Arcade File Downloads Support Forum
Email
Confirm email
Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown
Startup Name Process Name Details
X MSUpdateDevKit axfd.exe"Added by the SDBOT-ZD WORM!"
X msupdater msupdater.exe"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X MsUpdater System udpsys32.exe"Added by the RBOT.AAA WORM!"
X MSupdater.exe N/A"CoolWebSearch parasite variant. Installs the Winshow.dll browser plugin"
X msupdater25 lsasser.exe"Added by the RBOT-ATS WORM!"
X msupdates msupdt.exe"Added by the RBOT-JO WORM!"
X MSUpdSrv msupdsrv.exeBrowser hijacker redirecting to a adult content site
X msurl msurl32.exe"Added by the CRYPTER.A TROJAN!"
X msuser32.exe msuser32.exe"Added by the ANDROV TROJAN!"
X MsVBdll sys32dll.exe"Added by the AIMDES.B or AIMDES.C WORMS!"
X MsVBdll MsVBdll.pif"Added by the AIMDES.A WORM!"
X MSVBVM60 MSVBVBM60.pif"Added by the SCOLD-B WORM!"
X msvc32 msvc32.exe"ClientMan parasite variant"
X msvc32 msvc32.exe"Added by the AGOBOT-NT WORM!"
X msvcc msvchost.exe"Added by the XOMBE TROJAN!"
X msvcc25 svcchost.exe"Added by a variant of the SDBOT WORM!"
X msvcc25 salvage.exe"Added by a variant of the SDBOT WORM!"
X msvcc25 svcchost.exe"Added by the SDBOT-CSE WORM!"
X msvccc66 svcchosst.exe"Added by the RBOT-GLS WORM!"
X msvccc66 dload.exe"Added by a variant of the RBOT WORM!"
X msvecurity msvecurity.exe"Added by the DORF-BO WORM!"
X MSVersion INTERNETFEATURES.exe"Added by the POPMON.A TROJAN! - also known as PopMonster adware"
X MSVersion clrschp038.exe"Added by the POPMON.A TROJAN! - also known as PopMonster adware"
X msvhost aig.exe"Added by the AIMBOT-BC TROJAN!"
X msvload32 msvload32.exe"Added by the RBOT-ACI WORM!"
X msvps msvps.exe"Added by the AGOBOT.ALI WORM!"
X msvsc32 msdev.exe"Added by the RBOT-GJ WORM!"
X MSVsmt rpcxctx.exeAdded by an unidentified WORM or TROJAN!
X msvss msvss.exe"Added by a variant of the RBOT WORM!"
X MSVSync videosync.exe"Added by a variant of the SPYBOT WORM!"
X msvupdater msvupdater.exe"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X MSVXD MSVXD.EXE"Added by the DATOM.A WORM!"
X mswave mswave.exe"Added by the CRYPTER.A TROJAN!"
X Mswavedll mswavedll.exe"Added by the CRYPTER-C TROJAN!"
U MSwheel mswheel.exeMicrosoft Intellipoint software for their Intellimouse series of mice - required if you use non-standard Windows driver features
X MSWin mswin.exe"Added by the BANKER-CU TROJAN!"
X Mswincfg Mswincfg32.exe"Added by the CYBRSPY.D TROJAN!"
X MsWindows DRT Drivers wsdrt32.exe"Added by the RBOT.ALT WORM!"
X MsWindows SSL Drivers mssl32.exe"Added by the SPYBOT.API WORM!"
X MsWindows SysDate sysmsvc.exe"Added by the SPYBOT.FCD WORM!"
X MSWindows Syspg mspg32.exe"Added by the RBOT-TB WORM!"
X MSWindowsUpdate Systern.exe"Added by the RBOT-AFD WORM!"
X MSWindowsUpdate mswinup.exe"Added by a variant of the SDBOT WORM!"
X MSWinlogon SynCor.exe"Added by the AGENT-FZL TROJAN!"
