HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
N	Scotia OnLine Recovery	etdirrcv.exe	"Scotia OnLine Security Software provided by Entrust for Scotiabank. Provides trusted secure access to Scotia OnLine Secure Web sites. *.* represents the version number. Now obsolete after Scotiabank modernised their login process"
N	Scotia OnLine Security v*.* Recovery	etdirrcv.exe	"Scotia OnLine Security Software provided by Entrust for Scotiabank. Provides trusted secure access to Scotia OnLine Secure Web sites. *.* represents the version number. Now obsolete after Scotiabank modernised their login process"
X	Scr	scr.scr	"Added by the OPASERV.T WORM!"
N	ScrapPad	Scrappad.exe	ScrapPad allows you to quickly and easily record notes thoughts messages and just about anything you want. Use it like you use scrap paper
X	scrbmk	[path to trojan]	"Added by the DLOADER-VP TROJAN!"
U	Screen Calendar	scrcal.exe	"Screen Calendar allows you to create custom desktop wallpapers with built in active calendar and scheduler"
U	Screen Guard	launch.exe	"Part of Access Denied security and privacy software"
U	Screen Guard Message Scan	sgms.exe	"Part of Access Denied security and privacy software"
X	Screen Saver	scrnsaver.scr	"Added by the RBOT-AGP WORM!"
N	Screen Saver Control	FSScrCtl.exe	Installs as part of the Hubble Space Telescope screen saver (and possibly others). Lets you control your installed screensavers from a System Tray icon
N	ScreenHunter 4.0 Free	ScreenHunter.exe	"""ScreenHunter 4.0 Free is a completely free screen capture software for you to easily take screenshots"""
N	ScreenPrint32	ScreenPrint32.exe	"ScreenPrint32 screen capture software - can be launched manually"
X	ScreenSaverPlus	rundll32.exe MSA64CHK.dll DllMostrar	"MatrixDialer related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""MSA64CHK.dll"" file is located in the Winnt or Windows folder"
?	screxe	scruser2k.exe	"??"
?	script	script.bat	"Maybe associated with DOS on a Win9x machine"
Y	ScriptBlocking	SBServ.exe	"Update to Norton AntiVirus 2001. Detects certain types of script-based viruses without the need for specific virus definitions - such as JavaScript and VBScript. This will help protect you from these viruses even before virus definitions are available. Note - some users complain of problems once the update is installed - refer here for more information"
Y	ScriptSentry	Scriptsentry.exe	"Script Sentry from Jason's Toolbox. Blocks malicious scripts and allows safe scripts to run. Only required if you want it to check the file associations it guards at startup. It will function regardlessly"
U	Scroll-In-Mouse V2.0	SCROLL.EXE	"Toolkit for the Lynx-3D Net scroll mouse from QTronix. Required if you use the special features"
X	scroller	fpapli.exe	"CoolWebSearch parasite variant"
X	scrss	scrss.exe	"Added by the HACDEF-R TROJAN!"
X	scrsvc	scrsvc.exe	"Added by the AGENT-DS TROJAN!"
X	ScrSvr	ScrSvr.exe	"Added by the OPASERV WORM!"
X	ScrSvrOld	[worm filename]	"Added by the OPASERV WORM!"
Y	Scsi	Scsi.exe	SCSI Miniport driver
X	sctrlmgr	sescmgr.exe	"Added by a variant of the DWNLDR-GAH TROJAN!"
X	scvhost	svzhost.exe	"Added by a variant of the SPYBOT WORM!"
U	scvhost	scvhost.exe	"Wiretap surveillance software. Uninstall this software unless you put it there yourself"
X	scvhost loader	ixplore.exe	"Added by the SDBOT-CY TROJAN!"
X	scvhost.exe	scvhost.exe	"Added by the LOHAV-N TROJAN!"
X	sd32info	sd32info.exe	"Added by the CRYPTER.A TROJAN!"
U	SDaemon	sdaemon.exe	"PC Security from Tropical Software. 'PC Security? 5.1 is the ultimate in computer security offering multiple locking systems for the Windows environment and internet. Lock files monitor programs' activities even detect intruders! PC Security? offers flexible and complete password protection ""Drag and Drop"" support plus many other handy features'"
U	SDAutoLiveupdate	LiveUpdateSD.exe	"Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here"
X	SDAv	csnss.exe	"Added by the SERFLOG.C WORM!"
