# Getting rid of devldr16.exe



## cementhed (Apr 1, 2001)

Can anyone tell me how to get rid of devldr16.exe? I have unchecked it in my startup menu, but it keeps coming back. I went to device manager to disable "creative SB16 emulation" under Creative Miscellaneous Devices but I don't have Creative Miscellaneous Devices. Any suggestions?


----------



## ~Candy~ (Jan 27, 2001)

Are you hitting the ok button after you uncheck it in msconfig? or hitting the cancel button? You need to reboot as well....that is what you are referring to when you say startup menu? correct? Start button, run, then type msconfig and hit ok....go to startups.

Is there anything in the device manager listed under 'other devices' which may be that entry, but not installed correctly?


----------



## cementhed (Apr 1, 2001)

Yes, I am going to start-run-msconfig-startup and unchecking the devldr16. I am hitting apply & OK then restarting my computer. I checked in the device manager & don't have Other Devices.


----------



## ~Candy~ (Jan 27, 2001)

Start button, run, then type msinfo32 and hit ok...go to software, startups, edit, select all, edit, copy and come back and paste.

Oops, another thought............start button, run, then type sysedit and hit ok.....what is loading via autoexec.bat and config.sys?


----------



## cementhed (Apr 1, 2001)

Here is what is shown in msinfo32:
*StateMgr	c:\windows\system\restore\statemgr.exe	All Users	HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
EPSON Status Monitor 3 Environment Check 2	c:\windows\system\e_srcv02.exe .DEFAULT	Startup
GoBack	c:\progra~1\roxio\goback\gbtray.exe All Users	Common Startup
GoBack Polling Service	c:\program files\roxio\goback\gbpoll.exe	All Users	HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
iamapp	c:\program files\norton internet security\iamapp.exe	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
MSConfigReminder	c:\windows\system\msconfig.exe /reminder	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Multi-function Keyboard	gwhotkey.exe	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
NAV DefAlert	c:\progra~1\norton~1\defalert.exe	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
nisserv	c:\program files\norton internet security\nisserv.exe	All Users	HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
Norton Auto-Protect	c:\progra~1\norton~1\navapw32.exe /loadquiet	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Norton eMail Protect	c:\program files\norton antivirus\poproxy.exe	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
PCHealth	c:\windows\pchealth\support\pchschd.exe -s	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SAgent2ExePath	c:\program files\common files\epson\ebapi\sagent2.exe	All Users	HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
ScanRegistry	c:\windows\scanregw.exe /autorun	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SchedulingAgent	mstask.exe	All Users	HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
SystemTray	systray.exe	All Users	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

I could not do sysedit - it said windows could not find it. I did a search & there was nothing found from my search.


----------



## TechMonkey (Nov 20, 2002)

Background task installed with the drivers for some Creative Labs sound cards  it provides SoundBlaster 16 emulation for DOS applications and games. Without it, your DOS games will not have any sound. Disabling this program, however, often gives problems with the general behaviour of sound and of the Creative sound utilities on your PC.

Recommendation : 
This is another Creative program which is the cause of many frustrations for AnswersThatWork users. Once upon a time "Creative Labs" used to be synonymous with quality ! Some users experience unexplained crashes of this program where it is impossible to clear it off the screen; others experience occasional to total inability to start Windows 98/ME; some find that their modem no longer works properly; others experience strange behaviour of their software (Photoshop); others find that menus do not open up when clicking on them and that the only way to recover is to restart; some find that the mouse pointer disappears, till a reboot; some experience unexplained general instability problems; the list goes on. Shocking! For the technically minded all these problems are due to the fact that DEVLDR16 emulates old ISA sound cards which do not have the ability to share resources in the way that the newer PCI cards can. If you do not use DOS games, and you want to get rid of this task, the only way we have found to safely disable this task is as follows : 1) Disable in Startup Manager. 2) Next, in Device Manager, in the Sound section or under "Creative Miscellaneous Devices", disable Creative SB16 Emulation.



Also Check the RunServices key in the registry:

HKLM\Software\Microsoft\Windows\CurrentVerion\RunServices. *devldr16.exe


----------



## ~Candy~ (Jan 27, 2001)

Ya, I guess that isn't in ME..........start button, run, then type msconfig and hit ok......look at those 2 items there.


----------



## cementhed (Apr 1, 2001)

I'm sorry it took me so long to get back. I went to msconfig but I don't see autoexec.bat or config.sys. Can you give me additional instructions on what I am looking for?


----------



## ~Candy~ (Jan 27, 2001)

There's a general tab, then there should be additional tabs.....perhaps you aren't loading anything in them......I still think they should appear there though...........


----------



## cementhed (Apr 1, 2001)

In msconfig, I have the following tabs: general, system.ini, win.ini, static VxD's, Startup, Environment, and International


----------



## john1 (Nov 25, 2000)

Thats because you're running Windows ME.


----------



## ~Candy~ (Jan 27, 2001)

I hate ME...in another thread, the person was able to see this info....oh well....did you look for that registry key that was mentioned above?


----------



## cementhed (Apr 1, 2001)

I'm sorry - I didn't realize when I bought my computer that ME was such a problem! I've learned otherwise since - I thought I was getting a great product (the most current, you know!). Oh, well - what's done is done.

No, I didn't check the registry that was listed earlier because I wasn't sure eactly what I was supposed to do - some of this stuff is pretty new to me. So, let me know where to check that & I will do it & see where it leads.


----------



## pvc9 (Jul 7, 2002)

Try renaming the files, rename autoexec.bat to autoexec.old and config.sys to config.old. That could help.

Better if you could post back with the Startup List results, download Startup List and post back with the results -

Download Startup List

BTW, dont worry too much, ofcourse ME isnt as good as 98 SE or ... but it definetely is a pretty good OS and many many have no problems at all...so np!

Candy,


----------



## ~Candy~ (Jan 27, 2001)

It's all yours now PVC


----------



## pvc9 (Jul 7, 2002)

BTW, I see Norton AV in your startups, fine. Is it updated? Do you've the latest definitions?

Try an online AV scan at House Call

I definetely want to look at the Startup List results...

Candy,
Thanks


----------



## TechMonkey (Nov 20, 2002)

If you decide to go into the registry and have not checked the run keys yet, these articles might help you.

