StartupList report, 2/12/2011, 4:49:37 PM StartupList version: 1.52.2 Started from : C:\Program Files\Trend Micro\HiJackThis\HiJackThis.EXE Detected: Windows XP SP3 (WinNT 5.01.2600) Detected: Internet Explorer v7.00 (7.00.6000.17095) * Using default options ================================================== Running processes: C:\WINDOWS\System32\smss.exe C:\PROGRA~1\AVG\AVG10\avgchsvx.exe C:\WINDOWS\System32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\acs.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\AVG\AVG10\avgfws.exe C:\Program Files\AVG\AVG10\avgwdsvc.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\WINDOWS\system32\DVDRAMSV.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe c:\TOSHIBA\IVP\swupdate\swupdtmr.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\mswinext.exe C:\Program Files\AVG\AVG10\avgtray.exe C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\RAMASST.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\PROGRA~1\AVG\AVG10\avgrsx.exe C:\Program Files\AVG\AVG10\avgcsrvx.exe -------------------------------------------------- Listing of startup folders: Shell folders Common Startup: [C:\Documents and Settings\All Users\Start Menu\Programs\Startup] RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe -------------------------------------------------- Checking Windows NT UserInit: [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINDOWS\system32\userinit.exe, -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\Run dla = C:\WINDOWS\system32\dla\tfswctrl.exe ATIPTA = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" SynTPLpr = C:\Program Files\Synaptics\SynTP\SynTPLpr.exe SynTPEnh = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe Toshiba Hotkey Utility = "c:\Program Files\Toshiba\Windows Utilities\Hotkey.exe" /lang en PadTouch = C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe SmoothView = C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe Pinger = c:\toshiba\ivp\ism\pinger.exe /run SunJavaUpdateSched = "C:\Program Files\Common Files\Java\Java Update\jusched.exe" MSN Toolbar = "C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\mswinext.exe" AVG_TRAY = C:\Program Files\AVG\AVG10\avgtray.exe CFSServ.exe = CFSServ.exe -NoClient QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run TOSCDSPD = C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe Google Update = "C:\Documents and Settings\KEYWSHAWN\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c -------------------------------------------------- File association entry for .HTA: HKEY_CLASSES_ROOT\htafile\shell\open\command (Default) = "%1" %* -------------------------------------------------- Shell & screensaver key from C:\WINDOWS\SYSTEM.INI: Shell=*INI section not found* SCRNSAVE.EXE=*INI section not found* drivers=*INI section not found* Shell & screensaver key from Registry: Shell=Explorer.exe SCRNSAVE.EXE=C:\WINDOWS\TOSHIB~1.SCR drivers=*Registry value not found* Policies Shell key: HKCU\..\Policies: Shell=*Registry value not found* HKLM\..\Policies: Shell=*Registry value not found* -------------------------------------------------- Enumerating Browser Helper Objects: Freecause Shopping BHO - C:\Program Files\Shop to Win 9\ShoppingBHO.dll - {0095C290-A428-4BDD-B98C-E0A116F1C702} (no name) - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll - {02478D38-C3F9-4efb-9B51-7695ECA05670} (no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} PriceGong - C:\Program Files\PriceGong\2.1.0\PriceGongIE.dll - {1631550F-191D-4826-B069-D9439253D926} WormRadar.com IESiteBlocker.NavFilter - C:\Program Files\AVG\AVG10\avgssie.dll - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} (no name) - C:\WINDOWS\system32\dla\tfswshx.dll - {5CA3D70E-1895-11CF-8E15-001234567890} BHO Project - C:\Program Files\Object\bho_project.dll - {66D8FBA6-D90F-40A9-AC55-84896F79CA69} Search Helper - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} (no name) - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll - {9030D464-4C02-4ABF-8ECC-5164760863C6} (no name) - C:\Program Files\Search Toolbar\SearchToolbar.dll - {9D425283-D487-4337-BAB6-AB8354A81457} (no name) - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7} (no name) - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (no name) - C:\Program Files\MSN Toolbar\Platform\4.0.0379.0\npwinext.dll - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} (no name) - C:\Program Files\Java\jre6\bin\jp2ssv.dll - {DBC80044-A445-435b-BC74-9C25C1C588A9} JQSIEStartDetectorImpl - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} (no name) - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} -------------------------------------------------- Enumerating Task Scheduler jobs: GoogleUpdateTaskMachineCore.job GoogleUpdateTaskMachineUA.job GoogleUpdateTaskUserS-1-5-21-836520192-274971183-1050649626-1006Core.job GoogleUpdateTaskUserS-1-5-21-836520192-274971183-1050649626-1006UA.job Install_NSS.job NSSstub.job ParetoLogic Registration3.job ParetoLogic Update Version3.job PC Health Advisor Defrag.job PC Health Advisor.job -------------------------------------------------- Enumerating Download Program Files: [{15589FA1-C456-11CE-BF01-00AA0055595A}] CODEBASE = http://w4s2.work4sure.com/c/ge/w4sgeen9.exe [Shockwave ActiveX Control] InProcServer32 = C:\WINDOWS\system32\Adobe\Director\SwDir.dll CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab [{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}] CODEBASE = http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab [{BCC0FF27-31D9-4614-A68E-C18E1ADA4389}] CODEBASE = http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab [Oberon Flash Game Host] InProcServer32 = C:\WINDOWS\Downloaded Program Files\OberonGameHost.dll CODEBASE = http://cablevision.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab [Shockwave Flash Object] InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash10e.ocx CODEBASE = http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab -------------------------------------------------- Enumerating ShellServiceObjectDelayLoad items: PostBootReminder: C:\WINDOWS\system32\SHELL32.dll CDBurn: C:\WINDOWS\system32\SHELL32.dll WebCheck: C:\WINDOWS\system32\webcheck.dll SysTray: C:\WINDOWS\system32\stobject.dll WPDShServiceObj: C:\WINDOWS\system32\WPDShServiceObj.dll -------------------------------------------------- End of report, 9,162 bytes Report generated in 0.047 seconds Command line options: /verbose - to add additional info on each section /complete - to include empty sections and unsuspicious data /full - to include several rarely-important sections /force9x - to include Win9x-only startups even if running on WinNT /forcent - to include WinNT-only startups even if running on Win9x /forceall - to include all Win9x and WinNT startups, regardless of platform /history - to list version history only