Weird Errors

[Willy]

A couple things started happening on my PC last night. I have Norton
Internet Security 2006 (been running okay since I installed it back in
December) and all started after they put out an update to Norton Anti-Virus.
Here they are:

1--If I click Start>Run>REGEDIT, it tells me REGEDIT is being used by
another program????
2--If I do a CTRL-ALT-DEL and click Task Manager, It does nothing.
3--A svchost.exe was added to my Programs>Startup Group,
4--I have Limewire Pro 4.9 and it now starts on it's own. Each time I close
it, it restarts again, even after PC Restarts, I checked the settings, not
set to do this. Oh, and this started after svchost was added to my Startup
Group I mentioned in #3 above.

I've deleted Norton entirely and had to get in Safe Mode to run REGEDIT or
to delete Limewire.

Any suggestions?

 

[Jim]

A couple things started happening on my PC last night. I have Norton
Internet Security 2006 (been running okay since I installed it back in
December) and all started after they put out an update to Norton
Anti-Virus. Here they are:

1--If I click Start>Run>REGEDIT, it tells me REGEDIT is being used by
another program????
2--If I do a CTRL-ALT-DEL and click Task Manager, It does nothing.
3--A svchost.exe was added to my Programs>Startup Group,
4--I have Limewire Pro 4.9 and it now starts on it's own. Each time I
close it, it restarts again, even after PC Restarts, I checked the
settings, not set to do this. Oh, and this started after svchost was
added to my Startup Group I mentioned in #3 above.

I've deleted Norton entirely and had to get in Safe Mode to run REGEDIT or
to delete Limewire.

Any suggestions?

Most likely you have malware. Get the Multi-AV download from David Lipman.

Furthermore, get Ad-Aware and Spybot, and run them frequently.

Jim

 

[Wesley Vogel]

You have some sort of malware.

I've deleted Norton entirely

Get an antivirus program now! If you haven't replaced Norton already.

AVG Free for Windows is a free anti-virus protection tool developed by
Grisoft for home use.

Get Your AVG 7 for free!
http://free.grisoft.com/freeweb.php/doc/2/lng/us/tpl/v5

Update your antivirus software and run a full system scan.

Do the same for whatever anti-spyware applications that you have.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Willy]

I've got ZoneAlrm Security Suite, Microsoft AntiSpyware & AdAware. Have
updated all & ran them. Found some SpyWare that was deleted.
Restarted PC, same problems exist.

 

[Wesley Vogel]

Bill,

1--If I click Start>Run>REGEDIT, it tells me REGEDIT is being used by
another program????

What happens if you type: regedit.exe in Start | Run?

What happens if you type: %windir%\regedit.exe in Start | Run?

Does regedit open?

2--If I do a CTRL-ALT-DEL and click Task Manager, It does nothing.

To start the Task Manager...

Ctrl + Alt + Delete
or
Ctrl + Shift + Esc
or
Right click the Taskbar | Task Manager
or
Start | Run | Type: taskmgr | Click OK

Ctrl + Alt + Delete opens the Windows Security window if the Welcome screen
is turned off.

When you open Task Manager, it flashes for a second and quits.

This symptom is caused by viruses.

Task Manager, MSCONFIG, or REGEDIT disappear while opening
http://www.mvps.org/sramesh2k/ToolsQuit.htm

If you get an error message: Task Manager has been disabled by your
administrator.

Error Message: "Task Manager has been disabled by your administrator"
http://windowsxp.mvps.org/Taskmanager_error.htm

Enable/Disable Task Manager
http://www.dougknox.com/xp/utils/xp_taskmgrenab.htm

3--A svchost.exe was added to my Programs>Startup Group,

Go to Programs>Startup Group, right click svchost.exe, click Properties and
select the Find Target button under the Shortcut tab. What folder opens?

Do a Search on your machine for svchost.exe.

If you find svchost.exe any where but these two folders:
%windir%\system32 or C:\WINDOWS\system32
or
%windir%\system32\dllcache or C:\WINDOWS\system32\dllcache
then, chances are that you have malware.

Symantec Security Response - W32.Welchia.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Assarm@mm
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

Virus Profile: W32/Jeefo
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100277

How to Remove Welchia worm or MSBLAST.D worm virus
http://www.pchell.com/virus/welchia.shtml

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Willy]

Wes, I'll answer your questions/comments below following each one.
--
Thanks.....Bill
Please reply to the Newsgroup ONLY

1--If I click Start>Run>REGEDIT, it tells me REGEDIT is being used by
another program????

What happens if you type: regedit.exe in Start | Run?--Nothing

What happens if you type: %windir%\regedit.exe in Start | Run?--Nothing

Does regedit open?--No, just a window saying "another program is currently
using this file"

2--If I do a CTRL-ALT-DEL and click Task Manager, It does nothing.

To start the Task Manager...

