np

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
Consume	"Consumer Input Rewarded with MyPoints	U	"ConsumerInputRewardedwithMyPoints
Consume	"Consumer Input Rewarded with MyPoints	U	"ConsumerInputRewardedwithMyPoints
Y	a-winpoet-service	winpppoverethernet.exe	"WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion
X	Anti-Virus Product Sync	[unprintable character][3 characters]log.exe	"Added by the KEDEBE.D WORM!"
X	ApplicationProtocolRun	smsbvl32.exe	"Added by the IRCBOT-CX TROJAN!"
Y	AUCBPNP	aucbnpn.exe	Adaptec USB CardBus Safe-Eject - driver for the Adaptec USB 2.0 CardBus which provides USB 2.0 ports for laptop users via a PCMCIA card slot
X	AUNPS2	"RUNDLL32 AUNPS2.DLL	_Run@16"
U	Banpopup by Pratik	Banpopup.exe	Banpopup - popup killer
U	BelNotify	"rundll32.exe [path] NPBelv32.dll	RunDll32_BelNotify"
X	blah service	smnp.exe	"Added by the RBOT.IZ WORM!"
X	CheckWinPerf	perfinfo.exe	"Added by a variant of the IRCBOT TROJAN!"
X	CirebonPunya	XXrocks.exe	"Added by the BHARAT.A WORM!"
X	CleanPCTool	SysRep.exe	"CleanPCTool rogue system error and cleaning utility - not recommended
U	Consumer Input	ConsumerInput.exe	"Consumer Input Toolbar. Opt-in market research monitoring you browsing habits - see the FAQ"
U	cpqns	cpqnpcss.exe	Related to Compaq.Net - not required if you don't use that
X	Current32	msnpla.exe	"Added by the SDBOT-DIS WORM!"
X	Disk Panel Setup	npcsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
U	EpsonPhotoStarter	EPSON_PhotoStarter.exe	Only needed if you want to make full use of the capabilities of an Epson printer that included this
N	Fromine WinPopup	winpopup.exe	Instant Messenger program
X	GLF Network Lan Monitor	NPFMNTOR.exe	"Added by the RBOT-AGY WORM!"
X	GNP Generic Host Process	svchost.exe	"Added by the ZAPCHAS-F BACKDOOR! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
U	HP ScanPatch	HPScanFix.exe	"Program that starts up and automatically fixes earlier versions of the Scanjet 5100c software. If a Scanjet 5100C scanner is not going to be used
N	HP ScanPicture	hpsplmwa.exe	HP multifunction scanner software. Available from HP Office Jet R Toolbox so not required
U	Hti	npdor.exe	"Appears in startup if you have chosen to participate in on survey by NPD Online Research. Required for the survey to work correctly. Otherwise not required"
U	IBM ThinkPad Utility	NPDTray.exe	System Tray access to Presentation Director for IBM/Lenovo Thinkpad notebooks - which allows you to create and quickly select between various single and mulitple display options. Scheme selection and settings are also available via Fn+F7 key combination on some models
U	Kernel and Hardware Abstraction Layer	KHALMNPR.EXE	"Part of Logitech's SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice
U	KHALMNPR	KHALMNPR.EXE	"Part of Logitech's SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice
X	LoginPassport	Lgnpsp32.exe	"Added by the REDIST.C WORM!"
U	Logitech Hardware Abstraction Layer	KHALMNPR.EXE	"Part of Logitech's SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice
U	Logitech SetPoint	KHALMNPR.EXE	"Part of Logitech's SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice
X	mb2np	[random filename]	Added by the IRCBOT.TJ WORM!
X	McAfeeScanPlus	McAfeeScanPlus.exe	"Added by the MEPCOD TROJAN! This trojan file does not belong to any McAfee Antivirus Software and is found in the Windows or Winnt folder"
X	Microsoft FixUp	wnpzjpuw.exe	"Added by a variant of the SDBOT WORM!"
X	MICROSOFT UNPACCKER SYSTEM	unpak32.exe	"Added by a variant of the RBOT WORM!"
X	MICROSOFT UNPACK SYSTEM	winrarx.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft upnp Update	msie.exe	"Added by the RBOT-LQ WORM!"
