Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
Y!1_pgaccountpgaccount.exe"DiamondCS ProcessGuard security software - stops malicious worms and trojans from being executed silently in the background
XAdvancedPrivacyGuardapg.exe"AdvancedPrivacyGuard rogue privacy program - not recommended
XAntiSpionagepgs.exe"AntiSpionage
XAntiSpionagePropgs.exe"AntiSpionagePro
XAntiSpyControlpgs.exe"AntiSpyControl rogue security software - not recommended
XAntiSpywareControlpgs.exe"AntiSpywareControl rogue security software - not recommended
XAntiSpywareSuitepgs.exe"AntiSpywareSuite rogue security software - not recommended. A member of the AVSystemCare family"
XAntiVer2008pgs.exe"AntiVer2008
XAntivirusFiablepgs.exe"AntivirusFiable
XAntivirusForAllpgs.exe"AntivirusForAll rogue security software - not recommended
XAntivirusOrdipgs.exe"AntivirusOrdi
XAntivirusPCPakkepgs.exe"AntivirusPCPakke
XAntivirusPCSuitepgs.exe"AntivirusPCSuite rogue security software - not recommended
XAntiviruspertuttipgs.exe"Antiviruspertutti rogue security software - not recommended. A member of the AVSystemCare family"
XAntivirusschermpgs.exe"Antivirusscherm
XAntiWorm2008pgs.exe"AntiWorm2008 rogue security software - not recommended. A member of the AVSystemCare family"
Xatf.exepgs.exe"Part of the PCSecureSystem rogue security software - not recommended. A member of the AVSystemCare family"
XAVSeguropgs.exe"AVSeguro
XAVSystemCarepgs.exe"AVSystemCare rogue security software - not recommended. There are number of variants in this family sharing the same filename and user interface - see here"
XBastioneAntiviruspgs.exe"BastioneAntivirus
XBedreigingsMonitoorpgs.exe"BedreigingsMonitoor rogue security software - not recommended. A member of the AVSystemCare family"
XBestsellerAntiviruspgs.exe"BestsellerAntivirus rogue security software - not recommended
XBortMedViruspgs.exe"BortMedVirus rogue security software - not recommended. A member of the AVSystemCare family"
Ucapfupgradecapfupgrade.exe"CA Personal Firewall - part of the CA Internet Security Suite"
XCTFMONwscript.exe /E:vbs winjpg.jpg"Added by the RUNAUTO.F WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""winjpg.jpg"" file is located in %System%"
XDefensaAntiMalwarepgs.exe"DefensaAntiMalware
XDRM Upgradedrmupgd.exe"Added by the IRCBOT.AWU BACKDOOR!"
XDrmupgdsDrmupgds.exe"Maxfiles adware"
XDVD Upgradedvdupgd.exe"Added by a variant of the IRCBOT BACKDOOR!"
NDVDUpgradeDVDUpgrd.exe"Microsoft program to upgrade your DVD decoder program - see Q306331. Available via Start -> Programs"
UELSAChipGuardelsavect.exe"ChipGuard for ELSA graphics cards - monitoring solution which monitors both the GPU temperature and fan speed
UEPGServiceToolEPGClient.exe"Electronic Programme Guide (EPG) for the WinTV range of TV Tuners from Hauppauge"
UEPGServiceToolEPGCLI~1.EXE"Electronic Programme Guide (EPG) for the WinTV range of TV Tuners from Hauppauge"
XFhzepgyiHELLRAIDER.EXE"Added by the MINDCTRL.A BACKDOOR!"
XFirefox Plugin Managerfirefoxpgm.exeAdded by the MSNPHOTO.E WORM!
?First Principle Groupfpg.exe"Related to the E-Players Card from First Principle Group"
Xfreinstpgs.exe"Part of the AVSystemCare rogue security software and other members of this family. See here for more examples"
XFTPGraberFTPGraber.exe"Added by the DLOADER-DT TROJAN!"
XGoldenAntiSpypgs.exe"GoldenAntiSpy rogue security software - not recommended. A member of the AVSystemCare family"
UGTVEpgGTVEpg.exe"Part of Got All Media - control your TV tuner and other utilities from your PC"
UHPGamesActiveMenuActiveMenu.exeWild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
Nhpgs2wndhpgs2wnd.exe"Share-to-Web - HP-created software and Internet-based application that enables easy uploading and sharing of photos via affiliated photo-sharing Web sites. Available via Start → Programs"
UHPLaptopGamesActiveMenuActiveMenu.exeWild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
YISP.COM High Speedslipgui.exe"User interface for Slipstream - internet acceleration through compression/decompression techniques
Xjpgdiag[path to worm]"Added by the STRATION-AN WORM!"
XLTM2MPGSRV32.EXE"Added by the LITMUS.201 TROJAN!"
XMegaVirusKitpgs.exe"MegaVirusKit rogue security software - not recommended. A member of the AVSystemCare family"
XMenaceSecurepgs.exe"MenaceSecure rogue security software - not recommended. A member of the AVSystemCare family"
XMicrosft Upgraed[random filename].exe"Added by a variant of the SDBOT WORM!"
