Task Manager Immediately Close When I Open It

[daffariskyp]

Hello, recently (about 4 days ago) I just realize I can't open my Task Manager. Its immediately closes after a few second. I did search about it on internet, and then I found this thread https://forums.malwarebytes.com/topic/207404-task-manager-opens-then-immediately-closes/ . I think I got same problem as that thread, but I would like someone to help guiding me step by step regarding my problem.

Thank You.

[Maurice Naggar]

Hi,       
My name is Maurice. I will be helping and guiding you, going forward on this case.
Let me know what first name you prefer to go by.   

 

Please understand we cannot have any idea what is going on without collecting a full set of reports  

Please follow my directions as we go along.  Please do not do any changes on your own without first checking with me. 
Please only just attach   all report files, etc  that I ask for as we go along.

I would appreciate  getting some key details from this machine in order to help you forward.
 NOTE: The tools and the information obtained is safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

Do have patience while the report tool runs.  It may take several minutes.  Just let it run & take its time.  You may want to close your other open windows so that there is a clear field of view.
Download Malwarebytes Support Tool
    
    Once the file is downloaded, open your Downloads folder/location of the downloaded file
    Double-click mb-support-1.7.0.827.exe  to run the report

Once it starts, you will see a first screen with 2 buttons.  Click the one on the left marked "I don't have an open support ticket".

        You may be prompted by User Account Control (UAC) to allow changes to be made to your computer. Click Yes to consent.
        
    Place a checkmark next to Accept License Agreement and click Next
Now click the left-hand side pane "I do not have an open support ticket"

    You will be presented with a page stating, "Get Started!"
    Do NOT use the button “Start repair” !   But look instead at the far-left options list in black.

    Click the Advanced tab on the left column
    
    Click the Gather Logs button
    
    A progress bar will appear and the program will proceed with getting logs from your computer.  Please do have patience.  It takes several minutes to gather.
   
    Upon completion, click a file named mbst-grab-results.zip will be saved to your Desktop. Click OK.  Then Exit the tool.

    Please attach the ZIP file in your next reply.

Please know I help here as a volunteer.  and that I am not on 24 x 7.
Help on this forum is one to one.   Again, please be sure to ONLY attach report files  with your reply (s)  as we go along.  Do not do a copy / paste into main body.

Thank you,
Sincerely.

[daffariskyp]

Thanks for your reply!
You can call me Daffa.

I already did as you say, I'll attach the file.

 

Thank You.

mbst-grab-results.zip

[Maurice Naggar]

Hello Daffa.   Thank you for the support-tool report.  First thing, we need to keep in mind is that not all cases are the same.

I just wonder whether if you recall anything significant happening recently before this sort of behavior.

We are going to take one thing at a time.   I notice the most recent scan with Malwarebytes for Windows had found a number of items tagged related to Chrome and its Sync option.

I would like to be sure that all that is taken care of,  and to do a new scan  & then see the result.

I want you to be sure that you close Chrome & any other web browser that is open  just before you click the "scan" button on this next scan with MB.

[    1      ]

lets make sure that Windows File Explorer is able to show all folders, including any Hidden ones.

 Use the Option Two as in this article at Tenforums

https://www.tenforums.com/tutorials/9168-show-hidden-files-folders-drives-windows-10-a.html

.[       2       ]

Use Chrome browser   to go to https://www.google.com/settings/chrome/sync

 and sign into your account.
Scroll down until you see the "reset sync" button and click on the button
At the prompt click on "Ok". 

Close the Google tab.    You should close Chrome if you  do not have to have it open.   

I notice a very recent IP bock on IP  151.80.103.169    by the  Mlawrabytes web protection.   Please see if you can close Chrome & for the time being use EDGE instead.

[       3        ]

Run a scan with Malwarebytes.
Start Malwarebytes from the Windows  Start menu.
Click Settings ( gear icon)   at the top right of Malwarebytes window.   We want to see the SETTINGS window.
Then click the SECURITY  tab.
Scroll down and lets be sure the line in SCAN OPTIONs for "Scan for rootkits" is ON
Click it to get it ON  if it does not show a blue-color
Now click the small X  to get back to the main menu window.

Click the SCAN button.
Select a Threat Scan ( which should be the default).
When the scan phase is done, be real sure you Review and have all detected lines items check-marked on each line on the left. That too is very critical.

You can actually click the topmost left  check-box  on the very top line to get ALL lines  ticked   ( all selected).

Then click on Quarantine selected.

Be sure all items were removed

Then, locate the Scan run report;  export out a copy;  & then attach in with your  reply.
See https://support.malwarebytes.com/hc/en-us/articles/360038479194-View-Reports-and-History-in-Malwarebytes-for-Windows-v4

 

Have patience.   We will do more later.

