Windows Startup Item Database

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
N	ClipMate5x	ClipMt5x.exe	"Clip Mate 5.x by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs"
N	Clipmate6	CLIPMT60.EXE	"Clip Mate 6 by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs"
N	ClipMate7	ClipMate.exe	"Clip Mate 7 by Thornsoft - utility that allows you to store more than one item in the clipboard"
N	Clipomatic	Clipomatic.exe	"Mike Lin's Clipomatic is a clipboard cache program - it remembers what was copied to the clipboard even after new data is copied
N	Clipsrv	Clipsrv.exe	"Supports Windows XP ClipBook Viewer
X	ClipSrv	clipserv.exe	"Added by the SDBOT-AAV and SDBOT-AFE WORMS!"
X	ClipSrv	CLIPBRD3D.EXE	"Added by the MOFEI-D WORM!"
N	ClipTrak	ClipTrak.exe	"ClipTrakker	ClipTrakker.exe	"Cliptrakker - clipboard extender"
?	CLISTART	CLIStart.exe	"Associated with ATI's Catalyst� Control Center for their graphics cards. What does it do and is it required?"
U	CLMFrontPanel	clmpanel.exe	"System tray status/display/configuration utility for a number of modems. Can be disabled by right-clicking on the tray icon. If disabled
?	clnwall	"rundll.exe setupx.dll	InstallHinfSection ..delwall.inf"
X	clock	[various filenames]	"LiveChat Adware - known file names include: mssetup.exe
X	Clock Manager	amsngr.exe	"Added by the SDBOT-XM TROJAN!"
X	ClockSync	Sync.exe	"ClockSync - synchronizes your system clock with an internet time server. It's by WhenU
U	ClockWise	CLOCKWISE.EXE	"ClockWise - produced by R J Software - a time utility. It is a schedueler not only for dates
U	ClocX	ClocX.exe	"ClocX - places a clock on the desktop that can be moved and then changed into a calendar plus you can set alarms etc�"
U	CloneCD	CloneCDTray.exe	"System tray for CloneCD - the only useful option is "Hide CDR Media" only available via this tray. Has additional unknown functions in later versions"
U	CloneCDElbyCDFL	ElbyCheck.exe	"From Elaborate Bytes who make CloneCD - monitors the installed filters of CD-ROMs/DVD-ROMs. Note - under Win2K removing this from startup causes the CD drive in the computer to not be recognized in the OS and after rechecking it prompts that the driver has been corrupted and asks you to restart the computer to fix it"
U	CloneCDTray	CloneCDTray.exe	"System tray for CloneCD - the only useful option is "Hide CDR Media" only available via this tray. Has additional unknown functions in later versions"
?	Clotusorgreg0	prtStart.exe Orgprt.exe	"Lotus SmartSuite related. In a LotusOrgReg folder. Unclear what exactly it does?"
X	Clre	mmdc.exe	"Added by the PURSCAN-AI TROJAN!"
X	ClrSchLoader	[path to file]	"ClearSearch adware"
X	CLSID	com.exe	Adult content dialler
X	CLSID	dll.exe	Adult content dialler
X	CLSID	msgplus.exe	Adult content dialler
X	CLSID	plugin.exe	Adult content dialler
X	CLSID	sed.exe	Adult content dialler
X	CLSID	msgplus.exe	Premium rate adult content dialer. Note - this is NOT the MSN Messenger 'MessengerPlus' extension
?	CM-SmWizard	SmWizard.exe	"SmartWizard MFC Application - associated with C-Media who produce audio chipsets commonly used for on-board sound on motherboards. What does it do and is it required?"
U	cma	cma.exe	"DeskSite CMA siftware - "retrieves new content from the DeskSite Data Center""
X	CMAPP	cmappclient.exe	"CasClient adware - also detected as the CMAPP TROJAN!"
N	Cmaudio	"Rundll32 cmicnfg.cpl	CMICtrlWnd"
X	Cmd	cmd32.exe	"Added by the TANKED WORM!"
X	cmd32	configs.exe	"Hijacker
X	cmdcon	cmdcon.exe	"Added by the CRYPTER.A TROJAN!"
X	CME	cme.exe	"Part of Gator advertising spyware - see here for removal instructions"
X	CmeSYS	CMEsys.exe	"Part of Gator advertising spyware - see here for removal instructions"
X	CmeUPD	CMEupd.exe	"Part of Gator advertising spyware - see here for removal instructions"
X	CMFibula	CMFibula.exe	"CASClient adware"
N	CmFlywaveName	CmFlywav.exe	"Driver for Linksys Wireless-G Music Bridge"
?	CMGrdian	CMGrdian.exe	"One of the McAfee shared components. What does it do and is it required?"
