MSConfig: Question

I have a question about msconfig:

There is a a startup item symbolized by a square and the command is also a box.
The location:
hklm/software/microsoft\windows\currentversion\run

What is that item?

 

Hello there,

can you please post a screen shot of it? Cause I have no idea what you are talking about and I am in MsConfig and I am seeing nothing what you have describe.

JC

 

So the item has no name and no filename?
open up RegEdit and go to the key location it specifies and see what is in there.
Screenshots of the msconfig screen and the regedit screen would be helpful.

If you're really concerned with what is running... Download HijackThis and run it and copy paste the entire resulting file here for us to see.
HiJackThis- http://www.download.com/HijackThis/3000-8022_4-10227353.html

 

Just be careful with HiJack this. You can really screw up the reg.
Tim

 

Running it just to get the list isn't going to hurt anything... only if you start removing things willy-nilly.
It's a very useful tool.

 

You can uncheck that item. It doesn't run a program. If I remember correctly, it's just a command that is not important. I disabled it long ago and have had no problems.

 

Titanium -- I'm familiar with what you're talking about and no, they shouldn't be there. Feel free to remove away.

 

Here is a screenshot of what I am talking about.

 

Yeah.. just uncheck it. You'll be fine.

 

This is it:

HKLM\Run

Added by the FORBOT-BJ WORM! (where HKLM\Run represents HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run)

I'd remove it and not just uncheck it...

 

How do you know it's from a worm? My blank entry happened while installing Dell drivers and software. I don't remember the name that was in the HKLM\...\Run registry key, but I know it wasn't a trojan/worm. I think mine was related to not having .NET installed before installing ATI's Catalyst drivers. (.NET is a requirement for Catalyst)

 

Blank registry entries don't come from legit programs.

http://www.sysinfo.org/

 

How do you remove it?

 

I would use ccleaner or a similar program and run my virus scanner and an ad remover program while I was at it.

 

If someone downloads a program from an untrusted source (file sharing, warez sites, freeware, etc), I would agree with you. However, if the program is trusted, then a blank registry entry can come from an aborted install or an error during the install. I would delete the registry key then reboot. If the key does not reappear and msconfig is clean, I would keep an eye out for a few days. If it reappears, clean the machine.

 

How is the registry key deleted? I didn't see an option under Ccleaner and it didn't go away when I ran it.

 

Run regedit, go to HKLM\...\Run, and delete the key in question.

 

Hehehe, when he goes into regedit the infamous key won't be there. Here's my guess on what's going on:

Recently, some dell's include a DWORD value in HKLM\....\Run. The DWORD is called ShowLOMControl, and a little googlin' will reveal something like the following:

"Shows as O4 - HKLM\..\Run: [ShowLOMControl]
(note strange symbol here) HKLM\Software\Microsoft\Windows\Current Version\Run ShowLOMControl Reg_DWORD 0x00000001 (1) LOM = LAN on Motherboard. It mean Show "LAN on Motherboard" Control. On systems where you can install an external LAN interface, it will warn you that you already have a built-in LAN interface. Appears to be a feature on certain Dell systems. " (obtained here)

The thing is that it is not a typical registry key, but rather a DWORD value, so msconfig doesn't know how to handle it. Hence, the funny square thingie.

 

You are exactly right, Moebius, it was not there.

What a pain this is. I deactivated it on startup.

 

Thanks for sparking my memory, Moebius. It was indeed the ShowLOMControl. I had forgotten what it was. I found the DWORD and deleted it from the registry.

I really need to start writing things down when I remove them from my OS.

 

agreed grab ad aware se just as powerfull and its idiot proof.