*Microsoft Knowledge Base Article - 322754 *
HOW TO: Backup, Edit, and Restore the Registry in Windows 95, Windows 98, and Windows Me
The information in this article applies to:
Microsoft Windows Millennium Edition
Microsoft Windows 98 Second Edition
Microsoft Windows 98
Microsoft Windows 95
_________________________________________________
http://support.microsoft.com/default.aspx?scid=kb;en-us;322754

________________

*Microsoft Knowledge Base Article - 256419 *
How to Back Up the Registry in Windows 98 and Windows Millennium Edition
The information in this article applies to:
Microsoft Windows Millennium Edition
Microsoft Windows 98 Second Edition
Microsoft Windows 98
__________________________________________________
http://support.microsoft.com/default.aspx?scid=kb;EN-US;256419


----------



## cementhed (Apr 1, 2001)

Okay - some questions & answers for you. First, I tried to download the startup list as you asked. When I went to the link you sent me to & it asked me to open or save to my computer - I selected open - it went to an image preview & said there was no image to preview. So I tried to save it to my computer, but notice that it is a .zip file. I don't know where I should save this, so let me know & I will try to get it done.

I do have NAV & it is a current program and is up to date. I tried to do the housecall as you suggested but have tried twice to download the files - it cannot successfully complete the download?

Before I rename my autoexec.bat and config.sys files I would like to know why I am doing this & what the next step would be after that.

It may be later this evening before I get back to the site - holiday preparations, you know, but will check in to see where we are at.


----------



## pvc9 (Jul 7, 2002)

About saving the file...you can save it to any of the drive/folder...np...

If NAV is updated, then we'll look into the problem with housecall later...

About renaming the files...thats becaouse AcaCandy wanted you to avoid the loading of those 2 files at bootup...may be the devldr.exe is loading from any of those files...

HTH.


----------



## steamwiz (Oct 4, 2002)

It doen't matter where you d'load startup list to - desktop or my docs etc, open the zip -double click the exe file - copy and paste the contents here.

As for the virus scan - it tends to "hang" around 80% but will continue to d'load - it may take 10 mins before it actualy starts to scan

It zooms up to 80% - contiues to d'load - then jumps to 100%
A few people have noticed this - just be patient and let it finnish

steam

EDIT
sorry pvc - thought you were off-line - didn't mean to jump in there


----------



## pvc9 (Jul 7, 2002)

Np Steam...

Thats ok!


----------



## flavallee (May 12, 2002)

Cementhed:

I had a problem with keeping devldr16.exe from loading during startup in my 98SE desktop, even after disabling it in MSCONFIG. I was also getting a BSOD error message frequently during startup and/or shutdown because of it. I finally took some action and solved the problem. I have an article posted in my website on the steps I took. Hopefully, it'll help you.

Frank's Windows 95/98 Tips


----------



## cementhed (Apr 1, 2001)

Okay, I understand about the renaming of autoexec.bat & config.sys files - do you want me to do that now & see what happens or do you want me to do the startup list first?


----------



## pvc9 (Jul 7, 2002)

Post back with the results of Startup List.

As Frank posted check his link as well, that could help.


----------



## cementhed (Apr 1, 2001)

Okay - I'm finally back! I tried to download the startup list as per the link provided - saved it to Word & still I image preview with a blank screen. I went to some other posts to see if I could get resolve this there - I went to the site with the startup list download program & downloaded the most recent version - as of 12-01-02. I tried to open it in Word & all that is there is jibberish. Please help - I want to get you the start up list information.

I also went to Frank's site & checked autoexec.bat, config.sys, win.ini, system.ini, and winstart.bat. None of them are marked as read only. 

I will wait for further instructions.


----------



## ~Candy~ (Jan 27, 2001)

Did you get it downloaded and did you run it successfully?

I think it puts a log file on your desktop........is there anything new there?


----------



## cementhed (Apr 1, 2001)

No, there is nothing new on the desktop - if I click on "open" the image preview screen automatically pop-ups, if I save it and then go to Word to open it, dble-click on the start-up file, it also automatically goes to image preview. If I right click on the startup icon, and click open with Word - that's when I get the jibberish.


----------



## ~Candy~ (Jan 27, 2001)

The download is a .zip file........do you have Winzip intalled on your computer? You MUST unzip the file first, then run it afterwards....the file you downloaded isn't just ready to be read.......


----------



## cementhed (Apr 1, 2001)

My inexperience is going to show here - is winzip a separate program? I don't know if I have it. I have never had occasion to unzip anything. Where would I look for it? did a search but didn't see anything.


----------



## pvc9 (Jul 7, 2002)

Download Winzip from www.winzip.com

Install the program, try again with the Startup List zip file...


----------



## Rollin' Rog (Dec 9, 2000)

I may be blowing smoke here since I've never had SB, but I do recall someone solving a similar problem with the DOS emulation install, by removing the sound card and doing a CUSTOM install in which one can skip the option to install the Emulation component. If that's an option for you, it might work.


----------



## cementhed (Apr 1, 2001)

Thanks, PVC9! I finally have the startup list for you.

StartupList report, 12/2/2002, 9:32:41 PM
StartupList version: 1.40
Started from : C:\UNZIPPED\STARTUPLIST14[1]\STARTUPLIST.EXE
Detected: Windows ME (Win9x 4.90.3000)
Detected: Internet Explorer v6.00 (6.00.2600.0000)
* Using default options
* Using verbose mode
* Including empty and uninteresting sections
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\NORTON INTERNET SECURITY\NISSERV.EXE
C:\PROGRAM FILES\COMMON FILES\EPSON\EBAPI\SAGENT2.EXE
C:\PROGRAM FILES\ROXIO\GOBACK\GBPOLL.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\DEVLDR16.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\PROGRAM FILES\NORTON INTERNET SECURITY\NISUM.EXE
C:\PROGRAM FILES\NORTON INTERNET SECURITY\SYMPROXYSVC.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\GWHOTKEY.EXE
C:\PROGRAM FILES\NORTON INTERNET SECURITY\IAMAPP.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\POPROXY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\ROXIO\GOBACK\GBTRAY.EXE
C:\PROGRAM FILES\NORTON INTERNET SECURITY\ATRACK.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\UNZIPPED\STARTUPLIST14[1]\STARTUPLIST.EXE

This lists all processes running in memory, which are all active
programs and some non-exe system components.

