%Number%

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	*WinLogon	[trojan path] ren time:[random number]	"Added by the VUNDO TROJAN!"
X	avp	win.tmp.exe [ is a number]	Added by a variant of the ALPHABET TROJAN!
X	cftmon32	taskmgr.exe [ = number]	"Added by the SOWSAT.C and SOWSAT.J WORMS!"
X	ctfmon	taskmgr32.exe [ = number]	"Added by the SOWSAT.B WORM!"
X	Dx	sys.exe [ = random number]	"Added by the DEXTER.A WORM!"
U	E_S[numbers]	[path] E_[various].EXE [path] E_S[numbers].tmp	"Temporary entry related to Epson Status Monitor 3 for their range of printer and AIO devices - for monitoring printer status
U	ImageDrive-{hex numbers}	ImageDrive.exe	"Nero ImageDrive from Ahead - virtual CD/DVD drive software"
U	Intel Product Number Utility	IntelProcNumUtility.exe	"Intel Processor Serial Number Control Utility allows you to enable and disable the processor serial number capability of an Intel PIII processor. You can find more information here. System Tray icon providing the user with a visual state indication. You can find more information here"
U	IntelProcNumUtility	cpunumber.exe	"Intel Processor Serial Number Control Utility allows you to enable and disable the processor serial number capability of an Intel PIII processor. You can find more information here. System Tray icon providing the user with a visual state indication. You can find more information here"
X	Internal	regedit.exe /s c[month number]	"Added by the FORTNIGHT.D TROJAN! Note that the Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file ""c[month number]"" is located in %Windir%
X	keyboard	keyboard.exe [ = number]	"Detected by Kaspersky as the VB.ZG TROJAN!"
X	Malware Cleaner	[random numbers].exe	"Malware Cleaner rogue security software - not recommended
X	NumberOneMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Optim[NUMBER]	[path] egdtopt.exe	"Added by the RAMVICRYPE TROJAN!"
X	PAV.EXE	%Number%	"Added by the KITRO.D (or ARGEN.A) WORM! %Number% can be any number"
X	SearchSquire[number]	SearchSquire[number].exe	"SearchSquire adware"
U	SecureOnlineAccountNumbers	SOAN.exe	"Related to Secure Online Account Numbers by Discover(R) Card from Orbiscom Ltd. Secure and innovative payment solutions"
X	Shell	Explorer.exe [path] ibm[RANDOM 5 DIGIT NUMBER].exe	"Added by the ANSERIN TROJAN! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files"
X	ttool	[random numbers].exe	"Added by the BCKDR-QII BACKDOOR! The filename seen most often is ""9129837.exe"""
X	x[Number from 1 to 7]	x[Number from 1 to 7].exe	"Added by the DADOBRA-A TROJAN!"
X	[14 random numbers]	mradll.exe	"Green AV rogue security software - not recommended
X	[14 random numbers]	rwg.exe	"Green AV rogue security software - not recommended
X	[32 random hex numbers]	tsc.exe	"Total Security rogue security software - not recommended
X	[32 random hex numbers]	badware-protector.exe	"Badware Protector rogue security software - not recommended
X	[32 random numbers]	av2009.exe	"AntiVirus 2009 rogue security software - not recommended
X	[32 random numbers]	av360.exe	"Antivirus 360 rogue security software - not recommended
X	[32 random numbers]	AVS.exe	"Antivirus Sentry rogue security software - not recommended
X	[32 random numbers]	xpa.exe	"XP Antivirus rogue security software - not recommended"
X	[32 random numbers]	total.exe	"Total Antivirus rogue security software - not recommended
X	[decimal number]	[path to worm]	"Added by the OPOSSUM-A WORM! The decimal number can be anything
X	[random number]	"rundll32.exe shell32.dll	Control_RunDLL [random number].cpl"
X	[random number]	explorer.exe	"Added by the KEYLOG-AN TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%\service"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.