Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
UAcer eAP Launch ToolEAPLAU~1.EXE"Empowering Technology Launcher
UAPLAPL.exe"Sage Software's ACT! The application pre-loader (apl.exe) is a self contained executable that pre-loads the necessary .NET framework and ACT! 2005 assemblies. This pre-loading of assemblies enhances ACT! startup
XBS Mediaplayerbsplyr.exe"Added by the RBOT-OU WORM!"
XCore Process Aplicationccapl.exe"Added by the QHOSTS.G TROJAN!"
XCore Process Aplication x16ccapl16.exe"Added by the SPYBOT.AFT WORM!"
XCore Process Aplication x32ccapl32.exe"Added by the SRAMLER.E TROJAN!"
XDivX MediaPlayer 7.0Dr.DivX.exe"Added by the ALADINZ.G TROJAN!"
?Empowering Technology LaunchereAPLauncher.exe"Part of Acer Empowering Technology. What does it do and is it required?"
ULaplink PDASync 3.0 - LtNts4NtsAgnt.exe"Laplink PDASync for (IBM) Lotus Notes 4 - PDA synchronisation utility"
ULaplink PDASync 3.1 - PocketPCAUTODE~1.EXE"Laplink PDASync for Windows Mobile Pocket PC - PDA synchronisation utility"
ULaplink PDASync 3.1 - ScheduleSyncScheduleSync.exe"Laplink PDASync for ScheduleSync - PDA synchronisation utility"
ULapLink schedulerLlsched.exeUtility that automatically performs file transfers as unattended background operations
XlMAPllMAPl.exe"Added by the AGOBOT-RE WORM!"
UMaple_S2PScan2pc.exeScan to PC application for the scanning function of the Samsung CLX-216x Series multifunction printers
Xmediaplayer.exemediaplayer.exe"Added by the BANKER-EUT TROJAN! The file is located in %Windir%\Sun\Java\Deployment\logs"
Xmediaplayer.exemediaplayer.exe"Added by the BANKER.AOVZ TROJAN! The file is located in %Windir%\msagent\gf"
XMediaPlayeSMediaPlayer_update.exe"Added by the STARTER-K TROJAN!"
Xmediapluscash.exemediapluscash.exe"MediaGateway adware"
XMicrosoft Application Managermsapl32.exe"Added by the BROPIA-AE TROJAN!"
XMicrosoft USA Plugusaplug.exe"Added by the RBOT-DVC WORM!"
XMicrosoft Windows Media Playermediaplayer.exe"Added by a variant of the RBOT WORM!"
XQuicktime Mediaplayerwinmplyer32.exe"Added by the RBOT-PM WORM!"
XQuicktime Mediaplayrwnmplyr.exe"Added by a variant of the RBOT WORM!"
Xscrollerfpapli.exe"CoolWebSearch parasite variant"
XSVA PlayerSVAplayer.exe"SVAPlayer parasite"
XVC5MediaPlayer[path to file]"Added by the DEDLER-D TROJAN! The most common filenames seen are ""csmss.exe"" and ""csmrs.exe""
XWINAPLOGUPDWINAPLOGUPD.EXE"Added by the CAPSIDE-C WORM!"
XWindows Media Playerwmediaplayer.exe"Added by the AGOBOT-NQ WORM!"
YZoneAlarm Pluszaplus.exe"Firewall program from Zonelabs - paid for version"
X[various names]mediaplayer32.exe"Added by a variant of the RBOT WORM!"


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.