Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer


NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.


  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown

Startup Name Process Name Details
NAME_CSA"rundll32 amecsa.cpl RUN_DLL"
XAvg Antivirusicpldrvx.exe"Added by the BANKER.BYU TROJAN!"
UBluetoothAuthenticationAgent"rundll32.exe irprops.cpl
UBluetoothAuthenticationAgent"rundll32.exe bthprops.cpl
NCmaudio"Rundll32 cmicnfg.cpl CMICtrlWnd"
UCmPCIaudio"RunDll32 CMICNFG3.CPL CMICtrlWnd"
?Compaq Computer Security"Rundll32.exe SECURE32.CPL Service"
Xcpldeamon.exe"Added by the TACTSLAY.C TROJAN!"
Xcplmsgaol.exe"Added by the TACTSLAY.C TROJAN!"
Xcpls_menu.exe"Added by the TACTSLAY.C TROJAN!"
Xcplbrowse.exe"Added by the TACTSLAY.C TROJAN!"
NCplBTQ00CplBTQ00.EXERelated to EZbutton quick launcher for the Media player app that comes with certain laptops
NCPLDBL10CPLDBL10.exeRelated to EZbutton quick launcher for the Media player app that comes with certain laptops
UCPLDFL10CPLDFL10.EXEPart of the EzButton feature on some Toshiba (and maybe others) laptops which support additional buttons
XCrustydmcpl.exe"Added by the RUSTY WORM!"
XCTFMON.CPLCTFM0N.CMD"Detected by Symantec as the SILLYFDC WORM! See here"
Ueabconfg.cplEabServr.exeEasy Access Buttons control panel on Compaq laptops. Only required if you use the extra keys
YEnvyHFCPLEnMixCPL.exe"VIA Envy24 PCI Audio Controller driver"
NHD Audio Control PanelRtHDVCpl.exe"Realtek HD Audio Manager
UHDAudDeckHDAudioCPL.exe"Vista control panel for VIA Vinyl HD Audio Codecs from VIA Technologies
UIBMUltraBayHotSwapCPLLoaderIBMBAY2N.EXESupports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops
XiSecurity applet"rundll32.exe iSecurity.cplSecurityMonitor"
ULManagerCPLBCL53.EXESystem Tray icon found on Acer Travelmate laptops that allow you control access to the Internet and email buttons and other computer configurations
NMCPLaunchMCPLaunch.exe"Launcher for Message Center Plus ""which alerts you when conditions arise on your computer that require your attention"" on IBM/Lenovo ThinkCentre desktops
NMessage Center PlusMCPLaunch.exe"Launcher for Message Center Plus ""which alerts you when conditions arise on your computer that require your attention"" on IBM/Lenovo ThinkCentre desktops
XMsAudio"MsVM_STI.EXE RunDll32 cmicnfg.cpl CMICtrlWnd"
XMsconfigicpldrvx.exe"Added by the BANLOAD.BFT TROJAN!"
XNI.UGDCPL_0001_N108M0207[path to file]"Installer for the OczyszczaczKomputerza Polish rogue privacy tool - see here"
XNI.UGDCPL_0001_N122M2012[path to file]"Installer for the OczyszczaczKomputerza Polish rogue privacy tool - see here"
XNvCCCplNvCCCpl.exe"Added by the NOGATA-A TROJAN!"
UNvCpl"RUNDLL32.EXE NvCpl.dllNvStartup"
XNvCplNvCpl.EXE"Added by the YANZ.B WORM!"
XNvCpl[random filename]"Added by the AGOBOT-APJ WORM!"
XNvCplwindowsp.exe"Added by a variant of the SDBOT WORM!"