Ctrl + Alt + Delete--I meant a CTRL+ALT+DEL, sorry for using the "-" in
between the keys.
or
Ctrl + Shift + Esc--Nothing
or
Right click the Taskbar | Task Manager--Nothing
or
Start | Run | Type: taskmgr | Click OK--Nothing but, "another
program is currently using this file"

Ctrl + Alt + Delete opens the Windows Security window if the Welcome
screen
is turned off.--It does but clicking Task Manager does nothing

When you open Task Manager, it flashes for a second and quits.--It's not

This symptom is caused by viruses.

Task Manager, MSCONFIG, or REGEDIT disappear while opening
http://www.mvps.org/sramesh2k/ToolsQuit.htm

If you get an error message: Task Manager has been disabled by your
administrator.--Don't get that error message and I'm the Adminisrator and
only user of PC.

Error Message: "Task Manager has been disabled by your administrator"
http://windowsxp.mvps.org/Taskmanager_error.htm

Enable/Disable Task Manager
http://www.dougknox.com/xp/utils/xp_taskmgrenab.htm

3--A svchost.exe was added to my Programs>Startup Group,

Go to Programs>Startup Group, right click svchost.exe, click Properties
and
select the Find Target button under the Shortcut tab. What folder
opens?--D:\Documents and Settings\All Users\Start Menu\Programs\Startup.
I've tried to Delete it but won't allow me to.

Do a Search on your machine for svchost.exe.

If you find svchost.exe any where but these two folders:
%windir%\system32 or C:\WINDOWS\system32
or
%windir%\system32\dllcache or C:\WINDOWS\system32\dllcache
then, chances are that you have malware.--It shows up in
D:\Windows\pcheath\errorrep\userdumps and D:\Windows\Prefetch and where I
noted above after doing a right click on Properties, dated 2/23/06.

Symantec Security Response - W32.Welchia.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.worm.html

W32.Assarm@mm
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

Virus Profile: W32/Jeefo
http://us.mcafee.com/virusInfo/default.asp?id=description&virus_k=100277

How to Remove Welchia worm or MSBLAST.D worm virus
http://www.pchell.com/virus/welchia.shtml ---I don't see symtoms noted in
the above nor has Norton previously detcted any of the above noted
viruses. I ran daily full system scans and checked for def. updates
daily. Only thing I see in the above is they all mention svchost.exe
which in D:\Windows\System32 (and in dllcache) it is 14kb and dated
8/4/04.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Wesley Vogel]

Bill,

Reboot into Safe Mode a run a full system virus scan. Then run a full scan
with Ad-Aware while still in Safe Mode.

Some viruses and other malware like to conceal themselves in areas Windows
protects while using them. Safe mode will prevent those applications
access and therefore unprotect the viruses or other malware.

See this first before going into Safe Mode.

Robear Dyer explains...
HOW TO: Reconfigure Ad-aware for a Full Scan
http://forum.aumha.org/viewtopic.php?t=5877

How to start the computer in safe mode
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/boot_failsafe.mspx

I do not know what's wrong. Even if regedit.exe were running, trying to
start it again should not throw up an error. Same for Task Manager.

Another program normally cannot be using regedit.exe or taskmgr.exe, unless
you have some sort of malware or both of those files are borked.

There is nothing that I can think of that would add a svchost.exe start
shortcut to your start folder besides malware.

Maybe the reason that you cannot delete the svchost.exe that is in your
start folder is because it is an actual file and not a shortcut and the file
is running.

Go to Programs>Startup Group, right click svchost.exe, click Properties and
select the Find Target button under the Shortcut tab.

Is there a Shortcut tab?

What folder opens if there is a Shortcut tab and Find Target button?

Also if the problem is not fixed after running AntiVirus and Ad-Aware in
Safe Mode...

Run the System File Checker, sfc.exe. Sfc replaces bad files.

Load your XP CD in your CD drive.

Start | Run | Type or paste: sfc /scannow | Click OK

It should take a while to run.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Willy]

Wes,
I went into Safe Mode (before I received this post), deleted that
svchost.exe from Startup Group, now all seems well in Normal Mode.

 

[Wesley Vogel]

Glad to hear it, Bill. Keep your antivirus software up to date and keep
having fun.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Willy]

Wes,
I still ran your suggestions in Safe Mode and nothing found. Even turned
off System Restore while in Safe Mode, got it on again though.
Since I changed AV Software, I put my PC in Standby Mode each night. Is
there a Task I can make that will Wake it at a certain time each morning
(Norton did this), so that it can then run virus/spyware scans from
ZoneAlarm Security Suite?

 

[Wesley Vogel]

Bill,

I use AVG Free. I know nothing about ZoneAlarm Security Suite, look in
their Help for scheduling virus scans.

There should be something like: Schedule Daily Test.

I do not use Ad-Aware either, although the Pro version probably has a
scheduler.

At some point you had a virus\trojan\worm.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In

 

[Willy]

Wes,
It does have a scheduling feature but if the PC is in Standby, it won't Wake
to run the scans like it used to in Norton, which had set up Scheduled
Tasks.
Yes, I must of had a virus or something but all seems good now.