1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

NWEReboot, what, when, why?

Discussion in 'Security and Privacy' started by Christer, 2005/01/11.

Thread Status:
Not open for further replies.
  1. 2005/01/11
    Christer

    Christer Geek Member Staff Thread Starter

    Joined:
    2002/12/17
    Messages:
    6,566
    Likes Received:
    73
    Hello all!

    I had a look in msconfig > autostart and found an "empty" (no command) line with reference to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

    I cross referenced what is under that key with what is in msconfig > autostart and found NWEReboot possibly/probably matching the "empty" line.

    The NWEReboot stringvalue has no data.

    I went google on it but apart from giving the name "dummy.exe" (which I don't have on my system) for the executable, it yielded no useful information.

    Does anyone have the answers to the what, when and why?

    Thanks for Your time,
    Christer
     
    Last edited: 2005/01/11
    Christer,
    #1
  2. 2005/01/11
    Christer

    Christer Geek Member Staff Thread Starter

    Joined:
    2002/12/17
    Messages:
    6,566
    Likes Received:
    73
    I checked a few HijackThis logs that showed up in the google search.

    One of them gives reference to NeroVision Express 2.
    I have NeroVision Express 3 installed but nothing shows up in my HJT log.

    Another HJT log gives reference to InCD\Setup.exe which also is a Nero application. I don't have InCD installed.

    Could it be a key created during some Nero installation that should have been in RunOnce and not Run?

    Christer
     
    Last edited: 2005/01/11
    Christer,
    #2


  3. to hide this advert.

  4. 2005/01/11
    Zander

    Zander Geek Member Alumni

    Joined:
    2002/01/07
    Messages:
    4,084
    Likes Received:
    5
    Maybe you should give Autoruns a try. No guarantees but it may be able to point you to what it is. If you click on the view menu you can hide any MS stuff that's loading at startup. Anything odd in Taskmanager?
     
    Zander,
    #3
  5. 2005/01/11
    Christer

    Christer Geek Member Staff Thread Starter

    Joined:
    2002/12/17
    Messages:
    6,566
    Likes Received:
    73
    Hi Zander!

    Autoruns didn't list the entry, probably due to nothing running from it (no data in the stringvalue).

    Nothing strange in TaskManager. I checked additions during the installation of the operating system and programs. No recent additions that I can't explain (gcasDtServ from Microsoft AntiSpyware is a recent but explained addition).

    Christer
     
    Christer,
    #4
  6. 2005/01/11
    Zander

    Zander Geek Member Alumni

    Joined:
    2002/01/07
    Messages:
    4,084
    Likes Received:
    5
    Well, I really don't know what else to say about it. I've done some searching on it too and don't come up with much more than you. Theres' some hits on dummy.exe in the Google groups but a lot of them are programmer related things that I'm sure aren't related to this at all. I would imagine there's been a lot of different dummy.exe files created for one reason or another, if you know what I mean. It's kind of a common name.

    NWEReboot is listed at Pac Portal. It also refers to dummy.exe but it's listed as unknown there too. I'd do a virus scan, maybe use an online one or two also, just in case. Guess if I didn't find anything else I'd backup the key and delete the entry. Maybe somebody else will know but it doesn't look to promising. Hope you don't find any virus or trojan or anything like that. I saw that comment you made in the other thread about surfing like a choir boy. Just kidding. :)
     
    Zander,
    #5
  7. 2005/01/11
    Christer

    Christer Geek Member Staff Thread Starter

    Joined:
    2002/12/17
    Messages:
    6,566
    Likes Received:
    73
    I have run Ad-aware, Spybot, MS AntiSpyware, Norton AntiVirus scan, Trend Micro online scan and HijackThis. Nothing found and nothing I couldn't identify in the HJT log:

    Looks clean to me and I believe that if it really was something to worry about, someone would have sorted it by now. The first time reference I found when googling was 2003.

    Is it possible that an installer (Nero?) has put this entry in ...\Run instead of in ...\RunOnce?

    When I feel the urge, I'll delete that stringvalue and see what happens.

    Christer
     
    Christer,
    #6
  8. 2005/01/11
    Christer

    Christer Geek Member Staff Thread Starter

    Joined:
    2002/12/17
    Messages:
    6,566
    Likes Received:
    73
    Well, I felt the urge and deleted the NWEReboot value. I shut down and restarted ...... :p ...... and I'm back!

    Probably harmless but still no answers to what, when and why.

    Christer
     
    Christer,
    #7
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...