Task Manager will not open

[Smirnoff]

XP Pro, SP3

A friend's computer was infected with various nasties. I ran (in safe mode)
Malwarebytes, Superantispyware and Avast!

The programmes detected and deleted/quarantined various malware.

I then turned off system restore and ran them again in safe mode. All
reported a clean bill of health.

However, I cannot get Task Manager to open either by using Ctrl+Alt-Del or
right clicking the taskbar.

Have done a search for solution but advice ranges from the sublime to the
ridiculous.

I don't really want to start playing with the registry (but will if I have
to), so are there some basic things I could try first?

 

[Pegasus [MVP]]

XP Pro, SP3

A friend's computer was infected with various nasties. I ran (in safe
mode) Malwarebytes, Superantispyware and Avast!

The programmes detected and deleted/quarantined various malware.

I then turned off system restore and ran them again in safe mode. All
reported a clean bill of health.

However, I cannot get Task Manager to open either by using Ctrl+Alt-Del or
right clicking the taskbar.

Have done a search for solution but advice ranges from the sublime to the
ridiculous.

I don't really want to start playing with the registry (but will if I have
to), so are there some basic things I could try first?

Seeing that your friend's PC was infected with *various* nasties, the best
basic thing you could do is to back up all data files, then re-install
Windows onto a freshly formatted disk. Everything else amounts to
time-consuming tinkering. The machine is compromised and you do not know
what else is lurking there.

 

[Smirnoff]

Seeing that your friend's PC was infected with *various* nasties, the best
basic thing you could do is to back up all data files, then re-install
Windows onto a freshly formatted disk. Everything else amounts to
time-consuming tinkering. The machine is compromised and you do not know
what else is lurking there.

Fair comment, it may well come to that.

I was hoping that whatever disabled TM has now been removed and that I could
somehow re-enable it.

There is no error message such as "TM has been disabled by your
Administrator" so MS knowledge base article probably wont work but I'll try
it anyway. Also, I'll try taskmgr in "Run". Other than that, I think your
suggestion looks to be favourite. Thanks.

 

[Elmo]

XP Pro, SP3

A friend's computer was infected with various nasties. I ran (in safe
mode) Malwarebytes, Superantispyware and Avast!

The programmes detected and deleted/quarantined various malware.

I then turned off system restore and ran them again in safe mode. All
reported a clean bill of health.

However, I cannot get Task Manager to open either by using Ctrl+Alt-Del
or right-clicking the taskbar.

Have done a search for solution but advice ranges from the sublime to
the ridiculous.

I don't really want to start playing with the registry (but will if I
have to), so are there some basic things I could try first?

Simple:

http://www.kellys-korner-xp.com/xp_tweaks.htm
Line 51. (r-h column) Enable the Task Manager - Disable Task Manager

If you have a root-kit, it could be hiding malware from the mentioned
programs.

Burn the BitDefender .iso image from the link below, to a CD (using a
working machine) and test the infected machine with it. BitDefender
also has a Rootkit checker on the Linux Desktop; run it if you think
that's the problem:

http://www.techmixer.com/free-bootable-antivirus-rescue-cds-download-list/

Then run these again:

Malwarebytes© Corporation
http://www.malwarebytes.org/mbam/program/mbam-setup.exe

SuperAntispyware
http://www.superantispyware.com/superantispywarefreevspro.html

 

[Jose]

XP Pro, SP3

A friend's computer was infected with various nasties. I ran (in safe mode)
Malwarebytes, Superantispyware and Avast!

The programmes detected and deleted/quarantined various malware.

I then turned off system restore and ran them again in safe mode. All
reported a clean bill of health.

However, I cannot get Task Manager to open either by using Ctrl+Alt-Del or
right clicking the taskbar.

Have done a search for solution but advice ranges from the sublime to the
ridiculous.

I don't really want to start playing with the registry (but will if I have
to), so are there some basic things I could try first?

Didn't we do this already?

Browse to the windows\system32 folder, copy taskmgr.exe to
smirnoff.exe and see if smirnoff.exe will launch Task Manger and
report your results.

No matter what other scanning tools you have used, please use these:

Download, install, update and do a full scan with these free malware
detection programs:

Malwarebytes (MBAM): http://malwarebytes.org/
SUPERAntiSpyware: (SAS): http://www.superantispyware.com/

These can be uninstalled later if desired.

