Internet connection [Archive]

Smuga

June 5th 04, 12:15 AM

When I start computer before Windows ME are loaded I can see a lot of
internet activities on broadband modem. Any idea what is going on than? Any
chance hacker's programs are connecting before Win. programs like antivirus
and firewall are protecting the system?

Appreciate help
Chuck

Noel Paton

June 5th 04, 07:54 AM

You may have a virus/spyware hijack

download the Stinger from here and run it to make sure that A-V-disabling
viruses are not present on your PC
http://download.nai.com/products/mcafee-avert/stinger.exe

- update your virus scanner and run a full system scan of all files.

Reboot to Safe Mode and run CWShredder - to remove variants of the
CoolWebSearch hijacker.
http://www.merijn.org/cwschronicles.html

Use CWShredder, the removal tool:
http://www.merijn.org/files/cwshredder.zip
http://www.merijn.org/files/CWShredder.exe
http://www.spywareinfo.com/downloads/tools/CWShredder.exe
http://www.zerosrealm.com/downloads/CWShredder.zip

download AdAware from www.lavasoftusa.com, install, update, and run it to
remove spyware, adware,
and other such nasties from your system.

--
Noel Paton (MS-MVP 2002-2004, Win9x)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
"Smuga" > wrote in message
gers.com...
> When I start computer before Windows ME are loaded I can see a lot of
> internet activities on broadband modem. Any idea what is going on than?
Any
> chance hacker's programs are connecting before Win. programs like
antivirus
> and firewall are protecting the system?
>
> Appreciate help
> Chuck
>
>

Smuga

June 5th 04, 07:47 PM

Stinger find these:

Scan initiated on Sat Jun 05 12:53:17 2004

C:\_RESTORE\ARCHIVE\FS2669.CAB\A0374857.CPY

Found the W32/Pate.dam virus !!!

C:\_RESTORE\ARCHIVE\FS2670.CAB\A0374864.CPY

Found the W32/Pate.dam virus !!!

Number of clean files: 267781

Number of infected files: 2

Why my norton's antivirue did not find anything ( updated) ?
Why my computer have hard time to start without modem on?
Why my registery have same entries with name contanig word "hack" ?
DSAPPHACKID_MODIFYCSBFAILURE
DSAPPHACKID_RETURNWRITEPOS
DSAPPHACKID_DEVACCEL
and many more

Thanks
Chuck

"Noel Paton" > wrote in message
...
> You may have a virus/spyware hijack
>
> download the Stinger from here and run it to make sure that A-V-disabling
> viruses are not present on your PC
> http://download.nai.com/products/mcafee-avert/stinger.exe
>
> - update your virus scanner and run a full system scan of all files.
>
> Reboot to Safe Mode and run CWShredder - to remove variants of the
> CoolWebSearch hijacker.
> http://www.merijn.org/cwschronicles.html
>
> Use CWShredder, the removal tool:
> http://www.merijn.org/files/cwshredder.zip
> http://www.merijn.org/files/CWShredder.exe
> http://www.spywareinfo.com/downloads/tools/CWShredder.exe
> http://www.zerosrealm.com/downloads/CWShredder.zip
>
> download AdAware from www.lavasoftusa.com, install, update, and run it to
> remove spyware, adware,
> and other such nasties from your system.
>
>
> --
> Noel Paton (MS-MVP 2002-2004, Win9x)
>
> Nil Carborundum Illegitemi
> http://www.btinternet.com/~winnoel/millsrpch.htm
>
> Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
> or
> http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
> "Smuga" > wrote in message
> gers.com...
> > When I start computer before Windows ME are loaded I can see a lot of
> > internet activities on broadband modem. Any idea what is going on than?
> Any
> > chance hacker's programs are connecting before Win. programs like
> antivirus
> > and firewall are protecting the system?
> >
> > Appreciate help
> > Chuck
> >
> >
>
>

Noel Paton

June 5th 04, 08:52 PM

Smuga -
Don't worry either about virus findings in the _Restore folder - they can't
hurt your PC unless you use System Restore to restore back to a time when
you were infected, and before you cleaned your system.

