Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown
Startup Name Process Name Details
X mosearch mosearch.exe"Fast Search in Office XP - similar to the new revision of the Find Fast feature in Office 2000. Fast Search uses the Indexing Services in Office XP to create a catalog of Office files on your computer's hard disk. As with Find Fast - a waste of resources. If it can't be disabled via MSCONFIG try here"
X Motherboard Config Ati2xxx.exe"Added by the RBOT-AIK WORM!"
X MotherBoard Sounds Sounds.exe"Added by the RBOT-AAP WORM!"
N Motive SmartBridge mpbtn.exe"System tray icon for the Virtual Assistant from AT&T Broadband
N Motive SmartBridge MotiveSB.exe"System tray icon for the Virtual Assistant from AT&T Broadband
N Motive SmartBridge BTHelpNotifier.exe"System tray icon for help from BT Broadband
U MotiveMonitor motmon.exeFound on HP/Dell and Compaq systems (and maybe others). MotiveMonitor is used by the suppliers on-line support and allows the agent at the far end to do harddrive/ram/video/etc tests on the computer. Can cause some users problems with IE and Netscape by disabling this - in this case leave it to run. You may also wish to leave it alone if the PC is still within the support period from the manufacturer. For most users it's not required
N MotiveSB MotiveSB.exe"System tray icon for the Virtual Assistant from AT&T Broadband
U MotMon motmon.exeFound on HP/Dell and Compaq systems (and maybe others). MotiveMonitor is used by the suppliers on-line support and allows the agent at the far end to do harddrive/ram/video/etc tests on the computer. Can cause some users problems with IE and Netscape by disabling this - in this case leave it to run. You may also wish to leave it alone if the PC is still within the support period from the manufacturer. For most users it's not required
X motoin mm15201518.Stub.exe"Delfin Promulgate adware variant"
U Motorola Desktop Suite DesktopSuite.exe"Related to Motorola Desktop Suite - PC software managing Motorola mobiles such as the A1000"
U Motorola Desktop Suite mRouter Config mRouterConfig.exe"Configuration for Motorola's version of Intuwave's m-Router - ""that enables easy connectivity between mobile devices and PCs across Bluetooth
U Motor_Tracking_Tool MTTool.exe"Sweex Motion Tracking Webcam utility. ""The motion tracking function ensures that the camera can follow all your movements. So you can move and chat
U Mount Safe & Sound Fbmount.exeFrom McAfee VirusScan version 5.x. Creates back-up sets of critical files in a separate area of a hard drive. If you make regular back-ups it's not needed and can be painful during system start
U mount.exe mount.exe"Part of ""GiPo@FileUtilities - GiPo@Mount ""Provides advanced substitutional and mounting services. It allows to attach a local drive to an empty folder on an NTFS volume (only for Windows 2000/XP) and to substitute a local folder for a drive letter"""
X mouse mouse.exe"Added by the RBOT-AHJ WORM!"
U Mouse 32A Mouse32A.exeMouse utility. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
N Mouse Suite 98 Daemon pelmiced.exeMouse driver. Appears to cause a behaviour where the desktop suddenly flips back up when playing DirectX associated games
U Mouse Suite 98 Daemon ICO.EXE"Found on some Sony Vaio
X mousebut mousebut.exe"Added by the CRYPTER.A TROJAN!"
X Mousecntl mousecntl.exe"Added by a variant of the CRYPTER.C TROJAN!"
N MouseCount MC.exe"MouseCount by Kittyfeet Software. "Utility for counting how many times us computer junkies click our mouse in a given session/day/week/month/year." Not required"
X mousedrive.exe instantmsgrs.exe"Added by the FORBOT-ER WORM!"
X MouseDrv [path to worm]"Added by the ZOLOAD-B WORM!"
X MouseDrv update.exe"Added by the ZOTOB.N WORM!"
U mouseElf MC.exe"Genius NetScroll mouse driver - required if you use non-standard Windows driver features"
U mouseElf mouseElf.exeSystem Tray access to the mouse control panel for Genius Netscroll mice. Required if you use non-standard Windows driver features
U MouseImp MImpHost.exe"MouseImp Pro - "A reliable assistant that turns your mouse into a simple
X mousepad mousepad.exe"Added by the CLICKER TROJAN!"
U MouseWare Logi_MwX.exe"Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as ""SmartMove"". If you disable it and find you don't need it leave it disabled"
U Mousinfo mousinfo.exeMS mouse information tool - for troubleshooting mouse problems
X MoussaEvil [path to file]"Added by the MUSANUB-A WORM!"
