O4 HijackThis Entries

bleepingcomputer.com

Welcome Guest (Log In | Create Account)

New Member? Join for free.

BleepingComputer.com -> Startup Programs Database -> O4 HijackThis Entries

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z Other

HJT: F0, F1, F2, F3 · O4 · O20 · O21 · O22 · O23

Rootkit List · Submit a Startup · Top Submitters

Startup Index · Newest Entries · Mozilla Search Tools · WebMaster Site Tools · Status Key
Startup Database Forum · How to use the Startup Database

Enter the filename or keyword you would like to search for:

Advanced Search

Pages: (144) [1] 2 3 ... Last »

Name	Filename	Status	Description
Taskman	bncto.exe	X	Added by the Troj/Rimecud-CI Trojan.
ffdwnd	firefox.exe	X	Added by the Troj/Bredo-RJ Trojan.
KB00674719.exe	KB00674719.exe	X	Added by the Troj/Agent-UUS Trojan.
syshost32	syshost.exe	X	Added by the Troj/Agent-UTA Trojan.
gpresultl	gpresultl.exe	X	Added by the Mal/HerpBot-A Malware.
helpermob	helpermob.exe	X	Added by the Troj/DwnLdr-JQU Trojan downloader.
fastnotify	fastnotify.exe	X	Added by the Troj/DwnLdr-JQU Trojan downloader.
Mozilla client	firefox.exe	X	Added by the Troj/Agent-USU Trojan.
Home Security Solutions	HSa76.exe	X	Added by the Home Security Solutions rogue anti-spyware program.
Internet Security Guard	ISa76.exe	X	Added by the Internet Security Guard rogue anti-spyware program.
Malware Protection Center	MPa76.exe	X	Added by the Malware Protection Center rogue anti-spyware program.
Antivirus Smart Protection	ASa76.exe	X	Added by the Antivirus Smart Protection rogue anti-spyware program.
Smart Anti-Malware Protection	SAa76.exe	X	Added by the Smart Anti-Malware Protection rogue.
InetAccelerator	InetAccelerator.exe	X	Added by the Troj/Ransirac-A Trojan.
Microsoft Firevall Engine	mdm.exe	X	Added by the W32/Pushbot-R worm.
ProtectOn	ProtectOn.exe	X	Added by the ProtectOn rogue anti-spyware program.
userlog	userlog.exe	X	Added by the Troj/Luiha-AP Trojan.
sck.exe	sck.exe	X	Added by the Troj/VBInjec-DV Trojan.
zaber0	zaberg.exe	X	Added by the W32/SillyFDC-HC worm.
SrxRwxyu	srxrwxyu.exe	X	Added by the Troj/Agent-URM Trojan.
RegSvc32	svchost.exe	X	Added by the Mal/VB-ABH malware. This infection should not be confused with the legitimate C:\Windows\System32\svchost.exe file.
Internet Security 2012	isecurity.exe	X	Added by the Internet Security 2012 rogue anti-spyware program.
RDSound	NokiaDriveUpdate.exe	X	Added by the Troj/Agent-UOU Trojan.
apocalyps32	apocalyps32.exe	X	Added by the Troj/Agent-UNK Trojan.
HDAudDeck	VDeck.exe	U	Control panel for audio codecs from Via Technology.
HControlUser	HControlUser.exe	U	A utility that enables the Function (FN) key shortcuts on Asus laptops.
iolo Startup	ioloLManager.exe	?	Related to IOBit programs, but am unsure as to what it does.
APSDaemon	APSDaemon.exe	U	Part of Apple iTunes that allows you to wirelessly sync your iPhone, iTouch, or iPad.
ATKMEDIA	DMedia.exe	N	Asus software that is commonly installed on their laptops. This software allows Windows Media Center to be opened when you press the multimedia keys on the laptop.
Lexmark 5000 Series	fm3032.exe	Y	FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software. Incorporated into software by Lexmark, MCI, Lotus, My Software, Broderbund, Traffic Software and many others.
Akamai NetSession Interface	netsession_win.exe	U	Added by the Akamai NetSession downloader. This is a service launched by the legitimate C:\Windows\System32\svchost.exe program. The actual executable file for the Akamai NetSession Interface service is %ProgramFiles%\common files\akamai\netsession_win_b427739.dll.
Mopy Points Collector	GETPOINT.EXE	U	Part of the MOPy Fish freeware cyberpet software.
sbthostyazzz	ctxmon.exe	X	Added by the W32/Yaz-A worm.
System Update	svchost.exe	X	Added by the Troj/Malex-P Trojan. Please note that this infection should not be confused with the legitimate file located at C:\Windows\System32\svchost.exe.
