Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer


NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.


  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown

Startup Name Process Name Details
XAAMSFree702sys.exeAdded by the BACKDOOR-CPC TROJAN!
XAdvanced Protection Systemadvpsys.exe"Added by a variant of the RBOT WORM!"
XAgentalsys.exe"Added by the DREF-V VIRUS!"
UAutoSysautosys.exe"Winguardian surveillance software. Uninstall this software unless you put it there yourself"
Xavnortformatsys.exe"Added by the SERFLOG.A WORM!"
Xblah serviceevosys.exe"Added by a variant of the RBOT WORM!"
XCmeSYSCMEsys.exe"Part of Gator advertising spyware - see here for removal instructions. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
XConnectorSYS.EXE"Nunci premium rate dialer"
XCtfmonwmisys.exe"Added by the IRCBOT-ADS WORM!"
Xdrvsys.exedrvsys.exe"Added by the BEAGLE.W WORM!"
XEnumerate Servicewsys.exe"Added by the MANIFEST TROJAN!"
?ESSNDSYSESSNDSYS.EXE"Related to an ESS based soundacard. Is it required?"
UHookSysHookSys.exe"SurfinGuard Pro from Finjan - internet protection software
XHP Service Drivershdsys.exe"Added by the SDBOT-ZE WORM!"
UhsysHSYS.EXE"Keylogger Express keystroke logger/monitoring program - remove unless you installed it yourself!"
XI am not Ranky. I am eTunnel!winsys.exeAdded by an unidentified WORM or TROJAN!
XLinksys Modem Driverslinksys.exeAdded by the IRCBOT.VD WORM!
Xloadwinwinsys.exe"Added by the QQPASS-J TROJAN!"
XLookup_Syslookupsys.exeP04n trojan
Xltwobformatsys.exe"Added by the SERFLOG.A WORM!"
XMessengerntsubsys.exe"Added by the SDBOT.BGE WORM!"
XMicrosoft Router Managerlinksys.exe"Added by a variant of the IRCBOT TROJAN!"
XMicrosoft Security Systemmssecsys.exe"Added by the IRCBOT-WJ TROJAN!"
XMicrosoft Systemsys.exe"Added by the RBOT.AKI WORM!"
XMicrosoft System Monitormonsys.exe"Added by the IRCBOT-YV TROJAN!"
XMicrosoft Telecoms Centerxpfilesys.exeAdded by the RBOT.BCJ TROJAN!
XMicrosoft Updatewinsys.exe"Added by the RBOT-GV WORM!"
XMicrosoft Updatesys.exe"Added by the RBOT-AJ WORM!"
XMicrosoft Windows Servicewinsys.exe"Added by the RBOT-ADP WORM!"
XMicrosoft Xp Systems loaderswin32xpsys.exe"Added by the SPYBOT.NYT WORM!"
XMicrosoft32win32sys.exeAdded by an unidentified WORM or TROJAN!
XMicrosoftSysSPOOLSYS.exe"Added by the TARNO.N TROJAN!"
XMMCinisys.exe"Added by the OSCABOT-I WORM!"
Xmsndrvsysmsndrvsys.exe"Added by the BROGGER-D TROJAN!"
XMSSVCsvcsys.exe"Added by the FATOOS-C TROJAN!"
Xmssysmssys.exe"Added by the MYSS.B TROJAN!"
XMsSystemmssys.exe"Added by the VANTA.A TROJAN!"
XMSSYSTEMsvcsys.exe"Added by the FATOOS-C TROJAN!"
Xmsys lptt01msys.exe"RapidBlaster variant (in a ""Msyss"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
XNoooHsys.exe"Added by the ALNUH WORM!"
XNordnordsys.exe"Added by the DREF-S WORM!"
Unsysnsys.exe"NetSpy keystroke logger/monitoring program - remove unless you installed it yourself!"
UPPSYSppsys.exe"PC Police commercial keystroke logger. Uninstall this software if you did not install it yourself"
UPrnSys ExecutablePrnSys.exe"Print screen utility bundled with some HP printer software - not required
XRegistry SystemRegsys.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
