Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
XActiveScan AntivirusActiveScan.exe"Added by the RBOT-FKQ WORM!"
XantispyANTIVIRUS.exe"IE AntiVirus rogue security software - not recommended
XAntivirusav.exe"Added by the SINKIN TROJAN! Resets IE start page to realphx.com"
XAntivirusmaja.exe"Added by the NETSKY.H WORM!"
XAntivirusiexpl0res.exeAdded by an unidentified WORM or TROJAN!
XAntiViruskaspery.exe"Added by a variant of the RBOT WORM!"
XAntiVirusAntiVirus.exe"Added by the BANKER-EHB TROJAN!"
XAntivirusAntvrs.exe"AntiVirus 2008 rogue security software - not recommended
XAntivirusavm.exe"Antivirus Master rogue security software - not recommended
XAntivirusvav.exe"Vista Antivirus 2008 rogue security software - not recommended
XAntivirusaav.exe"Advanced Antivirus rogue security software - not recommended
XANTIVIRUSAVS.exe"Antivirus Sentry rogue security software - not recommended
XANTIVIRUSmicroAV.exe"Micro Antivirus 2009 rogue security software - not recommended
XAntivirusMSA.exe"MS Antivirus rogue security software - not recommended
XANTIVIRUSUltraAV.exe"Ultra Antivirus 2009 rogue security software - not recommended
XAntivirusxpa.exe"Xpert Antivirus Enterprise rogue security software - not recommended
XAntivirusSPP.exe"Spyware Preventer rogue security software - not recommended
XAntivirussav.exe"System Antivirus 2008 rogue security software - not recommended
XAntivirusuav.exe"Ultimate Antivirus 2008 rogue security software - not recommended
XAntiviruswav.exe"Windows Antivirus 2008 rogue security software - not recommended
XAntivirus 2009av2009.exe"AntiVirus'09 rogue security software - not recommended
XAntivirus 2009 plusAntivirus 2009 plus.exe"AntiVirus Plus rogue security software - not recommended
XAntivirus Agent Proaap.exe"Antivirus Agent Pro rogue security software - not recommended
XAntivirus Installer[path to trojan]"Added by the BADGENT-A TROJAN!"
XAntivirus PC 2009avpc2009.exe"Antivirus PC 2009 rogue security software - not recommended
XAntivirus Pro 2009AntivirusPro2009.exe"AntiVirus Plus rogue security software - not recommended
XAntivirus Pro 2010AntivirusPro_2010.exe"Antivirus Pro 2010 rogue security software - not recommended
XAntiVirus Processvirprot.exe"Added by a variant of the SDBOT WORM!"
XAntivirus Protection Servicesccapp2.exe"Added by the RBOT.EXI WORM!"
XAntiVirus Updateupdates.exe"Added by the RBOT-JF WORM!"
XAntiVirus Updateantivirus.exe"Added by the RBOT-IF WORM!"
XAntivirus Updatesavupdchk.exe"Added by the AGOBOT-IP WORM!"
XAntivirus-2008.exeAntivirus-2008.exe"Antivirus 2008 rogue security software - not recommended. Detected by Sophos as the FAKEAV-BK TROJAN!"
Xantivirus-2008pro.exeantivirus-2008pro.exe"Antivirus 2008 PRO rogue security software - not recommended. Detected by Sophos as the FAKEAV-AW TROJAN!"
XAntivirus-GoldenAntivirus-Golden.exe"Antivirus-Golden rogue security software - not recommended"
XAntivirus.exeAntivirus.exe"Antivirus rogue security software - not recommended
XAntivirus2008yantvrs.exe"AntiVirus 2008 rogue security software - not recommended
Xantivirus32antivirus.exe"Added by the SPYBOT.KAI WORM!"
