Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown
Startup Name Process Name Details
X Cekirge [path to worm]"Added by the KERGEZ.A WORM!"
X center [random name]32.exe"Added by the BOFRA.A WORM!"
X CentralProcessor taskimgr.exe"Added by the BANCOS.J TROJAN!"
? CEPA wsot.exe"??"
X Cerb DivXx.exe"Added by the KEYLOG-LV TROJAN!"
U CertificateRegistration SafeSignCertReg.exeSafeSign Certificate Registration Utility for Microsoft Crypto applications
U CertReg certreg.exe"Related to Gemplus Card Reader"
Y CertStoreInit CertStoreInit"Aladdin eToken authentication and password management"
Y certtool certtool.exe"Part of Client Security Software for IBM\Lenovo notebooks. If you have configured the software via the associated wizard this will need to be running if you want to mount password protected areas of the disk (created with SafeGuard PrivateDisk)
N CesarFTP FTP Server server.exe"CesarFTPd - FTP server"
X cesmain.dll "Rundll32.exe [path] cmail.dll Rundll32"
X CEventMgr Cell.exe"Added by the BIFROSE-AK TROJAN!"
N CFD CFD.exe"BroadJump Client Foundation. Broadband troubleshooting software installed by various companies. Not required and you can remove it via Add/Remove programs"
X CFDStart WinMuschi.exe"WINMUSCHI dialler"
N cfFncEnabler.exe cfFncEnabler.exe"Toshiba ""Config Free"" wireless network manager on their range of laptops"
X cfgboost cfgboot.exeAdded by an unidentified WORM or TROJAN!
Y cfgintpr cfgintpr.exe"Configuration Interpreter - part of Tiny Personal Firewall V4"
X cfgmgr51 "RunDLL32.EXE cfgmgr51.dllDllRun"
X cfgmgr52 "RunDLL32.EXE cfgmgr52.dllDllRun"
N cfgwiz cfgwiz.exe"Introduced with Norton Anti-Virus 2002
U CFi ShellToys Utility Manager CFiShlMan.exe"Manager for CFi ShellToys from Cool Focus International Ltd - which ""puts all the tools you need right where you need them - just a click away on your context menu. Right-click one or more files or folders
? cFosDNT cFosDNT.exe"cFos DSL Modem driver related. What does it do and is it required?"
? cFosInst_Check cfosinst.exe"cFos DSL Modem driver related. What does it do and is it required?"
U cFosSpeed cFosSpeed.exe"cFos Software Internet acceleration program related. Note - may be necessary for the software to work properly"
U CFSServ.exe CFSServ.exeBelongs to Toshiba's configfree utility and searches for Wireless Devices
X cftmon sfcmonit.exeAdded by a variant of the AGENT.ERG TROJAN!
X cftmon WindowsUpdate.exe"Added by the AGENT.AQK BACKDOOR!"
X cftmon32 taskmgr*.exe [* = number]"Added by the SOWSAT.C and SOWSAT.J WORMS!"
X Cftmon32 afd.exe"Added by the AUTORUN-AUB WORM! The ""afd.exe"" file is located in %Windir%"
X Cftmon32 afd.exe"Added by the SCAR.AYWK TROJAN! The ""afd.exe"" file is located in %AppData%"
X cfy cfy.exe"Surfenhance.com SearchForIt adware variant"
X CGI Firewall Script CGIAGENT.EXE"Added by the BROPIA-U WORM!"
U CGServer cgserver.exe"Associated with an Eicon Networks ISDN or ADSL modem. Call Guard Server (CGserver) watches your modem and blocks incoming or outgoing calls. You need cgard.exe (from Startmenu) to configure cgserver with rules and telephone numbers. Good against unwanted dialer programs"
X Cgtask Services cgtask.exe"Added by the LALA.B TROJAN!"
X Cgywin cgywin32.exe"Added by the RBOT-AEI WORM!"
U ChamClock ChamClock.exe"Chameleon Clock - system tray clock replacement"
X change-me-now msgfix1.exe"Added by the SDBOT.ZD WORM!"
U ChangeICON SPMSMON.EXECard reader related program. Note - may cause problems with My Computer loading at startup. Disabling through MsConfig seems to solve the problem
? ChangeLines chngline.exe"??"
X ChansonsMP3 "rundll32.exe MSA64CHK.dllDllMostrar"
Y Charter High-Speed Security Suite fspex.exe"Charter High-Speed Security Suite - security software in collaboration with F-Secure"
X Chat login chatlogin.exe"Added by the ANTINNY.F WORM!"
