sysd

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	Auto updat	SysDebug.exe	"Added by the FORBOT-BA WORM!"
X	DrefIW	SysDrefIWv2.exe	"Added by the DREF-C WORM!"
X	DrefIW	SysDref.exe	"Added by the DREF-D WORM!"
U	hpsysdrv	hpsysdrv.exe	"This item keeps track of how many times the system has been recovered and the times of the first and last recoveries done on the system. Leaving unchecked will sometimes prevent the Keyboard Manager program from detecting that the computer is an HP. Since this program/driver was only made to run on HP
X	Kernel32_sysdamper	sysdamp.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Media Player	Sysdll.exe	"Added by the BANKER-BR TROJAN!"
X	Microsoft Service 32	sysddm32.exe	"Added by the SDBOT.AKC WORM!"
X	MicrosoftCorp	sysdiag64.exe	"Added by a the AUTOINF-AB WORM!"
X	MicrosoftNAPC	sysdiag64.exe	"Added by a the AUTOINF-AB WORM!"
X	Mp3 Loader	Sysdata.EXE	"Added by the AVETTE-A VIRUS!"
X	MsWindows SysDate	sysmsvc.exe	"Added by the SPYBOT.FCD WORM!"
X	MSysDrv	msdrv.exe	Added by the VB.WF TROJAN!
N	Norton System Doctor	Sysdoc32.exe	"Norton Disk Doctor from Norton Utilities. Automatically runs at start-up
X	regsvc	sysd	"Sys Detective+ spyware"
U	RunSysd32	RunSysd32.exe	DesktopShield2000 by Stéphane Groleau. Locks the desktop at bootup so that users cannot bypass the Windows screensaver password. Only essential if using the program and is an optional setting. It can be disabled from within
U	Srv32Win	sysdiag.exe	"SpyAgent surveillance software. Uninstall this software unless you put it there yourself"
X	ssgrate.exe	sysdoor.exe	"Added by the MITGLIEDER.N TROJAN!"
X	StartupOption	loadsysdisk.exe	"Added by the HIDAGENT-B WORM!"
X	sys	regedit sysdllwm.reg	"CoolWebSearch parasite variant - also detected as the FEMAD-L TROJAN!"
X	sysdat.dll	sysdat.dll.exe	Added by the NISHICA 1.1 TROJAN!
X	SysData	[path to file]	"Added by the RANCK-BA TROJAN!"
X	SysDefence.exe	SysDefence.exe	"SysDefence rogue security software - not recommended
X	SysDefenders	SysDefenders.exe	"SysDefenders rogue security software - not recommended
X	SysDepannage	SysRep.exe	"SysDepannage
X	SysDeskqqfx	qqfx.exe	"Added by the QQPASS.H TROJAN!"
X	SysDeskqqfx	Runddll32.exe	"Added by the CHANGGAME TROJAN!"
X	SysDesktop	fswanQQ.exe	"Added by the QQSEND-A TROJAN!"
X	sysdiag64.exe	sysdiag64.exe	"Added by a the AUTOINF-AB WORM!"
X	sysdir	winrun.exe	"Added by the WINBUR.B WORM!"
X	sysdll	windll.exe	"Added by the AUTORUN.ECT WORM!"
X	sysdll	[trojan filename]	"Added by the HUGESOT TROJAN!"
X	Sysdpt	sysdpt.exe	"CRYPT trojan downloader"
X	sysdxvid	sysdxvid.exe	"Added by the DLUCA-S TROJAN!"
U	System Check	"Rundll32.exe SysDll32.dll	SystemCheck"
X	System Database Administration Support Process	sysdasp.exe	"Added by the DERDERO.C WORM!"
X	System DataBase Root	sysdbroot.exe	"Added by the QHOST-W TROJAN!"
X	System DB Manager	sysdbmg.exe	"Added by an unidentified WORM or TROJAN! See here"
X	System Diagnostics	sysdiag32.exe	"Added by the SDBOT.GEN TROJAN!"
U	System DLL Resources	sysdll.exe	"SnapKey is a surveillance software program that records all keyboard activities. Uninstall this software unless you put it there yourself"
X	System Drivers	sysdrv32.exe	"Added by the AGOBOT-ZX WORM!"
U	System32	sysdiag.exe	"SpyAgent surveillance software. Uninstall this software unless you put it there yourself"
X	system32.dll	sysdll32.exe	"CoolWebSearch parasite variant. Redirecting to wholeworldmarket.com
U	System32kfvw	sysdiag.exe	"SpyAgent surveillance software. Uninstall this software unless you put it there yourself"
X	SystemDebug	Sysdeb32.exe	"Added by the SYSBUG TROJAN!"
X	Task Debugger	sysdll.exe	"Added by the RBOT-CQ WORM!"
X	Taskman	sysdate.exe	"Added by the SILLYFDC.BCQ WORM!"
X	Taskman	sysdrv.exe	"Added by the AGENT-LRB TROJAN!"
X	Windows Services	winsysdll.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Update	sysdrv.exe	"Added by the AGENT-IYE TROJAN!"
X	winreg_32	sysdll.exe	"Added by the DLOADER-IJ TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.