Solved

WINOSCFG.EXE  Loading

Posted on 2002-03-31
18
150 Views
Last Modified: 2013-12-29
In my system configuration utility under win.ini
it shows this loading when I click on the windows folder -   Load=C:\WINDOWS\WINOSCFG.exe
What is it and how do i remove it totally?
0
Comment
Question by:M9340
  • 5
  • 3
  • 3
  • +3
18 Comments
 
LVL 22

Accepted Solution

by:
cookre earned 200 total points
ID: 6909088
I believe that's a worm.

1) Rename c:\windows\winoscfg.exe to something else, say, xinoscfg.xex

2) remove that line from win.ini

3) save a and reboot

If everything runs OK for several days, go back and delete the renamed file.
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 6909093
I found this page that might be helpful:

http://www.computing.net/windows95/wwwboard/forum/100385.html

Have not found anything else that might explain what it is, but as the computing net reply on the above page said, it could be a virus.
0
 
LVL 41

Expert Comment

by:stevenlewis
ID: 6909112
find the file in windows explorer, right click choose proerties, then check the version, see who makes it
0
 
LVL 3

Expert Comment

by:lpenrod
ID: 6909590
0
 

Author Comment

by:M9340
ID: 6909693
Cookre, you said, If everything runs OK for several days, go back and delete the renamed file.
do I just delete the renamed file and leave Load=C:\WINDOWS
please explain. thank you.
So far everything seems fine since i did what you said.
0
 
LVL 22

Expert Comment

by:cookre
ID: 6909742
If the line in the ini file is just LOAD=C:\WINDOWS, you can delete that now - it's not doing anything now anyway.

The reason I had you rename the file itself was just in case it turned out to be something you might need.  As you can see, none of us are really sure what the file is (although it is certainly NOT a Microsoft file that's part of the OS), since there are only three hits to it by the various search engines.

Hence, if everything seems to run OK with the file itself named something else (i.e., no program that may be looking for the file under its' original name complains or craps out[fine technical term that], then you can either just leave it or, assuming it is a worm that, oddly enough, none of the main scanner vendors seems to know anything about, you're probably best off simply deleting it.
0
 
LVL 17

Expert Comment

by:Wakeup
ID: 6909854
Do you have any antivirus software loaded?  You may want to invest in some.  That may help you find out if it is a virus or not.

Maybe try one of these if you dont want to buy any:
http://housecall.antivirus.com/
http://www.grisoft.com/html/us_index.htm
http://www.free-av.com/

Here is a list of some of the free AV progs out there:
http://www.thefreesite.com/Free_Software/Anti_virus_freeware/
Have it scan WINOSCFG.exe file as well as your system.
It may remove it if it is a virus.  
0
 
LVL 3

Expert Comment

by:lpenrod
ID: 6910046
I checked several virus companies virus databases and they did not list the file as a virus.  That does not mean that it is not one though.
0
 
LVL 17

Expert Comment

by:Wakeup
ID: 6910059
lpenrod, did you have the virus databases scan it?!  not just to see if the file is listed as a virus.  Did you scan it that is the main thing.  And I agree it may not mean that it is not a virus.  But at least check to see if it is scanned as a virus.
0
Make managing Office 365 email signatures a breeze

Are you using Office 365? Having trouble trying to set up email signatures for your users? Getting stressed out managing multiple signatures? Need an easier way to manage? We have a solution for you, try the most-user friendly and powerful signature management tool on the market.

 
LVL 3

Expert Comment

by:lpenrod
ID: 6910143
No.  I don't have that file installed.  I was just checking to see if a file what that name was listed.
0
 

Author Comment

by:M9340
ID: 6910546
Yes I have a anti virus that is installed and up to date and it does not find that file as being a virus.
A few weeks ago I did find that I had some kind of spyware on my system that i removed it was MSBB.EXE
Maybe this WINOSCFG.exe is some how connected to that.
It only shows up in the win.ini as Load=C:\WINDOWS\WINOSCFG.exe    I can not find any other reference to it anywhere in windows.
0
 
LVL 17

Expert Comment

by:Wakeup
ID: 6910795
Ok, another thing to try if it may be leftovers of Addware such as Gator or spyware or commet cursor or anything like this.  Try:

http://63.217.29.135/downloads.html

It will take to you ad-ware download site where you can download an ad-ware remover.  It is excellent and it provides a free version.  This program found like over 30 instances of AD-ware on my machine that I didn't know was running on my machine.  And got rid of lots of unwanted files related to ad-ware on my machine.  Try it and see if that gets rid of the file in question.

0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 6910878
If you take a look at this Annoyances.org forum thread, you will find that MSBB.EXE is installed as a program that monitors your web surfing, and one of the programs that puts it there is Bearshare.  Do you use Bearshare?  
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 6910879
Whoops, forgot to include the url for the forum:

http://www.annoyances.org/exec/forum/win95/n1011997046
0
 

Author Comment

by:M9340
ID: 6911585
I have a addware remover. I don't use bearshare.

cookre, I deleted the the line LOAD=C:\WINDOWS  like you said.
Everything is fine. Why is there something that looks like a pencil still there in the line?
0
 

Author Comment

by:M9340
ID: 6911593
I have a addware remover. I don't use bearshare.

cookre, I deleted the the line LOAD=C:\WINDOWS  like you said.
Everything is fine. Why is there something that looks like a pencil still there in the line?
0
 
LVL 22

Expert Comment

by:cookre
ID: 6911768
Stray character? Semi-colon? Exclamation mark?  Vertical bar?

If that's all that's there, just get rid of the whole line.
0
 

Author Comment

by:M9340
ID: 6911894
You really helped. Thanks to everyone for all your input
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you get continual lockouts after changing your Active Directory password, there are several possible reasons.  Two of the most common are using other devices to access your email and stored passwords in the credential manager of windows.
Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
This Micro Tutorial will give you a basic overview of Windows DVD Burner through its features and interface. This will be demonstrated using Windows 7 operating system.
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …

863 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now