Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
X1WinCfg32WebMailSpy.exe"WebMailSpy spyware"
NAccess IBM Message Centeribmmessages.exe"""The Access IBM Message Center displays messages to inform you about helpful software that may be pre-installed on your PC. The Message Center can also provide messages about new updates available from the IBM Support Center to keep your computer current"""
NAlbum Fast StartABMTSR.EXE"Scanner software
Xbmbm.exe"Part of the AVSystemCare rogue security software and other members of this family. See here for more examples"
NBMail InstallationFTP_back.exe"Part of iMesh - a file sharing system. Reported by Norton AntiVirus as a trojan. Once deleted does not prevent file sharing working. Older versions of iMesh re-instate this but the newer versions do not"
XBmanBMan1.exeAbcsearch.com/DealHelper adware variant
UBMMGAG"RunDll32 [path] pwrmonit.dllStartPwrMonitor"
NBMMLREFBMMLREF.EXE"Part of the Battery MaxiMiser and Power Management Features set for some IBM/Lenovo Thinkpad notebooks. The purpose of this entry is unknown at present. It doesn't normally appear to be running if left enabled at startup and it doesn't run if the Battery MaxiMiser Wizard is open - hence the ""N"" status"
NBMMLREF.EXEBMMLREF.EXE"Part of the Battery MaxiMiser and Power Management Features set for some IBM/Lenovo Thinkpad notebooks. The purpose of this entry is unknown at present. It doesn't normally appear to be running if left enabled at startup and it doesn't run if the Battery MaxiMiser Wizard is open - hence the ""N"" status"
UBMMMONWND"rundll32.exe [path] BatInfEx.dllBMMAutonomicMonitor"
XBMNbm.exe"Part of VirtualPCGuard
XBMNstrpmon.exe"Part of CleanPCTool
XBMNdcmon.exe"SystemDoctor rogue security software - not recommended
UBMO MasterCard WalletEWALLET.EXE"The wallet conveniently stores billing
XBmonqbmonq.exe"Added by the CLICKER.HZ TROJAN!"
NBMupdateBMupdate.exe"Related to the BookmarkCentral entry. Typically added after downloading drivers for Visioneer scanners for example
Xbmwbmw.exe"Added by the AGOBOT.BBV BACKDOOR!"
Xbmzbmz.exe"180Search adware"
NBookmarkCentralBMLauncher.exe"Bookmark Express - "offers a more flexible way to manage Web site bookmarks
XBron-Spizaetus-cfgmktoqbbm-qotkmgfc.exe"Added by the BRONTOK-M WORM!"
XBron-Spizaetus-cfgmmnrubbm-urnmmgfc.exe"Added by the BRONTOK-N WORM!"
NBuzmeBmui.exe"Buzme by RingCentral
XCasdvqwabmqnzkg.exe"Added by the RANDEX.BE WORM!"
UDell AIO Printer A920dlbkbmgr.exeSystem Tray application for the Dell Photo AIO Printer 920 that enables scan or fax functions to run directly from the printer via the buttons
UDell AIO Printer A940dlbabmgr.exeSystem Tray application for the Dell Photo AIO Printer 940 that enables scan or fax functions to run directly from the printer via the buttons
UDell AIO Printer A960dlbfbmgr.exeSystem Tray application for the Dell Photo AIO Printer 960 that enables scan or fax functions to run directly from the printer via the buttons
UDell Photo AIO Printer 922dlbtbmgr.exeSystem Tray application for the Dell Photo AIO Printer 922 that enables scan or fax functions to run directly from the printer via the buttons
UDell Photo AIO Printer 942dlbubmgr.exeSystem Tray application for the Dell Photo AIO Printer 942 that enables scan or fax functions to run directly from the printer via the buttons
Xdelsubmit"rundll32.exe advpack.dll DelNodeRunDLL32 submit.exe"
UDT 11Mbps WLAN USB StationDTUSBMonitor.exe11Mbps USB based wireless LAN connection monitor - possibly from Deutsche Telekom
Xebmmmebatesmmmv.exe"Ebates adware"
YGBMHome7AgentGBMAgent.exe"Genie Backup Manager Home 7 - backup software"
YGBMLite7AgentGBMAgent.exe"Genie Backup Manager Lite 7 - backup software"
YGBMPro7AgentGBMAgent.exe"Genie Backup Manager Pro 7 - backup software"
UGene USB MonitorUSBMonit.exeMonitors USB ports for insertion of Sandisk USB flashdrives
YGenie USB MonitorUSBmonitor.exePort monitor for an external USB hard drive. Required to enable access to the drive
UGoBackGBMenu.exe"Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
Nhpsjbmgrhpsjbmgr.exe"HP ScanJet Button Manager. It allows users of the HPScanJet scanners to indicate what the buttons on the scanner will do automatically if pushed. Not required at startup
Xibmibm.exe"Added by the LEGMIR-AH TROJAN!"