The W32/Pate.dam virus appears to be associated with eAnthology software - I
suggest that you uninstall any such.
They are however, an indicator that you your PC was infected at some time in
the past, and that that infection was cleaned by something (presumably
Norton? - which version are you running? - when was the last time you
updated it, and when did you last run a scan of all files??).
(W32/Pate.dam are the results of cleaned infections, rather than infections
of themselves).

The DSAPPHACKID registry entries are normal - believe it or not! - they are
MS's attempts to give compatibility to some programs (mostly games AFAICT).

Reboot to Safe Mode - open MSCONFIG - click on the Startup tab
What's listed there?

--
Noel Paton (MS-MVP 2002-2004, Win9x)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
"Smuga" > wrote in message
s.com...
> Stinger find these:
>
> Scan initiated on Sat Jun 05 12:53:17 2004
>
> C:\_RESTORE\ARCHIVE\FS2669.CAB\A0374857.CPY
>
> Found the W32/Pate.dam virus !!!
>
> C:\_RESTORE\ARCHIVE\FS2670.CAB\A0374864.CPY
>
> Found the W32/Pate.dam virus !!!
>
> Number of clean files: 267781
>
> Number of infected files: 2
>
> Why my norton's antivirue did not find anything ( updated) ?
> Why my computer have hard time to start without modem on?
> Why my registery have same entries with name contanig word "hack" ?
> DSAPPHACKID_MODIFYCSBFAILURE
> DSAPPHACKID_RETURNWRITEPOS
> DSAPPHACKID_DEVACCEL
> and many more
>
> Thanks
> Chuck
>
>
>
>
>
>
>
>
> "Noel Paton" > wrote in message
> ...
> > You may have a virus/spyware hijack
> >
> > download the Stinger from here and run it to make sure that
A-V-disabling
> > viruses are not present on your PC
> > http://download.nai.com/products/mcafee-avert/stinger.exe
> >
> > - update your virus scanner and run a full system scan of all files.
> >
> > Reboot to Safe Mode and run CWShredder - to remove variants of the
> > CoolWebSearch hijacker.
> > http://www.merijn.org/cwschronicles.html
> >
> > Use CWShredder, the removal tool:
> > http://www.merijn.org/files/cwshredder.zip
> > http://www.merijn.org/files/CWShredder.exe
> > http://www.spywareinfo.com/downloads/tools/CWShredder.exe
> > http://www.zerosrealm.com/downloads/CWShredder.zip
> >
> > download AdAware from www.lavasoftusa.com, install, update, and run it
to
> > remove spyware, adware,
> > and other such nasties from your system.
> >
> >
> > --
> > Noel Paton (MS-MVP 2002-2004, Win9x)
> >
> > Nil Carborundum Illegitemi
> > http://www.btinternet.com/~winnoel/millsrpch.htm
> >
> > Please read http://dts-l.org/goodpost.htm on how to post messages to
NG's
> > or
> > http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
> > "Smuga" > wrote in message
> > gers.com...
> > > When I start computer before Windows ME are loaded I can see a lot of
> > > internet activities on broadband modem. Any idea what is going on
than?
> > Any
> > > chance hacker's programs are connecting before Win. programs like
> > antivirus
> > > and firewall are protecting the system?
> > >
> > > Appreciate help
> > > Chuck
> > >
> > >
> >
> >
>
>

Smuga

June 6th 04, 03:11 AM

> Norton? - which version are you running? - when was the last time you
> updated it, and when did you last run a scan of all files??).
Norton Internet Security 2003 (includes antivirus) , updated daily , scanned
weekly.
I have run it after Stinger , but didn't see any virus again !

Reboot to Safe Mode - open MSCONFIG - click on the Startup tab
> What's listed there?
A lot of stuff , nothing looking suspicious. I couldn't figured how to copy
the whole startup list for you to see .

How to delete infected files? Stinger just shows the virus.

