system startup wont delete one of the entries
- Thread starter RODOT
- Start date
md usa spybot fan
Spybot Advisor Team [Retired]
Warning - The information on startup entries only reflects possibilities of what an entry by that name may be. There is no actual analysis of the startup entry (other than the name) nor of the program it points to. So before you attempt to remove any entry you better be sure that it should be removed.
What I am saying is, that in the tools section of spybot search and destroy, where system startup entries are listed, the big red delete X button at the top of the page is not lit up. But it will function with the other system startup entries. It is just this one entry that it won't delete.
md usa spybot fan
Spybot Advisor Team [Retired]
RODOT:
I was nice enough to warn you about the potential dangers of taking the comments that accompany startup entries literally. What to I get for my trouble? "… And what a useless and unhelpful reply."
In the type of entry that you indicated you have:
Now if you would like to ask a question civilly, I might be inclined to answer it. In the mean time, I don't know what your question is: "How do I delete the entry", maybe?
What is the question? You made a statement (twice) that the delete function in Spybot's System Startup did not work on that particular startup entry. I'm sorry but I can't fix the program.
I was nice enough to warn you about the potential dangers of taking the comments that accompany startup entries literally. What to I get for my trouble? "… And what a useless and unhelpful reply."
In the type of entry that you indicated you have:
- system.ini: Shell=Explorer.exe xxxxxxxx.exe
Now if you would like to ask a question civilly, I might be inclined to answer it. In the mean time, I don't know what your question is: "How do I delete the entry", maybe?
Last edited:
I have this exact same problem ...
I would really appreciate any help with this issue. I have a Windows 98 Machine that has this same entry in the startup.
System.ini(C:\WINDOWS\system ini) SHELL Explorer.exe
It was not found before I installed version 1.5.2. I can't uncheck it to stop it from loading with startup. The machine has really taken a hit on performance so I suspect this entry has something to do with it.
Thanks in advance for any help.
C.
I would really appreciate any help with this issue. I have a Windows 98 Machine that has this same entry in the startup.
System.ini(C:\WINDOWS\system ini) SHELL Explorer.exe
It was not found before I installed version 1.5.2. I can't uncheck it to stop it from loading with startup. The machine has really taken a hit on performance so I suspect this entry has something to do with it.
Thanks in advance for any help.
C.
md usa spybot fan
Spybot Advisor Team [Retired]
Shmaley:
The following entry is a valid entry on a Windows 98 system:
The following entry is a valid entry on a Windows 98 system:
Code:
System.ini(C:\WINDOWS\system ini) SHELL Explorer.exeA couple of questions then...
Why does spybot have this to say about it in the startup info if it's legit?
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: Shell32.exe
Description
Added by the _BADSECTOR_ TROJAN!
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: ray.exe
Description
Homepage hijacker re-directing browsers to adult content websites
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: Tray.exe
Description
Homepage hijacker re-directing browsers to adult content websites
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: wmedia16.exe
Description
Added by the _GOLDUN_ TROJAN!
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: Open32.exe
Description
Added by the _SMALL-DL_ TROJAN!
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: Explorer.exe sound_drive16.exe
Description
Added by the _GP_ TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System subfolder
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: Explorer.exe, msmsgs.exe
Description
Added by the _ZLOB_ TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: Explorer.exe [path] svchost.exe
Description
Added by the _DOYORG_ TROJAN! Note - this is not the legitimate _svchost.exe_ process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: explorer.exe
Description
Added by the _KAKKEYS_ TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System32 subfolder
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: iexplore.exe
Description
Added by the _KIPIS-U_ TROJAN! Note - this is not the legitimate Internet Explorer _iexplore.exe_ process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in a "Microsoft" subfolder
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: ibm0000*.exe [* = digit]
Description
Added by the _TORPIG-C_ and _TORPIG-J_ TROJANS! Filenames spotted include ibm00001.exe, ibm00002.exe, ibm00005.exe and so on
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: taskmrg.exe
Description
Added by the _BANCBAN-FT_ TROJAN!
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: Explorer.exe winupdate.exe
Description
Added by the _AGENT-FD_ TROJAN!
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: ibm[RANDOM 5 DIGIT NUMBER].exe
Description
Added by the _ANSERIN_ TROJAN!
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: svchost.exe
Description
Added by the _GOLDSPY-B_ TROJAN! Note - this is not the legitimate _svchost.exe_ process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: ibm00001.dll
Description
Added by the _TORPIG-Q_ TROJAN!
Source: Paul Collins Startup list
____________________
My guess was that a trojan had attached itself to my copy of Explorer.exe. And much to the programmers delight I cannot close it while I'm using the shell. It will have to be fixed in DOS... I have ran Hijackthis and Sysclean but haven't found anything. As well I have checked with Avast and Bitdefender to no avail. Spybot is the only one that finds this process to be a problem. What do you think?
