O21 HijackThis Entries

Bleeping Computer

Welcome Guide Blogs Chat Help Search RSS

Welcome Guest (Log In | Create Account)

New Member? Join for free.

Have a problem and would like to ask us for help? To learn how to ask your question Click Here!

Do you have popups or other malware infecting your computer? If so, Start Here!

Are you having trouble using this site? Then you should visit the New User Orientation Center!

BleepingComputer.com -> Startup Programs Database -> O21 HijackThis Entries

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z Other

HJT: F0, F1, F2, F3 · O4 · O20 · O21 · O22 · O23

Rootkit List

· Submit a Startup

· Top Submitters

Startup Index · Newest Entries · Mozilla Search Tools · WebMaster Site Tools · Status Key
Startup Database Forum · Computer Help Forums · How to use the Startup Database

Enter the filename or keyword you would like to search for:

Advanced Search

Pages: (3) 1 2 [3]

Name	Filename	Status	Description
mssmart	mssmart.dll	X	Identified as AdWare.Win32.Agent.bn.
iereport	iereport.dll	X	Identified as Adware.Agent. This infection is typically found along with other Zlob or Smitfraud infections.
tlhelp	tlhelp.dll	X	Identified as Adware.Agent. This infection is typically found along with other Zlob or Smitfraud infections.
mslm	mslm32.dll	X	Added by the W32/Feebs-BO email and P2P worm.
{3D38667C-CF08-4060-BAD3-30797B8FE363}	rdihost.dll	X	Added by the W32/IRCBot-VR worm and IRC backdoor.
rdshost	rdfhost.dll	X	Added by the W32/IrcWorm-A worm and IRC backdoor.
UrlMon	mslfmpk.dll	X	Added by the Troj/Bckdr-QES backdoor Trojan.
MSHelper	msw_p.dll	X	Added by the Trojan.Mixpel information stealing Trojan.
MSRemote	msremote.dll	X	Added by the Trojan.Mixpel information stealing Trojan.
DLMonF	msimain.dll	X	Added by the Troj/Agent-ECR Trojan.
IPicture	IPictureEx.dll	X	Added by the Troj/Agent-DZE Trojan.
odb_set	odbcmr32.dll	X	Added by the Troj/Small-DOA Trojan.
webwork	webwork.dll	X	Added by the Webwork downloader/updater DLL which is known to download and install advertising software. The adware applications Boran and Yokgug may be installed alongside or by Webwork.
msdf32.dll	msdf32.dll	X	Added by the W32/Feebs-BH email worm.
MemMan	MemMan.dll	X	Added by a variant of the Goldun.Fam Trojan. This infection also utilizes the CsdDriver.sys rootkit to hide itself.
msvcrt64.dll	msvcrt64.dll	X	Added by the Troj/Torpig-BK Trojan.
DLMon	DLMain.dll	X	Added by the Troj/Agent-DIX Trojan.
UpperHost	UpperHost.dll	X	A variant of the Goldun Trojan.
WPDShServiceObj	WPDShServiceObj.dll	Y	Windows Portable Device Shell Service Object
Battery Monitor	shlapiw32.dll	X	Added by the Troj/Delf-BPC Trojan.
mskk32.dll	mskk32.dll	X	Added by the W32/Feebs-Q worm.
msth32.dll	msth32.dll	X	Added by the W32/Feebs-O P2P worm.
msyk32.dll	msyk32.dll	X	Added by the W32/Feebs-N P2P worm.
msdy32.dll	msdy32.dll	X	Added by the W32/Feebs-M worm. This infection also creates the following files: C:\Windows\System32\msoe.exe and C:\Windows\System32\msry.exe.
WebShell	webshell.dll	X	Added by the Backdoor.Bebshell Trojan horse with backdoor capabilities.
