Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
Xaccwizz.exeaccwizz.exe"Added by the RULAND.A WORM!"
Xaccwizzz.exeaccwizzz.exe"Added by the RULAND.A WORM!"
UACWLIconACWLIcon.exe"Part of the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
XAdobe_RLXccwap.exe"Added by the BCKDR-RCL TROJAN!"
UAlcWzrdALCWZRD.EXE"RealTek AlcWzrd Application
?Ati2cwxxAti2cwxx.exe"For some ATI video cards. Probably used to access features and may not be required - for example the ATI Radeon works fine without it"
UAtiCwdAtiCwd.exeThis utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
UAtiCwdAtiCwd32.exeThis utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
UAtiCwdAti2cwad.exeThis utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
UAtiCwd32AtiCwd.exeThis utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
UAtiCwd32AtiCwd32.exeThis utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
UAtiCwd32Ati2cwad.exeThis utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
NBCWipeTMbcwipetm.exe"BCWipe Task Manager - scheduler for BCWipe so that it runs at convenient times. You can set a time for running the task
UccWasheraolwasher.exe"Webroot Cache & Cookie Washer - cleaning browser tracks
UCCWC7aac.exe"Moleculesoft Cache
UCCWC7Iidxl.exe"Moleculesoft Cache
UCCWC7sstealth.exe"Moleculesoft Cache
YCCWinTraywintmr.exe"System Tray access to Child Control parental control software by Salfield"
NCheckCustomWorksUpdateCheckCWupdate.exe"Update checker
UClient Access API Daemoncwbappcd.exe"IBM iSeries Client Access
NClient Access Check Versioncwbckver.exe"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
?Client Access Express Welcomecwbwlwiz.exe"Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
NClient Access Help Updatecwbinhlp.exe"Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
NClient Access ServiceCwbSvStr.Exe"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
UClient Access Taskbarcwbuitsk.exe"IBM iSeries Client Access taskbar
UCommand WorkStation 4cws 4.exe"EFI's Command WorkStation makes ""managing demanding workflows easier by centralizing job management. The software automatically identifies the Fiery servers on the network and offers customization options for displaying information"" - for high-end print environments"
NCoolwallpapercwm_tray.exe"Cool Wallpaper software allows you to manage high quality photos as desktop wallpaper and screen savers"
?Crystal 3D Audio ControlCWD3DSND.EXE"Crystal 3D Audio sound driver. Is it required?"
Ncsecwizcsecwiz.exe"Setup wizard for the Client Security Software for IBM\Lenovo notebooks. This entry only runs once
UCWcw4.exe"Chat Watch ""is a monitoring and logging software for online chat and instant messaging programs"""
UCWatchcw.exe"ChatWatch - chat monitoring tool"
Ncwbckvercwbckver.exe"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
Ncwbinhlpcwbinhlp.exe"Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
Ncwbsvstrcwbsvstr.exe"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
?cwbwlwizcwbwlwiz.exe"Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
?Cwcdschk.exeCwcdschk.exe"IBM Thinkpad related?"
Ucwcptraycwcptray.exe"Related to ContentWatch Parental Control internet filter"
Xcwingllibatllsimm.exe"Added by a variant of the SDBOT WORM!"
Xcwriterucookw.exe"Part of the ErrClean rogue system error and cleaning utility and other members of this family. See here for more examples"
Xcwritercwriter.exe"Part of PcRaiser
Ucwupdatecwupdate.exe"ContentProtect from ContentWatch - internet filter"
XDC6cwDC6cw.exe"Part of the DriveCleaner rogue security software - not recommended
UDiscWizardMonitor.exeDiscWizardMonitor.exe"Seagate DiscWizard - hard disk utility for Seagate's SATA and PATA (IDE) drives"
XERScwERScw.exe"Part of the ErrorSafe rogue system error and cleaning utility - not recommended"
Xga6pcwga6pcw.exe"Part of the AVSystemCare rogue security software and other members of this family. See here for more examples"
Xgcwgcw.exe"Part of BestsellerAntivirus
XgdcwGDCW.exe"Part of ContentEraser
Xgescwgescw.exe"Part of BeschermingsTool
Xgfxtray"rundll32 ctccw32.dllfindwnd"
NIBM Client Security Softwarecsecwiz.exe"Setup wizard for the Client Security Software for IBM\Lenovo notebooks. This entry only runs once
XMeuProgramaaccwizz.exe"Added by the RULAND.A WORM!"
NMMCWINMGMTwinmgmt.exe"Used for Enterprise Management. If you are not an IT Administrator you don't need it to be running. Also runs from the PCHealth ""scheduler"" - refer here"
YOfficeScan95pccwin97.exe"Trend Micro antivirus OfficeScan"
UOWCWebCamDVwcdvtray.exe"WebCamDV from Orange Micro
UPCWatchpcwatch.exe"PCWatch surveillance software. Uninstall this software if you did not install it yourself"
UQCWLICONQCWLICON.EXE"Part of IBM Access Connections - forerunner to the current ThinkVantage verison. Connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
URun Google Web AcceleratorGoogleWebAccWarden.exe"Google Web Accelerator"
YSECWIZ98SECWIZ98.EXE"Security Wizard 98 by Chris Farmer. Offers you a variety of ways to restrict access to many of the programs and settings on your PC. Available here"
XServices Start2odcwinst.exe"Added by the PYSKE-D WORM!"
