u.exe

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	1029BB4B-16A9-4E77-AA3D-96930BD68EEC	sysockeu.exe	"Added by the FAKEALERT-AH TROJAN!"
U	ABIT uGuru	uGuru.exe	"ABIT µGuru - on motherboards incorporating the µGuru processor this provides quick access to ""hardware monitoring
N	Active CPU	acpu.exe	"Active CPU - ""easy to use tool for Windows 95/98/ME/NT/2000 that enables you to watch a graphical representation of your CPU's activity"""
U	ActiveMenu	ActiveMenu.exe	Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
U	ACU	ACU.exe	"Atheros wireless Client Utility"
U	ACU_QSB	ACU.exe	"Atheros wireless Client Utility"
?	ADU	adu.exe	"Related to Cisco Aironet wireless products. What does it do and is it required?"
X	Aida	eetu.exe	"PurityScan adware"
X	ALGU	ALGU.EXE	"Added by the CWS-I TROJAN!"
X	ALGU.exe	ALGU.exe	"Added by the STARTPAGE.O TROJAN!"
X	apyginapygin	simenu.exe	"Added by the SDBOT.BTR WORM!"
X	asl	Aslru.exe	"Added by the BANCOS-CU TROJAN!"
N	ASUS Live Update	ALU.exe	ASUS Live Update utility for their motherboards
X	AttuneContentUpdater	attune_cu.exe	"Aveo Attune automated helpdesk software - adware/spyware"
U	au	DealioAu.exe	"Dealio Toolbar is a free shopping comparison toolbar that allows users to search for a wide range of consumer products"
X	au.exe	au.exe	"Added by the BEAGLE.B WORM!"
N	AudioHQU	AHQTBU.EXE	System Tray application installed with the drivers for Creative Labs SoundBlaster Live! Can be run from Start -> Programs
?	AvMenu	AVMenu.exe	"Part of the ArcaVir antivirus suite from Polish company Arcabit. What does this part do and is it required?"
X	browser	s_menu.exe	"Added by the TACTSLAY.C TROJAN!"
U	Care2GTU	Care2GTU.exe	"Care2 Green Thumbs-Up (from the Care2 site). Every online purchase helps environmental causes; tells you how eco-friendly a company really is
Y	Cliente DLO	DLOClientu.exe	"Part of the backup suites from VERITAS - Backup Exec and NetBackup. Both have now been replaced by their Symantec equivalents since they acquired VERITAS in 2005"
U	CobBU	CobBU.exe	"Cobian Backup versions 6 and 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup	CobBU.exe	"Cobian Backup 6 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 6	CobBU.exe	"Cobian Backup 6 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 7	CobBU.exe	"Cobian Backup 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 7 Application	CobBU.exe	"Cobian Backup 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
X	cpl	s_menu.exe	"Added by the TACTSLAY.C TROJAN!"
U	Creative MediaSource Go	CTCMSGoU.exe	"Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
U	CrossMenu	CrossMenu.exe	Toshiba CrossMenu Utility - allows the user to create their own menus
X	CSRSSU	CSRSSU.exe	"CoolWebSearch parasite variant - hijacking to Slawsearch.com. Also detected as the CWS-E TROJAN!"
N	CTSyncU.exe	CTSyncU.exe	"Creative Sync Manager - synchronizes music tracks on your computer with your player"
N	DDCActiveMenu	DDCActiveMenu.exe	Digital Distribution Channel - formally part of the WildTangent on-line games delivery service. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
Y	DLO Agent	DLOClientu.exe	"Part of the backup suites from VERITAS - Backup Exec and NetBackup. Both have now been replaced by their Symantec equivalents since they acquired VERITAS in 2005"
U	EasySync Pro	XCPCMenu.exe	"""IBM® Lotus® EasySync® Pro is a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	Enterprise Harmony	rsMenu.exe	"Enterprise Harmony 99 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000"
U	Enterprise Harmony '99	rsMenu.exe	"Enterprise Harmony 99 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000"
X	Esph	ortu.exe	"PurityScan adware"
U	FjMenu	FjMenu.exe	"From the ""Fujitsu Menu"" tray icon you have instant access to the Control Panel
X	Folder Service	wssdtu.exe	"Added by the MANIFEST TROJAN!"
