Solved

deleted startup programs keep coming back

Posted on 2007-03-29
9
2,098 Views
Last Modified: 2009-12-16
I am running Windows Vista Ultimate.  Using StartupCop, I have disable several startup programs.  However, as soon as I close StartupCop and reopen it, they are no longer disabled.  So I tried doing the same thing using MSConfig's startup program.  Same result.  I uncheck the items, X out and come back and the boxes are checked again.  So, I went to the Registry and deleted the items from run and -run and runonce, wherever they showed up.  But as soon as I X out and return, there they are again.  How do I get rid of this stuff?
0
Comment
Question by:rdaves
9 Comments
 
LVL 59

Accepted Solution

by:
LeeTutor earned 150 total points
ID: 18820728
When you unchecked the items in MSCONFIG and clicked Apply or OK, did you then reboot the computer?  Look at these instructions to ensure you did everything required:

http://www.vista4beginners.com/System-Configuration-Utility

If you did everything as above, then the next thing I would want to know is which startup programs are you trying to disable?
0
 
LVL 7

Assisted Solution

by:5t34lth_G33k
5t34lth_G33k earned 50 total points
ID: 18823689
You say you 'X out' - Im assuming you dont mean clicking the cross? If so, you are essentially discarding your changes. Click OK instead, or as I do, Apply and then OK.

0
 

Author Comment

by:rdaves
ID: 18824073
the two entries I am trying to eliminate are:
BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}
ehtray.exe

The BgMonitor is something related to Nero.  However, when I use MSConfig to disable it by unchecking the adjacent checkbox and clicking "apply",  I get a screen refresh and the check box is checked again.
Same thing for ehtray.exe.
When I use StartupCop by disabling or packing for removal and clicking "apply", I get a screen refresh and these two items are enabled again.
When I go to regedit and delete these two entries, they come back big as life after I close regedit and reopen it.  
0
Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

 
LVL 59

Expert Comment

by:LeeTutor
ID: 18827206
Well, I cannot find much at all on BgMonitor, but ehtray and some similarly named programs are mentioned on this page:

http://h10025.www1.hp.com/ewfrf/wc/genericDocument?lc=en&cc=us&docname=bph07149
HP and Compaq Desktop PCs -  Preventing Programs from Opening When Windows Starts (Windows 98, ME, XP)

Ehmsas   Ehrec  Ehsched  Ehshell  Ehtray  

  All of these software programs are related to Media Center. This software is integrated into Windows XP and should not be prevented from starting. Ehshell is the main Media Center software. The other programs support tasks for Ehshell, like recording and guide download scheduling. If any of these tasks are stopped, The Media Center software could stop functioning or exhibit strange behaviors. Do not prevent from starting.

Ehrec

Ehsched

Ehshell

Ehtray
0
 

Author Comment

by:rdaves
ID: 18831169
Understand the relationship of ehtray to Microsoft Media Center and guess I can't stop it from starting.
However, I am not sure that BGMonitor is really starting.  When I look at the details provided by StartupCop, it tells me that the following command is to be executed:  C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe.
However, I cannot find this file on my hard drive by following that path.  
I also do not understand why I am prevented from deleting the entry "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" from my registry
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 18831698
Can you try modifying the Permissions of the key?  Click the name in the right pane of Regedit, then go to the Edit menu and selection Permissions...
0
 

Author Comment

by:rdaves
ID: 18832274
I get the message:

 "You can’t remove RESTRICTED because this object is inheriting permissions from its parent.  To remove RESTRICTED you must prevent this object from inheriting permissions.  Turn off the option for inheriting permissions, and then try removing RESTRICTED again".  What does this mean?
0
 

Author Comment

by:rdaves
ID: 18832317
Right clicked on the object.  Then Edit>Permissions>advanced>Permissions
In the Permissions dialog box, I see that there is a permission entry for “RESTRICTED”, whatever that means.  I highlight this entre and uncheck the box “include inheritable permissions from this object’s parent”.  Then I get a real scary message that says “You have denied all users access to Run.  No one will be able to access Run and only the owner will be able to change permissions”.
Next, I get a message “Selecting this option means that the parent permission entries that apply to child objects will no longer be applied to this object. To copy the permission entries that were previously applied from the parent to this object, click Copy.  To remove the permission entries that were previously applied from the parent and keep only those permissions explicitly defined here, click Remove
To cancel this action, click Cancel”
If I click "Remove" it would be fine if just the BGMonitor entry would disappear from my registry, however, all the entries in the "Compouter\HKEY_USERS\S-1-5-21-2433034647-848334064-812248280-1000\Software\Microsoft\Windows\Current Version\Run"        disappear.
That scares me enough to cancel the action.
0
 

Assisted Solution

by:vietsonvpc
vietsonvpc earned 50 total points
ID: 18841040
you can get the tool check start up and reset many option like disable/enable registry, run, right click, conmamd, control panel, task manager.....
u can download it here http://adminviet.net/forum/showthread.php?t=21 
0

Featured Post

Use Case: Protecting a Hybrid Cloud Infrastructure

Microsoft Azure is rapidly becoming the norm in dynamic IT environments. This document describes the challenges that organizations face when protecting data in a hybrid cloud IT environment and presents a use case to demonstrate how Acronis Backup protects all data.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Make bootable USB with kon-boot 6 758
PXE question 7 85
Oracle VM VirtualBox running on Ubuntu Mate 16.04.1 - Shared Folder Access Issue 23 219
Inventory equipment in the office 7 125
Microsoft's ISA Server has been its pre-eminent security product for about a decade and is still regarded amongst the well-informed as one of the best software firewalls and application gateways ever released, by any manufacturer. ISA Server has bee…
As the title indicates, I have done this before. It chills me everytime I update the OS on my phone, (http://www.experts-exchange.com/articles/18084/Upgrading-to-Android-5-0-Lollipop.html) because one time I did this and I essentially had a bricked …
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
Hi friends,  in this video  I'll show you how new windows 10 user can learn the using of windows 10. Thank you.

791 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question