Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
X(default)winlog.exe"Added by the RBOT-CVY WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X*WinLogon[trojan path] ren time:[random number]"Added by the VUNDO TROJAN!"
X.Progwinlogon.exe"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X9mwinlog0n.exe"Added by the LEGMIR-AQK TROJAN!"
XAdministratorwinlogon.exe"Added by the RUBBLE-C WORM! Note - this is not the legitimate winlogon.exe process
XAntiVirwinlog.exe"Added by the IRCBOT-TJ TROJAN!"
XBossIdeawinlogin.exe"Added by the LINEAGE-I TROJAN!"
XBuildLabwinlogon.exe"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
UC:Program Filesdfjdkjfdkjfldjfdfjdkjfdkjfldjfwinlogin.exeCritProc.exe"KeyProwler keystroke logger/monitoring program - remove unless you installed it yourself!"
XccAppswinlogon.exe"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
Xcpanelwinlogin32.exe"Added by the RBOT-FOY WORM!"
XCueX44_stil_hereWINLOGON.EXE"Added by the PUNYA-A WORM! Note - this is not the legitimate winlogon.exe process
XFirewall auto setupwinlogon.exe"Added by the AGENT-EDB TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
XFriendlyTypeNamewinlogon.exe"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
XGeneric Host Process for Win32 Serviceswinlogon.exe"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
XHhjg5jfd93dftdfwinlogan.exe"Added by the ERTFOR.A TROJAN!"
Xicq litewinlog.exe"Added by the IRCBOT-TJ TROJAN!"
XICQ Netwinlogon.exe"Added by variants of the NETSKY WORMS! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
XICQNetwinlogon.exe"Added by the NETSKY-C WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
XInternetwinlogom.exe"Added by a variant of the SDBOT WORM!"
Xjkdfj94kgdftdfwinlogan.exe"Added by the ZLOB.BZ TROJAN!"
Xkey2winlog.exe"Added by the BAGLEDI-AL TROJAN!"
ULoginwinlog.exe"Salfeld Child Control - parental control software"
XMicrosof Winlog Hostwilogon32.exe"Added by the RBOT.XC WORM!"
XMicrosoft Loginwinlogin.exe"Added by the RBOT-AJP WORM!"
XMicrosoft Loginswinlogins.exe"Added by the SPYBOT.BCZ WORM!"
XMicrosoft Service Login Managerwinlogin.exe"Added by a variant of the IRCBOT TROJAN!"
XMicrosoft Synchronization ManagerWinLoginnn.exe"Added by the SPYBOT.FO WORM!"
XMicrosoft Synchronization Managerwinlogon32.exe"Added by the SDBOT.AEU WORM!"
XMicrosoft Visual SourceSafewinlogon.exe"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
XMicrosoft Windows Logon Processwinlogon.exe"Added by the PROXYSER-R TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
Xmsconfigwinlog.exe"Added by the IRCBOT-TJ TROJAN!"
XMSMSGSwinlogon.exe"Added by the BRONTOK-BS WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
Xmsnwinlogon.exe"Added by the PROSTI.AA BACKDOOR! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Media"
XMSWinlogonSynCor.exe"Added by the AGENT-FZL TROJAN!"
XMSWinlogonwinlogon.exe"Added by the AGENT-FZM TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
XNDplDeamonwinlogin.exe"Added by the RANDEX.E WORM!"
Xnvchostwinlogon.exe"Added by the KLONE-J TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
XNVIDIA Media Center Librarywinlogon.exe"Added by the AUTORUN-AZK WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
XPaRaY_VMwinlogon.exe"Added by the AUTORUN-DV WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
XRealTimeProtectorwinlogon.exe"Added by the AUTORUN.DIB WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~� subfolder"
XRegDonewinlogon.exe"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
XROOT_Machinewinlogon.exe"Added by the BANKER-FI TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\inf"
XRPCserr32gwinlogon.exe"Added by the RITDOOR-B WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
XRPCserv32gWINLOGON.EXE"Added by the BOBAX.AD WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
Xrunwinlogonwinlogon.exe"Added by the AGENT.TQY TROJAN! Note - this is not the legitimate winlogon.exe process
XSkynetRevengewinlogon.scr"Added by the NETSKY.AA WORM!"
