Help: RegEdit opens and then immediately closes

Hi Ollie,

As Will has stated, you need to run a virus check on the system with an
updated antivirus utility. The symptoms you are experiencing are a symptom
of several viruses, including Klez and Yaha. I would suggest that in
addition to your existing one, you also download stinger from
http://vil.nai.com/vil/stinger/, then restart in Safe mode and run the
system scans. This is necessary because the virus that is causing this
behavior will mask itself from protection in Normal mode.

How to start in Safe mode:
http://www.rickrogers.org/fixes.htm#Safe%20mode

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP
http://mvp.support.microsoft.com/
Associate Expert - WindowsXP Expert Zone
www.microsoft.com/windowsxp/expertzone
Windows help - www.rickrogers.org

"Ollie North" <Ollie.North RemoveThis @Contra.com> wrote in message
news:6utss05mnap2o2ktb9bbhd9ikt0pdrihmm@4ax.com...
> RegEdt32 and Task Manager also do this all of a sudden. Applied XP SP2
> and this did not help. Thanks for any guidance!

"Ollie North" <Ollie.North.RemoveThis@Contra.com> wrote in message
news:6utss05mnap2o2ktb9bbhd9ikt0pdrihmm@4ax.com
> RegEdt32 and Task Manager also do this all of a sudden. Applied XP SP2
> and this did not help. Thanks for any guidance!

Run an up to date virus check. One is available online here:
http://housecall.antivirus.com/

Then eliminate any scumware.
CAUTION!!!!! Before you try to remove spyware using any of these programs ,
download a copy of LSPFIX from any of the following sites:
http://www.cexx.org/lspfix.htm
http://www.spychecker.com/program/winsockxpfix.html
(if your OS is Win2k or XP) The process of removing certain malware may kill
your internet connection. If this should occur, this program, LSPFIX, will
enable you to regain your connection.

See
Dealing with Unwanted Malware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

Note that AdAware and SpyBot S & D will each catch some things the other
won't. Also, each needs to be updated with the program's update function
before every use, even when just downloaded. There's also a lot more to do
than just those two programs. CWShredder is also available here:
http://www.kellys-korner-xp.com/regs_edits/cwshredder.zip
**Post your HijackThis log to
http://www.spywareinfo.com/forums/
http://forums.tomcoyote.org/
http://www.wilderssecurity.com/ or the Spyware forum at
http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**
Alternative download pages for Ad-Aware, Spybot, HijackThis and CWShredder
may be found on this page:
http://aumha.org/a/parasite.htm.


See this link for information about malware:
http://arstechnica.com/articles/paedia/malware.ars

If nothing there helps, please post back to this thread.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx

Hi

Run a virus check on your system, with the latest definitions for your AV
program.

--


Will Denny
MS-MVP Windows Shell/User
Please reply to the News Groups


"Ollie North" <Ollie.North.TakeThisOut@Contra.com> wrote in message
news:6utss05mnap2o2ktb9bbhd9ikt0pdrihmm@4ax.com...
> RegEdt32 and Task Manager also do this all of a sudden. Applied XP SP2
> and this did not help. Thanks for any guidance!

Ollie North wrote:
> RegEdt32 and Task Manager also do this all of a sudden. Applied XP SP2
> and this did not help. Thanks for any guidance!


The type of behavior you describe is typical behavior of more than
one virus/worm, the three below being the most common:

W32.Klez
http://securityresponse.symantec.com/avcenter/venc/data/w32.klez.e@mm.html

W32.Yaha
http://securityresponse.symantec.com/avcenter/venc/data/w32.yaha.c@mm.html

W32.Spybot.Worm
http://securityresponse.symantec.com/avcenter/venc/data/w32.spybot.worm.html

Because many of the newer viruses and worms, such as the
Spybot mentioned above, can disable antivirus applications whose
definitions aren't kept up-to-date, try using one or more of the free
on-line scanners to double-check your system.

Trend Micro - Free online virus Scan
http://housecall.trendmicro.com/

McAfee Security - FreeScan
http://www.mcafee.com/myapps/mfs/default.asp

Symantec Security Check
http://security.symantec.com/ssc/home.asp

Panda ActiveScan - Free online scanner
http://www.pandasoftware.com/activescan/com/activescan_principal.htm


--

Bruce Chambers

Help us help you:
http://dts-l.org/goodpost.htm
http://www.catb.org/~esr/faqs/smart-questions.html

You can have peace. Or you can have freedom. Don't ever count on having
both at once. - RAH

On Sun, 26 Dec 2004 07:29:04 -0600, "Frank Saunders, MS-MVP"
<franksaunders.RemoveThis@mvps.org> wrote:

>"Ollie North" <Ollie.North.RemoveThis@Contra.com> wrote in message
>news:6utss05mnap2o2ktb9bbhd9ikt0pdrihmm@4ax.com
>> RegEdt32 and Task Manager also do this all of a sudden. Applied XP SP2
>> and this did not help. Thanks for any guidance!
>
>Run an up to date virus check. One is available online here:
>http://housecall.antivirus.com/
>
>Then eliminate any scumware.
>CAUTION!!!!! Before you try to remove spyware using any of these programs ,
>download a copy of LSPFIX from any of the following sites:
>http://www.cexx.org/lspfix.htm
>http://www.spychecker.com/program/winsockxpfix.html
>(if your OS is Win2k or XP) The process of removing certain malware may kill
>your internet connection. If this should occur, this program, LSPFIX, will
>enable you to regain your connection.
>
>See
>Dealing with Unwanted Malware, Parasites, Toolbars and Search Engines
>http://mvps.org/winhelp2002/unwanted.htm
>
>Note that AdAware and SpyBot S & D will each catch some things the other
>won't. Also, each needs to be updated with the program's update function
>before every use, even when just downloaded. There's also a lot more to do
>than just those two programs. CWShredder is also available here:
>http://www.kellys-korner-xp.com/regs_edits/cwshredder.zip
>**Post your HijackThis log to
>http://www.spywareinfo.com/forums/
>http://forums.tomcoyote.org/
>http://www.wilderssecurity.com/ or the Spyware forum at
>http://forum.aumha.org/viewforum.php?f=30 for expert analysis, not here.**
>Alternative download pages for Ad-Aware, Spybot, HijackThis and CWShredder
>may be found on this page:
>http://aumha.org/a/parasite.htm.
>
>
>See this link for information about malware:
>http://arstechnica.com/articles/paedia/malware.ars
>
>If nothing there helps, please post back to this thread.

Thank you! I had run numerous scans, and the key was safe mode and
WindowsockXPfix. Doh! All better now. Thanks so much!

"Ollie North" <Ollie.North.RemoveThis@Contra.com> wrote in message
news:q0lus0171qv53tifdd61c4e2ocot186vq6@4ax.com
>
> Thank you! I had run numerous scans, and the key was safe mode and
> WindowsockXPfix. Doh! All better now. Thanks so much!

Thanks for the feedback.

--
Frank Saunders, MS-MVP, IE/OE
Please respond in Newsgroup only. Do not send email
http://www.fjsmjs.com
Protect your PC
http://www.microsoft.com./athome/security/protect/default.aspx