boo

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X		regedit.exe /s appboost.reg	"Added by the APPIX.D WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run and HKCU\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank. The Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file ""appboost.reg"" is located in %Windir%"
X	0_AVD32	xzboot.exe	"Added by the AGENT-IWI TROJAN!"
U	AcerNotebookManager	almxptray.exe	System Tray access on some Acer Notebooks to give faster access to system settings
U	Adaware Bootup	Ad-aware.exe	"Ad-Aware from Lavasoft - popular spyware/adware removal tool"
N	Alias SketchBook Snapshot	ALIASS~2.EXE	Screen-capture utility for Alias Sketchbook
U	Auslogics BoostSpeed	boostspeed.exe	"System Tray access to Auslogics BoostSpeed system optimization utility - which allows you to ""Start programs faster. Speed up computer start time. Increase Internet speed
U	Auslogics BoostSpeed 4	boostspeed.exe	"System Tray access to Auslogics BoostSpeed 4 system optimization utility - which ""Start programs faster. Speed up computer start time. Increase Internet speed
U	Belkin F5D8013 N Wireless Notebook Card Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8013 N Wireless Notebook Card"
U	Belkin Wireless G Notebook Card Client Utility	Belkinwcui.exe	Wireless configuration utility for the Belkin F5D701F Wireless G Notebook Card
X	boo	boo.exe	"Adware downloader - detected by Kaspersky as the FAVADD.O TROJAN!"
X	BookedSpace	"RunDLL32.EXE bs2.dll	DllRun"
U	Bookmark	bookmark.exe	"System Tray access to Power Favorites by Desksware - which ""is a bookmark manager for Windows that helps you organize and synchronize your bookmarks. It takes bookmarks from Internet Explorer
U	Bookmark.exe	bookmark.exe	"System Tray access to Power Favorites by Desksware - which ""is a bookmark manager for Windows that helps you organize and synchronize your bookmarks. It takes bookmarks from Internet Explorer
N	BookmarkCentral	BMLauncher.exe	"Bookmark Express - "offers a more flexible way to manage Web site bookmarks
N	BookMarkSink	syncit.exe	Bookmark synchronization utility
N	BookMarkSync	syncit.exe	"Sync2IT BookMarkSync - ""real-time automatic synchronization service that allows you to access your bookmarks
N	BookMarkSync2It	sync2it.exe	"Sync2IT BookMarkSync - ""real-time automatic synchronization service that allows you to access your bookmarks
U	Boost XP Service	bxservice.exe	"Boost XP from Systweak - WinXP tweaking utility"
U	BoostSpeed	boostspeed.exe	"System Tray access to Auslogics BoostSpeed 4 system optimization utility - which ""Start programs faster. Speed up computer start time. Increase Internet speed
X	boot	boot.exe	"Added by the PUPPET-A TROJAN! Located in the %System%"
U	Boot	Boot.exe	"Part of Acer Empowering Technology. ""Acer ePower Management is a straightforward interface that allows users to select from pre-configured power usage profiles
X	Boot Check	bootchk.exe	"Added by the DELBOT-AB WORM!"
X	Boot Client	bootcli.exe	"Added by the IRCBOT-ACF BACKDOOR!"
X	Boot Config	bootconfig.exe	"Added by the FLOOD-EV TROJAN!"
X	Boot K	bootk.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Boot Manager	Njgal.exe	"Added by the KILO TROJAN!"
X	Boot Manager	bootmng.exe	"Added by a variant of the SPYBOT WORM!"
X	Boot Server	bootserver.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Boot Service	bootservice.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Boot Service	bootsv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Boot Verify	bootvfy.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	BootCfg	Install.log.vbs	"Added by the YPSAN.D WORM!"
X	BootClean	smartdrv.exe	"Added by the LURKA-A VIRUS!"
X	BootCTRL	bootctrl.exe	Added by an unidentified WORM or TROJAN!
X	BootLoader	BootLoader.exe.vbs	"Added by the WATERWORKS WORM!"
X	bootpd.exe	bootpd.exe	"Added by the AGENT-DT TROJAN!"
?	Boots Insert Detect	InsDetect.exe	"Part of Boots Picture Suite. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
X	BootsCfg	wscript.exe [path] Date.POP.vbs	"Added by the KUULLIO WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbs	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbe	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe Install.log.vbs	"Added by the YPSAN.E WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""Install.log.vbs"" file is located in %System%"
X	bootsec	NAVSSE.exe	"Added by the FORBOT-CY WORM!"
