Arcade File Downloads Support Forum
Email
Confirm email
Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown
Startup Name Process Name Details
U IntelliPoint point32.exeMicrosoft Intellipoint software for their Intellimouse series of mice - required if you use non-standard Windows driver features
U IntelliPoint ipoint.exeMicrosoft Intellipoint software for their Intellimouse series of mice - required if you use non-standard Windows driver features
U Intellitype type32.exe"For MS programmable keyboards. If you disable Intellitype in Startup any ""Hot Keys"" that are changed by the user to perform functions other than default settings defer back to their default settings. Not required unless you have changed them"
U IntelMEM IntelMEM.exeRelated to connection events on an Intel chipset based modem. It can alert you if the telephone line is being used when you're trying to get online (when you're using dial-up). It can also alert you if your modem line is disconnected. Furthermore it can alert you if you have made a wrong connection with your modem line
U IntelProcNumUtility cpunumber.exe"Intel Processor Serial Number Control Utility allows you to enable and disable the processor serial number capability of an Intel PIII processor. You can find more information here. System Tray icon providing the user with a visual state indication. You can find more information here"
Y IntelWireless ifrmewrk.exeAssociated with the Intel PRO/Set Wireless software
U IntelZeroConfig ZCfgSvc.exe"Zero Config MFC Application part of Intel's ProSET utilities and installed by the drivers for many of Intel wireless network cards - essential to the proper functioning of many of the Intel ProSET utilities (but not all) and these System Tray ProSET utilities are a must if you are using your wireless connection if only so you know when the signal is fading or dropping. The problem is that in some PCs ZCFGSVC can be incredibly badly behaved : taking up to 100% of CPU time and therefore resulting in an extremely slow PC preventing the installation of software or Windows updates or causing ""Not Responding"" or ""End this Program"" shutdown problems. If you experience this try first the very latest drivers from Intel or your laptop manufacturer. If that still does not solve the problem and you have WinXP/2003 try setting the ""Wireless Zero Configuration"" service to disabled"
? Intense Registry Service IntEdReg.exe /CHECK"Intense Educational Ltd - Language Office Software. Is it required?"
X InterceptedSystem [path to worm]"Added by the ANACON-B WORM!"
Y InterCheck Monitor Icmon.exe"Part of Sophos ant-virus sofware"
Y InterCheckMonitor ICMON.EXE"Part of Sophos anti-virus sofware"
X Interdll Interdll.exe"Added by the DELF family of TROJANS!"
X Internal [trojan filename]"Added by the SMOTHER and TRANSLAT TROJANS!"
X Internal regedit.exe /s %windir%c:[month number]"Added by the FORTNIGHT.D TROJAN!"
X Internal Memory File sysintmemory.exe"Added by the RBOT-GKT WORM!"
X InternalSystray Kazza.exe"Added by a variant of the OPTIX TROJAN! Note - unlike the valid KaZaA executable this is located in C:WindowsSystem (Win9x/Me) C:WinntSystem32 (WinNT/2K) or C:WindowsSystem32 (WinXP)"
X Internat systray.exe"Added by the ALADINZ.P TROJAN! Note - this is not the legitimate systray.exe process. If you right-click on the real systray.exe the ""Properties"" reveal it to be a Microsoft file"
X internat internat.exe"Added by the LYDRA-F TROJAN! Note - the real internat.exe resides in %windir%\system (where %windir% is the Windows directory - C:\Windows or C:\Winnt) whereas this version resides in %windir%"
X Internat msgsrv32.exe"Added by the NYRUBOT-A WORM!"
X Internat [trojan filename]"Added by the CMJSPY-Y TROJAN!"
X Internat Conf bootconf.exe"Homepage hijacker redirecting to coolwwwsearch.com; see for example here"
N internat.exe internat.exeMicrosoft language selection icon in system tray located in the System (Win98/Me) or System32 (WinNT/2K/XP) folder
X Internat.exe internat.exe"Added by the NETSNAKE TROJAN! Note - the real internat.exe resides in %windir%system (Win98/Me) or %windir%System32 (WinNT/2K/XP) (where %windir% is the Windows directory - C:\Windows or C:\Winnt) and has a ""?"" icon wheras this version resides in %windir% and has a ZIP icon"
X internct WinSocks5.exe"Added by the GRAYBIRD.F TROJAN!"
