Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown
Startup Name Process Name Details
X msmautoprotect msmssgs.exe"Added by the BIFROSE-AJ TROJAN!"
X msmc mscpbo.exe"ClientMan parasite variant"
X msmc msgdmf.exe"ClientMan parasite variant"
X msmc msongn.exe"ClientMan parasite variant"
X msmc msmc.exe"ClientMan parasite variant"
X msmc ms****.exe [* = random char]"ClientMan parasite variant"
X MSMcAfeee Avsynmgr32e.exe"Added by the FRAMAR TROJAN!"
X MSMcAfeeh Avsynmgr32h.exe"Added by the FRANGO TROJAN!"
X MSMcAfeeS Avsynmgr32S.exe"Added by the VOLAC or VOLAC.DR TROJANS!"
X MSMessnger msnupd.exe"Added by the RBOT-ADY WORM!"
? msmgr msmgr.exe"??"
X msMGR rtkmsg.exe"Added by the SDBOT-BPY WORM!"
X Msmgt msmgt.exe"Total Velocity adware/hijacker"
X msmmi msmmi.exe"Added by the AGENT.RFR TROJAN!"
X MSMNTGNT MSMNTGNT.EXE"Added by the BANKER-IE TROJAN!"
X MSMNTJBE MSMNTJBE.EXE"Added by the BANCOS-EF TROJAN!"
X MSMNTJNG MSMNTJNG.EXE"Added by the GRABER-G TROJAN!"
X MSMNTMTS MSMNTMTS.EXE"Added by the BANKER-GZ TROJAN!"
X msmon msmon.exe"Added by a variant of the GEMA.D TROJAN!"
X MsMon32 MsMon32b.exe"Added by the SDBOT.O BACKDOOR!"
X MsMovies MsMovies.exe"Added by the ALCRA-E WORM!"
? MsmqIntCert regsvr32 /s mqrt.dll"Microsoft Message Queue Server - Internal Certificate - see here for more info and here for a potential problem. Is it required?"
X MSMSGNER [4-8 random letters].exe"Added by the FOWLDO-GEN TROJAN!"
X MSMSGNER zzgf.exe"Added by the PWS-CCB TROJAN!"
X MSMSGNER fgozmox.exe"Added by the AGENT-EBJ BACKDOOR!"
X msmsgr msmsgss.exe"Detected by Kaspersky as the RBOT.AJJ WORM!"
N MSMSGS msmsgs.exe"Windows Messenger instant messenger utility included with Windows 2K/XP. Available via the Start menu. Go to Windows Messenger → Tools → Options → Preferences and uncheck ""Run this program when Windows starts"""
X Msmsgs Msmsgs.exe"Added by the SILLYFDC-AP WORM! Note - this particular msmsgs.exe file is located in %System% and should not be mistaken for the MSN Messenger file of the same name which is located in %Program Files%\Messenger"
X MSMsgs msmessgs.exe"Added by the SMALL-EW TROJAN!"
X msmsgs msmsgs.exe"Added by the SCLOG-AL TROJAN! Note - this particular msmsgs.exe file is located in %System% and should not be mistaken for the MSN Messenger file of the same name which is located in %Program Files%\Messenger"
X MSMSGS winlogon.exe"Added by the BRONTOK-BS WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X msmsgs.exe IEXPLORE.EXE"Added by the VB.FQX TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X MsMsgSrv msmsgsrv.exe"Added by the CQO TROJAN!"
X msmsgss [path to trojan]"Added by the RANKY.G BACKDOOR!"
X MSMsgSvc MSMSGSVC.exe"Browser hijacker
X msmsngr msmsngr.exe"Added by the DOPBOT-B WORM!"
X msn system32.exe"Added by the KITRO.A WORM!"
X msn msnmsg.exe"Added by the RBOT-GO WORM!"
X MSN msnmsgs.exe"Added by the RBOT-KL WORM! Note - not to be confused with msmsgs.exe
X MSN ctfmoons.exe"Added by the SPYBOT.HI WORM!"
