Samsung Galaxy A8 review: Hands-on
Anyone any ideas why I can't get at MSCONFIG??
I am running W98SE; I've used MSCONFIG frequently in the past. Now when I attmpt to start it either by clicking the .EXE file, or from START/RUN, the MSCONFIG window flashes on to my desktop for a fraction of a second and just disappears. I've tried rebooting - I don't think I have had any viruses recently.
i had the same problem with a virus i could not use msconfig or task manager or regedit
it just poped up for a second and then disapperaed
if you do a search for msconfig you can rename it msconfig.com and it will open, same for the others but it is best to do a full reformat and reinstall
if you open msconfig see what is set to start up if it says winsock2 then it is a virus it should say it twice in the start up tabs
You can check your startups with Autoruns click here to see if anything is running that shouldn't.
Jester2k II Many thanks - I am not running a popup stopper; I have downloaded Autoruns and suspect I'll find it useful. see next
Kortical implant Many thanks for yours. Renaming the files worked so presumably it is the virus BUT
there is only one winsock2 in the Startup list. I tried deselecting it but it reselected itself when I rebooted (twice). It seems to run WINCFG.SCR - I tried renaming that bu Windows wouldn't let me. I can't find it in DOS to rename it. Neither Ctrl/Alt/Del nor EndItAll show WINCFG running.
I am sure a re-install is due but it will take time. Any more ideas, and any idea why Norton did not and does not pick up this virus (I shall be shouting at them).
In order to be run automatically on system startup, W32/Spybot-Fam copies itself to a file with a random name in the system folder and sets the following registry entries to point to this file.
W32/Spybot-Fam also copies itself to the file mscongfig.exe in the system folder.
While the worm is active it attempts to terminate various monitoring programs. The worm also logs keystrokes to the file keylog.txt in the system folder and attempts to steal passwords.
W32/Spybot-Fam has an IRC backdoor component that connects to a remote IRC server announcing the infection and allows a malicious user remote access to the computer.
Another test is to try and run the following programs
If they open and close like msconfig then almost certainly Spybot virus.
Use this program Stinger (only 696,839 bytes)click here to do a search on your Hard Drives.
Make sure Norton is up to date too and do a full scan. MAKE SURE ALL FILES ARE SELECTED.
Nortons page on Spybot virus click here
Norton still claims my system is clean; STINGER did not indicate any problems. START/FIND finds no KEYLOG file. In the registry there is no reference to WINSOCK in 'RUN', one entry - "WINCFG.SCR" in RUNONCE. Can I delete that??
I need to reinstall any way but I have never done it and am nervous. In any event how do I prevent myself backing up and restoring an infection??
I would be grateful for any assistance you offer
Jester - I prepared my reply off-line and the first two paras. got lost My response should start:-
Thank you for a very full attempt to help. As you may have realised I am in a world of which I know little.
I run NORTON AntiVirus continuously - it updates itself automatically and I run a full system scan every night. Some months ago it spotted a virus similar to the one of which you are speaking; it was not able to clear it automatically but told me what to do manually and i thought I had got rid of it.
This is indeed odd.
From what i can find WINCFG.SCR is a malicious file but nothing picks it up. The fact that MSCONFIG doesn't work also ties in with it being SpyBot virus.
Hit CTRL, ALT and DELETE once and see if wincfg.scr is running in the background.
I think the idea of having in the RunOnce entry is so it runs the next time you start the PC and the entry is then deleted but as soon as the virus restarts it replaces the RunOnce command for next time.
Did you try to run any of these programs??
regedit.exe, taskmgr.exe, netstat.exe??
When you are running Norton to do a full sweep have you made sure it is scanning ALL FILES and not just commonly infected ones? This should be somewhere in the options.
Same with Stinger - you might need to run it again but make sure you go into Preferences first and select Scan All Files at the bottom right as its disabled by default.
If it's not a virus try running system file check and replace; or reinstall os over itself.
This thread is now locked and can not be replied to.