System32 Folder During Startup

A

Alan Edwards

I thought you had removed Aim6?
Please do so.

I can't see anything obvious in the rest.

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html



[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\\Program Files\\Logitech\\Desktop
Messenger\\8876480\\Program\\BackWeb-8876480.exe"
"H/PC Connection Agent"="\"C:\\Program Files\\Microsoft
ActiveSync\\WCESCOMM.EXE\""
"Mozilla Quick Launch"="\"C:\\Program
Files\\Netscape\\Netscape\\Netscp.exe\" -turbo"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Aim6"=""
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

====================================================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Zone Labs Client"="C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\"
-hide"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"Share-to-Web Namespace Daemon"="C:\\Program Files\\Hewlett-Packard\\HP
Share-to-Web\\hpgs2wnd.exe"
"Pure Networks Port
Magic"="\"C:\\PROGRA~1\\PURENE~1\\PORTMA~1\\PortAOL.exe\" -Run"
"OASClnt"="C:\\Program Files\\mcafee.com\\antivirus\\oasclnt.exe"
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE"
"HPHUPD08"="c:\\Program Files\\HP\\Digital
Imaging\\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\\hphupd08.exe"
"HPBootOp"="\"C:\\Program Files\\Hewlett-Packard\\HP Boot
Optimizer\\HPBootOp.exe\" /run"
"HP Software Update"="C:\\Program Files\\HP\\HP Software
Update\\HPwuSchd2.exe"
"HostManager"="C:\\Program Files\\Common
Files\\AOL\\1137256522\\ee\\AOLSoftware.exe"
"EmailScan"="C:\\Program Files\\mcafee.com\\antivirus\\mcvsescn.exe"
"ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe"
"D-Link AirPlus XtremeG"="C:\\Program Files\\D-Link\\AirPlus
XtremeG\\AirPlusCFG.exe"
"ANIWZCS2Service"="C:\\Program Files\\ANI\\ANIWZCS2 Service\\WZCSLDR2.exe"
"AlwaysReady Power Message APP"="ARPWRMSG.EXE"
"AOLSPScheduler"="C:\\Program Files\\Common
Files\\AOL\\1137256522\\ee\\services\\sscAntiSpywarePlugin\\ver1_10_3_1\\AOLSP Scheduler.exe"
"sscRun"="C:\\Program Files\\Common
Files\\AOL\\1137256522\\ee\\services\\sscFirewallPlugin\\ver1_10_3_1\\SSCRun.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"














Alan Edwards said:
Yes, post an export of your Registry run keys (they are not folders)

....Alan
 
G

Guest

Alan,

I had previously uninstalled aim6. One of the kids must have reloaded.
Anyway, I uninstalled again and no luck, system32 folder is still pooping up
upon startup.

Danny

Alan Edwards said:
I thought you had removed Aim6?
Please do so.

I can't see anything obvious in the rest.

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html



[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\\Program Files\\Logitech\\Desktop
Messenger\\8876480\\Program\\BackWeb-8876480.exe"
"H/PC Connection Agent"="\"C:\\Program Files\\Microsoft
ActiveSync\\WCESCOMM.EXE\""
"Mozilla Quick Launch"="\"C:\\Program
Files\\Netscape\\Netscape\\Netscp.exe\" -turbo"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Aim6"=""
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

====================================================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Zone Labs Client"="C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\"
-hide"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"Share-to-Web Namespace Daemon"="C:\\Program Files\\Hewlett-Packard\\HP
Share-to-Web\\hpgs2wnd.exe"
"Pure Networks Port
Magic"="\"C:\\PROGRA~1\\PURENE~1\\PORTMA~1\\PortAOL.exe\" -Run"
"OASClnt"="C:\\Program Files\\mcafee.com\\antivirus\\oasclnt.exe"
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE"
"HPHUPD08"="c:\\Program Files\\HP\\Digital
Imaging\\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\\hphupd08.exe"
"HPBootOp"="\"C:\\Program Files\\Hewlett-Packard\\HP Boot
Optimizer\\HPBootOp.exe\" /run"
"HP Software Update"="C:\\Program Files\\HP\\HP Software
Update\\HPwuSchd2.exe"
"HostManager"="C:\\Program Files\\Common
Files\\AOL\\1137256522\\ee\\AOLSoftware.exe"
"EmailScan"="C:\\Program Files\\mcafee.com\\antivirus\\mcvsescn.exe"
"ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe"
"D-Link AirPlus XtremeG"="C:\\Program Files\\D-Link\\AirPlus
XtremeG\\AirPlusCFG.exe"
"ANIWZCS2Service"="C:\\Program Files\\ANI\\ANIWZCS2 Service\\WZCSLDR2.exe"
"AlwaysReady Power Message APP"="ARPWRMSG.EXE"
"AOLSPScheduler"="C:\\Program Files\\Common
Files\\AOL\\1137256522\\ee\\services\\sscAntiSpywarePlugin\\ver1_10_3_1\\AOLSP Scheduler.exe"
"sscRun"="C:\\Program Files\\Common
Files\\AOL\\1137256522\\ee\\services\\sscFirewallPlugin\\ver1_10_3_1\\SSCRun.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"














Alan Edwards said:
Yes, post an export of your Registry run keys (they are not folders)

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html



On Mon, 8 May 2006 05:44:01 -0700, in
microsoft.public.windowsxp.general, Danny

Alan,

Thanks, I found the Regional & Language settings. Must have been tired last
night!