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

User shell folders Startup:
*Folder not found*

Shell folders Common Startup:
[C:\WINDOWS\All Users\Start Menu\Programs\StartUp]
GoBack.lnk = C:\Program Files\Roxio\GoBack\GBTray.exe

User shell folders Common Startup:
*Folder not found*

User shell folders Alternate Common Startup:
*Folder not found*

This lists all programs or shortcuts in folders marked by Windows as
'Autostart folder', which means any files within these folders are
launched when Windows is started. The Windows standard is that only
shortcuts (*.lnk, *.pif) should be present in these folders.
The location of these folders is set in the Registry.

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
SystemTray = SysTray.Exe
Norton Auto-Protect = C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
Multi-function Keyboard = GWHotKey.exe
NAV DefAlert = C:\PROGRA~1\NORTON~1\DEFALERT.EXE
iamapp = C:\Program Files\Norton Internet Security\IAMAPP.EXE
PCHealth = C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
Norton eMail Protect = C:\PROGRAM FILES\NORTON ANTIVIRUS\POProxy.exe
LoadQM = loadqm.exe
devldr16.exe = C:\WINDOWS\SYSTEM\devldr16.exe

This lists programs that run Registry keys marked by Windows as
'Autostart key'. To the left are values that are used to clarify what
program they belong to, to the right the program file that is started.

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

This lists programs that run Registry keys marked by Windows as
'Autostart key'. To the left are values that are used to clarify what
program they belong to, to the right the program file that is started.
The values in the 'RunOnce', 'RunOnceEx' and 'RunServicesOnce' keys
are run once and then deleted by Windows.

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*No values found*

This lists programs that run Registry keys marked by Windows as
'Autostart key'. To the left are values that are used to clarify what
program they belong to, to the right the program file that is started.

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

nisserv = C:\Program Files\Norton Internet Security\NISSERV.EXE
SAgent2ExePath = C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
GoBack Polling Service = C:\Program Files\Roxio\GoBack\GBPoll.exe
SchedulingAgent = mstask.exe
*StateMgr = C:\WINDOWS\System\Restore\StateMgr.exe

This lists programs that run Registry keys marked by Windows as
'Autostart key'. To the left are values that are used to clarify what
program they belong to, to the right the program file that is started.

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*No values found*

This lists programs that run Registry keys marked by Windows as
'Autostart key'. To the left are values that are used to clarify what
program they belong to, to the right the program file that is started.
The values in the 'RunOnce', 'RunOnceEx' and 'RunServicesOnce' keys
are run once and then deleted by Windows.

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

*No values found*

This lists programs that run Registry keys marked by Windows as
'Autostart key'. To the left are values that are used to clarify what
program they belong to, to the right the program file that is started.

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

*No values found*

This lists programs that run Registry keys marked by Windows as
'Autostart key'. To the left are values that are used to clarify what
program they belong to, to the right the program file that is started.
The values in the 'RunOnce', 'RunOnceEx' and 'RunServicesOnce' keys
are run once and then deleted by Windows.

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

*Registry key not found*

This lists programs that run Registry keys marked by Windows as
'Autostart key'. To the left are values that are used to clarify what
program they belong to, to the right the program file that is started.

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices

*Registry key not found*

This lists programs that run Registry keys marked by Windows as
'Autostart key'. To the left are values that are used to clarify what
program they belong to, to the right the program file that is started.

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

*Registry key not found*

This lists programs that run Registry keys marked by Windows as
'Autostart key'. To the left are values that are used to clarify what
program they belong to, to the right the program file that is started.
The values in the 'RunOnce', 'RunOnceEx' and 'RunServicesOnce' keys
are run once and then deleted by Windows.

--------------------------------------------------

Enumerating RunOnceEx keys:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx\*

*No subkeys found*

This lists a special autorun Registry key, from which both programs
and functions within DLLs can be launched without RUNDLL32.EXE. The
format for running a DLL function is
"DllFile.dll|FunctionName|CommandLineArguments", the format for
running a program is "||Program.exe CommandLineArguments".
This autorun key is used very rarely.

--------------------------------------------------

File association entry for .EXE:
HKEY_CLASSES_ROOT\exefile\shell\open\command

(Default) = "%1" %*

This Registry value determines how Windows runs files (in this case
.EXE files). If this file is executable, it should read "%1" %*.
("%1" /S for screensavers, .SCR files.) If it needs to be opened
with some other program, it should read program.exe "%1" %*.
File types that are executable are .EXE, .COM, .PIF, .BAT, .SCR.
File types that are not executable are types like .DOC, .LNK, .BMP,
.JPEG, .SHS, .VBS, .HTA etc.

--------------------------------------------------

File association entry for .COM:
HKEY_CLASSES_ROOT\comfile\shell\open\command

(Default) = "%1" %*

This Registry value determines how Windows runs files (in this case
.COM files). If this file is executable, it should read "%1" %*.
("%1" /S for screensavers, .SCR files.) If it needs to be opened
with some other program, it should read program.exe "%1" %*.
File types that are executable are .EXE, .COM, .PIF, .BAT, .SCR.
File types that are not executable are types like .DOC, .LNK, .BMP,
.JPEG, .SHS, .VBS, .HTA etc.

--------------------------------------------------

File association entry for .BAT:
HKEY_CLASSES_ROOT\batfile\shell\open\command

(Default) = "%1" %*

This Registry value determines how Windows runs files (in this case
.BAT files). If this file is executable, it should read "%1" %*.
("%1" /S for screensavers, .SCR files.) If it needs to be opened
with some other program, it should read program.exe "%1" %*.
File types that are executable are .EXE, .COM, .PIF, .BAT, .SCR.
File types that are not executable are types like .DOC, .LNK, .BMP,
.JPEG, .SHS, .VBS, .HTA etc.

--------------------------------------------------

File association entry for .PIF:
HKEY_CLASSES_ROOT\piffile\shell\open\command

(Default) = "%1" %*

This Registry value determines how Windows runs files (in this case
.PIF files). If this file is executable, it should read "%1" %*.
("%1" /S for screensavers, .SCR files.) If it needs to be opened
with some other program, it should read program.exe "%1" %*.
File types that are executable are .EXE, .COM, .PIF, .BAT, .SCR.
File types that are not executable are types like .DOC, .LNK, .BMP,
.JPEG, .SHS, .VBS, .HTA etc.

