msinfo32.exe where does it get its information from?

I installed Surfshark VPN and after that had some crazy info in start-up , but only when I use system information, so i made a copy of the sytem information and searched and found:

<Category name="Start-up Programs">
<Data>
<Program><![CDATA[]]></Program>
<Command><![CDATA[需尙ȑ]]></Command>
<Username><![CDATA[NT AUTHORITY\SYSTEM]]></Username>
<Location><![CDATA[HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]]></Location>
</Data>
If I go back to a resore point before Surfshark this info above is gone, Install Surfshark and its back?

Wonder who can piont me to where this garbage can be deleted

- - - Updated - - -

Almost 100 views and no answer?

Here is Surfsharks reply:
Thank you for your letter.

After a conversation with our Windows developers we can indeed confirm that those processes come with our latest software version and are not in Chinese, but are in hexadecimal code, which the system converts into a changing pattern of hieroglyphics.

The processes are natural and integral to the inner workings of the application.

- - - Updated - - -

Thank you for your reply.

These hexadecimal code processes are needed for the application, but disabling them will not interfere with its inner workings.

You can disable your Windows Security notification icon in the Startup Programs, then simply restart your computer and the processes will be gone.

- - - Updated - - -

Well rather stupid idea to disable security, but gave it a bash anyway and it did not resolve the issue Seems the only way is to format and reinstall windows and not put this software on the pc

To answer your title question: The Windows registry.

The software creates an auto start task in the registry at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.

To get rid of the start up entry but keep the software installed do..

REG DELETE "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v surfshark /f

You could uninstall the software (control panel, programs and features or settings, apps, uninstall), if you don't want to use it. The uninstaller is broken though (that's very common). Even after uninstalling the software it leaves the run entry in the registry, does not remove the C:\Program Files (x86)\Surfshark folder, does not remove the TAP driver and a multitude of other registry entries.

Best way to get rid of it; Use system restore or restore from a backup image if you have one.

I wonder if a more popular VPN provider like NordVPN, ExpressVPN, PrivateInternet Access might be worth considering? I've used all of these and NordVPN has been the best for me so far. this surfshark seems a bit off to me, but its a personal choice.

Wobitancrawfodi said:

To answer your title question: The Windows registry.

The software creates an auto start task in the registry at HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run.

To get rid of the start up entry but keep the software installed do..

REG DELETE "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v surfshark /f

You could uninstall the software (control panel, programs and features or settings, apps, uninstall), if you don't want to use it. The uninstaller is broken though (that's very common). Even after uninstalling the software it leaves the run entry in the registry, does not remove the C:\Program Files (x86)\Surfshark folder, does not remove the TAP driver and a multitude of other registry entries.

Best way to get rid of it; Use system restore or restore from a backup image if you have one.

I wonder if a more popular VPN provider like NordVPN, ExpressVPN, PrivateInternet Access might be worth considering? I've used all of these and NordVPN has been the best for me so far. this surfshark seems a bit off to me, but its a personal choice.

The problem is it put it here:
Computer\HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

skylink said:

The problem is it put it here:
Computer\HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run

Windows does often mirror registry entries. Then adjust the reg delete command as necessary to delete the corresponding keys.

But as ztruker said, as this software does seem to be obfuscating it's commands perhaps its best to use a different VPN provider.

Wobitancrawfodi said:

Windows does often mirror registry entries. Then adjust the reg delete command as necessary to delete the corresponding keys.

But as ztruker said, as this software does seem to be obfuscating it's commands perhaps its best to use a different VPN provider.

Well we got it sorted HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Just deleted the "Run" and then put "Run" back again and all the funny stuff has gone.