1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved malware is deleting software

Discussion in 'Malware and Virus Removal Archive' started by knighthawk, 2010/07/08.

Page 2 of 3
  1. 2010/07/10
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    How is your computer doing at the moment?


    Run OTL
    • Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following

      Code:
      :OTL
DRV - File not found [Kernel | On_Demand | Running] -- C:\ComboFix\catchme.sys -- (catchme)
O2 - BHO: (no name) - {2A0F3D1B-0909-4FF4-B272-609CCE6054E7} - No CLSID value found.
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {472734EA-242A-422B-ADF8-83D1E48CC825} - No CLSID value found.
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab  (Reg Error: Key error.)
O16 - DPF: CabBuilder http://kiw.imgag.com/imgag/kiw/toolb...lerControl.cab (Reg Error: Key error.)
@Alternate Data Stream - 48 bytes -> C:\Documents and Settings\All Users\DRM:مايكروسوفت
@Alternate Data Stream - 180 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2
@Alternate Data Stream - 109 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8

:Services

:Reg

:Files

:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
[Reboot]
    • Then click the [color= "#FF0000"]Run Fix[/color] button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.
     
    broni,
    #21
  2. 2010/07/10
    knighthawk

    knighthawk Inactive Thread Starter

    Joined:
    2010/07/08
    Messages:
    32
    Likes Received:
    0
    still cant get my task manager to work, just doesnt show up
     
    knighthawk,
    #22


  3. to hide this advert.

  4. 2010/07/10
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    OK. Run OTL script first.
     
    broni,
    #23
  5. 2010/07/11
    knighthawk

    knighthawk Inactive Thread Starter

    Joined:
    2010/07/08
    Messages:
    32
    Likes Received:
    0
    All processes killed
    ========== OTL ==========
    Service catchme stopped successfully!
    Service catchme deleted successfully!
    File C:\ComboFix\catchme.sys not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2A0F3D1B-0909-4FF4-B272-609CCE6054E7}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2A0F3D1B-0909-4FF4-B272-609CCE6054E7}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{472734EA-242A-422B-ADF8-83D1E48CC825} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{472734EA-242A-422B-ADF8-83D1E48CC825}\ deleted successfully.
    Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
    C:\WINDOWS\Downloaded Program Files\gp.inf not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
    Starting removal of ActiveX control CabBuilder
    Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\CabBuilder\DownloadInformation\\INF .
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\CabBuilder\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\CabBuilder\ not found.
    Unable to delete ADS C:\Documents and Settings\All Users\DRM:?????????? .
    ADS C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2 deleted successfully.
    ADS C:\Documents and Settings\All Users\Application Data\TEMP:A8ADE5D8 deleted successfully.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    ========== FILES ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Blain
    ->Temp folder emptied: 1985838 bytes
    ->Temporary Internet Files folder emptied: 10714366 bytes
    ->Java cache emptied: 14736547 bytes
    ->FireFox cache emptied: 40907394 bytes
    ->Flash cache emptied: 105276 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->FireFox cache emptied: 2116258 bytes

    User: LocalService
    ->Temporary Internet Files folder emptied: 67 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 32902 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 2402044 bytes
    %systemroot%\System32 .tmp files removed: 2577 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 609925 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 2412876 bytes
    RecycleBin emptied: 994176819 bytes

    Total Files Cleaned = 1,021.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Blain
    ->Flash cache emptied: 0 bytes

    User: Default User

    User: LocalService

    User: NetworkService

    Total Flash Files Cleaned = 0.00 mb

    C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
    HOSTS file reset successfully

    OTL by OldTimer - Version 3.2.9.0 log created on 07112010_035459

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...
     
    knighthawk,
    #24
  6. 2010/07/11
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    OK.

    Is this by pressing CTRL+ALT+DEL?
    Try couple of tricks:
    http://www.troublefixers.com/re-ena...reyed-folder-options-disabled-system-restore/
    http://www.raymond.cc/blog/archives...regedit-and-folder-options-disabled-by-virus/

    Also....

    1. Download Temp File Cleaner (TFC)
    Double click on TFC.exe to run the program.
    Click on Start button to begin cleaning process.
    TFC will close all running programs, and it may ask you to restart computer.


