msconfig>startup and hijack this logs

Printable View

March 22nd, 2005, 08:47 PM
kyrios

msconfig>startup and hijack this logs

I recenlty installed a program from this website here http://www.yenc32.com/download.php. I didn't think it would come with any spyware or adware, and im still not sure if it was the cause for me to have an extra line on my startup. You can see the picture in the attachment. Can someone tell me if thats supposed to be like that, and what it can be and what I can do to remove. I know it's not supposed to be like that obviosly. Also here is my hijack this log. Can someone please be kind enough to review it and see whats wrong. It is a really big annoyance having something in your startup when its not supposed to be there. Thank you in advance.

Hijack this:

Code:

Logfile of HijackThis v1.98.2 Scan saved at 1:46:23 PM, on 3/22/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Sygate\SPF\smc.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\System32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\Microsoft AntiSpyware\gcasServ.exe C:\WINDOWS\system32\devldr32.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\BitTorrent\btdownloadgui.exe C:\WINDOWS\System32\svchost.exe C:\Documents and Settings\Kyri0s\RN\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/game...s/y/pote_x.cab O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com...ll/xscan60.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1107813533452
March 22nd, 2005, 08:50 PM
zENGER

I've seen those before and as far as I know, its just a blank entry. No harm in those. Were you having some sort of problems or just decided to run HJT and msconfig?
March 22nd, 2005, 08:56 PM
ByTeWrangler

I agree with zENGER.

Anyway you can have a look at your hijackthis log file report at http://www.hijackthis.de/logfiles/6f...490a74a0.html.
March 22nd, 2005, 09:06 PM
kyrios

So both of you Zenger and ByteWrangler agree that it is okay for there to be a blank line in your startup??? It wasn't there yesterday and it is now. I don't think it is supposed to be there and I dont want it there.
ByteWrangler: Your link did not work buddy.
March 22nd, 2005, 09:09 PM
XTC46

why dont you just go ahead and take it out then.
March 22nd, 2005, 09:10 PM
whatthe

Back it up, delete it and find out.
March 22nd, 2005, 09:11 PM
zENGER

If its blank it can't do anything. My opinion is they come from poorly designed software that deletes the information rather than the entry. This in turn leaves a blank entry in your registry that does nothing. If you want to remove it I suggest using regedit and browsing to the key that is listed next to it in msconfig.
March 22nd, 2005, 09:15 PM
kyrios

Quote:

Originally posted here by XTC46
why dont you just go ahead and take it out then.

If thats all your going to post or reply, why reply at all. You should know better than that XTC46. OKay XTC46, how can I take it out? Could you be kind enough in telling me how. I know there is a way in going into regedit, but i dont recall the steps.
March 22nd, 2005, 09:20 PM
whatthe

Go to Google or Microsoft and type "how to edit registry" and pick your favorite.
March 22nd, 2005, 09:22 PM
morganlefay

Dont get all pissy kyrios .....

Use Hijack this..and remove them :rolleyes:

Click the items you want to remove and click the fix checked items button down at the bottom

MLF
March 22nd, 2005, 09:30 PM
kyrios

Im not pissy at all, my typing might just sound like it. OK i figured out how to get to the RUN in registry. And the blank entry in the startup has a name of NWEReboot. That's the entry in the startup that I do not want.
March 22nd, 2005, 09:33 PM
whatthe

You should read up on how to use regedit before you play with it or you may be reformatting in the near future.

Read this

How to back up, edit, and restore the registry in Windows XP and Windows Server 2003

http://support.microsoft.com/kb/322756
March 22nd, 2005, 09:37 PM
zENGER

Looks like residue. Pretty safe to delete it.
March 22nd, 2005, 09:42 PM
XTC46

lmfao...you sound all whiny, so I gave you an equaly valuable answer. you asked for peoples opinion on something they gave it to you, you didnt like it and got all pissy. why dont you google the thing you are trying to delete and add "how do I delete" to the front of it, that would probably help.
March 22nd, 2005, 09:49 PM
kyrios

Good website in case i need to backup my registry, thanks whatthe.
I am hoping it is "residue"(zenger). So should I delete it from a regular startup or do I have to go into Safe-Mode?
March 22nd, 2005, 09:50 PM
XTC46

you shouldnt have to be in safemode to delete it.
March 22nd, 2005, 09:51 PM
zENGER

Being that it doesn't start anything, nothing is going to stop you from deleting it in a regular bootup. Do it.. Do it.. Do it...
March 22nd, 2005, 09:53 PM
whatthe

Quote:

Good website in case i need to backup my registry, thanks whatthe.

No disrespect intended but it doesn't seem like you know much about the registry or this would have been cleared up in fewer posts. I think you need to before you touch it and then go in to regedit or use HiJack as Morgan suggested.
March 22nd, 2005, 10:00 PM
ByTeWrangler

Greeting's

Here is the updated the link. this one works. Sorry for broken link earlier.

http://www.hijackthis.de/logfiles/fb...05792fd01.html
March 22nd, 2005, 10:34 PM
ByTeWrangler

Greeting's

Here is some information on windows registry to get you started

http://support.microsoft.com/default...b;EN-US;256986

secondly here is an article my Microsoft to help you Backup and restore your registry :

http://support.microsoft.com/kb/322756

Also here is an article by Symantec which will help you to backup and restore your registry :

http://service1.symantec.com/SUPPORT...rc=sec_doc_nam

lastly it is very important to have a complete backup of your registry if you try to tweak it on your own (without help of registry editiong software or registry tweaking software).
March 22nd, 2005, 10:39 PM
XTC46

geee you guys act like deleting random things from the registry can casue damage or something <bfeg>
March 22nd, 2005, 11:14 PM
Und3ertak3r

I have suspected that the Blank entry in the MSCONFIG Startup list was due to an incomplete cleanup by an un-installer.. or a failed attempt from from an installer

Haveing seen this in win 9x and winXP boxes it certainly isnt specific to any one MS OS.

We cant blame any of the anti-spyware tools on their own, as I have seen it in machines that didnt have these installed. But boy is it easy to blame Spyware, every machine where I have seen this Blank entry has had spyware to remove. I suspect it is possable to duplicate this by useing some of the anti-spyware tools in a remote mode (Bart PE)..

As the registry is a large text document it only takes the insertion or non-removal of one character (like the CR in a normal Doc) for it to show a blank entry.. and in some areas cause a nice selection of probs.

Summery:
It is very safe to remove the entry from the startup list.
if your uncertain.. do your scans again and be sure that you do so in SAFE MODE.. run one of the other memebers of the holy trinity. (Adaware, Spybot SnD), DO a scan with either TDS or The Cleaner (and do this in safe mode)