HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
X	svcwinprocess32	[path to worm]	"Added by the UPERING WORM!"
X	SVGA Adapter	svghost.exe	"Added by a variant of the SPYBOT WORM! See here"
X	svhcost	svhcost.exe	"OpenSearch adware"
X	svhoost	checksys.exe	Added by a downloader TROJAN of Chinese origin!
X	SVHOST	svhost.exe	"Added by the MYDOOM.I WORM! The file is located in %System%"
X	SVHOST	SVHOST.EXE	"Added by the ZORI.A VIRUS! The file is located in %System%\SVCHOSTV"
X	Svhost	Svhost.exe	"Added by the VB-ASG WORM! This file is located in a ""Hwnd"" sub-directory of the Root folder (C:\)
X	Svhost Loader	svshost.exe	"Added by the AGOBOT.G WORM!"
X	Svhost Service Server	svhostser.exe	"Added by a variant of the RBOT WORM! See here"
X	svhost updates	Svhost.exe	"Added by a variant of the RBOT WORM!"
X	svhost windows services	svhost8.exe	"Added by the RBOT-WQ WORM!"
X	svhost1	mdsn.exe	"Added by the VB-EPK TROJAN!"
X	svhost32	svhost32.exe	"Added by the AUTORUN-AWY WORM!"
?	SVIDC32M	SVIDC32M.exe	"??"
X	sVideo2	[path to dialler]	"""Switch-D"" premium rate adult content dialler"
X	sviload32	sviload32.exe	"Added by the RBOT-AAS WORM!"
?	SVM Pop	svmpop.exe	"??"
X	svnlitup32	svnlitup32.exe	"Added by the RBOT.CBJ WORM!"
X	svnloader	svnload32.exe	"Added by the RBOT-ACU WORM!"
X	SVOHST	svohst.exe	"Added by the IRCBOT-AEI WORM!"
X	Svost Loader	svost.exe	"Added by the SDBOT.G BACKDOOR!"
X	svphost.exe	svphost.exe	"Added by the AGENT.CS TROJAN!"
U	SVPWUTIL	SVPWUTIL.exe SVPwUTIL	Part of Toshiba Hardware Setup
X	svrrun	svrrun.exe	Adware hailing from Deskwizz.com
X	svsekin	svsekt.exe	"Added by the QQPASS.G TROJAN!"
X	svshost	svshost.exe	"Added by the CHODE-H WORM!"
X	svshost	messenger.exe	"Added by the LOONY-G TROJAN!"
X	Svshost Update Service	svcbind.exe	"Added by the MYTOB.LH WORM!"
X	svshost32	msgrsv32.exe	Added by the RANKY.AJ TROJAN!
X	svshost32	svshost32.exe	"Added by a variant of the SDBOT WORM!"
X	svshostdriver	svshost.exe	"Added by the SDBOT-HN TROJAN!"
X	svshostdriver	msnmessengerupdate.exe	"Added by the SDBOT-BI BACKDOOR!"
X	svtcin	n20050308.a.Stub.EXE	"Added by the N20050308 TROJAN!"
X	svwin32	unninst32.exe	"Added by the AGOBOT-NF WORM!"
X	SVX Control Service	svxhost.exe	"Added by the FORBOT-K WORM!"
X	SW	SpyOnThis.exe	"SpyOnThis rogue spyware remover - not recommended"
U	SW20	sw20.exe	"Related to MSI's Dynamic Overclocking Technology"
U	SW24	sw24.exe	"Related to MSI's Dynamic Overclocking Technology"
Y	swAgentexe	SWAGENT.EXE	Part of the now obsolete McAfee Managed VirusScan anti-virus and anti-spyware security tool for small businesses
N	Swap Nut	javaw.exe	"javaw.exe can be loaded by other programs at startup but in this instance it's SwapNut
X	SWCaller	SWcaller.exe	"Swporta homepage hijacker"
X	SWCaller	Swcaller2.exe	"Swporta homepage hijacker"
X	Swchost	Swhost.exe	"Added by the BDOOR-MP BACKDOOR!"
U	SWClient	swsys.exe	"ActivMonAgent keyboard logger/monitoring program - remove unless you installed it yourself"
U	SWClient	swclient.exe	"Stealth Watcher surveillance software. Uninstall this software unless you put it there yourself"
X	swcroot	swcroot.exe	"Added by the SOLENO-A TROJAN!"
