Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
X(Default)QQUpdate.exe"Added by the QUADRULE.A WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X(Default)msnupdate.exe"Added by the RBOT-GWT BACKDOOR! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run & HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
NA NoteA Note.exe"""A Note is a program that lets you create post-it like notes on your Microsoft Windows desktop"""
Xaa bbcc dde effgghh jjupdate.exe"Added by a variant of the IRCBOT BACKDOOR!"
UAccelerateaccelerate.exeWebroot Accelerate - allows you to optimize Windows network registry settings in order to boost surfing speeds. Leave this enabled if you find it improves your connection
NAceGain LiveUpdateLiveUpdate.exe"""AceGain LiveUpdate can help to automate and optimize product updates. AceGain LiveUpdate will automatically detect new patch updates
XAcroreadGoogleUpdate.exe"Added by the AGENT-JGI TROJAN! Note - this is not the valid Google program which is normally located in %AppData%\Google\Update. This version resides in %Temp%"
UAdDeleteAdDelete.exeBanner advertisment blocker
XAdRoarUpdateARUpdate.exe"AdRoar adware updater"
XAdwareDeleteadwaredelete.exe"AdwareDelete rogue adware remover - not recommended
NAeXAgentLogonAeXAgentActivate.exe"Altiris Agent transmits information about your machine for the purpose of asset management and deployment"
NAGSatelliteAGSatellite.exeProgram from AudioGalaxy that lets you download some MP3s from their server. Available via Start -> Programs
XAppletINITINITIATE.EXE"Added by the AGOBOT.XV TROJAN!"
NaresliteAresLite.exe"""Ares is a free open source file sharing program that enables users to share any digital file including images
Xasrupdate.exeasrupdate.exe"Added by the VB.ATZ TROJAN!"
UATTBroadbandUpdateSAUpdate.exe"Big Brother from Quest Software. System and network monitor"
UATTRedUpdateAutoUpdate.exeAdditional item added to start-ups after AT&T took over the now bankrupt Excite@home high-speed internet service. Included for automatically downloading and installing updates. Leave it unless you plan to regularly run it to check for updates
Xautoloadwindowsupdate.exe"Added by the POLYCRYP.DY TROJAN!"
NAutoMate Task Serviceautomate.exe"Task scheduler for Unisyn Automate 4 task automation/macro running software. Available via a desktop shortcut or Start → Programs"
XAutomatic Windows UpdaterUpdate.exe"Added by the GAOBOT.AO WORM!"
XAutopdateAutopdate.exe"Added by the RBOT-AGL WORM!"
XAutoUpdateraupdate.exe"Tinybar variant"
XAutoUpdaterAutoUpdate.exe"PeopleonPage foistware"
XAV UpDateUpdate.exe"Added by the FUROOT-A TROJAN!"
Uawpliteawplite.exe"AllWallpapers Lite desktop wallpaper changer"
Xb3dUpdateZupdate.exe"Associated with B3d Projector foistware - see here"
XBADDATEBADDATE.EXE"Added by an unidentified VIRUS
UBayswap2TbUpdate.exeHot-swappable drive management on Compaq Notebooks which allows you to swap drives without closing down Windows. Only required if you frequently swap bay devices
NBlackBerryAutoUpdateRIMAutoUpdate.exe"Automatic updates for BlackBerry smartphones
Xblah servicewinupdate.exe"Added by the GAOBOT.BIA WORM!"
NBMupdateBMupdate.exe"Related to the BookmarkCentral entry. Typically added after downloading drivers for Visioneer scanners for example
XBouncer RunStartupLiveUpdate.exe"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
XccUpdateccUpdate.exe"Added by the AGOBOT.YS WORM!"
XcftmonWindowsUpdate.exe"Added by the AGENT.AQK BACKDOOR!"
XCheatleGigaByte.exe"Added by the SHODI.B VIRUS!"
NCheckCustomWorksUpdateCheckCWupdate.exe"Update checker
UClauerUpdateClUpdate.exe"Automatic updates for the software supporting the Clau-ACCV and Clauer-idCAT digital certificate USB keys"
NClipMate7ClipMate.exe"Clip Mate 7 by Thornsoft - utility that allows you to store more than one item in the clipboard"
UClUpdateClUpdate.exe"Automatic updates for the software supporting the Clau-ACCV and Clauer-idCAT digital certificate USB keys"
UComproRemoteComproRemote.exe"VideoMate TV tuner and capture card - remote control driver"
XConfigTaskUpdate.exe"Added by the MDROP-BRO TROJAN!"
XConfiguration Loadersvupdate.exe"Added by the RANDEX.DXP WORM!"
XConfiguration Loaderupdate.exe"Added by the SDBOT-OS WORM!"
?Contactecontacte.exe"Some kind of driver?"
