protect

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	.protected	N/A	"Smitfraud variant"
U	12Ghosts TrayProtect	12srvc.exe	"12Ghosts TrayProtect - ""Hide tray icons
X	9xHtProtect	AVprotect9x.exe	"Added by the NETSKY.M WORM!"
X	aaprotect	[path to trojan]	"Added by the BANCBAN-MJ TROJAN!"
U	Ad-Protect	ad-protect.exe	"Ad-Protect spyware and spam monitoring tool"
X	Advanced Protection System	advpsys.exe	"Added by a variant of the RBOT WORM!"
X	AdwareProtector	AdwareProtector.exe	"Part of rogue security tools
X	AntiVirProtect	AntiVirProtect.exe	"AntiVirProtect rogue security software - not recommended
X	Antivirus Protection Services	ccapp2.exe	"Added by the RBOT.EXI WORM!"
?	AntiVirusProtection	qumk.exe	"??"
X	AntivirusProtection	antivirusprotection.exe	"Antivirus Protection rogue security software - not recommended
U	AOL Spyware Protection	AOLSP Scheduler.exe	AOL's spyware protection program
X	APCProtect.exe	APCProtect.exe	"APCProtect rogue security software - not recommended
?	ASUS Screen Saver Protector	ASScrPro.exe	"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
X	autochk	"rundll32.exe protect.dll	_IWMPEvents@16"
X	AutoProtect	AutoProtect.vbs	"Added by the KILLBAT-C WORM!"
X	AUTOPROTECTU	navapq32.exe	Added by an unidentified WORM or TROJAN!
X	AutoVirusProtection	ciscv.exe	"Added by a variant of the RBOT WORM!"
N	BlackICE PC Protection	blackice.exe	"Loads the user interface for the BlackICE PC Protection (was Defender) firewall. From the parent site - '(the user interface) starts in the ""Startup"" menu and adds itself to the taskbar. The user interface is independent from the rest of the system and only displays the output or reconfigures the system. It does not need to be running for the rest of the system to run.' BlackICE was supported by IBM Internet Security Systems (formerly just ISS) when them acquired the NetworkICE parent but is no longer available. See also LoadBlackD"
X	BlockProtector.exe	BlockProtector.exe	"BlockProtector rogue security software - not recommended
U	BTModemProtection	BTModemProtection.exe	"BT Privacy Online modem protection software
?	CP	CopyProtectionNotifier.exe	"Related to Emuzed Systems and Middleware. Comes included with Windows XP Media Edition"
X	Data Protection	datprot.exe	"Data Protection rogue security software - not recommended
X	Digital Protection	digprot.exe	"Digital Protection rogue security software - not recommended
X	dpzProtect	n.vbe	"Added by the RUNAUTO.H WORM!"
X	DrProtection	DrProtection.exe	"DrProtection rogue security software - not recommended"
Y	Earthlink Protection Control Center	elnk_pcc.exe	"EarthLink Protection Control Center - ""powerful
X	EliteProtector	EliteProtector.exe	"EliteProtector rogue spyware remover - not recommended
Y	Email Protection	emlproxy.exe	"AntiVirus Quick Heal - E-mail protection"
X	ErrorProtector Free	ertmain.exe	"ErrorProtector rogue system error and cleaning utility - not recommended"
Y	eSafe Protect	ESPWatch.exe	"eSafe from Aladdin - internet security for gateway and E-mail servers"
U	eTrust PestPatrol Active Protection	PPActiveDetection.exe	"PestPatrol real-time protection feature. ""Stops spyware before it infects your system"""
Y	ezShieldProtector for Px	ezSP_Px.exe	"Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings"
Y	ezShieldProtector for Px	ezSP_PxEngine.exe	"Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings"
X	FBSearch	FastBrowserSearchProtection.exe	"Fast Browser Search/Search Guard Plus parasite - installed with ""Make the Web Better"" applications such as My Web Tattoo
X	File Protection Monitor	filemon.exe	"Added by a variant of the RBOT WORM!"