N Chatango Chatango.exe"Chatango - ""allows people to be connected in real time through their Web browsers. Include your Chatango contact link or button when you create eBay auctions
U ChatStat ChatStat.exe"ChatStat from ChatStat Technologies
N Chcenter chcenter.exe"IMSI HiJaak - ""the easiest way to convert
X Chckup Netverchk.exe"Covert Sys Exec malware variant"
X chcp.exe chcp.exe"Added by the SDBOT.BMH BACKDOOR!"
X che32 che.ocx.vbs"Added by the ADENU-B VIRUS!"
X Cheatle GigaByte.exe"Added by the SHODI.B VIRUS!"
U cheatmonitor start.exe"CheatMonitor surveillance software. Uninstall this software unless you put it there yourself"
X Check Check.exe"Added by the VB-DRN WORM!"
N Check for One Touch Update wiseupdt.exeChecks for updates for Visioneer OneTouch scanners
N Check for TWS Updates WiseUpdt.exeInteractive Brokers - check for update to their standalone Java-based trading platform
U Check Messenger cmesseng.exeCheck Messenger from Qchex.com - program that helps you manage the activity of your Qchex account. Qchex appear to be no longer in buisness
U Check&Get Check&Get.exe"Check&Get from ActiveURLs. Manages your browser bookmarks and favorites. Monitors Web sites for changes and updates
N CheckCustomWorksUpdate CheckCWupdate.exe"Update checker
U CheckDialer ChkDial.exe"Added by the CheckDialer modem connection monitoring tool"
X Checkdisk mscas.exe"Added by the VAGON-A TROJAN!"
X CheckFaultKernel mswdm.exe"Added by the SMALL-CSK TROJAN!"
U CheckIt ToolBox.exe"CheckIt Toolbox from
U CheckIt 86 CheckIt86.exe"CheckIt 86 popup blocker"
Y CheckMsgPlus "MsgPlusH.dll VerifyInstallation"
X checkrun elite***32.exe [* = random char]"EliteBar adware"
X checkrun elitelsj32.exe"Added by the MULTIDR-ER TROJAN!"
X CheckScan32 regload16.exe"Added by the AEBOT.K WORM!"
? checktime ct.exe"Found in the HPSelectFrontend directory on a HP machine. What is it's purpose and is it required?"
Y CheckVCR IOMagic.exe"Driver for the I/OMagic Personal Video Recorder (DR-PCTV100)"
X CheckWinPerf perfinfo.exe"Added by a variant of the IRCBOT TROJAN!"
U CherryKeyMan KeyMan.exe"Multimedia keyboard manager for the Cherry keyboard series. Only required if you use any of the special keys"
X chiCkie chiCkie.exe"Added by the CHIKO WORM!"
U ChicoSys webtmr.exe"Child Control parental control software"
U ChikkaDefault ChikkaLauncher.exe"Chikka PC text messanger and IM client"
U ChilyClient ChilyClient.exe"Chily Employee Activity Monitoring surveillance software. Uninstall this software unless you put it there yourself"
X china11msn CHINA11MSN.EXE"Added by the ENVID.O WORM!"
X Chinagnq vasdd.exe"Added by the SDBOT-SE WORM!"
U ChineseStar cstar.exeChinese language support software
U CHIPDRIVEPinManager sokscmpn.exe"ChipDrive Smartcard software"
U CHIPDRIVESmartcardManager SCMgr.exe"ChipDrive Smartcard software"
X CHK Disker chkdsker.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X CHK NT chkntf.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
N CHKADMIN CHKADMIN.EXE"Compaq Network Management System. When running
X ChkDisk chk_disk.exeAdded by an unidentified WORM or TROJAN!
X chkdrv iemon.exe"Detected by Symantec as the ADCLICKER TROJAN!"
X chkdsk autoexec.bat"Added by the ANPES WORM!"
U ChkMail ChkMail.exeMail-checking program supplied with Acer notebooks
U ChoiceMail CHOICEMAIL.EXE"ChoiceMail from DigiPortal Software. Block spam with an Email firewall"
X Choke Choke.exe -blahhh"Added by the CHOKE WORM!"
X chope runlli32.exe"Added by the QQPASS-U TROJAN!"
X chostsv chostsv.exe"Added by the BANPAES.C TROJAN!"
