What is "New value #1"

"PCR" wrote in news:#YQ7CEA6GHA.508
@TK2MSFTNGP06.phx.gbl:

That doesn't look well in Notepad. It should look like...

.....Quote..........
REGEDIT4

That's why I don't go to this newsgroup *unless* I have a problem.

There is so much very interesting good data in these threads that if I see
it and start saving data, well, life is too short. Even with a clipboard
extender!

ms

Is an MPV now :-)

--
I`m not a complete idiot, there`s still a few bits missing
"Dan W." wrote in message
...
kimbo_ wrote:
Thanks for your guidence, I removed the value from the run- key after
backing up the registry and all`s well.
cheers
Kim


Success is great for the soul, spirit and body but don't let it go to
your head. grin

--
Dan W.

Computer User

That's weird. It would appear that the problem is using Notepad in XPx64. It
looks fine here, but there are obviously hidden somethings that other
versions of Notepad see that I don't. Not supposed to be that way. Notepad
is supposed to be a simple pure plain-text reader. Don't think it could be
this OE, but perhaps...

--

Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com/articles/cleanboot.htm
http://grystmill.com/articles/security.htm

"PCR" wrote in message
...
That doesn't look well in Notepad. It should look like...

.....Quote..........
REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run-]
[END]
.....EOQ............

I've fixed & attached it to this post. REMEMBER to do what Terhune said
in MSConfig before merging it. Or do it manually as follows...

(1) Copy all between the dotted lines to a Notepad file.
(2) Name it "HKLM...Del_Run-.REG".
(3) Click the .REG file to delete that key,
AFTER you have done what Terhune said in MSConfig;
otherwise, you lose every item unchecked that is "Machine Run".

In case it's wrapped, the line between the [brackets] is ONE line with
NO space. It has a minus sign (-) at front & back. The minus sign at
front is an instruction to delete that Registry key & all it's contents.
The empty key itself will return at some point.

By default, when a ".reg" is clicked, it will Merge into the Registry.
To alter the default behavior...

(a) "START button, Settings, Folder Options, File Types tab".
(b) Scroll to & click (highlight) "Registration Entries".
(c) Click the "Edit" button.
(d) Select (highlight) "Edit" in the window.
(e) Click the "Set Default" button.

Now, when you click a ".reg" file, it will open in Notepad for
examination. To merge it into the Registry, R-Clk it & select "Merge".


But yours (Terhune's) looks to me like...
....Quote........
ÿþR E G E D I T 4
...snip blank lines...
[ - H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r o s
o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ R u n - ]
...snip blank lines...
.....EOQ...........


