entries in "hklm\software\microsoft\windows\currentversion\run" get deleted on reboot

[asimwajid]

for the last few days entries in
"hklm\software\microsoft\windows\currentversion\run" get deleted on
reboot ..... ive had to move all my programs that i want to run on
windows startup to the startup folder. any idea why this is happening ?

 

[Dave Patrick]

You can set up auditing. Run regedit.exe then browse to subkey, then
Edit|Permissions|Advanced|Auditing|Add|"everyone"|OK then check 'Delete'

Then check the Event log security for errors.

--

Regards,

Dave Patrick ....Please no email replies - reply in newsgroup.
Microsoft Certified Professional
Microsoft MVP [Windows]
http://www.microsoft.com/protect

| for the last few days entries in
| "hklm\software\microsoft\windows\currentversion\run" get deleted on
| reboot ..... ive had to move all my programs that i want to run on
| windows startup to the startup folder. any idea why this is happening ?
|

 

[Malke]

for the last few days entries in
"hklm\software\microsoft\windows\currentversion\run" get deleted on
reboot ..... ive had to move all my programs that i want to run on
windows startup to the startup folder. any idea why this is happening ?

What changed in the last few days? Did you install any security software?
Software that prevents changes to that part of the registry and your
homepage? Some of the Norton security programs do that, as does Spybot
Search & Destroy, and quite a few other antispyware/security programs.

Malke

 

[asimwajid]

What changed in the last few days? Did you install any security software?
Software that prevents changes to that part of the registry and your
homepage? Some of the Norton security programs do that, as does Spybot
Search & Destroy, and quite a few other antispyware/security programs.

Malke
--
MS-MVP Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic"

thanks for the replys guys....thats what getting to me...NOTHING has
changed at all

 

[Elmo]

for the last few days entries in
"hklm\software\microsoft\windows\currentversion\run" get deleted on
reboot ..... ive had to move all my programs that i want to run on
windows startup to the startup folder. any idea why this is happening ?

I have seen this behavior before on your system has a virus. Did you run a
system scan?
--
-E-
Download my free home PC Basics guide.
http://www.conejonetwork.com
Bottom of the page, PDF format.
Tell us what else you would like to see.

 

[asimwajid]

I have seen this behavior before on your system has a virus. Did you run a
system scan?

yeah scanned with nod32 and norton

 

[asimwajid]

no one ?

yeah scanned with nod32 and norton

 

[asimwajid]

(e-mail address removed) wrote:
now i just realized that nothing is being saved....not even my desktop
settings or quicklaunch settings....guys iam desperate here.

 

[Bob I]

Time to create a new profile and see if that works any better.

 

[frodo]

look for errors in the event log

could be a bad profile, as suggested

you might benefit from the User Profile Hive Cleanup Service, an optional
MS component; google for it.

as usual, run all available scans to validate that you don't have a nasty;
doing it from safe mode is best bet for a system that seems compromised,
the smarter nasties know all about the scanners that might catch them.

finally, things in the RUN key being "undone" are often done w/ good
intentions by spyware monitors, whose goal is to prevent something new
from adding itself to the run list. validate that you are not running one
of these "automatic" or "runtime monitor" utilities.

good luck