java

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
ME"	"MS Java Applets for Windows NT	X	javaapplets.exe
NT	"Ms Java for Windows 98	ME & XP"	X
NT	"Ms Java for Windows 98	XP & ME"	X
XP & ME	"MS Java for Windows NT	X	xpjavams.exe
X	ansjava	[path to worm]	"Added by the RANDON-AN WORM!"
X	command	javaw.exe	"Added by the AGOBOT-LG WORM!"
X	Etraffic	JavaRun.exe	"TopMoxie adware"
X	IE Java Update	iejava.exe	"Added by the AGENT-HD TROJAN!"
X	IExplorer32 Java Scripting	IExplore32b.exe	"Added by the RBOT.ABO WORM!"
X	IExplorer32c Java Scripting	IExplore32cb.exe	"Added by the RBOT.ABN WORM!"
X	IExplorer6 Java Scripting	IExplore326.exe	"Added by a variant of the SDBOT WORM!"
X	IExplorer7 Java Scripting	IExplore327.exe	"Added by a variant of the SDBOT WORM!"
X	java	remote.cmd	"Added by the BANKER-EHG TROJAN!"
X	java	system.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Java (VM) v6.9	jav.bat	"Added by the AGENT-GZK TROJAN!"
X	Java applet	javaup.exe	"Added by the SDBOT-ACF WORM!"
X	Java Application	vssmf32.exe	"Added by the SPIGOT BACKDOOR!"
X	Java Auto Update	ujm.exe	"Added by the SDBOT-ADH WORM!"
X	Java Runtime Environment	jbuild.exe	"Added by the DELBOT-J WORM!"
X	Java Runtime Value	runjava.exe	"Added by the RBOT-DDJ WORM!"
X	Java Runtimes	iexplore.exe	"Added by the KILLAV.B WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This file is located in a %Windir%\Java\Java folder"
X	Java Softe	Java32.com	"Added by the RBOT.ECN WORM!"
X	Java update	javaqs.exe	"Added by the SWARLEY.A WORM!"
X	Java Update	keeper.exe	"Added by the AGENT-DIS TROJAN!"
X	Java Update	svchost.exe.exe	"Added by the AGENT-LBS TROJAN!"
X	Java Update	hostwww.exe.exe	"Added by the AGENT-MFH TROJAN!"
X	Java Virtual Machine	javaw.exe	"Added by a variant of the RBOT WORM!"
X	Java VM v6.9.2	jav.bat	"Added by the DWNLDR-HLM TROJAN!"
X	Java VM v6.91	jav.bat	"Added by the DWNLDR-HLL TROJAN!"
N	Java(TM) Platform SE 6	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
N	Java(TM) Platform SE 6 U*	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now. U* represents the update version
N	Java(TM) Platform SE Auto Updater 2 0	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
X	Java*.exe [ = random char]	Java*.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Java*32.exe [ = random char]	Java*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	java-plugin	javasctp.exe	"Added by the VB.AMX TROJAN!"
X	Java32 Configuration Loader	msnmesgr.exe	"Added by a variant of the RBOT WORM!"
X	JavaCore	JavaCore.exe	"Added by the MATCASH TROJAN!"
X	Javascript	jscript.exe	"Added by the DELBOT-AD WORM!"
X	JavaScript Debugging Service	JsDbgMan.exe	"Added by the DERDERO.E WORM!"
X	JavaScriptMsxrs	Msxrs.exe	"Added by the VB.BL WORM!"
X	JavaTray	traymgr.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	JavaUpdate0.07	[filename]	"Added by the JUPDATE TROJAN!"
X	JavaUpdateSched	jusched32.exe	"Added by the BCKDR-CKB BACKDOOR!"
X	JavaVM	java.exe	"Added by the MYDOOM.M WORM and variants! Note - not to be confused with the valid Windows ""java.exe"" which is located in %System% as this is located in %Windir%"
X	javawsa.exe	javawsa.exe	"Added by the BANK-Y TROJAN!"
X	Jufualt	java2.exe	"Added by the SDBOT.AOE WORM!"
X	Kaspersky Email Security	javaupd.exe	"Added by the SWARLEY.A WORM!"
X	Microsoft Java Virtual Machine	MsConfiG.exe	"Added by the FORBOT-DV WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting"
X	Microsoft Java Virtual Machine	msjvm.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Java Virtual Machine	javavm.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Java Virtual Machine	msjavarxp.exe	"Added by the FORBOT-DL WORM!"
X	Microsoft Java Virtual Machine	winscr32.exe	"Added by a variant of the WOOTBOT WORM!"
