Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
Xregedit.exe /s appboost.reg"Added by the APPIX.D WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run and HKCU\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank. The Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file ""appboost.reg"" is located in %Windir%"
Note the filename has a ""0"" rather than an upper case ""o"""
ME""MS Java Applets for Windows NTXjavaapplets.exe
Y3capplnk3capplnk.exeUS Robotics Modem driver
UA Verizon AppVERIZO~1.EXE"Part of Verizon Online Support Manager"
Ya-winpoet-servicewinpppoverethernet.exe"WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion
XAappadprot.exe"AdBlaster adware"
YAccelerometerSysTrayAppletAccelerometerSt.exeHP 3D DriveGuard uses a digital accelerometer protects your disk drive by parking and halting I/O requests if you drop your PC or if you move your PC with the display lid closed
XAccess Control Appwinsto.exe"Added by the AGENT.DGO TROJAN!"
UACROMOUSEACROMAPP.exe"Related to ACROMOUSE Laser mouse control"
XAdobe Acrobat Distiller Applicationacrotray.exe"Added by the RANDEX.DFJ WORM!"
XAdRotator.Application[path to csrss.exe]"Added by the SMALL-AQ TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
XAdRotator.Applicationservices.exe"FakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in an ""Inetsrv"" subfolder"
UAEFltrs ApplicationAESTFltr.exe"Part of the XP installation of the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
Xagentppl.exe"Added by the DREF-U VIRUS!"
UAgere SoftModem Messaging AppletAGRSMMSG.exeInstalled with the drivers for internal software modems based upon Lucent/Agere Systems chipsets - required if you use the SoftModem Assistant to configure the modem
?AidemHotKeyKEYAPP.EXE"Keyboard related"
UAlarm ManagerAlarmapp.exePalm alarm event reminder that coordinates what is on your Palm with settings on your desktop
UAluria's Pop-Up Stoppereps.exeAluria Pop-Stopper
UAlwaysReady Power Message APPARPWRMSG.EXE"""Away Mode"" feature added with Update Rollup 2 for Windows XP Media Center Edition 2005 that allows the computer to appear off to the user while it continues to perform tasks that do not require user input
XAntivirusSPP.exe"Spyware Preventer rogue security software - not recommended
XAntivirus Protection Servicesccapp2.exe"Added by the RBOT.EXI WORM!"
XApp**32.exe [* = random char]App**32.exe [* = random char]"CoolWebSearch/HomeSearch adware - for examples
XApp.EXEName[path to worm]"Added by the BODIRU WORM!"
XApPache SystemApPache.exe"Added by the RBOT-YP BACKDOOR!"
UAppconvAppCon.exe"Vital Application Console - part of POS-partner 2000 point-of-sale software from Vital. This is the taskbar icon and is enabled at startup by the "Auto-start when OS starts" option. Required for a connection to be established"
Xappconnappconn.exe"Added by the CARGAO WORM!"
UAppExtenderAppExtCB.exe"Loads the Confimax add-in for popular E-mail programs to confirm E-mails have been sent and received"
Xappis.exeappis.exe"Added by the AGENT-BC TROJAN!"
NAppleSyncNotifierAppleSyncNotifier.exe"From WinPatrol PLUS by BillP Studios - ""This file installs with iTunes and is used when syncing your iPhone
XAppletINITINITIATE.EXE"Added by the AGOBOT.XV TROJAN!"
YApplicationmdmsetsp.exe"Aztech Labs modem driver"
XApplicationcsrss.exe"Added by the BEAGLE.EG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
XApplication Adapterabvsvc.exe"Added by the CHECKOUT WORM!"
UApplication ExplorerNaldesk.exe"Novell Zenworks Application Explorer Executable. ""For almost all users the Novell ZENworks agent (either Application Launcher or Application Explorer) will be run via the user's login script on each successful login. ZENworks is used to periodically deliver software updates and is also used to install the remote management components."""
UApplication ExplorerNalView.exe"Application Explorer - file manager type access to Novell Application Launcher for installing and updating network residing applications"
XApplication Explorerappexplr.exe"Added by the AGENT-NMO TROJAN!"
XApplication In SystemSnxmsh.exe"Added by the AGENT-LNV TROJAN!"
NApplication LauncherApplication Launcher.exe"System Tray access to the Sony Ericsson PC Suite and HTC Sync mobile phone management utilities. Run manually via the Start Menu (or optional desktop shortcut) before connecting the phone"
XApplication Layer Browserabgsvc.exe"Added by the ULPM.FX TROJAN!"
XApplication Layer Gateway Servicealgs.exe"Added by the LINKBOT.M WORM!"
XApplication Layer Scheduleragtsvc.exe"Added by the IRCBOT.BJJ BACKDOOR!"
XApplication Layer Servicesavrsvc.exe"Added by the IRCBOT.BJM BACKDOOR!"
XApplication Manageracnsvc.exe"Added by a variant of the IRCBOT TROJAN!"
XApplication Managerapnsvc.exe"Added by the SMALLTRO.FN TROJAN!"
XApplicationProtocolRunsmsbvl32.exe"Added by the IRCBOT-CX TROJAN!"
UAppPlusAppPlus.exe"AppPlus - ""menu bar or tray launcher that docks to your desktop
UAT&T Self Support Toolmatcli.exe"AT&T Resolution Assistant. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
NATI Task ApplicationAtitkad.exeSystem Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display
NATI Task Application (Atikey)Atitask.exeSystem Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display
UATSpoolerAppsTraka.exe"DeskTopScout keystroke logger/monitoring program - remove unless you installed it yourself!"
NAudioCommander ApplicationAudioCommander.exe"System Tray access to the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
UBart StationPPCOLink.exeDialer for PeoplePC ISP
UBayMgrDockApp.exeHot-swappable drive management on laptops allowing you to change drives without closing down Windows. Only required if you frequently swap bay devices
UBestSync 2008BestSyncApp.exe"System Tray access to BestSync® 2008 from Risefly Software - ""a professional utility for synchronizing files between your local folders and Network Drives
Xbin32hpuppstub.exe"PrecisionPop adware"
XBlah serviceCCAPPS32.EXE"Added by the RBOT.TV WORM!"
NBLSTAPPblstapp.exePuts access to Creative's BlasterControl in the System Tray
Ublueyonder Instant Support Toolmatcli.exe"Blueyonder Instant Support Tool. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
XBsoft lppt01Bsoft.exe"RapidBlaster variant (in a ""BelmontSoft"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
Ubtbb_wcm_McciTrayAppMcciTrayApp.exe"System tray access to Motive's Broadband 2.0 configuration and repair utility"
UCallCenter Main ApplicationV3calmcp.exe"""V3 Inc. CallCenter is a free 32-bit
?CameraApplicationLauncherCameraApplicationLaunchpadLauncher.exe"Supports the integrated webcam on IBM/Lenovo Thinkpad notebooks. What does it do and is it required?"