X MoveSearch Search.exe"PigSearch adware"
X MoveSearch zsearch.exe"PigSearch adware"
N Movielink Manager Uninstall msvcmm32.exe"Auto-update for Movielink - internet movie rental System Tray access"
X MovieM lmovie.exe"Added by the BEAGLE.DS WORM!"
X moviemk moviemk.exe"Added by the DWNLDR-GTB TROJAN!"
X MovieNetworks MovieNetworks.exeMovieNetworks will connect you by a domestic premium rate telephone number 900-xxx-xxxx - so you get xxx rated pictures and junk and high internet costs. Remove the %ProgramFiles%\MovieNetworks directory
X Movieplace Movieplace.exe"MoviePlace malware"
X Mozila mozila.exe"Added by the DELBOT-AJ WORM!"
X Mozila Firefox firebox.exe"Added by the RBOT-AIP WORM!"
X Mozilla Firebird v0.8 Internet Browser netstats.exe"Added by the IRCBOT.MC TROJAN!"
X Mozilla Firefox F1REF0X.EXE"Added by the SDBOT-UP BACKDOOR! Note that the filename has the numbers ""1"" and ""0"" in place of upper case ""i"" and ""o"" respectively"
X Mozilla Firefox firefox.exe"Added by the AUTOTUN.POM WORM! Note - this is not the popular FireFox web browser and is located in %System%"
N Mozilla Quick Launch Netscp6.exeNetscape 6 and Mozilla browsers
N Mozilla Quick Launch Mozilla.exeNetscape 6 and Mozilla browsers
X Mozillacorp system.exe"Added by the SILLYFDC WORM!"
N mozilla_cleanup xpicleanup.exe"Firefox Mozilla cleans up after installation. It is invoked on a restart after installation
U Mozy Status mozystat.exe"Mozy - free backup at a secure
X MP Services mpsvc.exe"Added by the WOOTBOT.EQ WORM!"
X MP Tcloakss mptclock.exe"Added by the NACKBOT-B WORM!"
X MP Tcloaxs mptcloaxs.exe"Added by the RANDEX.CT WORM!"
X MP Tclockvv mptclock.exe"Added by the NACKBOT-A WORM!"
X MP Tclockvv mptclock.exe"Added by the NACKBOT-A WORM!"
X MP Tclockvv mptclockvv.exe"Added by the RANDEX.CJ WORM!"
N MP3 CD Extractor CD-Extractor.exe"""MP3 CD Extractor is an audio CD to MP3 ripper which can extract Digital Audio tracks from Audio CDs into files on the hard disk"""
X Mp3 Loader Sysdata.EXE"Added by the AVETTE-A VIRUS!"
X MP3Collection "rundll32.exe MSA64CHK.dllDllMostrar"
X MP3download "rundll32.exe MSA64CHK.dllDllMostrar"
X MP3files "rundll32.exe MSA64CHK.dllDllMostrar"
X MP3freeDownload "rundll32.exe MSA64CHK.dllDllMostrar"
X MP3freeDownloads "rundll32.exe MSA64CHK.dllDllMostrar"
X MP3nice "rundll32.exe MSA64CHK.dllDllMostrar"
X MP3Themes "rundll32.exe MSA64CHK.dllDllMostrar"
X MP3ToTheMax "rundll32.exe MSA64CHK.dllDllMostrar"
X MP4 Player mp4Player.exe"MP4 Player allows you to view MP4 videos. Marked as undesirable due to the fact that it changes your homepage to a custom Google search engine
X MPatrolPRO MPatrolPRO.exe"MalwarePatrol Pro rogue security software - not recommended
U MPEO Csinsm32.exeAutomatic logging of installs from Norton CleanSweep - available via Start -> Programs
Y MPFExe mpf.exeMcAfee Personal Firewall
Y MPFExe MpfTray.exeMcAfee Personal Firewall
Y MPFTray MpfTray.exeMcAfee Personal Firewall
X MPL32 driver MPL32.exe"Added by the LOONY-M TROJAN!"
X MPlay64 mplay64.exe"Added by the MPLAY64 TROJAN!"
Y mpLockDrive LockDrive.exe"LockDrive from i8 Technologies makes selected folders and drives read only and can be used to prevent users downloading or copying data to portable drives and memory sticks - i.e.
U MplSetup MplSetup.exeUsed by Ricoh network printers to enable network printing from the client
X MPM Manager MPM.exe"Added by the DONBOMB.A TROJAN!"