XAntivirusBESTInstaller.exe"Installer for the AntivirusBEST rogue security software - not recommended. Removal instructions here"
XAntivirusBESTabest.exe"AntivirusBEST rogue security software - not recommended
XAntivirusDocAntivirusDoc.exe"AntivirusDoc rogue security software - not recommended
XAntivirusFiablepgs.exe"AntivirusFiable
XAntivirusForAllpgs.exe"AntivirusForAll rogue security software - not recommended
XAntivirusGoldAntivirusGold.exe"AntivirusGold rogue security software - not recommended
XAntivirusGold 5.1AntivirusGold 5.1.exe"AntivirusGold rogue security software - not recommended
XAntiVirusLab2009AntiVirusLab2009.exe"Antivirus Lab 2009 rogue security software - not recommended
XAntivirusOrdipgs.exe"AntivirusOrdi
XAntivirusPCPakkepgs.exe"AntivirusPCPakke
XAntivirusPCSuitepgs.exe"AntivirusPCSuite rogue security software - not recommended
XAntiviruspertuttipgs.exe"Antiviruspertutti rogue security software - not recommended. A member of the AVSystemCare family"
XAntiVirusProAntiVirusPro.exe"Anti Virus Pro rogue security software - not recommended"
XAntiVirusProMFCAntivirus Pro.exe"AntiVirus Pro rogue security software - not recommended"
?AntiVirusProtectionqumk.exe"??"
XAntivirusProtectionantivirusprotection.exe"Antivirus Protection rogue security software - not recommended
XAntivirusschermpgs.exe"Antivirusscherm
XAntivirusXP.exeAntivirusXP.exe"Antivirus XP Pro rogue security software - not recommended
XAntiVirus_ProNETAntiVirus_Pro.exe"AntiVirusPro rogue security software - not recommended
XASC-AntiSpywareWinAntivirus.exe"Win Antivirus Vista/XP rogue security software - not recommended
YAshampoo AntiVirus ServiceGuardGui.exe"System Tray access to the main user interface for Ashampoo® AntiVirus from Ashampoo GmbH & Co. KG."
XAV7antivirus7.exe"Antivirus7 rogue security software - not recommended
XAVantivirusAvconsol.exe"Added by the MSNVB-D WORM!"
Yavast! AntivirusashDisp.exe"System Tray access to and notifications for avast! Antivirus - giving left-click access to the On-Access Scanner
XAvg Antivirusicpldrvx.exe"Added by the BANKER.BYU TROJAN!"
XAVG AntiVirus Scanneravgscnx.exe"Added by the SILLYFDC.BBE WORM! Note - this is not a legitimate AVG entry"
XAVG AntiVirus Updateravgwusv.exe"Added by the SILLYFDC.BAX WORM! Note - this is not a legitimare AVG entry"
XavplAntivirus.exe"AntiVirus Plasma rogue security software - not recommended
XBastioneAntiviruspgs.exe"BastioneAntivirus
XBestsellerAntiviruspgs.exe"BestsellerAntivirus rogue security software - not recommended
XBitDefender AntivirusBITDEFENDERX.EXE"Added by a variant of the SPYBOT WORM!"
XCleanUp AntivirusCU[random characters].exe"Cleanup Antivirus rogue security software - not recommended
XCoreguard Antivirus 2009Coreguard 2009.exe"Coreguard Antivirus 2009 rogue security software - not recommended
XDoctor Antivirus 2008antvr.exe"Doctor Antivirus 2008 rogue security software - not recommended
XDrWeb AntivirusDRWEBAV.EXEAdded by an unidentified WORM or TROJAN!
?Eac_rnvdlANTIVIRUS_INSTALL.EXE"??"
XEdzy AntiVirusdppsfa.exe"Added by a variant of the RBOT WORM!"
XExpertAntivirusExpertAntivirus.exe"ExpertAntivirus rogue security software - not recommended
XExtra AntivirusExtraAV.exe"Extra Antivirus rogue security software - not recommended
UF-PROT Antivirus Tray applicationFProtTray.exe"System Tray access to F-PROT Antivirus"
XFast Antivirus 2009FastAV.exe"Fast Antivirus rogue security software - not recommended
XGeneral AntivirusGenAvir.exe"General Antivirus rogue security software - not recommended
XGhost AntivirusGhostAV.exe"Ghost Antivirus rogue security software - not recommended
XHome Antivirus 2010HomeAntivirus2010.exe"Home Antivirus 2010 rogue security software - not recommended
XHomeAntivirus 2009HomeAntivirus2009.exe"HomeAntivirus 2009 rogue security software - not recommended
XInternet AntivirusIAvir.exe"Internet Antivirus rogue security software - not recommended
XInternet Antivirus ProIAPro.exe"Internet Antivirus Pro rogue security software - not recommended
Yiolo AntiVirusioloAV.exe"iolo AntiVirus"
NiRiS AntiVirus Active MonitorWIMMUN32.exe"Iris Antivirus - discontinued
XKasper AntivirusKASPERANTIVIRUS.EXE"Added by a variant of the SPYBOT WORM!"
