HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
X	MP3freeDownload	rundll32.exe MSA64CHK.dll DllMostrar	"MatrixDialer related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""MSA64CHK.dll"" file is located in the Winnt or Windows folder"
X	MP4 Player	mp4Player.exe	"MP4 Player allows you to view MP4 videos. Marked as undesirable due to the fact that it changes your homepage to a custom Google search engine changes your browser's default search provider and runs hidden in the background. Terms of use also state that it collects and tracks urls you visit in order to display relevant ads"
X	MPatrolPRO	MPatrolPRO.exe	"Malware Patrol Pro rogue spyware remover - not recommended see here"
U	MPEO	Csinsm32.exe	Automatic logging of installs from Norton CleanSweep - available via Start -> Programs
Y	MPFExe	mpf.exe	McAfee Personal Firewall
Y	MPFExe	MpfTray.exe	McAfee Personal Firewall
Y	MPFTray	MpfTray.exe	McAfee Personal Firewall
X	MPL32 driver	MPL32.exe	"Added by the LOONY-M TROJAN!"
X	MPlay64	mplay64.exe	"Added by the MPLAY64 TROJAN!"
U	MplSetup	MplSetup.exe	Used by Ricoh network printers to enable network printing from the client
X	MPM Manager	MPM.exe	"Added by the DONBOMB.A TROJAN!"
X	MPNet	mpn.exe	"Added by the DELBOT-W WORM!"
U	MPower	MPower.exe	"MPower from MindBeat. ""Defragments and frees your RAM giving more stability to your system and avoiding needless use of swap file. Willl also benchmark (speed test) your hard disk drives and your CPU load"". MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
X	mppdds	mppdds.exe	"Added by the PWS-AKZ TROJAN!"
X	mppds	mppds.exe	"LEGMIR.AQZ spyware"
X	MPR MSG	mprmsg32.exe	"Added by the MYTOB.CF WORM!"
X	MPREXE	MPREXE.EXE	"Added by the OPASERV.T WORM! Note - this is not the legitimate Mprexe.exe system file"
Y	MPREXE.exe	mprexe.exe	"WIN32 Network Service Interface Process. MPREXE.exe enables the computer to have multiple clients/protocols for networks. There are some problems with it sometimes though - see here. Note - why some people have it listed in start-up programs I don't know but I was asked to include it here. It automatically runs in the background. NOTE : sometimes it will appear in start-ups if you have a virus"
X	MprHTML	MprHTML.exe	"Added by a variant of the VAGRNOCKER TROJAN!"
X	mprocessor	mprocessor.exe	InstallDollars.com foistware
U	MPSExe	mscifapp.exe	McAfee.com Privacy Service - "combines personal identifiable information (PII) protection with online advertisement blocking and content filtering"
Y	MpsOnn	MpsOnn.exe	Canon printer driver
?	MPT	MPT.exe	"??"
X	MPtask Services	mptask.exe	"Added by the LALA or AOT TROJANS!"
N	MPTBox	MPTBOX.EXE	Cannon Multi-Pass toolbox - a button bar
X	mptsgsvc.exe	mptsgsvc.exe	"Hacker Tool - detected by DiamondCS TDS-3 anti-trojan as ""HackTool.Win32.Hidd.j"""
N	MPXTray	mpxptray.exe	Windows Media Player PowerToy which is run from the taskbar. It can be used to hide Windows Media Player (when in use) and choose various standard buttons (play/pause nextprevious) etc
U	MP_STATUS_MONITOR	monitr32.exe	Cannon Multi-Pass status monitor - your choice
X	mqbkup	mqbkup.exe	"Added by the OPASERV.K WORM!"
X	MQT Svc	mqtsvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	mrsvctr	mrsvctr.exe	"Added by a variant of the SDBOT WORM!"
Y	MRT	MRT.exe	"Microsoft's Malicious Software Removal Tool"
N	mrtMngr	mrtMngr.exe	Maintenance Release Task Manager for Intuit's QuickBooks or Quicken
U	MRU-Blaster Scheduler	scheduler.exe	"Scheduler for MRU-Blaster - ""a program made to do one large task - detect and clean MRU (most recently used) lists on your computer"""
N	MRU-Blaster Silent Clean	mrublaster.exe	"MRU-Blaster - performs silent cleaning of MRU lists at boot"
U	MRUBlaster	indexcleaner.exe	"MRU-Blaster related - runs once in order to delete the index.dat file in the Temporary Internet Files and/or Cookies folder"
X	Mr_CoolFace_Game	Emma.exe	"Added by the ROMARIO-A WORM!"