XControlPanel"private.exe internat.dllLoadMouseCarpetProfile"
NCreative Software UpdateAutoUpdate.exeAuto-updater for Creative Labs software
Ucwupdatecwupdate.exe"ContentProtect from ContentWatch - internet filter"
Xd3dupdate.exebbeagle.exe"Added by the BEAGLE.A WORM!"
NDAEMON Tools LiteDTlite.exe"Daemon Tools Lite from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
XDAupdateDAupdate.exeNavEnhance adware
UDepFrezfrzstate.exe"Deep Freeze from Faronics Coporation. ""Freezes"" the current software configuration so that an a re-boot all changes made refer back to their original settings. Not required for most users - more likely to be used by system administrators
XDeskMateAutoUpdateDeskMateAutoUpdate.exe"DeskMates: Virtual scantily clad girls enhance your desktop. BargainBuddy adware related"
UDesktop iCalendarDesktop iCalendar Lite.exe"Desktop iCalendar Lite by Desksware - ""is a free desktop calendar for Windows. It allows you to manage your events
UDesktop iCalendar LiteDesktop iCalendar Lite.exe"Desktop iCalendar Lite by Desksware - ""is a free desktop calendar for Windows. It allows you to manage your events
UDesktop iCalendar Lite.exeDesktop iCalendar Lite.exe"Desktop iCalendar Lite by Desksware - ""is a free desktop calendar for Windows. It allows you to manage your events
XDieselRecalculate.exe"Added by the LAZAR TROJAN!"
YDigital Patrol Update 5update.exe"Digital Patrol - ""a powerful anti trojan scanner
YDPASUpdateDPASAutoUpdate.exe"Automatic updates for DefenderPro AntiSpy spyware remover - now incorporated Defender Pro 15-in-1 and 5-in-1"
XDRam prosessorWindowsUpdate.exe"Added by the RBOT-BBZ WORM!"
XDRam prosessormsupdate.exe"Added by the DELF-FAW TROJAN!"
NDTliteDTlite.exe"Daemon Tools Lite from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
XDxupdate.exeDxupdate.exe"Added by the MAFEG WORM!"
UDynSiteDynSite.exe"DynSite - dynamic DNS client
XEasySearchBarESBUpdate.exeEasySearchBar adware downloader
NEgisTecLiveUpdateEgisUpdate.exe"Software updater for biometric and data encryption products from EgisTec Inc"
UEMBASSY Trust Suite Secure UpdateAutoUpdate.exe"Updates for Wave Systems Corp. Embassy Trust Suite - ""delivers advanced levels of security to the client PC using the TPM security chip found on most enterprise PCs today"""
NEvent Planner RemindersPLNRNote.exePart of Sierra/Hallmark Card Studio - System Tray notification of events such as birthdays and anniversaries that you've scheduled with the customizable Event Planner
NEvent Planner Reminders Tray IconPLNRnote.exePart of Sierra/Hallmark Card Studio - System Tray notification of events such as birthdays and anniversaries that you've scheduled with the customizable Event Planner
UFG1_00frntgate.exe"FrontGate MX - e-mail spam blocker"
UFilterGatefiltergate.exe"Filtergate internet filtering software - filters sounds
XFirewallSP2 UPDATE.exe"Added by the ELITPER.E WORM!"
UFlashMuteFlashMute.exe"""FlashMute is a tool which allows you to mute/unmute Flash Movies loaded in a browser exclusively
NGameTrackerGTLite.exe"GameTracker - ""Keep track of and launch all your games from one application with the Game Tracker Client. Instantly announce on your profile and to your friends what game and on which server you are playing!"""
YGhostSurfDelSatelliteDeleteSatellite.exe"Part of SpyCatcher spyware remover from Tenebril. Prevents rogue programs from sending personal information to a remote user via the Internet. If you use SpyCatcher with real time scanning
NGoogle UpdateGoogleUpdate.exe"Update manager for the range of tools available from Google - such as the Chrome web browser and Picasa photo manager. Located in %AppData%\Google\Update"
XGoogle UpdateGoogleUpdate.exe"Added by the BUZUS.DBFM TROJAN! Note - this is not the valid Google program which is normally located in %AppData%\Google\Update. This version resides in %System%"
XGreasyPalmUpdateGreasyPalmUpdate.exe"SearchFast adware"
Xh4te Service Driversh4te.exe"Added by a variant of the RBOT WORM!"
XHKLMRunwindowsupdate.exe"Added by the FORBOT-BJ WORM (where HKLM\Run represents HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run)!"
NICQ LiteICQLite.exe"ICQ Lite - compact version of the popular messaging program"
XICQ Lite MessengerICQLITE.EXE"Added by an unidentified VIRUS
XIcqBetawebcamupdate.exeAdded by an unidentified TROJAN!
XIDTemplatesIDTemplate.exe"Added by the BRONTOK-H WORM!"
