Frmwrk32.exe, Disabled Task Manager and Display

[jinscriba]

Hey, I'm back again. Sagipsul's no longer bothering me but a new problem came up. My mom opened the computer this morning before I woke up. When I looked at the computer, it's packed with windows trying to load with the a spyware cleaner appearing at the taskbar below. I couldn't get out of it, so I simply shut the computer down and turned it back on.

Now when I logged on, a registry change came up for frmwrk32.exe. I blocked it, but it ran regardless, disabling my task manager. Eventually, I was able to run Internet Explorer to try and enable my task manager again. After doing so, I was able to terminate frmwrk32.exe. The spyware cleaner again came up earlier, but I have Malwarebytes and McAfee VirusScan running as I type this message, and the spyware cleaner disappeared (probably one of the files recently quarantined by VirusScan).

However, I still have the problem in Display. Changing the background has been disabled and there is a link of a Print Screen of what my Desktop looks like right now (2.2 MB, so the attachment failed). I'm also attaching a HJT log to help you figure out the problem. The X icon next to McAfee VirusScan is the spyware cleaner I mentioned earlier.

http://us.share.geocities.com/defghqqr/virus-desktop.bmp

How can I permanently block frmwrk32.exe and stop having my task manager and display disabled?

I'm in urgent need of help and any help is greatly appreciated.

 

[KrisMcNic2!]

I am really confused, how can you be doing 3 things @ the same time

but I have Malwarebytes and McAfee VirusScan running as I type this message,

If I am not mistaken you are supposed to let MBAM & the other STEPS run on their own. Too many Cooks spoil the Broth. Will probably get my knuckles rapped for butting in but I think when on a Virus Hunt & Destroy you are supposed to let each program run on it's own & go get a cup of coffee. Correct me if I'm wrong :suspiciou

 

[jinscriba]

Yeah, I noticed that McAfee was barely scanning, so after my post, I disabled McAfee and let MBAM on its own. I reboot, but frmwrk32.exe returned, display is still disabled and the annoying desktop background remained. Sad part is that I ran McAfee, left to pick up my brother and came back with my account logged off. No one logged it off, so I'm worried that the virus might be causing it as well. I ran msconfig and disabled frmwrk32.exe on startup, but have yet to restart because McAfee is still running.

 

[jinscriba]

Hey, I ran the 8 steps. The logs are attached below. Everything seems to be running fine now. Frmwrk32.exe is still there when I ran msconfig, but I disabled it from running on startup to get some progress done, eliminated disabling the Task Manager and all that stuff.

Also, I saw a lot of Vundo stuff on the scans. Where do you usually get those and how do I avoid frmwrk32 from coming back again?

Help is very much appreciated and thanks in advance.

 

[TheDud]

Here's a website that I found most valuable in the removing on Frmwrk32 from my computer:
prevx . com/filenames/114947037417195132-X1/FRMWRK322EEXE . html

Chances are that you don't want to look through it though, so I'll just simply tell you what you have to do.

Open Regedit (You already restored functionality of the Taskmanager, so I hope you know how to do this)
Navigate to: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

You'll find a few keys on the right, delete NoSetActiveDesktop, NoActiveDesktopChanges.

Then navigate to: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Active Desktop

Delete NoChangingWallpaper.

Don't trust me? No problem, here are the MSTechNet articles about the registry values:
NoChangingWallpaper: microsoft .com/technet/prodtechnol/windows2000serv/reskit/regentry/93252.mspx?mfr=true
NoActiveDesktopChanges: microsoft .com/technet/prodtechnol/windows2000serv/reskit/regentry/93208.mspx?mfr=true
Unforturnatly, there isn't a microsoft entry about NoSetActiveDesktop, so either leave it intact, change it to a 0, or delete it.

Best of luck.

You'll have to take spaces out of the URLs though, won't let me post with less then 5 posts.

 

[kimsland]

-> No action taken on MBAM scan, for found issues

Download and Run Malwarebytes' Anti-Malware
Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform full scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected. <========= Not Done

Please re-run Malwarebytes
Confirm updated (third tab) (Note: your Malwarebytes version is now old)
Then do the above quoted message, but this time "Remove all found issues"

By the way, you will need to then restart, and run (and attach) a new HJT log

 

[jinscriba]

Here are the logs you requested. Just to inform you that the computer is our home desktop and I will be returning to the dorms in less than a day since my winter break is almost over. Any further activities (like scans and saving log files) will be done by whoever is available at the house to do it should any more problems come up.

