Why does this folder keep popping up????

[Guest]

Ever since I installed the latest MS updates (March 15th--Outlook, Excel, and
the Malware one), when Windows XP Pro loads, the folder C:\Program
Files\Common pops up and stays on the screen till I close it. This is very
annoying. Is there a way to get it to stop doing this? Thanks!!

 

[Rick \Nutcase\ Rogers]

Hi,

There is a damaged registry entry. Try this: Control Panel/Folder
Options/View tab, uncheck the line "restore previous folder windows at
logon". Click apply/ok, do not reboot yet.

Start/run msconfig, on the general tab select the diagnostic mode. Click
apply/ok and reboot at prompted.

The folder should not show up now. Rerun msconfig, put the system back in
normal mode. Click apply/ok and reboot once more. Does this help?

For most users, this will resolve the issue. For some that still have
registry damage it will not. If this is the case, could you please export
and post the contents of these keys in the registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

To do this, start/run regedit, expand the branches to each key (do this one
at a time). Click on the key, then on file/export. Give it any name, then
save to the desktop. Once you have saved both keys, close the registry
editor. Right-click one of the saved files on the desktop, choose edit, it
should open in notepad. Click edit/select all/edit/copy. Open a response to
this post and click in the message text area. Hit ctrl+v to paste the
contents. Repeat for the other saved key, then send the post for
examination.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Windows help - www.rickrogers.org

 

[Guest]

Rick, Thanks for helping me with this. When I went into msconfig, the
"Restore previous folder windows at logon" was already unchecked. I did the
diagnostic start, but I still got the folder. So, here are the two registry
keys:

HERE IS THE FIRST ONE:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WT GameChannel"="C:\\Program Files\\WildTangent\\Apps\\GameChannel.exe"
"ViewMgr"="C:\\Program Files\\Viewpoint\\Viewpoint Manager\\ViewMgr.exe"
"UpdReg"="C:\\WINDOWS\\UpdReg.EXE"
"UpdateManager"="\"C:\\Program Files\\Common Files\\Sonic\\Update
Manager\\sgtray.exe\" /r"
"TkBellExe"="\"C:\\Program Files\\Common
Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"Share-to-Web Namespace Daemon"="C:\\Program Files\\Hewlett-Packard\\HP
Share-to-Web\\hpgs2wnd.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\""
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
"MXO Auto Loader"="C:\\WINDOWS\\MXOALDR.EXE"
"MMTray"="\"C:\\Program Files\\MUSICMATCH\\Musicmatch Jukebox\\mm_tray.exe\""
"MimBoot"="C:\\PROGRA~1\\MUSICM~1\\MUSICM~2\\mimboot.exe"
"MaxtorOneTouch"="C:\\PROGRA~1\\Maxtor\\OneTouch\\Utils\\OneTouch.exe"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"IntelMeM"="C:\\Program Files\\Intel\\Modem Event Monitor\\IntelMEM.exe"
"IAAnotif"="C:\\Program Files\\Intel\\Intel Application
Accelerator\\iaanotif.exe"
"HPHUPD06"="C:\\Program
Files\\Hewlett-Packard\\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\\hphupd06.exe"
"HPHUPD05"="C:\\Program
Files\\Hewlett-Packard\\{45B6180B-DCAB-4093-8EE8-6164457517F0}\\hphupd05.exe"
"HPHUPD04"="\"C:\\Program Files\\HP Photosmart
11\\hphinstall\\UniPatch\\hphupd04.exe\""
"HPHmon06"="C:\\WINDOWS\\system32\\hphmon06.exe"
"HPHmon05"="C:\\WINDOWS\\system32\\hphmon05.exe"
"HPHmon04"="C:\\WINDOWS\\system32\\hphmon04.exe"
"HPDJ Taskbar
Utility"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb11.exe"
"HP Software Update"="C:\\Program Files\\Hewlett-Packard\\HP Software
Update\\HPWuSchd2.exe"
"HP Component Manager"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\""
"DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\""
"dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe"
"CXMon"="\"C:\\Program Files\\Hewlett-Packard\\PhotoSmart\\Photo
Imaging\\Hpi_Monitor.exe\""
"CTSysVol"="C:\\Program Files\\Creative\\SBAudigy2\\Surround
Mixer\\CTSysVol.exe"
"CTHelper"="CTHELPER.EXE"
"CTDVDDet"="C:\\Program Files\\Creative\\SBAudigy2\\DVDAudio\\CTDVDDet.EXE"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Boxtops0"="\"C:\\Program Files\\BoxTops_Shopping_Reminder\\Boxtops0.exe\""
"AsioReg"="REGSVR32.EXE /S CTASIO.DLL"
"Adobe Photo Downloader"="\"C:\\Program Files\\Adobe\\Photoshop Elements
4.0\\apdproxy.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

HERE IS THE SECOND ONE:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="C:\\Program
Files\\Creative\\MediaSource\\Detector\\CTDetect.exe /R"
"H/PC Connection Agent"="\"C:\\Program Files\\Microsoft
ActiveSync\\WCESCOMM.EXE\""
"DellSupport"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"AdobeUpdater"="C:\\Program Files\\Common
Files\\Adobe\\Updater\\AdobeUpdater.exe"


Thanks again--hopefully, you'll be able to spot the gremlin for me!!

Tina

 

[PA Bear]

I'd run a /thorough/ check for viruses/Trojans and hijackware. (Malicious
Software Removal Tool may have removed something but traces of it remain.)

Checking for/Help with Hijackware
http://aumha.org/a/parasite.htm
http://aumha.org/a/quickfix.htm
http://aumha.net/viewtopic.php?t=5878
http://wiki.castlecops.com/Malware_Removal_and_Prevention:_Introduction
http://mvps.org/winhelp2002/unwanted.htm
http://inetexplorer.mvps.org/data/prevention.htm
http://inetexplorer.mvps.org/tshoot.html
http://www.mvps.org/sramesh2k/Malware_Defence.htm
http://defendingyourmachine.blogspot.com/
http://www.elephantboycomputers.com/page2.html#Removing_Malware

When all else fails, HijackThis v1.99.1
(http://aumha.net/downloads/hijackthis.zip) is the preferred tool to use.
It will help you to both identify and remove any hijackware/spyware. **Post
your log to http://forums.spybot.info/forumdisplay.php?f=22,
http://castlecops.com/forum67.html,
http://forums.subratam.org/index.php?showforum=7,
http://aumha.net/viewforum.php?f=30, or other appropriate forums for expert
analysis, not here.**

 

[Guest]

I'm up-to-date on my anti-virus/spyware, etc. I ran a full scan (2nd one in
three days, as the first one was on the regular schedule) and both of them
came back clean.

 

[PA Bear]

Unfortunately, that does NOT mean you're 100% clean.

 

[Rick \Nutcase\ Rogers]

Hi,

There are still some spy/ad issues at work there, but as to the actual
problem these are the possible problems:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdateManager"="\"C:\\Program Files\\Common Files\\Sonic\\Update
Manager\\sgtray.exe\" /r"
"TkBellExe"="\"C:\\Program Files\\Common
Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"AdobeUpdater"="C:\\Program Files\\Common
Files\\Adobe\\Updater\\AdobeUpdater.exe"

Basically, one of them is damaged. The easiest way to detect which is to
disable them on the startup tab of the system configuration utility
(msconfig) and restart the system to see if the problem still occurs.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP

Windows help - www.rickrogers.org

 

[Guest]

Did anything look out-of-place in those two registry key exports?