web

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	1WinCfg32	WebMailSpy.exe	"WebMailSpy spyware"
U	AbyssWebServer	abyssws.exe	"Abyss web server"
X	Access WebControl	[path to file]	"Added by the PPDOOR-M TROJAN!"
N	ActivSurf	backweb*****.exe	Packard Bell ActivSurf - automatically detects an internet connection and downloads any available updates
X	All Sea web link	FWLink.exe	"Free screensaver
N	ASUSWebStorage	ASUSWSDashBoard.exe	"System Tray access to ASUS Webstorage online backup and sharing utility which is pre-installed on some ASUS systems or available for free (with 1GB available) for others. Disable unless you want to automatically backup and sync your files every time your system starts"
Y	avast! Web Scanner	Ashwebsv.exe	"Web scanning part of avast! Antivirus. Starts via a registry ""Run"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
N	BackWeb	backweb.exe	Automatically detects an internet connection and downloads any available updates. Typical on Compaq and HP PC's but not restricted to those OEM's. Resource hog and often causes malfunctions. Available via Start -> Programs
N	backWeb-8876480	backweb-8876480.exe	"Installed with older versions of the software for Logitech products. Automatically checks for software upgrades and new products
N	BrowserWebCheck	loadwc.exe	Checks to make sure that IE is still your default browser
N	CahootWebcard	CahootWebcard.exe	"""The Cahoot Webcard is a virtual card that allows you to use your Cahoot credit card online without ever having to expose your real card numbers over the web. It works by generating one-off transaction numbers as a substitute for your real cahoot credit card details"". Run manually when needed"
U	ChicoSys	webtmr.exe	"Child Control parental control software"
N	Compaq Connections	BackWeb-1940576.exe	"See here - ""messaging service that automatically sends you support information
X	ComTry Web Searcher	wstray.exe	Comtry MP3 Downloader related - spyware
X	coolwebprogram	clrssn.exe	"CoolWebSearch Smartsearch parasite variant"
N	Creative WebCam Tray	Camtray.exe	Creative WebCam tray control - can be started manually
X	Default web browser	IexpIore.exe	"Added by the OBLIVION.B TROJAN! Note - do not confuse "IexpIore.exe" with "iexplore.exe" (Internet Explorer)
Y	Dell Webcam Central	WebcamDell.exe	"Dell Webcam Central - webcam management software controlling aspects such as picture control
N	DELL Webcam Manager	DellWMgr.exe	Dell Webcam Manager - Webcam management software provided on Dell PCs
X	Drivers for Internet Explorer	accesweb.exe	"Added by the STARTPAGE.FW TROJAN!"
X	DrWeb Antivirus	DRWEBAV.EXE	Added by an unidentified WORM or TROJAN!
Y	Drwebscheduler	Drwebscd.exe	"DrWeb antivirus related - scheduler that allows you to manage an automatic launch of applications
X	fmnwebassist	fmnwebassist.exe	Adware popup generator
X	fnmwebassist	fnmwebassist.exe	"WinPL adware"
N	FriendlyWebQuick-Launch	SELFCERT.EXE	selfcert.exe is a stand alone program for creating your own digital certificates for macros - the .exe is installed as an extra basically by clicking on MS Office in add/remove programs and selecting remove - also I would do away with the FriendlyWebQuickLaunchBar as well
U	FRITZ!webProtect	FwebProt.exe	Firewall included in FRITZ! ISP DSL software
U	FSWebServer	fsws.exe	"Easy File Sharing Web Server is a Windows program that allows you to host a secure peer-to-peer and web-based file sharing system without any additional software or services"
X	hp center	BACKWEB-*****.exe	"See here - ""messaging service that automatically sends you support information
X	IcqBeta	webcamupdate.exe	Added by an unidentified TROJAN!
