Jump to content
pilotguy1225

Task Manager Closing Every Time I Open

Recommended Posts

Hello,

I had some trojans and malware on my computer which I had removed previously, but it seems that Task Manager, which had persistently been closing upon opening (closing within 1 second) still has the same issue. Initially when this happened, my CPU kept staying at 100%, but that seems to have resided for now.

Thanks.

Share this post


Link to post
Share on other sites

Hi,    :welcome:

My name is Maurice. I will be helping and guiding you, going forward on this case.

Let me know what first name you prefer to go by.

 

Please follow my directions as we go along.  Please do not do any changes on your own without first checking with me.

If you will be away for more than 3 consecutive days,  do try to let me know ahead of time, as much as possible.

 

Please only just attach   all report files, etc  that I ask for as we go along.

Task manager ought not to be "closing" on its own.  In any event, the goal of this sub-forum is to help you to check about whether or not there is a malware infection.

Tell me, Have you done a scan with Malwarebytes for Windows ?

 

Please do the steps outlined on this pinned topic    https://forums.malwarebytes.com/topic/9573-im-infected-what-do-i-do-now/

Please know I help here as a volunteer.  and that I am not on 24 x 7.

Help on this forum is one to one.   Again, please be sure to ONLY attach report files  with your reply (s)  as we go along.  Do not do a copy / paste into main body.

Thank you,

Sincerely.

Share this post


Link to post
Share on other sites

Hello Maurice! You can call me Sid.

 

I have indeed done a scan with Malwarebytes for Windows. The first scan detected some Trojans and such, and the in the second scan, I added the Rootkit scan option. I will attach the logs below.

I am also attaching the FRST.txt and Addition.txt below.

 

Thank you :)

 

FRST.txt Addition.txt MalwarebytesLog1.txt MalwarebytesLog2.txt

Share this post


Link to post
Share on other sites

On the Log2,  the items were not removed.  The report shows " No Action By User "

I would like you to do a new scan with Malwarebytes for Windows.  One of the major goals here is to have it remove all that it detects.  If it finds anything that is.

Start Malwarebytes from the Windows  Start menu.

Click Settings ( gear icon)   at the top right of Malwarebytes window.   We want to see the SETTINGS window.

Then click the Security tab.   Look for the section "Automatic Quarantine".   Be sure it is clicked On   ( to the far right side)

 

Then scroll down to the section Potentially Unwanted items.   We need the next 2 lines   ( for P U P  & for P U  M)  to be set to "Always ( Recommended) ".

You can make the change by clicking on the down-arrow selection list-control.   We want all P U P  &  P U M to be marked for removal.

 

Next, click the small x on the Settings line   to go to the main Malwarebytes Window.

Next click the blue button marked Scan.

When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

Then click on Quarantine selected.

Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.

See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

 

 

Share this post


Link to post
Share on other sites
Posted (edited)

Hi, Sid.  OK.  Thanks  for that scan report.  1 item was detected and removed on the Downloads folder on D drive.

 

As far as Task Manager, the FRST report did show that it was aborting.  That is a Windows thing.  For the near term, I would like for your Windows 10  to be upgraded from Build 1803  to the more recent Build 1909.   More on that later on.

Quote

Error: (03/20/2020 04:49:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: taskmgr.exe, version: 10.0.17134.1, time stamp: 0xe3592b68
Faulting module name: taskmgr.exe, version: 10.0.17134.1, time stamp: 0xe3592b68
Exception code: 0xc0000005
Fault offset: 0x000000000006822e
Faulting process id: 0x29b0
Faulting application start time: 0x01d5ff0172c0c7bb
Faulting application path: C:\WINDOWS\system32\taskmgr.exe
Faulting module path: C:\WINDOWS\system32\taskmgr.exe
Report Id: a2b08a3a-6897-4d4a-a08c-586d722534a2
Faulting package full name: 
Faulting package-relative application ID:

 

 

For now, I would like to run a custom batch task to run System File Checker & to remove some odd auto-executed "Cleaning" job.  There is something called Cleaning specified like 5 times.  In addition, something called "Process.exe"   that is very highly suspicious.

