Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
Consume"Consumer Input Rewarded with MyPointsU"ConsumerInputRewardedwithMyPoints
Consume"Consumer Input Rewarded with MyPointsU"ConsumerInputRewardedwithMyPoints
Ya-winpoet-servicewinpppoverethernet.exe"WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion
XAnti-Virus Product Sync[unprintable character][3 characters]log.exe"Added by the KEDEBE.D WORM!"
XApplicationProtocolRunsmsbvl32.exe"Added by the IRCBOT-CX TROJAN!"
YAUCBPNPaucbnpn.exeAdaptec USB CardBus Safe-Eject - driver for the Adaptec USB 2.0 CardBus which provides USB 2.0 ports for laptop users via a PCMCIA card slot
XAUNPS2"RUNDLL32 AUNPS2.DLL _Run@16"
UBanpopup by PratikBanpopup.exeBanpopup - popup killer
UBelNotify"rundll32.exe [path] NPBelv32.dll RunDll32_BelNotify"
Xblah servicesmnp.exe"Added by the RBOT.IZ WORM!"
XCheckWinPerfperfinfo.exe"Added by a variant of the IRCBOT TROJAN!"
XCirebonPunyaXXrocks.exe"Added by the BHARAT.A WORM!"
XCleanPCToolSysRep.exe"CleanPCTool rogue system error and cleaning utility - not recommended
UConsumer InputConsumerInput.exe"Consumer Input Toolbar. Opt-in market research monitoring you browsing habits - see the FAQ"
Ucpqnscpqnpcss.exeRelated to Compaq.Net - not required if you don't use that
XCurrent32msnpla.exe"Added by the SDBOT-DIS WORM!"
XDisk Panel Setupnpcsvc.exe"Added by a variant of the IRCBOT TROJAN!"
UEpsonPhotoStarterEPSON_PhotoStarter.exeOnly needed if you want to make full use of the capabilities of an Epson printer that included this
NFromine WinPopupwinpopup.exeInstant Messenger program
XGLF Network Lan MonitorNPFMNTOR.exe"Added by the RBOT-AGY WORM!"
XGNP Generic Host Processsvchost.exe"Added by the ZAPCHAS-F BACKDOOR! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
UHP ScanPatchHPScanFix.exe"Program that starts up and automatically fixes earlier versions of the Scanjet 5100c software. If a Scanjet 5100C scanner is not going to be used
NHP ScanPicturehpsplmwa.exeHP multifunction scanner software. Available from HP Office Jet R Toolbox so not required
UHtinpdor.exe"Appears in startup if you have chosen to participate in on survey by NPD Online Research. Required for the survey to work correctly. Otherwise not required"
UIBM ThinkPad UtilityNPDTray.exeSystem Tray access to Presentation Director for IBM/Lenovo Thinkpad notebooks - which allows you to create and quickly select between various single and mulitple display options. Scheme selection and settings are also available via Fn+F7 key combination on some models
UKernel and Hardware Abstraction LayerKHALMNPR.EXE"Part of Logitech's SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice
UKHALMNPRKHALMNPR.EXE"Part of Logitech's SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice
XLoginPassportLgnpsp32.exe"Added by the REDIST.C WORM!"
ULogitech Hardware Abstraction LayerKHALMNPR.EXE"Part of Logitech's SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice
ULogitech SetPointKHALMNPR.EXE"Part of Logitech's SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice
Xmb2np[random filename]Added by the IRCBOT.TJ WORM!
XMcAfeeScanPlusMcAfeeScanPlus.exe"Added by the MEPCOD TROJAN! This trojan file does not belong to any McAfee Antivirus Software and is found in the Windows or Winnt folder"
XMicrosoft FixUpwnpzjpuw.exe"Added by a variant of the SDBOT WORM!"
XMICROSOFT UNPACCKER SYSTEMunpak32.exe"Added by a variant of the RBOT WORM!"
XMICROSOFT UNPACK SYSTEMwinrarx.exe"Added by a variant of the RBOT WORM!"
