StartupList report, 10/20/2005, 9:33:33 AM StartupList version: 1.52.2 Started from : C:\Program Files\HJT\HijackThis.EXE Detected: Windows XP SP2 (WinNT 5.01.2600) Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180) * Using default options ================================================== Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\System32\PackethSvc.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe C:\WINDOWS\System32\tcpsvcs.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Defender Pro LLC\Defender Pro Firewall\KAVPF.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\HJT\HijackThis.exe -------------------------------------------------- Listing of startup folders: Shell folders Common Startup: [C:\Documents and Settings\All Users\Start Menu\Programs\Startup] Defender Pro Firewall.lnk = ? -------------------------------------------------- Checking Windows NT UserInit: [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINDOWS\system32\userinit.exe, -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\Run gcasServ = "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe -------------------------------------------------- Shell & screensaver key from C:\WINDOWS\SYSTEM.INI: Shell= SCRNSAVE.EXE=C:\WINDOWS\System32\SUMMER~1.SCR drivers= Shell & screensaver key from Registry: Shell=Explorer.exe SCRNSAVE.EXE=C:\WINDOWS\StripS2.scr drivers=*Registry value not found* Policies Shell key: HKCU\..\Policies: Shell=*Registry key not found* HKLM\..\Policies: Shell=*Registry value not found* -------------------------------------------------- Enumerating Browser Helper Objects: (no name) - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll - {02478D38-C3F9-4efb-9B51-7695ECA05670} (no name) - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (no name) - (no file) - {378D667E-E146-7BC0-8753-65557EF37B36} (no name) - C:\PROGRA~1\SPYBOT~1\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F} (no name) - (no file) - {82315A18-6CFB-44a7-BDFD-90E36537C252} (no name) - (no file) - {911C4A8E-0F75-4B83-BEB9-02BDDF29D11E} (no name) - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (no name) - (no file) - {9527D42F-D666-11D3-B8DD-00600838CD5F} (no name) - c:\program files\google\googletoolbar2.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7} (no name) - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} -------------------------------------------------- Enumerating Task Scheduler jobs: Registration reminder 1.job Registration reminder 2.job Registration reminder 3.job -------------------------------------------------- Enumerating Download Program Files: [{01113300-3E00-11D2-8470-0060089874ED}] CODEBASE = http://support2.charter.com/sdccommon/download/tgctlcm.cab [MetaStreamCtl Class] InProcServer32 = C:\Program Files\Viewpoint\Viewpoint Experience Technology\AxMetaStream_03020215.dll CODEBASE = https://components.viewpoint.com/MTSInstallers/MetaStream3.cab?url=http://www.viewpoint.com/cgi-bin/vet_install_popup.pl?3 [Shockwave ActiveX Control] InProcServer32 = C:\WINDOWS\system32\macromed\Shockwave 10\Download.dll CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab [Windows Genuine Advantage Validation Tool] InProcServer32 = C:\WINDOWS\system32\LegitCheckControl.DLL CODEBASE = http://go.microsoft.com/fwlink/?linkid=39204 [MSSecurityAdvisor Class] InProcServer32 = C:\WINDOWS\System32\mssecadv.dll CODEBASE = http://download.microsoft.com/download/0/5/c/05c905f4-dd30-427d-a3de-373c3e5552fc/msSecAdv.cab?1093030616781 [VerifyGMN Class] InProcServer32 = C:\WINDOWS\Downloaded Program Files\hpobjinstaller_gmn.dll CODEBASE = http://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab [yucsetreg Class] InProcServer32 = C:\Program Files\Yahoo!\Common\yucconfig.dll CODEBASE = C:\Program Files\Yahoo!\common\yucconfig.dll [Symantec AntiVirus scanner] InProcServer32 = C:\WINDOWS\Downloaded Program Files\avsniff.dll CODEBASE = http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab [YInstStarter Class] InProcServer32 = C:\Program Files\Yahoo!\Common\yinsthelper.dll CODEBASE = C:\Program Files\Yahoo!