HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
X	Microsoft xpsp2	xpsp2.exe	"Added by the SDBOT-YQ WORM!"
X	Microsoft ® Windows Configuration Backup Service	svchost.exe	"Added by a variant of the SDBOT WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	Microsoft ® Windows Network Security Management Service	nsms.exe	"Added by the RANKY.LC TROJAN!"
X	Microsoft ® Windows Protected Content Restoration Service	services.exe	"Added by the AGENT.AGV TROJAN!"
X	Microsoft ® Windows TCP/IP Socket Driver	[path to trojan]	"Added by the PROXY-DD TROJAN!"
X	Microsoft ® Windows Update Service	wuauclt.exe	"Added by a variant of the SDBOT WORM! Note - this is not the legitimate wuauclt.exe process
X	Microsoft ® Windows Vista/NT Runtime Compatibility Service	nrcs.exe	"Added by the RANKY.X TROJAN!"
X	Microsoft's System Module	Sysmodule.exe	"Added by the FJ TROJAN!"
X	Microsoft--Updates	sxvhost.exe	"Added by the RBOT-FH WORM!"
X	Microsoft-software	****.exe [* = random char]	"Added by a variant of the RBOT WORM!"
X	Microsoft-Update	wngard.exe	"Added by the RBOT-JV WORM!"
X	Microsoft-Updates	svxhost.exe	"Added by the RBOT-CT WORM!"
X	microsoft420	microsoft420.exe	"Added by the MENACE.B WORM!"
X	Microsoft64	antiv.exe	"Added by the SOBER WORM!"
X	Microsoftf DDEs ContDLL	rune.pif	"Added by the RBOT-AGF WORM!"
X	Microsoftf DDEs ContrDL	runm.pif	"Added by the RBOT-AFQ WORM!"
X	Microsoftf DDEs Control	lxes.exe	"Added by the RBOT.BOF WORM!"
X	Microsoftf DDEs Control	wees.exe	"Added by a variant of the the RBOT.BOF WORM!"
X	Microsoftf DDEs Control	soff.pif	"Added by the RBOT-AKH WORM!"
X	Microsoftf DDEs Control	why-.exe	"Added by the RBOT-AMV WORM!"
X	Microsoftf DDEs Control	msnn.exe	"Added by the RBOT-AXT WORM!"
X	Microsoftf DDEs Control	FEnR.exe	"Added by the RBOT-AIM WORM!"
X	Microsoftkeysd	systemproc.exe	"Added by the FORBOT-BI WORM!"
X	Microsoftkeysd	systemwin32s.exe	"Added by the WOOTBOT.CO WORM!"
X	Microsoftkeysds	lass32.exe	"Added by a variant of the RBOT WORM!"
X	MicrosoftKs	Drivers.bat	"Added by the SHUTDOWN-F TROJAN!"
X	microsoftm eegs cuntrol	loor.pif	"Added by a variant of the RBOT WORM!"
X	Microsoftmsn32.exe	microsoftmsn32.exe	"Added by the CERTIF-C TROJAN!"
X	MicrosoftMultimediaTask	Mmtask.exe	Adware downloader - not the valid MusicMatch Jukebox which shares the same filename
X	MicrosoftNetwork Daemon for Win32	NETD32.EXE	"Added by the RANDEX.F WORM!"
X	MicrosoftOEM	smvss.exe	"Added by the DEDLER-G TROJAN!"
X	Microsofts media	winmplayd.exe	Added by an undidentified WORM or TROJAN!
X	Microsofts media	wingtp.exe	"Added by the RBOT-VO WORM!"
X	Microsofts MediaScope	winmep.exe	"Added by the RBOT-WB WORM!"
X	Microsofts MediaScope	winmedplay.exe	"Added by a variant of the RBOT WORM!"
X	Microsofts Security Manager	****.exe [**** = random char]	"Added by the RBOT-WH TROJAN!"
X	Microsofts Service	lcsrv16.exe	"Added by a variant of the RBOT WORM!"
X	Microsofts Updates	lsasss.exe	"Added by the RBOT-AEX WORM!"
X	Microsofts Updatez	cmsssr.exe	"Added by an unidentified VIRUS
X	Microsofts Updatez	exploirez.exe	"Added by a variant of the RBOT WORM!"
X	MicrosoftServiceManager	mstask32.exe	"Added by the YAHA.P WORM!"
X	MicrosoftServiceManager	Wintsk32.exe	"Added by the YAHA.U WORM!"
X	MicrosoftServiceManager	EXPLORERE.EXE	"Added by the YAHA.AB WORM!"
X	MicrosoftServiceManager	msupdat.exe	"Added by the YAHA.AA WORM!"
X	MicrosoftSourceSafe	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder"
X	MicrosoftSys	SPOOLSYS.exe	"Added by the TARNO.N TROJAN!"
