Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
Version"NVIDIA Driver Helper ServiceU"RUNDLL32.EXE nvsvc.dll
U3DLabsHelperDemon3dldemon.exe"Directly from the programs author ""It is a tiny program that is installed by the Permedia2/3 and probably other Oxygen-series cards. Normally it sits in the background doing nothing at all (sleeping on a semaphore)
UAcronis Scheduler Helperschedhlp.exe"Part of Acronis True Image backup software. Co-operates with the ""schedul2.exe"" service to perform backup/restore tasks correctly. Required if you want to use True Image to do some real backup/restore tasks - not if you only want to explore/mount images"
UAQ3HelperStartUpAQ3HEL~1.EXE"ScreenScenes ""Aquatica Water Worlds"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
UBI1HelperStartUpBI1HEL~1.EXE"ScreenScenes ""Beach Islands"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
YBitDefender Antiphishing HelperIEShow.exe"Anti-phishing component of BitDefender internet security products. Anti-phishing prevents sensitive data such as usernames
UBO1HelperStartUpBO1HEL~1.EXE"ScreenScenes ""Butterfly Oasis"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
UBO1HelperStartUpBo1helper.exe"ScreenScenes ""Butterfly Oasis"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
YCommunications_HelperCommunications_Helper.exe"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
YCommunications_Helper.exeCommunications_Helper.exe"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
XConfiguration LoaderWinHelper.exe"Added by a variant of the AGOBOT/GAOBOT WORM!"
UCTHELPERCTHELPER.EXE"CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers
XCTHelpercthelper.exe"Added by the RBOT-XB WORM! Note - do not confuse with the Creative application of the same name described here"
XCTHELPERsvhost.exe"Added by the SDBOT-RZ WORM!"
UddhelperW815DM.EXE"Enuff Parental Control Software by Akrontech"
XDealHelperBrwsrdhbrwsr.exe"DealHelper adware"
XDealHelperDowndownload.exe"DealHelper adware"
XDealHelperUpdateDHUpdt.exe"DealHelper adware"
NDialog HelperPDDLGHLP.EXE"Dialog Helper from PowerDesk Pro by Ontrack. Helps with the standard Open and Save As dialog boxes by showing recently used files and folders. Available via Start -> Programs"
NDLHelperEXEWATCH.exeDownload helper distributed with some software that allows the software installation to redirect download locations. Not required once the installation is finished
XDLHelperEXE.exeN/ADownloader for Microgaming/Casino software - stealth installed
XDNHelper32DNHlp32.exeAdded by an unidentified WORM or TROJAN!
?ExxtremeHelperDemonexxdemon.exe"Creative Exxtreme graphics card related?"
NezHelperezHelper.exe"Part of the ezPeer+ ezHelper music sharing program."
XHelpereschlp.exe"Added by the BLASTER.T WORM!"
XHELPERgreece_nm.exe"AsdPlug premium rate adult content dialer variant"
XHELPERNetherlands.exe"AsdPlug premium rate adult content dialer variant"
XHELPERnew_zealand.exe"AsdPlug premium rate adult content dialer variant"
XHELPERsweden.exe"AsdPlug premium rate adult content dialer variant"
XHELPERcanada.exe"AsdPlug premium rate adult content dialer variant"
XHELPERfrance.exe"AsdPlug premium rate adult content dialer variant"
XHELPERtemp532.exe"AsdPlug premium rate adult content dialer variant"
Xhelper.dllrundll32.exe [path] helper.dll"CnsMin (Chinese Keywords) hijacker related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
UHitman Pro SurfRight Helpersrhelper.exe"Hitman Pro - a utility to start a number of Security Protection software. They can be started individualy"
UHondaHelperHondaHelper.exe"Part of Honda Music Link which allows you to use your Honda's audio system's controls to play and search for music on your iPod® in you car"
XIehelpersyslaunch.exeOutwar adware downloader
XIPv6 Helper Drivercsass.exe"Added by the AGOBOT.TC WORM!"
YiTunes HelperiTunesHelper.exeInstalled with Apple's iTunes for Windows. Uses ~3-4MB of memory and if disabled in MSCONFIG or deleted from the registry it will re-instate itself after running iTunes a few times - hence the reluctant Y recommendation
XiTunes MusiciTunesHelper32.exe"Added by the SDBOT.CHK WORM!"
