wm

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	.WMAudio	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	.WMAudio	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
N	ActiveWords	AWMonitor.exe	"ActiveWords from ActiveWord Systems
U	Actual Window Manager	ActualWindowManagerCenter.exe	"Actual Window Manager from Actual Tools - ""an innovative desktop organization application which introduces unconventional window controls and also automatic general window operations making your work more productive
U	Actual Window Minimizer	ActualWindowMinimizerCenter.exe	"Actual Window Minimizer - ""allows minimizing any window to task tray notification area or to the edge of the screen"""
X	AutoDiscovery/AutoPurge (ADAP) Service	wmiadapi.exe	"Added by the RBOT.FLT WORM!"
N	AUTOPROP	REGPROP.EXE WMPADDIN.DLL	"Both the files are in the MS Office/Bots/FP_WMP directory. Apparently
U	AWMON	Ad-Watch.exe	"Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system"
U	AWMON	Ad-Monitor.exe	"F-Secure Anti-Spyware"
X	ccApp	WMADZ.EXE	"Added by the RBOT-LJ WORM!"
U	ContentTransferWMDetector.exe	ContentTransferWMDetector.exe	"Part of Sony's Content Transfer Software which ""provides an easy way to transfer music
N	Coolwallpaper	cwm_tray.exe	"Cool Wallpaper software allows you to manage high quality photos as desktop wallpaper and screen savers"
X	Ctfmon	wmisys.exe	"Added by the IRCBOT-ADS WORM!"
U	Cyber Trio	showmode.exe	"From G-Tek Technologies. Allows you to set the PC in one of three modes
U	DDWMon	ddwmon.exe	"Direct Disc Writer Event Monitor from TOSHIBA"
N	DELL Webcam Manager	DellWMgr.exe	Dell Webcam Manager - Webcam management software provided on Dell PCs
N	DigitalWizard Monitor	dwMon.exe	"InstallShield's DigitalWizard - free
X	DivXCodec	NEWMAIL.exe	"Added by the DELF-RQ BACKDOOR!"
X	Dowmingzu	Dowmingzu.dll.vbs	"Added by the SOLOW-E WORM!"
N	Encoder Agent	WMENCAGT.EXE	"MS Windows Media Encoder
X	File System Service	wmiprvsc.exe	"Added by the AGOBOT-HZ TROJAN!"
X	Firewall	wmlaunch .exe	"Added by the ELIPTER.A or ELIPTER.B WORMS! Note the space at the beginning of the filename"
X	Firewall	wmlaunch .exe	"Added by the ELIPTER.D WORM!"
N	FullAudio	WMPImporter.exe	Used to import settings from Windows Media Player into Music Now software (from www.musicnow.com - which is no longer available) and possibly others
N	GWMDMMSG	GWMDMMSG.exe	Used with internal modems on Gateway and vprMatrix PCs. This is the "GTW modem messaging applet" and is not required for the modem to work correctly
U	GWMDMpi	GWMDMpi.exe	"Used with internal modems on Gateway PCs such as the 450SX Notebook. Required for audio settings to be maintained and does not remain in memory once run. See here for more information"
U	Hidetools Spy Monitor	wmispe.exe	"HideTools Spy Monitor surveillance software. Uninstall this software unless you put it there yourself"
Y	IBM Password Manager	pwmgr.exe	"Part of Client Security Software for IBM\Lenovo notebooks - IBM® Client Security Password Manager ""enables you to manage your sensitive and easy-to-forget login information
Y	IBM_PWMGR	pwmgr.exe	"Part of Client Security Software for IBM\Lenovo notebooks - IBM® Client Security Password Manager ""enables you to manage your sensitive and easy-to-forget login information
X	infamous.exe	wmplayer.exe	Added by unknown malware. WMPLAYER.EXE is stored in the location and uses the same name as Windows Media Player but that valid Windows program doesn't load at startup
X	JW Manager	jwmngr.exe	"Added by the DELBOT-G WORM!"
X	Kernel_check	wmiprvse.exe	"Added by the SONEBOT-B WORM! Note - this is not the legitimate wmiprvse.exe process which is always located in the %System%\wbem folder and should not normally figure in Msconfig/Startup!"
X	loader	WMPLAYER.EXE	Unknown baddie - WMPLAYER.EXE is stored in the location and uses the same name as Windows Media Player but that valid Windows program doesn't load at startup
X	LoadPFW	wmimgr.exe	"Added by the QEDS-B WORM!"
U	lxdwmon.exe	lxdwmon.exe	Lexmark 7600 Series printer device monitor
X	machine-debugger	WMIPRVSW.exe	"Added by the AGOBOT.WW WORM!"
