"" /autorun

[J741]

I have a computer on which I have observed some unusual behavior which I suspect may be the result of a virus, but which none of my antivirus utilities report as such.

The behavior is that the Windows System32 folder is opened at Windows startup, and the following entry is found in the HKLM/Software/Microsoft/Windows/CurrentVersion/Run registry key:

"" /autorun

If I delete this command from the specified regisrty key, then the System32 folder is not opened when Windows starts, but the registry key keeps getting replaced by something, and the effect can be observed at the next Windows startup.

Does anyone have any information which can help me isolate the source of this problem. Is it the effect of a new virus or something?

- James.


My memory is not as good as it should be, and neither is my memory.

I have forgotten more than I can remember

 

[bcastner]

http://support.microsoft.com/default.aspx?scid=kb;en-us;170086

 

[J741]

Thanks for the link Bill, but I've already removed the offending entry as the article suggests, but it just keeps coming back.

- James.


My memory is not as good as it should be, and neither is my memory.

I have forgotten more than I can remember

 

[bcastner]

It is clearly malware, but likely not a virus. See: faq608-4650