X	Microsoft X Update	wuamkoppnp.exe	"Added by the RBOT-ANI WORM!"
X	MNPol	mnpol.exe	"Added by the DLUCA.B TROJAN!"
X	MONPluginSrIvcs	n3monap23.exe	"Added by a variant of the RBOT WORM!"
X	ms ownage	winPE.exe	"Added by the RBOT-AJL WORM!"
X	MSN P2P Manager	msnp2pmgr.exe	"Added by the SLENFBOT.YH WORM!"
X	Msn Plus Updater	msnplus.exe	"Added by the RBOT-MU WORM!"
X	MSN Popup Blocker	msnpopblck.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	MSN Service Updates	winproc.exe	"Added by the KELVIR-BB WORM!"
X	Msn Updater	msnplugins.exe	"Added by the RBOT-HS WORM!"
X	MSNPluginSrIvcs	n3vasap23.exe	"Added by a variant of the RBOT WORM!"
X	MSNPluginSrvcs	p6.exe	"Added by the SDBOT.AKJ or RBOT-VJ WORMS!"
X	MSNPluginSrvcs	sagate.exe	"Added by the SDBOT.AKJ WORM!"
X	MSNPlus	msnplus.exe	"Added by the BANKER-DAN TROJAN!"
X	MSPRO32	pnp.exe	"Added by the ZOTOB.O WORM!"
X	Mswinpid32	mswinpid32.exe	Added by the LAPOS.A TROJAN! This is a keylogger which emails back to China PayPal passwords and account information - thus allowing the perpetrators to steal PayPal funds in the name of the victim!
U	NaverPCGreen	NPCGreenUpgrader.exe	"Related to Naver_Anti-virus Realtime Monitor From NHNCorp"
X	NETVISIONPasse-partout	Passe-partout.exe	"Added by the DIALCAR-M DIALER!"
X	Network Provisioning Service	WinNPS.exe	Added by an unidentified WORM/TROJAN!
X	Netzip Smart Downloader	npnzdad.exe	Advertising spyware
U	NFM Service	NPDOR9x.exe	"Appears in startup if you have chosen to participate in on survey by NPD Online Research. Required for the survey to work correctly. Otherwise not required"
X	Norton Personal Firewall	npfw.exe	"Added by the RBOT-UI WORM!"
X	Norton Personal Firewall	npfw32.exe	"Added by the RBOT-UQ WORM!"
U	Norton Program Scheduler	NPSsvc.exe	"Installed on a Windows system where the Windows Task Scheduler isn't used as part of the OS (Win95
?	Norton Program Scheduler Event Checker	npscheck.exe	"Part of Norton Anti-Virus. What does it do? Apparently it can safely be disabled without causing problems. Can also be listed as NPS Event Checker"
X	Norton Protect	npprotect.exe	"Added by the RBOT-WW WORM!"
X	nortonp	nortonp.exe	"Added by the JD-A TROJAN!"
?	NovaPortal Single User Service	NPSU.exe	"??"
X	np	upnp.exe	"Added by the YABE.AE TROJAN!"
U	NPDTray	NPDTray.exe	System Tray access to Presentation Director for IBM/Lenovo Thinkpad notebooks - which allows you to create and quickly select between various single and mulitple display options. Scheme selection and settings are also available via Fn+F7 key combination on some models
X	NPF Value	NPFMONTR.exe	"Added by the RBOT-AWD WORM!"
?	NPFMonitor	NPFMntor.exe	"Norton AntiVirus Firewall Install Monitor. What does it do and is it required?"
X	npkmnc	npkmnc.exe	"WebVia adware"
U	NPROTECT	nprotect.exe	Norton Protected Recycle Bin from Norton Utilities. Adds an extra layer of safety before you remove deleted files from the Recycled Bin. Can be listed twice which is valid
?	NPS Event Checker	npscheck.exe	"Part of Norton Anti-Virus. What does it do? Apparently it can safely be disabled without causing problems. Can also be listed as Norton Program Scheduler Event Checker"
N	Paperport	runppdrv.exe	"Loads the drivers associated with monitoring scanner status associated with PaperPort software. Can be a resource hog - see here"
U	PCDrProfiler	RunProfiler.exe	Part of PC Doctor software installed for some machines. Disabling or enabling it is down to your preference
X	Performs peer to peer connection	WinPTTP.exe	"Added by the RBOT-GMI WORM!"