NCamio Viewer xIXApplet.exeImage viewing program that comes with digital cameras. Shows pictures that are in the camera before downloading them. "x" in the name is the version
YccAppccApp.exe"Part of earlier versions of Norton AntiVirus - Auto-protect and E-mail check will not function without this"
XccApp[random filename]"Added by the OBSORB TROJAN! Note the random filename compared to the valid Norton AntiVirus"
XccAppWMADZ.EXE"Added by the RBOT-LJ WORM!"
XccApp.EXE"Added by the RBOT-LJ WORM!"
XccAppgcasServ.exe"Added by a variant of the RBOT WORM! Do not confuse with the Microsoft AntiSpyware executable of the same name"
XccAppexample.exe"TwoSeven spyware"
XccApprsvcrhost.exe"Added by the TACTSLAY.A TROJAN!"
XccApprexpIorer.exe"Added by the TACTSLAY.A TROJAN!"
XccApproutIook.exe"Added by the TACTSLAY.A TROJAN!"
XccApprsvcshost.exe"Added by the TACTSLAY.A TROJAN!"
XccAppsservices.exe"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
XccAppswinlogon.exe"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
XccAppsN/A"Added by the KANGAROO-A TROJAN!"
XccAppsccApps.exe"Added by the KANGAROO-B WORM!"
XccpAppscsrss.exe"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
XccpAppslsass.exe"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
YCleanUpmcappins.exeUsed by older versions of McAfee internet security related products to clean up installation files that are no longer required once the product is installed. This entry will normally only appear once the product has been installed before the system is rebooted
?CleanupProgramcleanup.exe"Sony Vaio related - what does it do and is it required? Located in a C:\Sonysys folder"
UClient Access API Daemoncwbappcd.exe"IBM iSeries Client Access
XCMAPPcmappclient.exe"CasClient adware - also detected as the CMAPP TROJAN!"
Xcmssappiexplore_.exe"Added by the BANCBAN-CQ TROJAN!"
Xcmssappiexplore.exe"Added by the BANCBAN-GF TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
UCobian Backup 7 ApplicationCobBU.exe"Cobian Backup 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
XCOM+ System Applicationlsas.exe"Added by the AGOBOT-MO WORM!"
XCOM+ System Applicationslsas.exe"Added by the AGOBOT.SE WORM!"
XComcastSUPPORTtgkill.exeComcast (the cable folks who are replacing @home in some parts of the USA) have struck a deal with Tioga to provide an "enhanced" support and self-repairing tool. This is "beta" at present and was made available to download by mistake at present. Remove via Start -> Settings -> Add/Remove Programs
YCommon ClientccApp.exe"Part of earlier versions of Norton AntiVirus - Auto-protect and E-mail check will not function without this"
XComPlus Applicationstwain.exe"Added by the AGENT.AQO TROJAN!"
Xconfigurationapphost.exe"Added by the SDBOT-VP WORM!"
NCONNECTAUTrayAppCONNECTAUTrayApp.exe"System Tray access to change update settings for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
UCopperheadrazerhid.exe"Razer Copperhead gaming mouse driver - required if you use the additional features and programmed keys/macros"
NCorel Desktop Application Directordadx.exeThe Desktop Application Director (DAD) gives you easy access to all Corel applications - x represents ther version number. Available via Start -> Programs
UCostAwareniIPCApp.exe"NetInternals CostAware - download quota measuring tool"
?CPortPatchcppatch.exe"CPortPatch is a utility is required for Dell laptops that are using a docking station. Is it needed though?"
Xcppc[path to trojan]"Added by the VB-NV BACKDOOR!"
YDadAppdadapp.exe""DadApp is the SW utility that controls the programmable buttons on Dell Laptops. Not required
UDellSupportDSAgnt.exeDell Support Agent offers additional support and update features for your Dell computer or laptop
UDellSupportCentersprtcmd.exe /P DellSupportCenter"Dell Support Center (provided by SupportSoft
UDeltaIITaskbarAppDeltaIITray.exe"System Tray access to the Delta Control Panel for the M-Audio Delta series of PCI audio cards"
UDetectorAppDetectorApp.exe"Related to Roxio MyDVD (was Sonic) DVD authoring software"
XDialUp Network ApplicationRnaap.exe"Added by a variant of the SDBOT WORM!"
NDMISLAPPDMISLAPP.exe"DMI (Desktop Management Interface) Service Layer for Intel TokenExpress network card software. DMI support for the Intel network card managed through the Desktop Management Interface. See here for more information"
UDon't Panic Pop-Up Stopperdpps2.exe"Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group"
Udpps2dpps2.exe"Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group"
NDwlClientsupport.exeDownload manager for Dell support alerts
Xdwqblwppx.exe[random].exe"Okcashbackmall adware"
UEanthologyAppEANTHO~1.EXE"eAcceleration Stop-Sign security software related. Previously not recommended
UEanthologyAppeanthology.exe"eAcceleration Stop-Sign security software related. Previously not recommended
XEdzy AntiVirusdppsfa.exe"Added by a variant of the RBOT WORM!"
UEOUAppEOUWiz.exeIntel ProSET Wireless related - provides additional configuration options for these devices
UeTrust PestPatrol Active ProtectionPPActiveDetection.exe"PestPatrol real-time protection feature. ""Stops spyware before it infects your system"""
XEventApplicationCmdsmschk.exe"Added by the IRCBOT-AO TROJAN!"
UEZSMART Appezsmart.exeEZ-S.M.A.R.T. hard drive monitoring software from StorageSoft - appears to be no longer supported
UF-PROT Antivirus Tray applicationFProtTray.exe"System Tray access to F-PROT Antivirus"
?fgl23DoubleScreenHooksf23happ.exe"Related to the now discontinued ATI Fire GL3 graphics card. What does it do and is it required?"
XFile Mapping Serviceshp-1003.exe"Added by the RBOT.FAN WORM!"
Nfilehippo.comUpdateChecker.exe"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
NFileHippo.com Update CheckerUpdateChecker.exe"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
UFingerPrintSoftwarefpapp.exeSupports the fingerprint reader on selected IBM/Lenovo Thinkpad notebooks
XFloppy Master[path to trojan]"Added by the ZONIT-F TROJAN!"
NGhostStartTrayAppGhostStartTrayApp.exe"System Tray access to Norton Ghost - added from the 2003 version"
XGoogleUpdater3GoogleMapper.exe"Added by the ROUTROBOT WORM!"
UGravis Appawareloaderdbserver.exe"Looks like it's associated with Gravis game controllers and the Keyset Manager
UGravis Xperience Driver SupportGrxp4exe.exe"Driver for Gravis game controllers such as the Eliminator Aftershock. Must be loaded if you run the supplied application software for the controller to be recognized. Start it manually via a shortcut if not used"
YGuardGui ApplicationGuardGui.exe"System Tray access to the main user interface for Ashampoo® AntiVirus from Ashampoo GmbH & Co. KG."
UHotkeyAppHotkeyApp.exe"Programmable keys on Acer
UHP AutoIndexerhppautoindexer.exe"Installed by HP multi-function printer driver software
XHP Desktopccappms.exe"Added by the SDBOT-TG WORM!"
