HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
X	MSUpdateDevKit	axfd.exe	"Added by the SDBOT-ZD WORM!"
X	msupdater	msupdater.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X	MsUpdater System	udpsys32.exe	"Added by the RBOT.AAA WORM!"
X	MSupdater.exe	N/A	"CoolWebSearch parasite variant. Installs the Winshow.dll browser plugin"
X	msupdater25	lsasser.exe	"Added by the RBOT-ATS WORM!"
X	msupdates	msupdt.exe	"Added by the RBOT-JO WORM!"
X	MSUpdSrv	msupdsrv.exe	Browser hijacker redirecting to a adult content site
X	msurl	msurl32.exe	"Added by the CRYPTER.A TROJAN!"
X	msuser32.exe	msuser32.exe	"Added by the ANDROV TROJAN!"
X	MsVBdll	sys32dll.exe	"Added by the AIMDES.B or AIMDES.C WORMS!"
X	MsVBdll	MsVBdll.pif	"Added by the AIMDES.A WORM!"
X	MSVBVM60	MSVBVBM60.pif	"Added by the SCOLD-B WORM!"
X	msvc32	msvc32.exe	"ClientMan parasite variant"
X	msvc32	msvc32.exe	"Added by the AGOBOT-NT WORM!"
X	msvcc	msvchost.exe	"Added by the XOMBE TROJAN!"
X	msvcc25	svcchost.exe	"Added by a variant of the SDBOT WORM!"
X	msvcc25	salvage.exe	"Added by a variant of the SDBOT WORM!"
X	msvcc25	svcchost.exe	"Added by the SDBOT-CSE WORM!"
X	msvccc66	svcchosst.exe	"Added by the RBOT-GLS WORM!"
X	msvccc66	dload.exe	"Added by a variant of the RBOT WORM!"
X	msvecurity	msvecurity.exe	"Added by the DORF-BO WORM!"
X	MSVersion	INTERNETFEATURES.exe	"Added by the POPMON.A TROJAN! - also known as PopMonster adware"
X	MSVersion	clrschp038.exe	"Added by the POPMON.A TROJAN! - also known as PopMonster adware"
X	msvhost	aig.exe	"Added by the AIMBOT-BC TROJAN!"
X	msvload32	msvload32.exe	"Added by the RBOT-ACI WORM!"
X	msvps	msvps.exe	"Added by the AGOBOT.ALI WORM!"
X	msvsc32	msdev.exe	"Added by the RBOT-GJ WORM!"
X	MSVsmt	rpcxctx.exe	Added by an unidentified WORM or TROJAN!
X	msvss	msvss.exe	"Added by a variant of the RBOT WORM!"
X	MSVSync	videosync.exe	"Added by a variant of the SPYBOT WORM!"
X	msvupdater	msvupdater.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X	MSVXD	MSVXD.EXE	"Added by the DATOM.A WORM!"
X	mswave	mswave.exe	"Added by the CRYPTER.A TROJAN!"
X	Mswavedll	mswavedll.exe	"Added by the CRYPTER-C TROJAN!"
U	MSwheel	mswheel.exe	Microsoft Intellipoint software for their Intellimouse series of mice - required if you use non-standard Windows driver features
X	MSWin	mswin.exe	"Added by the BANKER-CU TROJAN!"
X	Mswincfg	Mswincfg32.exe	"Added by the CYBRSPY.D TROJAN!"
X	MsWindows DRT Drivers	wsdrt32.exe	"Added by the RBOT.ALT WORM!"
X	MsWindows SSL Drivers	mssl32.exe	"Added by the SPYBOT.API WORM!"
X	MsWindows SysDate	sysmsvc.exe	"Added by the SPYBOT.FCD WORM!"
X	MSWindows Syspg	mspg32.exe	"Added by the RBOT-TB WORM!"
X	MSWindowsUpdate	Systern.exe	"Added by the RBOT-AFD WORM!"
X	MSWindowsUpdate	mswinup.exe	"Added by a variant of the SDBOT WORM!"
X	MSWinlogon	SynCor.exe	"Added by the AGENT-FZL TROJAN!"
