Member Panel

Hi all,

My second post, and in the same day as my first!

Anyhoo, on my home PC my Task Manager doesnt work. I've tried cntl/alt/del and right clicking on the start bar to open it that way but neither works. It shows the sandtimer as it looks like its doing it but nothing happens after it disappears. I did have a virus a while ago that Zonelabs removed but perhaps it left a legacy?

P.S I've tried registry method of turning it back on after someone suggested it but no go I'm afraid!

Hya Kilf , welcome to PCHF.


First give this tool a try:

http://dougknox.com/xp/utils/xp_taskmgrenab.zip


And it might also be a good idea to follow the "Prework" instructions , see below , to see if there is malware left on youre pc.
If you attach the 2 resulting log files then we will have a look at that.

Thanks for the welcome

I'll try it when I get home from work (then college!) tonight.

No prob O0 , see ya later.

I actually had this problem too, and using Ewido, it was removed 5 seconds after I installed that program.
http://www.ewido.net/

Sorry it took me so long, I'm pinging around between home/girlfriends/work PC!

Tried the tool listed on the link but made no difference unfortunately. Yesterday I followed the pre-work plus I ran several other programs in safe mode (that I'd seen recommended elsewhere) and they found nothing.... Here is the log.

Logfile of HijackThis v1.99.1
Scan saved at 14:09:28, on 10/12/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
F:\Program Files\DAEMON Tools\daemon.exe
F:\Program Files\BitLord\BitLord.exe
F:\Program Files\ewido\security suite\ewidoctrl.exe
F:\Program Files\ewido\security suite\ewidoguard.exe
F:\WINDOWS\system32\ZoneLabs\vsmon.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\system32\oodag.exe
F:\WINDOWS\system32\ZoneLabs\isafe.exe
F:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.ex e
F:\WINDOWS\system32\wuauclt.exe
F:\Documents and Settings\Administrator\My Documents\Tools\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ntlworld.com/broadband
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - f:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - f:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Zone Labs Client] F:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [DAEMON Tools] "F:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [BitComet] "F:\Program Files\BitLord\BitLord.exe"
O8 - Extra context menu item: &Google Search - res://f:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://f:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://f:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://f:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://f:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://f:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: NavLogon - F:\WINDOWS\
O21 - SSODL: SYSTEM - {BBE9CA65-D4D6-401E-890C-3E1300F3F006} - TaskMgr.dll (file missing)
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - F:\WINDOWS\system32\ZoneLabs\isafe.exe
O23 - Service: ewido security suite control - ewido networks - F:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - F:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - F:\WINDOWS\system32\oodag.exe

Now even though I'm a noob I couldnt help but notice the taskmgr.dll was missing apparently so I guess this has something to do with it. Also I ran a Pandasoft virus scan online yesterday and it found a virus called Trillian.C which was in the taskmgr.exe! Even though it claimed to have "disinfected" it, the task manager itself still didnt work.....

See if this helps:

Boot in safemode (hit f8 when booting up) and fix these with hjt:

Then run this tool again:
http://dougknox.com/xp/utils/xp_taskmgrenab.zip


And attach a new hjt log when youre done.