ine

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
Inc."	"Machine Works	X	aecces.exe
X	(*)API Machine	winSOCKS.exe	"Homepage hijacker
U	24Online Client	CyberoamClient.exe	"Related to Cyberroam from Elitecore Technologies Ltd"
Y	@OnlineArmor GUI	oaui.exe	"System Tray access to and main user interface for the Online Armor range of security tools from Tall Emu Pty Ltd. The free version incorporates a firewall
X	AAMSFree702	Avengine.com	"Added by the DELF.LJ TROJAN!"
?	Ad Online Guide	adonlineguide.exe	"??"
N	America Online	aoltray.exe	"Adds the AOL icon in the System Tray (. denotes version if present) for versions of AOL up to and including 9.0. Start AOL via the desktop or quick launch shortcuts or via Start → All Programs"
N	America Online . Tray Icon	aoltray.exe	"Adds the AOL icon in the System Tray (. denotes version if present) for versions of AOL up to and including 9.0. Start AOL via the desktop or quick launch shortcuts or via Start → All Programs"
Y	AspireTimeMachine	acertmb.exe	"System recovery software supplied with some Acer notebook PCs. Similar to GoBack and the restore program in WinXP
X	AttuneClientEngine	attune_ce.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	Avengine	Avengine.com	"Added by the DELF.LJ TROJAN!"
U	AVFX Engine	StartFX.exe	"Advanced Video FX - supported by a number of Creative Web Cameras. ""Have more fun by adding a wide range of special effects and backgrounds to your video chat with Advanced Video FX"""
N	Bing Bar	mswinext.exe	"Bing Bar - the latest incarnation of the MSN Toolbar from version 5.* onwards. This entry loads the toolbar into memory at start-up before you open your internet browser. Not required - it will load with the browser and remains in memory after the browser is closed"
X	blah service	winsysengine.exe	"Added by the RBOT-KI WORM!"
X	blahh service	msengine.exe	"Added by a variant of the RBOT WORM!"
X	BLMessagingIntegration	blengine.exe	"BuddyLinks adware"
U	Browser Sentinel	BrowserSentinel.exe	"Browser Sentinel - notifies you if a program wants to penetrate into Internet explorer
?	ChangeLines	chngline.exe	"??"
U	ChineseStar	cstar.exe	Chinese language support software
N	Compaq Internet Setup	inetwizard.exe	For Compaq PC's. Runs Compaq internet setup wizard and offers you to signup from ISP list
X	cosine	cosine.exe	"Added by the RBOT-SW WORM!"
U	CPQInet Runtime Service	CpqInet.exe	"For Compaq PC's. Allows AOL and Compuserve to use the Easy Access buttons for the internet. Is not required if you don't use the ISP providers"
X	ctfmon.exe	ctfmon.exe eminem.exe	"Added by the BHARAT.A WORM!"
N	Cyberlink PowerCinema 3.0	PCMService.exe	"Part of Cyberlink's PowerCinema - which can be used to watch movies
N	Data LifeGuard LifeLine Lite installer	DLGLI.EXE	"Backweb installer - see here"
U	Dell DataSafe Scheduler	DataSafeOnlineScheduler.exe	"Scheduler for Dell DataSafe™ Online which ""helps protect your music
N	Digital Line Detect	DLG.exe	Detects whether your are plugged into a digital telephone line and displays the information graphically. Installed by Dell (and maybe others) and is included with all Connexant V.92 and Broadcom modems
X	DownloadWare Engine	Dwe.exe	"DownloadWare adware"
U	eMachines eBoard	Eboard.exe	eMachines multimedia keyboard manager. Required if you use the extra keys
U	enginecs2	enginecs2.exe	"Cyber Sentinel - internet filtering software"
N	ESPN BottomLine	bline.exe	"ESPN BottomLine. ""You can dock the BottomLine to the top or bottom of your screen or drag it around on your desktop
Y	ezPS_Px	ezSP_PxEngine.exe	"Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings"
Y	ezShieldProtector for Px	ezSP_PxEngine.exe	"Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings"
X	FCEngine	FCEngine.exe	"CASClient adware"
U	FinePrint Dispatcher v4	fpdisp4a.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 4.x of the software. ""FinePrint saves ink
U	FinePrint Dispatcher v4	fpdisp4.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 4.x of the software. ""FinePrint saves ink
U	FinePrint Dispatcher v5	fpdisp5a.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 5.x of the software. ""FinePrint saves ink
N	FineReader7NewsReaderPro	AbbyyNewsReader.exe	"ABBYY FineReader OCR software - version 7"
X	Firewall Update System1	WinedowsUpdater1.exe	"Added by the RBOT-ARU WORM!"
