Task Manager not responding

[ednachman]

My computer is causing a lot of "not responding" messages. When I initiate the "Task Manager" I click on "end task" and nothing happens. In fact the "Task Manager" has given me "not responding" on a number of occasions and I can't "end task"


Enjoy Life, this is not a rehearsal

 

[edfair]

Try invoking another task manager. I've seen systems hang like this and where a second TM worked correctly and when exited the first one became active.

This doesn't cure the original problem, just gets you out.

Ed Fair
Give the wrong symptoms, get the wrong solutions.

 

[linney]

Have you run the usual malware checks in case you have a "nasty" lurking in the background?

Before Task Manager fails is it able to give you any clues as to what is using all the CPU cycles?

The Event Viewer, Application Logs (check the System one too), might inform you of any programs that is hanging and not responding.

Can you reproduce this problem while in Safe Mode, or while in Normal Mode with a different user?

310560 - How to Troubleshoot By Using the Msconfig Utility in Windows XP

http://support.microsoft.com/kb/310560

Try running ChkDsk to check your drive for errors. Right-click your Drive icon/ Properties/ Tools/ Error Checking. Select both boxes.

Run the System File Checker program from the Run Box by typing.....Sfc /Scannow in it and have your XP CD handy.

HOW TO: Verify Unsigned Device Drivers in Windows XP

http://support.microsoft.com/support/kb/articles/q308/5/14.asp

 

[BadBigBen]

I agree with Linney, I've seen this behavior with MALWARE as the cause...

DL: MBAM (Malware Bytes Antimalware)

http://www.malwarebytes.org/mbam.php

if you can't download it on the affected PC, then most likely you are infected... in that case use the SAVE AS option and rename the install file to TEST.EXE and safe it to the desktop...

reboot and enter SAVEMODE with NETWORKING, and install MBAM then run a quick scan first, second a FULL scan... delete everything it finds...

post back...


Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[goombawaho]

If after scanning/removing malware, your task manager doesn't run, you may have had some items disabled by the malware. You might get an error like "task manager has been disabled by your administrator". If NOT - no need to do the following.

You could run this batch file which resets everything that the malware may have tried to preempt. Paste into notepad and save. Rename to .bat and run

@ECHO OFF
ECHO Working ..........

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall /v NoAddRemovePrograms /t REG_DWORD /d 0 /f >NUL

REG add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall /v NoAddRemovePrograms /t REG_DWORD /d 0 /f >NUL

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall /v NoRemovePage /t REG_DWORD /d 0 /f >NUL

REG add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall /v NoRemovePage /t REG_DWORD /d 0 /f >NUL

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall /v NoAddPage /t REG_DWORD /d 0 /f >NUL

REG add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall /v NoAddPage /t REG_DWORD /d 0 /f >NUL

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall /v NoWindowsSetupPage /t REG_DWORD /d 0 /f >NUL

REG add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall /v NoWindowsSetupPage /t REG_DWORD /d 0 /f >NUL

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall /v NoAddFromCDorFloppy /t REG_DWORD /d 0 /f >NUL

REG add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall /v NoAddFromCDorFloppy /t REG_DWORD /d 0 /f >NUL

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall /v NoAddFromInternet /t REG_DWORD /d 0 /f >NUL

REG add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall /v NoAddFromInternet /t REG_DWORD /d 0 /f >NUL

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall /v NoAddFromNetwork /t REG_DWORD /d 0 /f >NUL

REG add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall /v NoAddFromNetwork /t REG_DWORD /d 0 /f >NUL

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall /v NoServices /t REG_DWORD /d 0 /f >NUL

REG add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall /v NoServices /t REG_DWORD /d 0 /f >NUL

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall /v NoSupportInfo /t REG_DWORD /d 0 /f >NUL

REG add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall /v NoSupportInfo /t REG_DWORD /d 0 /f >NUL

REG add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\explorer /v NoControlPanel /t REG_DWORD /d 0 /f >NUL

REG add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\system /v DisableRegistryTools /t REG_DWORD /d 0 /f >NUL

REG add HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\system /v DisableTaskMgr /t REG_DWORD /d 0 /f >NUL

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoControlPanel /t REG_DWORD /d 0 /f >NUL

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoWindowsUpdate /t REG_DWORD /d 0 /f >NUL

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system /v DisableRegistryTools /t REG_DWORD /d 0 /f >NUL

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system /v DisableTaskMgr /t REG_DWORD /d 0 /f >NUL

REG Delete "HKCU\Software\Policies\Microsoft\internet explorer\control panel" /f >NUL

REG Delete "HKCU\Software\Policies\Microsoft\internet explorer\restrictions" /f >NUL

Exit

 

[ednachman]

Addressing advice; I cannot invoke a duplicate Task Manager
Am not advanced enough to mess with msconfig but I am sending screen shots. No Malware. I am also attaching a screen shot of my Task Manager which shows duplicate applications running. I have never seen that before the problem started. Would this in any way lead to the initial problem? Never mind the screen shots until I figure out how to upload the jpgs.

