Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
UFLMOFFICE4DMOUSEmoffice.exeMouse utility for a Labtec brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
UFLMOFFICE4DMOUSEmouse32a.exeMouse utility for a Micro Innovations brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
Xfofficenm.exe"Added by the DELF-CB TROJAN!"
YGroove Virtual OfficeGroove.exe"""Groove Virtual Office uses a peer-to-peer networking model to connect users in Groove Workspaces. In these workspaces geographically dispersed coworkers can do almost everything they could do in the same office. They can hold online meetings
?HP OfficeJet Series xxx StartupHPOSTR03.EXE"xxx represents the series number - such as 700. What does it do and it it required?"
?HP OfficeJet Series xxx StartupHPOstr05.exe"xxx represents the series number - such as 700. What does it do and it it required?"
?HPAiODevice(hp officejet g series)hpoavn07.exe"HP Printer related
?ILO_Office_ManagerIntEdReg.exe /OFFMAN"Intense Educational Ltd - Language Office Software. Is it required?"
XInstalled shell32.dllOffice.exe..."Added by the LOVGATE.AO WORM!"
XInstalled shell32.dllOffice.exe"Added by the LOVGATE.E WORM!"
XM-soft OfficeM-soft Office.htaHTA file which creates an executable on the hard drive which subsequently proceeds to download files from a malware site!
XMicro Office[path to trojan]"Added by the BANCBAN-QC TROJAN!"
NMicrosoft Officeosa.exeOn older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
NMicrosoft OfficeMsoffice.exeFeature included with older versions of MS Office giving you access to common Office functions and optional shortcuts to Office (and other) programs. Some people prefer it but a better way is to create desktop shortcuts if you want access these features and programs quickly. Also available via Start → All Programs
XMicrosoft OfficeMSMSGR.exe"Added by the GAOBOT.BB WORM!"
NMicrosoft OfficeOsa9.exeOn older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
XMicrosoft Officelserv.exe"Added by the SDBOT.MH WORM!"
XMicrosoft OfficeMicrosoft Office.htaHTA file which creates an executable on the hard drive which subsequently proceeds to download files from a malware site!
XMicrosoft Officemsoicons.exe"Added by the RBOT-ZI WORM! - NOTE - do no confuse with the legitimate Msoicons.exe file described here. The latter wil not be listed among your startups!"
XMicrosoft OfficeNxcao.exe"Added by the RBOT-ZE WORM!"
XMicrosoft Officenxcxtpr.exe"Added by the RBOT-YG WORM!"
XMicrosoft Officesvxhost.exe"Added by a variant of the RBOT WORM!"
XMicrosoft Officemsoffice32.exe"Added by a variant of the RBOT WORM!"
XMicrosoft Officemsoff.exe"Added by the RAKER-C TROJAN!"
XMicrosoft Officemicrosoft.exe"Added by the BANKER-VF TROJAN!"
XMicrosoft Officemsvcp.exe"Added by the AGENT-XK TROJAN!"
XMicrosoft Officemsmsgr.exe"Added by the GAOBOT.BB WORM!"
XMicrosoft Officemdm.exe"Added by the IBOT-A TROJAN! Note - this is not the legitimate Machine Debug Manager (mdm.exe) process which is located in %ProgramFiles%\Common Files\Microsoft Shared\VS7Debug (98/Me/XP/Vista) or C:\WINDOWS\SYSTEM (Me only)"
UMicrosoft Office 2010BCSSync.exe"Part of SharePoint Server 2010 which is part of the Microsoft Office 2010 suite. ""Business Connectivity Services (BCS) uses a cache to store a copy of the external data required by the BCS solutions deployed on the Office client. A process called BCSSync.EXE runs on the client and provides automatic cache refresh and data synchronization of the entity instances."" For more information - see here"
NMicrosoft Office Fast CacheFastboot.exe"Part of MS Office 95 (v7.0). According to this it improves the performance. Most likely a predecessor of MS Find Fast and can be disabled"
UMicrosoft Office GrooveGROOVE.EXE"System Tray access to and alerts for MS Office Groove - a stand-alone product or included with the Enterprise/Ultimate versions of MS Office 2007. ""A collaboration software program that helps teams work together dynamically and effectively
XMicrosoft Office Monitoralg2k.exe"Added by the SDBOT-CZO WORM!"
