Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown
Startup Name Process Name Details
X Pointmaru Pointmaru.exe"Added by the AGENT.BLDK TROJAN!"
X Points Manager points manager.exe"Altnet TopSearch adware"
N PoivY PoivY.exe"PoivY - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X PoliceAV xppolice.exe"XP Police Antivirus rogue security software - not recommended
X Policies server.exe"Added by the SPYRAT WORM!"
X Policies server.exe"Added by the AGENT-NLT TROJAN!"
X PolicyRun spoolsv32.exe"Added by the BACKDOOR-DNV TROJAN!"
X PolicyRun svchost.exe"Added by the SILLYFDC-AW WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X Pollon pollone.exe"Added by the SPYBOT.FW WORM!"
X polo.exe polo.exe"Added by the AGENT-PE TROJAN!"
X pool manager popsvr.exe"Added by the AGENT-S BACKDOOR!"
X poolsv poolsv.exeAdded by an unidentified WORM or TROJAN!
X POP PopSrv***.exe"PeopleonPage foistware
X POP Manager popmgr.exe"Added by the BCKDR-PYV BACKDOOR!"
U POP Peeper POPPeeper.exe"POP_Peeper from Mortal Universe Software Entertainment ""is an email notifier that runs in your Windows task bar and alerts you when you have new email on your POP3
U Pop-Up Smasher PopupSmasher.exe"Pop-Up Smasher - pop-up killer"
U Pop-Up Stopper dpps2.exe"Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group"
U Pop-Up_Blocker Popup.exe"A Tweak-XP component
U Pop-Up_Scanner Popupscn.exe"Panicware popup blocker"
X pop06ap pop06ap2.exe"MediaMotor adware"
X pop06apelt thiselt.exe"ZenoSearch adware"
U pop3 Server config.cfg"Part of HTML2POP3 - ""Convert Webmail to POP3.Is also included a SMTP/POP3 tunneling system that allow send and receive email in a private network HTTP PROXY based. All connection are plugin based. Over 250 email server supported and tested"""
Y Pop3trap.exe Pop3trap.exe"Part of Trend Micro web-security products - PC-cillin 2000
X PopeSvr PopeSvr.exe"Added by the LEGMIR-AJ TROJAN!"
X PopMark WinTask.exe"""Pop Marketing"" adware"
U PopNot PopNot.exe"PopNot - pop-up killer"
U PopOops PopOops.exe"PopOops - pop-up killer"
U Popopen popopen.exe"
X PopRock [path to trojan]"Added by the AGENT-LNU TROJAN!"
Y Poproxy POPROXY.EXE"Proxy E-mail protection from Norton Anti-Virus (prior to 2002). If you have it installed
X popsrv146 popsrv146.exe"AproposMedia adware"
U PopSubtract PopSub.exe"PopSubtract - pop-up killer"
X PopularScreensaversWallpaper "rundll32 [path] F3SCRCTR.DLLLES"
U Popup Ad Filter PopFilter.exe"Popup Ad Filter - pop-up killer"
X Popup and Advertisement Killers adkillers.exe"Added by the RBOT-DDH WORM!"
X Popup Blocker System PopUpBlocker.exe"Added by a variant of the RBOT WORM!"
X Popup Blocker System326a Monitoring PopUpBlocker6a.exe"Added by the RBOT.AUH WORM!"
X Popup Blocker System8 Monitoring PopUpBlocker8.exe"Added by a variant of the RBOT WORM!"
X Popup Blocker Updater regsvr32 veev****.dll [* = random char]"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
U PopUp Buster+ popupbuster.exePopUp Buster - free Pop-up blocker
X Popup Defence Updater regsvr32 pdfupd.dll"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
U Popup Defender PD.exe"
U PopUp Destroy Popup-Destroy.exe"French pop-up killer from VSoft"
X PopUp Stopper NO POPUP.EXE"Added by the SPYBOT-DC WORM!"
U Popup Terminator GLADManager.exe"Popup Terminator - pop-up killer"
U PopupEliminator Popup Eliminator.exe"Popup Eliminator - pop-up killer"
U PopUpKiller PopUpKiller.exe"PopUpKiller - pop-up killer"
X popuppers newpop63.exe"Medload adware"
X popuppers64 a64sddd.exe"Popuppers adware
X popuppers65 [path to file]"Medload adware"
U PopUpStopperCompanion PSComp.exe"PopupStopper Companion popup blocker"
U PopUpStopperFreeEdition PSFREE.EXE"Panicware's Pop-Up Stopper - free limited features version"
U PopUpStopperProfessional PopUpStopperProfessional.exe"Panicware's Pop-Up Stopper - paid for version"
U PopupVanish PopupVanish.exePop-up blocker
U PopUpWasher PopUpWasher.exe"PopUpWasher pop-up killer"
X PopUpWatch PopUpWatch.exe"BPS spyware remover - not recommended
X Pornfolio ioande.exe"Added by the SDBOT.ATW WORM!"
