HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
X	Web Offer	ezStub.exe	"eZula TopText adware"
X	Web Offer	EZSTUB22.EXE	"eZula TopText adware"
X	Web Offer	vl_ezstub.exe	"eZula TopText adware"
?	Web Search	??	"??"
X	Web Service	[random filename].exe	"Added by the ADMINCASH TROJAN!"
X	Web Service	sm.exe	"Added by the BUBE-F VIRUS!"
X	Web Service	MSXMIDI.EXE	"CoolWebSearch parasite variant detected by Kaspersky as the SMALL.CW TROJAN!"
U	Web2Pop	Web2Pop.exe	"Web2Pop allows you to retrieve your web-based accounts messages to read them in your favorite e-mail client"
Y	web3trap	web3trap.exe	PC-Cillin 2000 anti-virus software → ActiveX filter. Guards against malicious ActiveX programs etc
X	webalize	webalize.exe	"Searchcentrix hijacker"
N	WebArmyKnife	WAK.exe	"Web Army Knife - a suite of web site developer's tools"
X	webassist	webassist.exe	Adware popup generator
X	WebBuying	webbuying.exe	"WebBuying adware"
N	WebCallDirect	WebCallDirect.exe	"WebCallDirect - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X	webcam	webcam.exe	"Added by the MONAD-A TROJAN! Note - this malware actually changes the default value data of the Registry Run and RunServices keys in order to force Windows to launch it at boot. Name field may be empty"
?	Webcam Go Sti Service Application	wbcgosvc.exe	"Control software for the portable Creative Webcam Go digital camera/PC web cam. What does it do and is it required?"
N	WebcamRT.exe	WEBCAMRT.exe	For Logitech Web Cams. Not required - camera works fine without it
X	Webcelerator	webcel.exe	"Webcelerator from eAcceleration speeds your Web browsing by both remembering where you have been and anticipating where you will go. Only needed if you find it improves web browsing. Now no longer available and supported and when available was classed as spyware - see here"
X	WebCheck	WebCheck.pif	"Added by the CONE.C or CONE.F WORMS!"
X	WebCpr0	WebCpr0.exe	"WebRebates adware"
X	Webdav.exe	webdav.exe	IRC DDoS bot which gives the hacker full control over your system
U	WebExRemoteAccessAgent	raagtapp.exe	"Related to Web Meetings from WebEx Communications Inc. Share and present online with anyone anywhere"
X	WebHancer Agent	whagent.exe	"System Tray application that starts up Webhancer software. Software that optimizes your web browser and is also advertising spyware that you can find out about here"
X	webHancer Survey Companion	whSurvey.exe	"WebHancertrackware - traffic measurement service that uses a client agent that is stealth installed on user machines gathering detailed data about sites visited their performance and most important what the user actually does while there"
X	WebInstall	WebInstall.exe	ClipGenie adware downloader
X	WebInstall2	WebInstall.exe	ClipGenie adware downloader
N	WebKey	WebKey.exe	"WebKey from JB Utilities. Utility to keep track of login data required when browsing the internet"
N	WebLink	WebLink.exe	"Softex is a ""cost-effective way to provide software updates technical support or new product information to specific end-users - it can silently provide end-users with software updates technical support and new product information customized to their specific needs through a persistent link"""
N	WebOutfitterTray	sttray.exe	Intel WebOutfitter service System Tray icon
N	Webposition Gold 2	wpsche~1.exe	"Scheduler for Web Position Gold - utility to help optimize the position of web-sites in search engines"
X	WebRebates0	WebRebates0.exe	"WebRebates adware"
Y	Webroot Desktop Firewall	WDF.exe	"Webroot Desktop Firewall"
X	WebRun	[random filename]	"Added by the ADWARELOADER TROJAN!"
