msinfo32.exe where does it get its information from?


  1. Posts : 4
    Windows 10 Pro
       #1

    msinfo32.exe where does it get its information from?


    I installed Surfshark VPN and after that had some crazy info in start-up , but only when I use system information, so i made a copy of the sytem information and searched and found:

    <Category name="Start-up Programs">
    <Data>
    <Program><![CDATA[]]></Program>
    <Command><![CDATA[需尙ȑ]]></Command>
    <Username><![CDATA[NT AUTHORITY\SYSTEM]]></Username>
    <Location><![CDATA[HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]]></Location>
    </Data>
    If I go back to a resore point before Surfshark this info above is gone, Install Surfshark and its back?

    Wonder who can piont me to where this garbage can be deleted

    - - - Updated - - -

    Almost 100 views and no answer?

    Here is Surfsharks reply:
    Thank you for your letter.

    After a conversation with our Windows developers we can indeed confirm that those processes come with our latest software version and are not in Chinese, but are in hexadecimal code, which the system converts into a changing pattern of hieroglyphics.

    The processes are natural and integral to the inner workings of the application.

    - - - Updated - - -

    Thank you for your reply.

    These hexadecimal code processes are needed for the application, but disabling them will not interfere with its inner workings.

    You can disable your Windows Security notification icon in the Startup Programs, then simply restart your computer and the processes will be gone.

    - - - Updated - - -

    Well rather stupid idea to disable security, but gave it a bash anyway and it did not resolve the issue Seems the only way is to format and reinstall windows and not put this software on the pc
      My Computer


  2. Posts : 303
    Windows 10 x64 1809 LTSC
       #2

    To answer your title question: The Windows registry.

    The software creates an auto start task in the registry at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.

    To get rid of the start up entry but keep the software installed do..

    REG DELETE "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v surfshark /f

    You could uninstall the software (control panel, programs and features or settings, apps, uninstall), if you don't want to use it. The uninstaller is broken though (that's very common). Even after uninstalling the software it leaves the run entry in the registry, does not remove the C:\Program Files (x86)\Surfshark folder, does not remove the TAP driver and a multitude of other registry entries.

    Best way to get rid of it; Use system restore or restore from a backup image if you have one.

    I wonder if a more popular VPN provider like NordVPN, ExpressVPN, PrivateInternet Access might be worth considering? I've used all of these and NordVPN has been the best for me so far. this surfshark seems a bit off to me, but its a personal choice.
      My Computers


  3. Posts : 4
    Windows 10 Pro
    Thread Starter
       #3

    Wobitancrawfodi said:
    To answer your title question: The Windows registry.

    The software creates an auto start task in the registry at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.

    To get rid of the start up entry but keep the software installed do..

    REG DELETE "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v surfshark /f

    You could uninstall the software (control panel, programs and features or settings, apps, uninstall), if you don't want to use it. The uninstaller is broken though (that's very common). Even after uninstalling the software it leaves the run entry in the registry, does not remove the C:\Program Files (x86)\Surfshark folder, does not remove the TAP driver and a multitude of other registry entries.

    Best way to get rid of it; Use system restore or restore from a backup image if you have one.

    I wonder if a more popular VPN provider like NordVPN, ExpressVPN, PrivateInternet Access might be worth considering? I've used all of these and NordVPN has been the best for me so far. this surfshark seems a bit off to me, but its a personal choice.

    The problem is it put it here:
    Computer\HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
    msinfo32.exe where does it get its information from?-bs.png
      My Computer


  4. Posts : 13,959
    Windows 10 Pro X64 21H1 19043.1503
       #4

    Seems like getting rid of SurfShark is the way to go.
      My Computers


  5. Posts : 303
    Windows 10 x64 1809 LTSC
       #5

    skylink said:
    The problem is it put it here:
    Computer\HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run
    Windows does often mirror registry entries. Then adjust the reg delete command as necessary to delete the corresponding keys.

    But as ztruker said, as this software does seem to be obfuscating it's commands perhaps its best to use a different VPN provider.
      My Computers


  6. Posts : 4
    Windows 10 Pro
    Thread Starter
       #6

    Wobitancrawfodi said:
    Windows does often mirror registry entries. Then adjust the reg delete command as necessary to delete the corresponding keys.

    But as ztruker said, as this software does seem to be obfuscating it's commands perhaps its best to use a different VPN provider.
    Well we got it sorted HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Just deleted the "Run" and then put "Run" back again and all the funny stuff has gone.
      My Computer


 

  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd
All times are GMT -5. The time now is 23:57.
Find Us




Windows 10 Forums