Symantec

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	Norton Antivirus 2004	SYMANTECAV2.EXE	"Added by the SPYBOT-DY WORM! Note - this is not the real Norton AV!"
X	Symantec	ccapp.exe	"Added by the REATLE WORM! Note - this is not a Symantec file"
X	Symantec Anti Virus	symantec32.exe	"Added by a variant of the WOOTBOT WORM!"
X	Symantec Antivirus professional	dfrgfrat.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	autoformat.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	dyndns.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	f0dns.exe	"Added by the FORBOT-GT WORM!"
X	Symantec Antivirus professional	flushdns.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	for.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	regedit.exe	"Added by a variant of the FORBOT WORM! Note - this is not the valid Windows registry editor which resides in %Windir% and will not normally figure in Msconfig/Startup! This version resides in %System%"
X	Symantec Antivirus professional	Symantex.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	windows .exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	Winhp32.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	winudp.exe	"Added by a variant of the WOOTBOT WORM! See here"
X	Symantec Antivirus professional	xplrer.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Autoscan	[random filename]	"Added by the RBOT-AJO WORM!"
Y	Symantec Backup Exec Desktop Agent	DLOClientu.exe	"Part of Symantec's Backup Exec backup software"
X	Symantec Client Security	symclient.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Symantec Configuration Loader	ccApp32.exe	"Added by the AGOBOT-EE WORM!"
Y	Symantec Core LC	symlcsvc.exe	"Part of Norton AntiVirus 2004. What does it do?"
X	Symantec Debug Client	symdebugs.exe	"Added by the IRCBOT-ACM TROJAN!"
N	Symantec Fax Starter Edition Port	OLFSNT40.EXE	Offers a virtual printer as a fax machine. Can be run via a desktop shortcut
Y	Symantec NetBackup Desktop Agent	DLOClientu.exe	"Part of Symantec's NetBackup backup software"
U	Symantec NetDriver Monitor	SNDMon.exe	"Part of Symantec's LiveUpate (eg
U	Symantec NetDriver Warning	SNDWarn.exe	Part of Symantec Live Update - displays the warning when you need to update the firewall database
U	Symantec PIF AlertEng	PIFSvc.exe	"Symantec LiveUpdate Notice Service"
X	Symantec Secure Server	svrhost.exe	"Added by the IRCBOT-UB TROJAN!"
X	Symantec Security	symantec32.exe	"Added by the RANDEX.PR or RANDEX.YR WORMS!"
X	Symantec Security Addon	nvsvc.exe	"Added by a variant of the AGOBOT/GAOBOT WORM! Note - do NOT confuse with the legitimate NVIDIA Driver Helper Service file of the same name as described here"
X	Symantec Security Routine Addon	navpaw.exe	"Added by the AGOBOT-ES BACKDOOR!"
X	Symantec Security Routine Addon for Microsoft Windows	navpxaw32.exe	"Added by the AGOBOT-GJ TROJAN!"
X	Symantec Service	ccApp.exe	"Added by the AKHER.D WORM! Note - this is also not the valid Norton AV file with the same filename"
X	SymantecFilterCheck	svhost.exe	"Added by the BANKER-EEO TROJAN!"
X	SymantecFilterCheck	gmilogof.exe	"Added by the BANKER-EKC TROJAN!"
X	SymantecFilterCheck	[path to trojan]	"Added by the BANKER-EIN TROJAN!"
X	SymantecFilterCheck	bsyys.scr	"Added by the BANLOAD.DZC TROJAN!"
X	www.symantec.com	oz11111.exe	"Added by the MYDOOM.W WORM"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.