Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 643
  • Last Modified:

MSCONFIG startup settings not staying ?

Ok, this is an odd one ...
I have always used the trick of MSCONFIG and going to the startup tab and disable all the junk that boggs down my computer at startup.  I am working on a windows xp computer - IBM thinkpad t40 to be exact - and its just dogging at start up.  When i go to msconfig, and uncheck programs if i reboot, and go back in , they are all checked again ?
I tried to enable bootlogging to see what is going on, but its not creating a bootlog.txt.
Also, its defaulting to selective startup - wondering if that is because i have unchecked different items on the startup tab.  We are also running Novell Client 4.91 sp2 so I know that is causing some issue, but I am logging in as a local user - not into Novell - trying to narrow down where to start.

1.) Where in the registry would hold all these items at start up and could i just delete them out of there ?
     Is there a reason why MSCONFIG is not staying set ?

0
dmccormi35
Asked:
dmccormi35
  • 4
  • 3
  • 2
  • +1
2 Solutions
 
_Maddog_Commented:
Hi dmccormi35,

Before digging into the registry, I suggest you try using a 3rd party software to achieve your goal.
I recommend using the freeware AutoRuns from sysinternals - http://www.sysinternals.com/Utilities/autoruns.html

Maddog.
0
 
Mohammed HamadaSenior IT ConsultantCommented:
There are viruses and other pests that can add any number of different entries to the startups which might also enable them at startup every reboot. They also make an additional entries under the registry key...

HKLM\Software\Microsoft\Windows\CurrentVersion\ Run and RunOnce keys,  <-- You can find your startup items here

HKLM means HKEY_LOCAL_MACHINE, There are some other entries at registry which you can edit to remove any wierd entries that's not a system startup item..

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and Runonce keys

Download hijackthis from www.hijackthis.de, scan your computer and post your log to thier website, click analyze and then post the log analyze saved link here.

Scan your computer Online and on safe mode to make sure no malware, spyware, viruses ...etc

Antiviruses Online scans...

Norton Online Scan
http://security.symantec.com/

Panda Active scan
http://www.pandasoftware.com/activescan/

Trend micro...
http://housecall.trendmicro.com/

Anti - Spyware - Adaware:-

http://www.lavasoft.de/software/adaware/
http://www.download.com/Webroot-Spy-Sweeper/3000-8022_4-10405877.html
http://www.sunbelt-software.com/CounterSpy.
0
 
Craig_200XCommented:
when you run hijak this- post the log here if you have any questions..

you can also download HijackThis 1.99.1 here http://www.cyberanswers.org/forum/uploads/HijackThis1991.exe

Open Hijackthis, click  scan and save a logfile then navigate to programfiles hijackthis folder and copy out the log file contents and paste the log here http://www.hijackthis.de/ 

 click "Analyze", "Save". at the very bottom of this page..   Copy the address/url and post a link to the saved list here.
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
Mohammed HamadaSenior IT ConsultantCommented:
I Already mentioned hijackthis Craig_200X ..
0
 
Craig_200XCommented:
just making sure he posts the log here... relax.
0
 
Mohammed HamadaSenior IT ConsultantCommented:
lol nothing to worry about, they are just points but not thoughts ;-) regards
0
 
Craig_200XCommented:
:-)

for real

Happy Cinco De Mayo.!
0
 
dmccormi35Author Commented:
Hi,
Ok here is the hijack log - i am hoping there is something i am just not seeing that is causing this thing to just DOG at start up .... any help is greatly appreciated !


Logfile of HijackThis v1.99.1
Scan saved at 8:21:14 AM, on 5/8/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Lotus\Notes\ntmulti.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\PROGRA~1\AT&TGL~1\NetCfgSv.EXE
C:\WINDOWS\System32\RegSrvc.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe
C:\Program Files\ThinkPad\ConnectUtilities\SvcGuiHlpr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\TpScrLk.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe
C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\loginw32.exe
C:\Program Files\Novell\ZENworks\WMRUNDLL.EXE
C:\Program Files\BigFix Enterprise\BES Client\BESClient.exe
I:\Tools\Anti_Spyware\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\Real\Toolbar\realbar.dll
O3 - Toolbar: (no name) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [S3TRAY2] S3Tray2.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
0
 
Craig_200XCommented:
it doesnt look like anything really bad in there. the realbar - real player toolbar is questionable- you may want to remove that just in case..

can you defragment your hard drive? this could also be a cause of slow response times.. I assume the virus scans were done and nothing came up??

how is the processor usage? is it running low or otherwise? check by ctrl-alt-del to taskmanager and check performance tab..


0
 
dmccormi35Author Commented:
Thanks for all the suggestions - i am just giving up at this point.  I should re-image the machine, but i dont have a working image of this model t40.  
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

  • 4
  • 3
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now