Well, Ctfmon.exe is now disabled. System 32 flder is still popping up!
Should I post what is in my registry run folders just in case I missed
something?

Danny

:

Danny,

You have to realize that there can be different views in XP for
Control Panel.
I don't see that terminology either, as I don't like category view.
Just use Regional and Language Options if that is what you see (as I
did)

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html



On Sun, 7 May 2006 18:26:01 -0700, in
microsoft.public.windowsxp.general, Danny

Alan,

I am starting to wonder if the issue is in startup.

I disabled Aim6-folder still comes up.

Went thru the KB282599 to disable ctfmon.exe. No luck as it still loads.
The only step of the process I could not perform was step 2 as my version of
XP does not have: "In Windows XP, click Date, Time, Language, and Regional
Options, and then click Regional and Language Options. On the Languages tab,
click Details."

Spent time disabling startup items - no luck.

Danny


:

Danny,

I don't know why you didn't narrow it down as you could have done it
in about five restarts if you disabled half at a time.

I gave you the information of ctfmon.

You have nothing against Aim6.
If that correct, then remove it and see if it is your problem.

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html

On Sun, 7 May 2006 14:45:01 -0700, in
microsoft.public.windowsxp.general, Danny

So far I have not eliminated the problem. I noticed that I had Avast! as a
registry entry and after googling found it is remenants off a past virus
program. They had a clear uninstall, but it still left some of the program
and one registry entry so I manually deleted. Using Mike's startup I tried
to remove the ctfmon, but it keeps reloading after each boot.

I again tried the latest MV stinger and also ran the last on-line Avast!
after I saw it in the registry and prior to manual removal. I also tried
deleting all the files in the pretfetch directory - did not make a difference.

I have not ediited the msinfo32.

Danny

:

What did you find out using Msconfig or Mike's Startup as a
troubleshooter?
If you narrowed it down to ctfmon, then read this:
http://www.sysinfo.org/startuplist.php?filter=ctfmon
If you didn't narrow it down to ctfmon, what did you find as the
culprit?

Some of your Msinfo32 information is different to mine.
e.g. you have:
Windows Defender c:\program files\windows defender\msascui.exe -hide
I have:
Windows Defender "c:\program files\windows defender\msascui.exe" -hide
Have you edited the Msinfo32.exe information? If so it is of little
use to me.

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html



On Sun, 7 May 2006 13:31:01 -0700, in
microsoft.public.windowsxp.general, Danny

Alan,

Sorry for the delay, but i have been out of town. Each line string was too
long, so I posted the program & command columns. I also use start up by Mike
Linn & tried to keep ctfmon.exe from starting up,. but each time I disable it
re-enables.

Here is the msinfo32 info.

Thanks for hanging in there with me!

ANIWZCS2Service c:\program files\ani\aniwzcs2 service\wzcsldr2.exe
AOLSPScheduler c:\program files\common
files\aol\25894456\ee\services\sscantispywareplugin\ver1_10_3_1\aolsp
scheduler.exe
Adobe Gamma adobe gamma.lnk
Adobe Reader Speed Launch c:\progra~1\adobe\acroba~1.0\reader\reader~1.exe
Aim6
AlwaysReady Power Message APP arpwrmsg.exe
D-Link AirPlus XtremeG c:\program files\d-link\airplus xtremeg\airpluscfg.exe
EmailScan c:\program files\mcafee.com\antivirus\mcvsescn.exe
H/PC Connection Agent c:\program files\microsoft activesync\wcescomm.exe
HP Software Update c:\program files\hp\hp software update\hpwuschd2.exe
HPBootOp c:\program files\hewlett-packard\hp boot optimizer\hpbootop.exe /run
HPHUPD08 c:\program files\hp\digital
imaging\{33d6cc28-9f75-4d1b-a11d-98895b3a3729}\hphupd08.exe
HostManager c:\program files\common files\aol\1137256522\ee\aolsoftware.exe
LDM c:\program files\logitech\desktop
messenger\8876480\program\backweb-8876480.exe
Logitech Desktop
Messenger c:\progra~1\logitech\deskto~1\8876480\program\ldmconf.exe /start
Logitech Hardware Abstraction Layer khalmnpr.exe
Logitech SetPoint c:\progra~1\logitech\setpoint\kem.exe
MSMSGS c:\program files\messenger\msmsgs.exe /background
Mozilla Quick Launch c:\program files\netscape\netscape\netscp.exe -turbo
OASClnt c:\program files\mcafee.com\antivirus\oasclnt.exe
Pin c:\hp\bin\cloaker.exe c:\hp\bin\pintostart.bat
Pin c:\hp\bin\cloaker.exe c:\hp\bin\pintostart.bat
Pure Networks Port Magic c:\progra~1\purene~1\portma~1\portaol.exe -run
QuickTime Task c:\program files\quicktime\qttask.exe -atboottime
Share-to-Web Namespace Daemon c:\program files\hewlett-packard\hp
share-to-web\hpgs2wnd.exe
SunJavaUpdateSched c:\program files\java\jre1.5.0_06\bin\jusched.exe
WIS Live Online wis live online.lnk
Windows Defender c:\program files\windows defender\msascui.exe -hide
WordWeb wordweb.lnk
Zone Labs Client c:\program files\zone labs\zonealarm\zlclient.exe
ctfmon.exe c:\windows\system32\ctfmon.exe
desktop desktop.ini
desktop desktop.ini
desktop desktop.ini
desktop desktop.ini
ehTray c:\windows\ehome\ehtray.exe
sscRun c:\program files\common
files\aol\1137256522\ee\services\sscfirewallplugin\ver1_10_3_1\sscrun.exe





