System32 Folder opens on startup with Windows XP

[George]

When I boot up the System32 folder opens on the startup.
When I ran Norton it found a virus Trojan.Benuti which
pointed to a file wotypw.exe in the System 32 folder.
Norton has not been able to correct this and I am unable
to delete the wotypw.exe file. When I touch the file with
my cursor, the Norton virus checker immediately tells me
this is a virus file. Help!!!

[Rick \Nutcase\ Rogers]

Hi,

Start/run regedit, navigate to this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run

Look for a string in the right-pane that references that file and delete it.
Close the registry editor. Hit ctrl+shift+escape and check the processes tab
for wotypw.exe. End task on it, then reboot the system. See if this resolves
the problem.

--
Best of Luck,

Rick Rogers aka "Nutcase" MS-MVP - Win9x
Windows isn't rocket science! That's my other hobby!
http://mvp.support.microsoft.com/
Associate Expert - WinXP - Expert Zone
www.microsoft.com/windowsxp/expertzone
Win98 Help - www.rickrogers.org

"George" > wrote in message
...
> When I boot up the System32 folder opens on the startup.
> When I ran Norton it found a virus Trojan.Benuti which
> pointed to a file wotypw.exe in the System 32 folder.
> Norton has not been able to correct this and I am unable
> to delete the wotypw.exe file. When I touch the file with
> my cursor, the Norton virus checker immediately tells me
> this is a virus file. Help!!!

[Doug Knox MS-MVP]

For the virus file, open Task Manager (Start, Run and enter TASKMGR.EXE)
Locate the process with the same name as the virus file, highlight it and
click End Process. Then you should be able to delete the file, or let
Norton delete it.

In addition to the Registry entry that Rick gave, check the same key, except
in HKEY_LOCAL_MACHINE, instead of HKEY_CURRENT_USER

--
Doug Knox, MS-MVP Windows XP/ Windows Smart Display
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"George" > wrote in message
...
> When I boot up the System32 folder opens on the startup.
> When I ran Norton it found a virus Trojan.Benuti which
> pointed to a file wotypw.exe in the System 32 folder.
> Norton has not been able to correct this and I am unable
> to delete the wotypw.exe file. When I touch the file with
> my cursor, the Norton virus checker immediately tells me
> this is a virus file. Help!!!

[JL]

Hi,

I have the same problem when I get the to desktop after WindowsXP (French Family Edition) has booted, the System32 folder opens or wants to open, as I get a warning that this file should not be opened. I just close the warning message and everything seem
s to be fine. It's annoying and I would like to find a solution.

I searched my HD for the wotypw.exe file and it can't be found, so I guess that my particular problem is not related to this issue. Does anybody else have the same problem? Does anybody know of a fix?

JL

----- Doug Knox MS-MVP wrote: -----

For the virus file, open Task Manager (Start, Run and enter TASKMGR.EXE)
Locate the process with the same name as the virus file, highlight it and
click End Process. Then you should be able to delete the file, or let
Norton delete it.

In addition to the Registry entry that Rick gave, check the same key, except
in HKEY_LOCAL_MACHINE, instead of HKEY_CURRENT_USER

--
Doug Knox, MS-MVP Windows XP/ Windows Smart Display
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"George" > wrote in message
...
> When I boot up the System32 folder opens on the startup.
> When I ran Norton it found a virus Trojan.Benuti which
> pointed to a file wotypw.exe in the System 32 folder.
> Norton has not been able to correct this and I am unable
> to delete the wotypw.exe file. When I touch the file with
> my cursor, the Norton virus checker immediately tells me
> this is a virus file. Help!!!

[Doug Knox MS-MVP]

If you have a Sound Blaster Audigy 2 sound card, see:
www.kellys-korner.com/xp_tweaks.htm, Line 260
System32 Folder Opens Upon Boot

Otherwise, see:
http://support.microsoft.com/default.aspx?id=170086
System32 Folder Opens When Logging on to Windows

--
Doug Knox, MS-MVP Windows XP/ Windows Smart Display
Win 95/98/Me/XP Tweaks and Fixes
http://www.dougknox.com
--------------------------------
Per user Group Policy Restrictions for XP Home and XP Pro
http://www.dougknox.com/xp/utils/xp_securityconsole.htm
--------------------------------
Please reply only to the newsgroup so all may benefit.
Unsolicited e-mail is not answered.

"JL" > wrote in message
...
> Hi,
>
> I have the same problem when I get the to desktop after WindowsXP (French
> Family Edition) has booted, the System32 folder opens or wants to open, as
> I get a warning that this file should not be opened. I just close the
> warning message and everything seems to be fine. It's annoying and I
> would like to find a solution.
>
> I searched my HD for the wotypw.exe file and it can't be found, so I guess
> that my particular problem is not related to this issue. Does anybody
> else have the same problem? Does anybody know of a fix?
>
> JL
>
> ----- Doug Knox MS-MVP wrote: -----
>
> For the virus file, open Task Manager (Start, Run and enter
> TASKMGR.EXE)
> Locate the process with the same name as the virus file, highlight it
> and
> click End Process. Then you should be able to delete the file, or let
> Norton delete it.
>
> In addition to the Registry entry that Rick gave, check the same key,
> except
> in HKEY_LOCAL_MACHINE, instead of HKEY_CURRENT_USER
>
> --
> Doug Knox, MS-MVP Windows XP/ Windows Smart Display
> Win 95/98/Me/XP Tweaks and Fixes
> http://www.dougknox.com
> --------------------------------
> Per user Group Policy Restrictions for XP Home and XP Pro
> http://www.dougknox.com/xp/utils/xp_securityconsole.htm
> --------------------------------
> Please reply only to the newsgroup so all may benefit.
> Unsolicited e-mail is not answered.
>
> "George" > wrote in message
> ...
> > When I boot up the System32 folder opens on the startup.
> > When I ran Norton it found a virus Trojan.Benuti which
> > pointed to a file wotypw.exe in the System 32 folder.
> > Norton has not been able to correct this and I am unable
> > to delete the wotypw.exe file. When I touch the file with
> > my cursor, the Norton virus checker immediately tells me
> > this is a virus file. Help!!!
>
>
>