Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
X%Temp%%Temp%delwdef2008.bat"WinDefender 2008 rogue privacy program - not recommended
XAcrobatacrmon32.exe"Added by the SMALL-ECT TROJAN!"
UAcrobat AssistantAcroTray.exe"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
UAcrobat Assistant 7.0Acrotray.exe"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
UAcrobat Assistant 8.0Acrotray.exe"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
XAcrobat Readacroup32.exe"Added by the VANBOT-BQ TROJAN!"
NAcrobat Speed Launchacrobat_sl.exe"Speeds up the time it takes to load Adobe's Acrobat PDF creation and management tool. From version 7.0 onwards"
XAdobesysbat32.exe"Added by the LOWZONES.T TROJAN!"
NAdobe AcrobatREADER~1.EXE"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
NAdobe AcrobatReader_sl.exe"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
XAdobe Acrobat Distiller Applicationacrotray.exe"Added by the RANDEX.DFJ WORM!"
XAdobe Acrobat Reader CFG[random filename]"Added by a variant of the RBOT WORM!"
NAdobe Acrobat Speed Launcheracrobat_sl.exe"Speeds up the time it takes to load Adobe's Acrobat PDF creation and management tool. From version 7.0 onwards"
XBatsecure2.bat"Added by the ZCREW.C TROJAN!"
NBatchreg1N/A"Part of the Windows System Recovery process. Added to the registry via Msbatch.inf. The existence of this key or process after the last reboot during installation indicates an unsuccessful installation
UBatInfEx"rundll32.exe [path] BatInfEx.dllBMMAutonomicMonitor"
UBatLogEx"rundll32.exe [path] BatLogEx.DLLStartBattLog"
XBatSrvbatserv2.exe"Detected by Kaspersky as the LOCKSY.M WORM!"
UBattery Scopebatmgr.exeMonitors battery levels on a notebook/laptop PC
UBatteryBarbatterybar.exe"BatteryBar - displays battery usage
Ybatterymiserbatterymiser.exe"Battery Miser power management utility for LG Notebooks"
YBatteryMiser 5BatteryMiser5.exe"Battery Miser 5 power management utility for LG Notebooks"
XBatzBackBatzBack.scr"Added by the BACKZAT WORM!"
XBlank AntiViriAUT0EXEC.BAT StartUp"Added by the BRONTOK-CJ WORM!"
UBLOG"rundll32.exe [path] BatLogEx.DLLStartBattLog"
UBMMMONWND"rundll32.exe [path] BatInfEx.dllBMMAutonomicMonitor"
NCaptureBatCapture.exe"!Quick Screen Capture from EtruSoft Inc. - ""allows you to take screenshots from any part of your screen in more than 10 ways
Xchkdskautoexec.bat"Added by the ANPES WORM!"
Xcqlygworld_cup_.bat"Added by the WCUP.A WORM!"
Xcrash0001restorecrashwin32.bat"Added by the AGENT-ZC TROJAN!"
XCritical Update Checkbattlenet.exe"Added by the DELF-LB TROJAN!"
?Dosbat??"??"
XDownxzDownxz.bat"Added by the MYDOOM.W WORM"
XEbatesMoeMoneyMakerwjview ...Code"Ebates adware"
XEbatesMoeMoneyMaker0EbatesMoeMoneyMaker0.exe"Ebates adware"
Xebmmmebatesmmmv.exe"Ebates adware"
Xeixfichina.bat"Added by the WCUP.A WORM!"
XEspecialDeneca.bat"Added by the DELUZ VIRUS!"
XFirewallFirewall.bat"Added by the YPSAN.G WORM!"
Yiconcacheicon.bat"Related to the Vista Customization Pack"
Xinstitinstit.bat"Added by the OPASERV.H WORM!"
XinstitINSTIT.BAT"Added by the OPASERV.K WORM!"
UisDeleteMeisDel.batUsed by Norton Internet Security to remove certain files and directories on reboot when uninstalling their product
XJava (VM) v6.9jav.bat"Added by the AGENT-GZK TROJAN!"
XJava VM v6.9.2jav.bat"Added by the DWNLDR-HLM TROJAN!"
XJava VM v6.91jav.bat"Added by the DWNLDR-HLL TROJAN!"
Xjijblezlwy.bat"Added by the REDDW WORM!"
