Something strange starting up!

Printable View

May 5th, 2004, 02:55 PM
.bat-man101

Something strange starting up!

Right forum? Not sure...

I think I have a problem. All of the sudden, when I boot-up, a small Dos-Like screen pops up very briefly and I don't know what the hell it is! I have startup checkers and all I see in there is my AV, a little .bat file I made, and my firewall. I did a scan with hijackthis to see what else was there and I didn't really know how to discern what was what so I was wondering if some of you could help me. Here it is:

Quote:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [Outpost Firewall] C:\PROGRA~1\Agnitum\Outpost Firewall 1.0\outpost.exe /waitservice
O4 - Startup: Bright.bat <---- my file
O8 - Extra context menu item: + Offline &Explorer: Download the link - file://C:\Program Files\Offline Explorer Pro\Add_UrlO.htm
O8 - Extra context menu item: + Offline E&xplorer: Download the current page - file://C:\Program Files\Offline Explorer Pro\Add_AllO.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...084.5782986111
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab

Anything funky in there? I try to be careful, I only run from my limited account, and I run AV/Tjn and spy checkers and all that stuff. I don't know what the hell this little screen is ( and it's not my .bat starting up, it's definitely something else), and it scares me... ::hide-beh

Thanks for the help.

~.bat-man
May 5th, 2004, 02:55 PM
.bat-man101

Something strange starting up!

Right forum? Not sure...

I think I have a problem. All of the sudden, when I boot-up, a small Dos-Like screen pops up very briefly and I don't know what the hell it is! I have startup checkers and all I see in there is my AV, a little .bat file I made, and my firewall. I did a scan with hijackthis to see what else was there and I didn't really know how to discern what was what so I was wondering if some of you could help me. Here it is:

Quote:

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [Outpost Firewall] C:\PROGRA~1\Agnitum\Outpost Firewall 1.0\outpost.exe /waitservice
O4 - Startup: Bright.bat <---- my file
O8 - Extra context menu item: + Offline &Explorer: Download the link - file://C:\Program Files\Offline Explorer Pro\Add_UrlO.htm
O8 - Extra context menu item: + Offline E&xplorer: Download the current page - file://C:\Program Files\Offline Explorer Pro\Add_AllO.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...084.5782986111
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab

Anything funky in there? I try to be careful, I only run from my limited account, and I run AV/Tjn and spy checkers and all that stuff. I don't know what the hell this little screen is ( and it's not my .bat starting up, it's definitely something else), and it scares me... ::hide-beh

Thanks for the help.

~.bat-man
May 5th, 2004, 02:59 PM
groovicus

Quote:

a little .bat file I made

The obvious question would be, did the command window pop up before you put the batch file in there? If it is, I would bet that an application called by your batch file briefly opens a window, then closes once the application has started.
May 5th, 2004, 02:59 PM
groovicus

Quote:

a little .bat file I made

The obvious question would be, did the command window pop up before you put the batch file in there? If it is, I would bet that an application called by your batch file briefly opens a window, then closes once the application has started.
May 5th, 2004, 03:01 PM
.bat-man101

I made the batch file a few days ago, and placed it in my startup path. All it does is deletes a bunch of temp files/directories. This window started popping up last night when I turned the comp on.
May 5th, 2004, 03:01 PM
.bat-man101

I made the batch file a few days ago, and placed it in my startup path. All it does is deletes a bunch of temp files/directories. This window started popping up last night when I turned the comp on.
May 5th, 2004, 03:04 PM
halv

Take the .bat file out of your computer start up routine and see what happens. I would guess the pop up box you are seeing is the .bat file running for a split second.
May 5th, 2004, 03:04 PM
halv

Take the .bat file out of your computer start up routine and see what happens. I would guess the pop up box you are seeing is the .bat file running for a split second.
May 5th, 2004, 03:06 PM
.bat-man101

No, it shouldn't be. I know what the .bat file looks like when it starts up. This window is similar only it has a red color in the windows top bar. I can give it a try, but I most definitely know that they are two different windows, because I see them both on diff sides of my screen.

Ok, I took the .bat out, and it made it easier for me to spot the screen that's popping up. :p

I caught the file name just before the window closed down. It was called cscript.exe, so I searched for it, and it was in C:\WINDOWS\system32\cscript.exe

Wonder why this is trying to run at startup all of the sudden? I did a google search and I didn't see anything nefarious associated with it, at first glance. Any way to remedy this?
May 5th, 2004, 03:06 PM
.bat-man101

No, it shouldn't be. I know what the .bat file looks like when it starts up. This window is similar only it has a red color in the windows top bar. I can give it a try, but I most definitely know that they are two different windows, because I see them both on diff sides of my screen.

