Solved

Which items can I remove from startup menu in msconfig without damaging Window XP OS

Posted on 2004-08-18
15
28,580 Views
Last Modified: 2012-08-14
The following items are listed in the startup tab in mscofig which can I safely remove from startup without huting Windows XP Home OS:

Startup Item             Command
qdezpad                   C:Windows\qdezpad.exe
svxhost                     svxhost.exe
smsc                        smsc.exe
optimize             "C:\Program Files\internet  
                         optimizer\optimize.exe"
smsc                         smsc.exe
rundll32             rundll32.exe nview.dll,nViewLoadHook
wserv32             wserv32.exe
eber                  C:\Documents and                
                       Settings\Owner\Application Data\eber
tuyak                C:\Windows\System32\tuyak.exe
svxhost            svxhost.exe
Microsoft Office  C:\PROGA~1\MICROS~2\Offcie10          
                        \OSA.EXE -b -1
hpsydrv           c:\windows\system\hpsysdrv.exe
hkcmd            C:\Windows\System32\hkcmd.exe
KBD               C:\HP\KBD\KBD.exe
sgtray            C:\Program Files\VERITAS Software\Update
                    Manager\sgtray...
RECGUARD      C:\WINDOWS\SMINST\RECGFUARD.EXE
nwiz                nwiz.exe/installquiet /keeploaded
ps2                 C:\Windows\system32\ps2.exe
~9E8A            C:\DOCUME~\Owner\LOCALS~\Temp\~9E8A
                      .temp.exe
wserv32         wserv32.exe
yfrxlylj            C:\WINDOWS\System32\yfrxlylj.exe
Save              C:\PROGA~1\Save\Save.exe
bridge            rundll32.exe "C:\WINDOWS\System32
                    \bridge.dll".Load
ycdhoxl-        C:\WINDOWS\System32\ycdhoxh.exe
alchem         C:\WINDOWS\alchem.exe
istsvc           C:ProgramFiles\ISTsvc\Istsvc\.exe
msbb           c:\docume~1\owner\locals~1\temp\msbb.exe
omniscient   C:\Program Files\WindowsSA\omniscient.exe
ccApp         C:\Program Files\Common Files\Symantec
                 Shared\ccapp
cfgwiz        C:\Program Files\Common Files\Symantec
                 Shared\cfgwiz  
UrlstCK      C:\Program Files\Norton Internet ecurity\UrlstCK
                 .exe
nls            C:\Program Files\Navisearch\bin\nls.exe
bargains   C:\Program Files\bulseye Network\bin\bargains
                .exe
odezypad   C:WINDOWS\odezypad.exe

Thanks,
Dan
                 













0
Comment
Question by:dbdan
  • 5
  • 2
  • 2
  • +6
15 Comments
 
LVL 44

Expert Comment

by:CrazyOne
ID: 11838315
This one you can remove in in fact it looks like a virus

optimize             svxhost            svxhost.exe

0
 
LVL 44

Assisted Solution

by:CrazyOne
CrazyOne earned 250 total points
ID: 11838316
You really don't need this one.
Microsoft Office  C:\PROGA~1\MICROS~2\Offcie10          
                        \OSA.EXE -b -1
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 11838323
I really do not know what the following is but it seems to non-relevant

Save              C:\PROGA~1\Save\Save.exe
0
 
LVL 44

Expert Comment

by:CrazyOne
ID: 11838339
tuyak                C:\Windows\System32\tuyak.exe
~9E8A            C:\DOCUME~\Owner\LOCALS~\Temp\~9E8A
                      .temp.exe
ycdhoxl-        C:\WINDOWS\System32\ycdhoxh.exe

alchem         C:\WINDOWS\alchem.exe id a known spyware
http://www.anti-spy.info/file/alchem.exe.html
0
 
LVL 44

Accepted Solution

by:
CrazyOne earned 250 total points
ID: 11838349
Umm I Would suggest running the following programs given the nature of your post

Check for adware and sypware and browser hijackers. The following link is a list of tools to try out.
http://crazyone.tekmasters.com/malwaretools.html

Also use SpyBot and AdAware in tandem. Neither is 100% accurate but the two of them together get pretty close to 100% accuracy.

spybot here
http://www.safer-networking.org/
Download
http://spybot.safer-networking.de/index.php?lang=en&page=download

AdAware
http://www.lavasoftusa.com/

Not Free
Spycop:
http://www.spycop.com/
==========================

Could be a Broweser high jacker behind the problem

This little didy will get rid of some of the more well known Home page Hijackers.
CoolWebShredder
http://www.spychecker.com/program/coolwebshredder.html
here is a description of what it does
http://www.softpedia.com/public/cat/10/17/10-17-143.shtml
Features:

· Redirections to CoolWebSearch related pages
· Redirections when mistyping URLs
· Redirections when visiting Google
· Enormous IE slowdowns when typing
· IE start page/search page changing on reboot
· Sites in the IE Trusted Zone you didn't add
· Popups in Google and Yahoo when searching
· Errors at startup mentioning WIN.INI or IEDLL.EXE
· Unable to change or see certain items in IE Options
· Unable to access IE Options at all

download here
http://www.spychecker.com/download/download_coolwebshredder.html
----------------------------------

