Windows 7: "No Processes" Running

Hey friends,

Wondering if anyone else is experiencing this issue.

Running 7 x64 RC (7100) May release. A few months into using it I have issues at startup and log on. Often (maybe 50% of start ups), when I log in, the tray icons are missing and the GUI part of the taskbar icons do not work. The icons of the programs I open or that I open that are pinned to not expand, the apps don't open, etc. It is slow, unresponsive and just doesn't work.

I have to force shutdown using the power button and reboot with hopes that it works correctly next time.



I have an image of the task manager during this issue. Note that NO processes show in the TM.

Does TASKLIST on a command prompt list processes? If not, that's relatively severe and there's a possibility of a malware infection - something which is aiming to hide particular process names from you, but doing it so badly that the entire list is borked.

I encountered this twice about <two years ago on an XP system (belonging to a noob friend). I don't remember the name of the malware, but he got it from downloading some app that was supposed to make his system safer and faster ;-)

I had to replace at least one DLL.

Not saying it is the same thing, just that I have seen this before.

Thanks for the info. I have done scans on the system using my updated Avast antivirus software (always up to date). Nothing came up.

Antman, is there any software that might detect it? Otherwise do you think running sfc at the cmd prompt would fix the DLL problem (assuming it is a DLL).

Edit: I'll run TASKLIST command when it happens again.

You are better served working with H2SO4 on this one.

What? It only happens sometimes?

Yeah, it's not entirely uncommon in the malware world (although this may not be malware of course).

To hide a particular process name (MyMalware.exe), they insert a driver which attempts to hook the kernel in the appropriate places to mask EPROCESS/KPROCESS instances belonging to specific processes. When it all goes badly wrong, the result is an empty process list. At least that's a giveaway. It's worse when the scheme is functioning as it should.

SFC won't hurt (a healthy machine), so there's little reason not to try it.

The point of TASKLIST is to check whether the problem is specific to the Task Manager, in which case it's some sort of less serious UI issue or simple corruption, or whether all attempts to enumerate the process list, including those which have nothing to do with the Task Manager, all end up concluding that there are no processes to show.

If it's the latter - TASKLIST is also devoid of process names - then you should consider the very real possibility that the machine has been rootkitted. Either way, please make sure you've got backups of your data, and treat those backups as infected until you get to the bottom of this.

Thanks for the info! I'm considering all options, namely to reinstall Windows.