Task Manager Problem

[Mark]

My task manager is only staying on for a few seconds then
it goes away.I had the worm and it is gone now but task
manager still will not stay up to let me do anything in
there.What could be the problem with it please help if
you know.....

[PuPpYpc]

Have you tried setting the taskmanager to always stay on top? Sounds like a
worm or bug or something so I don't know if this will resolve the problem
but its worth a shot.

Best of luck,
Frankie
http://www.puppypc.com/forum/index.htm

"Mark" > wrote in message
...
> My task manager is only staying on for a few seconds then
> it goes away.I had the worm and it is gone now but task
> manager still will not stay up to let me do anything in
> there.What could be the problem with it please help if
> you know.....

[Doug Knox MS-MVP]

Mark,

MVP Kelly and I have been working on a "cleanup script" to remove the
Blaster worm, and the known variants. We've modified it to include the most
recent suspect file. If you would please download this script from:

http://www.kellys-korner-xp.com/xp_qr.htm#rpc

or the direct download

http://www.kellys-korner-xp.com/regs_edits/msblast.vbs

and run it before you attempt any other cleanup measures. The script can
be opened and viewed in Notepad. Your AV software may warn of a
"potentially" malicious script, this is normal. If the script says it found
and removed Blaster, then the most recent "suspect" file name, WUAUMGR.EXE
may well be another variant. If the script says it removed it, then you
should be able to open Task Manager normally. If not, do the following:

Open a Command Prompt Window (Start, Run and and enter CMD). Then enter
the following command:

COPY C:\Windows\System32\taskmgr.exe C:\Windows\System32\taskmgr1.exe.

Then click Start, Run and enter TASKMGR1.EXE

Task Manager should now run. Look for any processes that you don't recognize
and post back with the names. Also, if you would, click Start, Run and
enter REGEDIT (you may need to use the COPY method above) and export the
following Registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\RunOnce

And post the contents of these two files back here.

--
Doug Knox, MS-MVP Windows XP/ Windows Smart Display
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Associate Expert
ExpertZone - http://www.microsoft.com/windowsxp/expertzone
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"Mark" > wrote in message
...
> My task manager is only staying on for a few seconds then
> it goes away.I had the worm and it is gone now but task
> manager still will not stay up to let me do anything in
> there.What could be the problem with it please help if
> you know.....

[Doug Knox MS-MVP]

This is symptomatic of a virus (one of several). Maybe this is something to
add to your FAQ? Needs more!

--
Doug Knox, MS-MVP Windows XP/ Windows Smart Display
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Associate Expert
ExpertZone - http://www.microsoft.com/windowsxp/expertzone
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"PuPpYpc" > wrote in message
...
> Have you tried setting the taskmanager to always stay on top? Sounds like
a
> worm or bug or something so I don't know if this will resolve the problem
> but its worth a shot.
>
> Best of luck,
> Frankie
> http://www.puppypc.com/forum/index.htm
>
> "Mark" > wrote in message
> ...
> > My task manager is only staying on for a few seconds then
> > it goes away.I had the worm and it is gone now but task
> > manager still will not stay up to let me do anything in
> > there.What could be the problem with it please help if
> > you know.....
>
>

[Cathy]

>-----Original Message-----
>Mark,
>
>MVP Kelly and I have been working on a "cleanup script"
to remove the
>Blaster worm, and the known variants. We've modified it
to include the most
>recent suspect file. If you would please download this
script from:
>
>http://www.kellys-korner-xp.com/xp_qr.htm#rpc
>
>or the direct download
>
>http://www.kellys-korner-xp.com/regs_edits/msblast.vbs
>
>and run it before you attempt any other cleanup
measures. The script can
>be opened and viewed in Notepad. Your AV software may
warn of a
>"potentially" malicious script, this is normal. If the
script says it found
>and removed Blaster, then the most recent "suspect" file
name, WUAUMGR.EXE
>may well be another variant. If the script says it
removed it, then you
>should be able to open Task Manager normally. If not, do
the following:
>
>Open a Command Prompt Window (Start, Run and and enter
CMD). Then enter
>the following command:
>
>COPY C:\Windows\System32\taskmgr.exe C:\Windows\System32
\taskmgr1.exe.
>
>Then click Start, Run and enter TASKMGR1.EXE
>
>Task Manager should now run. Look for any processes that
you don't recognize
>and post back with the names. Also, if you would, click
Start, Run and
>enter REGEDIT (you may need to use the COPY method
above) and export the
>following Registry keys:
>
>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersi
on\Run
>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersi
on\RunOnce
>
>And post the contents of these two files back here.
>
>--
>Doug Knox, MS-MVP Windows XP/ Windows Smart Display
>Win 95/98/Me/XP Tweaks and Fixes
>http://www.dougknox.com
>--------------------------------
>Associate Expert
>ExpertZone - http://www.microsoft.com/windowsxp/expertzone
>--------------------------------
>Please reply only to the newsgroup so all may benefit.
>Unsolicited e-mail is not answered.
>
>"Mark" > wrote in message
...
>> My task manager is only staying on for a few seconds
then
>> it goes away.I had the worm and it is gone now but task
>> manager still will not stay up to let me do anything in
>> there.What could be the problem with it please help if
>> you know.....
>
>
>.
>I seem to have the same problem with the addition of the
regedit doing the same thing. I followed the instructions
to open the task manager but I don't know what shouldn't
be there. However I can open the task manager and the
regedit in safemode with no problem. Please help.

