HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
X	27	slsorve.exe	"Added by the SLSORVE-A TROJAN!"
X	27	csrss32.exe	"Added by the SLSORVE-D TROJAN!"
X	27	msm32.exe	"Added by the SLSORVE-E TROJAN!"
X	2Search	main.exe	"2Search adware"
X	2thousandbuck	[path to file]	"Added by the RANKY.L TROJAN!"
U	2wSysTray	2portalmon.exe	"2Wire Homeportal user interface"
X	32-bit Thunking service	thunk32.exe	"Added by the DERDERO.A WORM!"
?	39ELTFH25Z8SKF	Ezg1q5.exe	"Seems to be associated with software by Resplendence SP ?"
Y	3c1807pd	3cmlink.exe 3cpipe-3c1807pd	"3Com WinModem driver. See here for more WinModem information"
Y	3capplnk	3capplnk.exe	US Robotics Modem driver
N	3cdminic	3CDMINIC.EXE	3Com DMI (DynamicAccess Desktop Management Interface) Agent associated with 3Com network cards
Y	3CM Link	3cmcnkw.exe	Required for a US Robotics WinModem as it provides the link to Windows - won't work without it
Y	3Cmlink	3CmlinkW.exe	"For a US Robotics WinModem. Provides the link to Windows as the CPU does the processing on WinModems - won't work without it. See here for more WinModem information"
N	3ComDMIAgent	3CDMINIC.EXE	3Com DMI (DynamicAccess Desktop Management Interface) Agent associated with 3Com network cards
Y	3cpipe-USRpdA	USRmlnkA.exe	Modem driver files from US Robotics
X	3D Text	3D Text.scr	"Added by the JERMY.A WORM!"
U	3Deep Control Panel	3DeepCTL.EXE	"From LightSurf Technologies (nee E-Color) - 3Deep corrects lighting
X	3Dfx Acc	GFXACC.EXE	"Added by the GIBE WORM!"
N	3dfx Task Manager	3dfxMan.exe	System Tray application for 3dfx Voodoo 3/4/5 functions. Available via Start -> Programs
Y	3dfx Tools	3dfxCmn.dll	Updates the registry with information that can't be held for Voodoo 3/4/5 series graphics cards. Important for owners of these cards
Y	3dfxv2ps.dll	3dfxv2ps.dll	Updates the registry with info that can't be held for 3dfx Voodoo 2 video cards. Important for owners of these cards
?	3Dlabs Taskbar Display Manager	3DLman.exe	"3DLabs graphics driver related. System Tray access to display settings?"
U	3DLabsHelperDemon	3dldemon.exe	"Directly from the programs author "It is a tiny program that is installed by the Permedia2/3 and probably other Oxygen-series cards. Normally it sits in the background doing nothing at all (sleeping on a semaphore)
Y	3DMouse.EXE	3DMouse.EXE	Dritek System Inc. 3D Mouse driver
X	3d_sound	3d_sound.exe	"Added by the RIADOS-A TROJAN!"
U	3qdctl.exe	3qdctl.exe	"Provided with Terratec 128i PCI and similar sound cards. Loads a sound profile at bootup
Y	3ware 3DM	3dm.exe	Monitors status of the disk array on 3ware IDE RAID controllers
X	456655	explorer.exe	"Added by the BIFROSE-DE TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System folder"
X	4wd!!!	Natal!.pif	"Added by the OPASERV.AI WORM!"
X	5-1-61-96	members-area.exe	Adult content dialler
X	5-2-46-112	5-2-46-112.exe	"Adult content pop-up dialler. Removal instructions here"
X	55278	grepclient1.exe	"Added by the LINEAGE-S TROJAN!"
X	5p4m	[path to trojan]	"Added by the LITEBOT-C TROJAN!"
X	5whgue21	5whgue21.exe	"ClearSearch adware"
X	666	Ska.exe	"Added by the PIPES TROJAN!"
X	678	lsas32.exe	"Added by the SLSORVE-B TROJAN!"
X	98D0CE0C16B1	"rundll32.exe D0CE0C16B1	D0CE0C16B1"
Y	9xadiras	9xadiras.exe	"Allied Telesyn AT series router/modem related - apparently required"
X	9xHtProtect	AVprotect9x.exe	"Added by the NETSKY.M WORM!"
X	;Rundll	[filename]	"Added by the PWSLEGMIR.E TROJAN!"
X	?ekio Startups	?nksvc32.exe	"Added by the AGOBOT-OV WORM where ? is a random character"
X	@	regedit -s ..win.dll	"Added by the SEEKER.K TROJAN!"
N	@Hoc Toolbar	AtHoc.exe	"One-click activated browsing toolbar used by various web-sites. See here for more info"
N	@loha	reminder.exe	"Registration reminder for @tour_ww	@tour_ww[1].exe	Adult content dialler
X	a	a.exe	Commercials file that registers itself in the system registry and redirects IE to a certain commercial website
X	a	jesse.exe	"Added by the MELO-A WORM!"
X	A New Windows Updater	w32NTupdt.exe	"Added by MYTOB.BM WORM!"
