Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
?Ad Online Guideadonlineguide.exe"??"
?AidemHotKeyDVMAIN.EXE"Keyboard related"
?AidemHotKeyKEYAPP.EXE"Keyboard related"
XAntispySpiderantispyspider.exe"AntiSpySpider rogue spyware remover - not recommended
XATI Video Driver Controlatigfx.exe"Added by the RBOT-FWL WORM!"
XATI Video Driver Controlbtorrent.exe"Added by a variant of the IRCBOT TROJAN!"
XATI Video Driver Controls[path to worm]"Added by the SDBOT-DDS WORM!"
XATI VIDEO REGKEYati2vid.exe"Added by the SDBOT.UR WORM!"
XAuth Starter Identstartauth.exe"Added by the RBOT-WP WORM!"
XBadxHELLRAIDER.EXE"Added by the MINDCTRL.A BACKDOOR!"
XBossIdeawinlogin.exe"Added by the LINEAGE-I TROJAN!"
Xcaseyvideocaseyvideo.exeMalware causing adult content popups
Xcaseyvideo[*] [* = digit]caseyvideo[*].exe [* = digit]Malware causing adult content popups
YCnwiDeviceAgentcnwida.exe"Part of the Canon imagePROGRAF W8400 printer management software"
NCompaq Video CD Watcher??For Compaq PC's. MPEG viewer
XConfidentSurfGDC.exe"ConfidentSurf rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
XConfidentUserSRP.exeConfidentUser rogue system error and cleaning utility - not recommended
Xcpythidep.exe"Added by the MIRJACK-A TROJAN!"
UDeskSlideDeskSlide.exe"""DeskSlide is utility for automating wallpaper changes on your desktop"""
Udetectidetect.exe"iNTERNET Turbo from Clasys Ltd. "It accelerates any Windows 95/98/Me/NT/2000/XP internet connection in seconds". If you find it helps your connectivity leave it enabled"
NDigiGuideCLIENT.EXETV guide and reminder
NDigiGuideclient01.exeTV guide and reminder
XDirector Videobtnmgern.exe"Added by the MYTOB-KL WORM!"
XDirectX Video Driverdxterm5.exe"Added by the WILAB-A TROJAN!"
XDIVX Video PlayerDIVXPloyer.exeAdded by an unidentified WORM or TROJAN!
XDvVideo32dvvid32.exe"Added by the TINY.FD TROJAN!"
UEvidence Cleanerecleaner.exe"Evidence Cleaner cleans up tracks left by your PC and Internet activities"
NEvidence Eliminatoree.exe"Evidence Eliminator - cover the tracks of your browsing habits and E-mails if you think you need to. Run manually on a regular basis"
NEye Tide Launcheroneeyetideone.exeNascar wallpaper
XFhzepgyiHELLRAIDER.EXE"Added by the MINDCTRL.A BACKDOOR!"
XFirewall PolicyMidiDef32.exe"Added by the PIEBOT-A TROJAN!"
YGlideGlidew32.exe"Cirque touchpad driver"
UHide and Protect any Drives for Win95/98/Me/2k/XPHPDAgent.exe"Loads Hide and Protect any Drives - which allows you to ""Protect Hard drive
Xhidenhiden.exe"Added by the AGENT-IW TROJAN!"
UHideOEHideOE.exe"HideOE - allows you to 'hide' Outlook Express or minimize it to the System Tray"
XHideRun.exeHiderun.exe and svhost.exe and pro.gif"Added by the BOOHOO WORM!"
XHideStyleAnte Browse Trust.exe"IE toolbar taking you to Lop.com. If the exe is running
UHidetools Spy Monitorwmispe.exe"HideTools Spy Monitor surveillance software. Uninstall this software unless you put it there yourself"
XHot InsideHottest Story Ever.exe"Added by the BHARAT.A WORM!"
UHotIDEhotide.exeHotIDE allows Acer TravelMate owners to hot-swap external drives without switching of their notebooks
XIDEide.exe"Added by the ASSASIN.F TROJAN!"