Danny

:

Check in Msconfig for any oddities.
(Start-Run-MSCONFIG-Startup tab)
If you cannot see anything in Msconfig then:

Use Msconfig as a troubleshooter or:
Get a second opinion.

Start-Run-msinfo32
Click the + beside Software Environment to expand.
Click Startup Programs
Ctrl+A to Select All, Ctrl+C to Copy.
Paste that information in your message.

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html





On Mon, 1 May 2006 05:30:02 -0700, in
microsoft.public.windowsxp.general, Danny

Running a windows xp media center edition machine that I can not seem to stop
the system32 folder from popping up. Read thru numerous posts on this
subject and below is what I have tried to date with no luck.

Thanks for the help in advance-Danny

1. kb170086. Nothing obvious to me in the registry.

2. also looked for any balnk entrys or lines starting with "/".
 
A

Alan Edwards

Remove the Registry key is what I meant.

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html



Alan,

I had previously uninstalled aim6. One of the kids must have reloaded.
Anyway, I uninstalled again and no luck, system32 folder is still pooping up
upon startup.

Danny

Alan Edwards said:
I thought you had removed Aim6?
Please do so.

I can't see anything obvious in the rest.

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html



[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\\Program Files\\Logitech\\Desktop
Messenger\\8876480\\Program\\BackWeb-8876480.exe"
"H/PC Connection Agent"="\"C:\\Program Files\\Microsoft
ActiveSync\\WCESCOMM.EXE\""
"Mozilla Quick Launch"="\"C:\\Program
Files\\Netscape\\Netscape\\Netscp.exe\" -turbo"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Aim6"=""
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

====================================================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Zone Labs Client"="C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\"
-hide"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"Share-to-Web Namespace Daemon"="C:\\Program Files\\Hewlett-Packard\\HP
Share-to-Web\\hpgs2wnd.exe"
"Pure Networks Port
Magic"="\"C:\\PROGRA~1\\PURENE~1\\PORTMA~1\\PortAOL.exe\" -Run"
"OASClnt"="C:\\Program Files\\mcafee.com\\antivirus\\oasclnt.exe"
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE"
"HPHUPD08"="c:\\Program Files\\HP\\Digital
Imaging\\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\\hphupd08.exe"
"HPBootOp"="\"C:\\Program Files\\Hewlett-Packard\\HP Boot
Optimizer\\HPBootOp.exe\" /run"
"HP Software Update"="C:\\Program Files\\HP\\HP Software
Update\\HPwuSchd2.exe"
"HostManager"="C:\\Program Files\\Common
Files\\AOL\\1137256522\\ee\\AOLSoftware.exe"
"EmailScan"="C:\\Program Files\\mcafee.com\\antivirus\\mcvsescn.exe"
"ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe"
"D-Link AirPlus XtremeG"="C:\\Program Files\\D-Link\\AirPlus
XtremeG\\AirPlusCFG.exe"
"ANIWZCS2Service"="C:\\Program Files\\ANI\\ANIWZCS2 Service\\WZCSLDR2.exe"
"AlwaysReady Power Message APP"="ARPWRMSG.EXE"
"AOLSPScheduler"="C:\\Program Files\\Common
Files\\AOL\\1137256522\\ee\\services\\sscAntiSpywarePlugin\\ver1_10_3_1\\AOLSP Scheduler.exe"
"sscRun"="C:\\Program Files\\Common
Files\\AOL\\1137256522\\ee\\services\\sscFirewallPlugin\\ver1_10_3_1\\SSCRun.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"














:

Yes, post an export of your Registry run keys (they are not folders)

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html



On Mon, 8 May 2006 05:44:01 -0700, in
microsoft.public.windowsxp.general, Danny

Alan,

Thanks, I found the Regional & Language settings. Must have been tired last
night!

