Clean up Windows XP Startup Item List?

[benjnews]

Hi everyone,

After removing the spywares on my laptop with Spybot and Ad Aware, I
found out that the Startup list in my XP System Configuration Utility
is not completely clean (Start-> Run-> msconfig -> Startup).

On the list, I can still see items like (Startup Item -- Command --
Location):

optimize "C:\Program Files\Internet Optimizer\optimize.exe"
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
istsvc C:\ProgramFiles\ISTsvc\istsvc.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Msbb Msbb.exe SOFTWARE\Microsoft\Windows\CurrentVersion\Run

I am pretty sure these spyware .exe files have been removed, as
directories "ISTsvc" and "Internet Optimizer" are non-existence. But
the items still show up on the Startup list so I have to uncheck them.
I have also checked Windows registry tree and entries for the .exe
files are not in the registry either (e.g.,
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run).

Could someone please tell me how to remove these entries from the
Startup list? Or, does it mean my system is not completely cleaned?

Thanks in advance,

-Ben

 

[Guest]

The disabled entries are present in any of the locations:

[HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]
[HKLM\SOFTWARE\Microsoft\SharedTools\MSConfig\startupfolder]

regards
Hari
http://www.acelogix.com

 

[Kelly]

Hi Ben,

If they are unchecked via msconfig/startup and no longer listed under the
runkeys, they are gone. To clean up the msconfig/startup list:

Clear Disabled Items from Msconfig Startup (Line 148)
http://www.kellys-korner-xp.com/xp_tweaks.htm

 

[Boris Yankov]

If these files do not exist you don't have to worry.
These entries reside in the registry but can't run anything.
I would consider your system clean enough.

If you are still concerned download a startup manager and get rid of these.
I recommend InControl:
http://www.virtuoza.com/InControl/product.php

 

[benjnews]

I'd like to thank Hari, Kelly and Boris for the timely and valuable
help.

Indeed as Hari suggested, those residual items on the Startup list
were inside the HKLM\SOFTWARE\Microsoft\Shared
Tools\MSConfig\startupreg folder. With Kelly's tweaking tool, I was
able to clean the list up with the items removed from the registry.
Also thanks to Boris for the assurance and pointing out to InControl.

Always a learning experience when I get help from this group.

Thanks again,

-Ben

 

[ongjeff]

Hari,

I have a problem similar to Ben's. I've manually deleted c:\progra
files\istsvc folder but offending entries in the Registries that launc
those malware kept regenerating in spite of repeated deletion usin
ad-aware, spybot and manual registry delete. Min's a Win2K PC.

Can you help?

Ongjeff

*The disabled entries are present in any of the locations:

[HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg]
[HKLM\SOFTWARE\Microsoft\SharedTools\MSConfig\startupfolder]

regards
Hari
http://www.acelogix.com

Hi everyone,

After removing the spywares on my laptop with Spybot and Ad Aware I
found out that the Startup list in my XP System Configuratio Utility
is not completely clean (Start-> Run-> msconfig -> Startup).

On the list, I can still see items like (Startup Item -- Comman --
Location):

optimize "C:\Program Files\Internet Optimizer\optimize.exe"
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
istsvc C:\ProgramFiles\ISTsvc\istsvc.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Msbb Msbb.exe SOFTWARE\Microsoft\Windows\CurrentVersion\Run

I am pretty sure these spyware .exe files have been removed, as
directories "ISTsvc" and "Internet Optimizer" are non-existence. But
the items still show up on the Startup list so I have to unchec them.
I have also checked Windows registry tree and entries for th .exe
files are not in the registry either (e.g.,
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run).

Could someone please tell me how to remove these entries from the
Startup list? Or, does it mean my system is not completel cleaned?

Thanks in advance,

-Ben

-
ongjef

 

[Ramesh, MS-MVP]

Hi Ongjeff,

Follow the malware removal steps adviced here:
http://aumha.org/a/parasite.php