--------------------------------------------------

File association entry for .SCR:
HKEY_CLASSES_ROOT\scrfile\shell\open\command

(Default) = "%1" /S

This Registry value determines how Windows runs files (in this case
.SCR files). If this file is executable, it should read "%1" %*.
("%1" /S for screensavers, .SCR files.) If it needs to be opened
with some other program, it should read program.exe "%1" %*.
File types that are executable are .EXE, .COM, .PIF, .BAT, .SCR.
File types that are not executable are types like .DOC, .LNK, .BMP,
.JPEG, .SHS, .VBS, .HTA etc.

--------------------------------------------------

File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command

(Default) = C:\WINDOWS\SYSTEM\MSHTA.EXE "%1" %*

This Registry value determines how Windows runs files (in this case
.HTA files). If this file is executable, it should read "%1" %*.
("%1" /S for screensavers, .SCR files.) If it needs to be opened
with some other program, it should read program.exe "%1" %*.
File types that are executable are .EXE, .COM, .PIF, .BAT, .SCR.
File types that are not executable are types like .DOC, .LNK, .BMP,
.JPEG, .SHS, .VBS, .HTA etc.

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[SetupcPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection SetupcPerUser 64 C:\WINDOWS\INF\setupc.inf

[AppletsPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection AppletsPerUser 64 C:\WINDOWS\INF\applets.inf

[PerUser_CVT_Inis]
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_CVT_Inis 64 C:\WINDOWS\INF\applets1.inf

[FontsPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection FontsPerUser 64 C:\WINDOWS\INF\fonts.inf

[PerUser_HNW_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_HNW_Inis 64 C:\WINDOWS\INF\ICS.inf

[PerUser_ICW_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_ICW_Inis 0 C:\WINDOWS\INF\icw97.inf

[>{60B49E34-C7CC-11D0-8953-00A0C90347FF}MICROS] *
StubPath = RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP

[{89820200-ECBD-11cf-8B85-00AA005B4395}] *
StubPath = regsvr32.exe /s /n /i:U shell32.dll

[PerUser_moviemaker] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_moviemaker 64 C:\WINDOWS\INF\moviemk.inf

[>PerUser_MSN_Clean] *
StubPath = C:\WINDOWS\msnmgsr1.exe

[{CA0A4247-44BE-11d1-A005-00805F8ABE06}] *
StubPath = RunDLL setupx.dll,InstallHinfSection PowerCfg.user 0 powercfg.inf

[PerUser_Msinfo] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Msinfo 64 C:\WINDOWS\INF\msinfo.inf

[PerUser_Msinfo2] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Msinfo2 64 C:\WINDOWS\INF\msinfo.inf

[MotownMmsysPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MotownMmsysPerUser 64 C:\WINDOWS\INF\motown.inf

[MotownAvivideoPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MotownAvivideoPerUser 64 C:\WINDOWS\INF\motown.inf

[PerUser_Base] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Base 64 C:\WINDOWS\INF\msmail.inf

[SamplerPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection SamplerPerUser 64 C:\WINDOWS\INF\sampler.inf

[ShellPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection ShellPerUser 64 C:\WINDOWS\INF\shell.inf

[Shell2PerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection Shell2PerUser 64 C:\WINDOWS\INF\shell2.inf

[PerUser_winbase_Links] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_winbase_Links 64 C:\WINDOWS\INF\subase.inf

[PerUser_winapps_Links] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_winapps_Links 64 C:\WINDOWS\INF\subase.inf

[PerUser_LinkBar_URLs] *
StubPath = C:\WINDOWS\COMMAND\sulfnbk.exe /L

[TapiPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection TapiPerUser 64 C:\WINDOWS\INF\tapi.inf

[PerUser_MSWordPad_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_MSWordPad_Inis 64 C:\WINDOWS\INF\wordpad.inf

[PerUserOldLinks] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUserOldLinks 64 C:\WINDOWS\INF\appletpp.inf

[MmoptRegisterPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MmoptRegisterPerUser 64 C:\WINDOWS\INF\mmopt.inf

[PerUser_CDPlayer_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_CDPlayer_Inis 64 C:\WINDOWS\INF\mmopt.inf

[OlsPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection OlsPerUser 64 C:\WINDOWS\INF\ols.inf

[OlsMsnPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection OlsMsnPerUser 64 C:\WINDOWS\INF\ols.inf

[PerUser_PCHealth] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_PCHealth 64 C:\WINDOWS\INF\pchealth.inf

[{22d6f312-b0f6-11d0-94ab-0080c74c7e95}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\mswmp.inf,PerUserStub

[{6BF52A52-394A-11d3-B153-00C04F79FAA6}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp.inf,PerUserStub

[PerUser_Paint_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Paint_Inis 64 C:\WINDOWS\INF\applets.inf

[PerUser_Calc_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Calc_Inis 64 C:\WINDOWS\INF\applets.inf

[PerUser_Enable_Inis]
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Enable_Inis_remove 64 C:\WINDOWS\INF\enable.inf

[PerUser_Wingames_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Wingames_Inis 64 C:\WINDOWS\INF\games.inf

[PerUser_ZoneGame_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_ZoneGame_Inis 64 C:\WINDOWS\INF\games.inf

[PerUser_PBGame_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_PBGame_Inis 64 C:\WINDOWS\INF\games.inf

[MotownRecPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MotownRecPerUser 64 C:\WINDOWS\INF\motown.inf

[PerUser_Vol] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Vol 64 C:\WINDOWS\INF\motown.inf

[MotownMPlayPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MotownMPlayPerUser 64 C:\WINDOWS\INF\motown.inf

[PerUser_RNA_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_RNA_Inis 64 C:\WINDOWS\INF\rna.inf

[MmoptMusicaPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MmoptMusicaPerUser 64 C:\WINDOWS\INF\mmopt.inf

[MmoptJunglePerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MmoptJunglePerUser 64 C:\WINDOWS\INF\mmopt.inf

[MmoptRobotzPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MmoptRobotzPerUser 64 C:\WINDOWS\INF\mmopt.inf

[MmoptUtopiaPerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection MmoptUtopiaPerUser 64 C:\WINDOWS\INF\mmopt.inf