Well, Ctfmon.exe is now disabled. System 32 flder is still popping up!
Should I post what is in my registry run folders just in case I missed
something?

Danny

:

Danny,

You have to realize that there can be different views in XP for
Control Panel.
I don't see that terminology either, as I don't like category view.
Just use Regional and Language Options if that is what you see (as I
did)

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html



On Sun, 7 May 2006 18:26:01 -0700, in
microsoft.public.windowsxp.general, Danny

Alan,

I am starting to wonder if the issue is in startup.

I disabled Aim6-folder still comes up.

Went thru the KB282599 to disable ctfmon.exe. No luck as it still loads.
The only step of the process I could not perform was step 2 as my version of
XP does not have: "In Windows XP, click Date, Time, Language, and Regional
Options, and then click Regional and Language Options. On the Languages tab,
click Details."

Spent time disabling startup items - no luck.

Danny


:

Danny,

I don't know why you didn't narrow it down as you could have done it
in about five restarts if you disabled half at a time.

I gave you the information of ctfmon.

You have nothing against Aim6.
If that correct, then remove it and see if it is your problem.

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html

On Sun, 7 May 2006 14:45:01 -0700, in
microsoft.public.windowsxp.general, Danny

So far I have not eliminated the problem. I noticed that I had Avast! as a
registry entry and after googling found it is remenants off a past virus
program. They had a clear uninstall, but it still left some of the program
and one registry entry so I manually deleted. Using Mike's startup I tried
to remove the ctfmon, but it keeps reloading after each boot.

I again tried the latest MV stinger and also ran the last on-line Avast!
after I saw it in the registry and prior to manual removal. I also tried
deleting all the files in the pretfetch directory - did not make a difference.

I have not ediited the msinfo32.

Danny

:

What did you find out using Msconfig or Mike's Startup as a
troubleshooter?
If you narrowed it down to ctfmon, then read this:
http://www.sysinfo.org/startuplist.php?filter=ctfmon
If you didn't narrow it down to ctfmon, what did you find as the
culprit?

Some of your Msinfo32 information is different to mine.
e.g. you have:
Windows Defender c:\program files\windows defender\msascui.exe -hide
I have:
Windows Defender "c:\program files\windows defender\msascui.exe" -hide
Have you edited the Msinfo32.exe information? If so it is of little
use to me.

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html



On Sun, 7 May 2006 13:31:01 -0700, in
microsoft.public.windowsxp.general, Danny

Alan,

Sorry for the delay, but i have been out of town. Each line string was too
long, so I posted the program & command columns. I also use start up by Mike
Linn & tried to keep ctfmon.exe from starting up,. but each time I disable it
re-enables.

Here is the msinfo32 info.

Thanks for hanging in there with me!

ANIWZCS2Service c:\program files\ani\aniwzcs2 service\wzcsldr2.exe
AOLSPScheduler c:\program files\common
files\aol\25894456\ee\services\sscantispywareplugin\ver1_10_3_1\aolsp
scheduler.exe
Adobe Gamma adobe gamma.lnk
Adobe Reader Speed Launch c:\progra~1\adobe\acroba~1.0\reader\reader~1.exe
Aim6
AlwaysReady Power Message APP arpwrmsg.exe
D-Link AirPlus XtremeG c:\program files\d-link\airplus xtremeg\airpluscfg.exe
EmailScan c:\program files\mcafee.com\antivirus\mcvsescn.exe
H/PC Connection Agent c:\program files\microsoft activesync\wcescomm.exe
HP Software Update c:\program files\hp\hp software update\hpwuschd2.exe
HPBootOp c:\program files\hewlett-packard\hp boot optimizer\hpbootop.exe /run
HPHUPD08 c:\program files\hp\digital
imaging\{33d6cc28-9f75-4d1b-a11d-98895b3a3729}\hphupd08.exe
HostManager c:\program files\common files\aol\1137256522\ee\aolsoftware.exe
LDM c:\program files\logitech\desktop
messenger\8876480\program\backweb-8876480.exe
Logitech Desktop
Messenger c:\progra~1\logitech\deskto~1\8876480\program\ldmconf.exe /start
Logitech Hardware Abstraction Layer khalmnpr.exe
Logitech SetPoint c:\progra~1\logitech\setpoint\kem.exe
MSMSGS c:\program files\messenger\msmsgs.exe /background
Mozilla Quick Launch c:\program files\netscape\netscape\netscp.exe -turbo
OASClnt c:\program files\mcafee.com\antivirus\oasclnt.exe
Pin c:\hp\bin\cloaker.exe c:\hp\bin\pintostart.bat
Pin c:\hp\bin\cloaker.exe c:\hp\bin\pintostart.bat
Pure Networks Port Magic c:\progra~1\purene~1\portma~1\portaol.exe -run
QuickTime Task c:\program files\quicktime\qttask.exe -atboottime
Share-to-Web Namespace Daemon c:\program files\hewlett-packard\hp
share-to-web\hpgs2wnd.exe
SunJavaUpdateSched c:\program files\java\jre1.5.0_06\bin\jusched.exe
WIS Live Online wis live online.lnk
Windows Defender c:\program files\windows defender\msascui.exe -hide
WordWeb wordweb.lnk
Zone Labs Client c:\program files\zone labs\zonealarm\zlclient.exe
ctfmon.exe c:\windows\system32\ctfmon.exe
desktop desktop.ini
desktop desktop.ini
desktop desktop.ini
desktop desktop.ini
ehTray c:\windows\ehome\ehtray.exe
sscRun c:\program files\common
files\aol\1137256522\ee\services\sscfirewallplugin\ver1_10_3_1\sscrun.exe





