System 32 ??

[glassman]

I recently had a problem with my puter whereby the home page had been hijacked. From what I understand, a 'Zlob Downloader' was kindly removed by a tekkie-friend (which reminds me; must get him that drink for his time!).

Despite him successfully restoring the homepage to what it used to be, I now have - on start up - 'System32' opening up once I've booted. Please note: I'm ok with computers and relevant terminology when they work how they should. That's where it ends. How do I stop this folder opening, or is there still a problem?

Thanks,

Paul.

[aranell]

Could be a number of places...

Firstly, run a spyware checker (I tend to mainly use Adaware) as it may be spyware which is causing this.

Also, try Looking in your start-up menu (under Programs on your start menu) and see if it's there, and if it is, delete it.

If not, take a look in your registry under:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrent VersionRun and see if it's starting from there. If you are unsure, don't delete anything as you can serisouly mess your system if you delete stuff from the registry and there's no 'undo' key [to look at the registry, go to 'run' on your start menu and type 'regedit' and click OK]

[BliarOut]

Yup, most likely a duff entry in
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]

If you can't suss it, go into regedit, click on the above key in the left hand pane and export the selected branch. Save it somewhere you can find it so you can roll back if you stuff it up.

You can edit in notepad and paste the contents here for analysis if you need to, eg

My registry said:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun]
"SoundMan"="SOUNDMAN.EXE"
"NWTRAY"="NWTRAY.EXE"
"McAfeeUpdaterUI"=""C:\ePOAgent\UpdaterUI.exe" /StartedFromRunKey"
"ShStatEXE"=""C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE"
"msnappau"=""C:\Program Files\MSN Apps\Updater\01.02.0002.1001\en-gb\msnappau.exe""
"BluetoothAuthenticationAgent"="rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent"
"DataLayer"="c:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE"
"PCSuiteTrayApplication"="c:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE"
"TkBellExe"=""C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot"
"CoolSwitch"="C:\WINDOWS\system32\taskswitch.exe"
"iTunesHelper"=""C:\Program Files\iTunes\iTunesHelper.exe""
"QuickTime Task"=""C:\Program Files\QuickTime\qttask.exe" -atboottime"
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
"StartintY"=""C:\Program Files\intY\cmgrwin32.exe" 24302658"

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOptionalComponents]

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOptionalComponentsIMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOptionalComponentsMAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRunOptionalComponentsMSFS]
"Installed"="1"