Startup mystery

[Guest]

Archived from groups: microsoft.public.win95.general.discussion (More info?)

I can't figure out why a program is starting up when Win 95 4.01.970
B boots. This isn't spyware or anything, there's a "Run at system
startup" option in the program itself that I have checked. The app is
Atguard, a personal firewall, and the executable is named iamapp.exe.
Iamapp.exe/
Atguard doesn't show up when I hit Ctrl-Alt-Dele, but there is an
Atguard icon in the system tray. Norton Utilities/System/Memory shows
that there is an app named iamapp.exe running.
StartupRun from http://www.nirsoft.net/utils/strun.html doesn't show
anything like Atguard/iamapp.exe, and I recognize everything it shows,
although I don't know what loadwc.exe/BrowserWebCheck/Microsoft(R)
does.
Searching the Registry for iamapp.exe yields:
HKEY_CLASSES_ROOT\AppID\iamapp.EXE
HKEY_CLASSES_ROOT\CLSID\{70C80910-8B80-11D1-9BED-00A0C922BA92}\LocalServer32
HKEY_CLASSES_ROOT\TypeLib\{B67D995B-A17C-11D1-9C05-00A0C922BA92}\1.0\0\win32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc
Find Spec MRU
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\iamapp.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70C80910-8B80-11D1-9BED-00A0C922BA92}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B67D995B-A17C-11D1-9C05-00A0C922BA92}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App
Paths\iamapp.exe
HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc
Find Spec MRU

Any ideas?

Also, is there a way to reposition icons in the Taskbar? I always
have a dozen or more apps running and I've gotten used to having the
icons in a certain order. But once in a while I have to restart an app,
so that app goes to the end of the icon line. And then I get confused.
;-) Is there a way to move that icon back to its "proper" position?

Thanks for any insight,
Steve Baker

 

[Guest]

Archived from groups: microsoft.public.win95.general.discussion (More info?)

Why are you concerned if Atguard is running?
You must have installed it.

I haven't used it for many years but it should have two processes
starting from the Registry.

iamapp.exe starts from:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

iamserv.exe starts from:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

You have many more Atguard keys than the ones you mention.
Try searching for: iamapp, iamserv, IAM, WRQ, AtGuard,
@Guard,IAMVXD,IAMDRV

....Alan
--
Alan Edwards, MS MVP W95/98 Systems
http://dts-l.org/index.html


On Wed, 27 Jul 2005 17:02:55 -0400, Steve Baker <bakesph@comcast.net>
wrote:

>
> I can't figure out why a program is starting up when Win 95 4.01.970
>B boots. This isn't spyware or anything, there's a "Run at system
>startup" option in the program itself that I have checked. The app is
>Atguard, a personal firewall, and the executable is named iamapp.exe.
>Iamapp.exe/
>Atguard doesn't show up when I hit Ctrl-Alt-Dele, but there is an
>Atguard icon in the system tray. Norton Utilities/System/Memory shows
>that there is an app named iamapp.exe running.
> StartupRun from http://www.nirsoft.net/utils/strun.html doesn't show
>anything like Atguard/iamapp.exe, and I recognize everything it shows,
>although I don't know what loadwc.exe/BrowserWebCheck/Microsoft(R)
>does.
> Searching the Registry for iamapp.exe yields:
>HKEY_CLASSES_ROOT\AppID\iamapp.EXE
>HKEY_CLASSES_ROOT\CLSID\{70C80910-8B80-11D1-9BED-00A0C922BA92}\LocalServer32
>HKEY_CLASSES_ROOT\TypeLib\{B67D995B-A17C-11D1-9C05-00A0C922BA92}\1.0\0\win32
>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc
>Find Spec MRU
>HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\iamapp.EXE
>HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70C80910-8B80-11D1-9BED-00A0C922BA92}\LocalServer32
>HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B67D995B-A17C-11D1-9C05-00A0C922BA92}\1.0\0\win32
>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App
>Paths\iamapp.exe
>HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc
>Find Spec MRU
>
> Any ideas?