[{44BBA842-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.W95

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {44BBA840-CC51-11CF-AAFA-00AA00B6015C}

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {7790769C-0471-11d2-AF11-00C04FA35D02}

[Shell3PerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection Shell3PerUser 64 C:\WINDOWS\INF\shell3.inf

[Theme_MoreWindows_PerUser] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection Themes_MoreWindows_PerUser 0 C:\WINDOWS\INF\themes.inf

[{44BBA851-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wpie4x86.inf,PerUserStub

[PerUser_CharMap_Inis]
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_CharMap_Rem_Inis 64 C:\WINDOWS\INF\appletpp.inf

[PerUser_Winpopup_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_Winpopup_Inis_remove 64 C:\WINDOWS\INF\winpopup.inf

[PerUser_ClipBrd_Inis] *
StubPath = rundll.exe C:\WINDOWS\SYSTEM\setupx.dll,InstallHinfSection PerUser_ClipBrd_Inis 64 C:\WINDOWS\INF\clip.inf

[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *
StubPath = C:\WINDOWS\SYSTEM\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = C:\WINDOWS\SYSTEM\ie4uinit.exe

Programs listed here are components of the Windows Setup that were
only ran when Windows started for the first time. To prevent them
from running multiple times, Windows checks for a key with the same
name at the HKCU root. If it's not found, the component at the HKLM
root is ran, and a matching key is created at the HKCU root so the
component is not ran again next time. Most entries involve either
RUNDLL.EXE or RUNDLL32.EXE, so a suspicious key is not hard to find.

--------------------------------------------------

Enumerating ICQ Agent Autostart apps:
HKCU\Software\Mirabilis\ICQ\Agent\Apps

*Registry key not found*

The chat program ICQ includes an ICQ Agent that can be configured to
launch one or multiple browsers when an Internet connection is
detected. To configure it, open the ICQ Preferences menu and check
under 'Connection' for a button labelled 'Edit Launch List'.

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=
run=

These two entries in WIN.INI are leftover from Windows 3.x, which
used them as values denoting programs that should be started up
with Windows. Since Windows 95 and higher uses the Registry to
store locations of autostart folders, these two entries in WIN.INI
are redundant, and are rarely used.

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\SYSTEM\THE60'~2.SCR
drivers=mmsystem.dll power.drv

The Shell key from SYSTEM.INI tells Windows what file handles
the Windows shell, i.e. creates the taskbar, desktop icons etc. If
programs are added to this line, they are all ran at startup.
The SCRNSAVE.EXE line tells Windows what is the default screensaver
file. This is also a leftover from Windows 3.x and should not be used.
(Since Windows 95 and higher stores this setting in the Registry.)
The 'drivers' line loads non-standard DLLs or programs.

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present

Due to a bug in Windows 9x, it mistakenly uses C:\Explorer.exe and
other instances (if present) when searching for Explorer.exe.
Explorer.exe should only exists in the Windows folder.
Windows NT is vulnerable to this as well, but only if the 
'Shell' Registry value from the previous section 
is just 'Explorer.exe' instead of the full path.
Additionally, presence of \WINDOWS\Explorer\Explorer.exe indicates
infection with the [email protected]r virus.

--------------------------------------------------

C:\WINDOWS\WININIT.INI listing:

*File not found*

WININIT.INI is a settings file for WININIT.EXE, which updates files
at startup that are normally in use when Windows is running. It is
mostly used when installing programs or patches that need the
computer to be restarted to complete the install. After such a reboot,
WININIT.INI is renamed to WININIT.BAK.

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 30/11/2002, 22:54:40)

[Rename]
NUL=C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
NUL=C:\PROGRA~1\MESSEN~1\MSGSLANG.DLL
NUL=C:\PROGRA~1\MESSEN~1\RTCIMSP.DLL
C:\WINDOWS\SYSTEM\RTCDLL.DLL=C:\WINDOWS\SYSTEM\TBM6282.TMP

WININIT.INI is a settings file for WININIT.EXE, which updates files
at startup that are normally in use when Windows is running. It is
mostly used when installing programs or patches that need the
computer to be restarted to complete the install. After such a reboot,
WININIT.INI is renamed to WININIT.BAK.

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET windir=C:\WINDOWS
SET winbootdir=C:\WINDOWS
SET COMSPEC=C:\WINDOWS\COMMAND.COM
SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND
SET PROMPT=$p$g
SET TEMP=C:\WINDOWS\TEMP
SET TMP=C:\WINDOWS\TEMP

Autoexec.bat is the very first file to autostart when the computer
starts, it is a leftover from DOS and older Windows versions.
Windows NT, Windows ME, Windows 2000 and Windows XP don't use this
file. It is generally used by virusscanners to scan files before
Windows starts.

--------------------------------------------------

C:\CONFIG.SYS listing:

*File is empty*

Config.sys loads device drivers for DOS, and is rarely used in
Windows versions newer than Windows 95. Originally it loaded
drivers for legacy sound cards and such.

--------------------------------------------------

C:\WINDOWS\WINSTART.BAT listing:

@C:\WINDOWS\tmpcpyis.bat

Winstart.bat loads just before the Windows shell, and is used for
starting things like soundcard drivers, mouse drivers. Rarely used.

--------------------------------------------------

C:\WINDOWS\DOSSTART.BAT listing:

LH C:\PROGRA~1\MICROS~1\MOUSE\MOUSE.EXE

Dosstart.bat loads if you select 'MS-DOS Prompt' from the Startup
menu when the computer is starting, or if you select 'Restart in
MS-DOS Mode' from the Shutdown menu in Windows. Mostly used for
DOS-only drivers, like sound or mouse drivers.

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

Some file extensions are always hidden, like .lnk (shortcut) and
.pif (shortcut to MS-DOS program). The Life_Stages virus was a .shs
(Shell Scrap) file that had the extension hidden by default. This can
be a security risk when a virus with a double-extension filename is
on the loose, since the extension can be hidden even when 'Don't show
extensions for known filetypes' is turned off.
The shortcut overlay acts as a reminder that the file is just a shortcut.
If the shortcut overlay is removed, the difference between a file and
a shortcut is invisible.