XIDE LoaderIDElibr32.exe"Added by the XILON TROJAN! Related to the game ""Diablo II"""
Xidecntlidecntl.exe"Added by a variant of the CRYPTER.C TROJAN!"
UiDesktopidesktop.exe"Immersion TouchWare Desktop software for devices such as the Logitech iFeel Mouse"
NiLikeilikesidebar.exe"iLike Sidebar for iTunes and Windows Media Player"
XInsiderInsider.exe"Added by the AGENT.KMC TROJAN!"
XInstallProvidernewsoftware2007install.exe"Part of WinAntiVirusPro 2007 and Privacy Protector rogue security software (and possibly others) - not recommended"
XIntel Audio Studio V2.0fmideploy.exeDetected by VBA32 as the BIFROSE.ADR TROJAN!
NIntervideo Win Cinema ManagerWinCinemaMgr.exe"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
NIntervideo Win Cinema ManagerWINCIN~1.EXE"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
NIntervideo WinCinema ManagerWinCinemaMgr.exe"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
NIntervideo WinCinema ManagerWINCIN~1.EXE"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
NIntervideo WinSchedulerWinScheduler.exe"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
NIntervideo WinSchedulerSchSvr.exe"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
UJMB36X IDE SetupJMInsIDE.exe"JMB36x series IDE (or Parallel ATA) configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers"
UJMB36X IDE SetupxInsIDE.exe"JMB36x series IDE (or Parallel ATA) configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers. This is normally located in %Windir%\RaidTool"
UJv16pt Network Residentjv16pt_network.exe"jv16 PowerTools network resident program. Only needed if you are using the program's network features"
NLancement rapide d'Adobe Readerreader_sl.exe"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly. French version"
YLogitechRegisterVideoApplicationsInstallHelper.exeEntry added when you install versions of the Logitech QuickCam webcam software and used to register video applications that can use the webcam on the first reboot after installing the software
ULogitechVideoRepairISStart.exe"Installed with Logitech's QuickSmart and QuickCam (older versions) webcam software. The exact purpose of this startup entry is unknown at present
ULogitechVideoTrayLogiTray.exe"System Tray access to My Logitech Pictures
ULogitechVideo[inspector]InstallHelper.exeEntry added when you install versions of the Logitech QuickCam webcam software and used to monitor and register video applications that can use the webcam. It isn't normally running but you could disable it and re-enable it before you install supported applications
Xlololol_hideme_imhiddenlololol.exe"Added by the HIDEME-A TROJAN!"
?lycosInsideLyc_SysTray.exe"Lycos eMail related - what does it do and is it required?"
Xmaskridermaskrider2001.vbs"Added by the SOLOW-G WORM!"
XMicrosoft Helpdesk Sidemshelpdsk.exe"Added by the SPYBOT.ANJJ WORM!"
XMicrosoft Nvidia Videonvidia.exe"Added by a variant of the SDBOT WORM!"
NMicrosoft Sidewinder Game Controller SoftwareSWTRAY.EXEMS SideWinder game controller system tray icon. Available via Start -> Programs
XMicrosoft Update Managerscvideo.exe"Added by the SDBOT-CVP TROJAN!"
XMicrosoft Video Capture ControlsMSsrvs32.exe"Added by the SDBOT-AAK WORM!"
XMicrosoft Video Controlstskmsgr.exe"Added by a variant of the SPYBOT WORM!"
XMicrosoft Video Drivervideodrv.exe"Added by the SDBOT-AGP WORM!"