YIBM Client Securitycerttool.exe"Part of Client Security Software for IBM\Lenovo notebooks. If you have configured the software via the associated wizard this will need to be running if you want to mount password protected areas of the disk (created with SafeGuard PrivateDisk)
NIBM Client Security Softwarecsecwiz.exe"Setup wizard for the Client Security Software for IBM\Lenovo notebooks. This entry only runs once
XIBM Keyboard Driverikeybdrv.exe"Added by the SDBOT.IC TROJAN!"
YIBM Password Managerpwmgr.exe"Part of Client Security Software for IBM\Lenovo notebooks - IBM® Client Security Password Manager ""enables you to manage your sensitive and easy-to-forget login information
NIBM RecordNow!RecordNow.exe"IBM customized version of the RecordNow! CD-writing utility from Sonic Solutions"
UIBM ThinkPad EasyEject Support ApplicationEzEjMnAp.Exe"EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
NIBM ThinkPad EasyEject Tray UtilityEZEJTRAY.EXE"System Tray access to the EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
NIBM ThinkPad Tray UtilityTP98TRAY.EXE"System Tray access to the ThinkPad Configuration utility for IBM/Lenovo ThinkPad notebooks. ""The ThinkPad Configuration utility is a control center to configure your ThinkPad hardware. With this utility
UIBM ThinkPad UtilityNPDTray.exeSystem Tray access to Presentation Director for IBM/Lenovo Thinkpad notebooks - which allows you to create and quickly select between various single and mulitple display options. Scheme selection and settings are also available via Fn+F7 key combination on some models
UIBM TrackPoint Accessibility Featurestp4ex.exe"Supports accessibility features for the TrackPoint stick and associated buttons on IBM/Lenovo ThinkPad notebooks. If features such as ""Click Sound""
?IBM Warranty NotificationERTS0749.exe"IBM Warranty Notification - presumably it's a reminder to either register or that warranty is about to expire?"
Nibmmessagesibmmessages.exe"""The Access IBM Message Center displays messages to inform you about helpful software that may be pre-installed on your PC. The Message Center can also provide messages about new updates available from the IBM Support Center to keep your computer current"""
?Ibmmon.exeIbmmon.exe"??"
UIbmpmsvcibmpmsvc.exe"Power management driver for IBM laptops. Provides support for the use of four keys on the thinkpad keyboard with blue key tops - Fn
?IBMPRCibmprc.exeIBM application - what does it do and is it required?
UIBMUltraBayHotSwapCPLLoaderIBMBAY2N.EXESupports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops
?IBMUltraBayHotSwapSoundIBMBAYSN.EXE"Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops. Is it needed though - does it just play a sound?"