[daffariskyp]

Thanks again for your reply.

I think there isn't nothing special that I remember before this happen. Sorry if it's not helping you.

[ 1 ]

I already did as you say.

[ 2 ]

Done, I close my Chrome, and using EDGE right now.

[ 3 ] 

Done, i'll attach the report.

scan report.txt

[Maurice Naggar]

Thank you for that MB scan report.   This last scan found & removed several P U P

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Manual
Result: Completed
Objects Scanned: 445032
Threats Detected: 19
Threats Quarantined: 19

.

NEXT
 

I  would suggest to download, Save, and then run Malwarebytes ADWCLEANER.
Please close Chrome and all other open web browsers after you have saved the Adwcleaner and before you start Adwcleaner scan.
Adwcleaner  detects factory Preinstalled applications too! 

Please download  Malwarebytes AdwCleaner https://downloads.malwarebytes.com/file/adwcleaner

 
Be sure to Save the file first, to your system.  Saving to the Downloads folder should be the default on your system.

Go to the folder where you saved Adwcleaner. Double click Adwcleaner  to start it.
At the prompt for license agreement, review and then click on I agree.

You will then see a main screen for Adwcleaner. ( if you do not see it right away, minimized the other open windows, so you can see Adwcleaner).
Then click on Dashboard button.
Click the blue button "Scan Now".

allow it a few minutes to finish the Scan.   Let it remove what it finds.
NOTE:  When it comes to the section "
Pre-installed applications

You can skip that.
Please find and send the Adwcleaner "C" clean report.
In Adwcleaner, click the "Reports" button.  Look at the list of reports for the latest date & type "Clean".
Double Click that line & it will open in Notepad.   Save the file to your system and then Attach that with your reply.

That C clean report will be the one with the most recent Date and time at folder  C:\AdwCleaner\Logs
Thanks.  Keep me advised.
 

[daffariskyp]

Thanks again for your reply!

I downloaded the AdwCleaner, and I have done the scan. Now it's ask me to restart my pc. Should I do it before i report my logs?

Thanks You.

[Maurice Naggar]

Restart the pc  by following the prompts.    Go ahead and go forward by doing as prompted.   Then attach the report,  and give me a overall idea of how things are at this point.

😊

[daffariskyp]

I have done as you say, I'll attach the report. Things are pretty good right now. You explain step by step clearly.

Thank You.

AdwCleaner[C00].txt

[Maurice Naggar]

Thanks for that report.  There was only just 1 registry line that was removed.

Let me know if there is any new block notice from the Malwarebytes web protection , a block about IP   151.80.103.169

I would also like a new / different report:

Let’s  please try to get and run a special  report  tool from Microsoft. 
It does not make changes. It will be just a report.

Please download Sysinternals Autoruns from here and save it to your desktop.

Note: you also need to do the following:

Right-click on Autoruns.exe and select Properties
Click on the Compatibility tab
Under Privilege Level check the box next to Run this program as an administrator
Click on Apply then click OK

Double-click Autoruns.exe to run it.
Once it starts, please press the Esc key on your keyboard.
Now that scanning is stopped, click on the Options button at the top of the program and select Filter Options...
In the Autoruns Filter Options dialogue, verify that the following are unchecked, if they are checked, uncheck them:

• Include empty locations
• Hide Microsoft entries
• Hide Windows entries

Verify that the following is checked, if it is unchecked, check it:

• Verify code signatures
• Check VirusTotal.com

 

Once that's done press the F5 key on your keyboard, this will start the scan again, this time let it finish.
When it's finished and says Ready. on the lower left of the program window, please click on the File button at the top of the program and select Save and save the Autoruns.arn file to your desktop and close Autoruns.

Right click on the Autoruns.arn file on your desktop and hover your mouse over Send To and select Compressed (zipped) Folder
Attach the Autoruns.zip folder you just created to your next reply

Thank you.

[daffariskyp]

Thanks again for your reply! I'm very sorry for my late reply.

Okay, I have done as you say, I'll attach the report.

Thank You

Autoruns.zip

[Maurice Naggar]

Thanks for that report.

I would suggest a free scan with the ESET Online Scanner
Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

It will start a download of "esetonlinescanner.exe"
Save the file to your system, such as the Downloads folder, or else to the Desktop.

Go to the saved file, and double click it to get it started.

When presented with the initial ESET options, click on "Computer Scan".
Next, when prompted by Windows, allow it to start by clicking Yes

When prompted for scan type, Click on Full scan
Look at & tick  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on Start scan button.
Have patience.  The entire process may take an hour or more. There is an initial update download.
There is a progress window display.

You should ignore all prompts to get the ESET antivirus software program.   ( e.g.  their standard program).   You do not need to buy or get or install anything else.