UMicrosoft Windows SidebarSidebar.exe"Windows Sidebar is a pane on the side of the Microsoft Windows Vista desktop where you can keep your gadgets organized and always available. In Windows 7 this feature is known as Desktop Gadgets and each gadget can be placed anywhere on the desktop. If the file isn't located in %ProgramFiles%\Windows Sidebar or you're using other versions of Windows it could be part of the Searchcentrix hijacker"
UMicrosoft® Windows® Operating SystemSidebar.exe"Windows Sidebar is a pane on the side of the Microsoft Windows Vista desktop where you can keep your gadgets organized and always available. In Windows 7 this feature is known as Desktop Gadgets and each gadget can be placed anywhere on the desktop. If the file isn't located in %ProgramFiles%\Windows Sidebar or you're using other versions of Windows it could be part of the Searchcentrix hijacker"
NmiroVIDEO Tray Toolmisitray.exe"Tool for quickly changing options for miro/Pinnacle capture cards during capture/playback/output. When this program is closed
XMS Security Update 993msident.exe"Added by a variant of the SDBOT WORM!"
Xmskridermaskrider.dll.vbs"Added by the SOLOW-F WORM!"
UMSN Video EnhancedMSNVE.exe"""MSN Video Enhanced can play videos that have dramatically improved video quality and sound. It can play the latest high-quality videos at the best possible quality."" No longer appears to exist"
XMSVSyncvideosync.exe"Added by a variant of the SPYBOT WORM!"
XNT LM Security Support ProviderWinNTLM.exe"Added by a variant of the SDBOT WORM!"
XNvidex32Nvidex32.exe"Added by the GEMA TROJAN!"
XNVIDIA Video driversvideo_32D.exe"Added by the AGOBOT.KV WORM!"
XNVIDIA Video driversvideo_32sD.exe"Added by the RBOT-BB WORM!"
XNvVideoCenterNvVid.exe"Added by the HAXDOOR-DO TROJAN!"
XPaintingRoom evidence monitorpaintingroom.exePaintingroom.com smiley software - not recommended as the site tries to drop a trojan on you...
NPAL Evidence EliminatorCleaner.exe"PAL Evidence Eliminator - cover the tracks of your browsing habits and E-mails if you think you need to. Run manually on a regular basis"
?Pathlide.exe"??"
Ypccguide.exepccguide.exe"Part of Trend Micro web-security products - Internet Security 2005-2007
UPicture Package VCD MakerResidence.exe"Sony Picture Package software for their range of Digital Handycam video cameras. Used to connect the camcorder via USB and allows the user to burn the content directly to a CD"
UQuick Hide Windowsqhw.exe"Quick Hide Windows from CronoSoft - ""provides a quick and easy way for home and office PC users to quickly get sensitive materials off the screen without closing programs or losing documents"""
XRealplayer VideoRealPlay.exe"Added by a variant of the RBOT WORM!"
XRegistry oidetwin32.exe"Added by the RBOT.BMT WORM!"
Xryan1918servidevice.exe"Added by the RBOT-GVR WORM!"
XServicewinHide32.exe"Added by the MSNVB-D WORM!"
?SetDefaultMIDIMIDIDef.exe"Related to a Soundblaster Audigy soundcards. What does it do and is it required?"
USideACTSideACT.exe"SideACT organizer software"
USidebarSidebar.exe"Windows Sidebar is a pane on the side of the Microsoft Windows Vista desktop where you can keep your gadgets organized and always available. In Windows 7 this feature is known as Desktop Gadgets and each gadget can be placed anywhere on the desktop. If the file isn't located in %ProgramFiles%\Windows Sidebar or you're using other versions of Windows it could be part of the Searchcentrix hijacker"
NSIDEBARdsidebar.exe"""Desktop Sidebar provides you with instant access to the information you most desire by grabbing data from your PC and the internet. The result is a dynamic visual display you configure and control"""
XSideGreenSideGreen.exe"SideGreen adware. File located in %Program Files%\SideGreen"
NSideWinderTrayV4SWTrayV4.exeMS SideWinder game controller system tray icon. This is specific to version 4 of the software. Available via Start -> Programs
XslideIexplore.exe"Added by the GASLIDE TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup!"
