hk

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
U	000StTHK	000StTHK.exe	"Toshiba Hot key functionality for the function keys (Fn-Esc
X	AdobeReaderPro	chkdisk.exe	"Added by the RBOT-BDV WORM!"
X	Advanced Tool Checks	advchks.exe	"Added by a variant of the RBOT WORM!"
N	Advanced Tools Check	ADVCHK.EXE	Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget
N	ADVCHK	ADVCHK.EXE	Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget
X	algchk.exe	algchk.exe	"Detected by Kaspersky as the VB.ATE TROJAN!"
X	Antivirus Updates	avupdchk.exe	"Added by the AGOBOT-IP WORM!"
U	AsioThk32Reg	rregsvr32.exe ctasio.dll	"ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality"
U	atchk	atchk.exe	"AMT Status Message from Intel. Users can manage this
X	autochk	"rundll32.exe autochk.dll	_IWMPEvents@16"
X	autochk	"rundll32.exe protect.dll	_IWMPEvents@16"
U	AutoMate5	Am5HkWnd.exe	"""Automate is the Leading Software for Automation of front and back-office business processes.It provides all the tools necessary to completely automate business processes
?	BisonHK	BisonHK.exe	"Related to a Bison webcam - which is used on notebooks from a number of manufacturers including Acer
X	Boot Check	bootchk.exe	"Added by the DELBOT-AB WORM!"
X	Cabchk	Cabchk.exe	"Added by the GEMA TROJAN!"
X	Cabchk32	Cabchk32.exe	"Added by the GEMA TROJAN!"
X	ChansonsMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Chckup	Netverchk.exe	"Covert Sys Exec malware variant"
U	CheckDialer	ChkDial.exe	"Added by the CheckDialer modem connection monitoring tool"
X	CHK Disker	chkdsker.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	CHK NT	chkntf.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
N	CHKADMIN	CHKADMIN.EXE	"Compaq Network Management System. When running
X	ChkDisk	chk_disk.exe	Added by an unidentified WORM or TROJAN!
X	chkdrv	iemon.exe	"Detected by Symantec as the ADCLICKER TROJAN!"
X	chkdsk	autoexec.bat	"Added by the ANPES WORM!"
U	ChkMail	ChkMail.exe	Mail-checking program supplied with Acer notebooks
U	ConfigSafe	AUTOCHK.EXE	"ConfigSafe - lets you identify changes to the registry
X	ContentDownload	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	CoolDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	CoolMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
Y	CSAV_CheckViruses	vchk.exe	"Command Antivirus related"
?	Cwcdschk.exe	Cwcdschk.exe	"IBM Thinkpad related?"
N	Cyber	cyberchk.exe	"Part of Belkins ""Multimedia Cleaning Kit"" and is automatically installed when you run their optical disk drive cleaning utility - to remind you to clean your drive after ""x"" amount of time has passed"
?	CYNHKey	CYNHKey.exe	"??"
N	DataCaching	FlashKsk.exe	"SmartMedia Card management from the installation of a SanDisk reader for a camera's SmartMedia card and also adds the "Unplug and Eject Hardware" System Tray icon"
X	DescargaBromas	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	DesktopUpdate	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Dialer	"rundll32.exe MSA32CHK.dll	Reg"
X	Disk Check	chkdsk32.exe	"Added by the IM TROJAN!"
X	DownloadLegalMusic	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	DownloadMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	DownloadsAndMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	EntraOcio	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	EventApplicationCmd	smschk.exe	"Added by the IRCBOT-AO TROJAN!"
X	FastDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	FileManager32	Wscript.exe ChkMgr32.vbs	"Added by the NOTUP.A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""ChkMgr32.vbs"" file is located in %System%"
X	FreeMP3download	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	GetitAll	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	GetMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	GetTheMusic	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	GreatDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	HighKey1	HighKey1.exe	"Detected by AVG as GENERIC12.LHE - see here"
U	hk	hk.exe	"KeyLoggerExp keystroke logger/monitoring program - remove unless you installed it yourself!"
U	hkcmd	hkcmd.exe	"Hot Key handler for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
X	HKCU	server.exe	"Added by the AGENT-NLT TROJAN!"
