Windows Startup Item Database

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
N	CriticalUpdate	Wucrtupd.exe	"MS Windows Critical Update Notification. If you want to keep Windows up-to-date
X	CriticalUpdate	wucrtupd.exe	"Added by the NOALA.B WORM! Note - this file is located in the Windows or Winnt folder
X	Crnsava	scrnsave.pif	"Added by the SDBOT-ZV WORM!"
X	cronos	MARCO!.SCR	"Added by the OPASERV.G WORM!"
X	CrossMenu	CrossMenu	Toshiba CrossMenu Utility - allows the user to create their own menus
X	crs	crs.exe	"Added by the AGOBOT-TJ WORM!"
X	Crusty	dmcpl.exe	"Added by the RUSTY WORM!"
X	cryptdlg	cryptdlg.exe	Added by an unidentified TROJAN!
X	Cryptographic Service	*****.exe [ = random char]	"Added by the KORGO.W or KORGO.X or KORGO.AB WORMS!"
?	Crystal 3D Audio Control	CWD3DSND.EXE	"Crystal 3D Audio sound driver. Is it required?"
N	csaRem	spqmdmui.exe	Compaq modem country selection
Y	CSAV_CheckViruses	vchk.exe	"Command Antivirus related"
U	csc	csc.exe	Command line compiler for Microsoft C# it gets installed with the .NET SDK
X	CSCRS Value	cscrs.exe	"Added by the RBOT-AAA WORM!"
X	CSCRS Value Check	MsPMSPSd.exe	"Added by a variant of the SDBOT WORM!"
U	CSINJECT.EXE	CSINJECT.EXE	"Part of Quarterdeck/Norton CleanSweep. ""Csinject must be loaded in order for Smart Sweep to automatically monitor installations and properly track registry changes"""
X	csm Win Updates	csm.exe	"Added by the ZOTOB.B WORM!"
X	csoftok	softok.exe	"Added by the QQPASS.G TROJAN!"
X	csrs	csrs.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	csrsc	csrsc.exe	"Added by an unidentified VIRUS
X	CSRSS	CSRSS.EXE	"Search page hijacker
X	Csrss	csrss.exe	"Added by the CHOD WORM! Note - this is not the legitimate csrss.exe process
X	csrss	csrss.exe	"Added by the KEYLOG-AQ KEYLOGGER! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Windows or Winnt folder"
X	csrss	csrss.exe	"Added by the CHODE-J WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a random subfolder"
X	csrss	msmsgs.exe	"Added by the CHODE-J WORM!"
X	csrss	nwiz.exe	"Added by the CHODE-J WORM!"
U	csrss	csrss.exe	"Added by the Spyware.BeyondKeylog surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Program Files/Supremtec folder"
X	CSRSS Loader	csrsss.exe	"Added by the AGOBOT.TX WORM!"
X	csrss.exe	csrss.exe	"Added by the DALBUG WORM! Note - this is not the legitimate csrss.exe process which is always located in the WinntSystem32 or WindowsSystem32 folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	csrssLevel4	csrss.exe	"Unidentified malware. Note - this file is placed in a C:WindowsSystemLevel4 folder
X	CSRSSU	CSRSSU.exe	"CoolWebSearch parasite variant - hijacking to Slawsearch.com. Also detected as the CWS-E TROJAN!"
X	CSRSSW	CSRSSW.EXE	"Added by the CWS-F TROJAN!"
X	CSRSWIN	[trojan filename]	"Added by the WINSHELL.50 TROJAN!"
X	CSRSX	[trojan filename]	"Added by the WINSHELL.50.B TROJAN!"
U	CSS Server	CSSServer.exe	"Added by the ComSpySysSvr surveillance software. Uninstall this software unless you put it there yourself"
U	cssauth	cssauth.exe	Related to IBM ThinkVantage Client Security Solution
Y	CSScheduleCheck	SCHWIZEX.EXE	"Part of ConfigSafe - lets you identify changes to the registry
X	cssrs	cssrs.exe	"Added by the BANCBAN-DW TROJAN!"
X	csss	Csss.exe	"Added by the BALICK TROJAN!"
U	CSS_Central	CSS_1631.EXE	"CSS Communication Agent (95 Host) from Command Software Systems ""CSS Central� provides administrators with a powerfully proactive tool to effectively manage and maintain the anti-virus strategy from a centralized console""."
