Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
X1029BB4B-16A9-4E77-AA3D-96930BD68EECsysockeu.exe"Added by the FAKEALERT-AH TROJAN!"
UABIT uGuruuGuru.exe"ABIT µGuru - on motherboards incorporating the µGuru processor this provides quick access to ""hardware monitoring
NActive CPUacpu.exe"Active CPU - ""easy to use tool for Windows 95/98/ME/NT/2000 that enables you to watch a graphical representation of your CPU's activity"""
UActiveMenuActiveMenu.exeWild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
UACUACU.exe"Atheros wireless Client Utility"
UACU_QSBACU.exe"Atheros wireless Client Utility"
?ADUadu.exe"Related to Cisco Aironet wireless products. What does it do and is it required?"
XAidaeetu.exe"PurityScan adware"
XALGUALGU.EXE"Added by the CWS-I TROJAN!"
XALGU.exeALGU.exe"Added by the STARTPAGE.O TROJAN!"
Xapyginapyginsimenu.exe"Added by the SDBOT.BTR WORM!"
XaslAslru.exe"Added by the BANCOS-CU TROJAN!"
NASUS Live UpdateALU.exeASUS Live Update utility for their motherboards
XAttuneContentUpdaterattune_cu.exe"Aveo Attune automated helpdesk software - adware/spyware"
UauDealioAu.exe"Dealio Toolbar is a free shopping comparison toolbar that allows users to search for a wide range of consumer products"
Xau.exeau.exe"Added by the BEAGLE.B WORM!"
NAudioHQUAHQTBU.EXESystem Tray application installed with the drivers for Creative Labs SoundBlaster Live! Can be run from Start -> Programs
?AvMenuAVMenu.exe"Part of the ArcaVir antivirus suite from Polish company Arcabit. What does this part do and is it required?"
Xbrowsers_menu.exe"Added by the TACTSLAY.C TROJAN!"
UCare2GTUCare2GTU.exe"Care2 Green Thumbs-Up (from the Care2 site). Every online purchase helps environmental causes; tells you how eco-friendly a company really is
YCliente DLODLOClientu.exe"Part of the backup suites from VERITAS - Backup Exec and NetBackup. Both have now been replaced by their Symantec equivalents since they acquired VERITAS in 2005"
UCobBUCobBU.exe"Cobian Backup versions 6 and 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
UCobian BackupCobBU.exe"Cobian Backup 6 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
UCobian Backup 6CobBU.exe"Cobian Backup 6 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
UCobian Backup 7CobBU.exe"Cobian Backup 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
UCobian Backup 7 ApplicationCobBU.exe"Cobian Backup 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
Xcpls_menu.exe"Added by the TACTSLAY.C TROJAN!"
UCreative MediaSource GoCTCMSGoU.exe"Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
UCrossMenuCrossMenu.exeToshiba CrossMenu Utility - allows the user to create their own menus
XCSRSSUCSRSSU.exe"CoolWebSearch parasite variant - hijacking to Slawsearch.com. Also detected as the CWS-E TROJAN!"
NCTSyncU.exeCTSyncU.exe"Creative Sync Manager - synchronizes music tracks on your computer with your player"
NDDCActiveMenuDDCActiveMenu.exeDigital Distribution Channel - formally part of the WildTangent on-line games delivery service. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
YDLO AgentDLOClientu.exe"Part of the backup suites from VERITAS - Backup Exec and NetBackup. Both have now been replaced by their Symantec equivalents since they acquired VERITAS in 2005"
UEasySync ProXCPCMenu.exe"""IBM® Lotus® EasySync® Pro is a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
UEnterprise HarmonyrsMenu.exe"Enterprise Harmony 99 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000"
UEnterprise Harmony '99rsMenu.exe"Enterprise Harmony 99 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000"
XEsphortu.exe"PurityScan adware"
UFjMenuFjMenu.exe"From the ""Fujitsu Menu"" tray icon you have instant access to the Control Panel
XFolder Servicewssdtu.exe"Added by the MANIFEST TROJAN!"
UFTMSFLT(USB)FTMSFLTU.EXEFujitsu's Touch Panel Message Notifier
UGoBackGBMenu.exe"Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
UH2OWIBUCXWibu.exe"Related to CodeMeter from WIBU-SYSTEMS AG. Software protection hardware"
XHidup_SusahPembantu.exe"Added by the SILLYFDC.BDM WORM!"
XHot_Tarts_AuHot_Tarts_Au.exePremium rate adult content dialler
UHPGamesActiveMenuActiveMenu.exeWild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
UHPLaptopGamesActiveMenuActiveMenu.exeWild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
Xhttpds_menu.exe"Added by the TACTSLAY.C TROJAN!"
XInformation Updateiu.exe"Detected by Kaspersky as the CENTIM.CH TROJAN!"
XIntelprcAas3lovu.exe"Added by the SILLYFDC-CG WORM!"
Xjutsujutsu.exe"Added by the RBOT-LS WORM!"