Y	FltProcess	msinet.exe	"Part of Cyber Patrol internet filtering software to restrict access to certain types of material on the internet. It can be disabled but do not ask how it's done"
N	Fromine WinPopup	winpopup.exe	Instant Messenger program
N	Hard Disk Sentinel	HDSentinel.exe	"Hard Disk Sentinel - a multi-OS hard disk drive monitoring application. Its goal is to find
X	IEengine	IEeng.exe	"STARTPAG.AI hijacker"
X	ine	svchosts.exe	"Added by the RBOT.BNL WORM!"
X	INET	inetsync.exe	"Meplex adware"
X	Inet DataBase	Inetdbs.exe	"Added by the QEDS WORM!"
X	Inet Delivery	inetdl.exe	"Inet Delivery adware"
X	Inet Delivery	inetdl_2.exe	"Inet Delivery adware"
X	Inetapi	Netapi.exe	"Added by the NETDEVIL.14 TROJAN!"
X	InetChk	ms[random value].exe	"Added by the AGENT-IRL TROJAN!"
U	inetcntrl	inetcntrl.exe	Bsafe Online - internet filter
?	InetConf	inetconf.exe	"??"
U	Inetd	INETD32.EXE	"Windows Inet Daemon from Hummingbird Communications. ""Hummingbird Inetd has the advanced ability to conserve PC resources by listening for connection requests and launching server daemons"". Provides PCs with the full functionality of a UNIX workstation"
U	inetinfo.exe	inetinfo.exe	"Executable used by MS Internet Information Server (IIS). If it's running
X	inetinfomon manager	inetinfomon.exe	"Added by the DONBOMB.A TROJAN!"
X	inetmgr	inetmgr.exe	"Actual Names (AdvSearch) Internet Keywords parasite"
X	InetMSN	msnet.exe	"Added by a variant of the SDBOT TROJAN!"
X	InetServices	wsock32.exe	"Added by the WOCK32-A TROJAN!"
X	Instant Access	linewsrv.exe	"InstantAccess premium rate adult content dialer variant"
X	Intel Physical Routine 1.2A	stnetlib.exe	"Added by the BACKDR-AS BACKDOOR!"
U	Internet Answering Machine	IAMNET~1.EXE	"From Callwave. It offers a free utility to monitor your incoming phonecalls if you only have a single telephone line for internet access"
U	Internet Answering Machine	IAM.exe	"From Callwave - offers a free utility to monitor your incoming phonecalls if you only have a single telephone line for internet access"
X	Internet Server	inetsrv.exe	"Added by the STARTPA-EM TROJAN!"
N	Intervideo Win Cinema Manager	WinCinemaMgr.exe	"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	Intervideo Win Cinema Manager	WINCIN~1.EXE	"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	Intervideo WinCinema Manager	WinCinemaMgr.exe	"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	Intervideo WinCinema Manager	WINCIN~1.EXE	"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
X	ISS	inet.exe	"Meplex adware"
X	Java Virtual Machine	javaw.exe	"Added by a variant of the RBOT WORM!"
X	l44sys**	winmine	"Added by the VBS.LIDO WORM - where ** is a number between 33 and 44"
N	Line Speed Meter V3.0	LineSpeedMeter.exe	"LineSpeedMeter - detect the download and upload speed of your internet connection"
X	load	WinExplorer.exe	"Added by the VB.EIW WORM!"
X	load=	inetinfo.exe	"Added by the PROXY-GG TROJAN!"
