Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations SkipVought on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

remove startup items 4

Status
Not open for further replies.

mmosier

Technical User
Aug 5, 2001
70
0
0
US
Seems like question of the day for me. I have items in startup I wish to remove. The boxes are not checked, no files to be found with simular names and nothing in registry of same. I've ran adware, but unckecked items remain in startup. Does anyone know how to get rid of these?
 
You'll find them in the registry. Try this:
START-RUN-type in REGEDIT-hit ENTER-open the following:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows|CurrentVersion\Run or Run- or RunOnce or RunOnceEx or RunServices or RunServices- or RunServicesOnce.

When you see the name of the file you don't want to appear anymore, delete it from the right-hand pane.

As always with editing the registry, backup before commencing.
Error! Keyboard not attached. Press F1 to continue
Phil
Si fractum non sit, noli id reficere.
 
roamer1

This program, Does it do the same as msconfig? I don't see any difference.

crusty

Thanks, I think we're heading in the right direction. If I go to the startup tab in mscofig, there is there is a program/file name not seen in registry. At least not under the run area.
 
mmosier,

Use the RightClick on any entry in Mlin's startup utility and I think you'll find what you need.
 
checkout in c:\windows\win.ini
under [windows]
see
load =

run=
is the unwanted program listed there ?
there is a big list below that i forund from some website for auto starting programs with windows. here it is.
------------------------------------------------------------

All Known and (so called) Unknown Windows Autostart Methods (10/03/2001)


1. Autostart folder

C:\windows\start menu\programs\startup {english}
C:\windows\Menu Démarrer\Programmes\Démarrage {french}
C:\windows\All Users\Menu Iniciar\Programas\Iniciar { Portuguese, Brasilian }

This Autostart Directory is saved in :
* [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
Startup="C:\windows\start menu\programs\startup"

* [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders]
Startup="C:\windows\start menu\programs\startup"

* [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders]
"Common Startup"="C:\windows\start menu\programs\startup"

* [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders]
"Common Startup"="C:\windows\start menu\programs\startup"


By setting it to anything other then C:\windows\start menu\programs\startup will lead to execution
of ALL and EVERY executable inside set directory.
Addendum : as of 10/03/2001 Subseven 2.2 now uses this method.




2. Win.ini
[windows]
load=file.exe
run=file.exe



3. System.ini
[boot]
Shell=Explorer.exe file.exe



4. c:\windows\winstart.bat
'Note behaves like an usual BAT file. Used for copying deleting specific files. Autostarts everytime.



5. Registry

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
"Whatever"="c:\runfolder\program.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce]
"Whatever"="c:\runfolder\program.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Whatever"="c:\runfolder\program.exe"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Whatever"="c:\runfolder\program.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Whatever"="c:\runfolder\program.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Whatever"="c:\runfolder\program.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices]
"Whatever"="c:\runfolder\program.exe"




6. c:\windows\wininit.ini

'Often Used by Setup-Programs when the file exists it is run ONCE and then is deleted by windows
Example content of wininit.ini :
[Rename]
NUL=c:\windows\picture.exe
' This example sends c:\windows\picture.exe to NUL, which means that it is being deleted.
This requires no interactivity with the user and runs totaly stealth.



7. Autoexec.bat

Starts everytime at Dos Level.



8. Registry Shell Spawning

[HKEY_CLASSES_ROOT\exefile\shell\open\command] @="\"%1\" %*"
[HKEY_CLASSES_ROOT\comfile\shell\open\command] @="\"%1\" %*"
[HKEY_CLASSES_ROOT\batfile\shell\open\command] @="\"%1\" %*"
[HKEY_CLASSES_ROOT\htafile\Shell\Open\Command] @="\"%1\" %*"
[HKEY_CLASSES_ROOT\piffile\shell\open\command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\batfile\shell\open\command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\comfile\shell\open\command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open\command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\htafile\Shell\Open\Command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\piffile\shell\open\command] @="\"%1\" %*"
The key should have a value of Value "%1 %*", if this is changed to "server.exe %1 %*", the server.exe
is executed EVERYTIME an exe/pif/com/bat/hta is executed.
Known as Unkown Starting Method and is currently used by Subseven.