X MSWinlogon winlogon.exe"Added by the AGENT-FZM TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X Mswinpid32 mswinpid32.exeAdded by the LAPOS.A TROJAN! This is a keylogger which emails back to China PayPal passwords and account information - thus allowing the perpetrators to steal PayPal funds in the name of the victim!
X MSWinSrv MSWinSrv.exe"Added by the MTRON TROJAN!"
X MSWinSrv32 MSWinSrv32.exe"Added by the MTRON-B TROJAN!"
X MSWinupd winupd.exe"Added by the DLOADER-YE or DLOADR-AAA or DLOADER-ZF TROJANS - and others"
X MSWinupdate winupdate.exe"Added by the DLOADR-AAW TROJAN!"
X MsWinVgr msvgr.exe"Added by the MYTOB.LE WORM!"
X mswiz32 mswiz32.exe"Added by the STRATIO-BG WORM!"
X mswkork Service msework.exe"Added by a variant of the RBOT WORM!"
X msword msword.exe"Added by the RBOT-ADR WORM!"
X mswspl [random filename]"Added by the SMALL.IQ TROJAN!"
X mswspl searchbarcash.exeSearchBarCash adware
X mswspl vnmispoisn downloader.exeSearchBarCash adware variant
X mswspl plugin1.exe"Added by the SMALL.IQ TROJAN!"
X MSWTL32 MSATL32.exe"Added by an unidentified WORM or TROJAN! See here"
X msxct msxct.exe"eXact Advertising (NaviSearch BargainBuddy CashBack) adware"
X Msy Startups msyh32.exe"Added by the AGOBOT-QC WORM!"
X Msy1 Startups msyj32.exe"Added by the AGOBOT-QQ WORM!"
X msys lptt01 msys.exe"RapidBlaster variant (in a ""Msyss"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X Msys32 morfitwebentrance.exe"Morfit ADjectPager - ""uses home page rental technology for generating revenues"". Homepage hi-jacker that re-defines your IE or Netscape start page as http://www.web-entrance.com/. Any installed application including this must be un-installed before you can reset your homepage"
X MSysDrv msdrv.exeAdded by the VB.WF TROJAN!
X ms_anti_spyware mwfirewall.exe"Added by the GAMQOWI TROJAN!"
X ms_anti_spywarebxp mwfirebpx.exe"Added by the SURILA-D TROJAN!"
X ms_anti_spywarebxp mwfibpx.exe"Added by the SURILA-J TROJAN!"
X MS_LARISSA MS_LARISSA.exe"Added by the ASSIRAL WORM!"
X MS_NETD_WIN32 netd32.EXE"Added by the RANDEX.F WORM!"
X MS_SETUP.EXE MS_SETUP.EXE"Added by the CHARGE TROJAN!"
X MS_Update Check wdfmgr.exe"Added by the AGOBOT-TB WORM!"
X MS_update_0704_KB74073.exe MS_update_0704_KB74073.exe"Added by a variant of the UPDATEKB TROJAN!"
N MtdAcq MtdAcq.exe"Creative MediaSource ""Media Sniffer"" - monitors the drive for new media files then automatically adds them to the media library"
? MtdAcqu MtdAcqu.exe"Metadata monitor part of Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly."" Collects information on the songs. Is it required?"
X Mtr2 mtr2.exeAdded by the KRYPTONIC GHOST TROJAN!
U MUAL mual.exeMillesky video mail updater and launcher
N muamgr muamgr.exe"Using MicroAngelo On Display you can easily select the icon images that you prefer rather than the default icons displayed by Windows. On Display provides a consistent and elegant method to customize the icon display for almost every icon on your system"
X muBlinder muBlinder.exeProgram that bypasses Microsoft Update?s Genuine Windows Validation
? Mufix mufix.exe"Part of INFOConnect web-based enterprise client configuration management and deployment software as used by ABSS (a financial management system used by the US military which will allow purchase request packages to be electronically submitted to contracting and which also facilitates electronic receipt of items and EFT) - what does it do and is it required"
X mule_st_key flec006.exe"Added by the BAGLE.AV TROJAN!"
