BleepingComputer.com: clear out items in startup

Hi all, after having my sons computer given a complete seeing to by Grinler in the
HJT forum, for which i am extremely grateful.
I forgot this bit!!

There are approx 66 items in the system configuration startup menu, a lot of which
I am sure is "dead wood",
Could someone please tell me how to delete unwanted items, i have startup installed on my own computer(WinXPpro) can i use that on his??
Also below is a list of items, can someone say which i can remove safely(apart from the glaringly obvious, once again, i must stress, this is my sons computer!! )


Also, how do i post screenshots of system configuration utility start up !!


Many thanks

66 items. Yes prolly enough dead wood to start a bonfire.

Although I would love to see this massive list. And there is a way to capture a screenshot of it.

Why don't you visit this link. It is Bleeping Computer's brand new:

Startup Database

http://www.bleepingcomputer.com/startups/

There I'm afraid you are going to have to weed them out one by one.

I'm not sure if you should wait till the log is clean. Maybe someone who knows more about HJT. Can jump in and answer that.

This post has been edited by scarlett: 11 February 2005 - 05:35 AM

Hi Scarlett,
log is squeeky clean, Grinler cleaned it

I have typed out all the entries, and here they are:

Makes for interesting reading!!


Many thanks


SysTime C:\WINDOWS\SYSTEM\systime.exe
SurfSideKick 2 C:\PROGRAM\FILES\SURFSIDEKICK 2\Ssk.exe
aor3RWipX HPGM32.EXE
SystemTray SysTray.Exe
ScanRegistry C:\WINDOWS\scanregw.exe /autorun
TaskMonitor C:\WINDOWS\taskmon.exe
SBMX C:\WINDOWS\SYSTEM\sbmx.exe
ICH Synth eusexe.exe
NavRegReminder "C:\WINDOWS\TEMP\NAVBROWSER.EXE"/r/i"C:\WINDOWS\TEMP\NavLoad.ini"
LoadPowerProfile Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
CriticalUpdate C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
EPSON Stylus C62 Series C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P23"EPSON Stylus C62 Series"/07"EPUSB1:/M"Stylus C62"
EPSON Stylus C42 Series C:\WINDOWS\SYSTEM\E_S10IC2.EXE /P23"EPSON Stylus C42 Series"/05"LPT1:/M"Stylus C42"
LoadQM loadqm.exe
RealTray C:\Program Files\Real\RealPLayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
QuickTime Task "C:\WINDOWS\SYSTEM\QTTASK.EXE"-atboottime
Hot_Tarts C:\Program Files\Video1\Dialers\Hot_Tarts\Hot_Tarts.exe/dontdial
Virgins C:\Program Files\Video1\Dialers\Virgins\Virgins.exe/dontdial
EvtHtm c:\windows\system\evthtm.exe /nocomm
glwjmgeb c:\windows\system\glwjmgeb.exe /install
HP Software Update "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
sp2ctr c:\windows\system\sp2ctr.exe /nocomm
AOL Spyware Protection "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Sheduler.exe"
StillImageMonitor C:\WINDOWS\SYSTEMS\STIMON.EXE
HP Component Manager "C:\PROGRAM FILES\HP\HPCORETECH\HPCMPMGR.EXE"
KAVPersonal50 C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\Kav.exe
AVPCC "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exe" /wait
SysTime C:\WINDOWS\SYSTEM\systime.exe
Internet Optimizer "C:\Program Files\Internet Optimizer\optimize.exe"
SurfSideKick 2 C:\PROGRAM\FILES\SURFSIDEKICK 2\Ssk.exe
IE Menu Extension toolbar rundll32.exe "C:\PROGRA~1\IEMENU~1\tbextn.dll"DllShowTB
CashBack C:\Program Files\CashBack\bin\cashback.exe
BullsEye Network C:\Program Files\BullsEye Network\bin\bargains.exe
SESync "C:\PROGRAM FILES\SED\SED.EXE"
VBundleOuterDL C:\Program Files\VBouncer\BundleOuter.EXE
stcloader C:\WINDOWS\SYSTEM\stcloader.exe
winupdtl C:\WINDOWS\SYSTEM\winupdtl.exe
AutoLoaderAproposClient "C:\WINDOWS\SYSTEM\CACHE\CXTPLS_LOADER.EXE"/HideUninstall/HideDir/PC=CP.FHB/ShowLegalNote=nonbranded
hhcgkcgnyd C:\WINDOWS\SYSTEM\mkqruuex.exe
rF8T360 HPZASP1.EXE
AutoUpdater "c:\Program Files\AutoUpdate\AutoUpdate.exe"
USB controller "C:\WINDOWS\TEMP\ICD6.TMP\SVCMM32.EXE"/startup
180ax c:\windows\temp\180ax.exe
yngbup C:\WINDOWS\yngbup.exe
version C:\WINDOWS\SYSTEM\ADL_DH.exe
vcmpin C:\WINDOWS\BUNDLES\ADL_MTESTSTUB.EXE
Ahwtw C:\WINDOWS\schk32.exe
ASDPLUGIN
Kalvsys C:\WINDOWS\SYSTEM\KALVDCO32.EXE
LoadPowerProfile Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent mstask.exe
AVPCC Service "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\avpcc.exe"/service
SAgent2ExePath C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
Dvrvideo c:\windows\system\dvrvideo.exe
kavsvc C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\Kavsvc.exe
Microsoft Office StartUp C:\PROGRA~1\MICROS~1\OFFICE10\OSA.EXE
HP Digital Imaging Monitor C:\PROGRA~1\HP\DIGITA~1\BIN\HPQTRAO8.EXE
run= c:\windows\system\dvrvideo.exe

