Startup mystery

Archived from groups: microsoft.public.win95.general.discussion (More info?)

I can't figure out why a program is starting up when Win 95 4.01.970
B boots. This isn't spyware or anything, there's a "Run at system
startup" option in the program itself that I have checked. The app is
Atguard, a personal firewall, and the executable is named iamapp.exe.
Iamapp.exe/
Atguard doesn't show up when I hit Ctrl-Alt-Dele, but there is an
Atguard icon in the system tray. Norton Utilities/System/Memory shows
that there is an app named iamapp.exe running.
StartupRun from http://www.nirsoft.net/utils/strun.html doesn't show
anything like Atguard/iamapp.exe, and I recognize everything it shows,
although I don't know what loadwc.exe/BrowserWebCheck/Microsoft(R)
does.
Searching the Registry for iamapp.exe yields:
HKEY_CLASSES_ROOT\AppID\iamapp.EXE
HKEY_CLASSES_ROOT\CLSID\{70C80910-8B80-11D1-9BED-00A0C922BA92}\LocalServer32
HKEY_CLASSES_ROOT\TypeLib\{B67D995B-A17C-11D1-9C05-00A0C922BA92}\1.0\0\win32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc
Find Spec MRU
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\iamapp.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70C80910-8B80-11D1-9BED-00A0C922BA92}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B67D995B-A17C-11D1-9C05-00A0C922BA92}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App
Paths\iamapp.exe
HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc
Find Spec MRU

Any ideas?

Also, is there a way to reposition icons in the Taskbar? I always
have a dozen or more apps running and I've gotten used to having the
icons in a certain order. But once in a while I have to restart an app,
so that app goes to the end of the icon line. And then I get confused.
;-) Is there a way to move that icon back to its "proper" position?

Thanks for any insight,
Steve Baker
14 answers Last reply
More about startup mystery
  1. Archived from groups: microsoft.public.win95.general.discussion (More info?)

    Why are you concerned if Atguard is running?
    You must have installed it.

    I haven't used it for many years but it should have two processes
    starting from the Registry.

    iamapp.exe starts from:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

    iamserv.exe starts from:
    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

    You have many more Atguard keys than the ones you mention.
    Try searching for: iamapp, iamserv, IAM, WRQ, AtGuard,
    @Guard,IAMVXD,IAMDRV

    ....Alan
    --
    Alan Edwards, MS MVP W95/98 Systems
    http://dts-l.org/index.html


    On Wed, 27 Jul 2005 17:02:55 -0400, Steve Baker <bakesph@comcast.net>
    wrote:

    >
    > I can't figure out why a program is starting up when Win 95 4.01.970
    >B boots. This isn't spyware or anything, there's a "Run at system
    >startup" option in the program itself that I have checked. The app is
    >Atguard, a personal firewall, and the executable is named iamapp.exe.
    >Iamapp.exe/
    >Atguard doesn't show up when I hit Ctrl-Alt-Dele, but there is an
    >Atguard icon in the system tray. Norton Utilities/System/Memory shows
    >that there is an app named iamapp.exe running.
    > StartupRun from http://www.nirsoft.net/utils/strun.html doesn't show
    >anything like Atguard/iamapp.exe, and I recognize everything it shows,
    >although I don't know what loadwc.exe/BrowserWebCheck/Microsoft(R)
    >does.
    > Searching the Registry for iamapp.exe yields:
    >HKEY_CLASSES_ROOT\AppID\iamapp.EXE
    >HKEY_CLASSES_ROOT\CLSID\{70C80910-8B80-11D1-9BED-00A0C922BA92}\LocalServer32
    >HKEY_CLASSES_ROOT\TypeLib\{B67D995B-A17C-11D1-9C05-00A0C922BA92}\1.0\0\win32
    >HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc
    >Find Spec MRU
    >HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\iamapp.EXE
    >HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70C80910-8B80-11D1-9BED-00A0C922BA92}\LocalServer32
    >HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B67D995B-A17C-11D1-9C05-00A0C922BA92}\1.0\0\win32
    >HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App
    >Paths\iamapp.exe
    >HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc
    >Find Spec MRU
    >
    > Any ideas?
  2. Archived from groups: microsoft.public.win95.general.discussion (More info?)

