Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown
Startup Name Process Name Details
X DirectX DirectX.exe"Added by the BLAXE or LOGPOLE WORMS!"
X directx NTCmd.exe"Added by the SDBOT.D TROJAN!"
X directx PipeCmd.exe"Added by the SDBOT.D TROJAN!"
X DirectX 32 directx32.exe"Added by a variant of the AGOBOT/GAOBOT WORM!"
X DirectX Driver stdhost.exe"Added by the SDBOT.GVJ BACKDOOR!"
X DirectX For Microsoft Windows dtxservice.exe"Added by the PROGENT TROJAN!"
X DirectX for Microsoft Windows Fservice.exe"Added by the PRORAT TROJAN!"
X DirectX for Microsoft Windows Sservice.exe"Added by the PRORAT TROJAN!"
X DirectX For Microsoft® Windows fservice.exe"Added by the PRORAT-P TROJAN!"
X DirectX For Microsoft® Windows fservice.exe"Added by the PRORAT-L TROJAN!"
X DirectX shell driver [path to trojan]"Added by the MARKTMAN-B TROJAN!"
X Directx Startup Drivers direct.exe"Added by the RBOT.UXL WORM!"
X DirectX Video Driver dxterm5.exe"Added by the WILAB-A TROJAN!"
X DirectX64 DirectXset.exe"Added by the BROWNEY.A WORM!"
X DirectX9 direct3d.exe"Added by the AGENT.EAK TROJAN!"
X DirectX9 svchost32.exe"Added by the RBOT.AQG WORM!"
X DirectX9 Diag dx9diag.exe"Added by the RBOT-ALT WORM!"
X DirecX DirecX.exe"Added by the AGOBOT-HU BACKDOOR!"
U Dirkey Dirkey.exe"Dirkey - small utility that allows you to bookmark up to 9 folders by using the Ctrl+Alt+1..9 shortcut keys in an Open/Save File dialog or in Windows Explorer. After this the Ctrl+1..9 shortcut keys can be used in the same or another window to go to any of the 9 bookmarked folders"
X DirLocker dirlock.exe"Added by the AUTORUN-AMS WORM!"
? Disable EHCI nousb20.exe"??"
X DisableKeybaord "Rundll32.exe KeyboardDisable"
X DisableMouse "Rundll32.exe MouseDisable"
N Disc Detector CtNotify.exe"For Creative sound cards. Detects when you insert a CD
? disc detector qnetquestnotifty.exe"??"
? discoveg discoveg.exe"??"
? DISCover DISCover.exe"Related to DISCover Drop from Digital Interactive Systems Corporation. What does it do and is it required?"
N DiscoverDeskshop Deskshop.exe"Discover Deskshop - single use ""virtual"" credit card"
U DiscUpdateManager DiscUpdMgr.exe"Disc Update Manager for Digital interactive's DISCover Console. Provider of on-demand video games"
N DiscUpdateManager DiscUpdateMgr.exe"DISCover from Digital Interactive Systems Corporation Inc. ""The company's patented Drop 'n' Play technology provides a simple
U DiscWizardMonitor.exe DiscWizardMonitor.exe"Seagate DiscWizard - hard disk utility for Seagate's SATA and PATA (IDE) drives"
X Disk Check chkdsk32.exe"Added by the IM TROJAN!"
U Disk Cleaner DiskCleaner.Exe"Hard disk management part of TuneUp Utilities from TuneUp Distribution GmbH"
X Disk Defragmentation Loader pmsvcr.exe"Added by a variant of the IRCBOT TROJAN!"
X Disk Essensial Tools detsvc.exe"Added by a variant of the IRCBOT TROJAN!"
X Disk Keeper [path to trojan]"Added by the SMALL-VE TROJAN!"
X Disk Keeper SECURITY.EXE"Daosearch adware"
X Disk Manager diskver.exe"Added by the RBOT.AQT WORM!"
X Disk Master [trojan name]"Added by the DISTER TROJAN! - a spam relayer"
X Disk Panel Configuration dpcsvc.exe"Added by the IRCBOT.BSQ BACKDOOR!"
X Disk Panel Setup npcsvc.exe"Added by a variant of the IRCBOT TROJAN!"
X DiskCheck msdarkend.exeAdded by an unidentified WORM or TROJAN!
N DiskeeperSystray DkIcon.exe"DisKeeper defragmentation software - can be started manually"
X diskinf diskinf.exe"Added by the CRYPTER.A TROJAN!"
