go

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	(Default)	winligom.exe	"Added by the RBOT-GAI WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKCU\Run
X	*WinLogon	[trojan path] ren time:[random number]	"Added by the VUNDO TROJAN!"
X	.Prog	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
U	AcerGoto	AcerGoto.exe	"Acer Computer ""Goto Drive"" Cold Swap Driver - a swappable second disk drive provides convenient backup of large files
X	Acroread	GoogleUpdate.exe	"Added by the AGENT-JGI TROJAN! Note - this is not the valid Google program which is normally located in %AppData%\Google\Update. This version resides in %Temp%"
X	Administrator	winlogon.exe	"Added by the RUBBLE-C WORM! Note - this is not the legitimate winlogon.exe process
X	Administrator di Dago	Dago.exe	"Added by the PUNYA-B WORM!"
U	AdsGone	Adsgone.exe	"AdsGone - pop-up stopper"
N	AeXAgentLogon	AeXAgentActivate.exe	"Altiris Agent transmits information about your machine for the purpose of asset management and deployment"
X	AntiSpyGolden	AntiSpyGolden 5.1.exe	"AntiSpyGolden rogue spyware remover - not recommended"
X	AntiSpyGolden 5.1	AntiSpyGolden 5.1.exe	"AntiSpyGolden rogue spyware remover - not recommended"
X	AntiviralGolden	AntiviralGolden.exe	"AntiviralGolden rogue security software - not recommended
X	Antivirus-Golden	Antivirus-Golden.exe	"Antivirus-Golden rogue security software - not recommended"
X	AntivirusGold	AntivirusGold.exe	"AntivirusGold rogue security software - not recommended
X	AntivirusGold 5.1	AntivirusGold 5.1.exe	"AntivirusGold rogue security software - not recommended
U	army logo	readmename.exe	"Torrent101 potentially unwanted torrent client application that installs a Browser Helper Object and displays advertisements"
X	bgoomain.exe	bgoomain.exe	"Baigoo.a malware"
X	bigoris	bigoris.exe	"Added by the DORF-AZ TROJAN!"
?	Bingo Charm	charms.exe	"Some kind of screen icon kind of like desk flag
U	Boingo Wireless Utility	Icon###XXX#X#.exe	"Starts the Boingo Wireless utility
X	BuildLab	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	cAgOu	[filename].hta	"Added by the KAKWORM WORM!"
X	ccApps	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
Y	CCDoctorLogonTesting	ccdoctor.exe	"Checks your system to make sure it's configured properly for running IBM Rational ClearCase
N	Chatango	Chatango.exe	"Chatango - ""allows people to be connected in real time through their Web browsers. Include your Chatango contact link or button when you create eBay auctions
X	Command	Gotit.exe	"Added by the TITOG WORM!"
U	Creative MediaSource Go	CTCMSGo.exe	"Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
U	Creative MediaSource Go	CTCMSGoU.exe	"Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
X	CueX44	Dago.exe	"Added by the PUNYA-B WORM!"
X	CueX44_stil_here	WINLOGON.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate winlogon.exe process
N	cursor	Screendragon_VS_Taskbar.exe	"ScreenDragon video player"
U	Customizer2000	logon.exe	"Automatic logon feature of Customizer 2000 - ""a special utility which is designed to optimize Win9x/ME performance. The program lets you explore the many hidden settings in Windows
X	dago	fault.exe	"Added by the PUNYA-A WORM!"
U	Dialgo SDK	PhoneAnswer.exe	"Dialgo Wave Modem ActiveX - ""Telephone Answering Machine for scripting your own professional call center business scripts using a voice modem. Features Caller-ID
?	DNS2GoClient	dns2goclient.exe	"DNS2Go is a Domain Name System that will make your computer accessible anytime
U	DriverMagicLogon	dmschedule.exe	"Part of DriverMagic - ""the easiest way to locate device drivers"""
X	fegoze	SVCH0ST.EXE	"Added by the GRAYBIRD.D VIRUS! Note - the filename has the digit 0 rather then the uppercase ""o"""
X	firewall 2008	logoneui.exe	"Added by the SILLYFDC WORM!"