X	CSV10P1	CSP001.exe	"ClearSearch adware"
X	CSV10P70	CSv10P070.exe	"ClearSearch adware"
X	CSV7P26	CSV7P26.exe	"ClearSearch adware"
X	CSV7P70	CSV7P070.exe	"ClearSearch adware"
X	CSV7P91	CSV7P91.exe	"ClearSearch adware"
U	csvdea	csvdea.exe	"Added by the SpyArsenalLog surveillance software. Uninstall this software unless you put it there yourself"
Y	ct	ct.exe	ct.exe is a file is for the HP Learning Adventure software and if you use this software it is required to run it
X	CT Control Settings	CTSVCCD.EXE	"Added by the RBOT-YS WORM!"
N	CTAVTray	CTAvTray.exe	For Creative Soundblaster Live! series soundcards. Plays the EAX animation on start-up and adds a System Tray icon for it. Available via AudioHQ
U	CTCMonitor	CTCMonitor.exe	"Click-to-Convert - document-to-HTML or doc-to-PDF converter. Only required if you are going to use the File -> Print method of using Click-to-Convert. If converting directly from MS Office
N	CTDVDDet	CTDVDDet.exe	"Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player
N	CTDVDDet	CTDetect.exe	"Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player
X	ctflog manager	ctflog.exe	"Added by the DONBOMB.A TROJAN!"
X	CTFM0N.exe	CTFM0N.exe	"Added by the STARTPAGE.P TROJAN!"
U	ctfmon	ctfmon.exe	"CTFMon is involved with the language/alternative input services in Office XP. Ctfmon.exe will continue to put itself back into MSConfig when you run the Office XP apps as long as the Text Services and Speech applets in the Control Panel are enabled. Not required if you don't need these features. For more info on ctfmon see here. Ctfmon can be disabled from Control Panel
X	ctfmon	taskmgr32.exe [ = number]	"Added by the SOWSAT.B WORM!"
X	ctfmon	cftmon.exe	"Added by the DELIVE-A TROJAN! Note - this file is found in C:Windows or C:Winnt and is not the valid MS Office file of the same name (see here)"
X	ctfmon	mIRC.dll	"Added by the DELBOT-E TROJAN!"
X	ctfmon	WinConst.exe	"Added by the ASSASIN-G TROJAN!"
U	CTFMon	ctfmon.exe	"Family Keylogger is a program that lets you record to a special file and then view all the keystrokes typed by everyone using your computer. Keystroke logger/monitoring program - remove unless you installed it yourself! Found in the SystemCTF (9x/Me) or System32CTF (NT/2K/XP) folder"
X	ctfmon	msnmsgr.exe	"Added by the JV TROJAN!"
X	Ctfmon.exe	ctfmon32.exe	"CoolWebSearch Ctfmon32 parasite variant"
X	ctfmon.exe	ctfmon.exe	"Added by the RAIDYS TROJAN! Note - this should not be confused with the valid Office XP file
X	ctfmon.exe	msupdate32.exe	"Spy Sheriff/SpywareNO malware
U	ctfmon.exe	ctfmon.exe	"CTFMon is involved with the language/alternative input services in Office XP. Ctfmon.exe will continue to put itself back into MSConfig when you run the Office XP apps as long as the Text Services and Speech applets in the Control Panel are enabled. Not required if you don't need these features. For more info on ctfmon see here. Ctfmon can be disabled from Control Panel
X	CTFMON32	CTFMON32.EXE	"CoolWebSearch Ctfmon32 parasite variant - also detected as the CWS-E TROJAN!"
X	CTFMONSS	CTFMONSS.EXE	"Added by the CWS-F TROJAN!"
X	ctfnom	rundIl32.exe	"Added by the LEGMIR-AW TROJAN!"
X	ctfnom.exe	SVOHOST.exe	"Added by the DIGIDOR-A TROJAN!"
X	ctfnom.exe	OSRSS.exe	"Added by the DLOADER-UQ TROJAN!"
U	CTHELPER	CTHELPER.EXE	"CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers
X	CTHelper	cthelper.exe	"Added by the RBOT-XB WORM! Note - do not confuse with the Creative application of the same name described here"
X	CTime	[path to trojan]	"Added by the HTTPDOS TROJAN!"
X	CTin10	CTin10.exe	"Added by the BANCOS.E TROJAN!"
U	CTNMRUN	ctnmrun.exe	Detects the Creative NOMAD jukebox/MP3 player at the time it is attached to USB and starts the needed application (Creative PlayCentre 2) that you use to copy MP3 files to and from it. This is required if you want PlayCentre 2 to take control of the NOMAD once connected
?	CTPDPSRV	CTPDPSRV.EXE	"Printer driver (in the WINDOWSSystem32spoolDRIVERSW32X86 folder). Is it required?"
