HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
Y	CcPxySvc	CCPXYSVC.exe	"Part of Norton's AntiVirus 2003 Internet Security and Firewall products. E-mail proxy service - required for E-mail scanning and the firewall"
X	ccreg	explorer.exe	"Added by the ZCREW BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
Y	CcRegVfy	ccRegVfy.exe	"Part of Norton AntiVirus 2003. ""ccRegVfy.exe is responsible for checking the integrity of the NAV registry entries to make sure that the information has not been changed by a malicious threat or a hack"""
X	ccRegVfY	expIorer.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccRegVfY	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccRegVfY	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccRegVfY	outIook.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccrss	msdtc.exe	"Added by the STAP-C WORM!"
Y	ccSetMgr	ccSetMgr.exe	"Part of Norton AntiVirus 2004. What does it do?"
X	ccSvcHst.exe	ccSvcHst.exe	"Added by the SDBOT-DIW WORM!"
X	ccsvit.exe	ccsvit.exe	"Added by the STARTPA-HP TROJAN!"
U	cctray	cctray.exe	"Part of CA Internet Security Suite"
X	ccUpdate	ccUpdate.exe	"Added by the AGOBOT.YS WORM!"
U	ccUpdMgr	ccUpdMgr.exe	"In Loco Parentis remote surveillance software. Uninstall this software unless you put it there yourself!"
U	CCUTRAYICON	CCU_TrayIcon.exe	"Related to Traybar Launcher from Intel Corporation belonging to Intel® Viiv®"
U	ccWasher	aolwasher.exe	Webroot Cache & Cookie Washer - cleaning browser tracks including cache cookies history mail trash drop-down address bar auto-complete forms and downloaded program files for IE Netscape and AOL
U	CCWC7a	ac.exe	"Moleculesoft Cache Cookie & Windows Cleaner. No longer supported but available for free"
U	CCWC7I	idxl.exe	"Moleculesoft Cache Cookie & Windows Cleaner. No longer supported but available for free"
U	CCWC7s	stealth.exe	"Moleculesoft Cache Cookie & Windows Cleaner. No longer supported but available for free"
Y	CCWinTray	wintmr.exe	"System Tray access to Child Control parental control software by Salfield"
N	CD Storage Master	cdstorager.exe	"CD Storage Master - a program designed to catalog CD information boasts a number of handy features for organizing your collection"
X	cd1	cd1.exe	Premium rate adult content dialler
N	CDANTSRV	CDANTSRV.exe	C-Dilla License Management software. Used for any program that uses C-dilla Protection example: 3D Studio Max 4.x. It loads as a service automatically but is not needed unless you run said program. Can be started and stopped manually
X	Cdcompat	Cdcompat.exe	"Added by the GEMA TROJAN!"
X	cddrv32	cddrv32.exe	"Added by a variant of the CRYPTER.C TROJAN!"
N	CDInterceptor	cdi.exe	CD indexer for measuring the speed of CD players
Y	cdloader	cdloader2.exe	"From MagicJack - ""A softphone device that allows you to attach an analog phone into the PC so you can have a traditional-style phone system in your house without any monthly charge"""
X	CdnCtr	cdnup.exe	"CNNIC Update pest"
X	CDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	CDriver	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup!"
X	Cdrom Controller	cdromcntrl.exe	"Added by the BATTRY-A TROJAN!"
X	cds	cds.exe	"Added by the SPYMON TROJAN!"
X	CDSpeed.exe	CDSpeed.exe	"Detected by Kaspersky as the IRCBOT.AEX BACKDOOR! See here"
N	CDTray	CDTray.exe	On HP PCs this is the small CD icon next to the time
U	CeEKEY	CeEKey.exe	Hot Key utility included on Toshiba Satellite laptops
U	CeEPOWER	cepmtray.exe	Toshiba's Power Management Utility - allows the user to setup different profiles for both AC power and Battery Power on laptops. Contols CPU speed Monitor Shut Off Hard Drive Shut-Off Monitor Brightness System Stand-by and System Hibernate times
?	Ceic	Ceic.exe	"??"