Malwarebytes recommends NOT running in Safe Mode, SAS says it
depends... To remove any doubt of the appropriate mode, do both and
there will be no further questions.

If the scans don't fix it (sometimes they won't), and depending on if
smirnoff.exe opens TM or not, there will likely be a registry edit
involved to complete the malware removal job but it is far from
ridiculous and there will be no playing.

 

[Ken Blake, MVP]

XP Pro, SP3

A friend's computer was infected with various nasties. I ran (in safe mode)
Malwarebytes, Superantispyware and Avast!

The programmes detected and deleted/quarantined various malware.

I then turned off system restore and ran them again in safe mode. All
reported a clean bill of health.

However, I cannot get Task Manager to open either by using Ctrl+Alt-Del or
right clicking the taskbar.

Have done a search for solution but advice ranges from the sublime to the
ridiculous.

I don't really want to start playing with the registry (but will if I have
to), so are there some basic things I could try first?

You say "various" nasties. How many are "various"?

The idea that malware is just a nuisance, and one that can be
eliminated by running an anti-virus or anti-spyware program, is
completely false. A virus (and other kinds of malware) is a piece of
software designed to do irreparable damage to your computer.

Does that mean that viruses can never be removed? No, of course not.
In practice it is often possible to remove a virus, especially if you
haven't been infected with it very long. However, you say you had
"various nasties" (plural) The more you have, the less likely it is
that they can all be properly removed, and with several, it's highly
likely that the situation was bad enough to be uncorrectable.

Moreover, you told us nothing about which malware infections they
were.

 

[PA Bear [MS MVP]]

You have much more work to do!

NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection' scan
(only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting requested logs
in an appropriate forum, not here.

Checking for/Help with Hijackware:
.. http://aumha.net/viewtopic.php?f=30&t=4075

.. http://mvps.org/winhelp2002/unwanted.htm
.. http://inetexplorer.mvps.org/tshoot.html
.. http://www.mvps.org/sramesh2k/Malware_Defence.htm
.. http://www.elephantboycomputers.com/page2.html#Removing_Malware

**Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

 

[Pegasus [MVP]]

*** See below.

You have much more work to do!

*** I fully agree.

NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
scan (only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting requested logs
in an appropriate forum, not here.

Checking for/Help with Hijackware:
. http://aumha.net/viewtopic.php?f=30&t=4075

. http://mvps.org/winhelp2002/unwanted.htm
. http://inetexplorer.mvps.org/tshoot.html
. http://www.mvps.org/sramesh2k/Malware_Defence.htm
. http://www.elephantboycomputers.com/page2.html#Removing_Malware

Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

*** By the time the OP is through with studying and implementing
*** the advice provided in the 12 links you quote, he would have
*** re-installed Windows plus all applications, with a guaranteed
*** outcome! I do not disagree with your advice - I'm just trying
*** to gauge how efficient it is.

 

[PA Bear [MS MVP]]

*** See below.

You have much more work to do!

*** I fully agree.

NB: If you had no anti-virus application installed or the subscription
had
expired *when the machine first got infected* and/or your subscription
has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
scan (only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting requested
logs
in an appropriate forum, not here.

Checking for/Help with Hijackware:
. http://aumha.net/viewtopic.php?f=30&t=4075

. http://mvps.org/winhelp2002/unwanted.htm
. http://inetexplorer.mvps.org/tshoot.html
. http://www.mvps.org/sramesh2k/Malware_Defence.htm
. http://www.elephantboycomputers.com/page2.html#Removing_Malware

Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30 or other appropriate forums.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

*** By the time the OP is through with studying and implementing
*** the advice provided in the 12 links you quote, he would have
*** re-installed Windows plus all applications, with a guaranteed
*** outcome! I do not disagree with your advice - I'm just trying
*** to gauge how efficient it is.

I agree with you but I always like to give 'em an alternative. When they
see how much work's involved, they usually opt to wipe & reload. <w>

 

[Jose]

*** See below.


*** I fully agree.

NB: If you had no anti-virus application installed or the subscription had
expired *when the machine first got infected* and/or your subscription has
since expired and/or the machine's not been kept fully-patched at Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows.  A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan!  You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
scan (only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting requested logs
in an appropriate forum, not here.

