Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40
41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77
78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99
If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
Version"NVIDIA Compatible Windows Vista Display driverU"RUNDLL32.EXE NvCpl.dll
Version"NVIDIA Compatible Windows7 Display driverU"RUNDLL32.EXE NvCpl.dll
Version"NVIDIA Driver Helper ServiceU"RUNDLL32.EXE nvsvc.dll
X(Default)media_driver.exe"Added by the TUPEG VIRUS! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
XADriverwindrv.exe"Added by the DELF.WG TROJAN!"
XATI Display Driveratixd.exe"Added by the RBOT-FOV WORM!"
XATI Video Driver Controlatigfx.exe"Added by the RBOT-FWL WORM!"
XATI Video Driver Controlbtorrent.exe"Added by a variant of the IRCBOT TROJAN!"
XATI Video Driver Controls[path to worm]"Added by the SDBOT-DDS WORM!"
XatidriverreaIplayer.exe"Added by the WARPIGS-E WORM! Note the uppercase ""I"" in the filename
UAXIS Print System DriverScannerDriverScanner.exe"Part of AXIS Print System from AXIS Communications - ""adds printer discovery
UAXIS Print System DriverServerDriverServer.exe"Part of AXIS Print System from AXIS Communications - ""adds printer discovery
XCall Function System32sddriver.exe"Added by a variant of the SDBOT TROJAN!"
XCDriverwindrv.exe"Added by the DELF.WG TROJAN!"
XCDriversvchost.exe"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
UComm Drivercommh32.exe"G Data ""PC Spion"". PC monitoring and surveilling software
XCompaq DriversF1rewalls.exe"Added by the SDBOT-WD WORM!"
XCompaq Jes Driverswinjes.exe"Added by the SDBOT-XR WORM!"
XCompaq Service Driverssysteminfos.exe"Added by the SDBOT-XC WORM!"
XCompaq Service Driverscompq.exe"Added by a variant of the SDBOT WORM!"
XCompaq Service Driversnavapqwa.exe"Added by the SDBOT.BBQ WORM!"
XCompaq Service Driversamsn.exe"Added by a variant of the SDBOT WORM!"
XCompaq Service Driverscompqs.exe"Added by a variant of the SDBOT WORM!"
XCompaq Service Driversmsnt.exe"Added by the SDBOT.CQL WORM!"
XCompaq Service DriversNtKernelSystem.exe"Added by a variant of the SDBOT WORM!"
XCompaq Service Driverswincmd.exe"Added by the RBOT.ATV WORM!"
XCompaq Service Driverswind32.exe"Added by a variant of the SDBOT WORM!"
XCompaq Service Driverswinmsn.exe"Added by a variant of the SDBOT WORM!"
XCompaq Service Driverscompaq.exe"Added by the SDBOT-AFU WORM!"
XCompaq Service Driversmsnsvc.exe"Added by the RBOT.BKT WORM!"
XCompaq Service Driversntsys32.exe"Added by the RBOT.CIW WORM!"
XCompaq Service Driverswinsvc.exe"Added by the SDBOT-AGD WORM!"
XCompaq Service Drivers 32compq32.exe"Added by a variant of the SDBOT WORM!"
XCompaq Services Driversndt32.exe"Added by the RBOT.CQZ WORM!"
XCompaq Sound Drivers For WINDOWSsounddr.exe"Added by the SDBOT-XG WORM!"
XCompaq32 Service Driversms32.exe"Added by the SDBOT.BWH WORM!"
XCompaq32 Service Driversmsconfig32.exe"Added by the SDBOT-ADC WORM!"
XCompaq32 Service Driversmsnt32.exe"Added by the RBOT.BVF WORM!"
XCompaqs Service Drivercopypad32.exe"Added by the SDBOT.CSO WORM!"
XCompaqs Service Driverscompqs.exe"Added by a variant of the SDBOT WORM!"
XConfiguration Driverscghost.exe"Added by the SDBOT-DLA WORM!"
XCreative Audio Driverscreative.exe"Added by the RBOT-FKR WORM!"
XDDriverwindrv.exe"Added by the DELF.WG TROJAN!"
XDDriversvchost.exe"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
XDevice Security Driverdevicesec.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
XDirectX Driverstdhost.exe"Added by the SDBOT.GVJ BACKDOOR!"
XDirectX shell driver[path to trojan]"Added by the MARKTMAN-B TROJAN!"
XDirectx Startup Driversdirect.exe"Added by the RBOT.UXL WORM!"
XDirectX Video Driverdxterm5.exe"Added by the WILAB-A TROJAN!"
XDisplay Driverscssrs.exe"Added by the AGOBOT.FX WORM!"
XDLINK dfe drivers for Windows NTwindfe.exe"Added by the RANDEX.AK WORM!"
XDrivergbot.exe"Added by the JUNTADOR.K TROJAN!"