X MSN msnmesengers.exe"Added by the RBOT-ME WORM!"
X MSN MSN.exe"Added by the MINIT WORM!"
X MSN msnmsgr.exe"Added by the MYTOB or MYTOB.B WORMS! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X msn msnsvc.exe"Added by a variant of the SDBOT WORM!"
X MSN msn16.exe"Added by the SDBOT-VN WORM!"
X MSN msnsgr.exeAdded by an unidentified WORM or TROJAN!
X MSN install.exe"Added by the AGENT-GDO TROJAN!"
X MSN netstats.exe"Added by the IRCBOT.UXP WORM!"
X MSN scvhost.exe"Added by the IRCBOT-ZW WORM!"
X MSN wdlrss.exe"Added by a variant of the SDBOT TROJAN!"
X MSN wkssvr.exe"Added by the PUSHBOT.S WORM!"
X MSN Fixdriver.exe"Added by the SILLYFDC.BBY WORM!"
X MSN iTuneshelp.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X MSN lsass32.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X MSN msscomd.exe"Added by a variant of the SPYBOT WORM! See here"
X MSN systems.exeIdentified as a variant of the Backdoor.PosionIvy keylogging malware
X MSN taskngr.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X MSN wkssvrs.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X MSN wksvr.exe"Added by the IRCBOT-XU WORM!"
X MSN wmev.exe"Added by a variant of the SPYBOT WORM! See here"
X MSN kys7r.exe"Added by the AUTORUN-AR WORM!"
X MSN services51651.exe"Added by the IRCBOT-AAL TROJAN!"
X Msn "rundll32.exe ilss32.dllnetwork"
X msn winlogon.exe"Added by the PROSTI.AA BACKDOOR! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Media"
X MSN msnmsgx.exe"Added by the RBOT-PZ WORM!"
X MSN msservice.exe"Added by the IRCBOT-ABZ TROJAN!"
X MSN smsss.exe"Added by the BUZUS-D WORM!"
X MSN svchost.exe"Added by the PUSHBOT.FA WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X Msn 8.0 Live msn.exe"Added by the BANKER.EIE TROJAN!"
X MSN 9.0 Plus [random letters].exe"Added by the RBOT-ALY WORM!"
X MSN Administration For Windows msnadp32.exe"Added by the BROPIA.W WORM!"
X MSN ang cssrss.exe"Added by the FORBOT-CE WORM!"
X MSN Auto-Updater msnaupdater.exe"Added by a variant of the IRCBOT BACKDOOR!"
X MSN Auto-Updater msnupdates.exe"Added by the AUTORUN.WORM.GEN WORM!"
X MSN BETA service.exe"Added by the RBOT.AUU WORM!"
X MSN Booster msnbooster.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X Msn Boot msnbootcfg.exe"Added by the IRCBOT.BFU BACKDOOR!"
X MSN Checker msnchecker.exe"Added by the SDBOT-AGB WORM!"
X MSN Client Manager msnclimgr.exe"Added by the AUTORUN-FV WORM!"
X MSN CNF Manager msncnfmgr.exe"Added by the VUNDO TROJAN!"
X MSN Communication Manager msncommgr.exe"Added by an unidentified WORM or TROJAN! See here"
X Msn Config msngf.exe"Added by the RBOT-QG WORM!"
X MSN Configuration msnconfig.exe"Added by a variant of the IRCBOT TROJAN!"
X Msn Configuration Loader msngms.exe"Added by the KELVIR.T WORM!"
X MSN Configuration Loader msmsncfg.exe"Added by the AGOBOT-KX BACKDOOR!"
X MSN CST Manager mancstmgr.exe"Added by an unidentified WORM or TROJAN! See here"
X MSN Database Client msndbcli.exe"Added by an unidentified WORM or TROJAN! See here"
X MSN Debug Mgr msndebugs.exe"Added by a variant of the IRCBOT TROJAN!"
X MSN Explorer msnexplorer.exe"Added by the AGENT-CAX TROJAN!"
X MSN Explorer explorer..exe"Dropper for the Ciadoor.cb TROJAN!"
