BigDogBigFeet

Join Date 12/2005

+397

Where oh where is my msconfig.exe?

Do I still have it and it's been hidden by an installed app or is something else going on?

Hi all,

Well as a result of Po's thread Virtual Memory Question I've discovered that when I click on start, run and type in msconfig and press enter ...... nothing happens. I fired up explorer and searched my windows sub, no go and did a system Search twice and again no go. Did some web searching and discovered one of 2 possibilities an installed app has it hidden from my through a system key setting or in the worst case malware. At present I'm not suspecting malware. System has no other problems currently and it's possible any of these progs could have it hidden: Ad-Aware 2007 Free, SpyBot Search and Destroy (I'm new to both of these) I also have Tune-Up Utilities 2006 and please don't gasp, Norton System Works(well mostly, lol).

Anywho, I thought I'd post to see if anyone has some insight as to what's caused this and what Reg Key(s) might be involved. I'm thinking that's probably what's happened.

Locked Post

Advanced Search

Watch this post

Do not email me updates for this post Email me updates for this post

Successfully updated karma reason!

You and Po should get married......

Put your XP disk in the drive, Start/ Run; type (c/p): sfc /scannow

If by chance you have a backup image

, location: C:\WINDOWS\pchealth\helpctr\binaries

Successfully updated karma reason!

HI Gary!

Successfully updated karma reason!

Hey Hotstuff

Think of you often........

Successfully updated karma reason!

BigDogBigFeet

Join Date 12/2005

+397

You and Po should get married......

He seems to be totally mad for Skinhit right now. Besides I don't have hairy man boobs and my legs and arse aren't right for his tastes.

Ok, let's see. I've found C:\WINDOWS\pchealth\helpctr\binaries and it has msconfig.exe so that does confirm the program is still on my machine. Using windows search should have found it but it didn't which seems to indicate something is blocking it. It also does not run when double clicking it.

I don't have original install disks because it's an HP machine and they give you an oh so special partition that windows treats as a separate drive. So... not sure what to make of this:

Put your XP disk in the drive, Start/ Run; type (c/p): sfc /scannow

Thanks for the help by the way. I'll check this thread again when I get home from work tonight.

Successfully updated karma reason!

Boot into Safe mode and hit C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe or run it from the run cmd line using the entire path. If it comes up, then some security app is blocking you from making system changes or you have an ugly running loose in your system.

Successfully updated karma reason!

BigDogBigFeet

Join Date 12/2005

+397

Ya, I was afeerd u'd say that. But you're right. Time to face it. I sent an email to Symantec since I'm running Norton SystemWorks with Norton Internet Security 2008. I don't do weekly full scanning, only monthly. Sigh.

Anyway last night my stop just prior this post was their free live chat. First "agent" that entered said she needed to escalate. That person arrived and the first one left. I continued to wait. My security issue stated "I cannot run msconfig.exe, does Norton SystemWorks block this from running?" I never got an answer. The second person simply left the room and I was cutoff completely. Registered user, 3 year account with them.

So, I sent an email and their automated response said we need 96 hours to respond. They cannot even tell me an answer to that question? It's not in their knowledgebase either.

Now my mechanical mouse is leaving mouse droppings on my mouse pad and my screen is upside down and reads right to left. Just kidding. I'll work on it yrag. I've never used Hijack this but for now my next step is a full system scan in safe mode. If it is a virus I think I know how it may have happened. Live and learn.

Successfully updated karma reason!

vStyler

Join Date 11/2004

+919

Many trojans and exploits disable the use of msconfig from the run dialog. Sometimes your task manager too.

You can use a program like Ccleaner to access start-up items in much the same way tho. Try turning off \ removing ANYthing unfamilar or that you dont use at Startup. Then reboot. You may also want to check your services via Admin Tools > Services.

FYI.. some trojans can also turn ur screen upside down.. remotely.

Lastly, I wouldn't trust Norton with my Money or Mother.

Successfully updated karma reason!

PoSmedley

Join Date 04/2005

+788

Well as a result of Po's thread Virtual Memory Question

Just do a system recovery. Reformat. Reinstall. Get it over with. Do it. Do it.

Do it!

You and Po should get married..

Ahhh...jealousy rears it's ugly head.

Besides I don't have hairy man boobs and my legs and arse aren't right for his tastes.

You shave? oooooOOOoooooooH! How metrosexual!

Successfully updated karma reason!

BigDogBigFeet

Join Date 12/2005

+397

Hi guys! Well can boot into safe mode no problems. Msconfig runs from the run command when in this mode. While in Safe Mode I've done 2 hours of scanning using Microsoft's Malicious Software Removal Tool (It responded "please remove your hands from the keyboard", I typed "Oh shit" removed my hands, and it responded "there I feel safer now"). It then allowed me to do a quick scan with it and nothing found.

I then fired up Ad-Aware 2007 free version and did a quick scan with it and it found 9 items, 8 of which were tracking cookies. Something to do with a browser hack of some sort all removed.

I ran Spybot Search & Destroy and it too came up empty.

I finally brought out the likely culprit, it's hard to distinguish it from a virus NIS 2010. A super alpha release. I started the scan and after about 1 hour it responded "I got stuck in an infinite loop while searching for myself, which way to Shangri-La?" Quick scan nothing found. Oh weel.

Deep scan tonight. Muhaw ha ha ha!

And no, msconfig still cannot be run from the run command or double clicked for that matter.