XInternetGetConnectedStatewinupdate.exe"Added by the SDBOT-JN WORM!"
XInternetGetConnectedStateExwinupdate.exe"Added by the SDBOT-JN WORM!"
?iPrint LPT Redirectornipplpte.exe"Related to Novell iPrint - ""a printing solution that enables you to send documents to printers located throughout the Net."" Is it required?"
XIPSEC Configurationwsupdate.exe"Added by the AGOBOT-IQ WORM!"
Nkazaalitekazaalite.exe"Kazaalite is a file sharing client - not to be confused with the original Kazaa program. Unlike the original
XKernelUpdate.exe"Added by the DELF-FN TROJAN!"
Ulaimaimlite.exe"""AIM Lite is a reference application for testing some new client technology developed here at AOL®
NLG Intelligent Updateautoupdate.exe"Automatic update utility for LG Notebooks"
ULGODDFUfwupdate.exeAuto firmware update program for LG Electronics CD-ROM/DVD writer
NLiveNoteLivenote.exeAsus graphics card driver live update feature
ULiveUpdateLiveUpdate.exe"Web-update utility as used by various types of software - see here"
XLsasSSygate.exe"Added by the SDBOT.BCA WORM!"
XLTM2winupdate.exe"Added by the LITMUS.203 TROJAN!"
UManageDesk LiteManageDesk Lite.exe"ManageDesk Lite from Managebytes Desktop management software. Each desktop is a separate working space for you to use"
YMcAfee SecurityCenterMcUpdate.exeAutomatic virus definition and software updates/upgrades for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online
YMcUpdateMcUpdate.exeAutomatic virus definition and software updates/upgrades for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online
YMCUpdateExeMcUpdate.exeAutomatic virus definition and software updates/upgrades for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online
YMcVsRtemcvsrte.exe"Part of older versions of McAfee's internet security products such as VirusScan and VirusScan Online. Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
UMedia Codec Update Serviceupdate.exe"Windows Essentials Codec Pack 1.0 is a collection of the most commonly needed video and audio codecs. This program allows keeps these codecs updated"
XMediaPlayeSMediaPlayer_update.exe"Added by the STARTER-K TROJAN!"
Ymgavrtclexemgavrte.exePart of older versions of McAfee's internet security products such as VirusScan and VirusScan Online
XMicrooft Timingpupdate.exe"Added by a variant of the RBOT WORM!"
XMicrosoftMSUPDATE.exeAdded by an unidentified WORM or TROJAN!
XMicrosoft auto updatewinupdate.exe"Added by the BMBOT TROJAN!"
XMicrosoft DirectXwupdate.exe"Added by the RBOT-L WORM!"
XMicrosoft Generic Update Managerwupdate.exe"Added by the RBOT-AWC TROJAN!"
XMicrosoft Internet Explorer Updateieupdate.exe"Added by the SHEUR.MH TROJAN!"
XMicrosoft IT Updatemsupdate.exe"Added by the RBOT-FE WORM!"
XMicrosoft Security Monitor Processwindowsupdate.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
XMicrosoft Service Execution Managerexecute.exe"Added by a variant of the IRCBOT TROJAN! See here"
XMicrosoft Synchronization Managerwinupdate.exe"Added by the SDBOT.ER WORM!"
XMicrosoft System Updatesysupdate.exe"Added by the SDBOT.DG WORM!"
XMicrosoft Updatewudmate.exe"Added by the RBOT.AP WORM!"
XMicrosoft Updatexpupdate.exe"Added by the RBOT-QE WORM!"
XMicrosoft UpdateMupdate.exe"Added by the RBOT-AG WORM!"
XMicrosoft Updatemcupdate.exe"Added by the RBOT.XT WORM! Note - this file is located in %System% and should not be confused with the McAfee antivirus executable as described here"
XMicrosoft UpdateSygate.exe"Added by a variant of the SDBOT WORM!"
XMicrosoft Updateupdate.exe"Added by a variant of the SDBOT WORM!"
XMicrosoft updatewinupdate.exe"Added by a variant of the RBOT WORM!"
XMicrosoft Updatemsupdate.exe"Added by the BOROBOT-I TROJAN!"
XMicrosoft Update Machinewinupdte.exe"Added by the RBOT-GKL WORM!"
XMicrosoft Updaterwinupdate.exe"Added by the AGENT-KIR TROJAN!"
XMicrosoft Updattingmiroupdate.exe"Added by a variant of the RBOT WORM!"
XMicrosoft Windows 32 Updatewin32update.exe"Added by a variant of the IRCBOT TROJAN!"
XMICROSOFT Windows updatepdate.exe"Added by the RBOT.BZT WORM!"
XMicrosoft Windows Updatewindowsupdate.exe"Added by the AGOBOT.ON WORM!"