When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
Click The blue “Save scan log” to save the log.

If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at bottom).
Press Continue when all done.  You should click to off the offer for “periodic scanning”.
 
 

[daffariskyp]

Thanks again for your reply.
Finally the scan is over, I'll attach the report.

Thank You.

ESET report.txt

[Maurice Naggar]

Thanks for that ESET report.   It did do cleanups of some hack tools & other potentially harmful files.

The Microsoft Safety Scanner  is a free Microsoft stand-alone virus scanner that  can be used to scan for & remove malware or potentially unwanted software from a system. 
The download links & the how-to-run-the tool are at this link at Microsoft 
https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 
  
Let me know the result of this.
The log is named MSERT.log  
the log will be at  %SYSTEMROOT%\debug\msert.log   which in most cases is
C:\Windows\debug\msert.log
Please attach that log with your reply.    And also give me some idea as to the main/original issue.
 

[daffariskyp]

Thanks again for your reply! 
The scan finally done, I'll attach the report.

Thank You.

msert.log

[Maurice Naggar]

Thanks for the scan run log of the MS Safety Scanner.   It found a few 'threats'

Results Summary:
----------------
Found HackTool:Win32/Keygen, partially removed.
Found Trojan:Win32/Occamy.C, partially removed.
Found Trojan:Win32/Tiggre!rfn, partially removed.
Found Trojan:Win32/Vagger!rfn, partially removed.
Found HackTool:Win32/AutoKMS and Removed!
Found VirTool:Win32/DefenderTamperingRestore and Removed!

 

A number of those were downloaded files.   Please be extremely careful  what files you download, with special caution as to where from.

Free stuff can often be bundled with malware.

.

I am concerned as to what antivirus program exactly is installed & supposedly running as the resident antivirus.  Early on, the indication was that McAfee VirusScan is installed.

However looking back on the early report,  I do not see if it is installed actually.   I can get this system back onto Windows Defender as needed, just do not go installing on your own a 3rd party antivirus.

Lets take a time out  and run this special report tool.    It is a report only.

SecurityCheck by glax24    

I would like you to run a tool named SecurityCheck to inquire on the current-security-update  status  of some applications.
Download SecurityCheck by glax24 from here  https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe
and save the tool on the desktop.

If Windows's  SmartScreen block that with a message-window, then
Click on the MORE INFO spot and over-ride that and allow it to proceed.

This tool is safe.   Smartscreen is overly sensitive.
Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"   and reply YES to allow to run & go forward
Wait for the scan to finish. It will open in a text file named SecurityType.txt. Close the file.  Attach it with your next reply.
You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt
 

[    2    ]

Download   Farbar's Service Scanner utility
http://www.bleepingcomputer.com/download/farbar-service-scanner/dl/62/

and Save to your Desktop.
Right-Click on fss.exe and select Run As Admisnitrator.
 
Answer Yes to ok when prompted.
If your firewall then puts out a prompt, again, allow it to run.

Once FSS is on-screen, be sure the following items are checkmarked:

Internet Services
Windows Firewall
System Restore
Security Center/Action Center
Windows Update
Windows Defender
Other services

 

Click on "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Attach the report  file      FSS.txt into your reply. 

[daffariskyp]

Thanks again for your reply!

Okay, I'll be careful later.

I don't remember installing McAfee recently, if I recall correctly it was installed when I buy this laptop (and then I uninstall it),

 

[1]

I have done as you say, I'll attach the report.

[2]

I have done as you say, I'll attach the report.

 

Thank You.

SecurityCheck.txt FSS.txt

[Maurice Naggar]

Thank you for the reports.   Since Malwarebytes on this pc is just in trial or free mode,  we need to do one adjustment.

There is one setting in Malwarebytes that needs to be off.   
Start Malwarebytes. Click Settings ( gear ) icon. Next, lets make real sure that Malwarebytes does NOT register with Windows Security Center 
Click the Security Tab. Scroll down to 
"Windows Security Center"
Click the selection to the left  for the line "Always register Malwarebytes in the Windows Security Center".

{ far left is the OFF position }
Close Malwarebytes when done.

.

A few items pointed out by the SecurityCheck tool:

Uninstall    Java 8 Update 45       That is way out of date & insecure.    Your system does not need any Java  unless perhaps a specific app needs it.

Java 8 Update 45 (64-bit) v.8.0.450 Warning! Download Update
Uninstall old version and install new one (jre-8u261-windows-x64.exe).

.

Adobe Reader XI (11.0.23) v.11.0.23 Warning! This software is no longer supported. Please uninstall it and use Adobe Acrobat Reader DC.

