Where are startup/shutdown files ?

[Guest Frank F]

Where are the files that windows run at startup (beyond the startup folder)

and the files it runs at shutdown ?

I'm asking because just cleaned up a virus but one thing remaining.

Every time upon shutdown/startup, some items in registry get corrupted with

a hijack

of IE home page pointing to a bad web site (its 3929.cn DON'T go there)

Please help.

Frank

[Guest Malke]

Re: Where are startup/shutdown files ?

 

Frank F wrote:

> Where are the files that windows run at startup (beyond the startup

> folder) and the files it runs at shutdown ?

> I'm asking because just cleaned up a virus but one thing remaining.

> Every time upon shutdown/startup, some items in registry get corrupted

> with a hijack

> of IE home page pointing to a bad web site (its 3929.cn DON'T go there)

> Please help.

> Frank

 

Your computer is still not clean. Go through these general malware removal

steps systematically -

http://www.elephantboycomputers.com/page2.html#Removing_Malware

 

Include scanning with David Lipman's Multi_AV and follow instructions to do

all scans in Safe Mode. Please see the special Notes regarding using

Multi_AV in Vista.

 

http://www.elephantboycomputers.com/page2.html#Multi-AV - instructions

http://tinyurl.com/yoeru3 - download link and more instructions

 

When all else fails, get guided help. Choose one of the specialty forums

listed at the first link. Register and read its posting FAQ. PLEASE DO NOT

POST LOGS IN THE MS NEWSGROUPS.

 

Standard disclaimer: I can't see and test your computer myself, so these are

just suggestions based on many years of being a professional computer tech;

suggestions based on what you've written. You should not take my

suggestions as a definitive diagnosis. If you can't do the work yourself

(and there is no shame in admitting this isn't your cup of tea), take the

machine to a professional computer repair shop (not your local equivalent

of BigComputerStore/GeekSquad). Please be aware that not all local shops

are skilled at removing malware and even if they are, your computer may be

so infested that Windows will need to be clean-installed. If possible, have

all your data backed up before you take the machine into a shop.

 

Malke

--

MS-MVP

Elephant Boy Computers - Don't Panic!

FAQ - http://www.elephantboycomputers.com/#FAQ

[Guest Frank F]

Re: Where are startup/shutdown files ?

 

Malke

Thanks for the info. I have already run Norton and Malewarebyes in safe mode

which took care of all the major virus problems.

 

I really think I can fix the rest if I know where the startup/shutdown files

are. I can compare to a clean computer.

 

What folder(s) are the files in ??? Or if in the registry, where ?

 

Frank

 

 

"Malke" <malke@invalid.invalid> wrote in message

news:uxMiGheGJHA.740@TK2MSFTNGP03.phx.gbl...

> Frank F wrote:

>

>> Where are the files that windows run at startup (beyond the startup

>> folder) and the files it runs at shutdown ?

>> I'm asking because just cleaned up a virus but one thing remaining.

>> Every time upon shutdown/startup, some items in registry get corrupted

>> with a hijack

>> of IE home page pointing to a bad web site (its 3929.cn DON'T go

>> there)

>> Please help.

>> Frank

>

> Your computer is still not clean. Go through these general malware removal

> steps systematically -

> http://www.elephantboycomputers.com/page2.html#Removing_Malware

>

> Include scanning with David Lipman's Multi_AV and follow instructions to

> do

> all scans in Safe Mode. Please see the special Notes regarding using

> Multi_AV in Vista.

>

> http://www.elephantboycomputers.com/page2.html#Multi-AV - instructions

> http://tinyurl.com/yoeru3 - download link and more instructions

>

> When all else fails, get guided help. Choose one of the specialty forums

> listed at the first link. Register and read its posting FAQ. PLEASE DO NOT

> POST LOGS IN THE MS NEWSGROUPS.

