Task Manager Problem

[Mark]

My task manager is only staying on for a few seconds then
it goes away.I had the worm and it is gone now but task
manager still will not stay up to let me do anything in
there.What could be the problem with it please help if
you know.....

 

[PuPpYpc]

Have you tried setting the taskmanager to always stay on top? Sounds like a
worm or bug or something so I don't know if this will resolve the problem
but its worth a shot.

Best of luck,
Frankie
http://www.puppypc.com/forum/index.htm

 

[Doug Knox MS-MVP]

Mark,

MVP Kelly and I have been working on a "cleanup script" to remove the
Blaster worm, and the known variants. We've modified it to include the most
recent suspect file. If you would please download this script from:

http://www.kellys-korner-xp.com/xp_qr.htm#rpc

or the direct download

http://www.kellys-korner-xp.com/regs_edits/msblast.vbs

and run it before you attempt any other cleanup measures. The script can
be opened and viewed in Notepad. Your AV software may warn of a
"potentially" malicious script, this is normal. If the script says it found
and removed Blaster, then the most recent "suspect" file name, WUAUMGR.EXE
may well be another variant. If the script says it removed it, then you
should be able to open Task Manager normally. If not, do the following:

Open a Command Prompt Window (Start, Run and and enter CMD). Then enter
the following command:

COPY C:\Windows\System32\taskmgr.exe C:\Windows\System32\taskmgr1.exe.

Then click Start, Run and enter TASKMGR1.EXE

Task Manager should now run. Look for any processes that you don't recognize
and post back with the names. Also, if you would, click Start, Run and
enter REGEDIT (you may need to use the COPY method above) and export the
following Registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

And post the contents of these two files back here.

 

[Doug Knox MS-MVP]

This is symptomatic of a virus (one of several). Maybe this is something to
add to your FAQ? Needs more!

 

[Cathy]

-----Original Message-----
Mark,

MVP Kelly and I have been working on a "cleanup script" to remove the
Blaster worm, and the known variants. We've modified it to include the most
recent suspect file. If you would please download this script from:

http://www.kellys-korner-xp.com/xp_qr.htm#rpc

or the direct download

http://www.kellys-korner-xp.com/regs_edits/msblast.vbs

and run it before you attempt any other cleanup measures. The script can
be opened and viewed in Notepad. Your AV software may warn of a
"potentially" malicious script, this is normal. If the script says it found
and removed Blaster, then the most recent "suspect" file name, WUAUMGR.EXE
may well be another variant. If the script says it removed it, then you
should be able to open Task Manager normally. If not, do the following:

Open a Command Prompt Window (Start, Run and and enter CMD). Then enter
the following command:

COPY C:\Windows\System32\taskmgr.exe C:\Windows\System32 \taskmgr1.exe.

Then click Start, Run and enter TASKMGR1.EXE

Task Manager should now run. Look for any processes that you don't recognize
and post back with the names. Also, if you would, click Start, Run and
enter REGEDIT (you may need to use the COPY method above) and export the
following Registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersi on\Run
on\RunOnce

And post the contents of these two files back here.






.
I seem to have the same problem with the addition of the

regedit doing the same thing. I followed the instructions
to open the task manager but I don't know what shouldn't
be there. However I can open the task manager and the
regedit in safemode with no problem. Please help.

 

[Doug Knox MS-MVP]

Cathy,

For REGEDIT, use the following:

COPY C:\WINDOWS\REGEDIT.EXE C:\WINDOWS\REGEDIT.COM

Then use C:\Windows\REGEDIT.COM to run it.

Also, you might want to visit http://www.kellys-korner-xp.com/xp_tweaks.htm
Line 257, Left column. This small fix by Kelly and I will look for and
remove all known variants of the Blaster worm, and a few of the ones that
can piggy back in with it.