HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
X	nod32	nodqq.exe	"Added by the AUTORUN-BBV WORM!"
X	NOD32 FiX	regedt32.exe	"NodFix is a is a potentially unwanted application. This application is given an (X) status because we does not and will not support Cracks or Warez. Do not delete the regedt32.exe as it is the legitimate Windows application. NodFix interferes with the default settings of the NOD32 AV application allowing to bypass its free using period as well as changes the default update server to that eval signatures thus allowing to update NOD32 without password. Note - to avoid interfering with the NOD32 application original settings no full cleanup can be provided"
X	Nod32 Free antivirus	nod32krn.exe	"Added by the RBOT-AAO WORM! Note - not the popular free NOD32 antivirus software
X	Nod32 Runtime	sysregi.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Nod32 Service	nod64.exe	"Added by the RBOT.ESJ WORM!"
X	Nod32 Service	alserv32.exe	"Added by the RBOT.DHN WORM!"
X	Nod32 Service	AutoUpdateWin32.exe	"Added by the SDBOT-DJG WORM!"
X	Nod32 Service	nod6.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
U	Nod32CC	nod32cc.exe	"Control Center part of Eset's NOD32 virus-scanner. Leave this enabled if you want to update your virus data files via the click of a button"
Y	NOD32kernel	Nod32krn.exe	"NOD32 antivirus"
Y	nod32kui	nod32kui.exe	"NOD32 antivirus"
Y	NOD32POP3	Pop3scan.exe	"POP3 E-mail part of Eset's NOD32 virus-scanner"
X	Nod3d2 Free antivirus	N0D32KRN.EXE	"Added by the RBOT-ABQ WORM!"
?	NodeMnger	Nodemngr.exe	"Part of the Dell OpenManage Client installation - to allow Dell representatives to remote logon?"
X	NoDNS	NoDNS.exe	"Added by the CLICKER.WI TROJAN!"
X	nodriver	AUEKXRZ.EXE	"Added by a variant of the SPYBOT WORM!"
X	nodriver	SVCHOST.EXE	"Added by the SPYBOT-Z BACKDOOR! Note - this is not the legitimate svchost.exe process which should normally figure in Msconfig/Startup!"
X	NOFIIN.EXE	NOFIIN.EXE	"Added by the HAXDOOR-DP TROJAN!"
X	Noha	aasd.exe	"PurityScan adware"
X	Nokia Check	nokiacheck.exe	"Added by the RBOT.CDC WORM!"
N	Nokia Connection Monitor	NclConf.exe	"Monitors the infrared port
N	Nokia FastStart	NokiaMusic.exe	"Part of the Nokia Music music manager. ""With Nokia Music
U	Nokia M Platform	NokiaMServer.exe	"Part of the Nokia Music music manager
N	Nokia Music	NokiaMusic.exe	"Part of the Nokia Music music manager. ""With Nokia Music
N	Nokia Ovi Suite	NokiaOviSuite.exe	"Nokia Ovi Suite for managing Nokia mobile devices - ""gives you an easy access to the contents of your Nokia device. Transfer files and information effortlessly between your device and your computer
Y	Nokia PC Suite	DataLayer.exe	"Part of Nokia PC Suite version 5 - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" Required by the Nokia status/connection monitor (NclTray.exe)"
N	Nokia PC Sync	PCSync2.exe	"System Tray access to Nokia PC Sync - which ""allows you to synchronise contacts
Y	Nokia Software Updater	nsu_ui_client.exe	"Utility that only runs once after installing the Nokia Software Updater which is used to update the operating system (or firmware) for selected Nokia mobile devices"
N	Nokia Status Monitor	NclTray.exe	"Part of Nokia PC Suite version 5 - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" Monitors ports to see if a phone has been connected and provides System Tray access to the Connection Manager (and other PC Suite components if a phone is connected). Available via the Control Panel as ""Nokia Connection Manager"""
