Hi gang, here's a tough one for everyone. I'm using win2k with all the latest patches. When I press ctrl+alt+del and click on task manager, nothing happens. Clicking on the actual exe file..nothing happens...BUT if i right click on the task bar, then choose task manager it comes up. Anyone have any ideas? It's bizarre!!!!
Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations Shaun E on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
Task Manager won't show up (W2k) 1
- Thread starter Chambers
- Start date
-
1
- #2
In a domain setting, I would suspect Group Policy settings. On a stand-alone machine, this is almost surely a virus.
Run the Trend Micro and Panda online scans from smah's FAQ: faqy760-3862
As an extra check, as this is one symptom of the blaster worm, download and run a specific blaster scanner. Make certain you have the blaster security Hotfix from MS installed. You can find resources for all of these items at:
Run the Trend Micro and Panda online scans from smah's FAQ: faqy760-3862
As an extra check, as this is one symptom of the blaster worm, download and run a specific blaster scanner. Make certain you have the blaster security Hotfix from MS installed. You can find resources for all of these items at:
- Thread starter
- #3
Well I don't think it's a group policy problem as this is not happenning to every machine, just 1. We're running mcafee with all the updates and all the critical updates on MS's site installed. I am doing the trend micro scan but do you think it could be something else? I thought that the msblast worm would let you open the app but then suddenly close it, this isn't the case here.
Chambers,
I use Norton AV, and I learned a long time ago the limitations of antivirus scanners.
Neither McAfee nor Norton nor xyz were prepared for non-virus worms, trojans, adware, malware, etc. and most continue to focus their product efforts on viruses.
Your issue is not a virus, and McAfee has no cause for complaint. I hope you do follow the suggestions I made above, and that a clean resolution is presented. If no joy:
Download and run in this order:
cwshredder *
SpyBot 1.2 *
AdAware *
* = Update the definition files within the program as the first step.
If still no joy, download and run Hijack This! and post the log here.
Be certain prior to the Hijack scan you hit the Configure button, and check to enable the listing of running processes. Under the tab, Misc Tools, check to enable the listing in the log files of empty and other entries.
I use Norton AV, and I learned a long time ago the limitations of antivirus scanners.
Neither McAfee nor Norton nor xyz were prepared for non-virus worms, trojans, adware, malware, etc. and most continue to focus their product efforts on viruses.
Your issue is not a virus, and McAfee has no cause for complaint. I hope you do follow the suggestions I made above, and that a clean resolution is presented. If no joy:
Download and run in this order:
cwshredder *
SpyBot 1.2 *
AdAware *
* = Update the definition files within the program as the first step.
If still no joy, download and run Hijack This! and post the log here.
Be certain prior to the Hijack scan you hit the Configure button, and check to enable the listing of running processes. Under the tab, Misc Tools, check to enable the listing in the log files of empty and other entries.
- Thread starter
- #5
bcastner,
Thanks for all the tips, I did everything you suggested and still the problem persists. I have all the ms security patches, ran the msblast removal tool, ran trend micro, cwshredder, spybot, and adaware...all found nothing unusual.
Postd the hijackthis log and am waiting for an answer, however i don't think they'll find anything, i didn't notice anything unusual in the log.
Any other ideas?
Thanks for all the tips, I did everything you suggested and still the problem persists. I have all the ms security patches, ran the msblast removal tool, ran trend micro, cwshredder, spybot, and adaware...all found nothing unusual.
Postd the hijackthis log and am waiting for an answer, however i don't think they'll find anything, i didn't notice anything unusual in the log.
Any other ideas?
- Thread starter
- #7
Here ya go.
Logfile of HijackThis v1.97.7
Scan saved at 2:03:30 PM, on 12/16/2003
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Altiris\AClient\AClient.exe
C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\System32\nslsvice.exe
C:\WINNT\System32\NTME\METHWNT.EXE
C:\WINNT\System32\NTME\brad32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\wltrysvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\bcmwltry.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\Webscanx.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\carpserv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\RightFax\FaxCtrl.exe
C:\Program Files\Cisco Systems\Aironet Client Monitor\ACUMon.Exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Documents and Settings\TBabinea.BWPTC\Desktop\tmp\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [RightFAX Print-to-Fax Driver] C:\Program Files\RightFax\FaxCtrl.exe
O4 - HKLM\..\Run: [ACUMon] "C:\Program Files\Cisco Systems\Aironet Client Monitor\ACUMon.Exe" -a
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O16 - DPF: {037790A6-1576-11D6-903D-00105AABADD3} (Seagull Web-to-Host Control Module v3) - O16 - DPF: {0A10045F-B8E6-11D1-BC4D-006008CCBF84} (ActiveProject Authentication Control v9.0.1) - O16 - DPF: {0A100525-B8E6-11D1-BC4D-006008CCBF84} (ActiveProject Version Control v9.0.1) - O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
Might have to just bite the bullet and call MS on this issue.
Logfile of HijackThis v1.97.7
Scan saved at 2:03:30 PM, on 12/16/2003
Platform: Windows 2000 SP3 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Altiris\AClient\AClient.exe
C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\System32\nslsvice.exe
C:\WINNT\System32\NTME\METHWNT.EXE
C:\WINNT\System32\NTME\brad32.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\wltrysvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\bcmwltry.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\Webscanx.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\carpserv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINNT\System32\hkcmd.exe
C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\RightFax\FaxCtrl.exe
C:\Program Files\Cisco Systems\Aironet Client Monitor\ACUMon.Exe
C:\Program Files\Palm\HOTSYNC.EXE
C:\Documents and Settings\TBabinea.BWPTC\Desktop\tmp\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [CreateCD50] "C:\Program Files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [RightFAX Print-to-Fax Driver] C:\Program Files\RightFax\FaxCtrl.exe
O4 - HKLM\..\Run: [ACUMon] "C:\Program Files\Cisco Systems\Aironet Client Monitor\ACUMon.Exe" -a
O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O16 - DPF: {037790A6-1576-11D6-903D-00105AABADD3} (Seagull Web-to-Host Control Module v3) - O16 - DPF: {0A10045F-B8E6-11D1-BC4D-006008CCBF84} (ActiveProject Authentication Control v9.0.1) - O16 - DPF: {0A100525-B8E6-11D1-BC4D-006008CCBF84} (ActiveProject Version Control v9.0.1) - O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
Might have to just bite the bullet and call MS on this issue.
The issue comes from the Cisco VPN client.
Cisco offers an Hotfix/Patch/Workaround for the issue.
There are a few items that personally I would not allow to run; this bothers me for example:
O4 - HKLM\..\Run: [CARPService] carpserv.exe
But this is a known problem with the Cisco VPN client.
Cisco offers an Hotfix/Patch/Workaround for the issue.
There are a few items that personally I would not allow to run; this bothers me for example:
O4 - HKLM\..\Run: [CARPService] carpserv.exe
But this is a known problem with the Cisco VPN client.
- Thread starter
- #9
- Status
