Tech: Ctrl Alt Del - why doesn't it work?

Subject: Tech: Ctrl Alt Del - why doesn't it work?
From: BanjoRay
Date: 28 Sep 04 - 10:42 AM

I have windows XPpro on my machine. A most useful feature of this OS is the Ctrl Alt Del key combination which enables you to get rid of unwanted or crashed programs. Recently it stopped working around the time I used Norton in safe mode to get rid of a virus, and hasn't worked since. Does anyone know how to correct this?
Thanks in advance
Ray

Subject: RE: Tech: Ctrl Alt Del - why doesn't it work?
From: Nick
Date: 28 Sep 04 - 10:57 AM

Firstly, I presume you have rebooted the machine before all this? ie controlled shutdown and proper cold start.

Second thing to is to check you haven't got rubbish under the keys - it's often the case.

Keyboard upside down, bit of blowing, hit the keys hard etc

Try an ALT-[key] combination and see if it works
Try an CTR-[key] combination and see if it works
etc

Subject: RE: Tech: Ctrl Alt Del - why doesn't it work?
From: mooman
Date: 28 Sep 04 - 11:04 AM

Dear Ray

Others may well be more expert than me on this but one possible solution might be (also in safe mode) to use the facility of XP to revert to the "last good configuration" (or similar words). Depending on the nature of the virus there could be corruption to a registry key. If there is a registry problem I can also recommend "Fix-it Utilities" from VCOM as a good alternative to Norton Tools if you do not have them.

I'd prefer that you don't try this till someone more knowledgeable than myself posts on this problem.

Peace

moo

Subject: RE: Tech: Ctrl Alt Del - why doesn't it work?
From: Nigel Parsons
Date: 28 Sep 04 - 12:56 PM

The "last good configuration" mentioned by Mooman is the 'Restore' facility.
Well worth a try & it never (Well, hardly ever) [gratuitous G&S quote] messes anything up.
Find it from: Start; All programs; Accessories; System Tools ; System Restore;
From there it will walk you through it.

Nigel

Subject: RE: Tech: Ctrl Alt Del - why doesn't it work?
From: JohnInKansas
Date: 28 Sep 04 - 03:00 PM

If possible, you need to go to the Norton (or any other good AV maker's) website and see if you can find details on the virus that you removed. While you are there, you should let the AV site do a remote scan to make sure that you don't still have a virus on the machine.

There are very few instances with XP in which it's necessary to run Norton in Safe Mode (or to use Safe Mode at all), so it must be assumed that you had one of the really nasty ones. A few recent ones attempt to disable or corrupt the AV files on the machines that they infect, and do occasionally succeed.

Even if, perhaps especially if, you don't remember the name of the virus, or can't find it, a remote scan via an AV website is recommended. Since you're using Norton, it would be well to let the Norton site scan your machine AND do a manual run of Norton Update. This will make sure that the virus was successfully removed, that it wasn't restored (see below), and that your AV hasn't been corrupted by it.

In normal operations, System Restore is a reliable function, and for normal operations it should be turned on. You should almost never need to manually request a System Restore, but XP may use it - without even telling you - to make minor patches when you reboot.

The difficulty, when there is a virus involved, is that System Restore may have recorded a "last safe configuration" in which the entries made by the virus have already been made in the registry. If this is the case, running System Restore will "reinstall" the virus.

The backup files that System Restore makes are specially sequestered, and even Norton - even in Safe Mode - is not supposed to be able to touch them. The only approved method for deleting old and possibly contaminated backups from System Restore is to simply TURN OFF System Restore. When you do this, all stored copies are deleted by System Restore itself, which is, by design, the ONLY utility that is ever supposed to be able to access them.

You should not turn off System Restore unless there is a known good reason for doing so, as when it is recommended by the instructions for removing a specific virus. If it is needed, you will find "how to turn off" instructions in the virus removal procedure that you should get from a reliable AV source. You should turn System Restore back on when you've solved your problem.

There is the possibility in this case that you do just have a sticky keyboard. If you have an old keyboard around, swapping it, rebooting, and seeing if Ctl-Alt-Del works would tell you. (You can use a very old junker, since only those three keys really have to work to try it out, as long as it "connects" on boot.)

Ctl-Alt-Del can sometimes take a seemingly long time to turn on Task Manager, if the CPU is "very busy." If the CPU is busy enough to prevent Task Manager from opening, then you probably have problems elsewhere. Corruption of files by your virus, reinstallation of the virus from System Backup, or a new virus are Mong the possibilities. You can use other management tools via Start - Ctl Panel to try to find out what's going on, but you're not likely to find out much this way without an experienced helper who can get to your machine. You might get a clue by opening System Monitor (Start - Programs - Accessories - System Tools) to see if the CPU is locked up at 100%.