U	SWd	winwd.exe	"PC Security™ from Tropical Software - ""is the ultimate in computer security
Y	Sweep95	ICLOAD95.EXE	"Part of Sophos ant-virus sofware"
N	SweetIM	SweetIM.exe	"vSweetIM - send fancier smiley-faces and IM graphics to friends who are using MSN Messenger. They are only able to see these advanced smiley-faces if they also have SweetIM installed"
X	Swf32	AVupdate.exe	"Added by the MERKUR.E WORM!"
X	Swf32	_backup.exe	"Added by the SYMTEN WORM!"
U	swg	GoogleToolbarNotifier.exe	"Part of Google Toolbar (from version 4 onwards) for IE. ""Google Toolbar Notifier allows you to set Google as your default search engine and prevents your search settings from being changed without your consent. An icon in your system tray blinks if the Notifier identifies an attempt to change your default search engine. You can click the icon to get more details and allow the change"". There was a bug in earlier versions where disabling the option resulted in the entry still running at startup but this has now been resolved"
X	SwiftCleaner	SwiftCleanerScanner.exe	"SwiftCleaner rogue cleaning utility - not recommended
X	SwimSuitNetwork	SwimSuitNetwork.exe	Advertising spyware
X	swingsys	SWINGSYS.EXE	"Added by the BANCOS-CX TROJAN!"
U	Switch Off	swoff.exe	"Switch Off - tray-based system utility that can automatically perform various frequently used operations like shutdown or restart your computer
N	Switchboard.com Toolbar	AtHoc.exe	"Toolbar for the on-line version of Yellow Pages in the US - Switchboard.com"
U	SwitchDesk	SwitchDesk.exe	"PowerUp SwitchDesk - virtual desktop manager which allows ""you have the possibility to launch games
U	Switcher	Switcher.exe	"""On a Sony laptop with built in wireless it allows the user to select which wireless services they want to run (i.e. Wireless LAN
X	switp	switpa.exe	"OfferAgent adware"
U	SWL	rundll32.exe [path] SWL.dll rdl	"StealthWeblog surveillance software. Uninstall this software unless you put it there yourself! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
U	SWN2	swnxt.exe	"Spyware remover by TrekBlue. Previously not recommended but the latest version was delisted here"
X	sws.exe	[random filename]	"Haldex type adult content dialler"
X	sws.exe	gd-dial.exe	"Globaldialer adult content premium rate dialer"
N	SwTray	SWTRAY.EXE	MS SideWinder game controller system tray icon. Available via Start -> Programs. May have the version number after it
N	SWTrayV4	SWTrayV4.exe	MS SideWinder game controller system tray icon. This is specific to version 4 of the software. Available via Start -> Programs
U	SwyxIt!	SwyxIt!.exe	"PC Based soft phone from Swyx - see here for more details"
U	SX Virtual Link	Connect.exe	"SX Virtual Link from Silex Technology America
N	sXe Injected	sXe Injected.exe	"sXe Injected anti-cheat system client/server for Half-Life server based games that prevents cheat programs being loaded"
?	SXGDSENU	sxgdsenu.exe	"Yamaha SXG soundcard driver"
N	SxgTkBar	sxgtkbar.exe	Yamaha SXG soundcard utility - gives quick and easy access via the system tray bar to diagnostics and configuration
?	Sxplog	sxpstub.exe	"Part of CA Unicenter Software Delivery - manage software across various systems
X	sxrrv	sxrrv.pif	"Added by the VAX-A TROJAN!"
X	sy	s2.exe	"Added by a variant of the RBOT WORM!"
U	SybaseCentral43	scjview.exe	"Related to SQL Anywhere from Sybase. A comprehensive package providing data management and data exchange technologies"
X	SyBot v2.1 By Sky-Dancer	HPSV.exe	"Added by the ZOTOB.I WORM!"
X	SYDNEY	[file path]	"Added by the SYNEY WORM!"
X	syelimS-esreveR-troppuS	[filename]	"Added by the LITBOT.C TROJAN!"
X	Syesm	Syesm.exe	"Added by the BUZUS WORM!"
X	Syga432te Pe432rsonal Firewall	MrNo4236.exe	"Added by the RBOT-AQY WORM!"
X	Sygaete Personal Firewall	SyGate.exe	"Added by the RBOT-GLX WORM!"