X	MSWinlogon	winlogon.exe	"Added by the AGENT-FZM TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Mswinpid32	mswinpid32.exe	Added by the LAPOS.A TROJAN! This is a keylogger which emails back to China PayPal passwords and account information - thus allowing the perpetrators to steal PayPal funds in the name of the victim!
X	MSWinSrv	MSWinSrv.exe	"Added by the MTRON TROJAN!"
X	MSWinSrv32	MSWinSrv32.exe	"Added by the MTRON-B TROJAN!"
X	MSWinupd	winupd.exe	"Added by the DLOADER-YE or DLOADR-AAA or DLOADER-ZF TROJANS - and others"
X	MSWinupdate	winupdate.exe	"Added by the DLOADR-AAW TROJAN!"
X	MsWinVgr	msvgr.exe	"Added by the MYTOB.LE WORM!"
X	mswiz32	mswiz32.exe	"Added by the STRATIO-BG WORM!"
X	mswkork Service	msework.exe	"Added by a variant of the RBOT WORM!"
X	msword	msword.exe	"Added by the RBOT-ADR WORM!"
X	mswspl	[random filename]	"Added by the SMALL.IQ TROJAN!"
X	mswspl	searchbarcash.exe	SearchBarCash adware
X	mswspl	vnmispoisn downloader.exe	SearchBarCash adware variant
X	mswspl	plugin1.exe	"Added by the SMALL.IQ TROJAN!"
X	MSWTL32	MSATL32.exe	"Added by an unidentified WORM or TROJAN! See here"
X	msxct	msxct.exe	"eXact Advertising (NaviSearch BargainBuddy CashBack) adware"
X	Msy Startups	msyh32.exe	"Added by the AGOBOT-QC WORM!"
X	Msy1 Startups	msyj32.exe	"Added by the AGOBOT-QQ WORM!"
X	msys lptt01	msys.exe	"RapidBlaster variant (in a ""Msyss"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Msys32	morfitwebentrance.exe	"Morfit ADjectPager - ""uses home page rental technology for generating revenues"". Homepage hi-jacker that re-defines your IE or Netscape start page as http://www.web-entrance.com/. Any installed application including this must be un-installed before you can reset your homepage"
X	MSysDrv	msdrv.exe	Added by the VB.WF TROJAN!
X	ms_anti_spyware	mwfirewall.exe	"Added by the GAMQOWI TROJAN!"
X	ms_anti_spywarebxp	mwfirebpx.exe	"Added by the SURILA-D TROJAN!"
X	ms_anti_spywarebxp	mwfibpx.exe	"Added by the SURILA-J TROJAN!"
X	MS_LARISSA	MS_LARISSA.exe	"Added by the ASSIRAL WORM!"
X	MS_NETD_WIN32	netd32.EXE	"Added by the RANDEX.F WORM!"
X	MS_SETUP.EXE	MS_SETUP.EXE	"Added by the CHARGE TROJAN!"
X	MS_Update Check	wdfmgr.exe	"Added by the AGOBOT-TB WORM!"
X	MS_update_0704_KB74073.exe	MS_update_0704_KB74073.exe	"Added by a variant of the UPDATEKB TROJAN!"
N	MtdAcq	MtdAcq.exe	"Creative MediaSource ""Media Sniffer"" - monitors the drive for new media files then automatically adds them to the media library"
?	MtdAcqu	MtdAcqu.exe	"Metadata monitor part of Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly."" Collects information on the songs. Is it required?"
X	Mtr2	mtr2.exe	Added by the KRYPTONIC GHOST TROJAN!
U	MUAL	mual.exe	Millesky video mail updater and launcher
N	muamgr	muamgr.exe	"Using MicroAngelo On Display you can easily select the icon images that you prefer rather than the default icons displayed by Windows. On Display provides a consistent and elegant method to customize the icon display for almost every icon on your system"
X	muBlinder	muBlinder.exe	Program that bypasses Microsoft Update?s Genuine Windows Validation
?	Mufix	mufix.exe	"Part of INFOConnect web-based enterprise client configuration management and deployment software as used by ABSS (a financial management system used by the US military which will allow purchase request packages to be electronically submitted to contracting and which also facilitates electronic receipt of items and EFT) - what does it do and is it required"
X	mule_st_key	flec006.exe	"Added by the BAGLE.AV TROJAN!"
