Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown
Startup Name Process Name Details
U XTNDConnect PC - ScheduleSync SCHEDU~1.EXE"ScheduleSync specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
X Xtray xtray_link.exe"Added by the VB.JL TROJAN!"
U XtreamLok License Manager xl.exe"License manager for xLok (XtreamLok) - prevents software being reverse engineered"
U Xtrem parental control pcx.exeParentXtreme - surveillance software. Uninstall this software unless you put it there yourself
X XTServiceUpdate XTServiceUpdate.exehahame.net adware downloader
X XtTb.exe XtTb.exeTop-banners.com adware
? xuio.exe xuio.exe"??"
X Xupiter Startup XupiterStartup.exe"Xupiter - adware and homepage hijacker. Use Spybot S&D
X XupiterCfgLoader XTCfgLoader.exe"Xupiter - adware and homepage hijacker. Use Spybot S&D
X XupiterCfgLoader BWCfgLoader.exe"Xupiter - adware and homepage hijacker. Use Spybot S&D
X xupiterstartup2003 xupiterstartup2003.exe"Xupiter - adware and homepage hijacker. Use Spybot S&D
X XupiterToolbarLoader XupiterToolbarLoader.exe"Xupiter - adware and homepage hijacker. Use Spybot S&D
U xv_ctrl v_ctrl.exe3dfx Underground Tools - "Gives direct hardware control to your video graphics adapter"
X xware xware.exe"Malware downloader from xxsware.com
X xware cskware.exe"Malware downloader from xxsware.com
? XWMSUSBAPI XWMSAPI.EXE"Part of the installation of a Xerox WorkCentre printer/scanner. Is it required?"
X xxcm sys.exe"Added by the KRISWORM-A WORM!"
X xxsrSrv32 xxsrsrv.exe"Added by the BANCSDE-E TROJAN!"
X XXXmpeg XXXmpeg.exeAdult content dialler
X xxxvideo xxxvideo.exe"AccessPlugin premium rate adult content dialler"
X xy svhost32.exe"Added by the LINEAG-ABB TROJAN!"
X xzkadsfk10 afslkfasl10.exe"Added by the ONLINEG-R TROJAN!"
X x[Number from 1 to 7] x[Number from 1 to 7].exe"Added by the DADOBRA-A TROJAN!"
X x~{{dybel x~{{dy8%nsn"Added by the AGOBOT.DQ WORM!"
U Y!TunnelBasic YTBasic.exe"Y!TunnelBasic software provides additional features to Yahoo! Messenger"
U Y!TunnelPro YTunnelPro.exe"Spam
U Y!TunnelPro YTPro.exe"Spam
U Y'z Shadow YzShadow.exe"Y'z Shadow 'adds a shadow effect to the windows in pursuit of the ""beauty of a shadow"". It also allows the user the option of making menus transparent'"
U Y'z Toolbar YzToolBar.exe"Y'z Toolbar ""allows the user to change the toolbar icons in Explorer and Internet Explorer. The user can also create and add their own themes"""
X y1959sar sv711224030r.exe"Added by the BRONTOK-AK WORM and variants!"
X y1959sar yesbron.com"Added by the BRONTOK-AK WORM and variants!"
X Ya Salam NancyAjram.exe"Added by the JALABED WORM!"
? YaAutoRepair yrepair.dll"Appears to be related to software from Yahoo China. What does it do and is it required?"
X yaemu.exe yaemu.exeAdded by the WIN32.DNSCHANGER.S TROJAN!
X yahoo groups upgrdmgr.exe"Added by a variant of the RBOT WORM!"
? Yahoo HP Reminder 1.1 yr.exe"??"
X yahoo inc. ypages.exeAdded by a variant of the SDBOT.62235D21 WORM!
X Yahoo Instant Messengar YahooMsgr.exe"Added by the SDBOT.GEN TROJAN!"
X Yahoo Messenger Yahoomsg.exeAdded by an unidentified WORM or TROJAN!
X Yahoo Messenger YPager.exe"Added by the RBOT-QO BACKDOOR! Note - this is not the older version of Yahoo! Messenger which shares the same filename and is located on %ProgramFiles%\Yahoo!\Messenger. This one is found in %System%"
X Yahoo Messenger svchost32.exe"Added by the SOHANA-P WORM!"
X Yahoo Messengger SVICHHOST.exe"Added by the TIOTUA-C TROJAN!"
X Yahoo Messengger RVHOST.exe"Added by the SILLYFDC-G WORM!"
X Yahoo Messengger SSVICHOSST.exe"Added by the SOHANA-R WORM!"
