bm

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	1WinCfg32	WebMailSpy.exe	"WebMailSpy spyware"
N	Access IBM Message Center	ibmmessages.exe	"""The Access IBM Message Center displays messages to inform you about helpful software that may be pre-installed on your PC. The Message Center can also provide messages about new updates available from the IBM Support Center to keep your computer current"""
N	Album Fast Start	ABMTSR.EXE	"Scanner software
X	bm	bm.exe	"Part of the AVSystemCare rogue security software and other members of this family. See here for more examples"
N	BMail Installation	FTP_back.exe	"Part of iMesh - a file sharing system. Reported by Norton AntiVirus as a trojan. Once deleted does not prevent file sharing working. Older versions of iMesh re-instate this but the newer versions do not"
X	Bman	BMan1.exe	Abcsearch.com/DealHelper adware variant
U	BMMGAG	"RunDll32 [path] pwrmonit.dll	StartPwrMonitor"
N	BMMLREF	BMMLREF.EXE	"Part of the Battery MaxiMiser and Power Management Features set for some IBM/Lenovo Thinkpad notebooks. The purpose of this entry is unknown at present. It doesn't normally appear to be running if left enabled at startup and it doesn't run if the Battery MaxiMiser Wizard is open - hence the ""N"" status"
N	BMMLREF.EXE	BMMLREF.EXE	"Part of the Battery MaxiMiser and Power Management Features set for some IBM/Lenovo Thinkpad notebooks. The purpose of this entry is unknown at present. It doesn't normally appear to be running if left enabled at startup and it doesn't run if the Battery MaxiMiser Wizard is open - hence the ""N"" status"
U	BMMMONWND	"rundll32.exe [path] BatInfEx.dll	BMMAutonomicMonitor"
X	BMN	bm.exe	"Part of VirtualPCGuard
X	BMN	strpmon.exe	"Part of CleanPCTool
X	BMN	dcmon.exe	"SystemDoctor rogue security software - not recommended
U	BMO MasterCard Wallet	EWALLET.EXE	"The wallet conveniently stores billing
X	Bmonq	bmonq.exe	"Added by the CLICKER.HZ TROJAN!"
N	BMupdate	BMupdate.exe	"Related to the BookmarkCentral entry. Typically added after downloading drivers for Visioneer scanners for example
X	bmw	bmw.exe	"Added by the AGOBOT.BBV BACKDOOR!"
X	bmz	bmz.exe	"180Search adware"
N	BookmarkCentral	BMLauncher.exe	"Bookmark Express - "offers a more flexible way to manage Web site bookmarks
X	Bron-Spizaetus-cfgmktoq	bbm-qotkmgfc.exe	"Added by the BRONTOK-M WORM!"
X	Bron-Spizaetus-cfgmmnru	bbm-urnmmgfc.exe	"Added by the BRONTOK-N WORM!"
N	Buzme	Bmui.exe	"Buzme by RingCentral
X	Casdvqwa	bmqnzkg.exe	"Added by the RANDEX.BE WORM!"