    On Thu, 28 Jul 2005 09:45:29 +1000, Alan Edwards
    <edwards@southcom.com.au> wrote:

    >Why are you concerned if Atguard is running?

    I'm not "concerned", I'm curious. I just want to know what's going
    on.

    >You must have installed it.

    Yes, and I mentioned that I checked the "Run at system startup"
    option in Atguard itself.

    >I haven't used it for many years but it should have two processes
    >starting from the Registry.
    >
    >iamapp.exe starts from:
    >HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    >
    >iamserv.exe starts from:
    >HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

    Those are the "usual suspects", but neither are where Atguard is
    getting started. Iamserv.exe doesn't show up in the Registry. I've
    included the Registry hits on iamapp.exe below if you want to take a
    look. There is nothing in {the above path)\CurrentVersion\Run,
    RunServices, RunOnce, or RunOnceEx that has anything to do with
    Atguard. Unless loadwc.exe is somehow involved.

    >You have many more Atguard keys than the ones you mention.
    >Try searching for: iamapp, iamserv, IAM, WRQ, AtGuard,
    >@Guard,IAMVXD,IAMDRV

    Aha. Norton Utilities shows WRQNAM in memory, the details of which
    say:
    Process Path: C:\Program Files\Atguard\iamserv.exe.
    Parent Process: KERNEL32.DLL

    But the only hits on "wrq" in the Registry are:
    HKEY_CURRENT_USER\Software\WRQ
    HKEY_LOCAL_MACHINE\SOFTWARE\WRQ
    HKEY_USERS\.Default\Software\WRQ

    That seems like it might be an important clue, but I don't know what
    to make of it. ;-) How about you? Thanks for having a look in any case.
    Here are the Registry hits on iamapp.exe. I figured someone here would
    just know what the deal is. If I want to sort this out, it seems like
    it might be a good idea to disable that "Run at system startup" option
    and look for changes in the Registry. What do you think?

    Thanks again,
    Steve Baker

    HKEY_CLASSES_ROOT\AppID\iamapp.EXE
    HKEY_CLASSES_ROOT\CLSID\{70C80910-8B80-11D1-9BED-00A0C922BA92}\LocalServer32
    HKEY_CLASSES_ROOT\TypeLib\{B67D995B-A17C-11D1-9C05-00A0C922BA92}\1.0\0\win32
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc
    Find Spec MRU
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\iamapp.EXE
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70C80910-8B80-11D1-9BED-00A0C922BA92}\LocalServer32
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B67D995B-A17C-11D1-9C05-00A0C922BA92}\1.0\0\win32
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App
    Paths\iamapp.exe
    HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc
    Find Spec MRU
  3. Archived from groups: microsoft.public.win95.general.discussion (More info?)

    Loadwc.exe is not involved. It has no connection with AtGuard. Load
    web check is a Microsoft program.

    I really don't know what you want to achieve here.
    If you have a concern or problem, I will try and help as I still have
    installation logs from 1998 for V2 and 1999 for V3.
    If it is just idle curiosity, then I will pass.

    There is nothing relevant in the keys you have posted in duplicate.
    Posting things like "Doc Find Spec MRU" is irrelevant as that only
    exists because you have searched for the string.

    ....Alan
    --
    Alan Edwards, MS MVP W95/98 Systems
    http://dts-l.org/index.html

    On Wed, 27 Jul 2005 23:27:13 -0400, Steve Baker
    <bakes-nanae@comcast.net> wrote:

    >On Thu, 28 Jul 2005 09:45:29 +1000, Alan Edwards
    ><edwards@southcom.com.au> wrote:
    >
    >>Why are you concerned if Atguard is running?
    >
    > I'm not "concerned", I'm curious. I just want to know what's going
    >on.
    >
    >>You must have installed it.
    >
    > Yes, and I mentioned that I checked the "Run at system startup"
    >option in Atguard itself.
    >
    >>I haven't used it for many years but it should have two processes
    >>starting from the Registry.
    >>
    >>iamapp.exe starts from:
    >>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    >>
    >>iamserv.exe starts from:
    >>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
    >
    > Those are the "usual suspects", but neither are where Atguard is
    >getting started. Iamserv.exe doesn't show up in the Registry. I've
    >included the Registry hits on iamapp.exe below if you want to take a
    >look. There is nothing in {the above path)\CurrentVersion\Run,
    >RunServices, RunOnce, or RunOnceEx that has anything to do with
    >Atguard. Unless loadwc.exe is somehow involved.
    >
    >>You have many more Atguard keys than the ones you mention.
    >>Try searching for: iamapp, iamserv, IAM, WRQ, AtGuard,
    >>@Guard,IAMVXD,IAMDRV
    >
    > Aha. Norton Utilities shows WRQNAM in memory, the details of which
    >say:
    >Process Path: C:\Program Files\Atguard\iamserv.exe.
    >Parent Process: KERNEL32.DLL
    >
    > But the only hits on "wrq" in the Registry are:
    >HKEY_CURRENT_USER\Software\WRQ
    >HKEY_LOCAL_MACHINE\SOFTWARE\WRQ
    >HKEY_USERS\.Default\Software\WRQ
    >
    > That seems like it might be an important clue, but I don't know what
    >to make of it. ;-) How about you? Thanks for having a look in any case.
    >Here are the Registry hits on iamapp.exe. I figured someone here would
    >just know what the deal is. If I want to sort this out, it seems like
    >it might be a good idea to disable that "Run at system startup" option
    >and look for changes in the Registry. What do you think?
    >
    >Thanks again,
    >Steve Baker
    >
    >HKEY_CLASSES_ROOT\AppID\iamapp.EXE
    >HKEY_CLASSES_ROOT\CLSID\{70C80910-8B80-11D1-9BED-00A0C922BA92}\LocalServer32
    >HKEY_CLASSES_ROOT\TypeLib\{B67D995B-A17C-11D1-9C05-00A0C922BA92}\1.0\0\win32
    >HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc
    >Find Spec MRU
    >HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\iamapp.EXE
    >HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70C80910-8B80-11D1-9BED-00A0C922BA92}\LocalServer32
    >HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B67D995B-A17C-11D1-9C05-00A0C922BA92}\1.0\0\win32
    >HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App
    >Paths\iamapp.exe
    >HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc
    >Find Spec MRU
  4. Archived from groups: microsoft.public.win95.general.discussion (More info?)

    On Thu, 28 Jul 2005 19:13:40 +1000, Alan Edwards
    <edwards@southcom.com.au> wrote:

    >Loadwc.exe is not involved. It has no connection with AtGuard. Load
    >web check is a Microsoft program.
    >
    >I really don't know what you want to achieve here.

    I want to understand how Atgaurd gets loaded during Win 95 boot.

    >If you have a concern or problem, I will try and help as I still have
    >installation logs from 1998 for V2 and 1999 for V3.

    I have V 3.2. That's the version they just gave away just before they
    transferred their assets to whoever it was that bought them. Norton?

    >If it is just idle curiosity, then I will pass.

    OK, no problem, thanks for having a look. I don't think that wanting
    to understand why Win 95 loads an app when it boots is exactly "idle
    curiosity", but I don't have a problem that needs to be solved.

    >There is nothing relevant in the keys you have posted in duplicate.

    Well, I posted them again for your convenience, so you wouldn't have
    to backtrack to my original post. When iamapp.exe didn't show up in the
    Registry where you said it would, I thought you might be interested in
    seeing where iamapp.exe actually did show up in the Registry.

    >Posting things like "Doc Find Spec MRU" is irrelevant as that only
    >exists because you have searched for the string.

    Huh? Searching for a string causes that string to appear in the
    Registry? Maybe line wrap is causing some confusion here, I'm going to
    manually wrap a line and we'll see if it makes more sense.

