StartupList report, 20/11/2004, 01:35:30 
StartupList version: 1.52
Started from : J:\wintools\internet\homesearch virus\HijackThis.EXE
Detected: Windows XP  (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP1 (6.00.2600.0000)
* Using default options
==================================================

Running processes:

C:\WINNT\System32\smss.exe
C:\WINNT\SYSTEM32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\cisvc.exe
C:\Program Files\NavNT\defwatch.exe
C:\WINNT\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\MI6841~1\MSSQL\binn\sqlservr.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINNT\System32\MsPMSPSv.exe
C:\WINNT\system32\cidaemon.exe
C:\WINNT\System32\inetsrv\DavCData.exe
C:\Program Files\NavNT\vptray.exe
C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINNT\System32\dllhost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\explorer.exe
C:\WINNT\hh.exe
C:\Program Files\iMesh\Client\iMeshClient.exe
C:\WINNT\system32\msss32.exe
C:\WINNT\setupapi.log:echfe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINNT\system32\ntvdm.exe
C:\Program Files\Spyware Doctor\spydoctor.exe
C:\Program Files\Yahoo!\Messenger\YPager.exe
J:\wintools\internet\homesearch virus\HijackThis.exe

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINNT\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

vptray = C:\Program Files\NavNT\vptray.exe
MessengerPlus3 = "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
MSConfig = C:\WINNT\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
msss32.exe = C:\WINNT\system32\msss32.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Spyware Doctor = "C:\Program Files\Spyware Doctor\spydoctor.exe" /Q

--------------------------------------------------

Shell & screensaver key from C:\WINNT\SYSTEM.INI:

Shell=Explorer.exe C:\winnt\system32\msiexec16.exe
SCRNSAVE.EXE=
drivers=

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINNT\System32\logon.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - c:\program files\google\googletoolbar1.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7}
(no name) - C:\WINNT\javasv.dll - {F1C68265-EE66-8EAD-4E2D-1F9CAD11C690}

--------------------------------------------------

Enumerating Task Scheduler jobs:

A8A5FB0791FA71EB.job
B14180FF90723E5B.job
Symantec NetDetect.job

--------------------------------------------------

Enumerating Download Program Files:

[{33564D57-0000-0010-8000-00AA00389B71}]
CODEBASE = http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB

--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

WebCheck: C:\WINNT\System32\webcheck.dll
SysTray: C:\WINNT\System32\stobject.dll
PostBootReminder: C:\WINNT\system32\SHELL32.dll
CDBurn: C:\WINNT\system32\SHELL32.dll

--------------------------------------------------
End of report, 4,506 bytes
Report generated in 0.078 seconds

Command line options:
   /verbose  - to add additional info on each section
   /complete - to include empty sections and unsuspicious data
   /full     - to include several rarely-important sections
   /force9x  - to include Win9x-only startups even if running on WinNT
   /forcent  - to include WinNT-only startups even if running on Win9x
   /forceall - to include all Win9x and WinNT startups, regardless of platform
   /history  - to list version history only
