Help - Search - Members - Calendar
Full Version: Winini Is Checked Although I Unchecked It
BleepingComputer.com > Security > Am I infected? What do I do?
   
XML2005
I have Dell desktop with XP Professional, protected by Trend-Micro PcCillin (updated daily) and Ad-Aware & Spybot.

My system had been very slow to start up. I called Dell tech support. They advised me to run MsConfig, unclick "Process System.ini" & "Process Win.ini", leave the other 2 boxes shaded in green, and leave "original Boot.ini" checked. Sure enough, startup time was greatly reduced.

Then startup began to crawl again. When I checked MsConfig, either Win.Ini or both of them had been rechecked; so I unchecked and restarted. But every dozen or so times I restart my machine, either Win.ini or both of them is checked once again and I must reset and restart. I called Dell a couple of times, but they haven't been able to tell me why this is happening or how to avoid it.

I would appreciate help in resolving this annoyance.

Thank you!
Orange Blossom
Do you have Ad-Watch Monitoring on? Depending on your settings, Ad-Watch could very well be restoring the settings you changed. I had that problem getting a registry key of a deleted program out of the run folder. Ad-watch kept putting it back! If this is the case, print out this post, or copy and paste them to notepad or a word program as you will be disconnected from the internet for part of this process for security reasons.

Restore the Ad-Watch window. At the bottom right of the little window, you will see a tools button. Click on that button. Now click on the options button at the top left. At this point, if you are still connected to the internet, please DISCONNECT!

Below is a picture of the settings I have made to allow you to make your changes. (I have the window at full size in order to see it all. You can scroll down the sections to match the compare the various entries). If yours don't match, click on the circles by each given entry that doesn't match so they do match.



When you have done so, right click on the little icon in the system tray and click on UnLoad Ad-Watch. Now make the changes that you have been trying to make. Also, if you have any programs that automatically connect to the internet at start-up, please change those programs for now so they won't do that. Shut Down, and Restart - Without Connecting to the Internet!

Open Ad-Watch again, click on tools, then options and change your settings so they look like the picture below. Note: These settings are for if you want to manually start Ad-Watch. If you want it to load automatically, turn the orange button - next to the option I have boxed in pink - to green by clicking on it, and Ad-Watch will load up when you start-up. smile.gif



Ad-Watch should have loaded when you opened it, but double-check to make sure. You can now connect to the Internet smile.gif.

Let us know if this works,

Orange Blossom fruits_cherry.gif
XML2005
I did not sign up for Ad-Watch. Thank you, anyway, for the valuable suggestion.
Orange Blossom
Ad-Watch comes with Ad-Aware which is why I thought it might be the problem since you DO have Ad-Aware.

Do you have any other programs watching for changes to the registry?

Orange Blossom fruits_cherry.gif
XML2005
Thank you for persisting.

Yes, SpyBot is controlling registry changes. My SpyBot Black & White list has no "blocked registry changes" listed, and only the following 2 "allowed registry changes" listed (I know the first one is for connecting to / disconnecting from my ISP):
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\untd_recovery="C:\Program Files\NetZero\qsacc\x1exec.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MsConfig=C:\Windows\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

Should I be adding yet a third, or should I remove the second?

Thanks again.
-David-
Are you running Spybot's Tea Timer?
David
XML2005
Yes, I am running TeaTimer.
-David-
I suggest you to disable it because it can interfere with the changes you'll make on your system.
Try making the changes whilst tea timer is disabled.
If the changes stay, you know TeaTimer is responsible.

If teatimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.
How to disable TeaTimer during HijackThis Cleanup

Then, when you want to turn tea timer back on, download ResetTeaTimer.bat.
Double click ResetTeaTimer.bat to remove all entries set by TeaTimer.

David
XML2005
Thank you.

I have done as you instructed:I disabled TeaTimer, made the changes, reset and restarted TeaTimer.
I believe I now can safely assume this problem won't catch me up again.

Thanks again.
-David-
You're welcome smile.gif
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2008 Invision Power Services, Inc.