X Yahoo Messengger SCVHOST.exe"Added by the SOHANA-V WORM!"
X Yahoo Messengger SCVHSOT.exe"Added by the HAKAG-A WORM!"
X Yahoo Messengger SCVVHSOT.exe"Added by the SILLYFDC-AE WORM!"
X Yahoo Messengger SSCVIHOST.exe"Added by the SOHANA-W WORM!"
X Yahoo Messengger SSCVIIHOST.exe"Added by the SOHANA-Y WORM!"
X Yahoo Messengger regsvr.exe"Added by the IMAUT.CN WORM!"
X Yahoo Messengger chrome.exe"Added by the AUTORUN-NG WORM!"
X Yahoo Messengger gphone.exe"Added by the TIOTUA-W WORM!"
X Yahoo Messengger IEXPLORERS.exe"Added by the AUTOIT.DH TROJAN!"
X Yahoo Messengger RVHIOST.exe"Added by the SOHANNA-AC WORM!"
X Yahoo Messengger scvhosts.exe"Added by the SOHANNA-AH WORM!"
X Yahoo Messengger scvshosts.exe"Added by the TRAX-A WORM!"
X Yahoo Messengger SSVICSSHOST.exe"Added by the IMAUT.AA WORM!"
X Yahoo Messengger SVICHOOST.exe"Added by the SOHANNA-AE WORM!"
X Yahoo Messengger system3_.exe"Added by the AUTORUN-AOA WORM!"
X Yahoo Messengger winfiles.exe"Added by the AUTORUN-BCY WORM!"
X Yahoo Update Yahoo!.exe"Added by the YAHOO! TROJAN!"
X Yahoo Update Yahoo.exe"Added by the RBOT.AH BACKDOOR!"
X Yahoo Updater Messenger.exe"Added by the FORBOT-FE WORM!"
X yahoo! "rundll32.exe [random]don.dllSet"
X Yahoo! ethernet.exe"Added by the PROSTI.AA BACKDOOR!"
N Yahoo! Friend YahooFriend.exe"Yahoo!_Friend - plug-in for Yahoo! Messenger that add lots of emoticons and windows effects"
U Yahoo! Mail YMailAdvisor.exe"Yahoo! Mail Advisor - informs you of any changes to your Yahoo! Mail settings (i.e.
X Yahoo! Messanger ymsngr32.exe"Added by the WOOTBOT.HY WORM! Note - this should not be confused with Yahoo! Messenger"
N Yahoo! Messenger ypager.exe"System tray access to an older version of the Yahoo! Messenger instant messenger"
N Yahoo! Pager ypager.exe"System tray access to an older version of the Yahoo! Messenger instant messenger"
N Yahoo! Pager YAHOOM~1.EXE"System tray access to an older version of the Yahoo! Messenger instant messenger"
N Yahoo! Pager YahooMessenger.exe"System tray access to an older version of the Yahoo! Messenger instant messenger"
U Yahoo! Widget Engine YahooWidgetEngine.exe"Yahoo! Widget Engine lets you run little files called Widgets that can do pretty much whatever you want them to"
U Yahoo! Widgets YahooWidgets.exe"Yahoo! Widgets lets you run little files called Widgets that can do pretty much whatever you want them to"
X Yahoo2000 Anti.exe"Added by the RBOT.ATK WORM!"
X Yahoo2000 Anti.exe"Added by an unknown Malware
N YahooMessenger YahooMessenger.exe"System Tray access to the Yahoo! Messenger instant messenger"
U YahooMonitor YahooMonitor.exe"Yahoo Messenger Monitor Sniffer surveillance software for the Yahoo! instant messenger. Uninstall this software unless you put it there yourself"
X yahoomsgr Yahoomsngr.exe"Added by the AGOBOT.AKZ WORM!"
X YahooStock [path to file]"Adtomi adware"
X yahoo_toolbar lptt01 yahoo_toolbar.exe"RapidBlaster variant (in a ""yahoo_toolbar"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X yahoo_toolbar ml097e yahoo_toolbar.exe"RapidBlaster variant (in a ""yahoo_toolbar"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
? YAMAHA AC-XG Power Utility yacpower.exe"YAMAHA AC-XG Power Utility. What does it do and is it required?"
N YAMAHA DS-XG Launcher dslaunch.exeSystem Tray access for the features of the Yamaha DS-XG soundcard unless you regularly change set-ups
N Yankee Clipper III YankClip.exe"Yankee Clipper III - 'A super powerful Windows clipboard extender/memory - now in its third generation. Handles Pictures
U Yapta Tracker YaptaClient.exe"Yapta ""make it easy for you to secure the best airfare deals available on the Web. We do this by giving you a tool to ""tag"" the trips you like while shopping online
X yay.exe asass.exe"Added by the AGOBOT-M WORM!"
N YBrowser ybrwicon.exeSBC Yahoo! Browser system tray icon
U YCentral YahooCentral.exe"Yahoo! Central - ""alerts you if your default home page
X YDTMain.exe YDTMain.exe"180solutions adware"
X yeahdude.exe hallowelt.exe"Added by the GAOBOT.RS or GAOBOT.SA WORMS!"
X yemarvd sysmon.exe"Added by the AGENT-CH TROJAN!"
N YeppStudioAgent SamsungMediaStudioAgent.exe"Samsung Media Studio MP3 player file management software - see here for an example"
X YhooUapdates ymssmsgs.exe"Added by a variant of the SMALL_K TROJAN!"
X YhooUpdates ymsmsgs.exe"Added by the SMALL_K TROJAN!"
X ying ying.exe"Constructor VC2000 malware"
N YLive.exe Ylive.exe"Yahoo! Assistant (formerly 3721 Internet Assistant) - not recommended"
U YMailAdvisor YMailAdvisor.exe"Yahoo! Mail Advisor - informs you of any changes to your Yahoo! Mail settings (i.e.
N ymetray ymetray.exe"Yahoo! Music system tray icon"
X ynavmrcd.exe ynavmrcd.exe"Added by the DLOADR-AVC TROJAN!"
N YOP yop.exe"Dashboard Module for SBC Yahoo! Online Protection"
U You've Got Pictures Screensaver ygpsstra.exeAOL You've Got Pictures Screensaver
X Your Protection urpprot.exe"Your Protection rogue security software - not recommended
X YourMP3 "rundll32.exe MSA64CHK.dllDllMostrar"
X YourPrivacyGuard GDC.exe"YourPrivacyGuard rogue privacy tool - not recommended
? YOW tuner WatchPNM.exe"??"
N ypager ypager.exe"System tray access to an older version of the Yahoo! Messenger instant messenger"
N Ypager.exe ypager.exe"System tray access to an older version of the Yahoo! Messenger instant messenger"
U YPC ypc.exe"Yahoo Parental controls - ""Let you decide what type of sites and Yahoo! services your kids can access"""
U YPOPs YPOPs.exe"YPOPs! - an application that provides POP3 access to Yahoo! Mail. Yahoo! Mail disabled free access to its POP3 service in 2002. This application emulates a POP3 server and enables popular email clients like Outlook
U YPOPs YPOPs"YPOPs! - an application that provides POP3 access to Yahoo! Mail. Yahoo! Mail disabled free access to its POP3 service in 2002. This application emulates a POP3 server and enables popular email clients like Outlook
U YSearchProtection SearchProtection.exe"""Yahoo! Search Protection will alert you if an attempt is made to change your default browser search engine from Yahoo!"""
Y YTrayMagic Lite 1 YTRAYMAGIC.EXE"YTrayMagic from YoconSoft automatically restores your tray icons after an Explorer(the windows shell) crash. Leave to run at startup since only those icons that are in the taskbar after YTrayMagic has initialized will be restored"
U Yumgo's Homepage Protector V1 YumgoHomepageProtector.exe"Yumgo's Homepage Protector"
X ywwvc.exe ywwvc.exe"Added by the STARTPA-HR TROJAN!"
X ywzizdon ywzizdon.exeFree_Scratch_Cards foistware
X yx uu.exe"Added by the AGOBOT-YX WORM!"
X yyyyyyyy [path to trojan]"Added by the MUMUBOY.B TROJAN!"
X yz.exe yz.exe"Added by the VARDO TROJAN!"
X YZH YZH.exe"Added by the LEGMIR-BM VIRUS!"
X YZH.SYS YZH.exe"Added by the PHILIS.C VIRUS!"
X Z zmon.exe"Added by the DELBOT-AO WORM!"
U z-WrDialer WrDialer.exeWinPoet DSL dialer
X ZaCker [filename].PIF"Added by the HOLAR.A WORM!"
X Zacker Zacker.exe"Added by the GEMEL WORM!"
X ZagrebLand [trojan filename]"Added by the RENOS-EH TROJAN!"
X zango zango.exe"180solutions adware"
X Zango SiteFinder ZangoSiteFinder.exe"ZangoSearch adware variant"
X Zango TvTimes ZANGOT~1.EXE"ZangoSearch adware"
X ZangoOE OEAddOn.exe"Zango Search Assistant adware"
X ZangoSA ZangoSA.exe"Zango Search Assistant adware"
X zanu zanu.exe"ZangoSearch adware"
Y Zapro Zapro.exe"Firewall program from Zonelabs - paid for version"
U Zboard Zboard.exe"Ideazon Zboard gaming software"
U ZboardTray ZboardTray.exe"Ideazon Zboard gaming keyboard driver - allows you to customise keyboard functions"
U zBrowser Launcher iTouch.exe"Loads the iTouch configuration settings for supported Logitech keyboards. It's required if your keyboard has shortcut buttons and you use them or have reconfigured them for different functions. It's also required if your keyboard does not have the num lock
U zBrowser Launcher Commandr.exe"For a Logitech internet keyboard - loads the software for the shortcut keys on the keyboard. Also used to display your keyboard LEDs on-screen to indicate Caps Lock
? zcb zcb.exe"??"
U Zcfgsvc ZCfgSvc.exe"Zero Config MFC Application
U ZCfgSvc.exe ZCfgSvc.exe"Zero Config MFC Application
X zcproo qssstiej.exe"Possible homepage hijacker installing a toolbar: http://tdko.com/
X zcseacrt [random filename]"Added by a variant of the SLAPER TROJAN!"
? ZDConfig ZDConfig.exe"Related to various brands of Wireless USB LAN Adapter - what does it do and is it required?"
N zdnet kontiki.exe"Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops"
N Zebus msdc32.exeRuns a HTML tutorial on the Zebus web-site
X Zekio Startups znksvc32.exe"Added by the AGOBOT-AGI WORM!"
X Zekio Startups condll.exe"Added by the AGOBOT-AGD WORM!"
X Zen.A [path to trojan]"Added by the ZOOMEN-A TROJAN!"
X Zenet "rundll32 CNBabe.dll DllStartup"
X Zeno [random filename]"ZenoSearch adware"
X Zeno nwinrqez.exe"Added by the QEXREZ family of TROJANS!"
Y ZENRC zenrc32.exe"The main component of Novell's ZenWorks - "Complete End-to-End Directory-enabled Network Management". Leave well alone"
Y ZENRC Tray Icon zentray.exe"Part of Novell's ZenWorks - "Complete End-to-End Directory-enabled Network Management". Best left alone"
Y ZENworks Imaging Service ZISWin.exe"Imaging Agent. Part of Novell's ZenWorks - "Complete End-to-End Directory-enabled Network Management""
U Zero PoPup Killer XP zpk_xp.exe"Intelligent anti-pop-up software product by Ax-Soft"
U ZeroAds 0"ZeroAds - culls ads
U ZeroAds LAS0Ads.exe"ZeroAds - culls ads
U ZeroAds Zeroads.exe"ZeroAds - a popular Internet accelerator and anti-adware application"
U ZeroSpyware ZeroSpyware.exeFBM Software ZeroSpyware 2004 spyware detector and remover
X zervpack2 update2.exe"Added by the SDBOT.WD WORM!"
X zggjmyd zggjmyd.exe"Added by the AFCORE.O BACKDOOR!"
? ZGNUBI ZGNUBI.exe"??"
X Zi5 AntiVirus Update.exe"Added by the ERKEZ.G WORM!"
U ZIBMACC rundll.exe ZIBMACC.INFZIBMACC.INF is an IBM file that is only loaded and installed under a recovery operation. The file is a support file for IBM access to the system if needed. You may delete this file. This is as from IBM Technical Support (USA - 800-887-7435)
X Zinaps7 Zinaps7.exe"Zinaps Anti-Spyware 2008 rogue security software - not recommended
X ZincgrubInc Lsass.exe"Added by the VOUMIT-A WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Root%\mirc32"
U ZingSpooler ZingSpooler.exeWas used for a drag and drop program to upload pictures to www.zing.com but Zing has gone out of business. Now used for Sony ImageStation's upload photos to online albums
N Zinio DLM ZDLM.EXE"Zinio - used to read magazines in digital rather than paper format"
N Zinio DLM ZinioDeliveryManager.exe"Related to Zinio used to read magazines in digital rather than paper format"
X Zip Driver Loader ZipLoader32.exe"Added by the OBLIVION TROJAN! This executable is one of the most common but there are more"
X Zip Driver Loader msload32.exe"Added by the OBLIVION TROJAN! This executable is one of the most common but there are more"
U ZipDisk Icons IMGICON.EXE"Displays Iomega icons in Explorer/My Computer
N ZipGenius Clean zg.exe"ZipGenius file compression utility"
X ziphelp ziphelp.exe"CoolWebSearch parasite variant"
N ZipMagic zm32.exe"Zip utility by Ontrack. Preloading ZipMagic allows you to access files within a zip archive without unzipping them first"
Y zlclient zlclient.exe"Firewall program from Zonelabs. Pro version inlcudes other online security options"
U ZLH ZLH.EXE"System Tray icon for Norman Antivirus"
U ZMatrix matrix.exe"ZMatrix - ""an animated desktop background which displays streaming characters in a style similar to what was used in the movie 'The Matrix'"""
X ZNN znnsvc.exe"Added by the SDBOT-DAA WORM!"
