2 strange items in startup

[Bluemeanie]

Ever since installing Avast 6 (free) I've noticed that it takes about 10-15 seconds for the startup sound to play after the desktop icons are first displayed. With my previous AV it was almost immediate. This morning I got to poking around and found 2 strange items in the startup section of Msconfig. They both were a box type symnbol and pointed to HKCU/SOFTWARE/Microsoft/Windows NT/Currentversion/Windows followed by a colon then load and run. So I removed (unchecked them), upon reboot there were 2 more of them with different symbols that were checked to run and the 2 I unchecked, along with warnings at startup that the box symbol couldn't be started. Oh, before I unchecked them I looked at the entries in the registry and they were there but looked empty, after this startup where the 2 new entries showed up the box symbol was in the load entry. Figuring I was one step away from restoring from my latest backup I removed that symbol from the entry (20/20 hindsight I should have exported it first) and rebooted. Now those entries are gone from msconfig and the startup sound plays as soon as the desktop icons are displayed, just like before I installed Avast. Any ideas as to what happened and where these entries came from?

[Cast]

Remnants of your previous av?

[Pondus]

and also, for a second opinion....have you run a quick scan with a fully updated Malwarebytes!

[Bluemeanie]

Yes. I actually ran a full scan with Malwarebytes and it was clean. About the only thing I haven't done is a boot time scan. Also ran a full scan with SuperAntiSpyware and other than cookies it was clean.
I did think about it being left over from my last AV, but if that was the case they shouldn't (or a derivative of them) have come back after I deleted them this morning.
I'm at a loss at this point. But since something put them back it's almost like there's something hiding in here.

[Pondus]

If you want essexboy to have a look inside ?

follow this guide and post (attach) an OTS log here

http://forum.avast.com/index.php?topic=53253.0



lower left corner > additional options > attach

[ady4um]

Or maybe, if you suspect it might be a residual of your previous AV, then running the appropriate Uninstall Tool from http://thewebatom.net/uninstallers/security-software/ would solve the problem?

It might be worth to run the specific uninstallation utility of your previous AV under Windows Safe Mode, so you would avoid any interferences. Download the correct tool, reboot into Safe mode, run it, reboot.

All other suggestions from previous posts are still valid, of course.

[Bluemeanie]

Might not be a bad idea. Even tho Malwarebytes was clean, do you want to see the log from that. And with any luck I've attached the OTS log.

[Bluemeanie]

Anyone had a chance to look at the OTS log?

[DavidR]

Unfortunately there aren't that many trained or experienced with the OTS tool. Essexboy who usually checks these out has a problem with his main computer and having to borrow one, so he is playing catch-up. It may be tomorrow before he is able to get back on the forums.

[ady4um]

Anyone had a chance to look at the OTS log?

In the meantime, maybe you could check the other suggestions already posted, like running the cleaning utilities of previously (un)installed security tools.

[Para-Noid]

This link may help http://uninstallers.blogspot.com/ 

[Nesivos]

When you go into msconfig it lists an "Item Name", "Manufacturer" and "Location" for each startup item along with its Registry information.

Just curious: What did the items that you deleted say under "Item Name", "Manufacturer" and "Location"?

 

[Bluemeanie]

In the first case, the item name was the box symbol, manufacturer was blank, and the location was the registry key. When the 2 new ones were added the difference was the 2 new ones had a name of the box symbol and a few characters after them.
I have run the removal tools for all the old security programs I've ever used, do that right after I uninstall them, lesson learned many many years ago, back when moby dick was still a guppy. Tho looking at some of what's in the application data folder, it does make me wonder, but then again, I don't know how to read the ots log.
If it matters, the first boot of the day still takes 10-15 seconds from the time that the desktop icons are displayed until the startup sound occurs, after that any boot the sound is within a second. I realize that there are things that will run that first time, but it never did this before.

[DavidR]

I have asked if essexboy has time can he take a look at it for you.

[essexboy]

Hi back up on my new system now, reference the OTS log all I saw was one old reference to AVG7 in the appdata folder.  That would not cause any problems

Have you tried setting Avast to delay startup