0.exe

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	(Default)	5640.exe	"Added by the DOWNLD-ABF TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKCU\Run
U	0190 Warner	WARN0190.EXE	"Anti-dialer program (Germany)"
U	0900 Warner	WARN0900.EXE	"Anti-dialer program (Germany)"
U	A1000 Settings Utility	cpqa1000.exe	"Compaq A1000 Print Fax All-in-One copy scan printer software. Required in the Startup in order to scan
X	AntiSpyware3000.exe	antispyware.exe	"AntiSpyware 3000 rogue spyware remover - not recommended
X	AntiVermins 3.0	AntiVermins 3.0.exe	"Antivermins rogue security software - not recommended
X	Antivirus Pro 2010	AntivirusPro_2010.exe	"Antivirus Pro 2010 rogue security software - not recommended
Y	ATI Remote Control	ATIX10.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
Y	ATIRmtWndr	ATIX10.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
Y	ATIX10	atix10.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
N	backWeb-8876480	backweb-8876480.exe	"Installed with older versions of the software for Logitech products. Automatically checks for software upgrades and new products
X	begins	0.exe	"Added by the MYTOB-HE WORM!"
Y	BOC-420	BOC420.exe	"NSClean (now Comodo) BOClean anti-malware software - ""Protect yourself from online identity theft. The greatest threat on the Internet today is having your personal information hijacked remotely"". Version 4.20"
X	Care20	Care20.exe	"TopMoxie adware"
N	Clipmate6	CLIPMT60.EXE	"Clip Mate 6 by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs"
X	Compaq Print Fax	cpqa1000.exe	"Added by the SDBOT.BCV WORM! Please take note of the difference between the legitimate Compaq Fax Utility Name (A1000 Settings Utility) and the name (Compaq Print Fax) used by this worm"
X	ControlPanel	"popcorn320.exe rundll.dll	LoadMouseProfile"
U	CPATR10	CPATR10.EXE	"Dritek/Compal ATR10 Easy Button driver. Used on certain laptops (e.g. Toshiba
N	CplBTQ00	CplBTQ00.EXE	Related to EZbutton quick launcher for the Media player app that comes with certain laptops
N	CPLDBL10	CPLDBL10.exe	Related to EZbutton quick launcher for the Media player app that comes with certain laptops
U	CPLDFL10	CPLDFL10.EXE	Part of the EzButton feature on some Toshiba (and maybe others) laptops which support additional buttons
N	CreateCD50	Createcd50.exe	Adaptec Easy CD Creator version 5 system tray application. Available via Start -> Programs
X	CSV10P70	CSv10P070.exe	"ClearSearch adware"
X	CSV7P70	CSV7P070.exe	"ClearSearch adware"
X	CTin10	CTin10.exe	"Added by the BANCOS.E TROJAN!"
U	Deko550	Deko550.exe	"Associated with the Deko550 entry-level SD real-time graphics system from Avid Technology"
X	Desktop Defender 2010	Desktop Defender 2010.exe	"Desktop Defender 2010 rogue security software - not recommended
X	Desktop Security 2010	Desktop Security 2010.exe	"Desktop Security 2010 rogue security software - not recommended
?	Disable EHCI	nousb20.exe	"??"
X	djtopr1150.exe	djtopr1150.exe	"WebRebates adware"
X	DNS	mc-58-12-0000080.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-58-12-0000120.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-58-12-0000140.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
U	DWQueuedReporting	dwtrig20.exe	"Used to launch Microsoft Error Reporting (DW20.exe) - if
U	dwtrig20	dwtrig20.exe	"Used to launch Microsoft Error Reporting (DW20.exe) - if
X	EbatesMoeMoneyMaker0	EbatesMoeMoneyMaker0.exe	"Ebates adware"
U	eDonkey2000	edonkey2000.exe	"File sharing network - not recommended as the free version of this application should be avoided as it installs
X	ei10.exe	ei10.exe	"Added by the AGOBOT-NK WORM!"
U	EPSON CardMonitor	EPSON CardMonitor1.0.exe	Monitors the PCMCIA memory card slot on EPSON cameras and printers and launches PhotoStarter or PhotoPrint
X	fqor	stub_113_4_0_4_0.exe	"TargetSaver adware"
U	freesurfer	fs20.exe	"EMS Free Surfer mk II - pop-up stopper"
X	GetModule20	GetModule20.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule30	GetModule30.exe	"Internet Speed Monitor adware related"
X	GetPack20	GetPack20.exe	"Internet Speed Monitor adware related - see example here"
X	gotnewupdate000.exe	gotnewupdate000.exe	"Added by the FAKEAV-BGA TROJAN!"
X	Home Antivirus 2010	HomeAntivirus2010.exe	"Home Antivirus 2010 rogue security software - not recommended
X	HP Deskjet	HP_DeskJet_500.exe	"Added by the FORBOT-DA WORM!"
U	HPDJ Taskbar Utility	hpztsb10.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
X	IMJPMIG8.2	msime80.exe	"Added by the VB-CYJ TROJAN!"
X	intdctrr	idctup20.exe	"SafeSurfing adware variant"
X	Internet Security 2010	IS2010.exe	"Internet Security 2010 rogue security software - not recommended
X	JVM0	JVM0.exe	"Added by the BANLOA-AX TROJAN!"
N	LDM	backweb-8876480.exe	"Installed with older versions of the software for Logitech products. Automatically checks for software upgrades and new products
X	Life Personal Firewall	FirewallingV10.exe	"Added by the RBOT-BKF WORM!"
N	load=	adw30.exe	After Dark for Windows - screen saver program. Popular before screen savers were integrated into Win95
N	Logitech Desktop Messenger	setup-8876480.exe	"Installer for Logitech Desktop Messenger included with older versions of the software for Logitech products - which automatically checks for software upgrades and new products
N	LogitechQuickCamRibbon	QuickCam10.exe	"Loads versions of the Logitech QuickCam webcam software and is required to support features such as face tracking. If enabled
X	LTM2	MSGSRV320.EXE	"Added by the LITMUS.C TROJAN!"
X	MalwareBurn 7.0	MalwareBurn 7.0.exe	"MalwareBurn rogue security software - not recommended
X	Microsoft System Init	mtmnr0.exe	"Added by the SDBOT.BR TROJAN!"
X	Microsoft Windows	mstask0.exe	"Added by the SDBOT.FQ WORM!"
X	Microsoft Windows WKS Service	mstask0.exe	"Added by the SDBOT.FV WORM!"
X	microsoft420	microsoft420.exe	"Added by the MENACE.B WORM!"
X	MS Office	Office10.exe	"Added by the VB.DT TROJAN!"
X	msig	disk10.exe	"Added by the BANBRA-KF TROJAN!"
X	MsServer	msfun80.exe	"Added by the VB-CYG WORM!"
X	MsServer	msfir80.exe	"Added by the VB-CYJ TROJAN!"
X	mssync20	mssync20.exe	"Added by the LDPINC-QC TROJAN!"
X	Name	Iexplorer0.exe	"Added by the THREADSYS TROJAN!"
X	NJG40	NJG40.EXE	"Added by the BANCOS.D TROJAN!"
U	No-IP DUC	DUC20.exe	"Part of http://www.no-ip.com provided service. Keeps No-IP's dynamic nameserver (DNS) updated if and when your computer's (network's) dynamic IP-address changes so that you can run servers on computers with dynamic IP. Shortcut available"
U	nwss	Sp0.exe	"SpyOutside surveillance software. Uninstall this software unless you put it there yourself"
X	OESET	setup60.exe	"Added by the WAREZDL.28672 TROJAN!"
X	PC Antispyware 2010	PC_Antispyware2010.exe	"PC Antispyware 2010 rogue security software - not recommended
X	PeqBL100	PEQBL100.exe	"Added by the ENVID.D WORM!"
N	PerfectPrint	pfppop70.exe	Print engine used by Corel WordPerfect 7 and Presentations 7
U	PFM3.0	PFM30.exe	"Management software for the Philips 8FF3WMI/27 digital PhotoFrame. Used to configure the device
U	PFM30	PFM30.exe	"Management software for the Philips 8FF3WMI/27 digital PhotoFrame. Used to configure the device
U	phc700	vphc700.exe	"Related to the Philips SPC700NC web camera"
U	Philips PhotoFrame Manager	PFM30.exe	"Management software for the Philips 8FF3WMI/27 digital PhotoFrame. Used to configure the device
?	PLFFAP	HotfixQ0306270.exe	"Prolific Technology Inc. USB Flash Disk driver - is it required in startup?"
X	PowerProfile	mfcp30.exe	"Added by the RINDAS-A TROJAN!"
N	Printkey2000	printkey2000.exe	Screen grabber that intercepts the pressing of the Print Screen (Prn Scrn) key. Start manually when required
U	Purgative	PURGATIVE100.EXE	AIM (AOL Instant Messenger) Ad Remover Using Active Memory Edits instead of a patch/crack
X	QdrModule10	QdrModule10.exe	"Internet Speed Monitor adware"
X	QdrPack10	QdrPack10.exe	"Internet Speed Monitor H adware"
N	QuickCam10	QuickCam10.exe	"Loads versions of the Logitech QuickCam webcam software and is required to support features such as face tracking. If enabled
N	QuickCam10.exe	QuickCam10.exe	"Loads versions of the Logitech QuickCam webcam software and is required to support features such as face tracking. If enabled
N	QuickFinder Scheduler	QFSCHD100.exe	Used in Corel 2002 & Corel Suite 7 - finds files faster by indexing your files (similar to Microsoft's Find Fast or Fast Search for its Office products)
N	QuickFinder Scheduler	QFSCHD110.EXE	"Used in Corel WordPerfect Office 11 - finds files faster by indexing your files (similar to Microsoft's Find Fast or Fast Search for its Office products). See here"
N	QuickFinder Scheduler	QFSCHD130.EXE	"Used in Corel WordPerfect Office X3 - finds files faster by indexing your files (similar to Microsoft's Find Fast or Fast Search for its Office products). See here"
N	RaConfig2500	RaConfig2500.exe	"RaLink wireless LAN configuration utility"
?	readericon10	readericon10.exe	"Related to a multimedia card reader - possibly based upon an Alcor Micro chipset. What does it do and is it required?"