X	mdwmdmsp	mdwmdmsp.exe	"Adware - detected by Kaspersky as the AGENT.AM TROJAN!"
X	Media Player	wmplayer.exe	"Added by a variant of the AGOBOT.BM WORM! Note - this is not the valid Windows Media Player as the file is located in %System% rather than %ProgramFiles%\Windows Media Player"
X	Messenger	Wmsngr.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft File Demand Manager	wmgrdf.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft startup	wmpIayer.exe	Added by the IRCBOT.ACI TROJAN!
X	Microsoft Synchronization Manager	wmedia.exe	"Added by the SDBOT.BFC WORM!"
X	Microsoft Update Process	wmipcvse.exe	"Added by the AGOBOT-JF TROJAN!"
X	Microsoft Update Service	wmiprvre.exe	"Added by the AGOBOT-NN WORM!"
X	Microsoft Viewer Monitor Manager	viewmon.exe	"Added by the XPAK.A TROJAN!"
U	Microsoft Windows Media Player Network Sharing Service Configuration Application	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	Microsoft WM	mswm32.exe	"Added by the BCKDR-AM BACKDOOR!"
U	Microsoft� Windows Mobile� Device Center	wmdc.exe	"Windows Mobile Device Center - mobile device management/synchronization software for Windows7/Vista
U	Microsoft� Windows� Operating System	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	MSN	wmev.exe	"Added by a variant of the SPYBOT WORM! See here"
X	NAV Agent	wmilib32.exe	"Added by the VB-XU TROJAN!"
X	Nero Updater.6.12	wmp9.exe	"Added by the AGOBOT-AAG WORM!"
Y	NettGain2000	WgwMngr.exe	"Part of Flash-Networks NettGain2000 product. NettGain 2000 is a combined hardware/software networking solution
X	Newman	playavi.exe	"Added by the LINEAGE-AT TROJAN!"
X	NewMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
N	NkVwMon.exe	NkVwMon.exe	Nikon View - for transferring pictures from Nikon digital cameras
X	NTmessageSystem	loadnewmessage.exe	"Added by the HIDAGENT-B WORM!"
X	OWMngr	OWMngr.exe	"OnWebMedia/SearchSeekFind advertising foistware"
U	PC Dynamics SdwMon32	sdwmon32.exe	"SafeHouse ""Personal Privacy"" protects and hides your private and personal photos
Y	pwmgr	pwmgr.exe	"Part of Client Security Software for IBM\Lenovo notebooks - IBM® Client Security Password Manager ""enables you to manage your sensitive and easy-to-forget login information
Y	RfwMain	rfwmain.exe	"Rising antivirus"
X	run=	wmplayer.exe	"CoolWebSearch Smartsearch parasite variant"
X	scApp	wmiprvse.exe	"Added by the SILLYFDC-AW WORM!"
X	Security Update Service	wmiprvce.exe	"Added by the AGOBOT.ZW WORM!"
X	Shell	wmedia16.exe	"Added by the GOLDUN TROJAN!"
X	Shell	wmedia32.exe	"Added by the AGENT-BR TROJAN!"
X	Showme	Ruden.vbs	"Added by the HANDLE-A VIRUS!"
X	StartReplySystem	loadnewmessage.exe	"Added by the HIDAGENT-B WORM!"
X	stealth.wm.exe	stealth.wm.exe	"Added by the THEALS.A WORM!"
X	sys	regedit sysdllwm.reg	"CoolWebSearch parasite variant - also detected as the FEMAD-L TROJAN!"
X	SYSTEM MESSAGER	wmisg.exe	"Added by the MYTOB.ES WORM!"
X	System Update Service	wmiprvsa.exe	"Added by the AGOBOT-RG TROJAN!"
X	System Update Service	wmiprvsv.exe	"Added by the AGOBOT.YG WORM!"
X	System Updater Process	wmiprvsw.exe	"Added by the AGOBOT-IL WORM!"
X	System Updater Service	wmiprvsw.exe	"Added by the GAOBOT.AFC WORM!"
X	System Updates	wmkl.exe	"Added by the RBOT-AYJ WORM!"
X	SystemSv12	newmaxxsv234.exe	"Added by the TIBS-TS TROJAN!"
X	SystemSv121	n2ewma1xxsv234.exe	"Added by the TIBS.TJ TROJAN!"
U	ukl	wmpusrvc.exe	"Ultimate Keylogger surveillance software. Uninstall this software unless you put it there yourself"
X	USBConfigration2	wmmndir.exe	"Added by the AGOBOT-SV WORM!"
