Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
Y*StateMgrstatemgr.exeWindows ME default for System Restore. Do NOT disable!
X*winstatswinstats.exe"Added by the GARGAFX TROJAN!"
UAcer ePresentation HPDePresentation.exe"Part of Acer Empowering Technology. Allows you to manage both internal and external displays"
XActive Bit Stationabs.exe"Added by the MYTOB.BZ WORM!"
XAdRotator.Application[path to csrss.exe]"Added by the SMALL-AQ TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
XAdRotator.Applicationservices.exe"FakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in an ""Inetsrv"" subfolder"
XAdStatus ServiceAdStatServ.exe"WindUpdates AdStatus Service adware"
UAirPort Base Station AgentAPAgent.exe"Airport Base Station Agent utility for Apple's AirPort wi-fi basestations. ""Wireless solution for home
UAll Aboard Statusstswin.exe"All Aboard! Internet Connection Sharing status icon"
?AnnotateCheckAnnCheck.exe"Genius Wizard Pen Tablet driver related. Is it required?"
YAPC UPS StatusDisplay.exe"APC PowerChute® Personal Edition status icon"
XASP.NET State Servicecsrss.exe"Added by the DLOADER-QI TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
XASP.NET State Servicecrsass.exe"Added by the BANLOAD-M TROJAN!"
XASP.NET State Serviceservicos..exe"Added by the DADOBRA-I TROJAN!"
UAVStation premiumAVStation agent.exe"Related to Samsung AV Station - instant playback of music
?Bart Stationstation.sbrt"Related to PeoplePC ISP. May be a dialler for dial-up accounts?"
UBart StationPPCOLink.exeDialer for PeoplePC ISP
NBJ Printer Status MonitorCjstsr.exeCanon BJ printer status monitor
NBJ Status Monitor 5xxCJSTRxx.EXECanon printer status monitor - where "xx" is different depending upon the version. Not required as you can check the printer status via My Computer -> Printers
UBootStatusBOOTST~1.EXE"Visual Basic program that pops up a small window on startup telling you how many times the machine has been booted that day. Once you exit it
UCafeStationCafeStation.exe"""CafeSuite is the solution for your internet cafe. Our software provides you with ameans to control the workstations
UCanon MultiPASS Status Monitormonitr32.exeCannon Multi-Pass status monitor - your choice
?Canon PC1200 iC D600 iR1200G Status WindowCAPM1LAK.EXE"Cannon printer related - is it required in startup?"
XCashToolbarMSCStat.exe"Added by the DOWNLOADER-MY TROJAN!"
UChatStatChatStat.exe"ChatStat from ChatStat Technologies
NClik Status Monitortoolsclickstat.exePart of Iomega Tools to let you know whether an Iomega PocketZip (nee Clik) removable drive cartridge is installed
UCommand WorkStation 4cws 4.exe"EFI's Command WorkStation makes ""managing demanding workflows easier by centralizing job management. The software automatically identifies the Fiery servers on the network and offers customization options for displaying information"" - for high-end print environments"
XCPU Windows Statuscpustats.exe"Added by a variant of the RBOT WORM!"
XCrc32stats DependenciesCrc32stats.exe"Added by the MYTOB.GT WORM!"
?DashBarStatedashIE"??"
UDepFrezfrzstate.exe"Deep Freeze from Faronics Coporation. ""Freezes"" the current software configuration so that an a re-boot all changes made refer back to their original settings. Not required for most users - more likely to be used by system administrators
XDisk Defragmentation Loaderpmsvcr.exe"Added by a variant of the IRCBOT TROJAN!"