--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR

"Gary S. Terhune" wrote in message
...
| Interesting. If nobody's been into the Registry, then it's likely the
result
| of a hastily written script that didn't get prrof-read as well as it
should
| have been. While it's harmless, I'd want to stop and do several formal
| malware scans of your system, just to be sure. Then go into the
Registry and
| remove that New Value from the HKLM...\Run key. (Or from the "Run-"
key if
| it's currently disabled.)
|
| If you really, really don't want to go into the Registry, you can use
the
| following method.
|
| 1. In MSCONFIG, make sure everything on the Startup tab is enabled
*except*
| the New Value item. Any HKLM....\Run item that is left disabled will
be
| removed entirely. Click OK but do not restart.
|
| 2. Save the attached text file to your Desktop, rename it to change
the TXT
| extension to REG, right-click it and select Merge.
|
| --
|
| Gary S. Terhune
| MS-MVP Shell/User
| http://grystmill.com/articles/cleanboot.htm
| http://grystmill.com/articles/security.htm
|
| "kimbo_" wrote in message
| ...
| Thanks Gary, in msinfo32 under the name column it says "new value
#1" then
| under the loaded from column it`s "Registry[machine Run]" and
nothing
| under
| the Command column.
| I haven`t been into the registry and i`m the only user.
| On reflection last week some time limewire said there was an update
which
| I
| allowed it to do, perhaps this is where it came from.
| Thanks
| Kim
|
| --
| I`m not a complete idiot, there`s still a few bits missing
| "Gary S. Terhune" wrote in message
| ...
| Please go to StartRun. Type in MSINFO32 and then press Enter.
This
| will
| launch System Information. Expand the Software section, then click
on
| "Startup Items". In the right-hand pane you will see the same basic
info
| as
| you see in the MSCONFIG Startup tab. The big difference is that
MSINFO32
| will tell you *where* each item is loading from -- Startup Group,
Machine
| Run, Per-User Run, etc. Tell us where "New value #1" is loading
from. It
| will be one of three places: Per-User Run, Machine Run, or Machine
| RunServices (I think that last one is right, but I'm not sure
that's
| precisely the label that MSINFO32 uses.)
|
| The reason I'm sure that it's loading from the Registry is that
whenever
| you
| create a new Value in the Registry, "New Value" is what it's named,
with
| the
| additional number added to differentiate it from other New Values
that
| might
| exist in that Key.
|
| You also don't say what the Command is that "New Value #1" runs.
"New
| Value
| #1" is only a meaningless name, not anything useful to us here. If
you or
| someone else has been into your Registry, then I would say that
it's
| possible that this New Value was created by accident, especially if
there
| is
| no command included. If that's not a reasonable possibility, then
I'd say
| it's almost certainly malware in action. What's important is the
command
| line, so we can investigate what is installed that the command is
| running,
| and knowing where it's loaded from is necessary so that we can
instruct
| you
| on permanent removal from the Startup queue, whether or not it's
actually
| doing anything. You only want things in that list that are actually
doing
| something that you want to happen.
|
| --
|
| Gary S. Terhune
| MS-MVP Shell/User
|
| "kimbo_" wrote in message
| ...
| Hi, I`ve just noticed this new entry in msconfig startup tab "New
value
| #1"
| which was checked, I`ve unchecked it and it appears to make no
| difference
| to
| the running of the machine. Just wondering where it came from and
what
| it
| is, i`ve not installed anything new that i`m aware of. Any ideas
as to
| what
| this is. I`ve ran AVG, spybot and adware which show nothing.
| Thanks
| Kim
|
| --
| I`m not a complete idiot, there`s still a few bits missing
|
|
|
|
|
|
|
|
|
|

The [END] method avoids explanation about that bottom blank line. Too
bad I can't recall who first came up with it here in this NG. That's a
serious failing of Notepad in XPx64, if it can't communicate with us
normal Win98 folk. It's a form of deadly XP-irradiation to which I hope
you find a cure! Can there be a setting in it's menus?


