sf

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	.msfupdate	msveup.exe	"Added by the ALLOCUP.A WORM!"
X	AAMSFree702	Avengine.com	"Added by the DELF.LJ TROJAN!"
X	AAMSFree702	sys.exe	Added by the BACKDOOR-CPC TROJAN!
X	AdminSoft	sysfile.vbs	"Added by the STARGRUB-A WORM!"
X	afskfask8	fsfjasj8.exe	"Added by the ONLINEG-L TROJAN!"
X	AntivirusFiable	pgs.exe	"AntivirusFiable
X	AntivirusForAll	pgs.exe	"AntivirusForAll rogue security software - not recommended
X	Audio Device Manager	sfhgj.exe	"Added by the IRCBOT-ZA BACKDOOR!"
X	Background Intelligent Transfer Service	[path] rundll32.exe	"Added by the VB-ZD TROJAN! Note - this is not the legitimate rundll32.exe process
X	BVWORSFM	bvworsfm.exe	"Added by the DLUCA-AD TROJAN!"
X	cftmon	sfcmonit.exe	Added by a variant of the AGENT.ERG TROJAN!
X	cmrsf	cmrsf.exe	"Added by the DELF-HU TROJAN!"
X	COM Service	msflyx.com	"Added by the BEASTDO-O TROJAN!"
U	ContentTransferWMDetector.exe	ContentTransferWMDetector.exe	"Part of Sony's Content Transfer Software which ""provides an easy way to transfer music
X	daskaskfsak6	dsfids6.exe	"Added by the ONLINEG-J TROJAN!"
?	DellTransferAgent	TransferAgent.exe	"Found on Dell computers. What does it do and is it required?"
X	DfqwSfS	ffsqsd.exe	"Added by the SDBOT-SH WORM!"
X	dsfghjgj	keepSafe.exe	"Added by the KILLAV.KAX TROJAN!"
X	dvsfss	fbsfsdrs.exe	"Added by the SDBOT-QA WORM!"
X	Edzy AntiVirus	dppsfa.exe	"Added by a variant of the RBOT WORM!"
N	ESFTP	esftp.exe	"ESftp - FTP client for transfering files between a local PC and another remote computer"
X	ethernet	msftp.exe	"Added by the SDBOT.BXJ WORM!"
?	file indexing service	msfindfile.exe	"New version of MS FindFast and still a resource hog?"
X	Files Driver	sfdhost.exe	"Added by the AGOBOT-AJC BACKDOOR!"
X	Fire Wall services	wnlmzsfhobi.exe	"Added by the IRCBOT-QY WORM!"
X	fsdsft	[path to backdoor]	"Added by the RANKY.S BACKDOOR!"
U	FTMSFLT(USB)	FTMSFLTU.EXE	Fujitsu's Touch Panel Message Notifier
U	HostsFileMgr	winHostsEdit.exe	"AdBin from Gilmore Software Development. An easy solution to managing your Window's hosts file"
N	HPStart	hpstart.wsf	This a script used by HP that runs the first time one of their computers is started. Can't imagine why it would be starting up after the first boot
N	Image Transfer	SonyTray.exe	Sony Image Transfer software provides direct image transfer from your digital camera to a PC - can be started manually
U	Intel File Transfer	xfr.exe	Part of Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicating between the core server and managed clients
X	itunesff	itunesff.exe	"Added by the EB adult premium dialer"
N	Kodak Batch Transfer	pezdow1.exe	Part of "Kodak Picture Easy" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC
N	Kodak Picture Easy . Batch Transfer	PezDownload.exe	"Part of ""Kodak Picture Easy"" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC. . represents the version"
N	Kodak Picture Transfer Software	pts.exe	Looks for Kodak camera connection and media insertion. Available via Start -> Programs
X	LoadWindowsFile	Kernel32.exe	"Added by the DELF.B TROJAN!"
X	LoadWindowsFile	winreg.exe	"Added by the HUPIGON.A BACKDOOR!"
N	Logiciel de transfert d'images KODAK	pts.exe	Looks for Kodak camera connection and media insertion. Available via Start -> Programs
X	Media Transfer Protocals	msstc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Mi7sft sdce	b0yz.exe	"Added by the RBOT.CWG WORM!"
X	Mi7sft sdce	MNSQ.exe	"Added by the RBOT.DMU WORM!"
X	Mi7sft sdce	scorti.exe	"Added by the RBOT.ELC WORM!"
X	MICROSFT ANTIVIRUS UPDATE SUPPORT	[random 10-letter filename].EXE	"Added by the RBOT-AQA WORM!"
X	MICROSFT ANTIVIRUS UPDATE SUPPORT	MSGUPDATED.EXE	"Added by the RBOT-APZ WORM!"
