regedit and msconfig consoles disappear

[Peter]

When I start up regedit or msconfig, the console window
opens but then disappears after about 5 to 10 seconds. The
consoles are functional until they disappear.

I discovered this problem when installing Norton Anti-
virus. That product installs fine, but I notice that the
console window for that application also disappears after
a few seconds. (Note, the regedit and msconfig issue
existed before installing Norton.)

No other applications are affected. That is, the windows
for all my other applications (e.g., IE, Word, control
panel apps, Windows Explorer, etc.) all work fine. What is
so special about regedit, msconfig, and Norton Anti-virus
that their console windows won't stay open?

The installation of Norton Anti-virus did a virus scan and
found nothing. I have also searched the Symantec virus
database, and did not find any virus that has this
behavior. So I'm not sure this behavior is due to a virus.

Can anyone help me figure out what is wrong, and how to
fix the situation?

Thanks

- Peter

 

[Regedit disabled]

I have a worm called w32/SDBOT.CL It disabled my
regedit. Do you know how to remove. Trend couldn't
remove and I can't get into the registry to remove. This
could be the problem. There is also a adware virus called
multibot pro that disables firewalls.

 

[Peter]

Don't think it is that virus in my case. I can start
regedit, it just aborts soon. I also checked the Symantec
dictionary on that specific worm -- couldn't find it
there, but other sdbot worms don't seem to indicate any
effects on regedit.

 

[Doug Knox MS-MVP]

You have a virus. Likely one of the following:

W32.Klez
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

W32.Yaha
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

W32.Spybot.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.worm.html

Or a variant of the above.

For additional help see www.dougknox.com, Win XP Utilities, Create Emergency Copies of Critical XP System Utilities. This small VB Program will create backup, usable copies of Task Manger, Regedit and MSConfig (named Taskmgr1.exe, Regedit.com and MSConfig1.exe) in a new folder C:\EmergencyUtil. Many virus programs will intercept these programs, based on their original file name. The modified file names, allow them to be run. Open Windows Explorer to C:\EmergencyUtil and double click the application you need. The next revision will allow you to browse for the folder you want to place the backups in.

Additionally, see the Win XP Utilities section for Startup Programs Tracker. This small utility scans your system for startup programs and running processes. It also allows you to create a log file that can be copied and pasted into a newsgroup post. The contents of the program window are also copied to the Windows Clipboard, automatically. For replies to newsgroup posts, do NOT include the Running Services, unless its absolutely necessary.

 

[Bruce Chambers]

Greetings --

The type of behavior you describe is typical behavior of more than
one virus/worm, the three below being the most common:

W32.Klez
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

W32.Yaha
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

W32.Spybot.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.worm.html

Because many of the newer viruses and worms, such as the
Spybot mentioned above, can disable antivirus applications whose
definitions aren't kept up-to-date, try using one or more of the free
on-line scanners to double-check your system.

Trend Micro - Free online virus Scan
http://housecall.trendmicro.com/

McAfee Security - FreeScan
http://www.mcafee.com/myapps/mfs/default.asp

Symantec Security Check
http://security.symantec.com/ssc/home.asp

Panda ActiveScan - Free online scanner
http://www.pandasoftware.com/activescan/com/activescan_principal.htm


Bruce Chambers
--
Help us help you:



You can have peace. Or you can have freedom. Don't ever count on
having both at once. - RAH