U CHotKey mhotkey.exe"Enables special keys on Chicony keyboards. Special combinations include Internet
U CHotKey MK9805.EXE"Enables special keys on Chicony keyboards. Special combinations include Internet
U CHotKey zHotkey.exe"Enables special keys on Chicony keyboards. Special combinations include Internet
N Christmas Music Player TTEST6.EXE"Christmas Music Player brings the music of the Christmas Holiday to your desktop"
? ChromeMark keysh.exe"Related to this. Don't know what keysh.exe does though and if it's required"
? ChronitelInitTV CHTVINIT.EXE"??"
U chrono chrono.exe"Chronograph is a simple utility that synchronizes internal computer clock to the atomic time. Chronograph automatically maintains correct time using atomic clock servers of the National Institute of Standards and Technology (NIST)."" Shows seconds and shows the date without having to hover the mouse. Shows a calendar when hovered over"
X Ci Servs SysTuwin.exe"Added by the AGENT-NIQ TROJAN!"
X Ci Svr cisvr.exe"Added by the IRCBOT.AWN BACKDOOR!"
X ci1gnt ci1gnt.exe"Detected by Kaspersky as the AGENT.DHU TROJAN!"
X CiaBackdoor msldr.comAdded by a VIRUS!
X cihost.exe cihost.exe"Added by the LINST TROJAN!"
N CIJxP2PSERVER CIJxP2PS.EXE"Compaq printer utility which is required in order to make the printer work correctly - "x" depends upon the model
Y Cingular Communication Manager CingularCCM.exe"Cingular Communication Manager - now taken over by AT&T. ""provides a robust set of wireless communication tools for businesses and individuals. With wireless access to email
X Cinnabd Prompt32 CmdPrompt32.pif"Added by the ASSIRAL-B WORM!"
N CIO che7e1~1.exe"ChatItOut webcam chat program"
X Ciodiag DECCONF.EXE"Added by the STRAT.EL TROJAN!"
X CirebonPunya XXrocks.exe"Added by the BHARAT.A WORM!"
X Cisco Systems [path to worm]"Added by the AUTORUN.UHR WORM!"
U Cisco Systems VPN Client ipsecdialer.exe"Cisco VPN Client - lets local users gain Administrator privileges on the operating system"
U Cisco Systems VPN Client vpngui.exe"Sets up IPSec communications for Cisco's VPN Client"
N CISrvr Program CISRVR.EXERelated to internet setup on Compaq PC's
X Cissi Cissi.exe"Added by the CISSI.A WORM!"
U CitiUCS CitiUCS.exe"Citibank Virtual Account Numbers - ""With this free service for Citi cardmembers
N CitiVAN CitiVAN.exe"Option from Citibank to change a credit card number in a random fashion for each purchase. The number will only be used once and never again"
X cjb cjb.exe"Added by the AGENT.ALZE TROJAN!"
X cjb cjb*.exe"Added by a variant of the AGENT.ALZE TROJAN - where * is a random digit and the file is located in %ProgramFiles%\cjb"
X CJET CJet.exe"FFToolBar adware toolbar"
Y Cjstcom Cjstcom.exeCanon printer BJ status language monitor
Y ClamWin ClamTray.exe"ClamWin antivirus"
X Classes int1.exe"""Switch"" premium rate adult content dialler variant"
X Classes intl.exe"""Switch"" premium rate adult content dialler variant"
X Classes run_21.exe"""Switch"" premium rate adult content dialler variant"
X Classes srv.exe"""Switch"" premium rate adult content dialler variant"
X Classes srv2.exe"""Switch"" premium rate adult content dialler variant"
X Classes MSTAR2.EXE"""Switch"" premium rate adult content dialler variant"
X Classes mstart.exe"""Switch"" premium rate adult content dialler variant"
U ClauerUpdate ClUpdate.exe"Automatic updates for the software supporting the Clau-ACCV and Clauer-idCAT digital certificate USB keys"
X clcbt.exe clcbt.exe"Added by the AGENT.CBA TROJAN!"
X clcl3 clcl3.exeAdded by the AGENT.ES TROJAN!
X clcl7 clcl7.exe"Added by a variant of the Covert Sys Exec TROJAN!"
U CLCLSet CLCL.exeCLCL clipboard caching utility
N Clean Access Agent CCAAgent.exe"Cisco Clean Access Agent from Cisco Systems
X Clean Mgr cleanmg.exe"Added by the IRCBOT.BBO BACKDOOR!"
X Clean up service.exe"Added by the AGENT-FPY TROJAN!"
