WinUp

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	Auto WinUpdate	taskmrg.exe	"Added by the RBOT-AFA WORM!"
X	blah service	winupdate.exe	"Added by the GAOBOT.BIA WORM!"
X	CommonService	winup.exe	"Added by the DLOADR-BJJ TROJAN!"
X	ctfmon	WinUP.exe	"Added by the BANKER-VV TROJAN!"
X	DRam prosessor	winupl.exe	"Added by the RBOT-BCQ WORM!"
X	DRam rar proc	winupdaterar.exe	"Added by a variant of the IRCBOT TROJAN!"
X	InternetGetConnectedState	winupdate.exe	"Added by the SDBOT-JN WORM!"
X	InternetGetConnectedStateEx	winupdate.exe	"Added by the SDBOT-JN WORM!"
X	LTM2	winupdate.exe	"Added by the LITMUS.203 TROJAN!"
X	Microsoft auto update	winupdate.exe	"Added by the BMBOT TROJAN!"
X	Microsoft Office Start	winupdates.exe	"Added by the GAOBOT.BC WORM!"
X	Microsoft SpA Service	Winupd32.exe	"Added by the RBOT.LT WORM!"
X	Microsoft Synchronization Manager	winupdate.exe	"Added by the SDBOT.ER WORM!"
X	Microsoft Telecoms Center	winupn.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	WinUpdate32.exe	"Added by the RBOT-TI WORM!"
X	Microsoft Update	winupdater.exe	"Added by the RBOT.BIN WORM!"
X	Microsoft update	winupdate.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	winupdt.exe	"Added by the RBOT-FP WORM!"
X	Microsoft Update Machine	winupdte.exe	"Added by the RBOT-GKL WORM!"
X	Microsoft Update Win32a	winupdate32a.exe	"Added by the RBOT-LO WORM!"
X	Microsoft Update Win32x	winupdate32x.exe	"Added by the RBOT-AJN WORM!"
X	Microsoft Updater	winupdate.exe	"Added by the AGENT-KIR TROJAN!"
X	Microsoft Win Update	WinUP.exe	"Added by the RBOT-BPR WORM!"
X	Microsoft Windows 2000	Winupdsdgm.exe	"Added by the GAOBOT.AO WORM!"
X	Microsoft Windows Secure Update	rpcxwinupdt.exe	Added by an unidentified WORM or TROJAN!
X	Microsoft Windows Updater	winupdgm.exe	"Added by the GAOBOT.BI WORM!"
X	Microsoft Windows Updater	WINUPDATE.EXE	"Added by the RBOT-LI WORM!"
X	Microsoft WinUpdate	mntcgf032.exe	"Added by the RBOT-PF WORM!"
X	Microsoft WinUpdate	svh0st.exe	"Added by the SPYBOT.DL WORM!"
X	Microsoft WinUpdate	syslx32.exe	"Added by an unidentified VIRUS
X	Microsoft WinUpdate	syswin32.exe	"Added by the RBOT-HO WORM!"
X	Microsoft WinUpdate	spfix.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft WinUpdate	Winamp61.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft WinUpdate	Winupd32.exe	"Added by the RBOT.MQ WORM!"
X	Microsoft WinUpdate	WinNTinit32.exe	"Added by the RBOT.VS WORM!"
X	Microsoft WinUpdate	msupdte.exe	"Added by an unidentified TROJAN! See examples here & here"
X	Microsoft WinUpdates	serm32.exe	"Added by the RBOT.GE WORM!"
X	MicrosoftUpdate	WinUp32.exe	"Added by an unidentified VIRUS
X	mssonfig	winupdate.exe	"Added by a variant of the SDBOT WORM!"
X	MSStartOptimizer	WINUPD.EXE	"Added by the DASMIN-E TROJAN!"
X	MSWindowsUpdate	mswinup.exe	"Added by a variant of the SDBOT WORM!"
X	MSWinupd	winupd.exe	"Added by the DLOADER-YE or DLOADR-AAA or DLOADER-ZF TROJANS - and others"
X	MSWinupdate	winupdate.exe	"Added by the DLOADR-AAW TROJAN!"