U	Dell AIO Printer A920	dlbkbmgr.exe	System Tray application for the Dell Photo AIO Printer 920 that enables scan or fax functions to run directly from the printer via the buttons
U	Dell AIO Printer A940	dlbabmgr.exe	System Tray application for the Dell Photo AIO Printer 940 that enables scan or fax functions to run directly from the printer via the buttons
U	Dell AIO Printer A960	dlbfbmgr.exe	System Tray application for the Dell Photo AIO Printer 960 that enables scan or fax functions to run directly from the printer via the buttons
U	Dell Photo AIO Printer 922	dlbtbmgr.exe	System Tray application for the Dell Photo AIO Printer 922 that enables scan or fax functions to run directly from the printer via the buttons
U	Dell Photo AIO Printer 942	dlbubmgr.exe	System Tray application for the Dell Photo AIO Printer 942 that enables scan or fax functions to run directly from the printer via the buttons
X	delsubmit	"rundll32.exe advpack.dll	DelNodeRunDLL32 submit.exe"
U	DT 11Mbps WLAN USB Station	DTUSBMonitor.exe	11Mbps USB based wireless LAN connection monitor - possibly from Deutsche Telekom
X	ebmmm	ebatesmmmv.exe	"Ebates adware"
Y	GBMHome7Agent	GBMAgent.exe	"Genie Backup Manager Home 7 - backup software"
Y	GBMLite7Agent	GBMAgent.exe	"Genie Backup Manager Lite 7 - backup software"
Y	GBMPro7Agent	GBMAgent.exe	"Genie Backup Manager Pro 7 - backup software"
U	Gene USB Monitor	USBMonit.exe	Monitors USB ports for insertion of Sandisk USB flashdrives
Y	Genie USB Monitor	USBmonitor.exe	Port monitor for an external USB hard drive. Required to enable access to the drive
U	GoBack	GBMenu.exe	"Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
N	hpsjbmgr	hpsjbmgr.exe	"HP ScanJet Button Manager. It allows users of the HPScanJet scanners to indicate what the buttons on the scanner will do automatically if pushed. Not required at startup
X	ibm	ibm.exe	"Added by the LEGMIR-AH TROJAN!"
Y	IBM Client Security	certtool.exe	"Part of Client Security Software for IBM\Lenovo notebooks. If you have configured the software via the associated wizard this will need to be running if you want to mount password protected areas of the disk (created with SafeGuard PrivateDisk)
N	IBM Client Security Software	csecwiz.exe	"Setup wizard for the Client Security Software for IBM\Lenovo notebooks. This entry only runs once
X	IBM Keyboard Driver	ikeybdrv.exe	"Added by the SDBOT.IC TROJAN!"
Y	IBM Password Manager	pwmgr.exe	"Part of Client Security Software for IBM\Lenovo notebooks - IBM® Client Security Password Manager ""enables you to manage your sensitive and easy-to-forget login information
N	IBM RecordNow!	RecordNow.exe	"IBM customized version of the RecordNow! CD-writing utility from Sonic Solutions"
U	IBM ThinkPad EasyEject Support Application	EzEjMnAp.Exe	"EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
N	IBM ThinkPad EasyEject Tray Utility	EZEJTRAY.EXE	"System Tray access to the EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
N	IBM ThinkPad Tray Utility	TP98TRAY.EXE	"System Tray access to the ThinkPad Configuration utility for IBM/Lenovo ThinkPad notebooks. ""The ThinkPad Configuration utility is a control center to configure your ThinkPad hardware. With this utility
U	IBM ThinkPad Utility	NPDTray.exe	System Tray access to Presentation Director for IBM/Lenovo Thinkpad notebooks - which allows you to create and quickly select between various single and mulitple display options. Scheme selection and settings are also available via Fn+F7 key combination on some models
U	IBM TrackPoint Accessibility Features	tp4ex.exe	"Supports accessibility features for the TrackPoint stick and associated buttons on IBM/Lenovo ThinkPad notebooks. If features such as ""Click Sound""
?	IBM Warranty Notification	ERTS0749.exe	"IBM Warranty Notification - presumably it's a reminder to either register or that warranty is about to expire?"
N	ibmmessages	ibmmessages.exe	"""The Access IBM Message Center displays messages to inform you about helpful software that may be pre-installed on your PC. The Message Center can also provide messages about new updates available from the IBM Support Center to keep your computer current"""
?	Ibmmon.exe	Ibmmon.exe	"??"
U	Ibmpmsvc	ibmpmsvc.exe	"Power management driver for IBM laptops. Provides support for the use of four keys on the thinkpad keyboard with blue key tops - Fn
?	IBMPRC	ibmprc.exe	IBM application - what does it do and is it required?
U	IBMUltraBayHotSwapCPLLoader	IBMBAY2N.EXE	Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops
?	IBMUltraBayHotSwapSound	IBMBAYSN.EXE	"Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops. Is it needed though - does it just play a sound?"
