MOD

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
U	Agere SoftModem Messaging Applet	AGRSMMSG.exe	Installed with the drivers for internal software modems based upon Lucent/Agere Systems chipsets - required if you use the SoftModem Assistant to configure the modem
U	AModemLockDown	ModemLockDown.exe	"ModemLockDown - allows you to supervise internet access by disabling the modem
U	ATIModeChange	Ati2mdxx.exe	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. After testing it's exact function isn't known at this time and it doesn't appear to be running even with the startup entry enabled - hence the ""U"" recommendation"
Y	azmodem	azexe.exe	"Aztech Labs modem driver"
X	Bron-Spizaetus-5118REPM	komodo-6321422.exe	"Added by the BRONTOK-R WORM!"
U	BTModemProtection	BTModemProtection.exe	"BT Privacy Online modem protection software
X	Cable Modem Adapter	WindowsSec.exe	"Added by the WOOTBOT.A WORM!"
U	Comodo Firewall	CPF.exe	"Comodo Firewall"
Y	COMODO Firewall Pro	cfp.exe	"Comodo Firewall Pro"
U	Comodo Launch Pad Tray	CLPTray.exe	"System Tray access to LaunchPad as bundled with Comodo's freebie offerings such as Comodo Anti-Virus. Some allege that LaunchPad is impossible-to-uninstall adware
Y	COMODO Memory Firewall	cmf.exe	"""Comodo Memory Firewall is a buffer overflow detection and prevention tool which provides the ultimate defence against one of the most serious and common attack types on the Internet - the buffer overflow attack"""
U	Companion Module	companion.exe	"The AOL Companion is a small window that appears when you connect to the service using verison 8.0 and early builds of version 9.0. ""Use the Companion to quickly get to your favourite features
N	Compaq Computer Corp SCCenter Module	SCCENTER.EXE	For Compaq PC's. Part of Backweb
X	CTDrive	"rundll32.exe drvmod.dll	startup"
X	CtModule	CtModule.exe	"Added by the CLICKER-EG TROJAN!"
U	Cyber Trio	showmode.exe	"From G-Tek Technologies. Allows you to set the PC in one of three modes
U	Don't Panic	dontpanicdemodp.exe	"30-day trial version of Don't Panic privacy software from Panicware. "Clean up Internet tracks and quickly hide personal documents with this privacy suite.""
X	DriverModule	csrnvrt.exe	"Added by the IRCBOT.I TROJAN!"
X	eZmmod	mmod.exe	"eZula TopText adware"
X	ezula	eZmmod.exe	"eZula TopText adware"
X	Fdr Command Module	sp2.exe	"Added by the SDBOT.WP WORM!"
X	Framework module library	infocard.exe	"Added by the BUZUS.AYX TROJAN!"
X	Fwr Command Module	fwr.exe	"Added by the SDBOT-PP WORM!"
X	Gerenciamento de arquivos do Windows	Winmod32.exe	"Added by the DLOADER-WG TROJAN!"
X	GetModule18	GetModule18.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule19	GetModule19.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule20	GetModule20.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule21	GetModule21.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule23	GetModule23.exe	"Internet Speed Monitor adware related"
X	GetModule24	GetModule24.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule25	GetModule25.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule27	GetModule27.exe	"Internet Speed Monitor adware related"
X	GetModule29	GetModule29.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule30	GetModule30.exe	"Internet Speed Monitor adware related"
U	ioloDelayModule	delay.exe	"Part of Iolo System Mechanic. Used to delay the start of an application which loads automatically as Windows loads"
X	ISMModule	ISMModule.exe	"Internet Speed Monitor C adware related - see example here"
X	ISMModule2	ISMModule2.exe	"Internet Speed Monitor C adware related - see example here"
X	ISMModule3	ISMModule3.exe	"Internet Speed Monitor C adware"
X	ISMModule4	ISMModule4.exe	"Internet Speed Monitor A adware related"
X	ISMModule6	ISMModule6.exe	"Internet Speed Monitor C adware related - see example here"
X	ISMModule7	ISMModule7.exe	"Internet Speed Monitor C adware related - see example here"
X	ISMModule8	ISMModule8.exe	"Internet Speed Monitor C adware related"
X	Kernel Safe Mode	smss.exe	"Added by the 78CRACK-A TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	Krnlmod	Krnlmod.exe	Keystroke logger/monitoring program - remove unless you installed it yourself!
X	Linksys Modem Drivers	linksys.exe	Added by the IRCBOT.VD WORM!
?	LLMODCL2	"rundll.exe setupx.dll	InstallHinfSection ..LLMODCL2.INF"
Y	LTWinModem1	ltmsg.exe	"Lucent Technologies (now Alcatel-Lucent) WinModem - which uses software rather than hardware
X	main_module	drvmmx32.exe	"Added by the DILA TROJAN!"
X	Microsoft Safe Mode Manager	safemode.exe	"Added by the IRCBOT.HM BACKDOOR!"
X	Microsoft Services	module.exe	"Added by the LAVITS WORM!"
X	Microsoft Update Module	rundll24.exe	"Added by the RBOT-PS WORM!"
X	Microsoft's System Module	Sysmodule.exe	"Added by the BDOOR-FJ BACKDOOR!"
X	mmod	mmod.exe	"eZula TopText adware"
N	MOD	muamgr.exe	"Using MicroAngelo On Display
X	Modem	locatesvc.exe	"Added by a variant of the SPYBOT WORM!"
X	Modem Driverz Updates	mdmdrv.exe	"Added by a variant of the SDBOT WORM!"
U	MODEMBTR	MODEMBTR.EXE	"Modem Booster from inKline Global to improve ISP connections"
X	Modeminf	Modeminf.exe	"Added by a variant of the CRYPTER.C TROJAN!"
