windows update

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	*windows update	wrauclt.exe	"Added by the RBOT-QU WORM!"
X	*windows update	wuanclt.exe	"Added by the RBOT-PG WORM!"
X	*windows update	wuaucrlt.exe	"Added by the SPYBOT.HUR WORM!"
X	*windows update	wuraclt.exe	"Added by the RBOT-PO WORM!"
X	*windows update	wurauclt.exe	"Added by the RBOT-SY WORM!"
X	*windows update	wsctl.exe	"Added by the SPYBOT.PR WORM!"
X	*windows update	wkmst.exe	"Added by the SDBOT.AVD WORM!"
X	*windows update	wscxt.exe	"Added by the RBOT.AOS WORM!"
X	*windows update	waurclt.exe	"Added by a variant of the RBOT WORM!"
X	*windows update	wuaruclt.exe	"Added by the RBOT-TF WORM!"
X	A New Windows Updater	w32NTupdt.exe	"Added by the MYTOB.BM WORM!"
X	Automated Windows Updates	wauclt.exe	"Added by the GAOBOT.AJD WORM!"
X	Automatic Microsoft Windows Updater	suchost.exe	"Added by the RBOT-EQ WORM!"
X	Automatic Windows Updater	Update.exe	"Added by the GAOBOT.AO WORM!"
X	microsft windows updates	mwupdate32.exe	"Added by a variant of the TOXBOT/CODBOT WORM!"
X	Microsoft (R) Windows Update Service	wuauclt.exe	"Added by a variant of the SDBOT WORM! Note - this is not the legitimate wuauclt.exe process
X	Microsoft Java Windows Update	[filename]	"Added by the RBOT-DZ WORM!"
X	Microsoft Windows Update	rundlls.exe	"Added by the HABRACK WORM!"
X	Microsoft Windows Update	msoffice2.exe	"Added by the RBOT-GB WORM!"
X	Microsoft Windows Update	spools.exe	"Added by the SDBOT.TD WORM!"
X	Microsoft Windows Update	svchos.exe	"Added by the SDBOT.AC WORM!"
X	Microsoft Windows Update	svcshost.exe	"Added by the FORBOT-CF WORM!"
X	Microsoft Windows Update	svmhost.exe	"Added by the FORBOT-CH WORM!"
X	Microsoft Windows Update	svshost.exe	"Added by the WOOTBOT.CJ WORM!"
X	Microsoft Windows Update	msnmessenger.exe	"Added by the SDBOT.AJ WORM!"
X	Microsoft Windows Update	msnwun.exe	"Added by the SDBOT-RM WORM!"
X	Microsoft Windows Update	scvvhost.exe	"Added by the FORBOT-DH WORM!"
X	Microsoft Windows Update	swwhost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update	MSNMSGR.EXE	"Added by the SDBOT-WM WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Microsoft Windows Update	svzhost.exe	"Added by the FORBOT-EV WORM!"
X	Microsoft Windows Update	sccvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update	scrhost.exe	"Added by the RBOT-AOW WORM!"
X	Microsoft Windows Update	mnswinsx.exe	"Added by the RBOT-AWH WORM!"
X	MICROSOFT Windows update	pdate.exe	"Added by the RBOT.BZT WORM!"
X	Microsoft Windows Update	srshost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update	rhost32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows Update	windowsupdate.exe	"Added by the AGOBOT.ON WORM!"
X	Microsoft Windows Update	servcs.exe	"Added by the SDBOT.AL BACKDOOR!"
X	Microsoft Windows Update	syssinfos.exe	"Added by the RBOT-FWR WORM!"
X	Microsoft Windows Update Application	wuap.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update Client	csrss.exe	"Added by the KEBEDE-G WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Systems32"
X	Microsoft Windows Update Client	services.exe	"Added by the AUTORUN.DVE WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Windows Update Logon	win-logon.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update Service	wupdmgr32.exe	"Added by the DOS.AUTOCAT TROJAN!"
X	Microsoft Windows Update Service	msnmsg.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Windows Update x86	[various filenames]	"Added by a variant of the RBOT WORM! Filenames seen include (but are not limited to firefox.exe
X	Microsoft Windows Update XP64	*******.exe [ = random char]	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update XP64	updatexp64.exe	"Added by the SDBOT-AIM WORM!"
X	Microsoft Windows Update XP64	Lcuninst.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update XP64	mzhxlixm.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updater	winupdgm.exe	"Added by the GAOBOT.BI WORM!"
X	Microsoft Windows Updater	WINIUPDATES.EXE	"Added by the RBOT-KK WORM!"
X	Microsoft Windows Updater	WINUPDATE.EXE	"Added by the RBOT-LI WORM!"
