Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer


NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.


  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown

Startup Name Process Name Details
U"aimb.exe"" -h"aimb.exe"IMSufSentinel is a spy program which can record IM conversations
X.nvsvcbsmssb.exe"Added by the BOXED.CG TROJAN!"
Yaccrdsubaccrdsub.exe"ActivIdentity ActivClient - security software from ActivIdentity Corporation which ""enables organizations to secure workstations with smart cards and smart USB tokens while enforcing strong authentication for desktop access and network login"""
?ADSLSYSTEMTRAYSystemtrayV100B.exe"Apparently Annex A ADSL modem related. What does it do and is it required?"
UAdSubtractadsub.exe"AdSubtract blocks ads
YAiptek Graphics Tablet (USB)atwtusb.exeUSB interface for Aiptek Graphics Tablet (USB)
UAppExtenderAppExtCB.exe"Loads the Confimax add-in for popular E-mail programs to confirm E-mails have been sent and received"
UArgentum Backupab.exe"Argentum Backup - a small backup program that lets you easily back up your documents and folders"
UAS00_WN511BWN511B.exe"Netgear RangeMax NEXT wireless adapter configuration utility"
YAspireTimeMachineacertmb.exe"System recovery software supplied with some Acer notebook PCs. Similar to GoBack and the restore program in WinXP
NASUS ProbeAsusProb.exeASUS video card fan/thermal monitor - only required if you overclock your card or live in a hot area
UAtiPTAAtiptaab.exe"Control panel for the ATI series of video cards allowing access to such features as display resolution
Yatwtusbatwtusb.exeUSB interface for Aiptek Graphics Tablet (USB)
NAudioHQAhqtb.exeFor Creative Soundblaster Live! series soundcards. System tray application for SB Live! functions. Available via Start -> Programs
Xavguard3876000b09274b.exe"AntiVirus ransomware security software - not recommended
Xb.exeb.exe"Added by the SDBOT.BND WORM!"
UBackup4all OTB AgentB4AOTB.exe"""Backup4all is an award-winning data backup software for Windows. This backup utility was designed to protect your valuable data from partial or total loss by automating backup tasks
NBackWebbackweb.exeAutomatically detects an internet connection and downloads any available updates. Typical on Compaq and HP PC's but not restricted to those OEM's. Resource hog and often causes malfunctions. Available via Start -> Programs
UBAUSBBAUSB.exe"Boston Acoustics Audio
XBharatayudaGNB.exe"Added by the BHARAT.A WORM!"
Xbin32hpuppstub.exe"PrecisionPop adware"
XBrcttrdb.exe"Detected by Kaspersky as the PURITYSCAN.Y TROJAN!"
XBron-Spizaetusbronstab.exe"Added by the RONTOKBRO.C WORM!"
XBron-SpizaetusElnorB.exe"Added by the RONTOKBRO.D WORM!"
XCas2Stubcas2stub.exe"CasinoClient adware"
XCasStubcasstub.exe"Added by the CASS-A TROJAN!"
Xcjbcjb.exe"Added by the AGENT.ALZE TROJAN!"
XClickTheButtonCTB.EXE"ClickTheButton adware"
NCnxDslTaskBarCnxDslTb.exeConnexant DSL Taskbar as used on Acess Runner and Samsung AHT-E310 ADSL modems
NCPQBootPerfDBCPQBootPerfDB.EXESee the entry for Compaq Message Server
YCPQCalibCPQCalib.exeCompaq PowerCon power management software for laptops
UDELLMMKBDELLMMKB.EXEMultimedia keyboard control for Dell based PCs - only required if you use the multimedia keys
UDellTouchDELLMMKB.EXEMultimedia keyboard control for Dell based PCs - only required if you use the multimedia keys
Xdelmsbbdelmsbb.exe"180Search adware"
Xdnamd140113.a.Stub.EXE"Added by the STUB_A TROJAN!"
XDrivers for Internet Exploreraccesweb.exe"Added by the STARTPAGE.FW TROJAN!"
XDSBDSB.exe"EnergyPlugin adware"
NEasy Start Buttonesb.exeProvides functionality on certain laptops that have additional keys. Not required unless you use the extra keys
XEasyDates_gbEasyDates_gb.exe"""Edate-A"" premium rate adult content dialler"
UECentergtb.exeDell E-Center/Google Toolbar related
XeMakeSVEMAKE2B.EXE"""Switch"" adult content dialer"
Xempine121307.Stub.exe"Delfin Media Viewer adware related"
XEptrnopdb.exeAdded by an unidentified WORM or TROJAN!
