O23 HijackThis Entries

Bleeping Computer

Welcome Guide Blogs Chat Help Search RSS

Welcome Guest (Log In | Create Account)

New Member? Join for free.

Have a problem and would like to ask us for help? To learn how to ask your question Click Here!

Do you have popups or other malware infecting your computer? If so, Start Here!

Are you having trouble using this site? Then you should visit the New User Orientation Center!

BleepingComputer.com -> Startup Programs Database -> O23 HijackThis Entries

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z Other

HJT: F0, F1, F2, F3 · O4 · O20 · O21 · O22 · O23

Rootkit List

· Submit a Startup

· Top Submitters

Startup Index · Newest Entries · Mozilla Search Tools · WebMaster Site Tools · Status Key
Startup Database Forum · Computer Help Forums · How to use the Startup Database

Enter the filename or keyword you would like to search for:

Advanced Search

Pages: (24) 1 [2] 3 4 ... Last »

Name	Filename	Status	Description
HIPS Firewall Helper	UmxFwHlp.exe	Y	Related to the Computer Associate's Personal Firewall.
hcnwg4u	hcnwg4u.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
cyg_win	cygwin.exe	X	A variant of the Backdoor.Sdbot family of worms and IRC backdoor Trojans.
TupInsightCaptureEngine	TupInsightService.exe	U	Added by the Spyware.TupInsight surveillance software. Spyware.TupInsight is a spyware program that monitors user activity on the Internet. If this program is installed on your computer without your knowledge you should remove it.
Video Display	Video.exe	X	A variant of the Backdoor.Sdbot family of worms and IRC backdoor Trojans.
Bluetooth Connect Support Server	btwdin.exe	X	A variant of the Backdoor.Sdbot family of worms and IRC backdoor Trojans.
Sophos Message Router	RouterNT.exe	Y	This service provides communication between various components. Its main purpose is to send and receive information between the server and managed computers. It also queues messages if the network goes down. Sophos Message Router is also used by client computers.
Sophos Agent	ManagementAgentNT.exe	Y	This manages the Sophos Anti-Virus service on the client computers. The Sophos Agent sends and receives messages to the Sophos Management Service via the Remote Management System.
SecuROM User Access Service	UAService.exe	Y	User Access Service is a SecureROM service that enables users without Windows administrator rights to have the ability to access all SecuROM features.
ksnhtr	ksnhtr.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
sywtdxaz	sywtdxaz.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
Windows NetBalance Monitor	msnbm32.exe	X	Identified as a variant of the Trojan.AVKiller.AW malware.
Microsoft Security Center Extension	msscntr32.exe	X	Identified as a variant of the Trojan.PWS.Agent.RWD password-stealing Trojan.
RosettaStoneLtdController	RosettaStoneLtdController.exe	?	Related to the Rosetta Stone language-learning software.
DirectX multi version	dxcombin.exe	X	Unknown malware.
slysom	slysom.exe	X	Added by the W32/Tilebot-KW worm and IRC backdoor.
naPrdMgr	naPrdMgr.exe	X	Added by the W32/Tilebot-KX worm and IRC backdoor.
Security Accounts	ntsasvc.exe	X	Added by the Troj/Bckdr-QNP backdoor Trojan.
gsbgqpwwfw	gsbgqpwwfw.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
Windows Host Services	explorer.exe	X	Identified as a variant of the Net-Worm.Win32.Kolabc.aeh worm. This infection should not be confused with the legitimate C:\Windows\explorer.exe file.
SoundTap Recorder	nchssvad.sys	Y	Audio driver for audio chipset from Knowles.
DXEC02	dxec02.sys	Y	Audio driver for audio chipset from Knowles.
Bluetooth Modem	btwmodem.sys	Y	Bluetooth Driver.
btwhid	btwhid.sys	Y	Bluetooth Driver.
Bluetooth Serial Driver	btserial.sys	Y	Bluetooth Driver.
APPDRV	appdrv.sys	Y	Dell network driver.
Intel(R) PROSet/Wireless SSO Service	WLKeeper.exe	Y	Service related to Intel's wireless software.
SupportSoft Sprocket Service	sprtsvc.exe	Y	Driver related to Dell's support center.
GoToAssist	g2aservice.exe	Y	Added by the GoToAssist remote support software.
Windows Management Service	dmkkn.exe	X	Added by the TROJ_ALUREON.AI Trojan.
Windows Management Service	dmnds.exe	X	Added by the Troj/DNSChan-MK dns changing Trojan.
syom	syom.exe	X	Added by the W32/Tilebot-KV backdoor worm.
Pull Service	PullService.exe	?	Added by the WebEoc program.
WLAN route service	rotr.sys	X	Identified as a variant of the Rootkit.Win32.Agent.ahf rootkit.
nzqtegh	nzqtegh.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
iuzqpaf	iuzqpaf.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
Task Scheduler	ctfmun.exe	X	Identified as a variant of the Trojan-Dropper.Agent.snu malware.
Syntek STK1150 Service	StkASv2K.exe	?	Related to productes created by Added by the Syntek.
lxcz_device	lxczcoms.exe	Y	Lexmark printer driver.
Windows NT Logon Application	winlogon.exe	X	Unknown malware. This infection should not be confused with the legitimate C:\Windows\System32\winlogon.exe file.
yzbgqap	yzbgqap.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
wzghui	wzghui.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
srvcm	srvcm.exe	X	A variant of the Backdoor.Sdbot family of worms and IRC backdoor Trojans.
