MSCONFIG Inaccessible

  [DELETED] 14:56 04 Aug 2003

Anyone any ideas why I can't get at MSCONFIG??

I am running W98SE; I've used MSCONFIG frequently in the past. Now when I attmpt to start it either by clicking the .EXE file, or from START/RUN, the MSCONFIG window flashes on to my desktop for a fraction of a second and just disappears. I've tried rebooting - I don't think I have had any viruses recently.

  [DELETED] 15:07 04 Aug 2003

Popup stopper running??

  [DELETED] 16:27 04 Aug 2003

i had the same problem with a virus i could not use msconfig or task manager or regedit

it just poped up for a second and then disapperaed

if you do a search for msconfig you can rename it and it will open, same for the others but it is best to do a full reformat and reinstall

if you open msconfig see what is set to start up if it says winsock2 then it is a virus it should say it twice in the start up tabs

  [DELETED] 16:30 04 Aug 2003

You can check your startups with Autoruns click here to see if anything is running that shouldn't.

  [DELETED] 23:08 04 Aug 2003

Jester2k II Many thanks - I am not running a popup stopper; I have downloaded Autoruns and suspect I'll find it useful. see next

Kortical implant Many thanks for yours. Renaming the files worked so presumably it is the virus BUT
there is only one winsock2 in the Startup list. I tried deselecting it but it reselected itself when I rebooted (twice). It seems to run WINCFG.SCR - I tried renaming that bu Windows wouldn't let me. I can't find it in DOS to rename it. Neither Ctrl/Alt/Del nor EndItAll show WINCFG running.

I am sure a re-install is due but it will take time. Any more ideas, and any idea why Norton did not and does not pick up this virus (I shall be shouting at them).



  [DELETED] 23:13 04 Aug 2003
  [DELETED] 08:40 05 Aug 2003

click here

In order to be run automatically on system startup, W32/Spybot-Fam copies itself to a file with a random name in the system folder and sets the following registry entries to point to this file.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Winsock2 driver

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\Winsock2 driver

W32/Spybot-Fam also copies itself to the file mscongfig.exe in the system folder.

While the worm is active it attempts to terminate various monitoring programs. The worm also logs keystrokes to the file keylog.txt in the system folder and attempts to steal passwords.

W32/Spybot-Fam has an IRC backdoor component that connects to a remote IRC server announcing the infection and allows a malicious user remote access to the computer.

Another test is to try and run the following programs


If they open and close like msconfig then almost certainly Spybot virus.

Use this program Stinger (only 696,839 bytes)click here to do a search on your Hard Drives.

Make sure Norton is up to date too and do a full scan. MAKE SURE ALL FILES ARE SELECTED.

Nortons page on Spybot virus click here

  [DELETED] 07:58 06 Aug 2003

Norton still claims my system is clean; STINGER did not indicate any problems. START/FIND finds no KEYLOG file. In the registry there is no reference to WINSOCK in 'RUN', one entry - "WINCFG.SCR" in RUNONCE. Can I delete that??

I need to reinstall any way but I have never done it and am nervous. In any event how do I prevent myself backing up and restoring an infection??

I would be grateful for any assistance you offer


  [DELETED] 08:00 06 Aug 2003

Jester - I prepared my reply off-line and the first two paras. got lost My response should start:-

Thank you for a very full attempt to help. As you may have realised I am in a world of which I know little.

I run NORTON AntiVirus continuously - it updates itself automatically and I run a full system scan every night. Some months ago it spotted a virus similar to the one of which you are speaking; it was not able to clear it automatically but told me what to do manually and i thought I had got rid of it.

  [DELETED] 08:14 06 Aug 2003

This is indeed odd.

From what i can find WINCFG.SCR is a malicious file but nothing picks it up. The fact that MSCONFIG doesn't work also ties in with it being SpyBot virus.

Hit CTRL, ALT and DELETE once and see if wincfg.scr is running in the background.

I think the idea of having in the RunOnce entry is so it runs the next time you start the PC and the entry is then deleted but as soon as the virus restarts it replaces the RunOnce command for next time.

Did you try to run any of these programs??

regedit.exe, taskmgr.exe, netstat.exe??

When you are running Norton to do a full sweep have you made sure it is scanning ALL FILES and not just commonly infected ones? This should be somewhere in the options.

Same with Stinger - you might need to run it again but make sure you go into Preferences first and select Scan All Files at the bottom right as its disabled by default.

  [DELETED] 09:09 06 Aug 2003

If it's not a virus try running system file check and replace; or reinstall os over itself.

This thread is now locked and can not be replied to.

Elsewhere on IDG sites

How to watch the World Cup for free on TV and online

Adobe's brand-new video editing app Project Rush works across your computer, tablet and phone

Best external graphics cards (eGPUs) for Mac

Les meilleurs jeux pour Android (2018)