? DISKMON.EXE DISKMON.EXE"??"
N Disknag disknag.exeDell program that reminds you to make your backup diskettes
X DiskRetter SysRep.exe"DiskRetter
X Diskstart Code.exeAdult content dialler
X Diskstart cat.exeMS-Connect dialler
X Diskstart hit.exeAdult content dialler
X Diskstart Snt.exeAdult content dialler
U DiskSuite aDSProcMngr.exe"Part of PC Tools Disk Suite from PC Tools - which ""is an all-in-one hard-disk management utility that integrates disk optimization
U Disk_Monitor Disk_Monitor.exe"Multi-media
X disnisa disnisa.exe"Added by the DORF-AE WORM!"
X Dispatcher dispatcher.exe"Added by the DLOADR-AS TROJAN!"
X dispenter dispenter.exe"Added by the AGENT-MKK TROJAN!"
U display The_Eye.exe"ComSpySysSvr surveillance software. Uninstall this software unless you put it there yourself"
X Display backup.exe"Added by the BRONTOK-CR WORM!"
X Display Drivers cssrs.exe"Added by the AGOBOT.FX WORM!"
N Display Settings hptasks.exe"Allows for the adjustment of the display for LCD screen
U DisplayFusion DisplayFusion.exe"DisplayFusion from Binary Fortress Software - ""is a fantastic application that can make your dual monitor (or triple monitor or more) life much
N DisplayTrayIcon TrayIcon.exe"System Tray access to display properties for ABIT graphics cards. Unless you change your desktop resolution
U Disspy disspy.exe"Disspy spyware detection and removal software"
X Dist-FBGeneve GDC.exe"NettoyeurDePC French rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
N Distiller Assistant 3.01 DISTASST.EXEFrom Adobe. Creates PDF universal files for Acrobat Reader. Available via Start -> Programs
X Distributed File System Dfsvc.exe"Added by the MYFIP.A or MYFIP.K WORMS!"
X Distributed File System kernel32dll.exe"Added by the MYFIP-C or MYFIP.K WORMS!"
X Distributed File System blade.exe"Added by the MYFIP.AC WORM!"
X Distributed File System win.exe"Added by the MYFIP.AB WORM!"
X Distributed Link Tracking ascvt.exe"Added by the AGOBOT-GH BACKDOOR!"
U distributed.net client DNETC.EXE"Dsitributed computing projects client from Distributed.net where numerous computers are used to share a projects workload - similar to SETI@Home and Folding@Home. Also prone to being distributed by viruses"
Y Dit dit.exe""Drive Icon and Label Utility" - assigns drive icons and names to flash memory cards. Required
X Dit dit.exe"Added by the LAZAR-A TROJAN! Note - this is located in %System%"
N DiTask.exe DiTask.exe"Associated with an Eicon Networks ISDN or ADSL modem. System Tray icon which shows you the status of your lines (free
? Divamon.exe Divamon.exe"Associated with an Eicon Networks Diva ISDN or ADSL modem - what does it do and is it required?"
X divx divxenc.exe"Added by the SPBOT.B TROJAN!"
X Divx codll.exe"Added by the GRAVEBOT-A TROJAN!"
X DivX MediaPlayer 7.0 Dr.DivX.exe"Added by the ALADINZ.G TROJAN!"
X DivX Player DivXPlayer.exe"Added by a variant of the RBOT WORM!"
X DivX Updater DivX.Exe"Added by the NALDEM TROJAN or MASTAK VIRUS!"
X DIVX Video Player DIVXPloyer.exeAdded by an unidentified WORM or TROJAN!
X Divx4 codec devldr32.exe"Added by an unidentfied VIRUS! Note - this is not the legitimate Creative Labs devldr32.exe file"
X DivXCodec NEWMAIL.exe"Added by the DELF-RQ BACKDOOR!"
? Dixons Insert Detect InsDetect.exe"Part of Dixons Picture Suite. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
X djdsdvqwa vjdhdg.exe"Added by the SDBOT-EF BACKDOOR!"
N DJRegFix regedit /s c:hpdjregfix.reg"DJRegFix showed up first in WinME as a ""clever"" way to ensure that all Hewlett-Packard DeskJet printers actually worked with WinME - since most were having major problems. This ""utility"" adds the functionality and compatibility HP forgot to add in its WinME drivers"
? DJSNetCN DJSNetCN.exe"""Symantec Licensing Detect Internet Connection""
X djtopr1150.exe djtopr1150.exe"WebRebates adware"
X dKernel dKernel.exe"Added by the DECOY-A WORM!"