X	ms	svhost32.exe	"Added by the LEGMIR-AQO TROJAN!"
X	MS Agent Protection	ag1.exe	"Detected by Kaspersky as the IRCBOT.AZ BACKDOOR! See here"
X	MS Auto-IPSec Protection	MSASP32.exe	"Added by the RBOT-AER WORM!"
X	MS Autoloader 32	MSAuto32.exe	"Added by the SPYBOT.BD WORM!"
X	Ms Builders	Wupated.exe	"Added by the AGOBOT-SS WORM!"
X	MS Config	msdconfig.exe	"Added by the RBOT-CZH WORM!"
X	MS Config Loader	svchos1.exe	"Added by the AGOBOT.R WORM!"
X	MS Config Loader	MSWin32bck.exe	"Added by the GAOBOT.AA WORM!"
X	MS Config Loader	svcrhost.exe	"Added by a variant of the RBOT WORM!"
X	MS Config Service	Msloader32.exe	"Added by the RBOT-KJ WORM!"
X	MS Config v12	mscfg12.exe	"Added by the AGOBOT.YP WORM!"
X	MS Config v13	lrbz32.exe	"Added by the GAOBOT.AOL WORM!"
X	MS Config v13	mscfg13.exe	"Added by the AGOBOT.YQ WORM!"
X	Ms configsu	msconfigsu.exe	"Added by a variant of the SDBOT WORM!"
X	MS Configuration	MSFramer.exe	"Added by the RANDEX.OL WORM!"
X	Ms Configuration	microsoftsa32.exe	"Added by the KELVIR.X WORM!"
X	MS DATABASE	MSDATA32.EXE	"Added by a variant of the SDBOT WORM!"
X	MS Decryption Software	active.exe	"MediaTickets adware variant"
X	MS DirectX Sound Drivers	msdrvdx.exe	"Added by the RBOT.BCX WORM!"
X	MS DLL Library Manager	dllsys64.exe	"Added by the RANKY TROJAN!"
X	MS Domain Name Server Deamon	MSDNSD32.exe	"Added by the RBOT-CMZ WORM!"
X	MS Domain Name System	MSWDNS32.exe	"Added by the RBOT-GKY WORM!"
X	MS DVD DirectX Dll Drivers	mdxdl.exe	"Added by the SDBOT-XI WORM!"
X	MS DVD DirectX Sound Drivers	msdrvdx.exe	"Added by the SDBOT-XJ WORM!"
X	MS Explorer	mexplore.exe	"Added by the YAHA.AE WORM!"
X	MS FIREWALL	msfrewall.exe	"Added by the SDBOT-PU WORM!"
X	MS FIREWALL	msfirewall.exe	"Added by the SDBOT-QH WORM!"
X	MS Host	msthost.exe	"Added by the CHECKOUT WORM! See here"
X	MS Host Manager	ivhost.exe	"Added by the RBOT-BJN WORM!"
X	MS Hosts	msthosts.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	MS HTML	msHtml.exe	"Added by the PESTDOOR.31 TROJAN!"
X	MS HTML	mslat.exe	"Added by the LATINUS.SVR TROJAN!"
X	MS HTML Location Class	MSHTML32.exe	"Added by the RBOT-YD WORM!"
X	MS Initial	mstinitial.exe	"Detected by Trend Micro as the IRCBOT.ASP WORM! See here"
X	MS Internet Executor 32	MSIXEC32.exe	"Added by the RBOT-AEQ WORM!"
X	MS Internet Explore	MSIEx.exe	"Added by a variant of the RBOT WORM!"
X	MS Java Applets for Windows NT & XP	javaapplet.exe	"Added by the RBOT.BHG WORM!"
X	MS Java Applets for Windows NT ME	javaapplets.exe	"Added by the VANEBOT-B WORM!"
X	Ms Java for Windows 98 NT ME & XP	msjavames.exe	"Added by the RBOT.BHJ WORM!"
X	Ms Java for Windows 98 NT XP & ME	msjavaxps.exe	"Added by the BACKDOOR.GEN TROJAN!"
X	Ms Java for Windows NT	MS32.exe	"Added by the VANEBOT-H WORM!"
X	Ms Java for Windows NT	msi32java.exe	"Added by the VANEBOT-I WORM!"
X	Ms Java for Windows NT	msjava.exe	"Added by the VANEBOT-E WORM!"
X	Ms Java for Windows NT	msi32info.exe	"Added by the RBOT.AFX WORM!"
X	MS Java for Windows NT XP & ME	xpjavams.exe	"Added by the KASSBOT-V WORM!"
X	MS Java for Windows XP & NT	javanet.exe	"Added by the VANEBOT-A WORM!"