X MPNet mpn.exe"Added by the DELBOT-W WORM!"
U MPower MPower.exe"MPower from MindBeat. ""Defragments and frees your RAM giving more stability to your system and avoiding needless use of swap file. Willl also benchmark (speed test) your hard disk drives and your CPU load"". MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
X mppdds mppdds.exe"Added by the PWS-AKZ TROJAN!"
X mppds mppds.exe"LEGMIR.AQZ spyware"
X MPR MSG mprmsg32.exe"Added by the MYTOB.CF WORM!"
X MPREXE MPREXE.EXE"Added by the OPASERV.T WORM! Note - this is not the legitimate Mprexe.exe system file"
Y MPREXE.exe mprexe.exe"WIN32 Network Service Interface Process. MPREXE.exe enables the computer to have multiple clients/protocols for networks. There are some problems with it sometimes though - see here. Note - why some people have it listed in start-up programs I don't know but I was asked to include it here. It automatically runs in the background. NOTE : sometimes it will appear in start-ups if you have a virus"
X MprHTML MprHTML.exe"Added by a variant of the VAGRNOCKER TROJAN!"
X mprocessor mprocessor.exeInstallDollars.com foistware
U MPSExe mscifapp.exeMcAfee.com Privacy Service - "combines personal identifiable information (PII) protection with online advertisement blocking and content filtering"
Y MpsOnn MpsOnn.exeCanon printer driver
? MPT MPT.exe"??"
X MPtask Services mptask.exe"Added by the LALA or AOT TROJANS!"
N MPTBox MPTBOX.EXECannon Multi-Pass toolbox - a button bar
X mptsgsvc.exe mptsgsvc.exe"Hacker Tool - detected by DiamondCS TDS-3 anti-trojan as ""HackTool.Win32.Hidd.j"""
N MPXTray mpxptray.exe"Windows Media Player PowerToy which is run from the taskbar. It can be used to hide Windows Media Player (when in use) and choose various standard buttons (play/pause
U MP_STATUS_MONITOR monitr32.exeCannon Multi-Pass status monitor - your choice
X mqadscp3 mqadscp3.exe"Added by the STRATION.CX WORM!"
X mqbkup mqbkup.exe"Added by the OPASERV.K WORM!"
X MQT Svc mqtsvc.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
U mRouterConfig mRouterConfig.exe"Configuration for Intuwave's m-Router - ""that enables easy connectivity between mobile devices and PCs across Bluetooth
X mrsvctr mrsvctr.exe"Added by a variant of the SDBOT WORM!"
Y MRT MRT.exe"Microsoft's Malicious Software Removal Tool"
N mrtMngr mrtMngr.exeMaintenance Release Task Manager for Intuit's QuickBooks or Quicken
U MRU-Blaster Scheduler scheduler.exe"Scheduler for MRU-Blaster - ""a program made to do one large task - detect and clean MRU (most recently used) lists on your computer"""
N MRU-Blaster Silent Clean mrublaster.exe"MRU-Blaster - performs silent cleaning of MRU lists at boot"
U MRUBlaster indexcleaner.exe"MRU-Blaster related - runs once in order to delete the index.dat file in the Temporary Internet Files and/or Cookies folder"
X Mr_CoolFace_Game Emma.exe"Added by the ROMARIO-A WORM!"
X ms svhost32.exe"Added by the LEGMIR-AQO TROJAN!"
X MS Agent Protection ag1.exe"Added by the IRCBOT.AZ BACKDOOR!"
X MS AntiSpyware 2009 msas2009.exe"MS AntiSpyware 2009 rogue spyware remover - not recommended
X MS Auto-IPSec Protection MSASP32.exe"Added by the RBOT-AER WORM!"
X MS Autoloader 32 MSAuto32.exe"Added by the SPYBOT.BD WORM!"
X Ms Builders Wupated.exe"Added by the AGOBOT-SS WORM!"
X MS Config msdconfig.exe"Added by the RBOT-CZH WORM!"
X MS Config Loader svchos1.exe"Added by the AGOBOT.R WORM!"
X MS Config Loader MSWin32bck.exe"Added by the GAOBOT.AA WORM!"
X MS Config Loader svcrhost.exe"Added by a variant of the RBOT WORM!"
X MS Config Service Msloader32.exe"Added by the RBOT-KJ WORM!"
X MS Config Stream msasm.exe"Added by the AGOBOT-BA WORM!"
X MS Config v12 mscfg12.exe"Added by the AGOBOT.YP WORM!"
