HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
?	Tweak Manager	WinManager.Exe	"WinGuides Tweak Manager. Is this required for the live updates feature and/or if settings are changed?"
U	Tweak UI	rundll32.exe tweakui.cpl tweakmeup	Restores settings that can't be retained if you have Microsoft's Tweak UI "powertoy" installed
U	Tweak UI	rundll32.exe tweakui.cpl tweaklogon	Automatically logs you on if you have Microsoft's Tweak UI "powertoy" installed
X	Tweak UI	RunDLL32 tweakUI.DLL TWEAKUI /tweakmeup	"Added by the SUBWOOFER TROJAN! Note - the real Tweak UI entry for this is ""rundll32.exe tweakui.cpl tweakmeup"". Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
U	Tweak UI 1.33 deutsch	RUNDLL32.EXE TWEAKUI.CPL TweakMeUp	"Restores settings that can't be retained if you have Microsoft's Tweak UI ""powertoy"" installed - German version"
U	Tweak-Me	TWEAK-ME.exe	"3rd party version of Miscrosoft'sTweak UI "powertoy" with many more options and controls (plus full support) designed specifically to take advantage of features in WinMe/2K and above available from here"
U	Tweak-xp	Tweak-xp.exe	"Main program for Tweak-XP - a WinXP tweaking utility"
U	TweakDUN	tweakdun.exe	Utility to optimize your Internet Browser Software. TweakDUN promotes faster Internet data transfer rates and faster downloads by eliminating fragmentation of data packets
U	Tweaki4PU	twksup.exe	"""Tweaki puts several Windows utilities into one easy to use program while adding hundreds of additional tweaks not found in other system tweakers"""
?	tweakico	tweakico.exe	"May be a HP program to control their icons?"
U	TweakMASTER	TMTray.exe	"TweakMASTER Internet Optimizer"
U	TweakVI	tweakvi.exe	"TweakVI from Totalidea Software - ""Tweak hundreds of hidden features of Windows Vista optimize your machine and customize it to your needs"""
?	TweakYC	TweakYC.exe	"VideoMate TV tuner and capture card related - what does it do and is it required?"
U	twister	twister.exe	"Twister ""AntiTrojanVirus"""
N	TwkSCardSrv	SCardS32.Exe	Used with Towitoko SmartCard Readers for card recognition
X	twunk service	twunk16.exe	"Added by the RBOT.BAT WORM!"
X	Twunk_64	twunk_64.exe	System1060 homepage hi-jacker. Note - this is not a Windows file and is found in a WindowsSystem1060 directory
X	tyack drive	tyack.pif	"Added by the RBOT-AMT WORM!"
X	tymsetvc	osskhbd.exe	"Added by the MAILBOT-BW TROJAN!"
X	type	bat.exe	"Added by the ANSKYA-A WORM!"
N	type32	type32.exe	For MS programmable keyboards. If you disable Intellitype in Startup any "Hot Keys" that are changed by the user to perform functions other than default settings defer back to their default settings. Not required unless you have changed them
?	TypeRegChecker	TypeRegChecker.exe	"Part of Sharpdesk from Sharp Electronics Corp. ""An easy to use desktop-based personal document management application that lets users browse edit search compose process and forward both scanned and native electronic documents"". Is it required?"
N	TypingSatellite	KBOOST.exe	"Typing Master 2002 background utility that collects typing errors and builds up customised typing lessons for your needs. Available via Start -> Programs"
X	TZ Spyware Remover	SpyRem.exe	"TZ Spyware Remover spyware remover - not recommended see here"
U	U.S.Robotics WLAN Adapter Configuration Utility	USRWLAN.exe	"U.S.Robotics LAN Adapter - wireless LAN (WLAN) configuration utility"
X	UADC_3240389055	UADCcw.exe	"Advanced Cleaner misleading security program - not recommended see here"
X	UADC_599141581	UADCcw.exe	"Advanced Cleaner misleading security program - not recommended see here"
X	Uate	oocs.exe	"PurityScan/Clickspring adware"
U	UberIcon	UberIcon Manager.exe	"Uber Icon by Punk Labs. Creates a more customizable atmosphere on your desktop by extending Windows to perform new effects when you launch your icons and folders"
U	UBSShell	UBSShell.exe	UBS (United Bank of Switzerland) banking software
X	UCmd	fallfour.exe	"Added by the SDBOT-AZA WORM!"
