stopping a program from autostart

[Subyland]

Hello all,

I recently installed Nero; I then discovered that a program called "Nero check" loads automatically with Windows. I have tried to stop that via msconfig but to no avail as at each startup it creates a new "line" and starts. I believe it can be stop via the registry but I do not know what needs to be deleted there. Can anybody point me in the right direction ?

 

[benno]

HLKM\Software\Microsoft\Windows\CurrentVersion\Run\* is where you're going to find the load on startup entries. Just remove it from there.

 

[GrahamC230K]

StartupGroup
HKML....Run
HKCU....Run

 

[masqueraid]

If you don't want to go diving into your registry you can do this by cutting and pasting the line at the end of this post into the white box that comes up when you click on the Start button and click on Run...

Then click the OK button.


REG DELETE HKLM\Software\Microsoft\Windows\CurrentVersion\Run /V "NeroFilterCheck" /f

 

[GrahamC230K]

msconfig is a bit more novice friendly too.

 

[Subyland]

Many thanks for the replies...I have found the entry and deleted it but how do I save the changes? I can't find anywhere a "save". And if I close the registry and reboot the entry is still there...

 

[grober]

I think you have to disable the system restore function in XP for the reboot after registry editing? You can also use the system startup tools utility in advanced mode in the free Spybot Search and Destroy utility to stop it at boot up. http://www.spybot.info/ its a free useful anti-spyware utility to have on your PC anyway.

 

[masqueraid]

Subyland, Nero check is the name of the process run by the legitimate Nero filter cheker. The file that launches this is called NeroFilterCheck.

If your registry entry was for nerocheck.exe you may have the trojan Proxy-X which mimics the appearance of Nero's filter checker. The legitimate program does not relaunch itself if it is removed.

Spybot S&D grober has already mentioned should help clear this up.

If you still have problems with it try the 30 day trial version of Trojan Hunter which will need an hour or so to scan your entire machine but will grab anything that Proxy-X has let in.

 

[Subyland]

Again thanks for your assistance.
Masqueraid you are right it is nerocheck.exe that I have on my PC. Sadly, both spybot and Trojan Horse seem to have failed to remove it as it still appear in the registry when I do "regedit"...

 

[timskemp]

Autoruns is your friend.

Download here http://www.microsoft.com/technet/sysinternals/ProcessesAndThreads/Autoruns.mspx and then just highlight stuff you don't want to run and untick it, or delete it completely!

 

[masqueraid]

Again thanks for your assistance.
Masqueraid you are right it is nerocheck.exe that I have on my PC. Sadly, both spybot and Trojan Horse seem to have failed to remove it as it still appear in the registry when I do "regedit"...

Make sure you run both in Windows "Safe Mode" (hit F8 when the PC starts until you are offered the choice for "Safe Mode with Networking"

 

[Subyland]

I have tried going into safe mode and deleting the entry. All is fine and new settings saved and when I boot normally next, no problem. But Ad-watch advise me of a registry modification and when I look at it Nerocheck has reinstated itself into the registry !! so next boot we're back to square one !!!
It 's intereting to note that I have the same problem with Festoon which I cannot disable from autorun.

 

[masqueraid]

Did you install S&D's TeaTimer utility? This will allow you to refuse the registry change. Make a note of what program is asking to make the registry change.

 

[Subyland]

Tried autorun as well. No change. The minute the entry is deleted it recreates itself . Masqueraid, don't know what you're talking about...

 

[timskemp]

Tried autorun as well. No change. The minute the entry is deleted it recreates itself . Masqueraid, don't know what you're talking about...

Download process explorer from the sysinternals website, then look for odd processes. There'll be the one you know about, and when you kill it another one will wake up and replace it.

You need to freeze them both, then kill them both, then delete the files.

 

[masqueraid]

There are two approaches to this.

The one it is most difficult to screw up your computer with is to reinstall Spybot S&D and during setup ask it to install TeaTimer. This actively monitors your registry and if anything tries to change it it checks with you first to make sure you know about it (and allows you to refuse). Often it also tells you the name of the process that is trying to make the change (this is what timskemp is getting you to look for).

The second route is to use a utility called HiJackThis, which will almost cetainly fix the computer but you need to know what you are doing with it. Support available

 

[Carrotchomper]

Cheers for the tip about Spybot. I have just downloaded it and it found 56 nasties. MY computer is running so much faster now!

 

[Subyland]

I 've finally found the culprit. Ad-watch recreated the re entry when it was deleted as it believed it to be a malicious action. If I disable it then all ok. I have remove it but if I reinstall it pb appear again !!

Many thanks to all of you.