X	Firewall auto setup	winlogon.exe	"Added by the AGENT-EDB TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
?	Flow Go TV	flogotv.exe	"??"
X	FriendlyTypeName	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	gabougool	nounina.exe	"Added by the AGENT-JVX TROJAN!"
X	Generic Host Process for Win32 Services	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	go	cvir.exe	"Added by the SILOV-A WORM!"
X	Go And Start	svdll32.exe	"Added by the RBOT.AI BACKDOOR!"
X	Go!Zilla	gozilla.exe	Download manager for resuming downloads and choosing multiple download locations. Advertising spyware
X	Go!Zilla Monster Downloads	Go.exe	Download manager for resuming downloads and choosing multiple download locations. Advertising spyware
U	GoBack	GBMenu.exe	"Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
U	GoBack	GBTray.exe	"System Tray icon access to Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
U	GoBack Polling Service	GBPoll.exe	"Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
U	GoBack Tray Icon	GBTray.exe	"Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
X	GOG	GOG.exe	"Added by the PHILIS.B VIRUS!"
X	goidr	goidr.exe	"Goidr adware"
X	GoldenAntiSpy	pgs.exe	"GoldenAntiSpy rogue security software - not recommended. A member of the AVSystemCare family"
U	Goldensoft_MndlSvr	MndlSvr.exe	"Goldensoft CD Ghost related - turns a computer into a 200X-speed CD-ROM tower. Working from the hard drive
X	Golum	services.exe	"Added by the GOLUM.A TROJAN! Note - this is not the legitimate services.exe process
X	golumm	services.exe	"Added by the DLOADER-ET TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""golumm"" subfolder"
X	good	badvir.exe	"Added by the SILOV-B WORM!"
X	google	google.exe	"Added by the RBOT-AMW WORM!"
U	Google Desktop	GoogleDesktop.exe	"Google Desktop - ""a desktop search application that provides full text search over your email
U	Google Desktop Search	GoogleDesktop.exe	"Google Desktop - ""a desktop search application that provides full text search over your email
X	Google Earth	[random filename]	"Added by the RBOT-AXK TROJAN!"
N	Google Earth Viewer	GOOGLEMAPS.EXE	"Google Earth ""combines satellite imagery
U	Google IME Autoupdater	GooglePinyinDaemon.exe	"Google Pinyin Input Method Editor (IME) - allows a user to input Chinese characters by entering the pinyin of a Chinese character (with or without tone
X	google Intrenet Explorer	google.pif	"Added by the RBOT-ARA WORM!"
U	Google Quick Search Box	GoogleQuickSearchBox.exe	"Part of Google Toolbar (from version 6 onwards) for IE. The Quick Search Box sits between the ""Start"" button and Quick Launch toolbar and ""lets you easily search both your computer and the Web from a slick-looking search box that comes up only when you need it"""
X	Google service	Googlesetup.exe	"Added by the IRCBOT-RJ WORM!"
X	Google Service FR	GO0GLEFREE.EXE	"Added by a variant of the SPYBOT WORM!"
X	google toolbar	ggtb32.exe	"Added by the AGOBOT-RR WORM!"
N	Google Update	GoogleUpdate.exe	"Update manager for the range of tools available from Google - such as the Chrome web browser and Picasa photo manager. Located in %AppData%\Google\Update"
X	Google Update	GoogleUpdate.exe	"Added by the BUZUS.DBFM TROJAN! Note - this is not the valid Google program which is normally located in %AppData%\Google\Update. This version resides in %System%"
N	Google Updater	GOOGLE~1.EXE	"Downloads and installs updates for Google applications (Google Earth
N	Google Updater	GoogleUpdater.exe	"Downloads and installs updates for Google applications (Google Earth
X	GoogleBot.exe	GoogleBot.exe	"Added by the GB TROJAN!"