X	PNP	wuaaclt.exe	"Added by the LILBRE-A WORM!"
X	PnP Driver	playboy.exe	"Added by the FORBOT-FR WORM!"
X	PNP FIX	[worm filename]	"Added by the RBOT-AKQ WORM!"
U	Pnpchk	Pnpchk.exe	"Aztech Labs Sound 3 PnP driver"
X	pnpsvc_lock	*****.exe [ = random digit]	Browser hijacker
X	pnpsvc_lock	startsvs.exe	Browser hijacker
N	QNPlus	QNPlus.exe	"Quick Notes Plus by Conceptworld - sticky notes tool"
X	RealDownload Express	npnzdad.exe	Advertising spyware
N	RFX_auto_upgrade	rundll32.exe npvpg005.dll	"A browser plugin called the RichFX player. Here is a link to download RichFX's solution to removing the auto upgrade"
X	RunProg	Server.exe	"Added by the OPTIX.04.A TROJAN!"
X	RunProg	wini.exe	"Added by the OPTIX.04.D TROJAN!"
?	ScanPanel	ScanPanel.exe	"Trust Easy Webscan scanner related - what does it do and is it required?"
N	ScreenPrint32	ScreenPrint32.exe	"ScreenPrint32 screen capture software - can be launched manually"
X	Service Drivers	msnpg.exe	"Added by the RBOT.BMD WORM!"
X	SETPOINT Logitech Inc	KHALMNP.exe	"Added by the RBOT-AAX WORM!"
U	ShutDownPro	ShutDownPro.exe	"ShutDownPro - shutdown
N	Smart Start UP	PnPDetect.exe	"Part of Presto! Mr.Photo - ""an ideal program for creating
U	SMax4PNP	SMax4PNP.exe	"Analog Devices SoundMax integrated soundcard utility. Brings up the SoundMAX Control Panel when it detects if new audio devices (such as microphones
U	SMax4PNP Application	SMax4PNP.exe	"Analog Devices SoundMax integrated soundcard utility. Brings up the SoundMAX Control Panel when it detects if new audio devices (such as microphones
X	SNP Generic Host Process	svchost.exe	"Added by the ZAPCHAS-O TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
N	snp2std	vsnp2std.exe	Digital camera related
?	snp2uvc	vsnp2uvc.exe	"Related to a CameraMonitor Application from Sonix. What does it do and is it required?"
?	snpstd	vsnpstd.exe	"Sonix PC Camera Monitor MFC Application. What does it do and is it required?"
?	SNPSTD2	vsnpstd2.exe	"CameraMonitor MFC Application. Appears to be related to a USB connection to a digital camera -is it required?"
Y	snpstd3	vsnpstd3.exe	"Sonix Inc. Camera Monitor MFC Application"
U	SoundMAXPnP	SMax4PNP.exe	"Analog Devices SoundMax integrated soundcard utility. Brings up the SoundMAX Control Panel when it detects if new audio devices (such as microphones
U	SP2 Connection Patcher	SP2ConnPatcher.exe	Changes limit of concurrent TCP connections of Windows Service Pack 2
X	SpywareGuard	winproc32.exe	"Startpage adware Trojan"
N	Stat 'n' Perf	StatnPerf.exe	"Stat 'n' Perf monitors your internet connection and displays information about sent and received bytes"
U	StationPlaylistStudio	SPLStudio.exe	"StationPlaylist Studio - ""simple to use on-air broadcast playback software for the studio and/or DJ"" for small to medium sized radio broadcasters
Y	SunProtectionServer	SunProtectionServer.exe	"CounterSpy antispyware software"
U	SureCleanProfessional	SRClean.exe	"SureClean PC and Internet tracks cleaner"
X	svcwinprocess32	[path to worm]	"Added by the UPERING WORM!"
X	sysPnP	bootconf.exe	"Homepage hijacker
X	SysPnP	"rundll32 setupapi	InstallHinfSection [varies] oemsyspnp.inf"
X	system32	lowinplay.exe	"Added by the VB.FVJ TROJAN!"