N	Kodak Software Updater	backweb*****.exe	"Software updater for Kodak Easyshare digital cameras"
N	LDM	backweb-8876480.exe	"Installed with older versions of the software for Logitech products. Automatically checks for software upgrades and new products
X	livekey	webgrade.exe	"LiveKeys adware. File located in %Program Files%\livekey\livekeys"
X	livekeys	webgrade.exe	"LiveKeys adware. File located in %Program Files%\livekey\livekeys"
X	LOCAL INTERNET WEB DRIVERS FOR WIN32	phqghume.exe	"Added by a variant of the RBOT WORM!"
Y	McAfeeWebscanX	WebScanX.exe	"From McAfee VirusScan up to version 4.x. Provides functionality for VShield Download Scan and Internet Filter modules. Enables internet scanning. Guards against malicious ActiveX programs
X	Microsoft CP Web Manager	webcp.exe	"Added by the IRCBOT.HP TROJAN!"
X	Microsoft Security Monitor Process	web.exe	"Added by the EGGDROP.V BACKDOOR!"
X	Microsoft Update	webm.exe	"Added by the SDBOT.WK WORM!"
X	Microsoft Updating Client	websvc.exe	"Added by the RBOT.AQ WORM!"
X	Microsoft Web CP Manager	webcp32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Web Device	wdevice.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft web update	webmsn.exe	"Added by the RBOT-EMQ WORM!"
U	Microsoft Webserver	svctrl.exe	Personal web server program which enables you to create and host a web server from your computer. Not required for most people
X	Microsoft Windows Express	websploit.exe	"Added by a variant of the SPYBOT WORM! See here"
U	Mobipocket Web Companion	webcomp.exe	"Related to Mobipocket eBook Reader"
X	MS-Connect	web.exe	"Adult content dialler - see here"
N	MSN Webcam Recorder	ml20gui.exe	"""MSN Webcam Recorder is a tool that allows you to record video streamed to and from your computer by MSN Messenger's Webcam Feature"""
X	Msys32	morfitwebentrance.exe	"Morfit ADjectPager - ""uses home page rental technology for generating revenues"". Homepage hi-jacker that re-defines your IE or Netscape start page as http://www.web-entrance.com/. Any installed application including this must be un-installed before you can reset your homepage"
X	My Web Search Bar	MWSBAR.DLL	"MyWay - an IE Browser Helper Object used by adware WebSearch to add an IE toolbar to provide search features
X	My Web Search Bar Search Scope Monitor	m3SrchMn.exe	"MyWebSearch parasite"
X	My Web Search Community Tools	m3IMPipe.exe	"MyWebSearch parasite"
X	MyWebSearch Email Plugin	mwsoemon.exe	"MyWebSearch parasite"
X	MyWebSearch Plugin	"rundll32 [path] M3PLUGIN.DLL	UPF"
X	Optional Web Drivers For WIN32	phqghume.exe	"Added by a variant of the RBOT WORM!"
U	Oracle Web-to-Go	webtogo.exe	"""
U	OWCWebCamDV	wcdvtray.exe	"WebCamDV from Orange Micro
U	pjWebCam	pjWebCam.exe	Webcam automation software that saves regular photos from webcam and can also act as HTTP server
N	PPWWebCap	PPWebCap.exe	"PaperPort" software associated with scanners
X	Printer Monitor	webprinter.exe	"Added by the IRCBOT-Z TROJAN!"
U	Run Google Web Accelerator	GoogleWebAccWarden.exe	"Google Web Accelerator"
X	Run Services as Application	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Setting	sysweb.exe	"Added by the SDBOT.GEN TROJAN!"
N	Share-to-Web Namespace Daemon	hpgs2wnd.exe	"Share-to-Web - HP-created software and Internet-based application that enables easy uploading and sharing of photos via affiliated photo-sharing Web sites. Available via Start → Programs"
X	Spooler SubSystem Application	websvc.exe	"Added by the DLOADER-NY TROJAN!"
N	STBWEBTV	STBWEBTV.EXE	Used to display TV on your PC
X	System Update2	webcheck.exe	"Added by the AUTOTROJ-C TROJAN!"