N	GoogleDCClient	GoogleDCC.exe	"Google Compute Client - only present if you installed the Google Toolbar with ""Google Compute"" client active. Does complex calculations in the background when idle. If you want to turn it off go to your browser
U	GoogleDesktop	GoogleDesktop.exe	"Google Desktop - ""a desktop search application that provides full text search over your email
U	GoogleQuickSearchBox	GoogleQuickSearchBox.exe	"Part of Google Toolbar (from version 6 onwards) for IE. The Quick Search Box sits between the ""Start"" button and Quick Launch toolbar and ""lets you easily search both your computer and the Web from a slick-looking search box that comes up only when you need it"""
U	googletalk	googletalk.exe	"Google Talk ""enables you to call or send instant messages to your friends for free-anytime
U	GoogleToolbarNotifier	GoogleToolbarNotifier.exe	"Part of Google Toolbar (from version 4 onwards) for IE. ""Google Toolbar Notifier allows you to set Google as your default search engine and prevents your search settings from being changed without your consent. An icon in your system tray blinks if the Notifier identifies an attempt to change your default search engine. You can click the icon to get more details and allow the change"". There was a bug in earlier versions where disabling the option resulted in the entry still running at startup but this has now been resolved"
X	GoogleUpdater3	GoogleMapper.exe	"Added by the ROUTROBOT WORM!"
X	gotnewupdate000.exe	gotnewupdate000.exe	"Added by the FAKEAV-BGA TROJAN!"
U	GoToMyPC	g2svc.exe	"ExpertCity GoToMyPc logon - web-based remote-access solution that allows individuals and companies to register their computers online and then securely access those computers from any web browser"
U	GoTrusted	GoTrusted Secure Tunnel.exe	"""GoTrusted is the fast
X	GotSmiley	GotSmiley.exe	"GotSmiley - ad supported program that provides the user with smileys for use in emails. Not recommended. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	gouday.exe	readme.exe	"Added by the BEAGLE.C WORM!"
X	govurarope	"Rundll32.exe retasevo.dll	s"
X	HOT FIX	Gothic.exe	"Added by the SDBOT.FIR WORM!"
X	ICQ Net	winlogon.exe	"Added by variants of the NETSKY WORMS! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
X	ICQNet	winlogon.exe	"Added by the NETSKY-C WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	IEXPLORE.EXE	goot.exe	"Added by the BIFROSE-C TROJAN!"
X	Internet	winlogom.exe	"Added by a variant of the SDBOT WORM!"
X	KAVFOX	win1ogoin.exe	"Added by the GWGHOST-M TROJAN!"
U	LGODDFU	fwupdate.exe	Auto firmware update program for LG Electronics CD-ROM/DVD writer
X	LoadGolfCourses	LoadGolfCourses.exe	PlayMiniGolf.com foistware - stealth installed!
X	logg	logo_1.exe	"Added by the PWFUZZ-A WORM!"
X	Logo	[path to trojan]	"Added by the DLOADER-RH TROJAN!"
Y	Logoff	SCTUINotify.exe	"Part of Windows SteadyState
U	Logon Loader	LogonLoader.exe	"Logon Loader - customize boot & login screens"
U	Logon Loader Random	LogonLoader.exe	"Logon Loader - customize boot & login screens"
X	Logon.exe	logon.exe	"Added by the ZINS.A TROJAN!"
X	Logon	CSRSS.EXE	"Added by the BRONTOK-BH WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X	LogonAdministrator	imoet.exe	"Added by the RAHIWI.A WORM!"
X	LogonAdministrator	CSRSS.EXE	"Added by the KORRON.B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
U	LogOnHook	LogOnHook.exe	"Part of McAfee Data Backup (now Online Backup) - which ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection. The exact purpose of this entry is unknown at present but it unloads after startup"
X	Logonrepclient1	CSRSS.EXE	"Added by the BRONTOK-BT WORM and variants! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X	Logonsara	csrss.exe	"Added by the BRONTOK-BS WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
U	LogonStudio	logonstudio.exe	"WinCustomize LogonStudio - "Allows Windows XP users to edit
X	logonUiInit	Rundll32.exe rgtndz.dll	"Identified as a variant of the Trojan-Clicker.Win32.Agent.bqy malware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""rgtndz.dll"" file is found in %System%"
X	longos	WIWT.EXE	"Added by the BANKER-CD TROJAN!"
