HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
N	ScanSpyware v *	Scanner.exe	"Spyware remover (where * = the version number) - not recommended
X	scApp	scApp.exe	"Added by the STANDO-E WORM!"
N	SCardSvr	scardsvr.exe	Related to SmartCard readers and sometimes uses lots of system resources
X	SCardSvr	SCardSvr32.Exe	"Added by the MOFEI.B WORM!"
U	SCDEmuApp.exe	SCDEmuApp.exe	"Related to PowerISO - CD/DVD image file processing tool"
X	scheck45	scheck45.exe	Related to unknown malware - hidden installer associated with it
U	schedm	schedm.exe	"Part of Antivir PersonalEdition Classic anti-virus"
X	ScheduIe	nrchk.exe	Premium rate adult content dialler
U	Schedule	Schedule.exe	"Scheduler for Mercury Ez View TV Tuner Card"
N	Scheduled Maintenance	Scheduled_Maintenance.exe	"Scheduler for Iolo System Mechanic tweaking utility. It can cleans your registry and deletes temporary files at defined intervals. Available via Start -> Programs"
X	Scheduler	expIorer.exe	"Added by the TACTSLAY.A TROJAN!"
X	Scheduler	MSMSGS.EXE	"Added by the HOSTBANK-A TROJAN! Note - this particular msmsgs.exe file is located in the WindowsSystem32Config or WinntSystem32Config folder
X	Scheduler	outIook.exe	"Added by the TACTSLAY.A TROJAN!"
X	Scheduler	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	Scheduler	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	Scheduler	winagent.exe	"Added by the TACTSLAY.B TROJAN!"
U	Scheduler	Scheduler daemon.exe	"Tenebril GhostSurf or SpyCatcher related scheduler - you can schedule daily
X	Scheduler Service	wsass.exe	"Added by the LIOTEN.KX WORM!"
X	SchedulerMgr	navchk.exe	Premium rate adult content dialer
X	Scheduling Agent	Scheduler.exe	"Added by the SUBWOOFER TROJAN! Note - this is not the real MS Scheduling agent as the executable is incorrect"
X	SchedulingAgant	MMTASK.EXE	"Added by the YAB.A TROJAN! Not the valid MusicMatch Jukebox which has the same filename"
U	SchedulingAgent	mstask.exe	"MS Scheduling Agent displayed as a box with a stopwatch in the System Tray that is only needed if you have regular scheduled disk defragmenting
U	SchedulingAgent	mstinit.exe	"MS Scheduling Agent displayed as a box with a stopwatch in the System Tray that is only needed if you have regular scheduled disk defragmenting
X	SchedulingAgent	N/A	"Added by the DINOXI or DINOXI.B WORMS!"
U	Schmaili	Schmaili.exe	"Schmaili - insert animated smilies into your e-mail"
X	schost	[path to trojan]	"Added by the TJSERV.D TROJAN!"
N	SchSvr	SchSvr.exe	"WinScheduler is installed with Home Theater or WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
Y	SCHWIZEX	SCHWIZEX.EXE	"Part of ConfigSafe - lets you identify changes to the registry
X	ScManager	scman.exe	"Added by the FORBOT-CW WORM!"
X	scopedll	scopedll.exe	"Added by a variant of the CRYPTER.C TROJAN!"
N	Scotia OnLine Recovery	etdirrcv.exe	"Scotia OnLine Security Software provided by Entrust for Scotia OnLine Security v*.* Recovery	etdirrcv.exe	"Scotia OnLine Security Software provided by Entrust for Scr	scr.scr	"Added by the OPASERV.T WORM!"
N	ScrapPad	Scrappad.exe	"ScrapPad allows you to quickly and easily record notes
X	scrbmk	[path to trojan]	"Added by the DLOADER-VP TROJAN!"
U	Screen Calendar	scrcal.exe	"Screen Calendar allows you to create custom desktop wallpapers with built in active calendar and scheduler"
U	Screen Guard	launch.exe	"Part of Access Denied security and privacy software"
U	Screen Guard Message Scan	sgms.exe	"Part of Access Denied security and privacy software"
X	Screen Saver	scrnsaver.scr	"Added by the RBOT-AGP WORM!"
N	Screen Saver Control	FSScrCtl.exe	Installs as part of the Hubble Space Telescope screen saver (and possibly others). Lets you control your installed screensavers from a System Tray icon
N	ScreenHunter 4.0 Free	ScreenHunter.exe	"""ScreenHunter 4.0 Free is a completely free screen capture software for you to easily take screenshots"""
N	ScreenPrint32	ScreenPrint32.exe	"ScreenPrint32 screen capture software - can be launched manually"
?	screxe	scruser2k.exe	"??"
