O21 HijackThis Entries

bleepingcomputer.com

Welcome Guest (Log In | Create Account)

New Member? Join for free.

BleepingComputer.com -> Startup Programs Database -> O21 HijackThis Entries

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z Other

HJT: F0, F1, F2, F3 · O4 · O20 · O21 · O22 · O23

Rootkit List · Submit a Startup · Top Submitters

Startup Index · Newest Entries · Mozilla Search Tools · WebMaster Site Tools · Status Key
Startup Database Forum · How to use the Startup Database

Enter the filename or keyword you would like to search for:

Advanced Search

Pages: (3) 1 2 [3]

Name	Filename	Status	Description
xvideo	xvideo.dll	X	A variant of the Cpvfeed adware.
AceExt	AceExt32.dll	X	Added by the Troj/Agent-FYG Trojan.
LDpswSend	<random>.dll	X	Identified as Trojan-Downloader.Win32.Agent.
msqnx	msqnx.dll	X	A variant of the MyGeek adware family.
msddx	msddx.dll	X	A variant of the MyGeek adware family.
system32	sysprinters.dll	X	Added by the W32/IRCBot-WV worm and IRC backdoor.
msdde	msdde.dll	X	Trojan typically installed with certain Rogue antispyware programs.
msole	msole.dll	X	Trojan typically installed with certain Rogue antispyware programs.
rdshost	rdshost.dll	X	Identified as the Backdoor.Win32.IRCBot.aaq worm and IRC backdoor.
expro	expro.dll	X	Identified as a variant of the MyGeek Cpvfeed adware.
vpssup	vpssup.dll	X	Identified as a variant of the MyGeek Cpvfeed adware.
MediaExport	mplay32.dll	X	Identified as the Delf.acm Trojan Downloader.mplay32.dll
vpnsupport	vpnsupport.dll	X	Identified as the Adware.Agent Trojan.
pppconfig	pppconfig.dll	X	Identified as the Adware.Agent Trojan.
extctrl	extctrl.dll	X	Identified as the Adware.Agent Trojan.
netsup	netsup.dll	X	Identified as the Adware.Agent Trojan.
WinCTL	winctl.dll	X	Added by the Troj/Small-EJG Trojan downloader.
syshelps	syshelps.dll	X	Identified by Kaspersky Antivirus as Backdoor.Win32.IRCBot.acd.
advsort	advsort.dll	X	Identified as Adspy.BHOapp / Adware.Agent. Typically bundled with Smitfraud infections and other web installed malware.
mssms	mssms.dll	X	Identified as Adspy.BHOapp / Adware.Agent. Typically bundled with Smitfraud infections.
syshosts	syshosts.dll	X	Added by the W32/IRCBot-WB networm worm and IRC backdoor.
vpnconfig	vpnconfig.dll	X	Identified as Win32.Adware.Agent.BN. Know to be bundled with SmitFraud infections.
ossmart	ossmart.dll	X	Identified as Win32.Adware.Agent.BN. Know to be bundled with SmitFraud infections.
DirectX	d3d8xof.dll	X	Added by the W32.Almanahe.C worm.
SysRun	svshost.dll	X	Added by the BKDR_SMALL.EDI backdoor Trojan.
vsmart	vsmart.dll	X	Identified as AdWare.Win32.Agent.bn.
mssmart	mssmart.dll	X	Identified as AdWare.Win32.Agent.bn.
iereport	iereport.dll	X	Identified as Adware.Agent. This infection is typically found along with other Zlob or Smitfraud infections.
tlhelp	tlhelp.dll	X	Identified as Adware.Agent. This infection is typically found along with other Zlob or Smitfraud infections.
mslm	mslm32.dll	X	Added by the W32/Feebs-BO email and P2P worm.
{3D38667C-CF08-4060-BAD3-30797B8FE363}	rdihost.dll	X	Added by the W32/IRCBot-VR worm and IRC backdoor.
rdshost	rdfhost.dll	X	Added by the W32/IrcWorm-A worm and IRC backdoor.
UrlMon	mslfmpk.dll	X	Added by the Troj/Bckdr-QES backdoor Trojan.
MSHelper	msw_p.dll	X	Added by the Trojan.Mixpel information stealing Trojan.
MSRemote	msremote.dll	X	Added by the Trojan.Mixpel information stealing Trojan.
DLMonF	msimain.dll	X	Added by the Troj/Agent-ECR Trojan.
IPicture	IPictureEx.dll	X	Added by the Troj/Agent-DZE Trojan.
odb_set	odbcmr32.dll	X	Added by the Troj/Small-DOA Trojan.
webwork	webwork.dll	X	Added by the Webwork downloader/updater DLL which is known to download and install advertising software. The adware applications Boran and Yokgug may be installed alongside or by Webwork.
msdf32.dll	msdf32.dll	X	Added by the W32/Feebs-BH email worm.
MemMan	MemMan.dll	X	Added by a variant of the Goldun.Fam Trojan. This infection also utilizes the CsdDriver.sys rootkit to hide itself.
