Program mysteriously running at startup

[UnknownImp]

I have a webcam program (That I love) but it starts up with windows and as I am seriously restrictive about what is allowed to do that my first thought is "I'm going to disable it". So, I go into msconfig and no entry can be found and of course my next instinct was services so I went into services and found nothing again. I then proceed to check the startup folder to once again find nothing. Then I checked for tasks...nothing. Then I began digging through the registry. To find...NOTHING!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce

I also checked the following folders:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
C:\Users\Rays\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

I checked all tasks in the Task Scheduler for any out of the ordinary tasks (I only have 3, 2 are google updates, and the third is Adobe Application Manager for adobe updates) but besides all the generic Microsoft tasks I found nothing. Even HijackThis turned up nothing unusual.

I'm baffled where is it starting up from?

He's the file itself (A known and safe file I checked it's MD5 hash)
http://r.virscan.org/52e94abe5cb0880e8d078a39abb1e6db

 

[Elvandil]

Check all your startups.

Autoruns

 

[UnknownImp]

Check all your startups.

Autoruns

I've gone through every entry in the "Everything" tab and have found absolutely nothing out of the ordinary, I find HashTab files, Kaspersky Files, Windows Files, etc.

Further more I've started digging into the source for the program and so far I've found only four Reg keys being created/edited

#define SMARTCAM_REG_KEY "Software\\SmartCam\0"
#define SMARTCAM_REG_CONN_TYPE_VAL_NAME "ConnectionType\0"
#define SMARTCAM_REG_INET_PORT_VAL_NAME "InetPort\0"
#define SMARTCAM_REG_VIDEO_CODEC_VAL_NAME "VideoCodec\0"

All of which can be found in regedit but none of which seem to affect startup.

 

[Elvandil]

What is it that you actually see starting? Is it a program?

 

[UnknownImp]

What is it that you actually see starting? Is it a program?

It's a peice of software called SmartCam I installed it for use with my phone the program works entirely to my satisfaction but for some reason it starts every time i boot and opens its window. It then shuts down when I close the window.

 

[Elvandil]

Have you determined what process is running to create the window? Check Task Manager before closing the window. Under the Application tab is the most likely place to find it. Then, right-click and go to the process to see what process created the window.

It is possible that the window is initiated by the driver for the cam if it is installed by the program.

 

[UnknownImp]

Have you determined what process is running to create the window? Check Task Manager before closing the window. Under the Application tab is the most likely place to find it. Then, right-click and go to the process to see what process created the window.

It is possible that the window is initiated by the driver for the cam if it is installed by the program.

The program is running as SmartCam.exe which is the only executable the program has and it is still booting with me. I've removed malware easier than this :|

 

[Elvandil]

From the size of the driver download, there must be a lot included in that driver package in addition to the actual driver for the cam. It is likely that the program is started by the driver when the cam is detected. It shouldn't pop up if the cam is not connected. Is that the case?

 

[UnknownImp]

It actually connects via Bluetooth so the device is never physically connected, also I keep my bluetooth adapter undiscoverable and disabled unless I'm using it. Thanks for the help by the way

Edit: It starts up on every boot

 

[Elvandil]

I've never used Autoruns on an x64 system. Is it showing all the startups in the x64 registry, too?

Try a search of the Autoruns list just in case you missed it.

 

[Phantom010]

If you don't mind, Elvandil and UnknownImp, I'd like to have a look.


1- Please click HERE to download HijackThis.
2- Run the program.
3- Click on the Main Menu button if not already there.
4- Select Do a system scan and save a logfile.
5- Copy and paste the scan log from Notepad into your next reply.
6- Do not "Fix" anything unless advised to do so.

For Windows 7 and Vista:

If Windows is denying access to the Hosts file, disable the UAC and run HijackThis again.

===================================================================

Run Autoruns again.

Click on File.

Click on Save…

Save the new AutoRuns Data (*.arn) file to your desktop.

Close the Autoruns program.

Right-click on the new desktop AutoRuns .arn file.

Select Send To > Compressed (zipped) Folder.

Attach the compressed file to your next reply.

 

[Elvandil]

Yes, I'd like to see those, too.

 

[UnknownImp]

Logs of both programs are in the attached archive, good luck

 

[deionut]

I am the author of SmartCam; it's open source so you can rest assured the fact that it's starting at startup is not a virus or anything suspicious; The problem is that either Skype or Yahoo Messenger load the SmartCamFilter.ax DirectShow filter that enables SmartCam to be shown as a webcam to Windows. Not only do they load it but they also try to run it, accessing the video feed; when this happens that filter will itself start the SmartCam program to be able to connect to the phone; So the mistery is why does Skype/Yahoo Messenger (Not sure which one) tries to start the SmartCam webcam when Windows starts-up.

Regards,
Ionut

 

[Phantom010]

I am the author of SmartCam; it's open source so you can rest assured the fact that it's starting at startup is not a virus or anything suspicious; The problem is that either Skype or Yahoo Messenger load the SmartCamFilter.ax DirectShow filter that enables SmartCam to be shown as a webcam to Windows. Not only do they load it but they also try to run it, accessing the video feed; when this happens that filter will itself start the SmartCam program to be able to connect to the phone; So the mistery is why does Skype/Yahoo Messenger (Not sure which one) tries to start the SmartCam webcam when Windows starts-up.

Regards,
Ionut

None of which UnknownImp has. Could Messenger Plus! from Yuna Software be calling SmartCam?

O4 - HKLM\..\Run: [PlusService] D:\Program Files\(x86)\Messenger Plus!\PlusService.exe