X	Microsoft Windows Updater	TMNTSrv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Updater	win32upd.exe	"Added by the RBOT-EC WORM!"
X	Microsoft Windows Updater	msnupdateit.exe	"Added by the AGOBOT-RL WORM!"
X	Microsoft Windows Updater	windates.exe	"Added by the SDBOT.TE WORM!"
X	Microsoft Windows Updater	spoolvs.exe	"Added by the RBOT.ACQ WORM!"
X	Microsoft Windows Updater	suvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updater	winfix.exe	"Added by the RBOT-CM WORM!"
X	Microsoft Windows updaterD	log32zx.exe	"Added by the MYDOOM.W WORM!"
X	Microsoft Windows Updates	explorer32.exe	"Added by the SDBOT.VQ WORM!"
X	Microsoft Windows Updates	wsap32.exe	"Added by a variant of the SDBOT WORM!"
X	MS Windows Update	scguard.exe	"Added by the RBOT-YZ WORM!"
X	Windows Update	[filename]	"Added by the NORIO TROJAN! Acts as a hi-jacker redirecting to adult content sites"
X	Windows Update	iexplorere.exe	"Added by the GAOBOT.AP WORM!"
X	windows update	uddater.exe	"Added by the LEOX TROJAN!"
X	Windows Update	wudate.exe	"Added by the AGOBOT.ML WORM!"
X	Windows Update	wupdate.exe	"Wengs adware"
X	windows update	sychost.exe	"Added by the LEOX.B WORM!"
X	Windows Update	Wuamgrd.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Update	inetinf.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Windows Update	WindowsUpdate.exe	"Added by the BAYROB-A TROJAN!"
X	Windows Update	host32.exe	"Added by the RBOT-GU WORM!"
X	windows update	wuraclt.exe	"Added by the RBOT-PO WORM!"
X	windows update	Wuanclt.exe	"Added by the RBOT.XZ WORM!"
X	Windows Update	svchosts.exe	"Added by the FRUCTA TROJAN!"
X	Windows Update	ebay.exe	"Added by the GAOBOT.BUU WORM!"
X	Windows Update	windows.exe	"Added by the RBOT-RB WORM!"
X	windows update	wuaurlt.exe	"Added by the RBOT.ADG WORM!"
X	Windows Update	Update.exe	"Added by the DELF-FN TROJAN!"
X	Windows Update	winmguard.exe	"Added by the RBOT-EM WORM!"
X	Windows Update	wuampd.exe	"Added by the RBOT.UM WORM!"
X	windows update	wuarclt.exe	"Added by the RBOT-OF WORM!"
X	Windows Update	winupdate.exe	"Added by the SDBOT-WS WORM!"
X	Windows Update	msnwinsb.exe	"Added by the RBOT-AAH WORM!"
X	Windows Update	scvhost.exe	"Added by the SDBOT-XT WORM!"
X	windows update	Microsoft.exe	"Added by the LMIR.A TROJAN!"
X	Windows Update	mplupdate.exe	"Added by the MOEGA WORM!"
X	windows update	msnsever.exe	"Added by the RBOT-AHN WORM!"
X	Windows Update	taskmr.exe	"Added by the MYTOB-GZ WORM!"
X	Windows Update	update32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update	wininfo.exe	"Added by the MYTOB.GA WORM!"
X	Windows Update	winlogin.exe	"Added by the BANKER-DV TROJAN!"
X	Windows Update	msnupdates.exe	"Added by the RBOT-ALK WORM! Note - this file has nothing to do with Windows updates or MSN"
X	Windows Update	qtask.exe	"Added by the RBOT-AKU WORM! Note - do not confuse with the Quicken file of the same name as described here"
X	windows update	real.exe	"Added by the LEGMIR-AU WORM!"
X	Windows Update	windowsx.exe	"Added by the BANCD-A TROJAN!"
X	Windows update	wudupdate.exe	"ISTBar adware related"
X	Windows Update	wupdmgr.exe	"Added by the BANCBAN-FC TROJAN and variants!"
X	Windows Update	csrss.exe	"Added by the BANKER-HM TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Update	msnsupdate.exe	"Added by the RBOT-AXS WORM!"
X	Windows Update	XPLoogNT.exe	"Added by the BANCD-B TROJAN!"
X	Windows Update	install.exe	"Added by the BANKER-IB TROJAN!"
X	Windows Update	msi.exe	"Added by the BANKER-XB TROJAN!"
X	Windows Update	Sqltob.exe	"Added by the DASHER.A WORM!"
X	windows update	logonuit.exe	"Added by the LEGMIR-AO TROJAN!"
