Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
X1029BB4B-16A9-4E77-AA3D-96930BD68EECsysockeu.exe"Added by the FAKEALERT-AH TROJAN!"
UActivboardMMKeybd.exe"Packard Bell ActiveBoard keyboard - multimedia keyboard manager. Required if you use the additional keys and want to see the status of the Num Lock
UActiveKeys.AAB635BD7D054a37A576akeys.exe"""Active Keys is a powerful yet easy-to-use tool for creating and managing keyboard shortcuts for any system action"""
XAdobeReaderProcbdzfrsl.exe"Added by the RBOT.AZQ BACKDOOR!"
Xb3dBDEsecureinstall.exe"B3d Projector foistware - periodically trys to access the internet. (1) Uninstall it via Start -> Settings -> Control Panel -> Add/Remove Programs. (2) Remove the BDEsecureinstall.exe if still present in the ""System"" directory. (3) Disable and ideally delete it from the registry. (4) Remove the ""BDE"" directory and all its contents"
?BBDialBT Broadband.exe"Part of BT Broandband - is it required?"
XBDdc.exe"Added by the RASDOOR-A TROJAN!"
YBDAgentbdagent.exe"BitDefender Agent - for BitDefender internet security products. Maintains settings (for all users) and provides alerts and System Tray access to the main program. Note - for the System Tray icon to be displayed the Terminal Services service must be set to either ""Manual"" or ""Automatic"". It can also be licensed by other products such as versions of The Shield Deluxe from PCSecurityShield (see here) - who's reputation is poor"
Xbdfgergggasw.exe"Added by the SDBOT-RT WORM!"
YBDMConBdmcon.exe"BitDefender antivirus"
YBDNewsAgentbdnagent.exe"BitDefender antivirus - updater"
YBDOESRVbdoesrv.exe"Bitdefender 8 antivirus and firewall"
UBDRegionbrs.exe"Part of Cyberlink's PowerDVD version 8 - removes the Blu-ray region on a DVD"
YBDSwitchAgentbdswitch.exe"Bitdefender 8 antivirus and firewall"
YBDWizRegbdwizreg.exe"Configuration wizard for BitDefender internet security products. Only runs once the product has been installed. Guides you through the steps necessary to configure the BitDefender modules
XBIE"Rundll32.exe [path] BDSrHook.dll Rundll32"
YBitDefender 12bdwizreg.exe"Configuration wizard for BitDefender internet security products. Only runs once the product has been installed. Guides you through the steps necessary to configure the BitDefender modules
YBitDefender 2009bdagent.exe"BitDefender Agent - for BitDefender internet security products. Maintains settings (for all users) and provides alerts and System Tray access to the main program. Note - for the System Tray icon to be displayed the Terminal Services service must be set to either ""Manual"" or ""Automatic"". It can also be licensed by other products such as versions of The Shield Deluxe from PCSecurityShield (see here) - who's reputation is poor"
YBitDefender Live! Initbdinit.exe"BitDefender antivirus"
YBitDefender Scan Serverbdss.exe"BitDefender antivirus"
YBTUSRBDGBtUsrBdg.exe"Used with a Mitsumi USB Bluetooth adaptor (and maybe others)"
YBTUSRBDGFBtUsrBdg.exe"Used with a Mitsumi USB Bluetooth adaptor (and maybe others)"
XCinnabd Prompt32CmdPrompt32.pif"Added by the ASSIRAL-B WORM!"
XDASDS VSAVdjsdsabdw.exe"Added by the SDBOT-RE WORM!"
