HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
X	Microsoft Synchronization Manager	wmedia.exe	"Added by the SDBOT.BFC WORM!"
X	Microsoft Synchronization Manager	win932.exe	"Added by the SDBOT.AH WORM!"
X	Microsoft Synchronization Manager	mircup.exe	"Added by the SDBOT.BQD WORM!"
U	Microsoft Synchronization Manager	mobsync.exe	"Microsoft Synchronization Manager for 2K/XP - used to update network copies of materials that were edited offline
X	Microsoft Synchronization Manager	alien.exe	"Added by the SDBOT-MV BACKDOOR!"
X	Microsoft Synchronization Manager	microsoft.exe	"Added by the SDBOT-OM WORM!"
X	Microsoft Synchronization Manager 2	svhostc.exe	"Added by the SLINBOT.ST WORM!"
X	MicroSoft sys32	sysmsgr32.exe	"Added by a variant of the SPYBOT WORM! See here"
X	MicroSoft sys3s1	h4ckn3t.exe	"Added by the RBOT.QTY WORM!"
X	Microsoft System	msupdtm.exe	"Added by the SPYBOT.PKC WORM!"
X	Microsoft System	mssys32.exe	"Added by the PETTICK.A WORM!"
X	Microsoft System	sys.exe	"Added by the RBOT.AKI WORM!"
X	Microsoft System	winamp1.exe	"Added by the SDBOT-UF WORM!"
X	Microsoft System Administration	system.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft System Backup	[random filename]	"Added by the RBOT-AGM WORM!"
X	Microsoft System Checkup	Cool.exe	"Added by the DONK.B WORM!"
X	Microsoft System Checkup	Wnetlib.exe	"Added by the DONK.C WORM!"
X	Microsoft System Checkup	dbnetlib.exe	"Added by the DONK.L WORM!"
X	Microsoft System Checkup	Keymgr.exe	"Added by the DONK.M WORM!"
X	Microsoft System Checkup	inetman.exe	"Added by the DONK.O WORM!"
X	Microsoft System Checkup	ntsysmgr.exe	"Added by the DONK.S WORM!"
X	Microsoft System Checkup	ntsysman.exe	"Added by the SDBOT-QW WORM!"
X	Microsoft System Checkup	libsysmgr.exe	"Added by the SDBOT-CAF WORM!"
X	Microsoft System Checkup	sysmgr.exe	"Added by the SDBOT-OO TROJAN!"
X	Microsoft System Checkup	netapi32.exe	"Added by the DONK-E WORM!"
X	Microsoft System Checkup	wnetmgr.exe	"Added by the DONK.Q WORM!"
X	Microsoft System Checkup	libsys32.exe	"Added by the SDBOT-ACK WORM!"
X	Microsoft System Checkup	netlogin32.exe	"Added by the SDBOT-GN BACKDOOR!"
N	Microsoft System Configuration Utility	msconfig.exe	Entry that appears when you uncheck an item in the MSConfig Startup group and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode. Located in %System% (98/Me/Vista) or %Windir%\PCHealth\HelpCtr\Binaries (XP)
X	Microsoft System Debug	services32.exe	"Added by the RBOT.AKH WORM!"
X	Microsoft System DLL Services Configuration	windir32.exe	"Added by the SDBOT-ACY TROJAN!"
X	Microsoft System File	svchots.exe	"Added by the RBOT.BYU WORM!"
X	Microsoft System Firewall 2006.2	msmsgr.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft System Firewall 2006.2	msnmsgr.exe	"Added by a variant of the SDBOT WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Microsoft System Firewall 2006.2	reg32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft System Init	mtmnr0.exe	"Added by the SDBOT.BR TROJAN!"
X	Microsoft System Monitor	monsys.exe	"Added by the IRCBOT-YV TROJAN!"
X	Microsoft System Monitor	system.exe	"Added by the IRCBOT.AUT BACKDOOR!"
X	Microsoft System NT	svhost.exe	"Added by the SDBOT.COU WORM!"
X	Microsoft System Restore Configuration	CBRSS.EXE	"Added by a variant of the SPYBOT WORM!"
X	Microsoft System Saver	[path to worm]	"Added by the RBOT.BSK WORM!"
X	Microsoft System Security Agent	MSTSA.EXE	"Added by the RBOT.CCM WORM!"
X	Microsoft System Service	dnservice.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft System Service	taskmgr1.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft System Service	winIogon2.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft System Service Device	mssdh.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft System Services	msnmgsr.exe	"Added by the KELVIR.K WORM!"
X	Microsoft System Services	msmsgr.exe	"Added by the RBOT-ZH WORM!"
X	Microsoft System Update	sysupdate.exe	"Added by the SDBOT.DG WORM!"
X	Microsoft system Value	sys57.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft System32 Update	cmsrg.exe	"Added by the RBOT-GN WORM!"
X	Microsoft Task Manager Daemon	spoolsrv.exe	"Added by the SDBOT.FLL WORM!"
X	Microsoft Task Messenger Config	taskmgsr.exe	"Added by the SDBOT-JK WORM!"
X	Microsoft task tray monitor	ctray.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Task32 Protocol	taskmgr32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Taskmanager Updater	keyboard.exe	"Added by the RBOT-ALU WORM!"
X	Microsoft TCP Protocol	wintcp32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft TCP Service	scvhost.exe	"Added by the AGOBOT-L WORM!"
X	Microsoft TCP/IP Connection Monitor	svchost32.exe	"Added by the RBOT.KS WORM!"
X	Microsoft Telecom Center	tellecom.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Telecoma Center	tellcoma.exe	"Added by the RBOT-AWX WORM!"
X	Microsoft Telecoms Center	telcoms.exe	"Added by the IRCBOT.GEN WORM!"
X	Microsoft Telecoms Center	xpfilesys.exe	Added by the RBOT.BCJ TROJAN!
X	Microsoft Telecoms Center	winupn.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Telecoms Center	svcchost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Time Manager	dveldr.exe	"Added by the RBOT-HQ WORM!"
X	MicroSoft Toolbar	key.exe	"Added by the RBOT-AEW WORM!"
X	Microsoft Transfer File Server	mtfs.exe	"Added by the RBOT.AFE WORM!"
X	Microsoft Tray	[random filename]	"Added by the DELF.BZ TROJAN!"
X	Microsoft TTL Verifier	msttl.exe	"Added by the RBOT-GAP WORM!"
X	Microsoft U	wuamkopxp.exe	"Added by the RBOT-AHC WORM!"
X	Microsoft UMA Update	MSuma32.exe	"Added by the RBOT.FS WORM!"
X	MICROSOFT UNPACCKER SYSTEM	unpak32.exe	"Added by a variant of the RBOT WORM!"
X	MICROSOFT UNPACK SYSTEM	winrarx.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updat3	mswkst32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	Microsoft.exe	"Added by the GAOBOT.AFJ WORM!"
X	Microsoft Update	mssmgrd.exe	"Added by the SDBOT.JT WORM!"
X	Microsoft Update	mvsc.exe	"Added by the SPYBOT.DAZ WORM!"
X	Microsoft Update	ascdl.exe	"Added by the GAOBOT.SY WORM!"
X	Microsoft Update	Isac.exe	"Added by the RBOT-AU WORM!"
X	Microsoft Update	automgr32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	mediap.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	Microsoftx.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	msconfg.exe	"Added by the RBOT.H WORM!"
X	Microsoft Update	Mslti32.exe	"Added by the RBOT-LX WORM!"
X	Microsoft Update	muamgrd.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update	navmgrd.exe	"Added by the SDBOT.DP TROJAN!"
X	Microsoft Update	Smss32.exe	"Added by the RBOT-CB WORM!"
X	Microsoft Update	sys32cfg.exe	"Added by the RBOT.DR WORM!"
X	Microsoft Update	VPC32.EXE	"Added by the AGOBOT.XM WORM!"
X	Microsoft Update	winsys32.exe	"Added by the RBOT.BD WORM!"
X	Microsoft Update	wuamgrd.exe	"Added by the RBOT-LK WORM!"
X	Microsoft Update	wuammgr32.exe	"Added by the RBOT-AW WORM!"
X	Microsoft Update	wudmate.exe	"Added by the RBOT.AP WORM!"
X	Microsoft Update	msawindows.exe	"Added by the GAOBOT.AFJ WORM!"
X	Microsoft Update	msiwin84.exe	"Added by the GAOBOT.AFJ WORM!"
X	Microsoft Update	wuamgrd32.exe	"Added by the RBOT.ZB WORM!"
X	Microsoft Update	NAV.exe	"Added by the RBOT-IV WORM!"
X	Microsoft Update	systemi32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update	xpupdate.exe	"Added by the RBOT-QE WORM!"
X	Microsoft Update	webm.exe	"Added by the SDBOT.WK WORM!"
X	Microsoft Update	wuagrd.exe	"Added by the RBOT-FK WORM!"
X	Microsoft Update	aaupdt.exe	"Added by the RBOT-RQ WORM!"
X	Microsoft Update	lsac.exe	"Added by the GAOBOT.XW WORM!"
X	Microsoft Update	Mupdate.exe	"Added by the RBOT-AG WORM!"
