PDA

View Full Version : StartUp List


mjc
09-11-2002, 05:29 PM
I recently found a fantastic startup logger (lists everything that runs at startup more than any other one I have seen. The developer of this fantastic little program is also very responsive to suggestions and bug fixes (in the last week he has come out with several updates to both add new features and correct bugs). The only thing it does not do is offer a way to turn off what it finds, you must manually do this.

It is mainly a forensic tool, not a startup manager, but the list this program provides cannot be beat! It works on Win9x/Nt/2k/XP (maybe it will even run on 3.1 if you have the 32bit update and updated VB runtimes...haven't tried it yet, but I might...).

The info for it can be found here (http://www.geocities.com/merijn_bellekom/new/files.html) (the description is for version 1.20...it is up to 1.3) the download can be found here (http://www.lurkhere.com/~nicefiles/) or here (http://www.spywareinfo.com/files/startuplist.zip)

mjc
09-11-2002, 05:34 PM
This is what the output looks like with the /html option:

<html><head>
<title>StartupList report</title>
<meta NAME="Generator" CONTENT="StartupList v1.30">
<meta HTTP-EQUIV="content-type" CONTENT="text/html; charset=ISO-8859-1"><style TYPE="text/css"><!--
body{font-family: Fixedsys, Arial, monospace;margin-left:40px;margin-right:40px}
--></STYLE>
</head>
<body>StartupList report, 9/11/02, 4:32:36
Detected: Windows 98 SE (Win9x 4.10.2222A)
<blockquote>Sections:<blockquote>
<a HREF="#1">Running processes</a>
<a HREF="#4">Autorun key HKLM\..\Run</a>
<a HREF="#7">Autorun key HKLM\..\RunServices</a>
<a HREF="#9">Autorun key HKCU\..\Run</a>
<a HREF="#17">Class .EXE</a>
<a HREF="#18">Class .COM</a>
<a HREF="#19">Class .BAT</a>
<a HREF="#20">Class .PIF</a>
<a HREF="#21">Class .SCR</a>
<a HREF="#22">Class .HTA</a>
<a HREF="#23">Active Setup Stub Paths</a>
<a HREF="#25">Load/Run keys from WIN.INI</a>
<a HREF="#26">Shell/SCRNSAVE.EXE keys from SYSTEM.INI</a>
<a HREF="#27">Explorer check</a>
<a HREF="#29">Wininit.bak</a>
<a HREF="#30">C:\Autoexec.bat</a>
<a HREF="#32">C:\WINDOWS\Dosstart.bat</a>
<a HREF="#33">Superhidden extensions</a>
</blockquote></blockquote>
<center><hr WIDTH="80%" SIZE=5"></center><pre><font FACE="Fixedsys">

<a NAME="1"><b>Running processes:</b></a>
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SOINTGR.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE
C:\PROGRAM FILES\AHEAD\INCD\INCD.EXE
C:\PROGRAM FILES\NETLAUNCH\LAUNCH.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\VISIONEERONETOUCH\ONETOUCHMON.EXE
C:\WINDOWS\WINEJECT.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\ZONELABS\ZONEALARM\ZONEALARM.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\ZONELABS\VSMON.EXE
C:\PROGRAM FILES\MOZILLA.ORG\MOZILLA\MOZILLA.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\WINOA386.MOD
D:\DOWNLOADS\STARTUPLIST.EXE

<center><hr WIDTH="80%"></center>

<a NAME="4"><b>Autorun entries from Registry:</b></a>
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
SystemTray = SysTray.Exe
TClockEx = E:\PROGRAM FILES\TCCLOCK\TCLOCKEX.EXE
ScanRegistry = c:\windows\scanregw.exe /autorun
SO5 Integrator Pass Two = C:\WINDOWS\SOINTGR.EXE
AVG_CC = C:\PROGRAM FILES\GRISOFT\AVG6\avgcc32.exe /startup
InCD = C:\Program Files\ahead\InCD\InCD.exe
NetLaunch = C:\PROGRAM FILES\NETLAUNCH\LAUNCH.EXE
Tweak UI = RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
HotKeysCmds = C:\WINDOWS\SYSTEM\hkcmd.exe
IgfxTray = C:\WINDOWS\SYSTEM\igfxtray.exe
StillImageMonitor = C:\WINDOWS\SYSTEM\STIMON.EXE
OneTouch Monitor = C:\PROGRA~1\VISION~1\ONETOU~2.EXE

<center><hr WIDTH="80%"></center>

<a NAME="7"><b>Autorun entries from Registry:</b></a>
HKLM\Software\Microsoft\Windows\CurrentVersion\Run Services
SO5 Integrator Pass One = C:\WINDOWS\SOINTGR.EXE

<center><hr WIDTH="80%"></center>

<a NAME="9"><b>Autorun entries from Registry:</b></a>
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
WinEjectAutoStart1 = C:\WINDOWS\WINEJECT.EXE -instance:1
PPWebCap = C:\PROGRA~1\SCANSOFT\PAPERP~1\PPWebCap.exe

<center><hr WIDTH="80%"></center>

<a NAME="17"><b>File association entry for .EXE:</b></a>
HKEY_CLASSES_ROOT\exefile\shell\open\command
(Default) = "%1" %*