?	script	script.bat	"Maybe associated with DOS on a Win9x machine"
Y	ScriptBlocking	SBServ.exe	"Update to Norton AntiVirus 2001. Detects certain types of script-based viruses without the need for specific virus definitions - such as JavaScript and VBScript. This will help protect you from these viruses even before virus definitions are available. Note - some users complain of problems once the update is installed - refer here for more information"
Y	ScriptSentry	Scriptsentry.exe	"Script Sentry from Jason's Toolbox. Blocks malicious scripts and allows safe scripts to run. Only required if you want it to check the file associations it guards at startup. It will function regardlessly"
U	Scroll-In-Mouse V2.0	SCROLL.EXE	"Toolkit for the Lynx-3D Net scroll mouse from QTronix. Required if you use the special features"
X	scrsvc	scrsvc.exe	"Added by the AGENT-DS TROJAN!"
X	ScrSvr	ScrSvr.exe	"Added by the OPASERV WORM!"
X	ScrSvrOld	[worm filename]	"Added by the OPASERV WORM!"
Y	Scsi	Scsi.exe	SCSI Miniport driver
X	scvhost	svzhost.exe	"Added by a variant of the SPYBOT WORM!"
U	scvhost	scvhost.exe	"Wiretap is a surveillance software program that monitors and records keystrokes
X	scvhost loader	ixplore.exe	"Added by the SDBOT-CY TROJAN!"
X	scvhost.exe	scvhost.exe	"Added by the LOHAV-N TROJAN!"
X	sd32info	sd32info.exe	"Added by the CRYPTER.A TROJAN!"
U	SDaemon	sdaemon.exe	"PC Security from Tropical Software. 'PC Security™ 5.1 is the ultimate in computer security
U	SDAutoLiveupdate	LiveUpdateSD.exe	"Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here"
X	SDAv	csnss.exe	"Added by the SERFLOG.C WORM!"
X	SDAv	svhost.exe	"Added by the SERFLOG.C WORM!"
X	sdchosts32	vbdd.exe	Added by the RANKY.AG TROJAN!
?	SDClientMonitor	sdclientmonitor.exe	"Related to LANDesk Management Suite from LANDesk Software Ltd. What does it do and is it required?"
N	SDetect	SDetect.exe	"ScanSuite Scanner Detector - part of ScanWizard
X	sdfsdfsdf	sp2update.exe	"Added by a variant of the SPYBOT WORM!"
X	SDIN Adapter	sdin.exe	"Added by the FORBOT-AP WORM!"
?	SDJobCheck	triggusr.exe	"Part of CA Unicenter Software Delivery - manage software across various systems
X	SDK Codre Function22	sdkimddprovment2.exe	"Added by the SDBOT-YJ WORM!"
X	SDK Core Component	sdkcore.exe	"Added by the SDBOT-WC WORM!"
X	SDK Core Function	sdkimprovment.exe	"Added by the RBOT.BHL WORM!"
X	SDK Core Function2	sdkimprovment2.exe	"Added by the SPYBOT.OGX WORM!"
X	Sdk**.exe [* = random char]	Sdk**.exe [* = random char]	Sdk**.exe [* = random char]
X	Sdk**.exe [* = random char]	Sdk**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Sdk**32.exe [* = random char]	Sdk**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	SDKcore Update Components2	SDKC0R3.exe	"Added by the RBOT-ABA WORM!"
X	sdkupdate22	SDK0mCORE.exe	"Added by the FORBOT-DT WORM!"
N	SDPhotoBar.exe	SDPhotoBar.exe	"SmartDraw Photo - ""organize
X	sdrss	sdrss.exe	"Added by the SDBOT-SQ WORM!"
U	sds20	svchost.exe	"InlookExpress logs keystrokes and captures screenshots. If you didn't install this yourself remove it. Note - this should not be confused with the svchost.exe system process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder! This file is located in a ""sds20"" folder"
U	SDTray	sdtray.exe	"RSA Keon Web PassPort - software that allows organizations to use digital certificates in a Web-based environment to help ensure that their transactions are authentic
X	sdxsys32	sdxsys32.exe	"Added by the BROGGER-A TROJAN!"
U	sealmon	sealmon.exe	"SealedMedia enables you to combine document protection and control with your existing applications - such as Microsoft Word
X	Search Bar	taskbar.exe	"Added by the OPANKI-F WORM!"
?	Search Hook	srchhook.exe	"??"
X	Search Page	http://find.naupoint.com	"Naupoint browser hijacker"
X	Search-Exe	SE.exe	"Search-Exe hijacker"
X	Search.vbs		Hijacker
X	searchbar	vnmispoisn downloader.exe	SearchBarCash adware variant
X	SearchEnhancement	scbar.exe	"SCBar foistware"
X	searchnav	searchnav.exe	SearchNav adware - IEFeatures/Popnav variant
X	SearchNavVersion	searchnavversion.exe	SearchNav adware - IEFeatures/Popnav variant
X	SearchSetter	searchsetter[1].exe	Browser hijacker - redirecting to FindWhateverNow.com
X	SearchSquire[number]	SearchSquire[number].exe	"SearchSquire adware"
X	SearchUpgrader	SearchUpgrader.exe	Hijacker
X	Secboot	w32tm.exe	"Added by the HAXDOOR.D TROJAN!"
X	secboot	mszx23.exe	"Added by a variant of the HAXDOOR.BC TROJAN!"
X	secboot	vtd 16.exe	"Added by the HAXDOOR-AE TROJAN!"
U	Second Copy 2000	SecCopy.exe	"Related to Second Copy® - a files/folders backup utility"
U	SecondChance	sctray.exe	"Power Quest Second Chance. Sets checkpoints for saving a backup copy of the registry to a disk so you can restore it if you have a crash"
X	Secret	Secret.exe	"Added by the DELF-LW TROJAN!"
X	Secret-Crush	start.exe	Hijacker that may reset your browser's home page and/or search settings to point to undesired sites
U	SECRETMAKER	secretmaker.exe	"Secretmaker is a combonation of eight privacy-defending programs
U	SecretSmileys	ss.exe	"""Secret Smileys is an add-on for AIM that provides users access to 1000's of new Smileys that can be viewed by anyone using a current version of AIM. Secret Smileys also adds other features such as logging of IM conversations
X	secserv.exe	secserv.exe	Reported by Panda as an EasySearch Adware variant. Note - EasySearch modifies the Internet Explorer settings and may download programs onto the infected computer
X	secsvc32	secsvcnt.exe	"Added by the GLOBAL PATROL TROJAN!"
U	Secsys	Secsys.exe	"Key Interceptor - surveillance software that creates records of everything people do on a computer
X	secure	secure.exe	"DealHelper adware"
X	secure	svshost.exe	"Added by the RBOT-AFO WORM!"
N	SecureClean4RegManager	scregmanager4.exe	"WhiteCanyon SecureClean 4 disk cleaner - clean hard drive data
N	SecureClean4Tray	sctray4.exe	"WhiteCanyon SecureClean 4 disk cleaner - clean hard drive data
N	SecureCleanIEClean	SCIEClean.exe	"SecureClean - scans your system for hidden temporary files
U	SecureItPro	Secureitpro470p.exe	"SecureIt Pro - lock your computer when you're not there
X	SecureLogin	Mslg32.exe	"Added by the REDZED WORM!"
X	Security Accounts Manager SM	samsm.exe	"Added by the SPYBOT.JE WORM!"
X	Security Agent	securag.exe	"Added by the BANCBAN-F TROJAN!"
X	Security Agent Manager	mssams.exe	"Added by the RBOT-SV WORM!"
X	Security Center	AppControl.exe	"Added by the SDBOT.CFT WORM!"
N	Security iGuard	Security iGuard.exe	"Spyware remover - not recommended
U	Security Manager	SecurityManager.exe	"A ComCast Internet software suite that provides a variety of features (firewall
X	Security Patch	scmss.exe	"Added by the RBOT-ZW WORM!"
X	Security Patch	WinUpdate32.exe	"Added by the SDBOT-BM WORM!"
X	Security Patches	msnkn.exe	"Added by the RBOT.WW WORM!"
X	Security Patches	WinLab32.exe	"Added by the SDBOT-KB WORM!"
X	security service	syss.exe	Added by an unidentified WORM or TROJAN!
X	securw	Nctrup.exe	"Added by the NOPIR.A WORM!"
Y	SECWIZ98	SECWIZ98.EXE	"Security Wizard 98 by Chris Farmer. Offers you a variety of ways to restrict access to many of the programs and settings on your PC. Available seekmo	seekmo.exe	"Seekmo Search
X	seeve	seeve.exe	"Medload adware"
X	Select server	slcsvr.exe	"Added by the DLOADER-WD TROJAN!"
?	SelfHostUtil	slefhost.exe	"??"
X	seli	[path to file]	"Added by the LOWZONE-AS TROJAN!"
X	SemanticInsight	SemanticInsight.exe	"Added by RXToolbar ADAWARE! Software that displays pop-up/pop-under advertisements when the primary user interface is not visible"
U	SeMS	SeMS.exe	" PCsms - tool that enables you to send sms text messages from your PC to any UK mobile phone"
X	Sen	tlii.exe	"Recognized by Kaspersky antivirus as Win32.PurityScan.ah. This file is usually found in the Program Filesama folder"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list