Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
?00saskdanewlock.exe saskda"Part of Access Manager
NAimingClickAimingClick.exe"AimingClick from AimingTech. Web searching tool. Available via Start -> Programs"
UAlfaClock ClassicAlfaClock.exe"AlfaClock Free Edition from AlfaSoft Research Labs - ""enhances your taskbar clock (tray clock) with fully customizable clock display
UAMD PowerNow!GemBack.exe"
?AnnotateCheckAnnCheck.exe"Genius Wizard Pen Tablet driver related. Is it required?"
XAntiSpyCheckAntiSpyCheck.exe"AntiSpyCheck rogue spyware remover - not recommended
XAntiSpyCheck 2.1.0AntiSpyCheck.exe"AntiSpyCheck rogue spyware remover - not recommended
YAqua DockAqua Dock.exe"Aqua Dock - 'free program that allows you to have an ""OS X"" style
YArcaCheckArcaCheck.exe"Part of the ArcaVir antivirus suite from Polish company Arcabit. What does this part do?"
UAtrackatrack.exe"New feature of Norton Internet Security (NIS) and Norton Personal Firewall (NPF) 3.0 is the Alert Tracker
NAudioDeckADeck.exeADeck.exe is a system tray application for VIA's sound cards which offers quick access to a number of sound card related items
NBMail InstallationFTP_back.exe"Part of iMesh - a file sharing system. Reported by Norton AntiVirus as a trojan. Once deleted does not prevent file sharing working. Older versions of iMesh re-instate this but the newer versions do not"
XBrowser Paladblck.exe"BrowserAid/BrowserPal foistware"
?BullsEye TrackerBeTrack.exeBullseye - intelligent research assistant
NCamCheckCamCheck.exe"NuCam camera software related"
XCashBackcashback.exe"Part of eXact Advertising Software
XCBACK.EXECBACK.EXE"Added by the PENTA-A TROJAN!"
UChamClockChamClock.exe"Chameleon Clock - system tray clock replacement"
XCheckCheck.exe"Added by the VB-DRN WORM!"
UCleverKeysCK.exe"CleverKeys - ""is free software that provides instant access to definitions at Dictionary.com
UCloneCDElbyCDFLElbyCheck.exe"From Elaborate Bytes who make CloneCD - monitors the installed filters of CD-ROMs/DVD-ROMs. Note - under Win2K removing this from startup causes the CD drive in the computer to not be recognized in the OS and after rechecking it prompts that the driver has been corrupted and asks you to restart the computer to fix it"
Xcls_pack.execls_pack.exe"Added by the Malware Defense rogue security software. Also detected as the FAKEAV-AQB TROJAN!"
XCPCmscl0ckCPCmsclock.ExE"Added by the IRCFLOOD.BF TROJAN!"
UCTCheckCTCheck.exe"Associated with the ZEN range of MP3 players from Creative Technology Ltd. A visitor recommended the ""U"" status but what does it do?"
XDatcheckdatcheck.exe"Added by the KEYPANIC TROJAN!"
XDirLockerdirlock.exe"Added by the AUTORUN-AMS WORM!"
UDS Clockdsclock.exe"Digital desktop clock including synchronization with atomic servers - see here"
Xduckduck.exe"Added by the AGOBOT-AVG WORM!"
?DVDCheckDVDCheck.exe"Related to an Intervideo program. What does it do and is it required in startup?"
UElbycheckElbyCheck.exe"From Elaborate Bytes who make CloneCD - monitors the installed filters of CD-ROMs/DVD-ROMs. Note - under Win2K removing this from startup causes the CD drive in the computer to not be recognized in the OS and after rechecking it prompts that the driver has been corrupted and asks you to restart the computer to fix it"
YeRecoveryServicecheck.exe"Now part of Acer Empowering Technology. ""Acer eRecovery Management is a powerful utility that does away with the need for recovery disks provided by the manufacturer
UERUNT AutoBackupAUTOBACK.EXE"ERUNT backup utility - when added to the user's startup folder automatically backs up the registry each time the system boots
YFix-it AVmemcheck.exePart of Ontrack's Fix-it Utilities Suite anti-virus. Performs a quick check of memory for signs of any virus. Exits afterward and returns all resources used in one user's experience. Not required but could be left without a drain on resources
?frgukshdrkmck.exe"??"
XFW Managerfwcheck.exe"Added by the DELBOT-H WORM!"
UHDAudDeckHDeck.exe"XP control panel for VIA Vinyl HD Audio Codecs from VIA Technologies
Niecheckiecheck.exe"Integrity checker for IconEdit2 icon editor. It serves for IconEdit2 internal tasks only and can be safely deleted from the system if you are running the latest version of IconEdit2"
XIExplorerServiceWinSock.exe"Added by the AGENT.KIU TROJAN!"
?immcheck.exeimmcheck.exe"Related to I-FORCE driver for force feedback steering wheel?"
XIP Stackipstack.exe"Added by the AGOBOT.CW WORM!"
Xjucheckjucheck.exe"Added by the SCRIMGE.O WORM!"