 

[Guest]

Archived from groups: microsoft.public.win95.general.discussion (More info?)

On Thu, 28 Jul 2005 09:45:29 +1000, Alan Edwards
<edwards@southcom.com.au> wrote:

>Why are you concerned if Atguard is running?

I'm not "concerned", I'm curious. I just want to know what's going
on.

>You must have installed it.

Yes, and I mentioned that I checked the "Run at system startup"
option in Atguard itself.

>I haven't used it for many years but it should have two processes
>starting from the Registry.
>
>iamapp.exe starts from:
>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
>
>iamserv.exe starts from:
>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

Those are the "usual suspects", but neither are where Atguard is
getting started. Iamserv.exe doesn't show up in the Registry. I've
included the Registry hits on iamapp.exe below if you want to take a
look. There is nothing in {the above path)\CurrentVersion\Run,
RunServices, RunOnce, or RunOnceEx that has anything to do with
Atguard. Unless loadwc.exe is somehow involved.

>You have many more Atguard keys than the ones you mention.
>Try searching for: iamapp, iamserv, IAM, WRQ, AtGuard,
>@Guard,IAMVXD,IAMDRV

Aha. Norton Utilities shows WRQNAM in memory, the details of which
say:
Process Path: C:\Program Files\Atguard\iamserv.exe.
Parent Process: KERNEL32.DLL

But the only hits on "wrq" in the Registry are:
HKEY_CURRENT_USER\Software\WRQ
HKEY_LOCAL_MACHINE\SOFTWARE\WRQ
HKEY_USERS\.Default\Software\WRQ

That seems like it might be an important clue, but I don't know what
to make of it. ;-) How about you? Thanks for having a look in any case.
Here are the Registry hits on iamapp.exe. I figured someone here would
just know what the deal is. If I want to sort this out, it seems like
it might be a good idea to disable that "Run at system startup" option
and look for changes in the Registry. What do you think?

Thanks again,
Steve Baker

HKEY_CLASSES_ROOT\AppID\iamapp.EXE
HKEY_CLASSES_ROOT\CLSID\{70C80910-8B80-11D1-9BED-00A0C922BA92}\LocalServer32
HKEY_CLASSES_ROOT\TypeLib\{B67D995B-A17C-11D1-9C05-00A0C922BA92}\1.0\0\win32
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc
Find Spec MRU
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\iamapp.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70C80910-8B80-11D1-9BED-00A0C922BA92}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B67D995B-A17C-11D1-9C05-00A0C922BA92}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App
Paths\iamapp.exe
HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc
Find Spec MRU

 

[Guest]

Archived from groups: microsoft.public.win95.general.discussion (More info?)

Loadwc.exe is not involved. It has no connection with AtGuard. Load
web check is a Microsoft program.

I really don't know what you want to achieve here.
If you have a concern or problem, I will try and help as I still have
installation logs from 1998 for V2 and 1999 for V3.
If it is just idle curiosity, then I will pass.

There is nothing relevant in the keys you have posted in duplicate.
Posting things like "Doc Find Spec MRU" is irrelevant as that only
exists because you have searched for the string.

....Alan
--
Alan Edwards, MS MVP W95/98 Systems
http://dts-l.org/index.html

On Wed, 27 Jul 2005 23:27:13 -0400, Steve Baker
<bakes-nanae@comcast.net> wrote:

>On Thu, 28 Jul 2005 09:45:29 +1000, Alan Edwards
><edwards@southcom.com.au> wrote:
>
>>Why are you concerned if Atguard is running?
>
> I'm not "concerned", I'm curious. I just want to know what's going
>on.
>
>>You must have installed it.
>
> Yes, and I mentioned that I checked the "Run at system startup"
>option in Atguard itself.
>
>>I haven't used it for many years but it should have two processes
>>starting from the Registry.
>>
>>iamapp.exe starts from:
>>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
>>
>>iamserv.exe starts from:
>>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
>
> Those are the "usual suspects", but neither are where Atguard is
>getting started. Iamserv.exe doesn't show up in the Registry. I've
>included the Registry hits on iamapp.exe below if you want to take a
>look. There is nothing in {the above path)\CurrentVersion\Run,
>RunServices, RunOnce, or RunOnceEx that has anything to do with
>Atguard. Unless loadwc.exe is somehow involved.
>
>>You have many more Atguard keys than the ones you mention.
>>Try searching for: iamapp, iamserv, IAM, WRQ, AtGuard,
>>@Guard,IAMVXD,IAMDRV
>
> Aha. Norton Utilities shows WRQNAM in memory, the details of which
>say:
>Process Path: C:\Program Files\Atguard\iamserv.exe.
>Parent Process: KERNEL32.DLL
>
> But the only hits on "wrq" in the Registry are:
>HKEY_CURRENT_USER\Software\WRQ
>HKEY_LOCAL_MACHINE\SOFTWARE\WRQ
>HKEY_USERS\.Default\Software\WRQ
>
> That seems like it might be an important clue, but I don't know what
>to make of it. ;-) How about you? Thanks for having a look in any case.
>Here are the Registry hits on iamapp.exe. I figured someone here would
>just know what the deal is. If I want to sort this out, it seems like
>it might be a good idea to disable that "Run at system startup" option
>and look for changes in the Registry. What do you think?
>
>Thanks again,
>Steve Baker
>
>HKEY_CLASSES_ROOT\AppID\iamapp.EXE
>HKEY_CLASSES_ROOT\CLSID\{70C80910-8B80-11D1-9BED-00A0C922BA92}\LocalServer32
>HKEY_CLASSES_ROOT\TypeLib\{B67D995B-A17C-11D1-9C05-00A0C922BA92}\1.0\0\win32
>HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc
>Find Spec MRU
>HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\iamapp.EXE
>HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70C80910-8B80-11D1-9BED-00A0C922BA92}\LocalServer32
>HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B67D995B-A17C-11D1-9C05-00A0C922BA92}\1.0\0\win32
>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App
>Paths\iamapp.exe
>HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc
>Find Spec MRU

 

[Guest]

Archived from groups: microsoft.public.win95.general.discussion (More info?)

On Thu, 28 Jul 2005 19:13:40 +1000, Alan Edwards
<edwards@southcom.com.au> wrote:

>Loadwc.exe is not involved. It has no connection with AtGuard. Load
>web check is a Microsoft program.
>
>I really don't know what you want to achieve here.

I want to understand how Atgaurd gets loaded during Win 95 boot.

>If you have a concern or problem, I will try and help as I still have
>installation logs from 1998 for V2 and 1999 for V3.

I have V 3.2. That's the version they just gave away just before they
transferred their assets to whoever it was that bought them. Norton?

>If it is just idle curiosity, then I will pass.

OK, no problem, thanks for having a look. I don't think that wanting
to understand why Win 95 loads an app when it boots is exactly "idle
curiosity", but I don't have a problem that needs to be solved.

>There is nothing relevant in the keys you have posted in duplicate.

Well, I posted them again for your convenience, so you wouldn't have
to backtrack to my original post. When iamapp.exe didn't show up in the
Registry where you said it would, I thought you might be interested in
seeing where iamapp.exe actually did show up in the Registry.

>Posting things like "Doc Find Spec MRU" is irrelevant as that only
>exists because you have searched for the string.

Huh? Searching for a string causes that string to appear in the
Registry? Maybe line wrap is causing some confusion here, I'm going to
manually wrap a line and we'll see if it makes more sense.

HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Explorer\Doc Find Spec MRU

That's what I see in the left hand pane in Regedit. In the right hand
pane "iamapp.exe" is the data for something named "h". Interestingly, I
see another executable there that runs during boot. And two others that
do not run during boot. And other data values like "ie.txt", "cookies",
and "hajcfegdbi".

There is also:
HKEY_USERS\.Default\Software\Microsoft\Windows\
CurrentVersion\Explorer\Doc Find Spec MRU

that seems to have the same data values as the key above.

Thanks for your offer to help me with a problem, but that's not where
I'm coming from.

Steve Baker

 

[Guest]

Archived from groups: microsoft.public.win95.general.discussion (More info?)

"Steve Baker" wrote

> >Posting things like "Doc Find Spec MRU" is irrelevant as that only
> >exists because you have searched for the string.

MRU = Most-Recently-Used

> Huh? Searching for a string causes that string to appear in the
> Registry?

Welcome to Windows.
Start / Documents does the same thing.

> do not run during boot. And other data values like "ie.txt", "cookies",
> and "hajcfegdbi".

Mine says "hebigdcfja".
It's just an alphabetical index of what was searched for last, not necessarily
in chronological order (for some reason only Billy knows).

 

[Guest]

Archived from groups: microsoft.public.win95.general.discussion (More info?)

On Thu, 28 Jul 2005 07:12:25 -0400, Steve Baker
<bakes-nanae@comcast.net> wrote:

>On Thu, 28 Jul 2005 19:13:40 +1000, Alan Edwards
><edwards@southcom.com.au> wrote:

>
>>There is nothing relevant in the keys you have posted in duplicate.
>
> Well, I posted them again for your convenience, so you wouldn't have
>to backtrack to my original post. When iamapp.exe didn't show up in the
>Registry where you said it would, I thought you might be interested in
>seeing where iamapp.exe actually did show up in the Registry.
>

Perhaps I wasn't clear. The duplicate pairs are:

HKEY_CLASSES_ROOT\AppID\iamapp.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\iamapp.EXE

HKEY_CLASSES_ROOT\CLSID\{70C80910-8B80-11D1-9BED-00A0C922BA92}\LocalServer32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{70C80910-8B80-11D1-9BED-00A0C922BA92}\LocalServer32

HKEY_CLASSES_ROOT\TypeLib\{B67D995B-A17C-11D1-9C05-00A0C922BA92}\1.0\0\win32
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{B67D995B-A17C-11D1-9C05-00A0C922BA92}\1.0\0\win32

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc
Find Spec MRU
HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\Doc
Find Spec MRU

>>Posting things like "Doc Find Spec MRU" is irrelevant as that only
>>exists because you have searched for the string.
>
> Huh? Searching for a string causes that string to appear in the
>Registry?

Yes. That is correct. That is where the history of your MRUs is held.

....Alan
--
Alan Edwards, MS MVP W95/98 Systems
http://dts-l.org/index.html

 

[Guest]

Archived from groups: microsoft.public.win95.general.discussion (More info?)

On Thu, 28 Jul 2005 07:12:25 -0400, Steve Baker
<bakes-nanae@comcast.net> wrote:

>On Thu, 28 Jul 2005 19:13:40 +1000, Alan Edwards
><edwards@southcom.com.au> wrote:
>
>>Loadwc.exe is not involved. It has no connection with AtGuard. Load
>>web check is a Microsoft program.
>>
>>I really don't know what you want to achieve here.
>
> I want to understand how Atgaurd gets loaded during Win 95 boot.
>

The two Registry keys that AtGuard uses to get loaded at boot are in
my first reply.

....Alan
--
Alan Edwards, MS MVP W95/98 Systems
http://dts-l.org/index.html

 

[Guest]

Archived from groups: microsoft.public.win95.general.discussion (More info?)

On Thu, 28 Jul 2005 22:05:27 +1000, Alan Edwards
<edwards@southcom.com.au> wrote:

>The two Registry keys that AtGuard uses to get loaded at boot are in
>my first reply.

