Avast WEBforum
Consumer Products => Avast Free Antivirus / Premium Security (legacy Pro Antivirus, Internet Security, Premier) => Topic started by: papadiva on October 10, 2012, 12:33:07 PM
-
Hi y'all.
Since a week or so I encountered a strange phenomenon.
Everytime I start my laptop (Lenovo U310, W7) the Windows explorer is started up spontaneously.
I visited several forums for this issue and they all suggested I should try this:
msconfig - startup - disable all applications.
When I do this, after the first next startup explorer appears again, and when I check the settings in msconfig again, I see that the upper line contains Avast and it is enabled. I did NOT enable this line, so I reckon Avast does it automatically, confirming my suspicion that Avast causes explorer to start after laptop-startup.
Can anybody at Avast explain this?
Thanks in advance,
Jim
-
What folder does windows explorer open at ?
This is something which is commonly seen when a command to run a program/file is left behind after the program or file has been removed.
I have seen this in the past and it had nothing to do with avast as I have also had it a considerably long time ago before I even had avast and I have had avast eight and a half years.
The avast program is protected by the avast self-defence module, so it may be stopping you removing the entry in msconfig or it being replaced, which I believe is for the avastUI.exe, the avast User Interface and tray icon.
-
It seems as the explorer is started from 'My Computer' because all I see are the harddiscs in my laptop (C: and D:), and, when connected, the external drives.
-
That isn't something I have experienced, as it has generally been in a folder rather than at such a low level.
If it is truly my computer there should/would be some sort of call to open it on boot, be that in the MSCONFIG Startup tab or registry entry. Since you have tried checking and disabling items in the Startup tab, makes it all the more strange, are there any entries in there which make calls to either explorer.exe or any unknown program/process ?
But as I have said this is notoriously difficult to pin down.
-
No, avast! doesn't start the Explorer.
I remember I had the same problem once, but unfortunately I'm not sure how I solved that.
When you use regedit, what is the content of the "Shell" value in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ?
-
Yes, there was a forum where they adviced me to check the registry, and lookup the string:
"Shell"="Explorer.exe"
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
But it all is right there, so this didn't solve the issue.
But I will look (when there's time!) at all applications I regularly start, but until now no anomalies there!
-
Download CCleaner (http://www.piriform.com/ccleaner)
In it goto Tools>Startups. What to you have there?
-
Hi bob3160,
Thx for the input.
I started CCleaner but I don't see a difference with msconfig - startups
Scanning for the string 'explorer.exe' (in all tabs) doesn't give any result either
-
Any help http://www.addictivetips.com/windows-tips/windows-7-open-windows-explorer-as-my-computer-drive-view/
-
Try this;
Open Windows Explorer,
Press the Alt key and click Tools>Folder Options
Under the "View" tab, make sure that "Restore previous logon folders at startup" is unchecked.
-
I remember the problem Igor mentioned. It was caused by duplicate entries in the registry.
See attachment.
Hopefully this will help.
EDIT- I see you posted here. -> http://208.74.204.134/t5/IdeaPad-Y-U-V-Z-and-P-series/U310-Windows-Explorer-Libraries-opens-on-every-startup-revisited/td-p/880187
-
Yes Charib, I posted it at the Lenovo forum too and I followed their suggestions, as I already mentioned, but the winlogon - line didn't show any odd duplicates or whatever. In other words, it was all correct so it didn't solve this riddle :'(
I'm asking myself whether there is no other Lenovo U310 (or other models - perhaps i.c.w. Avast) user with this same issue.
-
Have you Checked your "Folder Options" ???
-
Which of the options for 'Folder options' should I look for?
I don't see any option how to start or cancel explorer at startup.
-
Which of the options for 'Folder options' should I look for?
I don't see any option how to start or cancel explorer at startup.
(http://my.jetscreenshot.com/2701/m_20121017-9u0s-54kb.jpg) (http://my.jetscreenshot.com/2701/20121017-9u0s-54kb)
-
Check!
Same (= No) result, at the next startup explorer still shows.
:'(
-
Thanks Ryan,
My system just restarted and the Libraries Folder didn't pop up.
I followed the outline in the link you had posted:
http://www.techspot.com/vb/topic21035.html (http://www.techspot.com/vb/topic21035.html)
1.Start>Run>Regedit>ok
2.Now navigate to the following key:-
HKEY_ LOCAL_ MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
3.Look down the list in the Right Hand pane,scroll down to the value Userinit This value should read: C:\WINDOWS\system32\userinit.exe, (The comma at the end must also be there)
4.If the value is different from that mentioned above then Right Click on the Userinit value and, from the drop down menu, select Modify. Type in the value C:\WINDOWS\system32\userinit.exe,in the Modify dialogue box click OK
5.Exit the Registry.Restart your computer.