UHP Instant Supportmatcli.exe""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
UHP Laser Jet Directorhppdirector.exe"System Tray icon that opens various functions such as copy
NHP Parallel Port Testhppt.exeAssociated with a HP ScanJet scanner
XHP Photo ManagerHPPhotoManager.exe"Added by the SDBOT.AXU WORM!"
UHP SchedIndexerhppschedindexer.exe"Installed by HP multi-function printer driver software
Yhpppthpppt.exeRelated to the drivers for HP ScanJet scanners
YhppptaHPPPTA.exeHP parallel port driver for certain hardware
XHpPrinterhpserver.exe"Added by the CMJSPY-W TROJAN!"
NHPPROPTYHPPROPTY.EXE"HP LaserJet Toolbox"
UHPPWRSAVHPPWRSAV.EXE"Power save related for HP Scanners. Many users have complained of system freezes with it running but it stops the light from remaining on all the time. Try www.hp.com
Yiamappiamapp.exe"AtGuard personal firewall engine. As Atguard was bought by Symantec some time ago
UIBM ThinkPad EasyEject Support ApplicationEzEjMnAp.Exe"EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
UIMOLIMOLApp.exe"IncrediMail for Office Outlook Add-On"
XInternet Application DriverexpIorer.exe"Added by the IRCBOT-WK TROJAN!"
NIPPDetectIPP4Detect.exe"Part of Presto! Mr.Photo - ""an ideal program for creating
?iPrint LPT Redirectornipplpte.exe"Related to Novell iPrint - ""a printing solution that enables you to send documents to printers located throughout the Net."" Is it required?"
XiSecurity applet"rundll32.exe iSecurity.cplSecurityMonitor"
XJava appletjavaup.exe"Added by the SDBOT-ACF WORM!"
XJava Applicationvssmf32.exe"Added by the SPIGOT BACKDOOR!"
NKAZAA[path] kpp.exe [path] kazaalite.kpp"System Tray access to later versions of the Kazaa Lite P2P file sharing utility - namely the K++ and Resurrection variants. Kazaa Lite is the unauthorized modification of the original Kazaa Media Desktop - with the malware removed"
YKB926239"rundll32.exe apphelp.dll ShimFlushCache"
XKernellAppscsrss.exe"Added by the BANCBAN-AC TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""System"" subfolder"
XKernellAppslexplore.exe"Added by the BANCBAN-BS TROJAN! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
XKernellAppssvshosti.exe"Added by the BANCBAN-V TROJAN!"
XKernellApps32smss.exe"Added by the BANCBAN-AN TROJAN! Note - this is not the legitimate smss.exe process which should not normally figure in Msconfig/Startup!"
XKIT3hpprintqueue.exe"Added by the ADCLICK-DS TROJAN!"
XKnowledgeBase GUIwppewafaj.exe"Added by the RBOT-GRZ WORM!"
UKN_PanelAppPanelApp.exe"KnowledgePanel online survey software"
ULaunAppLaunApp.exePart of Acer Launch Manager - programmable keys on such laptops as the TravelMate 610
NLaunch ApplicationLaunchApplication.exe"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
YLaunchAppAlaunch"Part of Acer eRecovery - ""a powerful utility that does away with the need for recovery disks provided by the manufacturer
NLaunchApplicationLaunchApplication.exe"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
Nlexppslexpps.exe"For Lexmark printers. From Lexmark: "This enables bi-directional printing over a peer to peer network. If the printer is connected directly to your PC
ULManagerHotkeyApp.exe"Programmable keys on Acer
XLogitech DesktopApPache.exe"Added by the RBOT-YP WORM!"
YLogitechRegisterVideoApplicationsInstallHelper.exeEntry added when you install versions of the Logitech QuickCam webcam software and used to register video applications that can use the webcam on the first reboot after installing the software
XLowVersionSupport[filename]"Added by the LASTRAS TROJAN!"
ULtcyCfgApplyLtcyCfg.exe"PCI Latency Tool - ""Utility to set PCI Latency and possibly prevent game stutter or improve FPS"" for older AGP/PCI graphics cards"
ULyraHD2TrayAppLYRAHD2TrayApp.exeRelated to RCA Lyra MP3 Player
UMacDrive applicationMacDrive.exe"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
UMAFWTaskbarAppMAFWTray.exeDrivers for the M-Audio Firewire Audiophile - Interface
XMalwareStopperMalwareStopper.exe"Malware Stopper rogue security software - not recommended"
YMcAfee Application Installermcappins.exeUsed by older versions of McAfee internet security related products to clean up installation files that are no longer required once the product is installed. This entry will normally only appear once the product has been installed before the system is rebooted
Ymcappinsmcappins.exeUsed by older versions of McAfee internet security related products to clean up installation files that are no longer required once the product is installed. This entry will normally only appear once the product has been installed before the system is rebooted
XMediaPipe P2P Loadermpp2pl.exe"MediaPipe peer-to-peer file swapping program also reported as a hijacker"
UMemoryZipperPlusmemzip.exe"Memory Zipper Plus - ""optimizes the memory management of your system and boost-up its performance amazingly!"""
XMicro Processappconf.exeAdded by an unidentified WORM or TROJAN!
XMICROSFT ANTIVIRUS UPDATE SUPPORT[random 10-letter filename].EXE"Added by the RBOT-AQA WORM!"
XMICROSFT ANTIVIRUS UPDATE SUPPORTMSGUPDATED.EXE"Added by the RBOT-APZ WORM!"
XMICROSFT MX UPDATE SUPPORTtaskmngrs.exe"Added by the RBOT-AUZ WORM!"
XMICROSFT MX UPDATE SUPPORTwinmx32.EXE"Added by the IRCBOT-FD WORM!"
XMICROSFT RAMA UPDATE SUPPORT[random filename]"Added by the RBOT-ASM or RBOT-AUW WORMS!"
XMICROSFT RAMA UPDATE SUPPORTMSN32.EXE"Added by the RBOT-AWJ WORM!"
XMICROSFT RAMA UPDATE SUPPORTmtakthmyn.EXE"Added by the RBOT-AUJ WORM!"
XMICROSFT RAMA UPDATE SUPPORTMSGUPDAT32.EXE"Added by the RBOT-BBB WORM!"
XMicrosft Security Monitor Processmssmppp.exe"Added by a variant of the IRCBOT BACKDOOR!"
XMicrosft Security Monitor Processmssmpp.exe"Added by the SDBOT-DJW WORM!"
XMicrosoftlsass.ppf"Added by the RBOT-GAA WORM!"
XMicrosoft (C) HTML Application host[random filename]"Added by the RBOT-YB WORM!"
XMicrosoft Application Centermappc.exe"Added by a variant of the RBOT WORM!"
XMicrosoft Application Managermsapl32.exe"Added by the BROPIA-AE TROJAN!"
XMicrosoft Buffer Appmsbuffer.exe"Added by the SLINBOT.NQ BACKDOOR!"
XMicrosoft Core SupportMSxUP32.exe"Added by the RBOT-ANR WORM!"
XMicrosoft Core Support[random filename]"Added by a variant of the RBOT TROJAN!"
XMicrosoft Datalog Applicationmsdata.exe"Added by a variant of the SDBOT WORM!"
