ms.exe

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	@	wincms.exe	"Added by the RBOT.CBR WORM!"
X	amsgupdate	ams.exe	Added by a variant of the MAILBOT TROJAN!
X	Anti-Virus	vpms.exe	"Added by a variant of the SLAPER TROJAN!"
X	AntiMalwareSuite	AMS.exe	"AntiMalwareSuite rogue security software - not recommended
X	avpms	avpms.exe	"Added by the ONLINEGAMES.CPV TROJAN!"
X	bal	SYSMONMS.EXE	"Added by the FAKEALERT TROJAN!"
?	Bingo Charm	charms.exe	"Some kind of screen icon kind of like desk flag
X	cmssSystemProcess	csms.exe	"Added by the AGENT-Y TROJAN!"
X	Connector	sms.EXE	"Added by the ExDial-B premium rate adult content dialer"
X	csrss	ssms.exe	Added by an unidentified malware
N	EPSON Background Monitor	STMS.EXE	Supposed to keep an Epson printer ready for quick printing. Users report little difference whether it is on or not
X	german.exe	winsystems.exe	"Added by the BAGLEDl-AE TROJAN!"
X	german.exe	wintems.exe	"Added by the BAGLE-AS TROJAN!"
X	Hardware Monitor Service	mshms.exe	"Added by the WOLLF-A TROJAN!"
X	HP Desktop	ccappms.exe	"Added by the SDBOT-TG WORM!"
X	IISADMINS	systems.exe	"Added by the AGOBOT.U WORM!"
X	jvms.exe	jvms.exe	"Added by the ORCU.B TROJAN!"
X	KernelFaultChk	sms.exe	"Added by the DEADHAT WORM! Do not confuse with the valid ""kernelfaultcheck"" which runs ""dumprep 0 -k"" or ""dumprep 0 -u"""
X	Kernell	systems.exe	"Added by the TARNO.C TROJAN!"
X	LiveSexCams	LiveSexCams.exe	Premium rate adult content dialler
U	Logitech ClickSmart	LVCOMS.EXE	Entry added when you install Logitech ClickSmart webcam software. It allows the camera to be accessed by both the Logitech software and (amongst others) NetMeeting and Windows Movie Maker. If you don't use the camera on a daily basis create your own shortcut and run it manually when required
U	Logitech ImageStudio	LVCOMS.EXE	Entry added when you install Logitech ImageStudio webcam software. It allows the camera to be accessed by both the Logitech software and (amongst others) NetMeeting and Windows Movie Maker. If you don't use the camera on a daily basis create your own shortcut and run it manually when required
U	Logitech QuickCam	LVCOMS.EXE	Entry added when you install older versions of Logitech QuickCam webcam software. It allows the camera to be accessed by both the Logitech software and (amongst others) NetMeeting and Windows Movie Maker. If you don't use the camera on a daily basis create your own shortcut and run it manually when required
U	LVCOMS	LVCOMS.EXE	"Entry added when you install Logitech's ClickSmart
X	Machine Debug Manager	mdms.exe	"Added by the SDBOT-CH WORM!"
X	mackfy.exe	msms.exe	"Added by the SDBOT-DID WORM!"
X	MC	wintrims.exe	"Added by the WINTRIM TROJAN!"
X	Microsoft	mdms.exe	"Added by the AGENT-GHY TROJAN!"
X	Microsoft (R) Windows Network Security Management Service	nsms.exe	"Added by the RANKY.LC TROJAN!"
X	Microsoft Support	sys32ms.exe	"Added by the RBOT-AHI WORM!"
X	Microsoft Telecoms Center	telcoms.exe	"Added by the IRCBOT.GEN WORM!"
X	Microsoft Update	ms.exe	"Added by the SDBOT.CC WORM!"
X	Microsoft Virual Machine	sms.exe	"Added by the RBOT-SP WORM!"
X	Microsoft Windows Storage Machine Service	winms.exe	"Added by the RBOT-AHK WORM!"
