1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Solved: 'Programs' folder appearing on desktop at startup

Discussion in 'Windows Vista' started by slorlkuk, Jul 30, 2008.

Thread Status:
Not open for further replies.
  1. slorlkuk

    slorlkuk Thread Starter

    Dec 2, 2005
    I don't really know how this happend but I can't figure out how to stop this. Everytime I start my computer, a 'Programs' folder appears on my desktop with nothing in the folder except a 'desktop.ini' file. I scanned my pc with spybot, superantispyware, and Nod32 v3 and they found nothing. I also disabled all startup items and services and it still happens. Although I am familiar with Hijack this for XP, I don't know too much about Vista to make changes. I am currently running Vista x64 Ultimate. Could someone take a look at my log file?

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:32:18 AM, on 7/30/2008
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Normal

    Running processes:
    C:\Program Files (x86)\Avant Browser\avant.exe
    C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    F2 - REG:system.ini: UserInit=userinit.exe
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.6.0_01\bin\ssv.dll
    O4 - HKLM\..\Run: [Copperhead] "C:\Program Files (x86)\Razer\Copperhead\razerhid.exe"
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
    O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files (x86)\ieSpell\iespell.dll/SPELLOPTION.HTM
    O8 - Extra context menu item: Check &Spelling - res://C:\Program Files (x86)\ieSpell\iespell.dll/SPELLCHECK.HTM
    O8 - Extra context menu item: Download All by FlashGet - C:\PROGRA~2\FlashGet\jc_all.htm
    O8 - Extra context menu item: Download using FlashGet - C:\PROGRA~2\FlashGet\jc_link.htm
    O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files (x86)\ieSpell\Merriam Webster.HTM
    O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files (x86)\ieSpell\wikipedia.HTM
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files (x86)\ieSpell\iespell.dll
    O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files (x86)\ieSpell\iespell.dll
    O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files (x86)\ieSpell\iespell.dll
    O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files (x86)\ieSpell\iespell.dll
    O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~2\FlashGet\flashget.exe
    O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~2\FlashGet\flashget.exe
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
    O13 - Gopher Prefix:
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
    O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
    O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-48.cab
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Unknown owner - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
    O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files (x86)\APC\APC PowerChute Personal Edition\mainserv.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe
    O23 - Service: Creative ALchemy AL1 Licensing Service - Creative Labs - C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL1Licensing.exe
    O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
    O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
    O23 - Service: Eset HTTP Server (EhttpSrv) - Unknown owner - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
    O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files (x86)\iPod\bin\iPodService.exe
    O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
    O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
    O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
    O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
    O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
    O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
    O23 - Service: TabletService - Unknown owner - C:\Windows\system32\Tablet.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
    O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
    O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
    O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
    O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
    O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

    End of file - 9162 bytes
  2. Sponsor

  3. Elvandil


    Aug 1, 2003
    Look in C: and see if you have a folder named "Program Files (x86)". Is this an x64 machine? A lot of your startups seem to be looking for that folder. Do you have any idea why?

    Try using Startup Control Panel and edit the startups. If it is an x64 machine, you could try just putting parentheses around the whole entries:

    "C:\Program Files (x86)\APC\APC PowerChute Personal Edition\mainserv.exe"
  4. slorlkuk

    slorlkuk Thread Starter

    Dec 2, 2005
    I already mentioned that I was using Vista x64 Ultimate. The reason why most of my programs are located in "C:\Program Files (x86)" is because in Vista x64, any 32 bit applications that are installed on the PC are default to install to that directory. Any 64 bit applications are located in the default "C:\Program Files".

    I have already attempted to edit the startup items through the "msconfig" command, disabling all startup items and services.
  5. Elvandil


    Aug 1, 2003
    You should never use msconfig to control services. That can have unpredictable results and lead to problems. Use the services console and check the command lines for the startup services. One of them may need quotes, especially if a new servoce has been recently installed.

    Does the folder say "Programs" or just "Program"?
  6. slorlkuk

    slorlkuk Thread Starter

    Dec 2, 2005
    I use the default msconfig command all the time. I have never experienced any glithces or major problems due to the use of msconfig in the past/present. If a startup item is encountering an issue, I simply re-enable the program at startup. What are these "unpredicatble results" that you speak of? Any examples? Everytime I have used it, I get exactly the results I expect.