XMicrosoft Help Supportmshelp32.exe"Addded by the KELVIR-BF WORM!"
XMicrosoft Map PCmappc.exe"Added by a variant of the RBOT WORM!"
XMicrosoft Mapped PCmappedpc.exe"Added by a variant of the RBOT WORM!"
UMicrosoft Media Center Tray AppletehTray.exe"Media Center Tray Applet - part of Windows Media Center on XP MCE
XMicrosoft Server Applacationsmsnmsg.exe"Added by the AGOBOT.BBM WORM!"
XMicrosoft Server Applacationswuauct1.exe"Added by a variant of the RBOT WORM!"
XMicrosoft Server Applacationslsasss.exe"Added by the RBOT-AQQ WORM!"
XMicrosoft Server ApplacationsQ8See.exe"Added by the SPYBOT.GEN3 TROJAN!"
XMicrosoft Server Applacationscli.exe"Added by the RBOT-GAQ WORM!"
XMicrosoft Server ApplicationSound.exe"Added by the RBOT-NE WORM!"
XMicrosoft SpA Servicemsapps.exe"Added by the RBOT-VI WORM!"
XMicrosoft Supportsys32ms.exe"Added by the RBOT-AHI WORM!"
Xmicrosoft supportsvchostt.exe"Added by the AGOBOT.AWN WORM!"
XMicrosoft Visual Applicationvpcrtf.exe"Added by the IRCBOT-XJ TROJAN!"
UMicrosoft Windows Media Player Network Sharing Service Configuration ApplicationWMPNSCFG.exe"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
XMicrosoft Windows Update Applicationwuap.exe"Added by a variant of the RBOT WORM!"
XMicrosoft Winsock Wrapperws2_32s.exe"Added by a variant of the SPYBOT WORM!"
XMicrosoft X Updatewuamkoppnp.exe"Added by the RBOT-ANI WORM!"
XMicrosoftİ System MapperSysMap.exe"Added by the MAPSY TROJAN!"
XMicrosot NT Support[random filename].exe"Added by the RBOT-CTI WORM!"
NMobile Connectivity SuiteApplication Launcher.exe"System Tray access to the HTC Sync mobile phone management utility for models including the Hero
XMonAppli[random filename]"Added by the DELF.IF TROJAN! The most common filenames are isys32.exe & msnmsg.exe"
Xmppddsmppdds.exe"Added by the PWS-AKZ TROJAN!"
Xmppdsmppds.exe"LEGMIR.AQZ spyware"
UMPSExemscifapp.exeMcAfee.com Privacy Service - "combines personal identifiable information (PII) protection with online advertisement blocking and content filtering"
XMS Java Applets for Windows NT & XPjavaapplet.exe"Added by the RBOT.BHG WORM!"
XMS Java Service Wrapper Windows NT & XPwrapper.exe"Added by the VANEBOT-D WORM!"
XMS USB 2.0 Windows Supportmsusb32.exe"Added by a variant of the RBOT WORM!"
Xmsappts32msappts32.exe"Added by the ELBURRO-A TROJAN!"
?MSCRMStartupMicrosoft.Crm.Application.Hoster.exe"Related to Microsoft Dynamics CRM integrated solutions for Financial
XMSN File & Folder Sharing Appmsnfileshare.exe"Added by an unidentified WORM or TROJAN! See here"
XMsn Update SUPPORT[random filename]"Added by the RBOT-BPS WORM!"
Nmsnappaumsnappau.exe"Updater for the MSN toolbar that can be downloaded onto IE. Calls home every day or so to ""update"" the toolbar"
Nmsnsyslogmsnappm.exe"Related to Messenger Applications. When you uninstall the trial version the msnappm keeps saying (You have xx days left) this is adware and it very annoying"
XMSPP System Update 64wiaadmgr.exe"Detected by Kaspersky as the RANKY.GEN TROJAN!"
XMy AppSMSSvc.exe"Added by the NEGASMS.A TROJAN!"
XMyapp[filename]"Added by the FATEE.B WORM!"
XMyappservice.exeHomepage hijacker
XMyVBAppSysNT.exe"ReferAd adware"
XMyVBAppinstall.exe"Detected as Generic Downloader.s by McAfee
XMyVBAppsetup.exe"Detected by Kaspersky as the VB.KB TROJAN! File location is in the root folder (i.e.
Xnavappnavapp.exe"NavExcel adware variant"
XNDIS Adapterservenxpp.exe"Added by the FORBOT-GP WORM!"
XNetAppwinserv.exe"Added by the SHADOWTHIEF TROJAN!"
NNetAppelNetAppel.exe"NetAppel - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
UNetShow Powerpoint HelperNSPPTHLP.EXE"If disabled
XNetwork ServiceMccTrayApp.exeAdded by an unidentified WORM or TROJAN!
Unmappnmapp.exe"Pure Networks ""Network Magic eliminates common frustrations and saves time by simplifying and automating set up
YNMSSupportIntelHCTAgent.exe"Network monitor for Intel® Hub Connect Technology"
NNokia Tray ApplicationNclTray.exe"Part of Nokia PC Suite version 5 - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" Monitors ports to see if a phone has been connected and provides System Tray access to the Connection Manager (and other PC Suite components if a phone is connected). Available via the Control Panel as ""Nokia Connection Manager"""
NNokiaPCSuiteTrayLaunchApplication.exe"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
XNorton Auto-ProtectccApp.exe"Added by the AKHER.D WORM! Note - for the valid Norton AV entry the filename is ""navapexe"". This is also not the valid Norton AV file with the same filename"
XNorton Protectnpprotect.exe"Added by the RBOT-WW WORM!"
XNT LM Security Support ProviderWinNTLM.exe"Added by a variant of the SDBOT WORM!"
Xntfyappntfyapp.exe"Added by the ZHELATIN WORM!"
XnVidia Application Driversnvidiav32.exe"Added by a variant of the IRCBOT BACKDOOR!"
XOffice_appmsnmrgs.exeAdded by a variant of the VBBANC-A TROJAN!
UOmniPassscureapp.exe"OmniPass from Softex Inc. - secure password management software"
NOneNote 2007 Screen Clipper and LauncherONENOTEM.EXE"System Tray access to MS Office OneNote 2007 - an electronic notebook that allows you to create free-form notes
Xp2snetiscomippwa.exe"Added by the SPAMTOO-AL TROJAN!"
UPanasonic HotKey ManagerHKEYAPP.EXEHotKey management for Panasonic rugged mobile PCs
NPaperportrunppdrv.exe"Loads the drivers associated with monitoring scanner status associated with PaperPort software. Can be a resource hog - see here"
NPaperPort PTDpptd40nt.exe"Part of Nuance (ScanSoft) PaperPort - ""scan
NPC SuiteLaunchApplication.exe"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
NPC Suite for SmartphonesApplication Launcher.exe"System Tray access to the Sony Ericsson PC Suite mobile phone management utility for some models
UPCLEPCIppe.exe"Pinnacle Systems PCI Performance Enhancer. "This tool helps to increase the PCI Busmaster performance of all Pinnacle PCI boards.""
