ff

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	aa bbcc dde effgghh jj	update.exe	"Added by a variant of the IRCBOT BACKDOOR!"
U	AMP WinOFF	winoff.exe	"WinOFF is "" a utility designed to shut down Windows computers automatically
U	BUFFALO Power Save Utility for HD	HDManage.exe	"Power Save utility for Buffalo backup hard discs"
Y	BufferZone	CLIENTGUI.EXE	"BufferZone from Trustware - ""is the only security software that creates a separate environment allowing you unlimited freedom to enjoy all Internet activities without the fear of external threats"""
N	cfFncEnabler.exe	cfFncEnabler.exe	"Toshiba ""Config Free"" wireless network manager on their range of laptops"
U	Clickoff	Clickoff.exe	"Clickoff automatically dismisses annoying dialog boxes"
X	Configuration Loader	wincffg.exe	"Added by the AGOBOT.A3 WORM!"
N	Corel Colleagues & Contacts Reminders	cffrem.exe	"Corel Colleagues & Contracts - all-in-one organizer for scheduling meetings
N	Corel Family & Friends reminders	CFFREM.EXE	"Corel Family & Friends - all-in-one calender
?	Coupon Offers	??	"??"
X	DfqwSfS	ffsqsd.exe	"Added by the SDBOT-SH WORM!"
X	dS35DLL	ffqca.exe	"Added by the SDBOT-KV WORM!"
U	EFI Hot Folders	hffw.exe	"""EFI Hot Folders improves productivity by simplifying the printing of PostScript and PDF files into a select
X	Etraffic	JavaRun.exe	"TopMoxie adware"
X	exploreff.exe	exploreff.exe	"Added by the FINFANSE TROJAN!"
X	ff	[path to worm]	"Added by the RBOT-XL WORM!"
X	ff	svhost32.exe	"Added by the LINEAG-AFF TROJAN!"
X	ffeqfqs	dqddss.exe	"Added by the SDBOT-SG WORM!"
X	ffeqOME	vcvsav.exe	"Added by the RANKY.AB TROJAN!"
X	ffis	ffisearch.exe	"iSearch adware"
Y	ffprsrv	ffprsrv.exe	"File and Folder Privacy - is a ""system security utility you can use to password-protect or hide your files and folders with a click of mouse. The program will always prompt to enter your access password when protection is enabled and a user is trying to access a protected file or folder"". If this entry is disabled
Y	ffprsrv.exe	ffprsrv.exe	"File and Folder Privacy - is a ""system security utility you can use to password-protect or hide your files and folders with a click of mouse. The program will always prompt to enter your access password when protection is enabled and a user is trying to access a protected file or folder"". If this entry is disabled
Y	ffpsrv	ffpsrv.exe	"File & Folder Protector - ""great easy-to-use password-protected security utility lets you password-protect certain files and folders
Y	ffpsrv.exe	ffpsrv.exe	"File & Folder Protector - ""great easy-to-use password-protected security utility lets you password-protect certain files and folders
U	FLMOFFICE4DMOUSE	moffice.exe	Mouse utility for a Labtec brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
U	FLMOFFICE4DMOUSE	mouse32a.exe	Mouse utility for a Micro Innovations brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
X	foffice	nm.exe	"Added by the DELF-CB TROJAN!"
Y	Groove Virtual Office	Groove.exe	"""Groove Virtual Office uses a peer-to-peer networking model to connect users in Groove Workspaces. In these workspaces geographically dispersed coworkers can do almost everything they could do in the same office. They can hold online meetings
U	Guardian PC Security Tools	Pfft.exe	"Boomerang Software's Guardian PC Security Tools - now rebranded as the eXtendia Security Suite"
X	he3bbcff	"rundll32.exe he3bbcff.dll	EnableRunDLL32"
Y	hffsrv	hffsrv.exe	"Hide Files & Folders - ""great easy-to-use password-protected security utility working at Windows kernel level you can use to password-protect certain files and folders
Y	hffsrv.exe	hffsrv.exe	"Hide Files & Folders - ""great easy-to-use password-protected security utility working at Windows kernel level you can use to password-protect certain files and folders
?	HP OfficeJet Series xxx Startup	HPOSTR03.EXE	"xxx represents the series number - such as 700. What does it do and it it required?"