X Cleanator Cleanator.exe"Cleanator rogue privacy program - not recommended
? CleanEasyImg cleanall.exe"??"
X Cleaner2009 Freeware UCLN.exe"Cleaner2009 rogue privacy program - not recommended
X CleanPCTool SysRep.exe"CleanPCTool rogue system error and cleaning utility - not recommended
? CleanRegPath CleanReg.exe"Apparently Annex A ADSL modem related. What does it do and is it required?"
U CleanSweep Smart Sweep- Internet Sweep Csinsm32.exeAutomatic logging of installs from Norton CleanSweep - available via Start -> Programs
N CleanSweep Useage Watch CSUSEM32.EXEQuarterdeck/Norton CleanSweep component - tracks how often you use files and alerts you to files that have not been used for a specified period of time
X cleansweep.exe cleansweep.exe"Added by the AGENT-NEU TROJAN!"
U CleanTemp CLEANT~1.EXE"CleanTemp - deletes the contents of the TEMP directory when Windows starts and then closes - using no memory"
U CleanTemp CleanTemp.exe"CleanTemp - deletes the contents of the TEMP directory when Windows starts and then closes - using no memory"
N Cleanup ONICTASK.EXE"Internet Cleanup from Allume Systems (used to be by OnTrack) - cleans up tracks left by browsing the internet"
Y CleanUp mcappins.exeUsed by older versions of McAfee internet security related products to clean up installation files that are no longer required once the product is installed. This entry will normally only appear once the product has been installed before the system is rebooted
Y CleanUp CleanUp.exe"Utility that only runs once after installing the drivers for Analog Devices SoundMax integrated soundcards to clean-up the files no longer required once the installation is complete. Other programs/drivers may use the same filename for the same purpose. In this case
X CleanUp Antivirus CU[random characters].exe"Cleanup Antivirus rogue security software - not recommended
? CleanupProgram cleanup.exe"Sony Vaio related - what does it do and is it required? Located in a C:\Sonysys folder"
X CleanupTool SysRep.exe"CleanupTool rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
X clean_service clean_service.cmd"Added by the REFAZ WORM!"
U CleverKeys CK.exe"CleverKeys - ""is free software that provides instant access to definitions at Dictionary.com
X clfmon clfmon.exe"Added by the TACTSLAY.E TROJAN!"
X clfmon nvsvca32.exe"Added by the TACTSLAY.E TROJAN!"
X clfmon.exe clfmon.exe"Added by the AGENT-BJ TROJAN!"
X Cli Confg cliconfig.exe"Added by a variant of the SPYBOT WORM! See here"
X CLI Services clisrv.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
N Click Radio Tuner clickr~1.exe"ClickRadio - subscription service playing radio music via the internet"
N Click Tray Calendar ClickT~1.EXE"ClickTray Calendar - shows holidays
N ClickMe ClickMe.exe"ClickM ""JOKE"" program"
U Clickoff Clickoff.exe"Clickoff automatically dismisses annoying dialog boxes"
N ClickSight Launcher cs.exe"Launcher for the ClickSight® marketing tool from ClickStream Technologies - which ""is a patented data-collection technology that helps independent software vendors understand the current and future usage of their product"""
X ClickTheButton CTB.EXE"ClickTheButton adware"
X ClickTheButton csrss.exe"ClickTheButton adware. Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X ClickTheButton cd_load.exe"Added by the DOWNLOADER-MY TROJAN!"
X CLICONFG CLICONFG.EXE"Added by the OPASERV.T WORM!"
U Client Access API Daemon cwbappcd.exe"IBM iSeries Client Access
N Client Access Check Version cwbckver.exe"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
? Client Access Express Welcome cwbwlwiz.exe"Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
N Client Access Help Update cwbinhlp.exe"Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
N Client Access Service CwbSvStr.Exe"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
U Client Access Taskbar cwbuitsk.exe"IBM iSeries Client Access taskbar
X Client Agent ipxwping.exe"Added by the PPDOOR-N TROJAN!"
X Client Agent photes.exe"Added by the PPDOOR-P TROJAN!"
X Client Agent [path to file]"Added by the PPDOOR-J TROJAN!"
? Client agent for ARCserve W95AGENT.EXE"Part of Brightstor ARCserve Backup from Computer Associates. What does it do and is it required?"
X Client for Microsoft Networks msclient32.exe"Added by the SDBOT-BXQ WORM!"