NvCplDaemonTool	qloadAC.dll	X	Added by the Troj/Sinowal-AS Trojan. Please note that C:\Windows\System32\rundll32.exe is a legitimate program and should not be deleted.
WinUpdaterstd	svchost.exe	X	Added by the Troj/VBObfus-E Trojan. This infection should not be confused with the legitimate C:\Windows\System32\svchost.exe file.
MUent	MUsia.exe	X	Added by the W32/Taterf-B worm.
winstep	reader.exe	X	Added by the Troj/Autoit-PC Trojan.
QQExtrenal	QQExtrenal.exe	X	Unknown malware.
RXY Start	RXY.exe	U	Added by the Ardamax Keylogger surveillance software. If this software is found on your computer without your knowledge, then you should remove it.
Driver Control Manager v7.7	sesnaesttoo.exe	X	Added by the Troj/IRCbot-AJL worm and IRC backdoor.
Security Monitor 2012 Security	securitymanager.exe	X	Added by the Security Monitor 2012 rogue anti-spyware program.
Security Monitor	Security Monitor.exe	X	Added by the Security Monitor 2012 rogue anti-spyware program.
onestep	onestepe.exe	X	Added by the Mal/Uddo-C malware.
serjfsd	fsrjsdks.exe	X	Added by the Mal/VBCheMan-A malware.
Upfsfm	Upfsfm.exe	X	Added by the Troj/Mdrop-DVU Trojan.
ActiveX Update	AxUpdateMS.exe	X	Added by the Troj/Banker-FIX online banking Trojan.
RDSound	Huawei3g.exe	X	Added by the Troj/Luiha-AD Trojan.
Microsoft Driver Setup	psreg.exe	X	Added by the W32/VBMato-C worm.
Service Noits	ranga.exe	X	Added by the Mal/Boom-A malware.
bootstat	csrss.exe	X	Added by the Troj/Swysin-Gen Trojan.
Google Update	bot.exe	X	Added by the Troj/Agent-UDF Trojan.
Microsoft DLL Registration	regsrv64.exe	X	Added by the Troj/VBKrypt-AL Trojan.
unit	unit.exe	X	Unknown malware.
Intel	csrss.exe	X	Unknown malware.
windows32	smss.exe	X	Identified by Kaspersky Antivirus as a variant of the Trojan.Win32.Autoit.aqh malware.
A40.exe	A40.exe	X	Unknown malware.
WindowsUpdate	winupdate.exe.exe	X	Added by the BKDR_EXDEPH.A backdoor.
Windows	winlogons.exe	X	Added by the W32/AutoIt-OQ worm.
McUpdate	Update.exe	X	Added by the Troj/Agent-TUH Trojan.
vbc	wdt.exe	X	Added by the Mal/MsilDyn-L malware.
*resbootdev.exe	resbootdev.exe	X	Added by the Troj/Agent-TTQ Trojan. This program will start in Windows Safe Mode as well.
*rescatacct.exe	rescatacct.exe	X	Added by the Troj/FakeAV-EQX Trojan. Please note that this executable will start in Safe Mode as well.
MicrosoftOnlineOnline	MicrosoftOnlineOnline.dll	X	Added by the CXmal/Tracur-C malware. Please note that C:\Windows\System32\rundll32.exe is a legitimate program and should not be deleted.
Windows Monitor	Winsys32.exe	X	Unknown malware.
Genuine Windows Monitor	msgenuine.exe	X	Identified by Sophos as a variant of the Mal/Koobface-G malware.
<random>	svhostu.exe	X	Added by the Cloud Protection rogue anti-spyware program.
CLCKR	nvvsvc.exe	X	Added by the Troj/Agent-TQK Trojan.
Safer Networking Limited	csrss.exe	X	Identified by ESET Nod32 as a variant of the Trojan.Generic.KD.373098 malware.
wificompressor	fsrun.exe	X	Added by the Troj/Banker-FHY Trojan.
privacynS	privacynU.exe	X	Added by the Troj/FakeAv-EOE Trojan.
volmgr	volmgr.exe	X	Added by the Troj/Agent-TPO Trojan.
Windows Generic Host Process	uvchost.exe	X	Added by the Troj/VB-FPI Trojan.
Ev~NeN^e.eXe	ev~nen^e.exe	X	Identifed by Kaspersky antivirus as a variant of the Virus.Win32.Sality.bh malware.
Driver Control Manager v8.1	sesdessetri.exe	X	Added by the Troj/ZXC-Q Trojan.
Paint.exe	Paint.exe	X	Added by the W32.Tapin worm. W32.Tapin is a worm that spreads by copying itself to network shares. It also downloads potentially malicious files on to the compromised computer.
OpenCloud Security	<random chars>.exe	X	Added by the OpenCloud Security rogue anti-spyware program.
nwizs	nwizs.exe	X	Added by the W32.Queshare worm. W32.Queshare is a worm that spreads through removable drives and instant messaging shared folders. It may also download files and steal information from the compromised computer.