U	FTMSFLT(USB)	FTMSFLTU.EXE	Fujitsu's Touch Panel Message Notifier
U	GoBack	GBMenu.exe	"Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
U	H2OWIBU	CXWibu.exe	"Related to CodeMeter from WIBU-SYSTEMS AG. Software protection hardware"
X	Hidup_Susah	Pembantu.exe	"Added by the SILLYFDC.BDM WORM!"
X	Hot_Tarts_Au	Hot_Tarts_Au.exe	Premium rate adult content dialler
U	HPGamesActiveMenu	ActiveMenu.exe	Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
U	HPLaptopGamesActiveMenu	ActiveMenu.exe	Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
X	httpd	s_menu.exe	"Added by the TACTSLAY.C TROJAN!"
X	Information Update	iu.exe	"Detected by Kaspersky as the CENTIM.CH TROJAN!"
X	Intelprc	Aas3lovu.exe	"Added by the SILLYFDC-CG WORM!"
X	jutsu	jutsu.exe	"Added by the RBOT-LS WORM!"
N	K6CPU.EXE	K6CPU.EXE	Authenticates CPU as K6 in system properties
U	Lexmark X125 Settings Utility	LEX125SU.exe	Settings utility for the Lexmark X125 printer
N	LIU	LIU.exe	"Logitech Internet Update. Used to update drivers/software for Logitech's Wingman
X	lmu	LMU.exe	"Detected by Kaspersky as the AGENT.BG TROJAN!"
Y	Mamutu	mamutu.exe	"Background Guard feature of Mamutu from Emsi Software GmbH - which provides behaviour rather than signature based protection that ""recognizes new and unknown Trojans
Y	Mamutu Guard	mamutu.exe	"Background Guard feature of Mamutu from Emsi Software GmbH - which provides behaviour rather than signature based protection that ""recognizes new and unknown Trojans
X	mbssm32	monstu.exe	"Detected by AVG as the AGENT.CNM TROJAN - see here"
U	Media Manager Indexer	AIRSVCU.EXE	"Part of MS Visual InterDev
X	Messanger	s_menu.exe	"Added by the TACTSLAY.C TROJAN!"
X	Microsoft Automatic Update Serivce	msautou.exe	"Added by the RBOT-AOB WORM!"
X	Microsoft CPU Over Heat Manager	CPU.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Internet Acceleration Utility	iau.exe	"EasySearch adware"
X	Microsoft msnseru	msnseru.exe	"Added by the RBOT-APB WORM!"
X	Microsoft Update Machine	windowsu.exe	"Added by a variant of the RBOT WORM!"
?	mnu	igomnu.exe	"Wanadoo broadband ISP (now rebranded as Orange) related. What does it do and is it required?"
X	Ms configsu	msconfigsu.exe	"Added by a variant of the SDBOT WORM!"
X	MSN Messenger 32	msniu.exe	"Added by the RBOT-AWB WORM!"
N	msnappau	msnappau.exe	"Updater for the MSN toolbar that can be downloaded onto IE. Calls home every day or so to ""update"" the toolbar"
X	mssaru	mssaru.exe	"Added by the AGENT.AM TROJAN! Note - example names include ""XviD""
?	MtdAcqu	MtdAcqu.exe	"Metadata monitor part of Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly."" Collects information on the songs. Is it required?"
X	niu	niu.exe	"Added by the SILLYFDC.BCS WORM!"
X	nnqcouu	nnqcouu.exe	"The Abi Network adware"
N	Norton Crashguard Monitor	cgmenu.exe	Troublesome program that doesn't actually work with WinME so Norton removed it from SystemWorks 2001
?	NovaPortal Single User Service	NPSU.exe	"??"