N Client Security Solution cssauth.exe"Part of Thinkvantage Client Security Solution for Lenovo ThinkPad notebooks and ThinkCentre desktops. Once configured via the associated setup screens this loads via winlogon.exe (and loads the password manager) and therefore disabling this entry has no effect"
X Client Server Control Process [path to trojan]"Added by the AGENT-HR TROJAN!"
X Client Server Run Time Proccess csrsrv.exe"Added by a variant of the SDBOT WORM!"
X Client Server Runtime [path to worm]"Added by the POEBOT-KR WORM!"
X Client Server Runtime Process csrsss.exe"Added by the SDBOT-LD WORM!"
X Client Server Runtime Process csrs.exe"Added by the LINKBOT.M WORM!"
X Client Server Runtime Process smmss.exe"Backdoor TROJAN! Possible SDBOT-GEN variant"
X Client Update wup.exe"Added by the OPANKI.O WORM!"
Y Cliente DLO DLOClientu.exe"Part of the backup suites from VERITAS - Backup Exec and NetBackup. Both have now been replaced by their Symantec equivalents since they acquired VERITAS in 2005"
X ClientMan1 mscman.exe"ClientMan parasite variant"
N Clik Status Monitor toolsclickstat.exePart of Iomega Tools to let you know whether an Iomega PocketZip (nee Clik) removable drive cartridge is installed
X Clip Service Manager clipmg.exe"Added by the DELF.DXJ TROJAN!"
X Clip Servicer clipsrvc.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X Clip Srv clipsv.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X clipboard.exe clipboard.exeAdded by an unidentified WORM or TROJAN!
N Clipbook Service Clipsrv.exe"Supports Windows XP ClipBook Viewer
U clipdiary clipdiary.exe"Clipdiary from Softvoile - ""Free Clipboard Manager for keeping the clipboard history"""
N ClipMate5x ClipMt5x.exe"Clip Mate 5.x by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs"
N Clipmate6 CLIPMT60.EXE"Clip Mate 6 by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs"
N ClipMate7 ClipMate.exe"Clip Mate 7 by Thornsoft - utility that allows you to store more than one item in the clipboard"
N Clipomatic Clipomatic.exe"Mike Lin's Clipomatic is a clipboard cache program - it remembers what was copied to the clipboard even after new data is copied
N Clipsrv Clipsrv.exe"Supports Windows XP ClipBook Viewer
X ClipSrv clipserv.exe"Added by the SDBOT-AAV and SDBOT-AFE WORMS!"
X ClipSrv CLIPBRD3D.EXE"Added by the MOFEI-D WORM!"
X Clipsvc clipsv.exe"Added by the BLACKHOLE.F BACKDOOR!"
N ClipTrak ClipTrak.exe"
N ClipTrakker ClipTrakker.exe"Cliptrakker - clipboard extender"
N CLISTART CLIStart.exePuts the ATI Catalyst™ Control Center Icon/Shortcut on the System Tray - available via Start → Programs
X clkhost [path to trojan]"Added by the WIXUD-B TROJAN!"
U CLMFrontPanel clmpanel.exe"System tray status/display/configuration utility for a number of modems. Can be disabled by right-clicking on the tray icon. If disabled
? CLMLServer for HP TouchSmart CLMLSvc.exe"Found on the HP Touchsmart range of desktops and notebooks. What does it do and is it required?"
? clnwall "rundll.exe setupx.dll InstallHinfSection ..delwall.inf"
X clock [various filenames]"LiveChat Adware - known file names include: mssetup.exe
X Clock Manager amsngr.exe"Added by the SDBOT-XM TROJAN!"
X ClockSync Sync.exe"ClockSync - synchronizes your system clock with an internet time server. It's by WhenU
U ClockWise CLOCKWISE.EXE"ClockWise - produced by R J Software - a time utility. It is a schedueler not only for dates
U ClocX ClocX.exe"ClocX - places a clock on the desktop that can be moved and then changed into a calendar plus you can set alarms etc?"
U CloneCD CloneCDTray.exe"System tray for the now discontinued CloneCD. The only useful option is ""Hide CDR Media"" only available via this tray. Has additional unknown functions in later versions"
U CloneCDElbyCDFL ElbyCheck.exe"From Elaborate Bytes who make CloneCD - monitors the installed filters of CD-ROMs/DVD-ROMs. Note - under Win2K removing this from startup causes the CD drive in the computer to not be recognized in the OS and after rechecking it prompts that the driver has been corrupted and asks you to restart the computer to fix it"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list