X	SDAv	svhost.exe	"Added by the SERFLOG.C WORM!"
X	sdchosts32	vbdd.exe	Added by the RANKY.AG TROJAN!
?	SDClientMonitor	sdclientmonitor.exe	"Related to LANDesk Management Suite from LANDesk Software Ltd. What does it do and is it required?"
N	SDetect	SDetect.exe	ScanSuite Scanner Detector - part of ScanWizard supplied with Microtek scanners. Waits until you press the "GO" button and seems to serve no other purpose. Automatically installed without prompting. Not required if you can start your scanning application before pressing the "GO" button
X	sdfsdfsdf	sp2update.exe	"Added by a variant of the SPYBOT WORM!"
X	SDIN Adapter	sdin.exe	"Added by the FORBOT-AP WORM!"
?	SDJobCheck	triggusr.exe	"Part of CA Unicenter Software Delivery - manage software across various systems from desktops and servers to PDAs and mobile phones in a controlled and standardized way - is it required at startup?"
X	SDK Codre Function22	sdkimddprovment2.exe	"Added by the SDBOT-YJ WORM!"
X	SDK Core Component	sdkcore.exe	"Added by the SDBOT-WC WORM!"
X	SDK Core Function	sdkimprovment.exe	"Added by the RBOT.BHL WORM!"
X	SDK Core Function2	sdkimprovment2.exe	"Added by the SPYBOT.OGX WORM!"
X	Sdk**.exe [* = random char]	Sdk**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples see this log"
X	Sdk**32.exe [* = random char]	Sdk**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples see this log"
X	SDKcore Update Components2	SDKC0R3.exe	"Added by the RBOT-ABA WORM!"
X	sdkupdate22	SDK0mCORE.exe	"Added by the FORBOT-DT WORM!"
?	SDMSSplash	launcher.exe	"Part of HP's Smart Desktop Management System - ""Preloaded on select business desktops SDMS features automatic remote backup and disaster recovery via secure offsite storage and helps detect and remove PC security threats."" Is this just the ""splash"" screen shown when the program lauches and is it therefore required?"
N	SDPhotoBar.exe	SDPhotoBar.exe	"SmartDraw Photo (now FotoFinsh) - ""organize enhance print and share your photos. It's also a powerful graphic editor for creating images and web graphics"""
X	SDR6_Check	udcsdr.exe	"DriveCleaner rogue security software - not recommended see here"
X	sdrss	sdrss.exe	"Added by the SDBOT-SQ WORM!"
U	sds20	svchost.exe	"InlookExpress logs keystrokes and captures screenshots. If you didn't install this yourself remove it. Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in C:\sds20"
X	SdScans**	stup_tmp.#32	"Added by the SDSCAN.A TROJAN - where ** are random upper case letters"
U	SDTray	sdtray.exe	"RSA Keon Web PassPort - software that allows organizations to use digital certificates in a Web-based environment to help ensure that their transactions are authentic confidential and digitally signed"
U	SDTray	SDTrayApp.exe	"Spyware Doctor spyware remover - system tray access"
X	sdxsys32	sdxsys32.exe	"Added by the BROGGER-A TROJAN!"
U	sealmon	sealmon.exe	"SealedMedia enables you to combine document protection and control with your existing applications - such as Microsoft Word Microsoft Excel Microsoft PowerPoint and Email"
X	Search Bar	taskbar.exe	"Added by the OPANKI-F WORM!"
X	Search Defender	SearchDefender.exe	Installed by SpeedItUp without permission along with PC-Checker. Detected by DrWeb as the STARTPAGE.ORIGIN TROJAN!
?	Search Hook	srchhook.exe	"??"
X	Search Page	http://find.naupoint.com	"Naupoint browser hijacker"
U	Search Protection	SearchProtection.exe	"""Yahoo! Search Protection will alert you if an attempt is made to change your default browser search engine from Yahoo!"""
U	Search Protection	SearchProtection.exe	"""Yahoo! Search Protection will alert you if an attempt is made to change your default browser search engine from Yahoo!"""
X	Search-Exe	SE.exe	"Search-Exe hijacker"
X	Search.vbs		Hijacker
X	SearchAndDestroyMFC	Search And Destroy.exe	"Search And Destroy rogue security software - not recommended see here"
X	SearchAndDestroyScheduler	SearchAndDestroy.exe	"Search And Destroy rogue security software - not recommended see here"
X	SearchAndDestroyT	SearchAndDestroy.exe	"Search And Destroy rogue security software - not recommended see here"
X	searchbar	vnmispoisn downloader.exe	SearchBarCash adware variant
X	SearchEnhancement	scbar.exe	"SCBar foistware"
X	searchnav	searchnav.exe	SearchNav adware - IEFeatures/Popnav variant
X	SearchNavVersion	searchnavversion.exe	SearchNav adware - IEFeatures/Popnav variant
X	SearchNet_Up	ServeUp.exe	"SearchNet adware"
X	SearchSetter	searchsetter[1].exe	Browser hijacker - redirecting to FindWhateverNow.com
X	SearchSettings	SearchSettings.exe	"Vendio ""Search Settings"" foistware - reportedly installed without notice see here and here"
X	SearchSpy	SearchSpy.exe	"SearchSpy spyware remover - not recommended see here"
X	SearchSquire[number]	SearchSquire[number].exe	"SearchSquire adware"
X	SearchUpgrader	SearchUpgrader.exe	Hijacker
X	Secboot	w32tm.exe	"Added by the HAXDOOR.D TROJAN!"
X	secboot	mszx23.exe	"Added by a variant of the HAXDOOR.BC TROJAN!"
X	secboot	vtd 16.exe	"Added by the HAXDOOR-AE TROJAN!"
X	secdrive.exe	secdrive.exe	"Added by a variant of the SPYBOT WORM! See here"
U	Second Copy 2000	SecCopy.exe	"Related to Second Copy? - a files/folders backup utility"
U	SecondChance	sctray.exe	"Power Quest Second Chance. Sets checkpoints for saving a backup copy of the registry to a disk so you can restore it if you have a crash"
X	Secret	Secret.exe	"Added by the DELF-LW TROJAN!"
X	Secret-Crush	start.exe	Hijacker that may reset your browser's home page and/or search settings to point to undesired sites
U	SECRETMAKER	secretmaker.exe	"Secretmaker is a combination of eight privacy-defending programs including Spam Fighter Pro Worm Hunter Pop-Up Killer Banner Blocker Cookie Eraser Privacy Protector History Cleaner and Garbage Cleaner"
U	SecretSmileys	ss.exe	"""Secret Smileys is an add-on for AIM that provides users access to 1000's of new Smileys that can be viewed by anyone using a current version of AIM. Secret Smileys also adds other features such as logging of IM conversations and it gets rid of that annoying advertisement on your buddy list window"""
X	secserv.exe	secserv.exe	"Detected by Panda as an EasySearch adware variant. Note - EasySearch modifies the Internet Explorer settings and may download programs onto the infected computer"
X	secsvc32	secsvcnt.exe	"Added by the GLOBAL PATROL TROJAN!"
U	Secsys	Secsys.exe	"UltraSoft Key Interceptor surveillance software - uninstall this unless you put it there yourself!"
U	SecurDisc	NBHGui.exe	"Part of the Nero multimedia suite backup function - ""Recover your data quickly and easily and create discs that are password protected. SecurDisc technology gives you peace of mind"""
X	secure	[random].exe	"DealHelper adware"
X	secure	svshost.exe	"Added by the RBOT-AFO WORM!"
X	secure socket layer	wins32a.exe	"Added by an IRCBOT TROJAN!"
X	Secure Socket Layer Certification	sslcert.exe	"Added by the VANEBOT-AN WORM!"
X	Secure System	integitor.exe	"Added by the AGOBOT.ACI WORM!"
X	Secure32	Shell32.com StartUp	"Added by the BRONTOK-CJ WORM!"
X	Secure64	Regedit32.com StartUp	"Added by the BRONTOK-CJ WORM!"
N	SecureClean4RegManager	scregmanager4.exe	"WhiteCanyon SecureClean 4 disk cleaner - clean hard drive data MRUs temp files and more. Can be started manually"
N	SecureClean4Tray	sctray4.exe	"WhiteCanyon SecureClean 4 disk cleaner - clean hard drive data MRUs temp files and more. Can be started manually"
X	SecureCleaner	SecureCleaner.exe	"SecureCleaner spyware remover - not recommended see here"
N	SecureCleanIEClean	SCIEClean.exe	SecureClean - scans your system for hidden temporary files deleted email messages Internet histories and caches
U	SecureItPro	Secureitpro470p.exe	"SecureIt Pro - lock your computer when you're not there to stop malicious users from accessing your desktop"
X	SecureLogin	Mslg32.exe	"Added by the REDZED WORM!"
U	SecureOnlineAccountNumbers	SOAN.exe	"Related to Secure Online Account Numbers by Discover(R) Card from Orbiscom Ltd. Secure and innovative payment solutions"
X	SecurePCCleaner	GDC.exe	"SecurePCCleaner spyware remover - not recommended see here"
U	SecurePCSolutionsBootCheck	BootCheck.exe	"1 Click Fixer PLUS from Secure PC Solutions ""takes the guesswork out of locating and solving problems in the Windows registry"""
X	Security	WindowsSecurityUpdate.exe	"Added by a variant of the SDBOT WORM!"
X	Security Accounts Manager SM	samsm.exe	"Added by the SPYBOT.JE WORM!"
X	Security Agent	securag.exe	"Added by the BANCBAN-F TROJAN!"
X	Security Agent Manager	mssams.exe	"Added by the RBOT-SV WORM!"
X	Security Antivirus Xp 1	inetfor.exe	"Added by the SDBOT.BAV WORM!"
X	Security Center	AppControl.exe	"Added by the SDBOT.CFT WORM!"
X	Security Center Distribution	securesec.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Security iGuard	Security iGuard.exe	"Security iGuard spyware remover - not recommended see here"
U	Security Manager	SecurityManager.exe	A ComCast Internet software suite that provides a variety of features (firewall popup blocker parental controls etcetera) to help ensure your computer is secure and your information is kept private
X	Security Monitor	securemon.exe	"Detected by Kaspersky as the AUTORUN.LPF WORM! See here"
X	Security Patch	scmss.exe	"Added by the RBOT-ZW WORM!"
X	Security Patch	WinUpdate32.exe	"Added by the SDBOT-BM WORM!"
X	Security Patches	msnkn.exe	"Added by the RBOT.WW WORM!"
X	Security Patches	WinLab32.exe	"Added by the SDBOT-KB WORM!"
X	Security Server DB	secserver.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	security service	syss.exe	Added by an unidentified WORM or TROJAN!
X	Security Service	secsvc.exe	"Added by the RBOT-GGF WORM!"
X	Security Service DB	secservice.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Security Service Process	svhost.exe	"Added by the AGOBOT-LC WORM!"
X	Security System	securesys.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Security Update Service	wmiprvce.exe	"Added by the AGOBOT.ZW WORM!"
X	securw	Nctrup.exe	"Added by the NOPIR.A WORM!"
Y	SECWIZ98	SECWIZ98.EXE	"Security Wizard 98 by Chris Farmer. Offers you a variety of ways to restrict access to many of the programs and settings on your PC. Available here"
X	seekmo	seekmo.exe	"Seekmo Search a 180Solutions adware variant - also see here"
X	SeekmoSA	SeekmoSA.exe	"180Solutions.Zango adware"
X	SeekmoToolbar	${HOOKOE_FILE}	180solutions/Seekmo adware
X	seeve	seeve.exe	"Medload adware"
X	Select server	slcsvr.exe	"Added by the DLOADER-WD TROJAN!"
?	SelfHostUtil	slefhost.exe	"??"
X	seli	[path to file]	"Added by the LOWZONE-AS TROJAN!"
