Unwanted program starting during bootup sequence in Win ME

Am using Windows ME, IE5, OE5, AVG 7 and 56K dialup Internet. All has
been fine until I recently installed the latest version of Kerio
Personal Firewall configured during setup to be in the Simple Mode,
working with pre-defined network and system rules.

At first boot after installing KPF, nearly all programs installed on the
hard-disk started after Windows ME had loaded. It would seem that KPF,
in the Simple Mode had taken over control of which programs were to
start during bootup of Windows ME. I used registry settings, Startup
Folder, System Configuration and the System Security settings in KPF
(since switched to Advanced Mode) to shut down all unwanted programs
from starting. All except one which presently escapes prevention from
starting.

I've been unable to stop Corel Photo House v1.00 from starting during
bootup. The offending executional is photohse.exe located in the
C:\Corel\Print & Photo House folder. I've searched the registry,
Startup Folder, System Configuration and the System Security settings of
KPF (still in Advanced Mode) for references to photohse.exe and for
links to the same e.g. photohse.pif or photohse.lnk and find none. Even
when I use System Configuration to startup Windows ME in selective
startup mode, the Corel Photo House program still starts at bootup. It
would seem that Corel Photo House starts before the KPF is fully
launched as is evidenced by the later appearance of the KPF icon in the
System Tray.

I've not yet attempted startup in Safe Mode so I can't speak to that
issue. Neither have I investigated the System Restore feature in
Windows ME, since I'm looking for a cause rather than a solution (???).

It's easy to shut down this unwanted program after the bootup sequence
is complete and then carry on computing as per normal...all else works
as expected. Should I give into the fact that KPF has apparently denied
me control of what starts on my computer at bootup or is there a yet
another way to resolve this issue further?

AVG 7 and the latest Ad-aware scanners show no virus or malware.
Ctrl-Alt-Del shows no unexpected programs running in the background
after the Corel Photo House program has been shut down.

TIA...and by the way, happy New Year to all readers of this newsgroup!

default
Wed Dec 29 08:18:52 CST 2004

On Tue, 28 Dec 2004 23:18:51 -0800, "Richard Roseweir"
<richrose@uniserves.com> wrote:

>Am using Windows ME, IE5, OE5, AVG 7 and 56K dialup Internet. All has
>been fine until I recently installed the latest version of Kerio
>Personal Firewall configured during setup to be in the Simple Mode,
>working with pre-defined network and system rules.
>
>At first boot after installing KPF, nearly all programs installed on the
>hard-disk started after Windows ME had loaded. It would seem that KPF,
>in the Simple Mode had taken over control of which programs were to
>start during bootup of Windows ME. I used registry settings, Startup
>Folder, System Configuration and the System Security settings in KPF
>(since switched to Advanced Mode) to shut down all unwanted programs
>from starting. All except one which presently escapes prevention from
>starting.
>
>I've been unable to stop Corel Photo House v1.00 from starting during
>bootup. The offending executional is photohse.exe located in the
>C:\Corel\Print & Photo House folder. I've searched the registry,
>Startup Folder, System Configuration and the System Security settings of
>KPF (still in Advanced Mode) for references to photohse.exe and for
>links to the same e.g. photohse.pif or photohse.lnk and find none. Even
>when I use System Configuration to startup Windows ME in selective
>startup mode, the Corel Photo House program still starts at bootup. It
>would seem that Corel Photo House starts before the KPF is fully
>launched as is evidenced by the later appearance of the KPF icon in the
>System Tray.
>
>I've not yet attempted startup in Safe Mode so I can't speak to that
>issue. Neither have I investigated the System Restore feature in
>Windows ME, since I'm looking for a cause rather than a solution (???).
>
>It's easy to shut down this unwanted program after the bootup sequence
>is complete and then carry on computing as per normal...all else works
>as expected. Should I give into the fact that KPF has apparently denied
>me control of what starts on my computer at bootup or is there a yet
>another way to resolve this issue further?
>
>AVG 7 and the latest Ad-aware scanners show no virus or malware.
>Ctrl-Alt-Del shows no unexpected programs running in the background
>after the Corel Photo House program has been shut down.
>
>TIA...and by the way, happy New Year to all readers of this newsgroup!


