Computer virus question
 

Is anybody aware of a virus that prevents the running of batch files? I had this just happen to me, I get no error, the batch file just won't run. I also cannot run regedit from START/RUN. It will start from a command prompt,but it close by itself 15 seconds later. If I rename regedit.exe, it stays open as it should. I am wondering if command.com has been attacked?

thanks
Fred

Can't comment on your exact problem, but ran into a Virus at a clients recently.
Actually one of those fake guys that comes up says you have a virus, and you have to buy THEIR virus scanner to remove it. It disables all kinds of stuff, wouldn't even let regedit run.

Do a remote regedit
NOTE NOT A SAFE THING TO DO, DO AS A LAST RESORT AND ONLY IF YOU HAVE A REASONABLE ABILITY TO FIX COMPUTERS.
EDITING THE REGISTRY IS DANGEROUS, REMOTE EVEN MORE SO.
OK, now the disclaimer is done.
Hook up a computer via a network and open regedit, the select the other computer. Depending on your setup you might have to do it by IP.
Do it while the other computer is on, but not Logged on.

Sorry, I can't find the key to be cleared, but it was a startup RUN key.

But the idea here is use REMOTE registry edit.

PLEASE SEE DISCLAIMER ABOVE.


Once that key is cleared, you should be able to work directly on the computer to clean and fix it.

Personal recommendations, TREND Micro and Advanced System Care.

I didn't realize you could do remote registry editing.

It is interesting that *something* closes regedit.exe. Makes me think something is running. I know task manager can be hacked to not show all processes that are running.

The problem I had was with Anti Virus 2009, you can search on it's removal.
If I find the key that need to be eliminated I'll post it. Just couldn't find it in a brief look through my notes, and searches.

Download malwarebytes, run it and report back. No need to edit the registry.

That was the issue I ran into.

You could not DL anything, couldn't even get to the web.

A lot of networking was kaput too.

Once this thing fired up you basically couldn't do anything w/o buying their product.

So stopping it from running gave me some control back to fix the other issue's it had created.