NPCSuiteTrayApplicationTrayApplication.exe"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
NPCSuiteTrayApplicationLaunchApplication.exe"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
NPCSuiteTrayApplicationTRAYAP~1.EXE"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
NPCSuiteTrayApplicationLAUNCH~1.EXE"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
YPCTAVAppPCTAV.exe"System Tray access to PC Tools AntiVirus from PC Tools - which ""provides world-leading protection against viruses
UpdfFactory Dispatcher v1fppdis1a.exe"FinePrint pdfFactory Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory printer. Version 1.x of the software. ""pdfFactory products offer a unique approach to PDF creation that is simpler
UpdfFactory Dispatcher v2fppdis2a.exe"FinePrint pdfFactory Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory printer. Version 2.x of the software. ""pdfFactory products offer a unique approach to PDF creation that is simpler
UpdfFactory Pro Dispatcher v1fppdis1.exe"FinePrint pdfFactory Pro Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory PRO printer. Version 1.x of the software. ""pdfFactory products offer a unique approach to PDF creation that is simpler
UpdfFactory Pro Dispatcher v3fppdis3a.exe"FinePrint pdfFactory Pro Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory Pro printer. Version 3.x of the software. ""pdfFactory products offer a unique approach to PDF creation that is simpler
NPDIBM Applicationpdibm.exe"Part of the IBM customized version of SafeGuard PrivateDisk from Utimaco - which provides secure area of hard disk where files and folders are encrypted. This entry loads the associated IBM wizard to create the initial secure area once the program has been installed and will no longer be loaded (but remains as a startup entry) once it is completed"
NPerfectPrintpfppop70.exePrint engine used by Corel WordPerfect 7 and Presentations 7
UPestPatrol Control CenterPPControl.exe"PestPatrol Control Terminal - utility that launched PestPatrol features such as PPMemCheck and CookiePatrol before CA's acquisition"
XPoliceAVxppolice.exe"XP Police Antivirus rogue security software - not recommended
UPOP PeeperPOPPeeper.exe"POP_Peeper from Mortal Universe Software Entertainment ""is an email notifier that runs in your Windows task bar and alerts you when you have new email on your POP3
UPop-Up Stopperdpps2.exe"Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group"
XPopUp StopperNO POPUP.EXE"Added by the SPYBOT-DC WORM!"
Xpopuppersnewpop63.exe"Medload adware"
Xpopuppers64a64sddd.exe"Popuppers adware
Xpopuppers65[path to file]"Medload adware"
UPopUpStopperCompanionPSComp.exe"PopupStopper Companion popup blocker"
UPopUpStopperFreeEditionPSFREE.EXE"Panicware's Pop-Up Stopper - free limited features version"
UPopUpStopperProfessionalPopUpStopperProfessional.exe"Panicware's Pop-Up Stopper - paid for version"
UPowerPanel Personal Edition User Interactionpppeuser.exe"CyberPower PowerPanel Personal Edition UPS Monitoring & Control Software - ""is included with CyberPower's products. This exclusive software allows control and monitoring of your UPS to provide protection for your computer system
Xpppp12.exe"Added by the DWNLDR-HXV TROJAN!"
Xpppp2.exe"Added by a variant of the KOOBFACE WORM!"
UPP Gammappgamma.exe"Profile Prism software that allows monitor calibration and can generate ICC profiles for digital cameras"
NPP****usbFBDirect.exe"Software that monitors the status of a Visioneer OneTouch scanner button and allows you to scan
UPP2000 InstaupdatePPInupdt.exeProtector Plus anti-virus software - instant update program for virus data updates. Not required if you regularly update virus data manually
YPP2000 Real Time ScanPPVstop.exeProtector Plus anti-virus software - real time scanner
YPP2000 Taskbar ControlPPTbc.exeProtector Plus anti-virus software - system tray access
NPP3100bflatbed.exe"Twain driver for the Visioneer PaperPort 3100b scanner that allows you to scan
UppassAntispy.exe"AntiSpy firewall - ""program designed to combat against various types of intrusion and monitoring programs currently in use or presently being developed worldwide"""
UPPControlPPControl.exe"PestPatrol Control Terminal - utility that launched PestPatrol features such as PPMemCheck and CookiePatrol before CA's acquisition"
UPPCRunoncePPCRunOnce.exe"Related to PeoplePC ISP software - may display advertising
UPPHIDPADpphidpad.exe"PenPower Chinese handwriting recognition software"
UPPK Setup(Server)SEServe.exe"Programmable Power Key on Sony Vaio laptops. "Using the Programmable Power Key (PPK) button
Nppmateppmate.exe"PPMate - free tool for streaming online TV via P2P (peer-to-peer)"
UPPMemCheckppmemcheck.exe"PPMemCheck - used to be part of PestPatrol before CA's acquisition"
NPPort10reminderEreg.exe ereg.ini"Registration reminder for PaperPort version 10 from Scansoft (now Nuance)"
NPPort11reminderEreg.exe Ereg.ini"Registration reminder for PaperPort version 11 from Scansoft (now Nuance)"
NPPort12reminderEreg.exe Ereg.ini"Registration reminder for PaperPort version 12 from Nuance"
NPPort9reminderEreg.exe ereg.ini"Registration reminder for PaperPort version 9 from Scansoft (now Nuance)"
XPPPOEOpingppac.exe"Added by the SPYBOT.KHC WORM!"
XPPPOEOEwinlite.exe"Added by the RBOT-AAN WORM!"
NPProTraypprotray.exePart of the power professional program. Loads the System Tray control
?PPSchedulerPPScheduler.exe"Part of Nuance (ScanSoft) PaperPort - ""scan
UPPSVC[path to file]"PC Police surveillance software that logs keystrokes
UPPSYSppsys.exe"PC Police commercial keystroke logger. Uninstall this software if you did not install it yourself"
Npptd40ntpptd40nt.exe"Part of Nuance (ScanSoft) PaperPort - ""scan
UPPUpdateppupdater.exe"PPUpdater - updater that used to be part of PestPatrol before CA's acquisition"
NPPWWebCapPPWebCap.exe"PaperPort" software associated with scanners
XPreinAPP****.tmp [* = random char or digit]Unidentified adware
?PreloadApphphprld.exe"HP PhotoSmart printers related. What does it do and is it required?"
XPrint Hp Trayhpprint.exe"Added by the RBOT-GWE WORM!"
NPtUDFAppPtUDFApp.exe"Sony abCD program
Xqappsrvc32.exeqappsrvc32.exe"Detected by Kaspersky as the WEBBER.M TROJAN!"
YRapAppRAPAPP.EXE"Application protection component of BlackICE PC Protection (was Defender) firewall
XRealplayer Codec Supportrealsched.exe"Added by the AGOBOT-AAD WORM! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name"
XRegistry Loaderwinhlpp32.exe"Added by the GAOBOT.AO WORM!"