X MS Config v13 lrbz32.exe"Added by the GAOBOT.AOL WORM!"
X MS Config v13 mscfg13.exe"Added by the AGOBOT.YQ WORM!"
X Ms configsu msconfigsu.exe"Added by a variant of the SDBOT WORM!"
X MS Configuration MSFramer.exe"Added by the RANDEX.OL WORM!"
X Ms Configuration microsoftsa32.exe"Added by the KELVIR.X WORM!"
X MS Configuration Utility msconfig32.exe"Added by the WOOTBOT.DY WORM!"
X MS DATABASE MSDATA32.EXE"Added by a variant of the SDBOT WORM!"
X MS Decryption Software active.exe"MediaTickets adware variant"
X MS DirectX Sound Drivers msdrvdx.exe"Added by the RBOT.BCX WORM!"
X MS DLL Library Manager dllsys64.exe"Added by the RANKY TROJAN!"
X MS Domain Name Server Deamon MSDNSD32.exe"Added by the RBOT-CMZ WORM!"
X MS Domain Name System MSWDNS32.exe"Added by the RBOT-GKY WORM!"
X MS DVD DirectX Dll Drivers mdxdl.exe"Added by the SDBOT-XI WORM!"
X MS DVD DirectX Sound Drivers msdrvdx.exe"Added by the SDBOT-XJ WORM!"
X MS Explorer mexplore.exe"Added by the YAHA.AE WORM!"
X MS FIREWALL msfrewall.exe"Added by the SDBOT-PU WORM!"
X MS FIREWALL msfirewall.exe"Added by the SDBOT-QH WORM!"
X MS Host msthost.exe"Added by the SLENFBOT.AH WORM!"
X MS Host Manager ivhost.exe"Added by the RBOT-BJN WORM!"
X MS Hosts msthosts.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X MS HTML msHtml.exe"Added by the PESTDOOR.31 TROJAN!"
X MS HTML mslat.exe"Added by the LATINUS.SVR TROJAN!"
X MS HTML Location Class MSHTML32.exe"Added by the RBOT-YD WORM!"
X MS Initial mstinitial.exe"Added by the IRCBOT.ASP BACKDOOR!"
X MS Internet Executor 32 MSIXEC32.exe"Added by the RBOT-AEQ WORM!"
X MS Internet Explore MSIEx.exe"Added by a variant of the RBOT WORM!"
X MS Java Applets for Windows NT & XP javaapplet.exe"Added by the RBOT.BHG WORM!"
X Ms Java for Windows NT MS32.exe"Added by the VANEBOT-H WORM!"
X Ms Java for Windows NT msi32java.exe"Added by the VANEBOT-I WORM!"
X Ms Java for Windows NT msjava.exe"Added by the VANEBOT-E WORM!"
X Ms Java for Windows NT msi32info.exe"Added by the RBOT.AFX WORM!"
X MS Java for Windows XP & NT javanet.exe"Added by the VANEBOT-A WORM!"
X MS Java Service Wrapper Windows NT & XP wrapper.exe"Added by the VANEBOT-D WORM!"
X Ms Java Update For Windows NT/XP msijavaupdt32.exe"Added by the RANDEX.AF WORM!"
X MS Java virtual machine javavm.exe"Added by the RBOT.ABG WORM!"
X MS LARISSA MS_LARISSA.exe"Added by the ASSIRAL.B WORM!"
X MS lsass Startup lsass135.exe"Added by the RBOT.WM WORM!"
? MS management console mms.exe"Suspicious as the legitimate ""Microsoft Management Console"" is ""mmc.exe"" and not ""mms.exe"" and doesn't normally run at startup"
X MS Microsoft Socket Deamon MSSCKD32.exe"Added by a variant of the RBOT WORM!"
X MS MSN Menssenger 7.0 MSMSN7.exe"Added by the RBOT-ACA WORM!"
X MS MSN Menssenger 7.0 MSEXPORT.exe"Added by a variant of the SDBOT WORM!"
X MS Network Control mswin.exe"Added by the DUMBA TROJAN!"
X MS Office Office10.exe"Added by the VB.DT TROJAN!"
X ms ownage winPE.exe"Added by the RBOT-AJL WORM!"
X MS Paint mspainter.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X MS PLUS INC wpad.exe"Added by the MYTOB-AN WORM!"
X Ms Processe Manager msproc.exe"Added by the RBOT.ATO WORM!"
X MS Real Player RealPlyr.exe"Added by the RBOT.MR WORM!"