?	HP OfficeJet Series xxx Startup	HPOstr05.exe	"xxx represents the series number - such as 700. What does it do and it it required?"
?	HPAiODevice(hp officejet g series)	hpoavn07.exe	"HP Printer related
X	icddefff	"rundll32.exe icddefff.dll	EnableRunDLL32"
?	ILO_Office_Manager	IntEdReg.exe /OFFMAN	"Intense Educational Ltd - Language Office Software. Is it required?"
X	Installed shell32.dll	Office.exe...	"Added by the LOVGATE.AO WORM!"
X	Installed shell32.dll	Office.exe	"Added by the LOVGATE.E WORM!"
X	itunesff	itunesff.exe	"Added by the EB adult premium dialer"
N	JB	Jiffybar.exe	"Get Paid As You surf" application
X	Kinofilmoff.Net	Reklamer.exe	"Added by the AGENT-NGX TROJAN!"
N	LenovoOobeOffers	LenovoOobeOffers.exe	"Displays product upgrades/offers from Lenovo on the first run of a new notebook/desktop. ""Oobe"" refers to the ""Out of box experience"""
Y	Logoff	SCTUINotify.exe	"Part of Windows SteadyState
X	M-soft Office	M-soft Office.hta	HTA file which creates an executable on the hard drive which subsequently proceeds to download files from a malware site!
X	McAfee	McAffeAv.exe	"Added by the NETSKY.AL WORM!"
X	Mcaffe Antivirus	Mcafeescn.exe	"Added by a variant of the SPYBOT WORM!"
X	MCAFFE FLD LOADER	MCAFFEFLD.EXE	"Added by the RBOT-PY WORM!"
X	Mcaffee	mcsheild.exe	"Added by the RBOT-FDP WORM!"
X	Micosoft Data Core stuff	svshosts.exe	"Added by the RBOT.FZA WORM!"
X	Micro Office	[path to trojan]	"Added by the BANCBAN-QC TROJAN!"
X	Microsoft Buffer App	msbuffer.exe	"Added by the SLINBOT.NQ BACKDOOR!"
N	Microsoft Office	osa.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
N	Microsoft Office	Msoffice.exe	Feature included with older versions of MS Office giving you access to common Office functions and optional shortcuts to Office (and other) programs. Some people prefer it but a better way is to create desktop shortcuts if you want access these features and programs quickly. Also available via Start → All Programs
X	Microsoft Office	MSMSGR.exe	"Added by the GAOBOT.BB WORM!"
N	Microsoft Office	Osa9.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
X	Microsoft Office	lserv.exe	"Added by the SDBOT.MH WORM!"
X	Microsoft Office	Microsoft Office.hta	HTA file which creates an executable on the hard drive which subsequently proceeds to download files from a malware site!
X	Microsoft Office	msoicons.exe	"Added by the RBOT-ZI WORM! - NOTE - do no confuse with the legitimate Msoicons.exe file described here. The latter wil not be listed among your startups!"
X	Microsoft Office	Nxcao.exe	"Added by the RBOT-ZE WORM!"
X	Microsoft Office	nxcxtpr.exe	"Added by the RBOT-YG WORM!"
X	Microsoft Office	svxhost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Office	msoffice32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Office	msoff.exe	"Added by the RAKER-C TROJAN!"
X	Microsoft Office	microsoft.exe	"Added by the BANKER-VF TROJAN!"
X	Microsoft Office	msvcp.exe	"Added by the AGENT-XK TROJAN!"
X	Microsoft Office	msmsgr.exe	"Added by the GAOBOT.BB WORM!"