U	a-squared	a2guard.exe	"a-Squared antitrojan - can be run on demand but necessary in Startup if you prefer the a˛ 'Background Guard' real time protection feature"
Y	a-winpoet-service	winpppoverethernet.exe	"WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion
U	A1000 Settings Utility	cpqa1000.exe	"Compaq A1000 Print Fax All-in-One copy scan printer software. Required in the Startup in order to scan
U	A4Proxy	A4Proxy.exe	"Anonymity 4 Proxy - local proxy server that makes you anonymous when visiting web sites"
?	AAACLEAN	AAACLEAN.INF	"??"
?	AAAKeyboard	??	"??"
N	AAATraySaver	TraySaver.exe	"System Tray management utility from Mike Lin which allows you to hide
U	AAK	aak.exe	"Advanced Anti-Keylogger - ""Anti-spy software to prohibit operation of any keyloggers currently in use or presently being developed anywhere"""
X	Aaou	amee.exe	"PurityScan/Clickspring adware"
X	Aapp	adprot.exe	"AdBlaster adware"
?	aauclient	ACNUpdater.exe	"Appears to be related to software from Accenture.comF1527"
?	ab EazyScheduler	ezsched.exe	"??"
N	ABBYY Community Agent	CAGENT.EXE	Installed with the Optical Character Recognition (OCR) software that comes bundled with a Compaq A3000 all-in-one printer/scanner. Its function appears to be to link you to the internet in an attempt to buy the 5.0 version of the software
U	ABC	keylogger.exe	Keystroke logger/monitoring program - remove unless you installed it yourself!
X	abcdefgh	abcdefgh.exe	"EPJ TROJAN!"
U	ABIT uGuru	uGuru.exe	"ABIT µGuru - on motherboards incorporating the µGuru processor this provides quick access to ""hardware monitoring
N	ABITEQ	abiteq.exe	"Monitoring utility for ABIT Motherboards. Displays system voltages
X	Abrada WIN32	abrada.exe	"Added by the DERMON-G TROJAN!"
U	Absolute Shield	dseraser.exe	"Absolute Shield Evidence Eliminator - internet history eraser"
U	Absolute StartUp monitor	ASMon.exe	"Absolute Startup - startup monitor from F-Group Software"
U	AbsoluteShield Internet Eraser	cseraser.exe	"AbsoluteShield Internet Eraser - ""protects your privacy by cleaning up all the tracks of your Internet and computer activities"""
X	ABsr	absr.exe	"Added by the AUTOUPDER TROJAN!"
X	absr	mwsvm.exe	"SeekSeek search hijacker related - see here"
X	abtu	mp3serch.exe	"Loads the executable for Lop.com. mp3serch.exe is the final version"
X	abtu	lopsearch.exe	"Loads the executable for Lop.com. lopsearch.exe is the beta version"
U	AbyssWebServer	abyssws.exe	"Abyss web server"
Y	AcBtnMgr_Xxx	AcBtnMgr_Xxx.exe	Associated with the Lexmark Xxx (where "xx" is the model) all-in-one printer/scanner/copier. Required for correct operation
U	acc	acc.exe	"Advanced Call Center - ""full-featured yet easy-to-use answering machine software for your voice modem"""
X	ACCDEFRAGINFO	[path to worm]	"Added by the DARBY-O WORM!"
U	Accelerate	accelerate.exe	Webroot Accelerate - allows you to optimize Windows network registry settings in order to boost surfing speeds. Leave this enabled if you find it improves your connection
N	Access Ramp Monitor	armon32.exe	"Monitors your progress on the internet; hang-ups
X	Access WebControl	[path to file]	"Added by the PPDOOR-M TROJAN!"
U	AccessManager	AccessMgr.exe	"Part of SmartPipes SecureSite software. ""SecureSite enables rapid turnup and enhanced administration of VPNs. It automates and simplifies tasks for VPN design and policy management
X	AccessMedia P2P Loader	amp2pl.exe	"My AccessMedia toolbar related
U	AccessoriesPlus	clockplus.exe	"Clock Plus
N	AccessRamp Monitor01	ARMon32a.exe	"From a visitor "Just wanted to provide you with some info on Access Ramp software installed with Verizon DSL accounts in those areas that use the Winpoet PPPoE software. The Access Ramp TSRs are installed as part of IP Insight software (can't remember the software maker). You can decline to install IP Insight during Winpoet setup
N	AccessRampLAN01	ARUpld32.exe	"Version of the AccessRamp Monitor01 entry for LAN connections - a history uploader. The key in turning it off is a file named ARUCfg32.exe. This file (ARUCfg32.exe) does not show up in the startup process. If you have this file
U	AcctMgr	AcctMgr.exe	"Norton™ Password Manager - part of Norton SystemWorks 2004 - stores passwords and other personal information
N	AccuWeather.com® Desktop	??	"Desktop weather from AccuWeather.com"
X	accwizz.exe	accwizz.exe	"Added by the RULAND.A WORM!"
X	accwizzz.exe	accwizzz.exe	"Added by the RULAND.A WORM!"