N	Nokia Tray Application	NclTray.exe	"Part of Nokia PC Suite version 5 - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" Monitors ports to see if a phone has been connected and provides System Tray access to the Connection Manager (and other PC Suite components if a phone is connected). Available via the Control Panel as ""Nokia Connection Manager"""
N	Nokia.PCSync	PCSync2.exe	"System Tray access to Nokia PC Sync - which ""allows you to synchronise contacts
U	NokiaMServer	NokiaMServer.exe	"Part of the Nokia Music music manager
N	NokiaMusic	NokiaMusic.exe	"Part of the Nokia Music music manager. ""With Nokia Music
N	NokiaOviSuite	NokiaOviSuite.exe	"Nokia Ovi Suite for managing Nokia mobile devices - ""gives you an easy access to the contents of your Nokia device. Transfer files and information effortlessly between your device and your computer
N	NokiaOviSuite.exe	NokiaOviSuite.exe	"Nokia Ovi Suite for managing Nokia mobile devices - ""gives you an easy access to the contents of your Nokia device. Transfer files and information effortlessly between your device and your computer
N	NokiaPCSuiteTray	LaunchApplication.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
N	NokiaPCSyncTray	PCSync.exe	"System Tray access to Nokia PC Sync - which ""allows you to synchronise contacts
U	NokKernel install	Nok_install.exe	"Installer for the NokNet Workstation Monitor surveillance software. Uninstall this software unless you put it there yourself"
U	NOMAD Detector	ctnmrun.exe	Detects the Creative NOMAD jukebox/MP3 player at the time it is attached to USB and starts the needed application (Creative PlayCentre 2) that you use to copy MP3 files to and from it. This is required if you want PlayCentre 2 to take control of the NOMAD once connected
N	NomdCheck	nomdchek.exe	Part of Intel's Native Audio
U	nomtray	nomtray.exe	"System Tray access to NetMotion Wireless options - including connectivity status (see here)"
X	none	pmsngr.exe	"Added by the ZLOB.MEDIA-CODEC TROJAN! This purports to be a Windows Media Player upgrade (with names such as ""iCodecPack""
N	Nonoh	Nonoh.exe	"Nonoh - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X	NoooH	sys.exe	"Added by the ALNUH WORM!"
X	NOPDBS	NOPDBS.exe	"Added by the BANCBAN-AS TROJAN!"
X	Nord	nordsys.exe	"Added by the DREF-S WORM!"
X	NordBull	msa.exe	"Added by the DLOADR-CSV TROJAN!"
X	Norman Worl System Ability	nwcss32.exe	"Added by the DELF.IO TROJAN!"
U	Norman ZANDA	ZLH.EXE	"System Tray icon for Norman Antivirus"
X	NortE Antivirus	norte.exe	"Added by the RBOT.BQQ WORM!"
X	NortE Antivirus	norten.exe	"Added by the RBOT-AFF WORM!"
X	norten Software Intrenet	norten.pif	"Added by the RBOT-AWA WORM!"
X	Norton Antiviral Scanner	navscnr.exe	"Added by the DELBOT-K WORM!"
X	Norton Antivirus	nortonav.exe	"Added by the RBOT-AYE TROJAN! Note - this is not the real Norton AV!"
X	Norton Antivirus 2004	SYMANTECAV2.EXE	"Added by the SPYBOT-DY WORM! Note - this is not the real Norton AV!"
X	Norton Antivirus 7.0a	[path to file]	"Added by the PERDA-B or RANCK-CT TROJANS!"
X	Norton Antivirus AV	FVProtect.exe	"Added by the NETSKY.P WORM! Note - this is not the popular AV software!"
X	Norton AntiVirus Sys	NAVsys32.exe	"Added by a variant of the WOOTBOT WORM!"
X	Norton Antivirus Updater	nortonav.exe	"Added by the DELBOT-T WORM! Note - this is not the real Norton AV!"
X	Norton Auto Protect	nava.exe	Added by an unidentified WORM or TROJAN!
X	Norton Auto Protect	crss32.exe	"Added by the SDBOT.ATF WORM!"