XDriver32Scam32.exe"Added by the SIRCAM WORM!"
XDriverChecksvchost.exe"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
XDriverConfdvrconf.exe"Added by the AGOBOT-IY WORM!"
XDriverDBsvcmdx32.exe"Added by the BERPI TROJAN!"
XDriverLoadsvchost.exe"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
UDriverMagicLogondmschedule.exe"Part of DriverMagic - ""the easiest way to locate device drivers"""
NDriverMaxdevices.exe"DriverMax from Innovative Solutions - ""a new tool that allows you to download the latest driver updates for your computer. No more searching for rare drivers on discs or on the web or inserting one installation CD after the other"""
XDriverModulecsrnvrt.exe"Added by the IRCBOT.I TROJAN!"
XDriverPathsystem32.exe"Added by the PRORAT-S TROJAN!"
XDrivers for Internet Exploreraccesweb.exe"Added by the STARTPAGE.FW TROJAN!"
XDSystemDriverwindrv.exe"Added by the DELF.WG TROJAN!"
Xeth0 driverexec.exe"Added by the SPYBOT-Z WORM!"
XEthernet Drivercmsrrs.exe"Added by a variant of the RBOT WORM!"
XEthernet Driverssmrrs.exe"Added by the RBOT-AAK WORM!"
XEthernet Driversethernet.exe"Added by the GAOBOT.CEZ WORM!"
XFDriverwindrv.exe"Added by the DELF.WG TROJAN!"
XFiles Driversdphost.exe"Added by the SDBOT-DKZ WORM!"
XFiles Driversfdhost.exe"Added by the AGOBOT-AJC BACKDOOR!"
XFireFox Service Driversssmss.exe"Added by a variant of the SDBOT WORM!"
XFireFox Startup Driverswuaclt.exe"Added by the RBOT.BYX WORM!"
XFireWire Driversamx.exe"Added by the SDBOT.AE WORM!"
XFlash Driver[path to trojan]"Added by the AGENT.CWVT TROJAN!"
NGDriveGDriver.exeFound on IBM systems. All it does is set the CDROM drive letter to G:. Set your drive letter manually via Start -> Settings -> Control Panel -> System -> Device Manager
XGenius Mose Driversvghost.exe"Added by a variant of the SPYBOT WORM! See here"
XGraphic Driversmss32.exe"Added by a variant of the RBOT WORM!"
UGravis Xperience Driver SupportGrxp4exe.exe"Driver for Gravis game controllers such as the Eliminator Aftershock. Must be loaded if you run the supplied application software for the controller to be recognized. Start it manually via a shortcut if not used"
Xh4te Service Driversh4te.exe"Added by a variant of the RBOT WORM!"
XHDAudio Driver 1.0[random filename].exe"Added by the TEADOOR-D TROJAN!"
XHDAudio Driver 2.0[random filename].exe"Added by the TEADOOR-E TROJAN!"
XHP Service Drivershdsys.exe"Added by the SDBOT-ZE WORM!"
XIBM Keyboard Driverikeybdrv.exe"Added by the SDBOT.IC TROJAN!"
XIEDriverIEDriver.exe"IEDriver adware. Can be installed as part of peer-to-peer file sharing software called URLBlaze"
XIEDriverxplore.exe"IeDriver adware variant"
XIEDriverTD.exe"IeDriver adware variant"
XIntec Service Driversmsmsgrs.exe"Added by the SDBOT-ADN WORM!"
XIntec Service Drivers[path to worm]"Added by the RBOT-GLU WORM!"
XIntec Service Driverswing32.exe"Added by the RBOT.HAZ WORM!"
XIntec Service Driversmsmsgredss.exe"Added by the SDBOT-AGL WORM!"
XIntec Services Driverrswinrvc.exe"Added by a variant of the SDBOT WORM!"
XIntec Services Driversmsupdate22e.exe"Added by the RBOT-CGC WORM!"
XIntel Drivercsrs.exe"Added by a variant of the SDBOT WORM!"
XIntel Service Driversmsconfig16.exe"Added by the MSCONFIG16 TROJAN!"
XInternet Application DriverexpIorer.exe"Added by the IRCBOT-WK TROJAN!"
XiPOD USB DriverIPODUSB.EXE"Added by a variant of the RBOT WORM!"
XIPOT Service Driverscompaq.exe"Added by a variant of the FUROOTKIT TROJAN!"
XIPOT USB Service DRIVERhpsebc087.exe"Added by the SDBOT-WA WORM!"
XIPv6 Helper Drivercsass.exe"Added by the AGOBOT.TC WORM!"
XLAN Driverlandriver32.exe"Added by the RBOT.BT WORM!"
Xldriverldriver.exe"Added by the CHORUS-A TROJAN! Searchforfree browser hijacker"
XLinksys Modem Driverslinksys.exeAdded by the IRCBOT.VD WORM!
