Sound

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	3d_sound	3d_sound.exe	"Added by the RIADOS-A TROJAN!"
X	Ac97Sound	snddrv.exe	"Added by the VB.AXG TROJAN!"
U	AtiSound	csrss.exe	"WinSpy surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""ComRoot"" subfolder"
X	AUDIO	SOUND.exe	"Added by the PLOYB-A TROJAN!"
X	cmsound	vcpdll.exe	"Added by the TCXMEDI-D downloader TROJAN!"
X	cmsound	vcsystem.exe	"Added by the TCXMEDI-D downloader TROJAN!"
X	Compaq Sound Drivers For WINDOWS	sounddr.exe	"Added by the SDBOT-XG WORM!"
X	Configuration Loader	soundconf.exe	"Added by the AGOBOT-MH WORM!"
X	DigiD	DigitalSound.exe	Adware downloader
?	IBMUltraBayHotSwapSound	IBMBAYSN.EXE	"Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops. Is it needed though - does it just play a sound?"
X	Logitech Camera	Soundcane.exe	"Added by the SDBOT.MUC WORM!"
X	Micr Update	soundblaster.exe	"Added by the SDBOT.NP WORM!"
X	Microsoft	soundvol32.exe	"Added by the RBOT.CIJ BACKDOOR!"
X	Microsoft Intrenet Explorer	Soundsyst.exe	"Added by the RBOT-AQU WORM!"
X	Microsoft Server Application	Sound.exe	"Added by the RBOT-NE WORM!"
X	Microsoft Sound Driver	sound32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Sound Technology	winsound.exe	"Added by the RBOT-AGG WORM!"
N	Microsoft Sound Volume Tool	mssvol.exe	This is a Blue version of the yellow speaker icon on the system tray and is used to edit advanced Sound Features that the MS DSS80 Speakers add. Should be accessible via Start -> Settings -> Control Panel
X	Microsoft Sounds	soundman.exe	"Added by the RBOT-GCI WORM!"
X	Microsoft Windows Sound	svghost.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Windows Sound	svshost.exe	"Added by the RBOT.RNE BACKDOOR!"
X	Microsoft Windows Sound	svuhost.exe	"Added by the KOLAB.XC WORM!"
X	Microsoft Windows Sound Drivers	sounddrivers.exe	"Added by the SLENFBOT.ABU WORM!"
X	Microsoft WinSound	[random filename]	"Added by a variant of the RBOT WORM!"
N	Monstersoundtray	Freectrl.exe	Diamond Multimedia sound card control panel
X	MotherBoard Sounds	Sounds.exe	"Added by the RBOT-AAP WORM!"
U	Mount Safe & Sound	Fbmount.exe	From McAfee VirusScan version 5.x. Creates back-up sets of critical files in a separate area of a hard drive. If you make regular back-ups it's not needed and can be painful during system start
X	MS DirectX Sound Drivers	msdrvdx.exe	"Added by the RBOT.BCX WORM!"
X	MS DVD DirectX Sound Drivers	msdrvdx.exe	"Added by the SDBOT-XJ WORM!"
X	MS Sound Config 16bit	sndcfg16.exe	"Added by the SDBOT.MB TROJAN!"
X	Ms Sound Drivers	msdrv.exe	"Added by the SDBOT-WR WORM!"
X	Pex Sound Driver	Today's Results.vbs	"Added by the TRODE-A WORM!"
X	pex Sound driver 2	Today's Results.vbs	"Added by the TRODE-A WORM!"
U	PsSound	PsSound.exe	"On a Toshiba laptop. Operates your sound in one of 4 modes
N	Realtek HD Audio Sound Effect Manager	RTHDCPL.EXE	"Realtek HD Audio Control Panel
U	Realtek HD Sound Manager	SOUNDMAN.EXE	"Realtek Sound Manager
X	Realtek Sound Manager	Tecompntwx.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Service Manager	dxsound.exe	"Added by the PROXY-GRIC TROJAN!"
X	Shell	Explorer.exe sound_drive16.exe	"Added by the GP BACKDOOR! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The ""sound_drive16.exe"" file is located in %System%"
?	SISSoundman	Soundman.exe	"Related to a Silicon Integrated Systems Corp (SiS) product?"
X	Sound	[path to trojan]	"Added by the DROPPER.EAT TROJAN!"
