Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Startup Programs And Autoruns


  • Please log in to reply
3 replies to this topic

#1 michele2007

michele2007

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:04:15 PM

Posted 10 December 2007 - 04:46 PM

I ran Autoruns and started looking up everything in your startup database. I think I could be making a serious mistake if I delete these files according to what the database says. Is there something I am missing? How can I know which ones to uncheck, delete, or leave alone?

Database says:
explorer.exe added by worms, trojans or viruses
shell32.dll worm
shmgrate.exe added by GASTER Trojan
regsvr32.exe ActiveX control or daily winner adaware
logonui.exe detected by Ewido as Backdoor.sdbot.aad (I have already been advised by people in this forum to
leave this alone as it is an important Windows file.)

BC AdBot (Login to Remove)

 


#2 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 37,046 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:04:15 PM

Posted 06 February 2008 - 12:52 AM

An important key to understanding if the file you have is legitimate or malware is the file path. Where is the file located on your computer? Another important key is the exact spelling. Slight differences in spelling also distinguish good files from bad ones.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Internet Security, NoScript Firefox ext.


animinionsmalltext.gif

#3 michele2007

michele2007
  • Topic Starter

  • Members
  • 15 posts
  • OFFLINE
  •  
  • Local time:04:15 PM

Posted 07 February 2008 - 03:09 PM

Thank you. What might be a bad place for bad files to be?

#4 Orange Blossom

Orange Blossom

    OBleepin Investigator


  • Moderator
  • 37,046 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:04:15 PM

Posted 07 February 2008 - 03:22 PM

That has no easy answer. Let's take the explorer.exe file as an example. Normally, it doesn't run at start-up, but some computer administrators set up the computer so it does. Therefore, if someone removed it because he/she thought it was malware, a good file would have been removed instead and cause problems. On a different computer, however, the file could very well have been malware. The best thing you can do is to find out where files should be, know what has been done on the computer, and if a file is where it shouldn't be, be suspicious but verify first. If you have questions about a file, feel free to ask about it on the forums.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Internet Security, NoScript Firefox ext.


animinionsmalltext.gif




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users