HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
U	MDM7	mdm.exe	"Used by developers for debugging. Those who have encountered it have unchecked it with no degradation in performance. May cause your computer to ""hang"" if you have MS Visual Studio installed and this disabled because it appears to take over error handling - hence the U recommendatioon. Can also be listed as Machine Debug Manager. See here to disable"
X	Mdmdll	mdmdll.exe	"Added by the CRYPTER TROJAN!"
X	Mdmdll32	mdmdll32.exe	"Added by a variant of the CRYPTER.C TROJAN!"
X	MDN	MDNS.exe	"Added by the SPYBOT.JPB WORM!"
X	MDN	MDNZ.exe	"Added by the RBOT.AQD WORM!"
X	MDN	MDN.exe	"Added by the RBOT.AOA WORM!"
X	MDNS	service.exe	"Mirar adware variant"
X	mds.exe	mds.exe	"Added by the MADS-A TROJAN!"
X	MDSA Sentinel X	smss.exe	"SentinelX spyware. Note - SentinelX is spyware that logs keystrokes. It also monitors and records Web sites visited and applications used. The risk can capture periodic screen shots and may be configured so as to block access to specific Web sites and chat rooms must be manually installed. Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a ""MDSA Software"" subfolder of the Program Files folder"
X	mdwmdmsp	mdwmdmsp.exe	"Adware - detected by Kaspersky as the AGENT.AM TROJAN!"
N	MECA	Meca.exe	"Meca cross-platform communications technology branded messengers will connect with AOL MSN Yahoo! and ICQ users"
X	MedGS	MEDGS1.exe	"PacerD_Media/Pacimedia.com adware"
X	Media Access	MediaAccK.exe	"WindUpdates MediaPass adware"
X	Media Adapter	bitblt.exe	"Added by the HANSAH-A WORM!"
U	Media Card Companion Monitor	MCC Monitor.exe	"Monitor for Media Card Companion from ArcSoft. ""Automates the tedious processes associated with downloading and sharing files from digital cameras card readers and other removable media"""
U	Media Codec Update Service	update.exe	"Windows Essentials Codec Pack 1.0 is a collection of the most commonly needed video and audio codecs. This program allows keeps these codecs updated"
X	Media Gateway	MediaGateway.exe	"WindUpdates MediaPass adware"
X	Media Load	msn32.exe	Added by a unidentified WORM or TROJAN!
U	Media Manager Indexer	AIRSVCU.EXE	Part of MS Visual InterDev Media Manager is an easy media file management system that works in conjunction with Windows Explorer. The Media Manager Indexer is a program that indexes all the information about your media files and puts it into a database
X	Media Pass	MediaPassK.exe	"WindUpdates MediaPass adware"
X	Media Pass	MediaPass.exe	"WindUpdates MediaPass adware"
X	Media Player	media.exe	"Added by the FLDMEDIA-A TROJAN!"
X	Media Player	wmplayer.exe	"Added by the AGOBOT-BM WORM!"
X	Media Player	Sysdll.exe	"Added by the BANKER-BR TROJAN!"
X	Media Player	Sysnet.exe	"BANKER.MW spyware"
X	Media Player Update	xpsp1mfh.exe	"Added by a variant of the RBOT WORM!"
X	Media Plug x.1.2	msdm.exe	Added by the MULDROP.352 VIRUS!
X	Media Server	msdts.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Media Service	msn64.exe	"Added by the SPYBOT.EV WORM!"
X	Media service	msnmsgxr.exe	"Added by the SDBOT.TF WORM!"
X	Media service	SYSTEM64.EXE	"Added by the RBOT.QV WORM!"
X	Media service	notpad.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Media Software UPdater	sscs.exe	"Added by the RBOT-ABE WORM!"
X	Media Transfer Protocals	msstc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Media X Services	MSNGRx.exe	"Added by the RBOT.AUL WORM!"
X	Media-XP-Service-Pack3	msnzx.exe	"Added by the SDBOT-ACW WORM!"
X	MEDIA32	[path to trojan]	"Added by the PURSCAN-Z TROJAN!"
