Yesterday I got a report from my customer that her computer is being infected by virus. Her description of the problem in her computer was computer is slow, can’t save any documents because her hard drive is nearly full although she doesn’t have much files, and Internet Explorer font is weird.
The first thing that I always do before anything is run MSCONFIG (System Configuration Utility) and check the startup entries there. It’s not the best tool to check for every programs that starts up with Windows, but it’s a basic one which is able to give me a rough idea if the computer is infected by virus or not.
When I go to Start, Run, type MSCONFIG and click OK, I got the error message “Windows cannot find ‘msconfig’. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search.”
Usually virus is the culprit for removing msconfig, regedit and etc from Run command. Anyway, here’s how I manage to bring back MSCONFIG to the Run command.
First of all, we need to make sure that the MSCONFIG file is still in your drive. Surprisingly MSConfig.exe is not located in Windows or System32 directory. Two ways to find where MSConfig.exe is. You can either use Windows search to look for *msconfig* or go to another computer, use Process Explorer to find the path to MSConfig.
As you can see, Process Explorer clearly shows that MSConfig.exe is located in C:\Windows\PCHealth\HelpCtr\Binaries\MSConfig.exe.
Go to C:\Windows\PCHealth\HelpCtr\Binaries\ and check if MSConfig.exe file is there or not. If it’s not there, you can copy it from another computer to the Binaries folder or if you only have Windows XP CD, open a command prompt window, insert your XP CD into the drive and enter the following command: (assuming D is your CD drive and C is where your Windows is installed)
EXPAND -R D:\I386\MSCONFIG.EX_ C:\WINDOWS\PCHEALTH\HELPCTR\BINARIES
That should restore MSConfig.exe to your Windows. IF MSConfig.exe is already there and you still can’t launch MSCONFIG from Run command, then the reference to the path within the registry may be wrong. Check this location in the registry:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MSCONFIG.EXE
In the right pane, next to Default, it should show:
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
Once you have both MSConfig.exe file in your computer and the registry path is set correctly, you shouldn’t have problems running msconfig command from Run.
In addition to the fix above, here’s a very good tool that is able to create usable copies of REGEDIT, MSCONFIG and Task Manager which I found from Doug’s website. This small VB 6 utility will create a usable backup copy of Taskmgr.exe, MSConfig.exe and Regedit.EXE in a new folder, called C:\EmergencyUtils. The new copies will be named Copy_of_Taskmgr.exe, Copy_of_MSConfig.exe and Copy_of_Regedit.com.
These programs are extremely helpful, and usually necessary in helping to rid your computer of a viral infection. Many virus programs will intercept these programs, based on their original file name, and prevent them from running. The alternate copies will not encounter this problem. Simply navigate to the C:\EmergencyUtils folder and double click the file you need to run.