spiceball
Topic Starter
Hello:
I am having trouble with errors and lockups and have to reboot my computer several times. I ran
PC Pitstop Full Tests and have posted a link for your information.
http://www.pcpitstop.com/techexpress.asp?id=Q9BSHWA7SLWSZ0EW
Also ran Spybot, Ad-Aware and AVG Anti-Spyware and they were all clean. Also used ATF Cleaner and CCleaner. However, when I ran CWShredder, I got Variant 31: CWS.Msconfig. After I removed it, my StartupMonitor Warning dialog box said:
The program MSConfig has registered the executable C:\Windows\PCHealth\HelpCtr\Binaries\MSConfig.exe/auto
When I clicked No, Spybot put up a dialog box saying that Search & Destroy has detected an important registry entry that has been changed.
Category: System Startup global entry
Change: Value deleted
Entry: MSConfig
Unless, I click on Yes, Spybot will keep re-opening that dialog box.
Trend Micro's definition of Variant 31: CWS.Msconfig
Approx date first sighted: February 5, 2004
Symptoms: IE pages being hijacked to www.31234.com on system startup and when changing homepage back, continuous errors about an invalid Registry script in temp2.txt, extra item in right-click menu of webpages named '??????'
Cleverness: 2/10
Manual removal difficulty: Involves a process killer, some Registry editing and restoring a Windows system file from CD
This variant uses the filename msconfig.exe which overwrites the real Windows file in Windows 98/98SE/ME. The temp2.txt file it drops is actually a Registry script, but since it's in the wrong format, Windows 9x/ME will throw up an error about an invalid Registry script. Windows 2000/XP will import it without complaining, creating the '??????' item in the IE right-click menu. The msconfig.exe file will always stay in memory, reinstalling the hijack every 5 seconds. Killing the process, deleting the file and restoring the IE homepages/search pages fixes this hijack.
Help! How can I kill the process and delete the file?
I am having trouble with errors and lockups and have to reboot my computer several times. I ran
PC Pitstop Full Tests and have posted a link for your information.
http://www.pcpitstop.com/techexpress.asp?id=Q9BSHWA7SLWSZ0EW
Also ran Spybot, Ad-Aware and AVG Anti-Spyware and they were all clean. Also used ATF Cleaner and CCleaner. However, when I ran CWShredder, I got Variant 31: CWS.Msconfig. After I removed it, my StartupMonitor Warning dialog box said:
The program MSConfig has registered the executable C:\Windows\PCHealth\HelpCtr\Binaries\MSConfig.exe/auto
When I clicked No, Spybot put up a dialog box saying that Search & Destroy has detected an important registry entry that has been changed.
Category: System Startup global entry
Change: Value deleted
Entry: MSConfig
Unless, I click on Yes, Spybot will keep re-opening that dialog box.
Trend Micro's definition of Variant 31: CWS.Msconfig
Approx date first sighted: February 5, 2004
Symptoms: IE pages being hijacked to www.31234.com on system startup and when changing homepage back, continuous errors about an invalid Registry script in temp2.txt, extra item in right-click menu of webpages named '??????'
Cleverness: 2/10
Manual removal difficulty: Involves a process killer, some Registry editing and restoring a Windows system file from CD
This variant uses the filename msconfig.exe which overwrites the real Windows file in Windows 98/98SE/ME. The temp2.txt file it drops is actually a Registry script, but since it's in the wrong format, Windows 9x/ME will throw up an error about an invalid Registry script. Windows 2000/XP will import it without complaining, creating the '??????' item in the IE right-click menu. The msconfig.exe file will always stay in memory, reinstalling the hijack every 5 seconds. Killing the process, deleting the file and restoring the IE homepages/search pages fixes this hijack.
Help! How can I kill the process and delete the file?