U Multi-function keyboard GWHotkey.exeSoftware that sets up the Gateway AnyKey keyboard shortcuts (a series of buttons that allow one-click access to e-mail browser volume and CD/DVD controls etc)
U MultiCAM Initializer MCamBoot.exe"The MultiCAM Initializer is part of the MultiCAM software package provided by Vista Imaging in order to run up to 10 USB ViCAM or 3Com Home Connect PC Digital cameras on a single computer. Clears itself from memory once initialized but can also be safely disabled"
X Multimedia Codecs mcc.exe"Added by the DLOADER-MB TROJAN!"
X Multimedia extensions mservice.exe"EasySearch adware"
X Multimedia extensions [path to trojan]"Added by the SMUTSRCH-A TROJAN!"
X Multimedia extensions mservice1.exe"Added by the DLOADR-AWD TROJAN!"
U Multimedia KBD MMKeybd.exeMultimedia keyboard manager. Required if you use the additional keys
U MULTIMEDIA KEYBOARD MMKeybd.exeMultimedia keyboard manager. Required if you use the additional keys
X multiran multiran.exe"Added by the COSIAM-E TROJAN!"
U MultiRes MultiRes.exe"MultiRes - system tray utility allowing quick access to changing desktop resolutions and has the ability to lock the screen refresh rate in WinNT/2K/XP"
U MUPS MUPS.exe"Launches the Belkin Bulldog Plus Service - required if you want to access the UPS advanced functions"
Y murphy shield lmgui.exe"Firewall part of BitDefender virus scanner/firewall"
N Music01 Server Music01 Server.exe"J River Media Jukebox"
X MusIRC (irc.music.com) client musirc4.71.exe"Added by the RANDEX.Q WORM!"
X Mustafx mustafx.exeAdded by a variant of the VIRANTIX.B TROJAN!
? Mustek MDC 3000 Mounter.exe"Related to software for the Mustek MDC 3000 digital camera - what does it do and is it required?"
N MutexServiceEx Sys32Smm.exe"Webroot Sofware's discontinued ""Privacy Master"""
X mv2 crasos.exe"Added by the DROPPS-A TROJAN!"
U MVRescue mvrescueRelated to Multivision Computers back up/restore program. Multivision Computers ceased operating in 2004
X mvsyswina acsysiom.exe"Added by a variant of the SDBOT WORM!"
U MW1HelperStartUp MW1HEL~1.EXE"ScreenScenes ""Magic Waterfall"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U MW1HelperStartUp Mw1helper.exe"ScreenScenes ""Magic Waterfall"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U mwavscan mwavscan.comMicroWorld Anti Virus Toolkit is a free anti-virus scanner that runs on-demand. You can choose to scan your entire system including memory services starup items and registry or only scan files in a specified folder or drive
U MWLExe MwlGui.exe"Part of McAfee Wireless Protection for Wi-Fi users"
N MWProEng MWProEng.exeLogitech Mouseware Pro software - only required when using special functions
N MWSnap MWSnap.exe"MWSnap - screen capture utility. Start manually when required"
X mwsoemon mwsoemon.exe"MyWebSearch parasite"
X Mwsvm mwsvm.exe"SeekSeek search hijacker related - see here"
X mxb2 [path to worm]"Added by the IXBOT-G WORM!"
X MxHLp32 MxHLp32.exe"Added by a variant of the VAGRNOCKER TROJAN!"
X mxjxde.exe mxjxde.exe"Added by the ORCU.B TROJAN!"
