HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
X	Msn Messenge	IExplorer.exe	"Added by the DELF-LL TROJAN!"
X	MSN messenger	messenger.exe	"Added by an unidentified TROJAN! Note - this is not the real MSN Messenger
X	Msn Messenger	msnmsgs.exe	"Added by the LOONY-P TROJAN! Note - not to be confused with msmsgs.exe
X	MSN Messenger	Reosmsngr.exe	"Added by a variant of the SPYBOT WORM!"
X	MSN MESSENGER	msmmsgr.exe	"Added by the KELVIR.Q WORM!"
X	MSN Messenger	msmsgs.exe	"Added by the DLOADER-LN or ZLOB-C or ZLOBDROP-C TROJANS! Note - this particular msmsgs.exe file is located in the WindowsSystem32 or WinntSystem32 folder
X	MSN Messenger	msnmsgr.exe	"Added by the AGOBOT.AOQ WORM! Note - this is not the valid MSN Messenger utility"
X	MSN Messenger	msmsgs.exe	"Added by the ZHOPA TROJAN! Note - this particular msmsgs.exe file is located in the WindowsSystem32 or WinntSystem32 folder
X	MSN Messenger	msnmsngr.exe	"Added by a variant of the RBOT WORM!"
X	MSN Messenger	IExplorer.exe	"Added by the BANKER-EU TROJAN!"
X	Msn Messenger	msnmsnr.exe	"Added by the BANKER-GG TROJAN!"
X	MSN Messenger	PIC1324.exe	"Added by the CHOKE.C WORM!"
X	MSN Messenger	explorer..exe	"Dropper for the Ciadoor.cb TROJAN!"
X	MSN Messenger 32	msniu.exe	"Added by the RBOT-AWB WORM!"
X	MSN Messenger 323	msniu3.exe	"Added by the RBOT-AXB WORM!"
X	MSN Messenger 6.2	tyd.exe	"Added by a variant of the RBOT WORM!"
X	MSN messenger service	mssgs.exe	"Added by an unidentified TROJAN! Note - this is not the real MSN Messenger
X	MSN Messenger Service Starter	msnmgsr.exe	"Added by the RBOT-AOS WORM!"
X	Msn Messenger Update	msnupdate.exe	"Added by a variant of the RBOT WORM!"
X	MSN Messenger User Controls	msmsgr.exe	"Added by the KELVIR.HI WORM!"
X	Msn Messengers	MSNMSGR.EXE	"Added by the RBOT.KX WORM!"
X	MSN MMISSENGER	mssmmspgr.exe	"Added by the KELVIR.AJ WORM!"
X	Msn Patch	msndp.exe	"Added by the RBOT.AAI WORM!"
X	Msn Patches	msndr.exe	"Added by a variant of the SDBOT WORM!"
X	Msn Plus Updater	msnplus.exe	"Added by the RBOT-MU WORM!"
X	Msn Processe Manager	msni32.exe	"Added by the RBOT-ADX WORM!"
N	MSN Quick View	Msndc.exe	Quick way to connect to MSN internet service
X	MSN Registry loader	msmnwin.exe	"Added by the KELVIR.FK WORM!"
X	MSN service	msnmgr16.exe	"Added by a variant of the RBOT WORM!"
X	MSN Service	amsnmsgrs.exe	"Added by a variant of the SDBOT WORM!"
X	Msn Service	matrixcam.exe	"Added by the MYTOB.JH WORM!"
X	Msn Service	raloded.exe	"Added by the MYTOB-DY WORM!"
X	MSN service	msnmsgr16.exe	"Added by the RBOT-RZ WORM!"
X	MSN service	NTDKRN.EXE	"Added by the RBOT.UJ WORM!"
X	MSN Service Updates	winproc.exe	"Added by the KELVIR-BB WORM!"
X	MSN Service Utilities	nkn.exe	"Added by the KELVIR-BC WORM!"
X	MSN Start	msnmsgr7.exe	"Added by the RBOT-PH WORM!"
X	MSN Update	mscon.exe	"Added by the RBOT-QA WORM!"
X	MSN Update	msn32.exe	"Added by the RBOT.AHN WORM!"
X	MSN Update	DLLCON.EXE	"Added by the RBOT-EA WORM!"
X	Msn Update Manager (Sp2)	MSMSGS.EXE	"Added by the AGOBOT-NL WORM!"
X	Msn Update Service	userx.exe	"Added by the MYTOB.JF WORM!"
X	MSN Updater	msnms.exe	"Added by the FORBOT-CG WORM!"
