HijackThis Log - Problems with msconfig, regedit

Question

Hello,

I am having trouble running msconfig, regedit, and right clicking on files to get the shortcut menu. I have run McAfee Virus Scan, Adaware, and spybot-s&d.

Here is my HijacktThis log file. Thanks for your help.

Logfile of HijackThis v1.99.1
Scan saved at 7:55:23 PM, on 1/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MSMPSVC.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\PROGRA~1\McAfee\MSC\mctskshd.exe
C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\SiteAdvisor\4979\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe
C:\Program Files\Windows Media Connect 2\WMCCFG.exe
C:\Program Files\Dell Photo AIO Printer 922\dlbtbmon.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\ESPNRunTime\DIGServices.exe
C:\Program Files\McAfee\MSK\MskAgent.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\SiteAdvisor\4979\SiteAdv.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\Program Files\Digital Line Detect\DLG.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpEng.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\4979\SiteAdv.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: McAfee Popup Blocker - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - c:\program files\mcafee\mps\mcpopup.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\4979\SiteAdv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Dell Photo AIO Printer 922] "C:\Program Files\Dell Photo AIO Printer 922\dlbtbmgr.exe"
O4 - HKLM\..\Run: [DLBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Windows Media Connect 2] "C:\Program Files\Windows Media Connect 2\WMCCFG.exe" /StartQuiet
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKLM\..\Run: [DIGServices] C:\Program Files\ESPNRunTime\DIGServices.exe /brand=ESPN /priority=0 /poll=24
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\4979\SiteAdv.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Uniblue Registry Booster] C:\Program Files\Registry.Booster.v1.1.WinALL.CRACKED-iNDUCT\CRACK\RegistryBooster.exe /S
O4 - Global Startup: Digital Line Detect.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/install/cli/1.1.1067.14/WinSSWebAgent.CAB
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.safety.live.com/resource/download/scanner/wlscbase8460.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168868230937
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\4979\SiteAdv.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: McAfee Application Installer Cleanup (0040621168863779) (0040621168863779mcinstcleanup) - McAfee, Inc. - C:\WINDOWS\TEMP\004062~1.EXE
O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Log Manager (McLogManagerService) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mclogsrv.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Task Scheduler (mctskshd.exe) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mctskshd.exe
O23 - Service: McAfee User Manager (mcusrmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcusrmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: MSMPSVC - Unknown owner - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MSMPSVC.exe" -n 4 (file missing)
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\4979\SAService.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

RKinner · Answer

Log doesn't show anything.

I know of a bug that makes dummy files called msconfig.com and regedit.com so that they get chosen before the legitimate files. Try msconfig.exe and regedit.exe and see if either works.

For the right click problem ShellExView is about the best tool.

Get ShellExView from http://www.nirsoft.net/utils/shexview.html install and run it.

Scroll to the far right and count back four columns. The column should say Micro... If you expand it by dragging the line to the right it will say Microsoft. Click on this column once (maybe 2 x) and it should sort the entries by NO then YES. Note the last NO line and move to the far left. Click on the first NO line then hold the shift key down and move with the mouse to the last NO line and click it. This should select all of the NO lines. Now click on the red light below File.

Close the program then either reboot or right click on the clock and select Task Manager then Processes. Find Explorer.exe and End Process. Then restart Explorer (From Task Manager, File, New Task(run), explorer.exe, OK). Now rightclick and see if things are better.

If the problem is gone then you go back to ShellExView and enable (green light) about half of the ones you disabled the first time and see if the problem comes back. The idea is to isolate it to the bad shell extension and either leave it disabled or replace it with a newer version.

If the problem comes back then we know it's not a shell extension problem so you can run shellexview and enable everything back the way it was.

Ron

garmerr · Answer

I tried the msconfig.exe command and got an error message stating that microsoft could not find msconfig.exe.  I tried the regedit.exe command and I was able to access the registry editor.   As for the shellexview, I did as you stated.  However, after following your directions, I was still unable to right click.   Also, I have noticed a general slowness to my comp.

RKinner · Answer

I think we have established the presence of regedit.com and there are probably a lot more of the same type but they are usually hidden. Let's look for them.

To enable the viewing of Hidden files follow these steps:

Close all programs so that you are at your desktop.
Double-click on the My Computer icon.
Select the Tools menu and click Folder Options.
After the new window appears check Use Classic folders then Apply then select the View tab.
Put a checkmark in the checkbox labeled Display the contents of system folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.
Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.
Press the Apply button and then the OK button.
Now your computer is configured to show all hidden files.
While still in Explorer locate the Windows folder in the left pane. Click on the plus in front of it. Then look in the subfolders under Windows for System32 and click on it. In the right pane may be a message saying something like you don't need to see these files but if you must click on this link. Click on the link.

In the right pane see if you can find regedit.com. To make your life easier go up to the toolbar and look for the little rightmost icon on the bottom toolbar. It looks like a little window and has a down arrow next to it. When you run the cursor over it it will say Views. Open it. Click on Details and it will change the right pane from a bunch of icons to an alphabetical list of files.

If regedit.com is not in System32 then it will be in Windows or the root \ folder so look there.

Once you find it then note the time and date under Date Modified then click on Date Modified. This will sort them by date and time. Look for file with the same date and time (plus or minus 5 minutes) and tell me what you found. You can delete regedit.com, msconfig.com, taskmgr.com ping.com, netstat.com without waiting for me.