X internet smss.exe"Added by the MIFENG-K TROJAN! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup!"
X Internet Internet.exe"Added by the PWS-CS TROJAN!"
X Internet recruit.exe"Added by the RBOT-AJG WORM!"
X internet [trojan filename].exe"Added by the MIFENG-D TROJAN!"
X Internet winlogom.exe"Added by a variant of the SDBOT WORM!"
X Internet nteusodp.exe"Added by the RBOT-GFJ WORM!"
X internet winsas32.exe"Added by a variant of the SDBOT WORM!"
X internet lsass.exe"Added by the DSPY-A TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X Internet alm7tas.exe"Added by a variant of the RBOT WORM!"
X Internet wins.exe"Detected by PCTools as the RBOT.AAYF WORM! See here"
U Internet Answering Machine IAMNET~1.EXE"From Callwave. It offers a free utility to monitor your incoming phonecalls if you only have a single telephone line for internet access"
U Internet Answering Machine IAM.exe"From Callwave - offers a free utility to monitor your incoming phonecalls if you only have a single telephone line for internet access"
X Internet Application Driver expIorer.exe"Added by the IRCBOT-WK TROJAN!"
U Internet Call Director ICD.EXE"TELUS Internet Call Director (ICD) provides Internet users with real-time call notification while connected to the Internet"
U Internet Call Manager ICM.EXE"Starts Internet Call Manager dialog box and/or taskbar icons at bootup. This is a subscription program from internetcallmanager.com that monitors a dialup phone line for incoming calls and handles voicemail"
X Internet Config svchosts.exe"Added by the SDBOT TROJAN!"
X Internet Connection Wizard stisvsq.exe"EasySearch adware"
X Internet Connection Wizard [path to trojan]"Added by the SMUTSRCH-A TROJAN!"
X Internet Connection Wizard stisvsq1.exe"Added by the DLOADR-AWD TROJAN!"
X Internet Content Publisher ICP.EXE"Added by the RBOT-UD WORM!"
U Internet Disk Cleaner CLEARH~1.EXE"""Internet Disk Cleaner from Elongsoft ""protects your privacy by cleaning up all Internet tracks and past computer activities"""
U Internet Download Accelerator ida.exe"Internet Download Accelerator download manager"
X Internet download manager service idman.exe"Added by the RBOT-BMS WORM!"
X Internet Exploere Services urlmon32.dll.exe"Added by the EVIAN.C WORM!"
X Internet Explore Microsoft lEXPLORE.EXE"Added by the RBOT-AOF WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X Internet Explorer iexplorer.exe"Added by the LORSIS WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X Internet Explorer IEXPLORE.EXE"Added by the RBOT-EY WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X Internet Explorer IExplorer.exe"Added by the NETHIEF-O BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X Internet Explorer http.exeAdded as part of a new potential CWS infection and part of a suite of programs that installs a web server php ftp server socks and mail server on your computer without your knowledge. These files are known to be part of an infection that transmits information about your bank accounts passwords and other financial information. It should be deleted immediately you should enable your firewall and you should contact your financial services in order to report the issue and to have your passwords changed
X Internet Explorer iexpiore.exe"Added by the RBOT-AZC WORM!"
X Internet Explorer Configuration IEXPLORE.EXE"Added by the SDBOT-UL WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X Internet Explorer Security iexplore.pif"Added by the RBOT-ALQ WORM!"
X Internet Explorer Updater lexbac.exe"Added by the DOWNLOAD TROJAN!"
X Internet Explorer Updater iexplorer.exe"Added by the REUR.B WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X Internet Explorer6 IEexplore.exe"Added by the RBOT.AGC WORM. Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X Internet Firewall Layer tsqla.exe"Added by a variant of the SPYBOT WORM!"
U Internet History Eraser HERASER.exe"Internet History Eraser - deletes your browsing tracks"
X Internet Loader1 MSInstall61.exe"Added by the KWBOT.B WORM!"
X Internet Mail and News msqdevl.exe"EasySearch adware"
X Internet Mail and News [path to trojan]"Added by the SMUTSRCH-A TROJAN!"