URemote Accessrnaapp.exe"Dial-up networking application - not normally found in the startup locations. It runs when you connect to the net via this method (ie
URevoTaskbarAppRevoTask.exeControl Application for M-Audio Revolution 7.1 sound card. The sound card will function without it - but changes to speaker setup and sound modification (Bass/Treble etc) will not be available
URivaTunerRivaTunerWrapper.exe"RivaTuner is a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This startup entry is for Vista and can appear twice - with registry key names of ""RivaTuner"" and ""RivaTunerStartupDaemon"" respectively. Both load the main application (RivaTuner.exe). The former minimizes it to the System Tray and is primarily required only if you want to use the ""Launcher"" or monitoring options. The latter applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
URivaTuner ApplicationRivaTuner.exe"RivaTuner is a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This startup entry is for XP and can appear twice - with registry key names of ""RivaTuner"" and ""RivaTunerStartupDaemon"" respectively. The former minimizes it to the System Tray and is primarily required only if you want to use the ""Launcher"" or monitoring options. The latter applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
URivaTunerStartupDaemonRivaTunerWrapper.exe"Part of RivaTuner - a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This entry is for Vista and loads the main application (RivaTuner.exe) to apply overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
URivaTunerWrapper ApplicationRivaTunerWrapper.exe"RivaTuner is a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This startup entry is for Vista and can appear twice - with registry key names of ""RivaTuner"" and ""RivaTunerStartupDaemon"" respectively. Both load the main application (RivaTuner.exe). The former minimizes it to the System Tray and is primarily required only if you want to use the ""Launcher"" or monitoring options. The latter applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
XRun Services as Applicationlocalsvc.exe"Added by the DLOADER-NY TROJAN!"
XRun Services as Applicationnetsvc.exe"Added by the DLOADER-NY TROJAN!"
XRun Services as Applicationspoolsvc.exe"Added by the DLOADER-NY TROJAN!"
XRun Services as Applicationsvcadmin.exe"Added by the DLOADER-NY TROJAN!"
XRun Services as Applicationsvcman.exe"Added by the DLOADER-NY TROJAN!"
XRun Services as Applicationsvcrun.exe"Added by the DLOADER-NY TROJAN!"
XRun Services as Applicationtcpsvc.exe"Added by the DLOADER-NY TROJAN!"
XRun Services as Applicationwebsvc.exe"Added by the DLOADER-NY TROJAN!"
?run=LXBTppls.exe"Reportedly part of Lexmark printer software - what does it do and is it required?"
Xrunappicqchk.exe"Added by the BOMKA TROJAN!"
XRunapp32Runapp32.exe"Added by the NEODURK TROJAN!"
NS3apphkS3apphk.exeA tool installed alongside the drivers for your S3 video output device. It is not necessary but should be allowed to run unless it is causing problems
Xsappsapp.exe"NCase adware"
USBC Self Support Toolmatcli.exe"matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
XscAppscApp.exe"Added by the STANDO-E WORM!"
XscAppsuchost.exe"Added by the ACNATT.A WORM!"
XscAppwmiprvse.exe"Added by the SILLYFDC-AW WORM!"
USCDEmuApp.exeSCDEmuApp.exe"Related to PowerISO - CD/DVD image file processing tool"
Uscheduler_proxy Applicationscheduler_proxy.exe"Found on IBM/Lenovo ThinkCentre/ThinkStation desktops and Thinkpad notebooks. Included with versions of ThinkVantage System Update (for software updates)
NScrapPadScrappad.exe"ScrapPad allows you to quickly and easily record notes
YSDTraySDTrayApp.exe"System Tray access to an older version of Spyware Doctor antispyware from PC Tools"
XSecurity CenterAppControl.exe"Added by the SDBOT.CFT WORM!"
XSernellApp.pcxcsrss.exe"Added by the BANCBAN-BJ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""D5133"" subfolder"
YServer Application for MFP ServerServoApp.exe"Multi Function Printer (MFP) Server Agent for Belkin's Wirless G All-in-One Print Server and ZyXEL's NPS-520"
XServicesLogccapp32.exe"Added by the RBOT-AMX WORM!"
YSharing and Mapping SoftwareDShmap.exe"Intel AnyPoint internet sharing software. Now discontinued"
XShockwave SupportFlashPlayer.exe"Added by the DELF-DRA WORM!"
NSigmatelSysTrayAppstsystra.exeSystem tray program for the Sigmatel Audio sound card. Often found on Dell computers
NSigmatelSysTrayAppsttray.exeSystem tray program for the Sigmatel Audio sound card. Often found on Dell computers
USIPPSSIPPS.exeWeb.de Internet phone utility
USiS (R) Compatible Super VGA SiSTray applicationsistray.exeSystem Tray access to display settings for Silicon Integrated Systems (SiS) based graphics chipsets. Located in %System%
Xsmanapp***.tmp [* = digit]Unidentified adware
XSmansaAppwinlogon.exe"Added by the ROMARIO-A WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
NSmappSmtray.exe"System Tray icon for Analog Devices SoundMax integrated soundcards. Sound properties can be accessed through the Start Menu or Control Panel"
USMax4PNP ApplicationSMax4PNP.exe"Analog Devices SoundMax integrated soundcard utility. Brings up the SoundMAX Control Panel when it detects if new audio devices (such as microphones
XSmileyAppstbapp.exe"DoubleD adware"
USMS Application LauncherLAUNCH32.EXE"Microsoft Systems Management Server - used to manage computers on a network remotely"
Xsnapplesnapple.exe"Added by the FORBOT-EG WORM!"
NSnappy Faxsf4.exe"Snappy Fax desktop fax program with an extensive set of features - version 4"
?Snappy Fax Printer Agentsfpagent.exe"Related to the Snappy Fax desktop fax program. What does it do and is it required?"
?Snappy Fax Printer virtual printer agentsfpagent.exe"Related to the Snappy Fax desktop fax program. What does it do and is it required?"
USnippetSnippingTool.exe"The Snipping Tool (part of the Experience Pack for Tablet PC) allows you to easily ""cut out"" anything on screen and share it with other people. The whole screen becomes an ""inkable"" surface that you can add comments to and mark up however you like. You can then save that annotated image to use later
USoftickPPPPPPGate.exe"Softick PPP is a Microsoft Windows driver that allows to establish PPP session between Palm powered devices and Microsoft Windows desktop computer"
NSony Auto Update Tray ApplicationCONNECTAUTrayApp.exe"System Tray access to change update settings for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
NSony Ericsson PC SuiteApplication Launcher.exe"System Tray access to Sony Ericsson PC Suite which ""connects your phone to your computer and expands the capabilities of your phone"". Run manually via the Start Menu (or optional desktop shortcut) before connecting the phone"
USpamMonitor ApplicationSpamMonitor.Exe"System Tray access to Spam Monitor from PC Tools - which ""is an easy-to-use spam filter that detects and isolates unsolicited junk mail sent to your mailbox. Designed for computer users
XSpooler SubSystem Appspoolsvc.exe"Added by the POEBOT-J WORM!"
XSpooler SubSystem AppspooIsv.exe"Added by the LINKBOT.M WORM!"
XSpooler SubSystem Appspoolv.exe"Added by the SDBOT-BN WORM!"
XSpooler SubSystem Applicationlocalsvc.exe"Added by the DLOADER-NY TROJAN!"