NK6CPU.EXEK6CPU.EXEAuthenticates CPU as K6 in system properties
ULexmark X125 Settings UtilityLEX125SU.exeSettings utility for the Lexmark X125 printer
NLIULIU.exe"Logitech Internet Update. Used to update drivers/software for Logitech's Wingman
XlmuLMU.exe"Detected by Kaspersky as the AGENT.BG TROJAN!"
YMamutumamutu.exe"Background Guard feature of Mamutu from Emsi Software GmbH - which provides behaviour rather than signature based protection that ""recognizes new and unknown Trojans
YMamutu Guardmamutu.exe"Background Guard feature of Mamutu from Emsi Software GmbH - which provides behaviour rather than signature based protection that ""recognizes new and unknown Trojans
Xmbssm32monstu.exe"Detected by AVG as the AGENT.CNM TROJAN - see here"
UMedia Manager IndexerAIRSVCU.EXE"Part of MS Visual InterDev
XMessangers_menu.exe"Added by the TACTSLAY.C TROJAN!"
XMicrosoft Automatic Update Serivcemsautou.exe"Added by the RBOT-AOB WORM!"
XMicrosoft CPU Over Heat ManagerCPU.exe"Added by a variant of the IRCBOT TROJAN!"
XMicrosoft Internet Acceleration Utilityiau.exe"EasySearch adware"
XMicrosoft msnserumsnseru.exe"Added by the RBOT-APB WORM!"
XMicrosoft Update Machinewindowsu.exe"Added by a variant of the RBOT WORM!"
?mnuigomnu.exe"Wanadoo broadband ISP (now rebranded as Orange) related. What does it do and is it required?"
XMs configsumsconfigsu.exe"Added by a variant of the SDBOT WORM!"
XMSN Messenger 32msniu.exe"Added by the RBOT-AWB WORM!"
Nmsnappaumsnappau.exe"Updater for the MSN toolbar that can be downloaded onto IE. Calls home every day or so to ""update"" the toolbar"
Xmssarumssaru.exe"Added by the AGENT.AM TROJAN! Note - example names include ""XviD""
?MtdAcquMtdAcqu.exe"Metadata monitor part of Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly."" Collects information on the songs. Is it required?"
Xniuniu.exe"Added by the SILLYFDC.BCS WORM!"
Xnnqcouunnqcouu.exe"The Abi Network adware"
NNorton Crashguard Monitorcgmenu.exeTroublesome program that doesn't actually work with WinME so Norton removed it from SystemWorks 2001
?NovaPortal Single User ServiceNPSU.exe"??"
XNVIDIA DriverMSPMSPSU.EXE"Added by the WOOTBOT.Y WORM!"
XOffice Monitor Word Exel Ru.exe"Added by the SDBOT-DEE WORM!"
UPLEAPCPUCPLpleapu.exe"CPU Control Panel for the Powerleap CPU upgrade"
XPointmaruPointmaru.exe"Added by the AGENT.BLDK TROJAN!"
NProfilerProfilerU.exe"Enables the ""Profiler"" to be launched from a System Tray icon for Saitek's game controllers. Available via Start -> Programs"
NProfilerUProfilerU.exe"Saitek SST (Saitek Smart Technolgy) Profile Launcher - allows System Tray access to the ""Profiler"" and ""Control Panel"" for Saitek's game controllers. Start manually via Start -> Programs -> Saitek SD6 Programming Software -> Profiler"
Xq36i36Olms2cenu.exeAdded by the SECONDTHOUGHT VIRUS!
XQuicktlmeru.exeAdult content dialler
XQuickZiplu.exeMsConnect browser hijacker and dialler
URandsoft Harmony '98rsMenu.exe"Randsoft Harmony '98 (superseded by Enterprise Harmony 99) for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000"
UrsMenursMenu.exe"Enterprise Harmony 99 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000. Formally Randsoft Harmony '98"
Nrun=cmmpu.exeMIDI emulator driver for the integrated sound chip by C-Media based on the CMI-8330 chip set normally found in cheap motherboards. Also installed as part of the software for a Guillemot Maxi Muse sound card (PCI)
Xrunner1retadpu.exe"Added by the AGENT.SLZ TROJAN!"
Xrunner1mrofinu.exe"Added by the AGENT.CZC TROJAN!"
XSakemsneqlsimenu.exe"Added by the SDBOT.BTO WORM!"
Xsausau.exe"180Search adware"
XSearchSpySearchSpyMenu.exe"SearchSpy rogue spyware remover - not recommended"
XServ-Uwssdsu.exe"Added by the MANIFEST TROJAN!"
XSfKg6wrayiou.exe"Added by the AGENT.BUO WORM!"
XSMSSUSMSSU.EXE"Added by the STARTPAGE.O TROJAN!"
XSPOOLSVUSPOOLSVU.EXE"Added by the STARTPAGE.K hijacker"
XSSLSearchNDestrou.exe"Added by the SDBOT-WG WORM!"
XStartMenus_menu.exe"Added by the TACTSLAY.C TROJAN!"
