run command closes immediately 2

[slider200]

When I enter a command in start,run command,it comes up for a quick second and closes immediately.
This happens with regedit,ipconfig,mssconfig,and a lot of others.dxdiag for example will stay opened.I cannot seem to find an answer on Google,so I thought I would see if anyone here can help me,which I am sure can.

Thx,
slider200
Canada

 

[bcastner]

Most likely a virus, assuming that there are no Group Policy settings that bar you from running particular .exe files.

SirCam and variants will do this.

 

[Jontmke]

Just so you understand, some commands like ipconfig will always do that if you just type them in the run box. For ipconfig especially you need to open a command box then run the command. It does run but closes right away.

This does not affect msconfig or regedit though. They should work.

Jon

There is much pleasure to be gained from useless knowledge. (Bertrand Russell)

 

[slider200]

I tried regedit and msconfig...it happens to both of them.
Thx for you reply
Slider

 

[bcastner]

Try some online virus scans. Trend Housecall is good:

http://www.antivirus.com/

 

[linney]

Another thing that might cause that type of action is if you have some duplicate (corrupt, zero byte size) entries for regedit.exe and msconfig.exe floating around in your system.

 

[slider200]

Still no resolver with this problem....any other suggestions?I tried all anti-viruses...nothing.

thx,
lider

 

[Jontmke]

Try this: open a command box. Then run those commands that are failing and see if it gives you an error. It might be saying something but the command box closes so fast you don't see them.

Jon

There is much pleasure to be gained from useless knowledge. (Bertrand Russell)

 

[MasterofNone]

Have you viewed all your running processes to make sure there is nothing untoward.

Read numerous people with the same problem as yourself and this almost always comes back to being related to a virus in someway. As you have tried a number virus detectors can see how hearing this again could be tiresome.

1st look at your running processes, anything that doesn't ring true, type into google and you should get verification one way or another whether it should be there.

Read someone had a process running called rpc.exe and mistook this for the service rpc. It was infact a virus and once he killed the process and removed the file, he could run regedit and removed the run entry.

Hope this helps.

 

[bcastner]

See Kelly Theriot's post of last week on exactly this issue:

http://groups.google.com/groups?q=x...=erkhae2WDHA.208@tk2msftngp13.phx.gbl&rnum=22

 

[slider200]

ok,well wouldn't you know it.
I attempted to see what processes were running by ctl+alt+del and guess what???That did the exact same thing.

 

[slider200]

I didnt read the post with the links attached before I posted my reply about task manager doing the same thing as run command.I will check it out when I get home as I am at the public library right now.I didn't know about the links at the time of my reply,but of course am unable to do it now.
I will let you know how I make out.
Thx,
Slider
Canada

 

[bcastner]

Some ideas from MVP Kelly Theriot:

**This worm disables NAV, Msconfig, Regedit and Task Manager:

http://www.bitdefender.com/bd/site/virusinfo.php?menu_id=1&v_id=114

http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.worm.html

To fix this worm:

(1). Rename regedit.exe to regedit.com;
(2). Go to:

http://www.kellys-korner-xp.com/xp

tweaks.htm
Download then Merge the edit on line 251.
(3). Then delete all the files mentioned in the above links.

 

[slider200]

my nav isn't disabled,and I ran two online scans...trend micro and mcafee scan,and both returned no viruses.I do believe however that there is some sort of virus on my pc,because of all those commands only staying up for 1/2 second or so.
I tired a couple fixes with still no results.
Any other suggestions other than re-formatting?
thx,
Slider,
Canada

 

[MasterofNone]

Still think you must have a process running which is causing all the havoc.

start, run, msinfo32

and check software enviroment, running tasks.

 

[slider200]