    HKEY_CURRENT_USER\Software\Microsoft\Windows\
    CurrentVersion\Explorer\Doc Find Spec MRU

    That's what I see in the left hand pane in Regedit. In the right hand
    pane "iamapp.exe" is the data for something named "h". Interestingly, I
    see another executable there that runs during boot. And two others that
    do not run during boot. And other data values like "ie.txt", "cookies",
    and "hajcfegdbi".

    There is also:
    HKEY_USERS\.Default\Software\Microsoft\Windows\
    CurrentVersion\Explorer\Doc Find Spec MRU

    that seems to have the same data values as the key above.

    Thanks for your offer to help me with a problem, but that's not where
    I'm coming from.

    Steve Baker
  5. Archived from groups: microsoft.public.win95.general.discussion (More info?)

    "Steve Baker" wrote

    > >Posting things like "Doc Find Spec MRU" is irrelevant as that only
    > >exists because you have searched for the string.

    MRU = Most-Recently-Used

    > Huh? Searching for a string causes that string to appear in the
    > Registry?

    Welcome to Windows. :)
    Start / Documents does the same thing.

    > do not run during boot. And other data values like "ie.txt", "cookies",
    > and "hajcfegdbi".

    Mine says "hebigdcfja".
    It's just an alphabetical index of what was searched for last, not necessarily
    in chronological order (for some reason only Billy knows).
  6. Archived from groups: microsoft.public.win95.general.discussion (More info?)

    On Thu, 28 Jul 2005 07:12:25 -0400, Steve Baker
    <bakes-nanae@comcast.net> wrote:

    >On Thu, 28 Jul 2005 19:13:40 +1000, Alan Edwards
    ><edwards@southcom.com.au> wrote:

    >
    >>There is nothing relevant in the keys you have posted in duplicate.
    >
    > Well, I posted them again for your convenience, so you wouldn't have
    >to backtrack to my original post. When iamapp.exe didn't show up in the
    >Registry where you said it would, I thought you might be interested in
    >seeing where iamapp.exe actually did show up in the Registry.
    >

    Perhaps I wasn't clear. The duplicate pairs are:

    HKEY_CLASSES_ROOT\AppID\iamapp.EXE
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\iamapp.EXE

    HKEY_CLASSES_ROOT\CLSID\{70C80910-8B80-11D1-9BED-00A0C922BA92}\LocalServer32
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70C80910-8B80-11D1-9BED-00A0C922BA92}\LocalServer32

    HKEY_CLASSES_ROOT\TypeLib\{B67D995B-A17C-11D1-9C05-00A0C922BA92}\1.0\0\win32
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B67D995B-A17C-11D1-9C05-00A0C922BA92}\1.0\0\win32

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc
    Find Spec MRU
    HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc
    Find Spec MRU

    >>Posting things like "Doc Find Spec MRU" is irrelevant as that only
    >>exists because you have searched for the string.
    >
    > Huh? Searching for a string causes that string to appear in the
    >Registry?

    Yes. That is correct. That is where the history of your MRUs is held.

    ....Alan
    --
    Alan Edwards, MS MVP W95/98 Systems
    http://dts-l.org/index.html
  7. Archived from groups: microsoft.public.win95.general.discussion (More info?)

    On Thu, 28 Jul 2005 07:12:25 -0400, Steve Baker
    <bakes-nanae@comcast.net> wrote:

    >On Thu, 28 Jul 2005 19:13:40 +1000, Alan Edwards
    ><edwards@southcom.com.au> wrote:
    >
    >>Loadwc.exe is not involved. It has no connection with AtGuard. Load
    >>web check is a Microsoft program.
    >>
    >>I really don't know what you want to achieve here.
    >
    > I want to understand how Atgaurd gets loaded during Win 95 boot.
    >

    The two Registry keys that AtGuard uses to get loaded at boot are in
    my first reply.

    ....Alan
    --
    Alan Edwards, MS MVP W95/98 Systems
    http://dts-l.org/index.html
  8. Archived from groups: microsoft.public.win95.general.discussion (More info?)

    On Thu, 28 Jul 2005 22:05:27 +1000, Alan Edwards
    <edwards@southcom.com.au> wrote:

    >The two Registry keys that AtGuard uses to get loaded at boot are in
    >my first reply.