--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR

"Gary S. Terhune" wrote in message
...
| That's weird. It would appear that the problem is using Notepad in
XPx64. It
| looks fine here, but there are obviously hidden somethings that other
| versions of Notepad see that I don't. Not supposed to be that way.
Notepad
| is supposed to be a simple pure plain-text reader. Don't think it
could be
| this OE, but perhaps...
|
| --
|
| Gary S. Terhune
| MS-MVP Shell/User
| http://grystmill.com/articles/cleanboot.htm
| http://grystmill.com/articles/security.htm
|
| "PCR" wrote in message
| ...
| That doesn't look well in Notepad. It should look like...
|
| .....Quote..........
| REGEDIT4
|
| [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run-]
| [END]
| .....EOQ............
|
| I've fixed & attached it to this post. REMEMBER to do what Terhune
said
| in MSConfig before merging it. Or do it manually as follows...
|
| (1) Copy all between the dotted lines to a Notepad file.
| (2) Name it "HKLM...Del_Run-.REG".
| (3) Click the .REG file to delete that key,
| AFTER you have done what Terhune said in MSConfig;
| otherwise, you lose every item unchecked that is "Machine Run".
|
| In case it's wrapped, the line between the [brackets] is ONE line
with
| NO space. It has a minus sign (-) at front & back. The minus sign at
| front is an instruction to delete that Registry key & all it's
contents.
| The empty key itself will return at some point.
|
| By default, when a ".reg" is clicked, it will Merge into the
Registry.
| To alter the default behavior...
|
| (a) "START button, Settings, Folder Options, File Types tab".
| (b) Scroll to & click (highlight) "Registration Entries".
| (c) Click the "Edit" button.
| (d) Select (highlight) "Edit" in the window.
| (e) Click the "Set Default" button.
|
| Now, when you click a ".reg" file, it will open in Notepad for
| examination. To merge it into the Registry, R-Clk it & select
"Merge".
|
|
| But yours (Terhune's) looks to me like...
| ....Quote........
| ÿþR E G E D I T 4
| ...snip blank lines...
| [ - H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r
o s
| o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ R u n - ]
| ...snip blank lines...
| .....EOQ...........
|
|
| --
| Thanks or Good Luck,
| There may be humor in this post, and,
| Naturally, you will not sue,
| should things get worse after this,
| PCR
|
| "Gary S. Terhune" wrote in message
| ...
| | Interesting. If nobody's been into the Registry, then it's likely
the
| result
| | of a hastily written script that didn't get prrof-read as well as
it
| should
| | have been. While it's harmless, I'd want to stop and do several
formal
| | malware scans of your system, just to be sure. Then go into the
| Registry and
| | remove that New Value from the HKLM...\Run key. (Or from the
"Run-"
| key if
| | it's currently disabled.)
| |
| | If you really, really don't want to go into the Registry, you can
use
| the
| | following method.
| |
| | 1. In MSCONFIG, make sure everything on the Startup tab is enabled
| *except*
| | the New Value item. Any HKLM....\Run item that is left disabled
will
| be
| | removed entirely. Click OK but do not restart.
| |
| | 2. Save the attached text file to your Desktop, rename it to
change
| the TXT
| | extension to REG, right-click it and select Merge.
| |
| | --
| |
| | Gary S. Terhune
| | MS-MVP Shell/User
| | http://grystmill.com/articles/cleanboot.htm
| | http://grystmill.com/articles/security.htm
| |
| | "kimbo_" wrote in message
| | ...
| | Thanks Gary, in msinfo32 under the name column it says "new
value
| #1" then
| | under the loaded from column it`s "Registry[machine Run]" and
| nothing
| | under
| | the Command column.
| | I haven`t been into the registry and i`m the only user.
| | On reflection last week some time limewire said there was an
update
| which
| | I
| | allowed it to do, perhaps this is where it came from.
| | Thanks
| | Kim
| |
| | --
| | I`m not a complete idiot, there`s still a few bits missing
| | "Gary S. Terhune" wrote in message
| | ...
| | Please go to StartRun. Type in MSINFO32 and then press
Enter.
| This
| | will
| | launch System Information. Expand the Software section, then
click
| on
| | "Startup Items". In the right-hand pane you will see the same
basic
| info
| | as
| | you see in the MSCONFIG Startup tab. The big difference is that
| MSINFO32
| | will tell you *where* each item is loading from -- Startup
Group,
| Machine
| | Run, Per-User Run, etc. Tell us where "New value #1" is loading
| from. It
| | will be one of three places: Per-User Run, Machine Run, or
Machine
| | RunServices (I think that last one is right, but I'm not sure
| that's
| | precisely the label that MSINFO32 uses.)
| |
| | The reason I'm sure that it's loading from the Registry is that
| whenever
| | you
| | create a new Value in the Registry, "New Value" is what it's
named,
| with
| | the
| | additional number added to differentiate it from other New
Values
| that
| | might
| | exist in that Key.
| |
| | You also don't say what the Command is that "New Value #1"
runs.
| "New
| | Value
| | #1" is only a meaningless name, not anything useful to us here.
If
| you or
| | someone else has been into your Registry, then I would say that
| it's
| | possible that this New Value was created by accident,
especially if
| there
| | is
| | no command included. If that's not a reasonable possibility,
then
| I'd say
| | it's almost certainly malware in action. What's important is
the
| command
| | line, so we can investigate what is installed that the command
is
| | running,
| | and knowing where it's loaded from is necessary so that we can
| instruct
| | you
| | on permanent removal from the Startup queue, whether or not
it's
| actually
| | doing anything. You only want things in that list that are
actually
| doing
| | something that you want to happen.
| |
| | --
| |
| | Gary S. Terhune
| | MS-MVP Shell/User
| |
| | "kimbo_" wrote in message
| | ...
| | Hi, I`ve just noticed this new entry in msconfig startup tab
"New
| value
| | #1"
| | which was checked, I`ve unchecked it and it appears to make
no
| | difference
| | to
| | the running of the machine. Just wondering where it came from
and
| what
| | it
| | is, i`ve not installed anything new that i`m aware of. Any
ideas
| as to
| | what
| | this is. I`ve ran AVG, spybot and adware which show nothing.
| | Thanks
| | Kim
| |
| | --
| | I`m not a complete idiot, there`s still a few bits missing
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
|
|
|
|
|