Y	Norton Auto-Protect	navapw32.exe	Norton Anti-Virus's background scanning process
X	Norton Auto-Protect	ccApp.exe	"Added by the AKHER.D WORM! Note - for the valid Norton AV entry the filename is ""navapexe"". This is also not the valid Norton AV file with the same filename"
X	Norton Auto-Protect	SERVICES.exe	"Added by the AHKER.B WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%. Also
X	Norton Auto-Protect	ffbaqe.exe	"Added by the SLINBOT.RF BACKDOOR! Note - this is not a valid Norton product"
?	Norton AV Preload	Premend.exe	"Norton Antivirus related. What does it do and is it required"
X	Norton AV Protection Startup	Ati2xxx.exe	"Added by a variant of the RBOT WORM!"
N	Norton Crashguard Monitor	cgmenu.exe	Troublesome program that doesn't actually work with WinME so Norton removed it from SystemWorks 2001
N	Norton Disk Doctor	Ndd32.exe	"Norton Disk Doctor from Norton Utilities. Automatically runs at start-up
X	Norton Drive Protection	msdt32.exe	"Added by the FORBOT-GB WORM! Note - this not a valid Norton program!"
Y	Norton eMail Protect	POPROXY.EXE	"Proxy E-mail protection from Norton Anti-Virus (prior to 2002). If you have it installed
X	Norton Firewall	[path to trojan]	"Added by the BANKER-ET TROJAN!"
N	Norton Ghost 10.0	GhostTray.exe	"Norton Ghost tray icon - the application can be launched manually"
N	Norton Ghost 9.0	GhostTray.exe	"Norton Ghost tray icon - the application can be launched manually"
X	Norton GProtect	ngrfn.exe	"Added by a variant of the RBOT WORM!"
X	Norton Guard 32	ntguard32.exe	"Added by a variant of the RBOT WORM!"
X	Norton Live Update Server	cpsdv.exe	"Added by the AGOBOT.EW TROJAN!"
X	Norton Live Updater	Cavapsvc.exe	"Added by the GAOBOT.AO WORM!"
X	Norton Live Updater	Sochost.exe	"Added by the GAOBOT.AO WORM!"
X	Norton Live Updater	Avapsvc.exe	"Added by the AGOBOT-BG BACKDOOR!"
N	Norton Navigator Loader	nnloader.exe	"An older Norton utility for file management under Windows 95. More information here"
X	Norton Personal Firewall	jah.exe	"Added by a variant of the SDBOT WORM!"
X	Norton Personal Firewall	npfw.exe	"Added by the RBOT-UI WORM!"
X	Norton Personal Firewall	lah.exe	"Added by a variant of the RBOT WORM!"
X	Norton Personal Firewall	npfw32.exe	"Added by the RBOT-UQ WORM!"
Y	Norton Personal Firewall	IntroWiz.exe	Part of Norton Personal Firewall or Norton Internet Security
X	Norton Personal Firewall	winmpts.exe	"Added by the RBOT.ANT WORM!"
U	Norton Program Scheduler	nsched32.exe	"Installed on a Windows system where the Windows Task Scheduler isn't used as part of the OS (Win95
U	Norton Program Scheduler	NPSsvc.exe	"Installed on a Windows system where the Windows Task Scheduler isn't used as part of the OS (Win95
?	Norton Program Scheduler Event Checker	npscheck.exe	"Part of Norton Anti-Virus. What does it do? Apparently it can safely be disabled without causing problems. Can also be listed as NPS Event Checker"
X	Norton Protect	npprotect.exe	"Added by the RBOT-WW WORM!"
X	Norton protect	nvsvc.exe	"Added by a variant of the RBOT WORM!"
X	Norton Protect Activies	csrss.exe	"Added by the BANKER-CZ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""D5133"" subfolder"
X	Norton Service Driver	wsul.exe	"Added by the RBOT-ABI WORM!"
X	Norton Service Process	navapvc.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Norton Service Process	navapsvc.exe	"Added by the AGOBOT-GV WORM! Note - this is not the valid Norton Anti-Virus service which has the same file and is located in %ProgramFiles%\Norton AntiVirus. This one is located in %System%"
X	Norton SpySweeper AutoUpdate	navsw.exe	"Added by the FORBOT-AS WORM!"
X	Norton Start	ccStart.exe	"Added by the SDBOT-OX WORM!"
