HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
X	Microsoft Windows Update	svchos.exe	"Added by the SDBOT.AC WORM!"
X	Microsoft Windows Update	svcshost.exe	"Added by the FORBOT-CF WORM!"
X	Microsoft Windows Update	svmhost.exe	"Added by the FORBOT-CH WORM!"
X	Microsoft Windows Update	svshost.exe	"Added by the WOOTBOT.CJ WORM!"
X	Microsoft Windows Update	msnmessenger.exe	"Added by the SDBOT.AJ WORM!"
X	Microsoft Windows Update	msnwun.exe	"Added by the SDBOT-RM WORM!"
X	Microsoft Windows Update	scvvhost.exe	"Added by the FORBOT-DH WORM!"
X	Microsoft Windows Update	swwhost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update	MSNMSGR.EXE	"Added by the SDBOT-WM WORM!"
X	Microsoft Windows Update	svzhost.exe	"Added by the FORBOT-EV WORM!"
X	Microsoft Windows Update	sccvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update	scrhost.exe	"Added by the RBOT-AOW WORM!"
X	Microsoft Windows Update	mnswinsx.exe	"Added by the RBOT-AWH WORM!"
X	MICROSOFT Windows update	pdate.exe	"Added by the RBOT.BZT WORM!"
X	Microsoft Windows Update	srshost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update	rhost32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows Update	windowsupdate.exe	"Added by the AGOBOT.ON WORM!"
X	Microsoft Windows Update Application	wuap.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update Client	csrss.exe	"Added by the KEBEDE-G WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Systems32"
X	Microsoft Windows Update Logon	win-logon.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update Service	wupdmgr32.exe	"Added by the DOS.AUTOCAT TROJAN!"
X	Microsoft Windows Update Service	msnmsg.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Windows Update x86	[various filenames]	"Added by a variant of the RBOT WORM! Filenames seen include (but are not limited to firefox.exe opera.exe taskmrg.exe aim.exe Winxdiag.exe and usnesvc.exe"
X	Microsoft Windows Update XP64	********.exe [* = random char]	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Updater	winupdgm.exe	"Added by the GAOBOT.BI WORM!"
X	Microsoft Windows Updater	WINIUPDATES.EXE	"Added by the RBOT-KK WORM!"
X	Microsoft Windows Updater	WINUPDATE.EXE	"Added by the RBOT-LI WORM!"
X	Microsoft Windows Updater	TMNTSrv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Updater	win32upd.exe	"Added by the RBOT-EC WORM!"
X	Microsoft Windows Updater	msnupdateit.exe	"Added by the AGOBOT-RL WORM!"
X	Microsoft Windows Updater	windates.exe	"Added by the SDBOT.TE WORM!"
X	Microsoft Windows Updater	spoolvs.exe	"Added by the RBOT.ACQ WORM!"
X	Microsoft Windows Updater	suvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows updaterD	log32zx.exe	"Added by the MYDOOM.W WORM!"
X	Microsoft Windows Updates	explorer32.exe	"Added by the SDBOT.VQ WORM!"
X	Microsoft Windows Updates	wsap32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updating System	msresource.exe	"Added by the RBOT-EAM WORM!"
X	Microsoft Windows Visual V2.0	msiutil.exe	"Added by the DELF.JPH TROJAN!"
X	Microsoft Windows W32 Services	mssw32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Windows WinSaSS Management	winsass.exe	"Added by the RBOT-APW WORM!"
X	Microsoft Windows WKS Service	gt.exe	"Added by the SDBOT.IR WORM!"
X	Microsoft Windows WKS Service	mstask0.exe	"Added by the SDBOT.FV WORM!"
X	Microsoft Windows Workstation	devcode.exe	"Added by the RBOT-AWL WORM!"
X	Microsoft Windows XP Configuration Loader	m32svco.exe	"Added by the SDBOT.WORM!.48548 WORM!"
X	Microsoft Windows XP/2K Explorer	winexplorer.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Microsoft Winedows startup	WinKey.exe	"Added by a variant of the SDBOT WORM! See here"
X	Microsoft Winedows WinServ	iPodFix.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft WINGS32 Protocol	WinSGR32.exe	"Added by the RBOT-APU WORM!"
X	Microsoft WinRaR	winrar.exe	"Added by the RBOT-AEC WORM!"
X	Microsoft Winsock	mswinsck.exe	"Added by the RBOT-ANK WORM!"
X	Microsoft Winsock Service	msusvc.exe	"Added by the RBOT-ANS WORM!"