[Doug Knox MS-MVP]

Cathy,

For REGEDIT, use the following:

COPY C:\WINDOWS\REGEDIT.EXE C:\WINDOWS\REGEDIT.COM

Then use C:\Windows\REGEDIT.COM to run it.

Also, you might want to visit http://www.kellys-korner-xp.com/xp_tweaks.htm
Line 257, Left column. This small fix by Kelly and I will look for and
remove all known variants of the Blaster worm, and a few of the ones that
can piggy back in with it.

--
Doug Knox, MS-MVP Windows XP/ Windows Smart Display
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Associate Expert
ExpertZone - http://www.microsoft.com/windowsxp/expertzone
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"Cathy" > wrote in message
...
>
> >-----Original Message-----
> >Mark,
> >
> >MVP Kelly and I have been working on a "cleanup script"
> to remove the
> >Blaster worm, and the known variants. We've modified it
> to include the most
> >recent suspect file. If you would please download this
> script from:
> >
> >http://www.kellys-korner-xp.com/xp_qr.htm#rpc
> >
> >or the direct download
> >
> >http://www.kellys-korner-xp.com/regs_edits/msblast.vbs
> >
> >and run it before you attempt any other cleanup
> measures. The script can
> >be opened and viewed in Notepad. Your AV software may
> warn of a
> >"potentially" malicious script, this is normal. If the
> script says it found
> >and removed Blaster, then the most recent "suspect" file
> name, WUAUMGR.EXE
> >may well be another variant. If the script says it
> removed it, then you
> >should be able to open Task Manager normally. If not, do
> the following:
> >
> >Open a Command Prompt Window (Start, Run and and enter
> CMD). Then enter
> >the following command:
> >
> >COPY C:\Windows\System32\taskmgr.exe C:\Windows\System32
> \taskmgr1.exe.
> >
> >Then click Start, Run and enter TASKMGR1.EXE
> >
> >Task Manager should now run. Look for any processes that
> you don't recognize
> >and post back with the names. Also, if you would, click
> Start, Run and
> >enter REGEDIT (you may need to use the COPY method
> above) and export the
> >following Registry keys:
> >
> >HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersi
> on\Run
> >HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersi
> on\RunOnce
> >
> >And post the contents of these two files back here.
> >
> >--
> >Doug Knox, MS-MVP Windows XP/ Windows Smart Display
> >Win 95/98/Me/XP Tweaks and Fixes
> >http://www.dougknox.com
> >--------------------------------
> >Associate Expert
> >ExpertZone - http://www.microsoft.com/windowsxp/expertzone
> >--------------------------------
> >Please reply only to the newsgroup so all may benefit.
> >Unsolicited e-mail is not answered.
> >
> >"Mark" > wrote in message
> ...
> >> My task manager is only staying on for a few seconds
> then
> >> it goes away.I had the worm and it is gone now but task
> >> manager still will not stay up to let me do anything in
> >> there.What could be the problem with it please help if
> >> you know.....
> >
> >
> >.
> >I seem to have the same problem with the addition of the
> regedit doing the same thing. I followed the instructions
> to open the task manager but I don't know what shouldn't
> be there. However I can open the task manager and the
> regedit in safemode with no problem. Please help.