X	Windows Update	avkir.exe	"Added by the RBOT-GJP WORM!"
X	Windows Update	easypwnt.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update	MSDEVS30.exe	Added by the SPYBOT.AHC WORM!
X	Windows Update	SecretStub.exe	"Added by the SRAMLER.C WORM!"
X	Windows Update	Winload.exe	"Added by the DEDMIR-A WORM!"
X	Windows Update	taskngr.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Update	usnsvc.exe	"Added by the KOBOT-C WORM!"
X	Windows Update	win32update.exe	"Added by the SDBOT.FTK WORM!"
X	Windows Update	livesrvs.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update	McAfee.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not a valid McAfee program"
X	Windows Update	McAfee3.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Windows Update	msconfig32.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows Update	msnsa32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Update	scrigz.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Update	winsc.exe	"Added by the BUZUS.RYI TROJAN!"
X	Windows Update	wuauclt32.exe	"Added by the SDBOT.DHY WORM!"
X	Windows Update	dllhostup.exe	"Added by the BANCBAN-NB TROJAN!"
X	Windows Update	explored.exe	"Added by the GAOBOT.MF WORM!"
X	Windows Update	smsscr.exe	"Added by the BANKER-DK TROJAN!"
X	Windows Update	sysdrv.exe	"Added by the AGENT-IYE TROJAN!"
X	Windows Update	winupupdate1.exe	"Added by the RBOT-UV WORM!"
X	Windows Update	klass.exe	"Added by the BIFROSE-ZH TROJAN!"
X	Windows Update	winlogonEvt.exe	"Added by the VB-DXM TROJAN!"
X	Windows update	explore.exe	"Added by the GAOBOT.AL WORM!"
X	Windows Update	fdos.exe	"Added by the RBOT-COG WORM!"
X	Windows Update	leak32x.exe	"Added by the AGENT.ALY BACKDOOR!"
X	Windows update	msb32.exe	"Added by the GAOBOT.CG WORM!"
X	Windows update	svdhost.exe	"Added by the GAOBOT.CG WORM!"
X	Windows Update	tskmngr.exe	"Added by the AGENT.ALY BACKDOOR!"
X	Windows Update	windb32.exe	"Added by the AGENT.ALY BACKDOOR!"
X	Windows update 2005	[random filename]	"Added by the RBOT.ARP WORM!"
X	Windows Update 32	winlogons.exe	"Added by the FORBOT-FI WORM!"
X	Windows Update 32	rempss.exe	"Added by the FORBOT-FW WORM!"
X	Windows Update 32	slsys.exe	"Added by the FORBOT-FT WORM!"
X	Windows update 32bit	winupd32.exe	"Added by the SDBOT.BE WORM!"
X	Windows Update 63	shupd64.exe	"Added by the FORBOT-GA WORM!"
X	Windows Update 64	nbupd64.exe	"Added by a variant of the FORBOT WORM!"
X	Windows Update 64	WinV.exe	"Added by the FORBOT-FP WORM!"
X	Windows Update Auto Update	wuaumgr.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Update Automatic Updates	[path to backdoor]	"Added by the VBBOT.AM BACKDOOR!"
X	Windows Update Automation	winuptdate.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update AutoUpdate Client	waucult.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update AutoUpdate Client	wuauclt.exe	"Added by the LAZAR.B TROJAN! Note - this is not the legitimate wuauclt.exe process
X	Windows Update AutoUpdate Client Product	wuauct.exe	"Added by the AGOBOT.ACL WORM!"
X	Windows Update Center	svthx.exe	"Added by the STUBBOT.A WORM!"
X	Windows Update Center	W32RSA.exe	Added by an unidentified WORM or TROJAN!
X	Windows Update Check	syslodr.exe	"Added by the SMALL.LU TROJAN!"
X	Windows Update Checker	[random filename]	Adware downloader trojan
X	Windows Update Checker	msupdte32.exe	"Added by the SDBOT-AEF WORM!"
X	Windows Update Checker	deinst_qfe001.exe	Added by a variant of the Win32.Small TROJAN!
X	Windows Update Checker	deinst_qfe002.exe	Added by a variant of the Win32.Small TROJAN!
X	Windows Update Client	wuclient.exe	"Added by the SMALL-RN TROJAN!"
X	Windows Update Client Service	windrvl32.exe	"Added by the AGOBOT-MM TROJAN!"
X	Windows update config	svhost.exe	"Added by the SDBOT-PF WORM!"
X	windows update configurator	svghost.exe	"Added by a variant of the SPYBOT WORM!"
X	windows update configurator	explore.exe	"Added by the SDBOT.RY BACKDOOR!"