Windows NT Login Application	winlogons.exe	X	Added by the Troj/BitCDl-A Trojan.
stldr	stldr1.exe	X	Identified by Kaspersky antivirus as a variant of the Trojan.Win32.Jorik.Koobface.bp malware.
sv□host	msiregnv.exe	X	Added by the Troj/Agent-TJL Trojan.
BSBALL.exe	BSBALL.exe	X	Added by the Mal/VB-ZS malware.
recinfo<random numbers 1-3 digits>	RecInfo.exe	N	Preinstalled on Fujistu computers, this program reminds the user to create a recovery CD/DVD.
recinfo	RecInfo.exe	N	Preinstalled on Fujistu computers, this program reminds the user to create a recovery CD/DVD.
sys32.exe	sys32.exe	X	Identified by Ikarus as a variant of the Email-Worm.Win32.Generic malware.
VMware, Inc.	csrss.exe	X	Unknown malware. This infection should not be confused with the legitimate C:\Windows\System32\csrss.exe file.
WinXPService	DriverUpdate.exe	X	Unidentified worm and IRC backdoor.
veuix	veuix.exe	X	Identified by Kaspersky Antivirus as a variant of the Worm.Win32.VBNA.aitt malware.
Darkness	surv86.exe	X	Added by the Trojan.Darkbot Trojan. Trojan.Darkbot is a Trojan horse that performs denial of service (DoS) attacks.
bbaka<or baka><one or two digit number>	bbaka<or baka><one or two digit number>.exe	X	Malware file added by the DOWNLOADER-CJD TROJAN.
DT Task	DTHtml.exe	U	This file is the system tray icon of a program which is preinstalled on many computers, is in many monitor software packages, and is involved in adjusting monitor display settings by using a mouse instead of the monitor buttons. EzTune, MagicTune, ImageTune, and forteManager are just a few of the software products this file is found in.
ImageTune	DTHtml.exe	U	This file is the system tray icon of a program which is preinstalled on many computers, is in many monitor software packages, and is involved in adjusting monitor display settings by using a mouse instead of the monitor buttons. EzTune, MagicTune, ImageTune, and forteManager are just a few of the software products this file is found in.
forteManager	DTHtml.exe	U	This file is the system tray icon of a program which is preinstalled on many computers, is in many monitor software packages, and is involved in adjusting monitor display settings by using a mouse instead of the monitor buttons. EzTune, MagicTune, ImageTune, and forteManager are just a few of the software products this file is found in.
MagicTune	DTHtml.exe	U	This file is the system tray icon of a program which is preinstalled on many computers, is in many monitor software packages, and is involved in adjusting monitor display settings by using a mouse instead of the monitor buttons. EzTune, MagicTune, ImageTune, and forteManager are just a few of the software products this file is found in.
DT ACR	DTHtml.exe	U	This file is the system tray icon of a program which is preinstalled on many computers, is in many monitor software packages, and is involved in adjusting monitor display settings by using a mouse instead of the monitor buttons. EzTune, MagicTune, ImageTune, and forteManager are just a few of the software products this file is found in.
usxxxxxxxx.exe	usxxxxxxxx.exe	X	Added by the TSPY_SPYEYE.EXEI Trojan.
toolbar_eula_launcher	EULALauncher.exe	N	Installed with Google Desktop, this file launches the Google End User License Agreement.
EULA	EULALauncher.exe	N	Authored by Fujitsu-Siemens, this file appears to be installed with as an yet undetermined Fujitsu product, possibly preinstalled on certain Fujitsu computers. This flle launches a license agreement.
QuickShock	AvMsUpd.exe	X	Identified by Kaspersky Antivirus as a variant of the Trojan-Spy.Win32.Delf.giz malware.
SevenUp	sevenup.exe	X	Identified as a variant of the Trojan-Downloader.Win32.Delf malware.

Pages: (144) [1] 2 3 ... Last »

Disclaimer

It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. BleepingComputer.com will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.