X Internet Mail and News msqdevl1.exe"Added by the DLOADR-AWD TROJAN!"
X Internet Optimizer optimize.exe"Internet Optimizer parasite - detected by Sophos as the DLUCA-G TROJAN and variants"
X Internet Protocol Configuration Loader ipcl32.exe"Added by the SDBOT TROJAN!"
X Internet Security Service msq32.exe"Added by the RBOT-GFP WORM!"
X Internet Security Service msq23.exe"Added by the RBOT-GQL WORM!"
X Internet Security Service msql23.exe"Added by the RBOT-GML WORM!"
X Internet Security Service mysqlwin32.exe"Detected by Trend Micro as the RBOT.UX TROJAN! See here"
X Internet Send More log.exeUnidentfied adware
X Internet Server inetsrv.exe"Added by the STARTPA-EM TROJAN!"
X Internet Service intersvc.exe"Added by the SPYBOT-DE WORM!"
X internet service syscfg32.exe"Added by the RBOT-QS WORM!"
X internet service ssvhost.exe"Added by a variant of the RBOT WORM!"
X internet service svho0st98.exe"Added by the RBOT.EAT WORM!"
X Internet Services systemdev.exe"Added by the SDBOT-PW WORM!"
X Internet Services internet.exe"Added by the MYTOB.BT WORM!"
X Internet Services interserv.exe"Added by the RBOT.BNT WORM!"
X Internet Services Netsvc.exe"Added by the MYTOB.MN WORM!"
X INTERNET SERVISES winz32.exe"Added by the KWBOT.Z WORM!"
Y Internet Sharing Server iss_srvr.exe"Intel AnyPoint internet sharing software. Now discontinued"
X Internet Suspention story.exe"Added by the WOOTBOT.HV WORM!"
N Internet Sweeper Sweeper.exe"Internet Sweeper - removes unnecessart left over files after browsing the internet"
U Internet Timer ITIMER.exe"Shareware dial-up connection call cost calculator from Ratsoft"
X Internet Washer Pro iw.exe"Internet Washer manages temporary browser files cookies etc - a 'trial' Internet Washer Pro seems to have been widely stealth-installed around March 2003"
X Internet.exe Internet.exe"Added by the MAGICCALL VIRUS!"
X internet.exe yinyin3345.vbs"Added by the YINI MACRO!"
X Internet2 Optimizer wkfix.exe"Added by a variant of the RBOT WORM!"
N InternetCalls InternetCalls.exe"InternetCalls - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X InternetExplorer2 windows.exe"Added by the SDBOT-CZP WORM!"
X InternetExplorer32 iexplore32.exe"Added by the RBOT-GRA WORM!"
X InternetShield INTERN~1.EXE"InternetShield misleading security software - not recommended see here"
U InternetSpy InternetSpy.exe"Internet Spy - freeware keylogger that tracks all visited websites including the date and exact time these sites were visited. The information is stored in a file that may be accessed by the person who knows where it is saved. Remove unless you installed it yourself!"
X InternetWasherPro iw.exe"Internet Washer manages temporary browser files cookies etc - a 'trial' Internet Washer Pro seems to have been widely stealth-installed around March 2003"
X INTERNET_SERVISES winz32.exe"Added by the SDBOT.Q TROJAN!"
U InternodeUsage mum.exeAustralian ISP's free monthly download meter
X Internt Internt.exe"Added by the PEEPER or CARUFAX.A TROJANS!"
X Intersoft Msngr intersoftmsngr.exe"Added by the AGOBOT-NW WORM!"
N InterTrust Quick Start it_cpq~1.exe"InterTrust offers something known as Digital Rights Management to control legal software download and other E-commerce related business"
X InterU WINDRV.EXE"Added by the IRCINTER.A TROJAN!"
N Intervideo Win Cinema Manager WinCinemaMgr.exe"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N Intervideo Win Cinema Manager WINCIN~1.EXE"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N Intervideo WinCinema Manager WinCinemaMgr.exe"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N Intervideo WinCinema Manager WINCIN~1.EXE"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N Intervideo WinScheduler WinScheduler.exe"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card you will need it. Available via Start -> Programs"
N Intervideo WinScheduler SchSvr.exe"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card you will need it. Available via Start -> Programs"
N InterVoip InterVoip.exe"InterVoip - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
U InterWARN interwarn.exe"InterWARN by Storm Alert Inc. Provides customized automated access to critical weather and civil emergency information from the US National Weather Service. Required if audio and screen crawler alerts are desired. Also available via Start -> Programs"
X Intespention IEXPLORE.exe"Added by the FORBOT-FL WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X Intmgr Intmgr.exe"Added by the GEMA TROJAN!"