U	MediaButtons	MediaButtons.exe	"Supports the eject button on the front on the Dell Studio Hybrid desktop. If disabled the user will have to eject the CD/DVD by opening My Computer right-clicking on the drive and selecting ""Eject"" from the available options"
N	MediaFace Integration	Sethook.exe	"Fellowes Neato? cd label design software. ""Launch NEATO's MediaFACE II label making software directly from the productname toolbar"""
U	Mediafour Mac Volume Notifications	MACVNTFY.EXE	"Part of MacDrive 6 CrossStripe Edition from Mediafour Corporation - ""a perfect way to share files between Mac OS and Windows."" Unlike the standard version of MacDrive 7 this version is not Vista compatible but does ""include support for striped Mac arrays created with ATTO ExpressStripe software."""
U	Mediafour MacDrive	MacDrive.exe	"MacDrive 7 & MacDrive 6 CrossStripe Edition from Mediafour Corporation - ""a perfect way to share files between Mac OS and Windows."" Version 6 is not Vista compatible but doesn ""include support for striped Mac arrays created with ATTO ExpressStripe software."""
U	Mediafour MacDrive	MDDiskProtect.exe	"Part of MacDrive 6 CrossStripe Edition from Mediafour Corporation - ""a perfect way to share files between Mac OS and Windows."" Unlike the standard version of MacDrive 7 this version is not Vista compatible but does ""include support for striped Mac arrays created with ATTO ExpressStripe software."""
U	Mediafour MacDrive	MDGetStarted.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista XP and 2003 Server to seamlessly access Mac disks (HFS/HFS+) of all types including CDs DVDs hard drives floppy Zip Jaz and more!"""
U	Mediafour XPlay Tray Notification Icon	Xptryicn.exe	"Mediafour Xplay - allows you to use an Apple iPod digital music player with a PC running Windows. If not used regularily start manually before connecting the iPod"
U	Mediafour XPlay Tray Notification Icon	Xptryicn.exe	"Xplay 2 from Mediafour Corporation - ""expands what you can do with any iPod including the iPhone and touch and a Windows computer."" No longer supported"
U	MediafourGettingStartedWithMacDrive6	MacDrive.exe	"MacDrive 6 CrossStripe Edition from Mediafour Corporation - ""a perfect way to share files between Mac OS and Windows."" Unlike the standard version of MacDrive 7 this version is not Vista compatible but does ""include support for striped Mac arrays created with ATTO ExpressStripe software."""
U	MediaKey	MediaKey.exe	"Multimedia keyboard manager. Required if you use the multimedia keys"
U	MediaLifeService	MediaLifeService.exe	"Related to MediaPlay Cordless Mouse from Logitech"
X	MediaLoads	dw.exe	"Medialoads adware"
X	MediaLoads Installer	dw.exe	"Medialoads adware"
N	MediaMonitor	Mediam~1.exe	Installed by Smartdisk MVP CD burning software. Software will work fine without it
X	mediamotor.exe	mmups.exe	"Added by the AGENT-BY TROJAN!"
X	MediaPath	Proyecto1.exe	"Added by the GRUEL WORM!"
X	MediaPath	Root.exe	"Added by the GRUEL WORM!"
X	MediaPipe P2P Loader	mpp2pl.exe	"MediaPipe peer-to-peer file swapping program also reported as a hijacker"
X	mediapluscash.exe	mediapluscash.exe	"MediaGateway adware"
N	MediaRing Talk	mrtalk.exe	Media Ring Talk voice recognition software Resource hog. Available via Start -> Programs
X	MediaXPServicePack	mxpsp.exe	"Added by the SDBOT.CDT WORM!"
X	media_manager	mediaman.exe	Mini-Player IMESH related foistware
X	media_stub	stub.exe	Mini-Player IMESH related foistware
U	MEDIC	sprtcmd.exe /P MEDIC	"Self-help support tool for an unidentified high-speed internet provider (provided by SupportSoft Inc). Identifies and automatically fixes typical problems that may occur with your high-speed internet service"
X	Medichi	medichi.exe	"Added by the VIRANTIX.B TROJAN!"
X	Medichi2	medichi2.exe	"Added by the VIRANTIX.B TROJAN!"
?	MedionVFD	MdionLCM.exe	"Related to Medion Display Information. What does it do and is it required?"
X	Meeting Connection	comsutil.exe	"Added by the PPDOOR-E TROJAN!"
X	Meeting Connection	wowdache.exe	"Added by the PPDOOR-D TROJAN!"