X	Microsft Conf 32	msaconf.exe	"Added by the RBOT.EYA WORM!"
X	Microsft Confige 32	msaconfigurez.exe	"Added by the RBOT.CLC WORM!"
X	Microsft Corporation Version 2001.12.4414	comrel.exe	"Added by a variant of the SDBOT TROJAN!"
X	Microsft Corporation Version 2002.12.2414	comserv.exe	"Added by a variant of the SLAPER TROJAN!"
X	MICROSFT MX UPDATE SUPPORT	taskmngrs.exe	"Added by the RBOT-AUZ WORM!"
X	MICROSFT MX UPDATE SUPPORT	winmx32.EXE	"Added by the IRCBOT-FD WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	[random filename]	"Added by the RBOT-ASM or RBOT-AUW WORMS!"
X	MICROSFT RAMA UPDATE SUPPORT	MSN32.EXE	"Added by the RBOT-AWJ WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	mtakthmyn.EXE	"Added by the RBOT-AUJ WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	MSGUPDAT32.EXE	"Added by the RBOT-BBB WORM!"
X	Microsft Remote Procedure Daemon	msrpcd.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsft Security Monitor Process	cmh.exe	"Added by the EGGDROP.V WORM!"
X	Microsft Security Monitor Process	mssmppp.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsft Security Monitor Process	mssmpp.exe	"Added by the SDBOT-DJW WORM!"
X	Microsft Updtes	sarvice.exe	"Added by a variant of the SDBOT WORM!"
X	Microsft Upgraed	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	Microsft Windows Adapter 5.1.3013	[random filename]	"Added by the SMALL.HIT TROJAN!"
X	microsft windows updates	mwupdate32.exe	"Added by a variant of the TOXBOT/CODBOT WORM!"
X	Microsoft Decryption Technology	Msfenoe.exe	"Added by the SPYBOT-DG WORM!"
X	Microsoft Kinetik Svc	msftksvc.exe	"Added by the AGENT.AGDO TROJAN!"
X	Microsoft Netview	gesfm32.exe	"Added by the RANDEX.C WORM!"
X	Microsoft PC Health Remote Assistance File Open & Save controls	sfrcdlg32.exe	"Added by the RBOT-AVY WORM!"
X	Microsoft Transfer File Server	mtfs.exe	"Added by the RBOT.AFE WORM!"
X	Microsoft Update Emulator	wuaddsff.exe	"Added by the RBOT-GX WORM!"
X	Micrsft Updese	xagwxz.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Micsorosft Security Center	wcnsfty.exe	"Added by the RBOT-AHU WORM!"
X	Miosf Update	wimsqaad.exe	"Added by the SDBOT.AG TROJAN!"
X	MS Configuration	MSFramer.exe	"Added by the RANDEX.OL WORM!"
X	MS FIREWALL	msfrewall.exe	"Added by the SDBOT-PU WORM!"
X	MS FIREWALL	msfirewall.exe	"Added by the SDBOT-QH WORM!"
X	Msfind	Msfind.exe	"CoolWebSearch parasite variant"
X	MSFind32	msfind32.exe	"Added by the CAYAM WORM!"
X	msfindosa.exe	msfindosa.exe	"Added by the DOWNLOADER-BS TROJAN!"
X	MSFTP Service Config	r3grun.exe	"Added by a variant of the SDBOT WORM!"
X	msfw.exe	msfw.exe	"Microsoft Security Adviser rogue security software - not recommended"
X	MSFWAVTSM	FTPDev.exe	"Added by the RBOT-ACF WORM!"
X	MsServer	msfun80.exe	"Added by the VB-CYG WORM!"
X	MsServer	msfir80.exe	"Added by the VB-CYJ TROJAN!"
X	mssfos	sfool.exe	"Added by the RANDEX.EUS WORM!"
N	MySoftware NewsFlash	Newsflsh.exe	"Runs in your task bar and receives alerts and release information on MySoftware products from Avenquest"
X	NAV Auto Protect	msfwe1.exe	"Added by a variant of the RBOT WORM!"
X	network device driver	msfirewall.exe	"Added by the DELF-LB TROJAN!"
X	NI.UGESF_0001_N122M0201	[path to file]	"Installer for the HataDuzelticisi Turkish rogue system error and cleaning utility - see here"
X	NTSF Microsoft System	fylez.exe	"Added by a variant of the RBOT WORM!"
X	NTSF MICROSOFT SYSTEM	wntsf.exe	"Added by the RBOT.ATC WORM!"
X	NTSF MICROSOFT SYSTEM	fufffy.exe	"Added by the RBOT-AEL WORM!"