U	UCmore XP - The Search Accelerator	rundll32.exe UCMTSAIE.dll DllShowTB	"UCmore toolbar - search accelerator"
X	ucookw	ucookw.exe	"Misleading security software such as WinPCDoctor StorageProtector and ErrClean - not recommended"
N	UC_SMB	ucstart.exe	Part of IBM Update connector on IBM PCs for updating drivers on a new installation. Once you manually run the IBM Update connector program (shortcut) this entry is removed
N	uc_start	ucstartup.exe	Auto updater feature for IBM machines that tries to connect to IBM to see if there are any new drivers patches and etc
U	UD Agent	UD.EXE	The United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home but for medical research. Available via Start > Programs
X	UDC6cw	UDC6cw.exe	"DriveCleaner misleading security program - not recommended see here"
X	udinajkv.exe	udinajkv.exe	Added by a premium rate adult material dialer!
X	udjudwq	sybqnub.exe	"Added by the SILLYFDC-AH WORM!"
X	udzok	udzou.exe	"Added by the SDBOT-CUS WORM!"
U	Ueproc32	UEPROC32.exe	Part of Norton Utilities - most likely associated with the Unerase Wizard in older versions
?	UFD Monitor9382	ufdlmon.exe	"Part of USB Flashdisk software - what does it do and is it required?"
?	UFD Utility9382	UFDTool.exe	"Part of USB Flashdisk software - what does it do and is it required?"
Y	UfSeAgnt.exe	UfSeAgnt.exe	"Part of Trend Micro Internet Security"
X	uga6pcw	uga6pcw.exe	"AVSystemCare misleading security software - not recommended see here"
X	ugac	ugac.exe	"WinSecureAv spyware remover - not recommended see here"
X	ugcw	ugcw.exe	"WinSpyControl NoWayVirus AVSystemCare SpyGuardPro and other misleading security software - not recommended"
X	ugdccw	UGDCcw.exe	"PCPrivacyTool and OnlineHelpmate misleading security software - not recommended"
X	ugescw	ugescw.exe	"Rogue security software such as ErrClean and SystemErrorFixer - not recommended"
?	ugon	aockstrs.exe	"??"
X	uhvjsul.dll	rundll32.exe uhvjsul.dll mrpmvyf	"Added by the BUSKY-G TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""uhvjsul.dll"" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder"
N	Uidler	Uidler.exe	Uniloc Titlewave Browser used with some shareware
N	UIWatcher	UIWatcher.exe	"Ashampoo's Uninstaller Suite - installation watcher. Available via Start -> Programs"
U	ujm	nm32.exe	"Stranget keystroke logger/monitoring program - remove unless you installed it yourself! Found in an ""fyt"" subfolder of the Windows or Winnt folder"
X	UKVideo2	ukvideo2.exe	Adult content dialler
?	Ulead AutoDetector	Monitor.exe	"Related to Ulead Systems Inc. programs. What does it do and is it required?"
?	Ulead AutoDetector v2	monitor.exe	"Related to Ulead Systems Inc.. What does it do and is it required?"
N	Ulead Calendar Checker	CalCheck.exe	"Ulead Calendar Checker - part of Ulead Photo Express - automatically replaces your calendar desktop wallpaper on a weekly/monthly/yearly basis if you've created them. Not required - change them manually"
U	Ulead Memory Card Detector	Monitor.exe	"Ulead Memory Card Detector - ""Automatically starts datadownload when your card is inserted into a memory card reader"""
N	Ulead Photo Express Calendar Checker	calcheck.exe	If you create multiple Weekly/Monthly/Yearly calendars to use as your wallpaper Photo Express will replace the wallpaper automatically. Photo Express 2.0 has a calendar checker which checks the date on your system and updates your wallpaper accordingly
N	Ulead Photo Express x.0 Calendar	calcheck.exe	"Ulead Calendar Checker - part of Ulead Photo Express where "x" represents the version number. Automatically replaces your calendar desktop wallpaper on a weekly/monthly/yearly basis if you've created them. Not required - change them manually"
X	Ultimate Cleaner	App.exe	"Ultimate Cleaner spyware remover - not recommended see here"
X	Ultimate Defender	UltimateDefender.exe	"Ultimate Defender spyware remover - not recommended see here"
X	UltimateBuddy	UltimateBuddy.exe	"UltimateBuddy - installs malware or is bundled with malware"
N	UltimateZip Quick Start	uzqkst.exe	"UltimateZip - file compression utility"
N	Ultra Hal Assistant 4.5 Startup	HalAsst.exe	"Zabaware Ultra Hal Assistant - artificial intelligence conversation simulator. It is capable of being your digital secretary and companion"
?	UltraDVDMon	DVDMon.exe	"UltraDVD DVD player software - is it required?"
