What prevents services.msc running?

[braddds]

I was working on a laptop this weekend and came accross a problem with running services, manage and task manager in XP pro. I checked for a virus and found Backdoor.SdBot.22 and went through the process of removal - AVG couldn't rid the system so I used:

http://securityresponse.symantec.com/avcenter/venc/data/backdoor.sdbotz.html

Here it gave me the manual method (safe mode) which seemed to work, however... I later tried the to access the services.msc and no luck, it would either not run or would popup the close almost instantly - the same happened when trying to use manage and task manager. I could find no info on this behaviour associated with this trojan but remember hearing about some little nasty that has this M.O. Though neither Avast or AVG could find any other problems I suspect another virus at work! Any help would be appreciated.

Cheers

 

[smah]

There are several virii that can cause this behavior. Run at least 2 other virus scans using:

Free online scanners faq760-3862

 

[braddds]

Thx smah

As I don't have access to the laptop I'd like to get as much info prior. If you could expand on the most likely suspects I'd appreciate it.

...or, if there is other info you require, I might be able to expand but as I said "I don't have access", so my info could be incomplete.

Cheers

 

[smah]

Klez is one of the most common causes of this behavior:

http://support.microsoft.com/default.aspx?scid=kb;en-us;326833

 

[braddds]

Thx again smah

Funny, how a AV program might not recognize an old virus like Klez...or any older virus!? Weird but it wouldn't be the first time!

I'll contact the owner tonight and have them run a test to determine if "Klez" or some variant is running on their laptop. Only problem is I believe msconfig also doesn't run either...this little bugger really wants to hide itself! Perhaps I'll get them to download the klez removal tool and run it on the laptop, with luck it'll work, otherwise...

...if that fails I'll try "process viewer" from Sysinternals...hopefully this, whatever it is, won't prevent the "viewer" from running and I'll get a better handle on what's actually happening.



Cheers

 

[happydownloader]

Make sure you turn off system restore before you try to remove the virus
If you don't you will more then likely still be infected