NSpeedBitVideoAcceleratorVideoAccelerator.exe"""SpeedBit Video Accelerator makes videos from YouTube and over 150 sites stream faster and play smoother by reducing buffering problems and video interruptions or hiccups"""
YSpIDerMailspiderml.exe"DrWeb antivirus Spider Mail e-mail scanner"
Xsuicidetempfile2.bat"Personal Protector rogue security software - not recommended
XSurfSideKickSsk.exe"SurfSideKick adware"
XSurfSideKick 2Ssk.exe"SurfSideKick adware"
XSurfSideKick 3Ssk.exe"SurfSideKick adware"
XsVideo2[path to dialler]"""Switch-D"" premium rate adult content dialler"
XSystemTraVideo.EXE"Added by the LOVGATE.E WORM!"
XSystemWideHook for Windows NT%WinHook32.exe"Added by the MYDOOM.AC WORM!"
XTelephony ProviderIexplore.exe"Added by the FORBOT-DF BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
Utgcmdprovidersbctgcmd.exe"Part of software from SupportSoft (aka Support.com) provided to manufacturers and ISPs that allows them to offer on-line support - to update drivers
UThoosje Vista SidebarThoosje Vista Sidebar.exe"Thoosje's Vista Sidebar - sidebar and skins for microsoft Windows XP and Vista"
YTridentTVIcontvicon.exe"Trident Microsystems
XUKVideo2ukvideo2.exeAdult content dialler
XVideoexplored.exe"Added by the GAOBOT.RF WORM!"
XVideowinamp32.exe"Added by the AGOBOT-NG WORM!"
XVideo Camera Frogwcamfrog.exe"Added by a variant of the IRCBOT TROJAN! See here"
XVideo Card Driver (do not remove)tsasi.exe"Added by the SPYBOT-EF WORM!"
XVideo DisplayVDISP.EXE"Added by the AGOBOT-KE WORM!"
XVideo Driversvchost.exe"Added by an unidentified WORM or TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
XVideo DriverMsregdrv32.exe"Added by the SPIGOT BACKDOOR!"
XVideo Lan PlayerVideoLanPlayer.exe"Added by the RBOT-MY WORM!"
XVideo Managervideomgr.exe"Added by the PANDEM.C WORM!"
XVideo Multimedia Driverndrives32.exe"Added by the RBOT-DK WORM!"
XVideo Poeswinii.exe"Added by the AGOBOT-CP WORM!"
XVideo Proceswinaps.exe"Added by the AGOBOT.HD WORM!"
XVideo Processsysconf.exe"Added by the GAOBOT.GEN!POLY or GAOBOT.UM or GAOBOT.ADX WORMS!"
XVideo ProcessMS32x16.exe"Added by the RBOT.RH WORM!"
XVideo Processnetsvcs.exe"Added by the AGOBOT.LH WORM!"
XVideo ProcessMSlti64.exe"Added by the AGOBOT.UE WORM!"
XVideo Process[random filename]"Added by the RBOT-LM WORM!"
XVideo Processwinasp.exe"Added by the AGOBOT-IS WORM!"
XVideo Processmsn5.exe"Added by the AGOBOT-TW WORM!"
XVideo ProcessMStli32s.exe"Added by the RBOT-GAD WORM!"
XVideo Processwincert32.exe"Added by the AGOBOT.JT WORM!"
XVideo Processntsystm.exe"Added by the GAOBOT.ZX WORM!"
XVideo ProcessNivopsvc.exe"Added by the AGOBOT-GT WORM!"
XVideo Processwincrt32.exe"Added by the AGOBOT-GR WORM!"
XVideo ProcessAvg123.exe"Added by the AGOBOT-MS WORM!"
XVideo ProcessNavapsvcc.exe"Added by the SPYBOT-CW WORM!"
XVideo Processormsconfsys88.exe"Added by the AGOBOT-QG WORM!"
XVideo Proeswinaii.exe"Added by the AGOBOT-FH WORM!"
XVideo Servicesexplore.exe"Added by the GAOBOT.GL WORM!"
XVideo Servicesvideol_32.exe"Added by the AGOBOT-DM WORM!"
XVideo Servicessys32.exe"Added by the AGOBOT.PS WORM!"
XVideocntlVideocntl.exe"Added by a variant of the GEMA.D TROJAN!"
XVideoDriver[filename]"Added by the GSPOT20.A TROJAN!"
