Hi, I found Start item controls in Spybot, so was experimenting with turning some off to ease the pressure on a decrepit circa 1996 PC I've had to start using suddenly. It is an inherited former office computer, which had other original users and was on a network at times. Tons of remnants of unused and mysterious old programs remain, and I have taken off what I could figure out. I saw that there were *19* start entries for RunOnce, not pointing to particular programs (in the viewable areas of the entry lines), but just to places like c:\programs... followed by c:\windows\system... I turned them all off, and I'm still running, so..? I'm not a developer or anything, just word processing, emailing and net browsing really. From what I read on the web, it looks like those kind of entries don't need to be there unless you just Add/Removed or installed something. But mine stayed there after reboots with no changes made... Would you guess that they were probably things I didn't need? I am under the impression that they should *only* be there if something new was done; and none of them named/pointed to an associated program (unless the name appears in the cut-off part of the line entry, but on all the other entry lines I could see program names displayed). But I want to make sure I haven't disabled anything I need. I left all start entries for things I recognize and do want to run at start up, but hope I haven't shut off what were actually another layer of the operation of those things. (I did guess at turning off some other stuff, like something called AccessRamp and even WebBrowser-something-or-other, and seem to be fine. It's just that the former user of this computer put on so much unnecessary crap and trial programs, all of which are ancient now and untouched, that I assume tons of stuff in there is useless and a drag on the system. And for much of it, I may have even removed its parent application.) I know there is RunOnce-related spyware, but I haven't looked at that as a possible explanation yet... Don't really know how to, as not all online or software diagnostics run on Win 95... Spybot, AVG, and trendmicro online all say clear for the specific stuff they can detect... Thanks!

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce is exactly what it states "RunOnce" and then it is supposed to delete itself. That is the nature or feature of the RunOnce key. If it is the registry key specified above and not something else that you are referring to then you should delete all of the entries in that folder within the registry. (you may want to Export that folder first for investigative purposes) If they return on your next start then you will need to look deeper into why or what is placing the entries in that key such as the autoexec.bat file. Bryan

Msconfig is a utility that comes with 98 but not 95, although it works just fine on 95. You can copy it from a 98 machine or download it. Here's one place to get it: msconfig.exe Download (or copy) it to the c:\windows\system folder. Run it from START--RUN. The startup tab will have all the entries in it. Often an item you uncheck in msconfig--startup will re-enable itself by making another entry. I assume the reason is it's being called by another file that's loading. That doesn't necessarily mean it's an unwanted entry. For those entries you're not sure about, do a google search and you can usually determine if it's something you want to keep. If you can't remove the items by using add/remove programs check this recent thread: http://computing.net/windows95/wwwboard/forum/159473.html I put together a listing of the locations the startup items load from. Then you can delete them.

Hi Dave, My google search (as far into it as I read it) only showed what RunOnce is supposed to be for -- mostly repetition of the same M$ knowledge base acticle -- but no info on whether or not it should just be turned off in start up if it keeps coming back despite no system changes made between reboots. But by deduction, it sure sounds like it *shouldn't* be coming back, as the first response here agreed. Spybot's identification of start items seems like a sufficient utility for that to me. I was more hoping for educated guesses on whether, as I have changed nothing, I am pretty safe assuming those RunOnce items shouldn't be there (in the past I had links to some established sites about start up items, but have lost them now). But I think RunOnce is something pretty cut-and-dried, not even amongst those many mystery start entries that need to be ID-ed to know anything for sure. If you've installed/added/removed nothing since your last boot, they shouldn't be there period. So while I may need to find out *why* it happened (they haven't regenerated since I turned them off, but are still all there), my take is that I should definitely leave them disabled, because there's no possible 'good' reason for them. However, I don't know enough to go with only my own take on things! P.S., correction: from the spybot utility, they point at "Value" c:\pr... and one at c:\win.... and then "Command" c:\windows\command.com.... (the dots being where the lines abbreviate themselves).

...and, preceding the "Value" of c:\pr... (or c:\win...) on each of those RunOnce lines in the spybot start item utility, these entries are numbered 0001 through 0019, and are all grouped together.

I'm not familiar with spybot's utility. I suggested msconfig as a means to select startup items because it's what most people use. Most of the registry items that run on startup are in the 'run' keys in HKLM and HKCU similar to the path referenced by Bryan. They usually aren't listed in 'runonce'. That led me to wonder if the way your spybot utility was defining runonce was the same way the registry defined it. Well, however you go about it you'll probably end up doing a google search on the running processes to see what they're associated with.

Select the Key in the left pane and export it as a .reg file which you can then open with notepad to read further past the .... If the pointed to item won't run then I don't think the key gets deleted by design. In other words it remains if something is broken at the target. Numbered series might be an ie reinstall attempt gone horribly wrong. There is always the possiblity of malware using this key to survive a boot - we need to see the target filenames to be of any more help.