Msconfig Startup list unusual item

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

Dear all,

I have an unusual item in my startup list, as follows:

Startup Item - W
Command - C:\W
Location HKLM\SOFTWARE\Microsoft\Windows\CurrentVerion\Run

Does anybody recognise this?

Many thanks for any help,

John Kenchington
 
John said:
Dear all,

I have an unusual item in my startup list, as follows:

Startup Item - W
Command - C:\W
Location HKLM\SOFTWARE\Microsoft\Windows\CurrentVerion\Run

Does anybody recognise this?

Many thanks for any help,

John Kenchington
Click to expand...

No. Get rid of it!
 
Agreed, think: trojan.

Follow these "relatively" simple removal steps:

Restart in Safe mode by hitting F8 as Windows first begins to load on boot.
Logon as administrator. As this can be tricky, you will find help in doing
this here:
http://www.rickrogers.org/fixes.htm#Safe mode

Start/search/files and folders, look for <filename> and delete it wherever
it is found (hopefully it is not found if your antivirus software is doing
its job).

Click start/run, type regedit and click ok. Expand the plus (+) signs to
look under these keys:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg

Look in the right hand pane for the string or strings that load that file.
Delete just those strings that contain the reference. Do not delete other
strings or the keys from the left pane. Close the registry editor when
completed, make sure you check all strings.

Go to the Control Panel/System/System Restore tab. Check the box to "Turn
off system restore on all drives". Click apply/ok. This will remove all
restore points, however you don't want them back as some or all of them will
contain the virus depending upon how recently you got infected.

Restart the system normally. Go back to the Control Panel/System and restart
System Restore.

Update your antivirus software, run a full system scan.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Associate Expert - WindowsXP Expert Zone

Windows help - www.rickrogers.org
 
John said:
Dear all,

I have an unusual item in my startup list, as follows:

Startup Item - W
Command - C:\W
Location HKLM\SOFTWARE\Microsoft\Windows\CurrentVerion\Run

Does anybody recognise this?

Many thanks for any help,

John Kenchington
Click to expand...

Probably some garbage dropped by a trojan/virus/malware. Do a virus scan
and spyware scan and get rid of it.

Steve
 
John said:
Thank you everybody, this was most helpful.

John.
Click to expand...

HKLM\SOFTWARE\Microsoft\Cryptography\Calais\Current and the like. It
belongs there. Cryptographical services.
 
Because the antivirus programs I have used have not kept viruses off my
computer, I have been studying my system using on-line resources. One of the
places I look everytime I go on my computer is the start/run/msconfig/startup
tab. Recently, I have been finding items on it that have nothing under
Startup Item and command, but under location, it has. Twice I was able to
uncheck this item and it stayed unchecked, but for the past week or two,
there is an item there that is always checked. I uncheck it and am required
to restart the computer, then it will be checked again. This is what is
under location:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVer...

I have given this information to my current antivirus program, Xoftspy, but
they have not corrected it. Can you advise me?
 
From: "Janet" <[email protected]>

| Because the antivirus programs I have used have not kept viruses off my
| computer, I have been studying my system using on-line resources. One of the
| places I look everytime I go on my computer is the start/run/msconfig/startup
| tab. Recently, I have been finding items on it that have nothing under
| Startup Item and command, but under location, it has. Twice I was able to
| uncheck this item and it stayed unchecked, but for the past week or two,
| there is an item there that is always checked. I uncheck it and am required
| to restart the computer, then it will be checked again. This is what is
| under location:
|
| HKLM\SOFTWARE\Microsoft\Windows\CurrentVer...
|
| I have given this information to my current antivirus program, Xoftspy, but
| they have not corrected it. Can you advise me?
|

XoftSpy is NOT anti virus. It is supposed to be anti spyware and was at one time listed on
Spyware Warrior as a Rogue applications. They lifted that designation but I think the were
to hasty in lifting that designation as a Rogue.

http://www.spywarewarrior.com/rogue_anti-spyware.htm



If you are using any version of Sun Java that is prior to JRE Version 5.0,
then you are strongly urged to remove any/all versions that are prior to JRE
Version 5.0. There are vulnerabilities in them and they are actively being exploited.
It is possible that is how you got infected with malware.

Therefore, it is highly suggested that if there are any prior versions of Sun Java
to Version 5 on the PC that they be removed and Sun Java JRE Version 5.0 Update 6
be installed ASAP.

http://www.java.com/en/download/manual.jsp


For non-viral malware...

Please download, install and update the following software...

* Ad-aware SE v1.06
http://www.lavasoft.de/
http://www.lavasoftusa.com/

* SpyBot Search and Destroy v1.4
http://security.kolla.de/

After the software is updated, I suggest scanning the system in Safe Mode.

I also suggest downloading, installing and updating BHODemon for any Browser Helper Objects
that may be on the PC.

* BHODemon

http://www.majorgeeks.com/downloadget.php?id=3550&file=11&evp=245a87539eea8ed6904332b4b8b8442d

For viral malware...

* Download MULTI_AV.EXE from the URL --
http://www.ik-cs.com/programs/virtools/Multi_AV.exe

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your
FireWall to allow it to download the needed AV vendor related files.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor's web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can
download the files and perform a scan in Normal Mode. Once you have downloaded the files
needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key
during boot] and re-run the menu again and choose which scanner you want to run in Safe
Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help
file. http://www.ik-cs.com/multi-av.htm


* * * Please report back your results * * *
 
David H. Lipman said:
From: "Janet" <[email protected]>

| Because the antivirus programs I have used have not kept viruses off my
| computer, I have been studying my system using on-line resources. One
of the
| places I look everytime I go on my computer is the
start/run/msconfig/startup
| tab. Recently, I have been finding items on it that have nothing under
| Startup Item and command, but under location, it has. Twice I was able
to
| uncheck this item and it stayed unchecked, but for the past week or two,
| there is an item there that is always checked. I uncheck it and am
required
| to restart the computer, then it will be checked again. This is what is
| under location:
|
| HKLM\SOFTWARE\Microsoft\Windows\CurrentVer...
|
| I have given this information to my current antivirus program, Xoftspy,
but
| they have not corrected it. Can you advise me?
|

XoftSpy is NOT anti virus. It is supposed to be anti spyware and was at
one time listed on
Spyware Warrior as a Rogue applications. They lifted that designation but
I think the were
to hasty in lifting that designation as a Rogue.

http://www.spywarewarrior.com/rogue_anti-spyware.htm
Click to expand...

The threat of legal action seems to have had that kind of effect for other
things in the past. It makes you wonder......
 
=?Utf-8?B?SmFuZXQ=?= said:
Because the antivirus programs I have used have not kept viruses off my
computer,
Click to expand...

It's up to you to keep viruses off your computer. Your anti-virus
program is ONLY a backup.
 
Back
Top