before I check the list I'll post what amounts to an answer to:

Quote

I typed msconfig into the run box.
positioned it.
pressed screenshot key on the keyboard.
pressed start-->then paint...you might have to
press start-->all programs-->accessories-->paint
paint opened, chose Edit-->Paste.
click/dragged upward/left to postition the (to be cropped) image's top&left margins.
clicked select (the rectangle) and placed the cross-hair cursor in the upper left corner.
click/dragged downward/right to outline (to be cropped) image's bottom&right margins.
before I released the left mousebutton I noted the ______x______ numbers (lowest right hand corner)
then chose Image-->Attributes and width = the first number (typed in), height = the second (typed it).
OK. (cropped image appears)
pressed File-->Save As (three choices to make)
save in: My Pictures
filename: mscofig
save as type: JPEG (*.JPG;*.JPEG;*JPE;*.JFIF) using dropdown menu.

opened a Firefox window.
chose photobucket from my bookmark toolbar.
logged in to My Album.
below add picture from URL I pressed browse.
File Upload-->My Pictures-->mscofig.jpg
OK. (dialog box disappeared) pressed Submit. waited 30 seconds. *pictured added appeared.
scrolled down, clicked the URL of three selections below the thumbnail mscofig.jpg to highlight it.
right-clicked "copy".

At BC "reply to topic" chose URL button, right-clicked "paste".
"Close all tags"
This was what I typed instead of "My Webpage"

You should register an account at photobucket.
It's free.
(you don't need to use Firefox, but I prefer using it and usually mention it.)

You need to show the Startup Tab and probably 5-6 times if you got 66 of 'em. You'd get some practice & we could advise which ones to delete... and best way(s) to delete them.

But you typed up that list.

Since this is your son's computer, I would suggest you give him the task to research the start up programs here on the BC database, since many of these applications, of the fun/pretty/happy variety, have been downloaded by him.

Here are two that can immediately be deleted:

Microsoft Office StartUp C:\PROGRA~1\MICROS~1\OFFICE10\OSA.EXE

RealTray C:\Program Files\Real\RealPLayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

Regards,
John

Quote

Turns up malware using the startup list here at BC.

