Printable View
What gives?!! I'm running XP home. I need to adjust some settings in my registry. The problem is that when I type regedit in my run box, it pops up on the screen for maybe 1 or 2 secs and then disappears.
What's going on, and how do I fix this?
-Thanx
sounds whacky, I'd reinstall.
Check these links-
http://www.computing.net/security/ww...orum/8794.html
http://www.hls-inc.net/general/virus.htm
Quote:
W32/Swen@MM modifies various registry keys and disables the execution of REGEDIT.EXE on the victim's machine.
Are you running anti virus/spyware software on your computer?
How long did you use that WinXP before this problem occurs? If it just happen after you install your OS, I suggest you to reinstall them, or you may check your system using Norton Utilities. NU provides more features to maintains you PC.
I hope I can help...
Weeeeelllllll... There are a number of reasons...
Given the above links.. first is the following still working?
Task Manager (Ctl-Alt-Del)
MSCONFIG
Your Anti-Virus (Norton. AVG, McAfee, Sophos PcCillen)??
that is besides the non working regedit..
Have you Installed any patches that Microsoft Kindly emailed you recently?
OR
Playing with the registry.. have you changed ANY setting in the Policy area..????
but the Swen/yaha/etc wormy problem is likely..
cheers
Some versions of Klez will disable registry editor, antivirus and taskmanager.
Do a scan for everything...it should get rid of that problem plus many others you might have and im sure you do...oh yea update before scaning :D
peace
Agreed, try to scan with an updated AV, however it's klez, it's extremely difficult to make any headway against within the OS, you'll need to slave the hardrive and scan it from another machine, unless you have a dualboot.
TheFBI,
How are you going with this problem, it is very good form to keep us upto date..ie progress report..
along with Klez, yaha, swen.. here is a recent contender http://[email protected]
cheers
<edit>
Don't know what you mean..
1/ Get removal tool form one of the AV companies..Quote:
however it's klez, it's extremely difficult to make any headway against within the OS,
2/ DISABLE SYSTEM RESTORE
3/ BOOT INTO SAFE MODE
4/ Run The Klez removal tool
5/ reboot system
6/ Re Run the tool or
7/ UPDATE AV DEFINITIONS AND DO FULL SYSTEM SCANN
8/ Re-Enable System Restore
Disableing System restore and attempting the removal in safe mode, be it manualy or with the aid of a removal tool is very much a standard practice..
Scanning the infected drive from a Clean OS either in the dual boot or by removing the HDD is hazardous.. I would only use it to DETECT the Infection ONLY.. the AV won't remove the Registry entries on the infected Drive, Viri like lovegate, opasrv have registry keys that enable the reinstallation over network or internet of the virus..
So Identification only.. remove by using the known proceedures..
Try scanning in safe mode, you have a better chance then :)
Cheers
Thanks to all who have responded.
I disabled system restore and ran a scan of ALL files with PCchilin, also use SpyBot and both come up clean on a full scan... Still haven't discovered the source of the problem.
The winxp came installed on my computer purchased brand new a couple of years ago. I have accessed the registry in the past without problems and I've not installed any new programming since, so I'm pretty confused as to what's going on.
What next guys?
I've reread your response a couple of times, and I see you ran PCcillin, did you update it first? Sorry if I am being redundant. :)
Spybot is for spyware, and popular opinion is that it's a virus, so Spybot won't help.
As Und3ertak3r asked, do these work? I think he is on the right track here.Quote:
Task Manager (Ctl-Alt-Del)
MSCONFIG
Your Anti-Virus (Norton. AVG, McAfee, Sophos PcCillen)??
This question is directed towards anybody that may know... do these viruses corrupt regedit, or do they just not allow it to run. I'm wondering if maybe putting a "good" version on a floppy and running it from there will work?
Also, would HiJack this be helpful in this situation... my feeling is there is something in the start up that needs to be addressed.
TheFBI, please be detailed as possible about what you have tried... sometimes we overlook the most obvious things?
Well.. PCcillen seems to be working just fine (did not update however), But it appears infact that neither Task Manager (Ctl-Alt-Del) nor MSCONFIG is working??
Ah hah! So what does this mean now?
Thanks
Update PC-Cillin and scan - see what you get.Quote:
Well.. PCcillen seems to be working just fine (did not update however), But it appears infact that neither Task Manager (Ctl-Alt-Del) nor MSCONFIG is working??
Holy WOW! Updating my PCcillin and so far it shows 550 virus!! - ALL are showing as some sort of SpyBot worm. 578 and STILL goin!!
635 and STILL counting
After you get all of this cleared up, make sure you have everything updated. Check for anti-virus updates & scan at least once a week. Do the same with spybot & ad-aware.Quote:
635 and STILL counting
Can you edit your post the next time you tell us your virus count? People are going to neg you if they think your cheating on your post count.Quote:
Holy WOW! Updating my PCcillin and so far it shows 550 virus!! - ALL are showing as some sort of SpyBot worm. 578 and STILL goin!!
Alright, well, It finished with 700 and something total. PCcillin wouldn't clean them so it quaranteened them.
My regedit, msconfig, and task manager still will not work?
What's next?
UPDATE UPDATE UPDATE UPDATE UPDATE:
I did a restart and everythings working well now.
Thank you for all the help I received here!
curious.. just how out of date was your AV definitions?
and was that 700 instances of Worm Spybot.578 ..? or a mixture.. of malware.
Cheers
Yes indeed, all 736 were Worm Spybot. All .exe
I'd suggest a format. Especially since PCcillin couldn't clean it. Then, after you reinstall everything, UPDATE. Update your AV, your windows, everything.
Cheers,
cgkanchi
Often when an AV says it can't clean means the whole file is a virus, thus there is nothing to clean, as long as the executable isn't running should be able to manually delete, however I agree, with a major infestation like that, you want to format, you never know what came in during that mess.
I agree, format is easy solution. But it can be time consuming. Just imagine how much time it takes to install OS, then install all of your programs. 3 hours minimal.
try to do this:
[list=1][*]boot to safe mode (disable system restore etc.)[*]delete all infected files[*]restart[*]if everything works fine scan for viruses next few days[*]if there is a bunch of errors, you'll have to reinstall OS[*]if that doesn't help, you would probably have to format[/list=1]
Some errors from step 5 might be of type "couldn't start program xxx.exe because it is missing". you will have to delete some keys for HLM\software\microsoft\windows\current version\run
I had a similar problem, but it was not a virus. I keep my AV up to date, run Spyware, and Ad-Aware. You do need to get rid of the virii, however they are not necessarily the problem. I think I messed something up by writing to a part of memory that I should not have been touching... or something. Anyway, I just rebooted and it worked. :) Norton AV is really good about cleaning and it does AV before it installs.
-Cheers-