here is what is running...not sure what most are though...any suggestions?
csrss.exe Not Available 488 13 Not Available Not Available 8/21/2003 1:17 PM Not Available Not Available Not Available
dw.exe c:\program files\downloadware\dw.exe 1472 8 204800 1413120 8/21/2003 1:17 PM 1.0.0.115 183.72 KB (188,128 bytes) 7/31/2003 10:36 PM
explorer.exe c:\windows\explorer.exe 1308 8 204800 1413120 8/21/2003 1:17 PM 6.00.2600.0000 (xpclient.010817-1148) 977.50 KB (1,000,960 bytes) 8/23/2001 9:00 AM
helpctr.exe c:\windows\pchealth\helpctr\binaries\helpctr.exe 1664 8 204800 1413120 8/21/2003 1:18 PM 5.1.2600.0 (xpclient.010817-1148) 676.00 KB (692,224 bytes) 2/12/2003 12:22 PM
helpsvc.exe c:\windows\pchealth\helpctr\binaries\helpsvc.exe 1952 8 204800 1413120 8/21/2003 1:18 PM 5.1.2600.0 (xpclient.010817-1148) 678.00 KB (694,272 bytes) 2/12/2003 12:22 PM
iexplore.exe c:\program files\internet explorer\iexplore.exe 1292 8 204800 1413120 8/21/2003 1:17 PM 6.00.2600.0000 (xpclient.010817-1148) 89.00 KB (91,136 bytes) 2/12/2003 12:22 PM
lsass.exe c:\windows\system32\lsass.exe 568 9 204800 1413120 8/21/2003 1:17 PM 5.1.2600.0 (xpclient.010817-1148) 11.50 KB (11,776 bytes) 8/23/2001 9:00 AM
msconfig35.exe c:\windows\system32\msconfig35.exe 1504 8 204800 1413120 8/21/2003 1:17 PM Not Available 24.00 KB (24,576 bytes) 8/8/2003 9:53 AM
navapsvc.exe c:\program files\norton antivirus\navapsvc.exe 1744 8 204800 1413120 8/21/2003 1:17 PM 8.07.17 113.62 KB (116,344 bytes) 2/12/2003 2:49 PM
navapw32.exe c:\progra~1\norton~1\navapw32.exe 1452 8 204800 1413120 8/21/2003 1:17 PM 8.07.17 73.62 KB (75,384 bytes) 2/12/2003 2:49 PM
ne.exe c:\progra~1\networ~1\v11\ne.exe 1184 8 204800 1413120 8/21/2003 1:17 PM 1.0.0.11 292.00 KB (299,008 bytes) 7/31/2003 10:37 PM
noads.exe c:\program files\noads\noads.exe 1512 8 204800 1413120 8/21/2003 1:17 PM 2002.11.05 120.00 KB (122,880 bytes) 2/13/2003 11:52 AM
services.exe c:\windows\system32\services.exe 556 9 204800 1413120 8/21/2003 1:17 PM 5.1.2600.0 (xpclient.010817-1148) 99.00 KB (101,376 bytes) 8/23/2001 9:00 AM
smss.exe c:\windows\system32\smss.exe 440 11 204800 1413120 8/21/2003 1:17 PM 5.1.2600.0 (xpclient.010817-1148) 44.50 KB (45,568 bytes) 8/23/2001 9:00 AM
spoolsv.exe c:\windows\system32\spoolsv.exe 1104 8 204800 1413120 8/21/2003 1:17 PM 5.1.2600.0 (XPClient.010817-1148) 50.00 KB (51,200 bytes) 8/23/2001 9:00 AM
svchost.exe c:\windows\system32\svchost.exe 740 8 204800 1413120 8/21/2003 1:17 PM 5.1.2600.0 (xpclient.010817-1148) 12.50 KB (12,800 bytes) 8/23/2001 9:00 AM
svchost.exe c:\windows\system32\svchost.exe 792 8 204800 1413120 8/21/2003 1:17 PM 5.1.2600.0 (xpclient.010817-1148) 12.50 KB (12,800 bytes) 8/23/2001 9:00 AM
svchost.exe Not Available 880 8 Not Available Not Available 8/21/2003 1:17 PM Not Available Not Available Not Available
svchost.exe Not Available 900 8 Not Available Not Available 8/21/2003 1:17 PM Not Available Not Available Not Available
svchost.exe c:\windows\system32\svchost.exe 1844 8 204800 1413120 8/21/2003 1:17 PM 5.1.2600.0 (xpclient.010817-1148) 12.50 KB (12,800 bytes) 8/23/2001 9:00 AM
system Not Available 4 8 0 1413120 Not Available Not Available Not Available Not Available
system idle process Not Available 0 0 Not Available Not Available Not Available Not Available Not Available Not Available
winlogon.exe c:\windows\system32\winlogon.exe 512 13 204800 1413120 8/21/2003 1:17 PM 5.1.2600.0 (xpclient.010817-1148) 420.00 KB (430,080 bytes) 8/23/2001 9:00 AM
wmiprvse.exe Not Available 236 8 Not Available Not Available 8/21/2003 1:18 PM Not Available Not Available Not Available

 

[slider200]

Masterofnone..
I noticed there is a msconfig35.exe running in here.Could this be the culprit,since I never heard of that before.Also,just ending the process,wondering if that would be enough?
f not,what steps do I need to take to clean it up?
Thx again..

 

[bcastner]

Viri, worm, trojan
csrss.exe Not Available 488 13 Not Available Not Available 8/21/2003 1:17 PM Not Available Not Available Not Available
dw.exe c:\program files\downloadware\dw.exe 1472 8 204800 1413120 8/21/2003 1:17 PM 1.0.0.115 183.72 KB (188,128 bytes) 7/31/2003 10:36 PM
....

Very, very suspicious
svchost.exe Not Available 880 8 Not Available Not Available 8/21/2003 1:17 PM Not Available Not Available Not Available
svchost.exe Not Available 900 8 Not Available Not Available 8/21/2003 1:17 PM Not Available Not Available Not Available
......

Highly suspicious

ne.exe c:\progra~1\networ~1\v11\ne.exe 1184 8 204800 1413120 8/21/2003 1:17 PM 1.0.0.11 292.00 KB (299,008 bytes) 7/31/2003 10:37 PM
noads.exe c:\program files\noads\noads.exe 1512 8 204800 1413120 8/21/2003 1:17

Remedy:

1. Update your virus definitions now, and do a thorough virus scan of your hard disk.

2. Download AdAware, Spybot, and Hijack This! from:

http://www.spywareinfo.com/articles/hijacked/#removal

run all three.

 

[slider200]

ok...what was I thinking...I am unable to open task manager for more that 1/2 second...therefore unable to end that process.

 

[bcastner]

slider2000,

I missed that one.

msconfig35.exe c:\windows\system32\msconfig35.exe 1504 8 204800 1413120 8/21/2003 1:17 PM Not Available 24.00 KB (24,576 bytes) 8/8/2003 9:53 AM

From the internet:
"That file running was causing my task manager to close a second after I opened it. What I did was shut the process down BEFORE it closed me out, then went into System32 and deleted the file, then went into the registry and deleted all references to it. Got rid of it for good that way."