Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown
Startup Name Process Name Details
X Wsdata service WSconf.exe"Added by the SDBOT.ZU WORM!"
X Wsecurity ldanw32.exe"Added by the AGENT-BUC TROJAN!"
U WSEP Status+Configuration controldGUI.exe"User interface for the WatchGuard Security Event Processor (WSEP) Status/Configuration dialog box associated with the Firebox series of security products from Watchguard"
X wserv wserv.exe"Added by a variant of the SDBOT WORM!"
X wserver wserver.exe"Added by the NETSKY.AC or SASSER.G WORMS!"
U WService WService.exe"Tablet client Driver for UC-Logic Pen/Graphics Tablet"
U wsg32 wsg32.exe"GoldenKeylog keystroke logger/monitoring program - remove unless you installed it yourself!"
U wskrnl wskrnl.exe"ActMon surveillance software. Uninstall this software unless you put it there yourself"
X wsock32 svchost.exe"Added by the HORST-A WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X WSock32 Protocol wsock32p.exe"Added by the SDBOT.M BACKDOOR!"
X WSockDrv32 WSockDrv32.exe"Added by the WINKO.AO WORM!"
X wsrv32 wsrv32.exe"Detected by Kaspersky as the AGENT.EP TROJAN!"
X WSSAConfiguration wmmon32.exe"Added by the AGOBOT-KC WORM!"
X WSSVC smsc.exe"Added by the AUTORUN-AGA WORM!"
U wssys wssys.exe"WebPI logs keystrokes and captures screenshots. If you didn't install this yourself remove it"
X Wstat32 driver Wstat32.exe"Added by the LOONBOT TROJAN!"
Y wstimeb wstimeb.exeUsed with NEC printers. You can disable it before printing but it re-loads itself when printing so you may as well leave it
X wsttrs wsttrs.exe"Added by the LDPINCH-QS TROJAN!"
X wsvbs wsvbs.exe"Added by the PWS-AEB TROJAN!"
X WSVCHO svhost.exe"Added by the SPYBOT-OQ WORM!"
U WSVCS SERVICES.EXE"WSLogger keystroke logger/monitoring program - remove unless you installed it yourself!"
Y wswpd wswpd.exe"Used with some models of Panasonic
U wsys.exe wsys.exe"SpyloPCMonitor - surveillance software. Uninstall this software unless you put it there yourself"
X ws_d ws32.exe"Added by the LEGMIR-RL TROJAN!"
X ws_ds sws32.exe"Added by the DELF-GZ TROJAN!"
N WT Game Channel GameChannel.exe"WildTangent GameChannel - notification of new games
N WT Game Channel wtgamechannel.exe"WildTangent GameChannel - notification of new games
N WT GameChannel GameChannel.exe"WildTangent GameChannel - notification of new games
N WT GameChannel wtgamechannel.exe"WildTangent GameChannel - notification of new games
X WTF Test wtftest.exe"Added by the RBOT-ACM WORM!"
U WTIndicator SchedInd.exe"WinTask - software that automates a variety of routine tasks quickly and simply"
X WTSC wapisvcc.exe"PurityScan adware"
X WTSI wapisvit.exe"PurityScan adware"
X WTSS wapi**.exe [* = random char]"PurityScan adware"
X WTST wapisvtr.exe"PurityScan adware"
X wtzlank.dll "rundll32.exe wtzlank.dllqttwuwc"
Y WU713STA.EXE WU713STA.EXEBlitzz Technology wireless NIC adapter driver
X wuanguard wuanguard32.exe"Added by the RBOT-AAF WORM!"
X WudfSvc WudfSvc.exe"Added by the SHEUR.BBB TROJAN!"
Y WUOLService WUOLService9x.exe"Remote wakeup status agent. Part of Novell's ZenWorks. Processes Wake-up on LAN requests (turn on a computer remotely on LAN)"
X wuosdial wuosdial.exe"Added by a variant of the RBOT WORM!"
X WUPD iglmtray.exe"Added by the TZET WORM!"
X wupd symcsvc.exe"Added by the ABWIZ.C TROJAN!"
X wupd win32.exe"Added by the ORSE-C TROJAN!"
X wupd32 wupd.exe"Added by the STRATION.EL WORM!"
X wupdate wisvccz.exe"Added by the ORSE-B TROJAN!"