X	Microsoft Office	mdm.exe	"Added by the IBOT-A TROJAN! Note - this is not the legitimate Machine Debug Manager (mdm.exe) process which is located in %ProgramFiles%\Common Files\Microsoft Shared\VS7Debug (98/Me/XP/Vista) or C:\WINDOWS\SYSTEM (Me only)"
U	Microsoft Office 2010	BCSSync.exe	"Part of SharePoint Server 2010 which is part of the Microsoft Office 2010 suite. ""Business Connectivity Services (BCS) uses a cache to store a copy of the external data required by the BCS solutions deployed on the Office client. A process called BCSSync.EXE runs on the client and provides automatic cache refresh and data synchronization of the entity instances."" For more information - see here"
N	Microsoft Office Fast Cache	Fastboot.exe	"Part of MS Office 95 (v7.0). According to this it improves the performance. Most likely a predecessor of MS Find Fast and can be disabled"
U	Microsoft Office Groove	GROOVE.EXE	"System Tray access to and alerts for MS Office Groove - a stand-alone product or included with the Enterprise/Ultimate versions of MS Office 2007. ""A collaboration software program that helps teams work together dynamically and effectively
X	Microsoft Office Monitor	alg2k.exe	"Added by the SDBOT-CZO WORM!"
X	Microsoft Office Monitor	aql32.exe	"Added by the RBOT-GCY TROJAN!"
N	Microsoft Office OneNote	ONENOTEM.EXE	"System Tray access to MS Office OneNote 2003 & 2007 - an electronic notebook that allows you to create free-form notes
N	Microsoft Office OneNote 2003 Quick Launch	ONENOTEM.EXE	"System Tray access to MS Office OneNote 2003 - an electronic notebook that allows you to create free-form notes
X	Microsoft Office quick launch	OSA.exe	"Added by the VBOT.A BACKDOOR! Note that OSA.exe was used in older versions of Office to launch common components to help speed up the launch but it is no longer normally used - see here. This file is located in a valid MS Office 2003 (aka Office 11) directory - %Program Files%\Microsoft Office\OFFICE11 - and may overwrite a valid file"
X	Microsoft Office Quick Launcher	iau1.exe	"Added by the DLOADR-AWD TROJAN!"
N	Microsoft Office Shortcut Bar	Msoffice.exe	Feature included with older versions of MS Office giving you access to common Office functions and optional shortcuts to Office (and other) programs. Some people prefer it but a better way is to create desktop shortcuts if you want access these features and programs quickly. Also available via Start → All Programs
X	Microsoft Office Start	winupdates.exe	"Added by the GAOBOT.BC WORM!"
N	Microsoft Office Startup	osa.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
N	Microsoft Office Startup	Osa9.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
X	Microsoft Office Studio	scvhvst.exe	"Added by the RANDEX.CST WORM!"
X	Microsoft OfficeXP	officeXP.exe	"Added by the KILLAV.MA WORM!"
X	Microsoft Special offer	infoebay.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Stuff you know	winslogin.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update Emulator	wuaddsff.exe	"Added by the RBOT-GX WORM!"
X	Microsoft Windows Update	msoffice2.exe	"Added by the RBOT-GB WORM!"
X	Microsoftf DDEs Control	soff.pif	"Added by the RBOT-AKH WORM!"
X	MS Office	Office10.exe	"Added by the VB.DT TROJAN!"
X	MS32DLL	ffqca.exe	"Added by the SDBOT-YD WORM!"
X	Msoffice	msoffice.hta	Hijacker - redirecting to Searchdot.net
X	MSOffice	services.exe	"Added by the DLOADER-EU TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in an ""MSOffice"" subfolder"
X	msoffice	msoffice.exe	"Added by the LIKASIMAL WORM!"
X	MSOffice32	msjcf.exe	"Added by the RAKER-A TROJAN!"
X	MSOfficeCfg	msocfg.exe	Premium rate adult content dialer
X	MSOfficeCfg	navchk.exe	Premium rate adult content dialer
X	MSOfficeCfg	qservice.exe	Premium rate adult content dialer
X	MSOfficeCfg	shman.exe	Premium rate adult content dialer
X	MSOfficeCfg	ssvr.exe	Premium rate adult content dialer
X	msoffwz	msoffwz.EXE	"Added by the BANCBAN-HQ TROJAN!"
