> i have already run many virus checkers, all say I have no
> virus. the dougknox.com utility errored out on me but I
> copied the files and renamed them and can now run both
> task manager and regedit. However, I have no idea what I
> am looking for. I saw nothing suspicious in the task
> manager. Any other suggestions. thanks for your help thus
> far.
> >-----

PS I finally discovered a program called netstatt.exe
which is a spy program that apparently is not detected by
spybot or adaware. I manually deleted it and deleted it
from my registry and that seems to have solved my problem.

Thanks.
>-----Original Message-----
>i have already run many virus checkers, all say I have no
>virus. the dougknox.com utility errored out on me but I
>copied the files and renamed them and can now run both
>task manager and regedit. However, I have no idea what I
>am looking for. I saw nothing suspicious in the task
>manager. Any other suggestions. thanks for your help
thus
>far.
>>-----Original Message-----
>>http://www.dougknox.com/xp/utils/xp_emerutils.htm
>>Creates usable copies of REGEDIT, MSCONFIG and Task
>Manager
>>
>>You could be infected with one of these worms:
>>
>>W32.Spybot.Worm
>>http://securityresponse.symantec.co...ter/venc/data/w
3
>2.spybot.worm.html
>>W32.Klez.Worm
>>http://securityresponse.symantec.co...ter/venc/data/w
3
>2.klez.gen@mm.html
>>W32.Yaha.Worm
>>http://securityresponse.symantec.co...ter/venc/data/w
3
>2.yaha.e@mm.html
>>
>>These viruses terminate Regedit.exe and taskmgr.exe
>>W32.HLLW.Kefy:
>>http://securityresponse.symantec.co...ter/venc/data/w
3
>2.hllw.kefy.html
>>W32.HLLW.Cydog@mm:
>>http://securityresponse.symantec.co...ter/venc/data/w
3
>2.hllw.cydog@mm.html
>>Backdoor.IRC.Yoink.A:
>>http://securityresponse.symantec.co...ter/venc/data/b
a
>ckdoor.irc.yoink.a.html
>>Backdoor.Volac.dr:
>>http://securityresponse.symantec.co...ter/venc/data/b
a
>ckdoor.volac.dr.html
>>W32.Kwbot.R.Worm:
>>http://www.symantec.com/avcenter/ve.../w32.kwbot.r.wo
r
>m.html
>>
>>These viruses delete the Regedit.exe, Regedt32.exe,
>Msconfig.exe, Taskmgr.exe
>>W32.Petch.B:
>>http://www.symantec.com/avcenter/ve.../w32.petch.b.ht
m
>l
>>W32.HLLW.Maax.B@mm:
>>http://securityresponse.symantec.co...ter/venc/data/w
3
>2.hllw.maax.b@mm.html
>>
>>
>>Perhaps an online security/virus check
>>Symantec
>>http://security.norton.com/sscv6/default.asp?
>langid=ie&venid=sym
>>Trend Micro House Call:
>>http://housecall.trendmicro.com/
>>Panda ActiveScan;
>>http://www.pandasoftware.com/active...m/activescan_pr
i
>ncipal.htm
>>McAfee FreeScan:
>>http://us.mcafee.com/root/mfs/default.asp
>>Kaspersky Labs On-line Virus Checker:
>>http://www.kaspersky.com/remoteviruschk.html
>>BitDefender Online Scan:
>>http://www.bitdefender.com/scan/licence.php
>>
>>
>>
>>"Joyce Hunnex" <anonymous@discussions.microsoft.com>
>wrote in message
>>news:2fda01c46162$74e747a0$7d02280a@phx.gbl...
>>> I am unable to access task manager and regedit. When i
>>> hit ctl-alt-del and select task manager, it flickers
and
>>> then closes everytime. same with regedit. I feel I
>>> probably have a virus. But, I have Mcafee activated
and
>up
>>> to date and have scanned using Mcafee, spybot,
>cwshredder
>>> and adawar and also pandasoftware and trend micro. I
>am
>>> using XP pro. Any help would be greatly appreciated.
I
>>> can access task manager in safe mode but obviously the
>>> virus program is not loading in safe mode.
>>
>>.
>>
>.
>

Can you provide the details of the error you received, so I can investigate the cause. It would help me make the utility work better.