X	NTSF MICROSOFT SYSTEM	ntssf.exe	"Added by a variant of the RBOT WORM!"
X	NTSF MICROSOFT SYSTEM	scvhost.exe	"Added by a variant of the RBOT WORM!"
X	NTSF MICROSOFT SYSTEM	winsis32.exe	"Added by a variant of the RBOT WORM!"
X	NTSF MICROSOFT SYSTEM	marya.exe	"Added by the RBOT-AXY WORM!"
X	NTSF MICROSOFT SYSTEM	sysman.exe	"Added by the RBOT.EDP WORM!"
X	NvCpl28Deamon	mdosft.exe	"Added by the SPYBOT-AD WORM!"
X	PCShield	regsvr32 sfg_***.dll [ = random char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
Y	PersFw	PersFw.exe	"Kerio or Tiny Personal Firewall"
U	PopUpStopperFreeEdition	PSFREE.EXE	"Panicware's Pop-Up Stopper - free limited features version"
U	PSFree	PSFree.exe	"Pop-Up Stopper Free from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group"
N	QD FastAndSafe	QDCSFS.exe	Automatically runs Fast & Safe clean-up from Norton/Quarterdeck Cleansweep. Deletes safe to remove files such as Temporary Internet Files (cache). Recommended you run it manually
X	RegistryMonitor	sysfade.exe	"Added by the SYSFADE TROJAN!"
X	Safeguard 2009	sf2009.exe	"Safeguard 2009 rogue spyware remover - not recommended
X	SafeGuard Popup Blocker Updater	regsvr32 sfgupd.dll	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	SafeGuard Popup Blocker Updater (required)	regsvr32 sfg***.dll [ = ramdom char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	SafeGuard Popup Updater (required)	regsvr32 sfg***.dll [ = random char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	Service PAck SFVP	[worm filename].exe	"Added by a variant of the RBOT WORM! The filename is 4 random characters"
X	sf	sf.exe	"SurfEnhance adware component"
N	SFIGUI	SFIGUI.EXE	"Sonic Focus - ""enhances music
X	sfita	sfita.exe	"Added by the FAVADD-H TROJAN! Also known as SurfEnhance adware"
X	SfKg6w	rayiou.exe	"Added by the AGENT.BUO WORM!"
X	SfKg6wIP	[random filename]	Identified as a variant of the TrojanDownloader.Matcash malware
X	SfKg6wIPu	[random filename]	Identified as a variant of the TrojanDownloader.Matcash malware
N	SFP	vzSFPWin.EXE	Verizon Online Support Center - prompts for online updates
U	sfpc	sfpc.exe	"Spy4PC surveillance software. Uninstall this software unless you put it there yourself"
X	SFtrb Service	cftrb32.exe	"Added by the SOBIG.D WORM!"
U	SfWinStartInfo	sfWinStartupInfo.exe	SFIRM32 Online Banking software
Y	SkyBlaster Scheduler	SSFSch.exe	For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system
X	sm	sf_exe.exe	"Added by the OLFEB.A TROJAN!"
N	Snappy Fax	sf4.exe	"Snappy Fax desktop fax program with an extensive set of features - version 4"
?	Snappy Fax Printer Agent	sfpagent.exe	"Related to the Snappy Fax desktop fax program. What does it do and is it required?"
?	Snappy Fax Printer virtual printer agent	sfpagent.exe	"Related to the Snappy Fax desktop fax program. What does it do and is it required?"
U	SoftGridTray	SFTTray.exe	"System Tray access to SoftGrid from Microsoft - ""the only virtualization solution that delivers applications that are never installed and dynamically delivered
N	SonicFocus	SFIGUI.EXE	"Sonic Focus - ""enhances music
U	SPAMfighter Agent	SFAgent.exe	"SPAMfighter anti email spam filter"
X	start	isfmntr.exe	"Added by the ZLOB.MEDIA-CODEC TROJAN! This purports to be a Windows Media Player upgrade (with names such as ""iCodecPack""
U	SurfinGuard Pro	winsfcm.exe	"SurfinGuard Pro from Finjan - internet protection software
X	sysfbtray	bill102.exe	"Added by the VB-ENI TROJAN!"
X	sysfbtray	bill106.exe	"Added by the MDROP-CLV TROJAN!"
X	sysfiler	sysfiler.exe	"Added by the RETSAM TROJAN!"
X	SYSfit	SYSfit.exe	"AdShooter adware variant"
X	sysflg32	sysflg32.exe	"Added by a variant of the CRYPTER.C TROJAN!"
X	sysformat	sysformat.exe	"Added by the BAGLE-BK WORM!"
X	sysfrcx	sysfrcx.exe	"Added by the KEYLOG-SCLOG TROJAN!"