N	Logitech QuickCam	ManifestEngine.exe	"Automatic updater for versions of Logitech QuickCam webcam software. Check for updates via the System Tray icon - see the LogitechVideoTray entry"
N	LogitechSoftwareUpdate	ManifestEngine.exe	"Automatic updater for versions of Logitech QuickCam webcam software. Check for updates via the System Tray icon - see the LogitechVideoTray entry"
X	Mabochine Deybug Malnager	kdm.exe	"Added by the SDBOT-SD WORM!"
U	Machine Debug Manager	MDM.EXE	"Used by developers for debugging and is a component of several MS products including Office and Visual Studio. Those who have encountered it have unchecked it with no degradation in performance. It may cause your computer to ""hang"" if you have Visual Studio installed and this disabled because it appears to take over error handling - hence the U recommendation. For this entry it loads under the ""RunServices"" key in Me (located in C:\WINDOWS\SYSTEM). It also loads a service in XP/Vista (located in %ProgramFiles%\Common Files\Microsoft Shared\VS7Debug)"
X	Machine Debug Manager	msdn.exe	"Added by a variant of the RBOT WORM!"
X	Machine Debug Manager	mdm.exe	"Added by the SDBOT-APE WORM! Note - this is not the legitimate Machine Debug Manager (mdm.exe) process which is located in %ProgramFiles%\Common Files\Microsoft Shared\VS7Debug (98/Me/XP/Vista) or %System% (Me only). This one is located in %Windir%"
X	Machine Debug Manager	mdms.exe	"Added by the SDBOT-CH WORM!"
X	Machine Update Soft	wusas.exe	Added by an unidfentified WORM!
X	machine-debugger	WMIPRVSW.exe	"Added by the AGOBOT.WW WORM!"
X	machine-debugger	mdmsv.exe	"Added by the AGOBOT-BR WORM!"
X	MachineTest	CMagesta.exe	"Added by the SDBOT-NE WORM!"
N	ManifestEngine	ManifestEngine.exe	"Automatic updater for versions of Logitech QuickCam webcam software. Check for updates via the System Tray icon - see the LogitechVideoTray entry"
U	McAfee Online Backup	MOBKstat.exe	"System Tray access to McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
U	McAfee Online Backup Status	MOBKstat.exe	"System Tray access to McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
X	McAfee Online virus Scanner	avp.exe	"Added by the RBOT-GCV WORM! Not to be confused with Kaspersky anti-virus and AOL's Active Virus Shield (by Kaspersky) - found in either a Kaspersky or AOL sub-directory"
X	McAfee Online Virus Scanner	nzm.exe	"Added by the IRCBOT.XV WORM!"
U	MDSA Sentinel X	smss.exe	"SentinelX surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the smss.exe process which is always located in %System%. This one is located in %ProgramFiles%\MDSA Software"
X	Microsoft	winline.exe	"Added by the AGENT.KT TROJAN!"
X	Microsoft Command Line	wincmd.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Data Machine	csdata32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Event Engine	EvtEngn.exe	"Added by the RBOT-XV WORM!"
X	Microsoft Genuine Logon	msnmsg.exe	"Added by the IRCBOT-XH WORM!"
X	Microsoft Genuine Logon	svchost.exe	"Added by the SDBOT.EXT WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Inet Xp..	teekids.exe	"Added by the BLASTER.C WORM!"
X	Microsoft Internet Dumping Protocol	inetdump.exe	"Added by the IRCBOT.BLL BACKDOOR!"
X	Microsoft Internet Syncing	inetsync.exe	"Added by the IRCBOT.BLL BACKDOOR!"
X	Microsoft Java Virtual Machine	MsConfiG.exe	"Added by the FORBOT-DV WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting"
X	Microsoft Java Virtual Machine	msjvm.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Java Virtual Machine	javavm.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Java Virtual Machine	msjavarxp.exe	"Added by the FORBOT-DL WORM!"
X	Microsoft Java Virtual Machine	winscr32.exe	"Added by a variant of the WOOTBOT WORM!"
X	Microsoft Kinetik Svc	msftksvc.exe	"Added by the AGENT.AGDO TROJAN!"
X	Microsoft Machine	winjava.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft machine	blah.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft machine	scvhost.exe	"Added by the RBOT.AEU TROJAN!"