XNvCplrundl32.exe"Added by the AGOBOT-TO WORM! Note - the valid version of this entry has the command line as ""rundll32.exe NvCpl.dll
XNvCpl28Deamonmdosft.exe"Added by the SPYBOT-AD WORM!"
XNvCPL32nvcpl32.exe"Added by the AGOBOT.DAA WORM!"
XNvCpl32Deamonnvcpl.exe"Added by the SPYBOT.S WORM!"
XNvCplDm2gr32.exe"""Switch"" premium rate adult content dialler variant"
XNvCplDntcpl.exe"""Switch"" premium rate adult content dialler variant"
UNvCplDaemon"RUNDLL32.EXE NvQTwkNvCplDaemon"
UNvCplDaemon"RUNDLL32.EXE NvCpl.dllNvStartup"
XNvCplDaemonmsmsgrs.exe"Added by the DLOADER-YI TROJAN!"
XNvCplDaemonXplorer.exe"Added by the ORBINA-A WORM!"
XNvCplDaemon32anvshell32.exe"Added by the VB-XU TROJAN!"
XNvCplDeamonnvdisp.exe"Added by the PEEPVIE-I TROJAN!"
XNvCplDmnNAVSVC.EXE"Added by an unidentified VIRUS
Xnvcpllnvcpll.exe"Added by the BANCBAN-PF TROJAN!"
XNvCplScanmsc32.exe"Added by the FORBOT-DD WORM!"
XNvCplScanwinasp.exe"Added by the FORBOT.BZ WORM!"
XNvCplScannvsc32.exe"Added by the BROPIA.N WORM!"
XNvCplScankav32.exe"Added by the FORBOT-EW WORM!"
XNvCplScannetstat32.exe"Added by the SDBOT.BRL WORM!"
XNvCplScandllmanager.exe"Added by the FORBOT.R WORM!"
UPLEAPCPUCPLpleapu.exe"CPU Control Panel for the Powerleap CPU upgrade"
NRealtek HD Audio Sound Effect ManagerRTHDCPL.EXE"Realtek HD Audio Control Panel
NRemovecplRemovecpl.exeRelated to a Belkin 54Mbps Wireless Utility Control Panel applet
NRTHDCPLRTHDCPL.EXE"Realtek HD Audio Control Panel
NRtHDVCplRtHDVCpl.exe"Realtek HD Audio Manager
Xrun=ptlseq.cpl"PhoenixNet BIOS adware. See here"
Urundll32"rundll32.exe irprops.cpl
Urundll32"rundll32.exe bthprops.cpl
NRundll32 cmicnfg"Rundll32 cmicnfg.cpl CMICtrlWnd"
YRunDll32 essprops"RunDll32 essprops.cpl TaskbarIconWnd"
?SoundFusionrundll32 cwcprops.cpl"Control panel item for the Terratec DMX Xfire 1024 soundcard (Start -> Settings -> Control Panel) based upon a Cirrus Logic "SoundFusion" DSP. Does it need to run at start-up every time?"
?SoundFusion"rundll32 hercplgs.cpl BootEntryPoint"
?SoundFusion"RunDll32 cwaprops.cpl C25CrystalControlWnd"
XSystem CPL manager[random filename]"Added by the RBOT-SR WORM!"
Xsystem servicespoolcrv.cplAdded by the INSPIR.11 TROJAN!
UTweak UI"rundll32.exe tweakui.cpl tweakmeup"
UTweak UI"rundll32.exe tweakui.cpl tweaklogon"
UTweak UI 1.33 deutsch"RUNDLL32.EXE TWEAKUI.CPL TweakMeUp"
XVnCplUpdatemsdm.exe"Masssend - spam relayer. Listens on a port for the spammers to feed it a list of addresses and what to send out. More information in
UWinfast2KLoadDefault"rundll32.exe wf2kcpl.dllDllLoadDefaultSettings"
UWinFast_Gamma"Rundll32.exe wfcpl.dll DllLoadGammaRampSettings"
X[various names]NsCplTray.exe"Wareout - malware masquerading as a spyware and dialer remover"
X[various names]NSYSCPLSTR.exe"Wareout - malware masquerading as a spyware and dialer remover"
X[various names]StartCpl.exe"Wareout - malware masquerading as a spyware and dialer remover"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.