Help

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
Version	"NVIDIA Driver Helper Service	U	"RUNDLL32.EXE nvsvc.dll
X	(Default)	winhelp.exe	"Added by the BLACKMAL.C WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
U	3DLabsHelperDemon	3dldemon.exe	"Directly from the programs author ""It is a tiny program that is installed by the Permedia2/3 and probably other Oxygen-series cards. Normally it sits in the background doing nothing at all (sleeping on a semaphore)
U	Acronis Scheduler Helper	schedhlp.exe	"Part of Acronis True Image backup software. Co-operates with the ""schedul2.exe"" service to perform backup/restore tasks correctly. Required if you want to use True Image to do some real backup/restore tasks - not if you only want to explore/mount images"
U	Ai Gear Help	GearHelp.exe	"Included with some ASUS motherboards (such as the Maximus Extreme & Striker II Extreme)
U	Ai Quicker Help	AsRc.exe	"ASUS DH Remote media portal launcher for their Digital Home range of motherboards that are designed for users to control the computer at a distance away
U	AQ3HelperStartUp	AQ3HEL~1.EXE	"ScreenScenes ""Aquatica Water Worlds"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
?	AsusStartupHelp	AsRunHelp.exe	"Unknown ASUS motherboard utility. What does it do and is it required?"
U	BI1HelperStartUp	BI1HEL~1.EXE	"ScreenScenes ""Beach Islands"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
Y	BitDefender Antiphishing Helper	IEShow.exe	"Anti-phishing component of BitDefender internet security products. Anti-phishing prevents sensitive data such as usernames
U	BO1HelperStartUp	BO1HEL~1.EXE	"ScreenScenes ""Butterfly Oasis"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	BO1HelperStartUp	Bo1helper.exe	"ScreenScenes ""Butterfly Oasis"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	Browser Help Svc	BHSV.EXE	"Added by the RBOT-AVQ WORM!"
U	BT Broadband Basic Help	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	BT Broadband Desktop Help	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	BT Broadband Help	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	ccHelp	ccHelp.hta	"Searchq adware"
N	Client Access Help Update	cwbinhlp.exe	"Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
Y	Communications_Helper	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	Communications_Helper.exe	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
X	Configuration Loader	WinHelper.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
U	Cpu Level Up help	CpuLevelUpHelp.exe	"Included with some ASUS motherboards (such as the Maximus Extreme & Striker II Extreme)
X	cthelp	cthelp.exe	"Added by the SDBOT TROJAN!"
U	CTHELPER	CTHELPER.EXE	"CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers
X	CTHelper	cthelper.exe	"Added by the RBOT-XB WORM! Note - do not confuse with the Creative application of the same name described here"
X	CTHELPER	svhost.exe	"Added by the SDBOT-RZ WORM!"
U	ddhelper	W815DM.EXE	"Enuff Parental Control Software by Akrontech"
X	DealHelperBrwsr	dhbrwsr.exe	"DealHelper adware"
X	DealHelperDown	download.exe	"DealHelper adware"
X	DealHelperUpdate	DHUpdt.exe	"DealHelper adware"
X	debugger	help.pif	"Added by the DELF-DRA WORM!"
N	Dialog Helper	PDDLGHLP.EXE	"Dialog Helper from PowerDesk Pro by Ontrack. Helps with the standard Open and Save As dialog boxes by showing recently used files and folders. Available via Start -> Programs"
X	DirectX	ddhelp32.exe	"Added by the BIONET.318 TROJAN! Note - not the DirectX helper which is ddhelp.exe"
N	DLHelperEXE	WATCH.exe	Download helper distributed with some software that allows the software installation to redirect download locations. Not required once the installation is finished
X	DLHelperEXE.exe	N/A	Downloader for Microgaming/Casino software - stealth installed
X	dllhelp	dllhelp.exe	"Added by the STARTPAGE.DQ hijacker"
X	dllhelp	dllhlp.exe	"Added by the Downloader-HI TROJAN!"
