Hey... I've been up all night and day on this~

I had a few bugs, spies, and ads on my computer yesterday that were preventing me to access task manager, and constantly opening up the LimeWire P2P program. I zapped everything I could with Norton, AdAware, Spybot and Hijack this in Safe Mode, removed LimeWire, and defragged just to be on the safe side. That fixed the problem~

I did some research into LimeWire, and found several testimonies from more computer-savy than I claiming to have tried and tested LimeWire for any malicious files and found it to be free of them.

So I redownloaded and installed LW, and now my task manager won't open again. Though, his time, Hijack, Adaware, Spybot and Norton tell me that my computer is clean. Hidden files and file extensions appear, and I've run everything in normal mode and Safe Mode. I've fiddled with msconfig trying all types of startup configurations, and still nothing.

Does anyone have an insight?

Thank you~

[B]Hello and welcome to Techspot.[/B]

Have you tried clicking start, run, and typing taskmgr.exe into the run box and hitting enter.

If that works. Look for any unusual entries in the task manager window under processes.

Regards Howard

doesn't work, but I tried AVG and it told me that i have Win32.P2P-Worm.Alcan.a

How can I fix this?

First turn off system restore. This will delete all your restore points, which is where a lot of virii live. That`s why AVG wont be able to kill it, because it can`t get into system restore.

Now run your antivirus programme again. See if it finds/kills it this time.

If it does, reboot your system, and turn system restore back on.

Regards Howard

howard, you said "virii", is that the official "plural" of virus? lol

Ya run your AV scan again and post here (if anything is found) the PATH to the file, including the file name. Or just post your scan log, whatever.

Do you get some type of error when you try to open Task Manager? Like press ctrl-alt-del? Or right-click the Task Bar and select Task Manager. Any popups?

Otherwise, if Task Manager is just plain "off", there is a registry key to turn it back on:
Go into the registry (start-run 'regedit'). And follow this:

Hive: HKEY_CURRENT_USER
Key: Software\Microsoft\Windows\CurrentVersion\Policies\System
Name: DisableTaskMgr
Type: REG_DWORD
Value: 1=Enablethis key, that is DISABLE TaskManager
Value: 0=Disablethis key, that is Don't Disable, Enable TaskManager

This taken from http://www.windowsnetworking.com/kba...XPHomePro.html

Good luck.

Having just looked it up in the dictionary, I have to say I`m completely wrong. There is no such word as virii. The correct plural of virus is viruses.

I therefore will never again use virii to mean viruses.

Regards Howard

Well, at least this thread has done some good

I had system restore turned off to begin with :/

AVG detected "Trojan horse BackDoor.Iroffer.f" as an infected and imbedded object, and was unable to quarantine or delete it.

Oh, and regarding task manager.

No message or notice when i ctrl+alt+del, just nothing.

When I run taskmgr.exe I'm told that another program is using it.

To remove the Trojan horse BackDoor.Iroffer.f manually, you need to access the task manager which clearly you cannot do at the moment.

Go [URL=http://www.techspot.com/vb/topic17297.html]HERE[/URL] and follow the instructions exactly.

Once you have done that go [URL=http://www.techspot.com/vb/topic19133.html]HERE[/URL] for intstructions on how to post your Hijackthis log.

Regards Howard

Or copy c:\windows\tskman.exe to another directory, and rename it e.g. tsk.exe;
double-click that to kill any nast processes.

I think it's "taskmgr.exe", right? You may also be able to rename it from "EXE" to "COM". That works for regedit I know.

Download PrcView from this link: http://www.svrops.com/svrops/downloa...es/PrcView.zip

That should get you into your processes to remove that junk. If not, use the DOS version "pv" that comes with it to do the job from a command prompt.

A little ooops from RBS there. Excuseable as like us he is suffering with the heat.

I was unable to find a 'tskmgr.exe' in my WINDOWS file, but there was a TASKMAN.exe. I was unable to open it; I tried changing the name to tsk.exe, and was unable to open that as well.

Had already done what RBS' post (the one HH linked to) said to do, and followed HJT with NAV and AVG, and this time they all found nothing.

Still, no task manager action is happening

I'm pretty sure I'm clean by HJT's account, but I've attached a log anyway.

Attached Files

hijackthis.txt (6.6 KB, 9 views)

Vigilante corrected the file to: taskmgr.exe.

Taskman.exe was put there by either AUTOTROJ-C TROJAN or FORBOT-T WORM

So turn off system restore and boot into safe mode.

Assuming AVG is up-to-date run it.
Then move HiJackThis to somewhere such as C:\HJT. You haven't read the stickies.
Then post a new HJT.log.

System restore needs to be turned back on - when all is clean.

AVG isn't letting me update... It seems to only have settings for dialup.

I tried downloading the update directly, then just uploading the update into the program, but it didn't recognize the file as a new update.

Go back to safe mode with system restore still turned off. Type taskmgr.exe in the run box (hopefully it is still there). On the Processes tab look for TASKMAN.EXE right click (if it is there) and select End Process. Then in Explorer search for TASKMAN.EXE and delete all references.

Clear out you Temp files. Try Crap Cleaner If you don't want to use it the download page tells where all your temp files are.

The we can attach a HJT.log.

Ok, I did what you said, and TASKMAN is history. Used CC as well, and still no task manager worky.

Any suggestions on how to get my AVG updated?

You should have a Control Centre running in the system tray. Icon is a square quartered in four colours. Click Update Manager and then click the update button and choose Internet.
Search for taskmgr.exe in Explorer. It should be in \system32. If it is not there may well be one under \service pack\I386 which you can copy to the correct location. If not come back.

Something seems fishy cause if taskmgr was "missing", it would say it was missing. If it was a policy, Windows would say it has been disabled by your administrator. But if simply "nothing" happens when running it, it could be that it is infected or corrupt. Could very well be that when running taskmgr you are running the very same virus you're trying to kill!
Just a theory.

I still say download PrcView and run that. It will give you an even MORE detailed view of your processes and let you kill them. The "real" taskmgr most likely needs to be extracted from an XP disk and restored.

Thanks for your intervention Vigilante. I'm not sure if has actual run taskmgr yet. Watch this space.