    2. Go to Kaspersky website and perform an online antivirus scan.

    1. Disable your active antivirus program.
    2. Read through the requirements and privacy statement and click on Accept button.
    3. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
    4. When the downloads have finished, click on Settings.
    5. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

    • Spyware, Adware, Dialers, and other potentially dangerous programs
      [*] Archives
      [*] Mail databases
    6. Click on My Computer under Scan.
    7. Once the scan is complete, it will display the results. Click on View Scan Report.
    8. You will see a list of infected items there. Click on Save Report As....
    9. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.
     
    broni,
    #25
  7. 2010/07/12
    knighthawk

    knighthawk Inactive Thread Starter

    Joined:
    2010/07/08
    Messages:
    32
    Likes Received:
    0
    --------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER 7.0: scan report
    Monday, July 12, 2010
    Operating system: Microsoft Windows XP Professional Service Pack 3, v.5938 (build 2600)
    Kaspersky Online Scanner version: 7.0.26.13
    Last database update: Monday, July 12, 2010 00:12:13
    Records in database: 4231063
    --------------------------------------------------------------------------------

    Scan settings:
    scan using the following database: extended
    Scan archives: yes
    Scan e-mail databases: yes

    Scan area - My Computer:
    C:\
    D:\
    F:\
    G:\

    Scan statistics:
    Objects scanned: 463637
    Threats found: 12
    Infected objects found: 26
    Suspicious objects found: 0
    Scan duration: 07:26:25


    File name / Threat / Threats count
    C:\DarkSide2.0\Play.exe Infected: Trojan-Dropper.Win32.Agent.cjmt 1
    C:\Documents and Settings\Blain\7zS3178.tmp\WblindsPatcher.exe Infected: Trojan-Dropper.Win32.VB.aium 1
    C:\Documents and Settings\Blain\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\textlinks@gamevance.com\components\gvtlf.dll Infected: not-a-virus:AdWare.Win32.Gamevance.dqj 1
    C:\Documents and Settings\Blain\Desktop\4fcom-20091110-05.rar Infected: Trojan-Downloader.Win32.Delf.xzv 1
    C:\Documents and Settings\Blain\Desktop\4fcom-20091110-05.rar Infected: not-a-virus:NetTool.Win32.Gina.ax 1
    C:\Documents and Settings\Blain\Desktop\4fcom-20100613-03.rar Infected: Backdoor.Win32.Hupigon.gklq 1
    C:\Documents and Settings\Blain\Desktop\revoultion eo server files and client\ACCServer\AccountServer Version 6.127-1.exe Infected: Backdoor.Win32.Hupigon.gklq 1
    C:\Documents and Settings\Default User\7zS3178.tmp\WblindsPatcher.exe Infected: Trojan-Dropper.Win32.VB.aium 1
    C:\Program Files\PhoenyxRysing\Play.exe Infected: Trojan-Dropper.Win32.Agent.cjmt 1
    C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBlinds - Save License.exe Infected: Trojan-Dropper.Win32.VB.aium 1
    C:\Server\ACCServer\AccountServer Version 6.127-1.exe Infected: Backdoor.Win32.Hupigon.gklq 1
    C:\System Volume Information\_restore{BFEEFB47-5D1B-4359-B6EE-BA456AA5E6D6}\RP119\A0029022.DLL Infected: not-a-virus:Monitor.Win32.Agent.c 1
    C:\System Volume Information\_restore{BFEEFB47-5D1B-4359-B6EE-BA456AA5E6D6}\RP119\A0029027.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.ax 1
    C:\System Volume Information\_restore{BFEEFB47-5D1B-4359-B6EE-BA456AA5E6D6}\RP142\A0033003.exe Infected: Virus.Win32.Sality.aa 1
    C:\System Volume Information\_restore{BFEEFB47-5D1B-4359-B6EE-BA456AA5E6D6}\RP142\A0033004.exe Infected: Virus.Win32.Sality.aa 1
    C:\System Volume Information\_restore{BFEEFB47-5D1B-4359-B6EE-BA456AA5E6D6}\RP142\A0033005.exe Infected: Virus.Win32.Sality.aa 1
    C:\System Volume Information\_restore{BFEEFB47-5D1B-4359-B6EE-BA456AA5E6D6}\RP142\A0033006.exe Infected: Virus.Win32.Sality.aa 1
    C:\System Volume Information\_restore{BFEEFB47-5D1B-4359-B6EE-BA456AA5E6D6}\RP142\A0033007.exe Infected: Virus.Win32.Sality.aa 1
    C:\System Volume Information\_restore{BFEEFB47-5D1B-4359-B6EE-BA456AA5E6D6}\RP142\A0033008.exe Infected: Virus.Win32.Sality.aa 1
    C:\System Volume Information\_restore{BFEEFB47-5D1B-4359-B6EE-BA456AA5E6D6}\RP142\A0033009.exe Infected: Virus.Win32.Sality.aa 1
    C:\System Volume Information\_restore{BFEEFB47-5D1B-4359-B6EE-BA456AA5E6D6}\RP143\A0033124.dll Infected: not-a-virus:AdWare.Win32.Gamevance.dvl 1
    C:\System Volume Information\_restore{BFEEFB47-5D1B-4359-B6EE-BA456AA5E6D6}\RP143\A0033128.dll Infected: not-a-virus:AdWare.Win32.Gamevance.dvl 1
    C:\System Volume Information\_restore{BFEEFB47-5D1B-4359-B6EE-BA456AA5E6D6}\RP143\A0033129.dll Infected: not-a-virus:AdWare.Win32.Gamevance.dqc 1
    C:\System Volume Information\_restore{BFEEFB47-5D1B-4359-B6EE-BA456AA5E6D6}\RP146\A0033481.DLL Infected: Packed.Win32.****.hc 1
    C:\System Volume Information\_restore{BFEEFB47-5D1B-4359-B6EE-BA456AA5E6D6}\RP146\A0033492.DLL Infected: Packed.Win32.****.hc 1
    C:\WINDOWS\system32\config\systemprofile\7zS3178.tmp\WblindsPatcher.exe Infected: Trojan-Dropper.Win32.VB.aium 1

