StartupList report, 6/27/2005, 1:29:15 AM
StartupList version: 1.52.2
Started from : C:\Documents and Settings\Dave Kim\Local Settings\Temp\HijackThis.EXE
Detected: Windows XP (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 (6.00.2600.0000)
* Using default options
==================================================
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\System32\SMSSU.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\WINDOWS\System32\Tmntsrv32.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\System32\qprazel.exe
C:\WINDOWS\System32\RUNDLL32.exe
C:\WINDOWS\System32\kaujpm.exe
C:\WINDOWS\System32\scrsvc.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\system\wbhklehrsu.exe
C:\Program Files\Messenger\msmsgs.exe
C:\program files\steam\steam.exe
C:\PROGRA~1\AIM\aim.exe
c:\windows\system32\uxcqtn.exe
C:\WINDOWS\System32\nvardssp.exe
C:\Program Files\Cas\Client\casclient.exe
C:\WINDOWS\System32\SMSSU.EXE
C:\WINDOWS\System32\Tmntsrv32.EXE
C:\WINDOWS\win32res.exe
C:\PROGRA~1\PANICW~1\POP-UP~2\PSFree.exe
C:\Corel\Graphics8\Programs\MFIndexer.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\PROGRA~1\MOZILL~1\firefox.exe
C:\Documents and Settings\Dave Kim\Local Settings\Temp\HijackThis.exe
--------------------------------------------------
Listing of startup folders:
Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Corel MEDIA FOLDERS INDEXER 8.LNK = C:\Corel\Graphics8\Programs\MFIndexer.exe
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cmaudio = RunDll32 cmicnfg.cpl,CMICtrlWnd
Anvshell = anvshell.exe
NvCplDaemon = RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
nwiz = nwiz.exe /install
LiveNote = livenote.exe
NeroFilterCheck = C:\WINDOWS\system32\NeroCheck.exe
NvMediaCenter = RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime
ViewMgr = C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
PSof1 = C:\WINDOWS\System32\PSof1.exe
exp.exe = C:\WINDOWS\System32\exp.exe
WinTask driver = C:\WINDOWS\System32\wintask.exe
us4W38j = qprazel.exe
AUNPS2 = RUNDLL32 AUNPS2.DLL,_Run@16
exp = C:\WINDOWS\System32\exp
checkrun = C:\windows\system32\eliteeng32.exe
KavSvc = C:\WINDOWS\System32\kaujpm.exe reg_run
PSGuard = C:\Program Files\PSGuard\PSGuard.exe
scrsvc = C:\WINDOWS\System32\scrsvc.exe
A70F6A1D-0195-42a2-934C-D8AC0F7C08EB = rundll32.exe E6F1873B.DLL,D9EBC318C
98D0CE0C16B1 = rundll32.exe D0CE0C16B1,D0CE0C16B1
eirkifi = c:\windows\system32\uxcqtn.exe r
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background
Steam = "c:\program files\steam\steam.exe" -silent
AIM = C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
fBv6RUHpi = nvardssp.exe
CAS Client = "C:\Program Files\Cas\Client\casclient.exe"
SMSSU = C:\WINDOWS\System32\SMSSU.EXE
Tmntsrv32 = C:\WINDOWS\System32\Tmntsrv32.EXE
sf = C:\Program Files\sf\sf.exe
Win32res = C:\WINDOWS\win32res.exe
PopUpStopperFreeEdition = "C:\PROGRA~1\PANICW~1\POP-UP~2\PSFree.exe"
--------------------------------------------------
File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command
(Default) =
--------------------------------------------------
Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=Explorer.exe C:\WINDOWS\Nail.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\logon.scr
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
Enumerating Browser Helper Objects:
(no name) - C:\WINDOWS\xmllib.dll - {60371670-81B9-4d06-9C42-4DEC1AABE62B}
--------------------------------------------------
Enumerating Download Program Files:
[QuickTime Object]
InProcServer32 = C:\Program Files\QuickTime\QTPlugin.ocx
CODEBASE =
http://www.apple.com/qtactivex/qtplugin.cab
[MSSecurityAdvisor Class]
InProcServer32 = C:\WINDOWS\System32\mssecadv.dll
CODEBASE =
http://protect.microsoft.com/security/protect/wsa/shared/CAB/x86/msSecAdv.cab?1118964246421
[FilePlanet Download Control Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\FilePlanetDownloadCtrl.dll
CODEBASE =
http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
[WUWebControl Class]
InProcServer32 = C:\WINDOWS\System32\wuweb.dll
CODEBASE =
http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1119671994779
[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE =
http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
--------------------------------------------------
Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*
Windows NT checkdisk command:
BootExecute = autocheck autochk *
Windows NT 'Wininit.ini':
PendingFileRenameOperations: C:\Documents and Settings\Dave Kim\Local Settings\Temp\temp.fr2573 => C:\DOCUME~1\DAVEKI~1\LOCALS~1\Temp\temp.fr8EB4|C:\System Volume Information\_restore{3A5DEFA5-38A9-476A-9E59-C48AC38322D9}\RP29\A0018382.exe => C:\DOCUME~1\DAVEKI~1\LOCALS~1\Temp\temp.fr3B52|C:\WINDOWS\systb.dll => C:\DOCUME~1\DAVEKI~1\LOCALS~1\Temp\temp.fr1AE9|C:\WINDOWS\tdtb.exe => C:\DOCUME~1\DAVEKI~1\LOCALS~1\Temp\temp.fr84A6|c:\windows\hosts => C:\DOCUME~1\DAVEKI~1\LOCALS~1\Temp\temp.frBEF4|c:\windows\system32\wbem\logs\wbemess.log => C:\DOCUME~1\DAVEKI~1\LOCALS~1\Temp\temp.fr9B58|c:\windows\lu.dat => C:\DOCUME~1\DAVEKI~1\LOCALS~1\Temp\temp.fr519F|c:\windows\redir.txt => C:\DOCUME~1\DAVEKI~1\LOCALS~1\Temp\temp.fr26FA|c:\windows\wupdt.exe => C:\DOCUME~1\DAVEKI~1\LOCALS~1\Temp\temp.fr1D24|||
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
wbhklehrsu.exe = C:\WINDOWS\system\wbhklehrsu.exe
--------------------------------------------------
End of report, 8,142 bytes
Report generated in 0.063 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
this happened about a year ago. I had my PC reformatted by the exact same guy 2 times. Reason why, when he reformatted everything about my PC moved alot faster. 
