Regedit and Msconfig problem. Fun for all.. cept me. :P

Hi guys (and girls). Having a bit of an annoying problem here.. Whenever I try to run regedit, wether it be from "run" a command console or from the windows directory, the window will popup for about 1/2 second then close. The same thing happens when trying to run msconfig or when I press ctrl+alt+del to view the processes. I'm running windows XP with service pack 1 (home edition). Problem began occuring about 2 weeks ago, I did not install any software around that time. I've scanned for viruses using three different scanners as well as two trojan scanners. Each scanner has the same result of "no viruses found". I've ran the Swen trojan fix as well but ended with the virus not being found. I've reset the registry back to default and the problem continues. I've set the swap file to automatic as well as disabled all startup applications. I've yet to format, as .. I really dont want to. lol. I also have ZoneAlarm firewall and connected to router (although that last tad of information is a bit pointless, figured i'd toss it in anyway) If anybody has any ideas on how to fix this, or even what would cause it, please let me know. Been working at this for quite some time now. Cheers. :)
System specs are AMD 3200+ XP, 512DDr, NVidia K7N2 Nforce2 mobo, with maxtor 80GB HD and 12 GB HD.

Try disconnecting the box from the net, killing all services running, perhaps safe mode, and see when you can access it. Work your way back connecting things and see where it stops allowing you.

Aphorix, check this link out (solutions near bottom): http://www.experts-exchange.com/Oper..._20724330.html

I take it that it has worked in the past? Have you tried a system roll restore to when it did work?

You say you can't view the task list, msconfig or regedit.

Sounds like something is trying to hide from you.

Look at your running processes. A program like "cool beans" will do it, or from CLI type tasklist.

It will show you what you have running. It might also be a good idea to check out netstat and see what your computer is listening for.

Does the same thing happen in safe mode?

Same thing happens in safe mode, renaming "regedit.exe" to "regedita.exe" worked. It allowed me to view it this time, without having the window close. When I pressed ctrl+alt+del, I managed to press on the "processes" tab, and it showed 32 processes. which is quite odd, because I really dont have that much going on, and with all startup apps disabled.. hmm.

Get into the reg and check your run and runonce keys.. Something in there is funky

I'm in the registry through regedita.exe .. im at the runonce key.. and theres two entries..
1. (Default) REG_SZ (value not set)
2. Configuration File REG_SZ WINCFG32.EXE
is this safe to delete? I've checked with a few other people, and they dont have that in there registry, but wanting to make sure here first.

I tried to find a reference to a trojan I read about on Symantec that did something like this. I think it is a mIRC-vector, IIRC, and makes the registry mods to cause this behavior.

I could be just mis-remembering, though.

I did a couple searches, but couldn't find the appropriate information. Update your AV, run a scan.

Already scanned 5 times, 3 regular anti-virus scanners and 2 trojan scanners. :)

Think I have something for you:

Backdoor.SilverFTP is a backdoor Trojan that gives an attacker unauthorized access to your computer. Backdoor.SilverFTP copies itself as %Windir%\Wincfg32.exe.

Also Known As: Backdoor.SilverFTP.10 [KAV], Backdoor:Win32/SilverFTP.1_0 [RAV]

Type: Trojan Horse
Infection Length: 13,312 bytes



Systems Affected: Windows 95, Windows 98, Windows NT, Windows 2000, Windows XP, Windows Me
Systems Not Affected: Windows 3.x, Microsoft IIS, Macintosh, OS/2, UNIX, Linux

AND---

Click Start, and then click Run. (The Run dialog box appears.)
Type regedit

Then click OK. (The Registry Editor opens.)

Navigate to the key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

In the right pane, delete the value:
Windows Config Loader %Windir%\Wincfg32.exe

Exit the Registry Editor.
-------------------------------------------------------------------

So, in answer to your question, YES! Kill da beastie!

Also, there are removal instructions:

http://securityresponse.symantec.com...silverftp.html

Hope this helps.

I was hit by a virus that did this before. The trouble was figuring out how to get rid of it, as I dod not know what it was, and without the registry editor or the task manager, it was impossible to find out. I had to open the task manager and switch to the processes listing at boot time, and in the time between its appearance on the list and its shutting the task manager down, I got a screenshot for future reference. Since the file was loaded in memory and the virus did not lock it, I was able to delete the file from wherever it was and rebooted the computer.

After this I was able to delete the registry key which caused it to start at boot time. Answers above explain how to do that. I think it was the Wincfg32 file mentioned by rapier57. Try getting a screenshot of the processes list before the virus shuts it down and see if this appears there.

But when I submitted the file to Norton, they did not find a virus contained in it. The file in question was scanned with a 3 day old sig file before running it.
Otherwise, percussive reconstruction might help. :killcompu:

Viruses suck.

Finally got everything working back to normal. The problem was infact being caused by wincfg32.exe
I deleted it from the registry, but it kept coming back. So I downloaded taskmanager2003, which lets you kill processes. As soon as I killed the wincfg32.exe process, everything began working normally again. Only task at hand now is to keep it that way. ;) many thanks to all those that contributed their time and ideas to helping me fix this.

well now go to one of the AV companies sites and read up on how to remove the malware.. then you won't need to worry as much.. BTW: how current were your AV definitions b4 this happened and how current were the defs for the various AV progs you ran to find this thing.. remember some AV's have trouble detecting when the malware is already active....
You will find that many of these progs have a second component hidden in the machine that is reinstalled by more than two other keys.. ..


cheers