XMicrosoft Office Monitoraql32.exe"Added by the RBOT-GCY TROJAN!"
NMicrosoft Office OneNoteONENOTEM.EXE"System Tray access to MS Office OneNote 2003 & 2007 - an electronic notebook that allows you to create free-form notes
NMicrosoft Office OneNote 2003 Quick LaunchONENOTEM.EXE"System Tray access to MS Office OneNote 2003 - an electronic notebook that allows you to create free-form notes
XMicrosoft Office quick launchOSA.exe"Added by the VBOT.A BACKDOOR! Note that OSA.exe was used in older versions of Office to launch common components to help speed up the launch but it is no longer normally used - see here. This file is located in a valid MS Office 2003 (aka Office 11) directory - %Program Files%\Microsoft Office\OFFICE11 - and may overwrite a valid file"
XMicrosoft Office Quick Launcheriau1.exe"Added by the DLOADR-AWD TROJAN!"
NMicrosoft Office Shortcut BarMsoffice.exeFeature included with older versions of MS Office giving you access to common Office functions and optional shortcuts to Office (and other) programs. Some people prefer it but a better way is to create desktop shortcuts if you want access these features and programs quickly. Also available via Start → All Programs
XMicrosoft Office Startwinupdates.exe"Added by the GAOBOT.BC WORM!"
NMicrosoft Office Startuposa.exeOn older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
NMicrosoft Office StartupOsa9.exeOn older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
XMicrosoft Office Studioscvhvst.exe"Added by the RANDEX.CST WORM!"
XMicrosoft OfficeXPofficeXP.exe"Added by the KILLAV.MA WORM!"
XMicrosoft Windows Updatemsoffice2.exe"Added by the RBOT-GB WORM!"
XMS OfficeOffice10.exe"Added by the VB.DT TROJAN!"
XMsofficemsoffice.htaHijacker - redirecting to Searchdot.net
XMSOfficeservices.exe"Added by the DLOADER-EU TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in an ""MSOffice"" subfolder"
Xmsofficemsoffice.exe"Added by the LIKASIMAL WORM!"
XMSOffice32msjcf.exe"Added by the RAKER-A TROJAN!"
XMSOfficeCfgmsocfg.exePremium rate adult content dialer
XMSOfficeCfgnavchk.exePremium rate adult content dialer
XMSOfficeCfgqservice.exePremium rate adult content dialer
XMSOfficeCfgshman.exePremium rate adult content dialer
XMSOfficeCfgssvr.exePremium rate adult content dialer
XOfficeOffice.exe"Added by the KRAIMER.12 TROJAN!"
XOffice Desktopsimag.exe"Added by the SPYBOT.AQR WORM!"
UOffice Mailoff_mail.exe"Office Mail from Burrotech Ltd - ""complete email solution for small/medium businesses
UOffice Mail Alerterom_Alerter.exe"Office Mail Alerter - ""alert Office Mail users when they receive new emails"" via a System Tray icon"
XOffice Monitoradv32.exe"Added by the SDBOT-CWO WORM!"
XOffice Monitoralg32.exe"Added by the RBOT-GMM WORM!"
XOffice Monitornvsvc86.exe"Added by the IRCBOT.BVO BACKDOOR!"
XOffice Monitor Secure Systemaabsecure32.exe"Added by the RBOT.FPW WORM!"
XOffice Monitor Word Exel Rsvch.exe"Added by the DWNLDR-GWW TROJAN!"
XOffice Monitor Word Exel Ru.exe"Added by the SDBOT-DEE WORM!"
XOffice Monitor Word Exel R[trojan filename]"Added by the IRCBOT-VX TROJAN!"
XOffice MonitorsGoogleUpdater.exe"Added by the RBOT-GKZ WORM! Note - this is not the updater for the popular Google tools"
XOffice Monitorse[path to worm]"Added by the SDBOT-CZX WORM!"
NOffice Startuposa.exeOn older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
XOffice StartupExploer.exe"Added by the GAOBOT.BV WORM! Note the different filename to the valid MS Office entries"
NOffice StartupOsa9.exeOn older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
XOffice SturtUposa9.exe"Added by the CLICKER-EC TROJAN! Note - this trojan is located in %Windir% and should not be confused with the Microsoft office program
XOfficeAgentexpIorer.exe"Added by the TACTSLAY.A TROJAN!"
