Missing Task Manager (Fixed)

[cash_site]

From [previous thread here]

OK so what happens exactly? When he/she gives the 3-fingered salute, for example, does your cousin get the task manager or not? If not ... what happens?

Yes that is correct. Status of PC: XP Professional SP2 just cleaned from Vundo Trojan using MBAM automatic removal.

Task Manager was and continues to not be displayed, either by Ctrl+alt+del, or right clicking taskbar. The mouse cursor changes (so you think it is loading) but then nothing happens, not even systray icon. Even tried "run taskmgr.exe" and nothing happens.

I'm getting my cousin to install SP3, and hopefully the new DLLs/files will overwrite the corrupt ones.

Any thoughts?

[piaqt]

1. sfc /scannow
2. http://technet.microsoft.com/en-us/s...s/default.aspx and download process explorer. It's taskmgr on steroids.

[rik]

What about in safe mode cash? Still no Task Mangler?

[cash_site]

Well I haven't heard from my cousin since SP3 install, so not sure about more details...

Thanks Pia for the sfc /scannow (but does that replace the files?!) ... I downloaded the process explorer and it looks good, even using it on my own laptop

Safe mode was touch & go before SP3... would boot into it, but after a few seconds explorer.exe would crash and I couldn't click on anything or 'run' explorer.exe again...

Thanks for the tips guys, I'll get back to you soon.

[phishhead]

SFC is a system file checker and will search and replace corrupted system files. Downside of using this is usually you will have to re-run the latest servicepack unless you installed xp with a slipstreamed SP.

[cash_site]

Thanks Phish, yeah I thought it did that... i'll try to stay away unless really needed

[Curio]

You say when you try to run task manager 'nothing happens' - this is obviously different to 'I get an error message'. One possible scenario is that the taskmgr.exe was infected and has been healed in a way that removed it's ability to actually run, otherwise you would gat an error message. It is not unusual for nasties to target taskmgr and to make a taskmgr.com which would run in it's place - in fact it's a known vundo thing
Probably replacing it with one from another PC or from a windows installation disk will fix it nicely although you may first need to run sfc /purgecache to clear the backup file. The sysinternals Process Explorer is much more granular though and I would recommend it, it even has the option to replace task manager built in. One great thing about it is that you can get at the individual exes that are being run by services.exe and restart them - something which you can not do with task manager - and then there is the ability to view every dll loaded by a process this too is great for spotting nasty stuff usually because it has no manufacturer name. Then there is the ability to load the image from memory rather than disk, it's just better all round.

[cash_site]

Curio, thanks for the detailed reply - I think that might be the answer.

UPDATE: As it turned out, the Vundo trojan (causing the missing task manager) wasn't fully removed from the system - although a thorough MBAM et al scan showed no evidence.

A clean format & XP SP3 install and everything is back to normal.

MOD: [FIXED BY FORMAT - CLOSED]