msconfig.exe,regedit.exe,taskmgr.exe refuses to run

  • Thread starter Thread starter yvadoi
  • Start date Start date
Y

yvadoi

i have just bought a new set of computer and installed windows xp pro
service pack 2 integrated.but after installing all the drivers and
some utilities bundled with the set,i’m surprised that i can’t open
msconfig,regedit and taskmgr..i have tried renaming regedit.exe to
regedit.com and it works but applying that remedy to taskmgr and
msconfig did’t work. can anyone help please?

thanks
 
yvadoi said:
i have just bought a new set of computer and installed windows xp pro
service pack 2 integrated.but after installing all the drivers and
some utilities bundled with the set,i'm surprised that i can't open
msconfig,regedit and taskmgr..i have tried renaming regedit.exe to
regedit.com and it works but applying that remedy to taskmgr and
msconfig did't work. can anyone help please?

thanks
Click to expand...

Line 275 left side
http://www.kellys-korner-xp.com/xp_tweaks.htm
 
yvadoi said:
i have just bought a new set of computer and installed windows xp pro
service pack 2 integrated.but after installing all the drivers and
some utilities bundled with the set,i’m surprised that i can’t open
msconfig,regedit and taskmgr..i have tried renaming regedit.exe to
regedit.com and it works but applying that remedy to taskmgr and
msconfig did’t work. can anyone help please?

thanks
Click to expand...


The type of behavior you describe is typical behavior of more than
one virus/worm, the three below being the most common:

W32.Klez
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

W32.Yaha
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]

W32.Spybot.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.worm.html

Because many of the newer viruses and worms, such as the Spybot
mentioned above, can disable antivirus applications whose definitions
aren't kept up-to-date, try using one or more of the free on-line
scanners to double-check your system.

Trend Micro - Free online virus Scan
http://housecall.trendmicro.com/

McAfee Security - FreeScan
http://www.mcafee.com/myapps/mfs/default.asp

Symantec Security Check
http://security.symantec.com/ssc/home.asp

Panda ActiveScan - Free online scanner
http://www.pandasoftware.com/activescan/com/activescan_principal.htm

Computer Associates:
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx

DialogueScience:
http://www.antivir.ru/english/www_av/

F-Secure:
http://support.f-secure.com/enu/home/ols.shtml

BitDefender
http://www.bitdefender.com/scan/license.php

Freedom Online scanner
http://www.freedom.net/viruscenter/index.html


--

Bruce Chambers

Help us help you:



You can have peace. Or you can have freedom. Don't ever count on having
both at once. - RAH
 
Bert Kinney said:
Hi,

The script on the following page will creates usable copies of

REGEDIT, MSCONFIG and Task Manager which were most likely
disabled by
a virus.
http://www.dougknox.com/xp/utils/xp_emerutils.htm

Here is a combination of utilities that I have found to work
very well
in the removal and prevention of virus infection, spyware,
parasites,
malware and the like.
http://bertk.mvps.org/html/spyware.html
Click to expand...

thanks for the reply..but i have tried xp_emergency utility already
and it still didnt work. I have tried scanning using the online scan
features of bit defender and picicillin,norton2005sytemworks,nod32 but
no virus nor trojans are detected. besides my unit is new and of
course its the hard disks first time to be written and i never
downloaded nor browse anything in the internet sans the picicillin and
bitdefenders homepage which i presume don’t have those trojans etc. I
have even uninstalled all software applications sans the board drivers
and the winXP itself ofcourse but to no avail....i still can’t run the
msconfig.exe and taskmgr.exe....i need more help pls...thank very much
 
Try changing the names totally. Make Taskmgr.exe = manager.exe Msconfig.exe = cnfgure.exe

Some virus's look for the name, with a little more effort. Rather than an exact match, they'll terminate any process that has Taskmgr or Msconfig in the name.

Are the programs terminating as soon as you open them, or is there an error about the program being disabled by the Administrator?
 
Doug Knox MS-MVP said:
Try changing the names totally. Make Taskmgr.exe = manager.exe
Msconfig.exe = cnfgure.exe

Some virus’s look for the name, with a little more effort.
Rather than an exact match, they’ll terminate any process that
has Taskmgr or Msconfig in the name.

Are the programs terminating as soon as you open them, or is there an
error about the program being disabled by the Administrator?
Click to expand...

thanks very much for the help.when i’m trying to run those
programs,(e.g.pressing ctrl-alt-del for taskmgr,start-run then typing
msconfig)nothing happens and no error messages were displayed.i’ve got
them running when i tried renaming these files (changing taskmgr.exe
to taskmgr.com and msconfig.exe to cnfigure.exe). i’m wondering why
the XPemergencyUtility program did’nt worked...another problem i have
just discovered is that i can’t open the add/remove folder on the
control panel: "Add or Remove programs has been restricted.please
check with your administrator" message appears, the fact that i am
using a single administrator account.....and i’m wondering why the
autoplay capability of my cd rom don’t work at all even when i set it
all to its default state...i am desperately in need of help here....
 
As I said, some malware programs look at just the first part of the name Taskmgr, MSCONFIG, etc. Changing the extension won't help. The utility that I wrote uses Copy_of_MSConfig.exe as the file name, so MSCONFIG is there for the malware to find. Try re-naming the files to something different like MSCFG.EXE or TSKMNGR.EXE. The original name is not contained in the new file name and the malware should not be able to find it.

For the Add/Remove Programs restriction, run REGEDIT and go to:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall

Look in the right pane for a value called NoAddRemovePrograms. If it exists, its probably set to 1. Double click it and set it to 0 (zero). Also look in

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall

If it the NoAddRemove value isn't in HKEY_LOCAL_MACHINE, don't worry about it.

If you can't run REGEDIT, either, try the renaming method described above.
 
Doug Knox MS-MVP said:
As I said, some malware programs look at just the first part
of the name Taskmgr, MSCONFIG, etc. Changing the extension
won't help. The utility that I wrote uses
Copy_of_MSConfig.exe as the file name, so MSCONFIG is there
for the malware to find. Try re-naming the files to something
different like MSCFG.EXE or TSKMNGR.EXE. The original name is
not contained in the new file name and the malware should not
be able to find it.

For the Add/Remove Programs restriction, run REGEDIT and go
to:

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPo
liciesUninstall

Look in the right pane for a value called NoAddRemovePrograms.
If it exists, its probably set to 1. Double click it and set
it to 0 (zero). Also look in

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionP
oliciesUninstall

If it the NoAddRemove value isn't in HKEY_LOCAL_MACHINE, don't
worry about it.

If you can't run REGEDIT, either, try the renaming method
described above.

--
Doug Knox, MS-MVP Windows Media CenterWindows Powered Smart
DisplaySecurity
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.


 >>Try changing the names totally. Make Taskmgr.exe =
manager.exe
 >>Msconfig.exe = cnfgure.exe
 >>
 >>Some virus’s look for the name, with a little more
effort.
 >>Rather than an exact match, they’ll terminate any
process that
 >>has Taskmgr or Msconfig in the name.
 >>
 >>Are the programs terminating as soon as you open them,
or is there an
 >>error about the program being disabled by the
Administrator?
 >>
here....
Click to expand...

i’m very much grateful for the help.i can already run the
programs(taskmgr,regedit,msconfig)by renaming them sans running the
taskmgr by using ctrl+alt+del... is there something to do about this?
as for the addremove restrictions,i got them running already...thanks
for the help..
 
You need to get rid of the virus/malware that is on your system. You're still infected, that's why you cannot run these programs using their original names!
 
Back
Top