Thanks for the info kento. This the startup log that i ran.I have the mscofig down to bare minimum. Don't think i can trim much more out of that. When i shut off cacheman it only improves by 6%. I know i have a few items running in my taskbar, but i figure withe total ram i have it should handle it. Would it be that windows it self doing all the damage here. Any more help would be apreciated thank you
---------- C:\WINDOWS\desktop\StartUp.Log
Start-Ups checked at 10-20-2002 6:49:05.43a
__________________________________________________________________________
__________________________________________________________________________
StartUp Log for Windows 95/98 - Freeware by rmbox
__________________________________________________________________________
__________________________________________________________________________
Comments:
This is a log of all the programs on your computer that
are starting automatically every time you start Windows.
Using this log can be a quick way to spot trojans.
StartUp Log (version 1.56) - Release Date 3/11/2002
__________________________________________________________________________
__________________________________________________________________________
StartUp Log Index
1. HKLM Run
2. HKCU Run
3. HKLM RunOnce
4. HKCU RunOnce
5. HKLM RunServices
6. HKLM RunServicesOnce
7. WIN.INI file
8. SYSTEM.INI file
9. AUTOEXEC.BAT file
10. StartUp folder
11. All Users StartUp
12. Misc. StartUp Configurations
__________________________________________________________________________
__________________________________________________________________________
The following is a list of your current Start-Ups
__________________________________________________________________________
__________________________________________________________________________
1. HKLM Run - Registry
[RegPath]
"StartUp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry"="C:\\WINDOWS\\scanregw.exe /autorun"
"TaskMonitor"="C:\\WINDOWS\\taskmon.exe"
"SystemTray"="SysTray.Exe"
"EM_EXEC"="c:\\mouse\\system\\em_exec.exe"
"Aureal A3D Interactive Audio Init"="A3dInit.exe"
"CISrvr Program"="C:\\COMPAQ\\INTERNET\\CISRVR.EXE"
"OEMCLEANUP"="c:\\windows\\OPTIONS\\oemreset.exe"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"LoadQM"="loadqm.exe"
"AVGCtrl"="C:\\PROGRAM FILES\\AVPERSONAL\\AVGCTRL.EXE /min"
"AVSCHED32"="C:\\PROGRAM FILES\\AVPERSONAL\\AVSCHED32.EXE /min"
"Shell"="c:\\ray.exe"
"CriticalUpdate"="c:\\windows\\SYSTEM\\wucrtupd.exe -startup"
==========================================================================
__________________________________________________________________________
2. HKCU Run - Registry
[RegPath]
"StartUp"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Weather"="C:\\PROGRAM FILES\\AWS\\WEATHERBUG\\WEATHER.EXE 1"
"Cacheman"="C:\\WINDOWS\\Desktop\\Program Files\\Cacheman\\Cacheman.exe"
==========================================================================
__________________________________________________________________________
3. HKLM RunOnce - Registry
[RegPath]
"StartUp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
==========================================================================
__________________________________________________________________________
4. HKCU RunOnce - Registry
[RegPath]
"StartUp"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
==========================================================================
__________________________________________________________________________
5. HKLM RunServices - Registry
[RegPath]
"StartUp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Aureal A3D Interactive Audio"="sa3dsrv.exe"
"ConfigServices"="C:\\CPQS\\TOOLS\\CONFIG.EXE"
"LoadPowerProfile"="Rundll32.exe powrprof.dll,LoadCurrentPwrScheme"
"SchedulingAgent"="mstask.exe"
"HC Reminder"="hc.exe"
"TrueVector"="C:\\WINDOWS\\SYSTEM\\ZONELABS\\VSMON.EXE -service"
==========================================================================
__________________________________________________________________________
6. HKLM RunServicesOnce - Registry
[RegPath]
"StartUp"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]
==========================================================================
__________________________________________________________________________
7. WIN.INI File - (c:\windows\win.ini)
Your win.ini run/load lines should look like run= and load= exclusively.