Checking for/Help with Hijackware:
.http://aumha.net/viewtopic.php?f=30&t=4075

Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30or other appropriate forums.**

If these procedures look too complex - and there is no shame in admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

*** By the time the OP is through with studying and implementing
*** the advice provided in the 12 links you quote, he would have
*** re-installed Windows plus all applications, with a guaranteed
*** outcome! I do not disagree with your advice - I'm just trying
*** to gauge how efficient it is.

Nah. Fixed this a dozen times without a reinstall.

 

[Pegasus [MVP]]

Nah. Fixed this a dozen times without a reinstall.

Congratulations - I hope the OP is as successful as you are. By the way,
seeing that you've had to do this a dozen times, do you practise safe hex?
Do you use a good virus scanner?

 

[Jose]

Congratulations - I hope the OP is as successful as you are. By the way,
seeing that you've had to do this a dozen times, do you practise safe hex?
Do you use a good virus scanner?

Never fixed this on any computer I own.

Prerequisites for my method are that MBAM and SAS run clean and a copy
of the executable works. cmd.exe is sometimes also effected in the
same way. The rest is (hopefully) easy.

I could be wrong and if so, I will keep trying to fix it without a
reinstall as long as the OP wants to keep trying.

Malware does not want you to do anything to remove it, so you can try
to outsmart it by understanding what it does. It is annoying and
inconvenient, but usually not destructive (like deleting files). It
just makes things difficult, and makes itself difficult to remove. It
is laughing.

I have never posted a message advocating a reinstall of XP for some
silly malware. I also have never advocated the use of System Restore
to fix a problem. I have never used SR except for testing, learning,
breaking on purpose, fixing.

A few variants of VUNDO have ended up with a scorched earth install,
but that was only after what appeared to be a successful removal,
system normal (whatever that means), all files safe, but I think it
was picked up on a banking site or banking sites were somehow
involved.

It was up to the OP and after discussion of what might be, we thought
it was the only 100% way to be sure.

 

[Kelly]

'Bear, back in the day - you did the same thing, like clock work. Remember
I kept asking you to use my site to offer one LINK to say all of that?

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Taskbar Repair Tool Plus!
http://www.kellys-korner-xp.com/taskbarplus!.htm

*** See below.

messageYou have much more
work to do!

*** I fully agree.

NB: If you had no anti-virus application installed or the subscription
had
expired *when the machine first got infected* and/or your subscription
has
since expired and/or the machine's not been kept fully-patched at
Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
scan (only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting requested
logs
in an appropriate forum, not here.

Checking for/Help with Hijackware:
.http://aumha.net/viewtopic.php?f=30&t=4075

Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30or other appropriate forums.**

If these procedures look too complex - and there is no shame in
admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

*** By the time the OP is through with studying and implementing
*** the advice provided in the 12 links you quote, he would have
*** re-installed Windows plus all applications, with a guaranteed
*** outcome! I do not disagree with your advice - I'm just trying
*** to gauge how efficient it is.

Nah. Fixed this a dozen times without a reinstall.

 

[Smirnoff]

Answers in line

Didn't we do this already?
No


Browse to the windows\system32 folder, copy taskmgr.exe to
smirnoff.exe and see if smirnoff.exe will launch Task Manger and
report your results.
smirnoff.exe???



No matter what other scanning tools you have used, please use these:

Download, install, update and do a full scan with these free malware
detection programs:

Malwarebytes (MBAM): http://malwarebytes.org/
SUPERAntiSpyware: (SAS): http://www.superantispyware.com/

These can be uninstalled later if desired.

Please see OP

Malwarebytes recommends NOT running in Safe Mode, SAS says it
depends... To remove any doubt of the appropriate mode, do both and
there will be no further questions.

Please indicate where MBAM advises NOT running in Safe Mode.

If the scans don't fix it (sometimes they won't), and depending on if
smirnoff.exe opens TM or not, there will likely be a registry edit
involved to complete the malware removal job but it is far from
ridiculous and there will be no playing.

There it is again, smirnoff.exe???

 

[Smirnoff]

Thanks Kelly but I was asking about Task Manager not Taskbar.

However, I have the appropriate link to your site from Elmo:

http://www.kellys-korner-xp.com/xp_tweaks.htm
Line 51. (r-h column) Enable the Task Manager - Disable Task Manager

'Bear, back in the day - you did the same thing, like clock work.
Remember I kept asking you to use my site to offer one LINK to say all of
that?