XLOCAL INTERNET WEB DRIVERS FOR WIN32phqghume.exe"Added by a variant of the RBOT WORM!"
XM S DVD DirectX Dll Driversmsxdl.exe"Added by the SDBOT-BJN WORM!"
XMajor Microsoft Windows Driver Boot loaderbpool.exe"Added by the MYTOB.AJ WORM!"
XMicrosoft (R) Windows TCP/IP Socket Driver[path to trojan]"Added by the PROXY-DD TROJAN!"
XMicrosoft Driverfaet.exe"Added by a variant of the RBOT WORM!"
XMicrosoft Driver Controlwindrv.exe"Added by the SDBOT.FW WORM!"
XMicrosoft Driver Managermswindrv.exe"Added by the FORBOT-EZ WORM!"
XMicrosoft Driver Setupmsddrv42.exe"Added by the PALEVO WORM!"
XMicrosoft Driver SetupJwrb.exe"Added by the AUTORUN-AOB WORM!"
XMicrosoft Driver Setupdllhost.exe"Added by the AUTORUN-AOZ WORM!"
XMicrosoft Driver Setupsysmngsr322.exe"Added by the BUZUS-AS TROJAN!"
XMicrosoft Driver Setupw7services.exe"Added by the AUTORUN-ARJ WORM!"
XMicrosoft Driver Setupmslsrv32.exe"Added by the SDBOT-DPF TROJAN!"
XMicrosoft Driver Setupccdrive32.exe"Added by the AGENT-LYL TROJAN!"
XMicrosoft Driver Setupcidrive32.exe"Added by the AGENT-NES TROJAN!"
XMicrosoft driver updateMshome.exeAdded by the SDBOT.BL WORM!
XMicrosoft DriversWSconf.exe"Added by a variant of the SDBOT WORM!"
XMicrosoft NT Driversntdrv.exeAdded by the SDBOT.AJN TROJAN!
XMicrosoft Proc Driver32msprc.exe"Added by a variant of the WOOTBOT WORM!"
XMicrosoft Service DriversSystem.exe"Added by a variant of the RBOT WORM!"
XMicrosoft Service DriversVSADNIM.exe"Added by a variant of the RBOT WORM!"
XMicrosoft Sound Driversound32.exe"Added by a variant of the SPYBOT WORM!"
XMicrosoft Update Device Driverswuauclt.exe"Added by a variant of the SDBOT WORM! Note - this is not the legitimate wuauclt.exe process
XMicrosoft Update Driversexplorers.exe"Added by a variant of the SDBOT WORM!"
XMicrosoft UpToDate Driver (32-bits)[random filename].exe"Added by the SPYBOT.LXJ WORM!"
XMicrosoft USB Windows2 Driverusbautotuner.exe"Added by the SILLYFDC.BCL WORM!"
XMicrosoft USB2 Drivercrmss.exe"Added by the RBOT-VK WORM!"
XMicrosoft Video Drivervideodrv.exe"Added by the SDBOT-AGP WORM!"
XMicrosoft Windows Driverswindrv.exe"Added by a variant of the SDBOT WORM!"
XMicrosoft Windows Sound Driverssounddrivers.exe"Added by the SLENFBOT.ABU WORM!"
XMicrosoftDriverService32drsys32.exe"Added by the IRCBOT.AKX BACKDOOR!"
XMicrosoftKsDrivers.bat"Added by the SHUTDOWN-F TROJAN!"
XMicrosoftROMDriverServicecdrss.exe"Added by the IRCBOT.BLF BACKDOOR!"
XMicrsoft Driverwindrive.exe"Added by the SDBOT.AF TROJAN!"
XMicrsoft Drivermsdriver.exe"Added by the SDBOT-XD WORM!"
XMicrsoft Driverwindrive32.exe"Added by the SLINBOT.TT BACKDOOR!"
XModem Driverz Updatesmdmdrv.exe"Added by a variant of the SDBOT WORM!"
XMPL32 driverMPL32.exe"Added by the LOONY-M TROJAN!"
XMS DirectX Sound Driversmsdrvdx.exe"Added by the RBOT.BCX WORM!"
XMS DVD DirectX Dll Driversmdxdl.exe"Added by the SDBOT-XI WORM!"
XMS DVD DirectX Sound Driversmsdrvdx.exe"Added by the SDBOT-XJ WORM!"
XMS Service Driverswinscv.exe"Added by the SDBOT-COG WORM!"
XMs Sound Driversmsdrv.exe"Added by the SDBOT-WR WORM!"
XMS Win32 Network Serviceswindriver.exe"Added by the AGOBOT.ADH WORM!"
XMS Windows AOL DriverMSAOLdrv.exe"Added by the RBOT-ASP WORM!"
XMSNFixdriver.exe"Added by the SILLYFDC.BBY WORM!"
XMstask32driverMstask32.exe"Added by the LOONY-D TROJAN!"