X MSN File & Folder Sharing App msnfileshare.exe"Added by an unidentified WORM or TROJAN! See here"
X MSN File Configuration msnfilecfg.exe"Added by a variant of the IRCBOT BACKDOOR!"
X MSN File Sharing msnusr.exe"Added by the SLENFBOT.AM WORM!"
X MSN File Sharing Wizard msnsharewiz.exe"Added by a variant of the IRCBOT BACKDOOR!"
X MSN File Sharing! msnuser.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X MSN Funny Images imsngsr.exe"Added by the AGOBOT-TT WORM!"
X MSN Gaming Zone Twain.exe"Added by the AGENT.BEA TROJAN!"
X MSN Hostn msnhostn.exe"Added by a variant of the IRCBOT BACKDOOR!"
N MSN Internet Access trayclnt.exeQuick way to connect to MSN internet service - replaces "MSN Quick View" from V5.6 onwards
X MSN Live Client msnlvclient.exe"Added by the IRCBOT.AWF BACKDOOR!"
X MSN Live Messanger msnlivegs.exe"Added by the RBOT-FSG WORM!"
X MSN Manager cvss.exe"Added by a variant of the SPYBOT WORM!"
X MSN Manager mscmgr.exeUnidentified malware - causes multiple browser windows to open
X MSN Manager msnmgrsv.exe"Added by the IRCBOT.BAZ BACKDOOR!"
X MSN Manager usnmsn.exe"Added by a variant of the IRCBOT TROJAN!"
X Msn Message Acount Helper 7.7 msnmessage7.7.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X MSN Message Background loader [path to worm]"Added by the RBOT-AIE WORM!"
X MSN Message Service msnmsg.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X Msn Messager msnmsgr.exe"Added by the DOWNLOADER.19456.C TROJAN! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X MSN Messager msnmgr.exe"Added by the IRCBOT-ACD WORM!"
X MSN Messages msnmesg.exe"Added by the RBOT-ACN WORM!"
X MSN Messages msnmessgs.exe"Added by the SLENFBOT.UC WORM!"
X MSN Messanger msnmsng.exe"Added by the SDBOT.XN WORM!"
X MSN messanger msnmsgsm.exe"Added by the RBOT-FMP WORM!"
X MSN Messanger msnmsgsmn.exe"Added by the RBOT-FOQ WORM!"
X Msn Messanger crsss.exe"Added by a variant of the IRCBOT BACKDOOR!"
X Msn Messanger msnmsgem.exe"Added by the RBOT.BLL BACKDOOR!"
X MSN Messanger System.exe"Added by the IRCBOT-AFX TROJAN!"
X MSN Messanger Live winntmsn.exe"Added by the RBOT-FSO WORM!"
X Msn Messeng windns.exe"Added by a variant of the RBOT WORM!"
X Msn Messenge IExplorer.exe"Added by the DELF-LL TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X MSN messenger messenger.exeAdded by an unidentified TROJAN! Note - this is not the real MSN Messenger
X Msn Messenger msnmsgs.exe"Added by the LOONY-P TROJAN! Note - not to be confused with msmsgs.exe
X MSN Messenger Reosmsngr.exe"Added by a variant of the SPYBOT WORM!"
X MSN MESSENGER msmmsgr.exe"Added by the KELVIR.Q WORM!"
X MSN Messenger msnmsgr.exe"Added by the AGOBOT.AOQ WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X MSN Messenger msmsgs.exe"Added by the ZLOB TROJAN! Note - this particular msmsgs.exe file is located in %System% and should not be mistaken for the MSN Messenger file of the same name which is located in %Program Files%\Messenger"
X MSN Messenger msnmsngr.exe"Added by a variant of the RBOT WORM!"
X MSN Messenger IExplorer.exe"Added by the BANKER-EU TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X Msn Messenger msnmsnr.exe"Added by the BANKER-GG TROJAN!"
X MSN Messenger PIC1324.exe"Added by the CHOKE.C WORM!"