U	Multi-function keyboard	GWHotkey.exe	Software that sets up the Gateway AnyKey keyboard shortcuts (a series of buttons that allow one-click access to e-mail browser volume and CD/DVD controls etc)
U	MultiCAM Initializer	MCamBoot.exe	"The MultiCAM Initializer is part of the MultiCAM software package provided by Vista Imaging in order to run up to 10 USB ViCAM or 3Com Home Connect PC Digital cameras on a single computer. Clears itself from memory once initialized but can also be safely disabled"
X	Multimedia Codecs	mcc.exe	"Added by the DLOADER-MB TROJAN!"
X	Multimedia extensions	mservice.exe	"EasySearch adware"
X	Multimedia extensions	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Multimedia extensions	mservice1.exe	"Added by the DLOADR-AWD TROJAN!"
U	Multimedia KBD	MMKeybd.exe	Multimedia keyboard manager. Required if you use the additional keys
U	MULTIMEDIA KEYBOARD	MMKeybd.exe	Multimedia keyboard manager. Required if you use the additional keys
X	multiran	multiran.exe	"Added by the COSIAM-E TROJAN!"
U	MultiRes	MultiRes.exe	"MultiRes - system tray utility allowing quick access to changing desktop resolutions and has the ability to lock the screen refresh rate in WinNT/2K/XP"
U	MUPS	MUPS.exe	"Launches the Belkin Bulldog Plus Service - required if you want to access the UPS advanced functions"
Y	murphy shield	lmgui.exe	"Firewall part of BitDefender virus scanner/firewall"
N	Music01 Server	Music01 Server.exe	"J River Media Jukebox"
X	MusIRC (irc.music.com) client	musirc4.71.exe	"Added by the RANDEX.Q WORM!"
X	Mustafx	mustafx.exe	Added by a variant of the VIRANTIX.B TROJAN!
?	Mustek MDC 3000	Mounter.exe	"Related to software for the Mustek MDC 3000 digital camera - what does it do and is it required?"
N	MutexServiceEx	Sys32Smm.exe	"Webroot Sofware's discontinued ""Privacy Master"""
X	mv2	crasos.exe	"Added by the DROPPS-A TROJAN!"
U	MVRescue	mvrescue	Related to Multivision Computers back up/restore program. Multivision Computers ceased operating in 2004
X	mvsyswina	acsysiom.exe	"Added by a variant of the SDBOT WORM!"
U	MW1HelperStartUp	MW1HEL~1.EXE	"ScreenScenes ""Magic Waterfall"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	MW1HelperStartUp	Mw1helper.exe	"ScreenScenes ""Magic Waterfall"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	mwavscan	mwavscan.com	MicroWorld Anti Virus Toolkit is a free anti-virus scanner that runs on-demand. You can choose to scan your entire system including memory services starup items and registry or only scan files in a specified folder or drive
U	MWLExe	MwlGui.exe	"Part of McAfee Wireless Protection for Wi-Fi users"
N	MWProEng	MWProEng.exe	Logitech Mouseware Pro software - only required when using special functions
N	MWSnap	MWSnap.exe	"MWSnap - screen capture utility. Start manually when required"
X	mwsoemon	mwsoemon.exe	"MyWebSearch parasite"
X	Mwsvm	mwsvm.exe	"SeekSeek search hijacker related - see here"
X	mxb2	[path to worm]	"Added by the IXBOT-G WORM!"
X	MxHLp32	MxHLp32.exe	"Added by a variant of the VAGRNOCKER TROJAN!"
X	mxjxde.exe	mxjxde.exe	"Added by the ORCU.B TROJAN!"
