Solved

What is "enoenwcq.exe"

Posted on 2008-10-24
12
2,175 Views
Last Modified: 2012-05-05
When ever I start my Win XP system I get the error msg listed right after the windows screen.   The system boots and nothing really seems wrong but worried about this error msg on startup.

In the registry is the following data..

BootExecute = autocheck C:\WINDOWS\system32\enoenwcq.exe C:\WINDOWS\system32\enoenwcq.exe:changelist


What is this?

Can I delete the whole registry key or do I need to delete the value and keep the "BootExecute" key?
IMG-3364.jpg
0
Comment
Question by:jondrejik
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 3
  • 2
  • +1
12 Comments
 
LVL 1

Expert Comment

by:WideAreaMedia
ID: 22800531
I googled the file name and came up with nothing. That's fairly unusual. You may want to perform a full anti-virus scan, as the seemingly random name of the executable along with its location on the system could indicate a problem.

It could be entirely benign, but that's what I'd do.

Best Regards,
Martin Schultz
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 22800545
A google search on enoenwcq.exe disclosed nothing.  I'm presuming it's leftover from some virus, spyware, or other malware that infected your computer but has been partially removed.  The normal value of the registry at this location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager

is

BootExecute  Reg_Multi_SZ  autocheck autochk * Isdelete

I suggest you open Regedit.exe, go to that key, verify that it appears to have been changed to the value in your error message, and then right click it, select Modify, and change it to the correct value.
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 22800701
Correction:  that is the correct value for a Vista computer, or NEARLY correct:  Lsdelete rather Isdelete.  But for an XP computer, it is just autocheck autochk *
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 50

Expert Comment

by:jcimarron
ID: 22800768
jondrejik--After scanning for viruses, you may also want to run HiJackThis and post the log if you need help in analysis.
http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html
0
 
LVL 50

Expert Comment

by:jcimarron
ID: 22800775
jondrejik--If indeed you find enoenwcq.exe  on your harddrive you could submit that file  for online analysis to http://www.virustotal.com/xhtml/index_en.html
0
 

Author Comment

by:jondrejik
ID: 22801049
I changed the registry key back to ....   BootExecute  Reg_Multi_SZ  autocheck autochk *

I ran a search for the file and didn't find it anywhere on the system.

Mcafee virus scan not showing any issues after it was run.

Hijack not showing any issues

Thanks.   Will report back if it shows up after the reboot
0
 
LVL 50

Expert Comment

by:jcimarron
ID: 22804328
jondrejik: and Lee Tutor--I run WinXP SP3.  The Data value showing for BootExecute  Reg_Multi_SZ is  autocheck autochk *
lsdelete
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 22804384
Interesting.  I have WinXP SP3 also, and there is no lsdelete in my BootExecute.  There is also no lsdelete.exe in my \Windows\System32 folder, in XP.  (There is, in my Vista \Windows\System32 folder.)
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 22804408
Did a little more research on lsdelete.exe, and found this page:

http://www.windowsbbs.com/windows-xp/64898-what-do-you-have-lsdelete-exe.html

I've never run LavaSoft AdAware on my XP pc (if memory serves correctly), but I have on my Vista pc.

0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 22806954
jondrejik, any feedback?
0
 

Author Comment

by:jondrejik
ID: 22807321
I have lavasoft on thi system so I need to have the lsdelete in the boot entry of the registry.  Added it back in and rebooted.   No issues seen.

Thanks
0
 
LVL 59

Accepted Solution

by:
LeeTutor earned 250 total points
ID: 22807376
Well, I think LavaSoft will add that lsdelete back in when it runs, if it's not already there.  But is your question now answered?
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Issue: Unstable cursor in Windows XP and Windows runs extremely slow in that any click will bring up the Hour glass (sometimes for several seconds before giving you what you want) . Troubleshooting Process and the FINAL FIX: This issue see…
Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question