Intuit Fuse Service	Intuit Fuse Service.exe	Y	Licensing component of the Intuit Proseries tax software.
VMware DHCP Service	vmnetdhcp.exe	Y	Used by Vmware guests to receive an IP address via DHCP.
VMware Agent Service	vmware-ufad.exe	?	Related to Vmware Workstation.
VMware Virtual Mount Manager Extended	vmount2.exe	Y	Vmware Workstation service used by the importer to mount images to import into a virtual machine.
MagicTuneEngine	MagicTuneEngine.exe	U	MagicTune is a monitor calibration and configuration tool for certain Samsung monitors.
pjsapdg	pjsapdg.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
zwqcplsp	zwqcplsp.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
tcpsr	tcpsr.sys	X	Identified as a variant of the Trojan.Rootkit.Agent.Ack malware.
bqzpas	bqzpas.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
Windows Shutdown Service Launcher	wssl.exe	X	A variant of the IRCBot family of worms and IRC backdoor Trojans.
MSN Starter	msnstarter.exe	X	A variant of the IRCBot family of worms and IRC backdoor Trojans.
MSN Setup	msnsetup.exe	X	A variant of the IRCBot family of worms and IRC backdoor Trojans.
MSN Connection	msncon.exe	X	A variant of the IRCBot family of worms and IRC backdoor Trojans.
MSN Applet	msnapplet.exe	X	A variant of the IRCBot family of worms and IRC backdoor Trojans.
ws2_32	ws2_32.exe	X	A variant of the Backdoor.Sdbot family of worms and IRC backdoor Trojans.
MSInfo Framework Service	MSInfnd.exe	X	Identified as a variant of the Win32/Hupigon malware.
EasyBits Magic Desktop Services for Windows NT	ezNTSvc.exe	Y	Added by the Magic Desktop parental controls software.
SpcvlsvsDrv	Spcvls.sys	X	Added by the Troj/Kbot-A Trojan.
Spcvl Srv	Spcvls.exe	X	Added by the Troj/Kbot-A Trojan.
MsSecurity Updated	winself.exe	X	Added by the TROJ_DNSCHANG.EU Trojan.
kzq5re	kzq5re.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
Intel AHCI Controller	iastor.sys	Y	Intel Advanced Host Controller Interface driver for SATA.
AFinding Service	afinding.exe	X	Identified as a variant of the Backdoor:Win32/Refpron.C malware.
WServing Service	wserving.exe	X	Identified by Kaspersky Antivirus as a variant of the Trojan-Downloader.Win32.Delf.gru malware.
Modifiet Amateur	C:\WINDOWS\system32\msl.exe	X	A variant of the IRCBot family of worms and IRC backdoor Trojans.
MNM Srv	mnmsrv.exe	X	A variant of the IRCBot family of worms and IRC backdoor Trojans.
Logon Agent	logonagt.exe	X	A variant of the IRCBot family of worms and IRC backdoor Trojans.
Defrag FAT32	dfrgfat32.exe	X	A variant of the IRCBot family of worms and IRC backdoor Trojans.
DDE Sharer	ddesharer.exe	X	A variant of the IRCBot family of worms and IRC backdoor Trojans.
WinLiveMessanger	wlliveapp.exe	X	A variant of the IRCBot family of worms and IRC backdoor Trojans.
nexkaqf	nexkaqf.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
hqiopa	hqiopa.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
uazpiq	uazpiq.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
Windows Security Center	winmgr.exe	X	A variant of the Backdoor.Sdbot family of worms and IRC backdoor Trojans.
Windows NT application	winlogon.exe	X	A variant of the Backdoor.Sdbot family of worms and IRC backdoor Trojans.
ServiceHost32	ServiceHost32.exe	X	A variant of the Backdoor.Sdbot family of worms and IRC backdoor Trojans.
Messenger Sharing USN Journal Service	usnsv.exe	X	A variant of the Backdoor.Sdbot family of worms and IRC backdoor Trojans.
zzz	zzz.sys	X	Added by the Hacktool.Rootkit rootkit.
QANDR	qandr.sys	X	Added by a variant of the Rootkit.Win32.Agent.ea rootkit Trojan.
Kernel CryptoModule	krnllds.sys	X	Added by a variant of the TR/Rootkit.Gen rootkit Trojan.
kbd	kbd.sys	X	Added by a variant of the W32/Inject worm.
fkjdfje	fkjdfje.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
ydhqzop	ydhqzop.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
zsqalpdt	zsqalpdt.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
klite	klite.sys	X	A variant of the Haxdoor rootkit.
grande48	grande48.sys	X	Added by the Troj/RKAgen-E rootkit Trojan.
DTM Protector	dprot.sys	X	A variant of the Haxdoor rootkit.
widuxngq	widuxngq.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
McAfee Security Agent Taskbar Extension.	Mctray.exe	X	A variant of the Backdoor.Sdbot family of worms and IRC backdoor Trojans.
qaszpurn	qaszpurn.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
IRAT	IRAT.mvb	X	Added by the Troj/Delf-FAH Trojan.
zeqbqwp	zeqbqwp.sys	X	Added by the Backdoor.Rustock backdoor rootkit.
MSSysInterv	winself.exe	X	Identified as a variant of the Trojan-Downloader.Win32.Small.ufd malware.
Uninterruptible Power Supply	USP.exe	X	Added by the Troj/Agent-GVT Trojan.
Infrared Monitor	lrmon.exe	X	Added by the Troj/Agent-GVT Trojan.
usbhdd	usbhdd.sys	X	Added by the Trojan.Drondog Trojan.
LPTRDC server	ctfmon.exe	X	Identified as a variant of the TrojanDownloader:Win32/Fourta.A malware. This infection should not be confused with the legitimate C:\Windows\System32\ctfmon.exe program.

Pages: (24) 1 [2] 3 4 ... Last »

Disclaimer

It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. BleepingComputer.com will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.