msvcrt64.dll	msvcrt64.dll	X	Added by the Troj/Torpig-BK Trojan.
DLMon	DLMain.dll	X	Added by the Troj/Agent-DIX Trojan.
UpperHost	UpperHost.dll	X	A variant of the Goldun Trojan.
WPDShServiceObj	WPDShServiceObj.dll	Y	Windows Portable Device Shell Service Object
Battery Monitor	shlapiw32.dll	X	Added by the Troj/Delf-BPC Trojan.
mskk32.dll	mskk32.dll	X	Added by the W32/Feebs-Q worm.
msth32.dll	msth32.dll	X	Added by the W32/Feebs-O P2P worm.
msyk32.dll	msyk32.dll	X	Added by the W32/Feebs-N P2P worm.
msdy32.dll	msdy32.dll	X	Added by the W32/Feebs-M worm. This infection also creates the following files: C:\Windows\System32\msoe.exe and C:\Windows\System32\msry.exe.
WebShell	webshell.dll	X	Added by the Backdoor.Bebshell Trojan horse with backdoor capabilities.
System	q_sys.dll	X	Added by the Troj/LdPinch-DY information stealing Trojan.
mspc32.dll	mspc32.dll	X	Added by the W32/Feebs-J worm.
DBGA0EEG	Cokmgl32.dll	X	Added by the W32/Doxpar-F worm.
fldrsys	fldrsys.dll	X	Added by the Troj/Agent-QY Trojan.
<randomly chosen CLSID>	msshell.dll	X	Added by the Troj/Vipgsm-AB Trojan.
System	kmc.dll	X	Added by the Troj/Dropper-BT dropper Trojan. This infection also makes the file C:\Windows\csrss.exe.
SysTray.Exiv	<random>.dll	X	Added by the Troj/Slogger-F backdoor Trojan.
MStask	win2sys.dll	X	Added by the Troj/Dropper-BS dropper Trojan.
DBGA0EEG	<random filename>.dll	X	Added by the W32/Doxpar-D password-stealing network worm.
DBGA0EEG	Laabph32.dll	X	Added by the W32/Doxpar-E password-stealing network worm.
MStask	p2sys.dll	X	Added by the Troj/LdPinch-UE Trojan.
sysctl32	sysctl32.dll	X	Added by the Trojan.Totmau Trojan.
[not used]	mswshell.exe	X	Added by the W32.Monikey@mm mass-mailing worm. This worm attempts to gather information found on your computer.
fgsrv	fgsrv.dll	X	Added by the Troj/Fgbot-A Trojan.
WebCheck	ldr.dll	X	Added by the Troj/Radium-A backdoor Trojan.
SystemCheck2	vbsys2.dll	X	Added by the Troj/AdClick-AZ Trojan.
SysTray.Exsh	[random 8 character dll]	X	Added by the Troj/Cozdoor-D bacdoor Trojan.
Internet Explorer	[random letters].dll	X	Added by the Troj/Proxma-A proxy and backdoor Trojan.
SysTray.Excn	[random 8 character dll)	X	Added by the Troj/Cozdoor-C Trojan.
Trayz	[random filename]	X	Added by the Troj/Bdoor-JG backdoor Trojan.
SysTray	cfustums.dll	X	Added by the Troj/Small-XG dropper Trojan.
System	ssmc.dll	X	Added by the Backdoor.Berbew.R Trojan.
SvcSys	svcsys.dll	X	Added by the PWSteal.Bancos.Y password-stealing Trojan.
OLE Automation Module	Wsthunk.dll	X	Added by the Backdoor.Thunker Trojan.
Windows Development Features	Thrh1032.dll	X	Added by the Backdoor.Hitcap backdoor Trojan.
SysConnect	sysconnect.dll	X	Added by the Trojan.Sconato Trojan.
Systask	dll.dll	X	Added by the PWSteal.Ldpinch.B password-stealing Trojan.
ss	dssa.dll	X	Added by the Backdoor.Xebiz backdoor Trojan.
cetihpz	hpuiprot.dll	?	Installed by HP Printers.
g7ps	G7PS.dll	Y	Part of G7 Productivity Systems.
XmLdrLocation	nvrcr32.dll	X	Added by the Spyware.Eblaster spyware. It also installs a file into %System%rmashlex.dll.
[Random]	mswshell.dll	X	Added by the W32/Monikey-A/a> worm.
System	mcsys.dll	X	Added by the Troj/Pindrop-A Trojan.
Internet Explorer	[RANDOM NAME].dll	X	Added by the Backdoor.Berbew.T backdoor.
Web Event Logger	[8 random characters].dll	X	Added by the Backdoor.Berbew.P backdoor.
Web Event Logger	[8 random characters].dll	X	Added by the Backdoor.Berbew.M backdoor.
WebEvent Logger	[8 random characters].dll	X	Added by the Backdoor.Berbew.F backdoor.
Web Event Logger	<8 random characters>.dll	X	Added by the Backdoor.Berbew.F backdoor.
Web Event Logger	<random>.exe	X	Added by the Backdoor.Berbew.D backdoor.
Web Event Logger	[8 random characters].dll	X	Added by the Backdoor.Berbew.B backdoor.

Pages: (3) 1 2 [3]

Disclaimer

It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. BleepingComputer.com will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.