Thanks
Ok I think this should finally fix your problem:
http://forum.avast.com/index.php?topic=74950.msg621292#msg621292 (http://forum.avast.com/index.php?topic=74950.msg621292#msg621292)
It did the trick when I had the problem and I believe it also took care of Igor's problem.
-
Thx bob3160, I appreciate your input, but this didn't work either.
It was already unchecked.
-
Thx bob3160, I appreciate your input, but this didn't work either.
It was already unchecked.
??? Had nothing to do with unchecking so I don't know what you meant by your answer.
-
I searched the registry and I found out that there are TWO winlogons:
HKEY_ LOCAL_ MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
C:\WINDOWS\system32\userinit.exe,
HKEY_ LOCAL_ MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon
userinit.exe
I know that the 1st winlogon is mandatory, while the second seems to be needed when using the 64-bit version, but does it really?
-
***
If you are running W7 64-bit, then that is a legitimate key.
But, there is also malware related to this key.
I suggest you post this in the "Virus & Worms" section.
Read the sticky post at the top of that section on what to use & what to attach so that help can be given.
***
-
I searched the registry and I found out that there are TWO winlogons:
HKEY_ LOCAL_ MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
C:\WINDOWS\system32\userinit.exe,
HKEY_ LOCAL_ MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon
userinit.exe
I know that the 1st winlogon is mandatory, while the second seems to be needed when using the 64-bit version, but does it really?
Based on what has been said before it appears that these these entries require a comma after the path as in your first reference:
HKEY_ LOCAL_ MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
C:\WINDOWS\system32\userinit.exe,
But your second reference in the Wow6432Node registry key doesn't have the comma after the userinit.exe reference.
Now I don't know if this is just a typo on your part or not ?
If it isn't a typo, then try adding the comma after the path value in the second registry key you posted and see if that makes a difference.
I'm also not sure if the path is correct as it only shows the file name and no full path before it, perhaps that too is required.
####
If there are any other 64bit OS users that can check that same registry key and see what the correct value should be.
-
This should be the key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon
and when clicking on Winlogon you should see this
-
Thanks for the confirmation Craig.
@ papadiva
Yep as mentioned that userinit.exe must have a comma after the value, so if it wasn't a typo the Userinit value needs to be changed to userinit.exe, and hopefully that will resolve this.
-
I searched the registry and I found out that there are TWO winlogons:
HKEY_ LOCAL_ MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
C:\WINDOWS\system32\userinit.exe,
HKEY_ LOCAL_ MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon
userinit.exe
I know that the 1st winlogon is mandatory, while the second seems to be needed when using the 64-bit version, but does it really?
My registry looks exactly like what I have quoted from papadiva - no comma after userinit.exe in Wow6432Node registry entry. I have a 64bit system and have no problems.
@papadiva - please make certain you have a plan to start your computer and have your important info backed up before you make any changes to the registry just in case something doesn't go as planned.
***
If you are running W7 64-bit, then that is a legitimate key.
But, there is also malware related to this key.
I suggest you post this in the "Virus & Worms" section.
Read the sticky post at the top of that section on what to use & what to attach so that help can be given.
***
CharleyO made a very good suggestion. Even if it is not malware, the problem may be found by one of the tools used by the malware removal experts.
-
Oh well, what I already expected: the comma after the 2nd userinit in my registry doesn't matter.
In other words, with or without comma, explorer keeps popping up after W7 startup.
But I will have a further look, some guys at the Lenovo and Microsoft forum gave me some interesting suggestions too.
Of course, when either of you had the ultimate and final solution, I will also inform the other forums (fora?)
-
If you haven't got the comma, it certainly wouldn't hurt or take long to add/test the theory.
-
The information I had posted specifically mentioned that the comma (,) is required following the exe.
We can only post and offer suggestions. We depend on you to follow those suggestions. :)
-
DavidR, bob3160,
I did add that comma after userinit, but the result is the same: explorer keeps popping up after W7 startup.
Thanks for the input, the search goes on :)
However, I switched to 'viruses and worms' with this same question (DavidR is there too!) as I don't think anymore that this winlogon thing is causing this issue.
Some are thinking that I removed a certain program that's causing this because of its -uh- residu's.