I recently received an email (claiming to be from a friend) with an attachment labelled ‘IncrediMail’. The attachment claimed to contain pictures, called ‘emoticons’ for decorating emails. I began to download these emoticons but became suspicious and aborted the download then deleted the email. I contacted my friend who said they had not sent the message. Now, when Windows starts the following message appears: ‘Open File. Security Warning. Do you want to run this file? Publisher: IncrediMail Ltd. From: C:DOCUME~OwnerLOCALS~1TempImInstall…’. There are two buttons: Run and Cancel. Of course, I click the Cancel button and the message disappears. How can I stop this message from appearing on startup? The computer is running Windows XP.

It is good that you are suspicious of any programs which are emailed to you. As a rule of thumb you should never open any attachments which you are not expecting, or you are not certain about their purpose. This is because generally once you run the program and the installation process is started, the damage can be done very quickly. Fortunately in this case, IncrediMail is not spyware (you can check the IncrediMail privacy policy at www.incredimail.com/english/privacy.html). However, it does contain in-program advertising (www.incredimail.com/english/advertising.html) but this is properly disclosed on their website and seems to be how they make money from their software.

It seems the IncrediMail installer is attempting to run on Windows startup. Fortunately you appear to have Windows XP Service Pack 2 installed, so Windows is prompting to confirm whether you would like to run the installer (rather than just blindly running the setup program). It should be a relatively easy process to prevent this from loading on startup. Go to the ‘Start’ menu > ‘Run’ and type ‘msconfig’ (without the quotes) and click OK. In the window that appears, click the ‘Startup’ tab. This will list all the processes and programs which load on Windows startup. Search through the list of programs until you find the IncrediMail installer. Confirm you have located the correct item by looking at the Command column, to ensure the item points to the IncrediMail installer located at the path mentioned in the Security Warning message: ‘C:DOCUME~OwnerLOCALS~1TempImInstall’¦’. Once you have found the item, untick its entry. This will prevent the item from loading on startup. Click OK. Restart the computer and you should no longer have the error message on startup. You should then be able to go into the ‘C:Documents and SettingsOwnerLocal SettingsTemp’ directory and delete the IncrediMail installer. The installer should have the file name starting with ‘ImInstall’ (as you may have noticed, the actual file name is abridged in the Security Warning message).