# startup menu in msconfig



## tellicoguy (Nov 30, 2002)

I was checking on startup items in msconfig and found the following item: Title: Description of shortcut. File that runs: c\windows\applicationdata\microsoft\installer\(0cd3bb5c-bbc4-11d2-8c20-00c04fbbcbb9)a94aab13.exe. What is this, what does it do and how do I get rid of it or should I? When I uncheck the box and restart it is always rechecked. Hope someone can help.

Thanks,

Tellicoguy


----------



## pvc9 (Jul 7, 2002)

[tsg=welcome][/tsg]

Did you install any software before this started? It seems to be a problem with some installation...did you?


----------



## steamwiz (Oct 4, 2002)

Was it *Mailloop v4.6* by any chance


----------



## jwbirdsong (Nov 7, 2002)

Tellicoguy
Like the guys said, it's PROBABLY from a recent install, however 8 or 6 letter random name are also generated by many viruses. Also do a complete ( UP TO DATE) virus scan


----------



## pvc9 (Jul 7, 2002)

*PM from tellicoguy : *



> tellicoguy wrote on 12-01-2002 03:07 AM:
> Thanks for the reply. I installed Picture It! Digital Image not long ago. I also tried to install a new version of MSN Messenger but it aborted.
> 
> I not sure I view my "problem" as a problem, more an annoyance. I just can't keep it from starting up when Windows boots. I could delete the file all together but I don't know what else it might affect.
> ...


Hi,
Plz post back any info at the thread itself...will be useful as other members can read and understand the problem better and help...

When did you try the installation? Few days or ? If this happened recently then I'd suggest you to restore the registry and that could help -

In case of Windows 98, 98 SE -

Tap F8 constantly when the system starts. This would start a bootmenu and from the menu select the Command Prompt option which would start the computer in the Command Prompt.

OR

Start->Shutdown->Restart in MS-DOS Mode->Ok.

Once at the C:\> or C:\Windows> prompt try this -

*scanreg /restore*

Select the date prior to the problems' starting!

In case of Windows ME -

Start the computer with a bootup floppy, select Command Prompt and try the same command. If you dont have a bootable floppy then download the program to create one from this link -

Windows Boot Disks


----------



## steamwiz (Oct 4, 2002)

*PM from tellicoguy*



> my problem (12-01-2002 07:52 PM)
> Thanks for the reply. No, I didn't install mailloop. Never heard of it in fact. It's just annoying to have things in my startup that I don't know about or want. Good old Microsoft is invading again. I considered deleting the file but I don't want to until I know what it does.
> 
> Thanks again,
> ...


I replied with the following - asking him to paste the results in the forum

Please d'load and run "startup list" click edit - select all - copy - then paste the results here

http://www.lurkhere.com/~nicefiles/

steam


----------



## tellicoguy (Nov 30, 2002)

> _Originally posted by tellicoguy:_
> *I was checking on startup items in msconfig and found the following item: Title: Description of shortcut. File that runs: c\windows\applicationdata\microsoft\installer\(0cd3bb5c-bbc4-11d2-8c20-00c04fbbcbb9)a94aab13.exe. What is this, what does it do and how do I get rid of it or should I? When I uncheck the box and restart it is always rechecked. Hope someone can help.
> 
> Thanks,
> ...


Here's the startup list

StartupList report, 12/3/02, 8:55:39 AM
StartupList version: 1.40.1
Started from : C:\WINDOWS\DESKTOP\STARTUPLIST.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 (6.00.2600.0000)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SYMTRAY.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\SYSTEM\ZONELABS\MINILOG.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NORTON SYSTEMWORKS\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\LVCOMS.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE
C:\WINDOWS\SYSTEM\HPZTSB06.EXE
C:\PROGRAM FILES\AHEAD\INCD\INCD.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZONEALARM.EXE
C:\PROGRAM FILES\ADSUBTRACT\ADSUB.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\WINDOWS\DESKTOP\STARTUPLIST.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
AdSubtract.lnk = C:\Program Files\AdSubtract\adsub.exe
Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe

Shell folders Common Startup:
[C:\WINDOWS\All Users\Start Menu\Programs\StartUp]
ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

SystemTray = SysTray.Exe
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
DXM6Patch_981116 = C:\WINDOWS\p_981116.exe /Q:A
ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
NAV Agent = C:\PROGRA~1\NORTON~1\NORTON~1\NAVAPW32.EXE
LVComs = C:\WINDOWS\SYSTEM\LVComS.exe
StillImageMonitor = C:\WINDOWS\SYSTEM\STIMON.EXE
LoadQM = loadqm.exe
POINTER = C:\Program Files\Microsoft Hardware\Mouse\point32.exe
Tweak UI = RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
HPDJ Taskbar Utility = C:\WINDOWS\SYSTEM\hpztsb06.exe
InCD = C:\Program Files\ahead\InCD\InCD.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

ScriptBlocking = "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
SymTray - Norton SystemWorks = C:\Program Files\Common Files\Symantec Shared\SymTray.exe "Norton SystemWorks"
SchedulingAgent = mstask.exe
TrueVector = C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
MiniLog = C:\WINDOWS\SYSTEM\ZONELABS\MINILOG.EXE -service

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

WEBCAMRT.EXE = 
msnmsgr = "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background

--------------------------------------------------

Enumerating Active Setup stub paths:
HKLM\Software\Microsoft\Active Setup\Installed Components
(* = disabled by HKCU twin)

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {89820200-ECBD-11cf-8B85-00AA005B4383}