X	Microsoft Java Windows Update	[filename]	"Added by the RBOT-DZ WORM!"
X	Microsoft JavaVM	msjarun.exe	"Added by the RBOT-JW WORM!"
X	Microsoft Machine	winjava.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Synchronization Manager	java.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Word Profissional	Java Plug In close.exe	"Added by the BANKER-EL TROJAN!"
X	MicrosoftCorp	javaw.exe	"Added by the BUZUS.BULO TROJAN!"
X	MicrosoftNAPC	javaw.exe	"Added by the BUZUS.BULO TROJAN!"
X	MS Java Applets for Windows NT & XP	javaapplet.exe	"Added by the RBOT.BHG WORM!"
X	Ms Java for Windows NT	MS32.exe	"Added by the VANEBOT-H WORM!"
X	Ms Java for Windows NT	msi32java.exe	"Added by the VANEBOT-I WORM!"
X	Ms Java for Windows NT	msjava.exe	"Added by the VANEBOT-E WORM!"
X	Ms Java for Windows NT	msi32info.exe	"Added by the RBOT.AFX WORM!"
X	MS Java for Windows XP & NT	javanet.exe	"Added by the VANEBOT-A WORM!"
X	MS Java Service Wrapper Windows NT & XP	wrapper.exe	"Added by the VANEBOT-D WORM!"
X	Ms Java Update For Windows NT/XP	msijavaupdt32.exe	"Added by the RANDEX.AF WORM!"
X	MS Java virtual machine	javavm.exe	"Added by the RBOT.ABG WORM!"
X	msjava service	xpcd.exe	"Added by the SDBOT.VM WORM!"
X	NeroFileCheck	msjavam32.exe	"Added by the AGOBOT.AKM WORM!"
X	NeroUpdate Check	msjava.exe	"Added by the AGOBOT.AMH WORM!"
X	NeroUpdater6.8	winjava.exe	"Added by the AGOBOT.AMK WORM!"
X	Service Monitor	javams32.exe	"Added by the DELF-NK TROJAN!"
X	Service Monitor	javams64.exe	"Added by the SDBOT-AFO WORM!"
X	Sun Java Console for Windows NT & XP	jconsole.exe	"Added by the VANEBOT-C WORM!"
X	Sun Java Updater	stacsv.exe	"Added by the BUZUS.DBFM TROJAN!"
X	Sun Java Updater v5	javajre.exe	"Added by the AUTORUN-XI WORM!"
X	Sun Java Updater v7.4	javawx.exe	"Added by the ACKANTTA.B WORM!"
X	Sunjava	javasmart.exe	"Added by the AGENT.AHV TROJAN!"
X	SunJava Updater v7	javale.exe	"Added by the ACKANTTA.B WORM!"
X	SunJavaSched	ccEvtMngr.exe	"Added by the SDBOT-YP WORM!"
X	SunJavaSched Updater	avamx.exe	"Added by the RBOT-ABJ WORM!"
X	SunJavaUpdate	smvss.exe	"Added by the DEDLER-G TROJAN!"
X	SunJavaUpdater	javaw.exe	"Added by the MYTOB.QR WORM!"
X	SunJavaUpdaterv13	javaupdater.exe	"Added by the ROUTROBOT WORM!"
N	SunJavaUpdateSched	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
X	SunJavaUpdateSched	scvhost.exe	"Added by the SDBOT-AVX WORM!"
X	SunJavaUpdateSched	javamx.exe	"Added by the SDBOT-WI WORM!"
X	SunJavaUpdateSched10	jushed.exe	"Added by the ACKANTTA.F WORM!"
X	SunJavaUpdateSched132	jschd.exe	"Added by the AUTORUN-AQY WORM!"
X	SunJavaUpdateSched16	jvshed.exe	"Added by the ACKANTTA.G WORM!"
X	SunJavaUpdatSched	spoolsv.exe	"Added by the BANCBAN-NP TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %ProgramFiles%\MSN Messenger"
N	Swap Nut	javaw.exe	"javaw.exe can be loaded by other programs at startup but in this instance it's SwapNut
X	topmoxie	JavaRun.exe	"TopMoxie adware"
X	WIn32S Java DLL	kavsvx.exe	"Added by the AGOBOT-RZ WORM!"
X	Windows Java Update	weatherBug32.exe	"Added by a variant of the RBOT WORM!"
X	Windows JavaScript Daemon	Winjsd.exe	"Added by the WOOTBOT.AF WORM!"
X	Windows Service Ajav	java128.exe	"Added by the RBOT.BNG WORM!"
X	Winjava xml	dirx9.exe	"Added by the HAXDOOR ROOTKIT!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.