X	Sound Loader	sndloader.exe	"Added by the AGOBOT-BV WORM!"
X	Sound services	SOUND32.EXE	"Added by the AGOBOT.GG WORM!"
X	Sound System	WinSound1.exe	"Added by an unidentified VIRUS
X	Sound Volume	svchosI.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	soundcontrl	soundcontrl.exe	"Added by the GAOBOT.AFJ WORM!"
X	sounddrv	sndbdrv3104.exe	"CoolWebSearch parasite variant"
?	SoundFusion	rundll32 cwcprops.cpl	"Control panel item for the Terratec DMX Xfire 1024 soundcard (Start -> Settings -> Control Panel) based upon a Cirrus Logic "SoundFusion" DSP. Does it need to run at start-up every time?"
?	SoundFusion	"rundll32 hercplgs.cpl	BootEntryPoint"
?	SoundFusion	"RunDll32 cwaprops.cpl	C25CrystalControlWnd"
X	SoundMam	SVOHOST.exe	"Added by the QQROB-AAL TROJAN!"
U	SoundMan	SOUNDMAN.EXE	"Realtek Sound Manager
X	SoundMan	soundman.exe	"Added by the AGOBOT.HM WORM! Note - this is not the legitimate SiS or Realtek file of the same name that is located in the Windows or WINNT directory"
X	SOUNDMAN Microsoft Help	soun.pif	"Added by the RBOT-AIU WORM!"
N	SoundMAX	Smax4.exe	"System Tray icon for Analog Devices SoundMax integrated soundcards. Sound properties can be accessed through the Start Menu or Control Panel"
X	SoundMAX	SoundMAX.exe	"Added by the RIZON-A WORM! Note - this file is placed in the Startup folder itself
N	SoundMAX	soundmax.exe	"System Tray icon for Analog Devices SoundMax integrated soundcards. Sound properties can be accessed through the Start Menu or Control Panel"
X	SoundMax Audio Drivers	SndMAX.exe	"Added by a variant of the SDBOT WORM!"
N	SoundMAX Control Panel	Smax4.exe	"System Tray icon for Analog Devices SoundMax integrated soundcards. Sound properties can be accessed through the Start Menu or Control Panel"
N	SoundMAX Integrated Digital Audio	Smtray.exe	"System Tray icon for Analog Devices SoundMax integrated soundcards. Sound properties can be accessed through the Start Menu or Control Panel"
U	SoundMAXPnP	SMax4PNP.exe	"Analog Devices SoundMax integrated soundcard utility. Brings up the SoundMAX Control Panel when it detects if new audio devices (such as microphones
X	soundmix	soundmix.exe	"Added by the AGENT.PGV WORM!"
X	SoundMixer	smvss.exe	"Added by the DEDLER-G TROJAN!"
X	SoundMnEx32	[path to worm]	"Added by the STRATION-FW WORM!"
X	Soundmx	Soundmx.exe	"CoolWebSearch Tapicfg parasite variant"
X	soundtask	soundtask.exe	"Added by the AGOBOT-MD WORM!"
X	soundtasks	soundtasks.exe	"Added by a variant of the CRYPTER.C TROJAN!"
X	soundtctrls	soundtctrls.exe	"Added by the AGOBOT-ZV WORM!"
X	SoundView	msdview32.exe	Trojan downloader
X	Windows Sound	svdhost.exe	"Added by the SDBOT.EFX BACKDOOR!"
X	Windows Sound Driver	SndMon32.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Sound Emulator	snd32_win.exe	"Added by the ATNAS.A WORM!"
X	Windows Sound Manager	SndMon32.exe	"Added by the FORBOT-BU WORM!"
X	Windows Sound Manager	SndMon16.exe	"Added by a variant of the FORBOT WORM!"
X	Windows Sound Manager	sound.exe	"Added by the AGOBOT-CD WORM!"
X	Windows Sound Manager	gearsec.exe	"Added by the PUSHBOT.DF WORM!"
X	Windows Sound Verifier	WinIp32.exe	"Added by the RBOT-FMO WORM!"
X	Windows Stand Sound Drivers	Sounddrv.exe	"Added by the SDBOT-XF WORM!"
X	Winsock2 driver	WINSOUND.EXE	"Added by the SPYBOT-H WORM!"
X	[various names]	sound64.exe	"Wareout - malware masquerading as a spyware and dialer remover"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.