Won't go away

Discussion in 'other security issues & news' started by SamSpade, Aug 18, 2007.

Thread Status:
Not open for further replies.
  1. SamSpade

    SamSpade Registered Member

    Joined:
    Oct 22, 2006
    Posts:
    415
    As a self-taught Windows user of 17 years I have done a fair amount of checking under the hood, but am by no means an expert on the os (or any other, for that matter). Just to let everyone know ....

    My question has to do with a recurring entry in my WinXP system startup list/folder, as indicated by several system startup checkers/editors I use. It occurs in the registry folder:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


    It is the key listed as (Default), first entry in that registry ("Run") folder, and the problem is that it is simply left empty; it is being picked up by those four registry editors/scanners I use for checking/cleaning up unnecessary entries.

    Most (or all, probably) other first entries of registry folders start with a (Default) key that says: "(value not set)", but my first entry in this aforementioned folder is simply open; there is nothing there. An empty space.

    When I manually put the entry of "(value not set)" into the key, it still comes up with a question mark in my MSConfig, Ace Utilities, Spybot, and CCleaner system startup editors. I've tried deleting this key time and again, but it just re-appears when I do a refresh. These utilities are checking for system startup entries that might be deleted if deemed unnecessary, but this only started showing up in the past two weeks. I've got nod32 running all the time with all possible filters "on"; I've done spyware checks with several anti-spyware programs; I've done online scans by Kaspersky and Symantec -- all come up clean.

    Why does it appear? I mean, there are hundreds -- thousands -- of (Default) first keys in the XP registry, so why is this particular key being picked up as an "not found" entry on my system startup?? When I do a system restore to a point of about one month ago, this entry no longer appears in the above registry editors, but then, after I use Uniblue's Registry Booster 2 to clean up the registry, and I do remove all the entries it tells me are "unneeded", I again get this empty key. Of course, I could try to restore what RegBooster has removed, but then, what's the purpose of having (and having paid for) ito_O

    I don't mean to use product names here, but it seems the only way to pin down this problem .... to be as specific as possible.




    /
     
  2. Bubba

    Bubba Updates Team

    Joined:
    Apr 15, 2002
    Posts:
    11,271
    While this is a long shot....do you recall running a program during that time frame called GreenBorder :doubt:
     
  3. SamSpade

    SamSpade Registered Member

    Joined:
    Oct 22, 2006
    Posts:
    415

    Never heard of it. What does it do??


    /
     
  4. QuestionX

    QuestionX Registered Member

    Joined:
    Aug 16, 2007
    Posts:
    28
    SAM== this is mine>>.. NAME (default)..type(reg_sz)..DATA ( value not set)and the next set is==NAME(ctfmon.exe)..type(reg_sz)...data(C:\Windows\system32\ctfmon.exe........use msconfig, goto start up and see if the ctfmon box is checked... don't know if it will do any good>>iam just a dummy...later:) http://support.microsoft.com/kb/282599/en-us
     
  5. SamSpade

    SamSpade Registered Member

    Joined:
    Oct 22, 2006
    Posts:
    415
    You are talking about the HKCU ("Current User") folder, whereas I am talking about the HKLM ("Local Machine") folder. Two different animals.

    Yes, I also have ctfmon listed (in my HKCU tree) as the second entry in my "Run" folder; and it has a specific program referenced in the registry, as you note. The entry in my HKLM tree that I am talking about now has *no* program associated with it, which is the weird part. It's like something is putting that reference back in there the moment I delete it.

    Now it *looks* like it *should* be there, albeit without the empty "(value not set)" non-reference; all other first entry (Default) keys in all other folder trees *have* a "(value not set)" entry as a part of the key, but mine wants to just add the (Default) key *without* the "(value not set)" entry within it, and with no reference to any program, either. (o_Oo_O?)

    Why would Ace, CCleaner, Spybot S&D, and MSConfig all show this entry in my system startupo_O Could it be that I once had a startup program that is now uninstalled, but that it left some kind of reference to itself as a "startup" program, even though it no longer exists??



    Have I confused you enough!! :blink:



    /
     
  6. QuestionX

    QuestionX Registered Member

    Joined:
    Aug 16, 2007
    Posts:
    28
    SAM..Doesn't take much to confuse me, just learning a lot of stuff on these Forums and having good time learning..hope U get it DONE..later:thumb:
     
  7. RCGuy

    RCGuy Registered Member

    Joined:
    Aug 7, 2005
    Posts:
    541
  8. RCGuy

    RCGuy Registered Member

    Joined:
    Aug 7, 2005
    Posts:
    541
    It apparently didn't. :p
     
  9. steely

    steely Registered Member

    Joined:
    Aug 24, 2006
    Posts:
    12
    Sam,

    Run Regprot to see if it warns you about the HKLM line modification in question; in my case, it was Acrotray from Acrobat Reader.
     
  10. RCGuy

    RCGuy Registered Member

    Joined:
    Aug 7, 2005
    Posts:
    541
    I think that Sam may have given up on this thread. :)
     
Loading...
Thread Status:
Not open for further replies.