ers.exe

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
U	BBC News alerts	skinkers.exe	"BBC News Desktop Alerts service - see here. Desktop alert and breaking news e-mail services let you find out about all the latest news as it happens"
X	Error Safe	ers.exe	"ErrorSafe rogue system error and cleaning utility - not recommended"
X	Error Safe Free	uers.exe	"ErrorSafe rogue system error and cleaning utility - not recommended"
X	ErrorSafe	ers.exe	"ErrorSafe rogue system error and cleaning utility - not recommended"
X	ErrorSafeFree	UERS.exe	"ErrorSafe rogue system error and cleaning utility - not recommended"
X	ERS_Check	uwasers.exe	"Part of the WinAntiSpyware 2006 and WinAntiSpyware 2007 rogue spyware removers - not recommended"
?	Execute	delfolders.exe	"??"
X	grinders	grinders.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
U	HalifaxHowardCluster	skinkers.exe	"""Howard the Weatherman"" desktop client from Halifax by Skinkers - marketing/messaging tool. Leave enabled if you want to receive messages"
X	hotefix	msnmanegers.exe	"Added by the IRCBRUTE.AS TROJAN!"
U	igfxpers	igfxpers.exe	"Installed with the graphics drivers for Intel desktop and mobile motherboard chipsets with integrated graphics. It's purpose or function isn't known at present but testing with it disabled would appear to indicate it isn't required - hence the recommended ""U"" status"
X	iisvers	iisvers.exe	Added by an unidentified TROJAN or adware
U	Intel(R) Common User Interface	igfxpers.exe	"Installed with the graphics drivers for Intel desktop and mobile motherboard chipsets with integrated graphics. It's purpose or function isn't known at present but testing with it disabled would appear to indicate it isn't required - hence the recommended ""U"" status"
X	Inters Configuration Loader	RCL0ADERS.exe	"Added by the SDBOT-KX WORM!"
N	LenovoOobeOffers	LenovoOobeOffers.exe	"Displays product upgrades/offers from Lenovo on the first run of a new notebook/desktop. ""Oobe"" refers to the ""Out of box experience"""
X	Microsoft	mixers.exe	"Added by the AGOBOT-AHU WORM!"
X	Microsoft Directx clicks	directxclickers.exe	"Added by the RBOT-GHT WORM!"
X	Microsoft media	winmplayers.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update Drivers	explorers.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update Loaders 2005	winusers.exe	"Added by the RBOT-AIQ WORM!"
X	Microsoft Windows Sound Drivers	sounddrivers.exe	"Added by the SLENFBOT.ABU WORM!"
X	MSN	msnmesengers.exe	"Added by the RBOT-ME WORM!"
X	nVidia Drivers	nVidiaDrvers.exe	"Added by the SDBOT-AFX WORM! Note - this is not related to any nVidia based motherboard or graphics card"
X	Offer Companion	offers.exe	Adware
X	Offers	offers.exe	Adware
U	Persistence	igfxpers.exe	"Installed with the graphics drivers for Intel desktop and mobile motherboard chipsets with integrated graphics. It's purpose or function isn't known at present but testing with it disabled would appear to indicate it isn't required - hence the recommended ""U"" status"
X	Popup and Advertisement Killers	adkillers.exe	"Added by the RBOT-DDH WORM!"
?	PowerS	PowerS.exe	"ProlinkTest for either their AGP graphics card or TV/FM capture card. Is it required?"
X	RegistryMonitor1	igfxpers.exe	"Added by the DELF-EZZ TROJAN! Note - this is not the legitimate Intel graphics driver which has the same filename"
X	SGPUpdater	sgpUpdaters.exe	"Fast Browser Search/Search Guard Plus parasite - installed with ""Make the Web Better"" applications such as My Web Tattoo
U	skinkers	skinkers.exe	"Selection of desktop messaging/marketing tools with celebrity tie-ins including MTV's ""Desktop Ozzy"" and Arsenal's ""Desktop Wenger"" - see here. Leave enabled if you want to receive messages"
X	SpecialOffers	SpecialOffers.exe	"SpecialOffers adware"
X	Synchronization Manager	rservers.exe	"Added by the FORBOT-FM WORM!"
X	SysDefenders	SysDefenders.exe	"SysDefenders rogue security software - not recommended
X	user	users.exe	"Added by the AUTORUN-AMK WORM!"
X	Virus-Bursters	virus-bursters.exe	"VirusBursters rogue security software - not recommended
X	VirusBursters	virusbursters.exe	"VirusBursters rogue security software - not recommended
X	Windows messenger	messengers.exe	"Added by the MYTOB.EI WORM!"
X	Windows Registry Manager	tasksmanagers.exe	"Added by the MYTOB.ER WORM!"
X	Windows Services	NetworkDrivers.exe	"Added by the SDBOT-YO WORM!"
X	Windows Services Tower	svctowers.exe	"Added by the IRCBOT.AGJ BACKDOOR!"
X	Windows Version Service	sysvers.exe	"Added by the SLENFBOT.IF WORM!"
X	WinRunners	WinDrivers.exe	"Added by the DULOAD.C WORM!"
X	Yahoo Messengger	IEXPLORERS.exe	"Added by the AUTOIT.DH TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.