Re: msconfig Startup Files Need File ID Help

From: Kent W. England [MVP] (kwe_at_mvps.org)
Date: 09/04/03 

Date: Wed, 3 Sep 2003 22:14:14 -0700

If this bug has only the one executable file and one registry key and
the process isn't hidden, you should be able to get rid of it manually
if your AV won't.

Copy taskmgr.exe to taskmgr1.exe. Then run taskmgr1.exe. Find
NRWNMWETMS.EXE running and kill it. Then remove the RunOnce key. If you
can't find that process in task manager, it is hiding itself, so you'll
need a tool to get rid of it. Some bugs are crafty so I can't guarantee
this simple process will work, but it often does. 

-- 
Kent W. England, Microsoft MVP for Windows
"Payton Chacalos" <payton323@sbcglobal.net> wrote in
message news:071401c3711a$057c0c90$a301280a@phx.gbl...
> Located: HK_CU:RunOnce, MSConfig
>   file: NRWNMWETMS.EXE
> Located: HK_LM:Run, MSConfig (DISABLED)
>   file: NRWNMWETMS.EXE
>
> My sons computer has these two files on his Startup
> list.I had to use the startup Items file on Spybot Search
> and Destroy to see the startup list. I need to find out
> what this program is. I can't get msconfig to open and
> stay open. The window opens for 1 sec. then closes. He is
> fire walled and has 2 popup blockers (Spyware Blaster and
> FreeSurfer MKII) and AVG anti virus, along with the
> spybot. I also have this spyware entry that the delete
> utility on Spybot doesn't work on
>
> Located: Startup (user), PowerReg Scheduler.exe
>   file:
>

Relevant Pages

  • Re: msconfig Startup Files Need File ID Help
    ... Kent W. England, Microsoft MVP for Windows ... >> If this bug has only the one executable file and one registry key ... >> need a tool to get rid of it. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Internet Explorer has been hijacked by "About:Blank"
    ... > programmer who wrote it should have his (sorry about gender discrimination ... Keep your modem off when you startup ... Kill Iexplore.exe sessions that come up in the process ... > To get rid of it I ran CWshredder.exe, which seemed to get rid of it, but ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: Virus causing System32 folder to be opened at startup?
    ... If you have any Microsoft Office programs, ... Turn Off the Speech Recognition and Handwriting Recognition Features ... I ran msconfig but did not see anything unexpected under Startup ... but now the ctfmon.exe registry key is gone and the msconfig Startup ...
    (microsoft.public.windowsxp.help_and_support)
  • RE: Virus causing System32 folder to be opened at startup?
    ... I know the date the trojan was put on my computer as I run multiple security ... I ran msconfig but did not see anything unexpected under Startup ... Once I did this it disappeared from the msconfig Startup screen as expected. ... but now the ctfmon.exe registry key is gone and the msconfig Startup ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: Taskbar Program ?s
    ... and I want to get rid of the shortcuts that cause them to appear. ... If that doesn't work, run MSCONFIG from the Start | Run line, and ... on the Startup tab, uncheck the programs you don't want to start ... decision about what you want to keep and what you want to get rid of. ...
    (microsoft.public.windowsxp.configuration_manage)