Y DkService DkService.exe"From Executive Software's Diskeeper defragmenting utility - a replacement for Windows Disk Defragmenter. It's recommended to leave this enabled
X DKTime dktime.exe"Added by the LUNII TROJAN!"
X Dkware lptt01 dkware.exe"RapidBlaster variant (in a ""DonkeySoft"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X Dkware ml097e dkware.exe"RapidBlaster variant (in a ""DonkeySoft"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
? dkzzixm dkzzixm.exe"??"
Y dla tfswctrl.exe"Drive letter access to a UDF packet writer for CD-RW - from HP
Y DLA DLACTRLW.EXE"Drive letter access to a UDF packet writer for CD-RW - from HP
Y DLACTRLW DLACTRLW.EXE"Drive letter access to a UDF packet writer for CD-RW - from HP
Y DLACTRLW.EXE DLACTRLW.EXE"Drive letter access to a UDF packet writer for CD-RW - from HP
N DlaTray Dlatray.exe"System Tray access to DLA - Drive letter access to HP's and Veritas' version of DirectCD. Does the same thing as DirectCD. From HP - ""This is a needed file as it controles the readability of the Combo drives. Without this file loading the end user will be able to burn CD's but wont be able to read them. The drive itself will be able to read store bought master Cd's without the file but not burnt ones"""
N dlbcserv dlbcserv.exeRelated to Dell Photo Printers and provides additional configuration options for these devices
Y DLBTCATS "rundll32 [path] DLBTtime.dll _RunDLLEntry@16"
Y DLBUCATS "rundll32 [path] DLBUtime.dll _RunDLLEntry@16"
Y DLBXCATS "rundll32 [path] DLBXtime.dll _RunDLLEntry@16"
Y DLCCCATS "rundll32 [path] DLCCtime.dll_RunDLLEntry@16"
U dlccmon.exe dlccmon.exeDell Photo AIO Printer 924 device monitor
Y DLCDCATS "rundll32 [path] DLCDtime.dll _RunDLLEntry@16"
U dlcdmon.exe dlcdmon.exeDell Photo AIO Printer 944 device monitor
Y DLCFCATS "rundll32 [path] DLCFtime.dll _RunDLLEntry@16"
Y DLCGCATS "rundll32 [path] DLCGtime.dll _RunDLLEntry@16"
U dlcgmon.exe dlcgmon.exeDell Photo AIO Printer 810 device monitor
Y DLCICATS "rundll32 [path] DLCItime.dll _RunDLLEntry@16"
X dlcipscl dcpavss.exe"Added by the MAILBOT-CB TROJAN!"
Y DLCJCATS "rundll32 [path] DLCJtime.dll _RunDLLEntry@16"
U dlcjmon.exe dlcjmon.exeDell Photo AIO Printer 964 device monitor
Y DLCQCATS "rundll32 [path] DLCQtime.dll _RunDLLEntry@16"
U dlcqmon.exe dlcqmon.exeDell Photo AIO Printer 966 device monitor
Y DLCXCATS "rundll32 [path] DLCXtime.dll _RunDLLEntry@16"
U dlcxmon.exe dlcxmon.exeDell Photo AIO Printer 926 device monitor
X dlder dlder.exe"Dlder spyware. Also creates a fake ""explorer.exe"" file and can be installed via versions of Grokster
X DlDir1 caKe"Added by the CAKE WORM!"
U dldtamon dldtamon.exeDell AIO Printer V305 device monitor
U dldtmon dldtmon.exeDell AIO Printer V305 device monitor
U dldtmon.exe dldtmon.exeDell AIO Printer V305 device monitor
? DLForcerExe DLForcerEXE.exe"??"
N DLF_00000B00 Vcdlf.exe"Known to cause problems with "Out of memory" errors (see here). Otherwise
N DLG DLGCHBW.exeBackweb part of Data LifeGuard - diagnostic tools for Western Digital's series of hard drives. Automatically detects an internet connection and downloads any available updates
N DLHelperEXE WATCH.exeDownload helper distributed with some software that allows the software installation to redirect download locations. Not required once the installation is finished
X DLHelperEXE.exe N/ADownloader for Microgaming/Casino software - stealth installed
X dlhost dlhost.exe"Added by the EXPHOOK-A TROJAN!"
