Task manager closes after a second or so...

Wow... I've resolved a few virus issues in my time but NOTHING like this...

Problems:

Task manager closes itself when I try and view processes running (on another account it is saying that task manager has been disabled by your administrator).

Regedit has been disabled by administrator.

Hijack this will only open for a few seconds.

when I try and select "file view" - view hidden folders, explorer closes itself.

I'm stumped! It doesn't give me ANY time to try and root out the virus/malware... it just closes the window when I try and look for it.

Tried Safe mode to no avail...

Also tried to run SDfix but it errors saying "regedit has been disabled by your administrator ".

Any ideas? I'm pulling my hair out here!

 

Many thanks... Yes, it is a bit of a critter this one.

I'll perform a backup now.

 

Download the Remove Ristrictions Tool (RRT

http://public.www.planetmirror.com/pub/majorgeeks/antivirus/RRT.exe

Run it.

Then because you have deeper problems.

Go here get and run Hijackthis and paste us a log file.
http://radiosplace.com/

It would be nice to know if you have SpyBot and Adaware have updated and run them.

Bob

 

If Taskmgr still not working.

D/L this reg file and dbl click and answer yes twice.

http://www.kellys-korner-xp.com/regs_edits/taskmgrenable.reg

Don't use if above also repairs taskmanager.

Don't forget to get us a HJT log. As you likely have a Vundo infection.

Bob

 

Olla Bob,

RRT.exe craps out with the error msg "this application has failed to start becayse MSVBVM60.DLL was not found ".

Hijack this craps out with the same error msg.

The same is true for both safe mode and running XP normally...

Uh oh!

 

I don't know if this helps, but everytime I restart windows, just after I log on as a user, 3 command prompts opens up (no name assoicated) and then closes... I'm sure it's related?

 

When I run process explorer (for the few seconds its open), i can see the following processes running:

csrss.exe
lsrss.exe
qm10563.exe
m10563.exe

The computer in question is off line (ethernet unplugged) so no one can access it... Now how do I get rid of those processes?

 

Lets please get a HJT log as was suggested earlier. The popping dos windows is a clear indication of something serious running.

First thing I'd like you to do is to rename the HijackThis executable, hijackthis.exe to <anything of your choice> .exe, as long you change it's name. See if it will run for you then. If it runs then post the log.

Let me know how that goes.

Please do not run any tools unless instructed by me.

 

Hi Termec,

Still no joy after renaming the file.

Also tried that idea on RRT application as well... no difference!

 

TeMerc he said it will not run!

Ok blimburg

D/L and install the VB Runtime
http://www.microsoft.com/downloads/...f9-b5c5-48f4-8edd-cdf2d29a79d5&displaylang=en

Yes those are Virus's except for the csrss.

Download process.exe
http://www.beyondlogic.org/consulting/processutil/process203.zip
extract it to c:\windows\system32
Make sure this file gets to c:\windows\system32

then

open command prompt

copy and paste the following commands and hit enter


process -k rundll32.exe
process -k lsrss.exe
process -k qm10563.exe
process -k m10563


Then do all the above.

Bob

 

Hi Bob,

Tried as suggested.

Cmd prompt only opens for a few seconds... whilst it opens I manage to paste in the command but it errors saying "can't find the process name of.... "

Sounds like i am well and truly *******!

 

Also, i keep getting an error msg popping up saying:

Windows-No Disk

Exception Processing Message c0000013 parameters 75b6bf9c 4 75b6bf9c 75 b6bf9c

any ideas?

 

Boot to Safe mode

and try all above but you will have to type the commands

so print this thread so you will have it.

Do all steps in this entire thread.

Bob

 

Hi Bob,

I've tried all of the above from safe mode (including renaming hijackthis etc) and still no joy.

 

OK so we wil manually install the MSVBVM60.DLL it needs.

Go here get it unzip it and put in c:\windows\system32
http://www.dll-files.com/dllindex/download.php?msvbvm60download0UKmXCaHiS

the reboot to
safe mode command prompt

print this so you get it correct

at the prompt
type
cd\
then
attrib lsrss.exe -h -s -r /s
attrib qm10563.exe -h -s -r /s
attrib m10563 -h -s -r /s

then

del lsrss.exe /s
del qm10563.exe /s
del m10563.exe /s

type
exit

reboot and try all again.

Bob

 

Yes I realize that, but in many cases it does not run because a file is preventing it from doing so. Thus the name change. If you've been reading along in some Vundo threads you would likely have known this.

But your lack of specific training is obvious.

Blimbug, try running this tool below to fix safe mode:
http://download.bleepingcomputer.com/sUBs/SafeBootKeyRepair.exe

Save it to your desktop and run it from there. Let me know what, if any messages you get.

 

Right then... Rebuild time it is then!

Either that, or I should consider buying a Mac!

 

Still no joy...

Tried installing the application however it doesn't even let me get that far. A frantic click "next and next" is about as far as I get.

Such a pain!