Could be a Broweser high jacker behind the problem
Hijack This and BHODemon and Browser Hijack Blaster

Hijack This http://www.spywareinfo.com/~merijn/files/hijackthis.zip | Written by a member of our support forums and based on our Hijacked! article, this program scans the locations in your computer system that may be modified by browser hijackers and fixes any problems found. An easy-to-understand tutorial is available at TomCoyote.org.

http://www.spywareinfo.com/downloads.php?cat=sp#det
BHODemon http://www.spywareinfo.com/downloads/bhod/ | Think of BHODemon as a guardian for your Internet browser: it protects you from unknown Browser Helper Objects (BHOs), by letting you enable/disable them individually. This program is my choice for BHO detection and is highly recommended.

Browser Hijack Blaster http://www.wilderssecurity.net/bhblaster.html | Running silently in the background, Browser Hijack Blaster only springs into action when an attempt is made. It watches and protects the following items: IE Homepage, IE Default Page, IE Search Page, BHOs. Whenver one of the above items is changed, or a BHO is added, you are immediately provided with information on the item, along with the option to keep the change, or revert to your previous settings.
=======================

General and overall information about Spy/Adware
http://www.cexx.org/adware.htm


and.


Double Check for viruses
Online Scanners

 Norton Web Services  
Virus Detection provides an analysis of your results and offers suggestions for further action. It does not examine compressed files or fix infected files.

When Symantec receives notification about a new virus, we develop and post a solution as quickly as possible. We are committed to providing swift responses to all virus threats, including Trojan horses.
http://security.symantec.com/sscv6/vc_about.asp?ax=0&langid=ie&venid=sym&plfid=23&pkj=BSZNTGXIBVEMBQAUWZK

======================
 Trend Micro HouseCall        
http://housecall.antivirus.com/housecall/start_corp.asp

======================
eTrust Online antivirus scanner
http://www3.ca.com/virusinfo/virusscan.aspx
======================

PC Pitstop Virus Scan
When the download completes, you will receive an ActiveX security dialog for the PC Pitstop virus scanner. Click Yes to install the scanner and proceed to the virus scan.

If you are currently running an antivirus package such as Norton Antivirus, it may detect our own virus detection file as a virus. If this occurs and you wish to use our scanner, please (temporarily) disable any active background virus checking software before scanning, or add our signature file (PAV.SIG) to the scanner's file exclusion list
http://www.pcpitstop.com/antivirus/AVLoad.asp
0
 
LVL 17

Expert Comment

by:Wakeup
ID: 11838546
I agree with crazyone, but to go from your list, You have alot of spyware and maybe viruses as well....here's what I think:

qdezpad                   C:Windows\qdezpad.exe
---unknown file...most likely spyware or viruses and is probably related to odezypad which is the last one in your list.  

svxhost                     svxhost.exe
---could be a worm....Trend micro says: wrm_sdbot.jb

smsc                        smsc.exe
---This one could be a worm ... the worm_agobot.wf (trend micro)

optimize             "C:\Program Files\internet  
                         optimizer\optimize.exe"
---this one is spyware

smsc                         smsc.exe
---This one could be a worm ... the worm_agobot.wf (trend micro)

wserv32             wserv32.exe
---another worm...trend micro: worm_rbot.af

eber                  C:\Documents and                
                       Settings\Owner\Application Data\eber
---according to some security web sites, this one should be removed (They dont say what it is tho...and i really didnt want to look too hard): http://www.wilderssecurity.com/showthread.php?t=28060&goto=nextoldest

tuyak                C:\Windows\System32\tuyak.exe
---may be spyware/virus/trojan/or worm related....if you dont know what it is....disable or remove it.

svxhost            svxhost.exe
---same as before: ---could be a worm....Trend micro says: wrm_sdbot.jb
RECGUARD      C:\WINDOWS\SMINST\RECGFUARD.EXE
---This is named wrong....usually it is named RECGUARD.EXE so could be bad...virus/troj/worm....maybe spyware: see here for what the real one is: http://www.kephyr.com/filedb/index.php?viewtopic=C:%5CWINDOWS%5CSMINST%5C

~9E8A            C:\DOCUME~\Owner\LOCALS~\Temp\~9E8A
                      .temp.exe
---This is a very suspect file.  first off the big clue is it is a TEMP folder...second is iti s named reallllyyy weird.  Thirdly, it is an executable TEMP file....meaning it is a filename.TEMP.EXE  so something is up.  so red flag and kill this boy.

wserv32         wserv32.exe
---again same: ---another worm...trend micro: worm_rbot.af

yfrxlylj            C:\WINDOWS\System32\yfrxlylj.exe
---spyware related most likely.  clue that tells you this file is suspect.  one it is probably a HIDDEN file, two it is named weird.  So remove.