X	Norton Auto-Protect	ffbaqe.exe	"Added by the SLINBOT.RF BACKDOOR! Note - this is not a valid Norton product"
X	NTSF MICROSOFT SYSTEM	fufffy.exe	"Added by the RBOT-AEL WORM!"
X	Offer Companion	offers.exe	Adware
X	Offers	offers.exe	Adware
X	Offica Monitor Secura Systeme	winxp_sp3.exe	"Added by a variant of the RBOT WORM!"
X	Office	Office.exe	"Added by the KRAIMER.12 TROJAN!"
X	Office Desktops	imag.exe	"Added by the SPYBOT.AQR WORM!"
U	Office Mail	off_mail.exe	"Office Mail from Burrotech Ltd - ""complete email solution for small/medium businesses
U	Office Mail Alerter	om_Alerter.exe	"Office Mail Alerter - ""alert Office Mail users when they receive new emails"" via a System Tray icon"
X	Office Monitor	adv32.exe	"Added by the SDBOT-CWO WORM!"
X	Office Monitor	alg32.exe	"Added by the RBOT-GMM WORM!"
X	Office Monitor	nvsvc86.exe	"Added by the IRCBOT.BVO BACKDOOR!"
X	Office Monitor Secure Systema	absecure32.exe	"Added by the RBOT.FPW WORM!"
X	Office Monitor Word Exel R	svch.exe	"Added by the DWNLDR-GWW TROJAN!"
X	Office Monitor Word Exel R	u.exe	"Added by the SDBOT-DEE WORM!"
X	Office Monitor Word Exel R	[trojan filename]	"Added by the IRCBOT-VX TROJAN!"
X	Office Monitors	GoogleUpdater.exe	"Added by the RBOT-GKZ WORM! Note - this is not the updater for the popular Google tools"
X	Office Monitorse	[path to worm]	"Added by the SDBOT-CZX WORM!"
N	Office Startup	osa.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
X	Office Startup	Exploer.exe	"Added by the GAOBOT.BV WORM! Note the different filename to the valid MS Office entries"
N	Office Startup	Osa9.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
X	Office SturtUp	osa9.exe	"Added by the CLICKER-EC TROJAN! Note - this trojan is located in %Windir% and should not be confused with the Microsoft office program
X	OfficeAgent	expIorer.exe	"Added by the TACTSLAY.A TROJAN!"
X	OfficeAgent	outIook.exe	"Added by the TACTSLAY.A TROJAN!"
X	OfficeAgent	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	OfficeAgent	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	OfficeDeamon	msorunner.exe	"Added by a variant of the TACTSLAY TROJAN!"
Y	OfficeGuard RegChecker	ogrc.exe	"Kaspersky Labs anti-virus"
X	OfficeGuardUI	svcss.exe	"Added by the DEDLER-C TROJAN!"
?	officejet 6100	hposol08.exe	Associated with a HP PSC2110 (and maybe others) all-in-one machine
U	OFFICEKB	kbdap32a.EXE	"Keyboard utility for a Micro Innovations brand keyboard. If you disable this entry you will not be able to use any of the keyboard hotkeys or other non-standard functions on the keyboard"
X	OfficeQuickAccess	OfficeHost.vbs	"Added by the PEXMOR WORM!"
X	Offices	msnmgd32.exe	"Added by the FORBOT-DV WORM!"
X	Offices Monitors	[path to worm]	"Added by the RBOT-GKO WORM!"
X	Offices Monitorse	[path to worm]	"Added by the RBOT-GKO WORM!"
X	Offices Monitorse	algose32.exe	"Added by the RBOT-GDD WORM!"
Y	OfficeScan95	pccwin97.exe	"Trend Micro antivirus OfficeScan"
Y	OfficeScanNT Monitor	pccntmon.exe	"Trend Micro OfficeScan Antivirus real-time scan monitor"
X	OfficeWord Monitor	msn32.exe	"Added by the RBOT-GUE WORM!"