Thanks
Chuck

"Noel Paton" > wrote in message
...
> Smuga -
> Don't worry either about virus findings in the _Restore folder - they
can't
> hurt your PC unless you use System Restore to restore back to a time when
> you were infected, and before you cleaned your system.
>
> The W32/Pate.dam virus appears to be associated with eAnthology software -
I
> suggest that you uninstall any such.
> They are however, an indicator that you your PC was infected at some time
in
> the past, and that that infection was cleaned by something (presumably
> Norton? - which version are you running? - when was the last time you
> updated it, and when did you last run a scan of all files??).
> (W32/Pate.dam are the results of cleaned infections, rather than
infections
> of themselves).
>
> The DSAPPHACKID registry entries are normal - believe it or not! - they
are
> MS's attempts to give compatibility to some programs (mostly games
AFAICT).
>
> Reboot to Safe Mode - open MSCONFIG - click on the Startup tab
> What's listed there?
>
>
> --
> Noel Paton (MS-MVP 2002-2004, Win9x)
>
> Nil Carborundum Illegitemi
> http://www.btinternet.com/~winnoel/millsrpch.htm
>
> Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
> or
> http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
> "Smuga" > wrote in message
> s.com...
> > Stinger find these:
> >
> > Scan initiated on Sat Jun 05 12:53:17 2004
> >
> > C:\_RESTORE\ARCHIVE\FS2669.CAB\A0374857.CPY
> >
> > Found the W32/Pate.dam virus !!!
> >
> > C:\_RESTORE\ARCHIVE\FS2670.CAB\A0374864.CPY
> >
> > Found the W32/Pate.dam virus !!!
> >
> > Number of clean files: 267781
> >
> > Number of infected files: 2
> >
> > Why my norton's antivirue did not find anything ( updated) ?
> > Why my computer have hard time to start without modem on?
> > Why my registery have same entries with name contanig word "hack" ?
> > DSAPPHACKID_MODIFYCSBFAILURE
> > DSAPPHACKID_RETURNWRITEPOS
> > DSAPPHACKID_DEVACCEL
> > and many more
> >
> > Thanks
> > Chuck
> >
> >
> >
> >
> >
> >
> >
> >
> > "Noel Paton" > wrote in message
> > ...
> > > You may have a virus/spyware hijack
> > >
> > > download the Stinger from here and run it to make sure that
> A-V-disabling
> > > viruses are not present on your PC
> > > http://download.nai.com/products/mcafee-avert/stinger.exe
> > >
> > > - update your virus scanner and run a full system scan of all files.
> > >
> > > Reboot to Safe Mode and run CWShredder - to remove variants of the
> > > CoolWebSearch hijacker.
> > > http://www.merijn.org/cwschronicles.html
> > >
> > > Use CWShredder, the removal tool:
> > > http://www.merijn.org/files/cwshredder.zip
> > > http://www.merijn.org/files/CWShredder.exe
> > > http://www.spywareinfo.com/downloads/tools/CWShredder.exe
> > > http://www.zerosrealm.com/downloads/CWShredder.zip
> > >
> > > download AdAware from www.lavasoftusa.com, install, update, and run it
> to
> > > remove spyware, adware,
> > > and other such nasties from your system.
> > >
> > >
> > > --
> > > Noel Paton (MS-MVP 2002-2004, Win9x)
> > >
> > > Nil Carborundum Illegitemi
> > > http://www.btinternet.com/~winnoel/millsrpch.htm
> > >
> > > Please read http://dts-l.org/goodpost.htm on how to post messages to
> NG's
> > > or
> > > http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
> > > "Smuga" > wrote in message
> > > gers.com...
> > > > When I start computer before Windows ME are loaded I can see a lot
of
> > > > internet activities on broadband modem. Any idea what is going on
> than?
> > > Any
> > > > chance hacker's programs are connecting before Win. programs like
> > > antivirus
> > > > and firewall are protecting the system?
> > > >
> > > > Appreciate help
> > > > Chuck
> > > >
> > > >
> > >
> > >
> >
> >
>
>

Noel Paton

June 6th 04, 07:42 AM

As I said, you don't need to worry about the infected files -they can't hurt
your system where they are.
http://support.microsoft.com/?scid=263455

It may simply be thatNorton doesn't consider healed files such as these to
be virus-infected or dangerous any more, and therefore doesn't flag them.