X	Sygate Peral Firewall	Syga.exe	"Added by the RBOT-AQK WORM!"
X	Sygate Personal 3	svrv.exe	"Added by the RBOT-XD WORM!"
X	Sygate Personal Block	Studio.exe	"Added by the RBOT-TW WORM!"
X	Sygate Personal Firewall	Win32x.exe	"Added by the RBOT-KZ WORM!"
X	Sygate Personal Firewall	system32.exe	"Added by the RBOT.VI WORM!"
X	Sygate Personal Firewall	sysgut.exe	"Added by the SDBOT.WM WORM!"
X	Sygate Personal Firewall	Sygate.exe	"Added by the RBOT-PN WORM!"
X	Sygate Personal Firewall	Mcafeeupdate.exe	"Added by the RBOT.YN WORM!"
X	Sygate Personal Firewall	Sygate32.exe	"Added by the RBOT.ATW WORM!"
X	Sygate Personal Firewall	MSNSRV32.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personal Firewall	service.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personal Firewall	t1ktik.exe	"Added by the RBOT-VP WORM!"
X	Sygate Personal Firewall	host32.exe	"Added by the RBOT.ALD WORM!"
X	Sygate Personal Firewall	sexy.exe	"Added by the RBOT-XY WORM!"
X	Sygate Personal Firewall	sys.exe	"Added by the RBOT-ZC WORM!"
X	Sygate Personal Firewall	syserror.exe	"Added by the RBOT.UC WORM!"
X	Sygate Personal Firewall	hostserv.exe	"Added by the RBOT.BKO WORM!"
X	Sygate Personal Firewall	msnmsgrs.exe	"Added by the RBOT.XN WORM!"
X	Sygate Personal Firewall	Sygat.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personal Firewall	wins.exe	"Added by the RBOT.AOB WORM!"
X	Sygate Personal Firewall	winxpstat.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personal Firewall	Syga.exe	"Added by the RBOT-AQD WORM!"
X	Sygate Personal Firewall	svchots.exe	"Added by the RBOT.ABT WORM!"
X	Sygate Personal Firewall	win31243.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Sygate Personal Firewall Start	services32.exe	"Added by the RBOT-MB WORM!"
X	Sygate Personal Firewall Start	servic.exe	"Added by the RBOT-RY WORM!"
X	Sygate Personal Port	crss.exe	"Added by the RBOT-PX WORM!"
X	Sygate Personal Port Blocker	volume.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personal Port Blocker	winupdate.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personals Firewalls	ccsrn.exe	"Added by a variant of the RBOT WORM!"
X	Sygates Personal Firewall	sygs.exe	"Added by the RBOT.XB WORM!"
U	SyGateService	sgserv95.exe	"SyGate is a useful little program that lets you share an internet connection over an intranet. Is it needed - it saves a lot of headache to just let SyGate load at startup. Available via Start -> Programs"
X	Symantec	ccapp.exe	"Added by the REATLE WORM! Note - this is not a Symantec file"
X	Symantec Anti Virus	symantec32.exe	"Added by a variant of the WOOTBOT WORM!"
X	Symantec Antivirus professional	dfrgfrat.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	autoformat.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	dyndns.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	f0dns.exe	"Added by the FORBOT-GT WORM!"
X	Symantec Antivirus professional	flushdns.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	for.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	regedit.exe	"Added by a variant of the FORBOT WORM! Note - this is not the valid Windows registry editor which resides in %Windir% and will not normally figure in Msconfig/Startup! This version resides in %System%"
X	Symantec Antivirus professional	Symantex.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	windows .exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	Winhp32.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	winudp.exe	"Added by a variant of the WOOTBOT WORM! See here"
X	Symantec Antivirus professional	xplrer.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Autoscan	[random filename]	"Added by the RBOT-AJO WORM!"
Y	Symantec Backup Exec Desktop Agent	DLOClientu.exe	"Part of Symantec's Backup Exec backup software"
X	Symantec Client Security	symclient.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Symantec Configuration Loader	ccApp32.exe	"Added by the AGOBOT-EE WORM!"
Y	Symantec Core LC	symlcsvc.exe	"Part of Norton AntiVirus 2004. What does it do?"
X	Symantec Debug Client	symdebugs.exe	"Added by the IRCBOT-ACM TROJAN!"