180ax.exe

Hi all, thanks for the replies,
I have studied the lists provided by Scarlett at;

http://www.bleepingcomputer.com/startups/

all evening!!

there are however some on my list which are not included,
i cannot submit using the form since i am not using THAT!! computer and cannot browse.

here is a list of those items not listed, l believe??

NavRegReminder "C:\WINDOWS\TEMP\NAVBROWSER.EXE"/r/i"C:\WINDOWS\TEMP\NavLoad.ini"

glwjmgeb c:\windows\system\glwjmgeb.exe /install

hhcgkcgnyd C:\WINDOWS\SYSTEM\mkqruuex.exe

rF8T360 HPZASP1.EXE

yngbup C:\WINDOWS\yngbup.exe

Ahwtw C:\WINDOWS\schk32.exe

ASDPLUGIN

Dvrvideo c:\windows\system\dvrvideo.exe

run= c:\windows\system\dvrvideo.exe

Any thought on these please??

Many thanks

NavLoad.ini

http://computercops.biz/startuplist-5609.html
this one not found here, but found there (above) and it looks like a bad installation
because it is running from a temp folder.

glwjmgeb c:\windows\system\glwjmgeb.exe /install
hhcgkcgnyd C:\WINDOWS\SYSTEM\mkqruuex.exe
yngbup C:\WINDOWS\yngbup.exe
these look like malware,
random character program name & the same
(or also random character) name as a filename.
also do not turn up on startup databases.
suspicious, due to that fact as well.

rF8T360 HPZASP1.EXE
Legitimate program name:
&start=1275&end=1300]http://www.windowsstartup.com/wso/search.p...t=1275&end=1300
could be a Hewlett-Packard file (something new) or (simply not identified)

AhwtwC:\WINDOWS\schk32.exe
Legitimate program name:
&start=2750&end=2775]http://www.windowsstartup.com/wso/search.p...t=2750&end=2775
schk32.exe not found in databases, not found on my winXP,
not located in the system32 folder, suspicious due to those reasons.

ASDPLUGIN
&start=2925&end=2950]http://www.windowsstartup.com/wso/search.p...t=2925&end=2950
Dvrvideo c:\windows\system\dvrvideo.exe
run= c:\windows\system\dvrvideo.exe
if this is a continuation of the above...maybe one thing.
as it stands, apart, still possibly legitimate.
Hard to say,
you can enter any of these .exe's into this site and get some clues, too.

http://virusscan.jotti.org/

or here:
http://www.kaspersky.com/scanforvirus

These from your first list.
You can kinda see how it goes.
I did not scrutinize the entire list, so
those not listed may/may not be good.
Hope this gives you some insight.

http://www.bleepingcomputer.com/startups/e...e.exe-2086.html
http://www.bleepingcomputer.com/startups/sbmx.exe-4739.html
http://www.bleepingcomputer.com/startups/s...e.exe-5598.html not good
http://www.bleepingcomputer.com/startups/Ssk.exe-5281.html not good
http://www.bleepingcomputer.com/startups/e...m.exe-1608.html not good

glwjmgeb c:\windows\system\glwjmgeb.exe /install probably not good

http://www.bleepingcomputer.com/startups/o...e.exe-2262.html up to you

http://www.bleepingcomputer.com/startups/c...ck.exe-730.html not good
http://www.bleepingcomputer.com/startups/b...ns.exe-675.html not good

http://www.bleepingcomputer.com/startups/H...s.exe-1968.html
Virgins C:\Program Files\Video1\Dialers\Virgins\Virgins.exe/dontdial doesn't appear to be good


Try duplicating the steps outlined and applt them to the others for a more complete picture of what is done to determine what's good, what's bad & what's optional.

Hi guys, thanks for all your help,
lhave succeeded in removing everything unpleasant, thanks again,

Geoff

Good Job!!