--------------------------------------------------

Verifying REGEDIT.EXE integrity:

- Regedit.exe found in C:\WINDOWS
- .reg open command is normal (regedit.exe %1)
- Company name OK: 'Microsoft Corporation'
- Original filename OK: 'REGEDIT.EXE'
- File description: 'Registry Editor'

Registry check passed

Regedit.exe is the Windows Registry Editor. Without it, you cannot
access the Registry or merge Registry scripts into the Registry.
Several viruses/trojans mess with this important system file, e.g.
moving it somewhere else or replacing it with a copy of the trojan.
Above checks will ensure that Regedit.exe is in the correct place
and that it really is Regedit.
If you have ScriptSentry installed, the .reg command
is altered and you fail the check. Don't worry
about this.

--------------------------------------------------

Enumerating Browser Helper Objects:

*No BHO's found*

MSIE features Browser Helper Objects (BHO) that plug into MSIE and
can do virtually anything on your system. Benevolant examples are
the Google Toolbar and the Acrobat Reader plugin. More often though, 
BHO's are installed by spyware and serve you to a neverending flow
of popups and ads as well as tracking your browser habits, claiming
they 'enhance your browsing experience'.

--------------------------------------------------

Enumerating Task Scheduler jobs:

Tune-up Application Start.job
PCHealth Scheduler for Data Collection.job
Scan for Viruses.job
Maintenance-Defragment programs.job
Maintenance-ScanDisk.job
Maintenance-Disk cleanup.job
Run LiveUpdate (for Norton AntiVirus).job
Run LiveUpdate (for Norton AntiVirus)(2).job

The Windows Task Scheduler can run programs at a certain time,
automatically. Though very unlikely, this can be exploited by
making a job that runs a virus or trojan.

--------------------------------------------------

Enumerating Download Program Files:

[Microsoft XML Parser for Java]
CODEBASE = file://C:\WINDOWS\Java\classes\xmldso.cab
OSD = C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd

[DirectAnimation Java Classes]
CODEBASE = file://C:\WINDOWS\SYSTEM\dajava.cab
OSD = C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://active.macromedia.com/flash2/cabs/swflash.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

[{32564D57-0000-0010-8000-00AA00389B71}]
CODEBASE = http://codecs.microsoft.com/codecs/i386/wmv8ax.cab

[NSUpdateLiteCtrl Class]
InProcServer32 = C:\WINDOWS\SYSTEM\NSUPDATE.DLL
CODEBASE = http://204.177.92.201/quickdl/NSupd9x.cab

[OPUCatalog Class]
InProcServer32 = C:\WINDOWS\SYSTEM\OPUC.DLL
CODEBASE = http://office.microsoft.com/ProductUpdates/content/opuc.cab

[Microsoft Office Tools on the Web Control]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\OUTC.DLL
CODEBASE = http://officeupdate.microsoft.com/TemplateGallery/downloads/outc.cab

[3DGreetings.com Player 2.0]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\VROOM.DLL
CODEBASE = http://www.expressit.com/Plugin/3DGreetings/vroom.CAB

[Download Class]
InProcServer32 = C:\WINDOWS\SYSTEM\PRETZLDN.DLL
CODEBASE = http://www.expressit.com/plugin/Download.cab

[CV3 Class]
InProcServer32 = C:\WINDOWS\SYSTEM\WUV3IS.DLL
CODEBASE = http://windowsupdate.microsoft.com/R911/V31Controls/x86/mil/en/actsetup.cab

[Symantec RuFSI Registry Information Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\RUFSI.DLL
CODEBASE = http://security2.norton.com/SSC/SharedContent/sc/bin/cabsa.cab

[WTHoster Class]
InProcServer32 = C:\WINDOWS\WT\WEBDRIVER\WTHOSTCTL.DLL
CODEBASE = http://www.wildtangent.com/install/wdriver/ddc/wtgeneric/wtinst.cab

[Live365Player Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\PLAY365.DLL
CODEBASE = http://www.live365.com/players/play365.cab

[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\XSCAN53.OCX
CODEBASE = http://a840.g.akamai.net/7/840/537/2002112001/housecall.antivirus.com/housecall/xscan53.cab

The items in Download Program Files are programs you downloaded and
automatically installed themselves in MSIE. Most of these are Java
classes Media Player codecs and the likes. Some items are only
visible from the Registry and may not show up in the folder.

--------------------------------------------------

Enumerating Winsock LSP files:

NameSpace #1: C:\WINDOWS\SYSTEM\rnr20.dll
Protocol #1: C:\WINDOWS\SYSTEM\msafd.dll
Protocol #2: C:\WINDOWS\SYSTEM\msafd.dll
Protocol #3: C:\WINDOWS\SYSTEM\msafd.dll
Protocol #4: C:\WINDOWS\SYSTEM\rsvpsp.dll
Protocol #5: C:\WINDOWS\SYSTEM\rsvpsp.dll

The Windows Socket system (Winsock) connects your system to the
Internet. Part of this task is resolving domain names (www.server.com)
to IP addresses (12.23.34.45) which is handler by several system
files, called Layered Service Providers (LSPs), which work as a
chain: if one LSP is gone, the chain is broken and Winsock cannot
resolve domain names - which means no program on your system can
access the Internet.

--------------------------------------------------
End of report, 32,297 bytes
Report generated in 0.369 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


----------



## ~Candy~ (Jan 27, 2001)

Start button, run, then type msconfig and hit ok....go to startups, find this puppy and uncheck it.........

C:\WINDOWS\SYSTEM\DEVLDR16.EXE 

then restart.


----------



## pvc9 (Jul 7, 2002)

Its definetely loading at startup. Dont know if you tried it already, I'd suggest you to boot to safe mode, rename the file there...

Tap F8 constantly when the system starts. This would start a bootmenu and from the menu select the 3rd option which would be Safe Mode. Try in Safe Mode and see what happens.

Start->Run->msconfig [enter]

Click on the Startup tab and uncheck the entry for that file.

To rename, once in Safe Mode, navigate to,

My Computer->C:\->Windows->System. Right click on the devldr.exe and rename it to devldr.old.

Now boot to Normal Mode...see if it starts again.


----------



## pvc9 (Jul 7, 2002)

> _Originally posted by cementhed:_
> *Can anyone tell me how to get rid of devldr16.exe? I have unchecked it in my startup menu, but it keeps coming back. *


Candy...first post...says it keeps coming back...