X	NVIDIA Driver	MSPMSPSU.EXE	"Added by the WOOTBOT.Y WORM!"
X	Office Monitor Word Exel R	u.exe	"Added by the SDBOT-DEE WORM!"
U	PLEAPCPUCPL	pleapu.exe	"CPU Control Panel for the Powerleap CPU upgrade"
X	Pointmaru	Pointmaru.exe	"Added by the AGENT.BLDK TROJAN!"
N	Profiler	ProfilerU.exe	"Enables the ""Profiler"" to be launched from a System Tray icon for Saitek's game controllers. Available via Start -> Programs"
N	ProfilerU	ProfilerU.exe	"Saitek SST (Saitek Smart Technolgy) Profile Launcher - allows System Tray access to the ""Profiler"" and ""Control Panel"" for Saitek's game controllers. Start manually via Start -> Programs -> Saitek SD6 Programming Software -> Profiler"
X	q36i36O	lms2cenu.exe	Added by the SECONDTHOUGHT VIRUS!
X	Quicktlme	ru.exe	Adult content dialler
X	QuickZip	lu.exe	MsConnect browser hijacker and dialler
U	Randsoft Harmony '98	rsMenu.exe	"Randsoft Harmony '98 (superseded by Enterprise Harmony 99) for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000"
U	rsMenu	rsMenu.exe	"Enterprise Harmony 99 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000. Formally Randsoft Harmony '98"
N	run=	cmmpu.exe	MIDI emulator driver for the integrated sound chip by C-Media based on the CMI-8330 chip set normally found in cheap motherboards. Also installed as part of the software for a Guillemot Maxi Muse sound card (PCI)
X	runner1	retadpu.exe	"Added by the AGENT.SLZ TROJAN!"
X	runner1	mrofinu.exe	"Added by the AGENT.CZC TROJAN!"
X	Sakemsneql	simenu.exe	"Added by the SDBOT.BTO WORM!"
X	sau	sau.exe	"180Search adware"
X	SearchSpy	SearchSpyMenu.exe	"SearchSpy rogue spyware remover - not recommended"
X	Serv-U	wssdsu.exe	"Added by the MANIFEST TROJAN!"
X	SfKg6w	rayiou.exe	"Added by the AGENT.BUO WORM!"
X	SMSSU	SMSSU.EXE	"Added by the STARTPAGE.O TROJAN!"
X	SPOOLSVU	SPOOLSVU.EXE	"Added by the STARTPAGE.K hijacker"
X	SSL	SearchNDestrou.exe	"Added by the SDBOT-WG WORM!"
X	StartMenu	s_menu.exe	"Added by the TACTSLAY.C TROJAN!"
?	SXGDSENU	sxgdsenu.exe	"Yamaha SXG soundcard driver"
Y	Symantec Backup Exec Desktop Agent	DLOClientu.exe	"Part of Symantec's Backup Exec backup software"
Y	Symantec NetBackup Desktop Agent	DLOClientu.exe	"Part of Symantec's NetBackup backup software"
X	System	SPOOLSU.EXE	"Added by the BANKER-FC TROJAN!"
X	System32Root	Gadu-Gadu.exe	"Added by a variant of the IRCBOT TROJAN! Note - doe not confuse with the Polish language Instant Messaging client also called Gadu-Gadu"
X	System33	FB_PNU.EXE	"Added by the NICHELLO-A WORM!"
X	SystemUpdate	Xeyu.exe	"Added by the CULLER-D WORM!"
X	sysu	sysu.exe	"Dynamic Desktop Media adware - see here"
X	TASKMGRU	TASKMGRU.EXE	"Added by the CWS-M TROJAN!"
X	Terminate Popup	ZPU.exe	"Free Popup Killer - foistware proven to install the Regsvc32 homepage hijacker. Also see here"
X	test	i love you.exe	"Added by the SINGU-T TROJAN!"
