HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
X	foobin ml097e	adaware.exe	"RapidBlaster variant (in a ""foo1"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
Y	FoolProof	fpwinldr.exe	"FoolProof Security PC security software from SmartStuff"
Y	FoolProofSweep	??	"Part of FoolProof Security PC security software from SmartStuff"
N	Forbes	ForbesAlerts.exe	Forbes Business News Alerts - displays business news headlines in a little window on the screen
X	ForceShow	"rundll32.exe QaBar.dll	ForceShowBar"
N	Forget Me Not	AGRemind.exe	"Calendar reminder part of American Greetings® CreataCard®"
X	FortiClient	FortiClient.exe	"Fortinet security systems are the new generation of real time network protection systems"
U	Fortis Secure Layer Config	cseinst.exe	Fortis Bank Home Banking part. Installed during the installation of the software necessary to run the Home Banking. According to Fortis Bank this will not in any way be harmful to the system or relay system information
N	FotoStation Easy AutoLaunch	FotoStation Easy AutoLaunch.exe	Installed with a Nikon digital camera. Used to collect photos uploaded from camera program NkVwMon.exe. If your camera is not connected (via USB port) you do not need this program loaded either
U	Foul PX	FoulPX.exe	"Foul PX
U	FourthDay	FourthDay.exe	"The Fourth Day - ""astronomical clock and almanac for your system tray"""
X	foxdh	foxdhend.exe	"Added by the MENGHUAN TROJAN!"
X	foxdh	foxdh.exe	"Added by the GWGHOST-Q TROJAN!"
X	foxrxjh	foxrxjh.exe	"Added by the GWGHOST-T TROJAN!"
X	foxwudy9912	service.exe	"Added by the BANCOS-BT TROJAN!"
Y	FP Loader	loadfp.exe	"FoolProof Security - PC security software from SmartStuff"
?	FPWGMWZD	FPWGMWZD.exe	"??"
N	Fpx	mnmsrvc.exe	Remote Desktop Sharing service part of Microsoft's Netmeeting allowing users to share items on their screens across remote locations
X	fqor	stub_113_4_0_4_0.exe	"TargetSaver adware"
X	FrameWork 2.5	FrameWork.exe	"Added by the RBOT-FMW WORM! Note - can terminate AV related processes"
X	France	svchost.exe	"Added by the MIMAIL.L WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
U	Fraps	fraps.exe	Fraps Real-Time Video Capture software
N	Free Download Manager	fdm.exe	"""Free Download Manager"" - see here"
?	Free Downloads Monitor	fdcmon.exe	"??"
U	Free Ram Optimizer	fro.exe	"Free Ram Optimizer monitors your memory
Y	Freedom	Freedom.exe	"Zero Knowledge Freedom - Anti-Virus
U	FreeMem Pro	FMEMPRO.EXE	"FreeMem Pro - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
U	FreeMemVn2	FreeMem.exe	"FreeMem - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
X	FreeMP3download	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	FreeRAM XP	FreeRAM XP Pro *.exe	"FreeRAM XP Pro - memory optimizer where * represents the version. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
X	freestyle	lockx.exe	"Added by the RBOT-ATH WORM!"
U	freesurfer	fs20.exe	"EMS Free Surfer mk II - pop-up stopper"
X	freexstyle	lockbar.exe	"Added by the LOXBOT.D WORM!"
X	freexstyle	lockbr.exe	"Added by the LOXBOT.C WORM!"
U	Fresh Desktop	freshdesktop.exe	"Fresh Desktop is a utility that lets you manage vast collections of wallpapers for your desktop with ease. When run on bootup it changes the desktop wallpaper at startup or at specified intervals"
N	freshclam	freshclam.exe	"Auto update agent of the open source Clamwin virus scanner"
?	frguk	shdrkmck.exe	"??"
?	FridaysInHellInstaller	FridaysInHellInstaller.exe	"??"
X	FriendlyType	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder"
X	FriendlyTypeName	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
X	FriendlyTypeName	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
N	FriendlyWebQuick-Launch	SELFCERT.EXE	selfcert.exe is a stand alone program for creating your own digital certificates for macros - the .exe is installed as an extra basically by clicking on MS Office in add/remove programs and selecting remove - also I would do away with the FriendlyWebQuickLaunchBar as well
U	FRISK FP-Scheduler	F-Sched.exe	"Scheduler for F-Prot anitvirus software. Leave enabled unless you scan manually on a regular basis"
?	FRITZ!DSL Startcenter	StCenter.exe	"FRITZ! ISP software ""StartCenter"" User interface that allows you to manage
U	FRITZ!webProtect	FwebProt.exe	Firewall included in FRITZ! ISP DSL software
N	Fromine WinPopup	winpopup.exe	Instant Messenger program
X	Frsk	frsk.exe	Unidentified adware downloader trojan
Y	FRW_EXE	FRW.EXE	"ConSeal Signal9 firewall - now McAfee Personal firewall"
Y	frxmxins	frxmxins.exe	ATI 3D Studio MAX/VIZ driver
X	FS Agent	fagent.exe	"Added by the VOLVER-B TROJAN!"