X DLINK dfe drivers for Windows NT windfe.exe"Added by the RANDEX.AK WORM!"
U DLink System Tray dlnetst.exe"Related to D-Link DGE-530T PCI card for servers and workstations"
X Dlite dllmanager.exe"Added by the WOOTBOT.DN WORM!"
X Dll Boot Loader on Startup (do not remove this) [various filenames]Added by an unidentified TROJAN!
X Dll Link svchoist.exe"Added by the AUTOSKY WORM!"
X Dll Link svchost.exe"Added by the AUTOSKY WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Favourites folder"
X DLL Manager dllmngr32.exe"Added by a variant of the RBOT WORM!"
X DLL Service Manager [path to worm]"Added by the RPCBOT.F TROJAN!"
X dll services [random filename].exe"Added by a variant of the SDBOT WORM!"
X DLL32 dllmem32.exe"Added by the KWBOT.E WORM!"
X DLL32 dllhost.dll"Added by the SUCLOVE.A WORM!"
X dllcache.exe dllcache.exe"Added by the VISPAT.A WORM!"
X DllCacherv2 dllcachev2.exe"Added by the LATEDA TROJAN!"
X dllcvss [random filename]"Added by a variant of the SLAPER TROJAN!"
X dlldmt dlldmt.exe"Added by a variant of the CRYPTER.C TROJAN!"
X DllExecutable [path to file]"Added by the VB-SP WORM!"
X dllhelp dllhelp.exe"Added by the STARTPAGE.DQ hijacker"
X dllhelp dllhlp.exe"Added by the Downloader-HI TROJAN!"
X DLLHost dllhst.exe"Added by the DELBOT-AC WORM!"
X DllHost dllhost.exe"Added by the PROSTI.AA BACKDOOR! Note - this is not the legitimate dllhost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Inf"
X dllhostxp.exe dllhostxp.exeBrowser hijacker and adware downloader
X DllLoader lssas.exe"Added by the BDOOR-JE BACKDOOR!"
X Dlload killer.exe"Added by the KILLAV-FK TROJAN!"
X dllreg dllreg.exe"Added by the CRYPTER.A TROJAN!"
X DLLService32 dllsvc32.exe"Added by the AGOBOT.VX WORM!"
X DLLUPDATE32 dllupdate32.exe"Added by the AGOBOT.IA WORM!"
N DLM.exe DLM.exe"IGN Download Manager has become a requirement for downloading files through FilePlanet.com. It is based on Internet Explorer and it installs through an ActiveX-plugin
N dlmMgr AdobeDownloadManager.exe"Adobe Download Manager - ""can prevent you from having to start from the beginning should your download process be interrupted
Y DLO Agent DLOClientu.exe"Part of the backup suites from VERITAS - Backup Exec and NetBackup. Both have now been replaced by their Symantec equivalents since they acquired VERITAS in 2005"
U DLPSP DLPSP.EXEDell laser printer status monitor
X dlsp2mx dlsp2mx.exe"Added by the MPB-B DIALER! An uninstall option can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as ""dlsp2mx"""
? DLT dlt.exe"??"
X dluca dluca.exe"Added by the DLUCA.C TROJAN!"
X dluxde dluxde.exeAll-In-One-Telcom (adult content dialler) variant
X Dluxjp Dluxjp.exe"Added by the DLUCA.D TROJAN!"
X Dm Hr lpns.exe"Added by the IRCBOT.WORM.61673 WORM!"
X DM mgr dm_mgr.exe"Added by the JITTAR TROJAN!"
X dm***.exe [* = random char] dm***.exe [* = random char]"Wareout - malware masquerading as a spyware and dialer remover"
N DMAScheduler DMAScheduler.exe"Related to DigitalMedia Plus Archiver. This program is non-essential process to the running of the program
X DMC dmc.exeAdded by Trojan-Downloader.Win32.Dluca.bv TROJAN!