? POS-Partnerbatchprocessor BATCH.EXE"VISA credit card batch processing related to Appcon. Is it needed or can it be started manually via Start -> Programs or a manually created shortcut?"
N Post-it(R) Digital Notes PDNotes.exe"Post-it® Digital Notes from 3M - ""simple to use software that lets you make and organize lists
N Post-It(r) Software Psnotes.exePop-up "yellow" notes on screen. Available via Start -> Programs
N Post-itR Software Notes Lite Psn2Lite.exe"Post-it® Software Notes - Lite from 3M - now replaced by the more advanced Post-it® Digital Notes"
N Post-itŪ Digital Notes PDNotes.exe"Post-it® Digital Notes from 3M - ""simple to use software that lets you make and organize lists
N Post-itŪ Software Notes psn.exe"Post-it® Software Notes - Lite from 3M - now replaced by the more advanced Post-it® Digital Notes"
X PostBootReminder [random filename]Added by and unidentified WORM or TROJAN!
X Postdavatch nvdas.exe"Added by the RANDEX.T WORM!"
X Postpatch nvdes.exe"Added by the RANDEX.T WORM!"
X PostSetupCheck Rundll32.exe atgban.dll"TrafficSol adware variant. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""atgban.dll"" file is found in %System%"
X postSetupCheck Rundll32.exe gzmrt.dll"TrafficSol adware variant. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""gzmrt.dll"" file is found in %System%"
X PostSetupCheck Rundll32.exe cpmsky.dll"TrafficSol adware variant. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""cpmsky.dll"" file is found in %System%"
X postsos post.exe"Added by the TATERF-Z WORM!"
U POW! pow.exePop-up killer
X Power Scan powerscan.exe"Foistware by Integrated Search Technologies - the people behind ISTBar adware"
X Power-Antivirus-2009 Power-Antivirus-2009.exe"Power Antivirus 2009 rogue security software - not recommended
U Power2GoExpress Power2GoExpress.exe"Power2GoExpress - all media disc burning software"
N PowerArchiver Tray PASTARTER.EXE"System Tray access to PowerArchiver from ConeXware
N PowerBar Powerbar.exe"Part of Cyberlink's PowerDVD software. Not sure what exactly it does
Y PowerChute Pwrchute.exe""During a power outage
X PowerChute Pwrchute.exe"Added by the LAZAR-A TROJAN! Note - this is located in %ProgramFiles%\APC_Power"
U PowerDOCSAPIHost papihost.exe"Hummingbird PowerDOCS - ""delivers powerful enterprise document management functionality via a tightly integrated Microsoft WinNT/98/2K environment"""
N PowerDVD PowerDVD.exe"Launches Cyberlink's PowerDVD software and creates a system tray icon. If enabled
U PowerForPhone PowerForPhone.exe"""ASUS Power 4 Phone is a telephone terminal emulation utility which can use hotkeys to handle a phone call from Skype or Modem in your notebook system."" For more information you can find a user's manual here"
N PowerGramo PowerGramo.exe"""PowerGramo Skype recorder is a perfect Skype recording solution. With it you can easily record skype calls of any kind"""
U PowerKey PowerKey.exe"Part of Acer Launch Manager - programmable keys on such laptops as the TravelMate 610"
X PowerManagement Rundlll.exe"Added by the SURDUX TROJAN!"
X PowerManager svchost.exe"Added by the JEEFO VIRUS! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U Powermarks pm.exe"Powermarks from Kaylon Technologies - bookmark manager and personal search engine"
Y PowerPanel POWPANEL.EXEPower management utility on notebooks/laptops - automatically switches modes when running on battery
U PowerPanel Personal Edition User Interaction pppeuser.exe"CyberPower PowerPanel Personal Edition UPS Monitoring & Control Software - ""is included with CyberPower's products. This exclusive software allows control and monitoring of your UPS to provide protection for your computer system
X PowerPrifile "rundl132 kenel.dll PowerProfileEnable"
U PowerPro powerpro.exe"Part of the power professional program that loads the floating menu bar. Can be accessed from Start -> Programs
X PowerProf PowerProf.exeAdded by the LOREX.B TROJAN!