UDellTouchMMKeybd.exeDell multimedia keyboard manager. Required if you use the additional keys
UeBayToolbareBayTBDaemon.exe"eBay toolabar related - also contains eBay account Guard which monitors for fraudulent eBay sites"
UFBDirectFBDirect.exe"Software that monitors the status of a Visioneer OneTouch scanner button and allows you to scan
UFLMK08KBMMKEYBD.EXEMultimedia keyboard manager. Required if you use the additional keys
UFLMK08KBKbdAp32A.exeKeyboard utility for a Medion brand (and possibly others) keyboard. If you disable this entry you will not be able to use any of the keyboard hotkeys or other non-standard functions on the keyboard
UFLMTRUSTKBKbdAp32A.exeKeyboard utility for a Trust brand keyboard. If you disable this entry you will not be able to use any of the keyboard hotkeys or other non-standard functions on the keyboard
UHot Key Kbd 2690 DaemonSK2690DM.EXEMulti-function keyboard driver. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
UHot Key Kbd 9910 DaemonSK9910DM.exeMulti-function keyboard driver. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
UHpMmKbdHpMmKbd.exeHP's multimedia keyboard driver which enables the end-user to use the automation features of the HP multimedia keyboard
XIBM Keyboard Driverikeybdrv.exe"Added by the SDBOT.IC TROJAN!"
XInstant Buzz DaemonIBDaemon.exe"Instant Buzz adware"
Nisdbdcisdbdc.exeFor Compaq PC's. May install properties in dial-up networking when you register with an ISP
UKBDKBD.EXEMultimedia keyboard manager. Required if you use the multimedia keys
UKBDKbdStub.EXEKey Watcher from HP - watches for Multimedia Keys on HP keyboards
UKBD MediaCenterMEDIACTR.EXEMultimedia keyboard manager. Required if you use the multimedia keys
Xkbddrv32kbddrv32.exe"Added by the CRYPTER.A TROJAN!"
Xkbddrvinfkbddrvinf.exe"Added by the CRYPTER.A TROJAN!"
XKeybdcntlkeybdcntl.exe"Added by a variant of the CRYPTER.C TROJAN!"
UKeyboard ManagerMMKeybd.exeMultimedia keyboard manager. Required if you use the additional keys
ULWBKEYBOARDKbdAp32A.exeKeyboard utility for a Labtec brand (and possibly others) keyboard. If you disable this entry you will not be able to use any of the keyboard hotkeys or other non-standard functions on the keyboard
UMagicKeyboardPreMKBD.exe"Related to Samsung laptops. Provides ability to program keys to perform specific functions"
UMMKeybdMMKeybd.exeMultimedia keyboard manager. Required if you use the additional keys
XMSOOBDMSOOBD.EXE"Added by the MAGISTR.A VIRUS!"
XMsVBdllsys32dll.exe"Added by the AIMDES.B or AIMDES.C WORMS!"
XMsVBdllMsVBdll.pif"Added by the AIMDES.A WORM!"
UMultimedia KBDMMKeybd.exeMultimedia keyboard manager. Required if you use the additional keys
UMULTIMEDIA KEYBOARDMMKeybd.exeMultimedia keyboard manager. Required if you use the additional keys
XNBInstallMBDownloader_876919.exe"Added by the MIRAR_D TROJAN!"
UOFFICEKBkbdap32a.EXE"Keyboard utility for a Micro Innovations brand keyboard. If you disable this entry you will not be able to use any of the keyboard hotkeys or other non-standard functions on the keyboard"
NPP****usbFBDirect.exe"Software that monitors the status of a Visioneer OneTouch scanner button and allows you to scan
NQuickBooks Delivery AgentQBDAGENT.EXEAs far QAGENT but for QuickBooks. Can also have the version number in the name
XRg2catbdRg2catbd.exeAdded by a variant of the BANLOAD family of TROJANS!
USBDrvDetSBDrv.exe"Detects the ""Easy Front-Panel Audio Connectivity Drive Internal Drive Bay"" on the Sound Blaster Audigy 2 Platinium eX. Can be disabled if you don't have one"
Nsbdrvdetsbdrvdet.exeChecks to see if Creative sound card driver should be updated
XSBIinstall_sbd_**.exe"Installer for a number of rogue security products and error fixing tools - where ** represents a 2 letter language code
USbUsb AudCtrl"RunDll32 sbusbdll.dll RCMonitor"
Xsdchosts32vbdd.exeAdded by the RANKY.AG TROJAN!