XVideoDrivervideodrv.exe"Added by the MIMAIL.A WORM!"
XVideoDrivergspotbot.exe"Added by the SPIGOT.C TROJAN!"
XVideoDriverHookvmdriver.exe"Added by the BCKDR-PSS BACKDOOR!"
XVideool32VIDEOL32.EXE"Added by the AGOBOT.EC WORM!"
Xvideopcivideopci.exe"Added by the AGENT-W TROJAN!"
Xvideoporno.exevideoporno.exePremium rate adult content dialer
YVideoraVideora.exe"Video Holding personal video downloading program"
NVoipRaiderVoipRaider.exe"VoipRaider - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
Uwfipsiphider.exe"ICQ (messaging/chat program) anti-bomb software. ""WFIPS is anti-bomb software for safeguarding ICQ Bomb before the bombing. 'ICQ Defoolder' is a tool for removing ICQ bomb after being exposed."" For more information about ICQ bombs see here"
Xwidelinkwidelinke.exe"WideLink adware. File located in %Program Files%\widelink"
XWifi Debugwifidebug.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
XWin32 Configurationvideosd32.exe"Added by the SDBOT.TT WORM!"
XWindows Event Providerwposvc.exe"Added by a variant of the IRCBOT TROJAN! See here"
XWindows Identifysysays.exe"Added by a variant of the SPYBOT WORM! See here"
XWindows Protectotboxide.exe"Added by a variant of the WOOTBOT WORM!"
XWindows Servicevideo.exeAdded by an unidentified TROJAN!
XWindows Servicevideo2.exeAdded by the DOWNLOADER.SMALL.MY TROJAN!
XWindows Services Guidesvcguide.exe"Added by the SLENFBOT.KQ WORM!"
XWindows Services Guidesvcguides.exe"Added by the SHEUR.YS BACKDOOR!"
XWindows videovide_32.exe"Added by a variant of the AGOBOT/GAOBOT WORM!"
XWindows Video Acquisition (WVA)wvsvc.exe"Added by the AGOBOT.YM WORM!"
XWindows Video Componentwvcsvc.exe"Added by a variant of the IRCBOT TROJAN!"
XWindows Video Driversvideons32.exe"Added by the GAOBOT.AZT WORM!"
XWindows Video DriversVIDEONS3.EXE"Added by the AGOBOT-KZ BACKDOOR!"
XWindows Video Inputviwsvc.exe"Added by the SLENFBOT.GS WORM!"
Xwinnt DNS identwuamgrd32.exe"Added by the RBOT-BAU WORM!"
Xwinnt DNS identiexplorer.exe"Added by a variant of the RBOT WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
Xwinnt DNS identpidchk32.exe"Added by the RBOT-ACY WORM!"
Xwinnt DNS identwindowxp.exe"Added by a variant of the RBOT WORM!"
Xwinnt DNS identWinupd32.exe"Added by the RBOT.AVU WORM!"
Xwinnt DNS identwinupdate32.exe"Added by a variant of the RBOT WORM!"
Xwinnt DNS identwuamgrd33.exe"Added by a variant of the RBOT WORM!"
XWinnt DNS identwindowsp.exe"Added by the RBOT.BAL WORM!"
XWinnt DNS identmsnmsrg.exe"Added by the RBOT.BVQ WORM!"
XWinsystemFreevideo5.EXE"Added by the AGENT.FZS WORM!"
XWireless Provider Serverwpsvr.exe"Added by the FORBOT-AD WORM!"
XxInsIDExInsIDE.exe"Added by the ADLOAD.BH TROJAN! Note - this should not be confused with the valid IDE configuration utility from JMicron Technology which is normally located in %Windir%\RaidTool and uses the same filename. This one is located in %ProgramFiles%\xInsIDE"
UxInsIDExInsIDE.exe"JMB36x series IDE (or Parallel ATA) configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers. This is normally located in %Windir%\RaidTool"
Xxxxvideoxxxvideo.exe"AccessPlugin premium rate adult content dialler"


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.