I created a "Keepers" folder in OE long ago. Looks like I've got 583
posts copied to it, but, right, there is no time to read them. Let's see
how many of Terhune's are in there... 17.


--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR

"ms" wrote in message
...
| "PCR" wrote in news:#YQ7CEA6GHA.508
| @TK2MSFTNGP06.phx.gbl:
|
| That doesn't look well in Notepad. It should look like...
|
| .....Quote..........
| REGEDIT4
|
| That's why I don't go to this newsgroup *unless* I have a problem.
|
| There is so much very interesting good data in these threads that if I
see
| it and start saving data, well, life is too short. Even with a
clipboard
| extender!
|
| ms

I'm going to wait until I get to my 98 machine (maybe tonight, maybe
tomorrow, maybe ???) to look at the file before I go looking for answers.
I'll also see if the same thing happens when I don't do any editing, like I
did with this one (changing first line to REGEDIT4). I'll also transport a
copy using floppy, to see if perhaps it's the OE transport that's doing it.

Or maybe someone who recognizes the problem will come along, explain it all,
and I won't have to do *any* of the above. Hope whoever it is has a fix or a
workaround!

--

Gary S. Terhune
MS-MVP Shell/User
http://grystmill.com/articles/cleanboot.htm
http://grystmill.com/articles/security.htm

"PCR" wrote in message
...
The [END] method avoids explanation about that bottom blank line. Too
bad I can't recall who first came up with it here in this NG. That's a
serious failing of Notepad in XPx64, if it can't communicate with us
normal Win98 folk. It's a form of deadly XP-irradiation to which I hope
you find a cure! Can there be a setting in it's menus?