X	Cekirge	[path to worm]	"Added by the KERGEZ.A WORM!"
X	center	[random name]32.exe	"Added by the BOFRA.A WORM!"
X	CentralProcessor	taskimgr.exe	"Added by the BANCOS.J TROJAN!"
?	CEPA	wsot.exe	"??"
U	CertificateRegistration	SafeSignCertReg.exe	SafeSign Certificate Registration Utility for Microsoft Crypto applications
U	CertReg	certreg.exe	"Related to Gemplus Card Reader"
Y	CertStoreInit	CertStoreInit	"Aladdin eToken authentication and password management"
N	CesarFTP FTP Server	server.exe	"CesarFTPd - FTP server"
X	cesmain.dll	Rundll32.exe [path] cmail.dll Rundll32	"CnsMin (Chinese Keywords) hijacker related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	CEventMgr	Cell.exe	"Added by the BIFROSE-AK TROJAN!"
N	CFD	CFD.exe	"BroadJump Client Foundation. Broadband troubleshooting software installed by various companies. Not required and you can remove it via Add/Remove programs"
X	CFDStart	WinMuschi.exe	"WINMUSCHI dialler"
X	cfgboost	cfgboot.exe	Added by an unidentified WORM or TROJAN!
Y	cfgintpr	cfgintpr.exe	"Configuration Interpreter - part of Tiny Personal Firewall V4"
X	cfgmgr51	RunDLL32.EXE cfgmgr51.dll DllRun	"BookedSpace parasite. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""cfgmgr51.dll"" file is located in the Winnt or Windows folder"
X	cfgmgr52	RunDLL32.EXE cfgmgr52.dll DllRun	"BookedSpace parasite. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""cfgmgr52.dll"" file is located in the Winnt or Windows folder"
N	cfgwiz	cfgwiz.exe	Introduced with Norton Anti-Virus 2002 this is a real resource hog. Many NAV users will find they can live without loading it
?	cFosDNT	cFosDNT.exe	"cFos DSL Modem driver related. What does it do and is it required?"
?	cFosInst_Check	cfosinst.exe	"cFos DSL Modem driver related. What does it do and is it required?"
U	cFosSpeed	cFosSpeed.exe	"cFos Software Internet acceleration program related. Note - may be necessary for the software to work properly"
U	CFSServ.exe	CFSServ.exe	Belongs to Toshiba's configfree utility and searches for Wireless Devices
X	cftmon	sfcmonit.exe	Added by a variant of the AGENT.ERG TROJAN!
X	cftmon	WindowsUpdate.exe	"Detected by Kaspersky as the AGENT.AQK BACKDOOR! See here"
X	cftmon32	taskmgr*.exe [* = number]	"Added by the SOWSAT.C and SOWSAT.J WORMS!"
X	cfy	cfy.exe	"Surfenhance.com SearchForIt adware variant"
X	CGI Firewall Script	CGIAGENT.EXE	"Added by the BROPIA-U WORM!"
U	CGServer	cgserver.exe	"Associated with an Eicon Networks ISDN or ADSL modem. Call Guard Server (CGserver) watches your modem and blocks incoming or outgoing calls. You need cgard.exe (from Startmenu) to configure cgserver with rules and telephone numbers. Good against unwanted dialer programs"
X	Cgtask Services	cgtask.exe	"Added by the LALA.B TROJAN!"
X	Cgywin	cgywin32.exe	"Added by the RBOT-AEI WORM!"
U	ChamClock	ChamClock.exe	"Chameleon Clock - system tray clock replacement"
X	change-me-now	msgfix1.exe	"Added by the SDBOT.ZD WORM!"
U	ChangeICON	SPMSMON.EXE	Card reader related program. Note - may cause problems with My Computer loading at startup. Disabling through MsConfig seems to solve the problem
?	ChangeLines	chngline.exe	"??"
Y	Charter High-Speed Security Suite	fspex.exe	"Charter High-Speed Security Suite - security software in collaboration with F-Secure"
X	Chat login	chatlogin.exe	"Added by the ANTINNY.F WORM!"
