Solved

What is "enoenwcq.exe"

Posted on 2008-10-24
12
2,168 Views
Last Modified: 2012-05-05
When ever I start my Win XP system I get the error msg listed right after the windows screen.   The system boots and nothing really seems wrong but worried about this error msg on startup.

In the registry is the following data..

BootExecute = autocheck C:\WINDOWS\system32\enoenwcq.exe C:\WINDOWS\system32\enoenwcq.exe:changelist


What is this?

Can I delete the whole registry key or do I need to delete the value and keep the "BootExecute" key?
IMG-3364.jpg
0
Comment
Question by:jondrejik
  • 6
  • 3
  • 2
  • +1
12 Comments
 
LVL 1

Expert Comment

by:WideAreaMedia
ID: 22800531
I googled the file name and came up with nothing. That's fairly unusual. You may want to perform a full anti-virus scan, as the seemingly random name of the executable along with its location on the system could indicate a problem.

It could be entirely benign, but that's what I'd do.

Best Regards,
Martin Schultz
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 22800545
A google search on enoenwcq.exe disclosed nothing.  I'm presuming it's leftover from some virus, spyware, or other malware that infected your computer but has been partially removed.  The normal value of the registry at this location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager

is

BootExecute  Reg_Multi_SZ  autocheck autochk * Isdelete

I suggest you open Regedit.exe, go to that key, verify that it appears to have been changed to the value in your error message, and then right click it, select Modify, and change it to the correct value.
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 22800701
Correction:  that is the correct value for a Vista computer, or NEARLY correct:  Lsdelete rather Isdelete.  But for an XP computer, it is just autocheck autochk *
0
 
LVL 50

Expert Comment

by:jcimarron
ID: 22800768
jondrejik--After scanning for viruses, you may also want to run HiJackThis and post the log if you need help in analysis.
http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html
0
 
LVL 50

Expert Comment

by:jcimarron
ID: 22800775
jondrejik--If indeed you find enoenwcq.exe  on your harddrive you could submit that file  for online analysis to http://www.virustotal.com/xhtml/index_en.html
0
 

Author Comment

by:jondrejik
ID: 22801049
I changed the registry key back to ....   BootExecute  Reg_Multi_SZ  autocheck autochk *

I ran a search for the file and didn't find it anywhere on the system.

Mcafee virus scan not showing any issues after it was run.

Hijack not showing any issues

Thanks.   Will report back if it shows up after the reboot
0
Complete Microsoft Windows PC® & Mac Backup

Backup and recovery solutions to protect all your PCs & Mac– on-premises or in remote locations. Acronis backs up entire PC or Mac with patented reliable disk imaging technology and you will be able to restore workstations to a new, dissimilar hardware in minutes.

 
LVL 50

Expert Comment

by:jcimarron
ID: 22804328
jondrejik: and Lee Tutor--I run WinXP SP3.  The Data value showing for BootExecute  Reg_Multi_SZ is  autocheck autochk *
lsdelete
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 22804384
Interesting.  I have WinXP SP3 also, and there is no lsdelete in my BootExecute.  There is also no lsdelete.exe in my \Windows\System32 folder, in XP.  (There is, in my Vista \Windows\System32 folder.)
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 22804408
Did a little more research on lsdelete.exe, and found this page:

http://www.windowsbbs.com/windows-xp/64898-what-do-you-have-lsdelete-exe.html

I've never run LavaSoft AdAware on my XP pc (if memory serves correctly), but I have on my Vista pc.

0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 22806954
jondrejik, any feedback?
0
 

Author Comment

by:jondrejik
ID: 22807321
I have lavasoft on thi system so I need to have the lsdelete in the boot entry of the registry.  Added it back in and rebooted.   No issues seen.

Thanks
0
 
LVL 59

Accepted Solution

by:
LeeTutor earned 250 total points
ID: 22807376
Well, I think LavaSoft will add that lsdelete back in when it runs, if it's not already there.  But is your question now answered?
0

Featured Post

IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

Join & Write a Comment

Can I legally transfer my OEM version of Windows to another PC?  (AKA - Can I put a new systemboard in my OEM PC?) Few of us are both IT and legal experts but we all have our own views of Microsoft's licensing rules and how they apply.  There are…
It is only natural that we all want our PCs to be in good working order, improved system performance, so that is exactly how programs are advertised to entice. They say things like:            •      PC crashes? Get registry cleaner to repair it!    …
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now