X intranet SYS32CFG.EXE"Added by the SPYBOT-DW WORM!"
X Intranet intranet.exe"Added by the CHIMOZ.AC TROJAN!"
X Intranet schost.exe"Detected by Kaspersky as the RBOT.SV BACKDOOR! See here"
X Intranet Explorer [random filename]"Detected by Trend Micro as the POEBOT.DK BACKDOOR! See here"
X Intrenat Intrenat.exe"Added by the LEMIR.E TROJAN!"
N Introducing Media Manager SPLASHA.EXE"MS Media Manager tour. Not required"
N Introduction-Registration ??For Compaq PC's. Should only run first time PC Introduction & Compaq registration
X IntruderAlert ia99.exe"Intruder Alert '99 from Bonzi - spyware"
X IntSys1 [path to trojan]"Added by the BANLOA-ASE TROJAN!"
U Inventory Scan LDISCN32.EXE"LANDesk® Management Suite software component"
X Ioadqm Media Player.exe"Added by the HAWAWI WORM!"
N iobi iobiClient.exe"iobi Home - a mail/voice service by Verizon"
Y iolo AntiVirus ioloAV.exe"iolo AntiVirus"
Y iolo Personal Firewall ioloFW.exe"iolo Personal Firewall"
U Iolo Task Agent Task_Agent.exe"Iolo System Mechanic Task Agent. Scheduled maintenance"
N iolo Utility Bar SMUtilityBar.exe"Iolo System Mechanic Utility Bar - can be launched manually"
U ioloDelayModule delay.exe"Part of Iolo System Mechanic. Used to delay the start of an application which loads automatically as Windows loads"
U Iomega Automatic Backup ibackup.exe"Iomega Automatic Backup - automatic backups for use with Iomega portable HDD"
U Iomega Automatic Backup 1.0.1 ibackup.exe"Iomega Automatic Backup - automatic backups for use with Iomega portable HDD"
N Iomega Backup Scheduler dtiom98.exe"Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs"
U Iomega Disk Icons IMGICON.EXE"Displays Iomega icons in Explorer/My Computer ejects Zip disks on shutdown and displays a special delete confirmation box when deleting files on an Iomega drive. Available via Start -> Programs. If you disable it remember to eject disks first before powering the drive down - hence the ""U"" recommendation. Note - FreeCell may not run with ImgIcon running"
U Iomega Drive Icons IMGICON.EXE"Displays Iomega icons in Explorer/My Computer ejects Zip disks on shutdown and displays a special delete confirmation box when deleting files on an Iomega drive. Available via Start -> Programs. If you disable it remember to eject disks first before powering the drive down - hence the ""U"" recommendation. Note - FreeCell may not run with ImgIcon running"
U Iomega ImIconXP imiconxp.exe"Iomega REV System Software - allows your Iomega REV drive to interact with the operating system via the Iomega REV UDF file system and provides drag-and-drop file access access and write protection and formatting of the disks"
? Iomega QuickSync Quicksync.exe"??"
N Iomega Startup Options IMGSTART.EXE"Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs"
N Iomega Watch IOWATCH.EXEUsed by Iomega drives. Available via Start -> Programs
N IomegaWare COMMANDER.EXE"Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs"
X Iomega_loader Iomega_loader.exe"Added by the ANTINNY.F WORM!"
U Iomon98.exe Iomon98.exePC-Cillin 98 real time virus check. Can cause floppy disk accesses to hang
X ioroxxo microsoft sux system32.exe"Added by a variant of the RBOT WORM!"
X IP Packet Redirect Service ipredirect.exe"Added by the FORBOT.SM WORM!"
X IP Stack ipstack.exe"Added by the AGOBOT.CW WORM!"
