Correct...there is a problem that is internal to XP. There are also multiple viruses out there that cause the same problem. Try the MS suggested method first. Mikey...yes, sfc /scannow replaces missing, damaged, or corrupt system files. -=Bryan=-

0

Ok asgers advise worked but am not quite sure if this is permanent coz i see this MSCONFIG32.exe on startup with MSERVICES.exe are they or not a windows file? since this is the first time i've seen them in startup...is it true whut they are saying that its a virus?

0

Guess whut people! READ THIS and check if u have dcom.exe and webdav.exe in ur startup folder!!! its hack patch!!! weve been hack as we call it damn Update: Aug 5, 2003 If you came to this page because you found webdav.exe in your startup folder, you have been hacked by someone using the recent Microsoft RPC/DCOM vulnerability. The webdav.exe in your startup folder is NOT related to the Webdav exploit described in the page below; it is an IRC DDoS bot which gives the hacker full control over your system. If your antivirus vendor does not detect it, you should send a sample to them so they can write signatures for it. Once detected, your antivirus software should be able to remove it from your system. In order to prevent further penetrations of your system, you must install the patch provided by Microsoft at http://www.microsoft.com/technet/security/bulletin/MS03-026.asp. You can do this by running Windows Update and applying all critical updates for your system.

0

hey all!! I have the same problem here...ms config quickly closes when opened as well as task mangr ctrl alt delete...ive ran vir scans and troj scans and ive run chk dsk and sfc scan and ive tried creating a new account with admin options and it still did the same thing ..has anyone found a fix for this problem?? if so please email me and tell me how ya fixed it...thanx alot!! mike

0

ok i have no idea what this is but its on my computer also i got rid of it by using a resourse hacker and making a diffrent virsion of windows task manager and regedit you have to change the title in the title bar because this program uses api to close the program it needs a window call and if the window name is diffrent it cant close it so after that you just close it and delete it from your reg

0

refer to message 5888

0

Mikey, about mservices.exe, it's a TROJAN ! >> http://securityresponse.symantec.com/avcenter/venc/data/backdoor.optixpro.13.html

0

I booted Windows into safe mode so that I could run the registry editor. Under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, I saw a key that was labeled as MSCONFIG. The value was set to an executable file like PNHMMVYBO.exe (I can't remember the exact name, and I think this varies anyways). I deleted this key, then I did a search for PNHMMVYBO (no extension!). I found instances of it in 2 other places. I deleted all traces of this key and anything else that I was sure was related. For example, I found webdav.exe right next to one of the entries. Then I went to my startup folder and deleted webdav.exe, then rebooted. So far I've had no problems.

0

I had the same problem. (TESTING.exe was the file name for mine) You could have a spybot worm (W32.Spybot.worm.gen). This one is easy to erradicate if you know what you're doing and I haven't found an Anti-Virus app that identifies it yet. The file resides in the Windows/System 32 folder and can be named anything and with almost any file extension. There is no common nomenclature. Here is how you can find out what file is executing the process. Step1: Navigate to.../windows/system23 folder and copy TASKMGR.exe to your Desktop. Step2: From the.../windows/system32 folder, rename TASKMGR.exe to MGRTASK.exe Step3: Run MGRTASK.exe Step4: Now you can run your task manager and see what processes are running in the background. If there is a process running that you don't recognize, KILL IT by highlighting the process and clicking on [End Process]. Step5: If you think you killed the right process, try running REGEDIT (Click Start, Run, type REGEDIT and press [enter]. If REGEDIT opens, then you know you have isolated the right file. If it doesn't open, repeat steps 3-5 until you do find the right file. Step6: Once you have determined the file name, navigate back to the /windows/system32 folder and delete that file. Step7: Copy TASKMGR.exe back to your windows/system32 folder and delete MGRTASK.exe (at this point all of your programs should function again including REGEDIT, MSCONFIG, TASKMGR.exe Step8: Launch MSCONFIG (Click Start, Run, type MSCONFIG and press [enter]. Look at your startup programs. If you find your file name there, then you will need to delete it from your registry (click start, run , type REGEDIT and press [enter]. The key is located at HKeyLocalMachine/SOFTWARE/MICROSOFT/WINDOWS/CURRENT VERSION/RUN Step 9: Grab a stiff drink to celebrate, cause YOU'RE DONE! PS. Be careful because there may be more than one instance of the worm. Once you located the original file, look for other files with the exact same date and time stamp as potential copycats. Unfortunately, its hard to track some processes considering the complexity behind "morphing, camelianizing" files coupled with the multi-threaded processing, so don't get too ticked off at your Anti-Virus vendor.! Also, check your startup folder for an instance of WebDave.exe or TCP???? (no file extension). These files indicate that you have been hacked! Good luck, hope this helps! :)