X wupdate wi32.exe"Detected by Panda as Trustbid spyware"
X WUpdate 1037v.exe"Added by the CLAGGER-AR TROJAN!"
X Wupdate driver [various filenames]"Added by a variant of the SPYBOT WORM!"
X Wupdate driver wupdadte.exe"Added by the SPYBOT-CQ WORM!"
X WUpdates WUpdates.exe"Added by the SWEPDAT TROJAN!"
X Wupdm32 Wupdm32.exe"Added by the MIDLAK WORM!"
X wupdmgr32.exe wupdmgr32.exe"Added by the CERTIF-I TROJAN!"
X wupdt wupdt.exe"Added by the IMISERV.A TROJAN!"
X Wupftp wupftp.exe"Added by the AGOBOT.AKV WORM!"
X wupipenimi "Rundll32.exe jinorije.dlls"
X wupipenimi "Rundll32.exe luyenofe.dlls"
X wupipenimi "Rundll32.exe poyimimu.dlls"
X wupipenimi "Rundll32.exe siremase.dlls"
X wupipenimi "Rundll32.exe tamuyiko.dlls"
Y WUSB11B.exe WUSB11B.exeLinksys WUSB11 WLAN USB adapter
Y WUSB54GS InvokeSvc3.exeWireless-G USB Wireless Network Adapter related - would appear to be required
Y WUSB54Gv2 InvokeSvc3.exeWireless-G USB Wireless Network Adapter related - would appear to be required
Y WUSB54Gv4 WUSB54Gv4.exeWireless-G USB Wireless Network Adapter related - would appear to be required
X wuviewer wuviewer.exe"Added by a Proxy Trojan variant"
X wuweb wuweb.exe"Added by the WUWO TROJAN!"
? WUx_RegSvr RegSvr32.exe"x is any number??"
X WWKS wsass.exe"Added by the SDBOT-BT WORM!"
X www.hidro.4t.com enbiei.exe"Added by the BLASTER.F WORM!"
X www.symantec.com oz11111.exe"Added by the MYDOOM.W WORM"
X WXcmeinst [path to file]"Added by the RANCK-CD TROJAN!"
X Wxp4 Norton Update.exe"Added by the ERKEZ.D WORM!"
N WXProcMgr Module WXprocMgr.exe"TVTonic from Wavexpress - ""enjoy 3 full-screen
U WZCBDLService WZCBDL9X.exeWZCBDLService Launcher from D-Link - configuration/drivers
X wzdmg wzdmg.exe"Added by a generic downloader TROJAN - see here"
X wzhelper wzhelper.exe"Searchcentrix hijacker"
X wzservice hess.exeAdded by the HACKARMY.W TROJAN!
X wzxzxds fdfddad.exe"Added by the RANKY.AB TROJAN!"
U X Server X.exe"""XoftWare for Windows"" enables you to run network-based UNIX programs (""X programs"" or ""clients"") side-by-side with Windows applications on your personal computer. You can also share programs and computing resources with host computers connected to your PC over a network"
U X-Cleaner Deluxe xcleaner.exe"X-Cleaner Deluxe - privacy and anti-spy application"
U X-Cleaner Freeware XCLEAN~1.EXE"X-Cleaner Freeware - ""cookie cleaning
N X-Grabber sswizard.exe"ScreenShot Wizard"
U X1 X1.exe"Part of X1's Enterprise Desktop Search Resource Center. An enterprise desktop search engine"
U X1 System Tray X1Systray.exe"Part of X1's Enterprise Desktop Search Resource Center. An enterprise desktop search engine"
U X10 Device Network Service x10nets.exeBelongs to X10 video streaming device(s)
X X10Weax WTHRTRAY.EXE"WeatherCheck - ""bring the latest local weather to your desktop"". Not recommended as it reportedly pops ads
U X1FileMonitor.exe X1FileMonitor.exe"Part of X1's Enterprise Desktop Search Resource Center. An enterprise desktop search engine"
U x3watch x3watch.exe"""program helping with online integrity. Whenever you browse the internet and accesses a site which may contain questionable material
X x3yy [path to trojan]"Added by the TANNICK TROJAN!"