There should be nothing to the right of the equal signs.
These are the run and load lines in your WIN.INI file
run=
load=
==========================================================================
__________________________________________________________________________
8. SYSTEM.INI File - (c:\windows\system.ini)
Your system.ini shell line should look like shell=Explorer.exe exclusively.
You should only see Explorer.exe following the equal sign.
This is the shell line in your SYSTEM.INI file
shell=Explorer.exe
==========================================================================
__________________________________________________________________________
9. AUTOEXEC.BAT File - (c:\autoexec.bat)
(Some trojans have been known to start from this file)
These are your program startups and set paths in your autoexec.bat file
@ECHO OFF
@REM Setup for QR, BW & Hibernation
@PATH C:\WINDOWS;C:\WINDOWS\COMMAND;C:\CPQS\SAVEREST;C:\CPQS\TOOLS
@IF EXIST C:\CPQS\SAVEREST\QRSETUP.* CALL C:\CPQS\SAVEREST\QRSETUP /MFG C:
@IF EXIST C:\HIBERNAT\PHDISK*.* IF EXIST C:\HIBERNAT\NEW_HIB.* CALL C:\HIBERNAT\NEW_HIB
@PATH C:\WINDOWS;C:\WINDOWS\COMMAND;C:\CPQS\SAVEREST;C:\CPQS\TOOLS;%PATH%
@IF EXIST C:\APPL.ZIP\NUL IF EXIST C:\WINDOWS\SMARTDRV.EXE C:\WINDOWS\SMARTDRV.EXE
@PATH C:\WINDOWS;C:\WINDOWS\COMMAND;C:\CPQS\SAVEREST;C:\CPQS\TOOLS
Rem TShoot: C:\PROGRA~1\NETWOR~1\MCAFEE~1\SCAN.EXE C:\ /NOEXPIRE
@IF ERRORLEVEL 1 PAUSE
SET BLASTER=A220 I5 D1
C:\essolo.com
REM Environment Settings For McAfee VirusScan
SET PATH=%PATH%;C:\PROGRA~1\NETWOR~1\MCAFEE~1;"C:\Program Files\Executive Software\DiskeeperWorkstation\"
CALL C:\CPQS\TOOLS\DOSPATH.BAT
==========================================================================
__________________________________________________________________________
10. StartUp Folder - (c:\windows\start menu\programs\startup)
Shortcuts to any program will automatically start when placed here.
These are the shortcuts located in your StartUp folder
C:\WINDOWS\Start Menu\Programs\StartUp\Microsoft Find Fast.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\Office Startup.lnk
C:\WINDOWS\Start Menu\Programs\StartUp\Webshots.lnk
==========================================================================
__________________________________________________________________________
11. All Users Folder - (c:\windows\all users\start menu\programs\startup)
Shortcuts to any program will automatically start when placed here.
These are the shortcuts located in your All Users StartUp folder
C:\WINDOWS\All Users\Start Menu\Programs\StartUp\ZoneAlarm.lnk
==========================================================================
__________________________________________________________________________
12. Miscellaneous StartUp Configurations
-============================-
Registry StartUp Directories
-============================-
Should show the Start Menu StartUp and All Users StartUp directories
.....................................................................
[1] HKCU - Shell Folders
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
"Startup"="C:\\WINDOWS\\Start Menu\\Programs\\StartUp"
.....................................................................
[2] HKCU - User Shell Folders
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
.....................................................................
[3] HKLM - Shell Folders
HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders
"Common Startup"="C:\\WINDOWS\\All Users\\Start Menu\\Programs\\StartUp"
.....................................................................
[4] HKLM - User Shell Folders
HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\User Shell Folders
.....................................................................
