so I have a user with a machine that shows two different lines in msconfig's startup tab with 4 empty squares in the command column. I had her uncheck both of them and reboot. they were recreated under that tab and on the desktop she was prompted with an error msg for each of them that they were missing and needed to be replaced. the location of each of them is in HKCU\software\microsoft\windows nt\currentversion\windows as Load and as Run. but nothing is in the Data column for a description of any kind. can these be deleted? is some little piece of spyware/virus or something buried deep in this machine and using these two keys to run a process? oh, btw, she said she just removed a whole heap of sw that didn't look relevant to her and before doing that there were two processes eating up all CPU resource (totalling 100% iow): spoolsv.exe and scan32.exe. she rebooted after uninstalling all of the programs she ditched, and the CPU was back to normal System Idle Process usage. any advice or input would be appreciated. thanks. Chuck

What are the names of the executables?

sounds to me like a worm. download and run AVG free edition from www.grisoft.com. this will find any virus that is on the machine. once all of the viruses are removed, insert your windows disk and do a fix on windows. the viruses embed themselves in windows system files and corrupt them. optiplex pentium 120, 120mhz processor

You have either Netsky worm or Welcia worm or both...time to get a decent antivirus program, but first run online scan at trendMicro and get thjose out of there, then buy a decent antivirus program like nod32, Bit defender or Kaspersky, and keep it updated which they all do automatically, that is if you value your system.

I have the same thing under msconfig and my computer is really slow and I have Norton, so I didn't think it could get in. Now that I think of it, my reports say "Wrom protection is monitoring 3 signatures" what does that mean? Its watching 3 signatures or are they on my computer? Can these load/run files be deleted? I tried that and computer ran slower still. What to do? TBug