?	MS management console	mms.exe	"Suspicious as the legitimate ""Microsoft Management Console"" is ""mmc.exe"" and not ""mms.exe"" and doesn't normally run at startup"
X	mscms	mscms.exe	"Added by the AGENT-MS TROJAN!"
X	MSN	systems.exe	Identified as a variant of the Backdoor.PosionIvy keylogging malware
X	Msn Configuration Loader	msngms.exe	"Added by the KELVIR.T WORM!"
X	MSN Updater	msnms.exe	"Added by the FORBOT-CG WORM!"
X	msoft-updater23	mssysstems.exe	"Added by the RBOT-ATU WORM!"
X	NAV Agent	systems.exe	"Added by the TARNO.C TROJAN! Note - this is not the valid Norton Antivirus entry of the same name"
X	printerdrv	vdms.exe	"Added by the OPTIXKIL.30 TROJAN!"
X	ProtocolDiskChk	ssrms.exe	"Added by the BDOOR-ML BACKDOOR!"
X	RunOnceEx	sms.exe	IESearchToolbar parasite. Identified by Ewido Security Suite (Ewido is now part of AVG Technologies) as the DELF.LF TROJAN!
X	Scan Register	ssms.exe	"Added by the RBOT-AT WORM!"
U	Screen Guard Message Scan	sgms.exe	"Part of Access Denied security and privacy software"
X	Security Agent Manager	mssams.exe	"Added by the RBOT-SV WORM!"
U	SeMS	SeMS.exe	"PCsms - tool that enables you to send sms text messages from your PC to any UK mobile phone"
X	Smss	ssms.exe	"Added by the RBOT.OP WORM!"
X	spoolms	spoolms.exe	"Added by the LEGMIR-ARO TROJAN!"
X	ssgrate.exe	winsystems.exe	"Added by the BAGLEDL-J TROJAN!"
X	ssgrate.exe	wintems.exe	"Added by the MITGLIEDER.Q TROJAN!"
X	ssms.exe	SSMS.EXE	"Added by the GISMOR WORM!"
X	ssms.exe	winn.exe	"Added by the SDBOT-DHE WORM!"
X	SysCVMS.exe	SysCVMS.exe	"Added by the SMALL.CBA TROJAN!"
X	Sysgate Personal Firewall	syst3ms.exe	"Added by a variant of the IRCBOT TROJAN!"
X	SysMemory manager	mdms.exe	"Added by the CIMUZ-D TROJAN!"
X	sysmss	sysems.exe	"Added by a variant of the SLAPER TROJAN!"
X	System Loader	systems.exe	"Added by the AGOGBOT-FI WORM!"
X	System Service	systems.exe	"Added by the AGOBOT.VZ WORM!"
X	System Services	ssms.exe	"Added by a variant of the RBOT WORM!"
X	Systems	Systems.exe	"Added by the BANKBOA-A TROJAN!"
U	Systems.exe	Systems.exe	"Keyboard Spectator - monitoring software that creates records of everything people do on a computer
U	systems.exe	systems.exe	"KGBSpy is a commercial surveillance software program. It logs keystrokes
X	Systesms.exe	systesms.exe	"Added by the RBOT-HI WORM!"
X	taskmgr.exe	paintms.exe	Added by a variant of the AGENT.AH TROJAN!
X	WinDLL (smms.exe)	"rundll32.exe smms.exe	start"
X	WinDll (sslms.exe)	"rundll32.exe sslms.exe	start"
X	Windows Drivers	ssms.exe	"Added by the RBOT-AT WORM!"
X	Windows Live	msgnms.exe	"Added by the XPACK.AV TROJAN!"
X	Windows Login	lms.exe	"Added by the AGOBOT-IC WORM!"
X	Windows Media Player	msams.exe	"Added by the RBOT.AHR WORM!"
X	Windows Secure Services	ssms.exe	"Added by the RBOT-GAR WORM!"
X	Windows Services Layer	sslms.exe	"Added by the RBOT-GAH WORM!"
U	WinSystem	WinSystems.exe	"CMKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	winsystems25	winsystems.exe	"Added by the RBOT-CNZ WORM!"
X	winystems25	winystems.exe	"Added by a variant of the SDBOT WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.