N	Symantec Fax Starter Edition Port	OLFSNT40.EXE	Offers a virtual printer as a fax machine. Can be run via a desktop shortcut
Y	Symantec NetBackup Desktop Agent	DLOClientu.exe	"Part of Symantec's NetBackup backup software"
U	Symantec NetDriver Monitor	SNDMon.exe	"Part of Symantec's LiveUpate (eg
U	Symantec NetDriver Warning	SNDWarn.exe	Part of Symantec Live Update - displays the warning when you need to update the firewall database
U	Symantec PIF AlertEng	PIFSvc.exe	"Symantec LiveUpdate Notice Service"
X	Symantec Secure Server	svrhost.exe	"Added by the IRCBOT-UB TROJAN!"
X	Symantec Security	symantec32.exe	"Added by the RANDEX.PR or RANDEX.YR WORMS!"
X	Symantec Security Addon	nvsvc.exe	"Added by a variant of the AGOBOT/GAOBOT WORM! Note - do NOT confuse with the legitimate NVIDIA Driver Helper Service file of the same name as described here"
X	Symantec Security Routine Addon	navpaw.exe	"Added by the AGOBOT-ES BACKDOOR!"
X	Symantec Security Routine Addon for Microsoft Windows	navpxaw32.exe	"Added by the AGOBOT-GJ TROJAN!"
X	Symantec Service	ccApp.exe	"Added by the AKHER.D WORM! Note - this is also not the valid Norton AV file with the same filename"
X	SymantecFilterCheck	svhost.exe	"Added by the BANKER-EEO TROJAN!"
X	SymantecFilterCheck	gmilogof.exe	"Added by the BANKER-EKC TROJAN!"
X	SymantecFilterCheck	[path to trojan]	"Added by the BANKER-EIN TROJAN!"
X	SymantecFilterCheck	bsyys.scr	"Added by the BANLOAD.DZC TROJAN!"
X	SymAV	SymAV.exe	"Added by the NETSKY.U WORM!"
U	SymKeepAlive	CKA.exe	"Part of Norton SystemWorks 2003 - keeps a dial-up modem connection alive"
X	Symlcs	[path to file]	"Added by the YASPY-A TROJAN!"
X	Symmetrical Network	symmec.exe	"Added by the DELBOT-N WORM!"
U	SymmTime	GeTTime.exe	"SymmTime from Symmetricon - freeware utility that ""synchronizes your PC clock to Coordinated Universal Time (UTC)
U	SymmTime	SymmTime.exe	"Older version of SymmTime from Symmetricon - freeware utility that ""synchronizes your PC clock to Coordinated Universal Time (UTC)
U	SymmTime Application	GeTTime.exe	"SymmTime from Symmetricon - freeware utility that ""synchronizes your PC clock to Coordinated Universal Time (UTC)
X	SymRun	N/A	"Added by the KANGAROO-A TROJAN!"
X	SymRun	ccApps.exe	"Added by the KAGEN-A TROJAN!"
N	SymTray - Norton SystemWorks	SYMTRAY.EXE	"Keeps all System Tray icons for Norton SystemWorks together to reduce clutter. SystemWorks includes Norton Anti-Virus
U	Synaptics Pointing Device Driver	SynTPEnh.exe	"Synaptics TouchPad Enhancements - included with drivers for Synaptics based TouchPads
Y	SynAsusAcpi	SynAsusAcpi.exe	Part of the Synaptics touchpad driver for the Asus Eee PC range
U	Sync Data	Hndsync.exe	"Pocket Real Estate - mobile synchronization manager"
X	Sync Server	drwatsoon.exe	"Added by the WATSOON.A TROJAN!"
U	Sync-It	Syncit.exe	"Sync-It - synchronizes the system clock with time servers on the internet"
U	SyncAgent	syncagent.exe	"Ghost Keylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	Synchronization Agent	mobsynca.exe	"Added by the RANDEX-E WORM!"
U	Synchronization Manager	mobsync.exe	"Microsoft Synchronization Manager for 2K/XP - used to update network copies of materials that were edited offline
X	Synchronization Manager	rservers.exe	"Added by the FORBOT-FM WORM!"
X	syncman	winsync.exe	"Added by the MANCSYN-A TROJAN!"
X	syncman	wuaucldt.exe	"Added by the NAMSYS-A TROJAN!"
X	SyncMan	SyncMan.exe	"Added by the AGENT-BNYL TROJAN!"