You mean this?

>iamapp.exe starts from:
>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
>
>iamserv.exe starts from:
>HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

That's not it. Neither executable shows up in either of those keys,
and there's nothing that has anything to do with Atguard in either of
those keys.

>You have many more Atguard keys than the ones you mention.
>Try searching for: iamapp, iamserv, IAM, WRQ, AtGuard,
>@Guard,IAMVXD,IAMDRV

I've searched on iam and atguard and found no differences between
Atguard starting on bootup and Atguard not starting on bootup (although
I didn't really look closely at key values).
There are no hits on @Guard.
There are three hits on WRQ when Atguard is set to start on bootup;
keys that have Name: (default) Data: (value not set) as the only info.

Got any other ideas? C'mon, don't you like solving mysteries? ;-)

This must have something to do with what's going on, right?

> Aha. Norton Utilities shows WRQNAM in memory, the details of which
>say:
>Process Path: C:\Program Files\Atguard\iamserv.exe.
>Parent Process: KERNEL32.DLL

How is that getting started? Could Atguard be messing around with
..dlls that run at bootup?

Thanks,
Steve Baker

 

[Guest]

Archived from groups: microsoft.public.win95.general.discussion (More info?)

See if there is anything relevant in the following folder.

C:\WINDOWS\All Users\Start Menu\PROGRAMS\STARTUP

Ben

"Steve Baker" <bakes-nanae@comcast.net> wrote in message news:qbqme19q2g49fg04vf7hdskqnlulq46ajr@4ax.com...
> On Thu, 28 Jul 2005 22:05:27 +1000, Alan Edwards
> <edwards@southcom.com.au> wrote:
>
> >The two Registry keys that AtGuard uses to get loaded at boot are in
> >my first reply.
>
> You mean this?
>
> >iamapp.exe starts from:
> >HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
> >
> >iamserv.exe starts from:
> >HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
>
> That's not it. Neither executable shows up in either of those keys,
> and there's nothing that has anything to do with Atguard in either of
> those keys.
>
> >You have many more Atguard keys than the ones you mention.
> >Try searching for: iamapp, iamserv, IAM, WRQ, AtGuard,
> >@Guard,IAMVXD,IAMDRV
>
> I've searched on iam and atguard and found no differences between
> Atguard starting on bootup and Atguard not starting on bootup (although
> I didn't really look closely at key values).
> There are no hits on @Guard.
> There are three hits on WRQ when Atguard is set to start on bootup;
> keys that have Name: (default) Data: (value not set) as the only info.
>
> Got any other ideas? C'mon, don't you like solving mysteries? ;-)
>
> This must have something to do with what's going on, right?
>
> > Aha. Norton Utilities shows WRQNAM in memory, the details of which
> >say:
> >Process Path: C:\Program Files\Atguard\iamserv.exe.
> >Parent Process: KERNEL32.DLL
>
> How is that getting started? Could Atguard be messing around with
> .dlls that run at bootup?
>
> Thanks,
> Steve Baker
>

 

[Guest]

Archived from groups: microsoft.public.win95.general.discussion (More info?)

On Sat, 30 Jul 2005 12:56:43 -0400, "Ben Myers"
<benjmyers@mindR-E-M-O-V-Espring.com> wrote:

>See if there is anything relevant in the following folder.
>
>C:\WINDOWS\All Users\Start Menu\PROGRAMS\STARTUP

I have a "C:\Windows\All Users" folder, but there is no "Start Menu"
subfolder. There is one subfolder, "Application Data", and one
subfolder under that, "QuickTime".

I do have a "startup" folder at:
C:\windows\start menu\programs\startup

Programs/Shortcuts located there do run at boot. There's nothing
there that has anything to with Atguard, though.

Thanks,
Steve Baker

 

[Guest]

Archived from groups: microsoft.public.win95.general.discussion (More info?)

