Problems with winxp

[leonb]

I've got a very odd problem with my winxp installation. When I open regedit.exe, it opens for about 2 seconds and then closes automatically before I can do anaything. The same happens when I press ctrl+alt+del to call up the tasks manager - open and then automatically closes. This is the only programs i've identified so far that does this.

Can anyone help me solve this - I dont want to reinstall windows.

Thanks
Leon

[Ramirez]

That's definitely looks like a virus activity to me, have you tried to scan your drives with any good antiv app?/(Spayware Remover?) (Also boot your machine in safe mood and then see what happens)

HTH

[leonb]

Scanned it with the newest virus dat-file and it didn't pick up any virus. Also scanned with Ad-aware ver.6 - no spyware except for the one entry needed to run divx5.

Will try safemode and let you know.

[leonb]

In safemode everything works like normal. How should I go about finding what causes the problem?

[TactX]

You should have a look at "HKLM\Software\Microsoft\Windows\CurrenVersion\Run" and "HKLM\Software\Microsoft\Windows\CurrenVersion\RunOnce" with a registry editor and look for something that looks strange (startup of unknown apps).

You could also take a look at the corresponding HKCU subkeys although I've never seen any malware registering there...

Good luck ;)

[TactX]

O.K., I've done some searching on Worms and such.

This page (http://www.ku.edu/acs/virus/viruses/yaha.shtml) is about a w32 worm called Yaha.
Yaha terminates most common antivirus programs, firewalls and regedit. It's difficult to disinfect in regular Windows mode; It continually reinstalls its registry keys and files on disk while it's in memory -- delete something, Yaha puts it back.
Unfortunately Sophos (my favourite AV) describes tons of Yaha variants. An interesting one is this. (http://www.sophos.com/virusinfo/analyses/w32yahaq.html)
W32/Yaha-Q contains a long list of anti-virus, windows management and security applications whose processes are terminated if they are found to be running. The worm will also terminate any process that have an associated window with the any of the following titles:
Windows Task Manager
System Configuration Utility
Registry Editor
Process Viewer

This one (http://http://www.sophos.com/virusinfo/analyses/trojspyboti.html) might be interesting, too (Not a Yaha variant).
The Trojan also terminates the following processes:

REGEDIT.EXE
MSCONFIG.EXE
TASKMGR.EXE
NETSTAT.EXE

Again, have luck ;)