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Taskbar Repair Tool Plus!
http://www.kellys-korner-xp.com/taskbarplus!.htm

*** See below.

messageYou have much more
work to do!

*** I fully agree.

NB: If you had no anti-virus application installed or the subscription
had
expired *when the machine first got infected* and/or your subscription
has
since expired and/or the machine's not been kept fully-patched at
Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
scan (only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting requested
logs
in an appropriate forum, not here.

Checking for/Help with Hijackware:
.http://aumha.net/viewtopic.php?f=30&t=4075

Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30or other appropriate forums.**

If these procedures look too complex - and there is no shame in
admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

*** By the time the OP is through with studying and implementing
*** the advice provided in the 12 links you quote, he would have
*** re-installed Windows plus all applications, with a guaranteed
*** outcome! I do not disagree with your advice - I'm just trying
*** to gauge how efficient it is.

Nah. Fixed this a dozen times without a reinstall.

 

[Smirnoff]

You say "various" nasties. How many are "various"?

The idea that malware is just a nuisance, and one that can be
eliminated by running an anti-virus or anti-spyware program, is
completely false. A virus (and other kinds of malware) is a piece of
software designed to do irreparable damage to your computer.

Does that mean that viruses can never be removed? No, of course not.
In practice it is often possible to remove a virus, especially if you
haven't been infected with it very long. However, you say you had
"various nasties" (plural) The more you have, the less likely it is
that they can all be properly removed, and with several, it's highly
likely that the situation was bad enough to be uncorrectable.

Moreover, you told us nothing about which malware infections they
were.

Unfortunately there were hundreds of nasties detected. It appears that my
friend's subscription to McAfee had expired.

I realise that my information is sketchy. Based on the fact that MBAM and
Superantispyware now report a clean scan and his machine appears to be
working OK (with the exception of Task Manager) I was hoping to resolve the
problem by re-enabling TM.

However, as I pointed out to Pegasus in my first reply, I believe that a
clean install is probably the best solution.

Unfortunately, I only have access to his computer on one day per week so I
will try a clean install on Monday.

Thanks to all who advised in this thread.

 

[Smirnoff]

Thanks Kelly but I was asking about Task Manager not Taskbar.

However, I have the appropriate link to your site from Elmo:

http://www.kellys-korner-xp.com/xp_tweaks.htm
Line 51. (r-h column) Enable the Task Manager - Disable Task Manager

'Bear, back in the day - you did the same thing, like clock work.
Remember I kept asking you to use my site to offer one LINK to say all of
that?

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Taskbar Repair Tool Plus!
http://www.kellys-korner-xp.com/taskbarplus!.htm

*** See below.

messageYou have much more
work to do!

*** I fully agree.

NB: If you had no anti-virus application installed or the subscription
had
expired *when the machine first got infected* and/or your subscription
has
since expired and/or the machine's not been kept fully-patched at
Windows
Update, don't waste your time with any of the below: Format & reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
scan (only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting requested
logs
in an appropriate forum, not here.

Checking for/Help with Hijackware:
.http://aumha.net/viewtopic.php?f=30&t=4075

Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30or other appropriate forums.**

If these procedures look too complex - and there is no shame in
admitting
this isn't your cup of tea - take the machine to a local, reputable and
independent (i.e., not BigBoxStoreUSA) computer repair shop.

*** By the time the OP is through with studying and implementing
*** the advice provided in the 12 links you quote, he would have
*** re-installed Windows plus all applications, with a guaranteed
*** outcome! I do not disagree with your advice - I'm just trying
*** to gauge how efficient it is.

Nah. Fixed this a dozen times without a reinstall.

 

[Jose]

Answers in line












Please see OP




Please indicate where MBAM advises NOT running in Safe Mode.




There it is again, smirnoff.exe???

The "problem" is the executable named taskmgr.exe is not allowed to be
a running task. It is intercepted by the malware (and it's residue)
based on the name alone. You do not seem to have the permissions
issue, which is also an easy fix.

It is unlikely that the malware will intercept smirnoff.exe, so it is
a test to see if TM will launch under another name (or another
problem). I would say smirnoff.exe will launch TM and it will run as
smirnoff.exe - not taskmgr.exe. If the copy runs, the rest is easy.
Of course, you would have to try it.

