Folder pop up on Windows XP Home SP2 startup

[nylint]

I'm working on a friend's box and every time windows starts, his My Docs folder pops up! It's easily closed, but I can't find a link to the folder in the startup folder or in the reg, and i even went into msconfig and disabled EVERYTHING - still pops up. Tried booting Knoppix, mounting the drive in read mode, and deleting the My Docs folder after backing up the contents, but it still pops up the folder. Any ideas?

Also, anyone know how to kill the System Volume Information folders after disabling System Restore? He's got a virus in that folder, and it keeps reinfecting the rest of the box, and I can't delete the folders. Do I have to kill the service as well as disable it through the System Restore tab?

[Phoenix86]

Disable system restore, don't worry about the service.

Check the all users profile startup menu and registry keys for additional startup items. If it only happens in his profile, and you have looked at the standard places (msconfig, registry, startup, etc) re-create the profile. This won't help if it's happening under other user's profiles.

GL

http://www.mentallyretired.com/h3/index.cfm/u_45754 (http://www.mentallyretired.com/h3/index.cfm?a=doMyStats&u_id=45754)

[nylint]

ok, your suggestion is in the process of being implemented. how about the system volume information folder?

edit: perhaps i should clarify. after disabling system restore they're still there, and infected with virii.

[pinkegobox]

can you not delete it when you have disabled system restore? if not, then just do it in safe mode. that should work.

oh, and with the pop up window thing. my old format used to do that, but with the nvidia folder. couldn't for the life of my fix it, so gave up and reformatted. heh.

[nylint]

newp. upon disabling system restore, the folders are still there, and undeletable. i cannot change the permissions on them, everything's grayed out. i'm going to try to re-enable system restore, then disable it again.

[Stellar]

FYI, the My Documents folder opening upon startup is a symptom of the "ISTBar" trojan/spyware program.

It can only be removed AFAIK by running Webroot Spysweeper in Safe Mode.

[nylint]

Thank you!