Folder opens automatically at startup

[Hans Näslund]

All of a sudden, my laptop (Windows 2000 Professional) has started to open
the Program folder at startup. I guess some register setting has been
changed. Any hint what I could do to remove that setting?

 

[Mark V]

All of a sudden, my laptop (Windows 2000 Professional) has started
to open the Program folder at startup. I guess some register
setting has been changed. Any hint what I could do to remove that
setting?

Possible malware. Full Anti-* scans recommended.
Check all Startup items (registry and disk) using a competent Startup
Manager such as Autoruns (sysinternals) for example. Any other
anomalies or spurious processes or event log entries? "At startup"
means what? At Windows startup or at an account logon?

 

[Boris Yankov]

Most likely this is a setting in Explorer.
Open an explorer window. Then from the menu choose:
Tools -> Folder Options... -> View
Then uncheck 'Restore previous folder windows at logon'.

If that does not solve the problem use InControl:
http://www.virtuoza.com/InControl/product.php

 

[Hans Näslund]

There is no such option ('Restore previous folder windows at logon') in my
system (Swedish W2K Pro).

I have run AdAware and Spybot - no malicious objetcs. And neither InControl
nor Autoruns display any suspicious entries.

I have had this problem once before, but after a while (several months,
though) it disappeared by itself. I still guess some register setting has
been changed - but how do I know which one?

 

[Heelen Diyond]

Hi,
Check
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
See if there is some unavailing value such as ","

 

[Arkadiusz 'Black Fox' Artyszuk]

There is no such option ('Restore previous folder windows at logon') in my
system (Swedish W2K Pro). I have run AdAware and Spybot - no malicious
objetcs. And neither InControl nor Autoruns display any suspicious entries.
I have had this problem once before, but after a while (several months,
though) it disappeared by itself. I still guess some register setting has
been changed - but how do I know which one?

First of all check registry keys:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
and other "Run keys" for any incorrect entries with explorer.exe.
You can use msconfig or Codestuff Starter http://codestuff.mirrorz.com/
(W2K does not include msconfig utility). If it doesn't help go to
registry key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
and create/change dword value "SeparateProcess" - set it to 0;
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
and create/change dword value "DesktopProcess" - set it to 0.

FUT warning

 

[Hans Näslund]

Thank you for your advices; unfortunately they did not help.

I have checked the "Run" register keys - no suspicious entries could be
found.

I have also checked that
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advance
d\ SeparateProcess is set to 0, and I have created "DesktopProcess" in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer and set
it to 0. The same obnoxious folder keeps popping up at startup.

Btw - in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer there
is a string with the name "Vodka Lime 1" and the value 1744. What is that?
Can I remove it?

Hans Näslund

 

[Arkadiusz 'Black Fox' Artyszuk]

Thank you for your advices; unfortunately they did not help.
;-((

I have also checked that
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SeparateProcess is set to 0, and I have created "DesktopProcess" in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer and set
it to 0. The same obnoxious folder keeps popping up at startup.

Check /maybe/ also HKLM keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
and
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer
for the same values. Check registry key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
for dword value "PersistBrowsers" - it should be set to 0.

Btw - in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer there
is a string with the name "Vodka Lime 1" and the value 1744. What is that?

I don't know - AFAIK this is not a "standard key".

Can I remove it?

Make a backup of HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer
and delete that value.

 

[Hans Näslund]

;-(( - - -
Check /maybe/ also HKLM keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanc
ed
and
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer
for the same values. Check registry key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advance
d
for dword value "PersistBrowsers" - it should be set to 0.

I have done that - no similar values in the HKLM keys. No dword
"PersistBrowsers" i HKCU.

Hans Näslund

 

[Syed Abdullah]

All of a sudden, my laptop (Windows 2000 Professional) has started to open
the Program folder at startup. I guess some register setting has been
changed. Any hint what I could do to remove that setting?

 

[Syed Abdullah]

Try checking the startup folder.
Go to Start menu.
Then point to Programs
Then point to Startup
Delete Program folder
OR
Go to Start Menu
Click Run
In the box type in C:\Documents and Settings\All Users\Start
Menu\Programs\Startup
Then delete Progam folder

From,
Syed Abdullah