It may be loading as a device driver. See if the following registry
key exists.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\IAMDRV

Ben

"Steve Baker" <bakes-nanae@comcast.net> wrote in message news:1edne1lctlikqq33b5un0mj5k6dokj1vvn@4ax.com...
> On Sat, 30 Jul 2005 12:56:43 -0400, "Ben Myers"
> <benjmyers@mindR-E-M-O-V-Espring.com> wrote:
>
> >See if there is anything relevant in the following folder.
> >
> >C:\WINDOWS\All Users\Start Menu\PROGRAMS\STARTUP
>
> I have a "C:\Windows\All Users" folder, but there is no "Start Menu"
> subfolder. There is one subfolder, "Application Data", and one
> subfolder under that, "QuickTime".
>
> I do have a "startup" folder at:
> C:\windows\start menu\programs\startup
>
> Programs/Shortcuts located there do run at boot. There's nothing
> there that has anything to with Atguard, though.
>
> Thanks,
> Steve Baker
>

 

[Guest]

Archived from groups: microsoft.public.win95.general.discussion (More info?)

On Sat, 30 Jul 2005 19:36:03 -0400, "Ben Myers"
<benjmyers@mindR-E-M-O-V-Espring.com> wrote:

>It may be loading as a device driver. See if the following registry
>key exists.
>
>HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\IAMDRV

Yes! It has three values, one of which is Name: StaticVxD Data:
C:\PROGRA~1\ATGUARD\iamdrv.vxd. But... that is there even when Atguard
doesn't start on bootup. And the last modified date on iamdrv.vxd is in
1999. However, iamfw.rel, iamsys.rel, and iamtcp.rel were modified when
I changed the Atguard configuration to not start on bootup. And then
when I changed it back so Atguard starts on bootup, iamsys.rel and
iamfw.rel were modified. Does this look like it might be the solution
to the mystery?

Thanks,
Steve Baker

 

[Guest]

Archived from groups: microsoft.public.win95.general.discussion (More info?)

I don't use AtGuard, but the version of ZoneAlarm I use removes
its registry entry when configured not to run at startup. I suspect
AtGuard leaves the registry key in place, perhaps disabling it by
adding or removing a "Start" value.

Ben

"Steve Baker" <bakes-nanae@comcast.net> wrote in message newsc3pe1l2sgail5vt8qiktajq0p2pegoqqr@4ax.com...
> On Sat, 30 Jul 2005 19:36:03 -0400, "Ben Myers"
> <benjmyers@mindR-E-M-O-V-Espring.com> wrote:
>
> >It may be loading as a device driver. See if the following registry
> >key exists.
> >
> >HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\IAMDRV
>
> Yes! It has three values, one of which is Name: StaticVxD Data:
> C:\PROGRA~1\ATGUARD\iamdrv.vxd. But... that is there even when Atguard
> doesn't start on bootup. And the last modified date on iamdrv.vxd is in
> 1999. However, iamfw.rel, iamsys.rel, and iamtcp.rel were modified when
> I changed the Atguard configuration to not start on bootup. And then
> when I changed it back so Atguard starts on bootup, iamsys.rel and
> iamfw.rel were modified. Does this look like it might be the solution
> to the mystery?
>
> Thanks,
> Steve Baker
>

 

[Guest]

Archived from groups: microsoft.public.win95.general.discussion (More info?)

On Sun, 31 Jul 2005 18:19:07 -0400, "Ben Myers"
<benjmyers@mindR-E-M-O-V-Espring.com> wrote:

>I don't use AtGuard, but the version of ZoneAlarm I use removes
>its registry entry when configured not to run at startup. I suspect
>AtGuard leaves the registry key in place, perhaps disabling it by
>adding or removing a "Start" value.

OK. Whatever that means. ;-) Just in case your're interested, I found
that the files I mentioned that get changed probably have nothing to do
with configuration, they're apparently just data files like the event
log, etc.

Thanks,
Steve Baker