HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
X	runSubvalues	[path to file]	"Added by the DLOADER-QY TROJAN!"
U	RunSysd32	RunSysd32.exe	DesktopShield2000 by Stéphane Groleau. Locks the desktop at bootup so that users cannot bypass the Windows screensaver password. Only essential if using the program and is an optional setting. It can be disabled from within
X	Runtime Process	Csrss.exe	"Added by the CIADOOR-J TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	Runtt1	Internat.exe	"Added by the LINEAGE-R TROJAN!"
X	Runtt1	Internet.exe	"Added by the LINEAGE-Q TROJAN!"
X	RunWin	[path to file]	"Added by the BANKER-ES TROJAN!"
X	runwin32	runwin32.exe	"Added by the ESEARCH-A TROJAN!"
X	RUNWIN32	runwin32.exe	"Added by the VB-AET TROJAN!"
X	RunWindowsUpdate	uptodate.exe	"BrowserAid/BrowserPal foistware"
X	Run[0]	syscnfg.exe	"Added by an unidentified VIRUS
X	Run_cd	Run_cd.exe	"Added by the GHOST.23 TROJAN!"
Y	run_pbnext	PBNext.exe	"PBNext is virtual phone system which offers the same functionality as expensive PBX hardware"
U	Rupsw32	Rupsw32.exe	"MegaTec Rups
?	RUSBHOLoader	"rundll32.exe RUSBHOLoader.dll	AutoRegister"
X	RVC6Player	tskdbg.exe	"Added by the ZAPCHAS-M TROJAN!"
X	rvde	N/A	Related to li-speed****
X	RVP	bpc.exe	"Spyware included with the latest version of Grokster. Also see here"
X	rx	rundll32.exe	"Added by the Lineage-BP TROJAN! Note - this is not the legitimate Windows process (Which is found in the Windows folder for 9xMe and the System32 folder for NT2KXP). This file is found in the Windows or Winnt folder"
N	RxMon	rxmon9x.exe	"Part of Dell Resolution Assistant - ""a diagnostic program that allows you to contact Dell. When factory-installed by Dell
N	RxUser	RxUser.exe	"Part of Dell Resolution Assistant - ""a diagnostic program that allows you to contact Dell. When factory-installed by Dell
Y	r_server	r_server.exe	"Radmin - remote admistrator server"
X	r_server	service.exe	"Added by the MULTIDR-CP TROJAN!"
X	S0undMan	svch0st.exe	"Added by the LOVGATE.AB WORM! Note - the filename has the digit 0 rather then the uppercase ""o"""
?	S24EvMon	S24EvMon.exe	"Event Monitor - supports driver extensions to NIC Driver for wireless adapters. Is it required?"
X	S3 Internal Chip	s3serv.exe	"Added by the AGOBOT-DD WORM!"
N	S3apphk	S3apphk.exe	A tool installed alongside the drivers for your S3 video output device. It is not necessary but should be allowed to run unless it is causing problems
U	S3Hotkey	s3hotkey.exe	Hotkey system tray icon to enable switching between monitors. Found on laptops with an S3 Twister integrated graphics card
?	S3Mon	S3Mon.exe	"S3DuoVue multi-monitor taskbar helper by S3 Graphics. What does it do and is it required?"
N	S3TRAY	S3Tray.exe	S3 display configuration taskbar utility for S3 chipset based graphics cards. Can be run from Start-> Settings -> Control Panel -> Display
?	s3tray2	s3tray2.exe	"Same as the s3tray entry in this table?"
?	S3TRAYHP	S3trayhp.exe	"S3 Video driver related. What does it do and is it required?"
U	S4F	S4F.exe	"S4F internet filtering software"
X	s4helper	s4helper.exe	"Searchcentrix hijacker"
?	SA	Sa3.exe	"Logitech QuickCam driver. Is it required?"
?	SA Service	SAservice.exe	"Associated with Cyber Trio and Warner troubleshooting software from G-Tek Technologies and pre-installed on some Packard Bell and NEC PCs. What function does this perform and is it required?"
N	Sa3dsrv	Sa3dsrv.exe	3D sound extension for Windows
X	saap	saap.exe	"NCase adware"
N	Sabreserver	SABSERV.EXE	Airline reservation software from Sabre. Available via Start -> Programs
X	sac	sac.exe	"NCase adware"
X	SACC	sacc.exe	"SurfAccuracy adware"
N	SAClient	RegCon.exe	"AT&T or ComCast BBClient - monitors system and network-delivered services for availability. Your current network status is displayed on a color-coded web page in near-real time. When problems are detected
X	Safe	SafeWin.exe	"Added by the FOCOSENHA TROJAN!"
X	Safe	[path to trojan]	"Added by the BANKER-DT TROJAN!"
