HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
N	Microsoft Office Fast Cache	Fastboot.exe	"Part of MS Office 95 (v7.0). According to this it improves the performance. Most likely a predecessor of MS Find Fast and can be disabled"
U	Microsoft Office Groove	GROOVE.EXE	"System Tray access to and alerts for MS Office Groove - a stand-alone product or included with the Enterprise/Ultimate versions of MS Office 2007. ""A collaboration software program that helps teams work together dynamically and effectively
X	Microsoft Office Monitor	alg2k.exe	"Added by the SDBOT-CZO WORM!"
X	Microsoft Office Monitor	aql32.exe	"Added by the RBOT-GCY TROJAN!"
N	Microsoft Office OneNote	ONENOTEM.EXE	"System Tray access to MS Office OneNote 2003 & 2007 - an electronic notebook that allows you to create free-form notes
N	Microsoft Office OneNote 2003 Quick Launch	ONENOTEM.EXE	"System Tray access to MS Office OneNote 2003 - an electronic notebook that allows you to create free-form notes
X	Microsoft Office quick launch	OSA.exe	"Added by the VBOT.A BACKDOOR! Note that OSA.exe was used in older versions of Office to launch common components to help speed up the launch but it is no longer normally used - see here. This file is located in a valid MS Office 2003 (aka Office 11) directory - %Program Files%\Microsoft Office\OFFICE11 - and may overwrite a valid file"
X	Microsoft Office Quick Launcher	iau1.exe	"Added by the DLOADR-AWD TROJAN!"
N	Microsoft Office Shortcut Bar	Msoffice.exe	Feature included with older versions of MS Office giving you access to common Office functions and optional shortcuts to Office (and other) programs. Some people prefer it but a better way is to create desktop shortcuts if you want access these features and programs quickly. Also available via Start → All Programs
X	Microsoft Office Start	winupdates.exe	"Added by the GAOBOT.BC WORM!"
N	Microsoft Office Startup	osa.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
N	Microsoft Office Startup	Osa9.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
X	Microsoft Office Studio	scvhvst.exe	"Added by the RANDEX.CST WORM!"
X	Microsoft OfficeXP	officeXP.exe	"Added by the KILLAV.MA WORM!"
X	Microsoft Oftice	msmsgs.exe	"Added by the IRCBOT.ALT WORM! Note - this particular msmsgs.exe file is located in %System% and should not be mistaken for the MSN Messenger file of the same name which is located in %Program Files%\Messenger"
X	MicroSoft OneCare	FreeS3x.exe	"Added by the SDBOT-DJT WORM!"
X	Microsoft Opeions	IEXwe.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Outlook Express Protocol	svchst.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Patch Update	bootini.exe	"Added by the RBOT-FMN WORM!"
X	Microsoft PC Health Remote Assistance File Open & Save controls	sfrcdlg32.exe	"Added by the RBOT-AVY WORM!"
X	Microsoft PCHealth32	[path to file]	"Added by the NICE-A TROJAN!"
X	Microsoft PCHealth32	NDDENB.exe	"Added by the PWSYAHOO-A TROJAN!"
X	Microsoft PCI Manager	mspci.exe	"Added by the RBOT.BBG WORM!"
N	Microsoft People Near Me	p2phost.exe	"Signs a user into the People Near Me feature at login in Windows 7 and Vista. People Near Me enables you to use certain peer-to-peer (P2P) programs on a network - that ""identifies people nearby who are using computers and allows those people to send you invitations for programs such as Windows Meeting Space. They can only invite you to participate in programs that are installed on your computer."" Available via Start → Control Panel"
X	Microsoft Personal Firewalls	bakw.exe	"Added by the RBOT-KS WORM!"
X	Microsoft Problem Doctor	windr128.exe	"Added by the SMALLTRO.EF TROJAN!"
X	Microsoft Problem Doctor	windr32.exe	"Added by a variant of the SMALLTRO.EF TROJAN!"
X	Microsoft Problem Doctor	windr64.exe	"Added by a variant of the SMALLTRO.EF TROJAN!"
X	Microsoft Proc Driver32	msprc.exe	"Added by a variant of the WOOTBOT WORM!"
X	Microsoft Procedure Call	MSPCALL.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Process Manager	process32.exe	"Added by the CHECKOUT WORM!"
X	Microsoft Profile Manager	profile.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft PSTCP32 Data	pstcp32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft QMGR	msnqmgr.exe	"Added by the IRCBOT-S TROJAN!"