X	Windows Update Controller	mwoffice.exe	"Added by the BATTRY-A TROJAN!"
X	Windows Update Draven	draven.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update Drive	updrvs.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update Files	dnetc.exe	"Added by an unidentified VIRUS
X	Windows Update Firewall System	ctfmoom.exe	"Added by the RBOT-GAN WORM!"
X	Windows Update Firewall System	winmsfw.exe	"Added by the RBOT-EEO WORM!"
X	Windows Update Firewall System	ctfmom.exe	"Added by the SPYBOT.ANDM WORM!"
X	Windows Update GUI Executable x32x	wupdategux32.exe	"Added by the RBOT.CXY WORM!"
X	Windows Update Host	winupsvc.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update IPv6 Layer	WIN32IPV6.EXE	"Added by the RBOT.DUD WORM!"
X	Windows update loader	xpupdate.exe	"Malware installed by different rogue security software including SpyKillerPro. Also detected as the BRAVE-A TROJAN!"
X	Windows Update Manager	wupdmngr.exe	"Added by the RANDEX.BTB WORM!"
X	Windows Update Manager	Winlog0n.exe	"Added by the AGENT-BO TROJAN!"
X	Windows Update Manager	wupdate.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update Manager	bootwiz.exe	Added by the MYBOT WORM!
X	Windows Update Manager	WindowsUpdateManager.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Update Manager for NT	wupdmgr32.exe	"Added by the SDBOT.AH WORM!"
X	windows update microsoft	updatem.exe	"Added by the RBOT-CHE WORM!"
X	Windows Update Monitoring Service	winupdt.exe	"Added by the RBOT-PL WORM!"
X	Windows Update Process	wmiprvsc.exe	"Added by the SDBOT-CB WORM!"
X	Windows Update Service	csrs.exe	"Added by the AGOBOT-NI WORM!"
X	Windows Update Service	smcg.exe	"Added by the SDBOT.QY WORM!"
X	Windows Update Service	SP00ISS.exe	"Added by the SDBOT-ZH WORM!"
X	Windows Update Service	update32.pif	"Added by the RBOT-ALC WORM!"
X	Windows Update Service	trest.exe	Identified by BitDefender as a variant of the PEED TROJAN!
X	Windows Update Service	wmiprvse32.exe	"Added by the AGOBOT.NI WORM!"
X	Windows Update Service	regscv.exe	"Added by the AGOBOT-AM BACKDOOR!"
X	Windows Update Service	msupdate32.exe	"Added by the DLOADR-CRJ TROJAN!"
X	Windows Update Service 2004/2005	systemupdate.exe	"Added by the RBOT-JE WORM!"
X	Windows Update services	wins32svcs.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update Services	winupdate32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update Software	system.exe	"TOFGER.BX spyware"
X	Windows Update SP3	Windat.EXE	"Added by the RBOT-GTS WORM!"
X	Windows Update Svc	rundll32.exe xpupdate.dll	"ContraVirus rogue security software - not recommended
X	Windows Update System	mswins.exe	"Added by the IRCBOT.DN WORM!"
X	Windows Update System Shell	svhostcs32.exe	"Added by the RBOT-AAZ WORM!"
X	Windows Update V6	[random filename]	"Added by the RBOT-KT WORM!"
X	Windows Update.exe	N/A	Homepage hijacker
X	Windows Updated	spoolsae.exe	"Added by the RBOT-APM WORM!"
X	Windows Updated	updatr.exe	"Added by the RBOT-AYB WORM!"
X	Windows Updater	wupdmgr32.exe	"Added by a variant of the DOS.AUTOCAT TROJAN!"
X	Windows Updater	iexplorerrs.exe	"Added by the RBOT-TN WORM!"
X	Windows Updater	svigost.exe	"Added by the RBOT-VS WORM!"
X	Windows Updater	wupdate.exe	"Added by the WOOTBOT.AJ WORM!"
X	Windows Updater	sdsys.exe	"Added by the FORBOT-JG WORM!"
X	Windows Updater Online	winupdatexx.exe	"Added by a variant of the RBOT WORM!"
X	Windows Updater Servc	xpuupdate.exe	"ContraVirus rogue security software - not recommended
X	Windows Updater Service Manager	winupdatr.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Updater Services	msnupdate.exe	"Added by a variant of the RBOT WORM!"
X	windows updaters	winupdats.exe	"Added by the SPYBOT-IS WORM!"
X	Windows Updates	lsassx.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Updates	winupd32.exe	"Added by the MYTOB.CE WORM!"
X	Windows Updates	w32dns.exe	"Added by the SDBOT-BFW WORM!"
X	Windows Updates Agent	winupdate.exe	"Added by the SPYBOT.HW WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.