sre

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	$WindowsRegKey%update	IEXPLORE.EXE	"Added by the RBOT-EZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	AhorreMemoria	SysRep.exe	"AhorreMemoria rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
U	AlwaysReady Power Message APP	ARPWRMSG.EXE	"""Away Mode"" feature added with Update Rollup 2 for Windows XP Media Center Edition 2005 that allows the computer to appear off to the user while it continues to perform tasks that do not require user input
X	APIMon	msreg.exe	"Added by the DROPPER.Z TROJAN!"
X	BeschermingsTool	SysRep.exe	"BeschermingsTool
X	btmsre.exe	btmsre.exe	"Added by the SDBOT.AM WORM!"
X	BugsDestroyer	SysRep.exe	"BugsDestroyer rogue system error and cleaning utility - not recommended
X	CleanPCTool	SysRep.exe	"CleanPCTool rogue system error and cleaning utility - not recommended
X	CleanupTool	SysRep.exe	"CleanupTool rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
X	DiskRetter	SysRep.exe	"DiskRetter
X	DNS Service	dnsresolver.exe	"Added by the RBOT-PQ WORM!"
X	DokterFix	SysRep.exe	"DokterFix
X	Domain Name Resolve Service	dnsresolver.exe	"Added by the KIMAN.A WORM!"
X	ErrClean	SysRep.exe	"ErrClean rogue system error and cleaning utility - not recommended. There are number of variants in this family sharing the same filename and user interface - see here"
X	ErreurChasseur	SysRep.exe	"ErreurChasseur
X	FestPlattenCleaner	SysRep.exe	"FestPlattenCleaner
N	FineReader7NewsReaderPro	AbbyyNewsReader.exe	"ABBYY FineReader OCR software - version 7"
X	HardDriveGuard	SysRep.exe	"HardDriveGuard rogue system error and cleaning utility - not recommended
X	HataDuzelticisi	SysRep.exe	"HataDuzelticisi
X	IsassRenascimento	Issas.exe	"Added by the BANKER.GAX TROJAN!"
N	IsReminder	ISPopup.exe	"Related to GuardWare iShield - this is the registration reminder for the trial version
X	LibreSystem	SysRep.exe	"LibreSystem
X	Microsoft Keyboard Enhance 2.0.	iasrecst.exe	"Added by the BCKDR-QIL BACKDOOR!"
X	Microsoft Keyboard Enhance V2.0	iasrecst.exe	"Detected by F-Prot as the DOWNLOADER2.AILI TROJAN!"
X	Microsoft Windows Updating System	msresource.exe	"Added by the RBOT-EAM WORM!"
X	MS SyS Restore	sysrestore.exe	"Added by the RBOT.XM WORM!"
X	MSNSysRestore	pc32.exe	Added by a variant of the MASTAK VIRUS!
X	msreg.exe	msrege.exe	"Added by the ZINX TROJAN!"
X	msReg32 Loader	msreg32.exe	"Added by the AGOBOT.IU WORM!"
X	MSREGIT	Msgp.exe	"Added by the KRYPGHOS.13 TROJAN!"
U	MSRegScan	SGP.exe	"SpyGator surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	SSDemo.exe	"SupremeSpy surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	ETNKL.exe	"ComKeylogger surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	KSPDemo.exe	"KeyStalker PRO surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	DDSSDemo.exe	"SystemSleuth surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	ESP+.exe	"ESP surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	ESPDemo.exe	"Eye Spy Pro surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	SBPDemo.exe	"SpyBoss Pro surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	YEKPND.exe	"EyeCandy Computer Monitor surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	YKPND.exe	"YKPMD surveillance software. Uninstall this software unless you put it there yourself"
X	MSRegSvc	regsvc32.exe	Homepage hijacker that changes your homepage to an adult content site
X	msresear	[path to trojan]	"Added by the WEASYW-B TROJAN!"
X	msresearch	msresearch.exe	"TROJAN! - 180SearchAssistant adware related"
X	msresearch	tool3.exe	"Spy Sheriff/SpywareNO malware
X	msserv	lvsrev.exe	"Added by the BROWMON-B TROJAN!"
X	Nod32 Runtime	sysregi.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	OEM32 Tools	sres32.exe	"Added by the RBOT.AML BACKDOOR!"
X	PCToolPro	SysRep.exe	"PCToolPro rogue system error and cleaning utility - not recommended
U	PhilipsRemote	PhilipsRemote.exe	"Remote control support for MusicMatch Jukebox on Philips audio players such as the AZ2555 Sound Machine - see
X	ProtectingTool	SysRep.exe	"ProtectingTool rogue system error and cleaning utility - not recommended
X	ProtejaseuDrive	SysRep.exe	"ProtejaseuDrive rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
X	ProtezioneSoft	SysRep.exe	"ProtezioneSoft
X	RecycleSTR	msreg32.exe	"Added by the RBOT-TC WORM!"
X	Remndr	CsRemnd.exe	CasinoOnline foistware
X	ReparateurDeSysteme	SysRep.exe	"ReparateurDeSysteme
U	RssReader	RssReader.exe	"RssReader - a free RSS reader able to display any RSS and Atom news feed (XML)"
X	SafeHardDrive	SysRep.exe	"SafeHardDrive rogue system error and cleaning utility - not recommended
X	SafePCTool	SysRep.exe	"SafePCTool rogue system error and cleaning utility - not recommended
X	SchijfBewaker	SysRep.exe	"SchijfBewaker
X	SicherheitsTool	SysRep.exe	"SicherheitsTool
X	SolutionReg	SysRep.exe	"SolutionReg rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
X	sre	"rundll32.exe sre.dll	Register"
?	srePostpone	"rundll32.exe [path] srescan.dll	DoSpecialAction"
X	StorageProtector	SysRep.exe	"StorageProtector rogue system error and cleaning utility - not recommended
X	Svcsys Registry Manager	svcsysreg.exe	"Detected by Kaspersky as the AGENT.CV TROJAN!"