X	Microsoft quick launch	OSA.exe	"Added by a variant of the VBOT.A BACKDOOR! Note that OSA.exe was used in older versions of Office to launch common components to help speed up the launch but it is no longer normally used - see here. This file is located in a valid MS Office 2003 (aka Office 11) directory - %Program Files%\Microsoft Office\OFFICE11 - and may overwrite a valid file"
X	Microsoft RDLL	sysconf32.exe	"Added by a variant of the SDBOT TROJAN!"
X	Microsoft Redirect	[path to file]	"Added by the BANKER-FW TROJAN!"
X	Microsoft Redirect	systen.exe	"Added by the BANCOS-FO TROJAN!"
X	Microsoft Regestry Edit Manager	regedit.exe	"Added by the SHEUR.HC TROJAN! Note - this is not the valid Windows registry editor which resides in %Windir% and will not normally figure in Msconfig/Startup! This version resides in %System%"
X	Microsoft Regestry Manager	regedit32.exe	"Added by a variant of the IRCBOT.ARD WORM!"
X	Microsoft Regestry Manager	registry32.exe	"Added by the IRCBOT.ARD WORM!"
X	Microsoft Registro	svchostt.exe	"Added by the BANCOS-DH TROJAN!"
X	Microsoft Registry	csrse.exe	"Added by the RBOT-PC WORM!"
X	MicroSoft Remote Secure Service	MSRSS.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Restore	scrgrd.exe	"Added by the SPYBOT.BR WORM!"
X	Microsoft Router Manager	linksys.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Router Manager	router.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Rundll	windos.exe	"Added by the SDBOT-WF WORM!"
X	Microsoft Runtime	CfgDll32.exe	"Added by the RANDEX.BD WORM!"
X	Microsoft Safe Mode Manager	safemode.exe	"Added by the IRCBOT.HM BACKDOOR!"
X	Microsoft Scanreg	microsoftscanreg.exe	"Added by the FRANRIV.A WORM!"
X	Microsoft SCVHOST32 Protocol	scvhost32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft sddcE Contol	taskmnegr.exe	"Added by the RBOT-AUM WORM!"
X	Microsoft sddcE Contol	taskmn.exe	"Added by the RBOT-BJZ WORM!"
X	Microsoft sdk temp	sdktemp.exe	"Added by the RBOT-ANP WORM!"
X	Microsoft SDKP3	mswinsdq.exe	"Added by the RBOT-ARY WORM!"
X	Microsoft Secure	Messenger.NET Service	"Added by the FORBOT-AM WORM!"
X	Microsoft Secure Messenger.NET Service	securitychk.exe	"Added by the SDBOT.VT WORM!"
X	Microsoft Security	winService.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft security adviser	mssadv.exe	"Microsoft Security Adviser rogue security software - not recommended"
X	Microsoft Security Center	savservices.exe	"Added by the RBOT-ANU WORM!"
X	Microsoft Security Center	wcsntfy.exe	"Added by the SDBOT.BYD WORM!"
X	Microsoft Security Controlers	fxsecues.exe	"Added by a variant of the SDBOT WORM!"
Y	Microsoft Security Essentials	msseces.exe	"System Tray access to a notifications from Microsoft Security Essentials which ""provides real-time protection for your home PC that guards against viruses
X	Microsoft Security GManagers	[random filename]	"Added by a variant of the SDBOT WORM!"
X	Microsoft Security Hot Fix Update	mshotfix.exe	"Affilred adware"
X	Microsoft Security Management	winnt.exe	"Added by the RBOT-MQ WORM!"
X	Microsoft Security Management	winserv.exe	"Added by the RBOT-MJ WORM!"
X	Microsoft Security Management	winamp.exe	"Added by a variant of the RBOT WORM! Note - this is NOT the popular Winamp media player which resides in a ""Winamp"" subdirectory of the Program Files directory"
X	Microsoft Security Management	wuauct1.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Security Management	bling.exe	"Added by the RBOT.XL WORM!"
X	Microsoft Security Management	sp2fix.exe	"Added by the RBOT.UB WORM!"
X	Microsoft Security Manager	winamp.exe	"Added by the RBOT.TU WORM! Note - this is NOT the popular Winamp media player which is located in %ProgramFiles%\Winamp. This one is located in %System%"
X	Microsoft Security Monitor Process	mssmp.exe	"Added by the RBOT-FUB WORM!"