X	OfficeWord Monitors	Offlce.exe	"Added by the IRCBOT.JZ TROJAN!"
X	OFFICEXP	OFFICEXP.exe	"Added by the WOOTBOT.HE WORM!"
X	Office_app	msnmrgs.exe	Added by a variant of the VBBANC-A TROJAN!
X	office_update	[path to trojan]	"Added by the DLOADER-ZB TROJAN!"
U	OfflineFileSync	OfflineFileSyn.exe	"Offline synchronization part of ZANTAZ EAS (Enterprise Archive Solution) - which ""is a secure
N	OpenOffice.org ..*	quickstart.exe	"OpenOffice.org office suite quick start (where ""..*"" is the version number)"
N	OpenOffice.org x	QUICKS~1.EXE	"Displays OpenOffice quick start applet in System tray. Right clicking on the icon allows rapid starting up of components of the OpenOffice suite. Available via Start -> Programs. Will automatically be started when any OpenOffice component is started from Start -> Programs. A resource hog (takes > 16 MB of memory). "x" represents the version number"
U	pdfFactory Dispatcher v1	fppdis1a.exe	"FinePrint pdfFactory Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory printer. Version 1.x of the software. ""pdfFactory products offer a unique approach to PDF creation that is simpler
U	pdfFactory Dispatcher v2	fppdis2a.exe	"FinePrint pdfFactory Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory printer. Version 2.x of the software. ""pdfFactory products offer a unique approach to PDF creation that is simpler
U	pdfFactory Pro Dispatcher v1	fppdis1.exe	"FinePrint pdfFactory Pro Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory PRO printer. Version 1.x of the software. ""pdfFactory products offer a unique approach to PDF creation that is simpler
U	pdfFactory Pro Dispatcher v3	fppdis3a.exe	"FinePrint pdfFactory Pro Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory Pro printer. Version 3.x of the software. ""pdfFactory products offer a unique approach to PDF creation that is simpler
X	PerfFont (Performance True Type Font)	perfont.exe	"Added by the MUTECH-E TROJAN!"
X	pgtaff	pgtaff.exe	AdRotator adware variant
?	PLFFAP	HotfixQ0306270.exe	"Prolific Technology Inc. USB Flash Disk driver - is it required in startup?"
X	pro	SpySheriff.exe	"Added by the SPYWAD-I TROJAN!"
X	Pwroff	Pwroff.exe	"Added by the GEMA TROJAN!"
X	Qffecdas	vvzxx.exe	"Added by the MULTIDRP.AA TROJAN!"
Y	QH Office 2K Check	O2KCHECK.EXE	"Quick Heal Anti-Virus MS Office documents virus checker"
X	Quick Office	activate.exe	"Added by the RANSOMLOCK.D TROJAN! Note - this infection hooks the keyboard to prevent anything except numbers from being typed and displays a Russian message requesting a valid license key"
N	Realtek HD Audio Sound Effect Manager	RTHDCPL.EXE	"Realtek HD Audio Control Panel
X	run=	msoffice.exe	"Added by the ADWARELOADER TROJAN! Note - do not confuse with the legitimate Microsoft Office file
N	SafeOFF	SafeOff.exe	Provides protection that if user accidentally presses the power switch a dialog will pop up for confirmation
X	Savasddwq	ffasd.exe	"Added by the SDBOT-SI WORM!"
X	ShowFF	ShowFF.exe	"FFToolBar adware toolbar"
N	soffice	SOFFICE.EXE	Displays StarOffice quick start applet in System tray. Right clicking on the icon allows rapid starting up of components of the StarOffice 6.0 suite. Available via Start -> Programs. Automatically started when any StarOffice 6.0 component is started from the Start -> Programs. A resource hog (it eats > 16 MB of memory).