I see something similar with Corel Word Perfect. To stop it from
loading (it loads in DOS) I used msconfig and take it out (uncheck)
from the "Environment" tab in msconfig.

C:\WINDOWS\SYSTEM\MSCONFIG.EXE

Just type msconfig in the Start/Run window.

The next time you start windows it will give you some warning or
other, just check the "don't bother me again" box and go on.

How to use msconfig

How to Troubleshoot Using the Msconfig Utility in
Windows Millennium Edition

Article ID : 281995

http://windows.about.com/gi/dynamic/offsite.htm?site=http%3A%2F%2Fsupport.microsoft.com%2Fsupport%2Fkb%2Farticles%2Fq281%2F9%2F95.asp

Richard
Thu Dec 30 11:34:24 CST 2004

Thanks for your reply. Sadly however there is no reference to the Corel
Photo House program or any other Corel program in the Environment tab of
the Configuration Editor. Note also that this problem did not exist
before I installed the Kerio Personal Firewall for the very first time.
Additional self-help reading since I last posted has also yielded no
additional help. My goal is to resolve this before the New Year...time
is a' ticking. Any other ideas?


I see something similar with Corel Word Perfect. To stop it from
loading (it loads in DOS) I used msconfig and take it out (uncheck)
from the "Environment" tab in msconfig.

C:\WINDOWS\SYSTEM\MSCONFIG.EXE

Just type msconfig in the Start/Run window.

The next time you start windows it will give you some warning or
other, just check the "don't bother me again" box and go on.

How to use msconfig

How to Troubleshoot Using the Msconfig Utility in
Windows Millennium Edition

Article ID : 281995

http://windows.about.com/gi/dynamic/offsite.htm?site=http%3A%2F%2Fsuppor
t.microsoft.com%2Fsupport%2Fkb%2Farticles%2Fq281%2F9%2F95.asp

default
Thu Dec 30 15:47:10 CST 2004

On Thu, 30 Dec 2004 09:34:24 -0800, "Richard Roseweir"
<richrose@uniserves.com> wrote:

>Thanks for your reply. Sadly however there is no reference to the Corel
>Photo House program or any other Corel program in the Environment tab of
>the Configuration Editor. Note also that this problem did not exist
>before I installed the Kerio Personal Firewall for the very first time.
>Additional self-help reading since I last posted has also yielded no
>additional help. My goal is to resolve this before the New Year...time
>is a' ticking. Any other ideas?
>
Well that was my best shot . . .

Corel isn't a virus or spyware, so it shouldn't be that hard to
eliminate (theoretically). And Kerio is a firewall and shouldn't be
starting programs, so something is hinky here. (like a masquerading
spyware)

I assume the first thing you tried is going into Corel Photo Shop and
look for preferences that tell it to look for updates or go on line .
. .

You can take the Win.ini and sys.ini and put them in a text editor and
search for references to corel . . .

I use Kerio also but could never get more recent versions to work for
me so settled on 2.1.4. I'm not familiar with the more recent ones
are you seeing it accessing the Internet? Data up and downloading?

The next thing that would seem logical to me is to see if it really is
running. Crl/alt/del shows it? I would assume it does.

If you can, why not try removing photoshop? That should solve the
problem unless something is masquerading as photoshop. Presumably you
could reinstall it if necessary - if that's the case, pay attention to
the install. I'm using Office 7 Pro and there were lots of optional
stuff I never use. (I have earlier and later versions but like 7 Pro)

Lastly, I'd try something like "task info". It tells you what is
running and allows you to shut down a running program (very useful for
virus and spyware progs - without resorting to safe mode). It will
also tell you how it started.

It is pay ware, but the trial version may solve the problem. Task
info is what I use when nothing else works.

Google for it
I have:
http://www.iarsn.com/taskinfo.html

but that wasn't the url I used a few years ago when I downloaded it.

Alan
Thu Dec 30 18:45:17 CST 2004

Try the Startup tab, not the Environment tab.