Please Close and Save any open work you may have open.

Please close as many un-needed app-windows that you yourself may have open at this point.   So you can have a clear field of view.

 

This custom script is for  pilotguy1225    only / for this machine only.

Close and save any open work files before starting this procedure. 

 

Please Close and save any open work files before you start this next step.  It will involve a Windows Restart at the end of it.

I am sending a   custom Fix script which is going to be used by the FRST64 tool. They will both work together as a pair.

Please RIGHT-click the (attached file named) FIXLIST and select SAVE  link AS and save it directly ( as is) to the  Downloads  folder

The tool named FRST64.exe   tool    is already on the Downloads folder

Start the Windows Explorer and then, to the Downloads folder.


RIGHT click on  FRST64    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.

  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.

IF Windows prompts you about running this, select YES to allow it to proceed.

 

IF you get a block message from Windows about this tool......

click line More info information on that screen

and click button Run anyway on next screen.

 

on the FRST window:
Click the Fix button just once, and wait.

image.png.a609a1f43f8e359ec5fa70884c74bec5.png

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. This run here should be fairly quick.
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity   

[   2   ]

 See to it that Malwarebytes for Windows is not registered with the Windows 10  Windows Security Center.

Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with WindowsSecurityCenter Click theSecurity Tab. Scroll d.own to 

"Windows Security Center"

Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".

When done, close the window.

Then I suggested Restart-ing Windows.

Let me know, at that point,  How are things ?

 

 

Fixlist.txt

Edited by Maurice Naggar
Corrected typos for FRST64

Share this post


Link to post
Share on other sites

Hello Maurice!

 

Thank you so much. The fixlist seems to have wiped out virus, and I can now open task manager. Thank you so much for your help, I really appreciate it.

 

I have also attached the fixlog in case you need it.

 

Once again, thank you so much.

 

-Sid

Fixlog.txt

Share this post


Link to post
Share on other sites

Hi Sid.

That is a good run.  Thanks for the report-file.

Let me suggest to do 2 different scans, as follow up.

[    1    ]

I want to be sure that your Windows 10 is able to do a scan with the Windows 10 Windows Defender antivirus.   Just do a regular Quick scan with Windows Defender.

Open an elevated command prompt window i.e. run Command Prompt as an administrator .

It is best to use the Windows Copy ( CTRL+ C )  and paste  ( CTRL+V )  for the whole line, as-is

To Get the elevated command prompt, press Windows-key + X key  and then selected Command prompt ( Admin )

On that command prompt,  Copy & Paste this command

"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -SignatureUpdate & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 1

tap Enter-key to have it proceed.   Then just let it run, however long it takes.

Make a note of the final display results.

[   2   ]

I would suggest a free scan with the ESET Online Scanner
Go to https://www.eset.com/us/home/online-scanner/

Look on the right side of the page.  Click Scan Now
It will start a download of "esetonlinescanner_enu.exe"
Save the file to your system, such as the Downloads folder, or else to the Desktop.

Go to the saved file, and double click it to get it started.
When presented with the initial ESET options, click on "Computer Scan".

Next, when prompted by Windows, allow it to start by clicking Yes

When prompted for scan type, Click on Full scan
Look at & tick   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on Start scan button.

Have patience.  The entire process may take an hour or more. There is an initial update download.
There is a progress window display.
You should ignore all prompts to get the ESET antivirus software program.   ( e.g.  their standard program).   You do not need to buy or get or install anything else.

When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.

Click The blue “Save scan log” to save the log.

If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at bottom).

Press Continue when all done.  You should click to off the offer for “periodic scanning”.

 

I will cover the Windows 10 Build update on the next pass.   Let me know if you need something else.

Share this post


Link to post
Share on other sites

Good morning, Sid.  I hope you are doing well.

How are things ?  Did you see my reply from Saturday afternoon ?

Share this post


Link to post
Share on other sites

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Thanks

 

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.