X MS Registry Service MSRMS32.exe"Added by the RBOT-AKP WORM!"
X MS Remote Procedure Call msrpc32.exe"Added by the RBOT-QL WORM!"
X MS Screen Saver scrsave.scr"Added by the RBOT-AGT WORM!"
X MS Security systm.pif"Added by the RBOT-AQN WORM!"
X MS Security Authority Service lsass.exe"Added by the KALEL-B WORM! Note - this is not the legitimate lsass.exe process
X MS Security Hotfix service5.exe"Added by the GAOBOT.AG WORM!"
X MS Security Update 993 msident.exe"Added by a variant of the SDBOT WORM!"
X MS service msservice.exe"Added by the RBOT-ZG WORM!"
X MS Service Drivers winscv.exe"Added by the SDBOT-COG WORM!"
X Ms sock for Windows NT winser.exe"Added by a variant of the SDBOT WORM!"
X MS Sound Config 16bit sndcfg16.exe"Added by the SDBOT.MB TROJAN!"
X Ms Sound Drivers msdrv.exe"Added by the SDBOT-WR WORM!"
X ms spool service msspooler.exe"Added by a variant of the RBOT WORM!"
X Ms Spool32 MS SPOOL32.EXE"Added by the ASASSIN TROJAN!"
X MS SyS Restore sysrestore.exe"Added by the RBOT.XM WORM!"
X MS Sys Security mswin.pif"Added by the RBOT-APJ WORM!"
X MS System Call Function msscf32.exe"Added by the RBOT-GBZ WORM!"
X Ms System Config Mscfg.exe"Added by the SDBOT-CCR WORM!"
X Ms System Config pcedit.exe"Added by a variant of the SDBOT WORM!"
X MS System Security mswin32.pif"Added by the RBOT-AOX WORM!"
X Ms task manager tskmgr.exe"Added by the SDBOT.CCD WORM!"
X MS Task Manager 32 [trojan filename] .exe"Added by the RANKY.NF TROJAN!"
X MS taskbar crssr.exe"Added by the RBOT-AGO WORM!"
X MS taskbar nts.exe"Added by the RBOT-AGB WORM!"
X MS taskbar taskbars.exe"Added by the RBOT.BRW WORM!"
X MS Taskbars taskbars.exe"Added by the SDBOT-ACV WORM!"
X MS taskmanager tskmgr.exe"Added by the RBOT-AKA WORM!"
X MS Time timezone.exe"Added by the AGOBOT.ADY WORM!"
X MS UniX navupdate64.exe"Added by the RBOT.CRZ BACKDOOR!"
X MS Unix Binary win32ttb.exe"Added by the SPYBOT.OQ WORM!"
X MS Unix Binary msmq2inst.exe"Added by the RBOT-YF WORM!"
X MS Unix Binary msnupdate.exe"Added by the RBOT-AAM WORM!"
X MS Unix Binary outlookexpressupdate.exe"Added by the RBOT-YU WORM!"
X MS Unix Binary Win32Update.exe"Added by the RBOT-BAS WORM!"
X MS Unix Binary Norton2005Update.exe"Added by a variant of the RBOT WORM!"
X MS Unix Binary trmupdate.exe"Added by the RBOT-ACC WORM!"
X MS Unix Binary WinGuard.exe"Added by the RBOT-ACL WORM!"
X MS Unix Binary msnq3insller.exe"Added by the RBOT.GXH BACKDOOR!"
X MS Update syshost.exe"Added by the EVAMAN-F WORM!"
X Ms Update WinServices NT/XP winservnt32.exe"Added by the VANEBOT-G WORM!"
X MS UPDATER update.exe"Added by the RBOT-VC WORM!"
X MS Updates mscache.exeSpyware web downloader
X MS Updates syshosts.exe"Added by the MYDOOM.Y WORM!"
X MS Updates aupd.exeSpyware web downloader
X MS Updating Utility msupdater.exe"Added by the RBOT-XR WORM!"
X MS USB 2.0 Windows Support msusb32.exe"Added by a variant of the RBOT WORM!"
X Ms Valud Loader Svhots.exe"Added by the AGOBOT-SP WORM!"
X MS Win32 Network Services windriver.exe"Added by the AGOBOT.ADH WORM!"
X ms window update ******.exe [* = random character]"Added by a variant of the RBOT WORM!"
X MS Windows AOL Driver MSAOLdrv.exe"Added by the RBOT-ASP WORM!"
X MS windows Data list process MSDATLST.exeAdded by an unidentified WORM or TROJAN!

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list