XMicrosoft Windows UpdaterWINUPDATE.EXE"Added by the RBOT-LI WORM!"
XMicrosoft WinUpdatemsupdte.exe"Added by an unidentified TROJAN! See examples here & here"
XMicrosoftCorpupdate.exe"Added by the AUTORUN-ASG WORM!"
XMicrosoftCorpwupdate.exe"Added by the AGENT-LAY TROJAN!"
XMicrosoftNAPCupdate.exe"Added by the AUTORUN-ASG WORM!"
XMicrosoftNAPCwupdate.exe"Added by the AGENT-LAY TROJAN!"
XMicrosoftUpdateMicrosoftUpdate.exe"Added by the BANKER-EHC TROJAN!"
NMiniNoteMININOTE.EXE"Mini NoteTab was the first in the family of "NoteTab" text and HTML editors from Fookes Software"
UMobile Phone SuiteMobilePhoneSuite.exeLogitech Mobile Phone Suite
UMotorola Desktop SuiteDesktopSuite.exe"Related to Motorola Desktop Suite - PC software managing Motorola mobiles such as the A1000"
XMouseDrvupdate.exe"Added by the ZOTOB.N WORM!"
XMS Unix Binarymsnupdate.exe"Added by the RBOT-AAM WORM!"
XMS Unix Binaryoutlookexpressupdate.exe"Added by the RBOT-YU WORM!"
XMS Unix BinaryWin32Update.exe"Added by the RBOT-BAS WORM!"
XMS Unix BinaryNorton2005Update.exe"Added by a variant of the RBOT WORM!"
XMS Unix Binarytrmupdate.exe"Added by the RBOT-ACC WORM!"
XMS UPDATERupdate.exe"Added by the RBOT-VC WORM!"
XMSConfig Managermsupdate.exe"CoolWebSearch parasite variant"
Xmsliveupdatemsliveupdate.exe"Added by the AGOBOT.ALT WORM!"
XMsn Messenger Updatemsnupdate.exe"Added by a variant of the RBOT WORM!"
XMSN Updatingmsnupdate.exe"Added by the QHOST.AEI TROJAN!"
XMSNPluginSrvcssagate.exe"Added by the SDBOT.AKJ WORM!"
Xmssonfigwinupdate.exe"Added by a variant of the SDBOT WORM!"
Xmsupdatemsupdate.exe"Added by the RBOT-MZ WORM!"
XMSUpdatecriticalUpdate.exe"Affilred adware"
Xmsupdateupdate.exe"Added by a variant of the SDBOT WORM!"
XMSupdate.exeN/A"CoolWebSearch parasite variant - resets home page to an adult content site"
XMSWinupdatewinupdate.exe"Added by the DLOADR-AAW TROJAN!"
XMyFastAccessmyfastupdate.exeMy-Fast-Access toolbar updater
Xnapv.exewupdate.exe"Added by the AGOBOT-JX BACKDOOR!"
XNAV_UpdateNAV_Update.exeUnidentified WORM or TROJAN!
?netfxupdatenetfxupdate.exe"Would appear to be a valid Microsoft .NET file (see here) but other sources suggest it could be a trojan"
?NetFxUpdate_v1.0.3705netfxupdate.exe"Would appear to be a valid Microsoft .NET file (see here) but other sources suggest it could be a trojan"
NNokia Ovi SuiteNokiaOviSuite.exe"Nokia Ovi Suite for managing Nokia mobile devices - ""gives you an easy access to the contents of your Nokia device. Transfer files and information effortlessly between your device and your computer
NNokiaOviSuiteNokiaOviSuite.exe"Nokia Ovi Suite for managing Nokia mobile devices - ""gives you an easy access to the contents of your Nokia device. Transfer files and information effortlessly between your device and your computer
NNokiaOviSuite.exeNokiaOviSuite.exe"Nokia Ovi Suite for managing Nokia mobile devices - ""gives you an easy access to the contents of your Nokia device. Transfer files and information effortlessly between your device and your computer
XNortE Antivirusnorte.exe"Added by the RBOT.BQQ WORM!"
XNorton UpdateccUpdate.exe"Added by a variant of the AGOBOT/GAOBOT WORM!"
XNorton UpdatecUpdate.exe"Added by the AGOBOT.APP WORM!"
XNorton UpdaterNortonUpdate.exeAdded by an unidentified WORM or TROJAN!
XNorton UpdaterccUpdate.exe"Added by a variant of the AGOBOT/GAOBOT WORM!"
XNSupdateNSupdate.exe"Added by the Dial/Laet-B premium rate dialer!"