UDSLSTATEXEdslstat.exeSystem tray connection status for ADSL modems from Eicon Networks (as used by BT Broadband for example)
UDT 11Mbps WLAN PC Card StationDTCARDMonitor.exe11Mbps PC Card based wireless LAN connection monitor - possibly from Deutsche Telekom
UDT 11Mbps WLAN USB StationDTUSBMonitor.exe11Mbps USB based wireless LAN connection monitor - possibly from Deutsche Telekom
Ue-Surveiller Stationestation.exe"ESurveiller - surveillance software. Uninstall this software unless you put it there yourself"
UEPSON Status Monitor 3E_[various].EXE"Epson Status Monitor 3 for their range of printer and AIO devices - for monitoring printer status
NEPSON Status Monitor 3 Environment Checke_srcv03.exeAccording to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
NEPSON Status Monitor 3 Environment Checke_srcv02.exeAccording to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
NEPSON Status Monitor 3 Environment Check 2e_srcv03.exeAccording to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
NEPSON Status Monitor 3 Environment Check 2e_srcv02.exeAccording to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
UFabrik Ultimate Backup Statusfabrikhomestat.exe"Status monitor for Fabrik Ultimate Backup from Fabrik Inc. ""No matter what happens to the drive on your desk - a spilled drink
NFlashPath MonitorSDSTAT.EXESystem Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
NFlashPath MonitorFLSHSTAT.EXESystem Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
NFlashPath StatusSDSTAT.EXESystem Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
NFlashPath StatusFLSHSTAT.EXESystem Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
NFotoStation Easy AutoLaunchFotoStation Easy AutoLaunch.exeInstalled with a Nikon digital camera. Used to collect photos uploaded from camera program NkVwMon.exe. If your camera is not connected (via USB port) you do not need this program loaded either
UGARO Status Monitorcnwism.exePrint monitor for certain Canon printers
Xhid_startgzmrotate.dll"AdRotator/IconAds adware"
NHP Presentation ReadyPresRdy.exeHP Omnibook related: "Press a dedicated button above the keyboard and the system will instantly load your presentation software and change the screen resolution to match your display device"
NHP Statushpstatus.exeHP Printer Status and Alerts
?HP Status Serverhpboid.exe"Copied during installation of HP Inkjet Printer Drivers in Win2K/XP. What does it do and is it required?"
XInternetGetConnectedStatewinupdate.exe"Added by the SDBOT-JN WORM!"
XInternetGetConnectedStateExwinupdate.exe"Added by the SDBOT-JN WORM!"
UKClientkstatus.exeKClient Kerberos client software for Win32 systems. It provides the libraries and utilities needed to use Kerberos-based PC applications developed by Computing Services such as KWeb and NiftyTelnet
?Keyboard StatusKeyStat.exe"Multimedia keyboard manager for Medion desktop and notebook PCs? Located in %ProgramFiles%\Medion\KeyStat"
NLM StatusLMSTATUS.EXEXerox WorkCenter XE - language monitor status application
NLMSTATUSLMSTATUS.EXEXerox WorkCenter XE - language monitor status application
Uload=asistat.exeStatus monitor for an NEC SuperScript printer
XMcafee Antivirus Monitoring System326VSStatmn326.exe"Added by a variant of the SDBOT WORM!"
XMcafee Antivirus Monitoring System32mnVSStatmn32.exe"Added by a variant of the RBOT WORM!"
UMcAfee Online BackupMOBKstat.exe"System Tray access to McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
UMcAfee Online Backup StatusMOBKstat.exe"System Tray access to McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
NMemory Stick MonitorMSTAT.exe"Used with the Sony floppy disk adapter for memory sticks
UMemory Stick MonitorMSstat.exeSony/SmartDisk memorystick-floppydisk-adapter software - allows you to read memorysticks in a normal floppydrive
XMicrosoft Update Machinememstat.exe"Added by the RBOT-OM WORM!"
XMicrosoft Windows Workstationdevcode.exe"Added by the RBOT-AWL WORM!"
XMistikotitaTuIpologistiGDC.exe"MistikotitaTuIpologisti Greek rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
XMozilla Firebird v0.8 Internet Browsernetstats.exe"Added by the IRCBOT.MC TROJAN!"
UMozy Statusmozystat.exe"Mozy - free backup at a secure
UMP_STATUS_MONITORmonitr32.exeCannon Multi-Pass status monitor - your choice
XMSNnetstats.exe"Added by the IRCBOT.UXP WORM!"
XNdtstatNdtstat.exeAdded by a variant of the BANLOAD family of TROJANS!
XNET Bios Statsntbstats.exe"Added by the SDBOT-ZX WORM!"
NNetStat LiveNsl.exe"AnalogX NetStat Live - TCP/IP protocol monitor which can be used to see your exact throughput on both incoming and outgoing data"
NNokia Status MonitorNclTray.exe"Part of Nokia PC Suite version 5 - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" Monitors ports to see if a phone has been connected and provides System Tray access to the Connection Manager (and other PC Suite components if a phone is connected). Available via the Control Panel as ""Nokia Connection Manager"""
Xnstatnetstat.exeAdult content dialler
XNvCplScannetstat32.exe"Added by the SDBOT.BRL WORM!"