UESBesb.exeEasy Start Button - provides functionality on certain laptops that have additional keys. Not required unless you use the extra keys
UEZ-DUB FinderEZ-DUB.exe"Support software for the Lite-On EZ-DUB external DVD writer from Lite-On IT Corporation"
Xgrgtgvgb.exe[random].exe"Added by the AGENT-EBF TROJAN!"
?hpScannerFirstBootscannerfb.exe"HP scanner related"
Xicrosoft Visual InterDevczvslmqb.exe"Added by the RBOT-AYP WORM!"
XIExplorer32 Java ScriptingIExplore32b.exe"Added by the RBOT.ABO WORM!"
XIExplorer32c Java ScriptingIExplore32cb.exe"Added by the RBOT.ABN WORM!"
UInstallstubinstallstub.exe"Tool for Outlook and Outlook Express from Plaxo for organising and keeping contacts organised and updated and providing online access to your contacts and access from PDA or mobile phone"
XIntel Physical Routine 1.2Astnetlib.exe"Added by the BACKDR-AS BACKDOOR!"
XiPOD USB DriverIPODUSB.EXE"Added by a variant of the RBOT WORM!"
Xish-b.exeish-b.exe"Added by the IRCBOT-ACZ TROJAN!"
XJregJreg2b.exe"FlashEnhancer adware"
UKBDKbdStub.EXEKey Watcher from HP - watches for Multimedia Keys on HP keyboards
UKEMailKbKEMailKb.EXE"Controls the buttons at the top of the Micro Innovations 650i Internet Access Keyboard. If you disable it you cannot use the buttons - like volume control or shut down"
XlaltinL90112201.Stub.exe"Delfin Media Viewer adware related"
ULOAD WBLOADWB.EXE"Part of Stardock's WindowBlinds custom desktop program. "WindowBlinds is the first utility of its kind. It extends Win98/NT/2K/XP to have a fully skinnable user interface. You can change the style of title bars
XMicrosoft Cab Managercab.exe"Added by the DELF-JJ TROJAN!"
XMicrosoft Driver SetupJwrb.exe"Added by the AUTORUN-AOB WORM!"
XMicrosoft PCHealth32NDDENB.exe"Added by the PWSYAHOO-A TROJAN!"
XMicrosoft Security Monitor Processweb.exe"Added by the EGGDROP.V BACKDOOR!"
XMicrosoft Standard Executions Librarywin32lib.exe"Added by the RBOT-AUK WORM!"
XMicrosoft System CheckupWnetlib.exe"Added by the DONK.C WORM!"
XMicrosoft System Checkupdbnetlib.exe"Added by the DONK.L WORM!"
XMicrosoft Updatewuamgrb.exe"Added by the RBOT-AZE WORM!"
XMicrosoft Update Machinewftestb.exe"Added by the RBOT-AFZ WORM!"
XMicrosoft Windows Expresswindowslogonb.exe"Added by the SDBOT.ABOO WORM!"
NMicrosoft Works PortfolioWksSb.exeThe Works Portfolio tool lets you collect and organize text and pictures from the Web or your favorite program. The Works Portfolio provides a location where you can store items you want to later put into a document or other file. Can be prevented from starting from a setting within Portfolio
XMicrsoft DerSystemuqieelpb.exe"Added by the RBOT-GRI WORM!"
XMircrosoft Windows Config DLLrundllc32b.exe"Added by the RBOT-ZY WORM!"
Umkb.exemkb.exe"MomKnowsBest surveillance software. Uninstall this software unless you put it there yourself"
UMoodBookmb.exe"MoodBook is a free Windows utility that brings art to your desktop"
Xmorphstbmorphstb.exe"Adware - detected by Kaspersky as the STUBBY.C TROJAN!"
NMotive SmartBridgeMotiveSB.exe"System tray icon for the Virtual Assistant from AT&T Broadband
NMotiveSBMotiveSB.exe"System tray icon for the Virtual Assistant from AT&T Broadband
Xmotoinmm15201518.Stub.exe"Delfin Promulgate adware variant"
XMS Unix Binarywin32ttb.exe"Added by the SPYBOT.OQ WORM!"
XMS-Connectweb.exe"Adult content dialler - see here"
Xmsbbmsbb.exe"180Search adware"
XMsbb.exeMsbb.exe"Added by the SDBOT.QJ WORM!"
