Howdy Folks from Fort Worth, Texas!
I am a brand spankin' new member
and I found you good folks by doin'
a search on Google for rasreg.exe.
This was the only site that even mentioned
this executable, and even then it did not
seem to be adressed in the threads.
This program is found in the windows/help folder
and is executed at startup from the registry
hklm/software/microsoft/windows/current version/run once
I once thought of myself as being a seasoned technician
and own and operate my own computer business
BUT
this one has me stumped. You can't delete either the file
or the registry entry - EVEN IN SAFE MODE!!! - as it either
won't let you delete the file or just comes back immediately after
you delete the registry entry, and all this even in safe mode!
YES, I have run hijack, spybot, adaware, spysweeper, avg, etc.
all to no avail.? This program does seem to be related to another
entry in the temp files called getsar.dat, which once again i cannot
delete even in safe mode and once again there is no mention in
any of the web searches i have performed. Any Suggestions???

Hi and welcome.

Ok, it's nice to know that we are the ONLY result on Google for some things!!?

Rasreg.exe showed up in this post: Homesearchassistant Hell

in the string..
O4 - HKLM\..\Run: [rasreg] C:\WINDOWS\security\templates\rasreg.exe

- a search on the forum for rasreg would have given you this result -

Personally I haven't heard of it either but hopefully someone will be able to help you, although with no other info being recorded on the 'net we may have to approach this a different way.

Welcome to the Forums miklskon.

-- I am sure you have probably done most of what I say but have to make sure ---

I have never seen that file either and can't find anything on it when doing a search on the net, so lets try go over a few things.

It sounds like the file is attached to a program that is launching when you boot your machine, that would explain why it keeps loading itself into the registry.

Have a look in the following:

• Startup Menu
• Autoexec.bat (not sure which version of windows you are running)
• Also look in the registry under RUN

You could go to START - RUN and type msconfig, and see whether there is anything funny in there.

Also check in Add/Remove programs and C:\Program Files and make sure there are no strange programs.

The last thing I can recommend is running something like Regclean

I found a brilliant regcleaner program (REGISTRY FIX) which you can get from this site http://www.registryfix.com/
You have to pay for it if you want it to fix your problems but its worth running it and then going through the end log to see what it had detected as a problem. Then you could manually go through and delete it.


---EDITED --- Could it not have something to do with Windows Remote Access Service (RAS) client http://support.microsoft.com/kb/q158909/
i might be wrong but worth a shot -- have you used this or enabled it?

OK, thanks for the suggestions, but perhaps i was not clear. I tried all the obvious and did extensive searches for rasreg.exe to no avail. Yes, there were a few mentions in hijack this log posts ( am i the only one who is REALLY frustrated with folks posting the entire contents of their logs in forums and then the whole world gets to see them whenever they do a search for a particular item? ) Anyway, my good tech buddy, JyCk ( who invented the internet, btw ) said he has had success with such problems by setting up the hard drive in question as a secondary drive on another machine and performing the scans and manual deletions from a known-good/clean primary/master drive. I know this works, too, but dadgummit, this is was a notebook, and the hard drive would have been a might bit difficult to get to, and then of course you would have to adapt it to a standard 40 pin cable, etc. Not worth the hassle just yet. His other suggestion was to boot up with BartPE and perform the deletions from that OS! Super Idea!!! Did it and worked like a champ. Then rebooted back into winxp off of original drive and winxp gave an error message that it could not find/run rasreg.exe! "Awwww.... too bad.... " I then went directly to the registry to edit out the entry but for once in its existence, winxp did something right! It had already deleted the entry for me! Super Nice. I do not think this was in anyway related to remote assistance, and none of the guns i tried ( and i have most all of them, including the regcleaners mentioned ) would even recognize this file as unwanted or undesirable. But one last thing, the more scans i did and the more i "poked" at the file, the more it "came to life." At several points i got a few error messages related to this files activity and later my firewall ( Zone Alarm has been a real winner for me after thoroughly firing "Norton's Abortion" of a Firewall. ) anyway, ( don't get me started on badmouthing norton) my firewall intercepted rasreg's attempt to call out to the internet. I denied it access, of course, and that put a cap on that. Also, I have been EXCEPTIONALLY pleased with LIUtilities WinTasks 5 Professional. I tried to block the rasreg process and it was like watching a tennis match, execute and block, execute and block, every second it would go back and forth. I STILL have no idea what this process is, but whatever it is, the author(s) does not seem very interested in letting us know what it is and who it is from, and that alone is the first red flag in my book. OK, let you ponder this if you like and let me know what you think. Computer was returned to native owner and seems to be working splendidly for the moment. Thanks for all your help! miklskon