XSpooler SubSystem Applicationnetsvc.exe"Added by the DLOADER-NY TROJAN!"
XSpooler SubSystem Applicationspoolsvc.exe"Added by the DLOADER-NY TROJAN!"
XSpooler SubSystem Applicationsvcadmin.exe"Added by the DLOADER-NY TROJAN!"
XSpooler SubSystem Applicationsvcman.exe"Added by the DLOADER-NY TROJAN!"
XSpooler SubSystem Applicationsvcrun.exe"Added by the DLOADER-NY TROJAN!"
XSpooler SubSystem Applicationtcpsvc.exe"Added by the DLOADER-NY TROJAN!"
XSpooler SubSystem Applicationwebsvc.exe"Added by the DLOADER-NY TROJAN!"
XSpooler Subsystem Applicationsmss.exe"Added by the IRCBOT-ZO TROJAN! Note - the legitimate smss.exe process should not normally figure in Msconfig/Startup!"
XSpooler Subsytem Appspoolsvc.exe"Added by the SDBOT-MM WORM!"
?SPPrun.exe"??"
Xsppregedit -s spp.reg"IE search hijacker - changes the default search to h**p://www.hotsearchbox.com/ie/. Note that the Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file ""spp.reg"" is located in the root folder (ie
?sppbridgesppbridge.exe"Associated with an Anycom bluetooth wireless card on laptops - used for printing to portable printers for example. Is it required or can it be started manually? "
USpyStopperspystopper.exe"SpyStopper - blocks intrusive spyware
YSRS AppletSrsTray.ExeS3 Sonic Vibes sound card drivers - if disabled you loose sound
XStart It Uppingsvchosets.exe"Added by a variant of the RBOT WORM!"
XStart Uppingtaskmrg.exe"Added by the RBOT-MA WORM!"
XStart UppingSVCHOSTES.EXE"Added by the RBOT-NB WORM!"
XStart Uppingtaksmgr.exe"Added by the RBOT-QK WORM!"
XStart Uppingmcrt32.exe"Added by a variant of the SPYBOT WORM!"
XStart Uppingwindupds.exe"Added by the SDBOT.AFH WORM!"
XStart Uppingwindupdts.exe"Added by a variant of the RBOT WORM!"
XStart Uppingxdcc.exe"Added by the SPYBOT.OY WORM!"
XStart Uppingspoolnt.exe"Added by the RBOT-TM WORM!"
XStart Uppingiexplorerupdt.exe"Added by the RBOT-RR WORM!"
XStart Uppingssvcchosts.exe"Added by the SDBOT.VY WORM!"
XStart Uppingsmssupdate.exe"Added by a variant of the RBOT WORM!"
UStatus Monitor CLJ1500HPPOUMUI.exe"Status monitor for the HP Color LaserJet 1500 printer from Hewlett-Packard - for monitoring printer status
XStreamAppliancewuauclt14.exe"Added by the RBOT-GMB WORM!"
XStreamAppliancewuauclt16.exe"Added by the RBOT-GME WORM!"
Xsupport-reverse-smileys[trojan filename]"Added by the LITEBOT TROJAN!"
USupport.com Scheduler and Command Dispatchertgcmd.exe"Part of software from SupportSoft (aka Support.com) provided to manufacturers and ISPs that allows them to offer on-line support - to update drivers
Xsupporter5supporter5.exe"Part of eScorcher anti-virus software- responsible for updates of new virus bases each time you logon to the web. Used to collect information about the user and therefore treated as spyware - now the web-site is dead"
XSVCHOST Generic applicationsvchost.exe"Added by the DAEMONI-K TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
XsyelimS-esreveR-troppuS[filename]"Added by the LITBOT.C TROJAN!"
XSymantecccapp.exe"Added by the REATLE WORM! Note - this is not a Symantec file"
XSymantec Configuration LoaderccApp32.exe"Added by the AGOBOT-EE WORM!"
XSymantec ServiceccApp.exe"Added by the AKHER.D WORM! Note - this is also not the valid Norton AV file with the same filename"
USymmTime ApplicationGeTTime.exe"SymmTime from Symmetricon - freeware utility that ""synchronizes your PC clock to Coordinated Universal Time (UTC)
XSymRunccApps.exe"Added by the KAGEN-A TROJAN!"
XSysmppcvpppSysTdSvr.dll"Generic2.PQG adware"
XSystem Applications Profilesap.exe"Added by the RBOT-QF WORM!"
XSystem Buffer Applicationbuffer32.exe"Added by the SDBOT-UD WORM!"
XSystem Database Administration Support Processsysdasp.exe"Added by the DERDERO.C WORM!"
XSystem Document Applicationnmod.exe"Added by the SDBOT-ABB WORM!"
XSystem Document Applicationmsdocument.exe"Added by the RANDEX.COX WORM!"
XSystem Document Applicationwins.exe"Added by the SDBOT.AUB WORM!"
XSystem Document Applicationwinsvc32.exe"Added by the SDBOT-VA WORM!"
XSystem Kernal Supportsystem.exe"Added by the SDBOT.BWV WORM!"
USystem Mechanic Popup StopperPopupstopper.exe"Popup stopper part of Iolo System Mechanic utility suite"
XSystem Supportsyscfg.exe"Added by the RBOT-AGQ WORM!"
XSystem Supportsystem32.exe"Added by the RBOT-AHA WORM!"
XSystem Supportsyssql.exe"Added by the RBOT-AUH WORM!"
XSystem Supporttorrent.exe"Added by a variant of the RBOT WORM!"
XSystem Update Applicationmsbuffer.exe"Added by the SDBOT.AFF WORM!"
XSystemBMessengerStopper.exe"MessStopper adware"
USystem_Messagespprsen.exe"TerminatorX - ""offers an easy and effective method of stopping users running predetermined file sharing programs like KaZaA
NTaskbar++TaskbarPP.exe"Taskbar++ is a software that allows you to sort (move) the buttons of the Windows taskbar by Drag & Drop"
XTcp Application Managerlocalsvc.exe"Added by the DLOADER-NY TROJAN!"
XTcp Application Managernetsvc.exe"Added by the DLOADER-NY TROJAN!"
XTcp Application Managerspoolsvc.exe"Added by the DLOADER-NY TROJAN!"
XTcp Application Managersvcadmin.exe"Added by the DLOADER-NY TROJAN!"
XTcp Application Managersvcman.exe"Added by the DLOADER-NY TROJAN!"
XTcp Application Managersvcrun.exe"Added by the DLOADER-NY TROJAN!"
XTcp Application Managertcpsvc.exe"Added by the DLOADER-NY TROJAN!"
XTcp Application Managerwebsvc.exe"Added by the DLOADER-NY TROJAN!"
Xtcpippuitcpippui.exe"Added by the RBOT-APS WORM!"
Xtcpippui32tcpippui32.exe"Added by the RBOT-ART WORM!"