N	Chatango	Chatango.exe	"Chatango - ""allows people to be connected in real time through their Web browsers. Include your Chatango contact link or button when you create eBay auctions blogs personal websites Friendster profiles and your visitors will be able to contact you instantly without downloading anything or registering. Alo use it to send email to your friends allowing them to respond to you in real time!."" The 'MessageCatcher' icon in the System Tray notifies you when you get a message. When you get a message a little alert pops up which you can click on and start chatting immediately"
U	ChatStat	ChatStat.exe	"ChatStat from ChatStat Technologies Inc. Provides live chat assistance in up to 16 languages allows your operators to be more productive"
N	Chcenter	chcenter.exe	"IMSI HiJaak - ""the easiest way to convert capture and manage all your graphic files"""
X	Chckup	Netverchk.exe	"Covert Sys Exec malware variant"
X	chcp.exe	chcp.exe	"Detected by Kaspersky as the SDBOT.BMH WORM! See here"
X	che32	che.ocx.vbs	"Added by the ADENU-B VIRUS!"
X	Cheatle	GigaByte.exe	"Added by the SHODI.B VIRUS!"
X	Check	Check.exe	"Added by the VB-DRN WORM!"
N	Check for One Touch Update	wiseupdt.exe	Checks for updates for Visioneer OneTouch scanners
N	Check for TWS Updates	WiseUpdt.exe	Interactive Brokers - check for update to their standalone Java-based trading platform
U	Check Messenger	cmesseng.exe	Check Messenger from Qchex.com - program that helps you manage the activity of your Qchex account. Qchex appear to be no longer in buisness
U	Check&Get	Check&Get.exe	"Check&Get from ActiveURLs. Manages your browser bookmarks and favorites. Monitors Web sites for changes and updates captures and highlights the changed contents"
N	CheckCustomWorksUpdate	CheckCWupdate.exe	"Update checker part of CustomWorks - ""customize any embroidery designs to design your own unique creations"""
U	CheckDialer	ChkDial.exe	"Added by the CheckDialer modem connection monitoring tool"
X	Checkdisk	mscas.exe	"Added by the VAGON-A TROJAN!"
X	CheckFaultKernel	mswdm.exe	"Added by the SMALL-CSK TROJAN!"
U	CheckIt	ToolBox.exe	"CheckIt Toolbox from WinCheckIt Diagnostic Software. Toolbox automatically backs up critical system files (such as .ini files and the Windows Registry) and performs a check on various system parameters at intervals you specify"
U	CheckIt 86	CheckIt86.exe	"CheckIt 86 popup blocker"
Y	CheckMsgPlus	MsgPlusH.dll VerifyInstallation	"Added by MSN Messenger Plus a third party extension to MSN Messenger. This is the auto-update feature - see here for more info."
X	checkrun	elite***32.exe [* = random char]	"EliteBar adware"
X	checkrun	elitelsj32.exe	"Added by the MULTIDR-ER TROJAN!"
X	CheckScan32	regload16.exe	"Added by the AEBOT.K WORM!"
?	checktime	ct.exe	"Found in the HPSelectFrontend directory on a HP machine. What is it's purpose and is it required?"
Y	CheckVCR	IOMagic.exe	"Driver for the I/OMagic Personal Video Recorder (DR-PCTV100)"
X	CheckWinPerf	perfinfo.exe	"Added by a variant of the IRCBOT TROJAN!"
U	CherryKeyMan	KeyMan.exe	"Multimedia keyboard manager for the Cherry keyboard series. Only required if you use any of the special keys"
X	chiCkie	chiCkie.exe	"Added by the CHIKO WORM!"
U	ChicoSys	webtmr.exe	"Child Control parental control software"
U	ChikkaDefault	ChikkaLauncher.exe	"Chikka PC text messanger and IM client"
X	china11msn	CHINA11MSN.EXE	"Added by the ENVID.O WORM!"