System	q_sys.dll	X	Added by the Troj/LdPinch-DY information stealing Trojan.
mspc32.dll	mspc32.dll	X	Added by the W32/Feebs-J worm.
DBGA0EEG	Cokmgl32.dll	X	Added by the W32/Doxpar-F worm.
fldrsys	fldrsys.dll	X	Added by the Troj/Agent-QY Trojan.
<randomly chosen CLSID>	msshell.dll	X	Added by the Troj/Vipgsm-AB Trojan.
System	kmc.dll	X	Added by the Troj/Dropper-BT dropper Trojan. This infection also makes the file C:\Windows\csrss.exe.
SysTray.Exiv	<random>.dll	X	Added by the Troj/Slogger-F backdoor Trojan.
MStask	win2sys.dll	X	Added by the Troj/Dropper-BS dropper Trojan.
DBGA0EEG	<random filename>.dll	X	Added by the W32/Doxpar-D password-stealing network worm.
DBGA0EEG	Laabph32.dll	X	Added by the W32/Doxpar-E password-stealing network worm.
MStask	p2sys.dll	X	Added by the Troj/LdPinch-UE Trojan.
sysctl32	sysctl32.dll	X	Added by the Trojan.Totmau Trojan.
[not used]	mswshell.exe	X	Added by the W32.Monikey@mm mass-mailing worm. This worm attempts to gather information found on your computer.
fgsrv	fgsrv.dll	X	Added by the Troj/Fgbot-A Trojan.
WebCheck	ldr.dll	X	Added by the Troj/Radium-A backdoor Trojan.
SystemCheck2	vbsys2.dll	X	Added by the Troj/AdClick-AZ Trojan.
SysTray.Exsh	[random 8 character dll]	X	Added by the Troj/Cozdoor-D bacdoor Trojan.
Internet Explorer	[random letters].dll	X	Added by the Troj/Proxma-A proxy and backdoor Trojan.
SysTray.Excn	[random 8 character dll)	X	Added by the Troj/Cozdoor-C Trojan.
Trayz	[random filename]	X	Added by the Troj/Bdoor-JG backdoor Trojan.
SysTray	cfustums.dll	X	Added by the Troj/Small-XG dropper Trojan.
System	ssmc.dll	X	Added by the Backdoor.Berbew.R Trojan.
SvcSys	svcsys.dll	X	Added by the PWSteal.Bancos.Y password-stealing Trojan.
OLE Automation Module	Wsthunk.dll	X	Added by the Backdoor.Thunker Trojan.
Windows Development Features	Thrh1032.dll	X	Added by the Backdoor.Hitcap backdoor Trojan.
SysConnect	sysconnect.dll	X	Added by the Trojan.Sconato Trojan.
Systask	dll.dll	X	Added by the PWSteal.Ldpinch.B password-stealing Trojan.
ss	dssa.dll	X	Added by the Backdoor.Xebiz backdoor Trojan.
cetihpz	hpuiprot.dll	?	Installed by HP Printers.
g7ps	G7PS.dll	Y	Part of G7 Productivity Systems.
XmLdrLocation	nvrcr32.dll	X	Added by the Spyware.Eblaster spyware. It also installs a file into %System%rmashlex.dll.
[Random]	mswshell.dll	X	Added by the W32/Monikey-A/a> worm.
System	mcsys.dll	X	Added by the Troj/Pindrop-A Trojan.
Internet Explorer	[RANDOM NAME].dll	X	Added by the Backdoor.Berbew.T backdoor.
Web Event Logger	[8 random characters].dll	X	Added by the Backdoor.Berbew.P backdoor.
Web Event Logger	[8 random characters].dll	X	Added by the Backdoor.Berbew.M backdoor.
WebEvent Logger	[8 random characters].dll	X	Added by the Backdoor.Berbew.F backdoor.
Web Event Logger	<8 random characters>.dll	X	Added by the Backdoor.Berbew.F backdoor.
Web Event Logger	<random>.exe	X	Added by the Backdoor.Berbew.D backdoor.
Web Event Logger	[8 random characters].dll	X	Added by the Backdoor.Berbew.B backdoor.

Pages: (3) 1 2 [3]

Disclaimer

It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. BleepingComputer.com will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.