-=======================-
Registry Shell Spawning
-=======================-
Open Commands for Executable File Types
@="\"%1\" %*"
(.exe file - RegPath = HKCR\exefile\shell\open\command)
@="\"%1\" %*"
(.com file - RegPath = HKCR\comfile\shell\open\command)
@="\"%1\" /S"
(.scr file - RegPath = HKCR\scrfile\shell\open\command)
@="\"%1\" %*"
(.bat file - RegPath = HKCR\batfile\shell\open\command)
@="\"%1\" %*"
(.pif file - RegPath = HKCR\piffile\shell\open\command)
@="C:\\WINDOWS\\SYSTEM\\MSHTA.EXE \"%1\" %*"
(.hta file - RegPath = HKCR\htafile\shell\open\command)
-=========================-
HKLM RunOnceEx - Registry
-=========================-
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx]
-=========================-
HKU (.Default) Run - Registry
-=========================-
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Weather"="C:\\PROGRAM FILES\\AWS\\WEATHERBUG\\WEATHER.EXE 1"
"Cacheman"="C:\\WINDOWS\\Desktop\\Program Files\\Cacheman\\Cacheman.exe"
-==============================-
HKU (.Default) RunOnce - Registry
-==============================-
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\RunOnce]
-================================-
StubPaths - Registry (Partial Listing)
-================================-
(Please see the StubPath.txt on your desktop for complete listing)
HKLM\Software\Microsoft\Active Setup\Installed Components
"OldStubPath"="c:\\windows\\SYSTEM\\ie4uinit.exe"
"RealStubPath"="C:\\WINDOWS\\SYSTEM\\IE4UINIT.EXE"
"StubPath"="C:\\WINDOWS\\COMMAND\\sulfnbk.exe /L"
"OldStubPath"="\"C:\\Program Files\\Outlook Express\\setup50.exe\" /APP:OE /CALLER:WIN9X /user /install"
"RealStubPath"="\"C:\\Program Files\\Outlook Express\\setup50.exe\" /APP:OE /CALLER:IE50 /user /install"
"StubPath"=""
"StubPath"="C:\\WINDOWS\\msnmgsr1.exe"
"OldStubPath"="\"C:\\Program Files\\Outlook Express\\setup50.exe\" /APP:WAB /CALLER:WIN9X /user /install"
"RealStubPath"="\"C:\\Program Files\\Outlook Express\\setup50.exe\" /APP:WAB /CALLER:IE50 /user /install"
"StubPath"="C:\\WINDOWS\\SYSTEM\\updcrl.exe -e -u C:\\WINDOWS\\SYSTEM\\verisignpub1.crl"
-=================-
DOSSTART.BAT File - (c:\windows\dosstart.bat)
-=================-
@echo off
LH C:\WINDOWS\COMMAND\MSCDEX.EXE /D:IDECD001 /M:12
c:\mouse\mouse.exe
c:\essolo.com
-=====================-
Screen Saver Settings (Possible system.ini start-up)
-=====================-
SCRNSAVE.EXE=C:\WINDOWS\WEBSHOTS.SCR
==========================================================================
__________________________________________________________________________
- Supplemental Environment Information -
TMP=C:\WINDOWS\TEMP
TEMP=C:\WINDOWS\TEMP
winbootdir=C:\WINDOWS
COMSPEC=C:\COMMAND.COM
LOG=NUL
QRCD=N:
BOTD=C:
MFG=YES
ZIPD=D:
CPQD=D:
DSHD=C:
D12=E:
EN=EN
LANG=EN
PATH=C:\WINDOWS;C:\WINDOWS\COMMAND;C:\CPQS\SAVEREST;C:\CPQS\TOOLS;C:\PROGRA~1\NETWOR~1\MCAFEE~1;C:\PROGRAM FILES\EXECUTIVE SOFTWARE\DISKEEPERWORKSTATIONwindir=C:\WINDOWS
File - c:\windows\deletefi.ini
==========================================================================
__________________________________________________________________________
- End -