?	v	WMPVer.EXE	"Dritek System Inc. 3D Mouse related. Is it required?"
N	ViewMgr	ViewMgr.exe	"Viewpoint Manager - automatic updates for ViewPoint products such as ViewPoint Media Player (as bundled with AOL
Y	WgwMngr	WgwMngr.exe	"Part of Flash-Networks NettGain2000 product. NettGain 2000 is a combined hardware/software networking solution
N	Wildwire Monitor	WWMon.exe	This places a status icon on the taskbar for the DSL WildWire Tiger Modem. This is also a shortcut to the diagnostics utility for the DSL modem
X	Win32 Wmls Driver	winitr32.exe	"Added by the WOOTBOT.B WORM!"
X	Windows Email Server	wmserv.exe	"Added by the FOUNDU-AWORM!"
X	Windows Management Informant	wmmiexe.exe	"Added by the IRCBOT-V BACKDOOR!"
X	WINDOWS MANAGEMENT SYSTEM	wm1exe.exe	"Added by the RBOT-VT WORM!"
X	Windows Media APP	wmapp.exe	Added by an unidentified WORM or TROJAN!
N	Windows Media Connect 2	WMCCFG.exe	"Windows Media Connect from Microsoft - stream digital media files on your computer to digital media receivers (DMRs) that are connected to your home network"
X	Windows Media Loader	wmloader.exe	"Added by a variant of the GAOBOT WORM!"
X	Windows Media Player	wmediaplayer.exe	"Added by the AGOBOT-NQ WORM!"
X	Windows Media Player	wmplayer.exe	"Added by the KELVIR.G WORM or variants! Note - this is not the valid Windows Media Player as the file is located in %System% rather than %ProgramFiles%\Windows Media Player"
X	Windows Media Player	wmplayerc.exe	"Added by the SILLYFDC.DBG WORM!"
X	Windows Media Player 3.6	wmpa36.exe	"Added by a variant of the RBOT WORM!"
X	Windows Media Player 3.6b	WMPA36B.EXE	"Added by the RBOT-VV WORM!"
X	Windows Media Player 3.6d	wmpa36d.exe	"Added by the RBOT-YA WORM!"
X	Windows Media Player 3.9	wmpa36.exe	"Added by a variant of the RBOT WORM!"
X	Windows Media Player 6.1.2	wmplayer612.exe	"Added by the RBOT.AIB BACKDOOR!"
X	Windows Media Player Service	wmedia.exe	"Added by the RBOT.213504 WORM!"
X	Windows Media Server	wmserv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Media Server!	wmserver.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Media Utility	wmediautil.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Messenger Connect	wmdsvc.exe	"Added by the SLENFBOT.S WORM!"
X	Windows Messenger Share	wmssvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Messenger Starter	wmvsvc.exe	"Added by the DELF.DAX TROJAN!"
U	Windows Mobile Device Center	wmdc.exe	"Windows Mobile Device Center - mobile device management/synchronization software for Windows7/Vista
U	Windows Mobile-based device management	wmdSync.exe	"Part of Windows Mobile Device Center in Vista. Microsoft Windows Mobile Device Center enables you to set up new partnerships
U	Windows Mobile-based device management	wmdc.exe	"Windows Mobile Device Center - mobile device management/synchronization software for Windows7/Vista
X	Windows MSN Live Messanger	wmsnlive.exe	"Added by the RBOT.BMV BACKDOOR!"
X	Windows Performance Monitor	wmscupd.exe	"Added by the IRCBOT_GEN WORM!"
X	Windows Scheduler	wmscheduler.exe	"Added by a variant of the SDBOT WORM! See here"
X	Windows Service Agent	wmscc.exe	"Added by the RBOT-GQP WORM!"
X	Windows Update Process	wmiprvsc.exe	"Added by the SDBOT-CB WORM!"
X	Windows Update Service	wmiprvse32.exe	"Added by the AGOBOT.NI WORM!"
X	Windows WMF Fix	winfix.exe	"Added by the RBOT-FTQ WORM!"
X	WinManage	wmanage.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	winmgmt	wmiprvse.exe	"Added by the AGENT-GHP TROJAN!"
Y	winmodem	wmexe.exe	"Software for software based modems. Required if you have one of these. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information"
X	WinUpdate	wmbem.exe	"Added by the REVCUSS.B TROJAN!"
U	Wireless PCI Card Configuration Utility	WMP11Cfg.exe	"Utility used by the LINKSYS wireless PCI card (WMP11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
X	wm	svhost32.exe	"Added by the LINEAGE.CIS TROJAN!"