XSmansaAppwinlogon.exe"Added by the ROMARIO-A WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
Xsrvwinlogon.exe"Added by the SILLYFDC.BCA WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%\Local Settings\Application Data"
Xstartkeywinlogin.exe"Added by the BIFROSE-PM TROJAN!"
XStartupWinlogonStartupUnidentified malware
XSystem Update2winlogon.exe"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate winlogon.exe process
Usystraywinlogin.exe"KidControl surveillance software. Uninstall this software unless you put it there yourself"
XTEXTCONVwinlogon.exe"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
XTorjan ProgramWINLOGON.EXE"Added by the WOWCRAFT.D TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
XUpdade Windowswinlogom.exe"Added by the TONAX-A TROJAN!"
XUpdate Checkerwinlog.exe"Added by the IRCBOT-TJ TROJAN!"
Xurudjeffniwinlogon.exe"Added by the ROMARIO-A WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
Xuserinitwinlogon.exe"Added by the DLOADER-TP TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
Xvirtual-iewinlogi.exe"Added by the RBOT-BJU WORM!"
Xvirtual-machinewinlogin.exe"Added by the RBOT-VU WORM!"
XW1N32.DLLWINLOGON .exe"Added by the DROPPERFL.A TROJAN!"
XWin Loginwinlogin.exe"Added by the RBOT-AWE WORM!"
XWin32 Driverswinlogons.exe"Added by the FORBOT-FG WORM!"
XWinAuthwinlogon.exe"Added by the STRTPAGE.BE TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
XWindow UDP Control Servicwinlogon.exe"Added by the RBOT-GXN WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
XWindows ARP Detectioncwinlogon.exe"Added by the RBOT.EAB WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
XWindows ARP Detectioncxwinlogon.exe"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
XWindows debug loggingwinlogg.exe"Added by the RBOT-OY WORM!"
XWindows debug loggingwinloggs.exe"Added by the RBOT-QN WORM!"
XWindows Firewall Logwinlog.exeAdded by an unidentified WORM or TROJAN!
XWindows Log Agentwinlogon.exe"Added by the KEYLOGGER.AVK TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files"
XWindows Loggerwinlog.exe"Added by the NSHADOW-B TROJAN!"
XWindows loggingwinlogd.exe"Added by the RBOT-ON WORM!"
XWindows Loginwinlog.exe"Added by the AGOBOT.MG WORM!"
XWindows Login Managerwinlogin.exe"Added by a variant of the SDBOT WORM!"
XWindows Login Securitywinlogin.pifAdded by an unidentified WORM or TROJAN!
XWindows Login Servicewinlog.exe"Added by the RBOT-AFN WORM!"
XWindows Login Servicewinlogin.pif"Added by the SDBOT-ACU WORM!"
XWindows Logonwinlogin.exe"Added by the SPYBOT-C TROJAN!"
XWindows Logonwinlogon.exe"Added by the VB.HE VIRUS! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\system"
XWindows Logon Applicationwinlogon.exe"Added by the POEBOT-KW WORM! Note - this is not the legitimate winlogon.exe process
XWindows Logon Applicationedcwinlogon.exe"Added by the DWNLDR-HGR TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%"
XWindows Logon Applicatonedcwinlogon.exe"Added by the VB-EBV TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%"
Xwindows logon procedurewinlogonpc.exe"Added by the WINLOGON TROJAN!"
XWindows Logon Servicewinlogon.pif"Added by the RBOT-AOU WORM!"
XWindows Logon Servicewinlogoservice.exe"Added by the SPYBOT.ANOO WORM!"
XWindows mangementwinlogonn.exe"Added by the RANDEX.FC WORM!"
XWindows Messanger Control Centerwinlogin.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
XWindows Messanger Control Centerwinlogon.exe"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
XWindows modez Verifierwinlogom.exe"Added by a variant of the RBOT WORM!"
XWindows MSConfig Startup Loggerwinlog.exe"Added by the RBOT.BCU WORM!"
XWindows NT Logon Applicationwinlogon.scr"Added by the RBOT-ALP WORM!"