UTelstraClear Broadband Supportmatcli.exe"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
XTimeSyncAppTimeSynchronize.exe"DealHelper adware"
NToshiba TEMPOToshiba.Tempo.UI.TrayApplication.exe"TEMPO is a software service developed by Toshiba. It will advise you on how to fine-tune the performance of your notebook and keep you informed of the latest Toshiba software and driver updates as soon as they are released. It does this by delivering various types of alerts into a special TEMPO inbox area on your notebook PC"
UTPP Auto LoaderTppaldr.exe"Installed with DataStor's (and some other manufacturers) USB 2.0 based external DVD
XTrayXwinppr32.exe"Added by the SOBIG.F WORM!"
XUniversal Plug & Play devicesWinUPPD.exeAdded by an unidentified WORM/TROJAN!
XUnix File Supportinit3.exe"Added by the RBOT-ZN WORM!"
UVerizon Online Support Centermatcli.exe""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
XVmlistapphelps.dll"Added by the ALAMNAHE.A VIRUS!"
UWarning: do not remove it!fpplock.exe"Part of Folder Password Expert by ZQS Software Team - ""a software program to restrict access to the folders that contain your sensitive data"""
?Webcam Go Sti Service Applicationwbcgosvc.exe"Control software for the portable Creative Webcam Go digital camera/PC web cam. What does it do and is it required?"
UWebExRemoteAccessAgentraagtapp.exe"Related to Web Meetings from WebEx Communications
Xwin ctl appwuctl.exe"Added by a variant of the SDBOT WORM!"
XWin USB 2.0 USB DriverHPPrint.exe"Added by the SPYBOT.DNB WORM!"
XWIN USB SUPPORTgrxsrv.exe"Added by a variant of the RBOT WORM!"
XWin Validation ApplicationDBExecCom.exe"Added by the VBSILLY-A WORM!"
XWinAmp Playerwinampp.exe"Added by the RBOT-AQI WORM! Note - this is NOT the popular Winamp media player which has a different filename"
XWinappwinpup32.exeProduces popup ads to adult content sites
XWinApp32msapp.exe"Added by the RSBOT TROJAN!"
UWinAppLogsvchost.exe"StingKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself!"
Xwincmapwincmapp.exe"CasClient adware variant - also detected as the CMAPP TROJAN!"
XWindows Application Layerwalg32.exe"Added by the AGOBOT.ATN WORM!"
XWindows Application Layer Gatewaywalg32.exe"Added by the AGOBOT-AAZ WORM!"
XWindows applications serverSysShield.exe"Added by the unregistered version of Personal Anti Malware rogue security software - not recommended
XWindows Audio Controlppnsvc.exe"Added by the HAM TROJAN!"
XWindows Audio Panelnppsvc.exe"Added by a variant of the IRCBOT TROJAN! See here"
XWindows live Supportwlmsngr.exe"Added by the RBOT-BKL WORM!"
XWindows Logon ApplicationWinIogon.exe"Added by the LINKBOT.M WORM!"
XWindows Logon Applicationlogon.exe"Added by the POEBOT-J WORM!"
XWindows Logon Applicationservices.exe"Added by the CIADOOR-L TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
XWindows Logon Applicationwin32help.exe"Added by the DELBOT-X WORM!"
XWindows Logon Applicationwinlogon.exe"Added by the POEBOT-KW WORM! Note - this is not the legitimate winlogon.exe process
XWindows Logon Applicationwinamp.exe"Added by the POEBOT-LR WORM! Note - this is NOT the popular Winamp media player which resides in a ""Winamp"" subdirectory of the Program Files directory"
XWindows Logon Applicationedcwinlogon.exe"Added by the DWNLDR-HGR TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%"
XWindows Logon Applicatonedcwinlogon.exe"Added by the VB-EBV TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%"
XWindows Media APwinmapp.exeAdded by an unidentified WORM or TROJAN!
XWindows Media APPwmapp.exeAdded by an unidentified WORM or TROJAN!
NWindows Media Powerpoint HelperNSPPTHLP.EXEGerman software (comes with some Toshiba CD writers) that helps convert Powerpoint files to ASF (Streaming Media) files. Available via Start -> Programs
XWindows NT Logon Applicationwinlogon.scr"Added by the RBOT-ALP WORM!"
XWindows Security Center Notification Appwscnfty.exe"Added by a variant of the RBOT WORM!"
XWindows Security Center Notification Applssxe.exe"Added by the RBOT-GKX WORM!"
XWindows Security Center Notification Applsesxes.exe"Added by the RBOT-GLR WORM!"
XWindows Security Center Notification Applseos.exe"Added by a variant of the RBOT-GLR WORM!"
XWindows Security Center Notification Applseesysecurex.exe"Added by a variant of the RBOT-GKX WORM!"
XWindows Service Supplywinsupply.exe"Added by the SLENFBOT.CZ WORM!"
XWindows Service Support CallSVSS32.EXE"Added by the RBOT-XQ WORM!"
XWindows Softwarehbsppe.exe"Added by the RBOT-GLL WORM!"
XWindows svchosthappy2008.exe"Added by the PUSHBOT.AM WORM!"
XWindows USB Driver SupportWindowsusb.exe"Added by a variant of the SPYBOT WORM!"
YWinFaxAppPortStarterwfxsnt40.exeWinFax 10.0 and maybe earlier versions. Used to initiate the WinFax port to enable printing to the WinFax printer (send a fax) from any application.
Xwinhlpp32.exewinhlpp32.exe"Added by the GAOBOT.SY WORM!"
YWinPoetWinPPPoverEthernet.exe"WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion
UWinSysAppMonWinSysRM.exe"Home & Family Content Filter related. See here"
Xwinterhappy.exe"Added by the SDBOT-YF WORM!"
XWinUPPD.exe[random filename]Added by an unidentified WORM/TROJAN!
XWinxp updateCappp.exe"Added by the RBOT.DKO WORM!"
XWinzip Applicationwinzip81.exe"Added by the RBOT-BKZ WORM!"
Xwin_supp00.exeWin Const.exe"Added by the ASSASIN-H TROJAN!"
NWLAN Status Tray AppletWLANSTA.EXESystem Tray icon for checking the status of a Wireless LAN
XWMI Application Interfacewmiapi.exe"Added by the SPYBOT.RBY WORM!"
?WOOKITShell.exe appLaunchClientZone.shl"Related to the Wanadoo broadband ISP (now rebranded as Orange). What does it do and is it required?"
XXP Protection CenterXPProtectionCenter.exe"XP Protection Center rogue security software - not recommended
Xxpprotectxpdeluxe.exe"XP Protector Deluxe rogue security software - not recommended
NYankee Clipper IIIYankClip.exe"Yankee Clipper III - 'A super powerful Windows clipboard extender/memory - now in its third generation. Handles Pictures
NYeppStudioAgentSamsungMediaStudioAgent.exe"Samsung Media Studio MP3 player file management software - see here for an example"
XYour Protectionurpprot.exe"Your Protection rogue security software - not recommended
X[executed file name]App.exe"Added by the WAXPOW WORM!"
X[various names]AppMasterCenter.exe"Wareout - malware masquerading as a spyware and dialer remover"
X[various names]jopplerg.exe"Wareout - malware masquerading as a spyware and dialer remover"
X[various names]SysSupport.exe"Wareout - malware masquerading as a spyware and dialer remover"


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.