?SXGDSENUsxgdsenu.exe"Yamaha SXG soundcard driver"
YSymantec Backup Exec Desktop AgentDLOClientu.exe"Part of Symantec's Backup Exec backup software"
YSymantec NetBackup Desktop AgentDLOClientu.exe"Part of Symantec's NetBackup backup software"
XSystemSPOOLSU.EXE"Added by the BANKER-FC TROJAN!"
XSystem32RootGadu-Gadu.exe"Added by a variant of the IRCBOT TROJAN! Note - doe not confuse with the Polish language Instant Messaging client also called Gadu-Gadu"
XSystem33FB_PNU.EXE"Added by the NICHELLO-A WORM!"
XSystemUpdateXeyu.exe"Added by the CULLER-D WORM!"
Xsysusysu.exe"Dynamic Desktop Media adware - see here"
XTASKMGRUTASKMGRU.EXE"Added by the CWS-M TROJAN!"
XTerminate PopupZPU.exe"Free Popup Killer - foistware proven to install the Regsvc32 homepage hijacker. Also see here"
Xtesti love you.exe"Added by the SINGU-T TROJAN!"
UTI WLANTIWLANCu.exe"Texas Instruments TI wireless LAN products"
UTOSHIBSUToshibsu.exe"Reduces the power consumption when the laptop isn't being used to preserve battery power. Hibernate function doesn't work if this is disabled. Similar programs on other laptops reduce the processor clock rate
Xudzokudzou.exe"Added by the SDBOT-CUS WORM!"
?UIUCUUIUCU.EXE"Universal Device Install Application from Conexant Systems
?uniucuuniucu.exe"??"
XUserInit StartUprpcxuisu.exe"Added by a variant of the SDBOT WORM!"
Xushlisscbltqu.exeObtained from an MP3 search list site. Also generates random processes on reboot
XVIEW POINT DRIVERS FOR WIN32phqghu.exe"Added by a variant of the RBOT WORM!"
UVista Start menuVistaStartMenu.exe"""Vista Start Menu is the convenient alternative to the plain Start menu you find in Windows XP and Windows Vista"". You have the option to either replace standard Start Menu or run it independently and can load at boot time or run it manually"
UVistaStartMenuVistaStartMenu.exe"""Vista Start Menu is the convenient alternative to the plain Start menu you find in Windows XP and Windows Vista"". You have the option to either replace standard Start Menu or run it independently and can load at boot time or run it manually"
YWG511WLUWG511WLU.exeNetgear configuration programme for the 54g wireless lan card - required to monitor and manage the lan card
XWin32 NVIDIA DriverMSPMSPSU.EXE"Added by a variant of the WOOTBOT.Y WORM!"
Xwinallapuwinallapu.exe"Added by the DELF.E TROJAN!"
XWindows Firewalllwinmu.exe"Added by a variant of the RBOT WORM!"
XWindows Service Agentcxfrru.exe"Added by the SDBOT.GAV WORM!"
XWindows Service Agentndibbeu.exe"Added by the RBOT.XVD BACKDOOR!"
XWindows Virus Controlplou.exe"Added by the SDBOT-ACZ WORM!"
UWinDSL MTU-AdjustWinDSL_MTU.exeAdjusts the registry setting of the DUN-Adapters (MTU) and the TCP/IP-Protocol (RWIN) by ENGEL Technologieberatung
?WinDSL_MTUWinDSL_MTU.exe"May be realted to Tiscali broadband
?Winnov MenuWnvMenu.Exe"Winnov Video Capture Card related. What does it do and is it required?"
XWinReg32 serviceholqdnoxpmeu.exe"Added by a variant of the SDBOT WORM!"
XWins Loader5Gadu-Gadu.exe"Added by a variant of the IRCBOT TROJAN! Note - doe not confuse with the Polish language Instant Messaging client also called Gadu-Gadu"
NWinTOTAL Schedulerguru.exeWinTOTAL Real estate appraisal software related
NXanaduXanadu.exe"Xanadu - free language and translation wizard from Foreignword"
UXTNDConnect PCXCPCMenu.exe"XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
Xyaemu.exeyaemu.exeAdded by the WIN32.DNSCHANGER.S TROJAN!
Xyxuu.exe"Added by the AGOBOT-YX WORM!"
Xzanuzanu.exe"ZangoSearch adware"
X[random filename]slk8x2peu.exe"QuickLinks adware"
X[random name]wincpu.exe"Added by an unidentified VIRUS
X[various names]zantu.exe"Wareout - malware masquerading as a spyware and dialer remover"
X{2C70168B-97CE-4f31-B85D-1FEC5002721D}sysavxjgdu.exe"Added by the FAKEALERT-AM TROJAN!"
X{78B578D7-BCE1-4d83-9CD4-195BC34D8CB3}sxjecknqhu.exe"Added by the FAKEALERT-AM TROJAN!"
X{A4C928E8-0ABA-4fd3-83DF-23BE54ADF9A4}sysqrnxstju.exe"Added by the FAKEALERT-AM TROJAN!"


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.