XWindows Serviceswinlogon.exe"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
XWindows Services Layerwinlogz2.exe"Added by the RBOT-FZE WORM!"
XWindows Updatewinlogin.exe"Added by the BANKER-DV TROJAN!"
XWindows UpdatewinlogonEvt.exe"Added by the VB-DXM TROJAN!"
XWindows Update 32winlogons.exe"Added by the FORBOT-FI WORM!"
XWindows Update ManagerWinlog0n.exe"Added by the AGENT-BO TROJAN!"
Xwinlogwinlog.exe"Added by the GAOBOT.DF WORM!"
Xwinlogwindowxs.exe"Added by the SDBOT-KT BACKDOOR!"
Xwinlog managerwinlog.exe"Added by the DONBOMB.A TROJAN!"
Xwinlog.exewinlog.exe"Added by the BCKDR-RBJ TROJAN!"
XWINLOG0NWINLOG0N.EXE"Added by the MYDOOM.BI WORM!"
XWinLoginwinlogin.exe"Added by the AGOBOT-IX WORM!"
Xwinloginwin32x.exe"Browser hijacker
XwinloginReadMe.exe"Added by the SILLYFDC.BBT WORM!"
XWinlogin.exelog.exeAdded by a variant of the AGENT.AH downloader TROJAN!
Xwinlogin.exelogfile.exeAdded by the AGENT.AH TROJAN!
Xwinlogin.exemspaint.exeAdded by a variant of the AGENT.AH TROJAN!
XWinlogin.exesteam.exeAdded by a variant of the AGENT.AH TROJAN!
Xwinlogins.exewinlogins.exe"Added by the OPTIX.H BACKDOOR!"
Xwinlogoffwinlogoff.exe"Added by the AGOBOT-TR WORM!"
Xwinlogonwinlogin.exe"Added by the RANDEX.E WORM!"
Xwinlogonwinlogon.exe"Added by the TRODAL TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
Xwinlogonmsreg32.exe"Added by the SDBOT.EO WORM!"
Xwinlogonwinlogon32.exe"Added by the MASLAN.C WORM!"
Xwinlogonwpwlogon.exeAdded by an unidentified WORM or TROJAN!
XWINLOGONwscript.exe WINLOGON.vbs"Added by the YSPAN.F WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""WINLOGON.vbs"" file is found in %System%"
XWinlogonLsass.exe"Added by the ALCOP-B WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
Xwinlogonnvchost.exeAdded by an unidentified WORM or TROJAN!
XWinlogonWINLOGON.EXE"Added by the PUNYA-B WORM! Note - this is not the legitimate winlogon.exe process
Xwinlogonsystem.exeAdded by a variant of the DELF.CNS TROJAN!
Xwinlogoncleanmg.exe"Added by the AGENT-ICR TROJAN!"
XWinlogonscssrr.exe"Added by the AGENT-LXB TROJAN!"
Xwinlogon serviceurx.exe"Added by the SPYBOT.EN WORM!"
XWinlogon ShellExplorer.exe svchost.exe"Added by the KIPIS.M WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""1032"" sub-folder"
XWinlogon.exeN/A"CoolWebSearch parasite variant - resets home page to an adult content site"
Xwinlogon.exehelper.exe"Added by the FAKESPY-A TROJAN!"
Xwinlogon.exemsole32.exe"Adware
Xwinlogon32_[path to file]"Added by the RULAND.A WORM!"
XWinLogonndwinlogonnd.exe"Added by the AGENT-NNQ TROJAN!"
Xwinlogon_userccIsass.exe"Added by the SILLYFDC.BBT WORM!"
XWinlogunwinlogin.exe"Added by the P2LOAD-C WORM!"
XWMAudiowinlogon.exe"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
XWSAConfigurationwinlogon32.exe"Added by the AGOBOT-WC WORM!"
Xxpstatwinlogins.exe"Added by the RBOT-AAR WORM!"
Xxp_systemwinlogon.exe"Added by the KREPPER-G TROJAN! - a CoolWebSearch parasite variant. Note - this is not the legitimate winlogon.exe
X[various names]winlogon32.exeAdded by an unidentified WORM or TROJAN!


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.