X	Microsoft Machine	updata.exe	"Added by the RBOT-DJ WORM!"
X	Microsoft Machine	temp.exe	"Added by the RBOT-FSQ WORM!"
X	Microsoft Machine	winxp43.exe	"Added by the RBOT-IA WORM!"
X	Microsoft machine	arcpack.scr.exe	"Added by the RBOT.ADF BACKDOOR!"
X	Microsoft Machine Script	iexplorersis.exe	"Added by the RBOT-CMH WORM!"
X	Microsoft MachineUpdatese	tempes.exe	"Added by the RBOT.EWN BACKDOOR!"
X	Microsoft Message Machine	msmesg32.exe	"Added by the SPYBOT.BI WORM!"
X	Microsoft NT Update	winexec32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft System Checkup	inetman.exe	"Added by the DONK.O WORM!"
X	Microsoft Update Machine	expl0rer.exe	"Added by the SDBOT.OK WORM!"
X	Microsoft Update Machine	rxhost.exe	"Added by the RBOT.FC WORM!"
X	Microsoft Update Machine	servicz.exe	"Added by the RBOT-HU WORM!"
X	Microsoft Update Machine	SP2.exe	"Added by the SPYBOT.FP WORM!"
X	Microsoft Update Machine	winini.exe	"Added by the RBOT-KV WORM!"
X	Microsoft Update Machine	xvshost.exe	"Added by the RBOT.QP WORM!"
X	Microsoft Update Machine	memstat.exe	"Added by the RBOT-OM WORM!"
X	Microsoft Update Machine	ntce.exe	"Added by the RBOT-FA WORM!"
X	Microsoft Update Machine	system03.exe	"Added by the RBOT-NM WORM!"
X	Microsoft Update Machine	wuawx.exe	"Added by the RBOT-CE WORM!"
X	Microsoft Update Machine	zonealarm.exe	"Added by the RBOT-BZ WORM! Note - this is not the valid Zone Labs firewall program!"
X	Microsoft Update Machine	systemll.exe	"Added by the RBOT-JT WORM!"
X	Microsoft Update Machine	winupdt.exe	"Added by the RBOT-FP WORM!"
X	Microsoft Update Machine	svshost.exe	"Added by the RBOT.AK WORM!"
X	Microsoft Update Machine	wuamgd.exe	"Added by the SDBOT.HQ WORM!"
X	Microsoft Update Machine	wupdt32x.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update Machine	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	linux.exe	"Added by the RBOT-IM WORM!"
X	Microsoft Update Machine	lmrss.exe	"Added by the RBOT-DY WORM!"
X	Microsoft Update Machine	windowsu.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	wininigo.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	winmgr.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	Winmsixp32.exe	"Added by the RBOT.DN WORM!"
X	Microsoft Update Machine	Winregs32.exe	"Added by the RBOT.DN WORM!"
X	Microsoft Update Machine	winxpini.exe	"Added by the RBOT-OB WORM!"
X	Microsoft Update Machine	wuamgrd.exe	"Added by the RBOT-HE WORM!"
X	Microsoft Update Machine	wuagrd.exe	"Added by the RBOT-GF WORM!"
X	Microsoft Update Machine	LANWAKE.EXE	"Added by the RBOT-QZ WORM!"
X	Microsoft Update Machine	scvhost.exe	"Added by the RBOT-GS WORM!"
X	Microsoft Update Machine	winhost.exe	"Added by the RBOT-GK WORM!"
X	Microsoft Update Machine	winss.exe	"Added by the RBOT.JU WORM!"
X	Microsoft Update Machine	WUAMGRDXS.EXE	"Added by the RBOT-GL WORM!"
X	Microsoft Update Machine	crss32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	lsasse.exe	"Added by the RBOT-DI WORM!"
X	Microsoft Update Machine	qwerty.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	rxxhost.exe	"Added by the RBOT.EP WORM!"
X	Microsoft Update Machine	servicez.exe	"Added by the SPYBOT.BI WORM!"
X	Microsoft Update Machine	spoolserv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	Systemnt.exe	"Added by the RBOT.DA WORM!"