--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR

"Gary S. Terhune" wrote in message
...
| That's weird. It would appear that the problem is using Notepad in
XPx64. It
| looks fine here, but there are obviously hidden somethings that other
| versions of Notepad see that I don't. Not supposed to be that way.
Notepad
| is supposed to be a simple pure plain-text reader. Don't think it
could be
| this OE, but perhaps...
|
| --
|
| Gary S. Terhune
| MS-MVP Shell/User
| http://grystmill.com/articles/cleanboot.htm
| http://grystmill.com/articles/security.htm
|
| "PCR" wrote in message
| ...
| That doesn't look well in Notepad. It should look like...
|
| .....Quote..........
| REGEDIT4
|
| [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run-]
| [END]
| .....EOQ............
|
| I've fixed & attached it to this post. REMEMBER to do what Terhune
said
| in MSConfig before merging it. Or do it manually as follows...
|
| (1) Copy all between the dotted lines to a Notepad file.
| (2) Name it "HKLM...Del_Run-.REG".
| (3) Click the .REG file to delete that key,
| AFTER you have done what Terhune said in MSConfig;
| otherwise, you lose every item unchecked that is "Machine Run".
|
| In case it's wrapped, the line between the [brackets] is ONE line
with
| NO space. It has a minus sign (-) at front & back. The minus sign at
| front is an instruction to delete that Registry key & all it's
contents.
| The empty key itself will return at some point.
|
| By default, when a ".reg" is clicked, it will Merge into the
Registry.
| To alter the default behavior...
|
| (a) "START button, Settings, Folder Options, File Types tab".
| (b) Scroll to & click (highlight) "Registration Entries".
| (c) Click the "Edit" button.
| (d) Select (highlight) "Edit" in the window.
| (e) Click the "Set Default" button.
|
| Now, when you click a ".reg" file, it will open in Notepad for
| examination. To merge it into the Registry, R-Clk it & select
"Merge".
|
|
| But yours (Terhune's) looks to me like...
| ....Quote........
| ÿþR E G E D I T 4
| ...snip blank lines...
| [ - H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i c r
o s
| o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ R u n - ]
| ...snip blank lines...
| .....EOQ...........
|
|
| --
| Thanks or Good Luck,
| There may be humor in this post, and,
| Naturally, you will not sue,
| should things get worse after this,
| PCR
|
| "Gary S. Terhune" wrote in message
| ...
| | Interesting. If nobody's been into the Registry, then it's likely
the
| result
| | of a hastily written script that didn't get prrof-read as well as
it
| should
| | have been. While it's harmless, I'd want to stop and do several
formal
| | malware scans of your system, just to be sure. Then go into the
| Registry and
| | remove that New Value from the HKLM...\Run key. (Or from the
"Run-"
| key if
| | it's currently disabled.)
| |
| | If you really, really don't want to go into the Registry, you can
use
| the
| | following method.
| |
| | 1. In MSCONFIG, make sure everything on the Startup tab is enabled
| *except*
| | the New Value item. Any HKLM....\Run item that is left disabled
will
| be
| | removed entirely. Click OK but do not restart.
| |
| | 2. Save the attached text file to your Desktop, rename it to
change
| the TXT
| | extension to REG, right-click it and select Merge.
| |
| | --
| |
| | Gary S. Terhune
| | MS-MVP Shell/User
| | http://grystmill.com/articles/cleanboot.htm
| | http://grystmill.com/articles/security.htm
| |
| | "kimbo_" wrote in message
| | ...
| | Thanks Gary, in msinfo32 under the name column it says "new
value
| #1" then
| | under the loaded from column it`s "Registry[machine Run]" and
| nothing
| | under
| | the Command column.
| | I haven`t been into the registry and i`m the only user.
| | On reflection last week some time limewire said there was an
update
| which
| | I
| | allowed it to do, perhaps this is where it came from.
| | Thanks
| | Kim
| |
| | --
| | I`m not a complete idiot, there`s still a few bits missing
| | "Gary S. Terhune" wrote in message
| | ...
| | Please go to StartRun. Type in MSINFO32 and then press
Enter.
| This
| | will
| | launch System Information. Expand the Software section, then
click
| on
| | "Startup Items". In the right-hand pane you will see the same
basic
| info
| | as
| | you see in the MSCONFIG Startup tab. The big difference is that
| MSINFO32
| | will tell you *where* each item is loading from -- Startup
Group,
| Machine
| | Run, Per-User Run, etc. Tell us where "New value #1" is loading
| from. It
| | will be one of three places: Per-User Run, Machine Run, or
Machine
| | RunServices (I think that last one is right, but I'm not sure
| that's
| | precisely the label that MSINFO32 uses.)
| |
| | The reason I'm sure that it's loading from the Registry is that
| whenever
| | you
| | create a new Value in the Registry, "New Value" is what it's
named,
| with
| | the
| | additional number added to differentiate it from other New
Values
| that
| | might
| | exist in that Key.
| |
| | You also don't say what the Command is that "New Value #1"
runs.
| "New
| | Value
| | #1" is only a meaningless name, not anything useful to us here.
If
| you or
| | someone else has been into your Registry, then I would say that
| it's
| | possible that this New Value was created by accident,
especially if
| there
| | is
| | no command included. If that's not a reasonable possibility,
then
| I'd say
| | it's almost certainly malware in action. What's important is
the
| command
| | line, so we can investigate what is installed that the command
is
| | running,
| | and knowing where it's loaded from is necessary so that we can
| instruct
| | you
| | on permanent removal from the Startup queue, whether or not
it's
| actually
| | doing anything. You only want things in that list that are
actually
| doing
| | something that you want to happen.
| |
| | --
| |
| | Gary S. Terhune
| | MS-MVP Shell/User
| |
| | "kimbo_" wrote in message
| | ...
| | Hi, I`ve just noticed this new entry in msconfig startup tab
"New
| value
| | #1"
| | which was checked, I`ve unchecked it and it appears to make
no
| | difference
| | to
| | the running of the machine. Just wondering where it came from
and
| what
| | it
| | is, i`ve not installed anything new that i`m aware of. Any
ideas
| as to
| | what
| | this is. I`ve ran AVG, spybot and adware which show nothing.
| | Thanks
| | Kim
| |
| | --
| | I`m not a complete idiot, there`s still a few bits missing
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
|
|
|
|
|