X	SysTray	Snnpapi.exe	Added by an unidentified TROJAN!
U	ThinkPad Presentation Director	NPDTray.exe	System Tray access to Presentation Director for IBM/Lenovo Thinkpad notebooks - which allows you to create and quickly select between various single and mulitple display options. Scheme selection and settings are also available via Fn+F7 key combination on some models
U	TLogonPath	tb2logon.exe	"Timbuktu Pro - remote desktop access software"
U	TnPopUp	billbrz.exe	"Related to Technesis ""award-winning solutions for tracking and managing print
X	TrayX	winppr32.exe	"Added by the SOBIG.F WORM!"
X	TrustIn Popups	TrustInPopups.exe	"TrustInPopups adware"
N	tsnp2std	tsnp2std.exe	Digital camera related
Y	tsnpstd3	tsnpstd3.exe	"Related to Sonix Inc. Camera Monitor MFC Application"
X	upnp	upnp.exe	"Added by the DLOADR-YT WORM!"
X	UPNP	[path to trojan]	"Added by the DROPPER.EAT TROJAN!"
X	UPNP	upnpsvc.exe	"Added by the CLOMP-B TROJAN!"
X	UPnP Manager	upnpman.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	UPNPService	WinSVCservice.exe	"Added by the AGOBOT.UN WORM!"
X	USB Driverz2	msnplus1.exe	"Added by the SDBOT-XQ WORM!"
Y	USBPNP	USBPNP.exe	SiPix digital camera Twain USB driver
N	USBTA	usbtapnp.exe	"System Tray access for the BeWAN Gazel 128 USB ISDN adapter"
X	User Input Services	CTFMON32.EXE	"Added by the MANCSYN.AK TROJAN!"
X	Video Lan Player	VideoLanPlayer.exe	"Added by the RBOT-MY WORM!"
X	virtual	winprotect.exe	"Added by the MUGLY.C WORM!"
Y	vsnpstd3	vsnpstd3.exe	"Sonix Inc. Camera Monitor MFC Application"
X	Winapp	winpup32.exe	Produces popup ads to adult content sites
X	Windows Audio Panel	nppsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Desktop Daemon	winpadg.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Extensions for Win32	winprgs32.exe	"Added by the SDBOT.AFA WORM!"
X	Windows File Protection	winprotect.exe	"Added by the AGOBOT.JB WORM!"
X	Windows Internet Protocol	winproc32.exe	"CoolWebSearch Winproc32 parasite variant - also detected as the STARTPA-BF TROJAN!"
X	windows logon procedure	winlogonpc.exe	"Added by the WINLOGON TROJAN!"
X	Windows LoL Layer	pyvnpt.exe	"Added by the RBOT-GKV WORM!"
X	Windows Network Logon	npesvc.exe	"Added by the AGENT.ERZ TROJAN!"
X	Windows PDG	winpdg.exe	"Added by the RBOT-ADW WORM!"
X	Windows PNP	winpnp.exe	"Added by the RBOT-AKN WORM!"
X	Windows PNP Server	pnpsrv.exe	"Added by the RBOT-AKM WORM!"
X	Windows Population Logger	winpo32.exe	"Added by the AGENT.YKR WORM!"
X	Windows Printing Driver	WinPrint.exe	"Added by a variant of the RBOT WORM!"
X	Windows Process Manager	winproc.exe	Added by an unidentified WORM or TROJAN!
X	Windows Protected Storage	npssvc.exe	"Added by the IRCBOT.AUL BACKDOOR!"
X	Windows Remote Addressing	wnpcgs.exe	"Added by the DELF-EZN TROJAN!"
X	Windows Remote Launcher	wnpmcs.exe	"Added by the IRCBOT.ASX BACKDOOR!"
X	Windows Services Ink Platform Tablet Input Subsystem	wsiptis.exe	"Added by the RBOT.APC WORM!"
X	windows system notepad	wnpsm.exe	"Added by a variant of the RBOT WORM!"
X	Windows Taskmanager	winpifviewer.exe	"Added by the PUSHBOT.BB WORM!"