Y	IBM_PWMGR	pwmgr.exe	"Part of Client Security Software for IBM\Lenovo notebooks - IBM® Client Security Password Manager ""enables you to manage your sensitive and easy-to-forget login information
U	IBWin Monitor	IBMonitor.exe	"IBackup for Windows"
U	ISBMgr.exe	ISBMgr.exe	Related to Sony ISB Utility
U	Lexmark 1200 Series	lxczbmgr.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark 1200 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	Lexmark 2200 Series	lxbvbmgr.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark 2200 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	Lexmark 3100 Series	lxbrbmgr.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark 3100 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	Lexmark 4200 Series	lxbmbmgr.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark 4200 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	Lexmark 5200 series	lxbtbmgr.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark 5200 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	Lexmark X1100 Series	lxbkbmgr.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X1100 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	Lexmark X5100 Series	lxbabmgr.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X5100 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	Lexmark X6100 Series	lxbfbmgr.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X6100 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	Lexmark X74-X75	lxbbbmgr.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X74-X75 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	LWBMOUSE	lwbwheel.exe	Mouse driver - required if you use non-standard Windows driver features
U	LWBMOUSE	MOUSE32A.EXE	Mouse utility for a Lenovo brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
?	LXbbmgr	LXbbmgr.exe	"Lexmark printer button manager? Is it required?"
U	lxbrbmgr	lxbrbmgr.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark 3100 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	MBM 4	MBM4.exe	Motherboard Monitor 4 - only needed if you overclock your system and want to keep a check on system temperatures/voltages/etc. Available via Start -> Programs
U	MBM 5	MBM5.exe	"Motherboard Monitor 5 - only needed if you overclock your system and want to keep a check on system temperatures/voltages/etc. Available via Start -> Programs"
U	MBMon	"Rundll32 CTMBHA.DLL	MBMon"
X	Microsoft Update	webm.exe	"Added by the SDBOT.WK WORM!"
X	Microsoft web update	webmsn.exe	"Added by the RBOT-EMQ WORM!"
U	Mount Safe & Sound	Fbmount.exe	From McAfee VirusScan version 5.x. Creates back-up sets of critical files in a separate area of a hard drive. If you make regular back-ups it's not needed and can be painful during system start
X	MSVBVM60	MSVBVBM60.pif	"Added by the SCOLD-B WORM!"
U	Network Associates Error Reporting Service	TBMon.exe	Network Associates Error Reporting Tool - tool traps errors and requests submission to NAI for the purpose of betatesting new software
N	NkbMonitor.exe	NkbMonitor.exe	"Part of Nikon PictureProject - image management for Nikon digital cameras"
?	NotebookManager	nbm.exe	"Associated with Acer notebook PCs. What does it do and is it required?"
X	OpenApizs	zrscbm.exe	"Added by the AGENT.RLH TROJAN!"
X	PASMonitor	pbm.exe	"PersonalAntiSpy rogue spyware remover - not recommended
U	PbAdminACAD	PbMngr5.exe	"Bluebeam PDF software printer support. Prints AutoCAD "".dwg"" to PDF"
N	pdibm	pdibm.exe	"Part of the IBM customized version of SafeGuard PrivateDisk from Utimaco - which provides secure area of hard disk where files and folders are encrypted. This entry loads the associated IBM wizard to create the initial secure area once the program has been installed and will no longer be loaded (but remains as a startup entry) once it is completed"
N	PDIBM Application	pdibm.exe	"Part of the IBM customized version of SafeGuard PrivateDisk from Utimaco - which provides secure area of hard disk where files and folders are encrypted. This entry loads the associated IBM wizard to create the initial secure area once the program has been installed and will no longer be loaded (but remains as a startup entry) once it is completed"
N	PDIBM.exe	pdibm.exe	"Part of the IBM customized version of SafeGuard PrivateDisk from Utimaco - which provides secure area of hard disk where files and folders are encrypted. This entry loads the associated IBM wizard to create the initial secure area once the program has been installed and will no longer be loaded (but remains as a startup entry) once it is completed"
?	Ptipbmf	"rundll32.exe ptipbmf.dll	SetWriteCacheMode"
U	PtiuPbmd	"Rundll32.exe ptipbm.dll	SetWriteBack"
X	Randex virus built for IRBMe	irbme.exe	"Added by the RANDEX.RH WORM!"
