Start-up: What can I get rid of?

*miaomiao*

Hello folks,

I've been having a look at my start up log. It looks to be congested (although I'm very happy to admit I am not a computer expert) and wondered if anyone could please give some advice as to what can be disabled/removed from the start-up of my Windows Vista 64-bit Intel Pentium Duo Core CPU T3400 @ 2.6GHz, 4GB RAM.

I would like to use CCleaner to remove these. Any advice?

Here is a log of what runs at Start Up (from CCleaner):

Yes HKCU:Run ehTray.exe C:\Windows\ehome\ehTray.exe
Yes HKCU:Run cdloader "C:\Users\Sera\AppData\Roaming\mjusbsp\cdloader2.exe" MAGICJACK
Yes HKCU:Run ISUSPM C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
Yes HKLM:Run NDSTray.exe NDSTray.exe
Yes HKLM:Run cfFncEnabler.exe cfFncEnabler.exe
Yes HKLM:Run Adobe Reader Speed Launcher "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"
Yes HKLM:Run Camera Assistant Software "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start
Yes HKLM:Run AdobeCS4ServiceManager "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
Yes HKLM:Run Adobe Acrobat Speed Launcher "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
Yes HKLM:Run Acrobat Assistant 8.0 "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
Yes HKLM:Run Adobe_ID0ENQBO C:\PROGRA~2\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
Yes HKLM:Run Samsung PanelMgr C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun
Yes HKLM:Run GrooveMonitor "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
Yes HKLM:Run EEventManager C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe
Yes HKLM:Run Adobe ARM "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
Yes HKLM:Run AVG_TRAY C:\Program Files (x86)\AVG\AVG10\avgtray.exe
Yes HKLM:Run DNS7reminder "C:\Program Files (x86)\Nuance\NaturallySpeaking11\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\NaturallySpeaking11\Ereg.ini
Yes HKLM:Run SSBkgdUpdate "C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
Yes HKLM:Run OpwareSE4 "C:\Program Files (x86)\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
Yes HKLM:Run NPSStartup
Yes HKLM:Run iTunesHelper "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
Yes HKLM:Run Windows Defender %ProgramFiles%\Windows Defender\MSASCui.exe -hide
Yes HKLM:Run SynTPEnh C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
Yes HKLM:Run RtHDVCpl RAVCpl64.exe
Yes HKLM:Run Skytel Skytel.exe
Yes HKLM:Run LtMoh C:\Program Files\ltmoh\Ltmoh.exe
Yes HKLM:Run IgfxTray C:\Windows\system32\igfxtray.exe
Yes HKLM:Run HotKeysCmds C:\Windows\system32\hkcmd.exe
Yes HKLM:Run Persistence C:\Windows\system32\igfxpers.exe
Yes HKLM:Run TPwrMain %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
Yes HKLM:Run SmoothView %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
Yes HKLM:Run 00TCrdMain %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
Yes HKLM:Run EvtMgr6 C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming

Thank you!

spakkker

Everything except synaptics -touchpad prog-, avg and defender -just disable them for starters and see how it goes . I don't know if you are using wireless ?

SussexSocialist

If you haven't got it, download SpybotSD from somewhere safe like Sgt Geek or CNET or Download.com or direct from Safer Networking.

Run it, and under advanced tools is a startup list similar to the CCleaner one BUT it advises what's needed and what's not on the right hand column.....easy to use and reversable if you mess up!!

GunJack

yup, spybot's startup manager is one of the reasons I keep it, it's more detailed than CCleaner's, and more friendly than regedit

even the synaptec prog can be disabled on startup, it won't stop the touchpad operating, just means if you want to change settings you have to go in via control panel > mouse to do so it may just reinstall the drivers next time you start up, but just cancel it.

OP, you have some distinctively dodgy-looking things in that log, suggest you run malwarebytes (install, update and quick scan)

http://www.filehippo.com/download_malwarebytes_anti_malware/

(download latest version top-right of page)

fix all it finds and post the log back here

*miaomiao*

Thanks very much for all of your suggestions, very helpful.

Spakker: I am using wireless internet. Thanks!
GunJack: Which dodgy looking bits do you notice? I have a lot of specialist software installed, so I'd like to be sure to not cause a disturbance in those files. Thanks!

I have MalwareBytes (great product) and ran an up-to-date scan of the laptop this morning. Here is the log:

Malwarebytes' Anti-Malware 1.51.0.1200
https://www.malwarebytes.org

Database version: 6866

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

16/06/2011 9:52:59 AM
mbam-log-2011-06-16 (09-52-59).txt

Scan type: Full scan (C:\|D:\|)
Objects scanned: 492975
Time elapsed: 1 hour(s), 56 minute(s), 6 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

RussJK

*miaomiao* wrote: »

GunJack: Which dodgy looking bits do you notice?

It's just because a few of them look like the usual random dodgeware names, and I thought the same when I'd seen the thread earlier yesterday. Checked most entries out & they're potentially legit, you'll have to look up " Adobe_ID0ENQBO" though as I won't have a chance this morning.

e.g. cfFncEnabler.exe cfFncEnabler.exe makes you look twice but can be a legit entry.

and NPSStartup looks wrong, but apparently relates to Samsung software IIRC.