?NVRotateSysTraynvsysrot.dll"Related to NVIDIA nView Control Panel. What does it do and is it required?"
XOpiStatOpiStat.exe"NetRatings Premeter spyware"
?PreAnnotatePreAnntt.exe"Genius Wizard Pen Tablet driver related. Is it required?"
UPro PCL Status MonitorPENGSS.EXEXerox printer/fax/copier status monitor (PCL = printer control language)
XReal Statics Agentccreal.exe"Added by a variant of the RBOT WORM!"
YShStatEXESHSTAT.EXEPart of McAfee's VirusScan Enterprise corporate anti-virus and anti-spyware security tool
USoftwareStationstation.exe"eAcceleration Stop-Sign security software related. Previously not recommended
XSpoolstatic.exe"Added by an unidentified WORM or TROJAN! Located in the Root folder (C:\)
XSpyDevastatorSpyDevastator.exe"SpyDevastator rogue security software - not recommended
Xsstatadwdas.exe"Added by the DASDA TROJAN!"
Xsstata[path to trojan]"Added by the RANCK-DF TROJAN!"
NStat 'n' PerfStatnPerf.exe"Stat 'n' Perf monitors your internet connection and displays information about sent and received bytes"
XStatBarSTATBAR.exe"StatBar (system status bar) allows you to quickly get an overview of your system's condition (memory
XState Servicecsrss.exe"Added by the DADOBRA-CP TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
UStationPlaylistStudioSPLStudio.exe"StationPlaylist Studio - ""simple to use on-air broadcast playback software for the studio and/or DJ"" for small to medium sized radio broadcasters
XStatisticsstatslist.exe"Added by the OPANKI-S WORM!"
Xstatloadspgjd83sa.exe"Added by the SDBOT-UM WORM!"
NStatus MonitorBrMfcWnd.exeBrother scanner status monitor - can be started manually
UStatus Monitor CLJ1500HPPOUMUI.exe"Status monitor for the HP Color LaserJet 1500 printer from Hewlett-Packard - for monitoring printer status
NStatus Monitor XEENGSS.EXEThe Xerox Document WorkCentre XE Series Status Monitor displays information about your printer and currently active or waiting print jobs. You can use it to control your printing environment and manage your printing operations. Available via Start -> Programs
?StatusClientStatusClient.exePart of Hewlett Packard network printer drivers
?StatusClient 2.6StatusClient.exePart of Hewlett Packard network printer drivers
NStatusViewStatusView.exe"Status View intra-office messaging"
Xstealth.stat.exestealth.stat.exe"Added by the THEALS.A WORM!"
UStopSignStatusstopsinfo.dll"eAcceleration Stop-Sign security software related. Previously not recommended
Xstxrmsgmsmstats.exe"Added by the IRCBOT-AE TROJAN!"
NSupastatusstatus.exe"Supanet ISP software"
XSygate Personal Firewallwinxpstat.exe"Added by a variant of the RBOT WORM!"
XSys-Statwuapdxe.exe"Added by the SDBOT.HK WORM!"
XSystem Failure Statisticcnstat.exe"Added by the RBOT-LF WORM!"
XSystem StatsSystemStats.exe"Added by a variant of the WOOTBOT WORM!"
XSystem-Statsystats.exe"Added by the SDBOT.RA WORM!"
Xtattatss.exe"Delfin Promulgate adware variant"
UThinkPad Presentation DirectorNPDTray.exeSystem Tray access to Presentation Director for IBM/Lenovo Thinkpad notebooks - which allows you to create and quickly select between various single and mulitple display options. Scheme selection and settings are also available via Fn+F7 key combination on some models
UToshiba Key StateKEYSTATE.EXE"Displays an icon in the System Tray indicating the state of the CAPS LOCK key. Can be handy on (e.g.
UTosRotationTRot.exeTOSHIBA Rotation Utility - allows users to rotate a notebook's screen image 180 degrees in order to share information on the screen with others seated across a table or desk
Xttaatata.exe"Added by the LINEAGE-T TROJAN!"