U	FRITZ!webProtect	FwebProt.exe	Firewall included in FRITZ! ISP DSL software
Y	HEProtect	HSockPE.exe	"Part of the AntiSpam function of the HAURI ViRobot Desktop internet security suite"
U	Hide and Protect any Drives for Win95/98/Me/2k/XP	HPDAgent.exe	"Loads Hide and Protect any Drives - which allows you to ""Protect Hard drive
X	HtProtect	AVprotect.exe	"Added by the NETSKY.L WORM!"
U	iProtectYou	ip.exe	"iProtectYou - internet filtering/parental control and network monitoring software"
U	jv16PT - Privacy Protector	Task.jvb	"jv16 PowerTools Privacy Protector - ""allows you to protect your privacy by automatically clearing out all the unwanted history items and cookies from you computer
X	LiveProtect	LiveProtect.exe	"System Live Protect rogue security software - not recommended
X	McAfee Antivirus Protection	mcafeeAV.exe	"Added by a variant of the RBOT WORM!"
X	Mcafee Auto Protect	mcafeshield.exe	"Added by the RBOT-UH WORM!"
Y	McAfee Family Protection	mfp.exe	"McAfee Family Protection - which 'is easy-to-use and built to empower parents to say ""yes"" to their children's online interests while protecting them as they learn and explore' and ""protects children of all ages from exposure to inappropriate content
X	McAfee Windows Protection	mcafee32.exe	"Added by a variant of the SPYBOT WORM!"
U	MDDiskProtect	MDDiskProtect.exe	"Part of MacDrive 6 CrossStripe Edition from Mediafour Corporation - ""a perfect way to share files between Mac OS and Windows."" Unlike the standard version of MacDrive 7
U	MDDiskProtect.exe	MDDiskProtect.exe	"Part of MacDrive 6 CrossStripe Edition from Mediafour Corporation - ""a perfect way to share files between Mac OS and Windows."" Unlike the standard version of MacDrive 7
U	Mediafour MacDrive	MDDiskProtect.exe	"Part of MacDrive 6 CrossStripe Edition from Mediafour Corporation - ""a perfect way to share files between Mac OS and Windows."" Unlike the standard version of MacDrive 7
X	Microsoft (R) Windows Protected Content Restoration Service	services.exe	"Added by the AGENT.AGV BACKDOOR! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\etc"
X	Microsoft Internet Antivirus Protection	antivirus.exe	"Detected by Kaspersky as the IRCBOT.BSK TROJAN!"
X	Microsoft Macro Protection SubSsy	msacroprots386.exe	"Added by the RBOT-KE WORM!"
X	Microsoft Macro Protection Subsystems	msmacroprotxz.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Macro Protection Subsystems	Msmacroprot32.exe	"Added by the RBOT.KN WORM!"
X	Microsoft standard protector	winsocks5.exe	Added by the SMALL.CF TROJAN!
X	Microsoft standard protector	[path to trojan]	"Added by the STOX-C TROJAN!"
X	MS Agent Protection	ag1.exe	"Added by the IRCBOT.AZ BACKDOOR!"
X	MS Auto-IPSec Protection	MSASP32.exe	"Added by the RBOT-AER WORM!"
X	msmautoprotect	msmssgs.exe	"Added by the BIFROSE-AJ TROJAN!"
X	MSprotect.exe	MSprotect.exe	"Added by the DABYREV.A VIRUS!"
X	NAV Auto Protect	msfwe1.exe	"Added by a variant of the RBOT WORM!"
X	NAV Auto Protect	navprotect.exe	"Added by the RBOT.BKW WORM! Note - this is not a valid Norton AntiVirus product from Symantec"
X	NAV Auto Protect	dnsserv.exe	"Added by a variant of the SDBOT WORM!"
X	NAV Auto Protect	mcafee32.exe	"Added by a variant of the SPYBOT WORM!"
X	NET protection system	netst.exe	"Added by the RIZO.A TROJAN!"