UKE9801DriBat32.exeKE9801 multimedia keyboard driver - required if you use the multimedia keys
Xkfienqmasbl.bat"Added by the KIFER TROJAN!"
NKodak Batch Transferpezdow1.exePart of "Kodak Picture Easy" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC
NKodak Picture Easy *.* Batch TransferPezDownload.exe"Part of ""Kodak Picture Easy"" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC. *.* represents the version"
XLivreDibane.bat"Added by the BANEDI VIRUS!"
Xlsassstart.bat"Added by the ZCREW TROJAN!"
XMicrosoftKsDrivers.bat"Added by the SHUTDOWN-F TROJAN!"
Xmsconfigmsconfig.bat"Added by the PAHATIA.B WORM!"
Xmsdir32msdir32.bat"Added by the ROOKIE-A TROJAN!"
XMSNMSGREswef.batIRC backdoor TROJAN or WORM!
XMSNMSGRRswin.batIRC backdoor TROJAN or WORM!
XMSNMSGRSswe.batIRC worm or backdoor trojan!
XMSNMSGRSswiss.batIRC worm or backdoor trojan!
XMSNMSGRS1swed.batIRC backdoor TROJAN or WORM!
XPC2Xinitial.bat"Added by the DWNLDR-FZZ TROJAN!"
?POS-PartnerbatchprocessorBATCH.EXE"VISA credit card batch processing related to Appcon. Is it needed or can it be started manually via Start -> Programs or a manually created shortcut?"
UPower_GearBatteryLife.exePower management for all Asus notebook. Useful but not critical
Xprint sharingstart.bat"Added by the ZCREW TROJAN!"
Upyrobatchftppyrobatchftp.exe"""PyroBatchFTP lets you transfer files to/from FTP/SFTP servers in an automatic and unattended way through a simple to learn batch/script language"""
Upyrobatchftp.exepyrobatchftp.exe"""PyroBatchFTP lets you transfer files to/from FTP/SFTP servers in an automatic and unattended way through a simple to learn batch/script language"""
UPyroTranspyrobatchftp.exe"""PyroBatchFTP lets you transfer files to/from FTP/SFTP servers in an automatic and unattended way through a simple to learn batch/script language"""
XRebateNation0RebateNation0.exe"RebateNation adware"
Xrun windowsservic.bat"Added by the REBOOT-AP TROJAN!"
Xrundll***die.exe [path] secure.bat"Added by the SUMTAX TROJAN! where *** is 134
?scriptscript.bat"Maybe associated with DOS on a Win9x machine"
Xservicesstart.bat"Added by the ZCREW TROJAN!"
Xshambl3rcnf.bat"Added by the REMABL WORM!"
XSistray32win.bat"Added by the JUMPRED.A WORM!"
XSMiro.bat"Added by the IROFFER.CT TROJAN!"
XSMSiro.bat"Added by the IROFFER.CT TROJAN!"
XSpees2Speedy.bat"Added by the OPASERV.AD WORM!"
Xsuicidetempfile2.bat"Personal Protector rogue security software - not recommended
XtaengtaeAutoRun.bat"Added by the GATINA-B WORM!"
Xtalktalk.bat"Added by the TIOTUA-G WORM!"
XTANG_INA_MOAutoRun.bat"Added by the FILUKIN.A WORM!"
XTasmgrTaskmgr.bat"Added by the YPSAN.G WORM!"
Xtypebat.exe"Added by the ANSKYA-A WORM!"
UVERBATIM STORE 'N' Gverbatim store 'n' go.exe"Loads the driver for the Verbatim Store'n'Go PRO USB Flash Drive - reportedly required only on systems running Windows 98 and Millennium"
XWebRebates0WebRebates0.exe"WebRebates adware"
XWebSavingsfromEbatesWebSavingsfromEbatesrun.exe"Web Savings From Ebates Software
XWebSavingsFromEbates0WebSavingsFromEbates0.exe"Web Savings From Ebates Software
XWIND0WSmella.bat"Added by the ALLEM WORM!"
XWindows System 32-Bat Servicewin32bat.exe"Added by the MYTOB.FI WORM!"
XWormslogon.bat"Added by the DELMP3-A WORM!"
XXecuter.batpsexec.bat"Added by the BOOHOO WORM!"
X[12 random characters]batmeter.exe"IeDriver adware variant"


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.