can't click on desktop icons....

[fenix]

A friends parents computer has a reoccuring problem.
It's a compaq presario, not sure of the model, about a 1.8 processor with W2K.

He can't click on any desktop icons and ctrl+alt+delete doesn't bring up task manager. It brings up an error box that says "task manager has been diabled by administrator". My friend has been the sys admin on this computer and he hasn't made any changes to normal home user operation. Previously he had run a compaq command f10 and did a system recovery and that fixed this problem (about a month ago). When he runs it now, it doesn't help; he still can't click on any icons on the desktop. He also said the alt + f4 doesn't bring up the shutdown window.
It's curious that the ctrl+alt+del provides some input to the OS, if only to bring up an error message, but that all other keys don't work.

Guess it's a bad virus of some kind. Other than wiping the drive, are there any suggestions for repair or even what might be causing this situation ?

thx,
fenix

 

[fenix]

ps. I forgot to mention that he can access safe mode but everything in safe mode acts just like normal mode.

 

[goombawaho]

That's spyware for sure. You need to have them do the following and even then it's not a guarantee of removal, especially if they don't have someone knowledgeable about spyware working on it. It's tough even for us "professionals".

Install Spybot and update all the "definitions" and immunize the system.

Install Adaware and make sure it's up to date.

Now boot into Safe Mode and do a scan with both of them (separately) and see what gets removed.

Also, a good idea is to run AutoRuns and/or Hijack this and Process Explorer to see what exactly is starting up when the computer starts (you can stop a lot of spyware from starting this way. And use the Process Explorer to kill any suspicious processes.

Here's the fix for the "can't start task manager" problem.

http://windowsxp.mvps.org/Taskmanager_error.htm

Another alternative is to purchase something like Spysweeper + Antivirus and let it do all the dirty work for you. All the previously mentioned products were free.

 

[lhuegele]

Just wipe the machine clean and start over. Then tell the user you won't help them again if they don't buy, and keep updated, their anti-spyware and anti-virus software.

Good luck,

 

[goombawaho]

A good (really bad) case of spyware sometimes will take 2 hours to clean up and even then it's not guaranteed to get rid of everything. It really depends on what you've got, but it's probably a combination of a virus (trojan downloader) and the spyware that comes with it. You have to eradicate the trojan or it will just get infected again.

 

[geirendre]

Wipe the machine and install Linux instead of XP,
then they can surf any site without being bothered
with virus ore spyware.

http://arstechnica.com/reviews/os/ubuntu-gutsy-gibbon-review.ars

http://www.ubuntu.com/getubuntu/download

BTW it's free too.

 

[fenix]

goombawaho,thx for the task mgr link. maybe he can click on the desktop and then use the tab button to get down to the task bar and the address box if it's activated. Thanks everyone for the replies and suggestions. I'll show him this thread tomorrow at work and probably reply back.

 

[goombawaho]

If he's inexperienced at computers and/or spyware removal, he's doomed. It takes a lot of savvy and experience to snuff out the little nasties once they get in your machine.

 

[SirBlack]

Hi fenix,

If your friend's parents can't get Windows Task Manager, they might try downloading one or both of the following:

They work better than Windows version & give you more detail as to programs & processes running:

http://www.download3k.com/Install-Security-Task-Manager.html

http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Also, have them download some AV & AS apps. Grisoft offers very good AV & AS apps as well as an AntiRootkit program. They're free downloads available at:

http://free.grisoft.com/

Avast is another good & free AV app. Download it @:

http://www.avast.com/eng/download-avast-home.html

Other free downloads they should run are CCleaner, cwshredder v2.19 & PeperFix:

You can download them at:

http://www.ccleaner.com/

http://www.intermute.com/cwshredder/learn_more_cwshredder.html

http://www.bleepingcomputer.com/files/peperremover.php

CCleaner will clean all the crap (temp files, etc.) off the PC. The last 2 are trojan removers. Be sure the check for updates before running these apps. Have them delete/quarantine anything the AV, AS or AntiRootkit find. I'm not familiar with W2K but verify the've downloaded & installed all critical & important updates. If they have system restore on W2K, shut it down, reboot & set a new restore point after deleting all the nasties.

If they want, they can download HijackThis to it's own folder in Program Files at:

http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html

When they run it, have them select 'Do a system scan and save a log file. Post this logfile to this thread to make sure all is clean.

If they can't get Internet connection, download these files yourself to a CD, install it in their PC using Windows Explorer & go from there.

Good luck!

Remember, if you can't stand behind our troops, feel free to stand in front of them!

Bob B-)

 

[DTracy]

Fenix,
You never did say if that computer was part of a LAN and that there may be a system policy in force that stops the users from accessing things they are not supposed to.

If it's not, I too suggest an OS reinstall, it's the quickest and simplist way to solve all those problems.

Regards,
David.

 

[linney]

Why does Task Manager, MSCONFIG, or REGEDIT disappear while opening?

http://windowsxp.mvps.org/ToolsQuit.htm

Task Manager has been disabled by your Administrator
thread779-1433594

 

[fenix]

Task Manager never comes up. The small warning box comes up
on the desktop only, TM doesn't open at all.

He'll probably wipe the drive. I don't see how he can run any a/v or a/spy if he can't click on anything. Even if he tabbed to the address box (if there is one on the task bar) it seems likely like he wouldn't be able to input any url or that it would even open a website of any kind.

At this point I can't go any further down the T/S road unless I'm at the computer, which is probably unlikely judging by the interest there was today when I mentioned this thread.


But, I have gained valuable personal knowledge by reading the exchange of ideas, the links, and the expert advice. Every little bit of info helps in the big picture (I am a pretty late starter studying "databits".

Thx again to ALL for your posts.

I even occasionally get to help answer a question !

 

[goombawaho]

The REAL way to go about cleaning a really infected system is probably over your friend's head, but it involves using a bootable CD (BART PE or other) which has an antivirus and spyware scanner as part of it. That way you can boot the system with a separate operating system and scan windows from "outside" the operating system. The benefit is that none of the spyware/viruses is trying to run AS you are scanning. It's much more difficult to remove the stuff if it's active and running in windows.

Check this out for future reference. It's not that hard to use once you understand the idea of plugins to do different jobs/enable different programs. It's absolutely essential to my job.

http://www.nu2.nu/pebuilder/