"kimbo_" wrote in message
...
| Thanks for your guidence, I removed the value from the run- key after
| backing up the registry and all`s well.
| cheers
| Kim

Glad to hear that.

| --
| I`m not a complete idiot, there`s still a few bits missing

LOL.

| "Dan W." wrote in message
| ...
| kimbo_ wrote:
| Thanks Gary, in msinfo32 under the name column it says "new value
#1"
| then
| under the loaded from column it`s "Registry[machine Run]" and
nothing
| under
| the Command column.
| I haven`t been into the registry and i`m the only user.
| On reflection last week some time limewire said there was an
update
| which I
| allowed it to do, perhaps this is where it came from.
| Thanks
| Kim
|
|
| Please Kim, if you do enter the registry then make certain that it
is at
| first backed up. Any changes may render your computer not bootable
or
| at least not easily bootable.
|
| --
| Dan W.
|
| Computer User
|
|

kimbo_ wrote:
Is an MPV now :-)


Sorry, long day -- I cannot detect the acronym and thanks in advance I
guess. :-

--
Dan W.

Computer User

OK. Sounds like you'll get to bottom of it, if that can be done. The one
I attached reads in well for me. So, it isn't something on my end. Can
you run a Win98 Notepad on that XPx64 machine & would it make
difference?


--
Thanks or Good Luck,
There may be humor in this post, and,
Naturally, you will not sue,
should things get worse after this,
PCR