Just check out for yourself that each autorun relates to a genuine piece of software.

*miaomiao*

RussJK wrote: »

It's just because a few of them look like the usual random dodgeware names, and I thought the same when I'd seen the thread earlier yesterday. Checked most entries out & they're potentially legit, you'll have to look up " Adobe_ID0ENQBO" though as I won't have a chance this morning.

e.g. cfFncEnabler.exe cfFncEnabler.exe makes you look twice but can be a legit entry.

and NPSStartup looks wrong, but apparently relates to Samsung software IIRC.

Just check out for yourself that each autorun relates to a genuine piece of software.

Thank you, RussJK. I didn't know you could check these via a search engine. I'll have a go! Cheers!

p.s. SuperAntiSpyware scan running now and nothing found yet.

GunJack

RussJK wrote: »

It's just because a few of them look like the usual random dodgeware names, and I thought the same when I'd seen the thread earlier yesterday. Checked most entries out & they're potentially legit, you'll have to look up " Adobe_ID0ENQBO" though as I won't have a chance this morning.

e.g. cfFncEnabler.exe cfFncEnabler.exe makes you look twice but can be a legit entry.

and NPSStartup looks wrong, but apparently relates to Samsung software IIRC.

Just check out for yourself that each autorun relates to a genuine piece of software.

as Russ has stated, some need more investigation. The other thing I noticed was, and it could be as innocent as a formatting thing when you pasted the log extracts, were some .exe files showing as ".e xe", which can also indicate dodgy stuff

*miaomiao*

Thanks, GunJack. : )

I've completed the SuperAntiSpyware scan now and there were 0 threats found. I've installed Spybot and had a go at the start-up removal tool. Very useful!

Thanks again!

RussJK

GunJack wrote: »

The other thing I noticed was, and it could be as innocent as a formatting thing when you pasted the log extracts, were some .exe files showing as ".e xe", which can also indicate dodgy stuff

Yeah it's a formatting thing, one of the quirks of forum software. Just copy/pasted some of them and the forum software re-adds the spaces when you do preview post

*miaomiao*

Hello nice MSE people on the Tecchie forum,

Would any of you be kind enough to have a look at this start up log produced using CCleaner? My computer is running quite slow on startup so I'm wondering what's going on.

Thank you!

Yes HKCU:Run ehTray.exe C:\Windows\ehome\ehTray.exe
Yes HKCU:Run cdloader "C:\Users\Sera\AppData\Roaming\mjusbsp\cdloader2.exe" MAGICJACK
Yes HKCU:Run ISUSPM C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe -scheduler
Yes HKLM:Run cfFncEnabler.exe cfFncEnabler.exe
Yes HKLM:Run Adobe Reader Speed Launcher "C:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"
Yes HKLM:Run Camera Assistant Software "C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe" /start
Yes HKLM:Run AdobeCS4ServiceManager "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
Yes HKLM:Run Adobe Acrobat Speed Launcher "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
Yes HKLM:Run Acrobat Assistant 8.0 "C:\Program Files (x86)\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
Yes HKLM:Run Adobe_ID0ENQBO C:\PROGRA~2\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
Yes HKLM:Run GrooveMonitor "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
Yes HKLM:Run Adobe ARM "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
Yes HKLM:Run AVG_TRAY C:\Program Files (x86)\AVG\AVG10\avgtray.exe
Yes HKLM:Run DNS7reminder "C:\Program Files (x86)\Nuance\NaturallySpeaking11\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\NaturallySpeaking11\Ereg.ini
Yes HKLM:Run NPSStartup
Yes HKLM:Run NDSTray.exe NDSTray.exe
Yes HKLM:Run Samsung PanelMgr C:\Windows\Samsung\PanelMgr\SSMMgr.exe /autorun
Yes HKLM:Run OpwareSE4 "C:\Program Files (x86)\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
Yes HKLM:Run QuickTime Task "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
Yes HKLM:Run iTunesHelper "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
Yes HKLM:Run Carbonite Backup "C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe"
Yes HKLM:Run Windows Defender %ProgramFiles%\Windows Defender\MSASCui.exe -hide
Yes HKLM:Run SynTPEnh C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
Yes HKLM:Run RtHDVCpl RAVCpl64.exe
Yes HKLM:Run Skytel Skytel.exe
Yes HKLM:Run LtMoh C:\Program Files\ltmoh\Ltmoh.exe
Yes HKLM:Run IgfxTray C:\Windows\system32\igfxtray.exe
Yes HKLM:Run HotKeysCmds C:\Windows\system32\hkcmd.exe
Yes HKLM:Run Persistence C:\Windows\system32\igfxpers.exe
Yes HKLM:Run TPwrMain %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
Yes HKLM:Run SmoothView %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
Yes HKLM:Run 00TCrdMain %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
Yes HKLM:Run EvtMgr6 C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming