Ctrl+alt+del doesn't respond

[shahar75]

Hello,

The ALT+CTRL+DEL doesn't respond and ofcourse the task manager itself doesn't open.
Attached are all the logs.
I'm also using Norton360, SpySweeper and ParetoLogic Antispyware with all the programs you've mentioned, but nothing worked.
Please help before i have to reformat my computer

Reagards,
Shahar

 

[kimsland]

I'm also using Norton360, SpySweeper and ParetoLogic Antispyware with all the programs you've mentioned

Hi shahar75

I have not viewed any of the logs
But I suspect that one of these programs mentioned is causing the issue
I also wish to ask why SpySweeper and ParetoLogic Antispyware were not un-installed ? (As per the 8-step removal guide, to remove any\all live protecting programs)

I strongly advise you to un-install all 3 of these programs mentioned, before any other support is offered
I suspect one of them is causing the issue

 

[shahar75]

Hi shahar75

But I suspect that one of these programs mentioned is causing the issue
I also wish to ask why SpySweeper and ParetoLogic Antispyware were not un-installed ? (As per the 8-step removal guide, to remove any\all live protecting programs)

thanks for your prompt reply.
I've always used Norton 360 and after the problem appeared, i've searched other forums and installed SpySweeper and ParetLogic Antispyware in order to solve the problem.
Neither worked.
I've uninstalled both programs and left only Norton360, but the problem stays.
I thought Norton360 is a good software for against spyware/malware aswell.
Can you recommend of a software for online monitoring?

 

[kimsland]

Thanks for your reply and questions
As you are presently under fault condition "recommend of a software for online monitoring" can be left for when your system is working again

Presently please un-install all 3 Programs (including Norton 360)
You may want to backup your license key for Norton 360 of which you can read the howto h e r e

Once Norton 360 (and the other 2) are un-installed
Please then Restart
Then run the Norton Removal Tool, from h e r e
Then Restart

I would then say Ctrl+alt+del will respond
At that stage, I would like to recommend using Avira (free) Antivirus (since Norton likely was the issue!)

Download; Install; Update; and run a full scan

Please reply once complete

 

[shahar75]

Still nothing

Well, i've unisnstalled Norton 360 and used the Removal tool to uninstall it completely.
After all that, the Ctrl+Atl+Del combination still doesn't respond and the task manager doesn't open.
What's next?

Btw. does Avira is your recommended product for Firewall as well?

 

[shahar75]

New logs

Attached new logs after all your instructions.
What can you make of it?

 

[Wendig0]

Shahar, please try upgrading your Task Manager with Process Explorer v11.3 found here on Microsoft's TechNet . You can also run a live process explorer window from the link at the bottom of the webpage, or by clicking here. This will tell you what processes are running before you download anything to your computer.

As kimsland mentioned, you need a good antivirus on your system like Avira. I personally use Avast Professional, but it all comes down to personal preference, and like Avira, Avast also has a free version that works very well.

 

[kimsland]

Download RatsCheddar

It contains a program written by Rathat, and it is a Policy Controller.
Save and extract this program to the desktop.
Once extracted, Double click on the RatsCheddar.exe file.
Enable everything, then click Exit
Reboot your Computer.

 

[rf6647]

[comments]
D/L of Rats Cheddar was quick. Unzipped OK.
Execution controlled selecting 'enable'
No salesware content added to freeware

RRT on bring-up does present a saleware banner with music to remind you the purchase version is available. This is somewhat annoying.
[/comments]

{Therefore this should be considered only if 'ratscheddar' does not clear the problem
This link takes you to Cnet for the RRT program. The download icon is for the freeware. There is a 'buy-now' as well
Link Removed

The freeware version does not offer "viewer" which gives you a record of the changes made. The application scans the computer, presents areas with 'check mark' to indicate areas it will 'normalize' by making changes to that general area of the registry. You can untick any or all. This means you can be selective.

The freeware version does not cover all areas shown in the display.
It claims to be effective for 'ctrl-alt-del".

It is easy to keep it from appearing in the notification portion of the taskbar. It is not installed as an application.

This info was shared with 1 other user who declined to run the fix without knowing what changes were to be made.

My experimental use does not amount to confirmation of its effectiveness, since my computer had no problem.

 

[kimsland]

I don't understand this tool "RRT freeware"
It only has "Firewall SharedAccess" as the only freely enabled option
Plus it puts a Windows autostart of the program in registry
Exiting the program, will take you to the home website (definitely not good)

I'm considering removing this link as Spam, but wanted your thoughts first
I am replying on the thread, to stop any user downloads presently

Edit:
No Response
Link Removed

 

[Wendig0]

Like I said, Process Explorer v11.3 will show you everything that is currently running on your computer. If there is something lockig up a process and you are not sure what program is locking up that process, download WhoLockMe to find the process.

