Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

What Keeps Adding This To Runonce ?


  • Please log in to reply
6 replies to this topic

#1 Raoul2834

Raoul2834

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:04:28 PM

Posted 04 October 2007 - 10:24 PM

Hi folks. I've had my work laptop for about 6 months, but have just installed StartupMonitor. Now every time I start up it asks me if I will allow this startup entry to be created:
------------------------------
The program

wextract_cleanup0

has registered the executable

rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "D:\DOCUME~1\{my_account}\LOCALS~1\Temp\IXP002.TMP\"

to be run at system startup.

Do you wish to allow this change?
------------------------------
No matter what I answer the message always comes back next login.

How can I track down whatever is causing this and get rid of it ?

Thanks

BC AdBot (Login to Remove)

 


#2 1101doc

1101doc

  • Members
  • 93 posts
  • OFFLINE
  •  
  • Location:Mackinac Island,MI Summer-SA/TX winter
  • Local time:02:28 PM

Posted 04 October 2007 - 11:25 PM

Since this a 'work' laptop, take it in and hand it to the IT staff. It's their problem, not yours.
Neurons that fire together, wire together.
posted with Opera

#3 Budapest

Budapest

    Bleepin' Cynic


  • Moderator
  • 23,573 posts
  • ONLINE
  •  
  • Gender:Male
  • Local time:06:28 AM

Posted 05 October 2007 - 04:32 AM

Wextract Cleanup0 is valid and legal software included or sold to help clean up temporary or cab files created by the installer software for a wide variety of software.

However, I was searching around on the internet and I came across someone who had the same problem as you, with Wextract Cleanup0 wanting to run at every startup, which was the result of a virus infection. So the first thing to do would be a thorough scan of your computer for malware.

Edit: fixed a typo

Edited by Budapest, 05 October 2007 - 11:03 AM.

The power of accurate observation is commonly called cynicism by those who haven't got it.

—George Bernard Shaw

#4 WinCrazy

WinCrazy

  • Members
  • 265 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Ambler, PA USA
  • Local time:03:28 PM

Posted 05 October 2007 - 11:03 AM

I would much rather figure this out and fix it myself.

I ran a full system scan with McAfee, but it turned up nothing.

#5 1101doc

1101doc

  • Members
  • 93 posts
  • OFFLINE
  •  
  • Location:Mackinac Island,MI Summer-SA/TX winter
  • Local time:02:28 PM

Posted 05 October 2007 - 12:04 PM

Everything I found about it suggested that after running once it would quit. Often triggered after installing Updates. Normal MS process. Perhaps could be stopped with Autoruns?
Neurons that fire together, wire together.
posted with Opera

#6 hamluis

hamluis

    Moderator


  • Moderator
  • 55,397 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Killeen, TX
  • Local time:03:28 PM

Posted 05 October 2007 - 04:18 PM

Delete the corresponding registry entry.

You can use Autoruns to look at it and delete it.

And dump your Internet files...

Louis

Edited by hamluis, 05 October 2007 - 04:19 PM.


#7 Raoul2834

Raoul2834
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:04:28 PM

Posted 05 October 2007 - 05:37 PM

Autoruns, Mike Lin's Startup Control Panel and Startup Inspector all show it and let me delete it. It goes away in the Registry but then returns on the next login.

I need to find out what is putting it there in the first place. :thumbsup:




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users