X	Microsoft Update Machine	systemse.exe	"Added by the RBOT-BD WORM!"
X	Microsoft Update Machine	taskmngrs.exe	"Added by the RBOT-CR WORM!"
X	Microsoft Update Machine	windowsup.exe	"Added by the RBOT-FV WORM!"
X	Microsoft Update Machine	wuamgard.exe	"Added by the SPYBOT.CS WORM!"
X	Microsoft Update Machine	wupdate32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	system.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	TMEMSER.EXE	"Added by the RBOT-NQ WORM!"
X	Microsoft Update Machine	winnie.exe	"Added by the RBOT-ACD WORM!"
X	Microsoft Update Machine	winortho.exe	"Added by the RBOT-NW WORM!"
X	Microsoft Update Machine	wins32.exe	"Added by the RBOT.EZ WORM!"
X	Microsoft Update Machine	serviz.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	TASKMAN4.EXE	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	wftestb.exe	"Added by the RBOT-AFZ WORM!"
X	Microsoft Update Machine	Win32.exe	"Added by the SDBOT.UV WORM!"
X	Microsoft Update Machine	windns.exe	"Added by the RBOT.EF WORM!"
X	Microsoft Update Machine	MSOICONS.EXE	"Added by the RBOT.AWS WORM! Note - do no confuse with the legitimate Msoicons.exe file described here. The latter should not normally figure in Msconfig/Startup!"
X	Microsoft Update Machine	WINSVC32.EXE	"Added by the RBOT.CU WORM!"
X	Microsoft Update Machine	ntsystem.exe	"Added by the RBOT.GF WORM!"
X	Microsoft Update Machine	winupdte.exe	"Added by the RBOT-GKL WORM!"
X	Microsoft Update Machine	jkfrnz.exe	"Added by the RBOT-GOZ WORM!"
X	Microsoft Update Machine	wlimyc.exe	"Added by the RBOT-GQN WORM!"
X	Microsoft Update Machine	xagwxzy.exe	"Added by the RBOT.S WORM!"
X	Microsoft Update Machine	jkydxg.exe	"Added by the RBOT.AEA BACKDOOR!"
X	Microsoft Update Machine	opmmve.exe	"Added by the KOLABC.DES WORM!"
X	Microsoft Update Machine	paxrxo.exe	"Added by the PUSHBOT.A WORM!"
X	Microsoft Update Machine	psmszw.exe	"Added by the KOLABC.CC WORM!"
X	Microsoft Update Machine	syadpo.exe	"Added by the CIADOOR.GN BACKDOOR!"
X	Microsoft Update Machine	systemi.exe	"Added by the BUZUS.JKU TROJAN!"
X	Microsoft Update Machine	thvfyq.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	ubthec.exe	"Added by the AGENT.AWZ TROJAN!"
X	Microsoft Update Machine	winmngr.exe	"Added by the RBOT.GKQ BACKDOOR!"
X	Microsoft Update Machine	gbhglj.exe	"Added by the IRCBOT-ZJ TROJAN!"
X	Microsoft Update Machine	wuamgdr.exe	"Added by the RBOT-IO BACKDOOR!"
X	Microsoft UpdateS Machine	wgrd.exe	"Added by the RBOT-FI WORM!"
X	Microsoft Updating Machine	sysc0de.exe	"Added by the RBOT.RB WORM!"
X	Microsoft UpMachine	doezs.exe	"Added by the RBOT.BCT WORM!"
X	Microsoft Virual Machine	sms.exe	"Added by the RBOT-SP WORM!"
X	Microsoft Windows Storage Machine Service	winms.exe	"Added by the RBOT-AHK WORM!"
X	Microsoft Windows XP/2K Explorer	winexplorer.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Winedows startup	WinKey.exe	"Added by a variant of the SDBOT WORM! See here"
X	Microsoft Winedows Updateing	NinKey.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Winedows WinServ	iPodFix.exe	"Added by a variant of the RBOT WORM!"
X	MMicrosoft Security Management	inetforn.exe	"Added by the RBOT.AFZ WORM!"
X	MS Java virtual machine	javavm.exe	"Added by the RBOT.ABG WORM!"