XMicrosoft upnp Updatemsie.exe"Added by the RBOT-LQ WORM!"
XMicrosoft X Updatewuamkoppnp.exe"Added by the RBOT-ANI WORM!"
XMNPolmnpol.exe"Added by the DLUCA.B TROJAN!"
XMONPluginSrIvcsn3monap23.exe"Added by a variant of the RBOT WORM!"
Xms ownagewinPE.exe"Added by the RBOT-AJL WORM!"
XMSN P2P Managermsnp2pmgr.exe"Added by the SLENFBOT.YH WORM!"
XMsn Plus Updatermsnplus.exe"Added by the RBOT-MU WORM!"
XMSN Popup Blockermsnpopblck.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
XMSN Service Updateswinproc.exe"Added by the KELVIR-BB WORM!"
XMsn Updatermsnplugins.exe"Added by the RBOT-HS WORM!"
XMSNPluginSrIvcsn3vasap23.exe"Added by a variant of the RBOT WORM!"
XMSNPluginSrvcsp6.exe"Added by the SDBOT.AKJ or RBOT-VJ WORMS!"
XMSNPluginSrvcssagate.exe"Added by the SDBOT.AKJ WORM!"
XMSNPlusmsnplus.exe"Added by the BANKER-DAN TROJAN!"
XMSPRO32pnp.exe"Added by the ZOTOB.O WORM!"
XMswinpid32mswinpid32.exeAdded by the LAPOS.A TROJAN! This is a keylogger which emails back to China PayPal passwords and account information - thus allowing the perpetrators to steal PayPal funds in the name of the victim!
UNaverPCGreenNPCGreenUpgrader.exe"Related to Naver_Anti-virus Realtime Monitor From NHNCorp"
XNETVISIONPasse-partoutPasse-partout.exe"Added by the DIALCAR-M DIALER!"
XNetwork Provisioning ServiceWinNPS.exeAdded by an unidentified WORM/TROJAN!
XNetzip Smart Downloadernpnzdad.exeAdvertising spyware
UNFM ServiceNPDOR9x.exe"Appears in startup if you have chosen to participate in on survey by NPD Online Research. Required for the survey to work correctly. Otherwise not required"
XNorton Personal Firewallnpfw.exe"Added by the RBOT-UI WORM!"
XNorton Personal Firewallnpfw32.exe"Added by the RBOT-UQ WORM!"
UNorton Program SchedulerNPSsvc.exe"Installed on a Windows system where the Windows Task Scheduler isn't used as part of the OS (Win95
?Norton Program Scheduler Event Checkernpscheck.exe"Part of Norton Anti-Virus. What does it do? Apparently it can safely be disabled without causing problems. Can also be listed as NPS Event Checker"
XNorton Protectnpprotect.exe"Added by the RBOT-WW WORM!"
Xnortonpnortonp.exe"Added by the JD-A TROJAN!"
?NovaPortal Single User ServiceNPSU.exe"??"
Xnpupnp.exe"Added by the YABE.AE TROJAN!"
UNPDTrayNPDTray.exeSystem Tray access to Presentation Director for IBM/Lenovo Thinkpad notebooks - which allows you to create and quickly select between various single and mulitple display options. Scheme selection and settings are also available via Fn+F7 key combination on some models
XNPF ValueNPFMONTR.exe"Added by the RBOT-AWD WORM!"
?NPFMonitorNPFMntor.exe"Norton AntiVirus Firewall Install Monitor. What does it do and is it required?"
Xnpkmncnpkmnc.exe"WebVia adware"
UNPROTECTnprotect.exeNorton Protected Recycle Bin from Norton Utilities. Adds an extra layer of safety before you remove deleted files from the Recycled Bin. Can be listed twice which is valid
?NPS Event Checkernpscheck.exe"Part of Norton Anti-Virus. What does it do? Apparently it can safely be disabled without causing problems. Can also be listed as Norton Program Scheduler Event Checker"
NPaperportrunppdrv.exe"Loads the drivers associated with monitoring scanner status associated with PaperPort software. Can be a resource hog - see here"
UPCDrProfilerRunProfiler.exePart of PC Doctor software installed for some machines. Disabling or enabling it is down to your preference
XPerforms peer to peer connectionWinPTTP.exe"Added by the RBOT-GMI WORM!"