X PowerProfile mfcp30.exe"Added by the RINDAS-A TROJAN!"
N PowerQuest Startup Utility PQINIT.EXE"From a visitor - "This seems to be installed when you install Power Quest Partition Magic. I think that it implements the changes when you use the magic mover app. If you don't have any mappings set up
N PowerReg eReg.exe"Registration reminder from Leader Technologies for software from Logitech
N PowerReg Scheduler PowerReg Scheduler.exe"PowerREGISTER from Leadertech. Registration reminder as used by Iomega
N PowerReg Scheduler PowerReg Scheduler V3.exe"PowerREGISTER from Leadertech. Registration reminder as used by Iomega
N PowerReg Scheduler V3 PowerReg Scheduler V3.exe"PowerREGISTER from Leadertech. Registration reminder as used by Iomega
N PowerReg SchedulerV2 PowerReg SchedulerV2.exe"PowerREGISTER from Leadertech. Registration reminder as used by Iomega
N PowerReg SchedulerV3 PowerReg SchedulerV3.exe"PowerREGISTER from Leadertech. Registration reminder as used by Iomega
? POWERR~1 POWERR~1.exe"Power monitoring?"
? PowerS PowerS.exe"ProlinkTest for either their AGP graphics card or TV/FM capture card. Is it required?"
? PowerSet Regedit.exe /s ...PowerSet_8100_CU.REG"Appears to be Toshiba power management related"
N PowerStrip powerstrip.exe"PowerStrip is a Video Mode Editor to allow special Refresh Rates and Tweaking of Video Settings"
N PowerStrip PSTRIP.EXE"PowerStrip is a Video Mode Editor to allow special Refresh Rates and Tweaking of Video Settings"
U PowerTools Tray Icon pttray.exe"PowerTools - add-on for AOL"
U Powertweak PT2.EXE""Powertweak is designed to configure your system in the best way. A processor
U Powertweak PTCTRL.EXE""Powertweak is designed to configure your system in the best way. A processor
U PowerUp SwitchDesk SwitchDesk.exe"PowerUp SwitchDesk - virtual desktop manager which allows ""you have the possibility to launch games
U Power_Gear BatteryLife.exePower management for all Asus notebook. Useful but not critical
X pp pp12.exe"Added by the DWNLDR-HXV TROJAN!"
X pp pp2.exe"Added by a variant of the KOOBFACE WORM!"
U PP Gamma ppgamma.exe"Profile Prism software that allows monitor calibration and can generate ICC profiles for digital cameras"
N PP****usb FBDirect.exe"Software that monitors the status of a Visioneer OneTouch scanner button and allows you to scan
U PP2000 Instaupdate PPInupdt.exeProtector Plus anti-virus software - instant update program for virus data updates. Not required if you regularly update virus data manually
Y PP2000 Real Time Scan PPVstop.exeProtector Plus anti-virus software - real time scanner
Y PP2000 Taskbar Control PPTbc.exeProtector Plus anti-virus software - system tray access
N PP3100b flatbed.exe"Twain driver for the Visioneer PaperPort 3100b scanner that allows you to scan
U ppass Antispy.exe"AntiSpy firewall - ""program designed to combat against various types of intrusion and monitoring programs currently in use or presently being developed worldwide"""
U PPControl PPControl.exe"PestPatrol Control Terminal - utility that launched PestPatrol features such as PPMemCheck and CookiePatrol before CA's acquisition"
U PPCRunonce PPCRunOnce.exe"Related to PeoplePC ISP software - may display advertising
U PPHIDPAD pphidpad.exe"PenPower Chinese handwriting recognition software"
U PPK Setup(Server) SEServe.exe"Programmable Power Key on Sony Vaio laptops. "Using the Programmable Power Key (PPK) button
N ppmate ppmate.exe"PPMate - free tool for streaming online TV via P2P (peer-to-peer)"
U PPMemCheck ppmemcheck.exe"PPMemCheck - used to be part of PestPatrol before CA's acquisition"
N PPort10reminder Ereg.exe ereg.ini"Registration reminder for PaperPort version 10 from Scansoft (now Nuance)"
N PPort11reminder Ereg.exe Ereg.ini"Registration reminder for PaperPort version 11 from Scansoft (now Nuance)"
N PPort12reminder Ereg.exe Ereg.ini"Registration reminder for PaperPort version 12 from Nuance"
N PPort9reminder Ereg.exe ereg.ini"Registration reminder for PaperPort version 9 from Scansoft (now Nuance)"
X PPPOEO pingppac.exe"Added by the SPYBOT.KHC WORM!"