X	Microsoft Winsock Wrapper	ws2_32s.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft WinSound	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft winsupdater	WINSUPDATER.EXE	"Detected by Kaspersky as the SPYBOTER.FB BACKDOOR! See here"
X	Microsoft WinUpdate	mntcgf032.exe	"Added by the RBOT-PF WORM!"
X	Microsoft WinUpdate	svh0st.exe	"Added by the SPYBOT.DL WORM!"
X	Microsoft WinUpdate	syslx32.exe	Added by an unidentified VIRUS WORM or TROJAN!
X	Microsoft WinUpdate	syswin32.exe	"Added by the RBOT-HO WORM!"
X	Microsoft WinUpdate	spfix.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft WinUpdate	Winamp61.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft WinUpdate	Winupd32.exe	"Added by the RBOT.MQ WORM!"
X	Microsoft WinUpdate	WinNTinit32.exe	"Added by the RBOT.VS WORM!"
X	Microsoft WinUpdate	msupdte.exe	"Added by an unidentified TROJAN! See examples here & here"
X	Microsoft WinUpdates	serm32.exe	"Added by the RBOT.GE WORM!"
X	Microsoft WM	mswm32.exe	"Added by the BCKDR-AM BACKDOOR!"
X	Microsoft Word	BootSector.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Word Profissional	csrss.exe	"Added by the BANCBAN-DB TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a ""s1613"" subfolder"
X	Microsoft Word Profissional	Java Plug In close.exe	"Added by the BANKER-EL TROJAN!"
X	Microsoft Word Profissional	csrss.exe	"Added by the BANKER-DJ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""protect"" subfolder"
X	Microsoft Word Profissional	csrss.exe	"Added by the BANKER-DP TROJAN! ! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""JavaVM"" subfolder"
N	Microsoft Works Calendar Reminders	wkcalrem.exe	Produces a pop-up reminder of events scheduled using the MS Works Calendar
N	Microsoft Works Portfolio	WksSb.exe	The Works Portfolio tool lets you collect and organize text and pictures from the Web or your favorite program. The Works Portfolio provides a location where you can store items you want to later put into a document or other file. Can be prevented from starting from a setting within Portfolio
N	Microsoft Works Update Detection	wkdetect.exe	Checks for updates to MS Works
X	Microsoft World Service	winworld.exe	Added by an unidentified IRC worm with backdoor capability!
X	Microsoft WPCEmail	svchost.exe	"Added by the SNIFFER-N TROJAN!"
X	Microsoft WWW	free.exe	Added by a variant of the CWS.AK TROJAN!
X	Microsoft Wxdate	Syswu32.exe	"Added by the SPYBOT.HZ WORM!"
X	Microsoft X Update	wuamkoppnp.exe	"Added by the RBOT-ANI WORM!"
X	microsoft xdaemon 2.0	xdaemon.exe	"Added by the DELF.D TROJAN!"
X	Microsoft XML Service	msxmlx.exe	"Added by the RBOT.KS WORM!"
X	Microsoft Xp Systems loader	winsystem32xp.exe	"Added by the KELVIR.W WORM!"
X	Microsoft Xp Systems loaders	win32xpsys.exe	"Added by the SPYBOT.NYT WORM!"
X	Microsoft XPSP Protocol	xp386.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft xpsp2	Networksystem.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft xpsp2	xpsp2.exe	"Added by the SDBOT-YQ WORM!"
U	Microsoft® Windows® Operating System	ehTray.exe	System Tray access to Media Center for Windows Vista Home Premium and XP Media Center Edition
N	Microsoft® Windows® Operating System	RunDLL32.exe ehuihlp.dll BootMediaCenter	"Starts Windows Media Center every time Windows Vista (Home Premium or Ultimate) boots. Disable by unchecking the ""Start Windows Media Center when Windows Starts"" option via Windows Media Center -> Tasks -> Settings -> General -> Startup and Window Behaviour"
N	Microsoft® Windows® Operating System	rundll32.exe oobefldr.dll ShowWelcomeCenter	Shows the Welcome Center every time you boot into Windows Vista
X	Microsoft's System Module	Sysmodule.exe	"Added by the BDOOR-FJ BACKDOOR!"
X	Microsoft(R) System Manager	sysmgr.exe	"Added by the AGENT.QTR TROJAN!"
X	Microsoft--Updates	sxvhost.exe	"Added by the RBOT-FH WORM!"
X	Microsoft-software	****.exe [* = random char]	"Added by a variant of the RBOT WORM!"
X	Microsoft-Update	wngard.exe	"Added by the RBOT-JV WORM!"
X	Microsoft-Updates	svxhost.exe	"Added by the RBOT-CT WORM!"