Y	BootSkin Startup Jobs	BootSkin.exe	"Stardock BootSkin is a program that allows users to change their Windows 2000 and Windows XP boot screens"
U	BootStatus	BOOTST~1.EXE	"Visual Basic program that pops up a small window on startup telling you how many times the machine has been booted that day. Once you exit it
U	BootWarn	BootWarn.exe	"From here: ""Norton AntiVirus Boot Warning. This program is installed as a startup item when you install Norton AntiVirus
X	boot_reg	[path to file]	"Added by the BANCBAN-CA TROJAN!"
X	boot_reg	svchot.exe	"Added by the BANCBAN-BQ TROJAN!"
?	BTSETBOOTKEY	BTSetBootKey.exe	"Related to a USB Bluetooth adaptor. What does it do and is it required?"
U	CacheBoost	trayicon.exe	"CacheBoost ""optimizes the System Cache-Management of Windows XP/2000/NT and Windows .Net Servers
X	ccExecute	bootcfg1.exe	"Added by the NEMSI-B VIRUS!"
X	cfgboost	cfgboot.exe	Added by an unidentified WORM or TROJAN!
N	Clipbook Service	Clipsrv.exe	"Supports Windows XP ClipBook Viewer
X	Confg	bootconfig.exe	"Added by the VB-ERB WORM!"
N	CPQBootPerfDB	CPQBootPerfDB.EXE	See the entry for Compaq Message Server
Y	D-Link D-Link RangeBooster N DWA-140	AirNCFG.exe	"D-Link DWA-140 RangeBooster N USB adapter driver and configuration utility"
Y	D-Link RangeBooster G WDA-2320	AirPlusCFG.exe	"D-Link WDA-2320 RangeBooster G desktop adapter driver and configuration utility"
Y	D-Link RangeBooster G WUA-2340	AirPlusCFG.exe	"D-Link WUA-2340 RangeBooster G USB adapter driver and configuration utility"
X	deejay	forboo.exe	"Added by the FORBOT-AY WORM!"
X	Dll Boot Loader on Startup (do not remove this)	[various filenames]	Added by an unidentified TROJAN!
X	DNSCacheBoost	dnsping.exe	"Added by the DNSBUST-A TROJAN!"
X	Font	boot.exe	"Added by the AGENT-LZW TROJAN!"
N	HGTXPEI	FirstReboot.exe	Herucles Audio tool for the Hercules Game Theater XP soundcard. Available via Start -> Settings -> Control Panel
U	HPBootOp	HPBootOp.exe	"""HP Boot Optimizer intelligently and dynamically launches software during startup
?	hpScannerFirstBoot	scannerfb.exe	"HP scanner related"
U	IECleanAux	Ieboot6.exe	"IEClean by Kevin McAleavy - cookie manager
X	Internat Conf	bootconf.exe	"Homepage hijacker
U	Launch Ai Booster	OverClk.exe	"Included with some ASUS motherboards (such as the Maximus Extreme & Striker II Extreme)
X	Major Microsoft Windows Driver Boot loader	bpool.exe	"Added by the MYTOB.AJ WORM!"
X	MasterBoot Switch	popupkill.exe	"Added by a variant of the RBOT WORM!"
U	MemoryBoost	MemoryBoost.exe	"MemoryBoost - memory optimizing program made by Tenebril Inc. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/ME. See this article and make up your own mind"
?	mfgboot	??	"??"
X	Microsoft Bool Value	MV2.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft boot system cfg32	actboost.exe	"Added by the BROPIA.R WORM!"
N	Microsoft Office Fast Cache	Fastboot.exe	"Part of MS Office 95 (v7.0). According to this it improves the performance. Most likely a predecessor of MS Find Fast and can be disabled"
X	Microsoft Patch Update	bootini.exe	"Added by the RBOT-FMN WORM!"
X	Microsoft Security Panagers	zzoboony.exe	"Added by the RBOT-AOI WORM!"
X	Microsoft Service Boot	sboot.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows	bootini.exe	"Added by the VANEBOT-K WORM!"
X	Microsoft Word	BootSector.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
N	MimBoot	mimboot.exe	"Starts Musicmatch Jukebox at bootup - can be started manually"
U	MoodBook	mb.exe	"MoodBook is a free Windows utility that brings art to your desktop"
X	MS-DOS Boot Service	Boot32.pif	"Added by the RBOT-AMF WORM!"
X	MsBootMgr.exe	MsBootMgr.exe	"Added by the VERIFY TROJAN!"