Ok, I took the .bat out, and it made it easier for me to spot the screen that's popping up. :p

I caught the file name just before the window closed down. It was called cscript.exe, so I searched for it, and it was in C:\WINDOWS\system32\cscript.exe

Wonder why this is trying to run at startup all of the sudden? I did a google search and I didn't see anything nefarious associated with it, at first glance. Any way to remedy this?
May 5th, 2004, 03:45 PM
groovicus

There's tons of info on Google....

http://www.winnetmag.com/Windows/Art...8962/8962.html
http://www.wincron.com/service_extensions.html

Basically, it's the windows script host. Go to start, type <cmd>, then type <cscript> and it will give you a better look.

I don't know why it's popping.... I'm guessing because something in your batch file is dependant on it.. but that's just a guess.
May 5th, 2004, 03:45 PM
groovicus

There's tons of info on Google....

http://www.winnetmag.com/Windows/Art...8962/8962.html
http://www.wincron.com/service_extensions.html

Basically, it's the windows script host. Go to start, type <cmd>, then type <cscript> and it will give you a better look.

I don't know why it's popping.... I'm guessing because something in your batch file is dependant on it.. but that's just a guess.
May 5th, 2004, 03:47 PM
SirDice

cscript is part of WSH (Windows Scripting Host). There's probably a .js (javascript) or .vbs (Visualbasic script) file starting somewhere.
May 5th, 2004, 03:47 PM
SirDice

cscript is part of WSH (Windows Scripting Host). There's probably a .js (javascript) or .vbs (Visualbasic script) file starting somewhere.
May 5th, 2004, 06:26 PM
untuchable-me

did you happen to edit your autoevec.bat file?????
May 5th, 2004, 06:26 PM
untuchable-me

did you happen to edit your autoevec.bat file?????
May 5th, 2004, 07:17 PM
.bat-man101

Thanks all for replying, it was a big help. I think I have it pinned down now after reading that link you gave groovicus. I did install the NT resource kit a few days ago and I uninstalled it yesterday or so. It's more than likely the remnants of that. Either that, or it was from the XPSP2 that installed and subsequently uninstalled as well a day or so ago.

Thanks again all.

~.bat-man
May 5th, 2004, 07:17 PM
.bat-man101

Thanks all for replying, it was a big help. I think I have it pinned down now after reading that link you gave groovicus. I did install the NT resource kit a few days ago and I uninstalled it yesterday or so. It's more than likely the remnants of that. Either that, or it was from the XPSP2 that installed and subsequently uninstalled as well a day or so ago.

Thanks again all.

~.bat-man
May 5th, 2004, 09:31 PM
hellforgedangel

You wouldnt have happened to have installed Process Guard from dimond cs would you? I installed that and my computer started making a brief popup with a red bar at the top. eventully i worked out it was just PG starting up. :) it took me ages to time a screen shot right but i got just enough to work out it was PG :)
May 5th, 2004, 09:31 PM
hellforgedangel

You wouldnt have happened to have installed Process Guard from dimond cs would you? I installed that and my computer started making a brief popup with a red bar at the top. eventully i worked out it was just PG starting up. :) it took me ages to time a screen shot right but i got just enough to work out it was PG :)
May 5th, 2004, 09:42 PM
mohaughn

Quote:

Originally posted here by .bat-man101
Thanks all for replying, it was a big help. I think I have it pinned down now after reading that link you gave groovicus. I did install the NT resource kit a few days ago and I uninstalled it yesterday or so. It's more than likely the remnants of that. Either that, or it was from the XPSP2 that installed and subsequently uninstalled as well a day or so ago.

Thanks again all.

~.bat-man

Has nothing to do with your orignal request, but you shouldn't load the NT resource kit on XP. The proper resource kit to run on XP is the Win2k3 resource kit.
May 5th, 2004, 09:42 PM
mohaughn

Quote:

Originally posted here by .bat-man101
Thanks all for replying, it was a big help. I think I have it pinned down now after reading that link you gave groovicus. I did install the NT resource kit a few days ago and I uninstalled it yesterday or so. It's more than likely the remnants of that. Either that, or it was from the XPSP2 that installed and subsequently uninstalled as well a day or so ago.

Thanks again all.

~.bat-man

Has nothing to do with your orignal request, but you shouldn't load the NT resource kit on XP. The proper resource kit to run on XP is the Win2k3 resource kit.
May 5th, 2004, 11:48 PM
.bat-man101

Quote:

Originally posted here by mohaughn
Has nothing to do with your orignal request, but you shouldn't load the NT resource kit on XP. The proper resource kit to run on XP is the Win2k3 resource kit.

Hey thanks mohaughn, I was completely unaware of that!

~.bat-man
May 5th, 2004, 11:48 PM
.bat-man101

Quote:

Originally posted here by mohaughn
Has nothing to do with your orignal request, but you shouldn't load the NT resource kit on XP. The proper resource kit to run on XP is the Win2k3 resource kit.

Hey thanks mohaughn, I was completely unaware of that!

~.bat-man