Frmwrk32.exe, Disabled Task Manager and Display

By jinscriba ยท 14 replies
Jan 14, 2009
  1. Hey, I'm back again. Sagipsul's no longer bothering me but a new problem came up. My mom opened the computer this morning before I woke up. When I looked at the computer, it's packed with windows trying to load with the a spyware cleaner appearing at the taskbar below. I couldn't get out of it, so I simply shut the computer down and turned it back on.

    Now when I logged on, a registry change came up for frmwrk32.exe. I blocked it, but it ran regardless, disabling my task manager. Eventually, I was able to run Internet Explorer to try and enable my task manager again. After doing so, I was able to terminate frmwrk32.exe. The spyware cleaner again came up earlier, but I have Malwarebytes and McAfee VirusScan running as I type this message, and the spyware cleaner disappeared (probably one of the files recently quarantined by VirusScan).

    However, I still have the problem in Display. Changing the background has been disabled and there is a link of a Print Screen of what my Desktop looks like right now (2.2 MB, so the attachment failed). I'm also attaching a HJT log to help you figure out the problem. The X icon next to McAfee VirusScan is the spyware cleaner I mentioned earlier.

    How can I permanently block frmwrk32.exe and stop having my task manager and display disabled?

    I'm in urgent need of help and any help is greatly appreciated.
  2. KrisMcNic2!

    KrisMcNic2! TS Rookie Posts: 16

    I am really confused, how can you be doing 3 things @ the same time

    If I am not mistaken you are supposed to let MBAM & the other STEPS run on their own. Too many Cooks spoil the Broth. Will probably get my knuckles rapped for butting in but I think when on a Virus Hunt & Destroy you are supposed to let each program run on it's own & go get a cup of coffee. Correct me if I'm wrong :suspiciou:confused:
  3. jinscriba

    jinscriba TS Rookie Topic Starter

    Yeah, I noticed that McAfee was barely scanning, so after my post, I disabled McAfee and let MBAM on its own. I reboot, but frmwrk32.exe returned, display is still disabled and the annoying desktop background remained. Sad part is that I ran McAfee, left to pick up my brother and came back with my account logged off. No one logged it off, so I'm worried that the virus might be causing it as well. I ran msconfig and disabled frmwrk32.exe on startup, but have yet to restart because McAfee is still running.
  4. jinscriba

    jinscriba TS Rookie Topic Starter

    Hey, I ran the 8 steps. The logs are attached below. Everything seems to be running fine now. Frmwrk32.exe is still there when I ran msconfig, but I disabled it from running on startup to get some progress done, eliminated disabling the Task Manager and all that stuff.

    Also, I saw a lot of Vundo stuff on the scans. Where do you usually get those and how do I avoid frmwrk32 from coming back again?

    Help is very much appreciated and thanks in advance.
  5. TheDud

    TheDud TS Rookie

    Here's a website that I found most valuable in the removing on Frmwrk32 from my computer:
    prevx . com/filenames/114947037417195132-X1/FRMWRK322EEXE . html

    Chances are that you don't want to look through it though, so I'll just simply tell you what you have to do.

    Open Regedit (You already restored functionality of the Taskmanager, so I hope you know how to do this)
    Navigate to: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

    You'll find a few keys on the right, delete NoSetActiveDesktop, NoActiveDesktopChanges.

    Then navigate to: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Active Desktop

    Delete NoChangingWallpaper.

    Don't trust me? No problem, here are the MSTechNet articles about the registry values:
    NoChangingWallpaper: microsoft .com/technet/prodtechnol/windows2000serv/reskit/regentry/93252.mspx?mfr=true
    NoActiveDesktopChanges: microsoft .com/technet/prodtechnol/windows2000serv/reskit/regentry/93208.mspx?mfr=true
    Unforturnatly, there isn't a microsoft entry about NoSetActiveDesktop, so either leave it intact, change it to a 0, or delete it.

    Best of luck.

    You'll have to take spaces out of the URLs though, won't let me post with less then 5 posts.
  6. kimsland

    kimsland Ex-TechSpotter Posts: 14,523

    -> No action taken on MBAM scan, for found issues
    Please re-run Malwarebytes
    Confirm updated (third tab) (Note: your Malwarebytes version is now old)
    Then do the above quoted message, but this time "Remove all found issues"

    By the way, you will need to then restart, and run (and attach) a new HJT log
  7. jinscriba

    jinscriba TS Rookie Topic Starter

    Here are the logs you requested. Just to inform you that the computer is our home desktop and I will be returning to the dorms in less than a day since my winter break is almost over. Any further activities (like scans and saving log files) will be done by whoever is available at the house to do it should any more problems come up.

    Thank you very much for the help.
  8. kimsland

    kimsland Ex-TechSpotter Posts: 14,523

    You still did not remove found malwares
    Note: As stated in the guide, and also directly above, by me

    Please rerun Malwarebytes (checking for any updates first as per normal)
    When finished manually remove the Malwares found, as Malwarebytes does not automatically do this for you

    Please try for the third time :rolleyes:
  9. jinscriba

    jinscriba TS Rookie Topic Starter

    Here are the logs you need. It was my brother who did the scan and he simply sent me the logs. He said that there were no infections found, but I do not know if he updated the program before the scan. I apologize if the logs are not the ones you need.
  10. kimsland

    kimsland Ex-TechSpotter Posts: 14,523

    Looks a lot better :grinthumb

    Note: you have many startups, the main ones being McAfee (slowing your system down)
    I usually inform users to Uninstall McAfee and then use the McAfee Removal Tool to be sure it's gone (obviously your choice)
    If you do decide to remove it, the free Avira is a lot better in removing found Virus on your system (ironically)

    For the moment please do another scan with HJT and remove (tick and fix) this one non critical entry:
    Then Clear & Reset System Restore's Cache

    Go to Start >> Run - type or copy/paste control sysdm.cpl,,4 and then press Enter
    * Tick on the checkbox - Turn off System Restore on all drives
    * Click Apply
    Turn it back 'On' by unticking the same checkbox & click Apply, and then OK

    Please inform me of the status of Task Manager and your Display :)
  11. jinscriba

    jinscriba TS Rookie Topic Starter

    I have yet to do what you're asking with HJT, but after the 8 steps, task manager and display have been restored as I posted much earlier. It might be a while before you get the new HJT log, as no one really knows how to work the 8 steps at my house aside from me.

    Thanks for the help.
  12. kimsland

    kimsland Ex-TechSpotter Posts: 14,523

    Well it's suppose to be user friendly
    But if there are any steps that look too difficult, for others, please let me know.
  13. gloryb2green

    gloryb2green TS Rookie


    You're a saint!! (thank you -thank you- thank you) My Toshiba laptop runs like a young colt again. (I really!!...really!!....Didn't want to do a re-install)

    I'll spread the good news wherever I can...

    You are to be praised!!


  14. humidor

    humidor TS Rookie

    I have exactly the same problem.

    What is being referred to in this thread as "the 8 steps" ?

    Are these the steps I need to follow?

    1. Run the Malwarebytes scan.
    2. Review results and click REMOVE SELECTED.
    3. Run HJT.
    4. Post HJT log.
    5. Wait for advise based on HJT log, if any.
    6. Follow and do the Clear & Reset System Restore's cache steps.
    7. Restart PC.

    Please help me as I am getting so frustrated. Thanks in advance.

    EDIT: Sorry. I should have read through some of the posts before posting my question. I will go ahead and review the 8 steps that I found as a sticky. Thaks. a lot.
  15. kimsland

    kimsland Ex-TechSpotter Posts: 14,523

Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...