XOpen Siteopnste.exe"OpenSite adware"
XOpen Siteopensite.exe"OpenSite adware"
UOpenwares LiveUpdateLiveUpdate.exe"Web-update utility as used by various types of software - see here"
XOrbitUpdateupdate.exe"Xupiter OrbitExplorer toolbar related. Drive-by foistware. Use Spybot S&D
XOuterinfoUpdateOuterinfoUpdate.exe"Clickspring.Outerinfo adware"
Xoutpostupdateoutpostupdate.exe"Added by the COSIAM-C TROJAN!"
NPC SuitePCSuite.exe"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
NPC Suite TrayPCSuite.exe"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
XPCHEasySearchSTUpdate.exePCH EasySearch bar
NPCSuitePCSuite.exe"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
UPhilipsRemotePhilipsRemote.exe"Remote control support for MusicMatch Jukebox on Philips audio players such as the AZ2555 Sound Machine - see
NPLNRNotePLNRNote.exePart of Sierra/Hallmark Card Studio - System Tray notification of events such as birthdays and anniversaries that you've scheduled with the customizable Event Planner
NPost-itR Software Notes LitePsn2Lite.exe"Post-it® Software Notes - Lite from 3M - now replaced by the more advanced Post-it® Digital Notes"
YPowerChutePwrchute.exe""During a power outage
XPowerChutePwrchute.exe"Added by the LAZAR-A TROJAN! Note - this is located in %ProgramFiles%\APC_Power"
Nppmateppmate.exe"PPMate - free tool for streaming online TV via P2P (peer-to-peer)"
XPPPOEOEwinlite.exe"Added by the RBOT-AAN WORM!"
NPsnLitePsnLite.exe"Post-it® Software Notes - Lite. ""You can use this digital version of the famous canary yellow note to remind you to do something
XQuick Officeactivate.exe"Added by the RANSOMLOCK.D TROJAN! Note - this infection hooks the keyboard to prevent anything except numbers from being typed and displays a Russian message requesting a valid license key"
NQuickbooks Update Agentqbupdate.exeAssociated with Intuit's Quickbooks but not required. Possibly to do with the payroll update service but you're prompted to check for updates when appropriate whether this is running or not
NQuicknotequicknote.exe"JC&MB Quicknote Virtual Scrapbook"
XQuickTimeUpdateQuickUpdate.exe"Added by the BIFROSE-CW TROJAN!"
Xrate.exei11r54n4.exe"Added by the BEAGLE-I WORM!"
Xrate.exei1ru74n4.exe"Added by the BEAGLE.E WORM and variants!"
?RealTimeUpdateRealTimeUpdate.exe"Product description in properties is ""InternetExplorerCommunicationAgent Module"" ?"
URemoteRemote.exe"Remote Control driver for LifeView internal and external TV products"
?RMremoteRmRemote.exe"Remote control driver for REALmagic Xcard. Is it required?"
Xrn4ddirote.exe"Added by the MAROON.A TROJAN!"
XRunDLL32winupdate.exe"Added by an unidentified TROJAN! - possibly a BMBOT variant"
XRunWindowsUpdateuptodate.exe"BrowserAid/BrowserPal foistware"
XSafeSurfingUpdateSSUpdate.exe"MoneyTree parasite - ActiveX control used to download premium-rate dialers"
XSagate Security Firewallsagate.exe"Added by the GAOBOT.BOW WORM!"
USAUpdateSAUpdate.exe"Big Brother from Quest Software. System and network monitor"
XSaveDateSaveStartDate.ExeUnidentified adware
USBAutoUpdatesbautoupdate.exe"SpywareBlaster auto-updater"
XScanRegistryupdate.exe"Added by the DWNLDR-FZY TROJAN!"
Xsdfsdfsdfsp2update.exe"Added by a variant of the SPYBOT WORM!"
XSecurityWindowsSecurityUpdate.exe"Added by a variant of the SDBOT WORM!"
XSepate Security Firewallsepate.exe"Added by the RBOT.BLC BACKDOOR!"
NSEPCSuiteSEPCSuite.exe"System Tray access to Sony Ericsson PC Suite which ""connects your phone to your computer and expands the capabilities of your phone"". Run manually via the Start Menu (or optional desktop shortcut) before connecting the phone"
XShellExplorer.exe winupdate.exe"Added by the AGENT-FD TROJAN! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The ""winupdate.exe"" file is located in %System%"
XShellapi32mcvsrte.exeAdded by an unidentified WORM! Note - do not confuse with the McAfee SecurityCenter file of the same name
XShmgrate.exeibot4.exe"Added by the GASTER TROJAN!"