XMsWindows DRT Driverswsdrt32.exe"Added by the RBOT.ALT WORM!"
XMsWindows SSL Driversmssl32.exe"Added by the SPYBOT.API WORM!"
Xnetwork device drivermsfirewall.exe"Added by the DELF-LB TROJAN!"
XnodriverAUEKXRZ.EXE"Added by a variant of the SPYBOT WORM!"
XnodriverSVCHOST.EXE"Added by the SPYBOT-Z BACKDOOR! Note - this is not the legitimate svchost.exe process which should normally figure in Msconfig/Startup!"
XNorton Service Driverwsul.exe"Added by the RBOT-ABI WORM!"
Xnsdrivernssys32.exe"NetShagg adware"
XnVidia Application Driversnvidiav32.exe"Added by a variant of the IRCBOT BACKDOOR!"
XnVidia Display Drivernvsvc64.exe"Added by the IRCBOT-YK WORM! Note - this is not related to any nVidia based graphics card"
XnVidia Display Drivers (x86)nvsys86.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
XNVIDIA DriverMSPMSPSU.EXE"Added by the WOOTBOT.Y WORM!"
XnVidia DriversnVidiaDrvers.exe"Added by the SDBOT-AFX WORM! Note - this is not related to any nVidia based motherboard or graphics card"
XNVidia Drivers[path to trojan]"Added by the RANCK-R TROJAN! Note - this is not related to any nVidia based motherboard or graphics card"
XnVidia System Driversnvsys32.exe"Added by an unidentified WORM or TROJAN! See here"
XNVIDIA Video driversvideo_32D.exe"Added by the AGOBOT.KV WORM!"
XNVIDIA Video driversvideo_32sD.exe"Added by the RBOT-BB WORM!"
XOpen Service Driversopiater.exe"Added by a variant of the RBOT WORM!"
XOpenGL Drivers0penGLD.exe"Added by the YIMP-A WORM!"
XOptional Web Drivers For WIN32phqghume.exe"Added by a variant of the RBOT WORM!"
XPex Sound DriverToday's Results.vbs"Added by the TRODE-A WORM!"
Xpex Sound driver 2Today's Results.vbs"Added by the TRODE-A WORM!"
YPinnacleDriverCheckPSDrvCheck.exe"Part of Pinnacle Systems InstantCD/DVD and InstantCopy CD/DVD copying software that verifies drive settings. Once loaded it doesn't use any resources so you can leave it enabled"
XPnP Driverplayboy.exe"Added by the FORBOT-FR WORM!"
XPrint Driver Helper Servicecrsrr.exe"Added by the AGENT-BC TROJAN!"
XPrinting Drivermsprint.exe"Added by the RBOT.JH WORM!"
XProtectionDeDriverGDC.exe"ProtectionDeDriver rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
YQCDriverInstallerLqdsw.exe"Launches the camera driver setup wizard on the first reboot after installing Logitech's ClickSmart
XRcf Driverrcf.exe"Added by the RANDEX.BLD WORM!"
XRequired Service Driversmicront.exe"Added by the RBOT-ABD WORM!"
URightFAX Print-to-Fax DriverFaxCtrl.exe"Part of RightFAX from Captaris - ""the proven market leader in fax server and document delivery software"""
XRPC Driversrpcall.exe"Added by the SDBOT.FLY WORM!"
XRSPC Driver[random filename].exe"Added by the RBOT-SN WORM!"
XRSPC Driver D[random filename]"Added by a variant of the RBOT WORM!"
XService Driversmsnpg.exe"Added by the RBOT.BMD WORM!"
XService DriversPC.EXE"Added by the SDBOT-WK WORM!"
XService DriversCompt.exe"Added by the RBOT-ZJ WORM!"
XService Driversabl.exe"Added by the SDBOT-YX WORM!"
XService DriversMSNMEssenger.exe"Added by a variant of the RBOT WORM!"
XService Host Driversvchost.exe"Added by the HITON TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
?ShowIcon_Justrams_USB Product Driver v2.12r012shwicon.exe"Related to Just Rams USB product driver. Is it required?"
XSmss.exe driverwinupd32.exe"Added by the SDBOT.MI BACKDOOR!"
USoftK56 Modem Drivercarpserv.exe"Associated with Zoltrix and Conexant modems - enables the internal modem speaker
XSoundMax Audio DriversSndMAX.exe"Added by a variant of the SDBOT WORM!"
XStreams Drivers[trojan filename]"Added by the RESTARTER.E TROJAN!"
Xsvshostdriversvshost.exe"Added by the SDBOT-HN TROJAN!"
Xsvshostdrivermsnmessengerupdate.exe"Added by the SDBOT-BI BACKDOOR!"