X	Windows UDP Control Center	msnpd.exe	"Added by the SDBOT.EBA BACKDOOR!"
X	Windows Video Input	viwsvc.exe	"Added by the SLENFBOT.GS WORM!"
X	WINP	winmic.exe	"Added by the SPYBOT-EB WORM!"
X	Winpack	winpack.exe	"Adware - detected by Kaspersky as the AGENT.GG TROJAN!"
X	WinPatch Protection	winpatch.exe	Added by an unidentified WORM or TROJAN!
U	WinPatrol	winpatrol.exe	"WinPatrol - ""Manage Startup programs
Y	WinPatrol Explorer	WinPatrolEx.exe	"Part of WinPatrol"
U	WinPatrol Monitor	winpatrol.exe	"WinPatrol - ""Manage Startup programs
X	WinPCDoctor	SysRep.exe	"WinPCDoctor rogue system error and cleaning utility - not recommended
X	WinPerformance	WinPerformance.lnk	"Windows Performance rogue optimization utility - not recommended"
X	winphonics7536	vbsystem35.exe setups.exe vb.vb	"Added by a variant of the MUTIN-C TROJAN!"
X	winpipe	winpipe.exe	Browser hijacker redirecting to wow-access.com
U	WinPLOSION	WinPlosion.exe	"""WinPLOSION allows you to immediately view and select from all the windows running on your computer
X	WinPN32	winpn32.exe	"Added by the AGOBOT-FJ WORM!"
Y	WinPoet	WinPPPoverEthernet.exe	"WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion
X	winpol	winpol.exe	"Added by the AGENT.IWD TROJAN!"
Y	Winpooch	Winpooch.exe	"""Winpooch is a Windows watchdog
X	WinPop	winpop.exe	"Brudevic A adware"
N	WinPopup	WINPOPUP.EXE	"Intranet chat software provided by windows for chat on small networks. Handy little LAN messaging utility. Has been included in Windows since 95
X	winpopup	winupie.exe	Adware by Tradeexit.com
N	Winpower	Winpower.exe	"Part of InstallAnywhere from Zero G Software
X	WinProc32	winproc32.exe	"Added by the AGOBOT-4 WORM!"
X	Winprocer32 Update	winprocer32.exe	"Added by the RBOT.GW WORM!"
X	winprocessor Update	winprocessor.exe	"Added by the RBOT.IO WORM!"
X	WinProfile	Command.exe	"Added by the BUDDY.E TROJAN!"
X	WinProfile	sndcfg16.exe	"Added by the SNDC.A WORM!"
X	winprofile	iexpiore.exe	Added by a variant of the MONCHER WORM!
X	WinProfile	iexpIore.exe	"Added by the CHUM-C TROJAN!"
X	WinProt	Winprot.exe	"Added by the CHUPACABRA TROJAN!"
X	WinProt	server.exe	"Added by the CHUPACABRA TROJAN!"
X	winprotect	win32.exe	"Added by the MUGLY.E WORM!"
X	winprotect	winprotect.exe	"Added by the SDBOT-SB WORM!"
X	winprotection	ccsrss.exe	"Added by the SILLYFDC.BBT WORM!"
X	WinProtector	WinProtector.exe	"WinProtector rogue security software - not recommended
U	WinProxy	WinProxy.EXE	""WinProxy is the world-first proxy server and a firewall with integrated mail server for Windows 95/98/ME/NT/2000/XP""
X	Winproxy Personal	WINPROXY.EXE	"Added by the SDBOT.BMF WORM!"
X	winpsd	winpsd.exe	"Added by the MYDOOM.Q WORM!"
X	WinPWD Manager	wpwdmgr.exe	"Added by the RBOT-AUT WORM!"
X	wintnpx.exe	wintnpx.exe	"Added by the ZOTOB.H WORM!"
N	ZSSnp211	ZSSnp211.exe	"Vmicro webcam USB utility - allows the webcam to initiate data transfer to a program. Create a shortcut and start it manually when needed"
X	[12 random characters]	capesnpn.exe	"IeDriver adware variant"
X	[various names]	InpriseMon.exe	"Wareout - malware masquerading as a spyware and dialer remover"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.