X	SafeGuard Popup Blocker Updater	regsvr32 [path] sfgupd.dll	"SafeguardProtect/Veevo hijacker"
X	SafeGuard Popup Blocker Updater (required)	regsvr32 [path] sfg****.dll [* = ramdom char/digit]	"SafeGuard Protect/Veevo - hijacker"
X	SafeGuard Popup Updater (required)	regsvr32 [path] sfg****.dll [* = ramdom char/digit]	"SafeguardProtect/Veevo hijacker"
X	SafeGuard Popup Updater (required)	regsvr32 [path] PDF****.dll [* = random char/digit]	"SafeguardProtect/Veevo hijacker"
U	SafeHouseSystemTray	SDWTRAY.EXE	"SafeHouse ""Personal Privacy"" system tray icon - PP protects and hides your private and personal photos
N	SafeInstall.exe	SAFEIN~1.EXE	Monitors a download and ensures an newer version of a file isn't replaced by an older one
N	SafeOFF	SafeOff.exe	Provides protection that if user accidentally presses the power switch a dialog will pop up for confirmation
X	SafeSearch	safesearch.exe	"SafeSearch.A adware"
X	SafeSurfingUpdate	SSUpdate.exe	"MoneyTree parasite - ActiveX control used to download premium-rate dialers"
U	SafetyNet	ipcTray.exe	"Safety.Net from Netveda - ""offers Internet security
U	SafetyNet_Notifier	ipcLn.exe	"Safety.Net from Netveda - ""offers Internet security
U	Safeworld	Freedom.exe	"SafeWorld Internet Security"
X	Sagate Security Firewall	sagate.exe	"Added by the GAOBOT.BOW WORM!"
N	SAgent2ExePath	SAgent2.exe	Seiko Epson printer status agent. Disable if printer is not used often
U	SAGENTSERVICE	Sagent.exe	"TinySpyAgent commercial keystroke logger. Uninstall this software if you did not install it yourself"
X	sagnt	sagnt.exe	Adware web downloader
X	SAHagent	Sahagent.exe	"ShopAtHomeSelect parasite"
X	SAHBundle	bundle.exe	"ShopAtHomeSelect parasite"
X	SAHBundle	shop1003.exe	"ShopAtHomeSelect parasite"
X	saie	saie.exe	"NCase adware"
U	SAIMON	SaiMon.exe	"Saitek joystick driver"
X	sain	sain.exe	"NCase adware"
X	sais	sais.exe	"NCase adware"
?	SaiSmart	SaiSmart.exe	"""Smart Button Special Sauce"" - included with the latest software for Saitek game controllers. Related to the ""S""
U	SaitekAutoConfigure	saicnfig.exe	"Configuration for Saitek game controllers"
X	Sakemsneql	simenu.exe	"Added by the SDBOT.BTO WORM!"
X	salm	salm.exe	"180Search adware"
X	salm	salm.exe	"NCase adware"
X	Sam-sung	Sam-sung.exe	"Added by a variant of the SDBOT WORM!"
U	SAMcal	SAMcal.exe	"SamCal - calendar/reminder program"
U	Sametime Connect	Connect.exe	"IBM Lotus Instant Messaging and Conferencing software"
X	Samsong	Samsong.exe	"Added by the SDBOT.BNE WORM!"
X	Samsung	Samsungs.exe	"Added by an IRC TROJAN variant!"
U	SandboxieControl	Control.exe	"SandBoxie - allows data to be read from the hard drive by an application but never written back unless you allow it"
N	SandIcon	SandIcon.exe	"SanDisk ImageMate CompactFlash card reader SDDR-31 (USB). Very little use except to place the Sandisk icon beside its drive designation in Windows Explorer. The reader itself will work fine without it. The simplest thing is to just unplug the reader when you're not using it. It may slow the startup by a few nanoseconds
X	sapp	sapp.exe	"NCase adware"
?	SaskTel Accelerated Dial-up	sasktelgui.exe	"""Experience faster surfing
X	saSyncMgr	"rundll32.exe sasync.dll	SyncWait"
U	SATARaid	SATARaid.exe	RAID driver for serial ATA disks on some motherboards such as the DFI Lanparty range. Only loaded if one is using RAID support on SATA drives
X	satmat	satmat.exe	"VX2.Transponder parasite updater/installer related"
X	sau	sau.exe	"180Solutions/180Search adware"
U	SAUpdate	SAUpdate.exe	"Big Brother from Quest Software. System and network monitor"
U	SAutoLaunchExe	SAutoLaunchExe.exe	"Sharp Zaurus PDA related
Y	SAVAgent	SAVAgent.exe	"Part of Sophos anti-virus software. Required for centrally administered Sophos updates to work correctly
X	Save	Save.exe	"WhenU.Save adware"
X	SaveDate	SaveStartDate.Exe	Unidentified adware
X	Savenow	SaveNow.exe	"WhenU.Save adware"
X	Savenow	savenow.exe	"Added by the SPREDA.B VIRUS!"
X	SAW	saw.exe	"SmartAdware adware"
U	Say The Time 5.0	SAYTIME.EXE	"This program has audio cues for the system clock in male and female voices
U	SB	SB.exe	Acer Soft Button on Acer Tablet PCs
N	SB Audigy 2 Startup Menu	/l:eng	"Related to the Dell OEM version of the Sound Blaster Audigy 2 sound card. If this item is listed and checked in startup
X	SB Watchdog	SBWatchdog.exe	Spyware utility installed by the manufacturers of some laptops (Sony) used to monitor browsing habits and send them back to whoever installed it - released by SoftBank
X	SB13mini	RYZO32.EXE	"Added by the SPYBOT-EJ WORM!"