X	Microsoft Update	prowind32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update	snlogsvc.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	svhost.exe	"Added by the RBOT-PI WORM!"
X	Microsoft Update	wauguard.exe	"Added by the RBOT.AEE WORM!"
X	Microsoft Update	winscv.exe	"Added by the RBOT-BH WORM!"
X	Microsoft Update	winsys.exe	"Added by the RBOT-GV WORM!"
X	Microsoft Update	wserv32.exe	"Added by the RBOT.AF WORM!"
X	Microsoft Update	wtm32.exe	"Added by the RBOT-AQ WORM!"
X	Microsoft Update	wumgrd.exe	"Added by the SDBOT-KY WORM!"
X	Microsoft Update	wuampd.exe	"Added by the RBOT-UT WORM!"
X	Microsoft Update	msupdate32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update	Botnet.exe	"Added by the RBOT.AFL WORM!"
X	Microsoft Update	sghost.exe	"Added by the SDBOT.AKV WORM!"
X	Microsoft Update	update_w.exe	"Added by the RBOT-EW WORM!"
X	Microsoft Update	windows24.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	wingrd32.exe	"Added by the RBOT-DW WORM!"
X	Microsoft Update	wssvr.exe	"Added by the RBOT-OD WORM!"
X	Microsoft Update	wuamagr32.exe	"Added by the SPYBOT.CG WORM!"
X	Microsoft Update	WinUpdate32.exe	"Added by the RBOT-TI WORM!"
X	Microsoft Update	wkfix.exe	"Added by the RBOT-ABZ WORM!"
X	Microsoft Update	Kkk.exe	"Added by the RBOT-AHL WORM!"
X	Microsoft Update	mcupdate.exe	"Added by the RBOT.XT WORM! Note - this file is located in %System% and should not be confused with the McAfee antivirus executable as described here"
X	Microsoft Update	Micr0s0ft.exe	"Added by the AGOBOT.AAR WORM!"
X	Microsoft Update	Msnmsngr.exe	"Added by the RBOT.BQS WORM!"
X	Microsoft Update	msupdate32.exe	"Added by the SPYBOT.LZ WORM!"
X	Microsoft Update	scvhost.exe	"Added by the RBOT-AEM WORM!"
X	Microsoft Update	svghost.exe	"Added by the RBOT.BUJ WORM!"
X	Microsoft Update	sys.exe	"Added by the RBOT-AJ WORM!"
X	Microsoft Update	up2dat5.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	winamp.exe	"Added by a variant of the RBOT WORM! Note - this is NOT the popular Winamp media player"
X	Microsoft Update	win-mang.exe	"Added by the RBOT-AFK WORM!"
X	Microsoft Update	winupdater.exe	"Added by the RBOT.BIN WORM!"
X	Microsoft Update	wuamk0032.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	wuamk032.exe	"Added by the RBOT-AHD WORM!"
X	Microsoft Update	wuamk0p32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	wuamkop.exe	"Added by the RBOT-AFI WORM!"
X	Microsoft Update	wuamkop32.exe	"Added by the RBOT.BGU WORM!"
X	Microsoft Update	wuampkd.exe	"Added by the SDBOT.BBX WORM!"
X	Microsoft Update	svzhost.exe	"Added by the RBOT.OX WORM!"
X	Microsoft Update	win32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	wininit.exe	"Added by the RBOT-AKR WORM!"
X	Microsoft Update	wuamgrd3.exe	"Added by the RBOT-AMC WORM!"
X	Microsoft Update	Wudates.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	ms.exe	"Added by the SDBOT.CC WORM!"
X	Microsoft Update	wuagmsd.exe	"Added by the RBOT-AX WORM!"
X	Microsoft Update	cmss.exe	"Added by the RBOT-ATQ WORM!"
X	Microsoft Update	wuamgrb.exe	"Added by the RBOT-AZE WORM!"
X	Microsoft Update	WINDOC.EXE	"Added by the SDBOT.PF WORM!"
X	Microsoft Update	phqghumea.exe	"Added by the SDBOT.AFO WORM!"
X	Microsoft Update	system32.exe	"Added by the RBOT.IS WORM!"
X	Microsoft Update	bling.exe	"Added by the RBOT-AVK WORM!"
X	Microsoft Update	Sygate.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	update.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	WinDrv32.exe	"Added by the RBOT.EGW WORM!"
X	Microsoft Update	devmks32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft update	winupdate.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	msupdate.exe	"Added by the BOROBOT-I TROJAN!"
X	Microsoft Update	mixer.exe	"Added by the RBOT-AIR WORM!"
X	Microsoft Update	taskmgr32.exe	"Added by the RBOT-CV WORM!"