XPNPwuaaclt.exe"Added by the LILBRE-A WORM!"
XPnP Driverplayboy.exe"Added by the FORBOT-FR WORM!"
XPNP FIX[worm filename]"Added by the RBOT-AKQ WORM!"
UPnpchkPnpchk.exe"Aztech Labs Sound 3 PnP driver"
Xpnpsvc_lock******.exe [* = random digit]Browser hijacker
Xpnpsvc_lockstartsvs.exeBrowser hijacker
NQNPlusQNPlus.exe"Quick Notes Plus by Conceptworld - sticky notes tool"
XRealDownload Expressnpnzdad.exeAdvertising spyware
NRFX_auto_upgraderundll32.exe npvpg005.dll"A browser plugin called the RichFX player. Here is a link to download RichFX's solution to removing the auto upgrade"
XRunProgServer.exe"Added by the OPTIX.04.A TROJAN!"
XRunProgwini.exe"Added by the OPTIX.04.D TROJAN!"
?ScanPanelScanPanel.exe"Trust Easy Webscan scanner related - what does it do and is it required?"
NScreenPrint32ScreenPrint32.exe"ScreenPrint32 screen capture software - can be launched manually"
XService Driversmsnpg.exe"Added by the RBOT.BMD WORM!"
XSETPOINT Logitech IncKHALMNP.exe"Added by the RBOT-AAX WORM!"
UShutDownProShutDownPro.exe"ShutDownPro - shutdown
NSmart Start UPPnPDetect.exe"Part of Presto! Mr.Photo - ""an ideal program for creating
USMax4PNPSMax4PNP.exe"Analog Devices SoundMax integrated soundcard utility. Brings up the SoundMAX Control Panel when it detects if new audio devices (such as microphones
USMax4PNP ApplicationSMax4PNP.exe"Analog Devices SoundMax integrated soundcard utility. Brings up the SoundMAX Control Panel when it detects if new audio devices (such as microphones
XSNP Generic Host Processsvchost.exe"Added by the ZAPCHAS-O TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
Nsnp2stdvsnp2std.exeDigital camera related
?snp2uvcvsnp2uvc.exe"Related to a CameraMonitor Application from Sonix. What does it do and is it required?"
?snpstdvsnpstd.exe"Sonix PC Camera Monitor MFC Application. What does it do and is it required?"
?SNPSTD2vsnpstd2.exe"CameraMonitor MFC Application. Appears to be related to a USB connection to a digital camera -is it required?"
Ysnpstd3vsnpstd3.exe"Sonix Inc. Camera Monitor MFC Application"
USoundMAXPnPSMax4PNP.exe"Analog Devices SoundMax integrated soundcard utility. Brings up the SoundMAX Control Panel when it detects if new audio devices (such as microphones
USP2 Connection PatcherSP2ConnPatcher.exeChanges limit of concurrent TCP connections of Windows Service Pack 2
XSpywareGuardwinproc32.exe"Startpage adware Trojan"
NStat 'n' PerfStatnPerf.exe"Stat 'n' Perf monitors your internet connection and displays information about sent and received bytes"
UStationPlaylistStudioSPLStudio.exe"StationPlaylist Studio - ""simple to use on-air broadcast playback software for the studio and/or DJ"" for small to medium sized radio broadcasters
YSunProtectionServerSunProtectionServer.exe"CounterSpy antispyware software"
USureCleanProfessionalSRClean.exe"SureClean PC and Internet tracks cleaner"
Xsvcwinprocess32[path to worm]"Added by the UPERING WORM!"
XsysPnPbootconf.exe"Homepage hijacker
XSysPnP"rundll32 setupapi InstallHinfSection [varies] oemsyspnp.inf"
Xsystem32lowinplay.exe"Added by the VB.FVJ TROJAN!"