X	NI.USYP	SysProtectScannerInstall.exe	"Installer for the SysProtect rogue security software
X	Norton Antivirus AV	FVProtect.exe	"Added by the NETSKY.P WORM! Note - this is not the popular AV software!"
X	Norton Auto Protect	nava.exe	Added by an unidentified WORM or TROJAN!
X	Norton Auto Protect	crss32.exe	"Added by the SDBOT.ATF WORM!"
Y	Norton Auto-Protect	navapw32.exe	Norton Anti-Virus's background scanning process
X	Norton Auto-Protect	ccApp.exe	"Added by the AKHER.D WORM! Note - for the valid Norton AV entry the filename is ""navapexe"". This is also not the valid Norton AV file with the same filename"
X	Norton Auto-Protect	SERVICES.exe	"Added by the AHKER.B WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%. Also
X	Norton Auto-Protect	ffbaqe.exe	"Added by the SLINBOT.RF BACKDOOR! Note - this is not a valid Norton product"
X	Norton AV Protection Startup	Ati2xxx.exe	"Added by a variant of the RBOT WORM!"
X	Norton Drive Protection	msdt32.exe	"Added by the FORBOT-GB WORM! Note - this not a valid Norton program!"
Y	Norton eMail Protect	POPROXY.EXE	"Proxy E-mail protection from Norton Anti-Virus (prior to 2002). If you have it installed
X	Norton GProtect	ngrfn.exe	"Added by a variant of the RBOT WORM!"
X	Norton Protect	npprotect.exe	"Added by the RBOT-WW WORM!"
X	Norton protect	nvsvc.exe	"Added by a variant of the RBOT WORM!"
X	Norton Protect Activies	csrss.exe	"Added by the BANKER-CZ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""D5133"" subfolder"
U	NPROTECT	nprotect.exe	Norton Protected Recycle Bin from Norton Utilities. Adds an extra layer of safety before you remove deleted files from the Recycled Bin. Can be listed twice which is valid
X	PC Protection Center	PcProtection.exe	"PC Protection Center 2008 rogue security software - not recommended
X	PCprotectar.exe	PCprotectar.exe	"PCprotectar rogue security software - not recommended. A member of the AntiAID family"
X	PcsProtector	PcsProtector.exe	"PcsProtector rogue security software - not recommended
Y	PER Email Protection	pavmail.exe	"PER Antivirus"
X	personalprotector	personalprotector.exe	"Personal Protector rogue security software - not recommended
X	Privacy Protector	Privacy Protector.exe	"PrivacyProtector rogue privacy tool - not recommended
X	PrivacyProtector Free	UPRP.exe	"PrivacyProtector rogue privacy tool - not recommended
U	Protect	SHVRTF.EXE	"PC Angel takes a 5-second snapshot of the current system registry each time the PC boots up. In the event of a crash
X	protect	protect.scr	"Added by the DLOADER-TQ TROJAN!"
X	ProtectDefender	ProtectDefender.exe	"ProtectDefender rogue security software - not recommended
X	Protected Storage	RUNDLL32.EXE MSSIGN30.DLL ondll_reg	"Added by the LOVGATE-W WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	protectinfo	protectinfo.exe	"ProtectInfo rogue security software - not recommended"
X	ProtectingTool	SysRep.exe	"ProtectingTool rogue system error and cleaning utility - not recommended
X	Protection	[path] runtask.exe [path] protection.exe	Added by a variant of the AGENT.3.AU TROJAN!
X	Protection	Protection.exe	"Added by the FEBELNECK-A WORM!"
X	Protection	Firewall.exe	"Added by the ELIPTER.A or ELIPTER.B WORMS! Located in %ProgramFiles%\Internet Explorer"
X	Protection	IExplore .exe	"Added by the ELIPTER.D WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process as there is a space before the "".exe"""
X	Protection	Norton Internet Security.exe	"Added by the ELITPER.E WORM!"