U	TI WLAN	TIWLANCu.exe	"Texas Instruments TI wireless LAN products"
U	TOSHIBSU	Toshibsu.exe	"Reduces the power consumption when the laptop isn't being used to preserve battery power. Hibernate function doesn't work if this is disabled. Similar programs on other laptops reduce the processor clock rate
X	udzok	udzou.exe	"Added by the SDBOT-CUS WORM!"
?	UIUCU	UIUCU.EXE	"Universal Device Install Application from Conexant Systems
?	uniucu	uniucu.exe	"??"
X	UserInit StartUp	rpcxuisu.exe	"Added by a variant of the SDBOT WORM!"
X	ushli	sscbltqu.exe	Obtained from an MP3 search list site. Also generates random processes on reboot
X	VIEW POINT DRIVERS FOR WIN32	phqghu.exe	"Added by a variant of the RBOT WORM!"
U	Vista Start menu	VistaStartMenu.exe	"""Vista Start Menu is the convenient alternative to the plain Start menu you find in Windows XP and Windows Vista"". You have the option to either replace standard Start Menu or run it independently and can load at boot time or run it manually"
U	VistaStartMenu	VistaStartMenu.exe	"""Vista Start Menu is the convenient alternative to the plain Start menu you find in Windows XP and Windows Vista"". You have the option to either replace standard Start Menu or run it independently and can load at boot time or run it manually"
Y	WG511WLU	WG511WLU.exe	Netgear configuration programme for the 54g wireless lan card - required to monitor and manage the lan card
X	Win32 NVIDIA Driver	MSPMSPSU.EXE	"Added by a variant of the WOOTBOT.Y WORM!"
X	winallapu	winallapu.exe	"Added by the DELF.E TROJAN!"
X	Windows Firewalll	winmu.exe	"Added by a variant of the RBOT WORM!"
X	Windows Service Agent	cxfrru.exe	"Added by the SDBOT.GAV WORM!"
X	Windows Service Agent	ndibbeu.exe	"Added by the RBOT.XVD BACKDOOR!"
X	Windows Virus Control	plou.exe	"Added by the SDBOT-ACZ WORM!"
U	WinDSL MTU-Adjust	WinDSL_MTU.exe	Adjusts the registry setting of the DUN-Adapters (MTU) and the TCP/IP-Protocol (RWIN) by ENGEL Technologieberatung
?	WinDSL_MTU	WinDSL_MTU.exe	"May be realted to Tiscali broadband
?	Winnov Menu	WnvMenu.Exe	"Winnov Video Capture Card related. What does it do and is it required?"
X	WinReg32 service	holqdnoxpmeu.exe	"Added by a variant of the SDBOT WORM!"
X	Wins Loader5	Gadu-Gadu.exe	"Added by a variant of the IRCBOT TROJAN! Note - doe not confuse with the Polish language Instant Messaging client also called Gadu-Gadu"
N	WinTOTAL Scheduler	guru.exe	WinTOTAL Real estate appraisal software related
N	Xanadu	Xanadu.exe	"Xanadu - free language and translation wizard from Foreignword"
U	XTNDConnect PC	XCPCMenu.exe	"XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
X	yaemu.exe	yaemu.exe	Added by the WIN32.DNSCHANGER.S TROJAN!
X	yx	uu.exe	"Added by the AGOBOT-YX WORM!"
X	zanu	zanu.exe	"ZangoSearch adware"
X	[random filename]	slk8x2peu.exe	"QuickLinks adware"
X	[random name]	wincpu.exe	"Added by an unidentified VIRUS
X	[various names]	zantu.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	{2C70168B-97CE-4f31-B85D-1FEC5002721D}	sysavxjgdu.exe	"Added by the FAKEALERT-AM TROJAN!"
X	{78B578D7-BCE1-4d83-9CD4-195BC34D8CB3}	sxjecknqhu.exe	"Added by the FAKEALERT-AM TROJAN!"
X	{A4C928E8-0ABA-4fd3-83DF-23BE54ADF9A4}	sysqrnxstju.exe	"Added by the FAKEALERT-AM TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.