some changes to the "System Internals" feature i see.
I can assure you, these startup values exist, a quick check with autoruns from sysinternals shows this
Not so sure about the uninstall string though...but I have seen this one before and I believe it is part of windows
A note however, my windows folder is F:\WINDOWS....not sure if that is important
Code:
Category: Startup file does not exist
Location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nwiz
Filename: nwiz.exe
Data:
Category: Startup file does not exist
Location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvMediaCenter
Filename: RunDLL32.exe
Data:
Category: Startup file does not exist
Location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvCplDaemon
Filename: RUNDLL32.EXE
Data:
Location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\PCHealth
Filename: rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 F:\WINDOWS\INF\PCHealth.inf
Data:
here is the code from the registry truncated to only show the relevant startup entries
Code:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.EXE F:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"NvMediaCenter"="RunDLL32.exe NvMCTray.dll,NvTaskbarInit"
here is the registry code for the pchealth string
Code:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PCHealth]
"UninstallString"="rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 F:\\WINDOWS\\INF\\PCHealth.inf"
"QuietUninstallString"="rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 F:\\WINDOWS\\INF\\PCHealth.inf"