...Alan

--
Alan Edwards, MS MVP W95/98 Systems
http://dts-l.org/index.html


In microsoft.public.windowsme.general, "Richard Roseweir"
<richrose@uniserves.com> wrote:

>Thanks for your reply. Sadly however there is no reference to the Corel
>Photo House program or any other Corel program in the Environment tab of
>the Configuration Editor. Note also that this problem did not exist
>before I installed the Kerio Personal Firewall for the very first time.
>Additional self-help reading since I last posted has also yielded no
>additional help. My goal is to resolve this before the New Year...time
>is a' ticking. Any other ideas?
>
>
>I see something similar with Corel Word Perfect. To stop it from
>loading (it loads in DOS) I used msconfig and take it out (uncheck)
>from the "Environment" tab in msconfig.
>
>C:\WINDOWS\SYSTEM\MSCONFIG.EXE
>
>Just type msconfig in the Start/Run window.
>
>The next time you start windows it will give you some warning or
>other, just check the "don't bother me again" box and go on.
>
>How to use msconfig
>
>How to Troubleshoot Using the Msconfig Utility in
> Windows Millennium Edition
>
> Article ID : 281995
>
>http://windows.about.com/gi/dynamic/offsite.htm?site=http%3A%2F%2Fsuppor
>t.microsoft.com%2Fsupport%2Fkb%2Farticles%2Fq281%2F9%2F95.asp
>

Alan
Thu Dec 30 18:55:13 CST 2004

Check in Msconfig
(Start-Run-MSCONFIG-Startup tab)
If you cannot see anything in Msconfig then:

Start-Run-msinfo32
Click the + beside Software Environment to expand.
Click Startup Programs
Ctrl+A to Select All, Ctrl+C to Copy.
Paste that information in your message.

...Alan

--
Alan Edwards, MS MVP W95/98 Systems
http://dts-l.org/index.html

In microsoft.public.windowsme.general, "Richard Roseweir"
<richrose@uniserves.com> wrote:


>I've been unable to stop Corel Photo House v1.00 from starting during
>bootup. The offending executional is photohse.exe located in the
>C:\Corel\Print & Photo House folder. I've searched the registry,
>Startup Folder, System Configuration and the System Security settings of
>KPF (still in Advanced Mode) for references to photohse.exe and for
>links to the same e.g. photohse.pif or photohse.lnk and find none. Even
>when I use System Configuration to startup Windows ME in selective
>startup mode, the Corel Photo House program still starts at bootup. It
>would seem that Corel Photo House starts before the KPF is fully
>launched as is evidenced by the later appearance of the KPF icon in the
>System Tray.
>

Jack
Fri Dec 31 11:34:24 CST 2004

The free "Process Explorer" is an excellent alternative "process viewer",
with which one can terminate any unwanted executing process
www.sysinternals.com

Follow Alan Edwards' advice for preventing unwanted programs from launching
at startup.
--
Jack E. Martinelli 2002-05 MS MVP for Shell/User / DTS
Help us help you: http://www.dts-L.org/goodpost.htm

http://www.microsoft.com/athome/security/protect/default.aspx
Your cooperation is very appreciated.
------
"default" <none@defaulter.net> wrote in message
news:73r8t0t4re38hge92grjrc9iu5erensogu@4ax.com...
> On Thu, 30 Dec 2004 09:34:24 -0800, "Richard Roseweir"
> <richrose@uniserves.com> wrote:
>
> >Thanks for your reply. Sadly however there is no reference to the Corel
> >Photo House program or any other Corel program in the Environment tab of
> >the Configuration Editor. Note also that this problem did not exist
> >before I installed the Kerio Personal Firewall for the very first time.
> >Additional self-help reading since I last posted has also yielded no
> >additional help. My goal is to resolve this before the New Year...time
> >is a' ticking. Any other ideas?
> >
> Well that was my best shot . . .
>
> Corel isn't a virus or spyware, so it shouldn't be that hard to
> eliminate (theoretically). And Kerio is a firewall and shouldn't be
> starting programs, so something is hinky here. (like a masquerading
> spyware)
>
> I assume the first thing you tried is going into Corel Photo Shop and
> look for preferences that tell it to look for updates or go on line .
> . .
>
> You can take the Win.ini and sys.ini and put them in a text editor and
> search for references to corel . . .
>
> I use Kerio also but could never get more recent versions to work for
> me so settled on 2.1.4. I'm not familiar with the more recent ones
> are you seeing it accessing the Internet? Data up and downloading?
>
> The next thing that would seem logical to me is to see if it really is
> running. Crl/alt/del shows it? I would assume it does.
>
> If you can, why not try removing photoshop? That should solve the
> problem unless something is masquerading as photoshop. Presumably you
> could reinstall it if necessary - if that's the case, pay attention to
> the install. I'm using Office 7 Pro and there were lots of optional
> stuff I never use. (I have earlier and later versions but like 7 Pro)
>
> Lastly, I'd try something like "task info". It tells you what is
> running and allows you to shut down a running program (very useful for
> virus and spyware progs - without resorting to safe mode). It will
> also tell you how it started.
>
> It is pay ware, but the trial version may solve the problem. Task
> info is what I use when nothing else works.
>
> Google for it
> I have:
> http://www.iarsn.com/taskinfo.html
>
> but that wasn't the url I used a few years ago when I downloaded it.