--
Noel Paton (MS-MVP 2002-2004, Win9x)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
"Smuga" > wrote in message
able.rogers.com...
> > Norton? - which version are you running? - when was the last time you
> > updated it, and when did you last run a scan of all files??).
> Norton Internet Security 2003 (includes antivirus) , updated daily ,
scanned
> weekly.
> I have run it after Stinger , but didn't see any virus again !
>
> Reboot to Safe Mode - open MSCONFIG - click on the Startup tab
> > What's listed there?
> A lot of stuff , nothing looking suspicious. I couldn't figured how to
copy
> the whole startup list for you to see .
>
> How to delete infected files? Stinger just shows the virus.
>
> Thanks
> Chuck
>
>
>
>
> "Noel Paton" > wrote in message
> ...
> > Smuga -
> > Don't worry either about virus findings in the _Restore folder - they
> can't
> > hurt your PC unless you use System Restore to restore back to a time
when
> > you were infected, and before you cleaned your system.
> >
> > The W32/Pate.dam virus appears to be associated with eAnthology
software -
> I
> > suggest that you uninstall any such.
> > They are however, an indicator that you your PC was infected at some
time
> in
> > the past, and that that infection was cleaned by something (presumably
> > Norton? - which version are you running? - when was the last time you
> > updated it, and when did you last run a scan of all files??).
> > (W32/Pate.dam are the results of cleaned infections, rather than
> infections
> > of themselves).
> >
> > The DSAPPHACKID registry entries are normal - believe it or not! - they
> are
> > MS's attempts to give compatibility to some programs (mostly games
> AFAICT).
> >
> > Reboot to Safe Mode - open MSCONFIG - click on the Startup tab
> > What's listed there?
> >
> >
> > --
> > Noel Paton (MS-MVP 2002-2004, Win9x)
> >
> > Nil Carborundum Illegitemi
> > http://www.btinternet.com/~winnoel/millsrpch.htm
> >
> > Please read http://dts-l.org/goodpost.htm on how to post messages to
NG's
> > or
> > http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
> > "Smuga" > wrote in message
> > s.com...
> > > Stinger find these:
> > >
> > > Scan initiated on Sat Jun 05 12:53:17 2004
> > >
> > > C:\_RESTORE\ARCHIVE\FS2669.CAB\A0374857.CPY
> > >
> > > Found the W32/Pate.dam virus !!!
> > >
> > > C:\_RESTORE\ARCHIVE\FS2670.CAB\A0374864.CPY
> > >
> > > Found the W32/Pate.dam virus !!!
> > >
> > > Number of clean files: 267781
> > >
> > > Number of infected files: 2
> > >
> > > Why my norton's antivirue did not find anything ( updated) ?
> > > Why my computer have hard time to start without modem on?
> > > Why my registery have same entries with name contanig word "hack" ?
> > > DSAPPHACKID_MODIFYCSBFAILURE
> > > DSAPPHACKID_RETURNWRITEPOS
> > > DSAPPHACKID_DEVACCEL
> > > and many more
> > >
> > > Thanks
> > > Chuck
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > >
> > > "Noel Paton" > wrote in message
> > > ...
> > > > You may have a virus/spyware hijack
> > > >
> > > > download the Stinger from here and run it to make sure that
> > A-V-disabling
> > > > viruses are not present on your PC
> > > > http://download.nai.com/products/mcafee-avert/stinger.exe
> > > >
> > > > - update your virus scanner and run a full system scan of all files.
> > > >
> > > > Reboot to Safe Mode and run CWShredder - to remove variants of the
> > > > CoolWebSearch hijacker.
> > > > http://www.merijn.org/cwschronicles.html
> > > >
> > > > Use CWShredder, the removal tool:
> > > > http://www.merijn.org/files/cwshredder.zip
> > > > http://www.merijn.org/files/CWShredder.exe
> > > > http://www.spywareinfo.com/downloads/tools/CWShredder.exe
> > > > http://www.zerosrealm.com/downloads/CWShredder.zip
> > > >
> > > > download AdAware from www.lavasoftusa.com, install, update, and run
it
> > to
> > > > remove spyware, adware,
> > > > and other such nasties from your system.
> > > >
> > > >
> > > > --
> > > > Noel Paton (MS-MVP 2002-2004, Win9x)
> > > >
> > > > Nil Carborundum Illegitemi
> > > > http://www.btinternet.com/~winnoel/millsrpch.htm
> > > >
> > > > Please read http://dts-l.org/goodpost.htm on how to post messages to
> > NG's
> > > > or
> > > > http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
> > > > "Smuga" > wrote in message
> > > > gers.com...
> > > > > When I start computer before Windows ME are loaded I can see a lot
> of
> > > > > internet activities on broadband modem. Any idea what is going on
> > than?
> > > > Any
> > > > > chance hacker's programs are connecting before Win. programs like
> > > > antivirus
> > > > > and firewall are protecting the system?
> > > > >
> > > > > Appreciate help
> > > > > Chuck
> > > > >
> > > > >
> > > >
> > > >
> > >
> > >
> >
> >
>
>