X IP**.exe [* = random char] IP**.exe [* = random char]"CoolWebSearch/HomeSearch adware - for examples see this log"
X IP**32.exe [* = random char] IP**32.exe [* = random char]"CoolWebSearch/HomeSearch adware - for examples see this log"
N iPalm mon.exe"Installed with a Panasonic iPalm digital camera. Used to upload photos from the camera. If your camera is not connected (via USB port) you do not need this program loaded"
X IPC Connection ipcconn.exe"Added by the RBOT-AEG WORM!"
X IPC Spool Manager wnmgre.exe"Added by the SDBOT-ZC WORM!"
X IPC Spool Manager winspec.exe"Added by the SDBOT-BLU WORM!"
X ipcfg.exe ipcfg.exe"Adware - detected by McAfee as a variant of the ADCLICKER-BM TROJAN!"
X IPConfig svcxnv32.exe"Added by the HACARMY.E TROJAN!"
X IPConfig svcxnw32.exe"Added by a variant of the HACARMY.E TROJAN!"
X IpCtrl ipcon32.exeAdded by an unidentified VIRUS WORM or TROJAN!
X IPFW ipwf.exe"Added by the DLOADER-YF TROJAN!"
? IPHSend IPHSend.exe"AOL related. What does it do and is it required?"
X IPInSightLAN 0* ipclient.exe"Installed with Verizon DSL accounts. IP Insight is a Quality of Service monitor and diagnostic tool that isn't required - see here for more information. This one constantly ""phones home"" and wastes resources. * represents 1 or 2"
N IPInSightMonitor 0* ipmon32.exe"Installed with Verizon DSL accounts. IP Insight is a Quality of Service monitor and diagnostic tool that isn't required - see here for more information. * represents 1 or 2"
Y IPinst N/AFor Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out
X IPLog Security iplogsec.exe"Detected by Trend Micro as the IRCBOT.GP BACKDOOR! See here"
? iPlusAgent2 iAgent2.exe"Related to iriver portable media products. What does it do and is it required?"
X ipmon.exe ipmon.exe"Added by the RECERV or R3C.B TROJANS!"
X IpNetwork ipnetwork.exeMaxifiles adware
X Ipnuker Ipnuker.vbs"Added by the INKER.B WORM!"
N IPO3 IP Operator 2005.exe"IP Operator 2005 - found on LG Electronics Notebook. The applet makes network connections easier to view and manage than does the standard Windows Network Connections tool. The WLAN module is easy to turn on or off with the press of a single button"
X Ipod Help [9 random letters].exe"Added by a variant of the RBOT WORM!"
X iPOD USB Driver IPODUSB.EXE"Added by a variant of the RBOT WORM!"
X iPod USB Service iPODService.exe"Added by a variant of the RBOT WORM! Do NOT confuse with the Apple iPod process of the same name. The legitimate iPod file will always be located in the Program FilesiPodin folder and is implemented as a system service thus NOT listed in Msconfig/Startup!"
U iPodManager iPodManager.exeApple iPod® management software for the iPod® player - updates formating restoring and other functions associated with the iPod®
? iPodWatcher iPodWatcher.exe"Associated with Apple's iPod® player. Detects when the iPod® is connected?"
X IPOT Service Drivers compaq.exe"Added by a variant of the FUROOTKIT TROJAN!"
X IPOT USB Service DRIVER hpsebc087.exe"Added by the SDBOT-WA WORM!"
X IPOT USB Service DRV32 hpsebc08.exe"Added by the SDBOT-WH WORM!"
N IPPDetect IPP4Detect.exe"Part of Presto! Mr.Photo - ""an ideal program for creating sharing and manag-ing digital images and videos"""
X ipreg ipreg.exe"Added by the ZAGABAN-H TROJAN!"
? iPrint LPT Redirector nipplpte.exe"Related to Novell iPrint - ""a printing solution that enables you to send documents to printers located throughout the Net."" Is it required?"
N iPrint Tray iprntctl.exe"Novell? iPrint - based on Novell Distributed Print Services - enables you to send documents to printers located throughout the Net"
U iProtectYou ip.exe"iProtectYou - internet filtering/parental control and network monitoring software"
X iprun iPY.exe"iProtectYou spyware"
X iPSec7 ipsec7.exe"Detected by Trend Micro as the AGENT.AHVR TROJAN! See here"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list