Richard
Sat Jan 01 13:50:49 CST 2005

Good morning everybody. Thanks for all the ideas. I have eventually
resolved the situation. Using Autoruns v6.4 I was able to detect that
the Corel Photo House was starting during the Windows ME bootup because
of a modified entry in the Task Scheduler. This was somewhere I had
simply not looked before. I have not been able to determine if this
entry had been modified by the Kerio Personal Firewall or not. I simply
deleted the relevant entry and POOF! the problem was no more. Also
resolved by the deadline of year's end. Thanks everybody...a whole lot
of fun and a whole lot of learning as well.


"Alan Edwards" <edwards@southcom.com.au> wrote in message
news:vp89t01oo8kuv4du5k6odip5ibd1k9o3cb@4ax.com...
Check in Msconfig
(Start-Run-MSCONFIG-Startup tab)
If you cannot see anything in Msconfig then:

Start-Run-msinfo32
Click the + beside Software Environment to expand.
Click Startup Programs
Ctrl+A to Select All, Ctrl+C to Copy.
Paste that information in your message.

...Alan

--
Alan Edwards, MS MVP W95/98 Systems
http://dts-l.org/index.html

In microsoft.public.windowsme.general, "Richard Roseweir"
<richrose@uniserves.com> wrote:


>I've been unable to stop Corel Photo House v1.00 from starting during
>bootup. The offending executional is photohse.exe located in the
>C:\Corel\Print & Photo House folder. I've searched the registry,
>Startup Folder, System Configuration and the System Security settings
of
>KPF (still in Advanced Mode) for references to photohse.exe and for
>links to the same e.g. photohse.pif or photohse.lnk and find none.
Even
>when I use System Configuration to startup Windows ME in selective
>startup mode, the Corel Photo House program still starts at bootup. It
>would seem that Corel Photo House starts before the KPF is fully
>launched as is evidenced by the later appearance of the KPF icon in the
>System Tray.
>

cquirke
Sun Jan 02 04:48:36 CST 2005

On Thu, 30 Dec 2004 16:47:10 -0500, default <none@defaulter.net>
>On Thu, 30 Dec 2004 09:34:24 -0800, "Richard Roseweir"
><richrose@uniserves.com> wrote:

>>Thanks for your reply. Sadly however there is no reference to the Corel
>>Photo House program or any other Corel program in the Environment tab

Environment tab lists environment variables, as set by Set, Prompt and
Path statements in Config.sys or Autoexec.bat - it doesn't list code
that runs when Windows starts, as the Startup tab does.

>>of the Configuration Editor. Note also that this problem did not exist
>>before I installed the Kerio Personal Firewall for the very first time.

I've lost prior posts, so unsure of what the problem is. Kerio can be
expected to prompt and ?block attempts by sware to "call home", as
application registration nags will tend to do. This bad application
behaviour is not restricted to unpaid-for shareware either.

>Corel isn't a virus or spyware, so it shouldn't be that hard to
>eliminate (theoretically). And Kerio is a firewall and shouldn't be
>starting programs, so something is hinky here. (like a masquerading
>spyware)

I'm going to assume you've already done a FORMAL virus check...

http://cquirke.mvps.org/9x/virtest.htm

...and used AdAware and Spybot to buldoze away the "easy" bulk of
whatever commercial malware you may have. Else this may be a CWOT.

>I assume the first thing you tried is going into Corel Photo Shop and
>look for preferences that tell it to look for updates or go on line .

>You can take the Win.ini and sys.ini and put them in a text editor and
>search for references to corel . . .