Danny

:

Check in Msconfig for any oddities.
(Start-Run-MSCONFIG-Startup tab)
If you cannot see anything in Msconfig then:

Use Msconfig as a troubleshooter or:
Get a second opinion.

Start-Run-msinfo32
Click the + beside Software Environment to expand.
Click Startup Programs
Ctrl+A to Select All, Ctrl+C to Copy.
Paste that information in your message.

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html





On Mon, 1 May 2006 05:30:02 -0700, in
microsoft.public.windowsxp.general, Danny

Running a windows xp media center edition machine that I can not seem to stop
the system32 folder from popping up. Read thru numerous posts on this
subject and below is what I have tried to date with no luck.

Thanks for the help in advance-Danny

1. kb170086. Nothing obvious to me in the registry.

2. also looked for any balnk entrys or lines starting with "/".
 
G

Guest

It's gone. Must have been removed during the unistall.

Danny

Alan Edwards said:
Remove the Registry key is what I meant.

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html



Alan,

I had previously uninstalled aim6. One of the kids must have reloaded.
Anyway, I uninstalled again and no luck, system32 folder is still pooping up
upon startup.

Danny

Alan Edwards said:
I thought you had removed Aim6?
Please do so.

I can't see anything obvious in the rest.

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html



On Tue, 9 May 2006 05:05:03 -0700, in
microsoft.public.windowsxp.general, Danny

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\\Program Files\\Logitech\\Desktop
Messenger\\8876480\\Program\\BackWeb-8876480.exe"
"H/PC Connection Agent"="\"C:\\Program Files\\Microsoft
ActiveSync\\WCESCOMM.EXE\""
"Mozilla Quick Launch"="\"C:\\Program
Files\\Netscape\\Netscape\\Netscp.exe\" -turbo"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Aim6"=""
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

====================================================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Zone Labs Client"="C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\"
-hide"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"Share-to-Web Namespace Daemon"="C:\\Program Files\\Hewlett-Packard\\HP
Share-to-Web\\hpgs2wnd.exe"
"Pure Networks Port
Magic"="\"C:\\PROGRA~1\\PURENE~1\\PORTMA~1\\PortAOL.exe\" -Run"
"OASClnt"="C:\\Program Files\\mcafee.com\\antivirus\\oasclnt.exe"
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE"
"HPHUPD08"="c:\\Program Files\\HP\\Digital
Imaging\\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\\hphupd08.exe"
"HPBootOp"="\"C:\\Program Files\\Hewlett-Packard\\HP Boot
Optimizer\\HPBootOp.exe\" /run"
"HP Software Update"="C:\\Program Files\\HP\\HP Software
Update\\HPwuSchd2.exe"
"HostManager"="C:\\Program Files\\Common
Files\\AOL\\1137256522\\ee\\AOLSoftware.exe"
"EmailScan"="C:\\Program Files\\mcafee.com\\antivirus\\mcvsescn.exe"
"ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe"
"D-Link AirPlus XtremeG"="C:\\Program Files\\D-Link\\AirPlus
XtremeG\\AirPlusCFG.exe"
"ANIWZCS2Service"="C:\\Program Files\\ANI\\ANIWZCS2 Service\\WZCSLDR2.exe"
"AlwaysReady Power Message APP"="ARPWRMSG.EXE"
"AOLSPScheduler"="C:\\Program Files\\Common
Files\\AOL\\1137256522\\ee\\services\\sscAntiSpywarePlugin\\ver1_10_3_1\\AOLSP Scheduler.exe"
"sscRun"="C:\\Program Files\\Common
Files\\AOL\\1137256522\\ee\\services\\sscFirewallPlugin\\ver1_10_3_1\\SSCRun.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"














:

Yes, post an export of your Registry run keys (they are not folders)

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html



On Mon, 8 May 2006 05:44:01 -0700, in
microsoft.public.windowsxp.general, Danny

Alan,

Thanks, I found the Regional & Language settings. Must have been tired last
night!

Well, Ctfmon.exe is now disabled. System 32 flder is still popping up!
Should I post what is in my registry run folders just in case I missed
something?

Danny

:

Danny,

You have to realize that there can be different views in XP for
Control Panel.
I don't see that terminology either, as I don't like category view.
Just use Regional and Language Options if that is what you see (as I
did)

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html



On Sun, 7 May 2006 18:26:01 -0700, in
microsoft.public.windowsxp.general, Danny

Alan,

I am starting to wonder if the issue is in startup.