X	DNHelper32	DNHlp32.exe	Added by an unidentified WORM or TROJAN!
X	Dynamic Dns Binary	WinHelpcfn.exe	"Added by a variant of the RBOT WORM!"
?	ExxtremeHelperDemon	exxdemon.exe	"Creative Exxtreme graphics card related?"
N	ezHelper	ezHelper.exe	"Part of the ezPeer+ ezHelper music sharing program."
X	FCHelp	FCHelp.exe	"Added by either FCHelp adware or a variant of it"
X	Generic Host Process for WinXP Services	mshelp.exe	"Added by the AGENT-GQP TROJAN!"
?	HDhelp	tbhdhelp.exe	"Associated with Philips Edge series soundcards. Is it required?"
?	Help	helpext.exe	"??"
X	help	help.scr	"Added by the BANCOS-BBU TROJAN!"
X	Help	Wizardnil.exe	"Added by the BANCOS-BCZ TROJAN!"
X	Help	lshost.exe	Identified as a variant of the Trojan-Clicker.Win32.Delf.aro malware
X	Help Temp Files	netreg.exe	"Added by the FORBOT-EM WORM!"
X	Help Temp Files	emp32.exe	"Added by the FORBOT-EC WORM!"
U	HelpCenter	sprtcmd.exe /P HelpCenter	"Self-help support tool for BellSouth's FastAccess® DSL (now owned by AT&T) broadband service (provided by SupportSoft
U	HelpCenter4.1	sprtcmd.exe /P HelpCenter4.1	"Self-help support tool for BellSouth's FastAccess® DSL (now owned by AT&T) broadband service (provided by SupportSoft
X	helpctl.exe	helpctl.exe	"Added by the GASLIDE TROJAN!"
X	Helper	eschlp.exe	"Added by the BLASTER.T WORM!"
X	HELPER	greece_nm.exe	"AsdPlug premium rate adult content dialer variant"
X	HELPER	Netherlands.exe	"AsdPlug premium rate adult content dialer variant"
X	HELPER	new_zealand.exe	"AsdPlug premium rate adult content dialer variant"
X	HELPER	sweden.exe	"AsdPlug premium rate adult content dialer variant"
X	HELPER	canada.exe	"AsdPlug premium rate adult content dialer variant"
X	HELPER	france.exe	"AsdPlug premium rate adult content dialer variant"
X	HELPER	temp532.exe	"AsdPlug premium rate adult content dialer variant"
X	helper.dll	rundll32.exe [path] helper.dll	"CnsMin (Chinese Keywords) hijacker related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	HelpExp.exe	HelpExp.exe	"Attune HelpExpress - spyware. Disable and uninstall - see here"
X	helpmanager	spoler.exe	"Added by the RANDEX.J WORM!"
X	helpo	helpo.exe	"Added by the BANLOA-BU TROJAN!"
X	helpw	helpw.exe	Adware downloader
U	Hitman Pro SurfRight Helper	srhelper.exe	"Hitman Pro - a utility to start a number of Security Protection software. They can be started individualy"
U	HondaHelper	HondaHelper.exe	"Part of Honda Music Link which allows you to use your Honda's audio system's controls to play and search for music on your iPod® in you car"
X	host	help.exe	IESearchToolbar parasite. Identified by Ewido Security Suite (Ewido is now part of AVG Technologies) as the DELF.LF TROJAN!
X	HTML Help System	hhs.pif	"Added by the RBOT-ATB WORM!"
X	HTML32 Help System	hhs32.pif	"Added by the RBOT-ATE WORM!"
X	Iehelper	syslaunch.exe	Outwar adware downloader
X	IMJPMIG6.1	HelpCat.exe	"Added by the BESVERIT WORM!"
X	Ipod Help	[9 random letters].exe	"Added by a variant of the RBOT WORM!"