U	MBkLogOnHook	LogOnHook.exe	"Part of McAfee Data Backup (now Online Backup) - which ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection. The exact purpose of this entry is unknown at present but it unloads after startup"
U	McAfee Data Backup	LogOnHook.exe	"Part of McAfee Data Backup (now Online Backup) - which ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection. The exact purpose of this entry is unknown at present but it unloads after startup"
X	Microsof Winlog Host	wilogon32.exe	"Added by the RBOT.XC WORM!"
X	Microsoft Configoration Service	msconfigs.exe	"Added by the RBOT-ETT WORM!"
X	Microsoft ErgoPack	wserb32.exe	"Added by the RBOT-RI WORM!"
X	Microsoft Genuine Logon	msnmsg.exe	"Added by the IRCBOT-XH WORM!"
X	Microsoft Genuine Logon	svchost.exe	"Added by the SDBOT.EXT WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Intrenet Explorer	goaw.pif	"Added by the RBOT-API WORM!"
X	Microsoft Logon User Interface	logonnui.exe	"Added by the RBOT-BCC WORM!"
X	Microsoft Synchronization Manager	winlogon32.exe	"Added by the SDBOT.AEU WORM!"
X	Microsoft System Service	winIogon2.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Update Machine	wininigo.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Visual SourceSafe	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	Microsoft Windows Express	windowslogonb.exe	"Added by the SDBOT.ABOO WORM!"
X	Microsoft Windows Logon Process	winlogon.exe	"Added by the PROXYSER-R TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Windows Update Logon	win-logon.exe	"Added by a variant of the RBOT WORM!"
?	mnu	igomnu.exe	"Wanadoo broadband ISP (now rebranded as Orange) related. What does it do and is it required?"
X	Mslogon lptt01	mslogon.exe	"RapidBlaster variant (in a ""Mslogon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Mslogon ml097e	mslogon.exe	"RapidBlaster variant (in a ""Mslogon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	MSMSGNER	fgozmox.exe	"Added by the AGENT-EBJ BACKDOOR!"
X	MSMSGS	winlogon.exe	"Added by the BRONTOK-BS WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X	msn	winlogon.exe	"Added by the PROSTI.AA BACKDOOR! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Media"
X	MSWinlogon	SynCor.exe	"Added by the AGENT-FZL TROJAN!"
X	MSWinlogon	winlogon.exe	"Added by the AGENT-FZM TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	My Kazaa Gold	MyGoldKazaa.exe	"My Kazaa Gold - regarded as a scam by McAfee SiteAdvisor as you're paying for something which available for free elsewhere"
U	My-disgo	MyKey disgo.exe	"Related to disgo pro. Program will synchronize data"
X	NetLogon	userint.exe	"Added by the SDBOT-BC WORM!"
X	nvchost	winlogon.exe	"Added by the KLONE-J TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	NVIDIA Media Center Library	winlogon.exe	"Added by the AUTORUN-AZK WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Office Monitors	GoogleUpdater.exe	"Added by the RBOT-GKZ WORM! Note - this is not the updater for the popular Google tools"
X	Offices Monitorse	algose32.exe	"Added by the RBOT-GDD WORM!"
X	OKGO	winutade.exe	"Added by the BANKER-EHZ TROJAN!"
U	Oracle Web-to-Go	webtogo.exe	"""
N	Pagoo	PAGOO.EXE	"Pagoo - internet call waiting. Intercepts telephone calls like an answering machine and plays the voice message on your PC. Only required when you're on-line and via dial-up modem"
X	PaRaY_VM	winlogon.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
U	Power2GoExpress	Power2GoExpress.exe	"Power2GoExpress - all media disc burning software"
U	ProcessGovernor	processgovernor.exe	"Core engine for Process Lasso from Bitsum Technologies - ""a state-of-the-art
X	RealTimeProtector	winlogon.exe	"Added by the AUTORUN.DIB WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ï¿½ subfolder"
X	Reg Service	winslogon.exe	"Added by the AGOBOT-SC WORM!"