X	sysftray2	bolivar19.exe	"Added by the KOOBFACE.I WORM!"
X	SYSsfitb	SYSsfitb.exe	"AdShooter adware"
X	System	Xsfr.exe	"Added by the CULLER-D WORM!"
X	System Firewall	sysfirewall.exe	"Added by the AGOBOT-ACY WORM!"
X	System Updates 4	mssysfix.exe	"Added by the RBOT-ADU WORM!"
Y	Tiny Personal Firewall	persfw.exe	"Tiny Personal Firewall"
U	TivoTransfer	TivoTransfer.exe	"Tivo Transfer Service. TiVo Desktop is an easy-to-use application that lets you publish and share digital music
X	TrojansFilter	pgs.exe	"TrojansFilter rogue security software - not recommended. A member of the AVSystemCare family"
X	TrojansFiltre	pgs.exe	"TrojansFiltre
X	USB Updates	msfirewalls.exe	"Added by a variant of the RBOT WORM!"
X	USBDrives	msfirewalI.exe	"Added by the RBOT-ABP WORM!"
X	VirusForsvar	pgs.exe	"VirusForsvar
X	WebSavingsfromEbates	WebSavingsfromEbatesrun.exe	"Web Savings From Ebates Software
X	WebSavingsFromEbates0	WebSavingsFromEbates0.exe	"Web Savings From Ebates Software
X	WIN-BUGSFIX	WIN-BUGSFIX.EXE	"Added by the LOVELETTER (I LOVE YOU) VIRUS!"
X	Win32 FRT Driver	msfr32.exe	"Added by the WOOTBOT.EJ WORM!"
X	WinDLL (ProsFix.exe)	ProsFix.exe	"Added by a variant of the IRCBOT BACKDOOR! The ""ProsFix.exe"" file is found in %System%"
X	Windows Firewall	WindowsFirewall.exe	"Added by the MYTOB.AO WORM!"
X	Windows Firewall Manager	msfw.exe	"Added by the RBOT.WR WORM!"
X	Windows Update Firewall System	winmsfw.exe	"Added by the RBOT-EEO WORM!"
X	Windows Vista Transformation	IEXPLORE.exe	"Added by the FORBOT-GV WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	WindowsFileSystem	winsfs32.exe	"Added by the RBOT-FMQ WORM!"
X	WindowsFileSystem	cidaemon32.exe	"Added by the RBOT-FSP WORM!"
X	WindowsFirewall	lsass.exe	"Messenger Blocker rogue security software - not recommended. Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\System"
X	WindowsFirewallSvc	winsvcup.exe	"Added by a variant of the SDBOT WORM!"
X	WINDOWSflashbrg	sqldata1.exe	"Added by a variant of the AGENT-IC TROJAN!"
X	WindowsFS	winfs.exe	"Added by the AGOBOT-BO WORM!"
X	Windowsfw	vssmf32.exe	"Added by the SPIGOT BACKDOOR!"
X	Windowsfw	windowsfw.exe	"Added by the AGOBOT-TA WORM!"
X	WindowsFY	wp.exe	"Part of a ""Security IGuard"" parasite infestation - also detected as DESKTOPHIJACK"
X	WindowsFY	bsw.exe	"Added by a variant of the DESKTOPHIJACK TROJAN! For removal see here"
X	WindowsFY	[path to trojan]	"Added by the FAKEALE-E TROJAN!"
X	WindowsFZ	[path to file]	"Added by the DESKTOPHIJACK VIRUS! Also see DESKTOPHIJACK.B TROJAN!"
X	WindowsFZ	A5281300.so	"Variant of the SmitFraud alias FAKEALE-C TROJAN!"
X	WindowsFZ	zloader3.exe	"Variant of the SmitFraud alias FAKEALE-C TROJAN!"
X	winsfc	winsfc.exe	"Added by the WISFC VIRUS!"
N	WorksFUD	wkfud.exe	A marketing program for MS Works
X	xzkadsfk10	afslkfasl10.exe	"Added by the ONLINEG-R TROJAN!"
X	[12 random characters]	asferror.exe	"IeDriver adware variant"
X	[random]	[random]sftav.exe	"Antivirus Soft rogue security software - not recommended
X	{78B578D7-BCE1-4d83-9CD4-195BC34D8CB3}	syssfzvakqg.exe	"Added by the FAKEALERT-AM TROJAN!"
X	{C2220120-1C24-4a79-BA7A-DDCBFC209DB3}	sysfbdgv.exe	"Added by the FAKEALERT-AM TROJAN!"
X	{C599792D-C6D9-461d-93CA-B48BFF8E37B1}	sysfdyev.exe	"Added by the FAKEALERT-AM TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.