The Elder Geek on Windows: System32 Folder On Startup - The Elder Geek on Windows

Jump to content

Posting Tips & Guidelines
Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic

System32 Folder On Startup system32 folder on startup

#1 User is offline   rong103 

  • New TEG Forum Member
  • Group: Members
  • Posts: 4
  • Joined: 28-May 04

Posted 17 June 2004 - 12:09 AM

I did what flrman1 suggested below, but cannot get anyone to take a look at the hijack log and advise me.
----------------------------
Originally Posted by ronglass
I have recently bought a new pc with winXP and either from the beginning or soon thereafter, I began to get the system32 folder on startup.

Assuming I did something to cause this, what might I have done. I did nothing intentionally.

-----------------------
flrman1 -

Go here:

http://forums.techguy.org/f54-s.html

Start a "New Thread" and post your Hijack This log:

Click here to download Hijack This. Click on the Hijackthis.exe.

Click the "Scan" button when the scan is finished the scan button will become "Save Log" click that and save the log.

Go to where you saved the log and click on "Edit > Select All" then click on "Edit > Copy" then Paste the log back here in your New Thread.

DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required. Someone here will be glad to advise you on what to fix.
----------------------------
Logfile of HijackThis v1.97.7
Scan saved at 12:29:30 AM, on 6/17/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\System32\services.exe
C:\WINDOWS\System32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
C:\WINDOWS\System32\dla\tfswctrl.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\keyboard\Hotkeycontrol XP\hkcontrol.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\ZoneLabs\vsmon.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\keyboard\WinKey\WinKey.exe
C:\keyboard\keylaunch\1stql.exe
C:\Utilities\desktopper\TopDesk.exe
C:\Text Editors\Yank Clipper\YankClip.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\Diagnostics\hijackthis\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://my.excite.com/?uid=A68EDAE833224C66"); (C:\Documents and Settings\Ron Glass\Application Data\Mozilla\Profiles\default\sn3qpxso.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CPROGRA%7E1%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_02.src"); (C:\Documents and Settings\Ron Glass\Application Data\Mozilla\Profiles\default\sn3qpxso.slt\prefs.js)
O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~2\fdcatch.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\dla\tfswshx.dll
O2 - BHO: (no name) - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\System32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Program Files\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Hotkeycontrol] C:\keyboard\Hotkeycontrol XP\hkcontrol.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\WordPerfect Office 11\Programs\QFSCHD110.EXE"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKCU\..\Run: [SB Audigy 2 Startup Menu] /L:ENG
O4 - HKCU\..\Run: [supelek bogiego] c:\program files\reminders\supb.exe -spr
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEUP~1\SNDMon.EXE
O4 - Startup: 1st QuickLaunch.lnk = C:\keyboard\keylaunch\1stql.exe
O4 - Startup: TopDesk.lnk = C:\Utilities\desktopper\TopDesk.exe
O4 - Startup: Yankee Clipper III.lnk = C:\Text Editors\Yank Clipper\YankClip.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinKey.lnk = C:\keyboard\WinKey\WinKey.exe
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM) :D
0

#2 User is offline   Alatar 

  • Chief Cook & Bottle Washer
  • Group: Members
  • Posts: 6,003
  • Joined: 01-July 03
  • Location:Montreal

Posted 17 June 2004 - 09:35 AM

Bumped up as it was in the wrong forum. I moved it here but it's not near the top of the list. Thus the bump. :D
If a man says something in the woods and there are no women around, is he still completely wrong?
0

#3 User is offline   DuaneB 

  • Senior TEG Forum Member
  • Group: Members
  • Posts: 524
  • Joined: 25-May 03

Posted 17 June 2004 - 03:39 PM

"System32 Folder Opens Upon Boot"
Try Tip 260 (in the second column).

http://www.kellys-ko...m/xp_tweaks.htm



or, this from Microsoft:

"System32 Folder Opens When Logging on to Windows XP"
http://support.micro...om/?kbid=170086

This post has been edited by DuaneB: 17 June 2004 - 03:42 PM

0

#4 User is offline   Guitar Man 

  • Part of the furniture
  • Group: Members
  • Posts: 9,750
  • Joined: 28-October 03
  • Gender:Male
  • Location:Montreal, Quebec

Posted 17 June 2004 - 05:49 PM

These look like suspect files, (in particular the red highlighted one):

O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~2\fdcatch.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
Phil

Layered protection: Spyware Terminator (with ClamAV) - SpywareBlaster - StartupMonitor
Maintenance tools: RegSeeker - CCleaner
Benchmark/system info/update checker tools: SIW - Sandra Lite - AIDA32 / Belarc Advisor / Secunia Software Inspector
SP3 resources: Steps to take before you install XP SP3 - XP SP3 Network Download - Release Notes for XP SP3

How to add your Hotmail account to Outlook Express
0

#5 User is offline   canoneman 

  • Senior TEG Forum Member
  • Group: Resigned
  • Posts: 1,696
  • Joined: 03-May 04

Posted 19 June 2004 - 12:02 PM

The "red one" is more likely to be associated with the other HP stuff you have in your log, that is to do with HP Drive Letter Access software IMO, but i am no exspert on Malware, i have never had more than a tracking cookie to deal with in all my years online. ;)
Providing many great solutions since FEB2004, despite "everything"
0

#6 User is offline   rong103 

  • New TEG Forum Member
  • Group: Members
  • Posts: 4
  • Joined: 28-May 04

Posted 22 June 2004 - 12:16 AM

The above reference --

http://www.kellys-ko...m/xp_tweaks.htm

called for a vbs file which seem to run find and say the problem should be fixed, but it was not.

The above refenence --

http://support.micro...om/?kbid=170086

had no items in common with my registry.
0

#7 User is offline   rong103 

  • New TEG Forum Member
  • Group: Members
  • Posts: 4
  • Joined: 28-May 04

Posted 30 June 2004 - 03:52 PM

Just a note to all who have tried to help me. My problem with the system32 folder opening on startup of XP apparently has to do (in my case) with the sound application (Audigy) on my Dell computer. To it:

As posted on the Dell forum: system32 opening on startup is caused by a line on the startup tab of msconfig. Go to Start|Run|type msconfig and click OK. On the startup tab, look for /L:ENG. If found, uncheck it. That entry is associated with the SB Audigy 2.

To remove the entry from the Startup tab go to Start|All Programs|Creative|Sound Blaster|Audigy 2|Welcome Message. Check “Do not show this again.”
0

#8 User is offline   smook 

  • New TEG Forum Member
  • Group: Members
  • Posts: 1
  • Joined: 17-July 04

Posted 17 July 2004 - 08:52 AM

I would like everyone to know that this fix actually works!

SO... Thanks. I had this problem on my DELL XPS as well.

It's so nice now that on bootup I don't have to close that system32 window any longer.

BIG THANKS!
-Bill. :D
0

Share this topic:


Page 1 of 1
  • You cannot start a new topic
  • You cannot reply to this topic