unexpected msiexec.exe being run in Windows XP desktop after boot up.

whenever I launch IE or when my windows desktop is started up, I am seeing a windows installer dialog box being popped up and prepare for install.  

I have run malwarebyte and my AV has the latest.  Is there something I could do?

Please advise.  Many thanks.
nav2567Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

TAWpowerCommented:
This is likely a Run/Run Once command. Check MSCONFIG and see if anything is there that would be looking to install a program. After that check the registry for Run and Run Once commands. I would remove it from the registry directly rather than configuring through MSCONFIG. If you need further help let me know.


---------------------------------------------------------------------------------below from: http://msdn.microsoft.com/en-us/library/aa376977(v=vs.85).aspx
Run and RunOnce Registry Keys
Run and RunOnce registry keys cause programs to run each time that a user logs on. The data value for a key is a command line. Register programs to run by adding entries of the form description-string=commandline. You can write multiple entries under a key. If more than one program is registered under any particular key, the order in which those programs run is indeterminate.

The Windows registry includes the following four keys:

•HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
•HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
•HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
•HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
By default, the value of a RunOnce key is deleted before the command line is run. You can prefix a RunOnce value name with an exclamation point (!) to defer deletion of the value until after the command runs. Without the exclamation point prefix, if the RunOnce operation fails the associated program will not be asked to run the next time you start the computer.

By default, these keys are ignored when the computer is started in Safe Mode. The value name of RunOnce keys can be prefixed with an asterisk (*) to force the program to run even in Safe mode.

A program run from any of these keys should not write to the key during its execution because this will interfere with the execution of other programs registered under the key. Applications should use the RunOnce or RunOnceServices keys only for transient conditions, such as to complete application setup. An application must not continually recreate entries under RunOnce or RunOnceServices because this will interfere with Windows Setup.

Run and RunOnce keys are run each time a new user logs in. RunServices and RunServicesOnce are run in the background when the logon dialog box first appears or at this stage of the boot process if there is no logon. These keys are for background services such as remote registry service and are run only once per boot. The Setup key is run only by Setup's first-boot activities, or after you use the Add/Remove Programs Wizard. This key displays the progress dialog box as the keys are run one at a time. For the Setup key, the name of the value is the name that is displayed in the dialog box.

0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Aaron TomoskySD-WAN SimplifiedCommented:
Download procmon from sysinternals. Run it, click the identify button, click the popup installer window. It should allow you to track down the cause.
0
younghvCommented:
I would download a fresh copy of Malwarebytes - (using the "Save As" function) and do the scans in the order shown in these EE Articles:

http://www.experts-exchange.com/A_1940.html (Basic Malware Troubleshooting)
http://www.experts-exchange.com/A_5172.html (Windows-Stability-Center)
0
greyknight17Commented:
Does it mention what program is trying to install there? If so, get the Windows Installer CleanUp Utility to remove it.
0
nav2567Author Commented:
Thanks.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Anti-Virus Apps

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.