MSCONFIG Inaccessible

  pppc 14:56 04 Aug 03
Locked

Anyone any ideas why I can't get at MSCONFIG??

I am running W98SE; I've used MSCONFIG frequently in the past. Now when I attmpt to start it either by clicking the .EXE file, or from START/RUN, the MSCONFIG window flashes on to my desktop for a fraction of a second and just disappears. I've tried rebooting - I don't think I have had any viruses recently.

  Jester2K II 15:07 04 Aug 03

Popup stopper running??

  kortical Implant 16:27 04 Aug 03

i had the same problem with a virus i could not use msconfig or task manager or regedit

it just poped up for a second and then disapperaed

if you do a search for msconfig you can rename it msconfig.com and it will open, same for the others but it is best to do a full reformat and reinstall

if you open msconfig see what is set to start up if it says winsock2 then it is a virus it should say it twice in the start up tabs

  Jester2K II 16:30 04 Aug 03

You can check your startups with Autoruns click here to see if anything is running that shouldn't.

  pppc 23:08 04 Aug 03

Jester2k II Many thanks - I am not running a popup stopper; I have downloaded Autoruns and suspect I'll find it useful. see next

Kortical implant Many thanks for yours. Renaming the files worked so presumably it is the virus BUT
there is only one winsock2 in the Startup list. I tried deselecting it but it reselected itself when I rebooted (twice). It seems to run WINCFG.SCR - I tried renaming that bu Windows wouldn't let me. I can't find it in DOS to rename it. Neither Ctrl/Alt/Del nor EndItAll show WINCFG running.

I am sure a re-install is due but it will take time. Any more ideas, and any idea why Norton did not and does not pick up this virus (I shall be shouting at them).

Cheers

PeterC

  VoG II 23:13 04 Aug 03
  Jester2K II 08:40 05 Aug 03

click here

In order to be run automatically on system startup, W32/Spybot-Fam copies itself to a file with a random name in the system folder and sets the following registry entries to point to this file.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Winsock2 driver

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\Winsock2 driver

W32/Spybot-Fam also copies itself to the file mscongfig.exe in the system folder.

While the worm is active it attempts to terminate various monitoring programs. The worm also logs keystrokes to the file keylog.txt in the system folder and attempts to steal passwords.

W32/Spybot-Fam has an IRC backdoor component that connects to a remote IRC server announcing the infection and allows a malicious user remote access to the computer.

Another test is to try and run the following programs

regedit.exe
msconfig.exe
taskmgr.exe
netstat.exe

If they open and close like msconfig then almost certainly Spybot virus.

Use this program Stinger (only 696,839 bytes)click here to do a search on your Hard Drives.

Make sure Norton is up to date too and do a full scan. MAKE SURE ALL FILES ARE SELECTED.

Nortons page on Spybot virus click here

  pppc 07:58 06 Aug 03

Norton still claims my system is clean; STINGER did not indicate any problems. START/FIND finds no KEYLOG file. In the registry there is no reference to WINSOCK in 'RUN', one entry - "WINCFG.SCR" in RUNONCE. Can I delete that??

I need to reinstall any way but I have never done it and am nervous. In any event how do I prevent myself backing up and restoring an infection??

I would be grateful for any assistance you offer

PeterC

  pppc 08:00 06 Aug 03

Jester - I prepared my reply off-line and the first two paras. got lost My response should start:-

Thank you for a very full attempt to help. As you may have realised I am in a world of which I know little.

I run NORTON AntiVirus continuously - it updates itself automatically and I run a full system scan every night. Some months ago it spotted a virus similar to the one of which you are speaking; it was not able to clear it automatically but told me what to do manually and i thought I had got rid of it.

  Jester2K II 08:14 06 Aug 03

This is indeed odd.

From what i can find WINCFG.SCR is a malicious file but nothing picks it up. The fact that MSCONFIG doesn't work also ties in with it being SpyBot virus.

Hit CTRL, ALT and DELETE once and see if wincfg.scr is running in the background.

I think the idea of having in the RunOnce entry is so it runs the next time you start the PC and the entry is then deleted but as soon as the virus restarts it replaces the RunOnce command for next time.

Did you try to run any of these programs??

regedit.exe, taskmgr.exe, netstat.exe??

When you are running Norton to do a full sweep have you made sure it is scanning ALL FILES and not just commonly infected ones? This should be somewhere in the options.

Same with Stinger - you might need to run it again but make sure you go into Preferences first and select Scan All Files at the bottom right as its disabled by default.

  MichelleC 09:09 06 Aug 03

If it's not a virus try running system file check and replace; or reinstall os over itself.

This thread is now locked and can not be replied to.

Best phone camera 2016/2017: Galaxy S7 vs iPhone 7 vs Google Pixel vs HTC 10 Evo vs OnePlus 3T vs…

1995-2015: How technology has changed the world in 20 years

Best Christmas Agency Projects of 2016

Super Mario Run preview | Hands-on first impressions of Super Mario Run: Mario's iPhone & iPad…