U	SBAutoUpdate	sbautoupdate.exe	"SpywareBlaster auto-updater"
U	SBC Self Support Tool	matcli.exe	"matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	SBC Yahoo! Connection Manager	ConnectionManager.exe	Used to create and connect your SBC Yahoo DSL connection. This program has been reported to cause problems for some users. If you find that it causes you pc to become slow or unstable you should uninstall it (using Add/Remove programs) and manually connect your DSL connection
U	SBDrvDet	SBDrv.exe	"Detects the ""Easy Front-Panel Audio Connectivity Drive Internal Drive Bay"" on the Sound Blaster Audigy 2 Platinium eX. Can be disabled if you don't have one"
N	sbdrvdet	sbdrvdet.exe	Checks to see if Creative sound card driver should be updated
X	SBHC	sbhc.exe	"SuperBar parasite - uninstall available here"
X	SBMPOP	SBMPop.exe	SearchByMedia adware
N	SBMX	sbmx.exe	SoundMAX MPU401 MIDI device emulator for x86 VM DOS games/apps (for Win9x only)
X	sbss Launcher	sbss.exe	"SideBySide adware"
U	SbUsb AudCtrl	"RunDll32 sbusbdll.dll	RCMonitor"
N	sc	scrubxp.exe	"ScrubXP - utility that deletes safe to remove files
U	sc	sc.exe	"Watchdog 2.0 Software - monitoring program"
U	sc	run.exe	"All-In-One_SPY stealth monitoring software - allows monitoring and recording of all actions performed on a computer. It records all keystrokes
?	sc23exec	sc23exec.exe	"Possibly related to a digital camera"
Y	SC3300CC	SC3300CC.exe	SiPix digital camera Twain device driver
X	scain	s030109.Stub.exe	"Delphin Media Viewer adware related"
X	ScamDisk	SVOHOST.exe	"Added by the LEWOR.D WORM!"
X	scan	mscman.exe	"ClientMan parasite variant"
?	Scan Detector	Pmxdetect.exe	"Associated with PrimaScan scanners. Is it required?"
X	Scan Register	ssms.exe	"Added by the RBOT-AT WORM!"
?	Scan Wizard	button.exe	"Associated with ScanWizard as supplied with Microtek scanners - see also Scanner Detector or SDetect. What does it do and is it required?"
X	ScanDisc	satan.exe	Added by the GREGSTAR TROJAN!
X	ScanDisk	ScanDisk.exe	"Added by the GANDA.A WORM! Note - this is not the valid ""ScanDisk"" Win9x/Me standard disk error checker"
X	scands32.exe	scands32.exe	"Added by a variant of the ADCLICKER TROJAN!"
?	ScanFile	??	"??"
?	ScanInicio	Inicio.exe	"Part of Panda Anti-Virus. Responsible for scanning the boot sector of your disk and your memory at startup to check for viruses that try and load and act before your anti-virus is fully operational. It only adds a fraction of a second to start-up time and is worth leaving active"
N	Scanner Detector	SDetect.exe	"ScanSuite Scanner Detector - part of ScanWizard
Y	Scanner File Utility	NsCatCom.exe	"Kycocera Mita network copier/printer/scanner process to dump scanned documents onto a workstation"
?	ScanPanel	ScanPanel.exe	"Trust Easy Webscan scanner related - what does it do and is it required?"
X	Scanreg	[filename]	"Added by the QQPASS.E TROJAN!"
X	ScanRegistry	nsrvnt.exe	"Added by the NERTE TROJAN! Not to be confused with the real ScanRegistry - which is a vital Windows file. This version has the executable as nsrvnt.exe not scanregw.exe"
X	ScanRegistry	scanregv.exe	"Added by the MASTERLOCK TROJAN!. Not to be confused with the real ScanRegistry - which is a vital Windows file. This version has the executable as scanregv.exe not scanregw.exe"
Y	ScanRegistry	Scanregw.exe	Scans the system registry and makes back-ups at start-up. Important should the registry become corrupt. The executable "Scanregw.exe" is located in %windir% (where %windir% is the Windows directory - C:Windows or C:Winnt)
X	ScanRegistry	Scanregw.exe	"Added by the STATOR WORM! Not to be confused with the legitimate ScanRegistry entry - which is a vital Windows file. The executable ""Scanregw.exe"" is located in %windir%System (where %windir% is the Windows directory - C:Windows or C:Winnt). Runs from the registry RunServices key as opposed to the Run key"
X	ScanRegistry	N/A	"Added by the DINOXI or DINOXI.B WORMS!"
X	ScanRegistry	scanregw.exe	"Added by the NYXEM-D WORM! Note - do not confuse this with the legitimate Windows process scanregw.exe which is always found in the Windows folder on Win9x/ME machines. This worm file is found in the System (9x/ME) or System32 (NT/2K/XP) folder"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list