# Programs open then quickly close



## orrink (Jun 19, 2004)

MSINFO for example will open for a split second then close on it's own. I've tried to reinstall windows 98se but no help.


----------



## ~Candy~ (Jan 27, 2001)

Hi and welcome. Will it open in safe mode?


----------



## orrink (Jun 19, 2004)

No it will not


----------



## ~Candy~ (Jan 27, 2001)

Ok, just to be certain, outline the steps you are taking and what you are typing and from where. I thought you were trying to open something like msinfo32, but I see you just typed msinfo.


----------



## ThunderCat8 (May 6, 2004)

I had something similar with Msconfig and regedit always shutting. I found out that what was causing it was a file called "Winexes.exe"

If this is what you have this is how you delete it. 

1. make all files visible (as winexes is a hidden file)
2. restart in safe mode
3. go to find, and type in winexes 
4. delete the file
5. enjoy your fixed computer 

If you don't have the file, then i'm afraid I cannot help you. Good luck! Tell us if it was winexes.


----------



## orrink (Jun 19, 2004)

Run - sysedit or Click msinfo.exe icon. Doesn't matter, program opens for a split second then closes itself. Word opens ok but some otjer utilities will just open then close or not open at all.


----------



## ~Candy~ (Jan 27, 2001)

Can you download hijack this and scan your system. It ends up being an exe file, so not sure if it will work. If it does, post a scan log.

http://www.spywareinfo.com/~merijn/downloads.html


----------



## KLT (May 7, 2003)

Hi orrink
Sounds like you have the W32/Zafi. B worm virus.
Good idea to run a AV software to check.


----------



## starwaves77 (Feb 17, 2002)

Hi Orrink,

Assume it's a virus, there are so many that will create your sympoms,

Download Exefix08.com to restore the original file associations with your *exe* files,

Double click on it's icon to run the fix,

****

Follow up with Mcafee Stinger 2.8

Run the program and it will automatically repair/fix virus damage,


----------



## orrink (Jun 19, 2004)

Logfile of HijackThis v1.97.7
Scan saved at 2:33:51 PM, on 6/21/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\SYMANTEC\PCANYWHERE\AWHOST32.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\NO POP.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\WINDOWS\START MENU\PROGRAMS\STARTUP\INTERNAT.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS.EXE

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRAM FILES\GRISOFT\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [PopUp Stopper] NO POP.EXE
O4 - HKLM\..\Run: [Windows Taskbar Manager] c:\windows\start menu\programs\startup\internat.exe
O4 - HKLM\..\RunServices: [awhost32] C:\Program Files\Symantec\pcAnywhere\\Awhost32.exe /A
O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\SYSTEM\mstask.exe
O4 - HKCU\..\RunOnce: [PopUp Stopper] NO POP.EXE
O4 - Startup: msupdate.exe
O4 - Startup: winupdate.exe
O4 - Startup: internat.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38089.5276157407
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = wcov
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 4.2.2.1,4.2.2.2,4.2.2.3


----------



## orrink (Jun 19, 2004)

PS - CAn't run regedit either


----------



## starwaves77 (Feb 17, 2002)

Orrink,

You have a couple worms/virus's.

*Run Hijack again,* checkmark these entry's and click on FIX,

****
C:\WINDOWS\START MENU\PROGRAMS\STARTUP\INTERNAT.EXE

O4 - HKLM\..\Run: [Windows Taskbar Manager] c:\windows\start menu\programs\startup\internat.exe

O4 - Startup: msupdate.exe
O4 - Startup: winupdate.exe
O4 - Startup: internat.exe

O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = wcov
****

Download the 'exefix08.com' in my previous post, double click it to run, that will get your exe files working again, don't reboot,

Then download the 'Stinger' from previous post, that should run now, it will automatically repair the virus,

Reboot into SAFE MODE: start pc, just after you hear the first BEEP, press the F5 key,

After it loads search for and DELETE:
msupdate.exe
winupdate.exe

****

*If you want to run regedit:*

Click start / programs / ms dos prompt
type the following/hit enter:

*copy regedit.exe regedit.com*

Now type:
*start regedit.com*

but run the exefix program and you won't have to do it,

*****

*Then from the internet run these scans:*

*Now run all of these online scans:* 
BitDefender Virus/Trojan Scan 
Mcafee Online Scan

Post a New Hijack log


----------

