Tuesday, September 8, 2009

Task Manager will not start or open

After removing the "Windows Protection Suite" spyware from a computer system, you may find that the Task Manager will not open. Searching the Internet, you may come across many solutions adding the following key to the registry:

"[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]"
DisableTaskMgr"=dword:00000000

This is the solution if you get the "Task Manager has been disabled by your administrator" error message, from spyware. Google the aforementioned error to get links to reg edit files.However, if you still have difficulty opening Task Manager after you apply the above fix, I came across a solution as follows:

Expand the following subkey:
"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]"

If 'taskmgr.exe' is listed, DELETE it!

Now the Task Manager should open by Ctrl-Shift-Esc, or right-clicking the taskbar and select "Task Manager", etc.

Hope this helps. Thanks.

Wednesday, September 2, 2009

Computer Hangs on Windows XP Splash Screen during boot-up

Here's one that I ran across, that took a little while to resolve.

When Windows XP is booting up, the blue scrolling bar will lock-up or hang. The hard drive light will be off, and nothing will happen. No BSOD (Blue Screen of Death)

If you boot the computer into "Safe Mode", it boots fine. So, what's the problem and subsequent solution? Well, read on...

First, I would like to also point out that this computer has both VGA & DVI monitor ports with subsequent connectors on them, to two monitors.

Next, I found the monitor card's heat-sink butted up against a TV Tuner card.

Lastly, this was a older Sony VIAO tower (between 3-6 years, roughly)

What it ended up to be the issue, is that when the monitor card was switching the DVI port to a digital signal (in normal boot mode), the computer would lock. This was due to the GPU chip was EXTREMELY HOT! (burnt my fingers), thus damaging the digital circuitry on the card.

In "Safe Mode", the digital port was being used as an analog signal, thus normal operation.
I also noticed a tremendous amount of dust/dirt where the video card heat-sink fan baked onto the TV tuner card.

I did switch the monitor inputs to verify that the card was the culprit, in case you're wondering.
If I cloned the VGA to the DVI port, I would also get a display, but expanding the desktop to the DVI port monitor resulted in NO display.

So, the resolution was to replace the video card.

Hope this helps your particular situation. Thanks.

Sunday, August 2, 2009

AVG, Windows Defender, Malwarebytes, etc - All close when scanning starts

Here's one that got me for a while.

When you install any of the following, AVG Anti-Virus, Windows Defender, SpyBot Search & Destroy, Malwarebytes Anti-Malware, etc., and try to scan the system to remove any malware, the scan stops, the program closes, then it seems the files have been deleted (like the program was never installed).

Well, I took the drive out of the system and scanned it for virus'/malware/spyware, or so I thought.

Once I put the drive back, I continued to have the problem. So, after trying to research this for hours and looking at solutions and trying different things. I took the drive out and re-scanned it.

FOUND IT!! Trojan Crypt.BGE on the C:\Windows\System32\netlogon.dll file.

Deleted the file and copied it from a clean system.

Booted the machine back up and was able to install Malwarebytes Anti-Malware and scan and clean the system.

Then, I had a problem with installing Windows Defender. It had a permission problem and couldn't install key registry edits. This was resolved by resetting the permissions in the registery. (See: http://www.winhelponline.com/blog/reset-the-registry-and-the-file-permissions-in-windows-xp/ ). Okay, that fixed Defender.

Spybot wouldn't install. Stated the the 'SpyBotSD.exe' was already there. I couldn't even see it to delete it or just delete the main folder altogether. Took the drive out and hooked up to another machine and ran a basic chkdsk. This fix the File System. I was then able to delete the files and folder properly and reinstall Spybot. Okay, that one's fixed.

Lastly, AVG wouldn't install. There was again, another Registry edit error. This time I found that the permissions for the 'HKLM\Software\Microsoft\Windows NT\CurrentVerision\Windows' key wouldn't allow ANY edits. I took ownership of the key folder(changed administrator), tried to "Copy" permissons (Access Denied), tried to add "Administrators" group(Full Control), and just kept doing it over and over, then it stuck. Then the proper entries magically came up. I reinstalled AVG and SUCCESS!!Final scan of the hard drive and applied missing Microsoft updates and the computer is done and I can get it back to the owner.

WHEW! Glad that's over.

Thursday, July 23, 2009

XP "Server" service hangs on boot - 15 min delay

Ok, so I have a client on Monday, July 20th, wanting a new router installed for wireless capabilities. After completing the task, she asks if I can resolve an Excel install issue everytime she opens Excel. Sure, shouldn't be too difficult. Where's the install CD?

Well, I stick the CD in the tray and setup starts (or I think it does). No wait, Task Manager is stating that setup is running. Ok. So where's the Install screen? Funny. Let's try something else. Nope, but TM states that the install is started. Other installation, uh huh!

WTF! Let's restart the system. Okay, now were getting somewhere. Net Logon service is hanging on "Stopping" and Server service is hanging on "Starting". After an extensive period of time, they would eventually get to there desired states.

After numerous MSCONFIG cycles and reboots, I came upon a possible solution by Rick at http://www.dslreports.com/forum/remark,9240123

Seems that the installed printer Dell V505 had services( loading upon bootup. This caused the system services to hang for a period of time. So the solution provided to Rick was to cause the printer services(dlcg_device & dldw_device) to load AFTER the Server service. This was corrected via the registry.

Once completed the computer booted up without any services hanging. Issue resolved. Customer happy.

Friday, July 17, 2009

PC Security 2009 malware issue

Today, I got a call from one of my customers stating that they have some pop-up requesting that the they purchase software to remove virus' and spyware from their computer.This turned out to be PC Security 2009 malware.

I downloaded Malwarebytes Anti-malware software from malwarebytes.org to remove this threat.

I killed the PCSecurity2009.exe process via Task Manager.

Deleted the folder "c:\Program Files\PC_Security2009". Then ran a full scan of Malwarebytes s/w to remove reg edits and check the system.

She's okay now, but don't know how she is the only one getting re-infected with different pieces of spyware (just had a thought to check for rootkits).