X	IPv6 Helper Driver	csass.exe	"Added by the AGOBOT.TC WORM!"
U	ISHelp	help.exe	"ISpy is a security risk that logs keystrokes and captures screenshots. If you didn't install this yourself uninstall it"
Y	iTunes Helper	iTunesHelper.exe	Installed with Apple's iTunes for Windows. Uses ~3-4MB of memory and if disabled in MSCONFIG or deleted from the registry it will re-instate itself after running iTunes a few times - hence the reluctant Y recommendation
X	iTunes Music	iTunesHelper32.exe	"Added by the SDBOT.CHK WORM!"
Y	iTunesHelper	iTunesHelper.exe	Installed with Apple's iTunes for Windows. Uses ~3-4MB of memory and if disabled in MSCONFIG or deleted from the registry it will re-instate itself after running iTunes a few times - hence the reluctant Y recommendation
Y	KB926239	"rundll32.exe apphelp.dll	ShimFlushCache"
X	Live-Help	lmns.exe	"Added by the RBOT-GHE WORM!"
Y	Logitech	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	LogitechCommunicationsManager	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	LogitechRegisterVideoApplications	InstallHelper.exe	Entry added when you install versions of the Logitech QuickCam webcam software and used to register video applications that can use the webcam on the first reboot after installing the software
U	LogitechVideo[inspector]	InstallHelper.exe	Entry added when you install versions of the Logitech QuickCam webcam software and used to monitor and register video applications that can use the webcam. It isn't normally running but you could disable it and re-enable it before you install supported applications
X	Microsoft Data Helper	cihost.exe	"Malware
X	Microsoft Help	svh0st.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Help	svchosl.exe	"Added by the AGENT-GPX TROJAN!"
X	Microsoft Help Support	mshelp32.exe	"Addded by the KELVIR-BF WORM!"
X	Microsoft Help SVC	msnmngr.exe	"Added by the SDBOT-PQ WORM!"
X	Microsoft Help System	mshelp32.exe	"CoolWebSearch parasite variant"
X	Microsoft Helpdesk Side	mshelpdsk.exe	"Added by the SPYBOT.ANJJ WORM!"
X	Microsoft Hyptertext Helper	mshtha.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Security Monitor Process	HelpMe.exe	"Added by the VB.BJO TROJAN!"
X	Microsofts Help Services	msnmngr.exe	"Added by the SDBOT-PJ WORM!"
X	MicrosoftUpdate	syshelper.exe	"Added by the WOOTBOT.AC WORM!"
X	MicrosoftUpdates	syshelped.exe	"Added by the FORBOT-AZ WORM!"
X	Mircrosoft Technic Help	EditKey.exe	"Added by the KOLABC.AS WORM!"
X	Mircrosoft Technic Help	RegKey.exe	"Added by a variant of the SPYBOT WORM! See here"
U	ML1HelperStartUp	ML1HEL~1.EXE	"ScreenScenes ""Midnight Lake"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	ML1HelperStartUp	ML1Helper.exe	"ScreenScenes ""Midnight Lake"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	Monitor Helper	monitor.exe	"MyLittleSpy keystroke logger/monitoring program - remove unless you installed it yourself!"
N	Motive SmartBridge	BTHelpNotifier.exe	"System tray icon for help from BT Broadband
X	MSDN HELP	msdn.exe	"Added by the AGOBOT.AIB WORM!"
X	MSDNN	help.exe	"Added by the AGENT-GBK TROJAN!"
X	Mshelp32	mshelp32.exe	"CoolWebSearch parasite variant"
X	MSN	iTuneshelp.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Msn Message Acount Helper 7.7	msnmessage7.7.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	mssyslanhelper	msmsgri32.exe	"Added by the RANDEX.D WORM!"
