Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
X3Dfx AccGFXACC.EXE"Added by the GIBE WORM!"
N3dfx Task Manager3dfxMan.exeSystem Tray application for 3dfx Voodoo 3/4/5 functions. Available via Start -> Programs
Y3dfx Tools3dfxCmn.dllUpdates the registry with information that can't be held for Voodoo 3/4/5 series graphics cards. Important for owners of these cards
Y3dfxv2ps.dll3dfxv2ps.dllUpdates the registry with info that can't be held for 3dfx Voodoo 2 video cards. Important for owners of these cards
XATI Video Driver Controlatigfx.exe"Added by the RBOT-FWL WORM!"
UAVFX EngineStartFX.exe"Advanced Video FX - supported by a number of Creative Web Cameras. ""Have more fun by adding a wide range of special effects and backgrounds to your video chat with Advanced Video FX"""
Xbfxtray[path to trojan]"Added by the AGENT-GEB TROJAN!"
NControllerWFXCTL32.EXEFrom Symantec's TalkWorks Pro and WinFax. Appears if you chose to have the program appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs
XDevice Managerwfxmgr.exe"Added by the RBOT.AJU WORM!"
XFXieloader.exeAdded by the SMALL.RR TROJAN!
XFxoekmmiyhart.exe"Added by the SDBOT-CZQ WORM!"
Ufxredirfxredir.exeCanon MultiPASS fax redirector
Xgfxtray"rundll32 ctccw32.dllfindwnd"
Xgvagfxjrundll32 ...gvagfxj.dll"Unidentified adware
Uhfxphfxp.exe"Hide Folders XP - hide your folders so only you can view them"
XIefxTrayIefxTray.exe"Added by the RILER-H TROJAN!"
UIFXSPMGTifxspmgt.exe"Part of the Infineon Security Platform Software - which supports the on-board TPM security device included with some laptops from suppliers such as Acer
Uigfxhkcmdhkcmd.exe"Hot Key handler for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
Uigfxpersigfxpers.exe"Installed with the graphics drivers for Intel desktop and mobile motherboard chipsets with integrated graphics. It's purpose or function isn't known at present but testing with it disabled would appear to indicate it isn't required - hence the recommended ""U"" status"
Xigfxtrassvchots.exe"Added by the AUTORUN-AIW WORM!"
UIgfxTrayigfxtray.exe"System Tray access to display settings for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
?Install Pending Filessifxinst.exe"Uninstall program for Lanovation's Prism Deploy and Prism Pack adminstrators software deployement tools. For specific information see here. Is it required?"
UIntel(R) Common User Interfaceigfxtray.exe"System Tray access to display settings for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
UIntel(R) Common User Interfaceigfxpers.exe"Installed with the graphics drivers for Intel desktop and mobile motherboard chipsets with integrated graphics. It's purpose or function isn't known at present but testing with it disabled would appear to indicate it isn't required - hence the recommended ""U"" status"
XlgfxTraylgfxTray.exe"Added by the TAKEOBEL WORM! Note - the filename has a lower case ""L"" rather than an upper case ""i"" at the beginning and should not be confused with the valid Intel graphics file ""igfxtray.exe"""
XMicrosoft Security Controlersfxsecues.exe"Added by a variant of the SDBOT WORM!"
XMicroSoft Visual SP2igfxsrvc32.exe"Added by the SDBOT.GAV WORM!"
XMustafxmustafx.exeAdded by a variant of the VIRANTIX.B TROJAN!
?netfxupdatenetfxupdate.exe"Would appear to be a valid Microsoft .NET file (see here) but other sources suggest it could be a trojan"
?NetFxUpdate_v1.0.3705netfxupdate.exe"Would appear to be a valid Microsoft .NET file (see here) but other sources suggest it could be a trojan"
XNI.UWFX5UWFX5NetInstaller.exe"WinFixer 2005 web installer - ""foistware""
XNI.UWFX5WinFixer2005ScannerInstall.exe"WinFixer 2005 web installer - ""foistware""
XNI.UWFX5LP_0001_0614UWFX5LP_0001_0614NetInstaller.exe"WinFixer 2005 web installer - ""foistware""
XNI.UWFX5LP_0001_0715UWFX5LP_0001_0715NetInstaller.exe"WinFixer 2005 web installer - ""foistware""
XNI.UWFX5LP_0001_0802UWFX5LP_0001_0802NetInstaller.exe"WinFixer 2005 web installer - ""foistware""
XNI.UWFX5LP_0001_0803UWFX5LP_0001_0803NetInstaller.exe"WinFixer 2005 web installer - ""foistware""
XNI.UWFX5TUWFX5TNetInstaller.exe"Added by the DOWNLDR-BO TROJAN!"