YIBM_PWMGRpwmgr.exe"Part of Client Security Software for IBM\Lenovo notebooks - IBM® Client Security Password Manager ""enables you to manage your sensitive and easy-to-forget login information
UIBWin MonitorIBMonitor.exe"IBackup for Windows"
UISBMgr.exeISBMgr.exeRelated to Sony ISB Utility
ULexmark 1200 Serieslxczbmgr.exe"""Lexmark Scan & Copy Control Program"" for the Lexmark 1200 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
ULexmark 2200 Serieslxbvbmgr.exe"""Lexmark Scan & Copy Control Program"" for the Lexmark 2200 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
ULexmark 3100 Serieslxbrbmgr.exe"""Lexmark Scan & Copy Control Program"" for the Lexmark 3100 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
ULexmark 4200 Serieslxbmbmgr.exe"""Lexmark Scan & Copy Control Program"" for the Lexmark 4200 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
ULexmark 5200 serieslxbtbmgr.exe"""Lexmark Scan & Copy Control Program"" for the Lexmark 5200 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
ULexmark X1100 Serieslxbkbmgr.exe"""Lexmark Scan & Copy Control Program"" for the Lexmark X1100 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
ULexmark X5100 Serieslxbabmgr.exe"""Lexmark Scan & Copy Control Program"" for the Lexmark X5100 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
ULexmark X6100 Serieslxbfbmgr.exe"""Lexmark Scan & Copy Control Program"" for the Lexmark X6100 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
ULexmark X74-X75lxbbbmgr.exe"""Lexmark Scan & Copy Control Program"" for the Lexmark X74-X75 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
ULWBMOUSElwbwheel.exeMouse driver - required if you use non-standard Windows driver features
ULWBMOUSEMOUSE32A.EXEMouse utility for a Lenovo brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
?LXbbmgrLXbbmgr.exe"Lexmark printer button manager? Is it required?"
Ulxbrbmgrlxbrbmgr.exe"""Lexmark Scan & Copy Control Program"" for the Lexmark 3100 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
UMBM 4MBM4.exeMotherboard Monitor 4 - only needed if you overclock your system and want to keep a check on system temperatures/voltages/etc. Available via Start -> Programs
UMBM 5MBM5.exe"Motherboard Monitor 5 - only needed if you overclock your system and want to keep a check on system temperatures/voltages/etc. Available via Start -> Programs"
UMBMon"Rundll32 CTMBHA.DLLMBMon"
XMicrosoft Updatewebm.exe"Added by the SDBOT.WK WORM!"
XMicrosoft web updatewebmsn.exe"Added by the RBOT-EMQ WORM!"
UMount Safe & SoundFbmount.exeFrom McAfee VirusScan version 5.x. Creates back-up sets of critical files in a separate area of a hard drive. If you make regular back-ups it's not needed and can be painful during system start
XMSVBVM60MSVBVBM60.pif"Added by the SCOLD-B WORM!"
UNetwork Associates Error Reporting ServiceTBMon.exeNetwork Associates Error Reporting Tool - tool traps errors and requests submission to NAI for the purpose of betatesting new software
NNkbMonitor.exeNkbMonitor.exe"Part of Nikon PictureProject - image management for Nikon digital cameras"
?NotebookManagernbm.exe"Associated with Acer notebook PCs. What does it do and is it required?"
XOpenApizszrscbm.exe"Added by the AGENT.RLH TROJAN!"
XPASMonitorpbm.exe"PersonalAntiSpy rogue spyware remover - not recommended
UPbAdminACADPbMngr5.exe"Bluebeam PDF software printer support. Prints AutoCAD "".dwg"" to PDF"
Npdibmpdibm.exe"Part of the IBM customized version of SafeGuard PrivateDisk from Utimaco - which provides secure area of hard disk where files and folders are encrypted. This entry loads the associated IBM wizard to create the initial secure area once the program has been installed and will no longer be loaded (but remains as a startup entry) once it is completed"
NPDIBM Applicationpdibm.exe"Part of the IBM customized version of SafeGuard PrivateDisk from Utimaco - which provides secure area of hard disk where files and folders are encrypted. This entry loads the associated IBM wizard to create the initial secure area once the program has been installed and will no longer be loaded (but remains as a startup entry) once it is completed"
NPDIBM.exepdibm.exe"Part of the IBM customized version of SafeGuard PrivateDisk from Utimaco - which provides secure area of hard disk where files and folders are encrypted. This entry loads the associated IBM wizard to create the initial secure area once the program has been installed and will no longer be loaded (but remains as a startup entry) once it is completed"
?Ptipbmf"rundll32.exe ptipbmf.dll SetWriteCacheMode"
UPtiuPbmd"Rundll32.exe ptipbm.dll SetWriteBack"
XRandex virus built for IRBMeirbme.exe"Added by the RANDEX.RH WORM!"