WinXP (and Win2K) also allows you to reset the Ctl-Alt-Del combination to be required for logon. If this reset is done, deliberately or accidentally, the key combination will give you a logon screen. ONE of the options offered on a "window shade" list is to run Task Manager. This (rarely) might happen if a virus or spyware program has attempted to insatll itself on your machine as a separate user.




You should also be able to Right-Click on a blank spot on the Task Manager toolbar at the extreme lower right corner of you screen (If you haven't moved your toolbar), Select Task Manager from the list to open it. This will at least tell you if there's a problem in Task Manager.

John

Subject: RE: Tech: Ctrl Alt Del - why doesn't it work?
From: JohnInKansas
Date: 28 Sep 04 - 03:04 PM

P.S. to above. Ignore the instruction for starting System Monitor. I forgot I'd changed my setup, so it won't work that way for most. Last paragraph above really tells where to get the info.

John

Subject: RE: Tech: Ctrl Alt Del - why doesn't it work?
From: BanjoRay
Date: 29 Sep 04 - 07:08 AM

Thanks, guys. Had to turn off system restore when my virus was being removed. Ran Norton from website - it found IRC.worm.gen attached to a Word file on my spare hard disk. I deleted it, then ran it again - virus gone. Ctrl Alt Del still doesn't work, and right clicking the task bar gives me task manager as an option. When I select it, nothing happens.
What can I do now?
Ray

Subject: RE: Tech: Ctrl Alt Del - why doesn't it work?
From: JohnInKansas
Date: 29 Sep 04 - 11:29 AM

I don't find anything at the Mickey$oft Knowledge Base that's specific to Task Manager failure. There are several configuration options that will make it appear differently, or that will cause the Ctl-Alt-Del combination to do other things. Most of the settings involved are found at Start - Control Panel - Administrative Tools - Computer Management – Local Users and Groups – Users.

If you have - or have had - more than one user defined, even if it's just you as a user and you as an administrator, changes may have been made here that would make Task Manager open differently. If you've been into this area of Control Panel without complete understanding of what's there (happens to me all the time – I usually just quite without changing anything) it's possible that you made unintended changes.

Regardless of any changes you might have made, or that your recent virus may have made, Task Manager should open when you right-click the Task Manager (Sys Tray) toolbar at the lower right of your screen. Failure to open from there indicates that a file is missing or corrupted. This is probably consistent with your description of Norton's requirement for safe mode to remove the virus. Norton will attempt to remove or quarantine only the viral component, if possible. The next step, if the viral part can't be removed, is to delete the file that contains it. In safe mode, Norton can usually delete an irreparably infected file even if it's a file critical to machine operation.

It is possible that restoring TASKMAN.EXE, the main Taskmanager file, from either your installation disk or from .CAB files that may be on your machine,would work; but the possiblility of other corrupt files makes this somewhat "iffy." You should look up the procedure if you want to try. The short form is at Description and Explanation of a Cabinet File 310435

An idea of what you're facing in trying to restore/replace files one at a time can be found at List of Windows Files. Note that this is not an official listing.

Since System Restore can't be trusted when there's been a viral infection, and you've indicated you turned it off and hence have dumped all previous restore points, the logical(?????) next step would be a "reinstall-restore" from your original WinXP CD. (Even if restoring the Taskman.exe file seems to work, you may want to consider this step to eliminate the possibility of other corrupt files, or if it worked you may want to try running for a while to see if things look ok.)

Before you start a repair reinstall - take a deep breath and think pleasant things. A reinstall is not usually complex, but it's not something that can be done in a few minutes, and not something to be done if you still think you might have other options. The reinstall is fairly simple – but getting all the security patches back may take quite a lot of time.

You probably should take a look at How to perform an in-place upgrade (reinstallation) of Windows XP at the Microsoft Knowledge Base site before you dive into it.

1. You must have your original WinXP installation disk. If you got a computer with XP preinstalled, it may have some incomprehensibly strange name; but you can probably find it.

2. You must have a valid Product ID number for your disk. It may be on the disk itself, so you need to write it down before you put the disk in where you can't read it.

3. If your machine is set to allow boot from the CD drive (the usual case) you can just put the CD in the drive and restart. The boot process may ask if you want to boot from CD - say yes. If your machine doesn't' boot from the CD drive, just put the CD in and look for an Install.exe.

4. Once the "Installation Manager" starts, it should ask what kind of installation you want, and you choose the "upgrade" option. (More specific info is in the article linked above.)

The link above cites several things that might go wrong, but in most cases this "upgrade installation" will replace Windows without disturbing other installed programs or data. If you can do it easily, you should back up anything critical before you start, but the process is relatively safe with respect to other stuff on the machine. Use your own judgment, there are no guarantees. Since browsers and email are closely linked to the Windows installation, backup of browser favorites, email, and address book(s) might be a good idea.