    Selected area has been scanned.
     
    knighthawk,
    #26
  8. 2010/07/12
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    You have to really watch what you're downloading....

    Run OTL
    • Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following

      Code:
      :OTL

:Services

:Reg

:Files
C:\DarkSide2.0\Play.exe 
C:\Documents and Settings\Blain\7zS3178.tmp\WblindsPatcher.exe 
C:\Documents and Settings\Blain\Desktop\4fcom-20091110-05.rar 
C:\Documents and Settings\Blain\Desktop\4fcom-20100613-03.rar 
C:\Documents and Settings\Blain\Desktop\revoultioneo server files and client\ACCServer\AccountServer Version 6.127-1.exe 
C:\Documents and Settings\Default User\7zS3178.tmp\WblindsPatcher.exe 
C:\Program Files\PhoenyxRysing\Play.exe 
C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBlinds - Save License.exe 
C:\Server\ACCServer\AccountServer Version 6.127-1.exe
C:\WINDOWS\system32\config\systemprofile\7zS3178.tmp\WblindsPatcher.exe

:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
[Reboot]
    • Then click the [color= "#FF0000"]Run Fix[/color] button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.
     
    broni,
    #27
  9. 2010/07/12
    knighthawk

    knighthawk Inactive Thread Starter

    Joined:
    2010/07/08
    Messages:
    32
    Likes Received:
    0
    C:\DarkSide2.0\Play.exe
    C:\Documents and Settings\Blain\Desktop\4fcom-20091110-05.rar
    C:\Documents and Settings\Blain\Desktop\4fcom-20100613-03.rar
    C:\Documents and Settings\Blain\Desktop\revoultioneo server files and client\ACCServer\AccountServer Version 6.127-1.exe
    C:\Program Files\PhoenyxRysing\Play.exe
    C:\Server\ACCServer\AccountServer Version 6.127-1.exe


    those are all false positives, there for an online game i run and play...
     
    knighthawk,
    #28
  10. 2010/07/12
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    If I were you, I'd upload those files, you just mentioned to http://www.virustotal.com/ for security check.

    For the sake of this topic, you delete those lines from my script and run the rest.
     
    broni,
    #29
  11. 2010/07/12
    knighthawk

    knighthawk Inactive Thread Starter

    Joined:
    2010/07/08
    Messages:
    32
    Likes Received:
    0
    All processes killed
    ========== OTL ==========
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    ========== FILES ==========
    C:\Documents and Settings\Blain\7zS3178.tmp\WblindsPatcher.exe moved successfully.
    C:\Documents and Settings\Default User\7zS3178.tmp\WblindsPatcher.exe moved successfully.
    C:\Program Files\Stardock\Object Desktop\WindowBlinds\WBlinds - Save License.exe moved successfully.
    C:\WINDOWS\system32\config\systemprofile\7zS3178.tmp\WblindsPatcher.exe moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Blain
    ->Temp folder emptied: 113232824 bytes
    ->Temporary Internet Files folder emptied: 16343744 bytes
    ->Java cache emptied: 128094 bytes
    ->FireFox cache emptied: 73736210 bytes
    ->Flash cache emptied: 43074 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->FireFox cache emptied: 0 bytes