----------



## ~Candy~ (Jan 27, 2001)

But are the changes being saved...........stranger things have happened.........looks like it could use a registry deletion too........



Autorun entries from Registry: 
HKLM\Software\Microsoft\Windows\CurrentVersion\Run 

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun 
SystemTray = SysTray.Exe 
Norton Auto-Protect = C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET 
Multi-function Keyboard = GWHotKey.exe 
NAV DefAlert = C:\PROGRA~1\NORTON~1\DEFALERT.EXE 
iamapp = C:\Program Files\Norton Internet Security\IAMAPP.EXE 
PCHealth = C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s 
Norton eMail Protect = C:\PROGRAM FILES\NORTON ANTIVIRUS\POProxy.exe 
LoadQM = loadqm.exe 
devldr16.exe = C:\WINDOWS\SYSTEM\devldr16.exe


----------



## flavallee (May 12, 2002)

R_R:

That's exactly what I did. After I deleted and cleaned everything out, I used the custom install and just installed the Soundblaster drivers and diagnostic tool. I haven't had a BSOD during startup and shutdown since.

Frank's Windows 95/98 Tips


----------



## NotRiteÂ² (Nov 7, 2002)

Not meaning to jump in the middle here........but...here is some more info about how to possibly disable this baby.....RollingRog had the rite idea earlier.

Devldr16 is associated with some Creative Labs sound cards. Provides audio support for DOS applications. Not needed if you don't have those. Required if you use "Sound Play Control" and "Sound Recorder". To disable: (1) Disable via MSCONFIG (2) Start -> Settings -> Control Panel -> System -> Device Manager then disable "Creative SB16 Emulation" under Creative Miscellaneous Devices.

I'm thinking #2 option might help you here.

Also I seem to recall seeing something way back bout you are running ME. If you have System Restore enable.....and even use it, or plan to.....you can't.......hehe....not without a patch for it available at the link posted below. Nice article bout it there too.

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q290700&FR=1

Good Luck


----------



## flavallee (May 12, 2002)

I did have SB16 Emulation disabled in the Device Manager, but Devldr16.exe was still persistent about re-enabling itself in the MSCONFIG startup list. I was only able to solve the problem by doing what I did.

Frank's Windows 95/98 Tips


----------



## Rollin' Rog (Dec 9, 2000)

Frank, thanks for the confirmation; I did read your web site post but must have missed the custom install part. I was wondering whether I imagined the solution as I had yet to get anyone to try it and report back.


----------



## cementhed (Apr 1, 2001)

Okay, I'm finally back. Here is what I have done based on your posts.

AcaCandy - I have unchecked devldr16.exe many times in msconfig with no luck - it keeps coming back at start-up. You questioned whether I should do a registry deletion. Do you want me to do that and if so how do I go about that?

Pvc9 - I went to safemode - msconfig - startup & devldr6.exe was not checkmarked! Then I renamed devldr16.exe to devldr.old and restarted the computer. It still loaded.

Now, here is something I discovered while going to safemode. In normal startup when going to msconfig-startup there are two entries for devlder16.exe. One is always unchecked and the other is always checked? But, in safemode there is only one devldr16.exe and it is unchecked. Does this help either of you recognize what is going on?

As for the other posts recommending that I get rid of creative SB16 emulation in device manager, I do not have Creative Miscellaneous Devices or creative SB16 emulation in my device manager.


----------



## pvc9 (Jul 7, 2002)

Ok, check try this -

Start->Run->regedit [enter]

Check these keys and *delete* the key(s) related to the file devldr.exe and post back.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run- 
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run- 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices 
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices-

One more suggestion, go to Safe Mode, instead of renaming the file, simply move the file to a temporary folder, say *C:\Windows\Temp*. Restart the computer, does it load again?


----------



## john1 (Nov 25, 2000)

Long shot.

Here is a daft idea.
Make an empty file called devldr.exe
the logic being that it wont put it in,
if there is already one there.


----------



## cementhed (Apr 1, 2001)

Wow! I'm starting to think that this file is possessed. I followed your instructions, pvc9, going to regedit and deleting the keys relating to devldr.exe. When I checked the startup in msconfig, both of the devldr16.exe items were gone - I thought, alright!!! But, when I restarted the computer, back came the devldr16.exe with the checkmark - the unchecked one is now gone. I tried moving the file into the temp folder in safe mode. When I went to safe mode, there wasn't a devld16.exe file - just the renamed devldr16.old. I did move the devldr16.old to the temp folder. But, still no change. Should I just give up?


----------



## john1 (Nov 25, 2000)

No.
Dont give up,
did it wipe out the false one you put in?


----------



## cementhed (Apr 1, 2001)

John1
I didn't create the false file because I wasn't sure where or how you wanted me to do that. So, let me know how to do that & we'll see what happens


----------



## john1 (Nov 25, 2000)

Still trying to make this work.


----------



## cementhed (Apr 1, 2001)

Pvc9 - do you have anymore suggestions?


----------



## pvc9 (Jul 7, 2002)

Hmm...been looking all over the net for the same cementhed. But all I find is Emulation...SB 16...same ole stuff. But you already posted you dont have any of it.

I'm not sure if this will work, try to put/move that file to NAV *Quarantine*...cos you've NAV installed. Try that, reboot the computer, see if that helps...

HTH...


----------



## cementhed (Apr 1, 2001)

Okay, here's a new one for you - I can't locate devldr16.exe to move it to the NAV quarantine. I did a search for this file and it came up with no results. Yet, it still continues to show up checkmarked on the startup list & keeps reappearing in the HKEY_LOCAL_MACHINES location even after I have deleted it. 

The file no longer shows up in the SYSTEM folder.


----------



## john1 (Nov 25, 2000)

Hi,

I'm still trying to get a dummy entry to take.
No success so far, but i found this which may help,

Make sure that the soundcard does not share the same
IRQ as any other PCI card, this can be checked from
the control panel\system\hardware\device manager and
then change your settings for this through Bios.

from:
http://www.soundsstudio.co.uk/modules/wfsection/article.php?articleid=70

you can usually adjust IRQ settings through device
manager.

John


----------



## john1 (Nov 25, 2000)

Well cementhed,

i'm glad that the devldr.exe file has gone from your system.

Ive been trying to figure out this 'dummy file' business.
I found that my PC reacts differently to instructions from
the keyboard/mouse, than it does to instructions from Win.

