Have searched and cant find this.
I installed IMesh but found all the "spyware"
that came with it and removed it. After that I Ran AdAware and found 9 hidden items. Deleted them. Now in my config/startup i still have Cydoor cd_laod.exe (unchecked)
I ran regedit and found NO related listings. Nothing in RunServices, Run, RunOnce, etc...cd_load has been removed from windows.
So why is this still in startup and better how can i clear it. Thanks for any help.
carson...
have you ran the latest version of ad aware
http://www.lavasoft.de/BINARY/awbin/aaw45.exe
also look here
http://www.cexx.org/cydoor.htm
[This message has been edited by driver (edited 03-12-2001).]
Find the win.ini file and it will show you what the computer loads up. Check to see if it is still in there. If so delete it, otherwise leave this alone.
Hope this information helped.
------------------
Fly like the angels at http://angel.auscstrike.com/
Look for me, PoisonAnGeL_VeNoM
Also look in the autoexec.bat file and the Start/Programs/Startup.
Did you look in both registry keys for references in the run services ?
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion
To remove from list look in
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices-
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run-
C:\Windows\All Users\Start Menu\Programs\Disabled StartUp Items
A nice easy way to get rid of this is by using Startup Cop's Pack for Removal feature. Everyone, should have this little utility. If you want to continue manually though, here's an extract from the Startup Cop Help file
"Windows loads startup items from three locations in the Registry, two lines in WIN.INI, and two folders. Observation reveals that it always loads the seven groups in the same order. Here they are, in order:
1. Registry (Machine Service) - Each value in the Registry key HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ RunServices defines a startup item. The value's data string is the command to be executed at startup.
2. Win.ini (Load=) - The value of the Load= key in the [Windows] section of WIN.INI consists of one or more startup program names, separated by semicolons. Neither long filenames nor command-line arguments may be used. (Windows NT users - see note below)
3. Win.ini (Run=) - The value of the Run= key in the [Windows] section of WIN.INI consists of one or more startup program names, separated by semicolons. Neither long filenames nor command-line arguments may be used. (Windows NT users - see note below)
4. Registry (Machine Run) - Each value in the Registry key HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ Run defines a startup item. The value's data string is the command to be executed at startup.
5. Registry (Per-User Run) - Each value in the Registry key HKEY_CURRENT_USER\ SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ RunServices defines a startup item. The value's data string is the command to be executed at startup.
6. Common Startup Group - Each shortcut in the common startup group (by default, C:\Windows\ All Users\ Start Menu\ Programs\ Startup) is launched at startup. This group does not appear on the Start menu. Some Windows installations will not have a common startup group.
7. Startup Group - Each shortcut in the Start menu's startup group (by default, C:\Windows\ Start Menu\ Programs\ Startup) is launched at startup."
------------------
Just trying to give others a friendly hand.
Sorry guys, my ISP has been down all day.
Thanks to ALL for the help.
amthmi: You were right . There was a second key with cd_load.exe. I ran regedit and F3 and typed "runsevices" and removed one and F3 again and computer said finished. (wrong).
driver: i have adaware4.5 and it missed at least 4 entries. I will contact them on that. Thanks for the link.
PAnGel; thanks for the win.ini tip.
Herring: thanks for the startup cop link. Maybe it will work better than AdAware. And for the detail info.
Adaware let me down on this one. But you guys helped. Now to look for more of Cydoors hidden entries. This program is very hard to get rid of as driver's link says.
Does everyone recommending IMesh know of how infested their computers are getting from Cydoor? Or do they know something i dont...or just dont mind?
Again a big Thanks to all.
carson