2009/09/30 list

[nickW]

Hello Paul,


Typos found in the last startups list:

AOL
AOL.exe
Fast Start loads the <a href="http://www.aol.com/" onclick="window.open(href); return false;">AOL</a> integrated email, instant messenger and web browser software in the background when you turn on your computer. This feature lets you quickly open AOL

It's the description of "AOL Fast Start"

=======================================================================

WCPI
wintsvit.exe
<a href="http://www.safer-networking.com/removePurityScan.php" onclick="window.open(href); return false;">PurityScan</a> adware

www.safer-networking.com is a rogue website

Possible links=
http://allentech.net/parasite/PurityScan.html
http://www.symantec.com/security_res...090516-2325-99

=======================================================================

XP SecurityCenter
XPSecurityCenter.exe
<a href="http://www.symantec.com/security_response/writeup.jsp?docid=2008-051910-0118-99" onclick="window.open(href); return false;">AdvancedXPFixer</a> rogue security software - not recommended, removal instructions <a href="http://www.bleepingcomputer.com/virus-removal/xp-securitycenter" onclick="window.open(href); return false;">here</a>


XPSecurityCenter (instead of AdvancedXPFixer)

=======================================================================

ControlPanel
private.exe internat.dll,LoadMouseCarpetProfile
Added by the <a href="http://www.sophos.com/security/analyses/viruses-and-spyware/trojclickeraz" onclick="window.open(href); return false;">CLICKER-AZ</a>! TROJAN!. Creates the files sdfff, fdsf and zxczxc. In the C:WINDOWSSYSTEM32 directory creates the files d.exe, s.exe and r.exe. Note - the "private.exe" file is found in %System%

Correct link=
http://www.sophos.com/security/analy...clickeraz.html

=======================================================================


AccelerometerSt
AccelerometerSt.exe
HP 3D DriveGuard uses a digital acclerometer protects your disk drive by parking and halting I/O requests if you drop your PC or if you move your PC with the display lid closed

AccelerometerSysTrayApplet
AccelerometerSt.exe
HP 3D DriveGuard uses a digital acclerometer protects your disk drive by parking and halting I/O requests if you drop your PC or if you move your PC with the display lid closed

accelerometer

=======================================================================

ViGlance (ViGlance.exe), ViOrb (ViOrb.exe), ViSplore (ViSplore.exe) and ViStart (ViStart.exe)

I'm not sure the code should be "Y". Perhaps "U"?

=======================================================================

VistaStartMenu (VistaStartMenu.exe)

I'm not sure the code should be "Y". Perhaps "U"?

=======================================================================

Verizon Custom Uninstall Tracking
InstallHelper.exe
<a href="http://www22.verizon.com/" onclick="window.open(href); return false;"> related installation tracker. <font color="#FF0000">What does it do and is it required?</font>

Missing </a> - strange looking sentence

=======================================================================

AOL Service Libraries
AOLSoftware.exe

AOLSoftware
AOLSoftware.exe

Link to AOL Beta: http://beta.aol.com/

=======================================================================


Regards,

[pacs-portal]

Hi NickW,

AOL (AOL.exe)

If you mean it's the same as the "AOL Fast Start" entry then that's correct. XP MSConfig & Windows Defender both show the entry as "AOL" whereas the registry has "AOL Fast Start" so they're a "set".

There are a number of other similar "sets" because it depends upon which method a visitor uses to identify an entry before coming to the database. Another example is "SunJavaUpdateSched" and "jusched" for "jusched.exe". The only ones that aren't displayed this way are malware or those with common file names and locations.

---

WCPI (wintsvit.exe)

Damn! Thought I'd caught them all :(

---

ViGlance (ViGlance.exe), ViOrb (ViOrb.exe), ViSplore (ViSplore.exe) and ViStart (ViStart.exe), VistaStartMenu (VistaStartMenu.exe)

The logic behind the "Y" on these is that they're all effectively replacement for the standard XP equivalent - so if you want to use them they'll have to run at boot time. I'll look into it further.

[pacs-portal]

I've tested the ViGlance (ViGlance.exe), ViOrb (ViOrb.exe), ViSplore (ViSplore.exe) and ViStart (ViStart.exe), VistaStartMenu (VistaStartMenu.exe) entries and will change them accordingly.