XKaspersky AntivirusKasperskyAV.exe"Added by a variant of the RBOT WORM!"
XLaunch Norton AntiVirus 2000jorgf.exe"Added by the RBOT-AUI WORM!"
XMcAfee AntivirusMcAfeeAV.exe"Added by a variant of the RBOT WORM!"
XMcAfee Antivirus 32MCAFEEAV32.EXE"Added by the SPYBOT-EH WORM!"
XMcafee Antivirus Monitoring System326VSStatmn326.exe"Added by a variant of the SDBOT WORM!"
XMcafee Antivirus Monitoring System32mnVSStatmn32.exe"Added by a variant of the RBOT WORM!"
XMcAfee Antivirus ProtectionmcafeeAV.exe"Added by a variant of the RBOT WORM!"
XMcaffe AntivirusMcafeescn.exe"Added by a variant of the SPYBOT WORM!"
XMICROSFT ANTIVIRUS UPDATE SUPPORT[random 10-letter filename].EXE"Added by the RBOT-AQA WORM!"
XMICROSFT ANTIVIRUS UPDATE SUPPORTMSGUPDATED.EXE"Added by the RBOT-APZ WORM!"
XMicrosoft Internal AntiVirus SystemsdIlhost.exe"Added by the RBOT-AEV WORM!"
XMicrosoft Internet Antivirus Protectionantivirus.exe"Detected by Kaspersky as the IRCBOT.BSK TROJAN!"
XMicrosoft Norton Antivirusnorton.exe"Added by a variant of the IRCBOT TROJAN!"
XNano Antivirusnanoav.exe"Nano Antivirus rogue security software - not recommended
XNI.UWA6P_0001_N56M1001WinAntiVirusPro2006Installer.exe"Installer for the WinAntiVirus Pro 2006 rogue security software"
XNI.UWA6P_0001_N69M0303WinAntiVirusPro2006Installer[1].exe"Installer for the WinAntiVirus Pro 2006 rogue security software"
XNI.UWA6P_0001_N73M1004WinAntiVirusPro2006FreeInstall.exe"Installer for the WinAntiVirus Pro 2006 rogue security software"
XNI.UWA6P_0001_N91M1807WinAntiVirusPro2006FreeInstall[1].exe"Installer for the WinAntiVirus Pro 2006 rogue security software"
XNI.UWA7P_0001_N91M0809WinAntiVirusPro2007FreeInstall.exe"Installer for the WinAntiVirus Pro 2007 rogue security software - see here"
XNod32 Free antivirusnod32krn.exe"Added by the RBOT-AAO WORM! Note - not the popular free NOD32 antivirus software
XNod3d2 Free antivirusN0D32KRN.EXE"Added by the RBOT-ABQ WORM!"
XNortE Antivirusnorte.exe"Added by the RBOT.BQQ WORM!"
XNortE Antivirusnorten.exe"Added by the RBOT-AFF WORM!"
XNorton Antivirusnortonav.exe"Added by the RBOT-AYE TROJAN! Note - this is not the real Norton AV!"
XNorton Antivirus 2004SYMANTECAV2.EXE"Added by the SPYBOT-DY WORM! Note - this is not the real Norton AV!"
XNorton Antivirus 7.0a[path to file]"Added by the PERDA-B or RANCK-CT TROJANS!"
XNorton Antivirus AVFVProtect.exe"Added by the NETSKY.P WORM! Note - this is not the popular AV software!"
XNorton AntiVirus SysNAVsys32.exe"Added by a variant of the WOOTBOT WORM!"
XNorton Antivirus Updaternortonav.exe"Added by the DELBOT-T WORM! Note - this is not the real Norton AV!"
XNortonAntivirusLSASS.exe"Added by the PEXMOR WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Temp"
XNortonAVnorton_antivirus.exe"Added by the NETJOE TROJAN! Note - this is not the legitimate Symantec AV program"
XnortonsantivirusccEvtMngr.exe"Added by the HZDOOR-A TROJAN!"
XPaladin Antiviruspav.exe"Paladin Antivirus rogue security software - not recommended
YPC Tools AntiVirus ClientPCTAV.exe"System Tray access to PC Tools AntiVirus from PC Tools - which ""provides world-leading protection against viruses
XPCAntiVirusPropgs.exe"PCAntiVirusPro rogue security software - not recommended
XPersonal AntivirusPerAvir.exe"Personal Antivirus rogue security software - not recommended
XPower-Antivirus-2009Power-Antivirus-2009.exe"Power Antivirus 2009 rogue security software - not recommended
XProAntiVirusProAntiVirus.exe"Added by the RBOT-FTP WORM!"