X PPPOEOE winlite.exe"Added by the RBOT-AAN WORM!"
N PProTray pprotray.exePart of the power professional program. Loads the System Tray control
? PPScheduler PPScheduler.exe"Part of Nuance (ScanSoft) PaperPort - ""scan
U PPSVC [path to file]"PC Police surveillance software that logs keystrokes
U PPSYS ppsys.exe"PC Police commercial keystroke logger. Uninstall this software if you did not install it yourself"
N pptd40nt pptd40nt.exe"Part of Nuance (ScanSoft) PaperPort - ""scan
U PPUpdate ppupdater.exe"PPUpdater - updater that used to be part of PestPatrol before CA's acquisition"
N PPWWebCap PPWebCap.exe"PaperPort" software associated with scanners
X pqhelper pqhelper.exe"Searchcentrix hijacker"
U PractiSearch PSearch.exe"PractiSearch web search software"
U Praize Messenger itLoad.exe"Praize IM Christian chat instant messenger"
U Prayer PTW.EXE"Islamic Adhan program (call fpr daily prayers)"
X Prcgd Prcgd.exe"Added by the AUTORUN-BCJ WORM!"
X PrdMgr.exe PrdMgr.exe"Added by a variant of the IRCBOT BACKDOOR!"
X prdtect prdtect.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
? PreAnnotate PreAnntt.exe"Genius Wizard Pen Tablet driver related. Is it required?"
N Precision Time Clock Checker PrecisionTime.exePrecision Time 2.0. Checks your computer clock time against the Naval Observatory or some other source to assure accurate time
X PrecisionTime PrecisionTime.exe"PrecisionTime - clock synchronizing software containg spyware by Claria/GAIN. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X precpop2 starter.exe"PrecisionPop adware"
X Prein APP****.tmp [* = random char or digit]Unidentified adware
X PreInstall Windows [path] repcale.exe [path] beird.exe"Added by a variant of the RANDON.AN WORM! Both files are located in %System%\detr"
Y Preload Preload.exeMillenium Multi-Function Keyboard driver
N preload RUNXMLPL.exeSoftware found on Acer computers from Wistron. Information suggests it maps keyboard buttons to operating system functions
? PreloadApp hphprld.exe"HP PhotoSmart printers related. What does it do and is it required?"
X Premeter nrpr.exe"NetRatings Premeter spyware"
X Premeter prmt.exe"NetRatings Premeter spyware"
X PremierOpinion pmropn.exe"PremierOpinion adware"
X present .exe"Added by the RUBBLE-C WORM!"
X Presto TuneUp PrestoTuneUp.exe"Presto TuneUp rogue optimization utility - not recommended
N PrestoNotes PrestoNotes.exe"PrestoNotes lets you create virtual notes on your desktop
X Preview AdService PrevAdServ.exeWindupdates adware variant
X PrevX prevx.exe"Added by the IRCBOT-TF WORM! Note - this worm is located in the System (Win9x/Me) or System32 (XP/WinNT/2K) directory and is not the PrevX Home intrusion prevention software"
Y PrevxHome SAGUI.exe"PrevX Home intrusion prevention software"
Y PrevxOne PXConsole.exe"Prevx intrusion prevention software"
Y PrevxPro SAGUI.exe"PrevX Home intrusion prevention software"
X prgtect prgtect.exe"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
X Pribi.exe Pribi.exe"FastFind adware variant"
X Pribi.exe Pribi.exe"FastFind.B adware"
N Price Patrol neo.exe"Price Patrol by Half.com - internet shopping companion for finding the best on-line prices"
? PrimaLauncher Launcher.exe"Associated with PrimaScan scanners. Is it required?"
U Primax 3D Mouse 3dmoused.exeEnables the scroll button on the Primax 3-D Scroll mouse
? Primsta Primsta.exe"Linksys Wireless CompactFlash Card driver related. Is it required?"
X Print Driver Helper Service crsrr.exe"Added by the AGENT-BC TROJAN!"
X Print Hp Tray hpprint.exe"Added by the RBOT-GWE WORM!"
N Print Master Event Reminder PMremind.exe"Event reminder for calendar dates
X Print Scheduler usnsvc.exe"Added by a variant of the KOBOT-C WORM!"