X	CMMan	CMMan.exe	"Added by the CMAPP TROJAN!"
X	Cmmon32Sys	cmmon32.exe	Added by the SMALL.CL TROJAN!
U	CmPCIaudio	"RunDll32 CMICNFG3.CPL	CMICtrlWnd"
U	CMPDPSRV	CMPDPSRV.EXE	"Printer Driver Plus from ViewAhead Technology (formerly DeviceGuys
X	Cmpnt	Devices2.exe	"Added by the TOMPAI-D TROJAN!"
X	Cmpnt	mainsv.exe	"Added by the TOMPAI-C TROJAN!"
X	cmrss	cmrss.exe	"Added by the DELF.DU TROJAN!"
X	cmrss	crmss.exe	"Added by the DLOADER-EK TROJAN!"
X	cmrss	[path to trojan]	"Added by the DLOADER-QQ TROJAN!"
X	cmrst	cmrst.exe	"Added by the BANCOS.S TROJAN!"
X	cmrst	cmrst.scr	"Added by the DLOADER-FP TROJAN!"
X	cms	iserver.exe	"Added by the DLOADER-WK TROJAN!"
U	CMSETTINGS	ctmn.exe	"Part of NetNanny cmsound	vcpdll.exe	"Added by the TCXMEDI-D downloader TROJAN!"
X	cmsound	vcsystem.exe	"Added by the TCXMEDI-D downloader TROJAN!"
X	cmss	system.exe	"Added by a variant of the RBOT WORM!"
X	cmssapp	iexplore_.exe	"Added by the BANCBAN-CQ TROJAN!"
X	cmssapp	iexplore.exe	"Added by the BANCBAN-GF TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder"
X	cmssSystemProcess	csmss.exe	"Added by the AGENT-CO TROJAN!"
X	cmssSystemProcess	mcsmss.exe	"Added by a variant of the AGENT.EI TROJAN!"
X	cmssSystemProcess	csms.exe	"Added by the AGENT-Y TROJAN!"
X	CMSystem	CMSystem.exe	"CASClient adware"
X	cmt101	cmt101.exe	"Added by a variant of the CRYPTER.C TROJAN!"
X	cmx32	cmx32.exe	"Added by the GEMA.D TROJAN!"
X	Cn323	cnfrm33.exe	"Added by the MIMAIL.G WORM!"
X	CNBABE	CNBABE.EXE	Appears to be spyware added by KAZAA (and maybe others) that displays pop-up ads whilst you're browsing
N	cnet	kontiki.exe	"Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops"
X	Cnfrm32	cnfrm.exe	"Added by the MIMAIL.D WORM!"
X	CnsMax	Internat.exe	"Added by the POINTEX TROJAN! Note - the real internat.exe resides in %windir%system (where %windir% is the Windows directory - C:Windows or C:Winnt) whereas this version resides in %windir%"
X	CnsMin	"Rundll32.exe CNSMIN.DLL	Rundll32"
Y	CnxAdslL	CnxAdslL.exe	"DLink
N	CnxDslTaskBar	CnxDslTb.exe	Connexant DSL Taskbar as used on Acess Runner and Samsung AHT-E310 ADSL modems
U	Codename Dashboard	dashboard.exe	"Codename: Dashboard - "an application that resides at the side of your screen. Built on the Microsoft .NET Framework
X	cof.updit	[random filename]	"Added by a variant of the SDBOT WORM!"
U	CognizanceTS	"rundll32.exe [path] AsTsVcc.dll	RegisterModule"
X	Coldlife -icmp	Systray.exe	"Added by the FLOOD.AV TROJAN! Note - this is not the legitimate systray.exe process"
U	coloreal	coloreal.exe	"Makes colours sharper and brighter
N	Colorific Control Panel	Hgcctl95.exe	From E_Color. Colorific delivers accurate gamma and color temperature across your entire system - monitor to printer and digital camera to monitor
X	COM Service	mscom32.com	"Added by the BEASTY.H TROJAN!"
X	COM Service	msynvr.com	"Added by the BEASTY.G TROJAN!"
X	COM Service	msjclh.com	"Added by the BEASTY.E TROJAN!"
X	COM Service	msdrce.com	"Added by the BEASTY.I TROJAN!"
X	COM Service	msflyx.com	"Added by the BEASTDO-O TROJAN!"
X	COM+ Event System	DRWTSN16.EXE	"Added by a variant of the LOVGATE WORM!"
X	COM+ EventSystem Services	ECSERVER.EXE	"Added by a variant of the SDBOT WORM!"
X	Com+ Sys	csrs.exe	"Added by the FORBOT-BT WORM!"
X	COM+ System Applications	lsas.exe	"Added by the AGOBOT.SE WORM!"