[PerUser_LinkBar_URLs] *
StubPath = C:\WINDOWS\COMMAND\sulfnbk.exe /L

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {44BBA840-CC51-11CF-AAFA-00AA00B6015C}

[>PerUser_MSN_Clean] *
StubPath = C:\WINDOWS\msnmgsr1.exe

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *
StubPath = rundll32.exe advpack.dll,UserInstStubWrapper {7790769C-0471-11d2-AF11-00C04FA35D02}

[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *
StubPath = C:\WINDOWS\SYSTEM\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl

--------------------------------------------------

Load/Run keys from C:\WINDOWS\WIN.INI:

load=
run=

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=Explorer.exe
SCRNSAVE.EXE=
drivers=mmsystem.dll power.drv

--------------------------------------------------

Checking for EXPLORER.EXE instances:

C:\WINDOWS\Explorer.exe: PRESENT!

C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 29/11/2002, 13:6:52)

[rename]
NUL=C:\WINDOWS\TEMP\_iu14D2N.tmp

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

rem SET PATH=C:\WINDOWS;C:\WINDOWS\COMMAND;;

--------------------------------------------------

Checking for superhidden extensions:

.lnk: HIDDEN! (arrow overlay: yes)
.pif: HIDDEN! (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: HIDDEN!
.shb: HIDDEN!
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

--------------------------------------------------

Enumerating Browser Helper Objects:

(no name) - (no file) - {EF99BD32-C1FB-11D2-892F-0090271D4F88}
NAV Helper - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}
(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Symantec NetDetect.job
Norton AntiVirus - Scan my computer.job

--------------------------------------------------

Enumerating Download Program Files:

[CV3 Class]
InProcServer32 = C:\WINDOWS\SYSTEM\WUV3IS.DLL
CODEBASE = http://windowsupdate.microsoft.com/R1108/V31Controls/x86/w98/en/actsetup.cab

[InstallShield Setup Player]
InProcServer32 = c:\WINDOWS\DOWNLO~1\ISETUP.DLL
CODEBASE = http://ftp.hp.com/pub/automatic/player/isetup.cab

[YInstStarter Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\YINSTHELPER.DLL
CODEBASE = http://download.yahoo.com/dl/installs/yinst.cab

[YahooYMailTo Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\YMMAPI.DLL
CODEBASE = http://download.yahoo.com/dl/installs/ymail/ymsgr/ymmapi.dll

[Yahoo! WebCam Upload Wrapper]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\YUPLAPP.DLL
CODEBASE = http://chat.yahoo.com/cab/yuplapp.cab

[CarPoint Auto-Pricer Control]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\AUTOPRICER.OCX
CODEBASE = http://carpoint.msn.com/components/ocx/autopricer/autopricer.cab

[InstallShield International Setup Player]
InProcServer32 = c:\WINDOWS\DOWNLO~1\ISETUPML.DLL
CODEBASE = http://ftp.hp.com/pub/automatic/player/isetupML.cab

[Symantec RuFSI Registry Information Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\RUFSI.DLL
CODEBASE = http://security1.norton.com/SSC/SharedContent/sc/bin/cabsa.cab

[CamImage Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\AXISCAMCONTROL.OCX
CODEBASE = http://65.216.159.20/activex/AxisCamControl.ocx

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?1038176678440

[{4E888414-DB8F-11D1-9CD9-00C04F98436A}]
CODEBASE = https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab

--------------------------------------------------
End of report, 8,736 bytes
Report generated in 0.453 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only


----------



## steamwiz (Oct 4, 2002)

Startup list posted above by tellicoguy (posted as an edit to a previous post)


----------



## pvc9 (Jul 7, 2002)

tellicoguy,
First I'm not sure why you're quoting your own post and then continuing with the latest info...thats not required. We were actually quoting your PMs and not the first post.

Lets trim the startup.

Start->Run->msconfig [enter]

Click on the Startup tab and uncheck the following.

Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe 
DXM6Patch_981116 = C:\WINDOWS\p_981116.exe /Q:A 
LoadQM = loadqm.exe 
WEBCAMRT.EXE = 
msnmsgr = "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background

In your PM you said there were few problems with the installation of MSN Msngr...so I'd suggest you to uninstall the program and re-install the same.


----------



## tellicoguy (Nov 30, 2002)

They sound like good ideas but I still don't know why the Microsoft item in the startup menu is there or why I can't stop it from running. This is my "problem". My machine runs well except for the "problem" as noted above. I really would like to know why this item is in my startup and what it does.

I appreciate all of the suggestions and comments from everyone. I'm sorry I have had such a hard time of posting etc. I'm trying to do better.

tellicoguy


----------



## pvc9 (Jul 7, 2002)

OK, try this -

Go to *c:\windows\applicationdata\microsoft\installer\* and rename the file (0cd3bb5c-bbc4-11d2-8c20-00c04fbbcbb9)a94aab13.exe to (0cd3bb5c-bbc4-11d2-8c20-00c04fbbcbb9)a94aab13._old._

Change the _exe_ extension to *old*.

Reboot, does that help?


----------



## NorthRanger (Aug 30, 2003)

A94AAB13.exe
I received the same file today on my startup when I checked it using msconfig.

I had just uninstalled Microsoft's Intellipoint 4.0 and then installed Microsoft Home Publisher 2000 when this showed up.

Those were the only changes I made.

I am going to try to rename it with the ".old" suffix as suggested above and post the results if I stay running lol.


----------

