Hi

I have my W2000 station which has certainly been infected
with a virus/trojan, and now each time I log on my
machine, at startup there is an "update" program which is
automatically lauched.
I guess it is related to chat program, because on the
window which appears (which name is UPDATE) I can read the
following sentences which appear one after the other :
- your name is now "something which changes each time"
- update status
- activation
- identd is ON (sd)
- /checkload

I want to find where this program is lauched, therefore I
would like to know where to look for the program lauched
at boot up (like startup menu,
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersio
n\Run,...).

Or even better, if there is someone having information
about how to remove this specific program I would be happy
to get advices.

Thank you

Yann SANCHEZ

most of programs run at startup are put at one of the 3
following place. in the startup menu, or in the registry
at one of the 2 following place.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersio
n\Run

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion
\Run


Charles

AND...

The startup group of icons.

C:\Documents and Settings\All Users\Start Menu\Programs\Startup

C:\Documents and Settings\your_logon_name\Start Menu\Programs\Startup


Dave