UShortKeys Liteshklite.exe"ShortKeys Lite from Insight Software Solutions
NSkypeMateSkypeMate.exe"SkypeMate acts as a bridge between networks of VoIP and PSTN"
USoftickPPPPPPGate.exe"Softick PPP is a Microsoft Windows driver that allows to establish PPP session between Palm powered devices and Microsoft Windows desktop computer"
NSony Ericsson PC SuiteSEPCSuite.exe"System Tray access to Sony Ericsson PC Suite which ""connects your phone to your computer and expands the capabilities of your phone"". Run manually via the Start Menu (or optional desktop shortcut) before connecting the phone"
Xsp2updatesp2update.exe"SP2Update adware! Tracks URLs visited and search terms entered into Internet Explorer"
XSpyFighterUpdateAutoUpdate.exe"SpyFighter spyware remover - not recommended
YSpywareTerminatorUpdateSpywareTerminatorUpdate.exe"Automatic updates for Spyware Terminator. Initially not recommended due to false positives but the later versions have since improved - see here"
Xssate.exeirun4.exe"Added by the BEAGLE.J WORM!"
Xssate.exewinsys.exe"Added by the BEAGLE.K WORM!"
NSSBkgdUpdateSSBkgdupdate.exe"Automatic updates for ScanSoft (now Nuance) products such as OmniPage and PaperPort. Can be disabled using the main program's options. Note - if you have a Soundblaster Audigy2 ZS soundcard installed on your computer and the volume of your sound system is turned on extremely high disabling this will solve the problem"
Xssgrate.exesystem.exe"Added by the MITGLIEDER.C TROJAN!"
Xssgrate.exeirun.exe"Added by the MITGLIEDER.D TROJAN!"
Xssgrate.exeirun4.exe"Added by the MITGLIEDER.F TROJAN!"
Xssgrate.exesysdoor.exe"Added by the MITGLIEDER.N TROJAN!"
Xssgrate.exewinerdir.exe"Added by the MITGLIEDER.O TROJAN!"
Xssgrate.exewinsystems.exe"Added by the BAGLEDL-J TROJAN!"
Xssgrate.exewintems.exe"Added by the MITGLIEDER.Q TROJAN!"
XSSUpdateSSUpdate.exe"MoneyTree parasite - ActiveX control used to download premium-rate dialers"
XStart Uppingsmssupdate.exe"Added by a variant of the RBOT WORM!"
Xstartkeyupdate.exe"Added by the BIFROSE-DG TROJAN!"
NStickyNoteStickyNote.exeUtility that allows you to put yellow "Post-It" type messages on your desktop. Available via Start -> Programs
UStreamZap Remotezremote.exe"StreamZap PC Remote - control Windows Media Player
Xsupdatesupdate.exe"Added by the MALWARE.D TROJAN!"
Xsvshostdrivermsnmessengerupdate.exe"Added by the SDBOT-BI BACKDOOR!"
XSwf32AVupdate.exe"Added by the MERKUR.E WORM!"
XSygaete Personal FirewallSyGate.exe"Added by the RBOT-GLX WORM!"
XSygate Personal FirewallSygate.exe"Added by the RBOT-PN WORM!"
XSygate Personal FirewallMcafeeupdate.exe"Added by the RBOT.YN WORM!"
XSygate Personal Port Blockerwinupdate.exe"Added by a variant of the RBOT WORM!"
XSysctrlswinupdate.exeAdded by an unidentified WORM or TROJAN!
Xsysmemmmsete.exe"Added by the NOPIR.C WORM!"
Xsysnatesysnate.exe"Added by the MEDIAS TROJAN!"
XSyssehuupdate.exe"EHU adware"
XSystem Monitoringcute.exe"Added by the RAHIWI.A WORM!"
XSystem Update2update.exe"Added by the AUTOTROJ-C TROJAN!"
XTabastte.exe"PurityScan adware"
XTaskmansysdate.exe"Added by the SILLYFDC.BCQ WORM!"
UTitlebar DateTitlebar Date.exe"Titlebar Date by Titlebar Software - displays the day of the week and date and time in the active window's tile bar. For example
NTK8 EasyNoteEasyNote.exe"TK8 EasyNote - desktop post-it notes"
Xtmaxpupdate.exeAdware pop-up generator
XTok-CirrhatusIDTemplate.exe"Added by the RONTOKBRO.A WORM!"
UToshiba Key StateKEYSTATE.EXE"Displays an icon in the System Tray indicating the state of the CAPS LOCK key. Can be handy on (e.g.