X	RegDone	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
U	RepliGo Assistant	RepliGoMon.exe	"Cerience RepliGo software - ""any document you have on your PC can be transferred to your mobile device"""
X	ROOT_Machine	winlogon.exe	"Added by the BANKER-FI TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\inf"
X	RPCserr32g	winlogon.exe	"Added by the RITDOOR-B WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	RPCserv32g	WINLOGON.EXE	"Added by the BOBAX.AD WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	Run Google Web Accelerator	GoogleWebAccWarden.exe	"Google Web Accelerator"
X	RUNGogoTools	LaunchAdware.exe	"GoGoTools adware"
X	RUNGogoTools	GoGoLaunch.exe	"GoGoTools adware"
X	runwinlogon	winlogon.exe	"Added by the AGENT.TQY TROJAN! Note - this is not the legitimate winlogon.exe process
X	Services Logon	services.exe	"Added by the CROWT.A WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Templates"
X	SkynetRevenge	winlogon.scr	"Added by the NETSKY.AA WORM!"
X	SmansaApp	winlogon.exe	"Added by the ROMARIO-A WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	SonudMan	WNILOGON.exe	"Added by the QQROB-DC TROJAN! Note - this is not the legitimate winlogon.exe process
X	SpyEx	Winllogo.exe	"Added by the PRSKEY-A WORM!"
U	Spyware Begone	SpywareBeGone.exe	"Spyware BeGone - spyware remover. Previously not recommended
U	Spyware Begone	freescan.exe	"Spyware BeGone - spyware remover. Previously not recommended
Y	Sr Agent	SrLogon.exe	"Related to Secure Resolutions - desktop virus protection"
X	srv	winlogon.exe	"Added by the SILLYFDC.BCA WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%\Local Settings\Application Data"
X	Startup	WinlogonStartup	Unidentified malware
X	svchost	logon.exe	"Added by the SLEGON WORM!"
U	swg	GoogleToolbarNotifier.exe	"Part of Google Toolbar (from version 4 onwards) for IE. ""Google Toolbar Notifier allows you to set Google as your default search engine and prevents your search settings from being changed without your consent. An icon in your system tray blinks if the Notifier identifies an attempt to change your default search engine. You can click the icon to get more details and allow the change"". There was a bug in earlier versions where disabling the option resulted in the entry still running at startup but this has now been resolved"
X	SymantecFilterCheck	gmilogof.exe	"Added by the BANKER-EKC TROJAN!"
X	syslogon	syslogon.exe	"Added by the SPYBOT-EP WORM!"
X	SYSTEM	wiinlogon.exe	"Added by the RBOT-AVG WORM!"
X	System Update2	winlogon.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate winlogon.exe process
?	Tango	Setup.exe	"Tango Broadband access software. Is it required?"
?	TangoManager	TangoManager.exe	"Tango Broadband access software. Is it required?"
X	Taskmgo	[path to file]	"Added by the BANCBAN-T TROJAN!"
X	TEXTCONV	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
N	Tiny Watcher Logon Time	Watcher.exe	"Tiny Watcher detects changes to your system. It will not prevent your system from being modified or corrupted. It will only tell you that something suspicious happened. Think of it as an early CAT scan against system tumors. Better to install a tool that will detect and remove bad items"
U	TLogonPath	tb2logon.exe	"Timbuktu Pro - remote desktop access software"
U	TMExLogon	TMESRV.EXE	Toshiba utility related to inserting and removing a laptop from a docking station. Not required if you don't use a docking station
X	Torjan Program	WINLOGON.EXE	"Added by the WOWCRAFT.D TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Trojan Guarder Gold Version	Trojan Guarder.exe	"TrojanGuarder rogue security software - not recommended"
?	TSBxLogon	TMESBS2.EXE	"Found on a Toshiba laptop. May be related to TMESBS?"
?	ugon	aockstrs.exe	"??"
X	Updade Windows	winlogom.exe	"Added by the TONAX-A TROJAN!"
X	update run dos	logon.exe	"Added by a variant of the SDBOT WORM!"
X	Update Run MSword	LOGON.EXE	"Added by the RBOT.TY WORM!"
X	urudjeffni	winlogon.exe	"Added by the ROMARIO-A WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	user logon	[path to worm]	"Added by the PAHATIA-A WORM!"
X	user logon	user logon.exe	"Added by the PAHATIA.A WORM!"