    You mean this?

    >iamapp.exe starts from:
    >HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    >
    >iamserv.exe starts from:
    >HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

    That's not it. Neither executable shows up in either of those keys,
    and there's nothing that has anything to do with Atguard in either of
    those keys.

    >You have many more Atguard keys than the ones you mention.
    >Try searching for: iamapp, iamserv, IAM, WRQ, AtGuard,
    >@Guard,IAMVXD,IAMDRV

    I've searched on iam and atguard and found no differences between
    Atguard starting on bootup and Atguard not starting on bootup (although
    I didn't really look closely at key values).
    There are no hits on @Guard.
    There are three hits on WRQ when Atguard is set to start on bootup;
    keys that have Name: (default) Data: (value not set) as the only info.

    Got any other ideas? C'mon, don't you like solving mysteries? ;-)

    This must have something to do with what's going on, right?

    > Aha. Norton Utilities shows WRQNAM in memory, the details of which
    >say:
    >Process Path: C:\Program Files\Atguard\iamserv.exe.
    >Parent Process: KERNEL32.DLL

    How is that getting started? Could Atguard be messing around with
    ..dlls that run at bootup?

    Thanks,
    Steve Baker
  9. Archived from groups: microsoft.public.win95.general.discussion (More info?)

    See if there is anything relevant in the following folder.

    C:\WINDOWS\All Users\Start Menu\PROGRAMS\STARTUP

    Ben

    "Steve Baker" <bakes-nanae@comcast.net> wrote in message news:qbqme19q2g49fg04vf7hdskqnlulq46ajr@4ax.com...
    > On Thu, 28 Jul 2005 22:05:27 +1000, Alan Edwards
    > <edwards@southcom.com.au> wrote:
    >
    > >The two Registry keys that AtGuard uses to get loaded at boot are in
    > >my first reply.
    >
    > You mean this?
    >
    > >iamapp.exe starts from:
    > >HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    > >
    > >iamserv.exe starts from:
    > >HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
    >
    > That's not it. Neither executable shows up in either of those keys,
    > and there's nothing that has anything to do with Atguard in either of
    > those keys.
    >
    > >You have many more Atguard keys than the ones you mention.
    > >Try searching for: iamapp, iamserv, IAM, WRQ, AtGuard,
    > >@Guard,IAMVXD,IAMDRV
    >
    > I've searched on iam and atguard and found no differences between
    > Atguard starting on bootup and Atguard not starting on bootup (although
    > I didn't really look closely at key values).
    > There are no hits on @Guard.
    > There are three hits on WRQ when Atguard is set to start on bootup;
    > keys that have Name: (default) Data: (value not set) as the only info.
    >
    > Got any other ideas? C'mon, don't you like solving mysteries? ;-)
    >
    > This must have something to do with what's going on, right?
    >
    > > Aha. Norton Utilities shows WRQNAM in memory, the details of which
    > >say:
    > >Process Path: C:\Program Files\Atguard\iamserv.exe.
    > >Parent Process: KERNEL32.DLL
    >
    > How is that getting started? Could Atguard be messing around with
    > .dlls that run at bootup?
    >
    > Thanks,
    > Steve Baker
    >
  10. Archived from groups: microsoft.public.win95.general.discussion (More info?)

    On Sat, 30 Jul 2005 12:56:43 -0400, "Ben Myers"
    <benjmyers@mindR-E-M-O-V-Espring.com> wrote:

    >See if there is anything relevant in the following folder.
    >
    >C:\WINDOWS\All Users\Start Menu\PROGRAMS\STARTUP

    I have a "C:\Windows\All Users" folder, but there is no "Start Menu"
    subfolder. There is one subfolder, "Application Data", and one
    subfolder under that, "QuickTime".

    I do have a "startup" folder at:
    C:\windows\start menu\programs\startup

    Programs/Shortcuts located there do run at boot. There's nothing
    there that has anything to with Atguard, though.

    Thanks,
    Steve Baker
  11. Archived from groups: microsoft.public.win95.general.discussion (More info?)

    It may be loading as a device driver. See if the following registry
    key exists.