U	websaverlive	websaverlive.exe	"WebSaver Live! is a companion program to Websaver that retrieves information from the Internet on a schedule and displays it on your screen when your computer is idle"
X	WebSavingsfromEbates	WebSavingsfromEbatesrun.exe	Web Savings From Ebates Software a shopping tool that opens pop-up windows
X	WebSavingsFromEbates0	WebSavingsFromEbates0.exe	Web Savings From Ebates Software a shopping tool that opens pop-up windows
U	WebScan	DEFSCANGUI.EXE	"eAcceleration Stop-Sign security software related. Previously not recommended see here"
U	webscan	stopsignav.exe	"eAcceleration Stop-Sign security software related. Previously not recommended see here"
Y	WebScanX	WebScanX.exe	From McAfee VirusScan up to version 4.x. Provides functionality for VShield Download Scan and Internet Filter modules. Enables internet scanning. Guards against malicious ActiveX programs etc
X	websearch	wjview ...websearch.exe	"""Web Savings"" From Ebates Software a shopping tool that opens pop-up windows"
N	WebSecureAlert	WebSecureAlert.exe	"WebSecureAlert - ""helps to protect your browser security by monitoring for unauthorized tampering with Internet Explorer's security settings and can help to protect your privacy by deleting your web surfing history on a regular basis"". Not recommended as it bundles GAIN adware. You can get the adware free version for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
?	WebServer	VBI_SE~1.EXE	"Related to a Pinnacle sound card. What does it do and is it needed?"
U	Webshots	Webshots Tray.exe	"Webshots - software that displays photos as your screensaver and wallpaper and provides tools for sharing your personal photos on the web"
U	Webshots	websho~1.exe	"Webshots - software that displays photos as your screensaver and wallpaper and provides tools for sharing your personal photos on the web"
U	Webshots	Launcher.exe	"Webshots - software that displays photos as your screensaver and wallpaper and provides tools for sharing your personal photos on the web"
U	Webshots	WebshotsTray.exe	"Webshots - software that displays photos as your screensaver and wallpaper and provides tools for sharing your personal photos on the web"
X	Website Administrator Info	webadmin.exe	"Added by the FORBOT-FY WORM!"
X	WebSpecials	rundll32 [path] webspec.dll	"WebSpecials spyware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	WebSUpdater	wupda.exe	"Detected by Kaspersky as the STARTPAGE.C TROJAN! See here"
X	Websx	Int*****.exe	Adult content dialler - where ***** are random
Y	Webtrap	webtrap.exe	Part of PC-Cillin anti-virus software. Checks web-sites for malicious Java and ActiveX elements in a similar way to McAfee WebScanX. A few users find it infuriating
Y	WebTrapNT.exe	WebTrapNT.exe	Part of PC-Cillin anti-virus software. Checks web-sites for malicious Java and ActiveX elements in a similar way to McAfee WebScanX. A few users find it infuriating
U	WebWasher	wwasher.exe	"Free Pop-up/ad/javascript filter program from Siemens. If not running then browsers will not be protected but will still work. Available via Start -> Programs"
X	WeirdOnTheWeb	WeirdOnTheWeb.exe	"WeirdOnTheWeb adware"
N	Welcome	Welcome.exe	Launches the Welcome to Windows tutorial on boot up
X	Welcome	winconfig.exe	"Added by the GIP.113.B1 TROJAN!"
X	Welcome	CONFIG.EXE	"Added by the PSWGIP.B TROJAN!"
?	WEPstat	Wepstat.exe	"Cisco Aironet 340 Series PC Card driver. If it can be started manually it shouldn't be required if you don't use the PC card facility regularily - hence the status could be ""U"". Can anybody confirm this?"
X	wersds	doriot.exe	"Added by the JECT.C TROJAN!"
X	wersds.exe	doriot.exe	"Added by the BAGLEDI-A TROJAN!"
X	wescmv	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	wesumu	wiustv.exe	"Added by the QQPASS-L TROJAN!"
N	WetSock	wetsock.exe	"RoboMagic Wetsock - weather reporting in the System Tray"
N	wextract_cleanup0	advpack.dll DelNodeRunDLL32 [path] [filename].TMP	Wextract Cleanup0 is valid and legal software included or sold to help clean up temporary or cab files created by the installer software for a wide variety of software. It should disapear after a restart of the system. If not fix it
N	WFGStartup	WFGStartup.exe	"World Weather. "This midlet displays the current weather conditions for major cities around the world. This version is for memory limited mobile phones""
U	wfips	iphider.exe	"ICQ (messaging/chat program) anti-bomb software. ""WFIPS is anti-bomb software for safeguarding ICQ Bomb before the bombing. 'ICQ Defoolder' is a tool for removing ICQ bomb after being exposed."" For more information about ICQ bombs see here"
N	WFXCTL32.EXE	WFXCTL32.EXE	From WinFax 10.0 and possibly earlier versions. Appears if you chose to have WinFax appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs
Y	wfxsnt40	wfxsnt40.exe	WinFax 10.0 and maybe earlier versions. Used to initiate the WinFax port to enable printing to the WinFax printer (send a fax) from any application
?	WFXSwtch	WFXSWTCH.exe	"Related to WinFax. What does it do and is it required?"