Successfully updated karma reason!

BigDogBigFeet

Join Date 12/2005

+397

So here's Symantec's response:

Thank you for contacting Symantec Technical Support.

I understand from your message that you are unable to run msconfig and wish to know whether Norton program blocks it.

This issue is not due to the Norton programs, this can happen when some threat resides on your computer or the important Windows Files are corrupted.

For assistance with this issue, please contact Microsoft. For information on contacting Microsoft Technical Support please click on the link provided below:

These guys are amazing they're telling me to get software virus removal assistance from Microsoft. Can you believe this? What the hell do I need their software for?

Successfully updated karma reason!

If something was there, you would have found it by now and it works in safe mode via path.

Open Registry:

KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MSCONFIG.EXE

The data string in the right pane should read:

C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe

If it doesn't, put it there. Re-boot

Successfully updated karma reason!

BigDogBigFeet

Join Date 12/2005

+397

More info:

KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MSCONFIG.EXE

The data string in the right pane should read:

C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe

This checks out just fine. When I attempt to run msconfig.exe (that is, when not in safe mode) I have discovered while checking task manager that it is in fact there as an active running process, it just isn't showing up on screen. Something that's loading in memory during regular boot-up is interfering with it most likely. Yikes. Now what?

Successfully updated karma reason!

This is turning into a mission.........

Just for the hell of it, let's see if something is sitting in memory and rearing it's ugly head on boot.

WWW Link

Install trial and run it.

Successfully updated karma reason!

BigDogBigFeet

Join Date 12/2005

+397

Installed trial and ran the quick scan. Nothing found sitting in memory. I'm running the full system scan currently and I'll run the full system scan with NIS tonight. If nothing pops here with 2 full system scans then I'm thinking a legitimate program conflict/problem of some sort. By the way thanks again yrag, I'm at least beggining to believe there's nothing malicious on my system. Still will run full system scans.

Successfully updated karma reason!

Give this a try:

WWW Link

Install and browse to:

C:\WINDOWS\PCHEALTH\HELPCTR\Binaries

Open msconfig.exe from there. Select the Profile tab in Dependency Walker and add msconfig.exe to the "arguments" field and open it.

It should show you any errors in loading....the operative word being "should"...

After that, jump in bed with Po'.....you're made for each other.

Successfully updated karma reason!

BigDogBigFeet

Join Date 12/2005

+397

It's looking for DWMAPI.DLL gives 2 warnings:
Warning: At least one delay-load dependency module was not found.
Warning: At least one module has an unresolved import due to a missing export function in a delay-load dependent module.

Seems to be flagging these as well red symbol SHLWAPI.DLL and MPR.DLL.

Could it be something is not right in services.msc?

After that, jump in bed with Po'.....you're made for each other.

He does strange things with memory sticks, chocolates and latex gloves. I know I saw it on his live web cam site "Mo' Po' ya no"

Successfully updated karma reason!

C:\WINDOWS\system32\SHLWAPI.DLL and MPR.DLL see what versions they are.

Successfully updated karma reason!

BigDogBigFeet

Join Date 12/2005

+397

MPR.DLL 5.1.2600.2180 SHLWAPI.DLL 6.0.2900.3231

Successfully updated karma reason!

MPR.DLL 5.1.2600.2180

Right

SHLWAPI.DLL 6.0.2900.3231

Wrong

When did msconfig stop showing (if you know) and are you running Vista?

Successfully updated karma reason!

BigDogBigFeet

Join Date 12/2005

+397

It says this: modified Thursday, October 11, 2007, 1:13:45 AM for SHLWAPI.DLL 6.0.2900.3231

It says this: modified Tuesday, August 10, 2004, 2:00:00 PM for MPR.DLL 5.1.2600.2180

I think you found the problem yrag! I'm supposed to be running XP SP2 latest updates.

One more piece to this strange puzzle, I did a full system restore around 12/2007 01/2008. So, why the modified date of 10/11/2007 on a system dll? Oh well, could still have a nasty then. It got corrupt somehow. So, is it fixable, that is start by replacing it with the correct version? Sure does explain Symantec's response better.

Successfully updated karma reason!

So, why the modified date of 10/11/2007 on a system dll?

Here's a hint: DWMAPI.DLL is a Vista file.

Unless you installed something funky (you and Po' are related after all), I'm going to guess it's IE7. Un-install it and it will revert to 6. Now try the msconfig. If it works, re-install IE7

WWW Link

If it does not work with IE6, do not re-install 7 until I give you a system fix.

HAVE A NICE DAY

Successfully updated karma reason!

PoSmedley

Join Date 04/2005

+788

I know I saw it on his live web cam site "Mo' Po' ya no"

By the way, you're subscription is about to run out.

Successfully updated karma reason!

ZubaZ

Join Date 11/2001

+917

I've never seen yrag so stumped.
Good for you BDBF!

Successfully updated karma reason!

I'm not stumped........just mildly disoriented

Here's a question for Bigdog, Po' and anyone else that has 'something' that is a no-show. Do you have Impulse installed?

Relish the moment before it's gone Zubahead.....

Successfully updated karma reason!

Here's a question for Bigdog, Po' and anyone else that has 'something' that is a no-show. Do you have Impulse installed?

Tried to run Msconfig on a whim; it's a no show (other than being listed in taskmanager). And I do have Impulse installed

Successfully updated karma reason!