X Zolero Translator ZoleroTranslator.exe"Zolero Translator - added by Clickspring
X Zonavirus 0"Added by the KITRO.D (or ARGEN.A) WORM!"
X Zone Alarm vsmon.exe"Added by the RBOT.BO WORM! If this was the ZoneAlarm firewall the name column would be TrueVector"
X zone alarm security zlclint.exe"Added by the NIRBOT WORM!"
Y Zone Labs Client zlclient.exe"Firewall program from Zonelabs. Pro version inlcudes other online security options"
X Zone Labs Client Ex svchost.exe"Added by the NETSKY.F WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X Zone system szchost.exe"Added by the MULTIDR-AC TROJAN!"
Y ZoneAlarm zonealarm.exe"Firewall program from Zonelabs - free version"
X zonealarm [random filename]"Added by an unidentified VIRUS
X Zonealarm Removeme.exe"Added by the FORBOT-BG WORM!"
X Zonealarm iexplore.exe"Added by the FORBOT-CP WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
Y ZoneAlarm Plus zaplus.exe"Firewall program from Zonelabs - paid for version"
Y ZoneAlarm Pro Zapro.exe"Firewall program from Zonelabs - paid for version"
X Zonesoft Cleaner rnsys.exe"Added by a variant of the SDBOT WORM!"
U ZoneUpdate csrss.exe"WinSpy surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""ComRoot"" subfolder"
U Zoom zoom.exe"Zoom - speeds up Windows startup and manages startup applications"
U Zooming ZoomingHook.exeToshiba Zooming Utility - found on Toshiba laptops and Tablet PCs. It allows users to zoom in (or magnify) text
U ZoomingHook ZoomingHook.exeToshiba Zooming Utility - found on Toshiba laptops and Tablet PCs. It allows users to zoom in (or magnify) text
Y ZPLED ZPKBDLED.exeDriver for the Advent ADE-AD2 Wireless Keyboard
X ZPoint winmuse.exe"Added by the DLOADR-VJ TROJAN!"
Y ZPOINT32 ZPOINT32.exeUSB graphics/writing tablet driver
X zSearch Zstb.exe"TotalVelocity zSearch parasite"
X zSecurity Service szsvc.exe"Added by the SDBOT-DAB WORM!"
X zsms smss.exe"Added by the BANCOS-CK TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X zsmscc rundll32.exe zsmscc071001.dll mymain"Added by the GENETIK.KQ TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""zsmscc071001.dll"" file is found in %System%"
X zsmscc rundll32.exe mycc071208.dll mymain"Added by the AGENT.FZK TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""mycc071208.dll"" file is found in %System%"
X zsmsgs iservice.exe"Added by the BANCOS-BU TROJAN!"
X zsmss smss.exe"Added by the BANCOS-DD TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U zSPGuard Spguard.exe""StartPage Guard (SPG) protects your PC from cyberscam
U ZSScheduler zsscheduler.dll"ZeroSpyware from FBM Software"
N ZSSnp211 ZSSnp211.exe"Vmicro webcam USB utility - allows the webcam to initiate data transfer to a program. Create a shortcut and start it manually when needed"
X ZStart [various filenames]"VX2.Transponder parasite updater/installer related"
X Zstart cxdxregt.exe"ZenoSearch adware"
X zt rundll32.exe"Added by the LINEAG-ABA TROJAN! Note - this is not the legitimate rundll32.exe process
X ZtgServerSwitch server.vbsZTGServerswitch is part of Sony's Vaio support agent - designed by Support.com. Not required if the user does not wish to use the Vaio support agent and regarded as spyware
N Zune Launcher ZuneLauncher.exe"Automatically launches the Zune software for Microsoft's Zune media players when they're connected to your PC. The software can be used to manage media
N ZuneLauncher ZuneLauncher.exe"Automatically launches the Zune software for Microsoft's Zune media players when they're connected to your PC. The software can be used to manage media

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list