X	MicrosoftUpdate	syshelper.exe	"Added by the WOOTBOT.AC WORM!"
X	MicrosoftUpdate	WinUp32.exe	"Added by an unidentified VIRUS
X	MicrosoftUpdates	[path to trojan]	"Added by the DELF-LO TROJAN!"
X	MicrosoftValue	syscnfg.exe	"Added by an unidentified VIRUS
X	Microsoftvirus	sysoverload.exe	"Added by the FORBOT-AL WORM!"
X	MicrosoftWindows	[various filenames]	"MagicSearch - a CoolWebSearch parasite variant"
X	MicrosoftXP Service Pack 2	servicepack2.exe	"Added by the RBOT.EMC WORM!"
X	Microsoftz turn Control	aexl.exe	"Added by the SDBOT.BCO WORM!"
X	Microsoftz turn Control	read.pif	"Added by the RBOT-AFS WORM!"
X	Microsoft© PID Lex	PIDLex.exe	"Added by the NIOVADOOR TROJAN!"
X	Microsoft« ActiveX Debugger NT	setdebugnt.exe	"Added by the BANCOS-CZ TROJAN!"
X	Microsoft® System Mapper	SysMap.exe	"Added by the MAPSY TROJAN!"
X	Microsong	svchosts11.exe	"Added by the SDBOT-EV WORM!"
X	Microsot NT Support	[random filename].exe	"Added by the RBOT-CTI WORM!"
X	Microszoft Update Mach1nezs	svchst.exe	"Added by the RBOT-ED WORM!"
X	Microzoft_Ofiz	KdzEregli.exe	"Added by the AMUS.A WORM!"
X	Micrsoft CFG 32	lrbzus32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Micrsoft Driver	windrive.exe	"Added by the SDBOT.AF TROJAN!"
X	Micrsoft Driver	msdriver.exe	"Added by the SDBOT-XD WORM!"
X	Micrsoft Internet Explorer	IEXPL0RE.EXE	"Added by the RBOT-AQV WORM! Note the number ""0"" in the filename"
X	Micsorosft Security Center	wcnsfty.exe	"Added by the RBOT-AHU WORM!"
N	MightyFAX Controller	MFNTCTL.EXE	"Mighty FAX from RKS Software - "installs a printer driver so that you can fax directly from Windows software""
?	MigrationVendorSetupCaller	"rundll32.exe migrate.dll	CallVendorSetupDlls"
N	MimBoot	mimboot.exe	"Starts Musicmatch Jukebox at bootup - can be started manually"
X	Mincer	Mincer.exe	"Added by the MINCEME-A WORM!"
X	MINIBUG	MINIBUG.EXE	"Displays ads inside Weatherbug - see here"
N	MiniEYE-MiniREAD Launch	ARLaunch.exe	"eyeQ - improve your reading speed"
N	MINIFERT.EXE	MINIFERT.EXE	Part of Backweb
U	minilog	MINILOG.EXE	If you don't have ZoneAlarm or ZoneAlarm Pro running you don't need this. This must be enabled if programs such as VisualZone Report utility or ZoneLog Analyzer are in use
N	MiniMavis	MiniMavis.exe	Mavis Beacon typing tutor
X	minimo	[path to file]	"Added by the MOSUCK-X TROJAN!"
N	MiniNote	MININOTE.EXE	"Mini NoteTab was the first in the family of "NoteTab" text and HTML editors from Fookes Software"
?	Miniphone	glophone.exe	"VoiceGlo Glophone Voice over Internet Protocol (VOIP) communications software - ""an affordable and convenient way to call friends and family throughout the world using a dial-up or broadband Internet connection on your computer"" - is it required in startup?"
X	miniport	usb2chk.exe	"Added by the LAZAR-A TROJAN!"
X	MiniPortRt	miniport_mp.exe	"Malware - see here"
X	MiniServer.exe	MiniServer.exe	"Added by the LITTLEW-E TROJAN!"
U	MinMaxExtender	Mmext.exe	"MinMaxExtender - window handling tool"
X	Miosf Update	wimsqaad.exe	"Added by the SDBOT.AG TROJAN!"
N	Mirabilis ICQ	NDetect.exe	"If connected to the internet
N	Mirabilis ICQ	icq.exe	"If connected to the internet
N	Mirabilis ICQ	ICQNet.exe	"If connected to the internet
N	Miranda IM	miranda32.exe	"Miranda instant messaging client"
X	Mirate Sp 2 Information	miratesp2.exe	"Added by the RBOT.QH WORM!"
X	Mircosoft DNS Service	svchost.exe	"Added by the IRCBOT-AK TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a ""drivers"" subfolder"
X	Mircosoft Sockets SP2	mssck.exe	"Added by the MYTOB.ET WORM!"