XSysTraySnnpapi.exeAdded by an unidentified TROJAN!
UThinkPad Presentation DirectorNPDTray.exeSystem Tray access to Presentation Director for IBM/Lenovo Thinkpad notebooks - which allows you to create and quickly select between various single and mulitple display options. Scheme selection and settings are also available via Fn+F7 key combination on some models
UTLogonPathtb2logon.exe"Timbuktu Pro - remote desktop access software"
UTnPopUpbillbrz.exe"Related to Technesis ""award-winning solutions for tracking and managing print
XTrayXwinppr32.exe"Added by the SOBIG.F WORM!"
XTrustIn PopupsTrustInPopups.exe"TrustInPopups adware"
Ntsnp2stdtsnp2std.exeDigital camera related
Ytsnpstd3tsnpstd3.exe"Related to Sonix Inc. Camera Monitor MFC Application"
Xupnpupnp.exe"Added by the DLOADR-YT WORM!"
XUPNP[path to trojan]"Added by the DROPPER.EAT TROJAN!"
XUPNPupnpsvc.exe"Added by the CLOMP-B TROJAN!"
XUPnP Managerupnpman.exe"Added by a variant of the AGOBOT/GAOBOT WORM!"
XUPNPServiceWinSVCservice.exe"Added by the AGOBOT.UN WORM!"
XUSB Driverz2msnplus1.exe"Added by the SDBOT-XQ WORM!"
YUSBPNPUSBPNP.exeSiPix digital camera Twain USB driver
NUSBTAusbtapnp.exe"System Tray access for the BeWAN Gazel 128 USB ISDN adapter"
XUser Input ServicesCTFMON32.EXE"Added by the MANCSYN.AK TROJAN!"
XVideo Lan PlayerVideoLanPlayer.exe"Added by the RBOT-MY WORM!"
Xvirtualwinprotect.exe"Added by the MUGLY.C WORM!"
Yvsnpstd3vsnpstd3.exe"Sonix Inc. Camera Monitor MFC Application"
XWinappwinpup32.exeProduces popup ads to adult content sites
XWindows Audio Panelnppsvc.exe"Added by a variant of the IRCBOT TROJAN! See here"
XWindows Desktop Daemonwinpadg.exe"Added by a variant of the SPYBOT WORM!"
XWindows Extensions for Win32winprgs32.exe"Added by the SDBOT.AFA WORM!"
XWindows File Protectionwinprotect.exe"Added by the AGOBOT.JB WORM!"
XWindows Internet Protocolwinproc32.exe"CoolWebSearch Winproc32 parasite variant - also detected as the STARTPA-BF TROJAN!"
Xwindows logon procedurewinlogonpc.exe"Added by the WINLOGON TROJAN!"
XWindows LoL Layerpyvnpt.exe"Added by the RBOT-GKV WORM!"
XWindows Network Logonnpesvc.exe"Added by the AGENT.ERZ TROJAN!"
XWindows PDGwinpdg.exe"Added by the RBOT-ADW WORM!"
XWindows PNPwinpnp.exe"Added by the RBOT-AKN WORM!"
XWindows PNP Serverpnpsrv.exe"Added by the RBOT-AKM WORM!"
XWindows Population Loggerwinpo32.exe"Added by the AGENT.YKR WORM!"
XWindows Printing DriverWinPrint.exe"Added by a variant of the RBOT WORM!"
XWindows Process Managerwinproc.exeAdded by an unidentified WORM or TROJAN!
XWindows Protected Storagenpssvc.exe"Added by the IRCBOT.AUL BACKDOOR!"
XWindows Remote Addressingwnpcgs.exe"Added by the DELF-EZN TROJAN!"
XWindows Remote Launcherwnpmcs.exe"Added by the IRCBOT.ASX BACKDOOR!"
XWindows Services Ink Platform Tablet Input Subsystemwsiptis.exe"Added by the RBOT.APC WORM!"
Xwindows system notepadwnpsm.exe"Added by a variant of the RBOT WORM!"