X	Meeting Connection	hgakdl32.exe	"Looks like a variant of the PPDOOR-E TROJAN!"
U	MegaPanel	HSTrans.exe	"Homescan Internet Transporter - part of ACNielson Homescan. Recognizes when the ACNielsen Homescan Scanner is attached to the computer and allows it to transmit scanner information to ACNielsen"
?	meidntpa	vqgdpfrs.exe	"??"
X	melg34	mdmd.exe	"Added by an unidentified WORM or TROJAN - see here"
X	melg3445	mdmdd.exe	"Added by a variant of the RBOT WORM!"
X	mem32	mem32.exe	"Added by the AGENT-FWF WORM!"
X	Members area	******.exe [* = random digit]	Premium rate adult content dialer
X	MemConfig	SetupIE.com	"Added by the TAPLAK WORM!"
N	Memento	Memento.exe	"Memento - simple app to keep text notes on your desktop"
U	MemMonster	memmnstr.exe	"MemMonster - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
U	MemoKit	MK.EXE	"Memory optimizer. It loads from startup group and it goes off as soon as the program (memokit.exe) is loaded in the System Tray. Mk.exe does not run while the memokit.exe is running. Probably loads a flash screen at startup and shutdown that stays on screen less than 5 seconds and gives you a button to push to purchase the full version. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
X	memory	outlookrem.exe	"Added by the NOPIR.C WORM!"
X	Memory Allocation Host	cihost.exe	"Detected by Avast as a variant of the IRCBOT-CHZ WORM!"
X	Memory Allocation Server	ciserv.exe	Added by an unidentified malware
X	Memory Allocation Services	cisrv.exe	"Detected by Trend Micro as the IRCBOT.FC TROJAN! See here"
X	Memory Check	memore.exe	"Added by the KILLAV.C TROJAN!"
X	Memory manager	himem32.exe	"Added by the MANCSYN TROJAN!"
X	Memory Manager	memorymanager.pif	"Added by the DELF-JJ TROJAN!"
X	Memory relocation service	reloc32.exe	"Added by the RELFEERWORM!"
X	Memory Service	freememory.exe	Added by the RBOT.GEN WORM!
N	Memory Stick Monitor	MSTAT.exe	Used with the Sony floppy disk adapter for memory sticks showing if there is a stick in the computer
U	Memory Stick Monitor	MSstat.exe	Sony/SmartDisk memorystick-floppydisk-adapter software - allows you to read memorysticks in a normal floppydrive
X	Memory Watcher	MemoryWatcher.exe	"MemoryWatcher spyware"
U	Memory+	tfimemsr.exe	"Memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
U	MemoryBoost	MemoryBoost.exe	"MemoryBoost - memory optimizing program made by Tenebril Inc. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/ME. See this article and make up your own mind"
U	MemoryCardManager	MemCard.exe	"Memory Card Manager - for removable memory cards found on Dell or Lexmark photo printers"
X	MemoryManager	[random name].dll	Virtumondo adware related
X	MemoryMeter	MemoryMeter.exe	"MemoryMeter - bundled with TVMedia adware"
U	MemoryZipperPlus	memzip.exe	"Memory Zipper Plus - ""optimizes the memory management of your system and boost-up its performance amazingly!"""
X	memreader.exe	memreader.exe	"Added by the AGOBOT-TY WORM!"
X	MEMreaload	MEMreaload.exe	"Added by the LAZAR TROJAN!"
X	MemScanner	MemScanner.exe	"Part of Enigma SpyHunter - not recommended see note"
U	MemTurbo	memturbo.exe	"MemTurbo memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
N	MenuSnap	MenuSnap.exe	"MenuSnap from Rietta Solutions. Utility that re-orders your Start Menu items alphabetically. You may not want this utility if you're able to do this manually by selecting Start -> Programs and right-clicking and choosing "Sort by Name" if availabe"
N	Mercora	MercoraClient.exe	"Mercora MusicSearch ""Search find and listen to music on the world's largest jukebox built by people just like you"". Note - if you subscribe make sure you read the Privacy Policy"
X	Message Queuing	msmqs.exe	"Added by the FREEFORS TROJAN!"
N	MessagerStarter Freeserve	StartMessager.exe	Freeserve Messenger
U	Message_Blocker	messageblock.exe	"Message Blocker - "prevents Outlook Express from loading images or other content from the internet without confirmation as well as executing scripts when displaying a formatted email message""
X	Messanger	trillian.exe	"Added by the RBOT.CKI WORM!"
