In microsoft.public.win2000.registry Hans Näslund wrote:

> All of a sudden, my laptop (Windows 2000 Professional) has started
> to open the Program folder at startup. I guess some register
> setting has been changed. Any hint what I could do to remove that
> setting?

Possible malware. Full Anti-* scans recommended.
Check all Startup items (registry and disk) using a competent Startup
Manager such as Autoruns (sysinternals) for example. Any other
anomalies or spurious processes or event log entries? "At startup"
means what? At Windows startup or at an account logon?

Most likely this is a setting in Explorer.
Open an explorer window. Then from the menu choose:
Tools -> Folder Options... -> View
Then uncheck 'Restore previous folder windows at logon'.

If that does not solve the problem use InControl:
http://www.virtuoza.com/InControl/product.php

There is no such option ('Restore previous folder windows at logon') in my
system (Swedish W2K Pro).

I have run AdAware and Spybot - no malicious objetcs. And neither InControl
nor Autoruns display any suspicious entries.

I have had this problem once before, but after a while (several months,
though) it disappeared by itself. I still guess some register setting has
been changed - but how do I know which one?


"Boris Yankov" skrev i meddelandet
news:cc8b320c.0410191326.79e67ee@posting.google.co m...
> Most likely this is a setting in Explorer.
> Open an explorer window. Then from the menu choose:
> Tools -> Folder Options... -> View
> Then uncheck 'Restore previous folder windows at logon'.
>
> If that does not solve the problem use InControl:
> http://www.virtuoza.com/InControl/product.php

Hans Näslund wrote:

>> Most likely this is a setting in Explorer. Open an explorer window. Then
>> from the menu choose: Tools -> Folder Options... -> View
>> Then uncheck 'Restore previous folder windows at logon'.
>> If that does not solve the problem use InControl:
>> http://www.virtuoza.com/InControl/product.php

> There is no such option ('Restore previous folder windows at logon') in my
> system (Swedish W2K Pro). I have run AdAware and Spybot - no malicious
> objetcs. And neither InControl nor Autoruns display any suspicious entries.
> I have had this problem once before, but after a while (several months,
> though) it disappeared by itself. I still guess some register setting has
> been changed - but how do I know which one?

First of all check registry keys:
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run
and other "Run keys" for any incorrect entries with explorer.exe.
You can use msconfig or Codestuff Starter http://codestuff.mirrorz.com/
(W2K does not include msconfig utility). If it doesn't help go to
registry key
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\Advanced
and create/change dword value "SeparateProcess" - set it to 0;
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer
and create/change dword value "DesktopProcess" - set it to 0.

FUT warning

--
Regards
Arkadiusz 'Black Fox' Artyszuk
Replaying by email change blackfox.org to gazeta.pl

Thank you for your advices; unfortunately they did not help.

I have checked the "Run" register keys - no suspicious entries could be
found.

I have also checked that
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\Advance
d\ SeparateProcess is set to 0, and I have created "DesktopProcess" in
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer and set
it to 0. The same obnoxious folder keeps popping up at startup.

Btw - in
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer there
is a string with the name "Vodka Lime 1" and the value 1744. What is that?
Can I remove it?

Hans Näslund

"Arkadiusz 'Black Fox' Artyszuk" skrev i
meddelandet news:417d2280.12414330@blackfox.org...
> Hans Näslund wrote:
>
> >> Most likely this is a setting in Explorer. Open an explorer window.
Then
> >> from the menu choose: Tools -> Folder Options... -> View
> >> Then uncheck 'Restore previous folder windows at logon'.
> >> If that does not solve the problem use InControl:
> >> http://www.virtuoza.com/InControl/product.php
>
> > There is no such option ('Restore previous folder windows at logon') in
my
> > system (Swedish W2K Pro). I have run AdAware and Spybot - no malicious
> > objetcs. And neither InControl nor Autoruns display any suspicious
entries.
> > I have had this problem once before, but after a while (several months,
> > though) it disappeared by itself. I still guess some register setting
has
> > been changed - but how do I know which one?
>
> First of all check registry keys:
> HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run
> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run
> and other "Run keys" for any incorrect entries with explorer.exe.
> You can use msconfig or Codestuff Starter http://codestuff.mirrorz.com/
> (W2K does not include msconfig utility). If it doesn't help go to
> registry key
>
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\Advance
d
> and create/change dword value "SeparateProcess" - set it to 0;
> HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer
> and create/change dword value "DesktopProcess" - set it to 0.
>
> FUT warning
>
> --
> Regards
> Arkadiusz 'Black Fox' Artyszuk
> Replaying by email change blackfox.org to gazeta.pl

Thank you for your advices; unfortunately they did not help.