USymantec NetDriver MonitorSNDMon.exe"Part of Symantec's LiveUpate (eg
USymantec NetDriver WarningSNDWarn.exePart of Symantec Live Update - displays the warning when you need to update the firewall database
USynaptics Pointing Device DriverSynTPEnh.exe"Synaptics TouchPad Enhancements - included with drivers for Synaptics based TouchPads
XSystem 64 Driver for Gamessys64dvr.exe"Added by the SDBOT TROJAN!"
XSystem driverMessenger.exe"Added by the WOOTBOT.GI WORM!"
XSystem Driverswingmt.exe"Added by the SDBOT-MG WORM!"
XSystem Driverscpsq32.exe"Added by the SDBOT.AXH WORM!"
XSystem Driverssysdrv32.exe"Added by the AGOBOT-ZX WORM!"
XSystem File Driversnvsysvc32.exe"Added by the AGOBOT.WJ WORM!"
XSystem32-Drivercsrs32.exe"Added by the SDBOT-CP BACKDOOR!"
XSystemDrivercsrss.exe"Added by the ASCETIC.B TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\addins\explorer"
XSystemDriverChecksvchost.exe"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
XSystemDriverLoadsvchost.exe"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
Xsystems usb driverWindows2.exe"Added by a variant of the RBOT WORM!"
XSystray driversystray.exe"Added by the MUTEBOT TROJAN! Note - this is not the legitimate systray.exe process"
XTaskmon driverwinampa.exe"Added by the LOONY-I TROJAN! Note - this is NOT associated with the popular Winamp media player. The valid file for the Winamp Agent resides in a ""Winamp"" subdirectory of %ProgramFiles% whereas this file is located in %System%"
XTkNetDriver Monitorlexbce.exe"Added by the SDBOT-ADF WORM!"
XTmNetDriver Monitorexbce.exe"Added by the SDBOT-ABR WORM!"
Xupdate driverSNDVOL32.EXE"Added by the SPYBOT-CU BACKDOOR!"
XUSB 2.0 DriverupdateXPSPC.exe"Added by the AGOBOT-RJ WORM!"
XUSB 2.0 DriverWinsys32.exe"Added by the AGOBOT-QM WORM!"
XUSB 2.0 DriverupdateXP.exe"Added by the AGOBOT-QP WORM!"
XUSB 2.0 Driverwinsystem.exe"Added by the AGOBOT-QS WORM!"
XUSB 2.0 DriverUpdateXPSP.exe"Added by the AGOBOT-QD WORM!"
XUSB 2.1 Driverwinupdate1.exe"Added by a variant of the RBOT WORM!"
XUsB drivermsjavx86.exe"Added by the AGOBOT-PQ WORM!"
XUSB Driver4UpdateXP*.exe [* = random digit]"Added by a variant of the SDBOT WORM!"
XUSB Drivers1msupdate.exe"Added by a variant of the RBOT WORM!"
XUSB Driverz2msnplus1.exe"Added by the SDBOT-XQ WORM!"
XUSD Driverccrss.exe"Added by the SDBOT.BFH WORM!"
XVgaDriverRsrVga32.exe"Added by the KEYLOG-AH TROJAN!"
XVideo Card Driver (do not remove)tsasi.exe"Added by the SPYBOT-EF WORM!"
XVideo Driversvchost.exe"Added by an unidentified WORM or TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
XVideo DriverMsregdrv32.exe"Added by the SPIGOT BACKDOOR!"
XVideo Multimedia Driverndrives32.exe"Added by the RBOT-DK WORM!"
XVideoDriver[filename]"Added by the GSPOT20.A TROJAN!"
XVideoDrivervideodrv.exe"Added by the MIMAIL.A WORM!"
XVideoDrivergspotbot.exe"Added by the SPIGOT.C TROJAN!"
XVideoDriverHookvmdriver.exe"Added by the BCKDR-PSS BACKDOOR!"
XVidiaDrivers[path to trojan]"Added by the RANKY.U TROJAN!"
XVIEW POINT DRIVERSphqghum.exe"Added by the RBOT.BRX WORM!"
XVIEW POINT DRIVERS FOR WIN32phqghu.exe"Added by a variant of the RBOT WORM!"
XVxD Driver Initializationntsvxd.exe"Added by the SDBOT-LW WORM!"
XWEB DRIVERS FOR WIN32phqgh.exe"Added by a variant of the RBOT WORM!"
UWildTangent Web Driver updaterwcmdmgrl.exe"Web Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case"
XWin Drivers SSLhpws.exe"Added by the IRCBOT.67098 WORM!"
XWin Drivers SSLTASKMAN4.exe"Added by a variant of the RBOT WORM!"
XWin Drivers SSL32hpwsnnsbc.exe"Added by the SPYBOT.MAR WORM!"
XWin USB 2.0 USB DriverHPPrint.exe"Added by the SPYBOT.DNB WORM!"
XWin32 Driversvchosts.exe"Added by the FORBOT-FD WORM!"
XWin32 Driversysmls.exe"Added by the MYTOB.JH WORM!"