Y	fsaa	fsaa.exe	"F-Secure antivirus Authentication Agent - creates and stores private keys used by a client to access servers"
N	FSCBoss	FSCBoss.exe	Free Store Club shop online software
?	FSDPSRV	FSDPSRV.exe	"??"
X	FSH	svcnva.exe	"Malware
U	fsp	fsp.exe	"Folder Shield - hide entire directories and thus prevent access by anyone else to your personal files and documents"
Y	fspr	FolderShield.exe	"Folder Shield - hide personal files and folders"
N	FSScrCtl	FSScrCtl.exe	Screen saver control applet used by the "Stardust Screen Saver Toolkit" and "SolidWorks Screen Saver"
U	fsserv	fserv.exe	"Farsighter Server - monitors a remote computer invisibly by streaming video to a viewer on your computer. You will know exactly what is happening on the remote computer as you see it in real-time"
X	FSW	FSW.exe	"FreeScratchAndWin parasite"
U	FSWebServer	fsws.exe	"Easy File Sharing Web Server is a Windows program that allows you to host a secure peer-to-peer and web-based file sharing system without any additional software or services"
X	FtkCPY	ftkcpy.exe	"FlashEnhancer adware variant"
U	FTMSFLT(USB)	FTMSFLTU.EXE	Fujitsu's Touch Panel Message Notifier
X	FTP FOR WINDOWS	ftpwin32.exe	"Added by a variant of the RBOT WORM!"
X	FTPGraber	FTPGraber.exe	"Added by the DLOADER-DT TROJAN!"
N	FTPManager	FTPDM.exe	"""Robust FTP is a Windows-based file transfer client application that transfers files between a user's local PC and another
U	Ftpqueue	Ftpsched.exe	"Part of WS_FTP Pro from Ipswitch. Queueing facility for scheduling FTP transfers"
U	Fujitsu Menu	FjMnuIco.exe	"From the ""Fujitsu Menu"" tray icon you have instant access to the Control Panel
X	fukerservice	fukerz.exe	"Added by a variant of the RBOT WORM!"
X	FUKLBAR	bar.exe	"PurityScan/Clickspring adware"
X	fvek	fvek.exe	"Added by the DRIVOL-A TROJAN!"
X	FWDMON.EXE	fwdmon.exe	"Added by the PROXY-S TROJAN!"
Y	fwenc.exe	fwenc.exe	"Check Point SecuRemote VPN client - "dynamic and fixed IP addressing for all ISP services - dial-up
X	Fwr Command Module	fwr.exe	"Added by the SDBOT-PP WORM!"
N	fwrastrc	fwrastrc.exe	Dial-up software for Friendly Technologies/1NationOnLine free ISP
U	fwservice	fwservice	"eAcceleration Stop-Sign security software related. Previously not recommended
X	FX	ieloader.exe	Added by the SMALL.RR TROJAN!
U	fxredir	fxredir.exe	Canon MultiPASS fax redirector
X	f~a	ra32.exe	"Added by the CAY TROJAN!"
X	g.exe	g.exe	"Added by the GRAYBIRD.Q TROJAN!"
X	G00123	[worm filename]	"Added by the BUGBROS WORM!"
X	G0mez	G0mez.vbs	"Added by the GORMLEZ-A WORM!"
X	G3	GSMedia3.exe	"Malware downloader - recognized by Kaspersky antivirus as Trojan.Win32.VB.ux"
?	g3dctl	g3dctl.exe	"??"
N	Gadu-Gadu	gg.exe	Polish language Instant Messaging client
N	Gadwin PrintScreen	PrintScreen.exe	"Gadwin PrintScreen - utility to capture
X	GAELICUM.EXE	GAELICUM.EXE	"Added by the PENTA-A TROJAN!"
X	gah95on6	gah95on6.exe	"ShopAtHome/SAHagent adware"
U	gaim	gaim.exe	"Gaim is an instant messenger client with capability to connect to AIM
U	Gainward	TBPanel.exe	Configuration utility for Gainward graphics cards. Not required unless you use non-default settings. Available via Start -> Settings -> Control Panel
X	game	shit.exe	Added by the Netclap Gold backdoor TROJAN!