--
Doug Knox, MS-MVP Windows Media Center\Windows Powered Smart Display
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

<anonymous@discussions.microsoft.com> wrote in message news:256a701c4617a$b2036d90$a601280a@phx.gbl...
>i have already run many virus checkers, all say I have no
> virus. the dougknox.com utility errored out on me but I
> copied the files and renamed them and can now run both
> task manager and regedit. However, I have no idea what I
> am looking for. I saw nothing suspicious in the task
> manager. Any other suggestions. thanks for your help thus
> far.
>>-----Original Message-----
>>http://www.dougknox.com/xp/utils/xp_emerutils.htm
>>Creates usable copies of REGEDIT, MSCONFIG and Task
> Manager
>>
>>You could be infected with one of these worms:
>>
>>W32.Spybot.Worm
>>http://securityresponse.symantec.co...er/venc/data/w3
> 2.spybot.worm.html
>>W32.Klez.Worm
>>http://securityresponse.symantec.co...er/venc/data/w3
> 2.klez.gen@mm.html
>>W32.Yaha.Worm
>>http://securityresponse.symantec.co...er/venc/data/w3
> 2.yaha.e@mm.html
>>
>>These viruses terminate Regedit.exe and taskmgr.exe
>>W32.HLLW.Kefy:
>>http://securityresponse.symantec.co...er/venc/data/w3
> 2.hllw.kefy.html
>>W32.HLLW.Cydog@mm:
>>http://securityresponse.symantec.co...er/venc/data/w3
> 2.hllw.cydog@mm.html
>>Backdoor.IRC.Yoink.A:
>>http://securityresponse.symantec.co...er/venc/data/ba
> ckdoor.irc.yoink.a.html
>>Backdoor.Volac.dr:
>>http://securityresponse.symantec.co...er/venc/data/ba
> ckdoor.volac.dr.html
>>W32.Kwbot.R.Worm:
>>http://www.symantec.com/avcenter/ve...w32.kwbot.r.wor
> m.html
>>
>>These viruses delete the Regedit.exe, Regedt32.exe,
> Msconfig.exe, Taskmgr.exe
>>W32.Petch.B:
>>http://www.symantec.com/avcenter/ve...w32.petch.b.htm
> l
>>W32.HLLW.Maax.B@mm:
>>http://securityresponse.symantec.co...er/venc/data/w3
> 2.hllw.maax.b@mm.html
>>
>>
>>Perhaps an online security/virus check
>>Symantec
>>http://security.norton.com/sscv6/default.asp?
> langid=ie&venid=sym
>>Trend Micro House Call:
>>http://housecall.trendmicro.com/
>>Panda ActiveScan;
>>http://www.pandasoftware.com/active.../activescan_pri
> ncipal.htm
>>McAfee FreeScan:
>>http://us.mcafee.com/root/mfs/default.asp
>>Kaspersky Labs On-line Virus Checker:
>>http://www.kaspersky.com/remoteviruschk.html
>>BitDefender Online Scan:
>>http://www.bitdefender.com/scan/licence.php
>>
>>
>>
>>"Joyce Hunnex" <anonymous@discussions.microsoft.com>
> wrote in message
>>news:2fda01c46162$74e747a0$7d02280a@phx.gbl...
>>> I am unable to access task manager and regedit. When i
>>> hit ctl-alt-del and select task manager, it flickers and
>>> then closes everytime. same with regedit. I feel I
>>> probably have a virus. But, I have Mcafee activated and
> up
>>> to date and have scanned using Mcafee, spybot,
> cwshredder
>>> and adawar and also pandasoftware and trend micro. I
> am
>>> using XP pro. Any help would be greatly appreciated. I
>>> can access task manager in safe mode but obviously the
>>> virus program is not loading in safe mode.
>>
>>.
>>