X	msconfig.exe	uline.exe	Added by a variant of the AGENT.AH downloader TROJAN!
X	Msinet	Msinet.exe	"Added by the RBOT-AOA WORM!"
N	MSN Toolbar	mswinext.exe	"MSN Toolbar from version 4.* onwards (now known as Bing Bar from version 5.* onwards). This entry loads the toolbar into memory at start-up before you open your internet browser. Not required - it will load with the browser and remains in memory after the browser is closed"
N	MSN� Toolbar	mswinext.exe	"MSN Toolbar from version 4.* onwards (now known as Bing Bar from version 5.* onwards). This entry loads the toolbar into memory at start-up before you open your internet browser. Not required - it will load with the browser and remains in memory after the browser is closed"
N	mswinext	mswinext.exe	"MSN Toolbar from version 4.* onwards (now known as Bing Bar from version 5.* onwards). This entry loads the toolbar into memory at start-up before you open your internet browser. Not required - it will load with the browser and remains in memory after the browser is closed"
X	My Security Engine	MS[random characters].exe	"My Security Engine rogue security software - not recommended
X	mysoft	winexplor.exe	"Browser hijacker
N	Netline User	netchk.exe	"Netline supplies internet related products and services and this program identifies user ID and IP information. Found installed along with the Falcon 4 game
X	NetMeter	NielsenOnline.exe	"NetRatings software by Opistat. ""OpiStat measures Internet usage anonymously and surveys participants according to their profiles and online habits"". This software has been reported to get downloaded and installed automatically after a Grokster install. It anonymously collects your use of the Internet protocols (sites visited
U	Nsengine	Nsengine.exe	"Scheduling engine of NovaSTOR Backup Service. Only required if scheduling is enabled and wanted - see here"
X	NT Virtual Machine	[path to file]	"Added by the SCAERBOT-A WORM!"
U	OfflineFileSync	OfflineFileSyn.exe	"Offline synchronization part of ZANTAZ EAS (Enterprise Archive Solution) - which ""is a secure
Y	Online Armor Firewall	oaui.exe	"System Tray access to and main user interface for the Online Armor range of security tools from Tall Emu Pty Ltd. The free version incorporates a firewall
?	online cdrom	Active acid.exe	"??"
X	Online Service	svchost.exe	"Added by the HOSTIDEL.B or HOSTIDEL.C or TARNO.B TROJANS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	Online Services	twain.exe	"Added by the AGENT.BEA TROJAN!"
Y	OnlineArmor GUI	oaui.exe	"System Tray access to and main user interface for the Online Armor range of security tools from Tall Emu Pty Ltd. The free version incorporates a firewall
X	OnlineGuard	OnlineGuard.exe	"OnlineGuard rogue security software - not recommended
X	OnlineHelpmate	GDC.exe	"OnlineHelpmate rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
U	OnlinePCfix SmoothSurfer	SS.exe	"Smooth-Surfer - blocks banners
N	OnlineTime	onlinetime.exe	"OnlineTimer - monitors your Windows dial-up network and logs the time you spend online as well as the resulting costs"
X	online_party	online_party.exe	Adult content dialler
X	Optimum Online	Netsurf.exe	OptimumOnline ISP software related spyware - displays advertising popups and collects information about user activity
X	PandaAVEngine	PandaAVEngine.exe	"Added by the NETSKY.R WORM!"
U	PDEngine	PDEngine.exe	"PerfectDisk from Raxco - disk defragmenter. Only required if you schedule disk defragmenting at re-boot"
U	pdfMachine dispatcher	mapisnd.exe	"pdfMachine Windows print driver"
U	Pervasive.SQL Workgroup Engine	W3dbsmgr.exe	Database Service Manager for Pervasive SQL 2000 Workgroup edition. Required if you use Pervasive SQL but it's recommended you start it manually before using it as it has a tendancy to crash/freeze if loaded with other applications at startup
?	PFW_CfgEngine	PFWCFG~1.EXE	"Personal Firewall related?"