Smuga

June 6th 04, 10:00 PM

Thanks a lot

Chuck

Noel Paton

June 6th 04, 10:07 PM

WRT the startup listing -
Open System Information, and go to the Startup list (in Software
Environment) there, copy/paste it to your response.

--
Noel Paton (MS-MVP 2002-2004, Win9x)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
"Smuga" > wrote in message
ogers.com...
> Thanks a lot
>
> Chuck
>
>

Smuga

June 6th 04, 11:55 PM

*StateMgr c:\windows\system\restore\statemgr.exe All Users
HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services
AdaptecDirectCD "c:\program files\adaptec\easy cd creator
5\directcd\directcd.exe" All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ATI Launchpad .DEFAULT
HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVer sion\Run
ATIGART c:\ati\gart\atigart.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
AtiPTA atiptaxx.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ccApp "c:\program files\common files\symantec shared\ccapp.exe" All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ccEvtMgr "c:\program files\common files\symantec shared\ccevtmgr.exe" All
Users HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services
ccPxySvc c:\progra~1\norton~2\ccpxysvc.exe All Users
HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services
ccRegVfy "c:\program files\common files\symantec shared\ccregvfy.exe" All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
EnsoniqMixer starter.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HotSync Manager c:\progra~1\sonyha~1\hotsync.exe .DEFAULT Startup
HPDJ Taskbar Utility c:\windows\system\hpztsb04.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
iamapp c:\program files\norton internet security\iamapp.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
LoadPowerProfile rundll32.exe powrprof.dll,loadcurrentpwrscheme All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
LoadQM loadqm.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Machine Debug Manager c:\windows\system\mdm.exe All Users
HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services
nisserv c:\program files\norton internet security\nisserv.exe All Users
HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services
Nisum c:\program files\norton internet security\nisum.exe All Users
HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services
PCHealth c:\windows\pchealth\support\pchschd.exe -s All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
QuickTime Task "c:\windows\system\qttask.exe" -atboottime All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ScanRegistry c:\windows\scanregw.exe /autorun All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SchedulingAgent mstask.exe All Users
HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services
ScriptBlocking "c:\program files\common files\symantec shared\script
blocking\sbserv.exe" -reg All Users
HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services
Symantec NetDriver Monitor c:\progra~1\symantec\liveup~1\sndmon.exe All
Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
SystemTray systray.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
TaskMonitor c:\windows\taskmon.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinPatrol c:\progra~1\billps~1\winpat~1\winpatrol.exe All Users
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Chuck