X MSN Messenger explorer..exe"Dropper for the Ciadoor.cb TROJAN!"
X Msn Messenger nkbf.exe"Added by the RBOT-GMQ WORM!"
X MSN Messenger live.messenger.com"Added by the DELF.AOI BACKDOOR!"
X Msn Messenger msnmgr.exe"Added by the AGOBOT.HA WORM!"
X MSN Messenger msnmsxp.exe"Added by the AGOBOT-O WORM!"
N MSN Messenger MsnMsgr.exe"MSN Messenger utility (now replaced by Windows Live Messenger) - available via the Start menu. Disable by clicking on Tools → Options → General → deselect ""Automatically run Messenger when I log on to Windows"""
X MSN Messenger 32 msniu.exe"Added by the RBOT-AWB WORM!"
X MSN Messenger 323 msniu3.exe"Added by the RBOT-AXB WORM!"
X MSN Messenger 6.2 tyd.exe"Added by a variant of the RBOT WORM!"
X MSN MESSENGER 9.0 messengerr.exe"Added by a variant of the RBOT WORM!"
X MSN Messenger BETA 7 bbsdf.exe"Added by the RANKY.AA TROJAN! Note - this is not a valid MSN Messenger variant"
X MSN Messenger Inbox Loader msninbox.exe"Added by the SLENFBOT.YG WORM!"
X MSN Messenger Live Login msnmessengerlive.exe"Added by an unidentified WORM or TROJAN! See here"
X MSN Messenger Live Windows messengerlive.exe"Added by an unidentified WORM or TROJAN! See here"
X MSN messenger service mssgs.exeAdded by an unidentified TROJAN!
X Msn Messenger Service msnmsg.exe"Added by the SDBOT.BMU WORM!"
X MSN Messenger Service Starter msnmgsr.exe"Added by the RBOT-AOS WORM!"
X MSN Messenger Service Startup msnservice.exe"Added by a variant of the RBOT WORM! See here"
X MSN Messenger Services msnmgr.exe"Added by the RBOT.ADF TROJAN!"
X MSN Messenger Services msnmgr.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X Msn Messenger Update msnupdate.exe"Added by a variant of the RBOT WORM!"
X Msn Messenger update msnservice.exe"Added by a variant of the IRCBOT BACKDOOR!"
X MSN Messenger User Controls msmsgr.exe"Added by the KELVIR.HI WORM!"
X Msn Messengers MSNMSGR.EXE"Added by the RBOT.KX WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X MSN Messengger MsRun32.exe"Added by the IMAUT.CO WORM!"
X Msn Messsenger regsvr.exe"Added by the AGENT-GXM TROJAN!"
X MSN MMISSENGER mssmmspgr.exe"Added by the KELVIR.AJ WORM!"
X MSN P2P Manager msnp2pmgr.exe"Added by the SLENFBOT.YH WORM!"
X Msn Patch msndp.exe"Added by the RBOT.AAI WORM!"
X Msn Patches msndr.exe"Added by a variant of the SDBOT WORM!"
X Msn Plus Updater msnplus.exe"Added by the RBOT-MU WORM!"
X MSN Popup Blocker msnpopblck.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X Msn Processe Manager msni32.exe"Added by the RBOT-ADX WORM!"
N MSN Quick View Msndc.exeQuick way to connect to MSN internet service
X MSN Registry loader msmnwin.exe"Added by the KELVIR.FK WORM!"
X MSN Router msnrouter.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X MSN RPC Manager msnrpcmgr.exe"Added by an unidentified WORM or TROJAN! See here"
X MSN Rx Manager msnrxmgr.exe"Added by an unidentified WORM or TROJAN! See here"
N MSN Search Toolbar WindowsSearch.exe"System Tray access to Windows Desktop Search for XP from Microsoft - which adds additional search options including a search box on the Taskbar. For this version
X MSN Security Agent msnsecure.exe"Added by a variant of the IRCBOT BACKDOOR!"
X MSN Serv msmsnserv.exe"Added by the IRCBOT.AVF BACKDOOR!"
