HELP - Corrupted WindowsTaskManager

[Ted Rodrick]

I'm running WindowsXP-MediaCenterEdition on a 2.8Ghz Pentium4.

It appears that I've picked up a particularly NASTY piece of
ADWARE (may be Spyware as well). It spontaneously opens IE6
with (seemingly random) popup Ads; it apparently is in memory
after a reboot or powerup. Startup->Startup folder is empty.
I have an application (Startup Copilot) ... that provides a
neat interface to control startup apps; with that I've reduced
the official startup apps to an absolutely minimal set (in
consultation with an HP technician). Whatever ADWARE app
that's resident in memory is unaffected (still there after
every boot/reboot). FWIW, I've run the latest versions of
Ad-Aware and Spybot, which both indicate all problems removed.

There is a related anomaly (or a most amazing coincidence).
Windows Task Manager (CNTRL-ALT-DEL) no longer functions
properly. When I simultaneously press those keys, I get
a different dialog box (no Tabs), which purports to show
*NO* tasks running. There is also *NO* close-box for the
modified dialog box; with it open there is a NEW icon in
my System Tray (looks like a green grid) ... with the cursor
over that a popup purports to display CPU usage. If I right-
click that mystery SysTray icon, I can close the Task-Manager-
Replacement dialog box.

I have prospected both the Control Panel "Ad/Remove" list and
the Start->Programs list, and removed all programs I don't
recognize. Still no joy ... the pernicious ADWARE app is still
present. I've also run a full system scan using Norton A/V 2003
(up-to-date virus signatures); no virus present. Geez!!! I'm
about out of ideas; can anyone be of assistance?

If nobody is able to "zero in" on the exact infection (and how
to remove it), perhaps someone could outline the steps to
restore Windows Task Manager to original condition? FWIW,
the computer came with an OEM-version of WindowsXP, It's
(supposedly) mirrored on a partition of the hard drive, but
I'm not sure the filenames are preserved (files may also be
compressed); the HP support person was pretty *vague* when
I asked him those questions. I know ... dumb of me to not
buy a system including Microsoft operating system on discs,
but ... water under that particular bridge. ;->

TIA,

Ted Rodrick

 

[Wesley Vogel]

To get the Task Manager tabs back double click anywhere on the border.
It's a useless XP "feature", not a virus or scumware.

The icon in the tray is the Task Manager.

 

[Ted Rodrick]

Hi Wesley,

To get the Task Manager tabs back double click anywhere on the border.
It's a useless XP "feature", not a virus or scumware.

The icon in the tray is the Task Manager.

Hmmm ... learn something new every day. Without the TABS I
had no way to examine RUNNING PROCESSES; now, maybe I can
isolate the running "process" that is serving up the unsolicited
"popup ads." At least that is something for me to *try* to do.

Of course, I wonder how Task Manager spontaneously (at least as
far as I am concerned) changed from one user interace to the other
(No Tabs) one. Also ... how the hell the Malware/Adware applet
got installed on my system without my permission (my IE6 security
settings are at HIGH, and should be "prompted" for approval prior
to any software installation download). Oh well ... I may never
know the answers to those questions. >sigh?

Thanks for helping with the Task Manager issue,

Ted Rodrick

 

[Wesley Vogel]

Ted,

I have no idea how Task Manager changed, but it's a common problem.

Scumware can get installed bundled with other software. Don't download any
untrustworthy software.

Until you rid yourself of scumware completely it can add itself back to
start locations in the registry even if you remove those references.

Scumware can get installed as a driveby.

Do you have a firewall running?

HOW TO: Enable or Disable Internet Connection Firewall in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;EN-US;283673

First.
Start | Settings | Control Panel | Internet Options | Advanced tab |
Make sure both of these are NOT checked.

 Enable Install On Demand (Internet Explorer)
[[Specifies to automatically download and install Internet Explorer
components if a Web page needs them in order to display the page properly or
perform a particular task.]]
 Enable Install On Demand (Other)
[[Specifies to automatically download and install Web components if a Web
page needs them in order to display the page properly or perform a
particular task.]]

Apply | OK
=================================

Second. If you need a scan right now.

Follow the instructions!
THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.php

======================
Third.
It is known as Scumware. Visit these sites. 1, 2, 3 and 4 are really good.
Download, install, run, update and run again; one or all. They are all
good, FREE utilities.

1) Spybot S & D
http://www.safer-networking.org/index.php?lang=en&page=download

2) SpywareBlaster
[[SpywareBlaster doesn't scan and clean for spyware - it prevents it from
ever being installed.
The most important step you can take is to secure your system. And
SpywareBlaster is the most powerful protection program available.]]
http://www.javacoolsoftware.com/spywareblaster.html

3) HijackThis (some other stuff that may be of interest also)
http://www.spywareinfo.com/~merijn/downloads.html

4) CWShredder direct download:
http://216.180.233.163/~merijn/files/CWShredder.exe

5) Bazooka Adware and Spyware Scanner v1.13
http://www.kephyr.com/spywarescanner/index.html?source=appvisit

6) ToolbarCop
http://www.mvps.org/sramesh2k/toolbarcop.htm

7) AdAware
http://www.lavasoft.de/support/download/
===============

Additional information & instructions.
A wealth of information here, boys and girls.