Thank you very much for the help.

 

[kimsland]

-> No action taken on MBAM scan, for found issues


Please re-run Malwarebytes
Confirm updated (third tab) (Note: your Malwarebytes version is now old)
Then do the above quoted message, but this time "Remove all found issues"

By the way, you will need to then restart, and run (and attach) a new HJT log

You still did not remove found malwares
Note: As stated in the guide, and also directly above, by me

# When the scan is complete, click OK, then Show Results to view the results.
# Be sure that everything is checked, and click Remove Selected

Please rerun Malwarebytes (checking for any updates first as per normal)
When finished manually remove the Malwares found, as Malwarebytes does not automatically do this for you

Please try for the third time

 

[jinscriba]

Here are the logs you need. It was my brother who did the scan and he simply sent me the logs. He said that there were no infections found, but I do not know if he updated the program before the scan. I apologize if the logs are not the ones you need.

 

[kimsland]

Looks a lot better :grinthumb

Note: you have many startups, the main ones being McAfee (slowing your system down)
I usually inform users to Uninstall McAfee and then use the McAfee Removal Tool to be sure it's gone (obviously your choice)
If you do decide to remove it, the free Avira is a lot better in removing found Virus on your system (ironically)

For the moment please do another scan with HJT and remove (tick and fix) this one non critical entry:

O9 - Extra button: Launch PicLens - {3437D640-C91A-458f-89F5-B9095EA4C28B} - C:\Program Files\PicLensIE\PicLens.dll (file missing)

Then Clear & Reset System Restore's Cache

Go to Start >> Run - type or copy/paste control sysdm.cpl,,4 and then press Enter
* Tick on the checkbox - Turn off System Restore on all drives
* Click Apply
Turn it back 'On' by unticking the same checkbox & click Apply, and then OK

Restart
Please inform me of the status of Task Manager and your Display

 

[jinscriba]

I have yet to do what you're asking with HJT, but after the 8 steps, task manager and display have been restored as I posted much earlier. It might be a while before you get the new HJT log, as no one really knows how to work the 8 steps at my house aside from me.

Thanks for the help.

 

[kimsland]

as no one really knows how to work the 8 steps at my house aside from me.

Well it's suppose to be user friendly
But if there are any steps that look too difficult, for others, please let me know.

 

[gloryb2green]

frmwrk32.exe

-> No action taken on MBAM scan, for found issues


Please re-run Malwarebytes
Confirm updated (third tab) (Note: your Malwarebytes version is now old)
Then do the above quoted message, but this time "Remove all found issues"

By the way, you will need to then restart, and run (and attach) a new HJT log

You're a saint!! (thank you -thank you- thank you) My Toshiba laptop runs like a young colt again. (I really!!...really!!....Didn't want to do a re-install)

I'll spread the good news wherever I can...

You are to be praised!!

Regards!!

Greg

 

[humidor]

I have yet to do what you're asking with HJT, but after the 8 steps, task manager and display have been restored as I posted much earlier. It might be a while before you get the new HJT log, as no one really knows how to work the 8 steps at my house aside from me.

Thanks for the help.

I have exactly the same problem.

What is being referred to in this thread as "the 8 steps" ?

Are these the steps I need to follow?

1. Run the Malwarebytes scan.
2. Review results and click REMOVE SELECTED.
3. Run HJT.
4. Post HJT log.
5. Wait for advise based on HJT log, if any.
6. Follow and do the Clear & Reset System Restore's cache steps.
7. Restart PC.

Please help me as I am getting so frustrated. Thanks in advance.

EDIT: Sorry. I should have read through some of the posts before posting my question. I will go ahead and review the 8 steps that I found as a sticky. Thaks. a lot.

 

[kimsland]

no problem 7seven

By the way, everyone should create their own New Thread not reply to old threads !

Here's the guide by the way: UPDATED 8-step Viruses/Spyware/Malware Preliminary Removal Instructions