U	MW1HelperStartUp	Mw1helper.exe	"ScreenScenes ""Magic Waterfall"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	MW1HelperStartUp	MW1HEL~1.EXE	"ScreenScenes ""Magic Waterfall"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	Netbios Helper	nbthlp.exe	"Added by the BANKER.Y TROJAN!"
U	NetShow Powerpoint Helper	NSPPTHLP.EXE	"If disabled
U	NSHelper	aexnsinstallhelper.exe	Altiris Express Notification Server Install helper - monitors integrity of the installation
X	olehelp	olehelp.exe	"Added by the BOOKMARKER.D or BOOKMARKER.G TROJANS!"
X	once	help.exe	IESearchToolbar parasite. Identified by Ewido Security Suite (Ewido is now part of AVG Technologies) as the DELF.LF TROJAN!
X	OnlineHelpmate	GDC.exe	"OnlineHelpmate rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
?	OOLHELPT	OOLHELPT.exe	"??"
U	P17Helper	"Rundll32 P17.dll	P17Helper"
?	P17Helper	"Rundll32 SPIRun.dll	RunDLLEntry"
X	pqhelper	pqhelper.exe	"Searchcentrix hijacker"
X	Print Driver Helper Service	crsrr.exe	"Added by the AGENT-BC TROJAN!"
N	QuickTime Update Completion x	quicktimeupdatehelper.exe	"Different numbers caused by number of launches. So if 3 updates are made separately
U	RegClean Expert Scheduler	RCHelper.exe	"""Registry Clean Expert scans the Windows registry and finds incorrect or obsolete information in the registry. By fixing these obsolete information in Windows registry
U	RegHelp	svchosts.exe	"SpyGraphica spy software - ""Stealth monitoring of ALL PC or Network Activity with DVD-like playback. EVERY keystroke can be e-mailed in a detailed activity report every 15 minutes...anywhere in the world."""
N	RemHelp	Remhelp.exe	BT Voyager ADSL Modem Help related
X	Remote Desktop Help Session Manager	WinRDH.exe	"Added by a variant of the SDBOT WORM!"
X	RichMedia	HBHelper.dll	"HenBang adware"
X	Run	help.exe	IESearchToolbar parasite. Identified by Ewido Security Suite (Ewido is now part of AVG Technologies) as the DELF.LF TROJAN!
X	s4helper	s4helper.exe	"Searchcentrix hijacker"
X	sck121	helpsyss.exe	Added by a variant of the MAILBOT TROJAN!
N	SM56 Helper Win32 Utility	sm56hlpr.exe	Helper utility for Motorola based SM56 software modems - resides in the System Tray
X	SOUNDMAN Microsoft Help	soun.pif	"Added by the RBOT-AIU WORM!"
U	StormCodec_Helper	StormSet.exe	"Storm Codec is a codec pack for Windows"
U	SurfHelper	SurfHelp.exe	"Related to SurfHelper - a free tool to remove popup windows
X	svchost	olehelp.exe	"Added by the BOOKMARKER.G TROJAN!"
X	svchost	winhelp.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	syshelp	syshelp.exe	"Added by the LOVGATE.C WORM!"
X	system	Winhelp.exe	"Added by the IMAUT.CN WORM!"
X	SYSTEM service helper	svchelper.exe	"Added by the MONKBD-A WORM!"
X	SYSTEM service helper	syshelp.exe	"Added by a variant of the MONKBD-A WORM!"
X	SystemHelp	"RUNDLL32.EXE SystemHper.dll	Install"
X	Task Help	wualcts.exe	"Added by a variant of the RBOT WORM!"
X	ToolHelp	hwpv.exe	"Added by a variant of the INFOSTEALER TROJAN!"
N	TPKMAPHELPER	TpKmapAp.exe	"Part of the Keyboard Customizer Utility for IBM/Lenovo Thinkpad notebooks. This is the main user interface for the utility but it doesn't normally seem to be running if enabled at startup. Also
N	tray_helper	tray_helper.exe	"Tray Helper is an Email checker with additional tools
?	Verizon Custom Uninstall Tracking	InstallHelper.exe	"Verizon related installation tracker. What does it do and is it required?"