XNI.UWFX5V_0001_0802UWFX5V_0001_0802NetInstaller.exe"WinFixer 2005 web installer - ""foistware""
XNI.UWFX6_0001_N68M2301UWFX6_0001_N68M2301NetInstaller.exe"WinFixer 2006 web installer - ""foistware""
UPersistenceigfxpers.exe"Installed with the graphics drivers for Intel desktop and mobile motherboard chipsets with integrated graphics. It's purpose or function isn't known at present but testing with it disabled would appear to indicate it isn't required - hence the recommended ""U"" status"
NQuick Shelf xxqushelfxx.exe"Places an icon in the system tray for launching MS Bookshelf. Available via Start -> Programs"xx" represents the version number - ie
XRegistryMonitor1igfxpers.exe"Added by the DELF-EZZ TROJAN! Note - this is not the legitimate Intel graphics driver which has the same filename"
NRFX_auto_upgraderundll32.exe npvpg005.dll"A browser plugin called the RichFX player. Here is a link to download RichFX's solution to removing the auto upgrade"
XStdAFXstdafx.exe"Added by the DELBOT-AF WORM!"
Xstmhawkfxi.js"Added by the SPETH WORM!"
XSysDeskqqfxqqfx.exe"Added by the QQPASS.H TROJAN!"
XSysDeskqqfxRunddll32.exe"Added by the CHANGGAME TROJAN!"
XTaskmanufxw.exe"Added by the VBINJ-D TROJAN!"
Xtestestfxxxh.exe"Added by the SDBOT-MK WORM!"
UToolBoxFXHPTLBXFX.exe"HP ToolBoxFX - ""provides desktop configuration
XVisual Element FX5[various filenames]"ClearStream Accelerator adware"
NWFXCTL32.EXEWFXCTL32.EXEFrom WinFax 10.0 and possibly earlier versions. Appears if you chose to have WinFax appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs
Ywfxsnt40wfxsnt40.exeWinFax 10.0 and maybe earlier versions. Used to initiate the WinFax port to enable printing to the WinFax printer (send a fax) from any application
?WFXSwtchWFXSWTCH.exe"Related to WinFax. What does it do and is it required?"
UWindowFXwfxload.exe"Stardock WindowFX - ""Allows you to add an unprecedented number of special effects to windows"""
XWindows UDP Control Centerfxstaller.exe"Added by the AGENT-IEE TROJAN!"
XWindows UDP Control Centerfxsteller.exe"Added by the IRCBOT-J BACKDOOR!"
NWinFax PRO ControllerWFXCTL32.EXEFrom WinFax 10.0 and possibly earlier versions. Appears if you chose to have WinFax appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs
YWinFaxAppPortStarterwfxsnt40.exeWinFax 10.0 and maybe earlier versions. Used to initiate the WinFax port to enable printing to the WinFax printer (send a fax) from any application.
XWinFixer 2005wfx5.exe"WinFixer 2005 web installer - ""foistware""
XWinFixer 2006uwfx6.exe"WinFixer 2006 web installer - ""foistware""
XWinFixer helperwfxcwr.exe"WinFixer web installer - ""foistware""
XWinFixer2005uwfx5.exe"WinFixer 2005 web installer - ""foistware""
XWinFixer2006uwfx6.exe"WinFixer 2006 web installer - ""foistware""
XWinFixer_2005uwfx5.exe"WinFixer 2005 web installer - ""foistware""
XWinFXcssrs.exe"Added by the AGOBOT.FX WORM!"
XWinFXcssrs.exe"Added by the GAOBOT.CD WORM!"
XWinFXlsas.exe"Added by the GAOBOT.CD WORM!"


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.