U DMHotKey DMLoader.exeHotKey access to the Samsung Display Manager on laptops and ultra-mobiles that support it - such as the M55 and Q1
N DMILDR dmildr.exe"Part of Dell OpenManage Client Instrumentation - software that allows remote management application programs to access information about
X dmime dmime.exe"Malware installed by different rogue security software including SpyKillerPro"
N DMISL DMISL.EXE"DMI (Desktop Management Interface) Service Layer for Intel TokenExpress network card software. DMI support for the Intel network card managed through the Desktop Management Interface. See here for more information"
N DMISLAPP DMISLAPP.exe"DMI (Desktop Management Interface) Service Layer for Intel TokenExpress network card software. DMI support for the Intel network card managed through the Desktop Management Interface. See here for more information"
? dmjay dmjay.exe"??"
X dmloader dmloader.exe"Added by a variant of the RBOT WORM!"
X Dmsvc32 Dmsvc32.exe"Added by the AGOBOT.ABU WORM!"
X dmtdll dmtdll.exe"Added by a variant of the CRYPTER.C TROJAN!"
U DmwClient dmwclient.exe"DMW ""anti-cheating"" software for online gaming"
U DMXLauncher DMXLauncher.exe"Part of Dell's Media Experience
X dm[3 random letters].exe dm[3 random letters].exe"Added by the RUINDEM TROJAN!"
X DM_server dmserver.exe"Comet Cursor adware"
X dm_service [path to file]"Added by the MITGLIEDER.P TROJAN!"
N DNA btdna.exe"""BitTorrent DNA is a FREE content delivery service based on the BitTorrent protocol which brings the power of user-contributed bandwidth to traditional content publishers while leaving publishers in full control of their files"". Now a stand-alone product where the user creates the download
X dnam d140113.a.Stub.EXE"Added by the STUB_A TROJAN!"
N Dnar Dnar.exe"Installed on some Dell workstations and DMI related. Tries to access the internet and is known to not be required - but what does it do?"
Y DNE Binding Watchdog "rundll dnes.dll DnDneCheckBindings"
Y DNE DUN Watchdog "rundll dnes.dll DnDneCheckDUN13"
X DNHelper32 DNHlp32.exeAdded by an unidentified WORM or TROJAN!
X DNS mc-58-12-0000080.exe"Shorty adware - also detected as the AGENT.FD TROJAN!"
X DNS mc-58-12-0000093.exe"Shorty adware - also detected as the AGENT.FD TROJAN!"
X DNS mc-110-12-0000079.exe"Shorty adware - also detected as the AGENT.FD TROJAN!"
X DNS mc-58-12-0000120.exe"Shorty adware - also detected as the AGENT.FD TROJAN!"
X DNS mc-58-12-0000140.exe"Shorty adware - also detected as the AGENT.FD TROJAN!"
X DNS [worm filename]"Added by the BCKDR-CQG BACKDOOR!"
X DNS Config service win32.exe"Added by the RBOT-TL WORM!"
X Dns Resolver dnsrslve.exe"Added by the RBOT-WS WORM!"
X DNS Service dnsresolver.exe"Added by the RBOT-PQ WORM!"
X DNS Service dnssvc.exe"Added by the DELBOT-Z WORM!"
? DNS2GoClient dns2goclient.exe"DNS2Go is a Domain Name System that will make your computer accessible anytime
N DNS7reminder Ereg.exe Ereg.ini"Registration reminder for versions of Nuance (ScanSoft) Dragon NaturallySpeaking"
X DnsCache Wscript.exe dns_cache.vbs"Added by the AUTORUN-AWI WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""dns_cache.vbs"" file is located in %System%"
X DNSCacheBoost dnsping.exe"Added by the DNSBUST-A TROJAN!"
X dnscleaner dnscleaner.exe"CoolWebSearch parasite variant"
X DNSE DNSE.exe"Part of rogue security tools
? DNXVC dnxvc.exe"??"
X doc doc.exe"Added by the AGOBOT-BJ WORM!"
X DocTor Doctor.exe"Added by the DOTOR.A WORM!"
X Doctor Antivirus 2008 antvr.exe"Doctor Antivirus 2008 rogue security software - not recommended
N DocuMagix Init PWATCH.EXE"PaperMaster is an application for the PC designed to automate the process of organizing
U Document Manager docmgr.exe"Wave Systems Corp. Document Manager - ""provides secure storage and management capabilities for file and folder level encryption"""
X Doggy Style MsPMSPSd.exe"Added by the SDBOT-AAP WORM!"
X DOGStart GSDOGST.EXE"Added by an unidentified VIRUS
? Doing doing.exe"??"
X doit.exe doit.exe"Added by the FORBOT-EK WORM!"
X DokterFix SysRep.exe"DokterFix

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list