X	Mircosoft Update	wuampkd.exe	"Added by a variant of the SDBOT WORM!"
X	Mircrosoft Svchost32	svchost32.exe	"Added by the RBOT-AZW WORM!"
X	Mircrosoft Windows Config DLL	rundllc32b.exe	"Added by the RBOT-ZY WORM!"
N	miroVIDEO Tray Tool	misitray.exe	"Tool for quickly changing options for miro/Pinnacle capture cards during capture/playback/output. When this program is closed
U	MirrorFolderShell	mrfshl.exe	"MirrorFolder backup software"
X	Mirsoft sdcE	taskmegr.exe	"Added by the RBOT-AWY WORM!"
X	Mirsoft sdcE	taskmegr.exe	"Added by the RBOT.DFQ WORM!"
X	Miscrosoft Windows Explorer	IEEXPLORER.exe	Reported as the SDBOT.YX WORM!
?	misiCTRL	misiCTRL.exe	"Miro video driver related. Is it required?"
?	misiTRAY	misiTRAY.exe	"Miro video driver related. Is it required?"
X	Mismo	win32x.exe	"Added by the RBOT-JP WORM!"
N	Mixer	Mixer.exe	C-Media Mixer - C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. Provides System Tray access to change audio settings. Available via Start -> Settings -> Control Panel or Start -> Programs
N	Mixersel	mixersel.exe	Configuration for Realtek audio devices
N	Mixghost	mixghost.exe	"Management software for Altec Lansing speakers.  If a change is needed
X	ml00!.exe	ml00!.exe	"Malware
U	ML1HelperStartUp	ML1HEL~1.EXE	"ScreenScenes ""Midnight Lake"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30..."
U	ML1HelperStartUp	ML1Helper.exe	"ScreenScenes ""Midnight Lake"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30..."
X	mload	lxmstart.exe	"Added by an unidentified VIRUS
?	MM Install	setup.exe	"Possibly Money Manager from Moneysoft?"
X	MMB2	explorer.exe	Added by an unidentified WORM or TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder
X	MMC	inisys.exe	"Added by the OSCABOT-I WORM!"
X	mmcndmgr	mmcndmgr.exe	"Added by an unidentified VIRUS
N	MMCWINMGMT	winmgmt.exe	"Used for Enterprise Management. If you are not an IT Administrator you don't need it to be running. Also runs from the PCHealth ""scheduler"" - refer here"
X	mmemdrv	mmemdrv.exe	"Added by SecondSight spyware. Note - SecondSight is spyware that captures keystrokes and screen shots
U	MMERefresh	MMERefresh.exe	"Part of Digidesgin Protools. Refreshes your midi ports on the 002(R) (the 002R is a hardware audio/midi converter connected to your computer via firewire). Must be running in order to use the MIDI functionality of the Digi002R"
X	Mmessenger	messenger.exe	"Added by the AGOBOT.GM WORM!"
X	Mmgsvc	mmgsvc.exe	Mmgsvc spyware
U	MMhid	mmhid.dll	"This is the Human Interface Device Server for Win98
?	MMHK	mmhk.exe	"A driver found on a Compaq Presario 800T notebook. Possibly something to do with multimedia hot keys?"
N	MMHotKey	MMHotKey.exe	Multimedia key handling for the relevant type of Turbo-Media keyboard. Shortcut available. Note that with this running it can crash DirectX8/9 under WinXP when a game switches to full-screen
X	MMicrosoft Security Management	inetforn.exe	"Added by the RBOT.AFZ WORM!"
U	MMKeybd	MMKeybd.exe	Multimedia keyboard manager. Required if you use the additional keys
U	Mmm	Mmm.exe	"Hace Mmm - free utility to configure your Windows menus and move and remove menu-items you never use"
X	mmod	mmod.exe	"eZula TopText adware"
N	mmpti	m1mmpti.exe	Mpact Mediaware Properties Taskbar Icon - multimedia software icon for Chromatic Research Mpact video cards
N	MMReminderService	MMReminderService.exe	"Mind Manager from Mindjet - ""easy way to organize ideas and information"". Registration reminder"
?	MMRun	mmrun.exe	"??"
?	mmsys	recover.exe	"??"
X	MMSystem	RunDll32	Added by the FUNNER-A WORM!
Y	MMTASK	mmtask.tsk	"A check on the file's properties reveals "Multimedia background task support module". MMTASK is a very simple 16-bit program used by certain multimedia drivers (which are still 16-bit on Win9x) to perform background processing. Some soundcards need this to support MIDI
N	mmtask	mmtask.exe	"Part of MusicMatch Jukebox - digital music player / CD burner and ripper / music organizer / playlist creator"
X	MMtask Service	mmtask.exe	"Added by the BACKGAT.A TROJAN! Not the valid MusicMatch Jukebox which has the same filename"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list