THE PARASITE FIGHT QUICK FIX PROTOCOL
http://aumha.org/a/quickfix.htm

THE PARASITE FIGHT
Finding, Removing & Protecting Yourself From Scumware
http://aumha.org/a/parasite.htm

Bugs, Glitches & Stuffups
http://www.mvps.org/inetexplorer/Darnit.htm

Dealing with Unwanted Spyware and Parasites
http://mvps.org/winhelp2002/unwanted.htm

Unexplained computer behavior may be caused by deceptive software
http://support.microsoft.com/default.aspx?scid=kb;EN-US;827315#appliesto

Spyware and Deceptive Software
http://www.microsoft.com/mscorp/twc/privacy/spyware.mspx?gssnb=1

What you should know about spyware
http://www.microsoft.com/security/articles/spyware.asp

 

[Ted Rodrick]

Hi Wesley,

Ted,

............................... Quotes Deleted to save Bandwidth
..................

Wow ... a cornucopia of data and useful links; that will keep
me busy for a while.

I dimly recalled enabling the WindowsXP Firewall shortly after
purchasing this system about nine months ago. I decided to
check on this (your link was helpful) manually via Network
Connections in Control Panel. I found ... as I expected ...
that my NIC was enabled with firewall enabled. I was surprised
to find a *second* network connection enabled, titled:

1394 Connection

I don't know what this is (and don't remember it from my initial
explorations after hooking up this system); the firewall was *NOT*
enabled on this connection. In any case, I DISABLED this network
connection ... will observe my system closely to see what (if
anything) this impacts. If anyone recognizes this "mystery"
connection (at least to me), please give me a headsup. I'm
wondering if this "1394 Connection" might be the vehicle that
HIJACK (or whatever scumware I'm fighting) may be using to
"serve up" the obnoxious popup ads via Internet Explorer.

Thanks again,

Ted Rodrick

 

[Wesley Vogel]

Hi Ted,

It appears to be a Bar & Grill on 57th Street in New York.
Just kidding. ;-) I haven't heard of scumware being able to this.

[[Windows XP provides support for Internet Protocol (IP) networking over the
IEEE 1394 bus. The interface is listed in the Network Connections folder as
"1394 Connection".]]

Description of 1394 Connection in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;307736#appliesto

 

[Ted Rodrick]

Hiya Wes,

Hi Ted,

It appears to be a Bar ? Grill on 57th Street in New York.
Just kidding. ;-) I haven't heard of scumware being able to this.

[[Windows XP provides support for Internet Protocol (IP) networking over the
IEEE 1394 bus. The interface is listed in the Network Connections folder as
"1394 Connection".]]

Description of 1394 Connection in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;307736#appliesto

OK ... I assume that means that the "1394 Connection" would support a
local
network, should I ever want to establish one. I'll take a look at the
reference link you provide to see if, indeed, that assumption is
correct.

Thanks,

Ted Rodrick

 

[Wesley Vogel]

Hiya Ted,

Keep having fun!

--
Hope this helps. Let us know.
Wes

In

Hiya Wes,

Hi Ted,

It appears to be a Bar ? Grill on 57th Street in New York.
Just kidding. ;-) I haven't heard of scumware being able to this.

[[Windows XP provides support for Internet Protocol (IP) networking
over the IEEE 1394 bus. The interface is listed in the Network
Connections folder as "1394 Connection".]]

Description of 1394 Connection in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;307736#appliesto

OK ... I assume that means that the "1394 Connection" would support a
local
network, should I ever want to establish one. I'll take a look at the
reference link you provide to see if, indeed, that assumption is
correct.

Thanks,

Ted Rodrick

In Ted Rodrick [email protected]? hunted and pecked:
? Hi Wesley,
?
? Wesley Vogel wrote:

Ted Rodrick wrote:
................... SNIP .........................
?
? I dimly recalled enabling the WindowsXP Firewall shortly after
? purchasing this system about nine months ago. I decided to
? check on this (your link was helpful) manually via Network
? Connections in Control Panel. I found ... as I expected ...
? that my NIC was enabled with firewall enabled. I was surprised
? to find a *second* network connection enabled, titled:
?
? 1394 Connection
?
? I don't know what this is (and don't remember it from my initial
? explorations after hooking up this system); the firewall was *NOT*
? enabled on this connection. In any case, I DISABLED this network
? connection ... will observe my system closely to see what (if
? anything) this impacts. If anyone recognizes this "mystery"
? connection (at least to me), please give me a headsup. I'm
? wondering if this "1394 Connection" might be the vehicle that
? HIJACK (or whatever scumware I'm fighting) may be using to
? "serve up" the obnoxious popup ads via Internet Explorer.
?
? Thanks again,
?
? Ted Rodrick