N Print Screen Deluxe psdeluxe.exe"Utility allows "Print Scrn" or "Print Screen" key to capture
X Print Services spolserv32.exe"Added by the RBOT.ZP WORM!"
X print sharing start.bat"Added by the ZCREW TROJAN!"
X print sharing [path] hidden32.exe [path] explorer.exe"Added by the ZCREW.B BACKDOOR! Note - the legitimate Windows Explorer (explorer.exe) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually!"
X Print Spooler Spoolsv.exe"Added by the CIADOOR.B TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %Windir%"
X Print Spooler spoolsvc32.exe"Added by the SDBOT.BB TROJAN!"
X Print Spooler spools.exe"Added by the RBOT-LD WORM!"
X Print Spooler spool.exe"Added by the BDOOR-IS BACKDOOR!"
X Print Spooler spoolsv32.exe"Added by the RBOT.SW WORM!"
X Printer Spyassault.exe"SpyAssault spyware remover - not recommended
X Printer [path to file]"Added by the LOWTAPER TROJAN!"
X Printer dipset.exe"Added by a variant of the FBSR TROJAN!"
X printer SpyAssaultScanner.exe"SpyAssault spyware remover - not recommended
X Printer vmmon32.exe"Added by the RBOT-CSB WORM!"
X printer printer.exe"WinIFixer rogue security software - not recommended
X printer sysprinter.exe"Added by the SMALL.ZY TROJAN!"
X Printer Monitor webprinter.exe"Added by the IRCBOT-Z TROJAN!"
X Printer Services spool.exe"Added by the RBOT-Y WORM!"
X Printer Spool updater.exe"Added by a variant of the RBOT WORM!"
X Printer spool Service spool.exe"Added by the RBOT-ACP WORM!"
X printer spooler commonaccess.exe"Added by the DELF-LB TROJAN!"
X Printer Spooler spooler.exe"Added by the DELF-JJ TROJAN!"
X Printer Spooler Subsystem spoolss.exe"Added by a variant of the RBOT WORM! Note - this is not the legitimate Windows spoolss.exe process which is always located in %System% and should not figure in Msconfig/Startup!"
? Printer Update CFGREG.EXE"Maybe a registration reminder or automatically updates drivers or application software for a printer?"
X printerdrv vdms.exe"Added by the OPTIXKIL.30 TROJAN!"
X PrinterSpool [path] RESTORE.EXE [path] SPOOL.EXE"Added by the ALADINZ.K TROJAN!"
X Printing Driver msprint.exe"Added by the RBOT.JH WORM!"
N Printkey2000 printkey2000.exeScreen grabber that intercepts the pressing of the Print Screen (Prn Scrn) key. Start manually when required
X PrintMngr system.exeAdded by an unidentified TROJAN!
N printnow printnow.exe"
N PrinTray Printray.exeLexmark/Compaq printer icon in the System Tray for quick access. Not required - uncheck via Printer configuration rather than MSCONFIG. See also LexmarkPrintray and CompaqPrinTray
N PrintScreen UNWISE.EXE"Gadwin PrintScreen - utility to capture
N Printscreen 95 PRT95MIN.EXE"Printscreen 95 - utility to capture
U PrintSpooler lass.exe"Win-Spy keystroke logger/monitoring program - remove unless you installed it yourself!"
X PrintSpoolSv System.exe"Added by the BDOOR-S BACKDOOR!"
N PrintUtil PrintUtil.exeHP Print Utility - a troubleshooting utility for HP printers and all-in-ones
U PRISMSTA.EXE PRISMSTA.EXECreates a system tray icon for accessing information about Intersil Prism Wireless Settings. Intersil silicon is used by Trendware/Trendnet for example
U PRISMSVR PRISMSVR.EXEConfiguration and settings utility for PRISM chipset based wireless modems such as the 2Wire Wireless Gateway (2701HG) and Siemens Gigaset USB Adapter
U PRISMSVR.EXE PRISMSVR.EXEConfiguration and settings utility for PRISM chipset based wireless modems such as the 2Wire Wireless Gateway (2701HG) and Siemens Gigaset USB Adapter
N Privacy Eraser Pro PrivacyEraser.exe"Privacy Eraser Pro - protects your Internet privacy by cleaning up all Internet history tracks and past computer activities"
X Privacy Guarantor PrivacyGuarantor.exe"Privacy Guarantor rogue privacy program - not recommended

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list