Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer


NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.


  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown

Startup Name Process Name Details
X*Windows [filename] Checker[filename]"Added by the KEDEBE-B WORM!"
X;Rundll[filename]"Added by the PWSLEGMIR.E TROJAN!"
XcAgOu[filename].hta"Added by the KAKWORM WORM!"
Xexplorerwscript.exe [filename]"Sneaky way to start any VBS script. Many viruses use VBS files. Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
XGustavVED[filename].exe"Added by the OPASERV.H WORM!"
Xhen[filename].exe"Added by the TARNO.G TROJAN!"
XJavaUpdate0.07[filename]"Added by the JUPDATE TROJAN!"
XLocator Service[filename]"Added by the AGOBOT-KY TROJAN!"
XLowVersionSupport[filename]"Added by the LASTRAS TROJAN!"
XMantis[filename]"Added by the MANTIBE VIRUS!"
XMatrixScreen[filename]"Added by the MATRIXSCREEN TROJAN!"
XMedia Services[filename].exe"Added by the AGENT-BA BACKDOOR!"
XMicrosoft IIS[filename]"Added by the FRANCETTE-S WORM!"
XMicrosoft Java Windows Update[filename]"Added by the RBOT-DZ WORM!"
XMicrosoft Security Panager[filename]"Added by the RBOT-ANL WORM!"
XMyapp[filename]"Added by the FATEE.B WORM!"
XNavScan[filename]"Added by the OBSORB TROJAN!"
XOLE[filename]"Added by the STAWIN or TARNO.D TROJANS!"
Xputil[filename]"Added by the LDPINCH TROJAN!"
XScanreg[filename]"Added by the QQPASS.E TROJAN!"
XService Host[filename].exe"Added by the TORVEL.B WORM!"
YSpybotDeleting*****[cmd or command] /c del [path] [filename]"Generated by Spybot Search & Destroy if it encounters files that cannot be deleted during runtime because they are locked by other processes. For example
Xstdlib[filename]"Added by the PERDA-E TROJAN!"
XsyelimS-esreveR-troppuS[filename]"Added by the LITBOT.C TROJAN!"
XSystem Update[filename].exe"CoolWebSearch parasite variant"
Xupme[filename]"Added by the MUGLY.F WORM!"
XUser32[filename]"Added by the NETTRASH TROJAN!"
XUserSystem[filename]"CoolWebSearch Smartsearch parasite variant. Also detected as the SEARCH-A TROJAN!"
XVideoDriver[filename]"Added by the GSPOT20.A TROJAN!"
XWindows Explorer[filename].exe"Added by the SDBOT TROJAN!"
XWindows Update[filename]"Added by the NORIO TROJAN! Acts as a hi-jacker redirecting to adult content sites"
Xworknote1[filename].exe"Added by the MEETOT WORM!"
Xxp_system[filename]"Added by the BOOKMARKER.J TROJAN! The file is located in %Windir%\inet20004"
XZaCker[filename].PIF"Added by the HOLAR.A WORM!"
X[filename]svchost.scr"Added by the BANKER-CC TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.