0

Yes I am having the same problems as earlier mentioned. MY msconfig/regedit/ task manager will appear for 1-2 seconds then suddenly dissapear. Stupidly, i even paid best buy to have a look and they could not rid this problem. Ive tried going into safe mode and deleting msconfig.exe under regedit(in safe mode) and in the run and run once folder. I also have a CD from a employee at work called w32.blaster.removal tool remover and WindowsXP-KB823980-x86-ENU.exe but when i try to run the second one, i get an error message saying "Setup could not verify the integrity of the file Update.inf. Make sure the Cryptographic service is running on this computer. If anyone has ANY information to solve this id really appreciate and e-mail reply or follow up response. Thanks Jared

0

this had been bugging me for a couple of days now. i found it was only after i ran the ms patch for the msblaster virus. but it was not that on the same day i had another virus install itself. ran my antivirus app not found. ran spyware tool not found. searched c:\ for anything new and found a folder called c2media. i deleted this but was still having problems. i had this message pop up from my software firewall about as ??.scr trying to access the internet. i said no but the trojun was in and ran at start up and was doing what is in this article - http://sophos.com/virusinfo/analyses/w32nachia.html - as with the other messages rename task manager and then ran it and found process running end tasked and regedit running fine found reg key that was running it at startup every time. rename taskmgr and then run it get rid of that virus.

0

Like i said refer to msg 5888 for solutions on how i got rid of that webdav.exe....simply making a new user account with admin status same as ur original one then actually go on both user accounts and go to progam files>startup and get rid of webdav.exe and dcom.exe and open ur msconfig with the user account u just created and take out the check mark of webdav.exe and dcom.exe so it wont load up when u restart ur system...oh and if u dont knoe where MSCONFIG.EXE and MSERVICE.exe is do a search in ur hard drive specifically in ur win folder and do a virus scan in the same folder where they are coz a buncha virus/trojan are in there at least 20 files so i sugget u scan that folder, quarantine and delete dont bother trying to fix the files play safe rather.....

0

I've been having the same problem. I went to the System 32 folder and changed taskmgr to mgrtask. Norton Virus Alert then popped up with about 5 different files it detected and got rid of related to the Spybot worm. I was then able to open regedit/ctrl+alt+delete. But..... I went back into the System 32 folder to rename the mgrtask back to taskmgr and it says a file with the same name already exists, and I looked and it does! So now I can still open regedit but now if I go to the System 32 folder, I immediately get 5 or 6 Virus Alerts saying Norton has gotten rid of virus files. Any ideas on what is going on?

0

thing is it loads up on startup as soon as u open ur computer... did u try checking ur startup folder under Start Menu>Programs>Startup check if sumthing there that ur not familiar with and scan then remove it then go to start>run type in msconfig and check ur startup if the same file u got rid off is still loading (have check mark beside it) then now u can go to ur system folder and get rid of the files that keep on coming back .... hopefully ur comp should be ok thaz if u had the same prob that i had with msconfig webdav.exe/dcom.exe

0

I don't want to sound rude but has anybody actually found a fix for this. I have tried everything above but formatting and I have still have had no luck. I have too much software to reload to do a format. Can somebody please help me. If somebody has a fix, please email me at durhamj@rockinghamcc.edu

0