X	recover.bmp.exe	Rundll.exe	"Added by the ANAFTP-01 TROJAN! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	rnwabmig	rnwabmig.exe	"Added by the AGENT-LMI TROJAN!"
U	Rundll32	"Rundll32.exe ptipbm.dll	SetWriteBack"
?	rundll32	"rundll32.exe ptipbmf.dll	SetWriteCacheMode"
X	Salestart	bm.exe	"Part of the AVSystemCare rogue security software and other members of this family. See here for more examples"
X	SBMPOP	SBMPop.exe	SearchByMedia adware
N	SBMX	sbmx.exe	SoundMAX MPU401 MIDI device emulator for x86 VM DOS games/apps (for Win9x only)
X	scrbmk	[path to trojan]	"Added by the DLOADER-VP TROJAN!"
?	SetCacheMode	"rundll32.exe ptipbmf.dll	SetWriteCacheMode"
X	Shell	ibm0000.exe [ = digit]	"Added by the TORPIG-C and TORPIG-J TROJANS! Filenames spotted include ibm00001.exe
X	Shell	Explorer.exe [path] ibm[RANDOM 5 DIGIT NUMBER].exe	"Added by the ANSERIN TROJAN! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files"
X	Shell	ibm00001.dll	"Added by the TORPIG-Q TROJAN!"
X	start	sbmntr.exe	"Added by the ZLOB.MEDIA-CODEC TROJAN! This purports to be a Windows Media Player upgrade (with names such as ""iCodecPack""
X	System DB Manager	sysdbmg.exe	"Added by an unidentified WORM or TROJAN! See here"
Y	Taskbar Button Manager	tbm.exe	"Taskbar Button Manager from Innovative Solutions - ""is a simple utility that helps you arrange the buttons on your Windows taskbar in any way you want by using drag and drop"""
U	tbbMeter	tbbmeter.exe	"tbbMeter - bandwidth meter developed by thinkbroadband.com ""to help you monitor your Internet usage. It allows you to see how much your computer is sending to and receiving from the Internet in real time. It also shows you how your Internet usage varies at different times of the day"""
Y	tbm	tbm.exe	"Taskbar Button Manager from Innovative Solutions - ""is a simple utility that helps you arrange the buttons on your Windows taskbar in any way you want by using drag and drop"""
U	TotalMedia Backup Monitor	uBBMonitor.exe	"ArcSoft's TotalMedia Backup - ""Backing up your precious photos
X	updwebmin	updwebmin.exe	"Added by the BACKDOOR.GEN TROJAN!"
U	USBMMKBD	usbmmkbd.exe	USB multimedia keyboard for HP systems. Allows the use of special function keys on USB keyboards. The latest version no longer pings a server when on-line wheras the older version did but did not transmit any user information
U	USBMonit.exe	USBMonit.exe	Monitors USB ports for insertion of Sandisk USB flashdrives
X	Volume Shadow Configuration	vbmsvc.exe	"Added by the SLENFBOT.DH WORM!"
U	WD Backup Monitor	uBBMonitor.exe	"WD Backup - customized version of ArcSoft's TotalMedia Backup for Western Digital external drives (see here)"
X	WINDOWS SYSTEM DNSPOOL	hbmail.exe	"Added by the MYTOB.FW WORM!"
U	ZIBMACC	rundll.exe ZIBMACC.INF	ZIBMACC.INF is an IBM file that is only loaded and installed under a recovery operation. The file is a support file for IBM access to the system if needed. You may delete this file. This is as from IBM Technical Support (USA - 800-887-7435)
X	[random characters]	rsbmsc.exe	"Detected by AntiVir antivirus as the BDS/Agent.adt TROJAN!"
X	{DD651081-A909-45ad-BD71-2335B0ADE043}	sysabmpmfr.exe	"Added by the FAKEALERT-AH TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.