U MXO Auto Loader MXOaldr.exeMaxtor includes a driver to bypass the Windows certified drivers check just when it detects an external drive. MXOaldr.exe is installed with the new driver and if disabled the button on a Maxtor OneTouch External Store no longer functions
U MXOBG MXOALDR.EXEMaxtor includes a driver to bypass the Windows certified drivers check just when it detects an external drive. MXOaldr.exe is installed with the new driver and if disabled the button on a Maxtor OneTouch External Store no longer functions
? mxomssmenu maxmenumgr.exe"Related to Maxtor's One Touch series of external hard drives. What does it do and is it required?"
U MxRunner MxRunner.exeEasyUninstall from Aladdin Systems (formerly by Ontrack)
U Mxvgautil Mxvgautil.EXE"Utility for a USB to VGA converter from MCT Corp"
X My Agent msagent.exe"Added by the NEGASMS.A TROJAN!"
X My App SMSSvc.exe"Added by the NEGASMS.A TROJAN!"
U My Essentials Wireless USB Utility O-Maxwcui.exe"Belkin My Essentials Wireless USB Utility"
X My Search Bar Eq S4BAREQ.EXE"MySearch parasite"
X My Web Search Bar MWSBAR.DLL"MyWay - an IE Browser Helper Object used by adware WebSearch to add an IE toolbar to provide search features and hijack browser search requests to its controlling servers run by MyWay"
X My Web Search Bar Search Scope Monitor m3SrchMn.exe"MyWebSearch parasite"
X My Web Search Community Tools m3IMPipe.exe"MyWebSearch parasite"
U My-disgo MyKey disgo.exe"Related to disgo pro. Program will synchronize data"
X MyAccessMedia tmp**.exe [* = random char/digit]My AccessMedia toolbar related stealth installed!
U MyAgtTry MyAgtTry.exe"System tray notification for McAfee VirusScan ASaP on-line scanner. Not required to be protected but you lose notifications"
X Myapp [filename]"Added by the FATEE.B WORM!"
X Myapp service.exeHomepage hijacker
X MyAV avpguard.exe"Added by the NETSKY.J WORM!"
Y MyCIO Agent Service myagtsvc.exe"McAfee VirusScan ASaP Agent service"
U myCIO.com ASaP MyAgtTry.exe"System tray notification for McAfee VirusScan ASaP on-line scanner. Not required to be protected but you lose notifications"
N myCIO.com Splash Splash.exe"Splash screen for McAfee VirusScan ASaP on-line scanner"
X myCleanerPC myCleanerPC.exe"MyCleanerPC spyware remover - not recommended see here"
X MyCometCursor MYCOME~1.EXE"Comet Cursor adware"
X MyDailyHoroscope MYDAIL~1.EXE"MyDailyHoroscope foistware"
X MyDailyHoroscope MyDailyHoroscope.exe"MyDailyHoroscope foistware"
U MyEmoticons MYEMOTICONS.EXE"MyEmoticons from Persona Ltd - add icons (emoticons) to your E-mail"
X MyFastAccess myfastupdate.exeMy-Fast-Access toolbar updater
X myhuy huy.exe"Added by the BLASTER-C WORM!"
X myhuy huy2.exe"Added by the BLASTER-L WORM!"
U MyIE.exe MyIE.exe"MyIE2/Maxthon browser related"
X MyLife CmdServ.exe"Added by the HOLAR.A WORM!"
X myMh2 iexpl0re.exe"Added by the DELF.FAI TROJAN!"
U myNetWatchman nwclient.exe"Sends your firewall alerts to a website which then filters them and forwards details of suspicious activities to the host ISP they originated from. Only needs to be running when your firewall is running"
X MyPointsPointAlert wjview ...MyPointsPointAlertrun.exe"""With MyPoints you can earn rewards from name-brand merchants. You can even earn vacations and frequent flyer miles"". Dubious privacy policy"
U MyPopupKiller mpk.exe"MyPopupKiller - popup killer"
U myprint mileage mpm.exeReports battery status on a portable printer
X Mysee Alert Mysee Alert.exe"MySee Alert adware"
X MyShares MyShares.exe"EHU adware"
X MySLScan msvc32.exe"Added by the FORBOT-EH WORM!"