I have checked the "Run" register keys - no suspicious entries could be
found.

I have also checked that
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\Advance
d\ SeparateProcess is set to 0, and I have created "DesktopProcess" in
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer and set
it to 0. The same obnoxious folder keeps popping up at startup.

Btw - in
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer there
is a string with the name "Vodka Lime 1" and the value 1744. What is that?
Can I remove it?

Hans Näslund

"Arkadiusz 'Black Fox' Artyszuk" skrev i
meddelandet news:417d2280.12414330@blackfox.org...
> Hans Näslund wrote:
>
> >> Most likely this is a setting in Explorer. Open an explorer window.
Then
> >> from the menu choose: Tools -> Folder Options... -> View
> >> Then uncheck 'Restore previous folder windows at logon'.
> >> If that does not solve the problem use InControl:
> >> http://www.virtuoza.com/InControl/product.php
>
> > There is no such option ('Restore previous folder windows at logon') in
my
> > system (Swedish W2K Pro). I have run AdAware and Spybot - no malicious
> > objetcs. And neither InControl nor Autoruns display any suspicious
entries.
> > I have had this problem once before, but after a while (several months,
> > though) it disappeared by itself. I still guess some register setting
has
> > been changed - but how do I know which one?
>
> First of all check registry keys:
> HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run
> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run
> and other "Run keys" for any incorrect entries with explorer.exe.
> You can use msconfig or Codestuff Starter http://codestuff.mirrorz.com/
> (W2K does not include msconfig utility). If it doesn't help go to
> registry key
>
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\Advance
d
> and create/change dword value "SeparateProcess" - set it to 0;
> HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer
> and create/change dword value "DesktopProcess" - set it to 0.
>
> FUT warning
>
> --
> Regards
> Arkadiusz 'Black Fox' Artyszuk
> Replaying by email change blackfox.org to gazeta.pl

Hans Näslund wrote:

> Thank you for your advices; unfortunately they did not help.

;-((

> I have also checked that
> HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\Advanced
> SeparateProcess is set to 0, and I have created "DesktopProcess" in
> HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer and set
> it to 0. The same obnoxious folder keeps popping up at startup.

Check /maybe/ also HKLM keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Explorer\Advanced
and
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Explorer
for the same values. Check registry key
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\Advanced
for dword value "PersistBrowsers" - it should be set to 0.

> Btw - in
> HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer there
> is a string with the name "Vodka Lime 1" and the value 1744. What is that?

I don't know - AFAIK this is not a "standard key".

> Can I remove it?

Make a backup of HKCU\Software\Microsoft\Windows\CurrentVersion\Exp lorer
and delete that value.

--
Regards
Arkadiusz 'Black Fox' Artyszuk
Replaying by email change blackfox.org to gazeta.pl

"Arkadiusz 'Black Fox' Artyszuk" skrev i
meddelandet news:417d4e4f.18915809@blackfox.org...
> Hans Näslund wrote:
>
> > Thank you for your advices; unfortunately they did not help.
>
> ;-((
- - -
> Check /maybe/ also HKLM keys:
>
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Explorer\Advanc
ed
> and
> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Explorer
> for the same values. Check registry key
>
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\Advance
d
> for dword value "PersistBrowsers" - it should be set to 0.

I have done that - no similar values in the HKLM keys. No dword
"PersistBrowsers" i HKCU.

Hans Näslund

"Hans Näslund" wrote in message
news:Bk4dd.6498$d5.54990@newsb.telia.net...
> All of a sudden, my laptop (Windows 2000 Professional) has started to open
> the Program folder at startup. I guess some register setting has been
> changed. Any hint what I could do to remove that setting?
>
>

Try checking the startup folder.
Go to Start menu.
Then point to Programs
Then point to Startup
Delete Program folder
OR
Go to Start Menu
Click Run
In the box type in C:\Documents and Settings\All Users\Start
Menu\Programs\Startup
Then delete Progam folder

From,
Syed Abdullah