RE: Free software loads other stuff - follow up

Using REGEDIT or REGEDT32, the entries you are looking for are in:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\
They should be under Run
The entries under Run- are those you disabled using msconfig.
The entries under RunServices are services that are executed on startup and
those under RunServices- are those you have disabled.
The entries under RunOnce are those that will execute one time when you
restart.
Those under RunOnceEx are those that have been executed one time (that
choose to leave the entry there).
Those located in wininit.ini are updates that need to happen on the next
boot and those in wininit.bak are those that were executed last (overwritten
each time wininit is executed with entries in wininit.ini).
As far as I know.

Under NT, Win2K and XP, you may also have entries as services and devices
that are started by the system. If you need some of this information, let me
know off list and I'll see what I can do for you.


John Brandt
iStudio400.com

-----Original Message-----
From: James R. Newman, CDP [mailto:cis146@xxxxxxxxxxx]
Sent: Monday, May 17, 2004 8:33 AM
To: PC Technical Discussion for iSeries Users
Subject: Re: [PCTECH] Free software loads other stuff - follow up


Since posting my original message, the "extra stuff" that was loaded
unpacked a virus.  The apparent culprit was QuikSearch, which came with one
of the aquarium programs downloaded from Cnet.

I ran Ad-Aware and it didn't pick it up.  Spybot caught it but couldn't
uninstall and neither could Norton.  I had to go into msconfig, uncheck
several things in the start up panel, reboot in safe mode, delete
QuikSearch.exe in the c:\windows\system32 folder, reboot, and run a full
scan with NAV, AdAware, and Spybot.  Man, what I wouldn't give for 30
seconds and my hands around the guy's throat who put that out!!

So now I've got these items in my start up that I don't want there and that
occupy memory.  I know I can uncheck them and I know I can delete the actual
files that are run on start up but how or where can I delete the entries
that are executed on boot up?




----- Original Message ----- 
From: "James R. Newman, CDP" <cis146@xxxxxxxxxxx>
To: "PC Tech" <PcTech@xxxxxxxxxxxx>
Sent: Saturday, May 15, 2004 11:10 AM
Subject: [PCTECH] Free software loads other stuff


I'm running a Dell (don't buy one) 1.4 ghz with 256 meg ram running Windows
XP Pro.

A couple of days ago my 4 year old son saw an aquarium program running in an
office superstore. Rather than buy the program I downloaded 3 from Cnet and
installed them. I quickly noticed they'd loaded lots of other stuff like
pop-ups. 1 of them had an uninstall. I deleted the folders the programs were
loaded into and ran Norton Windows Doctor to get rid of anything left
behind.
When I run MSCONFIG I notice I've still got stuff loading that wasn't there
before such as:

eeuneqv
vbabsxs
inetmgr
QuikSearch.exe
li01f948.dll
iel2cde.dll

I think these were left behind by the freebies but how do I know for sure? I
know I can find the files and delete them but won't Windows still try and
load at startup? How do I get this stuff to not load (get it out of
MSCONFIG)?
_______________________________________________
This is the PC Technical Discussion for iSeries Users (PcTech) mailing list
To post a message email: PcTech@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/pctech
or email: PcTech-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/pctech.


_______________________________________________
This is the PC Technical Discussion for iSeries Users (PcTech) mailing list
To post a message email: PcTech@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/pctech
or email: PcTech-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/pctech.

---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.665 / Virus Database: 428 - Release Date: 4/21/04
 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.686 / Virus Database: 447 - Release Date: 5/14/04