Unfortunately, the Windows version installed will be whatever was current when you got your disk. It will NOT HAVE ANY SECURITY UPDATES. If/when the reinstallation is completed, you should make sure your AV is up and working (and firewall if you have one) before you connect to any outside (web or LAN) sites. You then MUST GO DIRECTLY to Windows Update and get ALL the current critical updates. If you choose "Express Install" you'll only be shown the Critical Updates. You can come back later and select the "Custom Install" to see the other "optional goodies."

You do need to install all the critical updates, at least up to where the update site says you're ready for SR2. If you don't patch ALL the holes that the scum have found, the likelihood of operating anywhere on the net without being reinfected with something approaches nearly zero, even with AV and firewall in place. Some sources report and "ATI" (average time to infection) less than 20 minutes for machines with reinstalled unpatched Windows.

Installing all the critical updates may require rebooting and then reconnecting to the update site numerous times. You may want to set the update site as your browser home page the first time you go there. (Be sure to put your regular home page into your "Favorites" list before you change home pages.) The total of all patches you need appears to be something like 600 MB.

IF you have decided to install the latest SR2 update, an option would be to obtain the free SR2 CD, which permits you to reinstall windows AND ALL CRITICAL UPDATES - including SR2 - from CDs before making any connection to the internet. Unfortunately, the current wait for mail delivery of the CD is estimated at 4 to 6 weeks. If you can wait that long, or if you know someone who has the CD version of SR2, the update site has links to what you need to know about it.

Most of the updates have procedures for downloading without installing them, and theoretically you could download them all before you do the Windows Reinstall, so that you could apply the fixes before you hook up to the net. The procedures are really intended for administrators who need to download once and then install on multiple machines, so they are not simple to implement for a single machine.



Replacing TaskMan.exe is probably worth trying. You may have some other clues that would help find another file or two that may be corrupted and could be extracted from .CAB and replaced. (Look for a Norton log, perhaps, to see if you can find what was deleted?) It's not unlikely that your virus has done something to your Registry, but without specific instructions I wouldn't recommend poking around there.

There is also the option of phone or email support direct from Microsoft. Usually there's a "free support" period that starts with your first request for assistance, so if you haven't gone there you might get free help. If you've used up your free support period, there is likely to be a charge, but sometimes you can argue with them and get a waiver. Nearly all the Knowledge Base pages (links above) have a link to support options if you're interested.

John

Subject: RE: Tech: Ctrl Alt Del - why doesn't it work?
From: The Fooles Troupe
Date: 30 Sep 04 - 02:12 AM

Some Australian Computing Magazines have the XP SP2 disk as a 'free giveaway' - Microsoft insisted on 'selling' it to them :-)

I suppose other Mags around the world will have it too this 'month' - depending on the 'issue date' and publishing cycle of the various mags.

One thing that I haven't seen clearly set out anywhere - if you have the Original XP install and the SP2 disk - is that ALL you need? - and of course then all new updates after the issue of the SP2 disk...

Robin

Subject: RE: Tech: Ctrl Alt Del - why doesn't it work?
From: JohnInKansas
Date: 30 Sep 04 - 04:26 AM

The SP2 CD is free direct from Microsoft. You can order it at the XP update site - same place you download SP2. At present (or a few days ago) it's only available for machines using ENGLISH versions of XP, but I suppose that may apply to Aussies(?). Other versions will be available "soon" according to the website. At least one other language version was reportedly released this week.

When I ordered it late on 09/20 they estimated 4 to 6 weeks delivery, but it came in today's snail mail - 8 days. Whether it would get to down under users that quickly would depend on whether they may have burners running down there in order to do local mailings. I suspect they do, but can't confirm that.

SP2 is a SERVICE RELEASE. According to Microsoft, all Service Releases are cumulative, i.e. they include all prior critical updates. If you install any version of WinXP and then install SP2 from the CD you are up to date to the SP2 fix point.

If you go to the download site, you have to install all of the prior releases one at a time, to get current to immediately pre-SP2. The SP2 download itself is then "only" about 60 MB. With the CD, you get about 600 MB (reported - I haven't looked yet) and can install everything from the CD starting from any earlier version of XP. (Microsoft has stated that it will only install on "legal copies" of XP, so I assume you probably need the Product ID number from your XP CD.)

If you get the CD, you are encouraged by Microsoft to share it with anyone you want to. If the magazine was distributing it as an "advertising giveaway," I'm not surprised if Mickey charged them at least "burn costs," since giving it to them to distribute potentially interferes with Microsoft's own distribution - and they're trying to get it out to a whole bunch of users.

Just in case you're curious, you can check out List of fixes included in Windows XP Service Pack 2.

John