run command closes immediately 2

[slider200]

When I enter a command in start,run command,it comes up for a quick second and closes immediately.
This happens with regedit,ipconfig,mssconfig,and a lot of others.dxdiag for example will stay opened.I cannot seem to find an answer on Google,so I thought I would see if anyone here can help me,which I am sure can.

Thx,
slider200
Canada

 

[bcastner]

Slider2000,

Delete c:\windows\system32\msconfig35.exe. Use regedit to search for "config35.exe" and delete the keys where it is found. Reboot.

 

[bcastner]

Name: jgrayson
Date: August 13, 2003 at 14:28:06 Pacific
Subject: W32.Spybot.Wom variation. HELP!

Reply:
Yesterday after removing mblast.exe with fixblast.exe from symantec, I started noticing the task manager disappearing problem.
I then fixed this problem with the above advice. I used what I like to call the "quick fingers" solution described by crimperx on this discussion board:

http://forums.techguy.org/t141389/sab1c8d31f55e7d8d16c7a18bb25f1ce0.html

You have to hit CTRL_AKT_DEL, right click MSCONFIG35.exe, select END PROCESS, and hit enter, in less than 1 second. If it works, task manager will stay up and msconfig35.exe will be gone. Then I searched and deleted msconfig35 with regedit, and searched HD C: and deleted it.

So far, after rebooting everything still seems fine. I like the task.exe on the desktop solution too. But you have to keep your fingers in shape somehow!

One last bit that might help is to make sure you have gotten the windows security update to protect from getting reinfected once you do the above solutions.

 

[MasterofNone]

Process File: csrss or csrss.exe
Process Name: Client/Server Runtime Server Subsystem
Description: The Windows Client Server Runtime Subsystem handles Windows and Graphics Functions for all Subsystems
Common Errors: N/A
System Process: Yes


Process File: svchost or svchost.exe
Process Name: Service Host Process
Description: The Service Host Process is generic host process for services that are run from dynamic-link libraries (DLLs)
Common Errors: N/A
System Process: Yes


Apart from those 2, have to agree with bcastner. With regards to ne.exe read this

http://www.viruslist.com/eng/viruslist.html?id=3141

From what you are posting, it does appear that you have a number of virus/worm/spyware problems. Would suggest a review of your internet security, in regards to both your virus program and firewall (please tell me your not using WinXP firewall)

 

[bcastner]

MasterofNone,

But not from the directory shown in his display. If legitimate both processes would have been referenced only from c:\windows\system32.

This is trying to execute "fake" versions from c:\documents and setttings\username
cf. This:


NOTE: The files Smss.exe and Csrss.exe have the same file names as two system files that reside in the %windir%\System32 folder. If you delete these files manually, make sure that you delete the copies that are in the home folder and not the ones in the System32 folder.

During execution, the Smss.exe and Csrss.exe files keep the service running, and checking every three seconds to make sure that it is still running. If you attempt to change or disable the service, it will immediately reinstall it. After 5 minutes of execution time, they activate the Lady.exe program , which will display a few flies crawling across the screen.

During its execution W32.Dalbug.Worm will periodically (every 10 seconds) also add the following registry values:

Smss.exe %windir%\smss.exe
Csrss.exe %windir%\csrss.exe

to the registry key

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

In addition, it tries to kill the Regedit.exe process if it is activated.

Smss.exe and Csrss.exe also try to create the these registry values, however if they detect that Regedit.exe is running, they will delete them (instead of creating them).

Finally, Smss.exe and Csrss.exe will also copy the worm to the following files:

%windir%\inf\Cdrom.sys
%windir%\Fonts\Dosoem.fon
%windir%\Help\Dosapp.hlp

 

[bcastner]

The quote above is just one variant of this worm. Believe me, the csrss.exe shown in his msinfo32 output is a virus/worm.

Between "Sobig.x" variants and "W32.Spybot" variants the internet is under seige right now.

Make sure you have the Msblast hotfix installed.
Make sure you have at least the native XP ICF firewall enabled.

Your virus definitions need updating, even if you did them just two days ago.

Current Norton definitions will find both of these worms if updated after late Wednesday.

 

[bcastner]

Huge Help Tip


If you face one of the many virus/worms that deny you access to Task Manager, download the freeware "Process Explorer" utility from sysinternals.

This will let you view the running processes, and terminate them when you are unable to do so from Task Manager.

http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

 

[MasterofNone]

bcastner

From what you are saying, I too should have concerns as I currently have the process running without a reference to a valid path. I can only think msinfo32 is not verifying this file correctly as I am certain that I only have csrss.exe in c:\windows\system32, I have no problems with any programs dropping after 1 second, my virus definitions are upto date, my firewall is extremely secure and doesn't even answer icmp requests, I also run adaware and spybot.

Will continue the hunt on myside now to verify the above.

 

[MasterofNone]

bcastner

Had a look with process explorer and csrss.exe is infact the system32 file and is being misreported by msinfo32.

 

[bcastner]

MasterofNone,

Thanks for the research.
It helps.

 

[slider200]

I have taken bcastner's advice,as well as a lot of other's and d/loadedprocess explorer.I was able to end the msconfig35 process then delete using regedit.
I will give this a try and get back to you all.
Thx all for your help.
Slider

 

[smah]

You could also check several other online virus scanners faq760-3862

 

[slider200]

seems like this worked out fine.All my run commands are working again.
thx to all.

 

[slider200]

wow....thank God it's friday...I need a beer or 12 tonight!
I thought all was ok,until I tried a run command this morning,and then nothing.I had to use process explorer again to see if that msconfig35 was there again,but it wasn't.
I noticed another odd looking process called "whohcgnoxp.exe"
I killed that process and regedit,msconfig etc:all work in run command again.
Again,I will delete this in registry editor but after re-boot,I am sure something else with a different name will reappear!
btw..I did a search on google on whohcgnoxp.exe and search found nothing...any one else heard of this garbage?
thx all

 

[MasterofNone]

think your pc is cursed.

Said it before, but this again proves the need for a review of your system security.

 

[slider200]

to all who helped me with this virus,I must hide my head in shame...my symantec virus definitions were not up to date.They were last updated back in fe. 2003..
I assumed live update took care of this,however I got the d/load from their website.I found spybot in 63 files.
all seems ok now though.

thx again,
Slider