MSR

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	APIMon	msreg.exe	"Added by the DROPPER.Z TROJAN!"
?	Apmsrv9x	APMSRV9X.EXE	"Intel AnyPoint Wireless II Home Network related. Now discontinued. What does it do and is it required?"
X	btmsre.exe	btmsre.exe	"Added by the SDBOT.AM WORM!"
X	Configuration Loader	msrun.exe	"Added by the AGOBOT-Y WORM!"
U	Creata Mail	JMSrvr.exe	"Creata_Mail. Smileys
X	drmsrv32	stmhosts.exe	"Added by the AGENT.AGWU TROJAN!"
X	dxmsrv	dxmsrv.exe	Added by an unidentified WORM or TROJAN!
X	Ethernet Driver	cmsrrs.exe	"Added by a variant of the RBOT WORM!"
X	Explorer	msrstart.exe	"Added by the SOPICLICK TROJAN!"
N	Fpx	mnmsrvc.exe	Remote Desktop Sharing service part of Microsoft's Netmeeting allowing users to share items on their screens across remote locations
X	LEMSRV	lemsrv.exe	"Added by the IRCBOT-TC TROJAN!"
U	Memory+	tfimemsr.exe	"Memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
X	Microsft Remote Procedure Daemon	msrpcd.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Config Loader	msrun32.exe	"Added by the AGOBOT-DY WORM!"
X	MicroSoft Remote Secure Service	MSRSS.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft System32 Update	cmsrg.exe	"Added by the RBOT-GN WORM!"
X	Microsoft Windows Updating System	msresource.exe	"Added by the RBOT-EAM WORM!"
X	MS Registry Service	MSRMS32.exe	"Added by the RBOT-AKP WORM!"
X	MS Remote Procedure Call	msrpc32.exe	"Added by the RBOT-QL WORM!"
X	MSN Messengger	MsRun32.exe	"Added by the IMAUT.CO WORM!"
X	msnsmgr	MsnMsr.exe	"Added by the LOONY-N TROJAN!"
X	MSR	msr.exe	"Added by the AGOBOT.RT WORM!"
X	Msrc	Msrc.exe	Added by the KRYPTONIC GHOST TROJAN!
X	msrdc	msrdc.exe	"Added by the SDBOT-CXO WORM!"
X	msreg.exe	msrege.exe	"Added by the ZINX TROJAN!"
X	msReg32 Loader	msreg32.exe	"Added by the AGOBOT.IU WORM!"
X	MSREGIT	Msgp.exe	"Added by the KRYPGHOS.13 TROJAN!"
U	MSRegScan	SGP.exe	"SpyGator surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	SSDemo.exe	"SupremeSpy surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	ETNKL.exe	"ComKeylogger surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	KSPDemo.exe	"KeyStalker PRO surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	DDSSDemo.exe	"SystemSleuth surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	ESP+.exe	"ESP surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	ESPDemo.exe	"Eye Spy Pro surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	SBPDemo.exe	"SpyBoss Pro surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	YEKPND.exe	"EyeCandy Computer Monitor surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	YKPND.exe	"YKPMD surveillance software. Uninstall this software unless you put it there yourself"
X	MSRegSvc	regsvc32.exe	Homepage hijacker that changes your homepage to an adult content site
X	msresear	[path to trojan]	"Added by the WEASYW-B TROJAN!"
X	msresearch	msresearch.exe	"TROJAN! - 180SearchAssistant adware related"
X	msresearch	tool3.exe	"Spy Sheriff/SpywareNO malware
X	msrundll	msrund1l32.exe	"Added by the BINGHE TROJAN!"
X	msrunocx32	msrunocx32.exe	"Added by the SKUS WORM!"
X	RecycleSTR	msreg32.exe	"Added by the RBOT-TC WORM!"
X	Remote Services Manager	msrmsvc.exe	"Added by the SLENFBOT.AJ WORM!"
Y	run=	smsrun16.exe	"Microsoft Systems Management Server (SMS) related - program that reads SMSRUN16.INI on clients running Win 3.1
X	smsrv	smsrv.exe	"Added by the AGOBOT-SX WORM!"
X	System Service	MSREXE.EXE	"Added by the AML TROJAN!"
X	Video Driver	Msregdrv32.exe	"Added by the SPIGOT BACKDOOR!"
X	Win INI 32	msrp32.exe	"Added by the RBOT-FZC WORM!"
X	Windows32 Configuration Loader	msrf32.exe	"Added by the SDBOT-ABX WORM!"
X	winlogon	msreg32.exe	"Added by the SDBOT.EO WORM!"
X	WinMsrv32	WinMsrv32.exe	"Added by the GAOBOT.AFJ WORM!"
X	Winnt DNS ident	msnmsrg.exe	"Added by the RBOT.BVQ WORM!"
X	WINTASK DLL32	smsrss.exe	"Added by the MYTOB.BS WORM!"
X	wmsrc.exe	wmsrc.exe	"PrivacyRedeemer rogue privacy program - not recommended

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.