X	SyncManager	msorunner.exe	"Added by a variant of the TACTSLAY TROJAN!"
X	SyncMon	adslcomdos.exe	"Added by the CLUNKY-A TROJAN!"
X	SyncMon	fixcomdos.exe	"Added by the CLUNKY-B TROJAN!"
?	SynSetup	SynTP.tmp RunOnce.exe	"Probably associated Synaptics touchpads on laptops as for the SynTPEnh and SynTPLpr entries but what does it do and is it required?"
X	Syntax	windows32.exe	"Added by the SDBOT.CQ WORM!"
X	Syntax Script	systacq.exe	"Added by the SDBOT.AI WORM!"
X	Syntax Script	saskatcw.exe	"Added by the SDBOT-TE WORM!"
U	SynTPEnh	SynTPEnh.exe	"Synaptics TouchPad Enhancements - included with drivers for Synaptics based TouchPads
U	SynTPLpr	SynTPLpr.exe	"Synaptics TouchPad driver helper - included with drivers for Synaptics based TouchPads
U	SynTPStart	SynTPStart.exe	Synaptics Pointing Device starter belonging to Synaptics Pointing Device Driver
X	sys	regedit /s sys.reg	"Raxmus adware. Note that the Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file ""sys.reg"" is located in %Windir%"
X	sys	regedit sysdllwm.reg	"CoolWebSearch parasite variant - also detected as the FEMAD-L TROJAN!"
X	sys	Fonts.exe	"Added by the AUTORUN.BUK WORM!"
X	sys	rundll32.exe	"Added by the LINEAG-G TROJAN! Note - this is not the legitimate rundll32.exe process
X	Sys Ren	SysRen.exe	"Part of FlashEnhancer adware"
X	sys************* [* = random digit]	sys*************.exe [* = random digit]	"WINBO adware"
X	Sys**.exe [* = random char]	Sys**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Sys**32.exe [* = random char]	Sys**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Sys-Stat	wuapdxe.exe	"Added by the SDBOT.HK WORM!"
X	sys008	sys008.exe	"Hijacker
X	sys009	sys009.exe	"Added by the STARTPA-ZB TROJAN!"
X	SYS1	system.exe	"Added by the SILLYFDC-AP WORM!"
X	SYS1	explorar.exe	"Added by the SILLYFDC.BDJ WORM!"
X	SYS2	bad1.exe	"Added by the SILLYFDC-AP WORM!"
X	sys201	sys209.exe	"Added by the STARTPA-ZY TROJAN!"
X	Sys29	win***32.exe [* = random char]	"EliteBar adware"
X	SYS3	bad2.exe	"Added by the SILLYFDC-AP WORM!"
X	sys32	SYS32.EXE	"Added by the FLUX.E BACKDOOR! The file is located in %System%"
X	sys32	sysx32.exe	"Added by the KVEX-A VIRUS!"
X	Sys32	Sys32.exe	"Added by the AUTORUN-KL WORM! The file is located in %Windir%"
U	sys32cmd	sys32win.exe	"Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	sys32dll	sys32dll.exe	"Added by the AIMDES.B WORM!"
U	sys32sql	sys32win.exe	"Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	sys32_nov	sys32_nov.exe	"Added by the AGENT-LAX TROJAN!"
X	sys33	sys33.exe	"Added by the AGOBOT-WJ WORM!"
X	SYS4	bad3.exe	"Added by the SILLYFDC-AP WORM!"
X	sys64_nov	sys64_nov.exe	"Added by the MUTANT.FKA TROJAN!"
X	SysA	win***32.exe [* = random char]	"EliteBar adware"
U	SysAgent	SysAgent.exe	SYSagent - small utility for retrieving all the hardware and software information required by anyone administering a machine and/or the network it's a part of
X	SysAI	SysAI.exe	"AproposMedia adware"
X	sysalgg	sysalgg.exe	"Added by the TIBS.BF WORM!"
X	Sysanalysing	myrvc.exe	"Added by the AUTORUN-RD WORM!"
X	SysAntivirus 2009	sysav.exe	"SysAntivirus 2009 rogue security software - not recommended
X	SysATW	sysatw.exe	"Added by the VANEBOT-AM WORM!"
X	sysav	winav.exe	"WinPC Antivirus rogue security software - not recommended
U	SysBkup	[path to file]	"Keyspy keystroke logger/monitoring program - remove unless you installed it yourself!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list