X	RunDLL32	winupdate.exe	"Added by an unidentified TROJAN! - possibly a BMBOT variant"
X	Security Patch	WinUpdate32.exe	"Added by the SDBOT-BM WORM!"
X	Shell	Explorer.exe winupdate.exe	"Added by the AGENT-FD TROJAN! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The ""winupdate.exe"" file is located in %System%"
X	Smss.exe driver	winupd32.exe	"Added by the SDBOT.MI BACKDOOR!"
X	Sygate Personal Port Blocker	winupdate.exe	"Added by a variant of the RBOT WORM!"
X	Sysctrls	winupdate.exe	Added by an unidentified WORM or TROJAN!
X	System	winupd.exe	"Added by a variant of the SDBOT WORM!"
X	System Update Service	winupd32.exe	"Added by the ADTODA-A TROJAN!"
X	Universal Plug & Play devices	WinUPPD.exe	Added by an unidentified WORM/TROJAN!
X	UPDATE	WinUpdater5.0.vbs	"Added by the GORMLEZ-A WORM!"
X	Update	WinUpdate.exe	"Added by the SDBOT-CV BACKDOOR!"
X	Upgrade Service	winupd.exe	"Added by the TOFGER-U TROJAN!"
X	UpTimes service	WinUp.exe	"Added by the RBOT-AKB WORM!"
X	USB 2.1 Driver	winupdate1.exe	"Added by a variant of the RBOT WORM!"
X	Win Process Updates	winupdates.exe	"Added by a variant of the SDBOT WORM!"
X	Win Updater	WINUPDATER.EXE	"Added by the RBOT.IP WORM!"
X	Win32 USB2 Driver	winupdate.exe	"Added by the AGOBOT.YE WORM!"
X	Windowfdgfds DasdLL Verifier	winupdatr.exe	"Added by the AGOBOT.HZ WORM!"
X	Windows Auto Update	winupdater.exe	"Added by the SDBOT.TF WORM!"
X	Windows DLL host	winupd32.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Secure Update	winupser.exe	"Added by the RBOT-GCG WORM!"
X	Windows Service Agent	winup32.exe	"Added by the RBOT-GQX WORM!"
X	Windows Service Agent	winupds32.exe	"Added by the RBOT-GQT WORM!"
X	Windows Service Agent	winupd32.exe	"Added by the SDBOT.SYM WORM!"
X	Windows UDP Control Center	winupmgr.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Update	winupdate.exe	"Added by the SDBOT-WS WORM!"
X	Windows Update	winupupdate1.exe	"Added by the RBOT-UV WORM!"
X	Windows update 32bit	winupd32.exe	"Added by the SDBOT.BE WORM!"
X	Windows Update Automation	winuptdate.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update Host	winupsvc.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update Monitoring Service	winupdt.exe	"Added by the RBOT-PL WORM!"
X	Windows Update Services	winupdate32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Updater Online	winupdatexx.exe	"Added by a variant of the RBOT WORM!"
X	Windows Updater Service Manager	winupdatr.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	windows updaters	winupdats.exe	"Added by the SPYBOT-IS WORM!"
X	Windows Updates	winupd32.exe	"Added by the MYTOB.CE WORM!"
X	Windows Updates Agent	winupdate.exe	"Added by the SPYBOT.HW WORM!"
X	WindowsRegKey update	winupdate.exe	"Added by the RBOT-QJ WORM!"
X	WindowsRegKey update	winupdatexx.exe	"Added by the RBOT.LW WORM!"
X	WindowsRegKey update	WINUPDATES.EXE	"Added by the RBOT-MM WORM!"
X	WindowsRegKey update	winupdat32.exe	"Added by the RBOT-AGW WORM!"
X	windowsupdate	winupdate.exe	"Added by the WARPI WORM!"
X	WindUpdates	WinUpdt.exe	Windupdates adware variant
X	winnt DNS ident	Winupd32.exe	"Added by the RBOT.AVU WORM!"
X	winnt DNS ident	winupdate32.exe	"Added by a variant of the RBOT WORM!"
X	winpopup	winupie.exe	Adware by Tradeexit.com
X	Winsock driver	winupdate32.exe	"Added by the SPYBOT-JZ TROJAN!"
