Unknown Start-up Item

[Payuton]

My son has this on his start up items.
Located: HK_CU:RunOnce, MSConfig
file: NRWNMWETMS.EXE
I found nothing on it on the web or in the KB. Can anyone
out there tell me what it is? I tried to disable it but
it came right back as a new item with the old one still
showing unchecked.

 

[Bill James]

Very likely a virus. If there is Anti-Virus software on the computer, update the virus definition and run a full scan. If no Anti-Virus software, consider the free-for-personal-use AVG program from www.grisoft.com.

--

Bill James
Microsoft MVP - Shell/User

Win9x VBScript Utilities » www.billsway.com/vbspage/
Windows Tweaks & Tips » www.billsway.com/notes_public/

 

[Tom R.]

It could be a virus,
Go to this site:
http://www.ravantivirus.com/

Click on "Scan Online" on the left.

You can also try SpyBot Search and Destroy:
http://www.safer-networking.org/
Be sure and run the "updates" after you
download it. It is a free program,
Good Luck,
TR

 

[Ronnie Vernon MVP]

My son has this on his start up items.
Located: HK_CU:RunOnce, MSConfig
file: NRWNMWETMS.EXE
I found nothing on it on the web or in the KB. Can anyone
out there tell me what it is? I tried to disable it but
it came right back as a new item with the old one still
showing unchecked.

Payuton

You posted this same message a month ago? Did you take the advice you were
offered then and run a virus scan? What were the results?

--
Ronnie Vernon
Microsoft MVP
Windows Shell/User

Please reply to the newsgroup so all may benefit.

 

[Payton]

And a month ago is about when I saw him last. Yes I have
run online scans from trend micro and symantec. I have
AVG ,Spybot S&D, Spyware Guard, Spyware Blaster, Script
Sentry, and the machine is firewalled. DCOM has been shut
down in the registry, and MS patches have been
downloaded. Nothing showed up on any scans, and I ended
up reloading the OS after a zero wipe (full). I see him
this month and the thing is back. I hear a lot of I think
it may be's, but no definitive answer. I am trying to
find where it is coming from. I don't find any thing
about it anywhere. I apreciate your help, but having to
spend my too short of time with him wasted on some damned
virus is frustrating.

 

[Kelly]

Hi,

Anything listed under runonce, should only "run once". Remove it.

Go to Start/Run/Regedit, navigate to this key, and delete the entry:

HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\RunOnce

And/or other checkpoints:

If it is listed under Processes/Task Manager, end the process. Then uncheck
it in msconfig, remove the runonce listing then run this script.

Clear Disabled Items from Msconfig Startup (Line 148)
http://www.kellys-korner-xp.com/xp_tweaks.htm

/top10faqs.htm

 

[David Candy]

Can you find the actual file, and if so what are the properties.