X	Ulubione	sys****.exe	"Ulubione adware"
N	UMAX VistaAccess	vsaccess.exe	VistaAccess gives you quick and easy access to scanning functions right from your desktop
U	UMonit	umonit.exe	Alerts when USB device is plugged in
Y	umxagent	umxagent.exe	"Tiny Personal Firewall V4 - main engine"
Y	umxldra	umxldra.exe	"User mode executive module DLL loader - part of Tiny Personal Firewall V4"
Y	UMXLDRW	UMXLDRW.exe	"Tiny Personal Firewall (pre V4)"
X	un32info	un32info.Exe	"Added by the CRYPTER.A TROJAN!"
X	Undefined	winter.exe	"Added by the KILLAV.LW TROJAN!"
X	UNERI	yujixit.exe	"Added by the SDBOT.BOO WORM!"
U	UnHackMe Monitor	hackmon.exe	"UnHackMe allows you to detect and remove a new generation of 'invisible' Trojan programs called ""rootkits"""
U	Uniblue Quick Access	qaccess.exe	"Quick Access application from UniBlue Systems Ltd - ""helps you account for all processes on your computer by providing an additional plug-in for the Windows task manager"""
U	Uniblue Registry Booster	RegistryBooster.exe	"Uniblue ""Registry Booster is the safest and most trusted solution to clean and optimise your system free it from registry errors and fragmented entries"""
U	Uniblue SpeedUpMyPC	SpeedUpMyPC.exe	"Older version of SpeedUpMyPC from Uniblue - which ""lets you monitor and control all your PC resources with easy one click instructions. System settings internet usage disk clutter RAM and CPU are all automatically scanned cleaned and optimized for peak performance"""
U	Uniblue SpyEraser	spyeraser.exe	"SpyEraser from Uniblue. Spyware detection program"
U	UniblueSpeedUpMyPC	Launcher.exe	"SpeedUpMyPC 2009 from Uniblue - which ""lets you monitor and control all your PC resources with easy one click instructions. System settings internet usage disk clutter RAM and CPU are all automatically scanned cleaned and optimized for peak performance."" Located in %ProgramFiles%\Uniblue\SpeedUpMyPC"
X	uninstal	regsvr32 image.dll	"CoolWebSearch parasite variant"
X	Uninstall****	upd.exe	Adult content based screen saver where **** can be any number
N	UninstallAbility	uability.exe	"UninstallAbility free uninstaller"
X	UninstallHL	PreUninstallHL.exe	"LinkReplacer/FFinder adware"
X	UninstallQL	PreUninstallQL.exe	"LinkReplacer/FFinder adware"
X	Uninstall_TBPS	TBuninst.exe	"WebSearch Toolbar - HuntBar hijacker toolbar installer variant"
U	UniPrint	SetDfltSettings.exe	Drivers for Uniprint a printing help for Terminal Services and Citrix which recieves downloaded files from a Uniprint enabled server and prints them locally allowing for truly universal printing through Terminal Services or Citrix
U	UniSc	Unisc.exe	McAfee UnInstaller
?	uniucu	uniucu.exe	"??"
X	Universal Plug & Play devices	WinUPPD.exe	Added by an unidentified WORM/TROJAN!
X	Universal USB Service	svchost32.exe	"Added by the KELVIR.R WORM!"
X	Unix File Support	init3.exe	"Added by the RBOT-ZN WORM!"
X	unldr16	unldr16.exe	"Added by a variant of the CRYPTER.C TROJAN!"
