System

Daizy,
See what you think about this please.
I removed all unnecessary items from startup (about 6)

StartupList report, 9/13/03, 6:26:58 PM
StartupList version: 1.52
Started from : C:\UNZIPPED\HIJACKTHIS[1]\HIJACKTHIS.EXE
Detected: Windows 98 SE (Win9x 4.10.2222A)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
D:\PROGRAM FILES\ZONE LABS\ZONEALARM\ZONEALARM.EXE
C:\UNZIPPED\HIJACKTHIS[1]\HIJACKTHIS.EXE

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[C:\WINDOWS\All Users\Start Menu\Programs\StartUp]
ZoneAlarm.lnk = D:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

ScanRegistry = C:\WINDOWS\scanregw.exe /autorun
TaskMonitor = C:\WINDOWS\taskmon.exe
CriticalUpdate = C:\WINDOWS\SYSTEM\wucrtupd.exe -startup
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

TrueVector = C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE -service
LoadPowerProfile = Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

--------------------------------------------------

C:\WINDOWS\WININIT.BAK listing:
(Created 27/8/2003, 17:26:18)

[Rename]
NUL=C:\PROGRA~1\WINDOW~1\SETUP_WM.EXE
NUL=C:\WINDOWS\SYSTEM\WMPLOC.DLL

--------------------------------------------------

C:\AUTOEXEC.BAT listing:

SET SOUND=C:\VIBRA16
SET BLASTER=A220 I5 D1 H7 T6
SET MIDI=SYNTH:1 MAP:E
C:\VIBRA16\DIAGNOSE /S
C:\VIBRA16\MIXERSET /P /Q
SET BITCOM=C:\BITCOM
PROMPT $P$G
PATH C:\WINDOWS;C:\WINDOWS\COMMAND;C:\GEOWORKS;C:\BITCOM;C:\;C:\DOS;C:\MOUSE;C:\BSWIN
SET TEMP=C:\TEMP
SET TMP=C:\TEMP

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - (no file) - {004A5840-FF59-11d2-B50D-0090271D3FD4}
CCHelper - (no file) - {0CF0B8EE-6596-11D5-A98E-0003470BB48E}
(no name) - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\WINDOWS\SYSTEM\IETie.dll - {9527D42F-D666-11D3-B8DD-00600838CD5F}
(no name) - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll - {724d43a9-0d85-11d4-9908-00400523e39a}

--------------------------------------------------

Enumerating Task Scheduler jobs:

Windows Critical Update Notification.job
Symantec NetDetect.job
Maintenance-Defragment programs.job
Maintenance-ScanDisk.job
Maintenance-Disk cleanup.job
Tune-up Application Start.job

--------------------------------------------------

Enumerating Download Program Files:

[SurveyCtl35 Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\SURVEYCONTROL35.DLL
CODEBASE = http://activex.microsoft.com/controls/mtswizards/sw35.cab

[Microsoft ProgressBar Control, version 5.0 (SP2)]
InProcServer32 = C:\WINDOWS\SYSTEM\comctl32.ocx
CODEBASE = http://clinicdownload.mcafee.com/molbin/Shared/ComCtl32.cab

[CV3 Class]
InProcServer32 = C:\WINDOWS\SYSTEM\WUV3IS.DLL
CODEBASE = http://windowsupdate.microsoft.com/R1076/V31Controls/x86/w98/en/actsetup.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\FLASH\SWFLASH.OCX
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[YBIOCtrl Class]
CODEBASE = http://download.yahoo.com/dl/toolbar/yiebio3.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\SYSTEM\MACROMED\DIRECTOR\SWDIR.DLL
CODEBASE = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

[McAfee Smart Shop - Update Class]
InProcServer32 = C:\WINDOWS\MCBIN\MCAENG\ENG\MCSMTSHP.DLL
CODEBASE = http://download.mcafee.com/molbin/mcaeng/mcsmtshp.cab

[{DA28C54E-D95C-11D3-9A01-005004677EF4}]
CODEBASE = http://download.mcafee.com/molbin/clinic/CDM/McCDM.cab

[McAfee Hardware Finder Control]
CODEBASE = http://download.mcafee.com/molbin/clinic/hwf/mghwinfo.cab