X	Winsock2 driver	winupdate.exe	"Added by the SPYBOT-BX WORM!"
X	WinUp	svchost.exe	"Added by the SILLY.BR WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This file is located in a ""4350"" sub-folder"
X	winupated.exe	winupated.exe	"Added by a variant of the SDBOT WORM!"
X	winupd	"RUNDLL32.EXE [random value].dll	_mainRD"
X	winupd	winupd.exe	"SearchNew adware"
X	winupd.exe	winupd.exe	"Added by the BEAGLE.M or BEAGLE.N WORMS!"
X	WinUPD32	explorer.exe	"Added by an unidentified VIRUS
X	winupdat	winupdat.exe	"Added by the CANBOT.A WORM!"
X	WinUpdate	RBSKQQBO.EXE	"Added by the VBSWG2B.A WORM!"
X	WinUpdate	wmbem.exe	"Added by the REVCUSS.B TROJAN!"
X	WinUpdate	updsys.exe	"Added by a variant of the RBOT WORM!"
X	winupdate	winupdate.exe	"Added by the ALCAN.B WORM!"
X	WinUpdate	svhost.exe	"Added by a variant of the SDBOT WORM!"
X	WinUpdate	svchots.exe	"Added by the SMALL.GXJ TROJAN!"
X	winupdate	jusched.exe	"Added by the DWNLDR-FUX TROJAN! Note that this is not the legitimate Sun Microsystems file (of the same name) which is usually located in %Program Files%\Java\version number\bin. This one is located in %Windir%"
X	Winupdate	lsas.exe	"Added by the COSPET.JR TROJAN!"
X	Winupdate Engine	wupeng.exe	"MalwareCrush rogue security software - not recommended
X	WinUpdate Loader	msnnm.exe	"Added by the REVCUSS.C TROJAN!"
X	Winupdate Service	winxp.exe	"Added by the SPYBOT.IR WORM!"
X	winupdate.exe	winupdate.exe	"Added by the RADO TROJAN!"
X	winupdate.reg	winupdate.exe	"Added by the SPYBOT.EAS WORM!"
X	winupdate2846	vbsystem35.exe msvbrun.exe	"Added by a variant of the MUTIN-C TROJAN!"
X	winupdate86.exe	winupdate86.exe	"Added by the FAKEAV-AHQ TROJAN!"
X	WinUpdateAdministrator	CSRSS.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in C:\Application Data\WINDOWS"
X	WinUpdateB	breatle.exe	"Added by the BRATLE.AWORM!"
X	winupdateconn	[path to file]	"Added by the COMBRA-A WORM!"
X	winupdateconn_	Explorer.EXE	"Added by the COMBRA-B WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Winupdatee	winsvcc.exe	"Added by the AGENT.AN TROJAN!"
X	winupdatefiv_	[path to file]	"Added by the COMBRA.C WORM!"
U	WinUpdateProtection	csrss.exe	"EmployeeWatch is a commercial surveillance software program designed to monitor user activity on a computer. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a subfolder of C:\windowsupdate\ufp"
X	WinUpdater	update.exe	"Added by the STARTPAGE.C TROJAN!"
X	winupdates	winupdates.exe	"Added by the ALCRA-B WORM!"
X	winupdate_	[path to file]	"Added by the COMDOR.A WORM!"
X	WinUpdating	WinUpdating.exe	"Added by the AGENT-GSC TROJAN!"
X	WinUPDbc	winupdbc.exe	"Added by the BANKER-DSN TROJAN!"
X	WinUpdsv	winupdsv.exe	"Added by the DROPO MACRO!"
X	winupdt	RUNDLL32.EXE [random.dll]	"Added by the MABUT.A WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The random DLL file is found in the Windows or Winnt folder"
X	winupdtl	winupdtl.exe	"SecondThought adware"
X	WinUpgrader	[path to trojan]	"Added by the AGENT-DZ TROJAN!"
X	WinUPPD.exe	[random filename]	Added by an unidentified WORM/TROJAN!
X	xDRam rar procx	xwinupdaterarx.exe	"Added by the RILER-W TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.