9. Icq Inet
[HKEY_CURRENT_USER\Software\Mirabilis\ICQ\Agent\Apps\test]
"Path"="test.exe"
"Startup"="c:\\test"
"Parameters"=""
"Enable"="Yes"
[HKEY_CURRENT_USER\Software\Mirabilis\ICQ\Agent\Apps This key includes all the APPS which are executed IF ICQNET Detects an Internet Connection.



10. Explorer start-up

Windows 95,98,ME
Explorer.exe ist started through a system.ini entry, the entry itself contains no path information
so if c:\explorer.exe exist it will be started instead of c:\$winpath\explorer.exe.

Windows NT/2000
The Windows Shell is the familiar desktop that's used for interacting with Windows. During system
startup, Windows NT 4.0 and Windows 2000 consult the "Shell" registry entry,
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell, to determine the
name of the executable that should be loaded as the Shell.

By default, this value specifies Explorer.exe.

The problem has to do with the search order that occurs when system startup is in process.
Whenever a registry entry specifies the name of a code module, but does it using a relative path,
Windows initiates a search process to find the code. The search order is as follows:

* Search the current directory.
* If the code isn't found, search the directories specified in
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\Path, in the order
in which they are specified.
* If the code isn't found, search the directories specified in HKEY_CURRENT_USER\Environment\Path,
in the order in which they are specified.

More info : Patch :
General :
If a trojan installs itself as c:\explorer no run keys or other start-up entries are needed.
If c:\explorer.exe is a corrupted file the user will be locked out of the system. Affects all windows
version as of today.



11. Active-X Component [HKEY_LOCAL_MACHINE\Software\Microsoft\Active Setup\Installed Components\KeyName]StubPath=C:\PathToFile\Filename.exe

Believe it or not, this does start filename.exe BEFORE the shell (explorer.exe) and any other Program normaly
started over the Run Keys.


Misc Information
-------------------
[HKEY_LOCAL_MACHINE\Software\CLASSES\ShellScrap] @="Scrap object"
"NeverShowExt"=""

The NeverShowExt key has the function to HIDE the real extension of the file (here) SHS.
This means if you rename a file as "Girl.jpg.shs" it displays as "Girl.jpg" in all programs including Explorer.
Your registry should be full of NeverShowExt keys, simply delte the key to get the real extension to show up.


The always-up-todate version can be found at :
Int_13h


regards

Apoorva
An [indian] uses [pc2]

What solution I give is according to best of my knowledge and the information / feedback that you provide. So tell us more and we can lead you to right direction.
Internet is a tool respect it and use it for human wellfair.
 
There is little change in the list. The info that i gave had some error. the website has refined it but i hadn't.
Sorry for trouble. there the changes are.


Removed [HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices]
Thanks to MFC Spanx

Removed wrong Quotations from server.exe "%1 %*"
Thanks to Sorcer@Icare.nl

Added RunonceEX key
Thanks to MFC Spanx


You can see this page at






regards

Apoorva
An [indian] uses [pc2]

What solution I give is according to best of my knowledge and the information / feedback that you provide. So tell us more and we can lead you to right direction.
Internet is a tool respect it and use it for human wellfair.
 
When I run MLin's It give me about half the programs that are actually in startup. The program I am searching is not on MLin's list so delete does me no good.

I've been all through the system looking for a program in startup ending with .exe-m. Does anyone know what the "-m" means? Is it possible that this program is calling itself something else in the registry. There are a few items in the reg I don't reconize but afraid to touch. Thanks!
 
Don't be afraid to touch the registry, just make sure it's backed up, so if anything goes wrong, you can use a good copy.

The -m parameter could possibly signify a message that should appear in "xxxxxxxxxxx" after the command line.

If you would care to share the whole programme with us, I'm sure someone will know it and be able to advise. DOS Tip #1701: Add DEVICE=FNGRCROS.SYS to CONFIG.SYS
Phil
Si fractum non sit, noli id reficere.
 
Sorry to seem so novice, But could you guide me through backup?

I did go into reg and deleted one item which caused me troubles. Nothing more than re-installing things.

Startup item name is "5-2-46-112" I think it is one of those telephone pay sights that pop up from time to time.
 
OK, not difficult at all. START-RUN-type in REGEDIT-hit ENTER-FILE-EXPORT-call it 140103 and send it somewhere you're going to find later. To restore just double click the exported file.