X	unldr32	unldr32.exe	"Added by a variant of the CRYPTER.C TROJAN!"
U	UnlockerAssistant	UnlockerAssistant.exe	"Related to Unlocker utility to unlock files when the OS reports the file is being used by an other person or program"
X	UnSpyPC	UnSpyPC.exe	"UnSpyPC spyware remover - not recommended see here"
Y	untray	untray.exe	"Command Antivirus related"
N	uoltray	exec.exe	Netzero free ISP software - not required
X	Up Service	up32.pif	"Added by the RBOT-ARI WORM!"
N	UpConfgVer	UpgConf.exe	"Part of Panda Antivirus and Internet Security. Purpose unclear but according to Panda Software not required for the AV to function"
X	Updade Windows	winlogom.exe	"Added by the TONAX-A TROJAN!"
X	UpData	wupdata.exe	"Added by the IRCBOT-AA TROJAN!"
X	Update	[original file path]	"Added by the LYNDEGG WORM!"
X	Update	CDUpdater.exe	"""Carpe Diem"" adult premium rate dialler related"
X	Update	Sysupd.exe	Added by the SLACKBOT VIRUS!
X	Update	Zupdate.exe	"Associated with B3d Projector foistware - see here"
X	Update	mshtm.exe	Browser hijacker - redirecting to buldog-search.com
X	Update	UPDATE-28062004.exe[25 blank spaces].vbs	"Added by the MIDFIN WORM!"
X	update	winis.exe	"Added by the RBOT-VD WORM!"
X	update	r00t.exe	"Added by the RBOT-ACO WORM!"
X	UPDATE	WinUpdater5.0.vbs	"Added by the GORMLEZ-A WORM!"
X	UpDate	RAuth.exe	"Added by the DLOADER-UL TROJAN!"
X	Update	csrss.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Update	csrss.exe	"Added by the MEHEERWAR TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""winupdate"" subfolder"
X	Update	lsass.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	Update	svchost.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	Update	Update.exe	"QuickButton adware"
X	Update	hanz.exe	"Added by a variant of the RBOT-GLJ WORM!"
X	Update Checker	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	Update Checker	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	Update Explorer	iexploreupd.exe	"Added by a variant of the RBOT WORM!"
X	Update for Windows	[various filenames]	"Added by the LERPA-A WORM! Note - the file name will be one of the following common.exe common.pif common.scr Sexo.exe Sexo.jpg.pif ini_file__.pif load_me__.tmp msfile.pif system_load_.pif or zipped.rar.pif"
?	Update for Works	MSWkstz.exe	"Maybe related to later versions of MS Works?"
N	Update Grokster	WiseUpdt.exe	Automatically updates the Grokster file sharing software. Beware of adware and spyware when using this type of program for instance Grokster contains CyDoor
X	Update Install	Schost.exe	"Added by the GAOBOT.AO WORM!"
?	Update local	SetCPQLC.exe	"Running on a Compaq desktop. Any ideas?"
N	Update Manager	UpdateManager.exe	"Searches for updates for the Rogers Yahoo! Browser - can be run manually"
X	update mon sys	updaterar.exe	"Added by a variant of the RBOT WORM!"
X	update run dos	logon.exe	"Added by a variant of the SDBOT WORM!"
X	Update Run MSword	LOGON.EXE	"Added by the RBOT.TY WORM!"
Y	Update Service	Update.exe	"Loaded by Handybits programs such as EasyCrypto. Re-instates itself every time the program is run so best to leave it enabled. Prevent it dialling out via a firewall"
X	update service	svxhost.exe	"Added by the RBOT-MG WORM!"
X	Update Service	winu32.exe	"Added by the RBOT-MG WORM!"
X	update service	winx.exe	"Added by a variant of the RBOT WORM!"
?	Update TUT	WiseUpdt.exe	"??"
X	Update ver 1.0	Swap.exe	"Added by the SWAP-C WORM!"
X	Update Windows	EXPLORE.EXE	"Added by a variant of the SDBOT WORM!"
X	Update Windows	EXPLORE.EXE	"Added by a variant of the SDBOT WORM!"
X	Update.exe	ravseuper.exe	"Added by the QQPASS-P TROJAN!"