X	HKEYok	runlli32.exe	"Added by the QQPASS-U TROJAN!"
X	HKLM	server.exe	"Added by the AGENT-NLT TROJAN!"
X	HKLMRun	windowsupdate.exe	"Added by the FORBOT-BJ WORM (where HKLM\Run represents HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run)!"
X	HKLM\Run	svhost.exe	"Added by the FORBOT-AO BACKDOOR (where HKLM\\Run represents HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run)!"
U	hkserv	HKserv.exe	Keyboard manager program required to use programmable power and function keys on some laptops such as the Sony PCG R505TS
U	hkss	hkss.exe	Compaq HotKey Support - multimedia keyboard support
U	Hook99startup	hk2re.exe	""Hook99 enables the user to customize the start button. You can change or remove the text and replace the Windows flag on button with icon of your choice. Supports Windows icons
U	HotKeysCmds	hkcmd.exe	"Hot Key handler for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
U	igfxhkcmd	hkcmd.exe	"Hot Key handler for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
N	InControl Desktop Manager	DMHKEY.EXE	For Diamond Multimedia video cards. Allows System Tray access to desktop utilities such as screen resolution. Available via Start -> Programs
X	InetChk	ms[random value].exe	"Added by the AGENT-IRL TROJAN!"
U	Intel(R) Common User Interface	hkcmd.exe	"Hot Key handler for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
X	johkjh	srvd.exe	"Added by a variant of the SLAPER TROJAN!"
X	KernelFaultChk	sms.exe	"Added by the DEADHAT WORM! Do not confuse with the valid ""kernelfaultcheck"" which runs ""dumprep 0 -k"" or ""dumprep 0 -u"""
U	ledpointer	CNYHKey.exe	Chicony Electronics Multimedia Keyboard Hotkey Driver
X	LosMejoresMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	LotsOfGames	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	LotsOfJokes	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	LPMailChecker	LPMLCHK.exe	"Part of Lenovo's ThinkVantage® Productivity Center on their ThinkPad notebooks or ThinkCentre desktops. Checks for incoming e-mail and blinks the ThinkVantage button LED"
X	MainDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Microsoft DLL Verifier	chkfile.exe	"Added by the RBOT-AOC WORM!"
X	Microsoft Secure Messenger.NET Service	securitychk.exe	"Added by the SDBOT.VT WORM!"
X	miniport	usb2chk.exe	"Added by the LAZAR-A TROJAN!"
?	MMHK	mmhk.exe	"A driver found on a Compaq Presario 800T notebook. Possibly something to do with multimedia hot keys?"
X	MoreContent	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3Collection	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3download	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3files	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3freeDownload	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3freeDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3nice	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3Themes	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3ToTheMax	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	mschkdf.exe	mschkdf.exe	"Added by a variant of the SDBOT WORM!"
X	MSOfficeCfg	navchk.exe	Premium rate adult content dialer
X	NAVCheck	navchk.exe	Premium rate adult content dialer
N	Netline User	netchk.exe	"Netline supplies internet related products and services and this program identifies user ID and IP information. Found installed along with the Falcon 4 game
X	NewDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	NewMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	NiceDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	NiceMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	NT Printing Service	chkdsks.exe	"Added by the ARCHIVARIUS series of WORMS!"
X	NT Printing Service	chkdskss.exe	"Added by the ARCHIVARIUS series of WORMS!"
X	NT Printing Services	chkdsks.exe	"Added by the BUZUS-M TROJAN!"
X	NumberOneMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	P3p4chk	P3p4chk.exe	"Added by the GEMA TROJAN!"
U	Panasonic HotKey Manager	HKEYAPP.EXE	HotKey management for Panasonic rugged mobile PCs
N	Pe2ckfnt SE	chkfont.exe	"Used to check whether the fonts are installed properly on your computer or not for a scanner. If you don't want to execute it
U	PiDunHK	PIDUNHK.EXE	"Part of the Prodigy Internet software - part of the dialer/DUN. Presumably needed for users of that service otherwise you may not be able to connect
U	Pnpchk	Pnpchk.exe	"Aztech Labs Sound 3 PnP driver"
X	ProtocolDiskChk	ssrms.exe	"Added by the BDOOR-ML BACKDOOR!"