U	ChineseStar	cstar.exe	Chinese language support software
U	CHIPDRIVEPinManager	sokscmpn.exe	"ChipDrive Smartcard software"
U	CHIPDRIVESmartcardManager	SCMgr.exe	"ChipDrive Smartcard software"
X	CHK Disker	chkdsker.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	CHK NT	chkntf.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
N	CHKADMIN	CHKADMIN.EXE	Compaq Network Management System. When running it places an icon in the system tray titled "Intelligent Manageability"
X	ChkDisk	chk_disk.exe	Added by an unidentified WORM or TROJAN!
X	chkdrv	iemon.exe	"Detected by Symantec as the ADCLICKER TROJAN!"
X	chkdsk	autoexec.bat	"Added by the ANPES WORM!"
U	ChkMail	ChkMail.exe	Mail-checking program supplied with Acer notebooks
U	ChoiceMail	CHOICEMAIL.EXE	"ChoiceMail from DigiPortal Software. Block spam with an Email firewall"
X	Choke	Choke.exe -blahhh	"Added by the CHOKE WORM!"
X	chope	runlli32.exe	"Added by the QQPASS-U TROJAN!"
X	chostsv	chostsv.exe	"Added by the BANPAES.C TROJAN!"
U	CHotKey	mhotkey.exe	Enables special keys on Chicony keyboards. Special combinations include Internet E-mail vol+ vol- mute etc. Only required for extended features
U	CHotKey	MK9805.EXE	Enables special keys on Chicony keyboards. Special combinations include Internet E-mail vol+ vol- mute etc. Only required for extended features
U	CHotKey	zHotkey.exe	Enables special keys on Chicony keyboards. Special combinations include Internet E-mail vol vol- mute etc. Only required for extended features
N	Christmas Music Player	TTEST6.EXE	"Christmas Music Player brings the music of the Christmas Holiday to your desktop"
?	ChromeMark	keysh.exe	"Related to this. Don't know what keysh.exe does though and if it's required"
?	ChronitelInitTV	CHTVINIT.EXE	"??"
U	chrono	chrono.exe	"Chronograph is a simple utility that synchronizes internal computer clock to the atomic time. Chronograph automatically maintains correct time using atomic clock servers of the National Institute of Standards and Technology (NIST)."" Shows seconds and shows the date without having to hover the mouse. Shows a calendar when hovered over"
X	Ci Svr	cisvr.exe	"Detected by Trend Micro as the IRCBOT.AWN BACKDOOR! See here"
X	ci1gnt	ci1gnt.exe	"Detected by Kaspersky as the AGENT.DHU TROJAN!"
X	CiaBackdoor	msldr.com	Added by a VIRUS!
X	cihost.exe	cihost.exe	"Added by the LINST TROJAN!"
N	CIJxP2PSERVER	CIJxP2PS.EXE	Compaq printer utility which is required in order to make the printer work correctly - "x" depends upon the model ie for IJ300 x=3 for IJ700 x=7
Y	Cingular Communication Manager	CingularCCM.exe	"Cingular Communication Manager - now taken over by AT&T. ""provides a robust set of wireless communication tools for businesses and individuals. With wireless access to email the Internet business applications and corporate intranets mobile users can be more productive while they're out of the office"""
X	Cinnabd Prompt32	CmdPrompt32.pif	"Added by the ASSIRAL-B WORM!"
N	CIO	che7e1~1.exe	"ChatItOut webcam chat program"
X	Ciodiag	DECCONF.EXE	"Added by the STRAT.EL TROJAN!"
X	CirebonPunya	XXrocks.exe	"Added by the BHARAT.A WORM!"
U	Cisco Systems VPN Client	ipsecdialer.exe	"Cisco VPN Client - lets local users gain Administrator privileges on the operating system"
U	Cisco Systems VPN Client	vpngui.exe	"Sets up IPSec communications for Cisco's VPN Client"
N	CISrvr Program	CISRVR.EXE	Related to internet setup on Compaq PC's
X	Cissi	Cissi.exe	"Added by the CISSI.A WORM!"
