[random filename]

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	(Default)	[random filename].exe	"Added by the BLACKMAL WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	*MS Setup	[random filename]	"Virtumondo adware
X	Aceu	[random filename]	"PurityScan adware"
X	Adobe Acrobat Reader CFG	[random filename]	"Added by a variant of the RBOT WORM!"
X	Agent Browser	[random filename]	Added by the PPdoor.M-bdr backdoor TROJAN!
X	Agent Explorer	[random filename]	Unidentified adware
X	AIM Instant Message Cookies	[random filename]	"Added by the RBOT-AFV WORM!"
X	Anti-Virus	[random filename].exe	"Added by the CAPROBAD-A TROJAN!"
X	AOL Messenger	[random filename]	"Added by an unidentified VIRUS
X	ara-key	[random filename]	"Added by the ANTINNY WORM!"
X	Avril Lavigne - Muse	[random filename]	"Added by the AVRIL-A WORM!"
X	BIOS XP Loader	[random filename]	"Added by the RBOT-IC WORM!"
X	Bnexe	[random filename]	"Added by the KITRO.D (or ARGEN.A) WORM!"
X	BrowserUpdateSched	[random filename]	"ZenoSearch adware"
X	ccApp	[random filename]	"Added by the OBSORB TROJAN! Note the random filename compared to the valid Norton AntiVirus"
X	cof.updit	[random filename]	"Added by a variant of the SDBOT WORM!"
X	Content connector	[random filename].exe	"Added by the DIALER-Y TROJAN! Note - uses a random filename and random folders. Usually the folder containing the file is a Temp folder"
X	crmssrlt	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	ctfmon32	[random filename].exe	"Added by the RBOT-GSN WORM!"
X	Danton*	[random filename]	"Added by the DANTON TROJAN! where * = random number"
X	ddivmwa	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	dll services	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	dllcvss	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	DRam prmaessor	[random filename]	"Added by the RBOT.CSG WORM!"
X	DRam prosesor	[random filename]	"Added by the SPYBOT.EE WORM!"
X	DRam prosessor	[random filename]	"Added by the RBOT.CSG WORM!"
X	educational writer	[random filename]	"Added by the RBOT-LZ WORM!"
X	example	[random filename].exe	"Added by the NUCLEAR BACKDOOR! Note - this trojan file is located in %Windir%\NR"
X	Expatch	[random filename]	"Added by the PWSLMIR-G TROJAN!"
X	expcrt	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	ExploreUpdSched	[random filename]	"ZenoSearch adware"
X	Fire Wall services	[random filename]	"Added by the IRCBOT-QY WORM!"
X	G4G	[random filename]	Detected as Trojan-Downloader.Win32.VB.fki
X	Ghost Relay	[random filename]	"Added by the DNSCHANG.EK TROJAN!"
X	GlobalSCAPE	[random filename]	"Added by the RBOT-AYM WORM!"
X	Google Earth	[random filename]	"Added by the RBOT-AXK TROJAN!"
X	HDAudio Driver 1.0	[random filename].exe	"Added by the TEADOOR-D TROJAN!"
X	HDAudio Driver 2.0	[random filename].exe	"Added by the TEADOOR-E TROJAN!"
X	hpsysconf1	[random filename]	"Added by a variant of the VIVIA.A TROJAN!"
X	idmlssp	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	ieupdate	[random filename]	"Added by the AGENT-C BACKDOOR!"
X	ifperx	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	Intranet Explorer	[random filename]	"Added by the POEBOT.DK BACKDOOR!"
X	ist service uninstall	[random filename]	"ISTBar adware related"
X	jcidls	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	JVM0.12	[random filename]	"Added by the TEADOOR-A TROJAN!"
X	JVM0.14	[random filename]	"Added by the TEADOOR-B TROJAN!"
X	jysyqm	[random filename]	"ZenoSearch adware"
X	Kadoc	[random filename].exe	"Added by the STAPREW TROJAN!"
X	kern64dll	[random filename]	"Added by the TARNO.J TROJAN!"
X	LoadOrderVerification	[random filename]	"Added by the TRON.A TROJAN!"
X	Managment Service	[random filename]	Added by the RBOT.BIS TROJAN!
X	mb2np	[random filename]	Added by the IRCBOT.TJ WORM!
X	MbarInstall	[random filename]	"Mirar adware"
X	Mickey Mouse Cereal	[random filename].exe	"Added by the RANKY.Q TROJAN!"
X	MicroLoad	[random filename]	"Added by the DARBY WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	[random filename]	"Added by the RBOT-ASM or RBOT-AUW WORMS!"
X	Microsft Upgraed	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	Microsft Windows Adapter 5.1.3013	[random filename]	"Added by the SMALL.HIT TROJAN!"
X	Microsoft (C) HTML Application host	[random filename]	"Added by the RBOT-YB WORM!"
X	Microsoft ADservice	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Anti-Spy	[random filename]	"Added by a variant of the SDBOT WORM!"
X	Microsoft Core Support	[random filename]	"Added by a variant of the RBOT TROJAN!"
X	Microsoft Corporation	[random filename]	"Added by various VIRUSES
X	Microsoft Diagnostic	[random filename]	"Added by the ACEBOT TROJAN!"
X	Microsoft DirktorWin	[random filename]	"Added by the SPYBOT.GEN3 TROJAN!"
X	MicroSoft Getway Dire	[random filename]	"Added by the IRCBRUTE.AM WORM!"
X	Microsoft IT Update	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Locals 332	[random filename]	"Added by the RBOT-KU WORM!"
X	Microsoft Security GManagers	[random filename]	"Added by a variant of the SDBOT WORM!"
X	Microsoft Security Monitor Process	[random filename]	"Added by variants of the RBOT WORM! See here"
X	Microsoft Security Panagers	[random filename]	"Added by the RBOT-AIG WORM!"
X	Microsoft System Backup	[random filename]	"Added by the RBOT-AGM WORM!"
X	Microsoft Tray	[random filename]	"Added by the DELF.BZ TROJAN!"
X	Microsoft Update Loader	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Updote	[random filename]	"Added by the RBOT-ARC WORM!"
X	Microsoft UpToDate Driver (32-bits)	[random filename].exe	"Added by the SPYBOT.LXJ WORM!"
X	Microsoft WinSound	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsot NT Support	[random filename].exe	"Added by the RBOT-CTI WORM!"
X	mmsddlx	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	MonAppli	[random filename]	"Added by the DELF.IF TROJAN! The most common filenames are isys32.exe & msnmsg.exe"
X	Monitor Test	[random filename]	"Added by the SDBOT-NC WORM!"
X	MS-HTML	[random filename]	"Added by the LATINUS.15 TROJAN!"
X	MSKCES32	[random filename]	"Added by the CLONER TROJAN!"
X	Msn Update SUPPORT	[random filename]	"Added by the RBOT-BPS WORM!"
X	mswspl	[random filename]	"Added by the SMALL.IQ TROJAN!"
X	NAV Auto Update	[random filename]	"Added by the SPYBOT-E WORM!"
X	NETVISIONAdulti	[random filename]	"Trafficadvance dialer"
X	nssysconf	[random filename]	"Added by the VIVIA.A TROJAN!"
X	NvCpl	[random filename]	"Added by the AGOBOT-APJ WORM!"
X	nvviddrv32	[random filename]	"Added by the RBOT-HT BACKDOOR!"
X	passcxd	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	Plasdll service	[random filename]	"Added by a variant of the SDBOT WORM!"
X	PostBootReminder	[random filename]	Added by and unidentified WORM or TROJAN!
X	prompt drive	[random filename]	"Added by the SDBOT.AMF WORM!"
X	qbotd	[random filename]	"Added by the BOTTEN TROJAN!"
X	Quicktime Task	[random filename]	"Trafficadvance dialer"
X	rmalt	[random filename]	"Added by the CLICKER-CS TROJAN! Filenames spotted inlcude Setup.exe
X	RPC Service	[random filename]	"Added by the BDOOR-AAD BACKDOOR!"
X	RSPC Driver	[random filename].exe	"Added by the RBOT-SN WORM!"
X	RSPC Driver D	[random filename]	"Added by a variant of the RBOT WORM!"
X	rtkernsw	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	Rundll	rundll32.exe [random filename].dll	"Added by the MYTOB.IG WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The random DLL file is found in %System%"
X	Service Defender	[random filename]	"Added by a variant of the ZLOB TROJAN! See here"
X	Service Pack 1	[random filename]	"Added by the VXGAME.Z TROJAN! Note - the filename is random - see the link. Typical examples are vexg6ame4.exe
X	SfKg6wIP	[random filename]	Identified as a variant of the TrojanDownloader.Matcash malware
X	SfKg6wIPu	[random filename]	Identified as a variant of the TrojanDownloader.Matcash malware
X	spoolsv.exe	[random filename]	"Added by the RBOT-JB WORM!"
X	sws.exe	[random filename]	"Haldex type adult content dialler"
X	Symantec Autoscan	[random filename]	"Added by the RBOT-AJO WORM!"
X	SysStart	[random filename]	"ZenoSearch adware"
X	System backup	[random filename]	"Added by the ADMINCASH.B TROJAN! Note - multiple different file names have been spotted
X	System CPL manager	[random filename]	"Added by the RBOT-SR WORM!"
X	System Update	[random filename]	"Added by the KORGO.W or KORGO.X WORMS!"
X	System Update	[random filename]	"Added by the SOROMO-A TROJAN!"
X	SystemManager	[random filename]	"Added by the SETTEC ROOTKIT!"
X	TaskReg	[random filename]	"Added by the CBLAD WORM!"
X	TA_Start	[random filename]	"Zeno Think-Adz adware"
X	Telnet24	[random filename]	"Added by the RBOT-ARD WORM!"
X	Think-Adz	[random filename]	"Zeno Think-Adz adware"
X	updatesched	[random filename]	"ZenoSearch adware"
X	UpdateWin	[random filename]	"Added by the IRCBOT.AZW BACKDOOR!"
X	UpdSys	[random filename]	Added by the BJ TROJAN!
X	ValueS0ft	[random filename]	"Added by a variant of the SPYBOT WORM! See here"
X	ValueX	[random filename]	"Added by the IRCBOT.EE TROJAN!"
X	vbcdtm	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	Video Process	[random filename]	"Added by the RBOT-LM WORM!"
X	Voltage Manager	[random filename]	"Added by the DREFFORT WORM!"
X	vxcxcvfck	[random filename]	"Added by the RANCK-AZ TROJAN! The most common example is ""sbsvsd.exe"" located in %System%"
X	w02db700.dll	[random filename]	"ZenoSearch adware"
X	W32Load	[random filename].scr	"Added by the CASPID WORM!"
X	Web Service	[random filename].exe	"Added by the ADMINCASH TROJAN!"
X	WebRun	[random filename]	"Added by the ADWARELOADER TROJAN!"
X	wescmv	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	WiFix service	[random filename]	"Added by a variant of the SDBOT WORM!"
X	Win Prosess0r	[random filename]	"Added by the RBOT-BIT WORM!"
X	WIN prosessor16	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	Win Secure Update	[random filename]	"Added by the RBOT-AGI WORM!"
X	Win32system	[random filename]	"Added by the DDV.B WORM!"
X	Window service	[random filename]	"Added by the RBOT-ACH WORM!"
X	Windows ASN Service	[random filename]	"Added by the AGOBOT-TC WORM!"
X	Windows Compliant	[random filename]	"Added by the RBOT-IR WORM!"
X	Windows ExpIorer	[random filename]	"Added by the RBOT-AKO WORM!"
X	Windows LoL Layer	[random filename].exe	"Added by the RBOT-GMD WORM!"
X	Windows Media Player	[random filename]	"Added by a variant of the RBOT WORM!"
X	Windows Media Player Update	[random filename]	"Added by the RBOT-ET WORM!"
X	Windows Media SP.2.37	[random filename]	"Added by the LEMIR.C TROJAN!"
X	Windows Microsoft Service	[random filename]	"Added by the AGENT-HCD TROJAN!"
X	Windows Print Monitor Daemon	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	Windows Registry Name	[random filename]	"Added by the RBOT-AEB WORM!"
X	Windows Secure Layer	[random filename]	"Added by the RBOT.DRF WORM!"
X	Windows Servce Agent	[random filename]	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Service Agent	[random filename].exe	"Added by the IRCBOT-XE TROJAN!"
X	Windows Service alge	[random filename]	"Added by the RBOT.GJO TROJAN!"
X	Windows update 2005	[random filename]	"Added by the RBOT.ARP WORM!"
X	Windows Update Checker	[random filename]	Adware downloader trojan
X	Windows Update V6	[random filename]	"Added by the RBOT-KT WORM!"
X	WindowsReg% update	[random filename].exe	"Added by the RBOT-HH WORM!"
X	WindowsRegistration	[random filename]	"Added by the RBOT-NO WORM!"
X	WindowsRegKey Autoupdate	[random filename]	"Added by a variant of the RBOT WORM!"
X	WindowsRegKey update	[random filename]	"Added by the RBOT.QT WORM!"
X	WinFixer service	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	WinLoader	[random filename]	"Added by variants of the SUBSEVEN TROJAN!"
X	Winsock2 driver	[random filename]	"Added by members of the SPYBOT family of WORMS! Note - the random filename is located in %System%"
X	Winsvr	[random filename].exe	"Added by the ADCLICK-DK TROJAN!"
X	WinUPPD.exe	[random filename]	Added by an unidentified WORM/TROJAN!
X	Winz Firewall	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	wpxmls	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	zcseacrt	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	Zeno	[random filename]	"ZenoSearch adware"
X	zonealarm	[random filename]	"Added by an unidentified VIRUS
X	Z_Start	[random filename]	"ZenoSearch adware"
X	[random filename]	slk8x2peu.exe	"QuickLinks adware"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.