X	userinit	winlogon.exe	"Added by the DLOADER-TP TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	VERBATIM STORE 'N' G	verbatim store 'n' go.exe	"Loads the driver for the Verbatim Store'n'Go PRO USB Flash Drive - reportedly required only on systems running Windows 98 and Millennium"
N	Vongo Tray	Tray.exe	"System Tray access the now discontinued Vongo video-on-demand service"
X	W1N32.DLL	WINLOGON .exe	"Added by the DROPPERFL.A TROJAN!"
U	WashAndGo - Cleanup of old Backupfiles	checker.exe	"WashAndGo - temp file cleaner"
X	wblogon	ubpr01.exe	"Added by the AGENT-HFI TROJAN!"
X	wblogon	algg.exe	"Added by the AGENT.AGGI TROJAN!"
?	Webcam Go Sti Service Application	wbcgosvc.exe	"Control software for the portable Creative Webcam Go digital camera/PC web cam. What does it do and is it required?"
N	Webposition Gold 2	wpsche~1.exe	"Scheduler for Web Position Gold - utility to help optimize the position of web-sites in search engines"
X	Win32 Drivers	winlogons.exe	"Added by the FORBOT-FG WORM!"
U	Winamp to Google Talk	winamptogoogletalk.exe	"Winamp to Google Talk
X	WinAuth	winlogon.exe	"Added by the STRTPAGE.BE TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Window UDP Control Servic	winlogon.exe	"Added by the RBOT-GXN WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows ARP Detectionc	winlogon.exe	"Added by the RBOT.EAB WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Windows ARP Detectioncx	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Windows Log Agent	winlogon.exe	"Added by the KEYLOGGER.AVK TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files"
X	Windows Logon	winlogin.exe	"Added by the SPYBOT-C TROJAN!"
X	Windows Logon	winlogon.exe	"Added by the VB.HE VIRUS! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\system"
X	Windows Logon Application	WinIogon.exe	"Added by the LINKBOT.M WORM!"
X	Windows Logon Application	logon.exe	"Added by the POEBOT-J WORM!"
X	Windows Logon Application	services.exe	"Added by the CIADOOR-L TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Logon Application	win32help.exe	"Added by the DELBOT-X WORM!"
X	Windows Logon Application	winlogon.exe	"Added by the POEBOT-KW WORM! Note - this is not the legitimate winlogon.exe process
X	Windows Logon Application	winamp.exe	"Added by the POEBOT-LR WORM! Note - this is NOT the popular Winamp media player which resides in a ""Winamp"" subdirectory of the Program Files directory"
X	Windows Logon Applicationedc	winlogon.exe	"Added by the DWNLDR-HGR TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%"
X	Windows Logon Applicatonedc	winlogon.exe	"Added by the VB-EBV TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%"
X	Windows Logon Manager	logon.exe	"Added by a variant of the RBOT WORM!"
X	Windows Logon Procedure	Svchoste.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Logon Procedure	Svchosta.exe	"Added by a variant of the SPYBOT WORM!"
X	windows logon procedure	winlogonpc.exe	"Added by the WINLOGON TROJAN!"
X	Windows Logon Service	winlogon.pif	"Added by the RBOT-AOU WORM!"
X	Windows Logon Service	napi32.exe	"Added by the SPYBOT.ANDM WORM!"
X	Windows Logon Service	winlogoservice.exe	"Added by the SPYBOT.ANOO WORM!"
X	Windows mangement	winlogonn.exe	"Added by the RANDEX.FC WORM!"
X	Windows Messanger Control Center	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows modez Verifier	WindowsLogon.exe	"Added by a variant of the SDBOT WORM!"
X	Windows modez Verifier	winlogom.exe	"Added by a variant of the RBOT WORM!"
X	Windows Network Logon	npesvc.exe	"Added by the AGENT.ERZ TROJAN!"
X	Windows NT Logon Application	winlogon.scr	"Added by the RBOT-ALP WORM!"
X	Windows Services	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	WINDOWS SYSTEM	winligon.exe	"Added by the MYTOB.EP WORM!"
X	WINDOWS SYSTEM	gothica.exe	"Added by the MYTOB.HU WORM!"
X	windows update	logonuit.exe	"Added by the LEGMIR-AO TROJAN!"