>I use Kerio also but could never get more recent versions to work for
>me so settled on 2.1.4. I'm not familiar with the more recent ones
>are you seeing it accessing the Internet? Data up and downloading?

>The next thing that would seem logical to me is to see if it really is
>running. Crl/alt/del shows it? I would assume it does.

Ctl+Alt+Del won't show intrafile malware (e.g. a code virus that has
infected one of Corel's code files) or code that is patched in as a
driver or service (e.g. via RunServices etc.).

>Lastly, I'd try something like "task info". It tells you what is
>running and allows you to shut down a running program (very useful for
>virus and spyware progs - without resorting to safe mode). It will
>also tell you how it started.

>It is pay ware, but the trial version may solve the problem. Task
>info is what I use when nothing else works.

The PowerToy (or is it Kernel Toy) WinTop will show you services, tho
it won't let you kill them. But stuff operating at this level is
better tackled by formal av scan and anti-cm scans.



>---------- ----- ---- --- -- - - - -
"He's such a character!"
' Yeah - CHAR(0) '
>---------- ----- ---- --- -- - - - -

Alan
Sun Jan 02 04:53:47 CST 2005

In microsoft.public.windowsme.general, "cquirke (MVP Win9x)"
<cquirkenews@nospam.mvps.org> wrote:

>I've lost prior posts, so unsure of what the problem is.

Chris,

To save you using Google...

The last post by the OP, followed by the first post.
(I will spare you all the other responses)

In microsoft.public.windowsme.general, "Richard Roseweir"
<richrose@uniserves.com> wrote:

Good morning everybody. Thanks for all the ideas. I have eventually
resolved the situation. Using Autoruns v6.4 I was able to detect that
the Corel Photo House was starting during the Windows ME bootup
because
of a modified entry in the Task Scheduler. This was somewhere I had
simply not looked before. I have not been able to determine if this
entry had been modified by the Kerio Personal Firewall or not. I
simply
deleted the relevant entry and POOF! the problem was no more. Also
resolved by the deadline of year's end. Thanks everybody...a whole
lot
of fun and a whole lot of learning as well.



In microsoft.public.windowsme.general, "Richard Roseweir"
<richrose@uniserves.com> wrote:


>I've been unable to stop Corel Photo House v1.00 from starting during
>bootup. The offending executional is photohse.exe located in the
>C:\Corel\Print & Photo House folder. I've searched the registry,
>Startup Folder, System Configuration and the System Security settings
of
>KPF (still in Advanced Mode) for references to photohse.exe and for
>links to the same e.g. photohse.pif or photohse.lnk and find none.
Even
>when I use System Configuration to startup Windows ME in selective
>startup mode, the Corel Photo House program still starts at bootup. It
>would seem that Corel Photo House starts before the KPF is fully
>launched as is evidenced by the later appearance of the KPF icon in the
>System Tray.
>

cquirke
Mon Jan 03 19:22:26 CST 2005

On Sun, 02 Jan 2005 21:53:47 +1100, Alan Edwards
>In microsoft.public.windowsme.general, "cquirke (MVP Win9x)"

>>I've lost prior posts, so unsure of what the problem is.

>Chris,

Hi!

>To save you using Google...

You can use Google? :-)

>In microsoft.public.windowsme.general, "Richard Roseweir"

>Good morning everybody. Thanks for all the ideas. I have eventually
>resolved the situation. Using Autoruns v6.4 I was able to detect that
>the Corel Photo House was starting during the Windows ME bootup
>because of a modified entry in the Task Scheduler.

Ah, maybe that's the media indexer thingy (shades of Fast Find)

><richrose@uniserves.com> wrote:

>>I've been unable to stop Corel Photo House v1.00 from starting during
>>bootup. The offending executional is photohse.exe located in the
>>C:\Corel\Print & Photo House folder.

>>when I use System Configuration to startup Windows ME in selective
>>startup mode, the Corel Photo House program still starts at bootup.

I often forget about Tasks, but they are very relevant as they can be
set to run on OS boot or on logon. So effectively, they can operate
as part of startup, as well as an arbitrary-timed intrusion point.



>------------ ----- ---- --- -- - - - -
The most accurate diagnostic instrument
in medicine is the Retrospectoscope
>------------ ----- ---- --- -- - - - -