X	Microsoft.exe	[random].exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft32	win32sys.exe	Added by an unidentified WORM or TROJAN!
X	microsoft420	microsoft420.exe	"Added by the MENACE.B WORM!"
X	Microsoft64	antiv.exe	"Added by the SOBER WORM!"
X	Microsoft? ActiveX Debugger NT	setdebugnt.exe	"Added by the BANCOS-CZ TROJAN!"
X	Microsoft? PID Lex	PIDLex.exe	"Added by the NIOVADOOR TROJAN!"
X	Microsoft? System Mapper	SysMap.exe	"Added by the MAPSY TROJAN!"
X	MicrosoftDriverService32	drsys32.exe	"Detected by Trend Micro as the IRCBOT.AKX TROJAN! See here"
X	Microsoftf DDEs ContDLL	rune.pif	"Added by the RBOT-AGF WORM!"
X	Microsoftf DDEs ContrDL	runm.pif	"Added by the RBOT-AFQ WORM!"
X	Microsoftf DDEs Control	lxes.exe	"Added by the RBOT.BOF WORM!"
X	Microsoftf DDEs Control	wees.exe	"Added by a variant of the RBOT WORM!"
X	Microsoftf DDEs Control	soff.pif	"Added by the RBOT-AKH WORM!"
X	Microsoftf DDEs Control	why-.exe	"Added by the RBOT-AMV WORM!"
X	Microsoftf DDEs Control	msnn.exe	"Added by the RBOT-AXT WORM!"
X	Microsoftf DDEs Control	FEnR.exe	"Added by the RBOT-AIM WORM!"
X	Microsoftf DDEs Control	w33s.exe	"Added by a variant of the RBOT WORM!"
X	Microsoftf DDEs Control	waes.exe	"Added by a variant of the RBOT WORM!"
X	Microsoftkeysd	systemproc.exe	"Added by the FORBOT-BI WORM!"
X	Microsoftkeysd	systemwin32s.exe	"Added by the WOOTBOT.CO WORM!"
X	Microsoftkeysds	lass32.exe	"Added by a variant of the RBOT WORM!"
X	MicrosoftKs	Drivers.bat	"Added by the SHUTDOWN-F TROJAN!"
X	microsoftm eegs cuntrol	loor.pif	"Added by a variant of the RBOT WORM!"
X	MicrosoftMessenger	msnserv.exe	"Added by the DARKER.M WORM!"
X	Microsoftmsn32.exe	microsoftmsn32.exe	"Added by the CERTIF-C TROJAN!"
X	MicrosoftMultimediaTask	Mmtask.exe	Adware downloader - not the valid MusicMatch Jukebox which shares the same filename
X	MicrosoftNetwork Daemon for Win32	NETD32.EXE	"Added by the RANDEX.F WORM!"
X	MicrosoftOEM	smvss.exe	"Added by the DEDLER-G TROJAN!"
X	MicrosoftROMDriverService	cdrss.exe	"Detected by Kaspersky as the IRCBOT.BLF TROJAN! See here"
X	Microsofts media	winmplayd.exe	Added by an undidentified WORM or TROJAN!
X	Microsofts media	wingtp.exe	"Added by the RBOT-VO WORM!"
X	Microsofts MediaScope	winmep.exe	"Added by the RBOT-WB WORM!"
X	Microsofts MediaScope	winmedplay.exe	"Added by a variant of the RBOT WORM!"
X	Microsofts Security Manager	****.exe [**** = random char]	"Added by the RBOT-WH TROJAN!"
X	Microsofts Service	lcsrv16.exe	"Added by a variant of the RBOT WORM!"
X	Microsofts Updates	lsasss.exe	"Added by the RBOT-AEX WORM!"
X	Microsofts Updatez	cmsssr.exe	Added by an unidentified VIRUS WORM or TROJAN!
X	Microsofts Updatez	exploirez.exe	"Added by a variant of the RBOT WORM!"
X	MicrosoftServiceManager	mstask32.exe	"Added by the YAHA.P WORM!"
X	MicrosoftServiceManager	Wintsk32.exe	"Added by the YAHA.U WORM!"
X	MicrosoftServiceManager	EXPLORERE.EXE	"Added by the YAHA.AB WORM!"
X	MicrosoftServiceManager	msupdat.exe	"Added by the YAHA.AA WORM!"
X	MicrosoftShell	Shellcomm.exe	"Added by the BANCBAN-QG TROJAN!"
X	MicrosoftSourceSafe	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder"
X	MicrosoftSys	SPOOLSYS.exe	"Added by the TARNO.N TROJAN!"