YiTunesHelperiTunesHelper.exeInstalled with Apple's iTunes for Windows. Uses ~3-4MB of memory and if disabled in MSCONFIG or deleted from the registry it will re-instate itself after running iTunes a few times - hence the reluctant Y recommendation
YLogitechCommunications_Helper.exe"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
YLogitechCommunicationsManagerCommunications_Helper.exe"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
YLogitechRegisterVideoApplicationsInstallHelper.exeEntry added when you install versions of the Logitech QuickCam webcam software and used to register video applications that can use the webcam on the first reboot after installing the software
ULogitechVideo[inspector]InstallHelper.exeEntry added when you install versions of the Logitech QuickCam webcam software and used to monitor and register video applications that can use the webcam. It isn't normally running but you could disable it and re-enable it before you install supported applications
XMicrosoft Data Helpercihost.exe"Malware
XMicrosoft Hyptertext Helpermshtha.exe"Added by a variant of the SPYBOT WORM!"
XMicrosoftUpdatesyshelper.exe"Added by the WOOTBOT.AC WORM!"
UML1HelperStartUpML1HEL~1.EXE"ScreenScenes ""Midnight Lake"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
UML1HelperStartUpML1Helper.exe"ScreenScenes ""Midnight Lake"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
UMonitor Helpermonitor.exe"MyLittleSpy keystroke logger/monitoring program - remove unless you installed it yourself!"
XMsn Message Acount Helper 7.7msnmessage7.7.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
Xmssyslanhelpermsmsgri32.exe"Added by the RANDEX.D WORM!"
UMW1HelperStartUpMw1helper.exe"ScreenScenes ""Magic Waterfall"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
UMW1HelperStartUpMW1HEL~1.EXE"ScreenScenes ""Magic Waterfall"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
XNetbios Helpernbthlp.exe"Added by the BANKER.Y TROJAN!"
UNetShow Powerpoint HelperNSPPTHLP.EXE"If disabled
UNSHelperaexnsinstallhelper.exeAltiris Express Notification Server Install helper - monitors integrity of the installation
UP17Helper"Rundll32 P17.dll P17Helper"
?P17Helper"Rundll32 SPIRun.dll RunDLLEntry"
Xpqhelperpqhelper.exe"Searchcentrix hijacker"
XPrint Driver Helper Servicecrsrr.exe"Added by the AGENT-BC TROJAN!"
NQuickTime Update Completion xquicktimeupdatehelper.exe"Different numbers caused by number of launches. So if 3 updates are made separately
URegClean Expert SchedulerRCHelper.exe"""Registry Clean Expert scans the Windows registry and finds incorrect or obsolete information in the registry. By fixing these obsolete information in Windows registry
XRichMediaHBHelper.dll"HenBang adware"
Xs4helpers4helper.exe"Searchcentrix hijacker"
NSM56 Helper Win32 Utilitysm56hlpr.exeHelper utility for Motorola based SM56 software modems - resides in the System Tray
UStormCodec_HelperStormSet.exe"Storm Codec is a codec pack for Windows"
USurfHelperSurfHelp.exe"Related to SurfHelper - a free tool to remove popup windows
XSYSTEM service helpersvchelper.exe"Added by the MONKBD-A WORM!"
XSYSTEM service helpersyshelp.exe"Added by a variant of the MONKBD-A WORM!"
NTPKMAPHELPERTpKmapAp.exe"Part of the Keyboard Customizer Utility for IBM/Lenovo Thinkpad notebooks. This is the main user interface for the utility but it doesn't normally seem to be running if enabled at startup. Also
Ntray_helpertray_helper.exe"Tray Helper is an Email checker with additional tools
?Verizon Custom Uninstall TrackingInstallHelper.exe"Verizon related installation tracker. What does it do and is it required?"
UWatcherHelperWaHelper.exe"Sierra Wireless Watcher™ - wireless configuration utility"
XWin32 FireWire DriverCTHELPER32.EXE"Added by the WOOTBOT TROJAN!"
XWindows Help Filewinhelper32.exe"Added by the SDBOT-QK TROJAN!"
XWindows Helperwinhelp.exe"Added by the BANKER.APE TROJAN!"
XWindows Helperwsctnfy.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
NWindows Media Powerpoint HelperNSPPTHLP.EXEGerman software (comes with some Toshiba CD writers) that helps convert Powerpoint files to ASF (Streaming Media) files. Available via Start -> Programs
UWINDVDpatchCTHELPER.EXE"CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers
XWinFixer helperwfxcwr.exe"WinFixer web installer - ""foistware""
UWinIRXHelperWinIRXHelper.exe"MSI Media Center Deluxe software - see here"
Xwinlogon.exehelper.exe"Added by the FAKESPY-A TROJAN!"
Xwzhelperwzhelper.exe"Searchcentrix hijacker"
X[various names]atl_helper.exe"Wareout - malware masquerading as a spyware and dialer remover"
X[various names]ATLIEHELPER.exe"Wareout - malware masquerading as a spyware and dialer remover"
X[various names]iehelper.exe"Wareout - malware masquerading as a spyware and dialer remover"
X[various names]MsNetHelper.exe"Wareout - malware masquerading as a spyware and dialer remover"


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.