..

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	..	ABC2007.exe	"Added by the DLOADR-ASH TROJAN!"
X	ASP.NET State Service	servicos..exe	"Added by the DADOBRA-I TROJAN!"
X	COM++ System	svchost.exe...	"Added by a variant of the LOVGATE WORM!"
X	Data789	Regedit.exe ....data789.tmp	Homepage hijacker
X	drvupd	rundll32 ..drvupd.inf	"Hijacker - drvupd.inf file installs a ""searchforge.com"" hijack"
X	EbatesMoeMoneyMaker	wjview ...Code	"Ebates adware"
X	gvagfxj	rundll32 ...gvagfxj.dll	"Unidentified adware
X	Hardware Profile	hxdef.exe...	"Added by the LOVGATE.Z WORM!"
X	HostSrv	sachostx.exe...	"Added by the LOOKSKY.E WORM!"
U	HREF.OCX	regsvr32.exe ....HREF.OCX	"HREF.OCX is an ActiveX control developed by xFX JumpStart and used to provide HTML-alike clickable links on Windows-based programs such as PopUpKiller"
X	Installed shell32.dll	Office.exe...	"Added by the LOVGATE.AO WORM!"
N	lhttseng	"rundll32.exe ..lhttseng.inf	RemoveCabinet"
X	Microsoft Inc.	iexplorer.exe...	"Added by the LOVGATE.AO WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Microsoft Inet Xp..	teekids.exe	"Added by the BLASTER.C WORM!"
X	MSN Explorer	explorer..exe	"Dropper for the Ciadoor.cb TROJAN!"
X	MSN Messenger	explorer..exe	"Dropper for the Ciadoor.cb TROJAN!"
X	MyPointsPointAlert	wjview ...MyPointsPointAlertrun.exe	"""With MyPoints you can earn rewards from name-brand merchants. You can even earn vacations and frequent flyer miles"". Dubious privacy policy"
X	NewtonKnowsUpd	"NewtKnow.exe ...NewtnUpd.dll	runkey"
X	OPQFile	regedit.exe /s ...rad03FA6.tmp	Unsavoury program that resets your homepage every time you restart - uncheck in MSCONFIG and delete it via a registry edit
?	PowerSet	Regedit.exe /s ...PowerSet_8100_CU.REG	"Appears to be Toshiba power management related"
?	Register SeqChk	regsvr32.exe ..csseqchk.dll	"??"
X	rundl332	math.exe ...pluged.exe	"Added by the DOOMJUICE WORM!"
X	Services	back32.exe ...service.exe	"Added by an unidentified VIRUS
N	setup	hphprld.exe ....setup.exe	HP DeskJet Setup - printers function normally without it
X	Soft Profile Inc	hxdef.exe...	"Added by the LOVGATE.AO WORM!"
X	sp	regedit-s .... sp.dll	"Malicious javascript annoyance that changes the default search engine in IE to one of many including ""topsearcher"". See here for more and a fix"
X	system.	system..exe	"Added by the OPTIXPRO.13.C TROJAN!"
X	system...	system...exe	"Added by the OPTIXPRO.13.C TROJAN!"
X	SystemBoot	Mshta.exe ...filename.hta	Adult content dialler
N	tour	regedit ..tour.reg	Edits registry values to keep the WinMe tour in Task Scheduler
U	UpromiseRemindU	wjview ...Code	"Part of the Upromise saving scheme but associated with Ebates MoneyMaker adware so the choice is yours"
X	websearch	wjview ...websearch.exe	"""Web Savings"" From Ebates Software
X	Winhelp	TkBellExe.exe...	"Added by the LOVGATE.Z WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.