[RdxIE Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\RDXIE.DLL
CODEBASE = http://207.188.7.150/131a6a584a1d915d5803/netzip/RdxIE.cab

[MailConfigure Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MAILCFG.DLL
CODEBASE = http://supportservices.msn.com/us/oeconfig/MailCfg.cab

[MSN Photo Upload Tool]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MSNPUPLD.DLL
CODEBASE = http://communities.msn.com/scr/PhotoUC/MsnPUpld.cab

[QuickTime Object]
InProcServer32 = C:\WINDOWS\SYSTEM\QTPLUGIN.OCX
CODEBASE = http://www.apple.com/qtactivex/qtplugin.cab

[{41F17733-B041-4099-A042-B518BB6A408C}]
CODEBASE = http://a224.g.akamai.net/7/224/52/2...apple.com/qt502/us/win/QuickTimeInstaller.exe

[CWDL_DownLoadControl Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\CWDL_DOWNLOAD.DLL
CODEBASE = http://www.callwave.com/include/cab/CWDL_DownLoad.cab

[OPUCatalog Class]
InProcServer32 = C:\WINDOWS\SYSTEM\OPUC.DLL
CODEBASE = http://office.microsoft.com/productupdates/content/opuc.cab

[BrowseFolderPopup Class]
InProcServer32 = C:\WINDOWS\MCBIN\SHARED\MGBRWFLD.DLL
CODEBASE = http://download.mcafee.com/molbin/Shared/MGBrwFld.cab

[McAfee PC Clinic System Information Class]
InProcServer32 = C:\WINDOWS\MCBIN\SI\SICOMP.DLL
CODEBASE = http://download.mcafee.com/molbin/Clinic/sysinfo/sicomp.cab

[McAfee PC Clinic FaManager Class]
InProcServer32 = C:\WINDOWS\MCBIN\FA\MGFACTL.DLL
CODEBASE = http://download.mcafee.com/molbin/Clinic/FirstAid/FACheck/mgfactl.cab

[McAfee Clinic TreeView Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\MGTREE.DLL
CODEBASE = http://download.mcafee.com/molbin/Shared/MGTree.cab

[Register Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\HWUTILS.DLL
CODEBASE = http://content.hiwirenetworks.net/inbrowser/cabfiles/2.5.26/Hiwire.cab

[Support.com SmartIssue]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\TGCTLSI.DLL
CODEBASE = http://support.charter.com/sdccommon/download/tgctlsi.cab

[Support.com Configuration Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\TGCTLCM.DLL
CODEBASE = http://support.charter.com/sdccommon/download/tgctlcm.cab

[eWebEditorPro.eWebEditPro]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\EWEBEDITPRO.OCX
CODEBASE = http://sinkingforkbaptistchurch.com/allaire/spectra/ewebeditpro/eWebEditPro.CAB

[McAfee.com Operating System Class]
InProcServer32 = C:\WINDOWS\SYSTEM\MCINSCTL.DLL
CODEBASE = http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,64/mcinsctl.cab

[Update Class]
InProcServer32 = C:\WINDOWS\SYSTEM\IUCTL.DLL
CODEBASE = http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37861.8211342593

[Live365Player Class]
InProcServer32 = C:\WINDOWS\DOWNLO~1\PLAY365.DLL
CODEBASE = http://www.live365.com/players/play365.cab

[CWDL_DownLoadControl Class]
InProcServer32 = C:\WINDOWS\DOWNLOADED PROGRAM FILES\CONFLICT.1\CWDL_DOWNLOAD.DLL
CODEBASE = http://www.callwave.com/include/cab/CWDL_DownLoad.CAB

[DwnldGroupMgr Class]
InProcServer32 = C:\WINDOWS\SYSTEM\MCGDMGR.DLL
CODEBASE = http://bin.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,11/mcgdmgr.cab

[HouseCall Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\XSCAN53.OCX
CODEBASE = http://a840.g.akamai.net/7/840/537/2003080601/housecall.antivirus.com/housecall/xscan53.cab

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINDOWS\SYSTEM\WEBCHECK.DLL

--------------------------------------------------
End of report, 8,549 bytes
Report generated in 0.139 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only