<center><hr WIDTH="80%"></center>

<a NAME="18"><b>File association entry for .COM:</b></a>
HKEY_CLASSES_ROOT\comfile\shell\open\command
(Default) = "%1" %*

<center><hr WIDTH="80%"></center>

<a NAME="19"><b>File association entry for .BAT:</b></a>
HKEY_CLASSES_ROOT\batfile\shell\open\command
(Default) = "%1" %*

<center><hr WIDTH="80%"></center>

<a NAME="20"><b>File association entry for .PIF:</b></a>
HKEY_CLASSES_ROOT\piffile\shell\open\command
(Default) = "%1" %*

<center><hr WIDTH="80%"></center>

<a NAME="21"><b>File association entry for .SCR:</b></a>
HKEY_CLASSES_ROOT\scrfile\shell\open\command
(Default) = "%1" /S

<center><hr WIDTH="80%"></center>

<a NAME="22"><b>File association entry for .HTA:</b></a>
HKEY_CLASSES_ROOT\htafile\shell\open\command
*Registry key not found*

<center><hr WIDTH="80%"></center>

<a NAME="23"><b>Enumerating Active Setup stub paths:</b></a>

HKLM\Software\Microsoft\Active Setup\Installed Components
[{89820200-ECBD-11cf-8B85-00AA005B4383}]
StubPath = C:\WINDOWS\SYSTEM\IE4UINIT.EXE
[PerUser_LinkBar_URLs]
StubPath = c:\windows\COMMAND\sulfnbk.exe /L
[{44BBA851-CC51-11CF-AAFA-00AA00B6015C}]
StubPath = rundll32.exeadvpack.dll
[&gt;IEPerUser]
StubPath = RUNDLL32.EXE IEDKCS32.DLL,BrandIE4 SIGNUP
[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
StubPath = C:\WINDOWS\SYSTEM\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl
[{7790769C-0471-11d2-AF11-00C04FA35D02}]
StubPath = "C:\Program Files\Outlook Express\setup50.exe" /APP:WAB /CALLER:IE50 /user /install
[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
StubPath = "C:\Program Files\Outlook Express\setup50.exe" /APP:OE /CALLER:IE50 /user /install

<center><hr WIDTH="80%"></center>

<a NAME="25"><b>Load/Run keys from C:\WINDOWS\WIN.INI:</b></a>
load=
run=hpfsched

<center><hr WIDTH="80%"></center>

<a NAME="26"><b>Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:</b></a>
Shell=Explorer.exe
SCRNSAVE.EXE=

<center><hr WIDTH="80%"></center>

<a NAME="27"><b>Checking for EXPLORER.EXE instances:</b></a>

C:\WINDOWS\Explorer.exe: PRESENT!
C:\Explorer.exe: not present
C:\WINDOWS\Explorer\Explorer.exe: not present
C:\WINDOWS\System\Explorer.exe: not present
C:\WINDOWS\System32\Explorer.exe: not present
C:\WINDOWS\Command\Explorer.exe: not present

<center><hr WIDTH="80%"></center>

<a NAME="29"><b>C:\WINDOWS\WININIT.BAK listing:</b></a>

[rename]
NUL=C:\PROGRA~1\GRISOFT\AVG6\$AVGUPD$.BKP

<center><hr WIDTH="80%"></center>

<a NAME="30"><b>C:\AUTOEXEC.BAT listing:</b></a>

@ECHO OFF
SET PATH=%PATH%;C:\PROGRA~1\GRISOFT\AVG6;E:\BITWARE\
C:\PROGRA~1\GRISOFT\AVG6\BOOTUP.EXE
686max.com
LH 395_2129.EXE
LH XMSDSK 32768 G: /C1 /T /Y
MD G:\TEMP
SET TEMP=G:\TEMP
SET TMP=G:\TEMP
SET CLASSPATH="C:\PROGRAM FILES\JAVASOFT\JRE\1.3.0_02\LIB\EXT\QTJAVA.ZIP"
SET QTJAVA="C:\PROGRAMFILES\JAVASOFT\JRE\1.3.0_02\LIB\EXT\QTJA VA.ZIP"

<center><hr WIDTH="80%"></center>

<a NAME="32"><b>C:\WINDOWS\DOSSTART.BAT listing:</b></a>

@echo off
set path=c:\windows\command
mscdex.exe /d:idecd000 /l:m
set prompt=$p$g
set temp=c:\windows\temp
set tmp=c:\windows\temp
call c:\dosboot\drivers.bat
c:\windows\smartdrv /q
cd \windows

<center><hr WIDTH="80%"></center>

<a NAME="33"><b>Checking for superhidden extensions:</b></a>

.lnk: HIDDEN! (arrow overlay: yes)
.pif: not hidden (arrow overlay: yes)
.exe: not hidden
.com: not hidden
.bat: not hidden
.hta: not hidden
.scr: not hidden
.shs: not hidden
.shb: not hidden
.vbs: not hidden
.vbe: not hidden
.wsh: not hidden
.scf: HIDDEN! (arrow overlay: NO!)
.url: HIDDEN! (arrow overlay: yes)
.js: not hidden
.jse: not hidden

<center><hr WIDTH="80%"></center>
End of report, 6,753 bytes
Report generated in 0.350 seconds

StartupList version: 1.30.0
Started from: D:\DOWNLOADS\STARTUPLIST.EXE

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

</font></pre></body></html>