X	Update32	configs.exe	"Hijacker also detected as the QURL-2 TROJAN!"
X	UpdateCheck	winstall.exe	"Added by the SPYBOT-CY WORM!"
X	UpdateComponent	CNF UPD.EXE	Added by the SPYBOT.GEN VIRUS!
?	UpdateFW	fwdload.exe	"Appears to be firmware update software for a Network Associates ATMbook OC-3 SMF Interface Module?"
?	UPDATEHOOK	Rundll32.exe	"??"
X	updatelavasoft	updatelavasoft.exe	"CoolWebSearch parasite variant - redirecting to lalasearch.com"
U	UpdateManager	sgtray.exe	StorageGuard from Veritas (this version by Sonic). Free utility that integrates with Backup MyPC (formerly Backup Exec Desktop) Simple Backup and MS Backup. Provides system tray access and background monitoring - warning you of files that haven't recently been backed up. Required unless you backup manually on a regular basis or have scheduled backups
X	UpdateManager	updmanager.exe	"Added by the ANYHOMB.F TROJAN!"
X	UpdateMedia	UpdateMedia.exe	"MediaUpdate foistware"
X	UpdateMgr	updmgr.exe	"SouthBeachTel premium rate adult content dialer"
N	updateMgr	AdobeUpdateManager.exe	Automatic updates for the Adobe Reader file viewer
N	updatemgr.exe	updatemgr.exe	Once a month your EarthLink 5.0 Update Manager contacts EarthLink's servers to check for software updates. If an update is available for your EarthLink software Update Manager will inform you and with your permission download and install the update. Can go to http://www.earthlink.net and download the updates manually
X	UPDATEMSN	svhost.exe	Added by an unidentified WORM or TROJAN!
X	updater	wupdater.exe	"KeenVal adware"
?	updater	updater.exe	"??"
X	Updater	adservernow.exe	"AdServerNow adware"
X	updater	wisvc.exe	"Added by the ORSE-A TROJAN!"
X	UpDaTer	csrss.exe	"Detected by Kaspersky as the AUTORUN.DIB WORM! See here. Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~� subfolder"
X	Updater Service Process	svhost32.exe	"Added by the AGOBOT.TY WORM!"
X	updater32	winload32.exe	"Added by the CULT.M WORM!"
X	updatereal	realupdate.exe	Chinese originated adware
X	Updates	msupdate.exe	"CoolWebSearch parasite variant"
N	Updates from HP	backweb*****.exe	"See here - ""messaging service that automatically sends you support information tips ideas and special offers from HP and our partners especially designed for HP and Compaq desktop computer owners"". * can be any digit"
N	Updates from HP	Updates from HP.exe	Automatically detects an internet connection and downloads any available updates
X	updatesched	[random filename]	"ZenoSearch adware"
X	UpdateService	wservice.exe	"Added by the DREF-K WORM!"
X	Updatestats	Updatestats.exe	"Statblaster adware"
X	UpdateStats	UpdateStats.exe	"SeekSeek search hijacker related - see here"
N	updatev01	updatev01.exe	Ultra-networks.com software updater/downloader
X	updatewin	update.exe	"Added by a variant of the SDBOT WORM!"
X	UpdateWin	[random filename]	"Detected by Kaspersky as the IRCBOT.AZW TROJAN! See here"
?	Updatewiz	updatewiz.exe	"??"
X	UpdateXpSp	MS045-XP2.exe	"Added by the IRCBOT.NY TROJAN!"
N	UPDATE~1	updatemgr.exe	Once a month your EarthLink 5.0 Update Manager contacts EarthLink's servers to check for software updates. If an update is available for your EarthLink software Update Manager will inform you and with your permission download and install the update. Can go to http://www.earthlink.net and download the updates manually
X	upddateit	winit.exe	"Added by the RBOT-MS WORM!"
X	Updmgr	updmgr.exe	"KeenVal adware"
X	updmgr	rvupdmgr.exe	"KeenVal adware"
X	upDpacketo	services.exe	"Added by the NAFBOT-A TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a ""TEMPER"" subfolder of the Windows or Winnt folder"
N	UpdReg	Updreg.exe	Reminder to register Creative Labs SoundBlaster Live! cards

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list