X	MSN Booster	msnbooster.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Msn Boot	msnbootcfg.exe	"Added by the IRCBOT.BFU BACKDOOR!"
U	MultiCAM Initializer	MCamBoot.exe	"The MultiCAM Initializer is part of the MultiCAM software package provided by Vista Imaging in order to run up to 10 USB ViCAM or 3Com Home Connect PC Digital cameras on a single computer. Clears itself from memory once initialized but can also be safely disabled"
U	Notebook Maximizer	maximizer_startup.exe	Toshiba Notebook Maximizer software - adjust settings to save battery power and increase efficiency
U	NotebookHardwareControl	nhc.exe	"""With Notebook Hardware Control you can easily control the hardware components of your Notebook"""
?	NotebookManager	nbm.exe	"Associated with Acer notebook PCs. What does it do and is it required?"
?	NWEReboot	dummy.exe	"??"
X	OS Boot Configuration	bootconfig.exe	"Added by the IRCBOT.HJ WORM!"
X	OS Boot Configuration!	bootconf.exe	"CoolWebSearch BootConf adware"
X	OS Boot Load	bootload.exe	"Added by a variant of the IRCBOT TROJAN!"
U	Pando Media Booster	PMB.exe	"Pando Media Booster from Pando Networks
U	PC Booster	pcbooster.exe	"PC Booster from inKline Global - ""easy-to-use computer system optimizer that gives your system the extra speed and stability you want while ensuring that your computer is kept clean and in tip-top condition"""
U	PcBoost	PcBoost.exe	"PCBoost from PGWARE
N	Picaboo	PicabooMain.exe	"Picaboo - ""Easily create stunning photo books and cards with your digital photos"""
X	PostBootReminder	[random filename]	Added by and unidentified WORM or TROJAN!
U	QuickBooks Database Server Manager	QBServerUtilityMgr.exe	"Part of QuickBooks Pro/Premier from Intuit - ""QuickBooks Database Server Manager is a utility that allows you to configure the QuickBooks Server for multi-user access."" See here for further information"
N	QuickBooks Delivery Agent	QBDAGENT.EXE	As far QAGENT but for QuickBooks. Can also have the version number in the name
N	Quickbooks Update Agent	qbupdate.exe	Associated with Intuit's Quickbooks but not required. Possibly to do with the payroll update service but you're prompted to check for updates when appropriate whether this is running or not
U	RadBoot	RadBoot.exe	RadLinker - tweaker/linker for ATI Radeon based graphics cards. It allows you easy access to per game settings
X	RamBooster2	rb.exe	"Added by the AKAK TROJAN!"
N	Reboot	Reboot.exe	MS-DOS/Win3.1 utility use to clean boot a system. Sometimes installed by default from some driver CDs for motherboards
N	RecoverFromReboo	RECOVE~1.EXE	"Part of a DSL installer package from SBC (probably SBC/Yahoo DSL). If the installation is botched
N	RecoverFromReboo	RecoverFromReboot.exe	"Part of a DSL installer package from SBC (probably SBC/Yahoo DSL). If the installation is botched
N	RecoverFromReboot	RECOVE~1.EXE	"Part of a DSL installer package from SBC (probably SBC/Yahoo DSL). If the installation is botched
N	RecoverFromReboot	RecoverFromReboot.exe	"Part of a DSL installer package from SBC (probably SBC/Yahoo DSL). If the installation is botched
X	Reg Services	Winboot32.exe	"Added by the RBOT.PB WORM!"
N	RegistryBooster	RegistryBooster.exe	"RegistryBooster registry optimizer utility from Uniblue Systems Limited - which will ""clean
?	RIS2PostReboot	LaunchRIS2.exe	"Part of the programming software for LEGO® Mindstorms robotic building system. What does it do and is it required?"
X	SBR2009F	SystemBooster2009.exe	"SystemBooster2009 rogue system suite - not recommended
X	Secboot	w32tm.exe	"Added by the HAXDOOR.D TROJAN!"
X	secboot	mszx23.exe	"Added by a variant of the HAXDOOR.BC TROJAN!"
X	secboot	vtd 16.exe	"Added by the HAXDOOR-AE TROJAN!"
U	SecurePCSolutionsBootCheck	BootCheck.exe	"1 Click Fixer PLUS from Secure PC Solutions ""takes the guesswork out of locating and solving problems in the Windows registry"""
X	SysBoot	syskernel.exe	"Added by the AUTORUN-EY WORM!"
X	sysPnP	bootconf.exe	"Homepage hijacker
X	System Boot Check	sysload3.exe	"Added by the FUBALCA WORM!"
