unable to access task manager and regedit

[Joyce Hunnex]

I am unable to access task manager and regedit. When i
hit ctl-alt-del and select task manager, it flickers and
then closes everytime. same with regedit. I feel I
probably have a virus. But, I have Mcafee activated and up
to date and have scanned using Mcafee, spybot, cwshredder
and adawar and also pandasoftware and trend micro. I am
using XP pro. Any help would be greatly appreciated. I
can access task manager in safe mode but obviously the
virus program is not loading in safe mode.

 

[Kaylene aka Taurarian]

http://www.dougknox.com/xp/utils/xp_emerutils.htm
Creates usable copies of REGEDIT, MSCONFIG and Task Manager

You could be infected with one of these worms:

W32.Spybot.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.worm.html
W32.Klez.Worm
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]
W32.Yaha.Worm
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

These viruses terminate Regedit.exe and taskmgr.exe
W32.HLLW.Kefy:
http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.kefy.html
W32.HLLW.Cydog@mm:
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]
Backdoor.IRC.Yoink.A:
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.irc.yoink.a.html
Backdoor.Volac.dr:
http://securityresponse.symantec.com/avcenter/venc/data/backdoor.volac.dr.html
W32.Kwbot.R.Worm:
http://www.symantec.com/avcenter/venc/data/w32.kwbot.r.worm.html

These viruses delete the Regedit.exe, Regedt32.exe, Msconfig.exe, Taskmgr.exe
W32.Petch.B:
http://www.symantec.com/avcenter/venc/data/w32.petch.b.html
W32.HLLW.Maax.B@mm:
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]


Perhaps an online security/virus check
Symantec
http://security.norton.com/sscv6/default.asp?langid=ie&venid=sym
Trend Micro House Call:
http://housecall.trendmicro.com/
Panda ActiveScan;
http://www.pandasoftware.com/activescan/com/activescan_principal.htm
McAfee FreeScan:
http://us.mcafee.com/root/mfs/default.asp
Kaspersky Labs On-line Virus Checker:
http://www.kaspersky.com/remoteviruschk.html
BitDefender Online Scan:
http://www.bitdefender.com/scan/licence.php

 

[Guest]

i have already run many virus checkers, all say I have no
virus. the dougknox.com utility errored out on me but I
copied the files and renamed them and can now run both
task manager and regedit. However, I have no idea what I
am looking for. I saw nothing suspicious in the task
manager. Any other suggestions. thanks for your help thus
far.

 

[Larry Samuels]

If renaming the files worked you ARE infected with something, most likely
one of the spybot worm variants.

Go to http://vil.nai.com/vil/stinger/ and download Stinger.


--
Larry Samuels MS-MVP (Windows-Shell/User)
Associate Expert
Expert Zone -
Unofficial FAQ for Windows Server 2003 at
http://pelos.us/SERVER.htm

 

[Kaylene aka Taurarian]

Not really, perhaps there's something else you should be looking for.
Please note that some malware may kill the internet connection when it is
removed, the program on the link below will enable you to regain the internet
connection.
http://www.cexx.org/lspfix.htm

Spyware Programs links:-
www.lavasoftusa.com Ad-Aware
www.security.kolla.de Spybot

 

[Joyce Hunnex]

PS I finally discovered a program called netstatt.exe
which is a spy program that apparently is not detected by
spybot or adaware. I manually deleted it and deleted it
from my registry and that seems to have solved my problem.

Thanks.

 

[Doug Knox MS-MVP]

Can you provide the details of the error you received, so I can investigate the cause. It would help me make the utility work better.