X	Vmlist	apphelps.dll	"Added by the ALAMNAHE.A VIRUS!"
U	WatcherHelper	WaHelper.exe	"Sierra Wireless Watcher™ - wireless configuration utility"
X	Win32 Configuration	dllhelp.exe	"Added by the SDBOT.UL WORM!"
X	Win32 FireWire Driver	CTHELPER32.EXE	"Added by the WOOTBOT TROJAN!"
X	Win32 Help32 Service	win32help.exe	"Added by the DELBOT-U WORM!"
X	Windows Help	mailinfo.exe	"Added by the MYTOB.JX WORM!"
X	Windows Help	Stney.exe	"Added by the AGOBOT-VI WORM!"
X	Windows Help File	winhelper32.exe	"Added by the SDBOT-QK TROJAN!"
X	Windows Help Manager	svchost32.exe	"Added by the RBOT-OZ WORM!"
X	Windows Help Service	winhelpsv.exe	"Added by the RBOT-LP WORM!"
X	Windows Help Service	winhlp.pif	"Added by the RBOT-AKW WORM!"
?	Windows Help System	Help.pif	"??"
X	Windows Helper	winhelp.exe	"Added by the BANKER.APE TROJAN!"
X	Windows Helper	wsctnfy.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Logon Application	win32help.exe	"Added by the DELBOT-X WORM!"
N	Windows Media Powerpoint Helper	NSPPTHLP.EXE	German software (comes with some Toshiba CD writers) that helps convert Powerpoint files to ASF (Streaming Media) files. Available via Start -> Programs
X	Windows Runtime Help	win32hlp.exe	"Added by a variant of the AIMVISION TROJAN!"
X	Windows Runtime Help	WinRunHelp.wrh	"Added by a variant of the AIMVISION TROJAN!"
X	Windows Service help	winservices.exe	"Added by the DROPPER.TT TROJAN!"
U	WINDVDpatch	CTHELPER.EXE	"CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers
X	Winexec32	windhelp32.exe	"Added by the AGENT-HKU TROJAN!"
X	WinFixer helper	wfxcwr.exe	"WinFixer web installer - ""foistware""
X	Winhelp	winhe1p.exe	"Added by the QQPASS.E TROJAN!"
X	WinHelp	WinHelp.exe	"Added by the LOVGATE.F WORM! Note - this file is located in %System% whereas the valid one is located in %Windir%"
X	WinHelp	realsched.exe	"Added by the LOVGATE-F WORM! Note - this is not the legitimate RealPlayer (realsched.exe) application of the same name. This one is located in %System%"
X	Winhelp	TkBellExe.exe...	"Added by the LOVGATE.Z WORM!"
X	winhelp	dns32.exe	"Added by a variant of the RBOT WORM!"
X	winhelp	Updadv.exe	"Added by the QQPASS-N TROJAN!"
X	Winhelp	TkBellExe.exe	"Added by the LOVGATE.E WORM!"
U	WinIRXHelper	WinIRXHelper.exe	"MSI Media Center Deluxe software - see here"
X	winlogon.exe	helper.exe	"Added by the FAKESPY-A TROJAN!"
X	winthelp	winthelp.exe	"Associated with the AdvancedCleaner rogue security software - see here. Removal instructions here"
X	ws2help	ws2help.exe	"Added by a variant of the SMALL.AN TROJAN!"
X	wzhelper	wzhelper.exe	"Searchcentrix hijacker"
X	ziphelp	ziphelp.exe	"CoolWebSearch parasite variant"
X	[various names]	atl_helper.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	ATLIEHELPER.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	iehelper.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	MsNetHelper.exe	"Wareout - malware masquerading as a spyware and dialer remover"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.