Hi, Rick -- and others!

Thanks for your response. Actually, I went into
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg

and couldn't find anything there --

But I went one level (folder) deeper into the "Shell" folder, and there it
all was -- see below. So which of these can I change/delete without causing
the Registry to go pear-shaped. I'm not registry-savvy, but can do what
needs to be done.
Thanks again.
- marty

SHELL
-------

Default (value not set)

command "C:\Program Files\Common Files\Microsoft Shared\Web
Folders\ibm00003.exe"

hkey HKCU

inimapping 0

item ibm00003

key SOFTWARE\Microsoft\Windows\CurrentVersion\Run




"Rick "Nutcase" Rogers" wrote:

> Hi,
>
> Check these keys in the registry:
>
> HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg
>
> I'm betting you find the disabled entry in the last key.
>
> --
> Best of Luck,
>
> Rick Rogers, aka "Nutcase" - Microsoft MVP
> http://mvp.support.microsoft.com/
> Associate Expert - WindowsXP Expert Zone
> www.microsoft.com/windowsxp/expertzone
> Windows help - www.rickrogers.org
>
> "martyh" <martyh@discussions.microsoft.com> wrote in message
> news:4BCB9045-84E3-4DE1-A0E7-13288F1FD74F@microsoft.com...
> > Is it possible to actually delete/remove an entry in Startup from
> > MSCONFIG?
> > I don't mean simply disable/uncheck the entry, but remove it completely.
> > I
> > suffered a Trojan hit on my PC, and spent like 5 hours dealing with it.
> > The
> > Trojan wrote an entry to Startup (ibm00003.exe). I've deleted the culprit
> > in
> > the registry, I've deleted all the nasty files, and all is (hopefully)
> > copacetic -- but I still have this entry in Startup that I would like to
> > go
> > away.
> > Thanks for your time and response.
> > Cheers,
> > - martyh
>
>
>

Hi,

Click on the shell folder, click file/export. Give it a name and save to the
desktop. Now delete the shell folder from the registry, then close the
editor and reboot. If the problem is solved and there appears to be no other
issues, move the exported copy to the Recycle Bin. After a week or so of
normal use, you should be able to safely delete it. If there are problems,
you can put it back by double clicking the file from the desktop and
re-merging it.

--
Best of Luck,

Rick Rogers, aka "Nutcase" - Microsoft MVP
http://mvp.support.microsoft.com/
Associate Expert - WindowsXP Expert Zone
www.microsoft.com/windowsxp/expertzone
Windows help - www.rickrogers.org

"martyh" <martyh@discussions.microsoft.com> wrote in message
news:82E834A9-EE8E-4112-920F-0D04A9ABA72B@microsoft.com...
> Hi, Rick -- and others!
>
> Thanks for your response. Actually, I went into
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg
>
> and couldn't find anything there --
>
> But I went one level (folder) deeper into the "Shell" folder, and there it
> all was -- see below. So which of these can I change/delete without
> causing
> the Registry to go pear-shaped. I'm not registry-savvy, but can do what
> needs to be done.
> Thanks again.
> - marty
>
> SHELL
> -------
>
> Default (value not set)
>
> command "C:\Program Files\Common Files\Microsoft Shared\Web
> Folders\ibm00003.exe"
>
> hkey HKCU
>
> inimapping 0
>
> item ibm00003
>
> key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
>
>
>
>
> "Rick "Nutcase" Rogers" wrote:
>
>> Hi,
>>
>> Check these keys in the registry:
>>
>> HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run
>> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run
>> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg
>>
>> I'm betting you find the disabled entry in the last key.
>>
>> --
>> Best of Luck,
>>
>> Rick Rogers, aka "Nutcase" - Microsoft MVP
>> http://mvp.support.microsoft.com/
>> Associate Expert - WindowsXP Expert Zone
>> www.microsoft.com/windowsxp/expertzone
>> Windows help - www.rickrogers.org
>>
>> "martyh" <martyh@discussions.microsoft.com> wrote in message
>> news:4BCB9045-84E3-4DE1-A0E7-13288F1FD74F@microsoft.com...
>> > Is it possible to actually delete/remove an entry in Startup from
>> > MSCONFIG?
>> > I don't mean simply disable/uncheck the entry, but remove it
>> > completely.
>> > I
>> > suffered a Trojan hit on my PC, and spent like 5 hours dealing with it.
>> > The
>> > Trojan wrote an entry to Startup (ibm00003.exe). I've deleted the
>> > culprit
>> > in
>> > the registry, I've deleted all the nasty files, and all is (hopefully)
>> > copacetic -- but I still have this entry in Startup that I would like
>> > to
>> > go
>> > away.
>> > Thanks for your time and response.
>> > Cheers,
>> > - martyh
>>
>>
>>