U X4ALLNL wdfsctl.exe"XS4All Webdisk - web space management utility for the Dutch ISP"
N Xanadu Xanadu.exe"Xanadu - free language and translation wizard from Foreignword"
? XboxStat XboxStat.exe"Xbox 360 related. What does it do and is it required?"
? xBrotherMeCom BrMeCom.exe"Related to Brother MFC-9200c printer. What does it do and is it required?"
U xbtl bootldr.exe"Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X xcanxbwv axcvqvzk.exe"Added by the RANDEX.AR WORM!"
X xccinit rundll33.exe xccdf16_090131a.dll"Added by the BUZUS-AD TROJAN! Note - the ""rundll33.exe"" file is located in %System%\inf and the ""xccdf16_090131a.dll"" file is located in %Windir%"
X xccinit rundll33.exe xccdf16_090305a.dll"Added by the BUZUS-AF TROJAN! Note - the ""rundll33.exe"" file is located in %System%\inf and the ""xccdf16_090305a.dll"" file is located in %Windir%"
X xcfdhtyjkx keepSafe.exe"Added by the KILLAV.KAX TROJAN!"
X Xcpy1 Xcpy1.exe"FlashEnhancer adware"
X xcxdsaa7 slcskxsdl7.exe"Added by the ONLINEG-K TROJAN!"
U XDeskCal XDeskCal.exe"""XDeskCal is a fully customizable Desktop calendar that will allows users to display 'to do' list
X xDRam rar procx xwinupdaterarx.exe"Added by the RILER-W TROJAN!"
X xdxqa dewa.exe"Added by the SDBOT-YB WORM!"
U XE 8x LM Status lmsxxe.exeXerox XE8 series laser printer status monitor
X Xecuter.bat psexec.bat"Added by the BOOHOO WORM!"
U XemiCo ADC.EXE"XemiComputers Active Desktop Calendar"
U XemiComputers Scheduler Scheduler.exe"Smooth Program Scheduler from XemiComputers ""will start any program you want at a scheduled time"""
X xerox Twain.exe"Added by the AGENT.CBLX TROJAN!"
U Xerox PanelMgr SSMMgr.exe"Monitors ink levels
? XeroxEndeavorBackgroundTask xGKOHbgnd.exe"Associated with a Xerox multifunction and/or scanner. What does it do and is it required?"
N XeroxRegistation EReg.exeRegistration reminder from Leader Technologies for software from Xerox
U XeroxScannerDaemon XrxFTPLt.exe"Xerox Scanner Daemon - driver for Xerox Scanner model fu621d"
? XeroxScanUtility xrxzipui.exe"Associated with a Xerox multifunction and/or scanner. What does it do and is it required?"
U XFilesDialog XFilesDialog.EXE"""XFilesDialog is designed to improve all the (more or less standard) Windows file dialogs (Open / Load / Save)"""
Y XFILTER xfilter.exe"Filseclab Personal Firewall Professional Edition"
N Xfire Xfire.exeTerratec DMXFire 1024 soundcard control panel
U Xfire Music xfiremusic.exe"XfirePlus Music plugin is a program written to display your currently playing music into your Xfire Status. Currently the program supports 10 different music players and is packed with features to make it work just for you"
X xflash xflash.exe"Added by the BANCJ-A TROJAN!"
X xftpGraber Xftpgraber.exe"Added by the ENVID.C WORM!"
? XGIWatchDog XWatDog.exe"Related to XGI Technology's Volari graphics cards - what does it do and is it required?"
X XHFHGEBDbadw XHFHGEBDbadw.exe"Added by the AGENT-NHN TROJAN!"
X xhi xhi.exe"Added by the SCLOG-A TROJAN!"
X xhrmy Xhrmy.exe"HyperLinker adware"
X xibquxs rnxntup.exe"Added by a variant of the ORCU.B TROJAN!"
? xicon xicon.exe"Part of the IBM/XPoint Rapid Restore utility. What does it do and is it required?"
X XiD mmx.exe"Added by the ANALOGX TROJAN!"