UTracks Eraserte.exe"Tracks Eraser from Acesoft - "Erases all tracks of your internet activity""
UTracks Eraser Prote.exe"Tracks Eraser Pro from Acesoft - "Erases all tracks of your internet activity""
NTray DateTray Date.exe"Tray Date by Titlebar Software - displays a simple icon in the System Tray (that can't be configured) which shows the current date. The originator's website is no longer available but you can still download it here. Whilst it only uses around 10MB of memory
Utraydate.exeTRAYDATE.EXETrayDate - displays the date as well as the time in the System Tray
Ntunebitetunebite.exe"""Tunebite lets you make unprotected copies of copy-protected music files by recording them while they are being played"". Can be launched from it's Start Menu shortcut"
UTurboExplorerTE.exe"Web accelerator - ""TurboExplorer 2.x is a real-time web surfing accelerator specifically designed for Internet Explorer 4/5 to achieve a faster and more effective approach to the internet"". Only needed if you find it improves web browsing"
NTurboNotetbnote.exePost-It's on your desktop. Available via Start -> Programs
UTvrRemoteRemote.exe"Remote Control driver for LifeView internal and external TV products"
XUpdateZupdate.exe"Associated with B3d Projector foistware - see here"
XUpdateUpdate.exe"QuickButton adware"
XUpdateWinUpdate.exe"Added by the SDBOT-CV BACKDOOR!"
YUpdate ServiceUpdate.exe"Loaded by Handybits programs such as EasyCrypto. Re-instates itself every time the program is run so best to leave it enabled. Prevent it dialling out via a firewall"
XUpdate.exeravseuper.exe"Added by the QQPASS-P TROJAN!"
Xupdaterealrealupdate.exeChinese originated adware
XUpdatesmsupdate.exe"CoolWebSearch parasite variant"
Xupdatewinupdate.exe"Added by a variant of the SDBOT WORM!"
XUpToDateuptodate.exe"BrowserAid/BrowserPal foistware"
XUSB Drivers1msupdate.exe"Added by a variant of the RBOT WORM!"
Xwin updatewapdate.exe"Added by a variant of the RBOT WORM!"
XWin UpdateSysUpdate.exe"Added by the AGOBOT-TN WORM!"
XWin Updateoleupdate.exe"Added by the AGENT-UY TROJAN!"
Xwin updatewupdate.exe"Added by the RBOT-P BACKDOOR!"
XWin32 Kernel Updatewin32update.exe"Added by the PROXY-BS TROJAN!"
XWin32 USB2 Driverwinupdate.exe"Added by the AGOBOT.YE WORM!"
Xwin32updatewin32update.exe"Added by the GENOME.AQUV TROJAN!"
UWINCINEMAMGRWinRemote.exe"InterVideo WinCinema Manager - needed for the use of WinDVD Remote Control"
Xwindow2ieupdate.exe"Added by the FORBOT-BM WORM!"
XWindows 32 UpdateWindows-Update.exe"Added by a variant of the RBOT WORM!"
XWindows Auto UpdaterWINDOWSUPDATE.EXE"Added by the SDBOT.PB WORM! Note the space at the beginning of the filename"
XWindows Configuration Utilitywinxupdate.exe"Added by the AGOBOT.LW WORM!"
XWindows drivers updatewindowsupdate.exe"Added by the RBOT-ACE WORM!"
XWindows Firewall Updaterwindowsupdate.exe"Added by the SPYBOT.AVEO WORM!"
XWindows Fixes Systemselite.exe"Added by the MYTOB.EG WORM!"
XWindows Host Servicesvchoste.exe"Added by the KELVIR.BF WORM!"
XWindows LoaderSysUpdate.exe"Added by a variant of the SDBOT WORM!"
XWindows Logon ProcedureSvchoste.exe"Added by a variant of the SPYBOT WORM!"
XWindows MS Update 32jebote.exe"Added by the FORBOT-GK WORM!"
XWindows Processwin_update.exe"Added by the LASTWORD WORM!"
XWindows Registry Scantimeupdate.exe"Added by the SPYBOT.JE WORM!"
XWindows Servicesscvhoste.exe"Added by the SPYBOT.OBZ WORM!"
XWindows Serviceswupdate.exe"Added by the GAOBOT.ZT WORM!"
XWindows SP2 UpdateSp2update.exe"Added by the WOOTBOT.BS WORM!"
XWINDOWS SYSTEMxpupdate.exe"Added by the ZOTOB-G WORM!"
XWINDOWS SYSTEMwupdate.exe"Added by the MYTOB-HT WORM!"
XWINDOWS SYSTEM By FEnRwindasz-updote.exe"Added by the MYTOB.LR WORM!"
XWindows Updatewudate.exe"Added by the AGOBOT.ML WORM!"
XWindows Updatewupdate.exe"Wengs adware"
XWindows UpdateWindowsUpdate.exe"Added by the BAYROB-A TROJAN!"
XWindows UpdateUpdate.exe"Added by the DELF-FN TROJAN!"
XWindows Updatewinupdate.exe"Added by the SDBOT-WS WORM!"
XWindows Updatemplupdate.exe"Added by the MOEGA WORM!"
XWindows updatewudupdate.exe"ISTBar adware related"
XWindows Updatemsnsupdate.exe"Added by the RBOT-AXS WORM!"
XWindows Updatewin32update.exe"Added by the SDBOT.FTK WORM!"
XWindows Update Automationwinuptdate.exe"Added by a variant of the RBOT WORM!"