I disabled Aim6-folder still comes up.

Went thru the KB282599 to disable ctfmon.exe. No luck as it still loads.
The only step of the process I could not perform was step 2 as my version of
XP does not have: "In Windows XP, click Date, Time, Language, and Regional
Options, and then click Regional and Language Options. On the Languages tab,
click Details."

Spent time disabling startup items - no luck.

Danny


:

Danny,

I don't know why you didn't narrow it down as you could have done it
in about five restarts if you disabled half at a time.

I gave you the information of ctfmon.

You have nothing against Aim6.
If that correct, then remove it and see if it is your problem.

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html

On Sun, 7 May 2006 14:45:01 -0700, in
microsoft.public.windowsxp.general, Danny

So far I have not eliminated the problem. I noticed that I had Avast! as a
registry entry and after googling found it is remenants off a past virus
program. They had a clear uninstall, but it still left some of the program
and one registry entry so I manually deleted. Using Mike's startup I tried
to remove the ctfmon, but it keeps reloading after each boot.

I again tried the latest MV stinger and also ran the last on-line Avast!
after I saw it in the registry and prior to manual removal. I also tried
deleting all the files in the pretfetch directory - did not make a difference.

I have not ediited the msinfo32.

Danny

:

What did you find out using Msconfig or Mike's Startup as a
troubleshooter?
If you narrowed it down to ctfmon, then read this:
http://www.sysinfo.org/startuplist.php?filter=ctfmon
If you didn't narrow it down to ctfmon, what did you find as the
culprit?

Some of your Msinfo32 information is different to mine.
e.g. you have:
Windows Defender c:\program files\windows defender\msascui.exe -hide
I have:
Windows Defender "c:\program files\windows defender\msascui.exe" -hide
Have you edited the Msinfo32.exe information? If so it is of little
use to me.

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html



On Sun, 7 May 2006 13:31:01 -0700, in
microsoft.public.windowsxp.general, Danny

Alan,

Sorry for the delay, but i have been out of town. Each line string was too
long, so I posted the program & command columns. I also use start up by Mike
Linn & tried to keep ctfmon.exe from starting up,. but each time I disable it
re-enables.

Here is the msinfo32 info.

Thanks for hanging in there with me!

ANIWZCS2Service c:\program files\ani\aniwzcs2 service\wzcsldr2.exe
AOLSPScheduler c:\program files\common
files\aol\25894456\ee\services\sscantispywareplugin\ver1_10_3_1\aolsp
scheduler.exe
Adobe Gamma adobe gamma.lnk
Adobe Reader Speed Launch c:\progra~1\adobe\acroba~1.0\reader\reader~1.exe
Aim6
AlwaysReady Power Message APP arpwrmsg.exe
D-Link AirPlus XtremeG c:\program files\d-link\airplus xtremeg\airpluscfg.exe
EmailScan c:\program files\mcafee.com\antivirus\mcvsescn.exe
H/PC Connection Agent c:\program files\microsoft activesync\wcescomm.exe
HP Software Update c:\program files\hp\hp software update\hpwuschd2.exe
HPBootOp c:\program files\hewlett-packard\hp boot optimizer\hpbootop.exe /run
HPHUPD08 c:\program files\hp\digital
imaging\{33d6cc28-9f75-4d1b-a11d-98895b3a3729}\hphupd08.exe
HostManager c:\program files\common files\aol\1137256522\ee\aolsoftware.exe
LDM c:\program files\logitech\desktop
messenger\8876480\program\backweb-8876480.exe
Logitech Desktop
Messenger c:\progra~1\logitech\deskto~1\8876480\program\ldmconf.exe /start
Logitech Hardware Abstraction Layer khalmnpr.exe
Logitech SetPoint c:\progra~1\logitech\setpoint\kem.exe
MSMSGS c:\program files\messenger\msmsgs.exe /background
Mozilla Quick Launch c:\program files\netscape\netscape\netscp.exe -turbo
OASClnt c:\program files\mcafee.com\antivirus\oasclnt.exe
Pin c:\hp\bin\cloaker.exe c:\hp\bin\pintostart.bat
Pin c:\hp\bin\cloaker.exe c:\hp\bin\pintostart.bat
Pure Networks Port Magic c:\progra~1\purene~1\portma~1\portaol.exe -run
QuickTime Task c:\program files\quicktime\qttask.exe -atboottime
Share-to-Web Namespace Daemon c:\program files\hewlett-packard\hp
share-to-web\hpgs2wnd.exe
SunJavaUpdateSched c:\program files\java\jre1.5.0_06\bin\jusched.exe
WIS Live Online wis live online.lnk
Windows Defender c:\program files\windows defender\msascui.exe -hide
WordWeb wordweb.lnk
Zone Labs Client c:\program files\zone labs\zonealarm\zlclient.exe
ctfmon.exe c:\windows\system32\ctfmon.exe
desktop desktop.ini
desktop desktop.ini
desktop desktop.ini
desktop desktop.ini
ehTray c:\windows\ehome\ehtray.exe
sscRun c:\program files\common
files\aol\1137256522\ee\services\sscfirewallplugin\ver1_10_3_1\sscrun.exe





Danny

:

Check in Msconfig for any oddities.
(Start-Run-MSCONFIG-Startup tab)
If you cannot see anything in Msconfig then:

Use Msconfig as a troubleshooter or:
Get a second opinion.