Also click on Windows, and use Views to get the details list form then sort them by Date Modified and look for files with the same date and time as before. Repeat for C:\. What do you find?

Ron

garmerr · Answer

In the System32 file, I found the following:   cmd, ping, regedit, tasklist, tracert - all with the exact same time and date.  However, there was no .com extension.  However, when I double clicked on the 'regedit' file, it gave the same results as when I used the run-> regedit command.  When I moved the 'regedit' file to the recycle bin and repeated the run-> regedit command, the registry editor worked properly.   I did not find any other files that corresponded to this time in the windows or root/ drives.

RKinner · Answer

OK now that you know the date and time of the infection do a search for all files for that date.   Start, Search, For Files or Folders, click on When was it Modified then Specific date and then put in the date of the infection in both the From and To boxes.  Check under More Advanced Options that the first three boxes are checked then Search.  When it finishes, use the Views icon to get the details list then sort by time by clicking on Date Modified.  Look for the same time as before (+/- 5 minutes).  You can delete the ones you reported in your last post and anything that is in a Temp folder or ends in .tmp.  Anything else note where it was and the name and report back.   Ron

garmerr · Answer

Here is what I found that was at the same date modified time:   taskkill - C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\FakeMSNBeta   netstat - C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\FakeMSNBeta1   The date modified time was the same as the 'regedit, etc.' files i found before (6/28/2005 @6:56pm).  When I go to this file, these are saved as WinRAR Zip archives.    There are other files that come up, but none are within the +- 5 min time frame.   Another thing I have noticed is that there is no 'search' command in my start menu and it doesn't work when I click on the 'Search' button when in Classic view.  The only way I can search is by switching out of classic view.   Thanks, Gary

RKinner · Answer

The files we found had already been removed by Spybot so nothing to worry about there.   For search see if this helps:   The first two you just save to your desktop then doubleclick and allow them to go into the registry   http://www.kellys-korner-xp.com/regs_edits/search.reg   http://www.kellys-korner-xp.com/regs_edits/OldSearchOn.reg   This one turns off the criitters. It's a vbs files so some antivirus programs may choke on it.   http://www.kellys-korner-xp.com/regs_edits/noasst.vbs   Ron

garmerr · Answer

Alright!  I got the 'search' back on to the start menu!   However, I am not sure how to use the .vbs file.  When I save it to my hard drive and double click it, all I get is a text file when I select run.  Am I doing something wrong?   Also, I downloaded a copy of msconfig from perfectdrivers, but when I try to make a change or even if I don't make a change and select close when I run the utility, I get an error message that states:   'An access denied error was returned when attempting to change a service.  You may need to log on using an Adminsitrator account to make the specified change.'   However, my account is the only account and I have an adminstrator rights.  Any idea what is causing this?   Thanks for all of your help,   Gary

RKinner · Answer

You may have to wait until Monday for the msconfig problem.  I don't even have it on this Win2K here at home but I will see what I can find out about the problem.   Ron

RKinner · Answer

No.  The vbs file should run when doubleclicked.  Sometimes an antivirus will eat vbs files when you try to download them but usually the text message tells you it did so.  Also uninstalling Norton will sometimes kill off vbs.   Usually it's a file association thing.  It's really not a bad idea to disable scripting that way if you are not using it.  Right click on Start and select Explore then Tools, Folder Options, FIle Types.  Find the vbs extension and then Advanced, select Open,  Edit.  It should say:   C:\WINDOWS\System32\WScript.exe '%1' %*   Does it?  If not change it to the above and say OK.   When I disable it I change the wscript.exe to notepad.exe then it does what you are seeing.   Ron

garmerr · Answer

I changed the .vbs file associations, but when I run it, I get an error message stating 'the is no script engine for file extention .vbs'.   Gary

RKinner · Answer

Try the download here.   http://www.microsoft.com/downloads/details.aspx?FamilyID=c717d943-7e4b-4622-86eb-95a22b832caa&DisplayLang=en   That should reinstall wscript.exe.   Ron

RKinner · Answer

My msconfig is located at: C:\Windows\PCHealth\HelpCtr\Binaries

Do a search for msconfig and see if you have one in C:\Program Files\Msconfig\

One of the bugs likes to put a file (and folder) there.

I found this but I only have XP Pro so I don't know if it will work on XP home.

-Goto start->run and type 'regedit' (without the ')

-From here expand HKEY_LOCAL_MACHINE then right click on the SOFTWARE folder and
choose permissions.

-From here you may notice that the Everyone group is there but the
Administrators/System groups are not available/present. (You will want to keep the
everyone group, and make sure that they have Full Control and Read access here as
well).

-You will want to choose Add button from here, Then click the Advanced button, then
click the Find Now button to show all the users on the computer in the bottom of
this dialog box.

-Choose the 'Administrators' group from here, Click OK from here, and then ok to
the next Window, one the original permissions window give the Administrators Group
'Full Control' and 'Read' access.

-Do the same and add the SYSTEM group as well with Full Control and Read Access.

-Restart the machine.

They have you start in Software. Might be better to go down to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig since that's the only thing that is not working.

Ron

Virus & Spyware

HijackThis Log - Problems with msconfig, regedit

Was this post helpful?