XMicrosoft Vista Upgrade Validation Servicecfmon.exe"Added by a variant of the IRCBOT BACKDOOR!"
XMSN MMISSENGERmssmmspgr.exe"Added by the KELVIR.AJ WORM!"
XMSWindows Syspgmspg32.exe"Added by the RBOT-TB WORM!"
XMyAVavpguard.exe"Added by the NETSKY.J WORM!"
UNaverPCGreenNPCGreenUpgrader.exe"Related to Naver_Anti-virus Realtime Monitor From NHNCorp"
XNeuerSchildpgs.exe"NeuerSchild
XNoWayViruspgs.exe"NoWayVirus rogue security software - not recommended
Xorder_Shellorder_pgum.exe"Added by the AGENT-BSQ TROJAN!"
Xoverinstallpgs.exe"Part of VirtualPCGuard
UPC Tools Privacy Guardianpg.exe"Part of Privacy Guardian from PC Tools - which ""is a safe and easy-to-use privacy protection tool that securely deletes online Internet tracks and program activity records that are stored in your browser and other hidden files on your computer"". This startup entry runs only on the next reboot if the ""Cache
XPCAntiVirusPropgs.exe"PCAntiVirusPro rogue security software - not recommended
XPCSecureSystempgs.exe"PCSecureSystem rogue security software - not recommended. A member of the AVSystemCare family"
XPCTotalDefenderpgs.exe"PCTotalDefender rogue security software - not recommended. A member of the AVSystemCare family"
XPCViruslesspgs.exe"PCVirusless
UPeerGuardianpg2.exe"PeerGuardian - IP blocker for Windows. Used to protect privacy on P2P networks by blocking IP addresses specified in blocklists. Features support for multiple lists
Upgpg.exe"Part of Privacy Guardian from PC Tools - which ""is a safe and easy-to-use privacy protection tool that securely deletes online Internet tracks and program activity records that are stored in your browser and other hidden files on your computer"". This startup entry runs only on the next reboot if the ""Cache
YPghistPgHist.exe"Part of Privacy Guardian from PC Tools - which ""is a safe and easy-to-use privacy protection tool that securely deletes online Internet tracks and program activity records that are stored in your browser and other hidden files on your computer"". This startup entry runs only on the next reboot if the ""Cache
YPgHist.exePgHist.exe"Part of Privacy Guardian from PC Tools - which ""is a safe and easy-to-use privacy protection tool that securely deletes online Internet tracks and program activity records that are stored in your browser and other hidden files on your computer"". This startup entry runs only on the next reboot if the ""Cache
YPgIndexPgIndex.exe"Part of Privacy Guardian from PC Tools - which ""is a safe and easy-to-use privacy protection tool that securely deletes online Internet tracks and program activity records that are stored in your browser and other hidden files on your computer"". This startup entry runs only on the next reboot if the ""Index.dat"" option is selected for IE under ""Browsers"" when the users selects ""Clean Your Computer"". Index.dat files keep a track of pages
XPgMonitrPgMonitr.exe"Delfin Promulgate adware variant"
YPGPSDKSVCpgpsdkserv.exe"PGPsdkServ.exe is the new SDK service which is responsible for performing all PGP key management and cryptographic functions. This functionality was moved into a service to allow multiple modules simultaneous read/write access to the keyrings
UPGPSERVICEpgpservice.exe"PGPservice.exe has two main purposes: (1) it handles a large part of the PGPnet functionality (along with the PGPnet driver) and (2) it allows efficient access to the PGP preferences database. The individual PGP modules normally access the preferences through PGPservice
NPGPtraypgptray.exePGP 7.x. Provides icon tray shortcuts to PGP programs from Network Associates. Available via Start -> Programs
XPGQLpgql.exe"Added by the BCKDR-PQN BACKDOOR!"
XPGStub.exe[various filenames]Unidentified adware
Xpgtaffpgtaff.exeAdRotator adware variant
UPP Gammappgamma.exe"Profile Prism software that allows monitor calibration and can generate ICC profiles for digital cameras"
YPrivacy GuardianPgIndex.exe"Part of Privacy Guardian from PC Tools - which ""is a safe and easy-to-use privacy protection tool that securely deletes online Internet tracks and program activity records that are stored in your browser and other hidden files on your computer"". This startup entry runs only on the next reboot if the ""Index.dat"" option is selected for IE under ""Browsers"" when the users selects ""Clean Your Computer"". Index.dat files keep a track of pages
UPrivacy Guardianpg.exe"Part of Privacy Guardian from PC Tools - which ""is a safe and easy-to-use privacy protection tool that securely deletes online Internet tracks and program activity records that are stored in your browser and other hidden files on your computer"". This startup entry runs only on the next reboot if the ""Cache
YPrivacyGuardianIndexPgIndex.exe"Part of Privacy Guardian from PC Tools - which ""is a safe and easy-to-use privacy protection tool that securely deletes online Internet tracks and program activity records that are stored in your browser and other hidden files on your computer"". This startup entry runs only on the next reboot if the ""Index.dat"" option is selected for IE under ""Browsers"" when the users selects ""Clean Your Computer"". Index.dat files keep a track of pages
XPromulGatePgMonitr.exe"Delfin Promulgate adware variant"
XProtectionCompletepgs.exe"ProtectionComplete rogue security software - not recommended. A member of the AVSystemCare family"
XProtectionConuepgs.exe"ProtectionConue rogue security software - not recommended. A member of the AVSystemCare family"
XProtezionefiDatapgs.exe"ProtezionefiData rogue security software - not recommended. A member of the AVSystemCare family"
XRegistrywscript.exe ShakiraPics.jpg.vbs"Added by the VBSWG.AQ WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""ShakiraPics.jpg.vbs"" file is located in %Windir%"
XRemote Access Monitorrpgsvc.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
NRFX_auto_upgraderundll32.exe npvpg005.dll"A browser plugin called the RichFX player. Here is a link to download RichFX's solution to removing the auto upgrade"
XSearchUpgraderSearchUpgrader.exeHijacker
XService Driversmsnpg.exe"Added by the RBOT.BMD WORM!"