"Noel Paton" > wrote in message
...
> WRT the startup listing -
> Open System Information, and go to the Startup list (in Software
> Environment) there, copy/paste it to your response.
>
> --
> Noel Paton (MS-MVP 2002-2004, Win9x)
>
> Nil Carborundum Illegitemi
> http://www.btinternet.com/~winnoel/millsrpch.htm
>
> Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
> or
> http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
> "Smuga" > wrote in message
> ogers.com...
> > Thanks a lot
> >
> > Chuck
> >
> >
>
>

Noel Paton

June 7th 04, 08:46 PM

How did I know that Norton would come into this somewhere?
FWIW, you may find that getting rid of Norton will solve a lot of problems

--
Noel Paton (MS-MVP 2002-2004, Win9x)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's
or
http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
"Smuga" > wrote in message
ogers.com...
> *StateMgr c:\windows\system\restore\statemgr.exe All Users
> HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services
> AdaptecDirectCD "c:\program files\adaptec\easy cd creator
> 5\directcd\directcd.exe" All Users
> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> ATI Launchpad .DEFAULT
> HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVer sion\Run
> ATIGART c:\ati\gart\atigart.exe All Users
> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> AtiPTA atiptaxx.exe All Users
> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> ccApp "c:\program files\common files\symantec shared\ccapp.exe" All Users
> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> ccEvtMgr "c:\program files\common files\symantec shared\ccevtmgr.exe" All
> Users HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services
> ccPxySvc c:\progra~1\norton~2\ccpxysvc.exe All Users
> HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services
> ccRegVfy "c:\program files\common files\symantec shared\ccregvfy.exe" All
> Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> EnsoniqMixer starter.exe All Users
> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> HotSync Manager c:\progra~1\sonyha~1\hotsync.exe .DEFAULT Startup
> HPDJ Taskbar Utility c:\windows\system\hpztsb04.exe All Users
> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> iamapp c:\program files\norton internet security\iamapp.exe All Users
> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> LoadPowerProfile rundll32.exe powrprof.dll,loadcurrentpwrscheme All Users
> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> LoadQM loadqm.exe All Users
> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> Machine Debug Manager c:\windows\system\mdm.exe All Users
> HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services
> nisserv c:\program files\norton internet security\nisserv.exe All Users
> HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services
> Nisum c:\program files\norton internet security\nisum.exe All Users
> HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services
> PCHealth c:\windows\pchealth\support\pchschd.exe -s All Users
> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> QuickTime Task "c:\windows\system\qttask.exe" -atboottime All Users
> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> ScanRegistry c:\windows\scanregw.exe /autorun All Users
> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> SchedulingAgent mstask.exe All Users
> HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services
> ScriptBlocking "c:\program files\common files\symantec shared\script
> blocking\sbserv.exe" -reg All Users
> HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services
> Symantec NetDriver Monitor c:\progra~1\symantec\liveup~1\sndmon.exe All
> Users HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> SystemTray systray.exe All Users
> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> TaskMonitor c:\windows\taskmon.exe All Users
> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
> WinPatrol c:\progra~1\billps~1\winpat~1\winpatrol.exe All Users
> HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
>
> Chuck
>
>
>
>
>
>
>
> "Noel Paton" > wrote in message
> ...
> > WRT the startup listing -
> > Open System Information, and go to the Startup list (in Software
> > Environment) there, copy/paste it to your response.
> >
> > --
> > Noel Paton (MS-MVP 2002-2004, Win9x)
> >
> > Nil Carborundum Illegitemi
> > http://www.btinternet.com/~winnoel/millsrpch.htm
> >
> > Please read http://dts-l.org/goodpost.htm on how to post messages to
NG's
> > or
> > http://www.microsoft.com/presspass/features/2001/Mar01/Mar27pmvp.asp
> > "Smuga" > wrote in message
> > ogers.com...
> > > Thanks a lot
> > >
> > > Chuck
> > >
> > >
> >
> >
>
>