StartUpList Advice.....

Hello all,

I just about have my new system back to the "old" state of my stolen one.... I want to streamline my startup so I am posting my StartUpList Log and mt HijackThis Log for your analysis on what I can safely delete but still have full functionality. All advice will be appreciated....

Regards,
Kent

 

StartupList report, 7/14/2003, 12:13:56 PM
StartupList version: 1.52
Started from : C:\Program Files\HiJackThis\HijackThis.EXE
Detected: Windows XP SP1 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
C:\WINDOWS\System32\GEARSec.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\PGPsdkServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Motherboard Monitor 5\MBM5.EXE
C:\Program Files\CpuIdlePro\cpuidle.exe
C:\Program Files\PTBSync\PTBSync.exe
C:\Program Files\TrojanHunter 3.5\THGuard.exe
C:\Program Files\Soft4Ever\looknstop\looknstop.exe
C:\Program Files\Creative\SBAudigy\Taskbar\CTLTask.exe
C:\Program Files\ATI Multimedia\main\launchpd.exe
C:\Program Files\Creative\SBAudigy\Taskbar\CTLTray.exe
C:\DOCUME~1\Kent\LOCALS~1\Temp\4Bsdd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\PROGRA~1\Greatis\REGRUN~1\WatchDog.exe
C:\Program Files\PGP Corporation\PGP for Windows XP\PGPtray.exe
C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
C:\Program Files\Browser Hijack Blaster\bhblaster.exe
C:\Program Files\ID-Blaster Plus\idblasterplus.exe
C:\Program Files\ARM Software\MacroMaker\MacroMaker.exe
C:\Program Files\MRU-Blaster\scheduler.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\TDS3\tds-3.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\MailWasher Pro\MailWasher.exe
C:\Program Files\The Bat!\thebat.exe
C:\Program Files\Opera7\opera.exe
C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
C:\Program Files\HiJackThis\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\Documents and Settings\Kent\Start Menu\Programs\Startup]
Ad-watch.exe.lnk = C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
Browser Hijack Blaster (no splash).lnk = C:\Program Files\Browser Hijack Blaster\bhblaster.exe
idblasterplus.exe.lnk = C:\Program Files\ID-Blaster Plus\idblasterplus.exe
MacroMaker.lnk = ?
MRU-Blaster Scheduler.lnk = C:\Program Files\MRU-Blaster\scheduler.exe
MRU-Blaster Silent Clean.lnk = C:\Program Files\MRU-Blaster\mrublaster.exe
PowerReg Scheduler V3.exe
SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
tds-3.exe.lnk = C:\Program Files\TDS3\tds-3.exe
Trillian.lnk = ?

User shell folders Startup:
[C:\Documents and Settings\Kent\Start Menu\Programs\Startup]
Ad-watch.exe.lnk = C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
Browser Hijack Blaster (no splash).lnk = C:\Program Files\Browser Hijack Blaster\bhblaster.exe
idblasterplus.exe.lnk = C:\Program Files\ID-Blaster Plus\idblasterplus.exe
MacroMaker.lnk = ?
MRU-Blaster Scheduler.lnk = C:\Program Files\MRU-Blaster\scheduler.exe
MRU-Blaster Silent Clean.lnk = C:\Program Files\MRU-Blaster\mrublaster.exe
PowerReg Scheduler V3.exe
SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
tds-3.exe.lnk = C:\Program Files\TDS3\tds-3.exe
Trillian.lnk = ?

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
hp psc 1000 series.lnk = ?
hpoddt01.exe.lnk = ?
PGPtray.lnk = ?

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

nod32kui = C:\Program Files\Eset\nod32kui.exe /WAITSERVICE
@RegRunOnSecure = C:\PROGRA~1\Greatis\REGRUN~1\OnSecure.exe
RegRun WinBait = C:\WINDOWS\winbait.exe
Jet Detection = C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe
Logitech Utility = Logi_MwX.Exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