XOfficeAgentoutIook.exe"Added by the TACTSLAY.A TROJAN!"
XOfficeAgentsvcrhost.exe"Added by the TACTSLAY.A TROJAN!"
XOfficeAgentsvcshost.exe"Added by the TACTSLAY.A TROJAN!"
XOfficeDeamonmsorunner.exe"Added by a variant of the TACTSLAY TROJAN!"
YOfficeGuard RegCheckerogrc.exe"Kaspersky Labs anti-virus"
XOfficeGuardUIsvcss.exe"Added by the DEDLER-C TROJAN!"
?officejet 6100hposol08.exeAssociated with a HP PSC2110 (and maybe others) all-in-one machine
UOFFICEKBkbdap32a.EXE"Keyboard utility for a Micro Innovations brand keyboard. If you disable this entry you will not be able to use any of the keyboard hotkeys or other non-standard functions on the keyboard"
XOfficeQuickAccessOfficeHost.vbs"Added by the PEXMOR WORM!"
XOfficesmsnmgd32.exe"Added by the FORBOT-DV WORM!"
XOffices Monitors[path to worm]"Added by the RBOT-GKO WORM!"
XOffices Monitorse[path to worm]"Added by the RBOT-GKO WORM!"
XOffices Monitorsealgose32.exe"Added by the RBOT-GDD WORM!"
YOfficeScan95pccwin97.exe"Trend Micro antivirus OfficeScan"
YOfficeScanNT Monitorpccntmon.exe"Trend Micro OfficeScan Antivirus real-time scan monitor"
XOfficeWord Monitormsn32.exe"Added by the RBOT-GUE WORM!"
XOfficeWord MonitorsOfflce.exe"Added by the IRCBOT.JZ TROJAN!"
XOFFICEXPOFFICEXP.exe"Added by the WOOTBOT.HE WORM!"
XOffice_appmsnmrgs.exeAdded by a variant of the VBBANC-A TROJAN!
Xoffice_update[path to trojan]"Added by the DLOADER-ZB TROJAN!"
NOpenOffice.org *.*.*quickstart.exe"OpenOffice.org office suite quick start (where ""*.*.*"" is the version number)"
NOpenOffice.org xQUICKS~1.EXE"Displays OpenOffice quick start applet in System tray. Right clicking on the icon allows rapid starting up of components of the OpenOffice suite. Available via Start -> Programs. Will automatically be started when any OpenOffice component is started from Start -> Programs. A resource hog (takes > 16 MB of memory). "x" represents the version number"
YQH Office 2K CheckO2KCHECK.EXE"Quick Heal Anti-Virus MS Office documents virus checker"
XQuick Officeactivate.exe"Added by the RANSOMLOCK.D TROJAN! Note - this infection hooks the keyboard to prevent anything except numbers from being typed and displays a Russian message requesting a valid license key"
Xrun=msoffice.exe"Added by the ADWARELOADER TROJAN! Note - do not confuse with the legitimate Microsoft Office file
NsofficeSOFFICE.EXEDisplays StarOffice quick start applet in System tray. Right clicking on the icon allows rapid starting up of components of the StarOffice 6.0 suite. Available via Start -> Programs. Automatically started when any StarOffice 6.0 component is started from the Start -> Programs. A resource hog (it eats > 16 MB of memory).
XSuiteSuiteOffices.exe"Added by the LAZAR TROJAN!"
XsystemMicrosoft Office.exe"Added by the BANCBAN-LH TROJAN!"
NTGPro OfficeIdxOffice.exe"With IdiomaX Office Translator ""you can translate documents directly from your favorite text editor (Microsoft Word
YTrendMicro OfficeScan NTTMLISTEN.EXEVirus scanner
XWindows Office Monitoremdm.exe"Added by the RBOT.AFV BACKDOOR!"
XWindows Update Controllermwoffice.exe"Added by the BATTRY-A TROJAN!"
NWordPerfect Office 1215Registration.exe"Corel WordPerfect Office 12 registration wizard"


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.