X	Microsoft Security Monitor Process	mnsmp.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Security Monitor Process	msmp.exe	"Added by the RBOT.GKQ WORM!"
X	Microsoft Security Monitor Process	mssm32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Security Monitor Process	lsas.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Security Monitor Process	msword.exe	"Added by the VIRUT.P VIRUS!"
X	Microsoft Security Monitor Process	service.exe	"Added by the DELF.BERW BACKDOOR!"
X	Microsoft Security Monitor Process	svcchost.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Security Monitor Process	windowsupdate.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Security Monitor Process	[random filename]	"Added by variants of the RBOT WORM! See here"
X	Microsoft Security Monitor Process	com.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Security Monitor Process	exel.exe	"Added by the SDBOT.AFX BACKDOOR!"
X	Microsoft Security Monitor Process	firewall.exe	"Added by a variant of the IRCBOT BACKDOOR! Located in %System%"
X	Microsoft Security Monitor Process	flash.exe	"Added by the EGGDROP.EE BACKDOOR!"
X	Microsoft Security Monitor Process	hel.exe	"Added by the EGGDROP.V BACKDOOR!"
X	Microsoft Security Monitor Process	HelpMe.exe	"Added by the VB.BJO TROJAN!"
X	Microsoft Security Monitor Process	kar.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Security Monitor Process	lindicracker.exe	"Added by the BIFROSE.GR BACKDOOR!"
X	Microsoft Security Monitor Process	mail.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Security Monitor Process	mmp.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Security Monitor Process	mssm32.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Security Monitor Process	mssmpi32.exe	"Added by a variant of the RBOT WORM! See here"
X	Microsoft Security Monitor Process	nitty.exe	"Added by the RBOT.AEU BACKDOOR!"
X	Microsoft Security Monitor Process	ofice.exe	"Added by the VIRUT.N VIRUS!"
X	Microsoft Security Monitor Process	point.exe	"Added by the IRCBOT.AVP BACKDOOR!"
X	Microsoft Security Monitor Process	princ.exe	"Added by the HUPIGON.WTL TROJAN!"
X	Microsoft Security Monitor Process	web.exe	"Added by the EGGDROP.V BACKDOOR!"
X	Microsoft Security Monitor Process	winsys32.exe	"Added by the VIRUT.N VIRUS!"
X	Microsoft Security Monitor Process	winsyss32.exe	"Added by the RBOT.AEU BACKDOOR!"
X	Microsoft Security Monitor Process	word.exe	"Added by the EGGDROP.DC BACKDOOR!"
X	Microsoft Security Panager	[filename]	"Added by the RBOT-ANL WORM!"
X	Microsoft Security Panagers	[random filename]	"Added by the RBOT-AIG WORM!"
X	Microsoft Security Panagers	zzoboony.exe	"Added by the RBOT-AOI WORM!"
X	Microsoft Security Pansasagers	dgkztsqgn.exe	"Added by the RBOT-BBJ WORM!"
X	Microsoft Security Process	wininit.exe	"Added by the RBOT-FKM WORM!"
X	Microsoft Security System	mssecsys.exe	"Added by the IRCBOT-WJ TROJAN!"
X	Microsoft Security Update	security32.exe	"Added by the DELF-JJ TROJAN!"
X	Microsoft Server	rserv.exe	"Added by the AGOBOT.AVS WORM!"
X	Microsoft Server Applacations	msnmsg.exe	"Added by the AGOBOT.BBM WORM!"
X	Microsoft Server Applacations	wuauct1.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Server Applacations	lsasss.exe	"Added by the RBOT-AQQ WORM!"
X	Microsoft Server Applacations	Q8See.exe	"Added by the SPYBOT.GEN3 TROJAN!"
X	Microsoft Server Applacations	cli.exe	"Added by the RBOT-GAQ WORM!"
X	Microsoft Server Application	Sound.exe	"Added by the RBOT-NE WORM!"
X	microsoft server base	lass.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Server Process	svhst32.exe	"Added by the BCKDR-QHR BACKDOOR!"
X	Microsoft Service	microhost.exe	"Added by the RBOT-LC WORM!"
X	Microsoft Service	winsvc.exe	"Added by the SPYBOT-DB WORM!"
X	Microsoft Service	rundll.exe	"Added by the POPO-A WORM! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	Microsoft Service	service.exe	"Added by the IRCBOT-XX BACKDOOR!"
