Weird setting in Task Manager

[rrice2004]

I was working on a system that the desktop would not load when booted
up. ANd when you tried to run explorer from within the task manager, it
would open. I did a repair install and everything seemed fine.

I opened the task manager and under applications running is says, Quick
Launch. If i right click on it and select go to proccess, it takes me
to the EXPLORER.EXE proccess. If i end it, the desktop disappears,
until i bring it back up from with in Task Manager.

I can't get the system to do windows updates, it doesn't always connect
to the net. I have run the tcp/ip repair tool, ran a virus and spyware
scan - both came back clean. Was able to get it to run an on-line virus
scan via trend micro - came back clean. Used the proccess explorer from
sysinternals, nothing looks out of the ordinary there. I know NAv
security suite is giving me issues and i can't get it uninstalled. But
would this cause all of these issues?

I tried to uninstall nav via the add/remove tool. But it said it was
uninstalled already, and yet it still boots up with the system. If i
use FF as the browser, the system runs fine. But IE don't because it
seems it's related to this Quick Launch showing up as a running
application. I even have the quick launch tool bar turned off.

Any idea's?

Thanx!

 

[Wesley Vogel]

Quick Launch should NOT show up in Task Manager.

The legitimate Quick Launch is a folder not an executable.

I.e...
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet
Explorer\Quick Launch
C:\Documents and Settings\All Users\Application Data\Microsoft\Internet
Explorer\Quick Launch
C:\Documents and Settings\%username%\Application Data\Microsoft\Internet
Explorer\Quick Launch

Type: Spyware
Name: Quick Launch Shortcut
Version: 2.0
Publisher: ReadmeSoft
Risk Impact: High
File Names: Setup.exe Keystroke.exe mousehook.dll
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows
NT, Windows XP

Spyware.QuickLaunch
http://www.symantec.com/security_response/writeup.jsp?docid=2005-062015-1001-99

Other malware with this name also.

UPDATE your antivirus software and run a full system scan.

UPDATE whatever anti-spyware applications that you have and run a full
system scan with each one.

You might want to start in Safe Mode to run your antivirus and anti-spyware
software.

Running a full system antivirus scan or anti-spyware scan in Safe Mode can
be a good idea. Some viruses and other malware like to conceal themselves
in areas Windows protects while using them. Safe mode will prevent those
applications access and therefore unprotect the viruses or other malware
allowing for easier removal.

How to start Windows in Safe Mode Windows XP
http://www.bleepingcomputer.com/forums/index.php?showtutorial=61#winxo

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Guest]

I would 'unhide' all system files so they are scanned too. Another good
online scan site is www.ewido.net. Don't forget Spybot, either.

 

[Rock]

I was working on a system that the desktop would not load when booted
up. ANd when you tried to run explorer from within the task manager, it
would open. I did a repair install and everything seemed fine.

I opened the task manager and under applications running is says, Quick
Launch. If i right click on it and select go to proccess, it takes me
to the EXPLORER.EXE proccess. If i end it, the desktop disappears,
until i bring it back up from with in Task Manager.

I can't get the system to do windows updates, it doesn't always connect
to the net. I have run the tcp/ip repair tool, ran a virus and spyware
scan - both came back clean. Was able to get it to run an on-line virus
scan via trend micro - came back clean. Used the proccess explorer from
sysinternals, nothing looks out of the ordinary there. I know NAv
security suite is giving me issues and i can't get it uninstalled. But
would this cause all of these issues?

I tried to uninstall nav via the add/remove tool. But it said it was
uninstalled already, and yet it still boots up with the system. If i
use FF as the browser, the system runs fine. But IE don't because it
seems it's related to this Quick Launch showing up as a running
application. I even have the quick launch tool bar turned off.

Any idea's?

Thanx!

Do a thorough scan for malware in safe mode using a combination of
programs. See these links for info.

THE PARASITE FIGHT
Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.htm

Richard Harper’s Guide to Cleaning Pests
http://rgharper.mvps.org/cleanit.htm

http://www.elephantboycomputers.com/page2.html#Removing_Malware

PC Hell Spyware and Adware Removal Help
http://www.pchell.com/support/spyware.shtml

http://mvps.org/winhelp2002/unwanted.htm
http://www.spywareinfo.com

 

[rrice2004]

I checked all the links you have posted in response, i have searched
this sytem high and low for the files that should be here, registry
setting that should be here, and yet their not. I have run scans in
safe mode, normal mode, on-line and everything comes back clean.

And yet, Quick Launch still shows up as a running application, that
when the proccess is ended, it shuts the desktop off via EXPLORER.EXE.

There are no hidden folders or files as far as i can see. I have
everything unchecked. Even Winternals Rootkit finder found nothing.


I would really like to solve this issue, with out doing a wipe and
reload of XP. This way incase i should come across it again, i will
know what to do.

Thanx for the replies.

 

[Wesley Vogel]

I found this.

Quick Launch (QL) also shows up in the Applications list of Windows Task
Manager (WTM).

From David Candy...
This from a 98 thread in 2001. May throw some insight. I sent remesh the
whole thread.
I can't see it being helpful, but?

Procedure followed:
1. Hid the .scf files Show Desktop & View Channels. Restart... no change.
2. Unchecked Quick Launch toolbar on Taskbar. Restart... no change.
3. Renamed c:\WINDOWS\Application data\microsoft\Internet
Explorer\Quick Launch to Quick Launch Old, and added a new Quick
Launch folder. Restart... no change.
4. Did the above order, 1-3, in reverse order without restarts, checked CAD,
and, surprise, explorer displayed!
5. Restart. "explorer" is listed in the close program dialog box and NOT
Quick Launch!

Now anyone reading this thread is rewarded, and wiser.

Quick Launch in Task Manager
http://groups.google.com/group/micr...28238a77fb3898a9?tvc=1&hl=en#28238a77fb3898a9

Note: Windows XP may not have View Channels, or it may only exist in
C:\WINDOWS\system32 and that doesn't matter as long as it's not in Quick
Launch.

Show Desktop & View Channels do not show an extension (.scf a super hidden
file extension).

c:\WINDOWS\Application data\microsoft\Internet
Explorer\Quick Launch does not apply to XP.

These do...
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet
Explorer\Quick Launch
C:\Documents and Settings\All Users\Application Data\Microsoft\Internet
Explorer\Quick Launch
C:\Documents and Settings\%username%\Application Data\Microsoft\Internet
Explorer\Quick Launch

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Kelly]

How interesting!

Did you need to end explorer.exe first or was is not listed?
When you went to File/Run/explorer.exe, was QL listed before or after?
Was the show desktop missing as well? If so, how did you add it?
Were you using the Winlogo key + m while not having access to the desktop?
When you have nothing running at all, is it still listed?

Check for spyfalcon: http://www.spywaredb.com/remove-spyfalcon/
--

All the Best,
Kelly (MS-MVP/DTS&XP)

Taskbar Repair Tool
http://www.kellys-korner-xp.com/taskbarplus!.htm