U	MXO Auto Loader	MXOaldr.exe	Maxtor includes a driver to bypass the Windows certified drivers check just when it detects an external drive. MXOaldr.exe is installed with the new driver and if disabled the button on a Maxtor OneTouch External Store no longer functions
U	MXOBG	MXOALDR.EXE	Maxtor includes a driver to bypass the Windows certified drivers check just when it detects an external drive. MXOaldr.exe is installed with the new driver and if disabled the button on a Maxtor OneTouch External Store no longer functions
?	mxomssmenu	maxmenumgr.exe	"Related to Maxtor's One Touch series of external hard drives. What does it do and is it required?"
U	MxRunner	MxRunner.exe	EasyUninstall from Aladdin Systems (formerly by Ontrack)
U	Mxvgautil	Mxvgautil.EXE	"Utility for a USB to VGA converter from MCT Corp"
X	My Agent	msagent.exe	"Added by the NEGASMS.A TROJAN!"
X	My App	SMSSvc.exe	"Added by the NEGASMS.A TROJAN!"
U	My Essentials Wireless USB Utility	O-Maxwcui.exe	"Belkin My Essentials Wireless USB Utility"
X	My Search Bar Eq	S4BAREQ.EXE	"MySearch parasite"
X	My Web Search Bar	MWSBAR.DLL	"MyWay - an IE Browser Helper Object used by adware WebSearch to add an IE toolbar to provide search features and hijack browser search requests to its controlling servers run by MyWay"
X	My Web Search Bar Search Scope Monitor	m3SrchMn.exe	"MyWebSearch parasite"
X	My Web Search Community Tools	m3IMPipe.exe	"MyWebSearch parasite"
U	My-disgo	MyKey disgo.exe	"Related to disgo pro. Program will synchronize data"
X	MyAccessMedia	tmp**.exe [* = random char/digit]	My AccessMedia toolbar related stealth installed!
U	MyAgtTry	MyAgtTry.exe	"System tray notification for McAfee VirusScan ASaP on-line scanner. Not required to be protected but you lose notifications"
X	Myapp	[filename]	"Added by the FATEE.B WORM!"
X	Myapp	service.exe	Homepage hijacker
X	MyAV	avpguard.exe	"Added by the NETSKY.J WORM!"
Y	MyCIO Agent Service	myagtsvc.exe	"McAfee VirusScan ASaP Agent service"
U	myCIO.com ASaP	MyAgtTry.exe	"System tray notification for McAfee VirusScan ASaP on-line scanner. Not required to be protected but you lose notifications"
N	myCIO.com Splash	Splash.exe	"Splash screen for McAfee VirusScan ASaP on-line scanner"
X	myCleanerPC	myCleanerPC.exe	"MyCleanerPC spyware remover - not recommended see here"
X	MyCometCursor	MYCOME~1.EXE	"Comet Cursor adware"
X	MyDailyHoroscope	MYDAIL~1.EXE	"MyDailyHoroscope foistware"
X	MyDailyHoroscope	MyDailyHoroscope.exe	"MyDailyHoroscope foistware"
U	MyEmoticons	MYEMOTICONS.EXE	"MyEmoticons from Persona Ltd - add icons (emoticons) to your E-mail"
X	MyFastAccess	myfastupdate.exe	My-Fast-Access toolbar updater
X	myhuy	huy.exe	"Added by the BLASTER-C WORM!"
X	myhuy	huy2.exe	"Added by the BLASTER-L WORM!"
U	MyIE.exe	MyIE.exe	"MyIE2/Maxthon browser related"
X	MyLife	CmdServ.exe	"Added by the HOLAR.A WORM!"
X	myMh2	iexpl0re.exe	"Added by the DELF.FAI TROJAN!"
U	myNetWatchman	nwclient.exe	"Sends your firewall alerts to a website which then filters them and forwards details of suspicious activities to the host ISP they originated from. Only needs to be running when your firewall is running"
X	MyPointsPointAlert	wjview ...MyPointsPointAlertrun.exe	"""With MyPoints you can earn rewards from name-brand merchants. You can even earn vacations and frequent flyer miles"". Dubious privacy policy"
U	MyPopupKiller	mpk.exe	"MyPopupKiller - popup killer"
U	myprint mileage	mpm.exe	Reports battery status on a portable printer
X	Mysee Alert	Mysee Alert.exe	"MySee Alert adware"
X	MyShares	MyShares.exe	"EHU adware"
X	MySLScan	msvc32.exe	"Added by the FORBOT-EH WORM!"