MRUBlaster = C:\Program Files\MRU-Blaster\indexcleaner.exe -CC

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

Title = RegRun II Secure Start

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Taskbar = C:\Program Files\Creative\SBAudigy\Taskbar\CTLTask.exe
Regrun2 = C:\PROGRA~1\Greatis\REGRUN~1\regrun2.exe /c 1
ATI Launchpad = "C:\Program Files\ATI Multimedia\main\launchpd.exe"
AD_SCHED = "C:\Program Files\Common Files\ADT Shared\Scheduler\ADSched.exe"
TaskTray = C:\Program Files\Creative\SBAudigy\Taskbar\CTLTray.exe

--------------------------------------------------

Autorun entries in Registry subkeys of:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx

[@Regrun2]
= RegRun II Secure Start
1 = C:\PROGRA~1\Greatis\REGRUN~1\regrun2.exe /w

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\Microsoft Money\System\mnyside.dll - {243B17DE-77C7-46BF-B94B-0B5F309A0E64}
SpywareGuard Download Protection - C:\Program Files\SpywareGuard\dlprotect.dll - {4A368E80-174F-4872-96B5-0B27DDD11DB2}
(no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}
(no name) - C:\Program Files\CPal\CPBrHelp.dll - {D4E7C68D-37FD-11D4-9D32-0000A00B0B0B}

--------------------------------------------------

Enumerating Task Scheduler jobs:

FRU Task #Hewlett-Packard#hp psc 1200 series#1057714868.job
WinCleaner.job

--------------------------------------------------

Enumerating Download Program Files:

[YInstStarter Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\yinsthelper.dll
CODEBASE = http://download.yahoo.com/dl/installs/yinst.cab

[OPUCatalog Class]
InProcServer32 = C:\WINDOWS\System32\opuc.dll
CODEBASE = http://office.microsoft.com/productupdates/content/opuc.cab

[Update Class]
InProcServer32 = C:\WINDOWS\System32\iuctl.dll
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37796.3272916667

[{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}]

--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: C:\DOCUME~1\Kent\LOCALS~1\Temp\GLB1A2B.EXE


--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
End of report, 9,233 bytes
Report generated in 0.109 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

 