Start-Run-msinfo32
Click the + beside Software Environment to expand.
Click Startup Programs
Ctrl+A to Select All, Ctrl+C to Copy.
Paste that information in your message.
 
G

Guest

Alan, Any other thoughts or should I repost?

thanks,

Danny

Danny said:
It's gone. Must have been removed during the unistall.

Danny

Alan Edwards said:
Remove the Registry key is what I meant.

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html



Alan,

I had previously uninstalled aim6. One of the kids must have reloaded.
Anyway, I uninstalled again and no luck, system32 folder is still pooping up
upon startup.

Danny

:

I thought you had removed Aim6?
Please do so.

I can't see anything obvious in the rest.

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html



On Tue, 9 May 2006 05:05:03 -0700, in
microsoft.public.windowsxp.general, Danny

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\\Program Files\\Logitech\\Desktop
Messenger\\8876480\\Program\\BackWeb-8876480.exe"
"H/PC Connection Agent"="\"C:\\Program Files\\Microsoft
ActiveSync\\WCESCOMM.EXE\""
"Mozilla Quick Launch"="\"C:\\Program
Files\\Netscape\\Netscape\\Netscp.exe\" -turbo"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Aim6"=""
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

====================================================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Zone Labs Client"="C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\"
-hide"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"Share-to-Web Namespace Daemon"="C:\\Program Files\\Hewlett-Packard\\HP
Share-to-Web\\hpgs2wnd.exe"
"Pure Networks Port
Magic"="\"C:\\PROGRA~1\\PURENE~1\\PORTMA~1\\PortAOL.exe\" -Run"
"OASClnt"="C:\\Program Files\\mcafee.com\\antivirus\\oasclnt.exe"
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE"
"HPHUPD08"="c:\\Program Files\\HP\\Digital
Imaging\\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\\hphupd08.exe"
"HPBootOp"="\"C:\\Program Files\\Hewlett-Packard\\HP Boot
Optimizer\\HPBootOp.exe\" /run"
"HP Software Update"="C:\\Program Files\\HP\\HP Software
Update\\HPwuSchd2.exe"
"HostManager"="C:\\Program Files\\Common
Files\\AOL\\1137256522\\ee\\AOLSoftware.exe"
"EmailScan"="C:\\Program Files\\mcafee.com\\antivirus\\mcvsescn.exe"
"ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe"
"D-Link AirPlus XtremeG"="C:\\Program Files\\D-Link\\AirPlus
XtremeG\\AirPlusCFG.exe"
"ANIWZCS2Service"="C:\\Program Files\\ANI\\ANIWZCS2 Service\\WZCSLDR2.exe"
"AlwaysReady Power Message APP"="ARPWRMSG.EXE"
"AOLSPScheduler"="C:\\Program Files\\Common
Files\\AOL\\1137256522\\ee\\services\\sscAntiSpywarePlugin\\ver1_10_3_1\\AOLSP Scheduler.exe"
"sscRun"="C:\\Program Files\\Common
Files\\AOL\\1137256522\\ee\\services\\sscFirewallPlugin\\ver1_10_3_1\\SSCRun.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"














:

Yes, post an export of your Registry run keys (they are not folders)

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html



On Mon, 8 May 2006 05:44:01 -0700, in
microsoft.public.windowsxp.general, Danny

Alan,

Thanks, I found the Regional & Language settings. Must have been tired last
night!

Well, Ctfmon.exe is now disabled. System 32 flder is still popping up!
Should I post what is in my registry run folders just in case I missed
something?

Danny

:

Danny,

You have to realize that there can be different views in XP for
Control Panel.
I don't see that terminology either, as I don't like category view.
Just use Regional and Language Options if that is what you see (as I
did)

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html



On Sun, 7 May 2006 18:26:01 -0700, in
microsoft.public.windowsxp.general, Danny

Alan,

I am starting to wonder if the issue is in startup.

I disabled Aim6-folder still comes up.

Went thru the KB282599 to disable ctfmon.exe. No luck as it still loads.
The only step of the process I could not perform was step 2 as my version of
XP does not have: "In Windows XP, click Date, Time, Language, and Regional
Options, and then click Regional and Language Options. On the Languages tab,
click Details."

Spent time disabling startup items - no luck.

Danny


:

Danny,

I don't know why you didn't narrow it down as you could have done it
in about five restarts if you disabled half at a time.

I gave you the information of ctfmon.

