Im unable to open Task manager or add/remove programs..

[anyname]

hi people,
a few days ago i noticed i couldnt open my task manager, and my computer has been running really slow and also i cant open the add/remove programs in control panel.

i have read about a few similar problems on here, and ended up downloading hijackthis from merijn org thinking this would solve my problem.
then i found it wouldnt open so i went back to the site and it told me to get CoolWWWSearch.SmartKiller removal tool so i got it, but when i try to open that, a box just comes up saying "CoolWWWSearch.SmartKiller (v1/v2) has not been found on your system.

if someone could give me some instructions to fix this i would greatly appreciate it.

 

[howard_hopkinso]

Hello and welcome to Techspot.

First try running those programmes from safe mode. Post back with the results.

You may also want to take a look HERE and HERE

Regards Howard :wave: :wave:

 

[anyname]

----------

 

[anyname]

Ok ive follwed the instructions from that other thread, I ran AboutBuster, CWShredder, AdAware & Spybot. the only one to find anything was spybot.
I ran highjackthis again and attatched the log file.
what do I need to do next? my task manager still wont open.

 

[anyname]

can sumone please help me?

 

[howard_hopkinso]

I notice you are running both Norton, and AVG on your system. This will slow your system down considerably. It`s not a good idea to have two anti virus programmes running at once. I suggest you uninstall one of them.

First turn off system restore.

Then let hijack this fix the following.

All R0 and R3 entries.

O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)

O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/6247971CanadaInc/ie/bridge-c17.cab

O18 - Filter: text/html - {F0CA002E-6417-4EA0-BFD3-1CE530FE8810} - C:\Documents and Settings\User\Local Settings\Application Data\microsoft\internet explorer\V0.26.dat

Reboot your system. Turn system restore back on, and run another hijackthis scan and post it here.

Regards Howard

 

[anyname]

Thank you howard, ive followed those instructions, heres the log.

 

[RealBlackStuff]

I'm glad you had the good sense to uninstall the Norton bloatware, Well Done!

You also got a nice worm, namely SDBOT-XC, hiding behind 'Compaq Service Drivers'!

Boot in Safe Mode.
Switch System restore OFF.
Press Ctrl/Alt/Del simultaneously, select Taskmanager/Processes, select the process (if there), click "End Process" for:
systeminfos.exe

Next, click Start/Run and type services.msc and click OK. Look for the service:
systeminfos.exe
Doubleclick it, click Stop if it's running, and change the Startup type to Disabled.

Next, run a HJT scan and place a tick-mark in the little square before (if still there):
...................................................................................................
O4 - HKLM\..\Run: [Compaq Service Drivers] systeminfos.exe
O4 - HKLM\..\RunServices: [Compaq Service Drivers] systeminfos.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1111314875030
O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)
...................................................................................................
Now click on the Fix Checked button in HJT.

When done, from between the dotted lines, delete the highlighted bold files.
When a \directory-name\ is bold, delete everything in it, including that directory itself.
Delete all files and directories from: C:\Documents and Settings\[username]\Local Settings\Temp
Repeat this for ALL [usernames].
Boot normal. When all OK, switch System Restore back on.

 

[anyname]

Next, click Start/Run and type services.msc and click OK. Look for the service:
systeminfos.exe
Doubleclick it, click Stop if it's running, and change the Startup type to Disabled.

Thank you kindly realblackstuff,
i couldnt find systeminfos.exe
shall i just continue with the HJT scan?

 

[anyname]

i went ahead with the scan.
heres the log..
do i still have a worm?

 

[RealBlackStuff]

Make sure your Explorer shows hidden files and folders, as well as system-files, otherwise you won't find it!
In Explorer click on Tools/Folder Options/View and set it to show them.
UNtick Hide file extensions for known file type.

Basically, redo my original instructions for whatever is left.

 

[anyname]

ok ive set it to show hidden files/folders and system files and unticked hide file extentions.
in services, there is 2 tabs at the bottom, extended and standard.
nothing comes up under extended.
under standard a list of things come up and none of which are systeminfos.exe
am i looking in the right place?
i ran the HJT scan again and fixed:

O4 - HKLM\..\Run: [Compaq Service Drivers] systeminfos.exe
O4 - HKLM\..\RunServices: [Compaq Service Drivers] systeminfos.exe
23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)

i then ran another HJT scan heres the log.

ive also noticed the search function in explorer is not working, it comes up on the left side of the window as usual but no text boxes are showing up.

once again thank you for your help, it is greatly appreciated

 

[RealBlackStuff]

This one is still there:
O23 - Service: ScriptBlocking Service (SBService) - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe (file missing)

Fix it, then delete the Symantec directory if still there.

For the Search problem:
Try the Tune Up Utilities Trial, run Disc clean up then Registry clean up, then click Optimize to run reg defrag. That will take a while and it freezes the PC while it runs. At the end it needs a reboot.
http://www.tune-up.com/

 

[anyname]

ok heres the log..
am i clean now??

 

[RealBlackStuff]

Your old 'friends' are back:
O4 - HKLM\..\Run: [Compaq Service Drivers] systeminfos.exe
O4 - HKLM\..\RunServices: [Compaq Service Drivers] systeminfos.exe

You have to do the same as in post #8 again for these 2 items.

But BEFORE you reboot, click on Start/Run and type in regedit and click OK.
Browse to the following key, by clicking on the +sign in front of each stage, scroll to the next stage, click + etc.
+ HKLM
+ SOFTWARE
+ Microsoft etc.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Under 'Run' Hijackthis may have deleted the entry 'systeminfos.exe'.
If not, right-click it and select 'Delete', confirm that.

Now go to the key just under there
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Runonce
and delete 'systeminfos.exe' as above.

Exit the Registry.
Now do a Search for 'systeminfos.exe' on every drive/partition you have in your PC.
Delete when found.
When done, empty the Recycle bin/Trashcan whatever it is called.

Clean your Temp files again as in post #8
In IE, clean the Temporary internet files and all offline content. Delete all cookies.
Do the same for Firefox and any other browser you have.

Finally, reboot to normal.

I am now urging you to at least install Service Pack1 (SP1) for XP. If you want to go straight to SP2, you wont need SP1, as that's included in SP2.
SP2 is freely available on a CD from MS, or borrow it from a friend.
If downloading, get the full network version and install that, do NOT update online or through automatic updates!

If you don't do either, I will NOT help you any further.

 

[anyname]

i think things are all good now,
it wouldnt let me delete the files from HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
but i read on another forum to delete systeminfos.exe from system32 and i think it worked!
my task manager is working fine now.
i did a hjt scan in normal mode and attatched the log.
fingers crossed it doesnt come back.
im getting SP2 now.
Thank you so much for all your help
i cant explain how much i appreciate it!

 

[RealBlackStuff]

You are given a clean bill of health, congrats.