NT looking for program at startup

[Andronium]

I had a user install Yahoo Pager (*smack*) and then delete the program files without doing Add/Remove. I went in and tried to remove it with Add/Remove, and now everytime the user logs in they get "can't find 'C:\...Ypager.exe or one of it's components blah blah blah...' Error doesn't come up logged on as admin. Have checked startup folders for this user as well as 'all users' for a reference to this program. Have also checked hklm/software/microsoft/windows/current version/run for a reference and found nothing.

First question: Why is NT still looking for this program, and how where else can I look for a reference to it?

Second Question: How does this user install software when she doesn't have rights to do so in the local user manager? I've seen people do this before and don't understand how. Will NT allow people to install programs that don't have to register dlls? How can I prevent this in the future?

 

[Howiee]

You could try re-installing the program and then remove it the proper way.
Also check all the registry by doing a search for Ypager.exe because it could be in e.g. hkey_current_user/software/microsoft/windows/current version/run or somewhere else.

Regards,
Mark

 

[Andronium]

Actually I already tried searching the registry for the program, but didn't find anything. I'll try reinstalling/uninstalling.

Thanks Mark,
Andy

 

[bejayo]

Pretty sure users can install without local admin
rights on a FAT partition, because it's difficult
to assign security settings to FAT files, unlike NTFS. Though the user may be prevented from running administrative tasks, they are perfectly capable of deleting most, if not all of their C:\winnt directory ?!?!?
[Don't tell anyone!] hence installing whatever . . .

Only way I've been able to make a 'shadow launch program'
go away (besides the re-install, de-install method)is to re-create the userid. I'm pretty sure this
phenomenon hides in their NT profile - which is by now partially corrupted, and would explain why you can't find anything easily in the local registry (buried in user SID stuff) and why it doesn't show when you login with another ID.

Good luck!