X	Microsoft Update	drive.exe	"Added by the BIFROSE-PN WORM!"
X	Microsoft Update	wangard.exe	"Added by the RBOT-LH WORM!"
X	MICROSOFT UPDATE	WUAGTRD.EXE	"Added by the RBOT-CJ WORM!"
X	Microsoft Update	spool.exe	"Added by the AGENT-GJC TROJAN!"
X	Microsoft Update	bnmveqfts.exe	"Added by the BANLOAD.KWQ TROJAN!"
X	Microsoft Update	dqbxhupdt	"Added by a variant of the SDBOT WORM! See here"
X	Microsoft Update	enule.exe	"Added by the IRCBOT.DU BACKDOOR!"
X	Microsoft Update	explorer.exe	"Added by the RBOT.AEU BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft Update	imchemaoa.exe	"Added by the BANLOAD.KWQ TROJAN!"
X	Microsoft Update	livemessenger.com	"Added by the ADLOAD-LN TROJAN!"
X	Microsoft Update	msnmsgl.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Update	nnwyaupdt	"Added by the RBOT.RHK BACKDOOR!"
X	Microsoft Update	ntservice.exe	"Added by the AGENT-DIS TROJAN!"
X	Microsoft Update	rundll32.dll	"Added by the CIADOOR.GN BACKDOOR!"
X	Microsoft Update	wuamgrdx.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Update	wutr.exe	"Added by the SPYBOT.AAR WORM!"
X	Microsoft Update	SetPoints.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Update	system.exe	"Added by a variant of the RBOT WORM! See here"
X	Microsoft Update	service.exe	"Added by a variant of the RBOT WORM! See here"
X	Microsoft Update	msgn.exe	"Added by the RBOT.RQ BACKDOOR!"
X	Microsoft Update	wuamgrd16.exe	"Added by the RBOT-BQ WORM!"
X	Microsoft Update	windows32.exe	"Added by the RBOT-BHQ WORM!"
X	Microsoft Update	winsyst.exe	"Added by the RBOT-DL WORM!"
X	Microsoft Update 23	NtKernelSystem.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 23	spoolvs.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	explore32.exe	"Added by the SPYBOT.CYM WORM!"
X	Microsoft Update 32	MSupdate32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update 32	wininit.exe	"Added by the RBOT-ANY WORM!"
X	Microsoft Update 32	wininit32.exe	"Added by the RBOT-AKJ WORM!"
X	Microsoft Update 32	[path to file]	"Added by the RBOT-AJJ WORM!"
X	Microsoft Update 32	mscnfg.exe	"Added by the RBOT-ALM WORM!"
X	Microsoft Update 32	servic.exe	"Added by the RBOT-AXN WORM!"
X	Microsoft Update 32	winitXP32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	mssetup32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	wiit.exe	"Added by the RBOT-AMS WORM!"
X	Microsoft Update 32	explorer.exe	"Added by the RBOT-ARF WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft Update 32	network.exe	"Added by the RBOT-ARZ WORM!"
X	Microsoft Update 32	om4r.exe	"Added by the RBOT-AQP WORM!"
X	Microsoft Update 32	winin.exe	"Added by the RBOT-ARR WORM!"
X	Microsoft Update 32	wuinit.exe	"Added by the AGOBOT-UE WORM!"
X	Microsoft Update 32	neta.exe	"Added by the RBOT-AMI WORM!"
X	Microsoft Update 32	spoolvs.exe	"Added by the RBOT-BBQ WORM!"
X	Microsoft Update 32	rundll32.exe	"Added by the RBOT.AIE BACKDOOR! Note that this BACKDOOR modifies the file rundll32.exe
X	Microsoft Update 32	taskMangr.exe	"Added by the RBOT.AIE BACKDOOR!"
X	Microsoft Update 32	winssx.exe	"Added by the RBOT-ARW WORM!"
X	Microsoft Update 33	init.exe	"Added by the RBOT-ATT WORM!"
X	Microsoft Update 64 BIT	wininit32.exe	"Added by the RBOT-AHE WORM!"
X	Microsoft Update 64 BIT	winman32.exe	"Added by the RBOT-AKI WORM!"
X	Microsoft Update 64 BIT	schvost.exe	"Added by the RBOT.CAU WORM!"
X	Microsoft Update 64 BIT	winl32xe.exe	"Added by the RBOT-AQO WORM!"
X	Microsoft Update Clinic	svsipconfig.exe	"Added by the RBOT.BR WORM!"
X	MICROSOFT UPDATE CONFIGURATION	WIN32SNC.EXE	"Added by the RBOT-AI WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list