XWindows update loaderxpupdate.exe"Malware installed by different rogue security software including SpyKillerPro. Also detected as the BRAVE-A TROJAN!"
XWindows Update Managerwupdate.exe"Added by a variant of the RBOT WORM!"
XWindows Update Service 2004/2005systemupdate.exe"Added by the RBOT-JE WORM!"
XWindows Update.exeN/AHomepage hijacker
XWindows Updaterwupdate.exe"Added by the WOOTBOT.AJ WORM!"
XWindows Updater Servcxpuupdate.exe"ContraVirus rogue security software - not recommended
XWindows Updater Servicesmsnupdate.exe"Added by a variant of the RBOT WORM!"
XWindows Updates Agentwinupdate.exe"Added by the SPYBOT.HW WORM!"
XWindows USB Monitorservupdate.exe"Added by the IRCBRUTE.AQ TROJAN!"
XWindows XP Automatic UpdatewXPupdate.exe"Added by the RBOT-AFC WORM!"
XWindowsACEbaracebarupdate.exe"BarACE adware"
XWindowsCriticalUpdatewindows_critical_update.exe"Added by the ASTEF or RESPAN WORMS!"
XWindows�UpdatesUpdate.exe"Added by the RBOT.TRA BACKDOOR!"
XWindowsRegKey updatewinupdate.exe"Added by the RBOT-QJ WORM!"
XWindowsRegKey updatewdnupdate.exe"Added by the SDBOT.QX WORM!"
XWindowsUpdatewindows_update.exe"Added by the LOFNI WORM!"
Xwindowsupdatewinupdate.exe"Added by the WARPI WORM!"
XWindowsupdateWindowsupdate.exe"Added by the BANKER.ARK TROJAN!"
Xwindowsupdateautoupdate.exe"Added by the IRCBOT-P BACKDOOR!"
XWindowsXP Updatewindowsxpupdate.exe"Added by the RBOT-PB WORM!"
XWinGate initializeWinGate.exe"Added by the LOVGATE.F WORM!"
XWinLibUpdatelibupdate.exe"Added by the BIONET series of TROJANS such as BIONET.31 or BIONET.310"
XWinLibUpdtelibupdte.exe"Added by the BIONET.318 TROJAN!"
UWINREMOTEWinRemote.exe"InterVideo WinCinema Manager - needed for the use of WinDVD Remote Control"
Nwinroutewinroute.exe"Win-Route 4.27. WinRoute Tray Icon for starting and stopping the WrCtrl.exe process
XWinshellremote.exe"Added by the MYTOB.LJ WORM!"
XWinsock driverwinnt update.exe"Added by the SPYBOT-DM TROJAN!"
XWinsock2 driverwinupdate.exe"Added by the SPYBOT-BX WORM!"
XWinsock32driversp2XPupdate.exe"Added by the HACKARMY.S TROJAN!"
XWinsock32driverwinXPupdate.exe"Added by the HACKARMY.9728 TROJAN!"
Xwinupdatewinupdate.exe"Added by the ALCAN.B WORM!"
Xwinupdate.exewinupdate.exe"Added by the RADO TROJAN!"
Xwinupdate.regwinupdate.exe"Added by the SPYBOT.EAS WORM!"
XWinUpdaterupdate.exe"Added by the STARTPAGE.C TROJAN!"
Xwmupdatewmupdate.exe"Added by the AGENT-GGJ TROJAN!"
Xwon updateWAPDATE.EXE"Added by the RBOT.N WORM!"
?wristewriste.exe"??"
?wsbklitewsbklite.exe"Related to the Acer Soft Button on Acer Tablet PCs. Appears to do nothing so is it required?"
XWupdate driverwupdadte.exe"Added by the SPYBOT-CQ WORM!"
XWxp4Norton Update.exe"Added by the ERKEZ.D WORM!"
Xxpiupdatexpiupdate.exe"Added by the RBOT-AAB WORM!"
Xxpsp2installxpsp2Update.exe"Added by the AGENT-DPK BACKDOOR!"
Xxpsp2Updatexpsp2Update.exe"Added by the AGENT-DPK BACKDOOR!"
UXSC SIP ClientX-Lite.exe"""CounterPath's X-Lite 3.0 is the market's leading free SIP based softphone available for download"". For VOIP and broadband users"
XXTServiceUpdateXTServiceUpdate.exehahame.net adware downloader
XZi5AntiVirus Update.exe"Added by the ERKEZ.G WORM!"
XZupdateZupdate.exe"Associated with B3d Projector foistware - see here"
X[various names]forces_elite.exe"Wareout - malware masquerading as a spyware and dialer remover"
X{C0FB7D08-056E-1033-0501-03020730002c}Update.exe"Added by the AGENT-EOG TROJAN!"


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.