XMSIE ParsersMSIE32ab.exe"Added by the SDBOT.MV WORM!"
XMsMon32MsMon32b.exe"Added by the SDBOT.O BACKDOOR!"
Xmsnntwinampb.exe"Chinese originated adware - detected by Kaspersky as the AGENT.TL TROJAN!"
XOB Updaterob.exe"Added by the AGOBOT-IH WORM!"
XOmega AntiVirOM83b.exe"Omega AntiVir rogue security software - not recommended
UPando Media BoosterPMB.exe"Pando Media Booster from Pando Networks
XPGStub.exe[various filenames]Unidentified adware
UPopSubtractPopSub.exe"PopSubtract - pop-up killer"
XProtector GBprotectgb.exe"Added by the BANKER.EIE TROJAN!"
Nptfbptfb.exe"Push the Freakin' Button - "When a dialog causes irritation
NPush The Freakin' Buttonptfb.exe"Push the Freakin' Button - "When a dialog causes irritation
NQTSTUB.EXEQtstub.exePart of an old version of the Quick Tax application. It enables Quick Tax Calendar Popup to show tax calendar reminders
XRamBooster2rb.exe"Added by the AKAK TROJAN!"
URapid Restorerrpcsb.exe"XPoint ""Rapid Restore PC"" - ""a Managed Recovery solution that enables IT Administrators to protect the corporate image
YRavStubravstub.exe"Rising antivirus"
UReproPRDPrdUsb.exe"Thrustmaster Corporation Presets application - a game controller driver
XRNDc Testwf32b.exe"Added by a variant of the SDBOT WORM!"
Xrsmbrsmb.exe"Added by the WAREZOV.C WORM!"
USBSB.exeAcer Soft Button on Acer Tablet PCs
Xscains030109.Stub.exe"Delfin Media Viewer adware related"
Xservicestub.exeservicestub.exe"Added by the RBOT.CN BACKDOOR!"
XSettingsysweb.exe"Added by the SDBOT.GEN TROJAN!"
XSex Terisst01b.exe"Added by the REPAD WORM!"
USinus 1054 data WLAN ManagerWifiusb.exeWireless management utility for the T-Com Sinus 1054 Data WLAN adapter
UspamsubtractSpamSub.exeInterMute™ SpamSubtract - junk email detection and removal program. InterMute™ is now part of Trend Micro and their products are no longer supported
USpeedport W 100 Stick WLAN ManagerWifiusb.exeWireless management utility for the Speedport W 100 Stick WLAN USB stick
XSpooler Subsystemspoolsub.exe"Added by the SDBOT-ABG TROJAN!"
USpySubtractSpySub.exe"SpySubtract - multi spyware removal tool"
XSpywareBombSpywareBomb.exe"SpywareBomb rogue spyware remover - not recommended"
XSStb.exeSStb.exe" ""ServerSide"" keyword hijacker"
YSTDSBSTDSB.exe"Scrollbar driver for notebooks. If taken out of the Startup
NStreamload DownloaderSlDB.exe"Downloader for MediaMax (was Streamload) - ""gives you a private and secure place to upload
NSubtract the AdsAdSub.exeRemoves adverts from web pages. Although useful - not required
XSursawab.exe"PurityScan adware"
Xsvchostbsvchostb.exe"Added by the SNIFFER-J TROJAN!"
Xsvtcinn20050308.a.Stub.EXE"Added by the N20050308 TROJAN!"
?Sxplogsxpstub.exe"Part of CA Unicenter Software Delivery - manage software across various systems
XSyslibSyslib.exeAdult content related downloader trojan
XSYSsfitbSYSsfitb.exe"AdShooter adware"
Xsystemsystemdb.exe"Barracuda Antivirus and Security Central rogue security software - not recommended
XSystem Information ManagerMsbb.exe"Added by the SLINBOT.YR BACKDOOR!"
XSystem Loaderapsyst19b.exe"Added by the AGOBOT-AT BACKDOOR!"
Xsystembsystemb.exe"Added by a variant of the IRCBOT TROJAN!"
XSystemFTPVSENMB.exe"Malware (ie
UT-Com WLAN ManagerTS154USB.exeWireless management utility for the T-Com Sinus 154 Data II WLAN adapter
Xthis freebbb.exe"Added by the VB-DZG TROJAN!"
