StartupList report, 08/11/2019, 21.05.
11
StartupList version: 1.52.2
Started from : C:\Users\Administrator\Documents\HijackThis.EXE
Detected: Unknown Windows (WinNT 6.02.1008)
Detected: Internet Explorer v11.0 (11.00.10586.0000)
* Using default options
==================================================
Running processes:
C:\Program Files (x86)\GBillingClient\gbClientService.exe
C:\ProgramData\GarenaCIG\GarenaCIG.exe
C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
C:\Program Files (x86)\GBillingClient\gbClientApp.exe
C:\Program Files (x86)\GBillingClient\gbClientLocker.exe
C:\Program Files (x86)\GBillingClient\winvnc.exe
D:\Game menu\_PLAYNITE\Playnite.DesktopApp.exe
C:\Program Files (x86)\GBillingClient\cpm.exe
C:\ProgramData\GarenaCIG\GarenaCIG.exe
C:\ProgramData\GarenaCIG\GarenaCIG.exe
D:\Messenger\Garena\Garena\2.0.1909.2618\gxxsvc.exe
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
C:\Users\Administrator\Documents\HijackThis.exe
C:\Windows\SysWOW64\notepad.exe
--------------------------------------------------
Listing of startup folders:
Shell folders Startup:
[C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start
Menu\Programs\Startup]
MENU.lnk = D:\Game menu\MENU.exe
Playnite.lnk = D:\Game menu\_PLAYNITE\Playnite.DesktopApp.exe
--------------------------------------------------
Checking Windows NT UserInit:
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\Program Files (x86)\GBillingClient\gbClientLocker.exe,C:\Program
Files (x86)\GBillingClient\gbClientApp.exe,C:\Program Files
(x86)\GBillingClient\gInitTool.exe,
--------------------------------------------------
Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
SunJavaUpdateSched = "C:\Program Files (x86)\Common Files\Java\Java
Update\jusched.exe"
gbClientApp = C:\Program Files (x86)\GBillingClient\gbClientApp.exe
GarenaCIG = "C:\ProgramData\GarenaCIG\GarenaCIG.exe" --tray
--------------------------------------------------
Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Discord = C:\Users\Administrator\AppData\Local\Discord\app-0.0.301\Discord.exe
--------------------------------------------------
File association entry for .HTA:
HKEY_CLASSES_ROOT\htafile\shell\open\command
(Default) = C:\Windows\SysWOW64\mshta.exe "%1" {1E460BD7-F1C3-4B2E-88BF-
4E770A288AF5}%U{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} %*
--------------------------------------------------
Shell & screensaver key from C:\Windows\SYSTEM.INI:
Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*
Shell & screensaver key from Registry:
Shell=explorer.exe
SCRNSAVE.EXE=*Registry value not found*
drivers=*Registry value not found*
Policies Shell key:
HKCU\..\Policies: Shell=*Registry value not found*
HKLM\..\Policies: Shell=*Registry value not found*
--------------------------------------------------
Enumerating Browser Helper Objects:
Lync Click to Call BHO - C:\Program Files (x86)\Microsoft
Office\Office15\OCHelper.dll - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA}
URLRedirectionBHO - C:\PROGRA~2\MICROS~2\Office15\URLREDIR.DLL - {B4F3A835-0E21-
4959-BA22-42B3008E02FF}
(no name) - C:\PROGRA~2\MICROS~2\Office15\GROOVEEX.DLL - {D0498E0A-45B7-42AE-A9AA-
ABA463DBD3BF}
--------------------------------------------------
Enumerating Winsock LSP files:
NameSpace #1: C:\Windows\system32\napinsp.dll
NameSpace #2: C:\Windows\system32\pnrpnsp.dll
NameSpace #3: C:\Windows\system32\pnrpnsp.dll
NameSpace #4: C:\Windows\system32\NLAapi.dll
--------------------------------------------------
Enumerating Windows NT logon/logoff scripts:
Windows NT 'Wininit.ini':
PendingFileRenameOperations: C:\Program Files (x86)\Google\Update\1.3.33.23||
C:\Program Files
(x86)\Google\Chrome\Temp\scoped_dir10568_756296537\old_chrome.exe||C:\Program Files
(x86)\Google\Chrome\Temp\scoped_dir10568_756296537||C:\Program Files
(x86)\Google\Chrome\Temp||C:\Users\ADMINI~1\AppData\Local\Temp\is-
LTNC7.tmp\OCSetupHlp.dll||C:\Users\ADMINI~1\AppData\Local\Temp\is-LTNC7.tmp|||d
--------------------------------------------------
Enumerating ShellServiceObjectDelayLoad items:
WebCheck: *Registry key not found*
--------------------------------------------------
End of report, 5.109 bytes
Report generated in 0,015 seconds
Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only
