Trying to remove spyware in Vista, but can't run task manager!

steinooo · 19 Dec 2010 at 18:46

Hi all,

i'm trying to get rid of what looks to be spyware called "Internet Antivirus 2011" on someone's Vista computer but even though I've manually removed a load of exes and reg entries, even when I boot into safe mode i cant run task manager or Ad aware which I've just installed.

Has anyone got any tips on how I can at least run the Task Manager or Ad Aware programs please?

steinooo · 19 Dec 2010 at 19:01

yes i can run regedit, managed to get rid of some of the keys as per http://www.pcthreat.com/parasitebyid-15431en.html

steinooo · 19 Dec 2010 at 19:22

Draeger said:
Further details HERE

thanks for that, but there's nothing in that key which disables taskmgr. It must be disabled from somewhere but I cant think where. I'm searching the reg for taskmgr at the moment but am not confident about what might be legit or not.

steinooo · 19 Dec 2010 at 19:27

andy_mk3 said:
Try safe mode with command prompt and open explorer.exe, then you should be able to tackle the spyware

I can open explorer.exe in normal safe mode

steinooo · 19 Dec 2010 at 19:28

The only mention of taskmgr that I don't particularlly like the look of is HKLM\Software\MS\Windows NT\Current Version\Image File Execution Options but no idea if its a legit entry or not. I don't let computers defeat me but this is really annoying me lol. I thought installing Adaware would mean that I could at least run the damn program but no!

steinooo · 19 Dec 2010 at 20:37

james.miller said:
if task manager is disabled, try process explorer instead http://technet.microsoft.com/en-us/sysinternals/bb896653

so far its worked for me every time

wow great plan, never thought of a sysinternals tool. nice tip.

darael said:
Download Malwarebytes Anti-Malware and the latest defintions, then install and run a quick scan in safe mode. After hopefully getting rid of the worst, run a full scan.

After removing any left overs found from MBAM's full scan, install and update Spybot Search & Destroy and run a scan.

cheers, Spypot found 170 odd things but couldn't clean the hosts file, so it asked to be rerun which i'm doing now. taking a lonnnnnnnnnng while on startup! Interesting that Spybot ran but Adaware didn't

Draeger said:
I'm guessing you already did but have you tried looking for it in the GP Editor?.

yep, that wouldn't run either.