X	Windows Update	winlogonEvt.exe	"Added by the VB-DXM TROJAN!"
X	Windows Update 32	winlogons.exe	"Added by the FORBOT-FI WORM!"
X	Windows Updater	svigost.exe	"Added by the RBOT-VS WORM!"
X	Windows USB Printer	unqgod.exe	"Added by the RBOT.BKC BACKDOOR!"
X	wingo	wingo.exe	"Added by the BEAGLE.AW or BEAGLE.AV WORMS!"
X	wingo	[various filenames]	"Added by the BAGLE-AU WORM!"
X	winIogom	winIogom.exe	"Added by the BANCBAN-ML TROJAN!"
X	winlogoff	winlogoff.exe	"Added by the AGOBOT-TR WORM!"
X	winlogon	winlogin.exe	"Added by the RANDEX.E WORM!"
X	winlogon	winlogon.exe	"Added by the TRODAL TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	winlogon	msreg32.exe	"Added by the SDBOT.EO WORM!"
X	winlogon	winlogon32.exe	"Added by the MASLAN.C WORM!"
X	winlogon	wpwlogon.exe	Added by an unidentified WORM or TROJAN!
X	WINLOGON	wscript.exe WINLOGON.vbs	"Added by the YSPAN.F WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""WINLOGON.vbs"" file is found in %System%"
X	Winlogon	Lsass.exe	"Added by the ALCOP-B WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	winlogon	nvchost.exe	Added by an unidentified WORM or TROJAN!
X	Winlogon	WINLOGON.EXE	"Added by the PUNYA-B WORM! Note - this is not the legitimate winlogon.exe process
X	winlogon	system.exe	Added by a variant of the DELF.CNS TROJAN!
X	winlogon	cleanmg.exe	"Added by the AGENT-ICR TROJAN!"
X	Winlogon	scssrr.exe	"Added by the AGENT-LXB TROJAN!"
X	winlogon service	urx.exe	"Added by the SPYBOT.EN WORM!"
X	Winlogon Shell	Explorer.exe svchost.exe	"Added by the KIPIS.M WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""1032"" sub-folder"
X	Winlogon.exe	N/A	"CoolWebSearch parasite variant - resets home page to an adult content site"
X	winlogon.exe	helper.exe	"Added by the FAKESPY-A TROJAN!"
X	winlogon.exe	msole32.exe	"Adware
X	winlogon32_	[path to file]	"Added by the RULAND.A WORM!"
X	WinLogonnd	winlogonnd.exe	"Added by the AGENT-NNQ TROJAN!"
X	winlogon_user	ccIsass.exe	"Added by the SILLYFDC.BBT WORM!"
X	WMAudio	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	wmplayer	vergon1885.exe	"Added by the BRONTOK-DG WORM!"
X	WNILOGON	WNILOGON.exe	"Added by the LEWOR-M TROJAN!"
X	Worms	logon.bat	"Added by the DELMP3-A WORM!"
X	WSAConfiguration	winlogon32.exe	"Added by the AGOBOT-WC WORM!"
X	xp_system	winlogon.exe	"Added by the KREPPER-G TROJAN! - a CoolWebSearch parasite variant. Note - this is not the legitimate winlogon.exe
U	You've Got Pictures Screensaver	ygpsstra.exe	AOL You've Got Pictures Screensaver
U	Yumgo's Homepage Protector V1	YumgoHomepageProtector.exe	"Yumgo's Homepage Protector"
X	zango	zango.exe	"180solutions adware"
X	Zango SiteFinder	ZangoSiteFinder.exe	"ZangoSearch adware variant"
X	Zango TvTimes	ZANGOT~1.EXE	"ZangoSearch adware"
X	ZangoOE	OEAddOn.exe	"Zango Search Assistant adware"
X	ZangoSA	ZangoSA.exe	"Zango Search Assistant adware"
X	[random name]	l?gonui.exe	"PurityScan adware"
X	[random name]	w?nlogon.exe	"PurityScan adware"
X	[various names]	winlogon32.exe	Added by an unidentified WORM or TROJAN!
X	[various names]	bingo9.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	Bogobot.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	Kargo.exe	"Wareout - malware masquerading as a spyware and dialer remover"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.