Logfile of HijackThis v1.95.0
Scan saved at 12:13:46 PM, on 7/14/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
C:\WINDOWS\System32\GEARSec.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\PGPsdkServ.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Motherboard Monitor 5\MBM5.EXE
C:\Program Files\CpuIdlePro\cpuidle.exe
C:\Program Files\PTBSync\PTBSync.exe
C:\Program Files\TrojanHunter 3.5\THGuard.exe
C:\Program Files\Soft4Ever\looknstop\looknstop.exe
C:\Program Files\Creative\SBAudigy\Taskbar\CTLTask.exe
C:\Program Files\ATI Multimedia\main\launchpd.exe
C:\Program Files\Creative\SBAudigy\Taskbar\CTLTray.exe
C:\DOCUME~1\Kent\LOCALS~1\Temp\4Bsdd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\PROGRA~1\Greatis\REGRUN~1\WatchDog.exe
C:\Program Files\PGP Corporation\PGP for Windows XP\PGPtray.exe
C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
C:\Program Files\Browser Hijack Blaster\bhblaster.exe
C:\Program Files\ID-Blaster Plus\idblasterplus.exe
C:\Program Files\ARM Software\MacroMaker\MacroMaker.exe
C:\Program Files\MRU-Blaster\scheduler.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\TDS3\tds-3.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\WINDOWS\msagent\AgentSvr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\MailWasher Pro\MailWasher.exe
C:\Program Files\The Bat!\thebat.exe
C:\Program Files\Opera7\opera.exe
C:\PROGRAM FILES\ATI TECHNOLOGIES\ATI CONTROL PANEL\ATIPTAXX.EXE
C:\Program Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.rr.com/v5/home/0,1793,108,00.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://www.rr.com/v5/home/0,1793,108,00.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.rr.com/v5/home/0,1793,108,00.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=http://www.rr.com/v5/home/0,1793,108,00.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title=Puff the Magic Dragon
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride=127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page=
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {D4E7C68D-37FD-11D4-9D32-0000A00B0B0B} - C:\Program Files\CPal\CPBrHelp.dll
O4 - HKLM\..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe /WAITSERVICE
O4 - HKLM\..\Run: [@RegRunOnSecure] C:\PROGRA~1\Greatis\REGRUN~1\OnSecure.exe
O4 - HKLM\..\Run: [RegRun WinBait] C:\WINDOWS\winbait.exe
O4 - HKLM\..\Run: [Jet Detection] C:\Program Files\Creative\SBAudigy\PROGRAM\ADGJDet.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [Iomega Drive Icons] C:\Program Files\Iomega\DriveIcons\ImgIcon.exe
O4 - HKLM\..\Run: [Deskup] C:\Program Files\Iomega\DriveIcons\deskup.exe /IMGSTART
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [MBM 5] "C:\Program Files\Motherboard Monitor 5\MBM5.EXE"
O4 - HKLM\..\Run: [CpuIdle] C:\Program Files\CpuIdlePro\cpuidle.exe
O4 - HKLM\..\Run: [PTBSync] C:\Program Files\PTBSync\PTBSync.exe /Start
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 3.5\THGuard.exe"
O4 - HKLM\..\Run: [Look 'n' Stop] "C:\Program Files\Soft4Ever\looknstop\looknstop.exe" -auto
O4 - HKCU\..\Run: [Taskbar] C:\Program Files\Creative\SBAudigy\Taskbar\CTLTask.exe
O4 - HKCU\..\Run: [Regrun2] C:\PROGRA~1\Greatis\REGRUN~1\regrun2.exe /c 1
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [AD_SCHED] "C:\Program Files\Common Files\ADT Shared\Scheduler\ADSched.exe"
O4 - HKCU\..\Run: [TaskTray] C:\Program Files\Creative\SBAudigy\Taskbar\CTLTray.exe
O4 - Startup: Ad-watch.exe.lnk = C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
O4 - Startup: Browser Hijack Blaster (no splash).lnk = C:\Program Files\Browser Hijack Blaster\bhblaster.exe
O4 - Startup: idblasterplus.exe.lnk = C:\Program Files\ID-Blaster Plus\idblasterplus.exe
O4 - Startup: MacroMaker.lnk = ?
O4 - Startup: MRU-Blaster Scheduler.lnk = C:\Program Files\MRU-Blaster\scheduler.exe
O4 - Startup: MRU-Blaster Silent Clean.lnk = C:\Program Files\MRU-Blaster\mrublaster.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: tds-3.exe.lnk = C:\Program Files\TDS3\tds-3.exe
O4 - Startup: Trillian.lnk = ?
O4 - User Startup: Ad-watch.exe.lnk = C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
O4 - User Startup: Browser Hijack Blaster (no splash).lnk = C:\Program Files\Browser Hijack Blaster\bhblaster.exe
O4 - User Startup: idblasterplus.exe.lnk = C:\Program Files\ID-Blaster Plus\idblasterplus.exe
O4 - User Startup: MacroMaker.lnk = ?
O4 - User Startup: MRU-Blaster Scheduler.lnk = C:\Program Files\MRU-Blaster\scheduler.exe
O4 - User Startup: MRU-Blaster Silent Clean.lnk = C:\Program Files\MRU-Blaster\mrublaster.exe
O4 - User Startup: PowerReg Scheduler V3.exe
O4 - User Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - User Startup: tds-3.exe.lnk = C:\Program Files\TDS3\tds-3.exe
O4 - User Startup: Trillian.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: PGPtray.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Check Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: ieSpell (HKLM)
O9 - Extra 'Tools' menuitem: ieSpell (HKLM)
O9 - Extra 'Tools' menuitem: ieSpell Options (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: MoneySide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O10 - Broken Internet access because of LSP provider 'imon.dll' missing
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst.cab
O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37796.3272916667
O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) -

 

O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_01) -

I do not understand this line as I uninstalled that version and installed 1.4.2.....

Regards,
Kent

 

Hi Kent,

Running SpywareGuard and BHBlaster is overkill and not recommended.
You can delete the Java entry if you are using a newer version.
No bad guys in there that I could find, but there may be some you wish to remove, once you checked them against this list: http://www.pacs-portal.co.uk/startup_pages/startup_full.htm

Regards,

Pieter

 

BHBlaster and the java entry removed...
Thanks for reminding me of pacs-portal... I had forgotten what a GREAT resource that is.... I removed several entries and my startup has improved greatly...
Anyone else with any advice as to what is not needed will be greatly appreciated also...

Again, thanks Pieter...

Regards,
Kent