msconfig, regedit, task manager close immediately

**MAXIMUS2111-SPQR** · March 18th, 2005, 09:57 AM

any thoughts?

all 3 will either open & then close with a second or two or not open
all 3 work fine in safe mode

the system is clean of klez & yaha

HJT is clean
clean of viruses
clean of spyware

should i re-extract from cabs?

as always thanks in advance

**geoscomp** · March 18th, 2005, 10:37 AM

have you seen this?

there is a useful tool at the bottom of that link to create usable copies of those files

**Ferrit** · March 18th, 2005, 10:39 AM

Well maybe to start what windows system

**MAXIMUS2111-SPQR** · March 18th, 2005, 02:32 PM

its xp home

**Ferrit** · March 18th, 2005, 02:39 PM

If you have not already verified that the system has no viruses
using an online
scan I think thats where to start
www.pandasoftware.com/activescan
www.trendmicro.com

**MAXIMUS2111-SPQR** · March 18th, 2005, 02:42 PM

yup did that

safe mode network ran housecall found ZERO
ran NAV w/current defs in safe mode, system restore off....found ZERO

**Ferrit** · March 18th, 2005, 02:48 PM

OK now then go to Start Run type in sfc /scannow and hit enter

**geoscomp** · March 18th, 2005, 03:07 PM

It can't be a corrupt windows system file that would be fixed by sfc..or it would not work in safe mode. The same windows system files are accessed either way. Did you check processes for NETSTATT.EXE? Failing that, did you try the utility to make msconfig1.exe, etc and check to see if they would work? (after you make those files using the utility, you go to start/run and type in msconfig1.exe and hit enter)

**Reddman** · March 18th, 2005, 04:08 PM

Googled your issue and came up with the following:

"Sounds like you have installed yourself a variant of the HacDef Trojan.

See if you can find a file named hxdefdrv.sys in the Windows directory. Also,
try running REGEDIT, or MSCONFIG from the desktop 'run'. If it's HacDef, then
the application should start, and then abort. "

Here's a link with more information and removal instructions for HacDef (assuming that's what it is).
http://www3.ca.com/securityadvisor/v....aspx?ID=38058

Good luck!

**MAXIMUS2111-SPQR** · March 18th, 2005, 06:04 PM

I FINALLY GOT IT!!!!!

tahnks for all the helop ladies & gents

it was winrar32
i missed it on 1st glance

i used process exploresr from sysinternals to finally find it

again thanks for all the help

you all rock

**Kodiak** · March 18th, 2005, 07:54 PM

Why would winrar cause this?

**ironwill99** · March 18th, 2005, 11:03 PM

WinRAR shows up as WinRAR.exe in the process view of the task manager. I think a malicious app was trying to hide itself by using a variation of the name of a common program.