Ive been moving, copying etcetera from the keyboard,
and getting 'Windows messages' coming up, which i couldn't
figure out how to get rid of ! (prevent)
For instance, i would make up a Devil file of nothing much
maybe says hello or something, then i would attempt a copy
into its folder another Devil file, of the same name, maybe
says goodbye or something.

As expected, the Devil file(goodbye) would not copy in,
because it already had a Devil file(hello) in there.

BUT... a windows message would come up, to tell me that it
wouldn't copy cos theres already a Devil file in there.

I was most perplexed by this cos i had used this arrangement
before, but couldnt remember what to do.

So ive been fiddling about, and remembered something about
bat files, they dont give (that) error message.

So i made a bat file to do the job instead. "copy DevilFile
into HERE" well, that wasn't right, it overwrote it.

So (much later) i thought, it cant overwrite another folder.
So i put a folder in there called Devil

BINGO !!

It wont overwrite, AND no error message. 

So, you say you re-named this annoying file?
Well if you put a folder in its place with exactly the same
name, that is called, 'Devldr.exe' then hopefully it will
not be able to re-create that file there.

I have tried this with a dummy file and folder, using a bat
file to do the job, and it works for me. That is it wont re-
create the file, but i dont have the devldr problem.

I realise this is a bit late, and you say the file has gone
now, but if it comes back, then you might want to try this.

Cheers, John


----------



## cementhed (Apr 1, 2001)

Yeah, I don't see that file anywhere on the system, but that crazy thing still keeps rechecking itself in the startup program. Do you think it is just something that is not clearing out, but the actual file is gone, so therefore I don't need to worry about it anymore?


----------



## john1 (Nov 25, 2000)

OK,
we are talking about the startup bit,
in the System Configuration Utility,
on WinME (msconfig).....Yes ?

look under 'Loaded from' to find where
it starts, go to that,
you might find its a shortcut,
if so,
bring up the properties of the shortcut,
Check the address given as the target,
Also look under Command to check the
address given there.

I had one that kept recurring after i 
removed the tick, it referred to an
address that had been changed, once i
sorted that, it behaved normally.

let me know how you get on...


----------



## cementhed (Apr 1, 2001)

okay - devldr16.exe (from msconfig - startup) is loaded from Registry (machine run). You said to go to that - can you tell me how to do that & how I will know if it is a shortcut, etc.

Thank you for your patient efforts with me.


----------



## ~Candy~ (Jan 27, 2001)

Try this, start button, run, then type regedit and hit ok

then go to edit, find, and search for that nasty devil..........


----------



## Imsexy (May 26, 2003)

I registered with tech guy over this post. I was having same prob today but though "why dont i just delete devldr16?" 
searched it, deleted everything that came up from search (backed up on floppy just in case), and now im running problem free- and yes, sound works. I know this post is kinda late, but u might wanna try it if ur prob is not fixed.


----------



## laurennesaun (Aug 14, 2003)

can anyone help me. I have a devldr16.exe problem.


----------



## john1 (Nov 25, 2000)

Hi laurennesaun,

What sort of problem ?
It might be better to start a new thread,
see how it goes.

John


----------



## Anavax (Oct 14, 2003)

Heh. I registered just because of this file too. It is possessed. Here's what I did to get rid of it, and the problem its caused:

start - settings - control panel - system - device manager -sound/video/game controllers - disabled Creative SB Live! Value (WDM)

That fixed it. It no longer loads on my machine and my resources are at 96 when I boot.  

The problem is my system sounds no longer play, and Halo has no sound either...   

Any suggestions, or did I choose the wrong path to get rid of it? I tried deleting it, but even after I closed the program with ctrl-alt-delete, it still said the file was in use by windows when I attempted. Enabling would give me my sound back, so its an easy fix...or do I have to have it running to have any sound at all? A better program/driver to use?

EDIT: I zipped all the devldr16 into a folder on my desktop, and while the Creative SB Live! was disabled, I deleted both of them, then re-enabled Creative SB Live, rebooted and lo and behold, my sound came back, with no devldr16 loaded! The only problem is, RegProt (great program!) notified me that my machine was attempting to set a reg key for it, even though I deleted it...


----------



## GoJoAGoGo (Dec 26, 2002)

I use Windows ME. I've managed to delete the devldr16.exe file through JV16 Power Tools, but it will still appear in the startup list. I've done a search For Files Or Folders and it can no longer be found. It doesn't appear in Close Programs or Task Manager. I've deleted the devldr16.exe key located in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run 
After a reboot the key will reappear in the Registry and also in the startup list, but I can't locate the file when I do a search. If I can't locate the file, why does it keep appearing in the startup list?

What's up with this pest? I know it's related to Creative SB Live. A Trojan Removing program has labeled devldr18.exe as a trojan.


----------



## john1 (Nov 25, 2000)

Hi


----------



## john1 (Nov 25, 2000)

This may help ....

******************

taken from:
http://www.annoyances.org/exec/forum/winme/t1043392178

If you do not use DOS games, and you want to get rid of
this task, the only way we have found to safely disable
this task is as follows:
1) Disable in Startup Manager.
2) Next, in Device Manager,
in the Sound section or under
"Creative Miscellaneous Devices",
disable Creative SB16 Emulation.

************

John


----------



## GoJoAGoGo (Dec 26, 2002)

John:

Thanks for your input. Windows ME in Device Manager Creative Miscellaneous Devices doesn't exist.


----------



## john1 (Nov 25, 2000)

Hi GoJo,

i take it you have deleted the offending file ?


----------



## GoJoAGoGo (Dec 26, 2002)

Yes, I deleted the file but it still appears in my startup list.


----------



## john1 (Nov 25, 2000)

does the file re-create itself ?
do you have your mail set to play a sound when a reply is made ?
is your mail refresh set at at a long time?
mine is at four minutes.

If the file recreates itself,
and you dont want to or cannot disable the emulating,
it might be possible to prevent the file from re-creating.

if you check the properties of the file in the start-up list,
i think you will find that it is a shortcut.
see if you can find where its come from.


----------



## john1 (Nov 25, 2000)

i have to go to bed now,
goodnite.

John


----------



## ~Candy~ (Jan 27, 2001)

Uncheck it via start, run, msconfig, startup....or start, programs, startup folder.


----------