X	Msn Updater	msnplugins.exe	"Added by the RBOT-HS WORM!"
X	Msn Updater	windatemanager.exe	"Added by the SDBOT.TS WORM!"
X	MSN UPDATERS	virtualmemory.exe	"Added by the RBOT-JK WORM!"
X	msn.exe	son.exe	"Added by the STARTPA-GS TROJAN!"
X	MSN32 X Service	MSN32x.EXE	Added by an unidentified WORM!
X	MSN8m Startup	msn8m.exe	"Added by a variant of the RBOT WORM!"
X	msnager32	svchostt.exe	"Added by the WOMANIZ.E TROJAN!"
N	msnappau	msnappau.exe	"Updater for the MSN toolbar that can be downloaded onto IE. Calls home every day or so to ""update"" the toolbar"
X	Msnarrator	msnarrator.exe	"Added by the NARAT.A TROJAN! - also identified as MPGCOM Toolbar adware"
X	MSNavWH	MSWkwrH.exe	"Added by the ANAV-A WORM!"
X	msndrvsys	msndrvsys.exe	"Added by the BROGGER-D TROJAN!"
X	MSNET	msnet.exe	"Added by the BOA WORM!"
X	MsnExplorer	winagent.exe	"Added by the EQ TROJAN!"
X	MsnExplorer	MSEXPLOREN.EXE	"Added by the EB TROJAN!"
X	MsnExplorer	SHCH.EXE	"Added by the EB TROJAN!"
X	MsnExplorer	SVCHST.EXE	"Added by the EB TROJAN!"
?	MsnFixer	msnfixjs.js	"Located in the HPbinmsnfix directory of a HP PC"
X	MSNGrabber	MSNgrabber.exe	"Added by the ENVID.A WORM!"
X	msngta32	msngta32.exe	"Added by a variant of the RBOT WORM!"
N	MSNIA	MSNIASVC.EXE	Added with MSN version 9. Resets certain internet settings upon bootup and can't be disabled via MSCONFIG
X	msnload32.exe	msnload32.exe	"Added by the BANCOS.M TROJAN!"
X	MSNMESENGER	Main.exe	"Added by the PRORAT TROJAN!"
X	msnmsg	asgag.exe	"CoolWebSearch parasite variant"
X	msnmsg	TBC.exe	Added by an unidentified TROJAN!
X	msnmsg	msnmsg.exe	"Added by the BANKER-CLX TROJAN!"
X	msnmsg.exe	mscmd32.exe	Added by a variant of the AGENT.AH TROJAN!
X	msnmsgq32	msnmsgq.exe	"Added by the TACTSLAY.H TROJAN!"
N	msnmsgr	msnmsgr.exe	"MSN Messenger (now superseeded by Windows Live Messenger) utility. If you don't use MSN Messenger
X	MsnMsgr	MsnMsgrs.exe	"Added by the NETSKY-AD WORM!"
X	msnmsgr32-.exe	msnmsgr-.exe	"Added by a variant of the SPYBOT WORM!"
X	MSNMSGR5	MSNMSGR5.exe	"Added by the RBOT.PQ WORM!"
X	MSNMSGRE	swef.bat	IRC backdoor TROJAN or WORM!
X	MSNMSGRR	swin.bat	IRC backdoor TROJAN or WORM!
X	MSNMSGRS	swe.bat	IRC worm or backdoor trojan!
X	MSNMSGRS	swiss.bat	IRC worm or backdoor trojan!
X	MSNMSGRS1	swed.bat	IRC backdoor TROJAN or WORM!
X	msnmsgs.exe	msnmsgs.exe	"Added by the BANKER-HK TROJAN! Note - not to be confused with msmsgs.exe
X	msnmsgsgs	msnmsgsgs.exe	"Added by the ""Catal"" alias Spy.Delitall.B backdoor TROJAN!"
X	msnmsgy	[path to file]	"Added by the BANKER-EQ TROJAN!"
X	msnnt	winampb.exe	"Chinese originated adware - detected by Kaspersky antivirus as Trojan.Win32.Agent.tl"
X	MSNPluginSrIvcs	n3vasap23.exe	"Added by a variant of the RBOT WORM!"
X	MSNPluginSrvcs	p6.exe	"Added by the SDBOT.AKJ or RBOT-VJ WORMS!"
X	MSNPluginSrvcs	sagate.exe	"Added by the SDBOT.AKJ WORM!"
X	msnsched2	msnsched2.exe	"Added by the SPYBOT.NNT WORM!"