Xrecover.bmp.exeRundll.exe"Added by the ANAFTP-01 TROJAN! Note - this is NOT the Win9x/Me system file of the same name as described here"
Xrnwabmigrnwabmig.exe"Added by the AGENT-LMI TROJAN!"
URundll32"Rundll32.exe ptipbm.dll SetWriteBack"
?rundll32"rundll32.exe ptipbmf.dll SetWriteCacheMode"
XSalestartbm.exe"Part of the AVSystemCare rogue security software and other members of this family. See here for more examples"
XSBMPOPSBMPop.exeSearchByMedia adware
NSBMXsbmx.exeSoundMAX MPU401 MIDI device emulator for x86 VM DOS games/apps (for Win9x only)
Xscrbmk[path to trojan]"Added by the DLOADER-VP TROJAN!"
?SetCacheMode"rundll32.exe ptipbmf.dll SetWriteCacheMode"
XShellibm0000*.exe [* = digit]"Added by the TORPIG-C and TORPIG-J TROJANS! Filenames spotted include ibm00001.exe
XShellExplorer.exe [path] ibm[RANDOM 5 DIGIT NUMBER].exe"Added by the ANSERIN TROJAN! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files"
XShellibm00001.dll"Added by the TORPIG-Q TROJAN!"
Xstartsbmntr.exe"Added by the ZLOB.MEDIA-CODEC TROJAN! This purports to be a Windows Media Player upgrade (with names such as ""iCodecPack""
XSystem DB Managersysdbmg.exe"Added by an unidentified WORM or TROJAN! See here"
YTaskbar Button Managertbm.exe"Taskbar Button Manager from Innovative Solutions - ""is a simple utility that helps you arrange the buttons on your Windows taskbar in any way you want by using drag and drop"""
UtbbMetertbbmeter.exe"tbbMeter - bandwidth meter developed by thinkbroadband.com ""to help you monitor your Internet usage. It allows you to see how much your computer is sending to and receiving from the Internet in real time. It also shows you how your Internet usage varies at different times of the day"""
Ytbmtbm.exe"Taskbar Button Manager from Innovative Solutions - ""is a simple utility that helps you arrange the buttons on your Windows taskbar in any way you want by using drag and drop"""
UTotalMedia Backup MonitoruBBMonitor.exe"ArcSoft's TotalMedia Backup - ""Backing up your precious photos
Xupdwebminupdwebmin.exe"Added by the BACKDOOR.GEN TROJAN!"
UUSBMMKBDusbmmkbd.exeUSB multimedia keyboard for HP systems. Allows the use of special function keys on USB keyboards. The latest version no longer pings a server when on-line wheras the older version did but did not transmit any user information
UUSBMonit.exeUSBMonit.exeMonitors USB ports for insertion of Sandisk USB flashdrives
XVolume Shadow Configurationvbmsvc.exe"Added by the SLENFBOT.DH WORM!"
UWD Backup MonitoruBBMonitor.exe"WD Backup - customized version of ArcSoft's TotalMedia Backup for Western Digital external drives (see here)"
XWINDOWS SYSTEM DNSPOOLhbmail.exe"Added by the MYTOB.FW WORM!"
UZIBMACCrundll.exe ZIBMACC.INFZIBMACC.INF is an IBM file that is only loaded and installed under a recovery operation. The file is a support file for IBM access to the system if needed. You may delete this file. This is as from IBM Technical Support (USA - 800-887-7435)
X[random characters]rsbmsc.exe"Detected by AntiVir antivirus as the BDS/Agent.adt TROJAN!"
X{DD651081-A909-45ad-BD71-2335B0ADE043}sysabmpmfr.exe"Added by the FAKEALERT-AH TROJAN!"


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.