X	Messanger	deamon.exe	"Added by the TACTSLAY.C TROJAN!"
X	Messanger	msgaol.exe	"Added by the TACTSLAY.C TROJAN!"
X	Messanger	s_menu.exe	"Added by the TACTSLAY.C TROJAN!"
X	Messanger	browse.exe	"Added by the TACTSLAY.C TROJAN!"
X	Messenger	messenger.exe	"Added by the KUTEX TROJAN!"
X	Messenger	ntsubsys.exe	"Added by the SDBOT.BGE WORM!"
X	Messenger	Wmsngr.exe	"Added by a variant of the RBOT WORM!"
Y	Messenger	SCANMSG.EXE	"AntiVirus Quick Heal - virus protection"
X	Messenger Block	msngrblock.exe	"Added by the PATOO WORM!"
X	Messenger Journel	usnsvc.exe	"Detected by Trend Micro as the RBOT.FKT WORM! See here"
X	Messenger Protocol	netsender.exe	"Added by the SDBOT-ACC WORM!"
X	Messenger Service	msmsgs.exe	"Added by the SDBOT-ZB WORM!"
X	Messenger Service	nvhost.exe	"Added by the JLOK-A WORM!"
X	Messenger Service Updater	svshost.exe	"Added by the MYTOB.GC WORM!"
X	Messenger Sharing Control	mnwsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Messenger start-up	Msgran.exe	"Added by the GRAMOS WORM!"
X	Messenger6	command.pif	"Added by the INZAE.B WORM!"
U	MessengerDiscovery	MessengerDiscovery.exe	"MessengerDiscovery is a MSN Messenger add-on - adding over 70 new features. Now superseded by MessengerDiscovery Live - with support added for Windows Live"
N	MessengerPlus	MsgPlus.exe	"MessengerPlus - third party MSN Messenger extension that adds a number of useful features. Bundles the hard to remove C2Media LOP adware. The software does offer you a choice during setup - make sure to install MessengerPlus WITHOUT that ""sponsor program""!"
N	MessengerPlus2	MsgPlus.exe	"MessengerPlus - third party MSN Messenger extension that adds a number of useful features. Bundles the hard to remove C2Media LOP adware. The software does offer you a choice during setup - make sure to install MessengerPlus WITHOUT that ""sponsor program""!"
N	MessengerPlus3	MsgPlus.exe	"MessengerPlus - third party MSN Messenger extension that adds a number of useful features. Bundles the hard to remove C2Media LOP adware. The software does offer you a choice during setup - make sure to install MessengerPlus WITHOUT that ""sponsor program""!"
X	messengerskinner	MessengerSkinner.exe	"Messenger Skinner malware - uses a rootkit to hide executable files"
X	messnger	[worm filename]	"Added by the DELODER WORM!"
X	messnger	Dvldr32.exe	"Added by the DELODER.A WORM!"
N	Metacafe	MetacafeAgent.exe	"Metacafe - video sharing on the web. Note - if you subscribe make sure you read the Privacy Policy"
X	MeTaLRoCk (irc.musirc.com) has sex with printers	metalrock-is-gay.exe	"Added by the RANDEX.Q WORM!"
X	MeuPrograma	accwizz.exe	"Added by the RULAND.A WORM!"
X	Mfc**.exe [* = random char]	Mfc**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples see this log"
X	Mfc**32.exe [* = random char]	Mfc**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples see this log"
?	mfgboot	??	"??"
X	mFilter	MNeck.exe	"Added by the CLICKER-AG TROJAN!"
X	mfin32	mfin32.exe	MyFreeInternetUpdate - adware downloader
Y	MFP Server Agent	MFPAgent.exe	"Multi Function Printer (MFP) Server Agent for Belkin's Wirless G All-in-One Print Server and ZyXEL's NPS-520"
?	MGA Hook	Mgahook.exe	"MATROX Graphics card related. What does it do and is it required?"