    As for the specific folder name, I am not at my PC at the moment so I have to check back in several hours to clarify.

    Thanks for the help thus far.
  7. Elvandil


    Aug 1, 2003
    Msconfig is for diagnostics. Using it for startup control means that you need to run in Selective Startup all the time and get no warnings when malware changes those settings.

    If you don't see anything anywhere else, try looking through all your startups in Autoruns.

    Using msconfig rather than the console that is made for that purpose can lead to mistaken startups when services are re-enabled. A boot may be changed to a system, and so on.
  8. slorlkuk

    slorlkuk Thread Starter

    Dec 2, 2005
    Hmm, I never realised that. Looking at the startup selection, I have selected the 'Selective Startup'. So by using selective startup, I cannot get any warnings through my Anti-Virus that my system startup is being infected from malware? That seems like the most influential reason to stop using 'msconfig' as my primary startup utility.

    Thanks for pointing out autoruns to me. I was already aware of this program, but when I initially tryed it out a bit, I was a little put off by how complicated things looked. However, after looking through the program a little deeper today, I found a simple setting that makes things so much easier to search through. By going in to the "Options" and then checking "Hide Microsoft Entires" and then closing and re-launching the program, I get all the little bits of information that I really need. That last part I probably never realized, because I probably just checked to hide the entries and believed that it would change instantly, being dissapointed that nothing changed, thus assuming that the program was too complicated to use and not working properly in the first place.

    Anyways, I think I will use this program to properly manage my startup items and services. I will reply back later to see what happens to that folder that appears at startup.
  9. Elvandil


    Aug 1, 2003
    There is a "Refresh" button at the top of Autoruns so that you need not restart it.

    I know what you mean about it seeming complicated at first, but I can now scan through one pretty quickly since I use it so often. But it is surely overkill for most things, and a simple startup manager that just shows the most common program startup locations is also useful.

    But I would warn that they all work a bit differently. Some disable starups by placing a character before a registry entry. Others move the entry to a subkey. So you should always use the same program to control startups because you can't necessarily re-enable an item with a different program.

    Startup Control Panel
    MZ Startup Manager
    Startup Control Panel (Exe version for Vista)
    Emsa Startup Manager
    EM Startup Manager
    WheresJames Startup Manager

    Your AV would still alert you if a virus was located, but when you reboot after using msconfig for the first time in selective mode, a message pops up to inform you. Most people check the box to no longer be informed when startup is not normal.
  10. slorlkuk

    slorlkuk Thread Starter

    Dec 2, 2005
    Well I figured out what was causing a "Programs" folder to keep appearing on my desktop when my PC starts up...

    Earlier, I was sorting my programs from the start menu, adding folders and deleting entires. I found that there was two locations that Windows used to store the program shortcuts:

    %systemdrive%\ProgramData\Microsoft\Windows\Start Menu
    %systemdrive%\%UserProfile%\AppData\Roaming\Microsoft\Windows\Start Menu.

    In the process of organizing, I found that within my programs list at the start menu, I had another folder called "Programs" which listed pratically all the exact same entries as the original programs folder. This extra "Programs" folders location was C:\Users\User Name\AppData\Roaming\Microsoft\Windows\Start Menu. I ended up trying to delete this folder completely but it would not dissapear. I thought it may be on a corrupt sector of the HDD or something to that effect so I moved the folder to my desktop. Attempting to delete the folder failed. So I restarted the PC and was then able to delete the folder. However, I didn't realize that now I changed the default location of that "Programs" folder to my desktop, so that everytime my computer started, it would search for that folder and if it wasn't there, it would create a new "Programs" folder.

    I decided to try to see if I could locate a source of the folder through its properties, so I right clicked the "Programs" folder that was on my desktop, went to "Properties" and searched through the tabs. I came accross the tab "Location" and found that the path was directed to C:\Users\User Name\Desktop because I moved it there on accident. I clicked on the "Restore Default" button which redirected the directory to C:\Users\User Name\AppData\Roaming\Microsoft\Windows\Start Menu. After rebooting the PC, I no longer got the "Programs" folder created on my desktop.

    I appreciate your help Elvandil, thanks.
  11. Elvandil


    Aug 1, 2003
    Bit of a mess, huh? Glad you figured it out. Thank you for following up.
  12. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/735403