XWin32 Driverswinlogons.exe"Added by the FORBOT-FG WORM!"
XWin32 DRK Driverwdrk32.exe"Added by the WOOTBOT.CY WORM!"
XWin32 Firewall Driverwinfw.exe"Added by a variant of the RBOT WORM!"
XWin32 Firewall Driverswinfirewall.exe"Added by the WOOTBOT.GX WORM!"
XWin32 FireWire DriverCTHELPER32.EXE"Added by the WOOTBOT TROJAN!"
XWin32 FRT Drivermsfr32.exe"Added by the WOOTBOT.EJ WORM!"
XWin32 LSA Driverlsa.exe"Added by the FORBOT-FJ WORM!"
XWin32 NDIS Driverxpndis.exe"Added by a variant of the RBOT WORM!"
XWin32 NDIS DriverNdistcp.exe"Added by the WOOTBOT.EU WORM!"
XWin32 Network Drivercrss.exe"Added by a variant of the AGOBOT/GAOBOT WORM!"
XWin32 NVIDIA DriverMSPMSPSU.EXE"Added by a variant of the WOOTBOT.Y WORM!"
XWin32 SSL Driverwinssv.exe"Added by the FORBOT-BH WORM!"
XWin32 Svchosts Driversvchosts.exe"Added by the FORBOT-FO WORM!"
XWin32 USB Driverwinxpinit.exe"Added by the SDBOT.AA TROJAN!"
XWin32 USB Drivermvsecn.exe"Added by the FORBOT-BK WORM!"
XWin32 Usb Driversvhosint32.exe"Added by the FORBOT-BE or FORBOT-J WORMS!"
XWin32 Usb Driverusb32.exe"Added by the SDBOT-OV WORM!"
XWin32 Usb DriverAvpG.exe"Added by the FORBOT-BX WORM!"
XWin32 USB Driverrundll.exe"Added by the FORBOT-BN WORM! Note - this is NOT the Win9x/Me system file of the same name as described here"
XWin32 USB2 Driverwin32usb.exe"Added by the SPYBOT.DHV WORM!"
XWin32 USB2 Driversmsc.exe"Added by the SDBOT.FO WORM!"
XWin32 USB2 Driversvchosting.exe"Added by the FORBOT-J or SDBOT.HU WORM!"
XWin32 USB2 Driversys32.exe"Added by the WOOTBOT.X WORM!"
XWin32 USB2 Driversys32snd.exe"Added by the FORBOT-AN WORM!"
XWin32 USB2 Driverwind32.exe"Added by the FORBOT-AH WORM!"
XWin32 USB2 Driverwinupdate.exe"Added by the AGOBOT.YE WORM!"
XWin32 USB2 Driverupdatemgr.exe"Added by a variant of the FORBOT WORM!"
XWin32 USB2 Driverwinsnd32.exe"Added by a variant of the SDBOT WORM!"
XWin32 USB2 Drivermsn.exe"Added by the FORBOT-EX WORM!"
XWin32 USB2 Driversyscfg32.exe"Added by the FORBOT-R WORM!"
XWin32 USB2 Driveralgg.exe"Added by the TIBS.BF WORM!"
XWin32 USB2 Driverusb2.exe"Added by the FORBOT-Y WORM!"
XWin32 USB2 Driverwinusb32.exe"Added by the FORBOT-M WORM!"
XWin32 USB2.0 Driver386.exe"Added by the IRCBOT.D WORM!"
XWin32 USB2.0 Driverrundll16.exe"Added by the WOOTBOT.H WORM!"
XWin32 USB2.0 Driverw32usb2.exe"Added by the SPYBOT.DN WORM!"
XWin32 USB2.0 Driverservice.exe"Added by the SDBOT-QF WORM!"
XWin32 USB3 Driverwin32tool.exe"Added by a variant of the RBOT WORM!"
XWin32 Wmls Driverwinitr32.exe"Added by the WOOTBOT.B WORM!"
XWindows Domain Name Driverswindns.exe"Added by the FORBOT-EP WORM!"
XWindows Drive CompatibilitySystem32Driver32.exe"Added by the SUPOVA.Z WORM!"
XWindows Driverwinxpdriver.exe"Added by the WOOTBOT.EE WORM!"
XWindows Driverwindrive.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
XWindows Driver Adaptersvchost.exe"Added by the ANTINNY-K WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
XWindows Driver FoundationMTVSCMXT.EXE"Added by a variant of the RBOT WORM!"
XWindows Driver Servicesmsdrvs32.exe"Added by the WOOTBOT.L WORM!"
XWindows Driver Supwindvrhost.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
XWindows driver updatedmsvc32.exe"Added by the SDBOT-GP BACKDOOR!"
XWindows driver updateIpconfig32.exe"Added by the SDBOT-JV WORM!"
XWindows Driver!windriver.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
XWindows Driversssms.exe"Added by the RBOT-AT WORM!"