X	Norton System	csrs.scr	"Added by the BANLOA-AFM TROJAN!"
N	Norton System Doctor	Sysdoc32.exe	"Norton Disk Doctor from Norton Utilities. Automatically runs at start-up
N	Norton SystemWorks	cfgwiz.exe	Norton System Works configuration wizard. Reportedly a resource hog. Many users find they can live without loading it
X	Norton Update	ccUpdate.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Norton Update	winsvc.exe	"Added by the AGOBOT.ALP WORM!"
X	Norton Update	cUpdate.exe	"Added by the AGOBOT.APP WORM!"
X	Norton updated	NVSV32.EXE	"Added by the SDBOT.ABH WORM!"
X	Norton Updater	winset.exe	"Added by a variant of the SPYBOT WORM!"
X	Norton Updater	lsa.exe	"Added by a variant of the RBOT WORM!"
X	Norton Updater	NortonUpdate.exe	Added by an unidentified WORM or TROJAN!
X	Norton Updater	ccUpdate.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Norton Updater	navupdtr.exe	"Added by the SDBOT.AXV WORM!"
X	Norton Wizzard	nwiz.exe	"Added by the GAOBOT.ADV WORM! Note - this is not the valid nVidia application that shares the same name"
X	norton32	norton32.exe	"Added by an unidentified VIRUS
X	NortonAntivirus	LSASS.exe	"Added by the PEXMOR WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Temp"
X	NortonAV	norton_antivirus.exe	"Added by the NETJOE TROJAN! Note - this is not the legitimate Symantec AV program"
X	nortonav	CCUPD32.EXE	Added by an unidentified WORM or TROJAN!
X	nortonp	nortonp.exe	"Added by the JD-A TROJAN!"
X	Nortons AV SYSTEM	scvchost.exe	"Added by a variant of the RBOT WORM!"
X	Nortons AVS Systems	arse.exe	"Added by the RBOT.AWY WORM!"
X	nortonsantivirus	ccEvtMngr.exe	"Added by the HZDOOR-A TROJAN!"
X	NortonVPlus	svchost.exe	"Added by the ROAMER-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	noskrnl	noskrnl.exe	"Added by the PEACOMM.D TROJAN!"
U	Notebook Maximizer	maximizer_startup.exe	Toshiba Notebook Maximizer software - adjust settings to save battery power and increase efficiency
U	NotebookHardwareControl	nhc.exe	"""With Notebook Hardware Control you can easily control the hardware components of your Notebook"""
?	NotebookManager	nbm.exe	"Associated with Acer notebook PCs. What does it do and is it required?"
N	NoteBurner	VTBurnerGUI.exe	"NoteBurner from NoteBurner Inc. - ""a versatile music converter that can be used as MP3 music converter
X	NotePad	[worm filename]	"Added by the SILLYFDC-G WORM!"
X	Notepad	ntoepad.exe	"Added by the DELBOT-AK WORM!"
X	notepad	"rundll32.exe notepad.dll	_IWMPEvents@0"
X	notepad	"rundll32.exe ntload.dll	_IWMPEvents@0"
X	Notepad lptt01	notepad.exe	"RapidBlaster variant (in a ""Notepad"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not Windows Notepad which has the same executable name"
X	Notepad ml097e	notepad.exe	"RapidBlaster variant (in a ""Notepad"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not Windows Notepad which has the same executable name"
X	notepad.exe	upx.exe	Added by a variant of the AGENT.AH TROJAN!
X	notepad.exe	msmsgs.exe	"Added by the ZLOB TROJAN and variants! Note - this particular msmsgs.exe file is located in %System% and should not be mistaken for the MSN Messenger file of the same name which is located in %Program Files%\Messenger"
X	notepad2.exe	popuper.exe	"Added by the PUPER-E TROJAN!"
X	notes	notepaad.exe	"Added by the RBOT.BME WORM!"