X	System Boot Loader	sysboot32.exe	"Added by the SDBOT.PG WORM!"
X	System Config Boot	syscgboot.exe	"Added by the AGENT.VWU TROJAN!"
X	System Reboot	rebootsys.exe	"Added by the RBOT-WU WORM!"
X	SystemBooster2009	sbr_updater.exe	"SystemBooster2009 rogue system suite - not recommended
?	SystemBoot	ladies.htm	"Unknown but sounds very suspicious??"
X	SystemBoot	Mshta.exe ...filename.hta	Adult content dialler
X	SystemBoot	services.exe	"Added by the SOBER-Q TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Help\Help"
X	Systemboot	msnsngr.exe	"Added by a variant of the RBOT WORM!"
N	TypingSatellite	KBOOST.exe	"Typing Master 2002 background utility that collects typing errors and builds up customised typing lessons for your needs. Available via Start -> Programs"
N	Uniblue Registry Booster	RegistryBooster.exe	"RegistryBooster registry optimizer utility from Uniblue Systems Limited - which will ""clean
N	Uniblue RegistryBooster 2	RegistryBooster.exe	"RegistryBooster registry optimizer utility from Uniblue Systems Limited - which will ""clean
N	Uniblue RegistryBooster 2009	RegistryBooster.exe	"RegistryBooster registry optimizer utility from Uniblue Systems Limited - which will ""clean
U	UsbBoost	TurboHddUsb.exe	"LaCie USB Boost advanced driver for their range of USB hard disks which increases USB performance by up to 33%. Not required unless you use a supported external drive frequently"
X	VITAL BOOT PROCESS	taskmngr.exe	"Added by a variant of the RBOT WORM!"
X	VITAL BOOT PROCESS	taskmnsgr.exe	"Added by the Rbot-VY WORM!"
X	Vital Master-boot DLL	crsss.exe	"Added by the RBOT.ASE WORM!"
Y	VrBootScan	VRBScan.exe	"Boot scan feature of the HAURI ViRobot series of internet security products. HAURI's ViRobot engine is included in those used by VirusTotal
X	Wifi Boot	wifiboot.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Wifi Booter	wifibooter.exe	"Added by the IRCBOT.ATH BACKDOOR!"
X	winboot	winboot.exe	"Added by the BANLOAD-W TROJAN!"
X	Windows Boot	winboot.exe	"Added by the AGENT.HBD TROJAN!"
X	Windows Boot	windowsboot.exe	"Added by the IRCBOT.AZT BACKDOOR!"
X	Windows Booter	winboot.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Booter!	winbooter.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Bootup	ms-wks32.exe	"Added by the RBOT-AFM WORM!"
X	Windows Bootup	Systemwks32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Bootup	task-mngr.exe	"Added by the RBOT-AWP WORM!"
X	Windows Core Kernel Update	win32bootcfg.exe	"Added by the RANCK-EL TROJAN!"
X	Windows Host Booter	hostbooter.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Windows Update Manager	bootwiz.exe	Added by the MYBOT WORM!
X	WindowsBool	aimplg.exe	"Added by the SDBOT-CNG WORM!"
X	winservices	bootvfy.exe	Added by an unidentified WORM or TROJAN!
X	Win_BooT	[path to file]	"Added by the BANKER-GI TROJAN!"
Y	Wireless-G Notebook Adapter	Gcc.exe	LinkSys Wireless-G Notebook Adapter driver
U	Wireless-G Notebook Adapter Utility	WPC54CFG.EXE	"Utility used by the LINKSYS Wireless-G Notebook Adapter (WPC54G)"
N	WMBoot	N/A	"Associated with Logitech Wingman game controllers. Not required but what does it do?"
N	WMC_RebootCheck	unregmp2.exe	"Corrects problems with installations of Windows Media Player from version 9 onwards - see here and search for ""unregmp2.exe"""
U	xbtl	bootldr.exe	"Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
?	zzz-hpi-boot	hpi-boot.exe	"Associated with HP Photosmart printers"
X	[12 random characters]	bootvid4.exe	"IeDriver adware variant"
X	[12 random characters]	bootvid2.exe	"IeDriver adware variant"
X	[random name]	w?auboot.exe	"PurityScan adware"
X	[random name]	wuauboot.exe	"PurityScan adware. Note - do not confuse with the legitimate wuauboot.exe process which should not figure in Msconfig/Startup!"
X	_SystemBoot	services.exe	"Added by the SOBER-Q TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Help\Help"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.