Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
?
Solved

What is "enoenwcq.exe"

Posted on 2008-10-24
12
Medium Priority
?
2,180 Views
Last Modified: 2012-05-05
When ever I start my Win XP system I get the error msg listed right after the windows screen.   The system boots and nothing really seems wrong but worried about this error msg on startup.

In the registry is the following data..

BootExecute = autocheck C:\WINDOWS\system32\enoenwcq.exe C:\WINDOWS\system32\enoenwcq.exe:changelist


What is this?

Can I delete the whole registry key or do I need to delete the value and keep the "BootExecute" key?
IMG-3364.jpg
0
Comment
Question by:jondrejik
  • 6
  • 3
  • 2
  • +1
12 Comments
 
LVL 1

Expert Comment

by:WideAreaMedia
ID: 22800531
I googled the file name and came up with nothing. That's fairly unusual. You may want to perform a full anti-virus scan, as the seemingly random name of the executable along with its location on the system could indicate a problem.

It could be entirely benign, but that's what I'd do.

Best Regards,
Martin Schultz
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 22800545
A google search on enoenwcq.exe disclosed nothing.  I'm presuming it's leftover from some virus, spyware, or other malware that infected your computer but has been partially removed.  The normal value of the registry at this location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SessionManager

is

BootExecute  Reg_Multi_SZ  autocheck autochk * Isdelete

I suggest you open Regedit.exe, go to that key, verify that it appears to have been changed to the value in your error message, and then right click it, select Modify, and change it to the correct value.
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 22800701
Correction:  that is the correct value for a Vista computer, or NEARLY correct:  Lsdelete rather Isdelete.  But for an XP computer, it is just autocheck autochk *
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
LVL 50

Expert Comment

by:jcimarron
ID: 22800768
jondrejik--After scanning for viruses, you may also want to run HiJackThis and post the log if you need help in analysis.
http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html
0
 
LVL 50

Expert Comment

by:jcimarron
ID: 22800775
jondrejik--If indeed you find enoenwcq.exe  on your harddrive you could submit that file  for online analysis to http://www.virustotal.com/xhtml/index_en.html
0
 

Author Comment

by:jondrejik
ID: 22801049
I changed the registry key back to ....   BootExecute  Reg_Multi_SZ  autocheck autochk *

I ran a search for the file and didn't find it anywhere on the system.

Mcafee virus scan not showing any issues after it was run.

Hijack not showing any issues

Thanks.   Will report back if it shows up after the reboot
0
 
LVL 50

Expert Comment

by:jcimarron
ID: 22804328
jondrejik: and Lee Tutor--I run WinXP SP3.  The Data value showing for BootExecute  Reg_Multi_SZ is  autocheck autochk *
lsdelete
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 22804384
Interesting.  I have WinXP SP3 also, and there is no lsdelete in my BootExecute.  There is also no lsdelete.exe in my \Windows\System32 folder, in XP.  (There is, in my Vista \Windows\System32 folder.)
0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 22804408
Did a little more research on lsdelete.exe, and found this page:

http://www.windowsbbs.com/windows-xp/64898-what-do-you-have-lsdelete-exe.html

I've never run LavaSoft AdAware on my XP pc (if memory serves correctly), but I have on my Vista pc.

0
 
LVL 59

Expert Comment

by:LeeTutor
ID: 22806954
jondrejik, any feedback?
0
 

Author Comment

by:jondrejik
ID: 22807321
I have lavasoft on thi system so I need to have the lsdelete in the boot entry of the registry.  Added it back in and rebooted.   No issues seen.

Thanks
0
 
LVL 59

Accepted Solution

by:
LeeTutor earned 1000 total points
ID: 22807376
Well, I think LavaSoft will add that lsdelete back in when it runs, if it's not already there.  But is your question now answered?
0

Featured Post

[Webinar] Database Backup and Recovery

Does your company store data on premises, off site, in the cloud, or a combination of these? If you answered “yes”, you need a data backup recovery plan that fits each and every platform. Watch now as as Percona teaches us how to build agile data backup recovery plan.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

cPanel is a Unix based web hosting control panel that provides a graphical interface and automation tools designed to simplify the process of hosting a web site. cPanel utilizes a 3 tier structure that provides functionality for administrators, rese…
If you have done a reformat of your hard drive and proceeded to do a successful Windows XP installation, you may notice that a choice between two operating systems when you start up the machine. Here is how to get rid of this: Click Start Clic…
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
The Relationships Diagram is a good way to get an overall view of what a database is keeping track of. It is also where relationships are defined. A relationship specifies how two tables connect to each other. As you build tables in Microsoft Ac…
Suggested Courses

564 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question