U	NoticeP.exe	NoticeP.exe	"Part of iSync which allows ""you to transfer songs from any music downloading software to your iTunes® library"". The trial version displays advertisements which disappear if you purchase the software"
X	Notification Utility	altpayV2.exe	"AltPay adware"
X	Notn	Eber.exe	"PurityScan adware"
X	Notn	wtta.exe	"PurityScan adware"
U	NovaBackup * Tray Control	NbkCtrl.exe	"Scheduling engine of NovaSTOR Backup Service. Only required if scheduling is enabled and wanted - see here. * represents the version number"
?	NovaPortal Single User Service	NPSU.exe	"??"
U	NovastorSchedulerd	SCHENGD.EXE	NovaStor NovaBACKUP Scheduler - back-up utility. If you don't have regularly scheduled back-ups you don't need it
X	novsvida.exe	novsvida.exe	"GlobalAccess dialer"
X	NoWayVirus	pgs.exe	"NoWayVirus rogue security software - not recommended
N	Nowe Gadu-Gadu	gg.exe	Polish language Instant Messaging client
X	NOYPI_KANG_ASTIG	Exit to DosPrompt.pif	"Added by the FILUKIN.A WORM!"
X	np	upnp.exe	"Added by the YABE.AE TROJAN!"
U	NPDTray	NPDTray.exe	System Tray access to Presentation Director for IBM/Lenovo Thinkpad notebooks - which allows you to create and quickly select between various single and mulitple display options. Scheme selection and settings are also available via Fn+F7 key combination on some models
X	NPF Value	NPFMONTR.exe	"Added by the RBOT-AWD WORM!"
?	NPFMonitor	NPFMntor.exe	"Norton AntiVirus Firewall Install Monitor. What does it do and is it required?"
X	npkmnc	npkmnc.exe	"WebVia adware"
U	NPROTECT	nprotect.exe	Norton Protected Recycle Bin from Norton Utilities. Adds an extra layer of safety before you remove deleted files from the Recycled Bin. Can be listed twice which is valid
?	NPS Event Checker	npscheck.exe	"Part of Norton Anti-Virus. What does it do? Apparently it can safely be disabled without causing problems. Can also be listed as Norton Program Scheduler Event Checker"
X	NS	ns.exe	"Added by the AGOBOT-HS WORM!"
X	NSCheck	NSCHECK.EXE	"MarketScore parasite - ActiveX control used to download premium-rate dialers"
X	nscntrl	nscntrl.exe	"Added by the DLOAD-DC TROJAN!"
X	nsdcmd services	nsdcmdav.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	nsdcmd vid process	nsdcmdwin.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	nsdlua	nsdlua.exe	All-In-One Telcom - adult content dialler
X	nsdriver	nssys32.exe	"NetShagg adware"
X	nse	nse.exe	"Added by the AGOBOT-ML WORM!"
U	Nsengine	Nsengine.exe	"Scheduling engine of NovaSTOR Backup Service. Only required if scheduling is enabled and wanted - see here"
U	NSHelper	aexnsinstallhelper.exe	Altiris Express Notification Server Install helper - monitors integrity of the installation
U	NSK	NSK.exe	"Ardakey keystroke logger/monitoring program - remove unless you installed it yourself!"
U	NSRKey	NSRTray.exe	"System Tray access to Norton Save & Restore backup utility"
X	nssysconf	[random filename]	"Added by the VIVIA.A TROJAN!"
X	nstat	netstat.exe	Adult content dialler
X	NSupdate	NSupdate.exe	"Added by the Dial/Laet-B premium rate dialer!"
Y	nsu_ui_client	nsu_ui_client.exe	"Utility that only runs once after installing the Nokia Software Updater which is used to update the operating system (or firmware) for selected Nokia mobile devices"
Y	nsu_ui_client.exe	nsu_ui_client.exe	"Utility that only runs once after installing the Nokia Software Updater which is used to update the operating system (or firmware) for selected Nokia mobile devices"
X	Nsv	nsvsvc.exe	"Delfin Promulgate adware"
X	nsvcin	n20050308.exe	"Delfin Media Viewer adware related"
X	Nsvdr	nsvdr.exe	Adult content dialler
U	nsys	nsys.exe	"NetSpy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	nsys32	nsys32.exe	"Added by the AGOBOT-SU WORM!"