XWindows drivers updatewindowsupdate.exe"Added by the RBOT-ACE WORM!"
XWindows HP Drivershpdmws.exe"Added by the SDBOT.AQU WORM!"
XWindows IPv6 Driverswipv6.exe"Added by the SDBOT-VJ WORM!"
XWindows Media Drivermsnger.exe"Added by a variant of the RBOT WORM!"
XWindows Memory Driversmemretain.exe"Added by a variant of the IRCBOT TROJAN!"
XWindows Micro Driverswupdates32.exe"Added by the RBOT-AEH WORM!"
XWindows ms Driversmsnup32.exe"Added by the SDBOT-AAL WORM!"
XWindows MSX driverswinmsx.exe"Added by the RBOT-AYG TROJAN!"
XWindows Nivedia DriversysMGT.exe"Added by a variant of the RBOT WORM!"
XWindows Portable Device DriversMSKSVRVS.EXE"Added by a TROJAN - see here"
XWindows Printing DriverWinPrint.exe"Added by a variant of the RBOT WORM!"
XWindows Printing DriverWinSpooler.exe"Added by the ARCHIVARIUS series of WORMS!"
XWindows Printing Driverciadvs.exe"Added by the BUZUS-M TROJAN!"
XWindows Printing Driverciadvss.exe"Added by the ARCHIVARIUS series of WORMS!"
XWindows Printing Drivergpedits.exe"Added by the DCKEYG.A WORM!"
XWindows Server Driverssyssrv.exe"Added by a variant of the IRCBOT TROJAN! See here"
XWindows ServicesNetworkDriver32.exe"Added by the RBOT-ACR WORM!"
XWindows ServicesNetworkDrivers.exe"Added by the SDBOT-YO WORM!"
XWindows Sound DriverSndMon32.exe"Added by a variant of the SPYBOT WORM!"
XWindows sq Driverswinmsn32.exe"Added by the RBOT-ADI WORM!"
XWindows SSL Secondary DriversSSL32Dr.exe"Added by the SDBOT.ASQ WORM!"
XWindows Stand Sound DriversSounddrv.exe"Added by the SDBOT-XF WORM!"
XWindows Storm-Memory Driversmemorystorm.exe"Added by the SLENFBOT.CO WORM!"
XWindows System Driverssysretain.exe"Added by the SLENFBOT.BY WORM!"
XWindows System-Control Driverssyscontrl.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
XWindows System32 Driverclsass32.exe"Added by the SDBOT-AGG WORM!"
XWindows USB 2.0 Driverusbtskmgr.exe"Added by the RBOT-BKG WORM!"
XWindows USB 2.0 Driverusb2ctrl.exe"Added by the RBOT-BIW WORM!"
XWindows USB 2.0 Driverusbservice.exe"Added by the RBOT-BLF WORM!"
XWindows USB Control Driveriexplore.exe"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
XWindows USB Driver SupportWindowsusb.exe"Added by a variant of the SPYBOT WORM!"
XWindows User Mode Driver Managerwdfmrg.exe"Added by the SDBOT-ZN WORM!"
XWindows Video Driversvideons32.exe"Added by the GAOBOT.AZT WORM!"
XWindows Video DriversVIDEONS3.EXE"Added by the AGOBOT-KZ BACKDOOR!"
XWinDriver Configurationwindrvconf.exe"Added by the AGOBOT-LX TROJAN!"
XWinRunnersWinDrivers.exe"Added by the DULOAD.C WORM!"
XWins Service Driverwinet.exe"Added by the RBOT-APV WORM!"
XWinsock driverwinnt update.exe"Added by the SPYBOT-DM TROJAN!"
XWinsock driverwinnt64.exe"Added by the SPYBOT-DR WORM!"
XWinsock Drivernvscv32.exe"Added by the AGOBOT-FD WORM!"
XWinsock Driverscvhost.exe"Added by the RBOT.AEU BACKDOOR!"
XWinsock driverwin.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
XWinsock drivertcpmngr.exe"Added by the SPYBOT-CK WORM!"
XWinsock driverwinupdate32.exe"Added by the SPYBOT-JZ TROJAN!"
XWinsock2 driverSDJOIJE.EXE"Added by the SPYBOT.DR TROJAN!"
XWinsock2 driverMIRC32.exe"Added by the SPYBUZZ TROJAN!"
XWinsock2 driverkgzgjkpcw.exe"Added by the SDBOT.T TROJAN!"
XWinsock2 driverZONEALARM.EXE"Added by the SDBOT.T TROJAN! Note - ZONEALARM.EXE is not the valid Zone Labs firewall program"
XWinsock2 driverwincfg.scr"Added by the SPYBOT-E TROJAN!"
XWinsock2 driverwinupdate.exe"Added by the SPYBOT-BX WORM!"