X xInsIDE xInsIDE.exe"Added by the ADLOAD.BH TROJAN! Note - this should not be confused with the valid IDE configuration utility from JMicron Technology which is normally located in %Windir%\RaidTool and uses the same filename. This one is located in %ProgramFiles%\xInsIDE"
U xInsIDE xInsIDE.exe"JMB36x series IDE (or Parallel ATA) configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers. This is normally located in %Windir%\RaidTool"
Y XircWinModem4 ltcm000c.exe"WinModem drivers. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information"
U xitami Xiwin32.exe"Xitami Multiplatform Open Source web server"
? xkstartup "RunDll32 InstZ82.dll SetUsbPrinterPort"
X xload [path to trojan]"Added by the VB-AGP TROJAN!"
X xload32 netdd.exe"Added by the NETSPY TROJAN!"
X xloadnet xloadnet.exeAdded by the VB.NCK TROJAN!
X XML Service msxml.exe"Added by the RBOT-HD WORM!"
X XMLmedia 10.0 wmsdkns.exe"Added by the FAKEALERT TROJAN!"
X xmnfuruwk rnxntup.exe"Added by the ORCU.B TROJAN!"
X xmstart xuming.exe"Added by the GMIN-A WORM!"
U Xnet2 xnet2.exe"Green Dam Youth Escort content control software. Internet filtering software that the Chinese government requires to be installed on all new computers sold in China after July 1
X XNSearchAssistant SrchAsst.exeiWon Search Assistant - spyware
Y XoftSpy XoftSpy.exe"XoftSpy antispyware software by Pareto Logic"
X xor svchost.exe"Added by the XORDOOR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""xor"" subfolder"
X xor svshost.exe"Added by the AGENT.DC TROJAN!"
X Xordate wuauclt10.exe"Added by the RBOT-GKN WORM!"
X Xordate wuauclt11.exe"Added by the RBOT-GLI WORM!"
X Xordate wuauclt12.exe"Added by the RBOT-GLQ WORM!"
X Xordate wuauclt13.exe"Added by the RBOT-GLM WORM!"
X xp winis.exe"Added by the RBOT-WO WORM!"
X Xp p2pnetworking.exe"Added by the SDBOT.XA WORM!"
X XP Antispyware 2009 XP_AntiSpyware.exe"XP AntiSpyware 2009 rogue spyware remover - not recommended
X XP Antivirus xpantivirus.exe"XPAntivirus rogue security software - not recommended
X XP Antivirus xpa.exe"XP Antivirus rogue security software - not recommended"
X XP Cleaner xpc.exe"XP Cleaner rogue cleaning utility - not recommended
X XP HOT FIS kbx.exe"Added by the FORBOT-GS WORM!"
X XP Loader loaderxp.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
X XP Protection Center XPProtectionCenter.exe"XP Protection Center rogue security software - not recommended
X XP SecurityCenter XPSecurityCenter.exe"XPSecurityCenter rogue security software - not recommended
X XP Service Pack xpservicepack.exe"Added by the SDBOT.AQA WORM!"
X xp service pack 2 xpsp2.exe"Added by the RBOT-KW WORM!"
X XP System systemxp.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
U XP Tools xptools.exe"XPTools - ""integrated suite of powerful PC Utilities to fix
X XP-C300C3AC XP-C300C3AC.EXE"Added by the AUTORUN.EHW WORM!"
X xp32win xpupdater02.exe"Added by the MOSUCK-A TROJAN!"
N Xpadder Xpadder.exe"""Xpadder simulates the keyboard and mouse using your gamepad"""
? XPAgent XPAgent.exe"Part of the IBM/XPoint Rapid Restore utility - normally located in %ProgramFiles%\XPOINT\AGENT folder. Appears as a service in XP/Vista and under the ""RunServices"" registry key in Win98. What does it do and is it required?"
X XPAgent XPAgent.exe"Detected by Panda as the CLICKER.LE TROJAN! Do not confuse this with the IBM/XPoint Rapid Restore file which is normally located in %ProgramFiles%\XPOINT\AGENT folder. This one is found in %System%"
X XPAntivirus XPAntivirus.exe"XPAntivirus rogue security software - not recommended
X XpAspy [path to trojan]"Added by the DELF-WH BACKDOOR!"
? xpcfg xpcfg.exe"??"
? Xpclient xpclient.exe"Part of the IBM/XPoint Rapid Restore utility. What does it do and is it required?"
U XPCMonitor XPCMonitor.exe"XPC Monitor Keylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X XPCPHOST Settings xpcphost.exe"Added by a variant of the RBOT WORM!"
