info

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	ACCDEFRAGINFO	[path to worm]	"Added by the DARBY-O WORM!"
U	BGInfo	Bginfo.exe	"BGinfo automatically displays relevant information about a Windows computer on the desktop's background
X	ccStart	ccInfo.exe	"Added by the AGOBOT-GQ BACKDOOR!"
X	CheckWinPerf	perfinfo.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Compaq Service Drivers	systeminfos.exe	"Added by the SDBOT-XC WORM!"
X	Configuration Loader	sysinfo.exe	"Added by the GAOBOT.FQ WORM!"
X	CRSSXP SysInfo	crssxp.exe	"Added by a variant of the SDBOT TROJAN!"
X	Firewall Administrating	infocard.exe	"Added by the AUTORUN-AYV WORM! Note - this is not the valid InfoCard Service which is part of the .NET Framework from Microsoft and uses the same filename"
X	Framework module library	infocard.exe	"Added by the BUZUS.AYX TROJAN!"
Y	Getca	InfoMyCa.exe	"Monitor for a Belkin USB Wireless adapter"
N	HP Info Express	??	"On HP PCs
X	HWINFO*	HWINFO*	"Added by the PUROL WORM! where * is a random character"
U	inetinfo.exe	inetinfo.exe	"Executable used by MS Internet Information Server (IIS). If it's running
X	inetinfomon manager	inetinfomon.exe	"Added by the DONBOMB.A TROJAN!"
X	info	smss.exe	"Added by the VB.EIW WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %System%\inetsrv"
X	INFO DATA	apc.exe	"Added by the RANDON.B WORM!"
U	Info Select	is.exe	"Info Select from Micro Logic - personal information manager"
X	Info32x	Info32x.exe	"Added by the GEMA TROJAN!"
X	InfoData	"rundll32.exe ********.dll	realset [* = random char]"
U	InfoPenMSN	InfoPenIM.exe	"InfoPenMSN is a MSN Messenger plugin that allows you to send data written/drawn by hand"
?	Infoplay.exe	Infoplay.exe	"Written by New Media Properties
X	Information Update	iu.exe	"Detected by Kaspersky as the CENTIM.CH TROJAN!"
X	load=	inetinfo.exe	"Added by the PROXY-GG TROJAN!"
X	m32info	m32info.exe	"Added by the CRYPTER.A TROJAN!"
X	Microsoft Information	securenet.exe	"Added by the SDBOT.AJM WORM!"
X	Microsoft Information Check	microsoft.exe	"Added by the IRCBOT.AUH TROJAN!"
X	Microsoft Service Information	msnservices.exe	"Added by the RBOT.ID WORM!"
X	Microsoft Software	sysinfo33.exe	"Added by the RBOT.LS WORM!"
X	Microsoft Special offer	infoebay.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update	syssinfos.exe	"Added by the RBOT-FWR WORM!"
X	Mirate Sp 2 Information	miratesp2.exe	"Added by the RBOT.QH WORM!"
U	Mousinfo	mousinfo.exe	MS mouse information tool - for troubleshooting mouse problems
X	Ms Java for Windows NT	msi32info.exe	"Added by the RBOT.AFX WORM!"
?	msci	mcinfo.exe	"McAfee Internet Security related. What does it do and is it required?"
X	MSInfo	msinfo.exe	"Added by the ALADINZ.M TROJAN!"
X	MSInfo	AVBgle.exe	"Added by the NETSKY.O WORM!"
X	Outerinfo	Outerinfo.exe	"Clickspring.Outerinfo adware"
X	OuterinfoUpdate	OuterinfoUpdate.exe	"Clickspring.Outerinfo adware"
X	pm32info	pm32info.exe	"Added by the CRYPTER.A TROJAN!"
X	protectinfo	protectinfo.exe	"ProtectInfo rogue security software - not recommended"
?	reginfo32	reginfo32.exe	"??"
X	run	inetinfo.exe	"Added by the BINGHE TROJAN!"
X	run=	info32.exe	"CoolWebSearch Tapicfg parasite variant"
X	sd32info	sd32info.exe	"Added by the CRYPTER.A TROJAN!"
U	SfWinStartInfo	sfWinStartupInfo.exe	SFIRM32 Online Banking software
U	StopSignStatus	stopsinfo.dll	"eAcceleration Stop-Sign security software related. Previously not recommended
X	svchost	inetinfo.scr	"Added by the ODELUD WORM!"
X	svcinfo	svcinfo.exe	"Added by the CRYPTER.A TROJAN!"
X	sysinfo	sysinfo.exe	"Added by the BEDRILL TROJAN!"
X	sysinfo.exe	sysinfo.exe	"Added by the BEAGLE.V WORM!"
X	System	inetinfo.exe	"Added by the PARDROP-A TROJAN!"
X	System Information Manager	Navcpe.exe	"Added by the SDBOT-QB WORM!"
X	System Information Manager	Msbb.exe	"Added by the SLINBOT.YR BACKDOOR!"
X	System Information Manager	iexplore.exe	"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	System Information Manager	mslog.exe	"Added by the DELF.AKO TROJAN!"
X	System Information Manager	no.exe	"Added by the SPYBOT.NO WORM!"
X	System Information Manager	syspass.exe	"Added by the SDBOT-MO WORM!"
X	System Information Manager	win.exe	"Added by the SDBOT-MU WORM!"
X	System Information Manager	windowsNt.com	"Added by the SDBOT-ND WORM!"
X	un32info	un32info.Exe	"Added by the CRYPTER.A TROJAN!"
X	USBHWINFO	mac.exe	"Added by the LOWZONE-I TROJAN!"
X	USBHWINFO	[path to trojan]	"Added by the LOWZONE-I TROJAN!"
X	USBHWINFO	sst6.exe	"Added by the LOWZONE-I TROJAN!"
X	WDInfo	wdinfo.exe	"Added by the DLUCA.B TROJAN!"
X	Website Administrator Info	webadmin.exe	"Added by the FORBOT-FY WORM!"
X	Win32 Info	windowsnfo.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Win32 Information Service	crsrs.exe	"Added by the RINBOT.Y WORM!"
X	win32info	win32info.exe	Adult content dialler
X	Windows FormatAd	WinForm.exe	Windupdates adware variant
X	Windows Help	mailinfo.exe	"Added by the MYTOB.JX WORM!"
X	Windows Management Informant	wmmiexe.exe	"Added by the IRCBOT-V BACKDOOR!"
X	Windows Server Information	servinfo.exe	"Added by the FORBOT-EN WORM!"
X	WINDOWS SYSTEM	ninfoie.exe	"Added by the MYTOB-EP WORM!"
X	Windows Update	wininfo.exe	"Added by the MYTOB.GA WORM!"
X	winfont	winfont.exe	"Added by the DEATH TROJAN!"
X	winform	winform.exe	"Added by the PWS-ALB TROJAN!"
U	WinFoxV2	WF2K.EXE	System Tray application that starts up the Winfox utility for a Leadtek Winfast graphics card to restore settings. Can be started manually via Start → Control Panel → Display. Only needed if you wish to run things like the hardware monitor or overclock your card
X	Wminfo	Wminfo.exe	"Added by the GEMA TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.