Save              C:\PROGA~1\Save\Save.exe
---definitely spyware.  Related to WhenU.com

bridge            rundll32.exe "C:\WINDOWS\System32
                    \bridge.dll".Load
---adware/spyware related to Adware.WinFavorites which is an adware program that downloads advertisements onto your computer.  so remove

ycdhoxl-        C:\WINDOWS\System32\ycdhoxh.exe
---spyware related most likely.  clue that tells you this file is suspect.  one it is probably a HIDDEN file, two it is named weird.  So remove.

alchem         C:\WINDOWS\alchem.exe
---as stated by someone else spyware...
istsvc           C:ProgramFiles\ISTsvc\Istsvc\.exe
---adware/spyware known as ISTBar.  remove it

msbb           c:\docume~1\owner\locals~1\temp\msbb.exe
---definitely spyware.  called 180 solutions.  Remove.

omniscient   C:\Program Files\WindowsSA\omniscient.exe
---spyware remove this.

nls            C:\Program Files\Navisearch\bin\nls.exe
---probably spyware...I dunno for sure...but I did find this: http://www.newbie.org/help/messages/27994.html

bargains   C:\Program Files\bulseye Network\bin\bargains
                .exe
---spyware... remove it..
odezypad   C:WINDOWS\odezypad.exe
---Same reason as above.  
0
 

Author Comment

by:dbdan
ID: 11985828
Crazyone good advice on the removal of startup menu items and which to remove
Wake-up Great line by line breakdown of each startup menu items
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 
LVL 17

Expert Comment

by:Wakeup
ID: 11985846
aww...no points for me?!  hehe...sokay....

Glad to be of help!

Is everything working alright?
0
 

Expert Comment

by:alragusa
ID: 12088575
Personally I suggest backing up your personal files and re-installing Windows because your computer is infected to all hell. DEFINITELY run SpyBot, Ad-Ware and your anti-virus programs. To manage your start-up I suggest using a program such as:
Startup Control Panel
http://www.download.com/Startup-Control-Panel/3000-2094-1539340.html?tag=lst-0-1
Startup Mechanic
http://www.download.com/Startup-Mechanic/3000-2086-10316039.html?tag=lst-0-2
Startup Inspector
http://www.download.com/Startup-Inspector-for-Windows/3000-2086-10294569.html?tag=lst-0-3
They are all free and full of information concerning what starts, what location the file is in and descriptions of the file.
Good luck!

-AR
0
 

Expert Comment

by:MDrain
ID: 12090157
Here are a few of sites where you can look up the startup items individually.  That and / or the above mentioned program of startup inspector, you should be able to determine what startup programs are system programs or things that should not be running.  Also always start with a viurs scan and scan for spyware.  After you scan/remove any viruses and/or spyware, you will have a good starting point to solve other issues.

http://www.windowsstartup.com/wso/index.php

http://www.pacs-portal.co.uk/startup_index.htm

http://www.liutilities.com/products/wintaskspro/processlibrary/

Hope this helps.  
Mike
0
 

Expert Comment

by:DWYee
ID: 12097013
Couple of more places to look up what's running in your task manager:

http://www.answersthatwork.com/

http://www.greatis.com/regrun3appdatabase.htm

0
 

Author Comment

by:dbdan
ID: 12108422
Thanks DWYee
0
 
LVL 3

Expert Comment

by:way12go
ID: 12136266
In general you don't need any startup items so you can delete them all unless you want some specific programs like antivirus-realtime, internet,screen capture utilities,...etc; There are so many softwares that can help you by making you disable them and enable at will.
(1) Advanced Uninstaller. ------------- Allows you to enable, disable, remove and  run selected option.

(2) Reg Organizer. ---------------- Could be the most powerful registry tool .... it also helps you keep track of the startup items.

(3) Toniart's Easycleaner ( freeware ) ---------- this is good and has many options and also helps you with the startup items and the latest good news is XP version is now available but you have to take a careful look when you delete unnecessary files " If you use this option " Because some files that have extentions like .bak can play an important role in some programs.

(4) There are many other softwares. Visit " www.zilla-soft.com "  -- all good freewares.... you may find some programs that are only for startup items at " www.downloads.com " or " www.freedownloadscenter.com ".
0
 

Expert Comment

by:limxrich
ID: 12231259
I definitely agree with way12go. I suggest that you just disable all startup items which is very safe in windows XP unlike in ME and 98 where you have to leave systray, loadpowerprofile etc. Then if you have a spyware remover like what all the guys suggested run it. It's better to run the program if it's disabled in startup because some of these spywares cannot remove spy programs while it's running. After doing this, you can now enable the programs you need running in the background like anti-virus software and spyware remover. :) Good Luck!!!
0
 
LVL 2

Expert Comment

by:Sootah
ID: 12234112
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

Step by step guide to Clean and Sort your windows registry! Introduction: Always remember: A Clean registry = Better performance = Save your invaluable time In this article we're going to clear our registry manually! Yes, manually! The e…
It is only natural that we all want our PCs to be in good working order, improved system performance, so that is exactly how programs are advertised to entice. They say things like:            •      PC crashes? Get registry cleaner to repair it!    …
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

706 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now