[SOLVED] Strange trouble after malware removal

[sorcerer]

Got a Packard Bell OneTwo M3700 in running Win 7 Home Premium. It came to me because it was compromised with the Cheshire Police virus and it was a variant of said virus that I hadn't seen before.

Windows and all start-up programs would load as normal and it would take two or three minutes for the Cheshire Police screen to come up and lock the machine. After that, there was no way out except to power down.

It wouldn't let me boot into Safe Mode with Networking, nor Safe Mode with Command Prompt. Hitman Pro KickStart didn't work either - it would boot to the USB flashdrive and give me the choices screen, but after making my selection the computer then went into Windows auto startup-repair mode, which obviously failed. Kaspersky Rescue Disc (WindowsUnlocker/Regeditor/Scanner) was no help either.

I was a bit stumped and just about to ask here for help when I sort of stumbled on a way round it. Once the Police screen appeared and locked up the machine the only way out of that was to power down the machine by holding the power button in for four seconds. However, I held it in for just a second then released it, which initiated the normal shutdown routine and the first thing to disappear was the Police screen!!

That then allowed me to cancel shutdown and work in the machine as normal so I went straight to surfright.nl and immediately downloaded and ran Hitman Pro, then MBAM and a host of other malware scanners and the virus has now gone. Everything appears to be working alright - I can get on the internet, use programs like MS Office and play music etc., but one thing that isn't working is Task Manager.

Right-clicking the task bar and selecting 'Start Task Manager' results in a dialog box stating "Windows cannot find C:\Windows\system32\taskmgr.exe. Make sure you typed the name correctly and try again". Even going through Windows Explorer and navigating to C:\Windows\system32\taskmgr.exe manually, then right-clicking the .exe file itself to run it results in the same error message, so what can I do now folks?

 

[nlinecomputers]

Have you run SFC?

Sounds like a damaged or fake copy to me. Might just replace with a known good copy from another system.

 

[nlinecomputers]

Running Tweeking.com AIO repair tool might also be of help here.

 

[sorcerer]

Thanks Nline, will do.

 

[ohio_grad_06]

Agree with the tweaking tool. That's saved me from a reinstall after cleanup a couple of times.

 

[JustInspired]

...Once the Police screen appeared and locked up the machine the only way out of that was to power down the machine by holding the power button in for four seconds. However, I held it in for just a second then released it, which initiated the normal shutdown routine and the first thing to disappear was the Police screen!!

That then allowed me to cancel shutdown and work in the machine as normal...

Out of interest did you do a quick Win+R > 'shutdown -a' to abort the shutdown? Or do you have another method? I'm usually not fast enough to type this LOL.

I would suggest copying a good taskmanager file from a working computer too. Recently had one whose 'rasman.dll' file was damaged by malware and had to replace it with a known good copy.

 

[phaZed]

I abort my shutdowns with D7II

 

[B Trevathan]

Right-clicking the task bar and selecting 'Start Task Manager' results in a dialog box stating "Windows cannot find C:\Windows\system32\taskmgr.exe. Make sure you typed the name correctly and try again". Even going through Windows Explorer and navigating to C:\Windows\system32\taskmgr.exe manually, then right-clicking the .exe file itself to run it results in the same error message, so what can I do now folks?

Have you checked the IFEO for taskmgr ?:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
If instead of using regedit you use Autoruns and look under "Image Hijacks" you'll need to uncheck "Hide Microsoft and Windows Entries" and then uncheck "Hide Windows Entries" and then Refresh (F5).


Run Process Explorer and check the "Replace Task Manager" option under the Options menu and then close PE and open it again and uncheck "Replace Task Manager".

 

[sorcerer]

Good morning all - it's a dim and dismal Saturday morning here in Preston but I am one happy camper because, thanks to you good people here, this computer is now running well and everything seems to be as it should be.

SFC found no integrity violations but replacing taskmgr.exe with a copy from another computer solved the problem, so a sincere 'thank you' from me.

Julian - nothing as elegant as 'shutdown -a' I'm afraid. As the shutdown process began, the Police screen was the first to go and then I got that message that sometimes comes up saying that the system is waiting for xyz to shut down and it gives you the choice to either force close or cancel - I just clicked on the cancel button

Thanks again guys.