    User: LocalService
    ->Temporary Internet Files folder emptied: 0 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 90 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 4369279 bytes

    Total Files Cleaned = 198.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Blain
    ->Flash cache emptied: 0 bytes

    User: Default User

    User: LocalService

    User: NetworkService

    Total Flash Files Cleaned = 0.00 mb

    C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
    HOSTS file reset successfully

    OTL by OldTimer - Version 3.2.9.0 log created on 07122010_173559

    Files\Folders moved on Reboot...
    C:\Documents and Settings\Blain\Local Settings\Temp\~DFC71E.tmp moved successfully.
    C:\Documents and Settings\Blain\Local Settings\Temporary Internet Files\Content.IE5\IB0AEE1K\m0303[1].htm moved successfully.

    Registry entries deleted on Reboot...
     
    knighthawk,
    #30
  12. 2010/07/12
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    OTL Clean-Up
    Clean up with OTL:

    * Double-click OTL.exe to start the program.
    * Close all other programs apart from OTL as this step will require a reboot
    * On the OTL main screen, press the CLEANUP button
    * Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    ==============================================================

    Your computer is clean :)

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point.

    Turn off System Restore:

    - Windows XP:
    1. Click Start.
    2. Right-click the My Computer icon, and then click Properties.
    3. Click the System Restore tab.
    4. Check "Turn off System Restore ".
    5. Click Apply.
    6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
    7. Click OK.
    - Windows Vista and 7:
    1. Click Start.
    2. Right-click the Computer icon, and then click Properties.
    3. Click on System Protection under the Tasks column on the left side
    4. Click on Continue on the "User Account Control" window that pops up
    5. Under the System Protection tab, find Available Disks
    6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C: ")
    7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
    8. Click OK

    2. Restart computer.

    3. Turn System Restore on.

    4. Make sure, Windows Updates are current.

    [SIZE= "4"]5. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately![/SIZE]

    6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    7. Run defrag at your convenience.

    8. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    9. Please, let me know, how is your computer doing.
     
    broni,
    #31
  13. 2010/07/13
    knighthawk

    knighthawk Inactive Thread Starter

    Joined:
    2010/07/08
    Messages:
    32
    Likes Received:
    0
    i still cant use the task manager
     
    knighthawk,
    #32
  14. 2010/07/13
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Did you try links, I provided in my reply #25?
     
    broni,
    #33
  15. 2010/07/13
    knighthawk

    knighthawk Inactive Thread Starter

    Joined:
    2010/07/08
    Messages:
    32
    Likes Received:
    0
    yes i did...
     
    knighthawk,
    #34
  16. 2010/07/13
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    What does actually happen, when you press CTRL+ALT+DEL?
    Same thing, when you right click on a taskbar and click "Task Manager "?
     
    broni,
    #35
  17. 2010/07/13
    knighthawk

    knighthawk Inactive Thread Starter

    Joined:
    2010/07/08
    Messages:
    32
    Likes Received:
    0
    nothing opens at all
     
    knighthawk,
    #36
  18. 2010/07/13
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Go to C:\Windows\System32 and see, if you have taskmgr.exe file there.
    If you do, double click on it and see what happens.
     
    broni,
    #37
  19. 2010/07/13
    knighthawk

    knighthawk Inactive Thread Starter

    Joined:
    2010/07/08
    Messages:
    32
    Likes Received:
    0
    not there
     
    knighthawk,
    #38
  20. 2010/07/13
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Aha...

    Attached is zipped taskmgr.exe file.
    Unzip it and paste taskmgr.exe into C:\Windows\System32 folder.
    Restart computer and see, if Task Manager works.
     

    Attached Files:

    broni,
    #39
  21. 2010/07/14
    knighthawk

    knighthawk Inactive Thread Starter

    Joined:
    2010/07/08
    Messages:
    32
    Likes Received:
    0
    ok task manager is working now ty
     
    knighthawk,
    #40
Page 2 of 3

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...