X	Protection Center	cntprot.exe	"Protection Center rogue security software - not recommended
X	Protection System	psystem.exe	"Protection System rogue security software - not recommended
X	ProtectionComplete	pgs.exe	"ProtectionComplete rogue security software - not recommended. A member of the AVSystemCare family"
X	ProtectionConue	pgs.exe	"ProtectionConue rogue security software - not recommended. A member of the AVSystemCare family"
X	ProtectionDeDriver	GDC.exe	"ProtectionDeDriver rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	Protections	ProtEX32.exe	"Ultimate SecuritySuite rogue malware remover - not recommended
X	Protector GB	protectgb.exe	"Added by the BANKER.EIE TROJAN!"
X	ProtectPcs.exe	ProtectPcs.exe	"ProtectPcs rogue security software - not recommended
X	ProtectSoldier	ProtectSoldier.exe	"ProtectSoldier rogue security software - not recommended
Y	Quick Heal On-Line Protection	Cateye.exe	"Quick Heal - virus scanner"
X	RealTimeProtector	winlogon.exe	"Added by the AUTORUN.DIB WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ï¿½ subfolder"
X	Registry Protector	regprotect.exe	"Added by the ARIVER.A WORM!"
X	REGRUNM	autoprotect.exe	Added by an unidentified WORM or TROJAN!
X	Remote System Protection	"rundll32.exe [random].dll	HUI_proc"
X	SafetyCenter	protector.exe	"Safety Center rogue security software - not recommended
U	Search Protection	SearchProtection.exe	"""Yahoo! Search Protection will alert you if an attempt is made to change your default browser search engine from Yahoo!"""
U	SearchProtection	SearchProtection.exe	"""Yahoo! Search Protection will alert you if an attempt is made to change your default browser search engine from Yahoo!"""
U	Smart Protector Pro	SmartProtector-Pro.exe	"Smart Protector Pro internet eraser from SmartSoft - ""keeps out prying eyes and protects your private data on all Windows systems"""
X	smartprotector	smartprotector.exe	"Smart Protector rogue security software - not recommended
U	SmartProtector-Pro	SmartProtector-Pro.exe	"Smart Protector Pro internet eraser from SmartSoft - ""keeps out prying eyes and protects your private data on all Windows systems"""
U	SPSTEALT	SmartProtectorPro.exe	"Smart Protector Pro - internet privacy tool that erases tracks
U	SPSTEALT	SmartProtector-Pro.exe	"Smart Protector Pro internet eraser from SmartSoft - ""keeps out prying eyes and protects your private data on all Windows systems"""
U	Spy Protector	SpyProtector.exe	"Included in the full version of Security Task Manager
X	Spy Protector	srcss.exe	"SpyProtector rogue security suite - not recommended
X	Spy Protector	lsascs.exe	"Spy Protector rogue security software - not recommended
X	StorageProtector	SysRep.exe	"StorageProtector rogue system error and cleaning utility - not recommended
Y	SunProtectionServer	SunProtectionServer.exe	"CounterSpy antispyware software"
X	SysProtect	System.exe	"Added by the NETSPY TROJAN!"
X	SysProtect	syp.exe	"SysProtect rogue security software
X	SysProtect	USYP.exe	"SysProtect rogue security software
X	SysProtect Free	USYP.exe	"SysProtect rogue security software
X	SysProtector	SysProtector.exe	"SysProtector rogue security software - not recommended
X	System Protector	lsascs.exe	"System Protector rogue security software - not recommended
Y	ThinkVantage Active Protection System	TpShocks.exe	"Part of the Active Protection System found on some IBM/Lenovo Thinkpad models - including the T
X	Total Protect 2009	pcpc_starter.exe	"Total Protect 2009 rogue security software - not recommended
X	Total Virus Protection	TotalVirusProtection.exe	"Total Virus Protection rogue security software - not recommended
U	TrojanShield Protector	Port.exe	"TrojanShield anti-hacker/anti-trojan software"
X	User Protection	usrprot.exe	"User Protection rogue security software - not recommended
X	Vhosts Protection	vhosts.exe	Added by an unidentified WORM or TROJAN!
X	virtual	winprotect.exe	"Added by the MUGLY.C WORM!"
