HR

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
U	12Ghosts Synchronize	12sync.exe	"12Ghosts Synchronize - ""Sync PC clock with an atomic clock over the Internet"""
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Lock (and maybe others) -.html" title="Access Lock (and maybe others) -">Access Lock (and maybe others) -
	Access Lock (and maybe others) -.html" title="Access Lock (and maybe others) -">Access Lock (and maybe others) -
U	Adobe Reader Synchronizer	AdobeCollabSync.exe	"Adobe Synchronizer - installed along with Adobe Reader 8.x. ""Synchronizer is a small application that runs in the background
X	antihost	ahr.exe	"Added by the BANCBAN-QJ TROJAN!"
U	Atomic Time Synchronizer	TimeSync.exe	"TimeSync - lets you synchronize your computer's clock with any internet atomic clock"
N	Batchreg1	N/A	"Part of the Windows System Recovery process. Added to the registry via Msbatch.inf. The existence of this key or process after the last reboot during installation indicates an unsuccessful installation
U	BHR	BHR.exe	"Browser Hijack Retaliator - recovers your browser after it has been hijacked by spyware
X	cdoosoft	olhrwef.exe	"Added by the AUTORUN-AAG WORM!"
N	Christmas Music Player	TTEST6.EXE	"Christmas Music Player brings the music of the Christmas Holiday to your desktop"
?	ChromeMark	keysh.exe	"Related to this. Don't know what keysh.exe does though and if it's required"
?	ChronitelInitTV	CHTVINIT.EXE	"??"
U	chrono	chrono.exe	"Chronograph is a simple utility that synchronizes internal computer clock to the atomic time. Chronograph automatically maintains correct time using atomic clock servers of the National Institute of Standards and Technology (NIST)."" Shows seconds and shows the date without having to hover the mouse. Shows a calendar when hovered over"
N	DelayShred	ShrCL.EXE	McAfee Shredder - not required at startup. You can run it manually via McAfee Security Center
X	Dm Hr	lpns.exe	"Added by the IRCBOT.WORM.61673 WORM!"
U	HornetMonitor	MntrHrnt.exe	"Hornet Monitor - monitoring system that detects and responds to unauthorized access attempts and sources of channel interference on any local DSSS network"
X	HotAction_hr	hotaction_hr.exe	"Added by the SITEICON-B DIALER! An uninstall option can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as ""HotAction_hr"""
U	HR	Hr.exe	"HiddenRecorder periodically takes screenshots of the computer. If you didn't install this yourself remove it"
U	HREF.OCX	regsvr32.exe ....HREF.OCX	"HREF.OCX is an ActiveX control developed by xFX JumpStart and used to provide HTML-alike clickable links on Windows-based programs such as PopUpKiller"
X	hri	iexpl0re.exe	"Added by the DLOADER.MAQ TROJAN! Note the number ""0"" in the filename"
X	Hrn_qtv	hrnsvc32.exe	"Added by the SDBOT-AET WORM!"
N	load=	HPWHRC.EXE	Loads the Status Window software for the HP Laserjet printers
Y	load=	wpshrc.exe	Required to prevent configuration errors on a Compaq LBP-660 and LBP-460 parallel port laser printers (and maybe others)
Y	LogitechRegisterVideoApplications	InstallHelper.exe	Entry added when you install versions of the Logitech QuickCam webcam software and used to register video applications that can use the webcam on the first reboot after installing the software
N	MadExe	LaunchRA.exe	"Part of Dell Resolution Assistant - ""a diagnostic program that allows you to contact Dell. When factory-installed by Dell
X	Microsoft hren1	mmhren1.exe	Added by a variant of the AGENT.IWW TROJAN!
X	Microsoft Synchronization Manager	asgard.exe	"Added by the SDBOT-AEA WORM!"
X	Microsoft Synchronization Manager	bot.exe	"Added by the SDBOT.IH WORM!"
X	Microsoft Synchronization Manager	netscape.exe	"Added by the RANDEX.AE WORM!"
X	Microsoft Synchronization Manager	slhost.exe	"Added by the SDBOT.YH WORM!"
X	Microsoft Synchronization Manager	svhost.exe	"Added by the SDBOT-PY WORM!"
X	Microsoft Synchronization Manager	WinLoginnn.exe	"Added by the SPYBOT.FO WORM!"
X	Microsoft Synchronization Manager	winupdate.exe	"Added by the SDBOT.ER WORM!"
X	Microsoft Synchronization Manager	xXx.exe	"Added by the SDBOT-KZ WORM!"
X	Microsoft Synchronization Manager	___synmgr.exe	"Added by the MASLAN.A or MASLAN.C WORMS!"