U	ModemOnHold	MOH.EXE	"NetWaiting/Modem-on-Hold - allows you to place your Internet connection on hold while you take a voice call (if Call Waiting is supported by your phone company). See here for more information"
U	ModemOnHold	netWaiting.exe	"NetWaiting/Modem-on-Hold - allows you to place your Internet connection on hold while you take a voice call (if Call Waiting is supported by your phone company). See here for more information"
N	ModemUtility	mdmsetpe.exe	System Tray configuration icon for Aztech modems
X	Modifiet Amateur HTPB	wuaclt.exe	"Added by the IRCBOT.AYS WORM!"
U	ModPS2	ModPS2Key.exe	"Hotkey drivers for Chicony keyboard. Required if you use the hotkeys"
X	ModularConfig	syscnfg.exe	"Added by an unidentified VIRUS
X	Module Call initialize	"RUNDLL32.EXE reg.dll	ondll_reg"
X	Modulo 00FE0F01 Host Internet	syschost.exe	"Added by the DELF-KW TROJAN!"
X	MSDrive	rundll32.exe drvmod.dll	"Added by a variant of the OP DIALER! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""drvmod.dll"" file is found in %System%"
X	ntsmod	ntsmod.exe	"Adware downloader/installer
?	PCIMODEM	pcimodem.exe	"Associated with Lucent based Aztech MDP7800-U PCI modems. Is it required?"
N	PitFrame Module	Reminder.exe	"Registration reminder for the PC Pitstop Optimize 2.0 system optimizatoon utility by CA. Located in %ProgramFiles%\PCPitstop\Optimize2"
X	PVModule	pvmodule.exe	"Adperform.com/Adoptim.com adware - located in %ProgramFiles%\PrintView and detected by Avira AntiVir antivirus as the AGENT.ALB TROJAN! NOTE - the 'real' PrintView installs in C:\CBR folder"
X	QdrModule10	QdrModule10.exe	"Internet Speed Monitor adware"
X	QdrModule11	QdrModule11.exe	"Internet Speed Monitor adware related - see example here"
X	QdrModule12	QdrModule12.exe	"Internet Speed Monitor adware related - see example here"
X	QdrModule13	QdrModule13.exe	"Internet Speed Monitor adware related - see example here"
X	QdrModule15	QdrModule15.exe	"Internet Speed Monitor I adware"
X	QdrModule16	QdrModule16.exe	"Internet Speed Monitor adware related - see example here"
X	QdrModule17	QdrModule17.exe	"Internet Speed Monitor I adware"
X	QdrModule9	QdrModule9.exe	"Internet Speed Monitor H adware"
X	Recycler DO NOT MODIFY	recyclecl.exe	"Added by the RBOT.DDA WORM!"
?	SetCacheMode	"rundll32.exe ptipbmf.dll	SetWriteCacheMode"
U	smodul	smodule.exe	"UserMonitor from Neuber. Teachers can broadcast screen to other screens
U	SoftK56 Modem Driver	carpserv.exe	"Associated with Zoltrix and Conexant modems - enables the internal modem speaker
X	sysmod	sysmod.exe	"Added by the SPYBOT-DU WORM!"
X	System Document Application	nmod.exe	"Added by the SDBOT-ABB WORM!"
X	System Setup	rpcxcmod.exe	Added by an unidentified WORM or TROJAN!
X	TaskManager Load Module	TSKMNGR32.EXE	"Added by the SPYBOT.I WORM!"
X	tgbcde	module32.exe	"Added by the REIGN.R TROJAN!"
U	V.92 Modem On Hold	Ltmoh.exe	Modem On Hold utility - manages incoming/outgoing voice calls on a single phone line while being connected to the internet
X	Win32BaseServiceMOD	Wintask.exe	"Added by the NAVIDAD WORM!"
X	WIN3S2SNDS	winabsmod.exe	"Added by the AGENT.DN TROJAN - known to BOClean as ""CWS/INDEX""
X	Windows 128 Module	win128.exe	"Added by the FORBOT-ES WORM!"
X	Windows mod Verifier	Windows-mod.exe	"Added by the RBOT.DSU WORM!"
X	Windows modez Verifier	w1nz0zz0.exe	"Added by a variant of the SDBOT WORM!"
X	Windows modez Verifier	Window2.exe	"Added by a variant of the RBOT WORM!"
X	Windows modez Verifier	WindowsLogon.exe	"Added by a variant of the SDBOT WORM!"
X	Windows modez Verifier	Wwuamguard.exe	"Added by the RBOT.EZJ WORM!"
X	Windows modez Verifier	winlogom.exe	"Added by a variant of the RBOT WORM!"
X	Windows modez Verifier	Windows-.exe	"Added by the RBOT-DIO WORM!"
X	Windows modez Verifier	taskmngr.exe	"Added by a variant of the RBOT WORM!"
X	Windows modez Verifier	winl0g0z.exe	"Added by the RBOT-FNB WORM!"
X	Windows modez Verifier	wuamguard.exe	"Added by the RBOT.EZJ BACKDOOR!"
X	Windows Security Module	module.exe	"Added by a variant of the RBOT WORM!"
X	Windows User Mode Driver Manager	wdfmrg.exe	"Added by the SDBOT-ZN WORM!"
X	WindowsXP Module	DirectX3D.exe	"Malware
Y	winmodem	wmexe.exe	"Software for software based modems. Required if you have one of these. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information"
X	WinSysModule	[path to trojan]	"Added by the AGENT-DIQ TROJAN!"
N	WXProcMgr Module	WXprocMgr.exe	"TVTonic from Wavexpress - ""enjoy 3 full-screen
Y	XircWinModem4	ltcm000c.exe	"WinModem drivers. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.