Removing items from MSCONFIG after WMF exploit



OK, so, I’m busy killing off running processes and fire up MSConfig to try to keep them from coming back on the next boot. To launch msconfig go to start, run… type in msconfig and click ok. The startup tab is where we’re looking for programs running at startup (makes sense…) This is a bit easier and more straightforward than visiting the run entry in the registry. It does combine a few locations into one place.


That much said, one or two visits I made were in the registry currentversion/run key that msconfig gives a listing for. Anyway, here’s what I found THERE….

There was an entry called system which was set to c:windowswsystem32kernels64.exe and xp_system which is set to c:windowsinet20001winlogon.exe in addition winstall.exe was run from c:winstall.exe

I was able to get rid of kernels64.exe and winstall.exe (they had been killed from memory using task manager.) Winlogon was running (two copies, system process and user process, the user process was coming from the strange directory inet20001 which is not a legit windows directory.)

The process of disabling did take a couple boots and the registry fix to run Task Manager had to be run each time as I tried to “kill” off running processes.

Related Posts

Blog Traffic Exchange Related Posts
  • Remote tech support with anything - would I do it? I've tried to ask myself if I'd trust someone enough to let them run a remote session on my own desktop to solve a problem. I think the answer is "it depends". If you think about it, I do tech support for home users quite a bit and they let......
  • How to Remove Total PC Defender | Total PC Defender Removal Guide Total PC Defender is a rogue antivirus application that installs via malware and trojans. The software then runs each time the system boots and will run a fake scan that is designed to scare the user. This scan will find security problems, numerous viruses and they will further claim that......
  • The latest and greatest in Malware Removals I have started referring to malware more and more lately because the term virus doesn't exactly describe the pests I see on peoples machines and the terms spyware or adware aren't doing justice to some of these pests either. (There are many pieces of what I would consider malware that......
Blog Traffic Exchange Related Websites
  • Review of Buying a Great Boat by Athur Edmunds When the author of a book is an ex naval architect, you're pretty much guaranteed that you're getting some first class knowledge when it comes to selecting the boat that is right for you. This book did not disappoint in any major way and is truly helpful for those buying......
  • Cleaner For Registry Errors The operating system of the computer has the registry at its core. Over time, the user will install and remove programs, always changing the registry contents. The registry can develop errors as it collects redundant and outdated files over time and it is necessary to fix them. If left alone,......
  • Good Advice on Running for Beginners Running is a sport which is easy to get in to. You do not need a lot of specialized equipment to get started. Running for beginners only requires a good pair of shoes and some good advice. This way you can get started off the right way. The most important......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site