I found in the windows/currentversion/run registry key, that I have a listing
similar to if I ran MSCONFIG. I have a problem that I can't get a desktop on
my main server, so I was wondering if I could disable a startup program by
deleting it there from the registry? Please help asap. Thanks!

Also, I have a file I think I don't want in startup: it's shw32.exe. It's
located in the dllcache of system32, and it's set in the registry to start at
startup. Again, it's not shw32.dll, it's shw32.exe. I think my computer saw
it as a virus... but now it's not. Could this be malware, or is it a
necessary system process at startup? My other win 2000 server does not have
this program running at startup, which made me think it may be malware.

David

Google for shw32. It is not a native system file, but is included in a
several applic packages. You may then be able to determine which of your
apps (including perhaps an app since uninstalled) brought it in, and
determine whether it's authentic. Or really necessary at all.

PleaseHelp wrote:
> I found in the windows/currentversion/run registry key, that I have a listing
> similar to if I ran MSCONFIG. I have a problem that I can't get a desktop on
> my main server, so I was wondering if I could disable a startup program by
> deleting it there from the registry? Please help asap. Thanks!
>
> Also, I have a file I think I don't want in startup: it's shw32.exe. It's
> located in the dllcache of system32, and it's set in the registry to start at
> startup. Again, it's not shw32.dll, it's shw32.exe. I think my computer saw
> it as a virus... but now it's not. Could this be malware, or is it a
> necessary system process at startup? My other win 2000 server does not have
> this program running at startup, which made me think it may be malware.
>
> David
>
>
> ---
> avast! Antivirus: Inbound message clean.
> Virus Database (VPS): 0551-1, 12/20/2005
> Tested on: 12/20/2005 12:21:09 PM
> avast! - copyright (c) 1988-2004 ALWIL Software.
> http://www.avast.com
>
>
>



---
avast! Antivirus: Outbound message clean.
Virus Database (VPS): 0551-1, 12/20/2005
Tested on: 12/20/2005 12:27:07 PM
avast! - copyright (c) 1988-2004 ALWIL Software.
http://www.avast.com

In microsoft.public.win2000.registry =?Utf-8?B?UGxlYXNlSGVscA==?=
wrote:

> I found in the windows/currentversion/run registry key, that I
> have a listing similar to if I ran MSCONFIG. I have a problem
> that I can't get a desktop on my main server, so I was wondering
> if I could disable a startup program by deleting it there from
> the registry? Please help asap. Thanks!

Ensure you have a Full Registry Backup before editing the registry.

The "RUN" keys are just one set of locations from which
programs/services are started. Try (Sysinternals) AUTORUNS, which
IMO is far superior to MSCONFG. Manage Services via the
services.msc or sc.exe.

> Also, I have a file I think I don't want in startup: it's
> shw32.exe. It's located in the dllcache of system32, and it's
> set in the registry to start at startup. Again, it's not

Not a native W2K file. Could be left-over 3rd-party, or something
ugly. Anti-* scans and file Properties examination are warranted
most likely.

> shw32.dll, it's shw32.exe. I think my computer saw it as a
> virus... but now it's not. Could this be malware, or is it a
> necessary system process at startup? My other win 2000 server
> does not have this program running at startup, which made me
> think it may be malware.

On Tue, 20 Dec 2005 08:35:03 -0800, "PleaseHelp" <(E-Mail Removed)> wrote:

>I found in the windows/currentversion/run registry key, that I have a listing
>similar to if I ran MSCONFIG. I have a problem that I can't get a desktop on
>my main server, so I was wondering if I could disable a startup program by
>deleting it there from the registry? Please help asap. Thanks!
>
>Also, I have a file I think I don't want in startup: it's shw32.exe. It's
>located in the dllcache of system32, and it's set in the registry to start at
>startup. Again, it's not shw32.dll, it's shw32.exe. I think my computer saw
>it as a virus... but now it's not. Could this be malware, or is it a
>necessary system process at startup? My other win 2000 server does not have
>this program running at startup, which made me think it may be malware.
>
>David

See tip 0016 in the 'Tips & Tricks' at http://www.jsifaq.com


Jerold Schulman
Windows Server MVP
JSI, Inc.
http://www.jsiinc.com
http://www.jsifaq.com