 

------- [ UnwantedApps ] -----
Driver Easy 5.6.12 v.5.6.12 Warning! Suspected demo version of anti-spyware, driver updater or optimizer. If this program is not familiar to you it is recommended to uninstall it and execute PC scanning using Malwarebytes Anti-Malware. Possible you became a victim of fraud or social engineering.
KMSpico Warning! Crack, hacktool or keygen.

.

KMSPICO is one of those "free"  type things that are often bundled with malware.   It also causes problems.

DriverEasy   --- most driver auto-updaters are just snake oil junk.   You can get hardware drivers directly from your hardware manufacturers.

.

As to third-party ( non-Microsoft ) antivirus programs,   I need you to check what is listed as installed.   Do you see anything for McAfee Personal Security ?

or any MCAFEE ?

Please check & advise me.   We will do more  later.

[daffariskyp]

Thanks again for your reply!

I have done as you say, I turned off "Always register Malwarebytes in the Windows Security Center".

I uninstalled my Java, Adobe Reader, and DriverEasy. Then installing the up-to-date Java and Adobe Acrobat

 

I saw McAfee Personal Use, and I uninstalled it.

[Maurice Naggar]

Good afternoon.   I hope you are doing well.

Before we do anything else, we need to make time to do a run of the Microsoft CHKDSK

There were system notations about bad disk block on the system drive.

Quote

Error: (09/21/2020 06:25:02 PM) (Source: disk) (EventID: 7) (User: )
Description: The device, \Device\Harddisk0\DR0, has a bad block.

 

At this point, Close and save any open work files  ( if any).   Close the programs you started  & that are open at this time/

Click on Start and type in CMD.EXE and when it shows on the menu right click and select "Run as administrator"

Then copy / paste the whole line  ( as is )     and press the Enter key. It will say it cannot lock the drive.  if prompted     Press the Y key to allow it to run after a restart.

ECHO Y|CHKDSK c: /F 

Then  press the Enter-key.    There will be a notice message that the run will be scheduled for next restart.

Then do a Windows RESTART     and let the disk check run.

Let me know the result  / let me know after that completes.

[daffariskyp]

Thanks again for your reply!

I have done the Microsoft CHKDSK as you say. Is there somefile that I need to report?

Thank You.

[Maurice Naggar]

Hello.   That is ok.

I would like to do one follow up for Microsoft Windows Defender antivirus.   Since it appears it is the only currently installed antivirus.

The Windows 10 Microsoft Windows Defender antivirus is a fine one.   We just need to insure that it is all ON  ( enabled ).

The following custom script is to insure Windows Defender is enabled, do a quick scan with it, also run the System File Checker app.

Please be sure to Close any open work files, documents,  any apps you started yourself  before starting this.

 

 

The system will be rebooted after the script has run.

.

This custom script is for  Daffariskyp  only / for this machine only.

 
Close and save any open work files before starting this procedure.    If there are any CD / DVD / or USB-flash-thumb or USB-storage drives attached,  please disconnect any of those.

I am sending a    custom Fix script which is going to be used by the FRSTENGLISH  tool. They will both work together as a pair.

Please RIGHT-click the (attached file named) FIXLIST and select SAVE  link AS and save it directly ( as is) to the  Downloads  folder

The tool named FRSTENGLISH .exe   tool    is already on the Downloads
Start the Windows Explorer and then, to the Downloads folder.

RIGHT click on  FRSTENGLISH    and select RUN as Administrator and allow it to proceed.  Reply YES when prompted to allow to run.
  to run the tool. If the tool warns you the version is outdated, please download and run the updated version.
IF Windows prompts you about running this, select YES to allow it to proceed.

IF you get a block message from Windows about this tool......
click line More info information on that screen
and click button Run anyway on next screen.

on the FRST window:
Click the Fix button just once, and wait.

 

PLEASE have lots and lots of patience when this starts. You will see a green progress bar start. Lots of patience. This run here should be fairly quick.
If you receive a message that a reboot is required, please make sure you allow it to restart normally.
The tool will complete its run after restart.
When finished, the tool will make a log ( Fixlog.txt) in the same location from where it was run.

Please attach the FIXLOG.txt with your next reply later, at your next opportunity   

Please know this will do a Windows Restart.   Just let it do its thing.  

Fixlist.txt

[daffariskyp]

Thanks for your reply!
Where did I get the FRSTENGLISH.exe file?

 

Thank You.

[Maurice Naggar]

It gets placed when you ran the support tool that I had asked you to run.    Tell me, did you do the procedure ?   If not, please do so.

The FRSTENGLISH is on the Downloads folder.

Thanks.

[daffariskyp]

Thanks again for your reply!

I done all support tool you asked. I think I deleted the FRSTENGLISH.exe. My bad, I'll try do the farbar service scanner 1 more time. I'm so sorry.

 

Thank You.