N	ACDSee	ACDSee8Pro.exe	"ACDSee 8 photo software. Organize
?	Ace bows	Ace bows.exe	"??"
N	AceGain LiveUpdate	LiveUpdate.exe	"""AceGain LiveUpdate can help to automate and optimize product updates. AceGain LiveUpdate will automatically detect new patch updates
U	Acer ePower Management	Acer ePower Management.exe	"Part of Acer Empowering Technology. ""Acer ePower Management is a straightforward interface that allows users to select from pre-configured power usage profiles
U	AcerGoto	AcerGoto.exe	"Acer Computer ""Goto Drive"" Cold Swap Driver - a swappable second disk drive provides convenient backup of large files
U	AcerNotebookManager	almxptray.exe	System Tray access on some Acer Notebooks to give faster access to system settings
U	AcerPowerkey	Powerkey.exe	PowerKey utility for Acer TravelMate notebook PCs. Allows the user to quickly switch between different power schemes by pressing Fn+F3
X	Aceu	[random filename]	"PurityScan/Clickspring adware"
U	AClntUsr	AClntUsr.exe	"Altiris AClient Service Windows Tray Icon"
N	Acme.PCHButton	pchbutton.exe	Used by HP Instant Support
Y	ACMonitor_Xxx	ACMonitor_Xxx.exe	Associated with the Lexmark Xxx (where "xx" is the model) all-in-one printer/scanner/copier. Required for correct operation
X	acocash	fastdown.exe	Adult content dialler
X	acocash	fastdown.exe	Adult content dialler
U	Acombo3dmouse	Acombo3d.exe	Mouse driver - required if you use non-standard Windows driver features
X	Aconti	aconti.exe	Adult content dialler
U	acoustic	acoustic.exe	"Control panel program for Philips Acoustic Edge soundcard. Not required unless changed settings aren't retained"
N	acpart	agpart11.exe	Program for finding trucks on-line
U	Acrobat Assistant *.*	ACROTRAY.EXE	"Used to create PDF files with Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation. *.* represents the version"
U	Acronis Popup Blocker	"RunDll32.exe [path] Blocker.dll	Run"
U	Acronis Scheduler2 Service	schedhlp.exe	"Part of Acronis True Image - backup software. Co-operates with the ""schedul2.exe"" servuce to perform backup/restore tasks correctly. Required if you want to use TrueImage to do some real backup/restore tasks - not if you only want to explore/mount images"
N	Acronis True Image Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
N	Acronis TrueImage Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
N	AcronisTrueImage Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
N	Action Manager 32	am32.exe	Associated with a Plustech scanner. Small utility that runs in the background for doing fax/copy/etc. Available via Start -> Programs
?	ActionAgent	actionagent.exe	"""A COM server that runs on the client as part of the Dell OpenManage Client Instrumentation 6.x package; provides a simple method for a remote administrator to perform actions on the instrumented client"". Is it required?"
N	Activation	Activation.exe	Part of Microsoft Money
U	Activboard	MMKeybd.exe	"Packard Bell ActiveBoard keyboard - multimedia keyboard manager. Required if you use the additional keys and want to see the status of the Num Lock
X	Active Bit Station	abs.exe	"Added by the MYTOB.BZ WORM!"
U	Active Email Monitor	aem25.exe	"Active Email Monitor checks multiple accounts for email
U	Active shield	Activeshield.exe	"Active Shield is ""an heuristic screen that actively protects your computer from trojans
X	ActiveDesktop	systray32.exe	"Added by the DABOOM WORM!"
X	ACTIVEDS	ACTIVEDS.EXE	"Added by the OPASERV.T WORM!"
N	ActiveEyes	ActiveEyes.exe	"ActiveEyes from TFI Technology is a small utility that you can use to liven up your desktop. It follows your mouse around and can tell you how far your cursor has travelled or point out where the cursor is. It's small
U	ActiveMenu	ActiveMenu.exe	Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
U	ActivePlus	activeplus.exe	"Interactive Agents Plugin for Messenger Plus! (MSN Messenger add-on)"
X	ActiveScan Antivirus	ActiveScan.exe	"Added by the RBOT-FKQ WORM!"
Y	ActiveShield	MCVSSHLD.EXE	McAfee VirusScan On-line. See also the McAgentExe entry
U	ActiveSpeed	AS.exe	"Ascentive ActiveSpeed Internet Optimizer"
N	ActiveWords	AWMonitor.exe	"ActiveWords from ActiveWord Systems
X	ActiveX Streamer	msgfix.exe	"Added by the SDBOT.NQ WORM!"
X	ActiveXUpdate	svcss.exe	"Added by a variant of the DEDLER.C TROJAN!"
U	Activity	actik.exe	"ActivityKey Keystroke logger/monitoring program - remove unless you installed it yourself!"
N	ActivSurf	backweb*****.exe	Packard Bell ActivSurf - automatically detects an internet connection and downloads any available updates
U	ActMaker	ActMak25.exe	"""ActMaker mouse and keyboard toolkit can record the daily operation of your computer and reduce your workload. You don't need to do any coding

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list