N	MGA Quickdesk	MGAQDESK.EXE	For Matrox video cards. Quick access to tweak your card to your liking
U	Mgabg	Mgabg.exe	Matrox BIOS Guard - monitors a Matrox card's BIOS and will reflash it when needed. Cards like the G400 have a nasty habit of losing their BIOS especially on poor power supplies. If you make an emergency BIOS disk with the utility in their BIOS package you can disable Mgabg.exe and just use the crash disk if/when needed
Y	mgavctrl	mgavrtcl.exe	McAfee's Virus Scan Online
Y	mgavctrl	mgavrte.exe	McAfee's Virus Scan Online
Y	mgavrtclexe	mgavrtcl.exe	McAfee's Virus Scan Online
Y	mgavrtclexe	mgavrte.exe	McAfee's Virus Scan Online
N	MGA_CD_Install	mgasetup.exe	Matrox Millennium video driver. Not required once drivers installed
X	mgmtapi	mgmtapi.exe	Unidentified malware
X	MHDOGStart	mhdogst.EXE	Added by an unidentified VIRUS WORM or TROJAN! A possibility is a trojan known as PENIS
N	MHINIT	MHINIT.EXE	Part of the Cybermedia Clean Sweep package
X	mhs3	mhs3.exe	"Added by the PWS-ALZ TROJAN!"
X	Mi7sft sdce	b0yz.exe	"Added by the RBOT.CWG WORM!"
X	Mi7sft sdce	MNSQ.exe	"Added by the RBOT.DMU WORM!"
X	Mi7sft sdce	scorti.exe	"Added by the RBOT.ELC WORM!"
X	Mickey Mouse Cereal	[random filename].exe	"Added by the RANKY.Q TROJAN!"
X	Micosoft Data Core	runservice.exe	"Added by the IRCBOT.BK WORM!"
X	Micosoft Data Core stuff	svshosts.exe	"Added by the RBOT.FZA WORM!"
X	Micr Update	soundblaster.exe	"Added by the SDBOT.NP WORM!"
X	Micr Update System	upwin.exe	"Added by the SDBOT.YS WORM!"
X	Micr0s0ft Ms D0s	msdx.exe	"Added by the RBOT-AON WORM!"
X	Micr0s0ft Upd4t4z	svchost32.exe	"Added by the RBOT.ALF WORM!"
X	Micrcoft Exploerer	spoolsal.exe	"Added by the RBOT-AKK WORM!"
X	Micrcoft Exploerer	svchose.exe	"Added by the RBOT-ASL WORM!"
X	Micrcoft Updat	spoolsae.exe	"Added by the RBOT-AIB WORM!"
X	Micrcoft Updat	spoolsaex.exe	"Added by the RBOT-AJM WORM!"
X	Micrcoft Updat	Internet.exe	"Added by the RBOT-ANA WORM!"
X	Micrcsoft Certificate Services	cflmon.exe	"Added by the RBOT-FWV WORM!"
X	Micro CRC Protocol	scrc32.exe	"Added by a variant of the SDBOT WORM!"
X	Micro Office	[path to trojan]	"Added by the BANCBAN-QC TROJAN!"
X	Micro Process	appconf.exe	Added by an unidentified WORM or TROJAN!
X	Micro Update	dailin.exe	"Added by the RBOT-ER WORM!"
N	Microangelo Desktop	Muamgr.exe	"Using MicroAngelo On Display you can easily select the icon images that you prefer rather than the default icons displayed by Windows. On Display provides a consistent and elegant method to customize the icon display for almost every icon on your system"
N	microAttuneDownload	atmdlusr.exe	Application Launcher MS Office application. USR (US Robotics) modem auto updater. May be a sub-set of Attune
U	MicroBrew	MicroBrew2.exe	"Related to Bluebeam PDF printer support. Prints AutoCAD .dwgs to PDF's"
X	MicroCQ0	explorer.exe	"Added by the LINEAGE-AK TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %ProgramFiles%"
U	MicroDialler	atdialler1.exe	"Part of the Freeserve Connection Kit - changes the dial-up for Freeserve AnyTime if access problems are encountered"
X	MicroedSoft Toolbar	Smoked.exe	"Added by the RBOT-ALN WORM!"
X	Microfinder lptt01	mcf.exe	"RapidBlaster variant (in a ""mcf"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Microfinder ml097e	mcf.exe	"RapidBlaster variant (in a ""mcf"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Microfot Update	winldx32.exe	"Added by a variant of the RBOT WORM!"
X	Microft Exploerer	spoolsac.exe	"Added by the RBOT-AMD WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list