"Gary S. Terhune" wrote in message
...
| I'm going to wait until I get to my 98 machine (maybe tonight, maybe
| tomorrow, maybe ???) to look at the file before I go looking for
answers.
| I'll also see if the same thing happens when I don't do any editing,
like I
| did with this one (changing first line to REGEDIT4). I'll also
transport a
| copy using floppy, to see if perhaps it's the OE transport that's
doing it.
|
| Or maybe someone who recognizes the problem will come along, explain
it all,
| and I won't have to do *any* of the above. Hope whoever it is has a
fix or a
| workaround!
|
| --
|
| Gary S. Terhune
| MS-MVP Shell/User
| http://grystmill.com/articles/cleanboot.htm
| http://grystmill.com/articles/security.htm
|
| "PCR" wrote in message
| ...
| The [END] method avoids explanation about that bottom blank line.
Too
| bad I can't recall who first came up with it here in this NG. That's
a
| serious failing of Notepad in XPx64, if it can't communicate with us
| normal Win98 folk. It's a form of deadly XP-irradiation to which I
hope
| you find a cure! Can there be a setting in it's menus?
|
|
| --
| Thanks or Good Luck,
| There may be humor in this post, and,
| Naturally, you will not sue,
| should things get worse after this,
| PCR
|
| "Gary S. Terhune" wrote in message
| ...
| | That's weird. It would appear that the problem is using Notepad in
| XPx64. It
| | looks fine here, but there are obviously hidden somethings that
other
| | versions of Notepad see that I don't. Not supposed to be that way.
| Notepad
| | is supposed to be a simple pure plain-text reader. Don't think it
| could be
| | this OE, but perhaps...
| |
| | --
| |
| | Gary S. Terhune
| | MS-MVP Shell/User
| | http://grystmill.com/articles/cleanboot.htm
| | http://grystmill.com/articles/security.htm
| |
| | "PCR" wrote in message
| | ...
| | That doesn't look well in Notepad. It should look like...
| |
| | .....Quote..........
| | REGEDIT4
| |
| |
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run-]
| | [END]
| | .....EOQ............
| |
| | I've fixed & attached it to this post. REMEMBER to do what
Terhune
| said
| | in MSConfig before merging it. Or do it manually as follows...
| |
| | (1) Copy all between the dotted lines to a Notepad file.
| | (2) Name it "HKLM...Del_Run-.REG".
| | (3) Click the .REG file to delete that key,
| | AFTER you have done what Terhune said in MSConfig;
| | otherwise, you lose every item unchecked that is "Machine
Run".
| |
| | In case it's wrapped, the line between the [brackets] is ONE
line
| with
| | NO space. It has a minus sign (-) at front & back. The minus
sign at
| | front is an instruction to delete that Registry key & all it's
| contents.
| | The empty key itself will return at some point.
| |
| | By default, when a ".reg" is clicked, it will Merge into the
| Registry.
| | To alter the default behavior...
| |
| | (a) "START button, Settings, Folder Options, File Types tab".
| | (b) Scroll to & click (highlight) "Registration Entries".
| | (c) Click the "Edit" button.
| | (d) Select (highlight) "Edit" in the window.
| | (e) Click the "Set Default" button.
| |
| | Now, when you click a ".reg" file, it will open in Notepad for
| | examination. To merge it into the Registry, R-Clk it & select
| "Merge".
| |
| |
| | But yours (Terhune's) looks to me like...
| | ....Quote........
| | ÿþR E G E D I T 4
| | ...snip blank lines...
| | [ - H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ M i
c r
| o s
| | o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ R u n - ]
| | ...snip blank lines...
| | .....EOQ...........
| |
| |
| | --
| | Thanks or Good Luck,
| | There may be humor in this post, and,
| | Naturally, you will not sue,
| | should things get worse after this,
| | PCR
| |
| | "Gary S. Terhune" wrote in message
| | ...
| | | Interesting. If nobody's been into the Registry, then it's
likely
| the
| | result
| | | of a hastily written script that didn't get prrof-read as well
as
| it
| | should
| | | have been. While it's harmless, I'd want to stop and do
several
| formal
| | | malware scans of your system, just to be sure. Then go into
the
| | Registry and
| | | remove that New Value from the HKLM...\Run key. (Or from the
| "Run-"
| | key if
| | | it's currently disabled.)
| | |
| | | If you really, really don't want to go into the Registry, you
can
| use
| | the
| | | following method.
| | |
| | | 1. In MSCONFIG, make sure everything on the Startup tab is
enabled
| | *except*
| | | the New Value item. Any HKLM....\Run item that is left
disabled
| will
| | be
| | | removed entirely. Click OK but do not restart.
| | |
| | | 2. Save the attached text file to your Desktop, rename it to
| change
| | the TXT
| | | extension to REG, right-click it and select Merge.
| | |
| | | --
| | |
| | | Gary S. Terhune
| | | MS-MVP Shell/User
| | | http://grystmill.com/articles/cleanboot.htm
| | | http://grystmill.com/articles/security.htm
| | |
| | | "kimbo_" wrote in message
| | | ...
| | | Thanks Gary, in msinfo32 under the name column it says "new
| value
| | #1" then
| | | under the loaded from column it`s "Registry[machine Run]"
and
| | nothing
| | | under
| | | the Command column.
| | | I haven`t been into the registry and i`m the only user.
| | | On reflection last week some time limewire said there was an
| update
| | which
| | | I
| | | allowed it to do, perhaps this is where it came from.
| | | Thanks
| | | Kim
| | |
| | | --
| | | I`m not a complete idiot, there`s still a few bits missing
| | | "Gary S. Terhune" wrote in message
| | | ...
| | | Please go to StartRun. Type in MSINFO32 and then press
| Enter.
| | This
| | | will
| | | launch System Information. Expand the Software section,
then
| click
| | on
| | | "Startup Items". In the right-hand pane you will see the
same
| basic
| | info
| | | as
| | | you see in the MSCONFIG Startup tab. The big difference is
that
| | MSINFO32
| | | will tell you *where* each item is loading from -- Startup
| Group,
| | Machine
| | | Run, Per-User Run, etc. Tell us where "New value #1" is
loading
| | from. It
| | | will be one of three places: Per-User Run, Machine Run, or
| Machine
| | | RunServices (I think that last one is right, but I'm not
sure
| | that's
| | | precisely the label that MSINFO32 uses.)
| | |
| | | The reason I'm sure that it's loading from the Registry is
that
| | whenever
| | | you
| | | create a new Value in the Registry, "New Value" is what
it's
| named,
| | with
| | | the
| | | additional number added to differentiate it from other New
| Values
| | that
| | | might
| | | exist in that Key.
| | |
| | | You also don't say what the Command is that "New Value #1"
| runs.
| | "New
| | | Value
| | | #1" is only a meaningless name, not anything useful to us
here.
| If
| | you or
| | | someone else has been into your Registry, then I would say
that
| | it's
| | | possible that this New Value was created by accident,
| especially if
| | there
| | | is
| | | no command included. If that's not a reasonable
possibility,
| then
| | I'd say
| | | it's almost certainly malware in action. What's important
is
| the
| | command
| | | line, so we can investigate what is installed that the
command
| is
| | | running,
| | | and knowing where it's loaded from is necessary so that we
can
| | instruct
| | | you
| | | on permanent removal from the Startup queue, whether or not
| it's
| | actually
| | | doing anything. You only want things in that list that are
| actually
| | doing
| | | something that you want to happen.
| | |
| | | --
| | |
| | | Gary S. Terhune
| | | MS-MVP Shell/User
| | |
| | | "kimbo_" wrote in message
| | | ...
| | | Hi, I`ve just noticed this new entry in msconfig startup
tab
| "New
| | value
| | | #1"
| | | which was checked, I`ve unchecked it and it appears to
make
| no
| | | difference
| | | to
| | | the running of the machine. Just wondering where it came
from
| and
| | what
| | | it
| | | is, i`ve not installed anything new that i`m aware of.
Any
| ideas
| | as to
| | | what
| | | this is. I`ve ran AVG, spybot and adware which show
nothing.
| | | Thanks
| | | Kim
| | |
| | | --
| | | I`m not a complete idiot, there`s still a few bits
missing
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| |
| |
| |
| |
| |
|
|
|
|