>

> Standard disclaimer: I can't see and test your computer myself, so these

> are

> just suggestions based on many years of being a professional computer

> tech;

> suggestions based on what you've written. You should not take my

> suggestions as a definitive diagnosis. If you can't do the work yourself

> (and there is no shame in admitting this isn't your cup of tea), take the

> machine to a professional computer repair shop (not your local equivalent

> of BigComputerStore/GeekSquad). Please be aware that not all local shops

> are skilled at removing malware and even if they are, your computer may be

> so infested that Windows will need to be clean-installed. If possible,

> have

> all your data backed up before you take the machine into a shop.

>

> Malke

> --

> MS-MVP

> Elephant Boy Computers - Don't Panic!

> FAQ - http://www.elephantboycomputers.com/#FAQ

>

[Guest Malke]

Re: Where are startup/shutdown files ?

 

Frank F wrote:

> Malke

> Thanks for the info. I have already run Norton and Malewarebyes in safe

> mode

> which took care of all the major virus problems.

>

> I really think I can fix the rest if I know where the startup/shutdown

> files are. I can compare to a clean computer.

>

> What folder(s) are the files in ??? Or if in the registry, where ?

 

Use the free Autoruns utility from Sysinternals to help with startup issues.

 

http://www.microsoft.com/technet/sysinternals/default.mspx

 

Malke

--

MS-MVP

Elephant Boy Computers - Don't Panic!

FAQ - http://www.elephantboycomputers.com/#FAQ

[Guest smlunatick]

Re: Where are startup/shutdown files ?

 

On Sep 19, 6:34 am, "Frank F" <Fr...@nowhere.net> wrote:

> Malke

> Thanks for the info. I have already run Norton and Malewarebyes in safe mode

> which took  care of all the major virus problems.

>

> I really think I can fix the rest if I know where the startup/shutdown files

> are. I can compare to a clean computer.

>

> What folder(s) are the files in ???   Or if in the registry, where ?

>

> Frank

>

> "Malke" <ma...@invalid.invalid> wrote in message

>

> news:uxMiGheGJHA.740@TK2MSFTNGP03.phx.gbl...

>

> > Frank F wrote:

>

> >> Where are the files that windows run at startup (beyond the startup

> >> folder) and the files it runs at shutdown ?

> >> I'm asking because just cleaned up a virus but one thing remaining.

> >> Every time upon shutdown/startup, some items in registry get corrupted

> >> with a hijack

> >> of IE home page pointing to a bad web site (its  3929.cn   DON'T go

> >> there)

> >> Please help.

> >> Frank

>

> > Your computer is still not clean. Go through these general malware removal

> > steps systematically -

> >http://www.elephantboycomputers.com/page2.html#Removing_Malware

>

> > Include scanning with David Lipman's Multi_AV and follow instructions to

> > do

> > all scans in Safe Mode. Please see the special Notes regarding using

> > Multi_AV in Vista.

>

> >http://www.elephantboycomputers.com/page2.html#Multi-AV- instructions

> >http://tinyurl.com/yoeru3- download link and more instructions

>

> > When all else fails, get guided help. Choose one of the specialty forums

> > listed at the first link. Register and read its posting FAQ. PLEASE DO NOT

> > POST LOGS IN THE MS NEWSGROUPS.

>

> > Standard disclaimer: I can't see and test your computer myself, so these

> > are

> > just suggestions based on many years of being a professional computer

> > tech;

> > suggestions based on what you've written. You should not take my

> > suggestions as a definitive diagnosis. If you can't do the work yourself

> > (and there is no shame in admitting this isn't your cup of tea), take the

> > machine to a professional computer repair shop (not your local equivalent

> > of BigComputerStore/GeekSquad). Please be aware that not all local shops

> > are skilled at removing malware and even if they are, your computer may be

> > so infested that Windows will need to be clean-installed. If possible,

> > have

> > all your data backed up before you take the machine into a shop.

>

> > Malke

> > --

> > MS-MVP

> > Elephant Boy Computers - Don't Panic!

> > FAQ -http://www.elephantboycomputers.com/#FAQ

 

You must note that several "malware" application will not place

themselves in the startup / shutdown routines (because these would be

the first place to look at removing it) you need to run other

spyware / malware removal tool that only the ones you mentioned.