UTransparentTransparentB.exe"Utility to turn desktop icon text backgrounds transparent. The last letter defines the icon text color: D= as desktop
UTurboHddUsbTurboHddUsb.exe"LaCie USB Boost or PQI TurboHDD advanced driver for their range of USB hard disks which increases USB performance by up to 53%. Not required unless you use a supported external drive frequently"
Xtvs_btvs_b.exe"BroadcastPC adware"
Xudjudwqsybqnub.exe"Added by the SILLYFDC-AH WORM!"
XUPSUtlweb.exe"CoolWebSearch parasite variant"
?UsbUsb.exe"HP related - not sure whether it's required"
XUSB Devicewin32usb.exe"Added by the FORBOT-BQ WORM!"
UUsbBoostTurboHddUsb.exe"LaCie USB Boost advanced driver for their range of USB hard disks which increases USB performance by up to 33%. Not required unless you use a supported external drive frequently"
UViOrbViOrb.exe"ViOrb (Vista Start Button for XP) adds a Vista style Start Button for Windows XP users and can be loaded at boot time or started manually"
XViRsLabViRsLab.exe"VirusResponse Lab 2009 rogue security software - not recommended"
Xvmcleanergxlib.exe"Added by the SMALL-HS TROJAN!"
Xvmlibvmlib.exe"Added by the LOWZONE-AQ TROJAN!"
Xvmlibvmlib.exe"Malware installed by different rogue security software including SpyKillerPro. Also detected as the LOWZONE-AQ TROJAN!"
Xvmtunergclib.exe"Hijacker - detected by Kaspersky as the SMALL.FH TROJAN!"
Xvmtunergglib.exe"Added by the QLOWZON-D TROJAN!"
XVResLabVResLab.exe"VirusResponse Lab 2009 rogue security software - not recommended"
Xwab.exewab.exe"Added by a variant of the SDBOT WORM!"
XWCESMngrspoolsb.exe"Added by the AGOBOT-QZ WORM!"
XWeb OfferezPopStub.exe"eZula TopText adware"
XWeb OfferezStub.exe"eZula TopText adware"
XWeb Offervl_ezstub.exe"eZula TopText adware"
XWeirdOnTheWebWeirdOnTheWeb.exe"WeirdOnTheWeb adware"
XWIN USB 2.0winusb.exe"Added by a variant of the RBOT WORM!"
XWin32 USB2 Driverwin32usb.exe"Added by the SPYBOT.DHV WORM!"
Xwin32gbwin32gb.exe"Added by the DLUCA-F TROJAN!"
XWin32UsrWinCab.exe"Added by the DEDMIR-A WORM!"
XWindows ConfigurationWINHUB.EXE"Added by the SPYBOT-CG WORM!"
XWindows Expresspci32b.exe"Added by the BUZUS.C TROJAN!"
XWindows FAT 32WINFAT32B.exe"Added by the SPYBOT-AGT WORM!"
XWindows Manager Update Inctgb.exe"Added by the SDBOT-ACM WORM!"
XWindows Media Player 3.6bWMPA36B.EXE"Added by the RBOT-VV WORM!"
XWindows Updatemsnwinsb.exe"Added by the RBOT-AAH WORM!"
XWindows UpdateSqltob.exe"Added by the DASHER.A WORM!"
XWindows UpdateSecretStub.exe"Added by the SRAMLER.C WORM!"
XWindows USB controlerwinusb.exe"Added by the RBOT-HR WORM!"
XWindows USB Driver SupportWindowsusb.exe"Added by a variant of the SPYBOT WORM!"
XWindows USB Hub Managerusbhub.exe"Added by the RBOT-BJX WORM!"
XWinNtBBWinntBB.exe"Added by the DULOAD.C WORM!"
Xwinshellwindll32lib.exe"Added by the BAGLE-DM WORM!"
NWksSbWksSb.exeThe Works Portfolio tool lets you collect and organize text and pictures from the Web or your favorite program. The Works Portfolio provides a location where you can store items you want to later put into a document or other file
Ywstimebwstimeb.exeUsed with NEC printers. You can disable it before printing but it re-loads itself when printing so you may as well leave it
YWUSB11B.exeWUSB11B.exeLinksys WUSB11 WLAN USB adapter
Xwuwebwuweb.exe"Added by the WUWO TROJAN!" adware
XzSearchZstb.exe"TotalVelocity zSearch parasite"
Xzzbzzb.exe"IAGold adware"
X[random name]?ttrib.exe"PurityScan adware"
X[random name]n?pdb.exe"PurityScan adware"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.