X	mysoft	winexplor.exe	"Browser hijacker also detected as the STARTPA-JR TROJAN!"
N	MySoftware NewsFlash	Newsflsh.exe	"Runs in your task bar and receives alerts and release information on MySoftware products from Avenquest"
N	MySpaceIM	MySpaceIM.exe	"MySpaceIM internet messenger"
X	mysvcig38	mysvcc.exe	"Added by the RBOT-FOU WORM!"
X	mysvcig38	recsl.exe	"Added by a variant of the RBOT-FOU WORM!"
X	MyTam	MyTam.exe	"Covert Sys Exec malware variant"
U	MytekSystrayExePath	MyTekSystray.exe	"MyTek system tray - web site providing computer tech support in Australia"
X	MyTotalSearch Email Plugin	mtsoemon.exe	"MyTotalSearchBar adware"
X	MyVBApp	SysNT.exe	"ReferAd adware"
X	MyVBApp	install.exe	"Detected as Generic Downloader.s by McAfee probable variant of ReferAd adware!"
X	MyVBApp	setup.exe	"Detected by Kaspersky as the VB.KB TROJAN! File location is in the Root folder (C:) (D:) etc"
X	MyVirt.exe	MyVirt.exe	"Added by the REMADM-C TROJAN!"
U	MyVitalAgent	VtlAgent.exe	"MyVitalAgent from Lucent Technologies. Replacement for Net.Medic monitoring all popular internet transactions and alerting the user of the location of connection problems. Available via Start -> Programs"
X	MyWebSearch Email Plugin	mwsoemon.exe	"MyWebSearch parasite"
X	MyWebSearch Plugin	rundll32 [path] M3PLUGIN.DLLUPF	"MyWebSearch parasite. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	My_Heart	My_Heart.exe	"Added by the SILLYFDC-AD WORM!"
U	N2PTray	Net2fone.exe	"An Internet telephony application. Needed only if you have an account at Net2Phone Inc"
N	NADaemon	NADAEMON.EXE	"Program by NetActive which appears to be piggybacked onto some Nvidia graphics cards software. They seem to look after ""digital rights management"". One user reports disabling it has no detrimental affect - not required"
N	Naggerrunkey	nagger.exe	Packard Bell Free Internet Signup screen
Y	Naimagent_service	EPOAgentnaimas32.exe	Networked version of McAfee VirusScan. Installs configures and updates the software and DAT (virus definition) files on local computers from a network server. A resource hog but required for DAT updates and if disabled can also cause random freezes and error messages
Y	Naimagent_UI	EPOAgentnaimag32.exe	Workstation background program for Network Associates McAfee ePolicy Orchestrator - a network management tool for enforcing antivirus protection of the workstations using system policies. Works with both McAfee and Norton AntiVirus. NAIMAG32 and NAIMAS32 communicate with the ePolicy Orchestrator processes on the network fileserver to check for virus updates or for the need to perform a virus scan
Y	Naimagent_UI	naimag32.exe	Workstation background program for Network Associates McAfee ePolicy Orchestrator - a network management tool for enforcing antivirus protection of the workstations using system policies. Works with both McAfee and Norton AntiVirus. NAIMAG32 and NAIMAS32 communicate with the ePolicy Orchestrator processes on the network fileserver to check for virus updates or for the need to perform a virus scan
X	Name	Iexplorer0.exe	"Added by the THREADSYS TROJAN!"
X	Name Server	mswins.exe	"Added by a variant of the SDBOT WORM!"
X	NAMEDPIPE SYSTEM	namedpipe.exe	"Added by the MYTOB-FH TROJAN!"
X	nano	svchost.exe	"Added by the NANO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	NAP32	NAP32.exe	Premium rate adult content dialler
X	NarmonVirusAnti	smss.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
X	Narrator	******.exe [* = random char]	"Added by the QOOLOGIC TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list