U	WG111v2 Smart Wizard Wireless Setting	RtlWake.exe	"Configuration utility for the Netgear WG111 54 Mbps Wireless USB 2.0 Adapter that ""provides wireless access to your desktop or notebook PC through the computer's USB port"""
Y	WG511WLU	WG511WLU.exe	Netgear configuration programme for the 54g wireless lan card - required to monitor and manage the lan card
X	wgeax	wgeax.exe	"Added by the IRCBOT-TM WORM!"
X	wgs3	wgs3.exe	"Added by the LEGMIR-AQH TROJAN!"
X	WGV	WGV.exe	"Added by the ZIPPIE TROJAN!"
U	WGWLocalManager	WGWLocalManager.exe	Part of Flash-Networks NettGain2000 product. NettGain 2000 is a combined hardware/software networking solution which is designed to improve performance of satellite networks by increasing data transmission speeds and maximizing the existing bandwidth for complete utilization when sending TCP/IP applications over a satellite. It is needed when connecting to the internet via satellite to provide speed faster than 60k or so. It could be started by creating a shortcut running it only when connecting to the internet. If internet is used often it's recommended to leave it in startup so it starts with the system
Y	WgwMngr	WgwMngr.exe	Part of Flash-Networks NettGain2000 product. NettGain 2000 is a combined hardware/software networking solution which is designed to improve performance of satellite networks by increasing data transmission speeds and maximizing the existing bandwidth for complete utilization when sending TCP/IP applications over a satellite. It is needed when connecting to the internet via satellite to provide speed faster than 60k or so
X	whagent	whagent.exe	"System Tray application that starts up Webhancer software. Software that optimizes your web browser and is also advertising spyware that you can find out about here"
X	What Frenz	FriendEQUALsuX.exe	"Added by the BHARAT.A WORM!"
U	WhatPulse	WHATPU~1.EXE	"WhatPulse keeps track of your keystrokes allowing you to find out just how much you type a day"
U	WheelMouse	4DMAIN.EXE	Mouse software for "Fellowes" Wheelman mouse. Has caused some users problems but shouldn't be needed if you don't use any enhanced features it may provide
U	WheelMouse	AMOUMAIN.EXE	"A4Tech wireless mouse driver and utility - required if you use non-standard Windows driver features"
X	WheelsMouse	[path to trojan]	"Added by the SOCKSPR-D TROJAN!"
X	WhenUSave	Save.exe	"WhenU.Save adware"
X	WhenUSearch	Search.exe	"WhenU.Save adware"
X	WhenUSearchWHSE	whse.exe	"WhenU.Save adware"
X	Whistler	whismng.exe	"Added by the WHISTLER-F TROJAN!"
X	Whitechix	brightx.exe	"Added by a variant of the SDBOT WORM!"
N	WhitephonePersonal	WhitePhonePersonal.exe	"WhitePhone Personal from Voice Commerce Group - ""provides free PC to PC calls globally and access to low cost calls to phones worldwide."" Free internet telephony utility using the VoIP (Voice over Internet Protocol). No longer appears to be available"
X	Whvlxd	Whvlxd.exe	"Added by the ZAPCHAS-CS TROJAN!"
X	whxpin service	ssvsol.exe	"Added by a variant of the SDBOT WORM!"
X	wiascr	wiascr.exe	"Added by the AGENT.AM TROJAN! Note - example names include ""XviD"" ""Winamp Remote"" ""Windows Media Player"" and ""Futuremark"""
N	WIAWizardMenu	RUNDLL32.EXE sti_ci.dll WiaCreateWizardMenu	Still Image Class Installer - installed with a webcam
X	Widnows Xp Web scan	xpscan.exe	"Added by a variant of the SDBOT WORM!"