Y	Quick Heal On-Line Protection	Cateye.exe	"Quick Heal - virus scanner"
U	Realtime Audio Engine	mmrtkrnl.exe	"Associated with ALCATech BPM Studio"
N	Redline Taskbar	taskbar.exe	Taskbar icon for the Redline RegTweak overclocking program as supplied with Sapphire ATI graphics cards
X	Root_Machine	[path to trojan]	"Added by the BANCBAN-DI TROJAN!"
X	ROOT_Machine	winlogon.exe	"Added by the BANKER-FI TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\inf"
?	Roxio Engine	MSMNGR32.EXE	"Not believed to be a valid Roxio program - more likely a variant on the WOMANIZ.A TROJAN!"
Y	Roxio Engine Compatibility Wizard	EngUtil.exe	"Part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools - corrects any modification made to the Roxio Engine
Y	RoxioEngineUtility	EngUtil.exe	"Part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools - corrects any modification made to the Roxio Engine
X	RpcxWindows Extensions	rpcxwinex.exe	"Added by the RBOT.ACP WORM!"
X	run	inetinfo.exe	"Added by the BINGHE TROJAN!"
X	run=	Celine.scr	"Added by the CELINE-A TROJAN!"
X	Rundll32_8	"rundll32.exe inetp60.dll	DllRunServer"
N	Scotia OnLine Recovery	etdirrcv.exe	"Scotia OnLine Security Software provided by Entrust for
N	Scotia OnLine Security v. Recovery	etdirrcv.exe	"Scotia OnLine Security Software provided by Entrust for
U	SecureOnlineAccountNumbers	SOAN.exe	"Related to Secure Online Account Numbers by Discover(R) Card from Orbiscom Ltd. Secure and innovative payment solutions"
X	Security Antivirus Xp 1	inetfor.exe	"Added by the SDBOT.BAV WORM!"
X	Shine	Shine.exe	"Added by the HAPPYLOW (or NISHE-A) VIRUS!"
N	ShockmachineReminder	SmReminder.exe	"""Shockmachine is a stand-alone application that lets users collect Macromedia Shockwave and Flash titles and play them offline"". Could be a registration reminder for the trial version"
X	sInErA	.exe	"Added by the SILLYFDC-AB WORM!"
U	Smarthruengine	QS.exe	"Samsung smarthru software
U	SolidWorks Task Scheduler Engine	swBOEngine.exe	"Task scheduler for SolidWorks 3D CAD software"
X	ssgrate.exe	winerdir.exe	"Added by the MITGLIEDER.O TROJAN!"
X	svchost	inetinfo.scr	"Added by the ODELUD WORM!"
X	Symantec Security Routine Addon	navpaw.exe	"Added by the AGOBOT-ES BACKDOOR!"
X	Symantec Security Routine Addon for Microsoft Windows	navpxaw32.exe	"Added by the AGOBOT-GJ TROJAN!"
X	System	inetinfo.exe	"Added by the PARDROP-A TROJAN!"
N	System Mechanic Professional Update [Incinerator.dll]	SysMech4.exe /REREG: [path] Incinerator.dll	"Iolo System Mechanic ""Incinerator"" feature securely deletes files and folders from your PC so they can never be recovered again"
X	System Update2	wininet.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Updater Machine	crhwss.exe	"Added by the CIADOOR-DQ TROJAN!"
X	System Updater Machine	system.exe	"Added by the CIADOOR.GN BACKDOOR!"
X	System64	inet.exe	"Added by the DENGLE-A TROJAN!"
X	Task Scheduler Engine	schedsvc32.exe	"Added by the RBOT-ASJ WORM!"
X	The Registry Sentinel	The Registry Sentinel.exe	"The Registry Sentinel rogue security software - not recommended
X	The Web Sentinel	The Web Sentinel.exe	"The Web Sentinel rogue security software - not recommended
X	Tiger	Shine.exe	"Added by the HAPPYLOW (or NISHE-A) VIRUS!"
N	TimeOnline	TIMEONLINE.EXE	Lightman Groups's TimeOnline monitor. For dial-up users to monitor time spent on the net. Available via Start -> Programs
N	Turbine Download Manager Tray Icon	TurbineDownloadManagerIcon.exe	"Turbine Download Manager (TDM) - download manager associated with the game ""The Lord of the Rings Online™"""
X	Undefined	winter.exe	"Added by the KILLAV.LW TROJAN!"