NShare-to-Web Namespace Daemonhpgs2wnd.exe"Share-to-Web - HP-created software and Internet-based application that enables easy uploading and sharing of photos via affiliated photo-sharing Web sites. Available via Start → Programs"
XSichererAntiviruspgs.exe"SichererAntivirus
XSichererSchutzpgs.exe"SichererSchutz
Yslipguislipgui.exe"User interface for Slipstream - internet acceleration through compression/decompression techniques
USoftickPPPPPPGate.exe"Softick PPP is a Microsoft Windows driver that allows to establish PPP session between Palm powered devices and Microsoft Windows desktop computer"
XSolelunaAntiViruspgs.exe"SolelunaAntiVirus rogue security software - not recommended. A member of the AVSystemCare family"
XSpyGuardPropgs.exe"SpyGuardPro rogue security software - not recommended. A member of the AVSystemCare family"
Xstatloadspgjd83sa.exe"Added by the SDBOT-UM WORM!"
USystem Mechanic Startup GuardStartupGuard.exe"System Mechanic Startup Guard protects the Window's startup locations from being modified by viruses
Xtipguard.exetipguard.exe"Privacy Commander rogue privacy program - not recommended
XTrojansFilterpgs.exe"TrojansFilter rogue security software - not recommended. A member of the AVSystemCare family"
XTrojansFiltrepgs.exe"TrojansFiltre
XTrustedAntiviruspgs.exe"TrustedAntivirus rogue security software - not recommended. A member of the AVSystemCare family"
NUpConfgVerUpgConf.exe"Part of Panda Antivirus and Internet Security. Purpose unclear
XUpgrade Sarvicesxchost.exe"Added by a variant of the TOFGER-I TROJAN!"
XUpgrade Servicesxchost.exe"Added by the TOFGER-I TROJAN!"
XUpgrade Servicewinupd.exe"Added by the TOFGER-U TROJAN!"
XVeiligheidAgentpgs.exe"VeiligheidAgent
XVirtualPCGuardpgs.exe"VirtualPCGuard rogue security software - not recommended
XVirusDifesapgs.exe"VirusDifesa
XVirusEffaceurpgs.exe"VirusEffaceur
XVirusForsvarpgs.exe"VirusForsvar
XVirusGardepgs.exe"VirusGarde
XVirusGuardPluspgs.exe"VirusGuardPlus rogue security software - not recommended
XVirusSchlachtpgs.exe"VirusSchlacht
XVirusSeigyopgs.exe"VirusSeigyo rogue security software - not recommended. A member of the AVSystemCare family"
XVirusVaktpgs.exe"VirusVakt
XVistaUpgradevistaupgrade.exe"Added by the STRATION-AX WORM!"
XWegVonVirenpgs.exe"WegVonViren
XWin32 Usb DriverAvpG.exe"Added by the FORBOT-BX WORM!"
XWindows Media UpgradeNeUpgrade.exe"Added by the RBOT.BMF TROJAN!"
XWindows Upgrate Utilitywinulty.exe"Added by the AUTORUN-ASR WORM!"
XwinNT updatcwupgrd.exe"Added by a variant of the RBOT WORM!"
XWinSecureAvpgs.exe"WinSecureAv rogue security software - not recommended
XWinSpyControlpgs.exe"WinSpyControl rogue security software - not recommended. A member of the AVSystemCare family"
XWinUpgrader[path to trojan]"Added by the AGENT-DZ TROJAN!"
XxftpGraberXftpgraber.exe"Added by the ENVID.C WORM!"
XXPGuardXP-Guard.exe"XP-Guard rogue security software - not recommended
Xyahoo groupsupgrdmgr.exe"Added by a variant of the RBOT WORM!"
NZipGenius Cleanzg.exe"ZipGenius file compression utility"
UzSPGuardSpguard.exe""StartPage Guard (SPG) protects your PC from cyberscam
X{2C70168B-97CE-4f31-B85D-1FEC5002721D}sxpgknrwva.exe"Added by the FAKEALERT-AM TROJAN!"


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.