U	SoftStuff Wallpaper Changer	softstrt.exe	"AzureBay wallpaper changer"
X	SpecialOffers	SpecialOffers.exe [ = digit]	"SpecialOffers adware"
X	SpecialOffers	SpecialOffers.exe	"SpecialOffers adware"
X	SpySheriff	SpySheriff.exe	"SpySheriff rogue spyware remover - not recommended
X	Suite	SuiteOffices.exe	"Added by the LAZAR TROJAN!"
X	svcroot	xffanl.exe	"Added by the AGENT-BMF TROJAN!"
U	Switch Off	swoff.exe	"Switch Off - tray-based system utility that can automatically perform various frequently used operations like shutdown or restart your computer
X	SysMain	buff.exe	"Added by the AGENT-ECW TROJAN!"
X	system	Microsoft Office.exe	"Added by the BANCBAN-LH TROJAN!"
X	System Buffer Application	buffer32.exe	"Added by the SDBOT-UD WORM!"
X	System Efficiency Monitor	mscedit32.exe	"Added by the SDBOT.P TROJAN!"
X	System Efficiency Monitor	mscommand.exe	"Added by the KWBOT.P WORM!"
X	System Efficiency Monitor	msedit32.exe	"Added by the STEPH-B WORM!"
X	System Efficiency Monitor	svchostx.exe	"Added by the KWBOT.E WORM!"
X	System Update Application	msbuffer.exe	"Added by the SDBOT.AFF WORM!"
U	SystemWizard Sniffer	Sniffer.exe	"SystemWizard for Win98/ME from SystemSoft - diagnoses and solves hardware and software problems on a PC"
Y	Taskbar Shuffle	taskbarshuffle.exe	"""Taskbar Shuffle is a simple
Y	taskbarshuffle	taskbarshuffle.exe	"""Taskbar Shuffle is a simple
?	TAudEffect	TAudEff.exe	"TOSHIBA Notebook related. What does it do and is it required?"
N	TCAUDIAG -off	tcaudiag.exe	3Com NIC Installation/Diagnostic MFC application. Diagnostics may be run from the Start -> Programs
?	TDspOff	Tdspoff.exe	"Found on a Toshiba laptop"
N	TGPro Office	IdxOffice.exe	"With IdiomaX Office Translator ""you can translate documents directly from your favorite text editor (Microsoft Word
Y	TrendMicro OfficeScan NT	TMLISTEN.EXE	Virus scanner
X	urudjeffni	winlogon.exe	"Added by the ROMARIO-A WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	VirusEffaceur	pgs.exe	"VirusEffaceur
N	Wbiff	Wbiff.exe	"Wbiff! E-mail checker - automatically checks your e-mail and notifies you if any new e-mail has been received"
X	Web Offer	ezPopStub.exe	"eZula TopText adware"
X	Web Offer	ezStub.exe	"eZula TopText adware"
X	Web Offer	EZSTUB22.EXE	"eZula TopText adware"
X	Web Offer	vl_ezstub.exe	"eZula TopText adware"
X	Windows Offical Netvvorks	mywriter32.exe	"Added by a variant of the SDBOT WORM! See here"
X	Windows Office Monitor	emdm.exe	"Added by the RBOT.AFV BACKDOOR!"
X	Windows Proffesional Security	WinSecure32.exe	"Added by the AGOBOT.VA WORM"
X	Windows Reg Services	ffservice.exe	"Added by the DLOADER-PL or DLOADER-XM TROJANS!"
X	Windows Serv Patch	Mcaffe2005.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update Controller	mwoffice.exe	"Added by the BATTRY-A TROJAN!"
X	winlogoff	winlogoff.exe	"Added by the AGOBOT-TR WORM!"
N	WordPerfect Office 1215	Registration.exe	"Corel WordPerfect Office 12 registration wizard"
X	[various names]	stuffmon.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	{2F-FF-F4-4C-ZN}	omdsregk.exe	"ZenoSearch adware"
X	{C599792D-C6D9-461d-93CA-B48BFF8E37B1}	sysfdyev.exe	"Added by the FAKEALERT-AM TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.