\common\yinsthelper.dll [Office Update Installation Engine] InProcServer32 = C:\WINDOWS\opuc.dll CODEBASE = http://office.microsoft.com/officeupdate/content/opuc3.cab [{41F17733-B041-4099-A042-B518BB6A408C}] CODEBASE = http://a1540.g.akamai.net/7/1540/52/20020323/qtinstall.info.apple.com/qt505/us/win/QuickTimeInstaller.exe [{49232000-16E4-426C-A231-62846947304B}] CODEBASE = http://ipgweb.cce.hp.com/rdqcpc/downloads/sysinfo.cab [QDiagAOLCCUpdateObj Class] InProcServer32 = C:\WINDOWS\System32\qdiagcc.ocx CODEBASE = http://aolcc.aol.com/computercheckup/qdiagcc.cab [Malicious Software Removal Tool] InProcServer32 = C:\WINDOWS\Downloaded Program Files\WebCleaner.dll CODEBASE = http://download.microsoft.com/download/b/d/b/bdb4e4ee-63b2-45ff-9d84-33205bf43143/WebCleaner.cab [{4E7BD74F-2B8D-469E-DEFA-EB76B1D5FA7D}] CODEBASE = http://eztracks.aavalue.com/EZT/Toolbar/eztdl.cab [{4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21}] CODEBASE = http://download.av.aol.com/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab [{54771E6F-A5A2-4413-8FB8-7B8F85398174}] CODEBASE = http://dl.lygo.com/Sidesearch/en_US/Lycos/Sidesearch.cab [{56C9629A-C33F-11D3-BBFB-00105A1FAD68}] CODEBASE = http://www.eyetide.com/download//223/Eyetide%20Installer.cab [Symantec RuFSI Utility Class] InProcServer32 = C:\WINDOWS\Downloaded Program Files\rufsi.dll CODEBASE = http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab [MUWebControl Class] InProcServer32 = C:\WINDOWS\system32\muweb.dll CODEBASE = http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1129350983000 [Driver_Detective_v43_Non_Member.DD_v43] InProcServer32 = C:\WINDOWS\Downloaded Program Files\Driver_Detective_v43_Non_Member.ocx CODEBASE = http://www.drivershq.com/cab/prod/Driver_Detective_v43_Non_Member.CAB [Sinstaller Class] CODEBASE = http://dm.screensavers.com/dm/installers/si/1/sinstaller.cab [XML DOM Document 4.0] InProcServer32 = %SystemRoot%\system32\msxml4.dll CODEBASE = http://ipgweb.cce.hp.com/rdqcpc/downloads/msxml4.cab [WebLine Browser Integration Classes] InProcServer32 = C:\WINDOWS\System32\MSJAVA.DLL CODEBASE = http://vztxcisccpro.compaq.com/webline/applets/msie40x.cab [{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}] CODEBASE = http://fpdownload.macromedia.com/get/shockwave/cabs/flash/ultrashim.cab [RegConfig Class] InProcServer32 = C:\WINDOWS\Downloaded Program Files\yregcfg.dll CODEBASE = http://download.yahoo.com/dl/installs/bkm/prod/yregcfg.cab [{9F1C11AA-197B-4942-BA54-47A8489BB47F}] CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38320.360787037 [YahooYMailTo Class] InProcServer32 = C:\Program Files\Yahoo!\Common\ymmapi.dll CODEBASE = http://download.yahoo.com/dl/installs/ymail/ymmapi.dll [Crucial cpcScan] InProcServer32 = C:\WINDOWS\Downloaded Program Files\cpcScan.dll CODEBASE = http://www.crucial.com/controls/cpcScanner.cab [{B9191F79-5613-4C76-AA2A-398534BB8999}] CODEBASE = http://download.yahoo.com/dl/installs/yab_af.cab [{BCC0FF27-31D9-4614-A68E-C18E1ADA4389}] CODEBASE = http://download.av.aol.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cab [Downloader Class] InProcServer32 = C:\WINDOWS\DOWNLO~1\dwnldr.dll CODEBASE = https://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab [PhotosCtrl Class] CODEBASE = http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab [Shockwave Flash Object] InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash8.ocx CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab [{FFFFFFFF-CACE-BABE-BABE-00AA0055595A}] CODEBASE = http://www.trueswitch.com/sbc/TrueInstallSBC.exe -------------------------------------------------- Enumerating ShellServiceObjectDelayLoad items: PostBootReminder: C:\WINDOWS\system32\SHELL32.dll WebCheck: C:\WINDOWS\System32\webcheck.dll SysTray: C:\WINDOWS\System32\stobject.dll UPnPMonitor: C:\WINDOWS\System32\upnpui.dll CDBurn: C:\WINDOWS\system32\SHELL32.dll -------------------------------------------------- End of report, 10,015 bytes Report generated in 0.766 seconds Command line options: /verbose - to add additional info on each section /complete - to include empty sections and unsuspicious data /full - to include several rarely-important sections /force9x - to include Win9x-only startups even if running on WinNT /forcent - to include WinNT-only startups even if running on Win9x /forceall - to include all Win9x and WinNT startups, regardless of platform /history - to list version history only