N	WM VCR	WMVCR.exe	"WM Recorder allows you to record Windows Media(tm) streaming Video or Audio content. Can be accessed via Start Menu -> Programs"
Y	Wm24Pan	Wm24Pan.Exe	"ESI external sound card driver"
X	wm41a398	"rundll32.exe wm41a398.dll	EnableRunDLL32"
X	WMAudio	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
X	WMAudio	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
N	WMBoot	N/A	"Associated with Logitech Wingman game controllers. Not required but what does it do?"
X	wmcbaaca	"rundll32.exe wmcbaaca.dll	EnableRunDLL32"
N	WMC_RebootCheck	unregmp2.exe	"Corrects problems with installations of Windows Media Player from version 9 onwards - see here and search for ""unregmp2.exe"""
X	WMDM PMSP Service	cssrss.exe	"Added by the KNOCKIT-A TROJAN!"
X	WMedia32	wmedia32.exe	"Added by the BANGER TROJAN!"
X	WMI Application Interface	wmiapi.exe	"Added by the SPYBOT.RBY WORM!"
X	WMI Performance Adapter Services	wmiapsrvs.exe	"Added by the RBOT.COU BACKDOOR!"
X	WMI Service Client	wmispv.exe	"Added by the AUTORUN-ASX WORM!"
X	WMI Standard Event Consumer - Scripting	scrcons32.exe	"Added by the RBOT-GRD WORM!"
X	WMI Standard Event Consumer - Scripting	scrcs.exe	"Added by a variant of the RBOT-GRD WORM!"
U	WMIEXE.exe	wmiexe.exe	"NT component
X	Wminf	Wminf.exe	"Added by the GEMA TROJAN!"
X	Wminfo	Wminfo.exe	"Added by the GEMA TROJAN!"
X	wmiprevse	wmiprevse.exe	"Added by the BANKER-EPN TROJAN!"
X	wmiprv	wmiprv.exe	"Added by the RBOT-WM WORM!"
X	wmisrv	wmisrv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	wmon	jusched.exe	"Added by the AGOBOT-OW WORM! Note that this is not the legitimate Sun Microsystems file (of the same name) which is usually located in %Program Files%\Java\version number\bin. This one is located in %System%"
X	WMP Auto Update	WINMEDUP.EXE	"Added by the RBOT.CF WORM!"
Y	WMP54Gv4	WMP54Gv4.exe	"Linksys WMP54Gv4 wireless PCI adapter driver - required in order to automatically connect to the wireless router/gateway at bootup. Note - may not install correctly on Windows9x/ME computers which have Slipstream accelerator installed. Uninstall Slipstream first
X	wmplayer	vergon1885.exe	"Added by the BRONTOK-DG WORM!"
X	wmplayer.exe	wmplayer.exe	"Added by the BANCBAN-CZ TROJAN! Note - this is not the valid Windows Media Player as the file is located in %Windir% rather than %ProgramFiles%\Windows Media Player"
U	WMPNSCFG	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	wms3	wms3.exe	"Added by the LEGMIR-AQG TROJAN!"
X	WMSDOS-ServicePack2	cmd.exe /c C:WMSDOS.sys	"Detected by Bitdefender as the DELF.OFC TROJAN! See here. Note that cmd.exe is a legitimate Microsoft file normally located in %System% and shouldn't be deleted"
X	wmsrc.exe	wmsrc.exe	"PrivacyRedeemer rogue privacy program - not recommended
X	wmsys32	wmsys32.exe	"Added by the BANPAES.B TROJAN!"
U	WMUAgent.exe	WMUAgent.exe	"""WakeMeUp! is an advanced alarm clock for computers with Windows 2000
X	wmupdate	wmupdate.exe	"Added by the AGENT-GGJ TROJAN!"
X	wmv	winmonv.exe	"Added by the AGENT-DG TROJAN!"
?	WM_LOGIN	MSGLOGIN.EXE	"Part of McAfee Firewall. What is it for and is it needed?"
U	Workstation Scheduler	wm95.exe	"Desktop Management Scheduler. Part of Novell's Netware Client. Schedueles NDS events. If events have been schedueled
X	wpwmgrs	wpwmgrs.exe	"Added by the MYTOB-DH WORM!"
X	WSAConfiguration	wmon32.exe	"Added by the GAOBOT.BAJ WORM!"
X	WSSAConfiguration	wmmon32.exe	"Added by the AGOBOT-KC WORM!"
X	XMLmedia 10.0	wmsdkns.exe	"Added by the FAKEALERT TROJAN!"
?	XWMSUSBAPI	XWMSAPI.EXE	"Part of the installation of a Xerox WorkCentre printer/scanner. Is it required?"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.