You can certainly reinstall.

Here is info from the Malwarebytes CEO:

MBAM loses some effectiveness for detection & removal when used in
safe mode because the program includes a special driver which does not
work in safe mode. Further, scanning in safe mode prevents some types
of malware from running so it may be missed during the detection
process. Additionally, there are various types of malware infections
which target the safeboot keyset so booting into safe mode is not
always possible. For optimal removal, normal mode is recommended so it
does not limit the abilities of MBAM but in some cases, there is no
alternative but to do a safe mode scan.

Quick scan in Normal Mode, that is the best for detection rates.

 

[Ken Blake, MVP]

Unfortunately there were hundreds of nasties detected. It appears that my
friend's subscription to McAfee had expired.

I realise that my information is sketchy. Based on the fact that MBAM and
Superantispyware now report a clean scan and his machine appears to be
working OK (with the exception of Task Manager) I was hoping to resolve the
problem by re-enabling TM.

However, as I pointed out to Pegasus in my first reply, I believe that a
clean install is probably the best solution.

If there were *hundreds* of nasties, I'll not only agree with you,
I'll suggest that a clean installation is likely the *only* solution
(unless those "nasties" were just cookies). Although you say "appears
to be working OK (with the exception of Task Manager)," there may well
be remaining problems you are not yet aware of.

 

[Kelly]

My bad! (

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Taskbar Repair Tool Plus!
http://www.kellys-korner-xp.com/taskbarplus!.htm

Thanks Kelly but I was asking about Task Manager not Taskbar.

However, I have the appropriate link to your site from Elmo:

http://www.kellys-korner-xp.com/xp_tweaks.htm
Line 51. (r-h column) Enable the Task Manager - Disable Task Manager

'Bear, back in the day - you did the same thing, like clock work.
Remember I kept asking you to use my site to offer one LINK to say all of
that?

--

All the Best,
Kelly (MS-MVP/DTS&XP)

Taskbar Repair Tool Plus!
http://www.kellys-korner-xp.com/taskbarplus!.htm

*** See below.

messageYou have much more
work to do!

*** I fully agree.





NB: If you had no anti-virus application installed or the subscription
had
expired *when the machine first got infected* and/or your subscription
has
since expired and/or the machine's not been kept fully-patched at
Windows
Update, don't waste your time with any of the below: Format &
reinstall
Windows. A Repair Install will NOT help!

1. See if you can download/run the MSRT manually:
http://www.microsoft.com/security/malwareremove/default.mspx

NB: Run the FULL scan, not the QUICK scan! You may need to download
the
MSRT on a non-infected machine, then transfer MRT.EXE to the infected
machine and rename it to SCAN.EXE before running it.

2. [WinXP ONLY!! =>] Run the Windows Live Safety Center's 'Protection'
scan (only!) in Safe Mode with Networking, if need be:
http://onecare.live.com/site/en-us/center/howsafe.htm

3. Run a /thorough/ check for hijackware, including posting requested
logs
in an appropriate forum, not here.

Checking for/Help with Hijackware:
.http://aumha.net/viewtopic.php?f=30&t=4075

.http://mvps.org/winhelp2002/unwanted.htm
.http://inetexplorer.mvps.org/tshoot.html
.http://www.mvps.org/sramesh2k/Malware_Defence.htm
.http://www.elephantboycomputers.com/page2.html#Removing_Malware

Chances are you will need to seek expert assistance in
http://spywarehammer.com/simplemachinesforum/index.php?board=10.0,
http://www.spywarewarrior.com/viewforum.php?f=5,
http://www.dslreports.com/forum/cleanup,
http://www.bluetack.co.uk/forums/index.php,
http://aumha.net/viewforum.php?f=30or other appropriate forums.**

If these procedures look too complex - and there is no shame in
admitting
this isn't your cup of tea - take the machine to a local, reputable
and
independent (i.e., not BigBoxStoreUSA) computer repair shop.
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Client - since 2002
www.banthecheck.com

*** By the time the OP is through with studying and implementing
*** the advice provided in the 12 links you quote, he would have
*** re-installed Windows plus all applications, with a guaranteed
*** outcome! I do not disagree with your advice - I'm just trying
*** to gauge how efficient it is.

Nah. Fixed this a dozen times without a reinstall.