U	CitiUCS	CitiUCS.exe	"Citibank Virtual Account Numbers - ""With this free service for Citi cardmembers you never have to give out your real credit card number online"""
N	CitiVAN	CitiVAN.exe	"Option from Citibank to change a credit card number in a random fashion for each purchase. The number will only be used once and never again"
X	cjb	cjb.exe	"Added by and unidentified WORM or TROJAN! See here"
X	CJET	CJet.exe	"FFToolBar adware toolbar"
Y	Cjstcom	Cjstcom.exe	Canon printer BJ status language monitor
Y	ClamWin	ClamTray.exe	"ClamWin antivirus"
X	Classes	int1.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	intl.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	run_21.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	srv.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	srv2.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	MSTAR2.EXE	"""Switch"" premium rate adult content dialler variant"
X	Classes	mstart.exe	"""Switch"" premium rate adult content dialler variant"
X	clcbt.exe	clcbt.exe	"Added by the AGENT.CBA TROJAN!"
X	clcl3	clcl3.exe	Added by the AGENT.ES TROJAN!
X	clcl7	clcl7.exe	"Added by a variant of the Covert Sys Exec TROJAN!"
U	CLCLSet	CLCL.exe	CLCL clipboard caching utility
N	Clean Access Agent	CCAAgent.exe	Cisco Clean Access Agent from Cisco Systems Inc
X	Clean Mgr	cleanmg.exe	"Detected by Trend Micro as the IRCBOT.BBO BACKDOOR! See here"
X	Clean up	service.exe	"Added by the AGENT-FPY TROJAN!"
?	CleanEasyImg	cleanall.exe	"??"
?	CleanRegPath	CleanReg.exe	"Apparently Annex A ADSL modem related. What does it do and is it required?"
U	CleanSweep Smart Sweep- Internet Sweep	Csinsm32.exe	Automatic logging of installs from Norton CleanSweep - available via Start -> Programs
N	CleanSweep Useage Watch	CSUSEM32.EXE	Quarterdeck/Norton CleanSweep component - tracks how often you use files and alerts you to files that have not been used for a specified period of time
U	CleanTemp	CLEANT~1.EXE	"CleanTemp - deletes the contents of the TEMP directory when Windows starts and then closes - using no memory"
U	CleanTemp	CleanTemp.exe	"CleanTemp - deletes the contents of the TEMP directory when Windows starts and then closes - using no memory"
N	Cleanup	ONICTASK.EXE	"Internet Cleanup from Allume Systems (used to be by OnTrack) - cleans up tracks left by browsing the internet"
Y	CleanUp	mcappins.exe	Used by McAfee Virusscan to perform product updates. When updates are available the program will download and install them automatically. Recommended to leave enabled
?	CleanupProgram	cleanup.exe	"In a C:Sonysys folder - Sony Vaio related?"
X	clean_service	clean_service.cmd	"Added by the REFAZ WORM!"
U	CleverKeys	CK.exe	"CleverKeys - ""is free software that provides instant access to definitions at Dictionary.com synonyms at Thesaurus.com facts at Reference.com and more ? from almost all Windows programs including word processors Web browsers and most e-mail programs"""
X	clfmon	clfmon.exe	"Added by the TACTSLAY.E TROJAN!"
X	clfmon	nvsvca32.exe	"Added by the TACTSLAY.E TROJAN!"
X	clfmon.exe	clfmon.exe	"Added by the AGENT-BJ TROJAN!"
X	Cli Confg	cliconfig.exe	"Added by a variant of the SPYBOT WORM! See here"
X	CLI Services	clisrv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
N	Click Radio Tuner	clickr~1.exe	"ClickRadio - subscription service playing radio music via the internet"
N	Click Tray Calendar	ClickT~1.EXE	"ClickTray Calendar - shows holidays reminders of various anniversariestasks etc"
N	ClickMe	ClickMe.exe	"ClickM ""JOKE"" program"
U	Clickoff	Clickoff.exe	"Clickoff automatically dismisses annoying dialog boxes"
X	ClickTheButton	CTB.EXE	"ClickTheButton adware"
X	ClickTheButton	csrss.exe	"ClickTheButton adware. Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	ClickTheButton	cd_load.exe	"Added by the DOWNLOADER-MY TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list