X	MSNService	MSNService.exe	"Added by the CARPET.C WORM!"
X	msnsgs	msnsgs.exe	"Added by the CHEUKO-B TROJAN!"
X	msnshed	msnshed.exe	"Added by the RBOT-YN WORM!"
X	msnsmgr	MsnMsr.exe	"Added by the LOONY-N TROJAN!"
X	MSNSysRestore	pc32.exe	Added by a variant of the MASTAK VIRUS!
X	msnToolbaar	msnmsgesc.exe	"Added by the RBOT.BMF WORM!"
X	MSObject32	MSObject32.js	"Added by the PUN TROJAN!"
X	Msoffice	msoffice.hta	Hijacker - redirecting to Searchdot.net
X	MSOffice	services.exe	"Added by the DLOADER-EU TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in an ""MSOffice"" subfolder"
X	MSOffice32	msjcf.exe	"Added by the RAKER-A TROJAN!"
X	MSOfficeCfg	msocfg.exe	Premium rate adult content dialer
X	MSOfficeCfg	navchk.exe	Premium rate adult content dialer
X	MSOfficeCfg	qservice.exe	Premium rate adult content dialer
X	MSOfficeCfg	shman.exe	Premium rate adult content dialer
X	MSOfficeCfg	ssvr.exe	Premium rate adult content dialer
X	msoffwz	msoffwz.EXE	"Added by the BANCBAN-HQ TROJAN!"
X	msoft-updater23	mssysstems.exe	"Added by the RBOT-ATU WORM!"
X	msoft-updater23	slssystem.exe	"Added by the RBOT-ASR WORM!"
X	MSOleath32	winss.exe	"Added by the KATHER TROJAN!"
X	MSOOBD	MSOOBD.EXE	"Added by the MAGISTR.A VIRUS!"
X	mspaint.exe	check32.exe	"Added by the AGENT.AH TROJAN!"
X	Mspatch69	[path to trojan]	"Added by the MPROX TROJAN!"
X	Mspatch89	cnqmax.exe	"Added by the RANDEX.P WORM!"
X	msping	msping.exe	"Added by the FLOODBLACK TROJAN!"
X	msping.exe	msping.exe	"Added by the MZ TROJAN!"
X	MSPluginSrvc	p3.exe	"Added by the RBOT-WV WORM!"
X	MSPLUS	msplus32.exe	"Added by the MYTOB-AM or MYTOB-CL WORMS!"
X	MSPP System Update 64	wiaadmgr.exe	"Recognized by Kaspersky antivirus as the RANKY.GEN TROJAN!"
X	MSPQFile	MSA****.TMP	"Homepage hijacker. See here for more information. **** can be anything"
X	MSPRO32	[path to worm]	"Added by the IBERIO WORM!"
X	MSPRO32	pnp.exe	"Added by the ZOTOB.O WORM!"
X	MSprotect.exe	MSprotect.exe	"Added by the DABYREV.A VIRUS!"
U	mspwr	pupstman.exe	""Transparent icon background" feature of Ashampoo's PowerUp XP (WinNT/2K/XP) and PowerUp Deluxe (Win98/Me) "
U	mspwr	pupxpman.exe	"Related to Ashampoo's PowerUp XP"
U	mspwr	pwrupst.exe	"Ashampoo PowerUp XP is a ""tool for fine-tuning your Windows NT4
U	mspwr	PuXpMan2.exe	"Related to Ashampoo Magic Defrag Utility"
N	MSPY2002	ImScInst.exe	"Part of Microsoft's Input Message Editor (IME) for translating Japanese/Chinese text in IE
X	msqssr	msqssr.exe	Detected by Kaspersky as the DLUCA.GEN TROJAN!
X	MSR	msr.exe	"Added by the AGOBOT.RT WORM!"
X	Msrc	Msrc.exe	Added by the KRYPTONIC GHOST TROJAN!
X	msreg.exe	msrege.exe	"Added by the ZINX TROJAN!"
X	msReg32 Loader	msreg32.exe	"Added by the AGOBOT.IU WORM!"
X	MSREGIT	Msgp.exe	"Added by the KRYPGHOS.13 TROJAN!"
U	MSRegScan	SGP.exe	"SpyGator is a surveillance software program that monitors Internet activity
X	MSRegScan	SSDemo.exe	"Supremespy spyware"
U	MSRegScan	ETNKL.exe	"Added by the ComKeylogger surveillance software. Uninstall this software unless you put it there yourself"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list