NSetupICWDesktopicwconn1.exeAppears to be the "Internet Connection Wizard" from Internet Explorer being set-up as a desktop shortcut. Appears under the RunOnce registry key but is available under Start -> Programs -> Accessories -> Communication (or similar) anyway
?SoundFusionrundll32 cwcprops.cpl"Control panel item for the Terratec DMX Xfire 1024 soundcard (Start -> Settings -> Control Panel) based upon a Cirrus Logic "SoundFusion" DSP. Does it need to run at start-up every time?"
?SoundFusion"RunDll32 cwaprops.cpl C25CrystalControlWnd"
NStatus MonitorBrMfcWnd.exeBrother scanner status monitor - can be started manually
Xsvcwinprocess32[path to worm]"Added by the UPERING WORM!"
XSyntax Scriptsaskatcw.exe"Added by the SDBOT-TE WORM!"
UThinkVantage Access ConnectionsACWLIcon.exe"Part of the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
UTosHKCWTosHKCW.exeToshiba Hot Key Change/Control Wireless. Permits you to use a hot key to activate/deactivate built-in 802.11b wireless transmission on a laptop (if installed)
UTosHKCW.exeTosHKCW.exeToshiba Hot Key Change/Control Wireless. Permits you to use a hot key to activate/deactivate built-in 802.11b wireless transmission on a laptop (if installed)
XUADCcwUADCcw.exe"AdvancedCleaner rogue security software - not recommended
XUADC_104911963UADCcw.exe"AdvancedCleaner rogue security software - not recommended
XUADC_3240389055UADCcw.exe"AdvancedCleaner rogue security software - not recommended
XUADC_3769470239UADCcw.exe"AdvancedCleaner rogue security software - not recommended
XUADC_4242084050UADCcw.exe"AdvancedCleaner rogue security software - not recommended
XUADC_599141581UADCcw.exe"AdvancedCleaner rogue security software - not recommended
XUADC_815790765UADCcw.exe"AdvancedCleaner rogue security software - not recommended
XUDC6cwUDC6cw.exe"Part of the DriveCleaner rogue security software - not recommended
XUDC6_cwUDC6_cw.exe"Part of the DriveCleaner rogue security software - not recommended
XUERScwUERScw.exe"Part of the ErrorSafe rogue system error and cleaning utility - not recommended"
Xuga6pcwuga6pcw.exe"Part of the AVSystemCare rogue security software and other members of this family. See here for more examples"
Xugcwugcw.exe"Part of the AVSystemCare rogue security software and other members of this family. See here for more examples"
XugdccwUGDCcw.exe"Part of SecurePCCleaner
Xugescwugescw.exe"Part of the ErrClean rogue system error and cleaning utility and other members of this family. See here for more examples"
Xupascwupascw.exe"PersonalAntiSpy rogue spyware remover - not recommended
XUPCTPcwUPCTPcw.exe"Part of the PcTurboPro rogue system optimization tool - not recommended
Xuprpcwuprpcw.exe"PrivacyProtector rogue privacy tool - not recommended
XUSDR6cwUSDR6cw.exe"SystemDoctor rogue security software - not recommended
Xuwa6pcwuwa6pcw.exe"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
Xuwa7pcwuwa7pcw.exe"Part of the WinAntiVirus Pro 2007 rogue security software - not recommended
Xuwas6cwuwas6cw.exe"Part of the WinAntiSpyware 2006 rogue spyware remover - not recommended
Xuwas7cwuwas7cw.exe"Part of the WinAntiSpyware 2007 rogue spyware remover - not recommended"
XWA6PM_Checkudcwap.exe"Part of the DriveCleaner rogue security software - not recommended
XWA6PV_Checkudcwap.exe"Part of the DriveCleaner rogue security software - not recommended
Xwa7pcwwa7pcw.exe"WinAntiVirus Pro 2007 rogue security software - not recommended"
Xwa7pcwwa7pcw.exe"Part of the WinAntiVirus Pro 2007 rogue security software - not recommended
Xwas6cwwas6cw.exe"Part of the WinAntiSpyware 2006 rogue spyware remover - not recommended
Xwas7cwwas7cw.exe"Part of the WinAntiSpyware 2007 rogue spyware remover - not recommended"
XWindows Computer Browserbcwsvc.exe"Added by a variant of the IRCBOT TROJAN! See here"
XWindows FileSharing Servicemcwsvc.exe"Added by the IRCBOT.AJF BACKDOOR!"
XWindowsNT CWServicesCWServices.com"Detected by Bitdefender as the AGENT.AGDK TROJAN! See here"
XWinFixer helperwfxcwr.exe"WinFixer web installer - ""foistware""
XWinsock2 driverkgzgjkpcw.exe"Added by the SDBOT.T TROJAN!"
YXircWinModem4ltcm000c.exe"WinModem drivers. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information"
NZ_acamucli wizardcsecwiz.exe"Setup wizard for the Client Security Software for IBM\Lenovo notebooks. This entry only runs once
X{2C70168B-97CE-4f31-B85D-1FEC5002721D}sysxhtcwbse.exe"Added by the FAKEALERT-AM TROJAN!"


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.