Folder opens automatically at startup

  • Thread starter Thread starter Hans Näslund
  • Start date Start date
H

Hans Näslund

All of a sudden, my laptop (Windows 2000 Professional) has started to open
the Program folder at startup. I guess some register setting has been
changed. Any hint what I could do to remove that setting?
 
In said:
All of a sudden, my laptop (Windows 2000 Professional) has started
to open the Program folder at startup. I guess some register
setting has been changed. Any hint what I could do to remove that
setting?
Click to expand...

Possible malware. Full Anti-* scans recommended.
Check all Startup items (registry and disk) using a competent Startup
Manager such as Autoruns (sysinternals) for example. Any other
anomalies or spurious processes or event log entries? "At startup"
means what? At Windows startup or at an account logon?
 
There is no such option ('Restore previous folder windows at logon') in my
system (Swedish W2K Pro).

I have run AdAware and Spybot - no malicious objetcs. And neither InControl
nor Autoruns display any suspicious entries.

I have had this problem once before, but after a while (several months,
though) it disappeared by itself. I still guess some register setting has
been changed - but how do I know which one?
 
Hi,
Check
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
See if there is some unavailing value such as ","
 
There is no such option ('Restore previous folder windows at logon') in my
system (Swedish W2K Pro). I have run AdAware and Spybot - no malicious
objetcs. And neither InControl nor Autoruns display any suspicious entries.
I have had this problem once before, but after a while (several months,
though) it disappeared by itself. I still guess some register setting has
been changed - but how do I know which one?
Click to expand...

First of all check registry keys:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
and other "Run keys" for any incorrect entries with explorer.exe.
You can use msconfig or Codestuff Starter http://codestuff.mirrorz.com/
(W2K does not include msconfig utility). If it doesn't help go to
registry key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
and create/change dword value "SeparateProcess" - set it to 0;
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
and create/change dword value "DesktopProcess" - set it to 0.

FUT warning
 
Thank you for your advices; unfortunately they did not help.

I have checked the "Run" register keys - no suspicious entries could be
found.

I have also checked that
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advance
d\ SeparateProcess is set to 0, and I have created "DesktopProcess" in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer and set
it to 0. The same obnoxious folder keeps popping up at startup.

Btw - in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer there
is a string with the name "Vodka Lime 1" and the value 1744. What is that?
Can I remove it?

Hans Näslund
 
Hans said:
Thank you for your advices; unfortunately they did not help.
;-((

I have also checked that
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SeparateProcess is set to 0, and I have created "DesktopProcess" in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer and set
it to 0. The same obnoxious folder keeps popping up at startup.
Click to expand...

Check /maybe/ also HKLM keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
and
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer
for the same values. Check registry key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
for dword value "PersistBrowsers" - it should be set to 0.
Btw - in
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer there
is a string with the name "Vodka Lime 1" and the value 1744. What is that?
Click to expand...

I don't know - AFAIK this is not a "standard key".
Can I remove it?
Click to expand...

Make a backup of HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer
and delete that value.
 
Arkadiusz 'Black Fox' Artyszuk said:
;-(( - - -
Check /maybe/ also HKLM keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanc
ed
and
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer
for the same values. Check registry key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advance
d
for dword value "PersistBrowsers" - it should be set to 0.
Click to expand...

I have done that - no similar values in the HKLM keys. No dword
"PersistBrowsers" i HKCU.

Hans Näslund
 
Hans Näslund said:
All of a sudden, my laptop (Windows 2000 Professional) has started to open
the Program folder at startup. I guess some register setting has been
changed. Any hint what I could do to remove that setting?
Click to expand...
 
Try checking the startup folder.
Go to Start menu.
Then point to Programs
Then point to Startup
Delete Program folder
OR
Go to Start Menu
Click Run
In the box type in C:\Documents and Settings\All Users\Start
Menu\Programs\Startup
Then delete Progam folder

From,
Syed Abdullah
 
Back
Top