Why does spybot have this to say about it in the startup info if it's legit?
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: Shell32.exe
Description
Added by the _BADSECTOR_ TROJAN!
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: ray.exe
Description
Homepage hijacker re-directing browsers to adult content websites
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: Tray.exe
Description
Homepage hijacker re-directing browsers to adult content websites
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: wmedia16.exe
Description
Added by the _GOLDUN_ TROJAN!
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: Open32.exe
Description
Added by the _SMALL-DL_ TROJAN!
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: Explorer.exe sound_drive16.exe
Description
Added by the _GP_ TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System subfolder
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: Explorer.exe, msmsgs.exe
Description
Added by the _ZLOB_ TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: Explorer.exe [path] svchost.exe
Description
Added by the _DOYORG_ TROJAN! Note - this is not the legitimate _svchost.exe_ process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: explorer.exe
Description
Added by the _KAKKEYS_ TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System32 subfolder
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: iexplore.exe
Description
Added by the _KIPIS-U_ TROJAN! Note - this is not the legitimate Internet Explorer _iexplore.exe_ process which is always located in the Program Files\Internet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in a "Microsoft" subfolder
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: ibm0000*.exe [* = digit]
Description
Added by the _TORPIG-C_ and _TORPIG-J_ TROJANS! Filenames spotted include ibm00001.exe, ibm00002.exe, ibm00005.exe and so on
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: taskmrg.exe
Description
Added by the _BANCBAN-FT_ TROJAN!
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: Explorer.exe winupdate.exe
Description
Added by the _AGENT-FD_ TROJAN!
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: ibm[RANDOM 5 DIGIT NUMBER].exe
Description
Added by the _ANSERIN_ TROJAN!
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: svchost.exe
Description
Added by the _GOLDSPY-B_ TROJAN! Note - this is not the legitimate _svchost.exe_ process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder
Source: Paul Collins Startup list
____________________
Current filename: Explorer.exe
Database status: Not required - virus, spyware, malware or other resource hog
Value: Shell
Filename: ibm00001.dll
Description
Added by the _TORPIG-Q_ TROJAN!
Source: Paul Collins Startup list
____________________
My guess was that a trojan had attached itself to my copy of Explorer.exe. And much to the programmers delight I cannot close it while I'm using the shell. It will have to be fixed in DOS... I have ran Hijackthis and Sysclean but haven't found anything. As well I have checked with Avast and Bitdefender to no avail. Spybot is the only one that finds this process to be a problem. What do you think?
md usa spybot fan
Spybot Advisor Team [Retired]
Shmaley:
The information on startup entries only reflects possibilities of what an entry by that name may be. There is no actual analysis of the startup entry (other than the name) nor of the program it points to.
In the case you are observing all possible entries for "SHELL" in the Startup.tnfo file which is derived from Paul Collins Startup list.
Each of the entries you cited indicate:
If the "Current filename" matched a "Filename" in any of the various descriptions that you cited, that could indicate a possible problem.
However:
Does not match:
__________
Does not match:
__________
Does not match:
__________
Etc.
The information on startup entries only reflects possibilities of what an entry by that name may be. There is no actual analysis of the startup entry (other than the name) nor of the program it points to.
In the case you are observing all possible entries for "SHELL" in the Startup.tnfo file which is derived from Paul Collins Startup list.
Each of the entries you cited indicate:
Code:
Current filename: Explorer.exeHowever:
Code:
Current filename: Explorer.exe
Code:
Filename: Shell32.exe
Code:
Current filename: Explorer.exe
Code:
Filename: ray.exe
Code:
Current filename: Explorer.exe
Code:
Filename: Tray.exeEtc.
md usa spybot fan
Spybot Advisor Team [Retired]
RODOT:
Unlike most startup entries that are in a registry entry, on Windows 9X systems that particular entry is a line in a file. In order for that entry to be deleted the file has to be edited.
Besides that particular entry should not be deleted. If Spybot was able to delete the entry, Windows would no long function properly. In Windows 9X systems the entry Shell=explorer.exe is the interactive graphical user interface shell i.e. the Windows taskbar and desktop environment.
Unlike most startup entries that are in a registry entry, on Windows 9X systems that particular entry is a line in a file. In order for that entry to be deleted the file has to be edited.
Besides that particular entry should not be deleted. If Spybot was able to delete the entry, Windows would no long function properly. In Windows 9X systems the entry Shell=explorer.exe is the interactive graphical user interface shell i.e. the Windows taskbar and desktop environment.