X	wifeman	wifeman.exe	Unidentified malware
X	Wifi Boot	wifiboot.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Wifi Booter	wifibooter.exe	"Detected by Trend Micro as the IRCBOT.GP TROJAN! See here"
X	Wifi Configuration	wificonfig.exe	"Added by the CHECKOUT WORM! See here"
X	Wifi Configuration!	wificonfigs.exe	"Added by the CHECKOUT WORM! See here"
X	Wifi Connection	wificon.exe	"Detected by Trend Micro as the SLENFBOT.AC TROJAN! See here"
X	Wifi Connection!	wificonnect.exe	"Added by the CHECKOUT WORM! See here"
X	Wifi Debug	wifidebug.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Wifi Loader	wifiload.exe	"Detected by Trend Micro as the IRCBOT.AVG TROJAN! See here"
X	Wifi Loader!	wifiloader.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Wifi Setup	wifisetup.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	WiFix service	[random filename]	"Added by a variant of the SDBOT WORM!"
X	WildFlics	WildFlics.exe	"Direct-B premium rate adult content dialler"
?	WildTangent CDA	RUNDLL32.exe cdaEngine0400.dll cdaEngineMain	"Part of the WildTangent on-line games system. What does it do and is it required?"
U	WildTangent Web Driver updater	wcmdmgrl.exe	"Web Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case"
N	Wildwire Monitor	WWMon.exe	This places a status icon on the taskbar for the DSL WildWire Tiger Modem. This is also a shortcut to the diagnostics utility for the DSL modem
N	Willow Road	WillowRoad.exe	Willow Road Screen Saver
X	WillPolo	WillPolo.vbs	"Added by the SOLOW.AF VIRUS!"
X	win	regedit -s ..win.dll	"Added by the SEEKER.K TROJAN!"
X	win	xwinxrpc32.exe	"Added by the AGOBOT-MV WORM!"
X	win	xwinxrpc.exe	"Added by the AGOBOT-MV WORM!"
X	WIN	ehshell.exe	"Added by the MYTOB-CQ WORM!"
X	WIN	windows.exe	"Added by the REATLE.C WORM!"
U	win	homesec.exe	"Related to the Sentry Parental Controls software"
X	Win Antivir 2008	Win Antivir 2008.exe	"Win Antivir 2008 rogue security software - not recommended see here"
X	Win Antivirus 2008	Win Antivirus 2008.exe	"Win Antivirus 2008 rogue security software - not recommended see here"
U	Win Chimes	winchi~1.exe	"WinChimes - enhancement software for the system clock that runs in the system tray"
X	Win Comm	WinComm.exe	"Added by the WINCOM TROJAN!"
X	Win Command	command32.exe	"Added by the AGOBOT.XQ WORM!"
X	Win Config	winconfig.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Win CPU	sysin.pif	"Added by the RBOT-AXL WORM!"
X	win ctl app	wuctl.exe	"Added by a variant of the SDBOT WORM!"
X	Win Defrag	windfrag.exe	"Added by a variant of the SDBOT WORM! See here"
X	Win Defrag!	windefrag.exe	"Added by a variant of the SDBOT WORM! See here"
X	Win Defrags	defrag.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Win Drivers SSL	hpws.exe	"Added by the IRCBOT.67098 WORM!"
X	Win Drivers SSL	TASKMAN4.exe	"Added by a variant of the RBOT WORM!"
X	Win Drivers SSL32	hpwsnnsbc.exe	"Added by the SPYBOT.MAR WORM!"
X	WIN HOST PROCESS	WIN HOST PROCESS.EXE	"Added by the KEYLOGGER.CLONE TROJAN!"
X	Win INI 32	msrp32.exe	"Added by the RBOT-FZC WORM!"
X	Win l5oahder	winampa.exe	"Added by a variant of the RBOT WORM! Note - this is NOT associated with the popular Winamp media player. The valid file for the Winamp Agent resides in a ""Winamp"" subdirectory of the Program Files directory"
X	Win Login	winlogin.exe	"Added by the RBOT-AWE WORM! Note - this trojan file is found in the System (95/98/ME) or System32 (NT/2000/XP) folder"
X	Win Microsoft 98	win14.exe	"Added by the RBOT-AKX WORM!"
?	win name	stat.exe	"??"