X	SemanticInsight	SemanticInsight.exe	"RXToolbar adware. Software that displays pop-up/pop-under advertisements when the primary user interface is not visible"
U	SeMS	SeMS.exe	"PCsms - tool that enables you to send sms text messages from your PC to any UK mobile phone"
X	Sen	tlii.exe	"Detected by Kaspersky as PurityScan.ah"
U	Sensiva	Sensiva.exe	"Symbol Commander makes the use of your PC laptop Tablet PC and Pocket PC much easier and much faster. It recognizes your handwriting with unparalled performance and executes commands in a snap. Just by using your mouse pen or touchpad simply draw symbols to execute actions instantly"
X	SENTRY	SENTRY.exe	"From IP Insight. Allows website owners ""to instantly determine the precise geographic location connection speed and detailed demographics of every visitor to your website"". Will be detected by most firewalls and the majority of home users should disable it"
X	Sepate Security Firewall	sepate.exe	"Added by a variant of the RBOT WORM!"
X	septpop06apsept	septpop06apsept.exe	"MediaMotor.Popupwithcast adware"
X	Serials	serials.exe	Any one of a variety of worms and trojans
X	Serices Hostin	servicez.exe	"Detected by Trend Micro as the IRCBOT.AUA BACKDOOR! See here"
X	SernellApp.pcx	csrss.exe	"Added by the BANCBAN-BJ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""D5133"" subfolder"
X	serpe	formatsys.exe	"Added by the SERFLOG.A WORM!"
X	serpe	msmbw.exe	"Added by the SERFLOG.A WORM!"
X	serpe	serbw.exe	"Added by the SERFLOG.A WORM!"
Y	serrdctl.exe	serrdctl.exe	"Shared Modem Service Client Event Viewer" - used when a number of PCs have access to a number of modems. Required to be running on each PC for access to the modems
X	serrv	serrv.exe	"Added by the WAREZOV.DC WORM!"
X	SERV PacK2	nerx.exe	"Added by the SDBOT-ACP WORM!"
N	Serv-U	serv-u32.exe	FTP server
X	Serv-U	wssdsu.exe	"Added by the MANIFEST TROJAN!"
X	server	server.exe	"Added by the DELTAD.A WORM!"
X	server	system.exe	"Added by the METHS-A TROJAN!"
X	server	server.exe	"Added by the SINGU-Q TROJAN!"
Y	Server Application for MFP Server	ServoApp.exe	"Multi Function Printer (MFP) Server Agent for Belkin's Wirless G All-in-One Print Server and ZyXEL's NPS-520"
X	Server Backbone	server05.exe	"Added by the RBOT-ZM WORM!"
X	Server Daemon Host Manager	sdhost.exe	"Added by the RBOT-GWC WORM!"
X	Server Runtime Error	unsec.exe	"Added by the SDBOT-DFA WORM!"
X	Server Runtime Process	wbemstest.exe	"Added by the SDBOT-DDB WORM!"
X	SERVER.EXE	SERVER.EXE	"Added by the BUSHTRO122 or SMOKODOOR TROJANS!"
X	serverex	Server.txt.vbs	"Added by the DELTAD.A WORM!"
X	Serverx	Serverx.exe	"Added by the MADANGEL VIRUS!"
X	Service	service.exe	"Added by the ALADINZ.H TROJAN!"
X	Service	[trojan filename]	"Added by the KAITEX.E TROJAN!"
X	Service	services.exe	"Added by the NETSKY or NETSKY.B WORMS! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder"
X	Service	SYSNT.exe	"Added by the CHA TROJAN!"
X	Service	Service.pif	"Added by the ASSIRAL-C WORM!"
X	service	wN2S.exe	"Added by a variant of the RBOT WORM!"
U	Service Centre	launcher.exe	"Management tool for the Open Networks iConnect series of products - as used by Australian ISP's such as iiNet and Hotkey"
X	Service Cleaner	filen.exe	"Added by the RBOT.BRH WORM!"
X	Service Client	winsvcli.exe	"Added by an unidentified WORM or TROJAN! See here"
N	Service Connection	sccenter.exe	For Compaq PC's. Part of Backweb
N	Service Connection	bwtray.exe	For Compaq PC's. Part of Backweb
X	Service Controller	Csrrs.exe	"Added by the GAOBOT.AO WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list