X	syelimS-esreveR-troppuS	[filename]	"Added by the LITBOT.C TROJAN!"
X	Sys Ren	SysRen.exe	"Part of FlashEnhancer adware"
X	SysDepannage	SysRep.exe	"SysDepannage
X	SysReg	SysReg.exe	"Added by the CHEKIN TROJAN!"
X	SysReg	SysReg.exe	"SearchSeekFind textual marketing foistware"
X	Sysres	Sysres.exe	"Added by the LOGMOD.A TROJAN!"
X	SysRes	TASKMANAGER.exe	"Added by the ELIPTER.A or ELIPTER.B WORMS!"
X	SysRes	WWE DIVAS.exe	"Added by the ELIPTER.D WORM!"
X	SysRes	IExpIore .exe	"Added by the ELITPER.E WORM!"
X	sysrest32.exe	sysrest32.exe	"Added by the AGENT-GIN TROJAN!"
X	sysrestore32.exe	sysrestore32.exe	"Unknown malware detected by McAfee - see here"
X	SysSearch	Regedit.exe -s sysreg.reg	"Added by the STARTPA-ME TROJAN! Note that regedit.exe is a legitimate Microsoft file and shouldn't be deleted. The ""sysreg.reg"" file is located in %Windir%"
X	System Service	MSREXE.EXE	"Added by the AML TROJAN!"
X	SystemErrorFixer	SysRep.exe	"SystemErrorFixer rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
X	SystemOrdnare	SysRep.exe	"SystemOrdnare
X	toolsicuro	SysRep.exe	"ToolSicuro
X	UtilisateurSur	SysRep.exe	"UtilisateurSur
X	Video Driver	Msregdrv32.exe	"Added by the SPIGOT BACKDOOR!"
X	Virus Remover Profesional	virusremover.exe	"Virus Remover Profesional rogue security software - not recommended
X	VirusRemover2008	VRM2008.exe	"VirusRemover2008 rogue security software - not recommended
X	VirusRemover2009	VRM2009.exe	"VirusRemover2009 rogue security software - not recommended
X	VirusRescue	VirusRescue.exe	"VirusRescue rogue security software - not recommended"
X	VirusResponseLab2009	VirusResponseLab2009.exe	"VirusResponse Lab 2009 rogue security software - not recommended
X	Windows Spoolsre Service	spoolsre.exe	"Added by the SDBOT-AAE WORM!"
X	Windows System Drivers	sysretain.exe	"Added by the SLENFBOT.BY WORM!"
X	WindowsReg% update	[random filename].exe	"Added by the RBOT-HH WORM!"
X	WindowsRegistration	[random filename]	"Added by the RBOT-NO WORM!"
X	WindowsRegKey Autoupdate	[random filename]	"Added by a variant of the RBOT WORM!"
X	WindowsRegKey upd4te2d4te	********.exe [ = random char]	"Added by the RBOT.XQ WORM!"
X	WindowsRegKey update	winupdate.exe	"Added by the RBOT-QJ WORM!"
X	WindowsRegKey update	windns.exe	"Added by the RBOT.IE WORM!"
X	WindowsRegKey update	winupdatexx.exe	"Added by the RBOT.LW WORM!"
X	WindowsRegKey update	[random filename]	"Added by the RBOT.QT WORM!"
X	WindowsRegKey update	svchoosts.exe	"Added by the RBOT.ADB WORM!"
X	WindowsRegKey update	svchostc.exe	"Added by the RBOT.IF WORM!"
X	WindowsRegKey update	wdnupdate.exe	"Added by the SDBOT.QX WORM!"
X	WindowsRegKey update	Windowsup.exe	"Added by the SDBOT.PU WORM!"
X	WindowsRegKey update	WINUPDATES.EXE	"Added by the RBOT-MM WORM!"
X	WindowsRegKey update	rkbuouoxfl.exe	"Added by the RBOT-OO WORM!"
X	WindowsRegKey update	winsys.exe	"Added by the RBOT-JY WORM!"
X	WindowsRegKey update	winupdat32.exe	"Added by the RBOT-AGW WORM!"
X	WindowsRegKey update XP	windexv1.exe	"Added by the RBOT-ABM WORM!"
X	WindowsRegKey%$ update	msi332.exe	"Added by the RBOT-IX WORM!"
X	WindowsRegKey%update	ethernet32m.exe	"Added by the RBOT-EN WORM!"
X	WindowsRegKeys update	winsysi.exe	"Added by the SDBOT.WE WORM!"
X	winlogon	msreg32.exe	"Added by the SDBOT.EO WORM!"
X	WinPCDoctor	SysRep.exe	"WinPCDoctor rogue system error and cleaning utility - not recommended
X	Winsock2 driver	sysreq.exe	"Added by the SPYBOT-CC WORM!"
X	WinSP	[path] REGEDIT.EXE -s [path] sysreg.reg	"Added by the STARTPA-ME TROJAN!"
X	{----**}	mrdsregp.exe	"Zenosearch adware
X	{1C-CC-C5-54-ZN}	dwdsregt.exe	"ZenoSearch adware"
X	{2F-FF-F4-4C-ZN}	omdsregk.exe	"ZenoSearch adware"
X	{8C-C4-4A-A4-ZN}	dwdsregt.exe	"ZenoSearch adware"
X	{B7-7D-D0-08-ZN}	dwdsregt.exe	"Added by the AGENT-GBC TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.