ULClocklclock.exe"LClock is a program that makes the Windows' clock look like a Windows Longhorn Clock"
XMail_CheckMail_Check.exe"Added by the PANOIL.C WORM!"
XMedia AccessMediaAccK.exe"WindUpdates MediaPass adware"
UMessage_Blockermessageblock.exe"Message Blocker - "prevents Outlook Express from loading images or other content from the internet without confirmation
XMessenger Blockmsngrblock.exe"Added by the PATOO WORM!"
XmFilterMNeck.exe"Added by the CLICKER-AG TROJAN!"
XMicrosoft Digital Clockmsclock.exe"Added by the NACKBOT-D WORM!"
XMicrosoft Directx clickdirectxclick.exe"Added by a variant of the RBOT-GHT WORM!"
XMicrosoft Winsockmswinsck.exe"Added by the RBOT-ANK WORM!"
XMircosoft Sockets SP2mssck.exe"Added by the MYTOB.ET WORM!"
XMP Tcloakssmptclock.exe"Added by the NACKBOT-B WORM!"
XMP Tclockvvmptclock.exe"Added by the NACKBOT-A WORM!"
XMP Tclockvvmptclock.exe"Added by the NACKBOT-A WORM!"
XMS Config LoaderMSWin32bck.exe"Added by the GAOBOT.AA WORM!"
XMSN Popup Blockermsnpopblck.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
Xmssdbsrvmsupdtck.exeAdded by a variant of a password stealing TROJAN!
XNero Checkernerocheck.exe"Added by the PROXY-X TROJAN! Note - this is not related to ""Nero Burning Rom"" CD writing software"
UNeroChecknerocheck.exeAssociated with "Nero Burning Rom" CD writing software. Checks for driver issues
UNeroFilterCheckNeroCheck.exeAssociated with "Nero Burning Rom" CD writing software. Checks for driver issues
XNetReachnrcheck.exe"Added by an unidentified VIRUS
Unewlocknewlock.exe"Part of Access Manager
Unewlock.exenewlock.exe"Part of Access Manager
XNokia Checknokiacheck.exe"Added by the RBOT.CDC WORM!"
?Norton Program Scheduler Event Checkernpscheck.exe"Part of Norton Anti-Virus. What does it do? Apparently it can safely be disabled without causing problems. Can also be listed as NPS Event Checker"
?NPS Event Checkernpscheck.exe"Part of Norton Anti-Virus. What does it do? Apparently it can safely be disabled without causing problems. Can also be listed as Norton Program Scheduler Event Checker"
XNSCheckNSCHECK.EXE"MarketScore parasite - ActiveX control used to download premium-rate dialers"
YOBRCheckcheck.exe"Now part of Acer Empowering Technology. ""Acer eRecovery Management is a powerful utility that does away with the need for recovery disks provided by the manufacturer
NOEXCheckEA2Check.exe"Express Assist from AJSystems.com. Utility for use with Outlook Express to backup
UosCheckosCheck.exe"Part of Norton Antivirus. Initiates a quick scan (at startup) of the portions of the OS Symantec currently (as defined by the most recent updates downloaded onto the host computer) thinks are most susceptible to infection. This scan is not necessary for proper operation of Norton Antivirus"
YOutpostFeedBackfeedback.exe"Part of Outpost firewall by Agnitum. The feedback service is for reporting issues directly to Agnitum from within OP"
UPCMagInstaback2InstaBack.exe"
NPhoto Express Calendar Checker SECALCHECK.EXE"If you create multiple Weekly/Monthly/Yearly calendars to use as your wallpaper
UPhotoExplosionCalCheckcalcheck.exe"Calendar management feature of Nova Development's Photo Explosion"
YPinnacleDriverCheckPSDrvCheck.exe"Part of Pinnacle Systems InstantCD/DVD and InstantCopy CD/DVD copying software that verifies drive settings. Once loaded it doesn't use any resources so you can leave it enabled"
UPlus! Alarm ClockAlarmClock.exeAlarm Clock function of Microsoft Plus! Digital Media Edition (which is no longer available)
UPPMemCheckppmemcheck.exe"PPMemCheck - used to be part of PestPatrol before CA's acquisition"
YPSDrvCheckPSDrvCheck.exe"Part of Pinnacle Systems InstantCD/DVD and InstantCopy CD/DVD copying software that verifies drive settings. Once loaded it doesn't use any resources so you can leave it enabled"
YQH Office 2K CheckO2KCHECK.EXE"Quick Heal Anti-Virus MS Office documents virus checker"
XQuickInstallPackQuickInstallPack.exe"Installed and used by rogue security products such as Cleaner2009
NRocketDockRocketDock.exe"""RocketDock is a smoothly animated
Xrun32dllWINClock.exe"Added by an unidentified VIRUS
Xrunner1faceback.exe"Added by the DLOADR-BSX TROJAN!"
Xsclicksclick.exe"Added by the FAKEALERT TROJAN!"
