To the Tech Team:
I am at the last stages of malware removal with the skilled help of the Malware experts at Spybot. I think we have removed pretty much everything but there are some lingering problems that I hope you can help with (they referred me to this site). When I right click on the Task Bar and click Task Manager, nothing happens. If I right click on the Desktop and select Properties, the Display Properties dialog contains only ONE tab, Screensavers. The desktop is showing a generic blue background but underneath this is the custom wallpaper I want. I can't restore the desktop because I can't get to a dialog for this. There are probably other things broken but this will do for starters.

I imagine that the various malware has deleted registry keys or such. Is there a simple way of 1) determining if this is the case and; 2) restoring those keys?

Thank you very much.

Hi Rentnec... Welcome to WhatTheTech...

It is standard procedure here for helpers to request that you post the link to your malware removal thread with Spybot. This is so that we can review the thread and determine what may have happened and where to go from here.

You have a couple different problems as you mentioned. The display properties problem sounds like restrictive policies that were put in place. Download Dial-A-Fix and open the file. Run the dial-a-fix.exe file. When it first starts, if there are any restrictive policies in place it will pop-up a window notifying you of such. Use the option to remove all restrictive policies. Reboot your computer.

If policies were removed it is likely you will now have access to the necessary display properties. Dial-a-fix does not find all policies, and it may be necessary to take a close look if this doesn't work.

With Task Manager, try running the program manually and see if the file is present. Click start -> run -> type taskmgr and press ENTER. See if you get a file not found error or something like that. If you aren't, and task manager still isn't opening, it is almost 100% without a doubt you are still infected which is why it is nice for us to see the malware thread link.

The only other possibility that I can think of is that the file may have been replaced by a dummy file that does nothing. Open my computer, navigate to C:\windows\system32 and find the taskmgr.exe file. Report back here with the file size and modification date of the file as well as what service pack level you are running on Windows.

This post has been edited by appleoddity: Aug 21 2009, 09:40 AM