X	COM++ System	exploier.exe	"Added by a variant of the LOVGATE WORM!"
X	COM++ System	suchost.exe	"Added by a variant of the LOVGATE WORM!"
X	COM++ System	svchost.exe...	"Added by a variant of the LOVGATE WORM!"
N	COM-IP	COMIP.EXE	COM-IP Virtual Modem Driver (COM-IP Creates a Fake Serial Port that allows you to use older DOS Based Communications Programs over Telnet. Type atdt host.domain.com instead of atdt 5551212)
U	ComAgent	ComAgent.exe	"ComAgent - MDaemon's instant messaging client"
X	combo.exe	combo.exe	"Added by the CHIMO-C TROJAN!"
X	combop.exe	combop.exe	"Added by the BOWFEED-A TROJAN!"
X	Comcast Network	ribiva.exe	"Added by an IRC TROJAN variant!"
X	ComcastSUPPORT	tgkill.exe	Comcast (the cable folks who are replacing @home in some parts of the USA) have struck a deal with Tioga to provide an "enhanced" support and self-repairing tool. This is "beta" at present and was made available to download by mistake at present. Remove via Start -> Settings -> Add/Remove Programs
X	COMCFG	comcfg.exe	"Added by the TOADCOM.A TROJAN!"
X	comctl32	comctl32.exe	"Adware - recognized by Kaspersky antivirus as TrojanDownloader.Win32.Agent.am"
U	COMDRV32	svdhost.exe	"Orvell Monitoring 2003 - surveillance software that creates records of everything people do on a computer
U	Comm Driver	commh32.exe	"G Data ""PC Spion"". PC monitoring and surveilling software
X	Command	system.exe	"Added by the GATECRASH.A or GATECRASH.B TROJANS!"
X	Command	Gotit.exe	"Added by the TITOG WORM!"
X	COMMAND	command.exe	"Added by the QQPASS.E TROJAN!"
X	command	javaw.exe	"Added by the AGOBOT-LG WORM!"
X	Command Prompt32	CmdPrompt32.pif	"Added by the ASSIRAL.B WORM!"
X	command32	command32.exe	"Added by the LINEADI-A TROJAN!"
N	CommCtr	commctr.exe	"""Net2Phone CommCenter is the latest in Internet voice technology allowing you to place calls easily all over the world right from your PC!"". Available via Start -> Programs"
U	Comodo Firewall	CPF.exe	"Comodo Firewall"
U	Compaq Alerter	CPQAlert.exe	"Compaq's Insight Manager Agent - a tool that allows for "fault
N	Compaq Computer Corp SCCenter Module	SCCENTER.EXE	For Compaq PC's. Part of Backweb
?	Compaq Computer Security	"Rundll32.exe SECURE32.CPL	Service"
N	Compaq Connections	COMPAQ~1.EXE	"See here - ""messaging service that automatically sends you support information
N	Compaq Connections	BackWeb-1940576.exe	"See here - ""messaging service that automatically sends you support information
N	Compaq DMI	cpqdmi.exe	Compaq version of the Desktop Management Interface
X	Compaq Drivers	F1rewalls.exe	"Added by the SDBOT-WD WORM!"
N	Compaq Internet Setup	inetwizard.exe	For Compaq PC's. Runs Compaq internet setup wizard and offers you to signup from ISP list
X	Compaq Jes Drivers	winjes.exe	"Added by the SDBOT-XR WORM!"
U	Compaq Knowledge Center	silent.exe & matcli.exe	""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	Compaq Message Server	COMPAQ-RBA.EXE	"Applies to the CPQBootPerfDB entry as well. These files generate some kind of server or servlet that attempts to connect with Compaq online. They are like Trojans
U	Compaq PK Daemon	cpqkl.exe	For Compaq laptops for programming user configurable keys. Not required unless you use them
X	Compaq Print Fax	cpqa1000.exe	"Added by the SDBOT.BCV WORM! Please take note of the difference between the legitimate Compaq Fax Utility Name (A1000 Settings Utility) and the name (Compaq Print Fax) used by this worm"
X	Compaq Service Drivers	systeminfos.exe	"Added by the SDBOT-XC WORM!"
X	Compaq Service Drivers	compq.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	navapqwa.exe	"Added by the SDBOT.BBQ WORM!"
X	Compaq Service Drivers	amsn.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	compqs.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	msnt.exe	"Added by the SDBOT.CQL WORM!"
X	Compaq Service Drivers	NtKernelSystem.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	wincmd.exe	"Added by the RBOT.ATV WORM!"
X	Compaq Service Drivers	wind32.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	winmsn.exe	"Added by a variant of the SDBOT WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.