X XPdefender XPdefender.exe"XPdefender rogue spyware remover - not recommended
X XPGuard XP-Guard.exe"XP-Guard rogue security software - not recommended
X xpiupdate xpiupdate.exe"Added by the RBOT-AAB WORM!"
U xPlanetControl xPlanetControl.exe"Tool that displays a globe with current day/night zones and clouds on users desktop."
U Xplay XPlay.exe"Xplay 3 from Mediafour Corporation - ""expands what you can do with any iPod
U XPlay.exe XPlay.exe"Xplay 3 from Mediafour Corporation - ""expands what you can do with any iPod
X Xplorer Xplorer.exe"Added by the AUTOIT-BP WORM!"
X Xplorer KHATRA.exe"Added by the AUTOIT.K TROJAN!"
X Xpnet NetXp.exe"Added by the BANCBAN-AT TROJAN!"
X xpprotect xpdeluxe.exe"XP Protector Deluxe rogue security software - not recommended
X XPShield XP-Shield.exe"XP-Shield rogue security software - not recommended
X XPSoft CVDAsDW.exe"Added by the SDBOT-SY WORM!"
X XPSP2 Firewall xpsp2fw.exe"Added by the SMALL-RN TROJAN!"
X xpsp2install xpsp2Update.exe"Added by the AGENT-DPK BACKDOOR!"
X xpsp2Update xpsp2Update.exe"Added by the AGENT-DPK BACKDOOR!"
X xpstart wini.exe"Added by the PICRATE.A WORM!"
X xpstat winlogins.exe"Added by the RBOT-AAR WORM!"
X XPsys XPsys.exe"Added by the DELF-KQ TROJAN!"
X xpsystem y.exe"CoolWebSearch parasite variant"
X Xpsystem SERVICES.EXE"Added by the DAEMOZ.A TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %System%\SERVICES"
X xpsystem services.exe"CoolWebSearch parasite variant. Note - this is not the legitimate services.exe process
X xpsystem MSXMIDI.EXE"CoolWebSearch parasite variant
X xpupdate updates.exe"Added by the BROPIA.L WORM!"
X XpyBurner XpyBurner.exe"XpyBurner rogue spyware remover - not recommended
X xp_system [filename]"Added by the BOOKMARKER.J TROJAN! The file is located in %Windir%\inet20004"
X xp_system winlogon.exe"Added by the KREPPER-G TROJAN! - a CoolWebSearch parasite variant. Note - this is not the legitimate winlogon.exe
X xp_system services.exe"Added by the KREPPER-N TROJAN and variants! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The one is located in a %Windir%\inet***** - where ***** varies dependent upon the variant
X xrt_Shell xrt_****.exe"XRT spyware"
X xrt_Shell xrt_brel.exe"Added by the AGENT.AJAT BACKDOOR!"
X xSafe xSafe.exe"Added by the SILLYFDC.BAY WORM!"
U XSC SIP Client X-Lite.exe"""CounterPath's X-Lite 3.0 is the market's leading free SIP based softphone available for download"". For VOIP and broadband users"
X xserv [path to trojan]"Added by the STUMPY-A TROJAN!"
U XStop95 XStop95.exe"XStop - internet filter"
X xswdmse [8 random letters].exe"Added by a variant of the SPYBOT WORM! See here"
N xswin xswin.exe"Installed with a Xerox Work Centre Pro 555. Unchecking it removes an ""out of system memory"" error"
? XTCsgloader XTCsgloader.exe"Another Xupiter toolbar variant??"
X XTN Service Drivers winxtn.exe"Added by the SDBOT-YK WORM!"
U XTNDConnect PC XCPCMenu.exe"XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
U XTNDConnect PC - 3CmPlm Autodet.exe"3Com Palm PC specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
U XTNDConnect PC - CasioOrg CasAgnt.exe"Casio Pocket PC specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
U XTNDConnect PC - ErPhn2 ErTray.exe"Sony Ericsson IrMC (Infrared Mobile Connectivity) phones and smartphones specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
U XTNDConnect PC - LtNts4 NtsAgnt.exe"(IBM) Lotus Notes 4 specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
U XTNDConnect PC - MyPalm MPTray.exe"Palm OS specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
U XTNDConnect PC - PocketPC AutoDetect.exe"Windows Mobile Pocket PC specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list