cerio Posted June 12, 2004 Report Share Posted June 12, 2004 Hi,I'm having a problem with Task Manager in Windows XP. It was fine until a few days ago and now, when I open it (ctrl Alt Delete), it opens for a split second then immediately closes. Can anyone suggest why this is happening and how I can fix it?ThanksC Quote Link to comment Share on other sites More sharing options...
mark2 Posted June 12, 2004 Report Share Posted June 12, 2004 I think your 1st thing to do is an online virus scan, there are several viruses that will cause those symptoms. Check out the button in the security boards for panda.Then post back with a hijackthis log, instructions here Quote Link to comment Share on other sites More sharing options...
cerio Posted June 12, 2004 Author Report Share Posted June 12, 2004 Hi,thanks for your reply.I ran Panda, which found and disinfected 23 files. I still have the task manager problem and today something else occurred, possibly unrelated. All my .psd (Photoshop) and .jpg files have lost their usual icons. They still open ok, just their icons have changed to some generic looking thing.I have run hijackthis and attached the log here.Thanks for your helpChijackthis.log Quote Link to comment Share on other sites More sharing options...
madboy33 Posted June 12, 2004 Report Share Posted June 12, 2004 Hi thereWhat you need to do is a system file checkGo to start>run and tpye sfc /scannow (not the space between sfc and /)Make sure you put the XP disc in your cd-rom drive Quote Link to comment Share on other sites More sharing options...
cerio Posted June 12, 2004 Author Report Share Posted June 12, 2004 Hi,I put the Win XP disc in, typed sfc /scannow (without the space between sfc and /, I've put it back in, in this post, as I assume you had a reason for adding it in the post text) into Start/Run and got a box saying 'Windows cannot find 'sfc /scannow'... My Win XP Pro disc is fine, complete and undamaged, just in case you wonder.:-(C Quote Link to comment Share on other sites More sharing options...
cerio Posted June 12, 2004 Author Report Share Posted June 12, 2004 Hi,out of desperation I tried that again, this time leaving the space in between sfc and the / This time it worked and seemed to replace files. I then restarted my PCSadly, however, the task manager problem hasn't changed nor has the missing icons one.C Quote Link to comment Share on other sites More sharing options...
nellie2 Posted June 12, 2004 Report Share Posted June 12, 2004 Cerio's hijack logLogfile of HijackThis v1.97.7Scan saved at 12:03:10, on 12/06/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINNT\System32\smss.exeC:\WINNT\system32\winlogon.exeC:\WINNT\system32\services.exeC:\WINNT\system32\lsass.exeC:\WINNT\system32\svchost.exeC:\WINNT\System32\svchost.exeC:\WINNT\Explorer.EXEC:\WINNT\system32\spoolsv.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Iomega\DriveIcons\ImgIcon.exeC:\WINNT\SOUNDMAN.EXEC:\Program Files\Iomega\AutoDisk\ADUserMon.exeC:\Program Files\Messenger Plus! 2\MsgPlus.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\ScanSoft\OmniPagePro12.0\Opware12.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Program Files\Logitech\iTouch\iTouch.exeC:\WINNT\System32\RUNDLL32.EXEC:\WINNT\System32\GYISHFC.EXEC:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exeC:\Program Files\DU Meter\DUMeter.exeC:\WINNT\System32\rundll32.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\PerSono\PersTray.exeC:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exeC:\PROGRA~1\Iomega\System32\AppServices.exeC:\Program Files\Norton AntiVirus\navapsvc.exeC:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXEC:\WINNT\System32\nvsvc32.exeC:\WINNT\System32\svchost.exeC:\WINNT\System32\Tablet.exeC:\Program Files\Iomega\AutoDisk\ADService.exeC:\Program Files\Internet Explorer\iexplore.exeC:\WINNT\System32\MDM.EXEC:\Program Files\Messenger\msmsgs.exeC:\Documents and Settings\Ceri\Desktop\hijackthis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.wanadoo.co.uk/iesearch/default.htmR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.search.yahoo.com/search/ukie/options?fr=fp-top&p=R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/...://my.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/...rch/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.wanadoo.co.ukR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by WanadooR1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/...//www.yahoo.comO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: (no name) - {a5d71e9f-dffa-4cf4-89ee-a2d8b4fd626b} - C:\DOCUME~1\Ceri\APPLIC~1\crjxnprht.dll (file missing)O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocxO4 - HKLM\..