Page 1 of 3 123 LastLast
Results 1 to 10 of 24

Thread: Something strange starting up!

  1. #1
    Junior Member
    Join Date
    May 2004
    Posts
    15

    Thumbs down Something strange starting up!

    Right forum? Not sure...


    I think I have a problem. All of the sudden, when I boot-up, a small Dos-Like screen pops up very briefly and I don't know what the hell it is! I have startup checkers and all I see in there is my AV, a little .bat file I made, and my firewall. I did a scan with hijackthis to see what else was there and I didn't really know how to discern what was what so I was wondering if some of you could help me. Here it is:


    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
    O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
    O4 - HKLM\..\Run: [Outpost Firewall] C:\PROGRA~1\Agnitum\Outpost Firewall 1.0\outpost.exe /waitservice
    O4 - Startup: Bright.bat <---- my file
    O8 - Extra context menu item: + Offline &Explorer: Download the link - file://C:\Program Files\Offline Explorer Pro\Add_UrlO.htm
    O8 - Extra context menu item: + Offline E&xplorer: Download the current page - file://C:\Program Files\Offline Explorer Pro\Add_AllO.htm
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...084.5782986111
    O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
    Anything funky in there? I try to be careful, I only run from my limited account, and I run AV/Tjn and spy checkers and all that stuff. I don't know what the hell this little screen is ( and it's not my .bat starting up, it's definitely something else), and it scares me...

    Thanks for the help.

    ~.bat-man

  2. #2
    Junior Member
    Join Date
    May 2004
    Posts
    15

    Thumbs down Something strange starting up!

    Right forum? Not sure...


    I think I have a problem. All of the sudden, when I boot-up, a small Dos-Like screen pops up very briefly and I don't know what the hell it is! I have startup checkers and all I see in there is my AV, a little .bat file I made, and my firewall. I did a scan with hijackthis to see what else was there and I didn't really know how to discern what was what so I was wondering if some of you could help me. Here it is:


    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
    O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
    O4 - HKLM\..\Run: [Outpost Firewall] C:\PROGRA~1\Agnitum\Outpost Firewall 1.0\outpost.exe /waitservice
    O4 - Startup: Bright.bat <---- my file
    O8 - Extra context menu item: + Offline &Explorer: Download the link - file://C:\Program Files\Offline Explorer Pro\Add_UrlO.htm
    O8 - Extra context menu item: + Offline E&xplorer: Download the current page - file://C:\Program Files\Offline Explorer Pro\Add_AllO.htm
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...084.5782986111
    O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
    Anything funky in there? I try to be careful, I only run from my limited account, and I run AV/Tjn and spy checkers and all that stuff. I don't know what the hell this little screen is ( and it's not my .bat starting up, it's definitely something else), and it scares me...

    Thanks for the help.

    ~.bat-man

  3. #3
    Senior Member
    Join Date
    Aug 2003
    Posts
    1,018
    a little .bat file I made
    The obvious question would be, did the command window pop up before you put the batch file in there? If it is, I would bet that an application called by your batch file briefly opens a window, then closes once the application has started.

  4. #4
    Senior Member
    Join Date
    Aug 2003
    Posts
    1,018
    a little .bat file I made
    The obvious question would be, did the command window pop up before you put the batch file in there? If it is, I would bet that an application called by your batch file briefly opens a window, then closes once the application has started.

  5. #5
    Junior Member
    Join Date
    May 2004
    Posts
    15
    I made the batch file a few days ago, and placed it in my startup path. All it does is deletes a bunch of temp files/directories. This window started popping up last night when I turned the comp on.

  6. #6
    Junior Member
    Join Date
    May 2004
    Posts
    15
    I made the batch file a few days ago, and placed it in my startup path. All it does is deletes a bunch of temp files/directories. This window started popping up last night when I turned the comp on.

  7. #7
    Take the .bat file out of your computer start up routine and see what happens. I would guess the pop up box you are seeing is the .bat file running for a split second.

  8. #8
    Take the .bat file out of your computer start up routine and see what happens. I would guess the pop up box you are seeing is the .bat file running for a split second.

  9. #9
    Junior Member
    Join Date
    May 2004
    Posts
    15
    No, it shouldn't be. I know what the .bat file looks like when it starts up. This window is similar only it has a red color in the windows top bar. I can give it a try, but I most definitely know that they are two different windows, because I see them both on diff sides of my screen.


    Ok, I took the .bat out, and it made it easier for me to spot the screen that's popping up.


    I caught the file name just before the window closed down. It was called cscript.exe, so I searched for it, and it was in C:\WINDOWS\system32\cscript.exe

    Wonder why this is trying to run at startup all of the sudden? I did a google search and I didn't see anything nefarious associated with it, at first glance. Any way to remedy this?

  10. #10
    Junior Member
    Join Date
    May 2004
    Posts
    15
    No, it shouldn't be. I know what the .bat file looks like when it starts up. This window is similar only it has a red color in the windows top bar. I can give it a try, but I most definitely know that they are two different windows, because I see them both on diff sides of my screen.


    Ok, I took the .bat out, and it made it easier for me to spot the screen that's popping up.


    I caught the file name just before the window closed down. It was called cscript.exe, so I searched for it, and it was in C:\WINDOWS\system32\cscript.exe

    Wonder why this is trying to run at startup all of the sudden? I did a google search and I didn't see anything nefarious associated with it, at first glance. Any way to remedy this?

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •