Computer Help forum

General discussion

Annoying Prompt at Start-up "Sansa.exe"

Last night I installed my copy of ESET NOD32 Anti-virus and ever sine then, I've been getting these annoying prompts at start up; Sometimes the same prompt will pop up 2 to 5 times all at once.

I looked into the msconfig startup menu and I see what the problem is...it's a program called "ghfghfghfghfg" from a manufacturer with the same name. A close look into the Location section shows that an .exe file called Sansa.exe is trying to start up.

The prompt says something like "This fix can only be run by an administrator." or something very similar.

I've done a virus scan but it still comes up the same. Can anyone help me?

Discussion is locked
You are posting a reply to: Annoying Prompt at Start-up "Sansa.exe"
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Annoying Prompt at Start-up "Sansa.exe"
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.
Collapse -
Any clue in the location?

In reply to: Annoying Prompt at Start-up "Sansa.exe"

MSCONFIG should tell you the path or location of this file, but you may have to drag the location column header to the right (and scroll the window to the left), to see the full path.

I could find much about Sansa.exe in Google, except a reference to "Sansa media converter". Does that ring a bell?

If not, what happens if you de-select the entry in MSCONFIG?

Mark

Collapse -
Location

In reply to: Any clue in the location?

Here's the location that MSCONFIG gives me...
HKCU\software\microsoft\windows\currentversion\run

Interestingly, the command section gives a different path, which is...
C:\Windows\System32\Sansa\sansa.exe

Last night, after I posted, I downloaded the Autoruns program from Microsoft and managed to get rid of the pop up, but according to MSCONFIG, the fghfghfghfghf program is still starting up.

I've tried to deselect or disable it, but it starts up anyway.

Collapse -
Well that's progress.

In reply to: Location

Did you check what this C:\Windows\System32\Sansa\ folder holds? As I said before, I could only find some reference to a "Sansa media converter". If you have that software installed then that could explain Sansa.exe.

MSCONFIG does not delete entries in it's Startup tab, even if we de-select the entry there. It still remains listed, although I would have assumed that any entry there would have a corresponding registry entry in one of the "Run" keys, so perhaps deleting that key should have deleted the entry as well.

Mark

Collapse -
No folders

In reply to: Well that's progress.

Mark, I've looked around for the folder but it's not there! I've even tried to type it in manually and went as far as trying to delete the file via the command prompt.

I've tried to delete the registry keys, but they just keep coming back.

@Cursorcowboy
Thanks! I'll definitely research those products and see what turns up.

Thanks again, guys.

Collapse -
Location.

In reply to: Location

Here's the location that MSCONFIG gives me...

a. HKCU\software\microsoft\windows\currentversion\run

Interestingly, the command section gives a different path, which is...

b. C:\Windows\System32\Sansa\sansa.exe


FIRST concerning a: above, either one the following applications can stop the running of the module in question.

1. In the recesses of your computer, numerous seemingly invisible processes run silently in the background that may be hogging system resources turning your PC into a sluggish computer, and worse yet, other useless processes harbor spyware and Trojans - violating your privacy and giving hackers free reign on your computer. The System Configuration Utility "MSCONFIG" automates the routine troubleshooting steps to eliminate issues and diagnose system configuration and to easily reset or change configuration settings.

Warning: Before beginning a troubleshooting session initiate a System Restore operation to create restore points that can be used to restore a computer to a previous state just in case something goes wrong, [Q306084].

2. Although MSCONFIG is a priceless troubleshooting tool, it's lacking a few features and one or more of the following two applications is suggested:

a. Written by Mike Lin, the utility "Startup Control Panel" is well worth investigating.

b. "Starter" is yet another free startup manager that allows you to view and manage all the programs that are starting automatically whenever Windows boots. It lists all the hidden registry entries, as well as the common Startup Folder items. You can choose to safely disable selected entries, edit them or delete them altogether (if you know what you're doing). Expert users can even add their own entries.

SECOND concerning b: above, though either one of the above applications will stop the module from running on startup neither one can remove the module from your computer which either has to be uninstalled or removed manually by you. It appears that the sansa.exe file exists in the folder C:\Windows\System32\Sansa\, where you may find an uninstall process listed within the Sansa subfolder. You'll just have to see.
Collapse -
Sansa.exe

In reply to: Annoying Prompt at Start-up "Sansa.exe"

Had the same problem, solved it as follows (WinXP)

1) In My Computer, Tools, Folder Options, View, untick 'hide protected operating system files'.

2) Start Windows in safe mode (F8 at startup), go to C:\windows\system32, find the Sansa folder & delete it.

3) Click start, run & type 'regedit'. In HKLM & HKCU \Software delete any Sansa folder (I only found one).

4) In C:\windows\prefetch delete the Sansa file.

5) Restart Windows normally - should be OK. You can retick the protected files box.

Collapse -
How to kill the sansa threat

In reply to: Sansa.exe

I found that doing the following removed the threat:

1. Open Regedit and go to to the HKLM\Software\Sansa and delete the folder
2. Go to the HKLM\Software\Microsoft\Windows\CurrentVersion\Run (don't delete the sansa entry just yet)...keep that window open
3. Open Task Manager
4. Wait for ESET to identify the threat
5. Kill the process in Task Manager that ESET identifies (probably explorer.exe)
6. Verify the process is gone in Task Manager(your desktop icons will disappear). You may have to kill it more than once.
7. Click on "Delete" in ESET's warning popup. It may pop up several times. keep doing it until it stops. Make sure that the offending process doesn't show up again in Task Manager or you'll have to kill it again.
8. Once ESET is done and is quiet again, delete the sansa entry in the remaining Registry key in step 2 (above).
9. Reboot the computer. I had to do a hard shut down since Explorer was off.

The problem should be gone now.

Popular Forums

icon
Computer Newbies 10,686 discussions
icon
Computer Help 54,365 discussions
icon
Laptops 21,181 discussions
icon
Networking & Wireless 16,313 discussions
icon
Phones 17,137 discussions
icon
Security 31,287 discussions
icon
TVs & Home Theaters 22,101 discussions
icon
Windows 7 8,164 discussions
icon
Windows 10 2,657 discussions

DEALS, DEALS, DEALS!

Best Black Friday Deals

CNET editors are busy culling the list and highlighting what we think are the best deals out there this holiday season.