Cherryman,

 

Is this the Microsoft KB article with registry edits that you checked? http://support.microsoft.com/kb/555294

 

Try using this tweak from Kellys-Korner.  Scroll down to number 255.  Click on "My Documents Folder Opens Upon Boot ( for C:\). 

http://www.kellys-korner-xp.com/xp_tweaks.htm

Let us know how you fare.

 

Tony

I checked them, and they are correct. There is no redundant Explorer.exe, and the userinit is correct as well. Anything else you can think of? The advice is MUCH appreciated!

I tried the tweak, to no avail. Arrgghh,,,

Karl

I tried Denny's link for tweaks, as well, but there is a cryptic tip in there "

Another checkpoint:  In the right pane, check your settings under Load:  Start/Run/Regedit

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows" It doesn't state what is supposed to be the setting. I show no data at all, it is blank. Is it supposed to be?

Cherryman,

 

I think you're in the right section of the registry.  Check the following:

 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\

 

You should see a list of keys under that such as:

crypt32chain

cryptnet

cscdll

igfxcui

ScCertProp

Schedule

sclgntfy

SensLogn

termsrv

WGALogon

wlballoon

 

Look for a key that is obviously garbage; i.e., ObgAcFxbcd.  Usually, when the My Documents folder opens at start up, there's some garbage in the WinLogon\Notify section put there by a virus or malware.  Sometimes the garbabe remains after the virus or malware is removed from the system.

 

If you find something, be sure to create a restore point before removing it.

 

Let us know if you find anything.

 

Tony

 

Tony,
Is there a specific list for the registry items? I do have something in there, for an anti spyware program I believe. Should I just create a restore point, then delete it?
Karl 

Cherryman,

 

The registry items I listed are pretty much the standard list, but there can be more legitimate entries.  Definitely create a restore point before deleting any registry entry.  What is the name of the antispyware program associated with the suspicious entry that you found?

 

Tony

Tony,

The name is: !ISASWINLOGON FROM "SuperAntispyware" I haven't deleted it yet. But I may uninstall that program if you think it will help..
Karl

Karl,

 

If you click on the !SASWinlogon key, in the right hand pane beside DllName you should see

C:\Program Files\SUPERAntiSpyware\SASWINLO.dll   That is a legitimate dynamic library link.

 

Click on each of the keys in the WinLogon\Notify, in the right hand pane beside DllName, there should be a DLL listed as the key value.  If one shows a program path such as C:\Documents and Settings\Username\My Documents, then that's probably the culprit.  If you find it, let us know BEFORE changing or deleting anything.  By all means, create a system restore point and a registry backup before making changes.

 

Another possible cause for the My Documents folder opening at startup is a corrupt Userinit at logon.

 

Check this as follows:

 

Open regedit. Navigate to:

HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Winlogon

In the right pane look for a value labeled Userinit.

IF the data for this key shows a duplicated value such as the following:

C:\windows\system32\userinit.exe,C:\windows\system32\userinit.exe,

Double click on the Userinit value. Edit the data so that the value reads as follows:

C:\windows\system32\userinit.exe,

Exit registry edit and reboot.

 

If that fails to fix the problem then continue as follows:

 

Apparently, you have SuperAntiSpyware installed.  That's good.  You can use it to attempt to fix your problem.

 

Open SuperAntiSpyware.  Click on the  Preferences button.  The SuperAntiSpyware Control Center window will open.  Click on the Repairs tab.  In the System and Browser Repair Items window, you can click on each item and then click on the Perform Repair... button.  In your case, I would probably reset/repair the Winlogon shell as well as the items relating to the Desktop.  If you desire, you can reset/repair all the items. You may lose a legitimate startup item, but at least you will be working with a clean slate so to speak.

 

Let us know what you find.

 

Tony