Seems your problem is a Trojan virus and quite a problem world-wide. Here's how to get rid.

(1) Open your Browser. Delete all temporary internet files.
If you are using Internet Explorer this is located at
(Tools\Internet Options\Temporary Internet Files\Delete Files)

(2) Open MSConfig (Start\run\Msconfig) Click on the Startup tab and uncheck any file that contains a reference to:

5-2-46-112
webdialer
openme

When you close Msconfig not to bother restarting just yet.

(3) Run regedit. (Start\Run\regedit.com [Return])

Search for, and delete, any registry entry that references:

5-2-46-112

webdialer

openme (Please note that you should only delete the openme reference in the data string. DO NOT delete explorer.exe unless you want to reinstall Windows.)

(4) Shut your computer down completely. Do not use "restart." Turn the power off for 10 seconds.

Start your computer up again and your problem should be gone.

Note: Contrary to popular belief most people who are having this problem did not get this trojan by downloading and running porn.

Most got it downloading files on Kazza, Morpheus, Bearshare, etc., that claimed to be a small loader program for popular gaming files. Your virus-checking software will not detect this Trojan. Avoid these files.

To increase your security you might want to download a program called RegCleaner. It allows you to monitor what is being installed on your computer after the fact:


Another nifty program for Trojan detection and removal is The Cleaner:


And finally, a program to defeat the spyware programs that seem to be attached to all those FREEWARE applications you installed:


For more info on the concept of Spyware and Adware see:



HTH DOS Tip #1701: Add DEVICE=FNGRCROS.SYS to CONFIG.SYS
Phil
Si fractum non sit, noli id reficere.
 
Crustyoldbloke

I recently followed the links you provided above. Being an advocate and user of Adaware, I was blissfully unaware of the ongoing problems with the software (and company as well). This prompted me to D/L SpyBot Search & Destroy. Having just run a complete Adaware test, with no hits, I then ran SpyBot and found no less than 30 components that Adaware had missed.

Many others here have been recommending Adaware, and are presumably as ignorant as I. Perhaps an informational post would be in order. Thanks for the info. Star for you.
 
I recall reading somewhere that using MSCONFIG to remove start-up programs should only be done as a temporary troubleshooting effort. For a long term solution the registry must be modified, I don't believe MSCONFIG does this.

Regarding Crustyoldbloke's posting about RegCleaner:

That program's author, Jouni Vuorio, has updated and superceded that program with PowerTools which is a suite of applications for modifying, cleaning and otherwise tweaking your computer.

It is freeware for individuals and can be obtained at .

It also comes with a strong disclaimer as should any program that diddles your registry. Not for the faint hearted.
 
Roamer1

Ta for the star.

It's a huge disappointment to me, and other techies that I converse with privately, that the thread starter has not posted a thankyou message.

I will NOT help this person again!

On a side issue, I think that Spybot is the Bees Knees (English expression meaning very good) and Adaware pales into insignificance in it's face. Regards
Phil
 
Re: my post dated 14 January 2003. Since posting I have been enlightened into the Adaware failures and have done a couple of tests of my own. I have to say that Spybot is far superior. Not only does it search and destroy Spyware but also gets rid of Trojan dialers and all sorts of Malware. It even satisfies the paranoid ones amongst us by deleting all sorts of history lists in MS Office programmes (an absolute must for employees of MI6, CIA, FBI et al).

The Regcleaner referred to is very good, although I prefer Toniart's EasyCleaner, but not the latest Beta version. Regards
Phil
 
Hi Phil

been using spybot for about a mnth or so. its fantastic! i couldn't believe how much spyware stuff i had on my puter. like the tomcoyote site also.

cheers
TOM
 
Hello all: Here's a link that may prove useful to all those unsure as to what prog., it's purpose, etc; that may be found within MSCONFIG, startup tab: (be sure to check-out the "Startup Content" link near the top...ton of handy info there also). Also, a very useful tool for monitoring any app.that tries to register itself to run at startup,can be found here(it's also FREE):
It runs completely transparently until a program registers itself to run at startup< & it's only 60kb. Hope this stuff is useful to some1.
Regards,
Jimbowl. [peace]
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top