X mysoft winexplor.exe"Browser hijacker also detected as the STARTPA-JR TROJAN!"
N MySoftware NewsFlash Newsflsh.exe"Runs in your task bar and receives alerts and release information on MySoftware products from Avenquest"
N MySpaceIM MySpaceIM.exe"MySpaceIM internet messenger"
X mysvcig38 mysvcc.exe"Added by the RBOT-FOU WORM!"
X mysvcig38 recsl.exe"Added by a variant of the RBOT-FOU WORM!"
X MyTam MyTam.exe"Covert Sys Exec malware variant"
U MytekSystrayExePath MyTekSystray.exe"MyTek system tray - web site providing computer tech support in Australia"
X MyTotalSearch Email Plugin mtsoemon.exe"MyTotalSearchBar adware"
X MyVBApp SysNT.exe"ReferAd adware"
X MyVBApp install.exe"Detected as Generic Downloader.s by McAfee probable variant of ReferAd adware!"
X MyVBApp setup.exe"Detected by Kaspersky as the VB.KB TROJAN! File location is in the Root folder (C:) (D:) etc"
X MyVirt.exe MyVirt.exe"Added by the REMADM-C TROJAN!"
U MyVitalAgent VtlAgent.exe"MyVitalAgent from Lucent Technologies. Replacement for Net.Medic monitoring all popular internet transactions and alerting the user of the location of connection problems. Available via Start -> Programs"
X MyWebSearch Email Plugin mwsoemon.exe"MyWebSearch parasite"
X MyWebSearch Plugin rundll32 [path] M3PLUGIN.DLLUPF"MyWebSearch parasite. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X My_Heart My_Heart.exe"Added by the SILLYFDC-AD WORM!"
U N2PTray Net2fone.exe"An Internet telephony application. Needed only if you have an account at Net2Phone Inc"
N NADaemon NADAEMON.EXE"Program by NetActive which appears to be piggybacked onto some Nvidia graphics cards software. They seem to look after ""digital rights management"". One user reports disabling it has no detrimental affect - not required"
N Naggerrunkey nagger.exePackard Bell Free Internet Signup screen
Y Naimagent_service EPOAgentnaimas32.exeNetworked version of McAfee VirusScan. Installs configures and updates the software and DAT (virus definition) files on local computers from a network server. A resource hog but required for DAT updates and if disabled can also cause random freezes and error messages
Y Naimagent_UI EPOAgentnaimag32.exeWorkstation background program for Network Associates McAfee ePolicy Orchestrator - a network management tool for enforcing antivirus protection of the workstations using system policies. Works with both McAfee and Norton AntiVirus. NAIMAG32 and NAIMAS32 communicate with the ePolicy Orchestrator processes on the network fileserver to check for virus updates or for the need to perform a virus scan
Y Naimagent_UI naimag32.exeWorkstation background program for Network Associates McAfee ePolicy Orchestrator - a network management tool for enforcing antivirus protection of the workstations using system policies. Works with both McAfee and Norton AntiVirus. NAIMAG32 and NAIMAS32 communicate with the ePolicy Orchestrator processes on the network fileserver to check for virus updates or for the need to perform a virus scan
X Name Iexplorer0.exe"Added by the THREADSYS TROJAN!"
X Name Server mswins.exe"Added by a variant of the SDBOT WORM!"
X NAMEDPIPE SYSTEM namedpipe.exe"Added by the MYTOB-FH TROJAN!"
X nano svchost.exe"Added by the NANO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X NAP32 NAP32.exePremium rate adult content dialler
X NarmonVirusAnti smss.exe"Added by the AUTORUN-DV WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
X Narrator ******.exe [* = random char]"Added by the QOOLOGIC TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list