X	RebateNation0	RebateNation0.exe	"RebateNation adware"
X	REGRUN	winfix22490.exe	"Adware downloader - also detected as a variant of the LOWZONES.BW or AGENT.RD TROJANS!"
Y	Regx10EXE	ATIX10.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
N	RoxWatchTray	RoxWatchTray10.exe	"System Tray access to managing the ""Watched Folders""
N	RoxWatchTray10	RoxWatchTray10.exe	"System Tray access to managing the ""Watched Folders""
X	Security essentials 2010	SE2010.exe	"Security Essentials 2010 rogue security software - not recommended
X	services32	mc-58-12-0000120.exe	"""Shorty"" adware - also detected as the AGENT.FD TROJAN!"
X	services32	mc-58-12-0000140.exe	"""Shorty"" adware - also detected as the AGENT.FD TROJAN!"
U	SK60	SK60.EXE	"SaveKeys keystroke logger/monitoring program - remove unless you installed it yourself!"
X	sms_msn40	sms_msn40.exe	Added by an unknown WORM or TROJAN infection
X	SpyBlocs3.0	SpyBlocs3.0.exe	"SpyBlocs spyware remover - not recommended
X	SpyLocked 4.0	SpyLocked 4.0.exe	"Spylocked rogue spyware remover - not recommended
Y	Start RF Wireless Mouse	cm20.exe	Yuanxun Electronics RF wireless mouse driver
U	SW20	sw20.exe	"Related to MSI's Dynamic Overclocking Technology"
N	Symantec Fax Starter Edition Port	OLFSNT40.EXE	Offers a virtual printer as a fax machine. Can be run via a desktop shortcut
X	sysldtray	ld10.exe	"Added by the FAKEAV-UD TROJAN!"
N	TaskPlus	TASKPLUS0.EXE	Task and calendar management software available as freeware or as a "Professional" version for sharing over a LAN
X	Total PC Defender 2010	Total PC Defender 2010.exe	"Total PC Defender rogue security software - not recommended
X	trackerx90.th.gs	anti_data_exe_by_trackerx90.exe	"Added by the BCKDR-QIT BACKDOOR!"
U	Traymin900	Tray900.exe	Related to the Philips SPC webcam - System Tray manager for Personal 900 series camera
U	Upromise0	Upromise0.exe	"Upromise college savings program"
X	VnrBlock20	VnrBlock20.exe	"Berlinads adware"
X	VnrPack20	VnrPack20.exe	"Internet Speed Monitor adware related - see example here"
?	VX1000	vVX1000.exe	"Associated with Microsoft's VX-1000 LifeCam webcams. What does it do and is it required?"
?	VX3000	vVX3000.exe	"Associated with Microsoft's VX-3000 LifeCam webcams. What does it do and is it required?"
?	VX6000	vVX6000.exe	"Associated with Microsoft's VX-6000 LifeCam webcams. What does it do and is it required?"
U	Watson Subscriber for SENS Network Notifications	dwtrig20.exe	"Used to launch Microsoft Error Reporting (DW20.exe) - if
X	WebCpr0	WebCpr0.exe	"WebRebates adware"
X	WebRebates0	WebRebates0.exe	"WebRebates adware"
X	WebSavingsFromEbates0	WebSavingsFromEbates0.exe	"Web Savings From Ebates Software
Y	wfxsnt40	wfxsnt40.exe	WinFax 10.0 and maybe earlier versions. Used to initiate the WinFax port to enable printing to the WinFax printer (send a fax) from any application
X	Win Security 360	WinSecurity360.exe	"Win Security 360 rogue security software - not recommended
X	Windows modez Verifier	w1nz0zz0.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Services Layer	winl0g0.exe	"Added by the RBOT-FZQ WORM!"
?	Windows shell	win70.exe	"??"
X	Windows Update	MSDEVS30.exe	Added by the SPYBOT.AHC WORM!
Y	WinFaxAppPortStarter	wfxsnt40.exe	WinFax 10.0 and maybe earlier versions. Used to initiate the WinFax port to enable printing to the WinFax printer (send a fax) from any application.
X	wingerver2.0.exe	wingerver2.0.exe	"Added by the GRAYBRD-AE TROJAN!"
X	Winsock32driver	ZoneAlarmPr0.exe	"Added by the HACKARMY-B TROJAN!"
X	win_supp00.exe	Win Const.exe	"Added by the ASSASIN-H TROJAN!"
X	WSAConfiguration	msnote30.exe	"Added by the AGOBOT-KF BACKDOOR!"
X	Xordate	wuauclt10.exe	"Added by the RBOT-GKN WORM!"
X	xzkadsfk10	afslkfasl10.exe	"Added by the ONLINEG-R TROJAN!"
X	[32 random numbers]	av360.exe	"Antivirus 360 rogue security software - not recommended
X	[various names]	10010.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	80d0.exe	"MediaMotor adware"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.