XWinsock2 driverSPOLSV.EXE"Added by the SPYBOT-CM WORM!"
XWinsock2 driver[random filename]"Added by members of the SPYBOT family of WORMS! Note - the random filename is located in %System%"
XWinsock2 driversysreq.exe"Added by the SPYBOT-CC WORM!"
XWinsock2 driverWUAUMQR.EXE"Added by the SPYBOT-DP WORM!"
XWinsock2 driverwincfg.exe"Added by the SPYBOT.CO WORM!"
XWinsock2 driversvchorsst.exe"Added by the SPYBOT-EE WORM!"
XWinsock2 driverSYSTEM32.EXE"Added by the SPYBOT-EG WORM!"
XWinsock2 driverdllcfg32.exe"Added by the SPYBOT.AG WORM!"
XWinsock2 driverCFTMON.EXE"Added by a variant of the IRCBOT BACKDOOR!"
XWinsock2 driverntsys32.exe"Added by the SPYBOT-DD WORM!"
XWinsock2 driverWINNT32.EXE"Added by the SPYBOT-CN WORM!"
XWinsock2 driverPAC.EXE"Added by the SPYBOT-ET WORM!"
XWinsock2 driverwinsock2.exe"Added by the SPYBOT-CT BACKDOOR!"
XWinsock2 drivermmtask5.exe"Added by the SPYBOT-CD WORM!"
XWinsock2 driverWWEUMQR.EXE"Added by the SPYBOT-BY WORM!"
XWinsock2 driverIEXPLORE .EXE"Added by the SPYBOT-AU WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process as there is a space before the "".exe"""
XWinsock2 driverWINSOUND.EXE"Added by the SPYBOT-H WORM!"
XWinsock32 driverTESTING.EXE"Added by the SPYBOT-B WORM!"
XWinsock32 driversystem32.exe"Added by the IRCBOT-VT TROJAN!"
XWinsock32driverwin32server.scr"Added by the HACARMY TROJAN!"
XWinsock32driversp2XPupdate.exe"Added by the HACKARMY.S TROJAN!"
XWinsock32driverwin32server.exe"Added by the BACKDOOR-AZV TROJAN!"
XWinsock32driverZoneAlarmPr0.exe"Added by the HACKARMY-B TROJAN!"
XWinsock32driverZoneLockup.exe"Added by the HACARMY.D TROJAN!"
XWinsock32driverwin32server.exe"Added by the HACARMY.F TROJAN!"
XWinsock32driverwinXPupdate.exe"Added by the HACKARMY.9728 TROJAN!"
XWinsock32driversvchhost.exe"Added by the HACKARMY.I TROJAN!"
XWinsock6 MIC driverieservicesupd.exe"Added by the SPYBOT.AFZ WORM!"
Xwinsockdrivertskmg.exe"Added by the SDBOT.GEN TROJAN or WARPIGS.C WORM!"
Xwinsockdriverwinsock2.2.exe"Added by a variant of the SPYBOT WORM!"
Xwinsockdriveriexplor.exe"Added by the BLATIC.A WORM!"
Xwinsockdriverwinsock3.exe"Added by the SPYBOT-DO WORM!"
Xwinsockdriverbot.exe"Added by the WARPIGS-D WORM!"
Xwinsockdriverwinsock4.1.exe"Added by a variant of the IRCBOT TROJAN! See here"
Xwinsockdriverwinsock2.exe"Added by the SPYBOT-AC WORM!"
XWinsocks2 drivermznmgr.exe"Added by a variant of the SDBOT WORM!"
Xwinsys32 Driverwinsys32.exe"Added by the LOONY-O TROJAN!"
XWinTask driverwintask.exe"Added by the DLOADER-NA TROJAN!"
XWin_api_driversystem.exe"Added by the REVIRD TROJAN!"
XWlan Driveravscan.exe"Added by the WOOTBOT.DH WORM!"
XWnsck2 driverwlogf.exe"Added by the SPYBOT-AF WORM!"
XWstat32 driverWstat32.exe"Added by the LOONBOT TROJAN!"
XWupdate driver[various filenames]"Added by a variant of the SPYBOT WORM!"
XWupdate driverwupdadte.exe"Added by the SPYBOT-CQ WORM!"
XXTN Service Driverswinxtn.exe"Added by the SDBOT-YK WORM!"
XZip Driver LoaderZipLoader32.exe"Added by the OBLIVION TROJAN! This executable is one of the most common but there are more"
XZip Driver Loadermsload32.exe"Added by the OBLIVION TROJAN! This executable is one of the most common but there are more"
X[various names]driver32.exe"Added by a variant of the SDBOT WORM!"
X[various names]driver64.exe"Wareout - malware masquerading as a spyware and dialer remover"
X_SystemDrivercsrss.exe"Added by the ASCETIC.B TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\addins\explorer"


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Copyright 2003-2013 iamnotageek &/or Martin Krohn.