X	Microsoft Synchronization Manager	al.exe	"Added by the OPTXPRO.132 TROJAN!"
X	Microsoft Synchronization Manager	win.exe	"Added by the SDBOT.AK WORM!"
X	Microsoft Synchronization Manager	java.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Synchronization Manager	svchosts.exe	"Added by the SDBOT-LM WORM!"
X	Microsoft Synchronization Manager	winlogon32.exe	"Added by the SDBOT.AEU WORM!"
X	Microsoft Synchronization Manager	svxhost.exe	"Added by the SDBOT-ZU WORM!"
X	Microsoft Synchronization Manager	wincfg32.exe	"Added by the SDBOT.DO WORM!"
X	Microsoft Synchronization Manager	screen.exe	"Added by the SDBOT-ACO WORM!"
X	Microsoft Synchronization Manager	devldr32.exe	"Added by a variant of the RBOT WORM! Note - do not confuse with the legitimate Creative Labs devldr32.exe file"
X	Microsoft Synchronization Manager	explorer.exe	"Added by the SDBOT-AEA WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft Synchronization Manager	firewire.exe	"Added by the SDBOT-AFC WORM!"
X	Microsoft Synchronization Manager	wmedia.exe	"Added by the SDBOT.BFC WORM!"
X	Microsoft Synchronization Manager	win932.exe	"Added by the SDBOT.AH WORM!"
X	Microsoft Synchronization Manager	mircup.exe	"Added by the SDBOT.BQD WORM!"
U	Microsoft Synchronization Manager	mobsync.exe	"Microsoft Synchronization Manager for 2K/XP - used to update network copies of materials that were edited offline
X	Microsoft Synchronization Manager	alien.exe	"Added by the SDBOT-MV BACKDOOR!"
X	Microsoft Synchronization Manager	microsoft.exe	"Added by the SDBOT-OM WORM!"
X	Microsoft Synchronization Manager 2	svhostc.exe	"Added by the SLINBOT.ST WORM!"
U	PcThrust	PcThrust.exe	"PCThrust from SwiftDog - ""increases computer performance by allocating higher portions of CPU power to active applications and games"""
U	PhraseExpress	phrase.exe	"""PhraseExpress organizes your frequently used text phrases and allows pasting them into any application"""
?	RIS2PostReboot	LaunchRIS2.exe	"Part of the programming software for LEGO® Mindstorms robotic building system. What does it do and is it required?"
X	rrmso	bqhrmug.exe	"Added by the AGENT-GYY TROJAN!"
U	Smarthruengine	QS.exe	"Samsung smarthru software
X	SpyShredder	SpyShredder.exe	"SpyShredder rogue spyware remover
X	Synchronization Agent	mobsynca.exe	"Added by the RANDEX-E WORM!"
U	Synchronization Manager	mobsync.exe	"Microsoft Synchronization Manager for 2K/XP - used to update network copies of materials that were edited offline
X	Synchronization Manager	rservers.exe	"Added by the FORBOT-FM WORM!"
X	System Process Analization Thread	system.exe	"Added by a variant of the RBOT WORM!"
X	systhread	winkernal.exe	"Added by the LIAMED WORM!"
X	systhread	HELLO.EXE	"Added by the WINKER.F BACKDOOR!"
X	Threaded	intcp32.exe	"Added by the RANDEX.UG WORM!"
Y	ThreatFire	TFTray.exe	"System Tray access to ThreatFire no-signature anti-malware from PC Tools - which ""features innovative real-time behavioral technology that provides powerful protection against both known and unknown viruses
U	ThrustTSR	TMTMTSR.exe	"Thrustmaster Thrustmapper - ""t-mapper - icon sits on your taskbar and automatically detects when the joystick is plugged in and configures it accordingly"""
X	Time Zone Synchronization	wscript zshell.js	"Added by the NETDEX-A TROJAN!"
X	TimeSyncApp	TimeSynchronize.exe	"DealHelper adware"
N	USSShReg	USSSHREG.EXE	Registration reminder for Ulead SmartSaver Pro - compacts large graphics for web designers
X	Windows Memory Sharing	memoryshr.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Memory Sharing	memshr.exe	"Added by the IRCBOT.MC BACKDOOR!"
X	Windows Service Threads	svcthreading.exe	"Added by the SHEUR.AUM TROJAN!"
X	Windows Service Threads	svcthreads.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	X10Weax	WTHRTRAY.EXE	"WeatherCheck - ""bring the latest local weather to your desktop"". Not recommended as it reportedly pops ads
X	xhrmy	Xhrmy.exe	"HyperLinker adware"
X	Yahoo Messengger	chrome.exe	"Added by the AUTORUN-NG WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.