U	SystemWeb	rundll32.exe [path] SystemWeb.dll rdl	"StealthWeblog surveillance software. Uninstall this software unless you put it there yourself! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	Tcp Application Manager	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	The Web Sentinel	The Web Sentinel.exe	"The Web Sentinel rogue security software - not recommended
N	Updates from HP	backweb*****.exe	"See here - ""messaging service that automatically sends you support information
X	updwebmin	updwebmin.exe	"Added by the BACKDOOR.GEN TROJAN!"
X	UPSUtl	web.exe	"CoolWebSearch parasite variant"
U	VDrive2	WebLifeDisk.exe	"EarthLink WebLife Disk - ""Consumers can quickly save files from their desktop into WebLife Disk
X	web	*****.exe [ = random char]	"Added by a variant of the EASTO.A TROJAN!"
X	WEB DRIVERS FOR WIN32	phqgh.exe	"Added by a variant of the RBOT WORM!"
X	Web Offer	ezPopStub.exe	"eZula TopText adware"
X	Web Offer	ezStub.exe	"eZula TopText adware"
X	Web Offer	EZSTUB22.EXE	"eZula TopText adware"
X	Web Offer	vl_ezstub.exe	"eZula TopText adware"
?	Web Search	??	"??"
X	Web Service	[random filename].exe	"Added by the ADMINCASH TROJAN!"
X	Web Service	sm.exe	"Added by the BUBE-F VIRUS!"
X	Web Service	MSXMIDI.EXE	"CoolWebSearch parasite variant
X	Web-cameinst	[path to trojan]	"Added by the RANCK-BP TROJAN!"
U	Web2Pop	Web2Pop.exe	"Web2Pop allows you to retrieve your web-based accounts messages to read them in your favorite e-mail client"
Y	web3trap	web3trap.exe	"PC-Cillin 2000 anti-virus software → ActiveX filter. Guards against malicious ActiveX programs
X	webalize	webalize.exe	"Searchcentrix hijacker"
N	WebArmyKnife	WAK.exe	"Web Army Knife - a suite of web site developer's tools"
X	webassist	webassist.exe	Adware popup generator
X	WebBuying	webbuying.exe	"WebBuying adware"
N	WebCallDirect	WebCallDirect.exe	"WebCallDirect - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X	webcam	webcam.exe	"Added by the MONAD-A TROJAN! Note - this malware actually changes the default value data of the Registry Run and RunServices keys in order to force Windows to launch it at boot. Name field may be empty"
?	Webcam Go Sti Service Application	wbcgosvc.exe	"Control software for the portable Creative Webcam Go digital camera/PC web cam. What does it do and is it required?"
N	WebcamRT.exe	WEBCAMRT.exe	For Logitech Web Cams. Not required - camera works fine without it
X	Webcelerator	webcel.exe	"Webcelerator from eAcceleration speeds your Web browsing by both remembering where you have been and anticipating where you will go. Only needed if you find it improves web browsing. Now no longer available and supported and when available was classed as spyware - see here"
X	WebCheck	WebCheck.pif	"Added by the CONE.C or CONE.F WORMS!"
X	WebCpr0	WebCpr0.exe	"WebRebates adware"
X	Webdav.exe	webdav.exe	IRC DDoS bot which gives the hacker full control over your system
N	WebDrive	webdrive.exe	"System Tray access to WebDrive from South River Technologies
N	WebDriveTray	webdrive.exe	"System Tray access to WebDrive from South River Technologies
U	WebExRemoteAccessAgent	raagtapp.exe	"Related to Web Meetings from WebEx Communications
X	WebHancer Agent	whagent.exe	"System Tray application that starts up Webhancer software. Software that optimizes your web browser and is also advertising spyware that you can find out about here"
X	webHancer Survey Companion	whSurvey.exe	"WebHancertrackware - traffic measurement service that uses a client agent that is stealth installed on user machines
X	WebInstall	WebInstall.exe	ClipGenie adware downloader
X	WebInstall2	WebInstall.exe	ClipGenie adware downloader
N	WebKey	WebKey.exe	"WebKey from JB Utilities. Utility to keep track of login data required when browsing the internet"
N	WebLink	WebLink.exe	"Softex is a ""cost-effective way to provide software updates
X	weboqacuc	firitirol.exe	"Added by the SDBOT-UC WORM!"