X Msn Serv msnserv.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X MSN Server msmsnserver.exe"Added by the IRCBOT.AUS BACKDOOR!"
X MSN service msnmgr16.exe"Added by a variant of the RBOT WORM!"
X MSN Service amsnmsgrs.exe"Added by a variant of the SDBOT WORM!"
X Msn Service matrixcam.exe"Added by the MYTOB.JH WORM!"
X Msn Service raloded.exe"Added by the MYTOB-DY WORM!"
X MSN service msnmsgr16.exe"Added by the RBOT-RZ WORM!"
X MSN service NTDKRN.EXE"Added by the RBOT.UJ WORM!"
X MSN Service msnsvc.exe"Added by the SLENFBOT.EG WORM!"
X MSN Service Updates winproc.exe"Added by the KELVIR-BB WORM!"
X MSN Service Utilities nkn.exe"Added by the KELVIR-BC WORM!"
X MSN Service! msnservice.exe"Added by a variant of the RBOT WORM! See here"
X MSN Servicer msnsrv.exe"Added by a variant of the IRCBOT TROJAN!"
X MSN Servicer msnservicer.exe"Added by the SLENFBOT.PQ WORM!"
X MSN Services msnserv.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X MSN Services msnservice.exe"Added by the IMPARD-A TROJAN!"
X MSN Settings msnsettings.exe"Added by the IRCBOT.AWH BACKDOOR!"
X MSN Settings Manager msnsetmg.exe"Added by an unidentified WORM or TROJAN! See here"
X MSN Setup MSN.msn"Added by the JAMBU WORM!"
X MSN Software msnsoftware.exe"Added by the IRCBOT.AWD BACKDOOR!"
X MSN Start msnmsgr7.exe"Added by the RBOT-PH WORM!"
X Msn Startup msnstartup.exe"Added by the ARBOT.AA WORM!"
N MSN Toolbar mswinext.exe"MSN Toolbar from version 4.* onwards (now known as Bing Bar from version 5.* onwards). This entry loads the toolbar into memory at start-up before you open your internet browser. Not required - it will load with the browser and remains in memory after the browser is closed"
X MSN Tray Monitor msnmsgr.exe"Added by the SDBOT.FKX WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%\inetsrv"
X MSN Update mscon.exe"Added by the RBOT-QA WORM!"
X MSN Update msn32.exe"Added by the RBOT.AHN WORM!"
X MSN Update DLLCON.EXE"Added by the RBOT-EA WORM!"
X MSN Update Cfg msnupdbt.exe"Added by an unidentified WORM or TROJAN! See here"
X MSN Update Client msnupdater.exe"Added by a variant of the IRCBOT BACKDOOR!"
X MSN Update Client msnupdcli.exe"Added by a variant of the IRCBOT BACKDOOR!"
X Msn Update Manager (Sp2) MSMSGS.EXE"Added by the AGOBOT-NL WORM! Note - this particular msmsgs.exe file is located in %System% and should not be mistaken for the MSN Messenger file of the same name which is located in %Program Files%\Messenger"
X Msn Update Service userx.exe"Added by the MYTOB.JF WORM!"
X MSN Update Service msnupdsv.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X Msn Update SUPPORT [random filename]"Added by the RBOT-BPS WORM!"
X MSN Updater msnms.exe"Added by the FORBOT-CG WORM!"
X Msn Updater msnplugins.exe"Added by the RBOT-HS WORM!"
X Msn Updater windatemanager.exe"Added by the SDBOT.TS WORM!"
X MSN UPDATERS virtualmemory.exe"Added by the RBOT-JK WORM!"
X MSN Updating msnupdate.exe"Added by the QHOST.AEI TROJAN!"
X msn upddate mesenger.exe"Added by the RBOT-AVZ WORM!"
X MSN User mymsnusr.exe"Added by the IRCBOT.AVD BACKDOOR!"
X MSN User Server msnserver.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X MSN User Server! msnservices.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X MSN User Service msnsvc.exe"Added by the SLENFBOT.NS WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list