Urun=ramsys.exe"Advanced Startup Manager from Rays Lab"
XSafeSysSafeSys.exe"Added by the AUTORUN.DMI WORM!"
USecsysSecsys.exe"UltraSoft Key Interceptor surveillance software - uninstall this unless you put it there yourself!"
XSecurity Systemsecuresys.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
Xserpeformatsys.exe"Added by the SERFLOG.A WORM!"
XServicessys.exe"Added by a Proxy Trojan variant"
XShellExplorer.exe kbdsys.exe"Added by the DAPROSY WORM! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The ""kbdsys.exe"" file is located in %AppData%\Microsoft\Keyboard"
USmpcSysSmpSys.exe"""Set Up My PC"" utility supplied with some Packard Bell computers"
Xssate.exewinsys.exe"Added by the BEAGLE.K WORM!"
Xsvhoostchecksys.exeAdded by a downloader TROJAN of Chinese origin!
USWClientswsys.exe"ActivMonAgent keyboard logger/monitoring program - remove unless you installed it yourself"
XSygate Personal Firewallsys.exe"Added by the RBOT-ZC WORM!"
XSystem Rebootrebootsys.exe"Added by the RBOT-WU WORM!"
XSystem Startupsys.exe"Added by a variant of the IRCBOT TROJAN!"
XSystem32DllDLL32SYS.EXE"Added by the SPYBOT-CZ WORM!"
Xsystemdrvms32sys.exe"Added by an unidentified WORM or TROJAN - most likely GAOBOT variant"
Xsys_up1svchostsys.exe"Added by the MULTIDR-FL TROJAN!"
XTaskbar Systemtasksys.exe"Added by a variant of the SDBOT WORM!"
XTray manager systemtraysys.exe"Added by the RIZO.A TROJAN!"
XVirusScannermnsys.exe"Added by the SDBOT-AFQ WORM!"
XW32SYSw32sys.exe"Added by the JAMBU-A WORM!"
YWarning: do not remove it! (system)cfpsys.exe"Folder Password Protect - a program that lets you set a password on folders of your choice"
Xwcsyswcsys.exe"Added by the KEYLOG-AP TROJAN!"
UWINDLLWSYS.EXE"STARR key logger. "It logs almost everything that goes through the box. It logs all key strokes
XWindows ConfigSSYS.EXE"Added by the SPYBOT-DA WORM!"
XWindows Explorer Servicesexploresys.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
XWindows Messanger Control Centerwinsys.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
XWindows SystemWINSYS.exe"Added by the RBOT-AEF WORM!"
XWindows Task Service (32-bits)tasksys.exe"Added by the DREFIR.D WORM!"
XWindows Taskbar Systemtasksys.exe"Added by a variant of the SDBOT WORM!"
XWindows TMWinxSys.exe"Added by a variant of the RBOT WORM!"
XWindows Update 32slsys.exe"Added by the FORBOT-FT WORM!"
XWindows Updatersdsys.exe"Added by the FORBOT-JG WORM!"
XWindowsRegKey updatewinsys.exe"Added by the RBOT-JY WORM!"
UWinsysWinsys.exe"Win-Spy keyboard logger/monitoring software - remove unless you installed it yourself"
XWinUpdateupdsys.exe"Added by a variant of the RBOT WORM!"
Uwssyswssys.exe"WebPI logs keystrokes and captures screenshots. If you didn't install this yourself remove it"
Uwsys.exewsys.exe"SpyloPCMonitor - surveillance software. Uninstall this software unless you put it there yourself"
XXPsysXPsys.exe"Added by the DELF-KQ TROJAN!"
Xxxcmsys.exe"Added by the KRISWORM-A WORM!"
XZonesoft Cleanerrnsys.exe"Added by a variant of the SDBOT WORM!"
X[various names]scanSYS.exe"Wareout - malware masquerading as a spyware and dialer remover"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.