X	MS Java Service Wrapper for Windows NT	wrapper.exe	"Added by the VANEBOT-D WORM!"
X	Ms Java Update For Windows NT/XP	msijavaupdt32.exe	"Added by the RANDEX.AF WORM!"
X	MS Java virtual machine	javavm.exe	"Added by the RBOT.ABG WORM!"
X	MS LARISSA	MS_LARISSA.exe	"Added by the ASSIRAL.B WORM!"
X	MS lsass Startup	lsass135.exe	"Added by the RBOT.WM WORM!"
?	MS management console	mms.exe	"Suspicious as the legitimate ""Microsoft Management Console"" is ""mmc.exe"" and not ""mms.exe"" and doesn't normally run at startup"
X	MS Microsoft Socket Deamon	MSSCKD32.exe	"Added by a variant of the RBOT WORM!"
X	MS MSN Menssenger 7.0	MSMSN7.exe	"Added by the RBOT-ACA WORM!"
X	MS MSN Menssenger 7.0	MSEXPORT.exe	"Added by a variant of the SDBOT WORM!"
X	MS Network Control	mswin.exe	"Added by the DUMBA TROJAN!"
X	ms ownage	winPE.exe	"Added by the RBOT-AJL WORM!"
X	MS Paint	mspainter.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	MS PLUS INC	wpad.exe	"Added by the MYTOB-AN WORM!"
X	Ms Processe Manager	msproc.exe	"Added by the RBOT.ATO WORM!"
X	MS Real Player	RealPlyr.exe	"Added by the RBOT.MR WORM!"
X	MS Registry Service	MSRMS32.exe	"Added by the RBOT-AKP WORM!"
X	MS Remote Procedure Call	msrpc32.exe	"Added by the RBOT-QL WORM!"
X	MS Screen Saver	scrsave.scr	"Added by the RBOT-AGT WORM!"
X	MS Security	systm.pif	"Added by the RBOT-AQN WORM!"
X	MS Security Authority Service	lsass.exe	"Added by the KALEL-B WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the System folder"
X	MS Security Hotfix	service5.exe	"Added by the GAOBOT.AG WORM!"
X	MS Security Update 993	msident.exe	"Added by a variant of the SDBOT WORM!"
X	MS service	msservice.exe	"Added by the RBOT-ZG WORM!"
X	MS Service Drivers	winscv.exe	"Added by the SDBOT-COG WORM!"
X	Ms sock for Windows NT	winser.exe	"Added by a variant of the SDBOT WORM!"
X	MS Sound Config 16bit	sndcfg16.exe	"Added by the SDBOT.MB TROJAN!"
X	Ms Sound Drivers	msdrv.exe	"Added by the SDBOT-WR WORM!"
X	ms spool service	msspooler.exe	"Added by a variant of the RBOT WORM!"
X	Ms Spool32	MS SPOOL32.EXE	"Added by the ASASSIN TROJAN!"
X	MS SyS Restore	sysrestore.exe	"Added by the RBOT.XM WORM!"
X	MS Sys Security	mswin.pif	"Added by the RBOT-APJ WORM!"
X	MS System Call Function	msscf32.exe	"Added by the RBOT-GBZ WORM!"
X	Ms System Config	Mscfg.exe	"Added by the SDBOT-CCR WORM!"
X	Ms System Config	pcedit.exe	"Added by a variant of the SDBOT WORM!"
X	MS System Security	mswin32.pif	"Added by the RBOT-AOX WORM!"
X	Ms task manager	tskmgr.exe	"Added by the SDBOT.CCD WORM!"
X	MS Task Manager 32	mstskmgr.exe	Added by the RANKY.DE TROJAN!
X	MS taskbar	crssr.exe	"Added by the RBOT-AGO WORM!"
X	MS taskbar	nts.exe	"Added by the RBOT-AGB WORM!"
X	MS taskbar	taskbars.exe	"Added by the RBOT.BRW WORM!"
X	MS Taskbars	taskbars.exe	"Added by the SDBOT-ACV WORM!"
X	MS taskmanager	tskmgr.exe	"Added by the RBOT-AKA WORM!"
X	MS Time	timezone.exe	"Added by the AGOBOT.ADY WORM!"
X	MS UniX	navupdate64.exe	"Added by a variant of the RBOT WORM!"
X	MS Unix Binary	win32ttb.exe	"Added by the SPYBOT.OQ WORM!"
X	MS Unix Binary	msmq2inst.exe	"Added by the RBOT-YF WORM!"
X	MS Unix Binary	msnupdate.exe	"Added by the RBOT-AAM WORM!"
