It is currently Sun Sep 05, 2010 8:50 am

All times are UTC - 5 hours




Post new topic Reply to topic  [ 1 post ] 
Author Message
 Post subject: Removing Blank/Sneaky/Malware MsConfig Entries
PostPosted: Tue Jul 20, 2010 11:00 am 
Offline
Site Admin
User avatar

Joined: Sun May 17, 2009 4:46 pm
Posts: 7
Location: Southeast US
Locations of the entries in MSConfig from the registry (Windows XP/MCE)

:!: Of course, it's advisable to backup your registry before fiddling with it, (although I never do, and have never hosed my box, and unless you know how to restore registry hives through the restoration console, it's doubtful they would do you much good anyways).
If you don't feel comfortable fiddling with the code of your OS, and the thought of clicking delete by accident and hosing your OS from booting terrifies you, I suppose you can download one of the multitudes of "cleaning" software on the market, though if your doing that, this post is hardly worth your reading, and note I have never found any of those software's worth the HDD space they are written on. :!:

Removing the entries
When you expand the "Shared Tools - MSConfig - Startupreg" path, to remove completely from the startup tab, you will want to delete the entire key for the offending software.
Note that the only reason you should be doing this at all is for:
Blank entries usually caused by spyware/adware/viruses
Or faulty uninstalled software (Bridge CS4 done this to me), that is still listed in your startup tab. Usually uninstallers this messy will leave other files hanging around as well so hit up the Program Files area to see what's left there before removing the key.


Enabled/checked items are found in the following registry locations:

HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ CurrentVersion \ Run
HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Run

And more rarely in -

HKCU \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Windows
Values named Run & Load

You can find the disabled entries in:

HKLM \ Software \ Microsoft \ Shared Tools \ MSConfig \ startupreg (rare, but could be stuck files hidden/locked/screwed in a user startup folder "usually just a shortcut anyway")

HKLM \ Software \ Microsoft \ Shared Tools \ MSConfig \ startupfolder (entries in startup found in other locations)


Disabled entries are stored per-machine in the HKLM hive.
Hkey string value stores the location where the entry was originally. When a user re-checks an entry, the hkey value determines which hive to place the entry back to HKCU or HKLM.
Thanks to Ramesh's Site for the majority of this info which wasn't prominent on the net, which is why I am regurgitating it in these forums.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 1 post ] 

All times are UTC - 5 hours


Who is online

Users browsing this forum: No registered users and 1 guest


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group