X	Microsoft Service	winspl.exe	"Spyman spyware"
X	Microsoft service	cssrs.exe	"Added by the STARTP-DC TROJAN!"
X	Microsoft Service 32	mssvc32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Service 32	sysddm32.exe	"Added by the SDBOT.AKC WORM!"
X	Microsoft Service Access Manager	Access.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Service Boot	sboot.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Service Controller	services.exe	"Added by the KALEL-D WORM! Note - this is not the legitimate services.exe process
X	Microsoft Service Disk Cycle	disksave.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Service Drivers	System.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Service Drivers	VSADNIM.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Service Execution Manager	execute.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Microsoft Service firewall Manager	firewall.exe	"Added by a variant of the SDBOT BACKDOOR! Located in %System%"
X	Microsoft Service Host Manager	32svchost.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Service Host Process	svchost.exe	"Added by the KRYNOS.B WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Help"
X	Microsoft Service Information	msnservices.exe	"Added by the RBOT.ID WORM!"
X	Microsoft Service Login Manager	winlogin.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Service Manager	service32.exe	"Added by the IRCBOT.WDW BACKDOOR!"
X	Microsoft Service Manager	winsvc.exe	"Added by a variant of the RBOT WORM! See here"
X	Microsoft Service Pack	WindowsSP.exe	"Added by the RBOT-RF WORM!"
X	Microsoft Service Pack2.1	svchost2.exe	"Added by the RBOT.ASN BACKDOOR!"
X	Microsoft Service Tools	MStools1.exe	"Added by the RBOT-BHT WORM!"
X	Microsoft Services	lsserv.exe	"Added by an unidentified VIRUS
X	Microsoft Services	lssrv.exe	"Added by the RBOT.CW WORM!"
X	Microsoft Services	services.exe	"Added by the ALETS TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Services	lsrv.exe	"Added by the RBOT-BK WORM!"
X	Microsoft Services	svshost.exe	"Added by the ALETS.B TROJAN!"
X	Microsoft Services	bsc32.exe	"Added by the BDOOR-AW BACKDOOR!"
X	Microsoft Services	Smss32.exe	"Added by the RBOT-AD WORM!"
X	Microsoft Services	svssshost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Services	module.exe	"Added by the LAVITS WORM!"
X	Microsoft Services	msmpserv.exe	"Added by the IRCBOT.BKA BACKDOOR!"
X	Microsoft Services Unitd	MSU32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Servicez Manager	servicemgrz.exe	"Added by the RBOT-ASN WORM!"
X	Microsoft Session Manager Subsystem	smss.exe	"Added by the KALEL-D WORM! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup!"
X	Microsoft Setup Initializazion	localhost.exe	"Added by a variant of the IRCBOT TROJAN!"
N	Microsoft Sidewinder Game Controller Software	SWTRAY.EXE	MS SideWinder game controller system tray icon. Available via Start -> Programs
X	Microsoft Sinsup	odjiwjf.exe	"Added by the RBOT-DN WORM!"
X	Microsoft Software	sysinfo33.exe	"Added by the RBOT.LS WORM!"
X	microsoft software	****.exe [* = random char]	Added by an unidentified WORM or TROJAN!
X	Microsoft software	cdaccess.exe	"Added by the RBOT.ABK WORM!"
X	Microsoft Software Update	nmon.exe	"Added by the RBOT.HZ WORM!"
X	Microsoft Sound Driver	sound32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Sound Technology	winsound.exe	"Added by the RBOT-AGG WORM!"
N	Microsoft Sound Volume Tool	mssvol.exe	This is a Blue version of the yellow speaker icon on the system tray and is used to edit advanced Sound Features that the MS DSS80 Speakers add. Should be accessible via Start -> Settings -> Control Panel
X	Microsoft Sounds	soundman.exe	"Added by the RBOT-GCI WORM!"
X	Microsoft SpA Service	msapps.exe	"Added by the RBOT-VI WORM!"
X	Microsoft SpA Service	win32.exe	"Added by the RBOT.ATS WORM!"
X	Microsoft SpA Service	Winupd32.exe	"Added by the RBOT.LT WORM!"
X	Microsoft SpAr Service	winsbsd32.exe	"Added by the RBOT-RN WORM!"
X	Microsoft Special offer	infoebay.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Spool ** Service	spool**.exe	"Added by a variant of the IRCBOT TROJAN - where ** represents a 2 digit number"
X	Microsoft Spool Server for Win32	spoolsrv.exe	"Added by the RANDEX.H WORM!"