X	Win Net Wks32	netwks32.exe	"Added by the RBOT.AA WORM!"
X	Win Patch	ntldr.exe	"Added by the SDBOT-GS WORM!"
X	Win Process Updates	winupdates.exe	"Added by a variant of the SDBOT WORM!"
X	Win Prosess0r	[random filename]	"Added by the RBOT-BIT WORM!"
X	WIN prosessor16	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	Win Proxy32 Protocol	bsvtem.exe	"Added by a variant of the SDBOT WORM!"
X	Win Secure Update	[random filename]	"Added by the RBOT-AGI WORM!"
X	Win Security	msw32.pif	"Added by the RBOT-AQT WORM!"
X	Win Security	winsecure.exe	"Detected by Trend Micro as the IRCBOT.AVE BACKDOOR! See here"
X	Win Server	winserv.exe	"Added by the IMISERV.A TROJAN!"
X	Win Server Updt	wupdt.exe	"Added by the IMISERV.A TROJAN!"
X	Win Server Updt	winserver.exe	"Added by a variant of the IMISERV TROJAN!"
X	Win Server Updt	pxckdla.exe	"IEPlugin adware"
X	Win Sync montr	winsyncupx.exe	"Detected by Kaspersky as the RBOT.BYJ TROJAN! See here"
X	Win TaskLoader	msgmr.exe	"Added by the MYTOB.L WORM!"
X	win update	wupda32.exe	"Added by the SDBOT.J WORM!"
X	win update	wapdate.exe	"Added by a variant of the RBOT WORM!"
X	Win Update	SysUpdate.exe	"Added by the AGOBOT-TN WORM!"
X	Win Update	oleupdate.exe	"Added by the AGENT-UY TROJAN!"
X	Win Update	msnmger.exe	"Added by the RBOT-GDP WORM!"
X	Win Updater	WINUPDATER.EXE	"Added by the RBOT.IP WORM!"
X	Win Updator Services	ctfnom.exe	"Added by a variant of the WOOTBOT WORM!"
X	WIN USB 2.0	usbsystem.exe	Added by an unidentified WORM of TROJAN!
X	WIN USB 2.0	winusb.exe	"Added by a variant of the RBOT WORM!"
X	Win USB 2.0 USB Driver	HPPrint.exe	"Added by the SPYBOT.DNB WORM!"
X	WIN USB SUPPORT	grxsrv.exe	"Added by a variant of the RBOT WORM!"
X	Win Validation Application	DBExecCom.exe	"Added by the VBSILLY-A WORM!"
X	Win WinAmp	winamp.exe	"Added by the RBOT.AGF WORM! Note - this is NOT the popular Winamp media player which resides in a ""Winamp"" subdirectory of the Program Files directory. This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder"
X	win************* [* = random digit]	win*************.exe [* = random digit]	"WINBO adware"
X	WIN-BUGSFIX	WIN-BUGSFIX.EXE	"Added by the LOVELETTER (I LOVE YOU) VIRUS!"
X	win-xp	nvsc32.exe	"Added by the BROPIA.N WORM!"
X	win-xp	winis.exe	"Added by the BROPIA.N WORM!"
X	win.exe	win.exe	"Added by the PODROP-C TROJAN!"
U	win16.dll	win16dll.exe	"Screenspy captures screenshots silently. If you didn't install this yourself remove it"
X	win23.exe	win23.exe	"Detected by Kaspersky as the BIFROSE.BSJ TROJAN! See here"
X	Win2Drv	[worm filename]	"Added by the WINTOO WORM!"
X	WIN32	WIN32.EXE	"Added by the RATEGA TROJAN!"
X	win32	Shakira_1997_Part_1_.Mpeg_.scr	"Added by the MYLIFE.N WORM!"
X	win32	Setup_32.exe	"Added by the EVILBOT.B TROJAN!"
X	Win32	Win32.exe	"Added by the ISRAZ.A WORM!"
X	win32	winsrv32.exe	"Added by the ADUENT TROJAN! Acts as a hi-jacker redirecting to Surferbar.com and adult content sites"
X	win32	WinSetup.exe	"Added by the EVILBOT.B TROJAN!"
X	Win32	system32.vbs	"Added by the SWERUN VIRUS!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list