Enjoy Life, this is not a rehearsal

 

[BadBigBen]

Never mind the screen shots until I figure out how to upload the jpgs.

Use Imageshack or PhotoBucket to host your files, then use the [ignore]

[/ignore] tag... make sure that it is downsized to a readable size...


e.g. [ignore]

[/ignore] would produce the following:

Am not advanced enough to mess with msconfig

Download HiJackThis from the Trend Micro website, and post a LOG here for our perusal...


HiJackThis

http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[linney]

By duplicate applications are you talking about the process called svchost? There are always several of those running in Task Manager by design.

 

[ednachman]

Here is the HijackThis list; Screen shots to follow soon.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:44:14 PM, on 6/1/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\WINDOWS\SYSTEM32\astsrv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys

Server\sntlkeyssrvr.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection

Server\WinNT\spnsrvnt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\Program Files\TechSmith\SnagIt 9\Snagit32.exe
C:\Program Files\TechSmith\SnagIt 9\TSCHelp.exe
C:\Program Files\TechSmith\SnagIt 9\SnagPriv.exe
C:\Program Files\TechSmith\SnagIt 9\snagiteditor.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet

Settings,ProxyOverride = *.local
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208}

- C:\Program Files\TechSmith\Snagit 9\SnagitBHO.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -

C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter -

{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program

Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} -

C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O3 - Toolbar: Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} -

C:\Program Files\TechSmith\Snagit 9\SnagitIEAddin.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE

C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet

Security 2009\avp.exe"
O4 - HKLM\..\Run: [MSConfig]

C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE

C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program

Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O9 - Extra button: Web traffic protection statistics -

{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky

Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -

{e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs:

C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KA

SPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGR

A~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program

Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: AST Service (astcc) - Nalpeiron Ltd. -

C:\WINDOWS\SYSTEM32\astsrv.exe
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program

Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##

(Bonjour Service) - Apple Computer, Inc. - C:\Program

Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program

Files\Common Files\Macrovision Shared\FLEXnet

Publisher\FNPLicensingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -

C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner -

C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Sentinel Keys Server (SentinelKeysServer) - SafeNet, Inc. -

C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys

Server\sntlkeyssrvr.exe
O23 - Service: Sentinel Protection Server (SentinelProtectionServer) - SafeNet, Inc -

C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection

Server\WinNT\spnsrvnt.exe

--
End of file - 5472 bytes


Enjoy Life, this is not a rehearsal

 

[ednachman]

Any application that I am working on and I want to "end taks" there are two applications shown for one application.

Photoshop not responding
Photoshop not responding

Enjoy Life, this is not a rehearsal

 

[ednachman]

I hope this works. I don't know how to make the pictures larger so that you can read them.


Enjoy Life, this is not a rehearsal

 

[linney]

I can't see too much wrong with your log, other than the way it is presented in the post. You seem to have lots of breaks in the lines and some sort of extra spacing. This is making it very hard to read and decipher.

You could look at removing this "file missing" entry.

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)

More of a worry is way the posted format of your log is so nonconforming to what I normally see. This with the other problems you are seeing indicates a sick machine.

Yes, the images were a bit small too, not meaning to be hyper critical. What Display Resolution is your machine set at? Do you have a lower resolution that you can use to make them bigger, or a Photo Editing program to enlarge them?

You could try repairing windows by running it over itself. You will lose all your windows updates but your files will be untouched.

How to Perform an In-Place Upgrade (Reinstallation) of Windows XP (Q315341)

http://support.microsoft.com/kb/315341/en-us

 

[BadBigBen]

I agree with Linney, about deleting the BHO, and the following:

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

allow MSCONFIG to boot normally again...

The following are unnecessary startup entries, and can be fixed:

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

The following is recommended to be DISABLED:

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

about the screenshots:

Photobucket has a resize option when you upload a picture, but I have a feeling that SnagIt needs to be set up correctly, it may just create ThumbNails instead of full pictures...

a good size for readability is 640x480 or 320x240... and use the image tags or direct links (no attachments)...


Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"