USecurePCSolutionsBootCheckBootCheck.exe"1 Click Fixer PLUS from Secure PC Solutions ""takes the guesswork out of locating and solving problems in the Windows registry"""
XSessionMngrdirlock.exe"Added by the DAPROSY WORM!"
XShedulernerocheck.exe"Added by the TACTSLAY.B TROJAN!"
USkinClockAtomicAlarmClock.exe"Atomic Alarm Clock - ""Alert yourself about important events with different alarms and replace your computer tray clock using different skins. Computer Alarm clock that will play any MP3 file. It can also run a program
USoloSysCheckSyscheck.exe"Solo antivirus System Integrity Check - Monitors system registry
XSrvce Pack Updtesvcpack.exe"Added by a variant of the RBOT WORM!"
UStardock ObjectDockObjectDock.exe"Stardock ObjectDock is a program that enables users to organize their shortcuts
USuperAdBlockerSAdBlock.exe"SuperAdBlocker"
XSVC Servicesvcpack.exe"CoolWebSearch Svcinit parasite variant"
XSystemwinipck.exe"Added by the RBOT-TK WORM!"
XSystem Update2webcheck.exe"Added by the AUTOTROJ-C TROJAN!"
XSystemCheckSystemcheck.exe"Added by the LAVITS WORM!"
USystweak Ad and Popup Blockeradblock.exe"Ad and popup blocker part of Advanced System Optimizer from Systweak"
UTClockTCLOCK.EXEKazubon TClock. Utility that amongst other things synchronizes your system clock with Internet time servers. Available via Start -> Programs
XTClock.exetclock_install.exe"TClock - distributed and installed without user permission by other rogue software or malware. TClock contains no uninstall facility through Windows. As TClock is of dubious origin and usefulness
Xtcp checkertcpcheck.exe"Added by the VBBOT-A TROJAN!"
UTiTleBarClockTiTleBarClock.exe"TitleBarClock - displays Day
UTopmostClockTopMostClock.exe"TopMost Clock - transparent analog clock which displays on top of your other windows"
NUlead Calendar CheckerCalCheck.exe"Ulead Calendar Checker - part of Ulead Photo Express - automatically replaces your calendar desktop wallpaper on a weekly/monthly/yearly basis if you've created them. Not required - change them manually"
NUlead Photo Express Calendar Checkercalcheck.exe"If you create multiple Weekly/Monthly/Yearly calendars to use as your wallpaper
NUlead Photo Express x.0 Calendarcalcheck.exe"Ulead Calendar Checker - part of Ulead Photo Express
YUrlLstCkUrlLstCk.exe"Part of Norton Internet Security. From Symantec - ""UrlLstCk.exe is a necessary file that will be present in %Program Files%\Norton Internet Security. It is a URL Checklist. It should not be disabled"""
YURLLSTCK.exeUrlLstCk.exe"Part of Norton Internet Security. From Symantec - ""UrlLstCk.exe is a necessary file that will be present in %Program Files%\Norton Internet Security. It is a URL Checklist. It should not be disabled"""
YVOBRegCheckVOBRegCheck.exe"Part of Pinnacle Systems InstantCD/DVD and InstantCopy CD/DVD copying software that verifies drive settings. Once loaded it doesn't use any resources so you can leave it enabled"
XVsamplewinxpsock.exe"Added by the SDBOT.BLK WORM!"
UWarning: do not remove it!fpplock.exe"Part of Folder Password Expert by ZQS Software Team - ""a software program to restrict access to the folders that contain your sensitive data"""
?WatchDogDVDCheck.exe"Related to an Intervideo program. What does it do and is it required in startup?"
NWetSockwetsock.exe"RoboMagic Wetsock - weather reporting in the System Tray"
XWinCheckWinCheck.exe"Added by the PWS-CY TROJAN!"
XWinCheckcheck.exe"Added by the DELBOT-Y WORM!"
XWindows (random character)diskcheck.exe"Added by the SINGU.B TROJAN!"
XWINDOWS FUCK BY CLASICfuck.exe"Added by the ZOTOB.H or ZOTOB.J WORMS!"
XWindows MeTaLRoCk servicemetalrock.exe"Added by the TASTYRED TROJAN!"
XWindows NT Service Namewinshock.exe"Added by the RBOT-PK WORM!"
Xwindows system servicewinsock.exe"Added by the RBOT-MR WORM!"
XWinpackwinpack.exe"Adware - detected by Kaspersky as the AGENT.GG TROJAN!"
Xwinsock.clientwinsock.exe"Added by the DIABLO-M TROJAN!"
NWinZip Quick PickWZQKPICK.EXE"Added with WinZip version 8.1. "The new WinZip Quick Pick taskbar tray icon gives you instant access to WinZip and your Zip files. Just left click the icon to open WinZip
XXP Service Packxpservicepack.exe"Added by the SDBOT.AQA WORM!"
Uzzsecagentnewlock.exe login shutdown"Part of Access Manager
X[various names]StatusCheck.exe"Wareout - malware masquerading as a spyware and dialer remover"


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.