Protection

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	Advanced Protection System	advpsys.exe	"Added by a variant of the RBOT WORM!"
X	Antivirus Protection Services	ccapp2.exe	"Added by the RBOT.EXI WORM!"
?	AntiVirusProtection	qumk.exe	"??"
X	AntivirusProtection	antivirusprotection.exe	"Antivirus Protection rogue security software - not recommended
U	AOL Spyware Protection	AOLSP Scheduler.exe	AOL's spyware protection program
X	AutoVirusProtection	ciscv.exe	"Added by a variant of the RBOT WORM!"
N	BlackICE PC Protection	blackice.exe	"Loads the user interface for the BlackICE PC Protection (was Defender) firewall. From the parent site - '(the user interface) starts in the ""Startup"" menu and adds itself to the taskbar. The user interface is independent from the rest of the system and only displays the output or reconfigures the system. It does not need to be running for the rest of the system to run.' BlackICE was supported by IBM Internet Security Systems (formerly just ISS) when them acquired the NetworkICE parent but is no longer available. See also LoadBlackD"
U	BTModemProtection	BTModemProtection.exe	"BT Privacy Online modem protection software
?	CP	CopyProtectionNotifier.exe	"Related to Emuzed Systems and Middleware. Comes included with Windows XP Media Edition"
X	Data Protection	datprot.exe	"Data Protection rogue security software - not recommended
X	Digital Protection	digprot.exe	"Digital Protection rogue security software - not recommended
X	DrProtection	DrProtection.exe	"DrProtection rogue security software - not recommended"
Y	Earthlink Protection Control Center	elnk_pcc.exe	"EarthLink Protection Control Center - ""powerful
Y	Email Protection	emlproxy.exe	"AntiVirus Quick Heal - E-mail protection"
U	eTrust PestPatrol Active Protection	PPActiveDetection.exe	"PestPatrol real-time protection feature. ""Stops spyware before it infects your system"""
X	FBSearch	FastBrowserSearchProtection.exe	"Fast Browser Search/Search Guard Plus parasite - installed with ""Make the Web Better"" applications such as My Web Tattoo
X	File Protection Monitor	filemon.exe	"Added by a variant of the RBOT WORM!"
X	McAfee Antivirus Protection	mcafeeAV.exe	"Added by a variant of the RBOT WORM!"
Y	McAfee Family Protection	mfp.exe	"McAfee Family Protection - which 'is easy-to-use and built to empower parents to say ""yes"" to their children's online interests while protecting them as they learn and explore' and ""protects children of all ages from exposure to inappropriate content
X	McAfee Windows Protection	mcafee32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Internet Antivirus Protection	antivirus.exe	"Detected by Kaspersky as the IRCBOT.BSK TROJAN!"
X	Microsoft Macro Protection SubSsy	msacroprots386.exe	"Added by the RBOT-KE WORM!"
X	Microsoft Macro Protection Subsystems	msmacroprotxz.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Macro Protection Subsystems	Msmacroprot32.exe	"Added by the RBOT.KN WORM!"
X	MS Agent Protection	ag1.exe	"Added by the IRCBOT.AZ BACKDOOR!"
X	MS Auto-IPSec Protection	MSASP32.exe	"Added by the RBOT-AER WORM!"
X	NET protection system	netst.exe	"Added by the RIZO.A TROJAN!"
X	Norton AV Protection Startup	Ati2xxx.exe	"Added by a variant of the RBOT WORM!"
X	Norton Drive Protection	msdt32.exe	"Added by the FORBOT-GB WORM! Note - this not a valid Norton program!"
X	PC Protection Center	PcProtection.exe	"PC Protection Center 2008 rogue security software - not recommended
Y	PER Email Protection	pavmail.exe	"PER Antivirus"
X	Protection	[path] runtask.exe [path] protection.exe	Added by a variant of the AGENT.3.AU TROJAN!
X	Protection	Protection.exe	"Added by the FEBELNECK-A WORM!"
X	Protection	Firewall.exe	"Added by the ELIPTER.A or ELIPTER.B WORMS! Located in %ProgramFiles%\Internet Explorer"
X	Protection	IExplore .exe	"Added by the ELIPTER.D WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process as there is a space before the "".exe"""
X	Protection	Norton Internet Security.exe	"Added by the ELITPER.E WORM!"
X	Protection Center	cntprot.exe	"Protection Center rogue security software - not recommended
X	Protection System	psystem.exe	"Protection System rogue security software - not recommended
X	ProtectionComplete	pgs.exe	"ProtectionComplete rogue security software - not recommended. A member of the AVSystemCare family"
X	ProtectionConue	pgs.exe	"ProtectionConue rogue security software - not recommended. A member of the AVSystemCare family"
X	ProtectionDeDriver	GDC.exe	"ProtectionDeDriver rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	Protections	ProtEX32.exe	"Ultimate SecuritySuite rogue malware remover - not recommended
Y	Quick Heal On-Line Protection	Cateye.exe	"Quick Heal - virus scanner"
X	Remote System Protection	"rundll32.exe [random].dll	HUI_proc"
U	Search Protection	SearchProtection.exe	"""Yahoo! Search Protection will alert you if an attempt is made to change your default browser search engine from Yahoo!"""
U	SearchProtection	SearchProtection.exe	"""Yahoo! Search Protection will alert you if an attempt is made to change your default browser search engine from Yahoo!"""
Y	SunProtectionServer	SunProtectionServer.exe	"CounterSpy antispyware software"
Y	ThinkVantage Active Protection System	TpShocks.exe	"Part of the Active Protection System found on some IBM/Lenovo Thinkpad models - including the T
X	Total Virus Protection	TotalVirusProtection.exe	"Total Virus Protection rogue security software - not recommended
X	User Protection	usrprot.exe	"User Protection rogue security software - not recommended
X	Vhosts Protection	vhosts.exe	Added by an unidentified WORM or TROJAN!
X	Windows File Protection	winprotect.exe	"Added by the AGOBOT.JB WORM!"
X	Windows Hijack Protection	comngr.exe	"Added by the AGENT-FYD TROJAN!"
X	Windows Hijack Protection System	commngr.exe	"Added by a variant of the AGENT-FYD TROJAN!"
X	Windows Protection Suite	WI[random characters].exe	"Windows Protection Suite rogue security software - not recommended
X	Windows Reversed Virus Protection	winrsvp.exe	"Added by the SLENFBOT.HX WORM!"
X	WinPatch Protection	winpatch.exe	Added by an unidentified WORM or TROJAN!
X	winprotection	ccsrss.exe	"Added by the SILLYFDC.BBT WORM!"
U	WinUpdateProtection	csrss.exe	"EmployeeWatch is a commercial surveillance software program designed to monitor user activity on a computer. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a subfolder of C:\windowsupdate\ufp"
X	XP Protection Center	XPProtectionCenter.exe	"XP Protection Center rogue security software - not recommended
X	Your Protection	urpprot.exe	"Your Protection rogue security software - not recommended
U	YSearchProtection	SearchProtection.exe	"""Yahoo! Search Protection will alert you if an attempt is made to change your default browser search engine from Yahoo!"""

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.