Explorer window appearing at startup -- why? 1

[MrRedwood]

I've been trying to restabilize a friend's computer since I helped him upgrade from a 267MHZ PII to a slightly less obsolete 400MHZ PII, and still have a number of problems. I suspect some of them are related to his insistance on installing AOL 9, but one of 'em should be easy to work out:

Whenever the system boots up, a Windows Explorer browser showing the directory "C:/WINDOWS/SYSTEM" pops onto the screen. (It may actually be "C:/SYSTEM/WINDOWS" -- I forgot to write it down and I'm not enough of a Windows practioner to know which one it must be).

The only curiousity is the title bar -- if I open a second Windows Explorer to the same directory, the new one says "Exploring" plus the directory name. The original popup doesn't have the word "Exploring". Otherwise the two seem identical.

I suspect this has something to do with a registry entry (I'm always suspicious of that unholy mess). But how could it have been created, and why? And -- most importantly -- how do I get rid of it?

Thanks.

 

[mattjurado]

First, run an up to date virus and a spyware scan. Then, go to start, run, type msconfig, click ok. Hit the startup tab, see if you can locate the explorer entry.



Matt J.

Please always take the time to backup any and all data before performing any actions suggested for ANY problem, regardless of how minor a change it might seem. Also test the backup to make sure it is intact.

 

[MrRedwood]

I took a look at msconfig and didn't see any Explorer entries. Here's the list:
ScanRegistry
TaskMonitor
SystemTray
AltnetPointsManager
updmgr
LoadPowerProfile
CMESys
RealTray
AOLDialer
m2AudioSetup
LoadPowerProfile [identical to the one above]
SchedulingAgent
Machine Debug Manager
AolAcsDaemon1

That's it. Can I prune any of this stuff, like the RealTray or redundant LoadPowerProfile?

Is there anything suspicious in here? Any other ideas?

Thanks.

 

[BionicJohn]

Hi, MrRedwood,

CMESys

That's a likely culprit. Disable it immediately.

surf over to:

http://www.2-spyware.com/entry-cmesys.html

Their SpyHunter should remove it.



Iechyd da! John
Glannau Mersi, Lloegr.

 

[BionicJohn]

Apols for the fouled up link. It should be: [URL unfurl="true"]http://www.2-spyware.com/entry-cmesys.html[/url]

Iechyd da! John
Glannau Mersi, Lloegr.

 

[micker377]

LoadPowerProfile" is redundant for a reason: one for "global" and one for "current user".

 

[MrRedwood]

I've cleaned up the startup portion of the registry, but one oddity still remains: when the system first starts, a windows explorer window pops up for the directory "C:/WINDOWS/SYSTEM". There was nothing about it in msconfig. Is there anything else that could cause this?

On nefarious startup processes, the link BigJohnD provided gave me a little more info --

All three of these were installed by Kazaa:
+ AltnetPointsManager
+ updmgr (aka eUniverse aka KeenValue)
+ CMESys (aka Gator)

They've been removed from the registry's RUN or RUNSERVICEs entries.

I also turned off LoadPowerProfile; I understood it to be optional -- right now I'm trying to minimize variables.

I removed RealTray, from RealNetworks -- strangely, even when it was loading no Real icon showed up in the system tray.

The "m2AudioSetup" is still unknown -- Google didn't have *anything* on it, which seems odd.

Oh, and Microsoft's website told me I could turn off MDM.

Another good link for researching these was <

http://www.windowsstartup.com>.

If anyone knows about the "WINDOWS/SYSTEM" windows explorer issue, I'd appreciate it.

 

[Marcs41]

Step by step:
disable everything in MSConfig, restart and see if it comes back.
It is usually a leftover from an application that wnats to start but is removed, hence Windows opens the folder.
In this case, C:\Windows\System , indicates it may be about some spyware or such

Marc
_{If 'something' 'somewhere' gives 'some' error, expect random guesses or no replies at all. Please specify details.
Free Tip: The F1 Key does NOT destroy your PC!}
How Do I Get Great Answers To my Tek-Tips Questions? See faq222-2244

 

[TekTippy4U]

also turned off LoadPowerProfile; I understood it to be optional -- right now I'm trying to minimize variables.

Turn it back on, as Micker377 said.

I removed RealTray, from RealNetworks -- strangely, even when it was loading no Real icon showed up in the system tray.


Inside Real Player > preferences is an option to show / hide tray Icon (which you don't want anyway - disable (Rename) the Realsched.exe (or similar file) found in the Update_OB (?) folder, somewhere on hdd - I forget exactly. I think i recall the Uninstaller bring in this folder as well.

couple of other good startup proggie listings;

http://www.answersthatwork.com/Tasklist_pages/tasklist.htm

http://www.compu-docs.com/Startup.htm

I hope you removed GATOR crap using Add/Remove Programs in Cotrol Panel as well.....and also the MS Machine Debug Manager (I think it's in there).
Check the C:\WINDOWS\Profiles folder and delete and <profilename> that is no longer being used.

Start > Run REGEDIT and drill to HKEY_USERS ( the \.Default key and it's subkeys are the defaults - leave alone for now). Anything with a <profilename> such as HKEY_USERS\<mrRedwood> is related to UserProfiles (customized Startup etc..) and can be removed/deleted.
Check Control Panel >> Users for more entries (if exist)

Right click IE > choose Properties on Desktop (or an IE Window > Tools > Internet Options) (or Control Panel > Internet Options) and LOOK IN THE SECURITY tab >> Trusted Sites >> for FREE.AOL.COM and Remove any thing here.
General Tab >> CLEAR HISTORY and DELETE TEMPORARY INTERNET FILES.

D/l and Run SpyBot Search and Destroy (use the Immunize feature) once installed and AdAware with updated defs
--------------------------------------------------

Now -- as far as C:\WINDOWS\SYSTEM - go to Msconfig
System.ini tab
expand [Boot] by clicking the [+]
Shell=Explorer.exe (ONLY THIS, nothing ELSE should be here)

Same for
Win.ini
expand [Windows]
Load=
Run=
(should be Nothing here for BOTH.....sometimes Printer proggies put there scheduler here - sometimes legit, and related to empty inkjet cartridge - but mostly for Registration online ).

Even look in Autoexec.bat Tab for funnies (possible program TSR driver being called on Startup)

Search all the Run, RunOnce, RunOnceEx and RunServices Keys beneath HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE which should get at MOST is not all the Startup Folders - scattered all over the drive from OEMs and Differing USERS.

TT4U

Notification:
These are just my thoughts....and should be carefully measured against other opinions.
Backup All Important Data/Docs