Cant access msconfig

[Camthalion]

Hello. I have had this problem for a while that I can not access msconfig. I tried through run as well as trying to access the file manually. I can assess it now, but I had to change its name. My computer is also running slow lately, so I wondered if this was just a symptom of a larger problem. I am attaching a current HiJackThis log and would appreciate any assistance. Thank you.

[PhilliePhan]

Hi Camthalion,

Let's go ahead and do this:

• Download combofix.exe by sUBs to your computer's Desktop.
  
• Alternate Download
  
• (If you already have a previous version, delete it and download a new version).
• Double click combofix.exe & follow the prompts.
  Note: Combofix will automatically disconnect your Internet connection when it runs, do not reconnect it.

When it finishes, it ought to

• Produce a log for you. ( C:\ComboFix\ComboFix.txt)
• Restore your Internet connection.

IMPORTANT:

• Do not use your computer while Combofix is running.
• Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  If you've lost your Internet connection when Combofix has completely finished, re-start your computer to restore it.

Please post the log for Judy and hang in there until she is able to have a look. I don't work with malware too often these days due to other commitments.

Best Luck
PP

[Camthalion]

Due to classwork and illness, its taken a while for me to get back on here and tell the results. I ran ComboFix once, and while running, I noticed 3 or 4 programs it stopped, but after the reboot, it froze before it could create the result file. I ran it again and here are the results in ComboFix.txt:

ComboFix 08-02-13.2 - Gerald 2008-02-14 11:41:15.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1526 [GMT -6:00]
Running from: C:\Documents and Settings\Gerald\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
The following files were disabled during the run:
C:\Program Files\iolo\Common\Lib\sguard.dll

EDIT: P.S. ComboFix never did return my system clock back to the 12 hr AM/PM format either... But I fixed that manually.

[PhilliePhan]

Due to classwork and illness, its taken a while for me to get back on here and tell the results.

Not a problem - most of the volunteers in support forums have "real lives" that intrude upon their Internet lives as well

--- Could you please use the "manage attachments" button when you post back to locate and upload C:\ComboFix\ComboFix.txt for Judy.
What you posted doesn't help us.
-- I'd like to do it this way rather that running ComboFix again, though we will likely do that later.....

Thanks
PP

[Camthalion]

Sure. Heres the ComboFix.txt as an attachment.

[PhilliePhan]

Hello. I have had this problem for a while that I can not access msconfig.

I assume you could access and use this at one time? Is this your machine, or one issued to you by school?
Often businesses and schools limit msconfig, regedit and the like.

Of course, malware does this too. For example:
http://www.sophos.com/virusinfo/anal...2sdbotcaf.html


Anyhoo, we definitely need to see a bit more than a HJT log, so let's try this:

I have attached an early version of a tool I've been writing off and on as time permits. It is definitely a "run at your own risk" proposition (as are all tools you are asked to download and run in support forums )
This version is pretty simple and will give us a decent look at what is or isn't going on.....

-- Please download the attached PeekabooXP.zip and Extract the PeekabooXP Folder to your Desktop.
-- Open the Folder and DoubleClick RUN ME.bat and follow the prompts.
-- A log should pop up in notepad. Please save and submit that for us.

Sometimes this tool will hang if you do not disable your resident AV. I doubt this will happen with this early version - the scan should actually be pretty quick.
If it does hang or you would prefer not to disable your AV, you can run this in Safe Mode to avoid any problems.

Cheers
PP

[Camthalion]

I assume you could access and use this at one time? Is this your machine, or one issued to you by school?
Often businesses and schools limit msconfig, regedit and the like.

Yes, I used to be able to access msconfig, and this is my personal laptop that I've had for a few years.

I ran the scan in safe mode and am attaching the text file.

[PhilliePhan]

Well . . . . I feel kinda stupid . . LOL!

I see that (and should've seen in the first HJT) you have "iolo technologies' System Mechanic Professional 7"installed.

I would be willing to bet that its "System Guard" feature is what is preventing you from running msconfig......
Here we had ComboFix run into trouble with it - it was practically waving its arms and shooting up flares - and I completely missed it. I'm definitely getting too old for this ****!

-- I would also add that msconfig is a diagnostic tool and not a startup manager. There are better ways to deal with unwanted startups.

-- I don't see any malware in your logs. Though, I would suggest uninstalling the below in Add/Remove programs:
"J2SE Runtime Environment 5.0 Update 6"
"Java(TM) 6 Update 2"
"Java(TM) SE Runtime Environment 6 Update 1"
"Java(TM) SE Runtime Environment 6"

Then, update your Java at http://www.java.com/en/
Yo do need to remove all older versions. This will help keep baddies such as Vundo at bay....

Let us know if System Mechanic was the culprit.

Best
PP

[Camthalion]

Thank you! That was the problem! I wasn't really worried about being able to use msconfig so much as making sure something bad wasn't the culprit. Thanks for your help and the clean bill of health!

[PhilliePhan]

Thank you! That was the problem! I wasn't really worried about being able to use msconfig so much as making sure something bad wasn't the culprit. Thanks for your help and the clean bill of health!

You're welcome! Happy to help

If you desire, you could have HJT fix these:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.defaulthomepage.info
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

Other than that, I think you're good to go.

PP