N	Game Device	JOYUPDRV.EXE	Genius game controller profile activator
N	GameDrive	GDTask.exe	"GameDrive Virtual Driver from FarStone Technology
X	Games Acceleration	svshost.exe	"EasySearch adware"
X	Games Acceleration	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Games toolbar	"rundll32.exe [path] tbGame.dll	DllShowTB"
N	GameSpot	kontiki.exe	"Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops"
U	gameutil.exe	gameutil.exe	Part of Redline RegTweak as supplied with Sapphire ATI graphics cards. You can configure different overlclocking settings on a per game basis and this sets those conditions following a re-boot
U	GammaHotKeys	setgamma.exe	"Part of the RadeonTweaker program for adjusting ATI Radeon graphics cards. Allows you to adjust the gamma (or brightness) when playing a full-screen game without switching back to the desktop"
X	gaSrv	gaSrv.exe	"Adware downloader
X	gaSrve	gaSrve.exe	"Adware downloader
X	Gate Personal Firewall	Systpl.exe	"Added by the RBOT.ADC WORM"
N	Gateway Extended Warranty	GWCares.exe	Gateway Extended Warranty reminder
X	Gator	gator.exe	"Gator eWallet adware"
X	Gator eWallet	gator.exe	"Gator eWallet adware"
X	Gay_Sexy_**	Gay_Sexy_**.exe	Premium rate adult content dialler (where * is a random char)
U	GazelDisplay	gsyno.exe	"BT Digital Access USB - Gazel ISDN installation System Tray icon"
Y	GBSpaceMan	SpaceMan.exe	"GreenBorder - secure your browsing activities on the internet"
U	GBTray	GBTray.exe	"System Tray icon access to Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
X	gcasDtServ	gcasDtServ.exe	Added by an unidentified WORM or TROJAN. Note - this is not related to Microsoft Antispyware which has a process bearing the same name which doesn't appear as a startup
U	gcasServ	gcasServ.exe	"Giant Antipsyware - now superseeded by Microsoft Windows AntiSpyware"
X	gcasServ	realsched.exe	"Added by a variant of the TACTSLAY.A TROJAN! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name"
?	GCC Reminder	gccrem.exe	"Associated with AcraMax Greeting Card Creator. Is it a registration reminder?"
N	GCS	GrabClipSave.exe	"GrabClipSave screen capture tool"
X	GDAX	[path to backdoor]	"Added by the RANKY.K TROJAN!"
X	gdien32	gdien32.exe	"Added by the SINGU-P TROJAN!"
U	GDMgr.exe	gdmgr.exe	"GuardMon is a commercial surveillance software program designed to monitor all forms of user activity on a computer"
N	GDrive	GDriver.exe	Found on IBM systems. All it does is set the CDROM drive letter to G:. Set your drive letter manually via Start -> Settings -> Control Panel -> System -> Device Manager
N	Gearbox	confsvr.exe	"NTL's Gearbox software for configuring internet connections with their NTLWorld software - does a similar job to the Internet Connection Wizard which can be used instead using the dial-up details available here"
N	GEARsec	gearsec.exe	Installed by Apple Quicktime package - iPod/iTunes CDRW support. Can be disabled if you only require Quicktime player
X	GEDZAC	GEDZAC.exe	"Added by the GEMEL WORM!"
N	GemStRmW	GemStRmW.exe	"For a GemPlus smart card reader. If it doesn't start automatically when you insert the smart card
U	Gene USB Monitor	USBMonit.exe	Monitors USB ports for insertion of Sandisk USB flashdrives
X	general lptt01	general.exe	"RapidBlaster variant (in a ""General"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	general ml097e	general.exe	"RapidBlaster variant (in a ""General"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Generic host proccess for windows	SVCHOSTS.EXE	"Added by the SPYBOT-GQ WORM!"
X	Generic Host Process	SCHOST.EXE	"Added by the RBOT-NC WORM!"
X	Generic Host Process	svchost.exe	"Added by the DLOADER-NX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	Generic Host Process for Win32 Services	ntspcv.exe	"Added by the SDBOT.S TROJAN!"
X	Generic Host Process for Win32 Services	intspvc.exe	"Added by the DINFOR.D WORM!"
X	Generic Host Process for Win32 Services	winsvc.exe	"Added by the SDBOT-O WORM!"
X	Generic Host Process for Win32 Services	bazzi.exe	"Added by the AHKER.E WORM!"
X	Generic Host Process for Win32 Services	winsvc32.exe	"Added by the SDBOT-P WORM!"
X	Generic Host Process2 System Backup	scvhost2.exe	"Added by the RBOT-BAH WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list