X	Microsoft Spool Svc	spoolsvc32.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Spooler Services	Spoolsv.exe	"Added by a variant of the SPYBOT WORM! See here"
X	MicroSoft ssadsadas3s1	eXtream.exe	"Added by the SPYBOT.ZK TROJAN!"
X	MicroSoft ssadssjdhasjadas3s1	kdjfsdklfjsl.exe	"Added by the SDBOT.AEX WORM!"
X	MicroSoft ssas3s1	SADASDA.exe	"Added by the RBOT.URF WORM!"
X	Microsoft SSISVRI32 Protocol	ssisvri.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Standard Executions Library	win32lib.exe	"Added by the RBOT-AUK WORM!"
X	Microsoft standard protector	winsocks5.exe	Added by the SMALL.CF TROJAN!
X	Microsoft standard protector	[path to trojan]	"Added by the STOX-C TROJAN!"
X	Microsoft startup	wmpIayer.exe	Added by the IRCBOT.ACI TROJAN!
X	Microsoft Startup Manager	sysservice.exe	"Added by the AVALANEC TROJAN!"
N	Microsoft Sticky Notes	stikynot.exe	"Microsoft Sticky Notes - virtual sticky notes tool from Windows Vista. This implementation of the popular yellow ""Post-It"" tool is part of the Tablet PC features and allows you to enter either handwriting (via a pen or mouse) or record a voice note. AVailable via Start → All Programs"
X	Microsoft Stuff you know	winslogin.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Sum32	sum32.exe	"Added by the RBOT-YW WORM!"
X	Microsoft Support	sys32ms.exe	"Added by the RBOT-AHI WORM!"
X	microsoft support	svchostt.exe	"Added by the AGOBOT.AWN WORM!"
X	Microsoft SVC	mssvc.exe	"Added by the BIFROSE-UQ TROJAN!"
X	Microsoft Svchost local services	winoem.exe	"Added by the RBOT-FPE WORM!"
X	Microsoft Svchost local services	nzm23.exe	"Added by the RBOT-GMC WORM!"
X	Microsoft Svchost local services	msnserver.exe	"Added by the RBOT-GPM WORM!"
X	Microsoft Syn Manager	Manager.exe	"Added by the SDBOT.BEF WORM!"
X	Microsoft Synchronization Manager	asgard.exe	"Added by the SDBOT-AEA WORM!"
X	Microsoft Synchronization Manager	bot.exe	"Added by the SDBOT.IH WORM!"
X	Microsoft Synchronization Manager	netscape.exe	"Added by the RANDEX.AE WORM!"
X	Microsoft Synchronization Manager	slhost.exe	"Added by the SDBOT.YH WORM!"
X	Microsoft Synchronization Manager	svhost.exe	"Added by the SDBOT-PY WORM!"
X	Microsoft Synchronization Manager	WinLoginnn.exe	"Added by the SPYBOT.FO WORM!"
X	Microsoft Synchronization Manager	winupdate.exe	"Added by the SDBOT.ER WORM!"
X	Microsoft Synchronization Manager	xXx.exe	"Added by the SDBOT-KZ WORM!"
X	Microsoft Synchronization Manager	___synmgr.exe	"Added by the MASLAN.A or MASLAN.C WORMS!"
X	Microsoft Synchronization Manager	al.exe	"Added by the OPTXPRO.132 TROJAN!"
X	Microsoft Synchronization Manager	win.exe	"Added by the SDBOT.AK WORM!"
X	Microsoft Synchronization Manager	java.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Synchronization Manager	svchosts.exe	"Added by the SDBOT-LM WORM!"
X	Microsoft Synchronization Manager	winlogon32.exe	"Added by the SDBOT.AEU WORM!"
X	Microsoft Synchronization Manager	svxhost.exe	"Added by the SDBOT-ZU WORM!"
X	Microsoft Synchronization Manager	wincfg32.exe	"Added by the SDBOT.DO WORM!"
X	Microsoft Synchronization Manager	screen.exe	"Added by the SDBOT-ACO WORM!"
X	Microsoft Synchronization Manager	devldr32.exe	"Added by a variant of the RBOT WORM! Note - do not confuse with the legitimate Creative Labs devldr32.exe file"
X	Microsoft Synchronization Manager	explorer.exe	"Added by the SDBOT-AEA WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft Synchronization Manager	firewire.exe	"Added by the SDBOT-AFC WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list