X	MicrosoftUpdate	syshelper.exe	"Added by the WOOTBOT.AC WORM!"
X	MicrosoftUpdate	WinUp32.exe	Added by an unidentified VIRUS WORM or TROJAN!
X	MicrosoftUpdate	MicrosoftUpdate.exe	"Added by the BANKER-EHC TROJAN!"
X	MicrosoftUpdate	windll.exe	"Added by the RBOT-IH WORM!"
X	MicrosoftUpdate	RBuilder.exe	"Added by the DLOADR-BMV TROJAN!"
X	MicrosoftUpdates	[path to trojan]	"Added by the DELF-LO TROJAN!"
X	MicrosoftValue	syscnfg.exe	"Added by an unidentified VIRUS WORM or TROJAN! ""syscnfg.exe"" is found in C:windowsfonts (or C:winntfonts) directory where no *.exe files should reside"
X	Microsoftvirus	sysoverload.exe	"Added by the FORBOT-AL WORM!"
X	MicrosoftWindows	[various filenames]	"MagicSearch - a CoolWebSearch parasite variant"
X	MicrosoftWindows	a@26m.exe	"Added by the KILLPAR-B TROJAN!"
X	MicrosoftXP Service Pack 2	servicepack2.exe	"Added by the RBOT.EMC WORM!"
X	Microsoftz turn Control	aexl.exe	"Added by the SDBOT.BCO WORM!"
X	Microsoftz turn Control	read.pif	"Added by the RBOT-AFS WORM!"
X	Microsong	svchosts11.exe	"Added by the SDBOT-EV WORM!"
X	Microsot NT Support	[random filename].exe	"Added by the RBOT-CTI WORM!"
X	microsystem	snddrv.exe	"Detected by Kaspersky as the VB.AXG TROJAN! See here"
X	Microszoft Update Mach1nezs	svchst.exe	"Added by the RBOT-ED WORM!"
U	Microtek Scanner Finder	ScannerFinder.exe	Monitors whether a scanner is present. Provided with Microtek scanners
X	Microzoft_Ofiz	KdzEregli.exe	"Added by the AMUS.A WORM!"
X	Micrsft Updese	xagwxz.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Micrsoft CFG 32	lrbzus32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Micrsoft DerSystem	uqieelpb.exe	"Added by the RBOT-GRI WORM!"
X	Micrsoft Driver	windrive.exe	"Added by the SDBOT.AF TROJAN!"
X	Micrsoft Driver	msdriver.exe	"Added by the SDBOT-XD WORM!"
X	Micrsoft Internet Explorer	IEXPL0RE.EXE	"Added by the RBOT-AQV WORM! Note the number ""0"" in the filename"
X	Micsoft-Published-Software	explrer.exe	"Added by the RBOT-GFL WORM!"
X	Micsorosft Security Center	wcnsfty.exe	"Added by the RBOT-AHU WORM!"
X	mig2	mig2.exe	"Added by the BRONTOK-BW WORM!"
N	MightyFAX Controller	MFNTCTL.EXE	"Mighty FAX from RKS Software - "installs a printer driver so that you can fax directly from Windows software""
?	MigrationVendorSetupCaller	rundll32.exe migrate.dll CallVendorSetupDlls	"??"
X	Military Net Killer	MNK.exe	"Added by the MILLNET-A WORM!"
U	MilShieldSlave	ShieldWorker.exe	"Mil Shield from Mil Incorporated. It protects your privacy by removing all tracks from your online or offline computer activities"
N	MimBoot	mimboot.exe	"Starts Musicmatch Jukebox at bootup - can be started manually"
X	Mincer	Mincer.exe	"Added by the MINCEME-A VIRUS!"
U	Mindful	Mindful.exe	"Mindful from Felitec inc. ""Event reminder software with date and time tools in a simple to use system tray application"""
U	Mini-XP	Mini-XP.exe	"Minimizer-XP from Totalidea Software - adds an additional button in the top right-corner of any application window to allow you to quickly minimize it to the System Tray. No longer available from the author but still available from download sites such as Download.com"
X	MINIBUG	MINIBUG.EXE	"Displays ads inside Weatherbug - see here"
N	MiniEYE-MiniREAD Launch	ARLaunch.exe	"eyeQ - improve your reading speed"
N	MINIFERT.EXE	MINIFERT.EXE	Part of Backweb
U	minilog	MINILOG.EXE	If you don't have ZoneAlarm or ZoneAlarm Pro running you don't need this. This must be enabled if programs such as VisualZone Report utility or ZoneLog Analyzer are in use
N	MiniMavis	MiniMavis.exe	Mavis Beacon typing tutor

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list