XWindows Taskmanagerwinpifviewer.exe"Added by the PUSHBOT.BB WORM!"
XWindows UDP Control Centermsnpd.exe"Added by the SDBOT.EBA BACKDOOR!"
XWindows Video Inputviwsvc.exe"Added by the SLENFBOT.GS WORM!"
XWINPwinmic.exe"Added by the SPYBOT-EB WORM!"
XWinpackwinpack.exe"Adware - detected by Kaspersky as the AGENT.GG TROJAN!"
XWinPatch Protectionwinpatch.exeAdded by an unidentified WORM or TROJAN!
UWinPatrolwinpatrol.exe"WinPatrol - ""Manage Startup programs
YWinPatrol ExplorerWinPatrolEx.exe"Part of WinPatrol"
UWinPatrol Monitorwinpatrol.exe"WinPatrol - ""Manage Startup programs
XWinPCDoctorSysRep.exe"WinPCDoctor rogue system error and cleaning utility - not recommended
XWinPerformanceWinPerformance.lnk"Windows Performance rogue optimization utility - not recommended"
Xwinphonics7536vbsystem35.exe setups.exe vb.vb"Added by a variant of the MUTIN-C TROJAN!"
Xwinpipewinpipe.exeBrowser hijacker redirecting to wow-access.com
UWinPLOSIONWinPlosion.exe"""WinPLOSION allows you to immediately view and select from all the windows running on your computer
XWinPN32winpn32.exe"Added by the AGOBOT-FJ WORM!"
YWinPoetWinPPPoverEthernet.exe"WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion
Xwinpolwinpol.exe"Added by the AGENT.IWD TROJAN!"
YWinpoochWinpooch.exe"""Winpooch is a Windows watchdog
XWinPopwinpop.exe"Brudevic A adware"
NWinPopupWINPOPUP.EXE"Intranet chat software provided by windows for chat on small networks. Handy little LAN messaging utility. Has been included in Windows since 95
Xwinpopupwinupie.exeAdware by Tradeexit.com
NWinpowerWinpower.exe"Part of InstallAnywhere from Zero G Software
XWinProc32winproc32.exe"Added by the AGOBOT-4 WORM!"
XWinprocer32 Updatewinprocer32.exe"Added by the RBOT.GW WORM!"
Xwinprocessor Updatewinprocessor.exe"Added by the RBOT.IO WORM!"
XWinProfileCommand.exe"Added by the BUDDY.E TROJAN!"
XWinProfilesndcfg16.exe"Added by the SNDC.A WORM!"
Xwinprofileiexpiore.exeAdded by a variant of the MONCHER WORM!
XWinProfileiexpIore.exe"Added by the CHUM-C TROJAN!"
XWinProtWinprot.exe"Added by the CHUPACABRA TROJAN!"
XWinProtserver.exe"Added by the CHUPACABRA TROJAN!"
Xwinprotectwin32.exe"Added by the MUGLY.E WORM!"
Xwinprotectwinprotect.exe"Added by the SDBOT-SB WORM!"
Xwinprotectionccsrss.exe"Added by the SILLYFDC.BBT WORM!"
XWinProtectorWinProtector.exe"WinProtector rogue security software - not recommended
UWinProxyWinProxy.EXE""WinProxy is the world-first proxy server and a firewall with integrated mail server for Windows 95/98/ME/NT/2000/XP""
XWinproxy PersonalWINPROXY.EXE"Added by the SDBOT.BMF WORM!"
Xwinpsdwinpsd.exe"Added by the MYDOOM.Q WORM!"
XWinPWD Managerwpwdmgr.exe"Added by the RBOT-AUT WORM!"
Xwintnpx.exewintnpx.exe"Added by the ZOTOB.H WORM!"
NZSSnp211ZSSnp211.exe"Vmicro webcam USB utility - allows the webcam to initiate data transfer to a program. Create a shortcut and start it manually when needed"
X[12 random characters]capesnpn.exe"IeDriver adware variant"
X[various names]InpriseMon.exe"Wareout - malware masquerading as a spyware and dialer remover"


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.