Now, back to the original issue. The 2 programs described above have helped me out on numerous occasions, and I highly recommend them.

There are several other alternatives to using CTRL+ALT+DEL to open up task manager. One of them is obvious. Try going to Start--->Run--->Taskmgr.exe .

If this does not work, another way of opening it is to press CTRL+SHIFT+ESC simultaneously as you would CTRL+ALT+DEL. If this doesn't work, it is possible that a virus or other piece of malware disabled it in group policy.

Follow these instructions and see if it works. http://ask-leo.com/why_is_my_task_manager_disabled_and_how_do_i_fix_it.html

Let me know if this works.

 

[Blind Dragon]

If that don't work you can always go the manual way

Backup your regsitry
First, we need to backup your registry:
Please go to Start > Run
Paste in the following line:

• regedit /e c:\registrybackup.reg

Click OK.
It won't appear to be doing anything, that's normal.
Your mouse pointer may turn to an hour glass for a minute.
Please continue when it no longer has the hour glass.


Making a .reg file
Open notepad and copy and paste the text in the quotebox below in it:

[b]REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000
"**del.DisableTaskMgr"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\]
"DisableTaskMgr"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"DisableCAD"=dword:00000000 
[/b]

Name the file as Fix.reg

Change the "Save As" type to "All Files" and save it on the desktop.

It should look like this:

Double-click on it and when it asks you if you want to merge the contents to the registry, click yes/ok.

Also may want to check your local group policies

Edit: If by any chance the registry changes give you problems, simply navigate to c:\registrybackup.reg -> and double click the file to restore everything


Regards,

BD

 

[shahar75]

Not a policty issue

There's no reg key concerning the task manager.
I've used RatsCheddar, enabled everything, but notihng changed.
I've tried to run Taskmgr.exe from the Run windows and got a Windows message that the file doesn''t exist.
I've located it in \Windows\System32 and when i tried to run it, i got the same message that Windows can't find the file.
The file attributes seems ok.
It's not the task manager that bothers me, but the infection itself.
Did you see anything in the logs?

Btw, Ive read that Norton Internet Security 2009 should be the best security suite, according to Pc Magazine.

 

[kimsland]

No I hate Norton

You are better to un-install it fully
Then use Avira

 

[shahar75]

What about the infection

Did you make anything out of the logs?

 

[kimsland]

Sorry, I should have been clearer
Please un-install Norton fully
Then restart

Then Install Avira
And run a full scan

 

[Blind Dragon]

The logs look fine, did you make and run the reg file? Does ctrl+alt+del work now?

 

[shahar75]

The reg fix didn't work

The logs look fine, did you make and run the reg file? Does ctrl+alt+del work now?

I guess it's something else since when i try to run taskmgr.exe i get a message that the file doesn't exist.
I've also ran The Alvera antivirus, and it reported 2 detections, but removed nothing.

 

[Blind Dragon]

so did you make and run the reg file i posted above? and afterwards does task manager work?

 

[shahar75]

so did you make and run the reg file i posted above? and afterwards does task manager work?

I did, but nothing changed.
Even when i locate the file taskmgr.exe and try to run it, i get a window saying the the file doesn't exist.
I'm starting to think that there's something unfamiliar with this kind of behaviour regarding a virus or malware.

 

[Blind Dragon]

Let's take a look and see if it was replaced with a malicious file maybe

Download random's system information tool (RSIT) by random/random from here and save it to your Desktop.

• Double click on RSIT.exe to run.
• Click Continue at the disclaimer screen.
• Once it has finished, two logs will open.
• log.txt <will be maximized and info.txt <will be minimized
• Please post the contents of both logs in the next reply.

 

[shahar75]

RSIT logs

Please post the contents of both logs in the next reply.[/list]

Attached are RSIT's logs.

 

[Blind Dragon]

I do see at least 1 malicious item.

First Disable any real time monitoring (including norton) The real time protection can usually be disabled by right clicking it in the system tray and checking or unchecking to disable real time monitoring.

=============================================

Combofix

• Download Combofix to your desktop.
• Double click combofix.exe & follow the prompts.
• A window will open with a warning.
• When the scan completes it will open a text window. Please attach that log back here together with a fresh HJT log.

Caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Combofix is a very powerful tool so please do NOT do anything without instruction

Combofix will automatically save the log file to C:\combofix.txt