X	MS Unix Binary	outlookexpressupdate.exe	"Added by the RBOT-YU WORM!"
X	MS Unix Binary	Win32Update.exe	"Added by the RBOT-BAS WORM!"
X	MS Unix Binary	Norton2005Update.exe	"Added by a variant of the RBOT WORM!"
X	MS Unix Binary	trmupdate.exe	"Added by the RBOT-ACC WORM!"
X	MS Unix Binary	WinGuard.exe	"Added by the RBOT-ACL WORM!"
X	MS Unix Binary	msnq3insller.exe	"Added by a variant of the RBOT WORM!"
X	MS Update	syshost.exe	"Added by the EVAMAN-F WORM!"
X	Ms Update WinServices NT/XP	winservnt32.exe	"Added by the VANEBOT-G WORM!"
X	MS Updates	mscache.exe	Spyware web downloader
X	MS Updates	syshosts.exe	"Added by the MYDOOM.Y WORM!"
X	MS Updates	aupd.exe	Spyware web downloader
X	MS Updating Utility	msupdater.exe	"Added by the RBOT-XR WORM!"
X	MS USB 2.0 Windows Support	msusb32.exe	"Added by a variant of the RBOT WORM!"
X	Ms Valud Loader	Svhots.exe	"Added by the AGOBOT-SP WORM!"
X	MS Win32 Network Services	windriver.exe	"Added by the AGOBOT.ADH WORM!"
X	ms window update	******.exe [* = random character]	"Added by a variant of the RBOT WORM!"
X	MS Windows AOL Driver	MSAOLdrv.exe	"Added by the RBOT-ASP WORM!"
X	MS windows Data list process	MSDATLST.exe	Added by an unidentified WORM or TROJAN!
X	MS Windows Executor Process	MSEXECP32.exe	"Added by a variant of the RBOT WORM!"
X	MS Windows Local Directory	MSWLD32.exe	"Added by a variant of the RBOT WORM!"
X	MS Windows procces 32	msprocces.exe	"Added by the RBOT-AEZ WORM!"
X	MS Windows Process Class	MSPRCSS32.exe	"Added by the RBOT-YQ WORM!"
X	MS Windows Process Init	MSWPI32.exe	"Added by the RBOT-ASQ WORM!"
X	MS Windows Security Updater	updater.pif	"Added by the RBOT-AKY WORM!"
X	MS Windows System Alert	MSWSA32.exe	"Added by the RBOT-BFN WORM!"
X	MS Windows TASK Service	MSWTASK32.exe	"Added by a variant of the RBOT WORM!"
X	MS Windows Update	scguard.exe	"Added by the RBOT-YZ WORM!"
X	MS WINS Binary	ign32.pif	"Added by the RBOT-ASB WORM!"
X	MS Winsock	msws2_32.exe	"Added by the AKBOT-A TROJAN!"
X	ms************* [* = random digit]	ms*************.exe [* = random digit]	"WINBO adware"
X	Ms**.exe [* = random char]	Ms**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples see this log"
X	Ms**32.exe [* = random char]	Ms**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples see this log"
X	MS-Connect	arr.exe	"Adult content dialler - see here"
X	MS-Connect	cdm.exe	"Adult content dialler - see here"
X	MS-Connect	game.exe	"Adult content dialler - see here"
X	MS-Connect	msite18.exe	"Adult content dialler - see here"
X	MS-Connect	web.exe	"Adult content dialler - see here"
X	MS-DOS Boot Service	Boot32.pif	"Added by the RBOT-AMF WORM!"
X	MS-DOS Security Service	ms-dos.pif	"Added by the RBOT-AMR WORM!"
X	MS-DOS Service	MS-DOS.pif	"Added by the RBOT-AII WORM!"
X	MS-DOS Windows Service	MS-DOS.PIF	"Added by the RBOT-AJW WORM!"
X	MS-HTML	[random filename]	"Added by the LATINUS.15 TROJAN!"
X	MS-patch	msconfig32.exe	"Added by the RBOT-AUF WORM!"
X	MS-patch	mspatch32.exe	"Added by the RBOT-AWF TROJAN!"
X	MS-RunKey	arr.exe	MS-Connect dialler/hijacker
X	ms2src	ms2src.exe	"Added by a TROJAN - see here"
X	MS32DLL	achi.dll.vbs	"Added by the ACHI-A TROJAN!"
X	MS32DLL	Bha.dll.vbs	"Added by the BUTSUR-A WORM!"
X	MS32DLL	MS32DLL.dll.vbs	"Added by the ZODGILA WORM!"
X	MS7531	ms7531.exe	Homepage hijacker

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list