start up list

[philip1519]

I recently hit upon the idea of lessening the amount of programs that open at startup. It was suggested here that I use msconfig on my XP system to keep some programs from opening. I now get a notification that I have used msconfig and that I should restore the system to it's prior settings, which I have done. Here is my startup list. Would someone be kind enough to scan it and tell me if there are items that need to be deleted (i.e. harmful) or that can be removed from startup. How can these things be done without activating the notification again? I should add that I have also been deleting entries that are related to "wildtangent", a game provider that installs alot of spyware on a persons computer.

StartupList report, 4/6/2004, 1:08:57 PM
StartupList version: 1.52
Started from : C:\Documents and Settings\Owner\Desktop\StartupList.EXE
Detected: Windows XP SP1 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Lexmark X5100 Series\lxbabmon.exe
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Broderbund\Mavis Beacon Teaches Typing 15\minimavis.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Verizon Online\SupportCenter\bin\mpbtn.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Owner\Desktop\StartupList.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
hp center UI.lnk = C:\Program Files\hp center\137903\Shadow\ShadowBar.exe
hp center.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe
Personal Coach.lnk = ?
Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
Verizon Online Support Center.lnk = C:\Program Files\Verizon Online\SupportCenter\bin\matcli.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

hpsysdrv = c:\windows\system\hpsysdrv.exe
HotKeysCmds = C:\WINDOWS\System32\hkcmd.exe
Share-to-Web Namespace Daemon = c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
CamMonitor = c:\Program Files\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe
KBD = C:\HP\KBD\KBD.EXE
AutoTBar = C:\hp\bin\autotbar.exe
WCOLOREAL = "C:\Program Files\Coloreal\coloreal.exe"
Recguard = C:\WINDOWS\SMINST\RECGUARD.EXE
nwiz = nwiz.exe /install
ccApp = "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
ccRegVfy = "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
PS2 = C:\WINDOWS\system32\ps2.exe
Motive SmartBridge = C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\MotiveSB.exe
TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
Lexmark X5100 Series = "C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe"
UpdateManager = "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
IPInSightLAN 01 = "C:\Program Files\Verizon Online\VisualIPInsight\IPClient.exe" -l
IPInSightMonitor 01 = "C:\Program Files\Verizon Online\VisualIPInsight\IPMon32.exe"
WT GameChannel = C:\Program Files\WildTangent\Apps\GameChannel.exe
WildTangent CDA = RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Weather = C:\Program Files\AWS\WeatherBug\Weather.exe 1
MsnMsgr = "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\system32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
NAV Helper - c:\Program Files\Norton AntiVirus\NavShExt.dll - {BDF3E430-B101-42AD-A544-FADC6B084872}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Norton AntiVirus - Scan my computer.job
Symantec NetDetect.job

--------------------------------------------------

Enumerating Download Program Files:

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab

[SurroundVideoCtrl Object]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\MSSurVid.ocx
CODEBASE = http://autos.msn.com/components/ocx/survid/MSSurVid.cab

[ExteriorSurround Object]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\Outside.ocx
CODEBASE = http://autos.msn.com/components/ocx/exterior/Outside.cab

[CPostLaunch Object]
InProcServer32 = C:\Program Files\Common Files\Verizon Online\VOLMSN\PostLaunchTask.dll
CODEBASE = http://www2.verizon.net/update/msnwebinstall/includes/vzWebIns.CAB

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\Macromed\Flash\Flash.ocx
CODEBASE = http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[{E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD}]
CODEBASE = http://download.abacast.com/download/files/abasetup141.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
End of report, 7,354 bytes
Report generated in 0.188 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

Also, what is PS2? I accidently deleted it when I was getting rid of programs related to wild tangent.I guess I haven't tried accessing it yet because I haven't gotten a notice that it is not available. Can I get it back?

Thanks, Phil

 

[Cris_Cr0ss]

C:\Documents and Settings\Owner

u see where it says Owner thats your username, I hope you have a password on that account if not get one or change username that can be a great security risk. Thats what i have read, If you dont believe me google up blackviper and on his site it will tell you. People can hack it becuase its the DEFUALT*

you dont need

C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\AWS\WeatherBug\Weather.exe <--looks like spyware to me run ad-aware and spybot links in sig

Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
dont know if you want

WT GameChannel = C:\Program Files\WildTangent\Apps\GameChannel.exe
WildTangent CDA = RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain

dont need those thats forsure go to start>search> and search anything that has to do with wildtangent.

UpdateManager = "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r

TkBellExe = "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
i dont think you need to update real either you can always manual update your choice tho.

Im not 100% sure these are safe so don't take my word as final always do a little research GOOGLE is a friend use IT.

I hope this helps.

 

[philip1519]

OK Cris. How do I get rid of these items? Am I deleting them from my computer or just from the start up list? I am three times as old as you are but still brand new. I do want weather bug to open and I want to get totally rid of wild tangent. As for the other items I don't know. Help me out.

 

[Cris_Cr0ss]

alrite, go to start>run> type msconfig.

Go to the startup tab and remove the ones that are unneccesary.
as for wild tangent you should run spybot search and destroy and ad-aware. then reboot after rebooting run hijack this and click on scan then save it and copy the log and paste it here for someone to help you clean it up. Reboot. Make sure you update before scanning. now go to start search and type wild or tangent and delete any of those make sure you double check their directory.

all the links to what you need are in my signature. Hope its clear if not please reply i will get back to you.

 

[WILDFYRE]

Instead of typing msconfig in run box, try typing: services.msc this will prevent you from getting the msconfig notification and will also open up your start up list. Check out www.blackviper.com for a complete list of programs and information on the ones that are safe to disable.