16 replies to this topic

[lmscc]

a-squared HiJackFree shows
freedom.exe from Zero Knowledge in
HKEY_CURRENT_USER Software/Microsoft/Windows/CurrentVersion/Run

RegEdit shows that the section actually ends in "Run-" (with a minus sign at the end).

There is no such program on my computer.

CCleaner doesn't think that this is an "Issue"
The registry check in EasyCleaner 2.0 by ToniArts also doesn't detect this.

What's going on?

[AndyManchesta]

Hi lmscc, Welcome to the forum

Have you got any products from Freedom installed ?

If not open Regedit again and right click the run subkey, choose export and save it to your desktop, right click the exported reg file on your desktop and choose Edit then copy and paste the contents back on here.

Thanks

Andy

[lmscc]

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run-]
"Zero Knowledge Freedom"="C:\\Program Files\\Zero Knowledge\\Freedom\\Freedom.exe"


I do not have directory "Program Files/Zero Knowledge"
nor even a directory "Program Files/Freedom"

HP Pavilion 510n using XP SP2

[AndyManchesta]

Hi Again

That isnt a default registry key and Freedom must of been installed at some stage to add that value to your system, Can you confirm that you have a Key called Run and another key called Run- or do you just have the one key which has the - at the end ? , If you have both can you also export the Run Key and post the contents of that then we can remove the value for freedom if your certain its not on the system.

[lmscc]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Acme.PCHButton"="C:\\PROGRA~1\\HPINST~1\\plugin\\bin\\PCHButton.exe"
"ccleaner"="\"C:\\Program Files\\CCleaner\\ccleaner.exe\" /AUTO"

I'm sure that it is ok to remove the "freedom" key,
the software was probably on this machine originally,
or maybe even the previous computer.

Is the "RUN-" key normal in the registry?
Should CCleaner be cleaning it up, or at least reporting it as an "issue"?

It almost seems like an archive to record things that have been deleted/deactivated.

[AndyManchesta]

Hi Again

Sorry for the delay, That key with the - should not exist, the only run keys that should be in the HKCU area of the registry is Run, RunOnce, RunServices & RunServicesOnce.

I assume Ccleaner works on preset paths which the Author has written into the program, as the Run- is not a default key it could be the reason why its not being found as an issue in the scan.

You now have a backup file for the Run- key which you can keep and restore anytime by double clicking the reg file which you exported but its not needed as you have the correct Run key present so the next thing to do is delete the Run- key

Navigate to

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion

Right click the Run- subkey and choose Delete.

Let us know if you have any problems.

Regards

Andy

[lmscc]

Thanks Andy,

I'm trying to get my aging computer super-clean and super-secure.
The "Run-" section puzzled me:

standard or not, if it is an archive of deleted software,
then it just about qualifies as spyware,
and it would be nice if CCleaner made it an "issue"

If nothing else, it certainly qualifies as "crap"

[AndyManchesta]

Yeah I agree but Ive never seen a Run- subkey before so I cannot explain how it got there, Windows doesnt create an archive of deleted software in that area of the registry so Its likely the Freedom program either had a bug when it was installed and created the Run- key instead of adding itself to the Run key or the key was manually made by someone who uses the pc but I can only take guesses as Ive never seen that before.

The reason I mentioned it was not a default key was that if Ccleaner has set paths which it checks for obsolete entries then it wouldnt check the Run- key as that key shouldnt exist, MrG (Author) would be a better person to comment on that but I can only assume this is a one off and Id be suprised if anyone else said they had a Run- key on their system.

Its probably worth checking the HKEY_LOCAL_MACHINE branch to make sure that hasnt got a Run- key as well.

[lmscc]

Yes RUN- is in HKLM as well,
but it isn't Freedom stuff in there .......... ? ? ?
Verizon is definitely new to this computer, it wasn't on the old one.
So its not just an error from Freedom (un)installer

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run-]
"IPInSightLAN 01"="\"C:\\Program Files\\Verizon Online\\Visual IP InSight\\IPClient.exe\" -l"
"IPInSightMonitor 01"="\"C:\\Program Files\\Verizon Online\\Visual IP InSight\\IPMon32.exe\""
"Motive SmartBridge"="C:\\PROGRA~1\\VERIZO~1\\SUPPOR~1\\SMARTB~1\\MotiveSB.exe"
"NvCplDaemon"="RUNDLL32.EXE NvQTwk,NvCplDaemon initialize"
"HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe"

RUN- is also in HKEY_USERS

[HKEY_USERS\S-1-5-21-1990122784-2190867815-4088190255-1003\Software\Microsoft\Windows\CurrentVersion\Run-]
"Zero Knowledge Freedom"="C:\\Program Files\\Zero Knowledge\\Freedom\\Freedom.exe"

[AndyManchesta]

Very Strange

You can delete the RUN- key from HKEY_USERS:

Can you post the contents of the HKLM RUN key before doing anything with that Run- key

Cheers

[DjLizard]

RUN- is created by MSCONFIG when you uncheck items from the Startup tab and press OK.

Zero Knowledge is often installed on HP, Compaq, etc machines by default.

[AndyManchesta]

Thankyou DjLizard

I assumed with that latest post I was missing something obvious

So the HKEY_USERS RUN- key can be deleted with it having an obsolete program inside and the one already removed was also fine as that refers to an obsolete program but the HKLM RUN- key is fine to leave in place.


@DjLizard - Do you know why I do not have that key on my machines when I have alot of items disabled in Msconfig ?

[TheFiresInTheSky]

im not sure but i think its one time that it shows up on there. thats why when you reboot it pops up with a message saying you've changed some stuff. id like to know for sure though.

EDIT: thats not it. it puts the pop up in RUN.

[DjLizard]

AndyManchesta, on May 27 2006, 07:23 PM, said:

@DjLizard - Do you know why I do not have that key on my machines when I have alot of items disabled in Msconfig ?

Not really, but:
If a deactivated item was in HKCU, Run- gets created there.
If it was in HKLM, it gets created there.
If it was in the Start Menu > Startup folder, then it creates "Disabled Startup Items" in the Start Menu, and no Run- is created. Etc.

[AndyManchesta]

Hi DjLizard

I appreciate you stepping in when you did to prevent problems

I can only assume this key isnt available on XP Home as I do not have it on any of my PC's . Ive just done a quick test and can show what happens when you disable items

Here's the HKLM run key contents and MSConfig :

[attachment=693:attachment]

If I disable them all from startup and reboot then the HKLM is removed from the location in MSConfig and all the Values are removed from the HKLM Run key as shown here:

[attachment=694:attachment]

It doesnt create any additional keys (RUN-) and if they are re-enabled it returns to the first screenshot.

Thanks for letting me know this key is created on some systems though incase the topic comes up again.

Cheers

Andy

[DjLizard]

It obviously does something different now... I found that the keys are moved to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\<name of original entry>

Run- was the Win9x way, but I could have sworn it does it in XP too. Perhaps this is an SP2 thing? (it's definitely not a Home/Pro thing - that's not the point of the Pro version's differences)

[TheFiresInTheSky]

i have XP and RUN- along with Run has and has always been at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion