HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
X	SystemInit	iservc.exe	"Added by the FIZZER WORM!"
X	Systemiom Updater	Systemiom.exe	"Added by the SPYBOT.TY WORM!"
U	SystemKey	rundll32.exe [path] SystemKey.dll rdl	"Stealth Keylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	SystemLoad32	sysload32.exe	"Added by the MIMAIL.E WORM!"
X	SystemManager	Sysman32.exe	"Added by the DOWNLOADER-BW.B TROJAN!"
X	SystemMap32	Netisp32.vbs	"Added by the REDIST.C WORM!"
X	SystemMD	md.exe	Homepage hijacker
X	SystemMonitor	Sysmon32.exe	"Added by the AIDID.A WORM!"
X	SystemNetwork	NETSERV.EXE	Added by the NETCONTROL VIRUS!
X	SystemNetwork	sysnet.exe	"Added by a variant of the RBOT WORM!"
X	SystemNT	SystemNT.exe	"Added by the PWSVB-EG TROJAN!"
X	SystemProcEvent	csrwnd.exe	"Added by the IRCBOT.I TROJAN!"
X	systemr	d11host.exe	"Added by the GX TROJAN!"
X	systemr	gedit.exe	"Added by the ADCLICK-AQ TROJAN!"
?	SystemReg	PROCES.EXE	"??"
X	SystemReg	svchost.exe	"Added by the DEWIN.E TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder"
X	SystemReg	WINREG.EXE	"Added by the DEWIN.A TROJAN!"
X	Systems	scchost.exe	"Added by the DAEMOZ.A TROJAN!"
X	Systems	svch0st.exe	"Added by the MYDOOM.BI WORM!"
X	Systems	Systems.exe	"Added by the BANKBOA-A TROJAN!"
X	Systems	itDDD.exe	"Added by the DLOADER-PP TROJAN!"
X	Systems Backups	windrives.exe	"Added by the AGOBOT-RB WORM!"
X	Systems Restart	slchost.exe	"Added by the MULTIDROP.C TROJAN!"
X	Systems Restart	spchost.exe	Added by an unidentified WORM or TROJAN!
X	Systems Restart	"Rundll32.exe beem.dll	DllRegisterServer"
X	Systems Restart	"Rundll32.exe snim.dll	DllRegisterServer"
X	Systems Restart	"Rundll32.exe zolk.dll	DllRegisterServer"
U	Systems.exe	Systems.exe	"Keyboard Spectator - monitoring software that creates records of everything people do on a computer
U	systems.exe	systems.exe	"KGBSpy is a commercial surveillance software program. It logs keystrokes
U	SystemSafe	Syssafe.exe	"System Safety Monitor - system monitoring tool with additional application firewalling"
X	SYSTEMSars32	csrss.exe	"Added by the AHLEM.A WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	SystemSAS	System32.exe	"Added by the KWBOT.C WORM!"
X	SystemSearch	regedit.exe -s c:ie.reg	Installs a Seachxl.com browser page hijack
X	SystemSearch	regedit.exe -s c:sys.reg	Installs a i--search.com browser page hijack
X	SystemService	msocfg.exe	Premium rate adult content dialler
X	SystemService	navchk.exe	Premium rate adult content dialler
X	SystemService	qservice.exe	Premium rate adult content dialler
X	SystemService	shman.exe	Premium rate adult content dialler
U	SystemService	nsserver.exe	"NiceSpy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	SystemSettingf	TRUG.vbs	"Added by the TRUG.B MACRO!"
U	SystemSuite Task Manager	MXTASK.EXE	"vcom (nee Ontrack) SystemSuite - PC maintenance and security. Use the program's configuration options to enable only the parts you want running all the time - such as Virusscanner Pro"
X	SystemTasks	filez.exe	Adult content dialler
X	SystemTasks	sexypicz.exe	Adult content dialler
X	SystemTasks	loaded.exe	Adult content dialler
X	SystemTools	kernels32.exe	"Added by the DLOADER-FC TROJAN!"
X	Systemtra	Systra.exe	"Added by the LOVGATE-W WORM!"
X	SystemTra	CDPlay.EXE	"Added by a variant of the LOVGATE WORM!"
U	SystemTray	SysTray.Exe	"SYSTRAY.EXE - System Tray Services. Provides the Volume Control
X	SystemTray	SystemTray.exe	"Added by the BIGFOOT TROJAN! Note - this is not the legitimate systray.exe process"
X	SystemTray	SysTray.exe	"Added by the ALADINZ.P TROJAN! Note - this is not the legitimate systray.exe process. If you right-click on the real systray.exe the ""Properties"" reveal it to be a Microsoft file"
U	SystemTraySD	SDSystemTray.exe	"Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here"
U	SystemTraySR	SRSystemTray.exe	"Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here"
N	SystemUpd	SystemUpd.exe	"Updater for Swapoo.com
X	SystemWideHook for Windows NT	%WinHook32.exe	"Added by the MYDOOM.AC WORM!"
U	SystemWizard Sniffer	Sniffer.exe	"SystemWizard for Win98/ME from SystemSoft - diagnoses and solves hardware and software problems on a PC"
X	systemyom Updater	systemyom.exe	"Added by a variant of the BACKDOOR.IRC.BOT TROJAN!"
X	SYSTEMZ Patch	SYSZ.exe	"Added by the ALADINZ.P TROJAN!"
U	System_Messages	pprsen.exe	"TerminatorX - ""offers an easy and effective method of stopping users running predetermined file sharing programs like KaZaA
X	Systes	jrdtifkkxbbsa.exe	"Added by the RBOT-ADC WORM!"
X	Systesms.exe	systesms.exe	"Added by the RBOT-HI WORM!"
N	Systest	Systest.exe	"Clean Space temp files cleaner"
X	systhread	winkernal.exe	"Added by the LIAMED WORM!"
X	SysTime	systime.exe	"CoolWebSearch parasite variant - also detected as the STARTPA-FL TROJAN!"
X	Systmesy	Systmesy.exe	"Added by the RBOT-KQ WORM!"
X	Systoan32	systoan.exe	"Added by an unidentified VIRUS
?	systr32	systr32.exe	"??"
X	systrans	[path to trojan]	"Added by the STARTPA-GZ TROJAN!"
?	systrax	systrax.exe	"??"
X	Systray	Systray_.Exe	"Added by the KERGEZ.A WORM!"
X	Systray	[filename.exe]	"Winfavorites adware"
X	SYSTRAY	UNMT.EXE	"Added by the DLOADER-LQ TROJAN!"
U	SysTray	SysTray.Exe	"SYSTRAY.EXE - System Tray Services. Provides the Volume Control
X	SysTray	Snnpapi.exe	Added by an unidentified TROJAN!
X	Systray	w32explorer.exe	"Added by the RBOT-AJY WORM!"
X	Systray	SteFanie.vbs	"Added by the STEFAN WORM! Note - make sure you check the hyperlink as this one copies it's self to numerous dirves and folders"
X	Systray driver	systray.exe	"Added by the MUTEBOT TROJAN! Note - this is not the legitimate systray.exe process"
X	SystrayServices	Msxpw.exe	"Added by the CITOR WORM!"
X	systree	systree	"Added by the BANCOS.L TROJAN!"
X	Systrsy	Systrsy.exe	"Added by the CDTRAY TROJAN! Note - this malware actually changes the default value data of the Registry ""Run"" key in order to force Windows to launch it at boot. Name field may be empty"
X	Systry	[path to worm]	"Added by the AUTEX WORM!"
X	SYStry	spoolsvr.exe	"Added by the SDBOT.GN WORM!"
X	Systryt	[path to worm]	"Added by the AUTEX WORM!"
X	SystUphes	algesetp.exe	"Added by the QQPASS-AM TROJAN!"
U	Systweak Ad and Popup Blocker	adblock.exe	"Ad and popup blocker part of Advanced System Optimizer from Systweak"
U	Systweak Memory Optimizer	memtuneup.exe	"Part of SysTweak Advanced System Optimizer"
X	sysu	sysu.exe	"Dynamic Desktop Media adware - see here"
X	sysug32.exe	sysug32.exe	Added by an unidentified TROJAN or WORM!
X	SysUpd	Sysupd.exe	"VirtuMonde adware"
X	Sysvupex	Sysvupex.exe	"Added by the MEDIAS TROJAN!"
U	SysW8	csta.exe	"Clean Space - privacy and perfomance enhancer"
U	SYSWB6	SYSWB6.exe	"We-Blocker - gives parents the opportunity to monitor their children's Internet access and provide them with age-appropriate content
X	SysWin	SysWin.exe	"Added by the IRCCONTACT TROJAN!"
X	syswin32	syswin32.exe	"Added by a variant of the SPYBOT WORM!"
X	Syswindow	Syswindow.exe	"Added by the COW TROJAN!"
X	SysWy	rundll32.exe	"Added by the LINEAGE-JH TROJAN! Note - this file is found in the C:WindowsSystem folder
X	sysX3	sys22.exe	"Added by the RANTS.C WORM!"
X	sysygm32	syscxd32.exe	"Added by the IRCBOT-PC TROJAN!"
X	sysygm64	winrxd64.exe	"Added by the IRCBOT-RK TROJAN!"
X	SYS_CLEAN	Service.exe	"Added by the FLOPCOPY WORM!"
X	Sys_Run	ghost.exe	"Added by the LINEAGE-N TROJAN!"
X	sys_Runtt1	explorer.exe	"Added by the LINEAGE-M TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the Program Files folder"
U	SZMsgSvc.exe	SZMsgSvc.exe	"StopZilla! - pop-up killer"
X	t	xclean.exe	"FlashEnhancer adware"
N	T-DSL SpeedMgr	speedmgr.exe	T-Online ISP SpeedManager - shows upload and download speed. Also checks for updates automatically
U	T3Console	T3Console.exe	"Related to T3 Security Suite - prevents unauthorized or inappropriate access to your PC and data"
U	Taakcontrole	taskmon.exe	"Task Monitor (on Dutch language versions of Windows) - checks the disk-access patterns of programs when they are started and stores this information in log files in the Applog folder. Task Monitor also records the number of times you use a program. The Disk Defragmenter tool uses this information to optimize your hard disk so that programs that you use frequently are loaded faster. Not required - but can be useful. Note: for Norton Anti-Virus 2002 users
X	Taba	stte.exe	"PurityScan/Clickspring adware"
N	Tablet	Tablet.exe	"Loads the tablet drivers for the Wacom Graphics Tablet. This can be unchecked in msconfig without problems if you don't need the tablet functional all the time. Create your own shortcut if you need to run it ad hoc. If you forget to run it before running Paint Shop Pro & Adobe Photo Shop) you may find the following: (1) Paint Shop Pro (version 7.04) - (a) Browse function will NOT work (program freezes) (b) On program exit
Y	tablet s	tablet s	Starts the Wacom Penabled driver on Acer Tablet PCs (tablet icon with a green check appears during startup if successful)
X	Tablet Task	tabletsk32.exe	"Added by the RBOT-AJB WORM!"
U	TabletTip	tabtip.exe	"The Microsoft Tablet PC Input Panel converts handwriting to text dynamically
U	TabletWizard	SPLSHWRP.EXE	Microsoft Tablet PC Component
Y	TabUserW	TabUserW.exe	Wacom pen tablet driver
?	TAcelMgr	TAcelMgr.exe	"TOSHIBA Acceleration Utilities related. What does it do and is it required?"
N	Tad	tad.exe	From Turtle Beach's Santa Cruz on a Dell WinME system. Not required - works fine without it including keyboard hot controls for volume and mute
X	Taesk managers	tase.pif	"Added by the RBOT-AYK TROJAN!"
?	TAG	tag.exe	"??"
N	Tahni Deskmate	Tahni.exe	"Tahni Deskmate - "Interactive cartoon character that lives on your Windows desktop""
X	TakeMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	TAKSMGN	taskmr.exe	"Added by the RBOT-AHS WORM!"
N	TalkingReminder	TALKINGREMINDER.EXE	"Talking Reminder from Software River Solutions - talking calendar reminder"
?	talknow	talknow.exe	"Could it be related to this or something similar?"
?	Tango	Setup.exe	"Tango Broadband access software. Is it required?"
?	TangoManager	TangoManager.exe	"Tango Broadband access software. Is it required?"
X	TANG_INA_MO	AutoRun.bat	"Added by the FILUKIN.A WORM!"
X	Tapicfg	Tapicfg.exe	"CoolWebSearch Tapicfg parasite variant"
X	Tapisys	tss.exe	Added by the SMALL TROJAN!
U	TapiTNA	TapiTNA.exe	"Telephony Location Selector allowing mobile users to change dialling locations - part of the Win95 Power Toys"
U	Tardis	Tardis.exe	"Tardis - time synchronization software"
X	Task	tasker.exe	"Added by the MYDOOM.R WORM!"
X	Task Bar	TASKBAR.EXE	"Added by the FRETHEM.J WORM!"
?	Task BarClient	TaskBarClient.exe	"Responsible for creating the System Tray icon and associated display system for the Starband satellite always on internet service"
?	Task BarSvr	TaskBarSvr.exe	"Part of the Starband satellite always on internet service. Not included on the current system. What does it do and is it needed?"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list