My Computer Folder keeps opening on startup.

Rainman21

Limp Gawd
Joined
Aug 23, 2007
Messages
318
My Computer Folder keeps opening on startup. I ran a lot of anti-spyware programs that removed spyware from the pc and I have ran ccleaner and AWC and checked windows startup but I can't figure out why the folder keeps opening. Anyone have any ideas?
 
You can just go to run then type msconfig, then go to the Startup tab and find it under Startup Item. Just uncheck the checkbox for the proper Startup Item and you should be all good to go.
 
My guess is that you have something launching from a registry key or command line that references something like "Program Files" without the quotes, so it just opens that folder because it can't find the rest of the path. Check your startup entries for long paths with spaces and no quotes.
 
Thanks guys. I checked in window startup and in the registry key in the run folder and I didn't really see anything that wasn't already in windows startup.
Here's a Hijack this log from the pc.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:08:28 PM, on 7/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\SiteAdvisor\6261\SAService.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\ctfmon.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\regedit.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
F2 - REG:system.ini: Shell=explorer.exe "
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\GoogleAFE\GoogleAE.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6261\SiteAdv.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [DLCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,lcdbtpcb.dll,
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\system32\dlcccoms.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: is-25AIQ - Unknown owner - C:\Documents and Settings\All Users\Desktop\Kaspersky Lab Tool\is-25AIQ\is-25AIQ.exe (file missing)
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6261\SAService.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

--
End of file - 6185 bytes
 
O23 - Service: is-25AIQ - Unknown owner - C:\Documents and Settings\All Users\Desktop\Kaspersky Lab Tool\is-25AIQ\is-25AIQ.exe (file missing)


Looks like a problem here.You might want to delete that if the file is missing.
 
Ok Thanks. Any more ideas I could try to stop it from opening at startup?

Not from the info provided. It has to be something trying to launch that has a broken path. I have seen it before. The last time I encountered it a game was causing it. A registry entry in the startup section was pointing to an invalid path for an executable. Look for entries for a program that should be starting and isn't. As a last resort you could copy all of your startup entries and try to run each one with the copied command and see if any of them cause the problem you are having. I know it is all tedious and the answer may not be obvious, but I believe it is 99% likely that your problem is an incorrect startup entry, most like in the registry. Did it start after the installation of a particular program that you can remember? If you can remember when it started, that would help.
 
I don't know how long it has been poping up. The computer belongs to someone else I'm working on it for them. It was loaded with spyware and trojans which I have removed. Could you give me a little more detail about how to run them from a copied command. Thanks
 
There's also a Startup folder in the Start menu, under All Programs (on XP) or just scroll down through the list on Vista. Check what is in that folder.
 
There's also a Startup folder in the Start menu, under All Programs (on XP) or just scroll down through the list on Vista. Check what is in that folder.

Thanks. I checked the folder and it was empty any other place I could check? The OS is xp.
 
I ran it but nothing seems to happen after it installs and I click ok. How do I use it?
 
Go to your control panel to find a new entry called Startup. Run that. There will be several different tabs with different types of startup entries. Throw us a link to screenshots of them, preferable to posting the images directly on the forum.
 
I suggest replacing Explorer.exe with a known good copy, then go in your registry..

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

make sure Shell is pointed to Explorer.exe

I'm willing to bet you had a Vundo virus that replaced Explorer.exe with Spools.exe
 
I will have some screenshots uploaded shortly my Internet is having problems it's very slow at the moment. I will post a screenshot of the winlogon directory also see if it looks normal.
 
Here's the screenshots...
These two was the only ones that had anything in them.
reg3.jpg

reg1.jpg


Is there suppose to be a big space between explorer.exe and the quotation mark?
reg4.jpg
 
I'm sorry, I don't see anything there looking problematic.

DLCCCATS is for a dell printer
the 2 ISUS entries are for InstallShield update service
the 3 igfx entries are related to nvidia drivers, but from intel
ctfmon relates to Microsoft Office

Perhaps try searching for each of those file names in the locations specified to make sure they exist. If you find one that does not exist, it might be what's causing the window to open upon startup.
 
I suggest replacing Explorer.exe with a known good copy, then go in your registry..

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

make sure Shell is pointed to Explorer.exe

I'm willing to bet you had a Vundo virus that replaced Explorer.exe with Spools.exe

I think I did remove the vundo virus? How do I replace the Explorer.exe with a good copy? Would it hurt anything to just let it keep popping up at startup?
 
I'm sorry, I don't see anything there looking problematic.

DLCCCATS is for a dell printer
the 2 ISUS entries are for InstallShield update service
the 3 igfx entries are related to nvidia drivers, but from intel
ctfmon relates to Microsoft Office

Perhaps try searching for each of those file names in the locations specified to make sure they exist. If you find one that does not exist, it might be what's causing the window to open upon startup.
I looked for the files in their given directory's and they all appeared to be there. Should I just leave the problem alone?
 
Back
Top