N	NSystemMonitor	Symmon.exe	Norton Uninstall Deluxe - monitors programs being installed and logs them for removing later. Available via Start -> Programs for manual logging
N	NT Kernel Patch	ntkrnlpt.exe	"FaxServe network fax software"
X	NT LM Security Support Provider	WinNTLM.exe	"Added by a variant of the SDBOT WORM!"
X	NT Logging Service	Syslog32.exe	"Added by the DONK.B WORM and variants!"
X	NT MICROSOFT SVCD	ntvsvcd.exe	"Added by a variant of the RBOT WORM!"
X	NT Printing Service	spoolsc.exe	"Added by the BUZUS-K WORM!"
X	NT Printing Service	chkdsks.exe	"Added by the ARCHIVARIUS series of WORMS!"
X	NT Printing Service	chkdskss.exe	"Added by the ARCHIVARIUS series of WORMS!"
X	NT Printing Services	chkdsks.exe	"Added by the BUZUS-M TROJAN!"
X	NT security	rundll32.com	"Added by the RBOT-AJC WORM!"
X	NT Service	NTOKSRNL.EXE	"Added by the RBOT-AAG WORM!"
X	NT Services	ntsvc.exe	"Added by the AGOBOT.VJ WORM!"
X	Nt System Protocol	ntsystem.exe	"Added by the RBOT.DSB TROJAN!"
X	NT Virtual Machine	[path to file]	"Added by the SCAERBOT-A WORM!"
X	NT Windows System Manager Loader	csrlss.exe	"Added by the AGOBOT.OX WORM!"
X	Nt**.exe [* = random char]	Nt**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Nt**32.exe [* = random char]	Nt**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	NT-Virtual Device Manager	ntvdmn.exe	"Added by the SDBOT-AAA WORM!"
X	Ntcheck	mapserver.exe	"Added by the TOMPAI-B WORM!"
X	NTCommLib3	[path to trojan]	"Added by the AGENT-AXB TROJAN!"
X	ntddetect	ntddetect.exe	"Added by the AGENT-CU TROJAN!"
X	NTdhcp	NTdhcp.exe	"Added by the QQROB-C TROJAN!"
X	NTdhcp	CiKewl.exe	"Added by the QQROB-N TROJAN!"
X	ntdll	ntdll.exe	"Added by the BIONET.404 TROJAN!"
X	ntdll.dll	TrustCleaner.exe	"Smitfraud variant"
X	NTDLM	csrss.exe	"Added by the HALE TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Qossrv"" subfolder"
X	Ntech.patchs	[trojan filename]	"Added by the LEMIR.G TROJAN!"
X	ntechin	n20050308.exe	"Delfin Media Viewer adware related"
X	nternet Explorer	iexplore.exe	"Added by the FORBOT-CT WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	NTFS16	ntfs16.exe	"Added by the RBOT-LY WORM!"
Y	NTFSCLUP	NTFSCLUP.EXE	"Part of ConfigSafe- ""checks if an ntfssos restore has been performed since it was last run. It exits immediately after running. 99+% of the time it will only execute about a dozen instructions before exiting"""
X	ntfsmonitorpro	ntfs64.exe	"Added by the FORBOT-EB WORM!"
X	NTFSS Microsoft System	filees.exe	"Added by the RBOT.GAB WORM!"
X	NTFSS MICROSOFT SYSTEM	filess.exe	"Added by the RBOT.AXZ WORM!"
X	ntfyapp	ntfyapp.exe	"Added by the ZHELATIN WORM!"
U	NTI Backup NOW! Scheduler	Schdlr32.exe	"Scheduled backups for the NTI Backup Now archiving utility. If a backup job has been scheduled
Y	ntl Netguard	RPS.exe	"ntl Netguard - anti-virus a package of services
X	ntldr	ntldr.exe	"Browser hijacker re-directing to search-control.com. In addition to the registry changes found by HijackThis it also creates the following system files: %System%\ntldr.exe
N	ntlfreedom	"rundll32 [path] RyDial.dll	QuickStart"
X	NTmessageSystem	loadnewmessage.exe	"Added by the HIDAGENT-B WORM!"
X	ntmsevt	ntmsevt.exe	"Added by the STOPED-B TROJAN"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list