"Gary S. Terhune" wrote:

That's weird. It would appear that the problem is using Notepad in
XPx64. It looks fine here, but there are obviously hidden
somethings that other versions of Notepad see that I don't. Not
supposed to be that way. Notepad is supposed to be a simple pure
plain-text reader. Don't think it could be this OE, but perhaps...

Gary, it seems you and Dan both have problems with 'encoding'
currently.

Notepad 5.1 silently opens and then resaves pure-text unicode-encoded
plain text files.
If you still have the *.reg file _PCR_ followed up about, open that
with WinXP Notepad and then choose 'Save as ..." Look at the 'save as'
window, at the bottom you can choose an encoding-scheme.
If one open a blank-document, for me, it defaults to saving in ANSI-
encoding, you probably opened and edited then saved a previous unicode-
encoded Text-document .. and that Win98 Notepad no habla.

WinXP Regedit saves ver.5 reg.-exports unicode-encoded.
WinXP Regedit saves ver.4 reg.-exports ANSI-encoded.
Changing the first line in Notepad from 'Windows Registry Editor
Version 5.00' to 'RegEdit4' is not enough to make a Ver.5 Reg.-export
then work under Win98, (i have not tested if it RegEdit can merge it,
but Notpad can't correctly display and edit it for you), as it will
still be wrongly encoded.

I guess _PCR_ will take this as consequences of being /XP-irradiated/ .

--
"'How are you?' he said to me,
I said it back to him."

Please followup in the newsgroup.
E-mail address is invalid due to spam-control.