\Run: [iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exeO4 - HKLM\..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTARTO4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [Pop-Up Stopper] "C:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe"O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exeO4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"O4 - HKLM\..\Run: [REGSHAVE] C:\Progra~1\REGSHAVE\REGSHAVE.EXE /autorunO4 - HKLM\..\Run: [synchronization Manager] mobsync.exe /logonO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXEO4 - HKLM\..\Run: [Opware12] "C:\Program Files\ScanSoft\OmniPagePro12.0\Opware12.exe"O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -kO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exeO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\System32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [Winsock2 driver] GYISHFC.EXEO4 - HKLM\..\Run: [speedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /iconO4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exeO4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\\NeroCheck.exeO4 - HKCU\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe" /WinStartO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\RunOnce: [Winsock2 driver] GYISHFC.EXEO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: contentadvisoroff.vbsO4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINNT\system32\spool\drivers\w32x86\3\E_SRCV02.EXEO4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exeO4 - Global Startup: Perstray.lnk = C:\Program Files\PerSono\PersTray.exeO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htmO8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htmO9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.ukO16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://active.macromedia.com/director6/cabs/sw.cabO16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa...ash/swflash.cabO17 - HKLM\System\CCS\Services\Tcpip\..\{62AB6070-E4BD-4295-B17E-3C59402BB311}: NameServer = 195.92.195.95 195.92.195.94 Quote Link to comment Share on other sites More sharing options...
nellie2 Posted June 12, 2004 Report Share Posted June 12, 2004 Ok... run hijackthis again, make sure all browsers and windows are closed except for hijackthis, put a check against the following and click 'fix checked'R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/...://my.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/...rch/search.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/...//www.yahoo.comO2 - BHO: (no name) - {a5d71e9f-dffa-4cf4-89ee-a2d8b4fd626b} - C:\DOCUME~1\Ceri\APPLIC~1\crjxnprht.dll (file missing)O4 - HKLM\..\Run: [Winsock2 driver] GYISHFC.EXEO4 - HKCU\..\RunOnce: [Winsock2 driver] GYISHFC.EXEIf you haven't set the policies to fix your homepage then fix these too.O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentThen reboot into safe mode, you may have to enable hidden files and folders and delete this fileC:\WINNT\System32\GYISHFC.EXEThen run hijackthis again and post a fresh log Quote Link to comment Share on other sites More sharing options...
Andy-2004 Posted June 12, 2004 Report Share Posted June 12, 2004 Hi thereWhat you need to do is a system file checkGo to start>run and tpye sfc /scannow (not the space between sfc and /)Make sure you put the XP disc in your cd-rom driveto clear things up, i think madboy ment to say NOTE and not NOT in his post Quote Link to comment Share on other sites More sharing options...
cerio Posted June 15, 2004 Author Report Share Posted June 15, 2004 OK, I got WAY ahead of myself.I rashly inserted my Win XP CD and did an update, believing it would do no harm. Wrong!!I completely lost my network connections and it wouldn't let me add one anymore. I couldn't dial up at all. I did this before the reply to my hijackthis report was posted.I ended up installing a second copy of XP, which allowed me to add a dialup connection again and solved the Task Manager problem while it was at it. It did, however, cause other problems which are somewhat niggling. I knew I shouldn't have been so impatient... I had no idea what I was doing.Anyway, I get broadband in a day or so and, when I do, I'm going to reformat my HD and start afresh, then download all the Windows updates again (that's why I'm waiting for broadband, there is a mountain of updates to download, which is ok on a modem if done bit by bit but, for all at once, I'll wait until I have the faster connection).I'll start again with a nice clean machine and, if any other thing goes wrong at any time, try not to meddle before I know what I'm doing.Thanks for all your posts.C Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.