XUpdatestatsUpdatestats.exe"Statblaster adware"
XUpdateStatsUpdateStats.exe"SeekSeek search hijacker related - see here"
Xvietato.exevietato.exeAdult content dialler
?VirusScanMSCVsStat.exe"Part of McAfee VirusScan. System Tray application as with previous versions (were also VsStat.exe)
UVMware Workstationvmware-tray.exe"System Tray access to virtual machines (VMs) currently in a ""powered on"" state in VMware Workstation - which ""makes it simple to create and run multiple virtual machines on your desktop or laptop computer"". Can be helpful if VMs are configured to run ""headless"" at Windows startup
NVMware Workstationhqtray.exe"VMware Host Network Access Status Tray Application - part of both VMware Player (from version 2.0) and Workstation (until version 6.5) - which allow you to ""run multiple operating systems simultaneously on a single PC."" It's function is uknown at present and it displays no tray icon as the name suggests. Can be disabled without affecting the operation of either product"
YVsStatEXEVSSTAT.EXEFrom McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Communicates between VSSTAT.EXE and the VShield System Scan module. Can be started automatically or available via Start -> Programs
UWDDMStatusWDDMStatus.exe"WD Drive Manager - part of Western Digital's WD SmartWare management software for selected external drives in the My Book and My Passport range. Allows the user see the drive status
?WEPstatWepstat.exe"Cisco Aironet 340 Series PC Card driver. If it can be started manually it shouldn't be required if you don't use the PC card facility regularily - hence the status could be ""U"". Can anybody confirm this?"
?win namestat.exe"??"
XWin32.Trojan.Downloadernetstat2.exe"Added by the PAINTER TROJAN!"
XWindows AdStatusWinStat.exe"Added by the BLESHARE!DR VIRUS!"
XWindows Management Instrumentationmwd.exe"Added by the GRAPS WORM!"
XWindows Management Instrumentation[path to file]"Added by the QEDS-A WORM!"
XWindows Management Instrumentationswinmg.exe"Added by the GAOBOT.GW WORM!"
YWindows SteadyState - Bubble MessagesBubble.exe"Part of Windows SteadyState
YWindows SteadyState - Session Timer Notify (UI)SCTUINotify.exe"Part of Windows SteadyState
XWindows Workstationmpci.exe"Added by a variant of the RBOT WORM!"
XWindows Workstationmsup32a.exe"Added by a variant of the SDBOT WORM!"
XWindows Workstation Serviceexplore.exeAdded by unknown malware
XWindows Workstation Servicewkssvc.exe"Added by the IRCBOT-AAI WORM!"
XWindows Workstation Service (32-bits)wkssvc32.exe"Added by a variant of the SDBOT WORM!"
XWindows Workstation Service [5.1-2600]windrm.exe"Added by the RBOT-CNY WORM!"
XWindows Workstation Start Servicemslanmgr.exe"Added by a variant of the RBOT WORM!"
?Winnov StatusWvStatus.Exe"Winnov Video Capture Card related. What does it do and is it required?"
Xwinstatswinstats.exe"Added by the GARGAFX TROJAN!"
NWLAN Status Tray AppletWLANSTA.EXESystem Tray icon for checking the status of a Wireless LAN
UWorkstation Schedulerwm95.exe"Desktop Management Scheduler. Part of Novell's Netware Client. Schedueles NDS events. If events have been schedueled
XWorkstation Serviceswrkstn.exe"Added by the RBOT-OJ WORM!"
XWorkstation Ver 5.0vmware.exe"Added by the RBOT-AHB WORM!"
UWSEP Status+ConfigurationcontroldGUI.exe"User interface for the WatchGuard Security Event Processor (WSEP) Status/Configuration dialog box associated with the Firebox series of security products from Watchguard"
XWstat32 driverWstat32.exe"Added by the LOONBOT TROJAN!"
?XboxStatXboxStat.exe"Xbox 360 related. What does it do and is it required?"
UXE 8x LM Statuslmsxxe.exeXerox XE8 series laser printer status monitor
NXeroxRegistationEReg.exeRegistration reminder from Leader Technologies for software from Xerox
Xxpstatwinlogins.exe"Added by the RBOT-AAR WORM!"
X[various names]StatusCheck.exe"Wareout - malware masquerading as a spyware and dialer remover"


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.