N	WebOutfitterTray	sttray.exe	Intel WebOutfitter service System Tray icon
N	Webposition Gold 2	wpsche~1.exe	"Scheduler for Web Position Gold - utility to help optimize the position of web-sites in search engines"
X	WebRebates0	WebRebates0.exe	"WebRebates adware"
Y	Webroot Desktop Firewall	WDF.exe	"Webroot Desktop Firewall"
X	WebRun	[random filename]	"Added by the ADWARELOADER TROJAN!"
U	websaverlive	websaverlive.exe	"WebSaver Live! is a companion program to Websaver that retrieves information from the Internet on a schedule and displays it on your screen when your computer is idle"
X	WebSavingsfromEbates	WebSavingsfromEbatesrun.exe	"Web Savings From Ebates Software
X	WebSavingsFromEbates0	WebSavingsFromEbates0.exe	"Web Savings From Ebates Software
U	WebScan	DEFSCANGUI.EXE	"eAcceleration Stop-Sign security software related. Previously not recommended
U	webscan	stopsignav.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
Y	WebScanX	WebScanX.exe	"From McAfee VirusScan up to version 4.x. Provides functionality for VShield Download Scan and Internet Filter modules. Enables internet scanning. Guards against malicious ActiveX programs
X	websearch	wjview ...websearch.exe	"""Web Savings"" From Ebates Software
N	WebSecureAlert	WebSecureAlert.exe	"WebSecureAlert - ""helps to protect your browser security by monitoring for unauthorized tampering with Internet Explorer's security settings
?	WebServer	VBI_SE~1.EXE	"Related to a Pinnacle sound card. What does it do and is it needed?"
U	Webshots	Webshots Tray.exe	"Webshots - software that displays photos as your screensaver and wallpaper
U	Webshots	websho~1.exe	"Webshots - software that displays photos as your screensaver and wallpaper
U	Webshots	Launcher.exe	"Webshots - software that displays photos as your screensaver and wallpaper
U	Webshots	WebshotsTray.exe	"Webshots - software that displays photos as your screensaver and wallpaper
X	Website Administrator Info	webadmin.exe	"Added by the FORBOT-FY WORM!"
X	WebSpecials	rundll32 [path] webspec.dll	"WebSpecials spyware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	WebSpyShield	WebSpyShield.exe	"WebSpyShield rogue security software - not recommended"
X	WebSUpdater	wupda.exe	"Added by the STARTPAGE.C TROJAN!"
X	Websx	Int*****.exe	Adult content dialler - where ***** are random
Y	WebTrap.exe	WebTrap.exe	"Part of Trend Micro web-security products - PC-cillin 2000 and Virus Buster 2001. Checks web-sites for malicious Java and ActiveX elements in a similar way to McAfee WebScanX. A few users find it infuriating"
Y	WebTrapNT.exe	WebTrapNT.exe	Part of PC-Cillin anti-virus software. Checks web-sites for malicious Java and ActiveX elements in a similar way to McAfee WebScanX. A few users find it infuriating
U	WebWasher	wwasher.exe	"Free Pop-up/ad/javascript filter program from Siemens. If not running then browsers will not be protected but will still work. Available via Start -> Programs"
X	WeirdOnTheWeb	WeirdOnTheWeb.exe	"WeirdOnTheWeb adware"
X	Widnows Xp Web scan	xpscan.exe	"Added by a variant of the SDBOT WORM!"
U	WildTangent Web Driver updater	wcmdmgrl.exe	"Web Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case"
X	Win32Host Process	webemir.exe	"Added by the TURGEN -A TROJAN!"
X	Windows .Net Manager	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	WinwebSecurity	WinwebSecurity.exe	"Winweb Security rogue security software - not recommended
N	WordWeb	wweb32.exe	"WordWeb - free theasaurus and dictionary. Start manually"
N	WordWeb Pro	wweb32.exe	"WordWeb Pro - theasaurus and dictionary. Start manually"
X	wuweb	wuweb.exe	"Added by the WUWO TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.