XRapid AntivirusRapid Antivirus.exe"Rapid Antivirus rogue security software - not recommended
XSecure AntiVirus Proav.exe"Secure AntiVirus Pro rogue security software - not recommended
XSecurity AntivirusSA[random characters].exe"Security Antivirus rogue security software - not recommended
XSecurity Antivirus Xp 1inetfor.exe"Added by the SDBOT.BAV WORM!"
XSichererAntiviruspgs.exe"SichererAntivirus
XSmart Antivirus-2009.exeSmart Antivirus-2009.exe"Smart Antivirus 2009 rogue security software - not recommended
XSolelunaAntiViruspgs.exe"SolelunaAntiVirus rogue security software - not recommended. A member of the AVSystemCare family"
XSymantec Antivirus professionaldfrgfrat.exe"Added by a variant of the FORBOT WORM!"
XSymantec Antivirus professionalautoformat.exe"Added by a variant of the FORBOT WORM!"
XSymantec Antivirus professionaldyndns.exe"Added by a variant of the FORBOT WORM!"
XSymantec Antivirus professionalf0dns.exe"Added by the FORBOT-GT WORM!"
XSymantec Antivirus professionalflushdns.exe"Added by a variant of the FORBOT WORM!"
XSymantec Antivirus professionalfor.exe"Added by a variant of the FORBOT WORM!"
XSymantec Antivirus professionalregedit.exe"Added by a variant of the FORBOT WORM! Note - this is not the valid Windows registry editor which resides in %Windir% and will not normally figure in Msconfig/Startup! This version resides in %System%"
XSymantec Antivirus professionalSymantex.exe"Added by a variant of the FORBOT WORM!"
XSymantec Antivirus professionalwindows .exe"Added by a variant of the FORBOT WORM!"
XSymantec Antivirus professionalWinhp32.exe"Added by a variant of the FORBOT WORM!"
XSymantec Antivirus professionalwinudp.exe"Added by a variant of the WOOTBOT WORM! See here"
XSymantec Antivirus professionalxplrer.exe"Added by a variant of the FORBOT WORM!"
XSysAntivirus 2009sysav.exe"SysAntivirus 2009 rogue security software - not recommended
XSystemantivirus.vbe"Added by the AUTORUN-AYI WORM!"
XTRE AntiVirustreav.exe"TRE AntiVirus rogue security software - not recommended
YTrend Micro AntiVirus 2007tavui.exe"Part of Trend Micro AntiVirus 2007"
YTrendMicro AntivirusAveagent.exeVirus scanner
XTrustedAntiviruspgs.exe"TrustedAntivirus rogue security software - not recommended. A member of the AVSystemCare family"
XUnigrayUnigray Antivirus.exe"Unigray Antivirus rogue security software - not recommended"
XWin Antivirus 2008Win Antivirus 2008.exe"Win Antivirus 2008 rogue security software - not recommended
XWinAntivirusAVSVC.EXE"Part of the WinAntiVirus Pro 2005 rogue security software when installed in Win98/Me - not recommended
XWinAntiVirus Pro 2007WinAv.exe"WinAntiVirus Pro 2007 rogue security software - not recommended
XWinAntiVirusPro2006WinAV.exe"WinAntiVirus Pro 2006 rogue security software - not recommended
XWindows Anti-Virus Built 32AntiVirus32.exe"Added by the SDBOT-BG WORM!"
XWinsecure AntivirusSecureantivirus.exe"Added by a variant of the SPYBOT WORM!"
Xwistaantiviruswistaantivirus.exe"Wista Antivirus rogue security software - not recommended
XXP Antivirusxpantivirus.exe"XPAntivirus rogue security software - not recommended
XXP Antivirusxpa.exe"XP Antivirus rogue security software - not recommended"
XXPAntivirusXPAntivirus.exe"XPAntivirus rogue security software - not recommended
XZi5AntiVirus Update.exe"Added by the ERKEZ.G WORM!"
X_pnd_Panda Antivirus_pnd_*****.exe [* = random char/digit]Added by the AGENT.NAK TROJAN!


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.