X	Virus Protect	vrsprtc.exe	"Added by the RBOT-APR WORM!"
X	Virus Protector	[random].exe	"Virus Protector rogue security software - not recommended
X	VirusProtect 3.8	VirusProtect 3.8.exe	"VirusProtect Pro rogue security software - not recommended
X	VirusProtect 3.9	VirusProtect 3.9.exe	"VirusProtect Pro rogue security software - not recommended
X	VirusProtectPro 3.3	VirusProtectPro 3.3.exe	"VirusProtect Pro rogue security software - not recommended
X	VirusProtectPro 3.4	VirusProtectPro 3.4.exe	"VirusProtect Pro rogue security software - not recommended
X	VirusProtectPro 3.5	VirusProtectPro 3.5.exe	"VirusProtect Pro rogue security software - not recommended
X	VirusProtectPro 3.6	VirusProtectPro 3.6.exe	"VirusProtect Pro rogue security software - not recommended
X	VirusProtectPro 3.7	VirusProtectPro 3.7.exe	"VirusProtect Pro rogue security software - not recommended
X	Wind0ws Sharing	ssprotecter.exe	"Added by the RBOT-AHW WORM!"
X	Windows File Protection	winprotect.exe	"Added by the AGOBOT.JB WORM!"
X	Windows Hijack Protection	comngr.exe	"Added by the AGENT-FYD TROJAN!"
X	Windows Hijack Protection System	commngr.exe	"Added by a variant of the AGENT-FYD TROJAN!"
X	Windows Protected Storage	npssvc.exe	"Added by the IRCBOT.AUL BACKDOOR!"
X	Windows Protection Suite	WI[random characters].exe	"Windows Protection Suite rogue security software - not recommended
X	Windows Protectot	boxide.exe	"Added by a variant of the WOOTBOT WORM!"
X	Windows Reversed Virus Protection	winrsvp.exe	"Added by the SLENFBOT.HX WORM!"
X	Windows_Protect	winsystem.exe	"Added by a variant of the RBOT WORM!"
X	Windows_Protect	winregal.exe	"Added by a variant of the RBOT WORM!"
X	Windows_Protect	lsas.exe	"Added by the RBOT.ARO WORM!"
X	Windows_Protect	wincontrol32.exe	"Added by the RBOT-ADK WORM!"
X	Window_Protect	winsi32.exe	"Added by a variant of the RBOT WORM!"
X	WinPatch Protection	winpatch.exe	Added by an unidentified WORM or TROJAN!
X	winprotect	win32.exe	"Added by the MUGLY.E WORM!"
X	winprotect	winprotect.exe	"Added by the SDBOT-SB WORM!"
X	winprotection	ccsrss.exe	"Added by the SILLYFDC.BBT WORM!"
X	WinProtector	WinProtector.exe	"WinProtector rogue security software - not recommended
X	WinSpywareProtect	WinSpywareProtect.exe	"WinSpywareProtect rogue security software - not recommended
X	WinSpywareProtect (ver. 5.1)	WinSpywareProtect.exe	"WinSpywareProtect rogue security software - not recommended
U	WinUpdateProtection	csrss.exe	"EmployeeWatch is a commercial surveillance software program designed to monitor user activity on a computer. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a subfolder of C:\windowsupdate\ufp"
X	WinXProtector	WinXProtector.exe	"WinXProtector rogue security software - not recommended
X	XP Protection Center	XPProtectionCenter.exe	"XP Protection Center rogue security software - not recommended
X	xpprotect	xpdeluxe.exe	"XP Protector Deluxe rogue security software - not recommended
X	Your Protection	urpprot.exe	"Your Protection rogue security software - not recommended
U	YSearchProtection	SearchProtection.exe	"""Yahoo! Search Protection will alert you if an attempt is made to change your default browser search engine from Yahoo!"""
U	Yumgo's Homepage Protector V1	YumgoHomepageProtector.exe	"Yumgo's Homepage Protector"
X	[32 random hex numbers]	badware-protector.exe	"Badware Protector rogue security software - not recommended

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.