N	Usrobotics Online Registration	??	Pop-up reminding customers to register their products online at US Robotics
X	Vagiconline	vadaSq.exe	"Added by the SDBOT-TD WORM!"
U	Verizon Online Support Center	matcli.exe	""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	virtual-machine	svchosts.exe	"Added by the RBOT-US WORM!"
X	virtual-machine	winlogin.exe	"Added by the RBOT-VU WORM!"
X	virtual-machine	wini.exe	"Added by the RBOT-WR WORM!"
Y	VirusScan Online	mcvsshld.exe	"ActiveShield - background scanner for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online which scans files in the background as and when they are accessed
?	WildTangent CDA	"RUNDLL32.exe cdaEngine0400.dll	cdaEngineMain"
N	WINCINEMAMGR	WINCIN~1.EXE	"WinCinema_Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	WinCinemaMgr	WinCinemaMgr.exe	"WinCinema_Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
U	WINCINEMAMGR	WinRemote.exe	"InterVideo WinCinema Manager - needed for the use of WinDVD Remote Control"
X	WindowEnhancer	Winex.exe	"SCBar foistware variant"
X	Windows Explorer Shell	Winexec32.exe	"Added by the REDIST.B WORM!"
X	Windows Genuine	svghost.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows Genuine Validate	winservicessss.exe	"Added by the IRCBOT.UUI BACKDOOR!"
X	Windows Internet Service	wininet.exe	"Added by the RBOT-AUX WORM!"
X	Windows Online Updater	dllman.exe	"Added by the RBOT-TE WORM!"
X	Windows Update	inetinf.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Windows Updater Online	winupdatexx.exe	"Added by a variant of the RBOT WORM!"
X	winenv	winenv.exe	"Added by a variant of the SDBOT WORM!"
X	WinEssential	Keyhost.exe	Hijacker - hailing from jraun.com
X	WinEssential	keyword.exe	"Jraun adware"
X	WineWork	WineWork.exe	"Added by the BANCOS.AB TROJAN!"
X	WinEx	lexplore_.exe	"Added by the MSNOPT-A TROJAN!"
X	WinExec	Winexec.exe.vbs	"Added by the AINESEY.A WORM!"
X	WinExec	WinExec.exe	"Added by the FALUS-A WORM!"
X	WinExec	Lsass.exe	"Added by the CRUTLE-B WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	WinExec32	WinExec32.exe	"Added by the KAZWIN WORM!"
X	Winexec32	windhelp32.exe	"Added by the AGENT-HKU TROJAN!"
X	winexecs	winexecs.exe	"Added by the SILLYFDC.BBB WORM!"
U	WinGate Engine Monitor	wgengmon.exe	"WinGate Internet Client Dialup Monitor - component of WinGate proxy server software. Displays the status of the WinGate engine
X	WinINet	services.exe	"Added by the SOBER.R WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\ConnectionStatus and note the space at the beginning of the ""Startup Item"" field"
X	wininet	wininet.exe	"Added by the STUBBOT-C WORM!"
X	wininet.dll	regperf.exe	"Added by the ZLOB TROJAN and variants!"
X	wininet32	wininet32.exe	"Added by the RAZNEW-A TROJAN!"
X	wininetd	wininetd.exe	"Added by the WINET TROJAN!"
X	WinMine	D4NG3.vbs	"Added by the BISCUIT.A WORM!"
X	Wins Service Driver	winet.exe	"Added by the RBOT-APV WORM!"
X	Wins32 Online	cfgpwnz.exe	"Added by the BROPIA.R WORM!"
X	Winupdate Engine	wupeng.exe	"MalwareCrush rogue security software - not recommended
U	Yahoo! Widget Engine	YahooWidgetEngine.exe	"Yahoo! Widget Engine lets you run little files called Widgets that can do pretty much whatever you want them to"
X	_WinINet	services.exe	"Added by the SOBER.R WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\ConnectionStatus"
X	_WinMain	winexec.exe	"Added by the DLOADER-XX TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.