X	ProtocolDiskChk	svcvlw32.exe	"Added by the STINX-Y TROJAN!"
X	QTime	nrchk.exe	Premium rate adult content dialler
X	QTSvc	navchk.exe	Premium rate adult content dialler
X	RealPlayer Ath Check	rnathchk.exe	"Added by the MYTOB.AG WORM!"
X	RealPlayer Ath Check	mathchk.exe	"Added by the MYDOOM-AJ WORM!"
?	Register SeqChk	regsvr32.exe ..csseqchk.dll	"??"
X	RegistryCheck	"rundll32.exe chkreg.dll	CheckRegistry"
X	RegistryChk	winbackup.exe	"Added by the MERTIAN WORM!"
X	runapp	icqchk.exe	"Added by the BOMKA TROJAN!"
N	S3apphk	S3apphk.exe	A tool installed alongside the drivers for your S3 video output device. It is not necessary but should be allowed to run unless it is causing problems
X	ScheduIe	nrchk.exe	Premium rate adult content dialler
X	SchedulerMgr	navchk.exe	Premium rate adult content dialer
X	ScreenSaverPlus	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	SearchMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	ShortKeys Lite	shklite.exe	"ShortKeys Lite from Insight Software Solutions
X	sp2chk.exe	sp2chk.exe	"Added by the ALUROOT.A TROJAN!"
X	strkjhk	sdflkj3.exe	"Added by an unidentified WORM or TROJAN - see here"
X	SystemChecker	Syschk.exe	"Added by the GALIL.F WORM!"
X	SystemService	navchk.exe	Premium rate adult content dialler
X	TakeMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	TheBestMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	ThemeMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	TosHKCW	TosHKCW.exe	Toshiba Hot Key Change/Control Wireless. Permits you to use a hot key to activate/deactivate built-in 802.11b wireless transmission on a laptop (if installed)
U	TosHKCW.exe	TosHKCW.exe	Toshiba Hot Key Change/Control Wireless. Permits you to use a hot key to activate/deactivate built-in 802.11b wireless transmission on a laptop (if installed)
U	TPHKMGR	TPHKMGR.exe	"Hotkey manager for IBM/Lenovo Thinkpad notebooks. Supports the blue ""ThinkVantage"" or ""Access IBM"" help key
U	TPHKMGR.exe	TPHKMGR.exe	"Hotkey manager for IBM/Lenovo Thinkpad notebooks. Supports the blue ""ThinkVantage"" or ""Access IBM"" help key
U	TPHOTKEY	TPHKMGR.exe	"Hotkey manager for IBM/Lenovo Thinkpad notebooks. Supports the blue ""ThinkVantage"" or ""Access IBM"" help key
X	tutcdchk2	tutcdchk2.exe	"Added by the HAXDOOR ROOTKIT!"
X	UtilitiesAndSoftware	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	VirusCheckII	AVIRCHK.EXE	"Added by the DASMIN TROJAN!"
U	winchk	winchk.exe	"RemoteSpy surveillance software. Uninstall this software unless you put it there yourself"
X	windows	hkey.exe	"Added by the GAOBOT.AFW WORM!"
X	Windows Service Agent	vbsxkhk.exe	"Added by the IRCBOT.AHX WORM!"
N	Windows Version Check	ver_chk.exe	"Version checker for CyberAudioLibrary - ""a new way to exchange information through the Internet"""
X	winnt DNS ident	pidchk32.exe	"Added by the RBOT-ACY WORM!"
X	YourMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	[random name]	?hkdsk.exe	"PurityScan adware"
X	[random name]	?hkntfs.exe	"PurityScan adware"
X	[random name]	chkdsk.exe	"PurityScan adware. Note - the legitimate Windows chkdsk.exe will always be located in %System% and will NOT figure among the startups!"
X	[random name]	chkntfs.exe	"PurityScan adware. Do not confuse with the legitimate NTFS Volume Maitenance Utility (chkntfs.exe) process which is always located in %System% and should not figure in Msconfig/Startup!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.