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\IAMDRV

    Ben

    "Steve Baker" <bakes-nanae@comcast.net> wrote in message news:1edne1lctlikqq33b5un0mj5k6dokj1vvn@4ax.com...
    > On Sat, 30 Jul 2005 12:56:43 -0400, "Ben Myers"
    > <benjmyers@mindR-E-M-O-V-Espring.com> wrote:
    >
    > >See if there is anything relevant in the following folder.
    > >
    > >C:\WINDOWS\All Users\Start Menu\PROGRAMS\STARTUP
    >
    > I have a "C:\Windows\All Users" folder, but there is no "Start Menu"
    > subfolder. There is one subfolder, "Application Data", and one
    > subfolder under that, "QuickTime".
    >
    > I do have a "startup" folder at:
    > C:\windows\start menu\programs\startup
    >
    > Programs/Shortcuts located there do run at boot. There's nothing
    > there that has anything to with Atguard, though.
    >
    > Thanks,
    > Steve Baker
    >
  12. Archived from groups: microsoft.public.win95.general.discussion (More info?)

    On Sat, 30 Jul 2005 19:36:03 -0400, "Ben Myers"
    <benjmyers@mindR-E-M-O-V-Espring.com> wrote:

    >It may be loading as a device driver. See if the following registry
    >key exists.
    >
    >HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\IAMDRV

    Yes! It has three values, one of which is Name: StaticVxD Data:
    C:\PROGRA~1\ATGUARD\iamdrv.vxd. But... that is there even when Atguard
    doesn't start on bootup. And the last modified date on iamdrv.vxd is in
    1999. However, iamfw.rel, iamsys.rel, and iamtcp.rel were modified when
    I changed the Atguard configuration to not start on bootup. And then
    when I changed it back so Atguard starts on bootup, iamsys.rel and
    iamfw.rel were modified. Does this look like it might be the solution
    to the mystery?

    Thanks,
    Steve Baker
  13. Archived from groups: microsoft.public.win95.general.discussion (More info?)

    I don't use AtGuard, but the version of ZoneAlarm I use removes
    its registry entry when configured not to run at startup. I suspect
    AtGuard leaves the registry key in place, perhaps disabling it by
    adding or removing a "Start" value.

    Ben

    "Steve Baker" <bakes-nanae@comcast.net> wrote in message news:oc3pe1l2sgail5vt8qiktajq0p2pegoqqr@4ax.com...
    > On Sat, 30 Jul 2005 19:36:03 -0400, "Ben Myers"
    > <benjmyers@mindR-E-M-O-V-Espring.com> wrote:
    >
    > >It may be loading as a device driver. See if the following registry
    > >key exists.
    > >
    > >HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\IAMDRV
    >
    > Yes! It has three values, one of which is Name: StaticVxD Data:
    > C:\PROGRA~1\ATGUARD\iamdrv.vxd. But... that is there even when Atguard
    > doesn't start on bootup. And the last modified date on iamdrv.vxd is in
    > 1999. However, iamfw.rel, iamsys.rel, and iamtcp.rel were modified when
    > I changed the Atguard configuration to not start on bootup. And then
    > when I changed it back so Atguard starts on bootup, iamsys.rel and
    > iamfw.rel were modified. Does this look like it might be the solution
    > to the mystery?
    >
    > Thanks,
    > Steve Baker
    >
  14. Archived from groups: microsoft.public.win95.general.discussion (More info?)

    On Sun, 31 Jul 2005 18:19:07 -0400, "Ben Myers"
    <benjmyers@mindR-E-M-O-V-Espring.com> wrote:

    >I don't use AtGuard, but the version of ZoneAlarm I use removes
    >its registry entry when configured not to run at startup. I suspect
    >AtGuard leaves the registry key in place, perhaps disabling it by
    >adding or removing a "Start" value.

    OK. Whatever that means. ;-) Just in case your're interested, I found
    that the files I mentioned that get changed probably have nothing to do
    with configuration, they're apparently just data files like the event
    log, etc.

    Thanks,
    Steve Baker
Ask a new question

Read More

Microsoft Software Windows