Davey 7549-startuplist

Hi. My computer kept freezing up so I couldn't get back to you.
I have downloaded the startup list but don't know how to get it to you. I tried to email it but that didn't work. Wanted to email you through incredimail. Any suggestions. Also tried outlook but got a message from postmaster not to do that. I really need some help please. Thank you

 

StartupList report, 2/2/03, 9:04:43 PM
StartupList version: 1.51
Started from : C:\PROGRAM FILES\STARTUPLIST.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\PRINTRAY.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\PROGRAM FILES\REAL\REALPLAYER\REALPLAY.EXE
C:\WINDOWS\LOADQM.EXE
C:\PROGRAM FILES\INCREDIMAIL\BIN\INCMAIL.EXE
C:\PROGRAM FILES\KAZAA\KAZAA.EXE
C:\PROGRAM FILES\SAVENOW\SAVENOW.EXE
C:\PROGRAM FILES\MICROSOFT WORKS\WKSSB.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKUFIND.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\OSA.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\PRECISIONTIME\PRECISIONTIME.EXE
C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE10\MSOFFICE.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\MICROSOFT MONEY\SYSTEM\URLMAP.EXE
C:\PROGRAM FILES\STARTUPLIST.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Startup:
[C:\WINDOWS\Start Menu\Programs\StartUp]
Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
PrecisionTime.lnk = C:\Program Files\PrecisionTime\PrecisionTime.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
SystemTray = SysTray.Exe
LexmarkPrinTray = PrinTray.exe
EM_EXEC = C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
NAV Agent = C:\PROGRA~1\NORTON~1\NAVAPW32.EXE
RealTray = C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
LoadQM = loadqm.exe
IncrediMail = C:\PROGRAM FILES\INCREDIMAIL\BIN\IncMail.exe /c
CriticalUpdate = C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
KAZAA = C:\PROGRAM FILES\KAZAA\KAZAA.EXE /SYSTRAY
SaveNow = C:\Program Files\SaveNow\SaveNow.exe
MoneyStartUp10.0 = "C:\Program Files\Microsoft Money\System\Activation.exe"
Microsoft Works Portfolio = C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
Microsoft Works Update Detection = C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

ScriptBlocking = "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
SchedulingAgent = mstask.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Microsoft Works Update Detection = C:\Program Files\Microsoft Works\WkDetect.exe
msnmsgr = "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
IncrediMail = C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
MoneyAgent = "C:\Program Files\Microsoft Money\System\Money Express.exe"
RamBooster = C:\PROGRAM FILES\RAMBOOSTER\RAMBOOSTER.EXE

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 2/2/2003, 19:9:48)

[rename]
NUL=C:\WINDOWS\TEMP\_iu14D2N.tmp

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

C:\PROGRA~1\NORTON~1\NAVDX.EXE /startup

--------------------------------------------------


Enumerating Browser Helper Objects:

NAV Helper - C:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}
(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\Program Files\Microsoft Money\System\mnyviewer.dll - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Symantec NetDetect.job
Norton AntiVirus - Scan my computer.job
Disk Defragmenter.job
Maintenance-ScanDisk.job
Maintenance-Disk cleanup.job
Windows Critical Update Notification.job

--------------------------------------------------

Enumerating Download Program Files:

[{9DBAFCCF-592F-FFFF-FFFF-00608CEC297C}]
CODEBASE = http://download.weatherbug.com/minibug/tricklers/AWS/minibuginstaller.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\FLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash5r42.cab

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37637.9682523148

[OPUCatalog Class]
InProcServer32 = C:\WINDOWS\SYSTEM\OPUC.DLL
CODEBASE = http://office.microsoft.com/productupdates/content/opuc.cab

--------------------------------------------------
End of report, 6,296 bytes
Report generated in 2.105 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

 

carole,

Savenow.exe is spyware loaded by Kazaa that can cause problems.

Kazaa is loaded with spyware.

You can go here and download and run Spybot-Search&Destroy, but it will cause Kazaa to not work.

I would disable FINDFAST.EXE from running at startup. It has been known to cause problems too. It is part of windows, not spyware.

 

Carole- If you have the original version of Kazaa, that is loaded with malware, which can cause some nasty connection problems, poor performance, but it can be solved. There is a Lite version of Kazaa, much better, same stuff available. I have never used either, but I know there is plenty of info available about how to switch, I am not sure if you just download the Lite without uninstalling the original, so hang on for support on that....
SpyBot Search and Destroy is the hot app for now, to remove malware components....only thing is, some programs which bundled the malware may not fully work, or work at all....
Here is a link to Rog's compilation about Security in general, with a good section on SpyBot and how to install and use it....http://forums.techguy.org/t110854/s.html

Just scroll down the page a bit, for Spyware Info/Tools, it has directions and links to go get SpyBot. (Its from same place you got the StartupList....if you already have SpyBot, have you updated it....some came out just today or very recently)
For some of the spyware components, you can go to Add/ remove Programs and uninstall them from there first, then run SpyBot to clean up what they like to leave behind.

 

I have sent my startuplist again after I had used sypbot. Its in the thread to Virtual me. Can you take a look and see if it's ok. If not what else do I do. Thanks for your response.

 

carole,

Here is the list you posted to me. You need to keep using this thread so everyone can keep up with what has been done please.

 

http://www.answersthatwork.com/Tasklist_pages/tasklist_f.htm

To delete using Startup Manager

click Start

Run

type in msconfig

then click OK

Click on the Startup tab

See if you can see anything listed with Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE if so uncheck it.

click Apply

OK

and reboot.

There is more you could disable, but that depends on your preferences.

 

Found microsoft finfast. C:\proga`1 micros`3\office\findfast.exe
Is this the one. Kazza icon is there too.

 

Carole, Well, you have the two threads going, with responses at both that can help you.
The error message is related to some of the components that Kazaa came with....CyDoor. There is a way to fix it, so i will give you this link....you can fix this later on when things arent so confusing. http://cexx.org/cydoor.htm
Note that you may not have the files it shows you to search for....they may have already been removed. You should update SpyBot by going online, open the SpyBot program, check Online in the menu, have it search for updates, get all but the skins and other language files....just Includes, and program updates, go offline and run SpyBot again, maybe twice more, rebooting in between runs. You can also uncheck in SpyBots "File Sets" category, Usage Tracks, and Sys Internals, they are not important. only things that have checks in them, in red, that SpyBot finds need to be removed.
You have plenty of help for MS Office FindFast I see. have fun.

 

WHat else can I disable that i don't need. Any suggestions

 

Carole- Using the msconfig utility, from Start>Run, type in msconfig....then, under Startups.....you can uncheck RealPlayer and Real Tray. Probably the MS Money things, too, unless you use it a lot... Works Calendar Reminder can be unchecked, unless you use that. Looks like you are loading antivirus scan in DOS through Autoexec.bat.....really no need for that scanning at startup. You can change the settings inside the Norton AV program....to not scan at bootup. Now, that is only a suggestion....it's really your preference. The background scanner still would run during Windows sessions.

 

Your hard to keep up with, that is why it is best to keep to one thread. lol

Have you done what Byteman told you to do in his last post yet?

Yes to both. I won't be able to stay on much longer.

You can find what is in the startup here, and decide what to disable.

http://www.in.fh-merseburg.de/startuplist/startup_full.htm

 

Will try it out. If not working Ill be back. Thanks again