XShellExplorer.exe kbdsys.exe"Added by the DAPROSY WORM! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The ""kbdsys.exe"" file is located in %AppData%\Microsoft\Keyboard"
USmart KeyboardSmartkbd.exeNetropa Smart Keyboard driver
?smbdpmismbdpmi.exe"IBM Netfinity Director and Universal Management Services related. What does it do and is it required?"
Xsounddrvsndbdrv3104.exe"CoolWebSearch parasite variant"
Xstlbdist"rundll32exe stlbdist.DLL DllRunMain"
UTPKBDLEDTpScrLk.exeIBM Thinkpad utility for displaying the Scroll Lock status on the System Tray - for Thinkpad's that don't have a Scroll Lock LED
Xtymsetvcosskhbd.exe"Added by the MAILBOT-BW TROJAN!"
XUsbDsmss32.exe"Adware - detected by Kaspersky as the AGENT.CJ TROJAN!"
XUsbDsvhost32.exe"Added by the AGENT.IB TROJAN!"
XUsbdusb_d.exe"Added by the CIDRA-A TROJAN!"
XUsbD[path to trojan]"Added by the CIDRA-F TROJAN!"
UUSBDetectorUSBDetector.exeUSBDetector sets up an icon in the System Tray for a USB card which is intended to be used to eject or unplug hardware
UUSBDetectorUDetect.exeUSB tray icon/detection for external Belkin (and maybe other makes) under Win98
XUSBDrivesmsfirewalI.exe"Added by the RBOT-ABP WORM!"
Xusbdrvservicetask.exe"Added by a variant of the SDBOT WORM!"
UUSBMMKBDusbmmkbd.exeUSB multimedia keyboard for HP systems. Allows the use of special function keys on USB keyboards. The latest version no longer pings a server when on-line wheras the older version did but did not transmit any user information
XWebdav.exewebdav.exeIRC DDoS bot which gives the hacker full control over your system
NWebDrivewebdrive.exe"System Tray access to WebDrive from South River Technologies
NWebDriveTraywebdrive.exe"System Tray access to WebDrive from South River Technologies
Xwin32usbdssrs.exe"Added by the RBOT-RA WORM!"
XWindows USBDmsifirewall.exeAdded by an unidentified WORM or TROJAN!
Xwinxpusbdwinxp64.exe"Added by a variant of the RBOT WORM!"
UWireLessKeyboardPS2USBKbdDrv.exe"Related to WireLess Keyboard Multimedia Combo Set by SANSUN Industries"
UWZCBDLServiceWZCBDL9X.exeWZCBDLService Launcher from D-Link - configuration/drivers
XXHFHGEBDbadwXHFHGEBDbadw.exe"Added by the AGENT-NHN TROJAN!"
YZPLEDZPKBDLED.exeDriver for the Advent ADE-AD2 Wireless Keyboard
X[various names]keybdll.exe"Wareout - malware masquerading as a spyware and dialer remover"
X{2CF0B992-5EEB-4143-99C0-5297EF71F444}"rundll32.exe stlbdist.dllDllRunMain"
X{C2220120-1C24-4a79-BA7A-DDCBFC209DB3}sysfbdgv.exe"Added by the FAKEALERT-AM TROJAN!"
X{DD651081-A909-45ad-BD71-2335B0ADE043}sysutrnez.exe"Added by the FAKEALERT-AH TROJAN!"
X{DD651081-A909-45ad-BD71-2335B0ADE043}sysabmpmfr.exe"Added by the FAKEALERT-AH TROJAN!"
X{DD651081-A909-45ad-BD71-2335B0ADE043}sysnxcphmgy.exe"Added by the FAKEALERT-AH TROJAN!"
X{F758F78B-0885-490e-AA3C-4A38D28B0240}sysyeabdgfp.exe"Added by the FAKEALERT-AM TROJAN!"


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.