You have nothing against Aim6.
If that correct, then remove it and see if it is your problem.

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html

On Sun, 7 May 2006 14:45:01 -0700, in
microsoft.public.windowsxp.general, Danny

So far I have not eliminated the problem. I noticed that I had Avast! as a
registry entry and after googling found it is remenants off a past virus
program. They had a clear uninstall, but it still left some of the program
and one registry entry so I manually deleted. Using Mike's startup I tried
to remove the ctfmon, but it keeps reloading after each boot.

I again tried the latest MV stinger and also ran the last on-line Avast!
after I saw it in the registry and prior to manual removal. I also tried
deleting all the files in the pretfetch directory - did not make a difference.

I have not ediited the msinfo32.

Danny

:

What did you find out using Msconfig or Mike's Startup as a
troubleshooter?
If you narrowed it down to ctfmon, then read this:
http://www.sysinfo.org/startuplist.php?filter=ctfmon
If you didn't narrow it down to ctfmon, what did you find as the
culprit?

Some of your Msinfo32 information is different to mine.
e.g. you have:
Windows Defender c:\program files\windows defender\msascui.exe -hide
I have:
Windows Defender "c:\program files\windows defender\msascui.exe" -hide
Have you edited the Msinfo32.exe information? If so it is of little
use to me.

....Alan
--
Alan Edwards, MS MVP Windows - Internet Explorer
http://dts-l.org/index.html



On Sun, 7 May 2006 13:31:01 -0700, in
microsoft.public.windowsxp.general, Danny

Alan,

Sorry for the delay, but i have been out of town. Each line string was too
long, so I posted the program & command columns. I also use start up by Mike
Linn & tried to keep ctfmon.exe from starting up,. but each time I disable it
re-enables.

Here is the msinfo32 info.

Thanks for hanging in there with me!

ANIWZCS2Service c:\program files\ani\aniwzcs2 service\wzcsldr2.exe
AOLSPScheduler c:\program files\common
files\aol\25894456\ee\services\sscantispywareplugin\ver1_10_3_1\aolsp
scheduler.exe
Adobe Gamma adobe gamma.lnk
Adobe Reader Speed Launch c:\progra~1\adobe\acroba~1.0\reader\reader~1.exe
Aim6
AlwaysReady Power Message APP arpwrmsg.exe
D-Link AirPlus XtremeG c:\program files\d-link\airplus xtremeg\airpluscfg.exe
EmailScan c:\program files\mcafee.com\antivirus\mcvsescn.exe
H/PC Connection Agent c:\program files\microsoft activesync\wcescomm.exe
HP Software Update c:\program files\hp\hp software update\hpwuschd2.exe
HPBootOp c:\program files\hewlett-packard\hp boot optimizer\hpbootop.exe /run
HPHUPD08 c:\program files\hp\digital
imaging\{33d6cc28-9f75-4d1b-a11d-98895b3a3729}\hphupd08.exe
HostManager c:\program files\common files\aol\1137256522\ee\aolsoftware.exe
LDM c:\program files\logitech\desktop
messenger\8876480\program\backweb-8876480.exe
Logitech Desktop
Messenger c:\progra~1\logitech\deskto~1\8876480\program\ldmconf.exe /start
Logitech Hardware Abstraction Layer khalmnpr.exe
Logitech SetPoint c:\progra~1\logitech\setpoint\kem.exe
MSMSGS c:\program files\messenger\msmsgs.exe /background
Mozilla Quick Launch c:\program files\netscape\netscape\netscp.exe -turbo
OASClnt c:\program files\mcafee.com\antivirus\oasclnt.exe
Pin c:\hp\bin\cloaker.exe c:\hp\bin\pintostart.bat
Pin c:\hp\bin\cloaker.exe c:\hp\bin\pintostart.bat
Pure Networks Port Magic c:\progra~1\purene~1\portma~1\portaol.exe -run
QuickTime Task c:\program files\quicktime\qttask.exe -atboottime
Share-to-Web Namespace Daemon c:\program files\hewlett-packard\hp
share-to-web\hpgs2wnd.exe
SunJavaUpdateSched c:\program files\java\jre1.5.0_06\bin\jusched.exe
WIS Live Online wis live online.lnk
Windows Defender c:\program files\windows defender\msascui.exe -hide
WordWeb wordweb.lnk
Zone Labs Client c:\program files\zone labs\zonealarm\zlclient.exe
ctfmon.exe c:\windows\system32\ctfmon.exe
desktop desktop.ini
desktop desktop.ini
desktop desktop.ini
desktop desktop.ini
ehTray c:\windows\ehome\ehtray.exe
sscRun c:\program files\common
files\aol\1137256522\ee\services\sscfirewallplugin\ver1_10_3_1\sscrun.exe





Danny

:

Check in Msconfig for any oddities.
(Start-Run-MSCONFIG-Startup tab)
If you cannot see anything in Msconfig then:

Use Msconfig as a troubleshooter or:
Get a second opinion.
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Top