N	CTPerformanceUtility	CTPowUti.exe	"Related to Creative PowerSysTrayApp. This program is a non-essential process
N	CTRegRun	CTRegRun.exe	For Creative Soundblaster Live! series soundcards. Reminds you to register your card with Creative
U	CtrlVol	CtrlVol.exe	"Volume control key on Acer
N	CTStartup	CTEaxSpl.exe	Splash screen with sound on every boot up. Installed with a Sound Blaster Audigy soundcard
U	CTsysVol	CTSYSVOL.exe	Creative sound card volume controls
?	cttdpsrv	cttdpsrv.exe	"??"
X	CTUpdate	ctupdclt.exe	"Added by the RBOT-ABG WORM!"
N	CTxfiHlp	CTXFIHLP.EXE	Added by the installation of a Creative Labs X-Fi sound card. This particular process provides the help functionality for your card
N	CTXFIREG	CTxfiReg.exe	Creative Labs sound card driver related. It appears that it isn't required and maybe registration related
X	Ctykd	[path to file]	"SMALL.SN spyware"
X	CU1	VCClient.exe	Associated with the Surf Sidekick adware and should be removed
X	CU2	VCMain.exe	Associated with the Surf Sidekick adware and should be removed
Y	cuagentExe	Cuagent.exe	"Command Antivirus related"
X	cuo	cuo.exe	"Added by the BUGBEAR.A WORM!"
X	Current Security Config	csecure.exe	"Added by the RBOT-AMO WORM!"
N	cursor	Screendragon_VS_Taskbar.exe	"ScreenDragon video player"
N	CursorXP	CursorXP.exe	"CursorXP from Stardock - tool for creating mouse cursors"
U	Customizer2000	logon.exe	"Automatic logon feature of Customizer 2000 - ""a special utility which is designed to optimize Win9x/ME performance. The program lets you explore the many hidden settings in Windows
N	CuteMX	CuteMX.EXE	File sharing utility
X	cvmonitor.exe	cvmonitor.exe	"Added by the SDBOT.BV WORM!"
Y	CVPND	cvpnd.exe	Sub-system used by Cisco VPN client for making a connection to a remote IPSec server
U	CW	cw4.exe	"Chat Watch ""is a monitoring and logging software for online chat and instant messaging programs"""
U	CWatch	cw.exe	"ChatWatch - chat monitoring tool"
N	cwbckver	cwbckver.exe	"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
N	cwbinhlp	cwbinhlp.exe	"Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
N	cwbsvstr	cwbsvstr.exe	"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
?	cwbwlwiz	cwbwlwiz.exe	"Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
?	Cwcdschk.exe	Cwcdschk.exe	"IBM Thinkpad related?"
U	cwcptray	cwcptray.exe	"Related to ContentWatch Parental Control internet filter"
U	cwupdate	cwupdate.exe	"ContentProtect from ContentWatch - internet filter"
N	CXMon	Hpi_Monitor.exe	Autodetects when a HP camera is attached to the computer and launches the "HP Photoimaging Software". Available via Start -> Programs
N	Cyber	cyberchk.exe	"Part of Belkins ""Multimedia Cleaning Kit"" and is
U	Cyber Trio	showmode.exe	"From G-Tek Technologies. Allows you to set the PC in one of three modes
U	Cyber-Defender 2003	uwcdsvr.exe	"Cyber Defender 2003"
X	cyberfree.exe	***.dat [ = random char]	Unidentified adware
U	CyberLat Ram Cleaner	CLRamCleaner.exe	"CyberLat RAM Cleaner - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
N	CyberMedia Agent	CMAGENT.EXE	"Part of CyberMedia's Oil Change program. Not normally required. Note - if you have TextBridge
U	CyberPatrolNew	cphq.exe	"""CyberPatrol is one of the most powerful and popular client-based
X	CyberWolf	CyberWolf.exe	"Added by the KICKIN.A (or CYDOG.C) WORM!"
X	CyDoor	CD_Load.exe	"Adware. Check here for information about Cy-Door and here for a program that can remove it"
X	CydoorUpdate	CD_Load.exe	"Adware. Check here for information about Cy-Door and here for a program that can remove it"
?	CYNHKey	CYNHKey.exe	"??"
N	CyphTray	CyphTray.exe	"Cypherus - encryption software"
U	CypressLinkMon	CypressLinkMon.exe	"Related to CypressViewer from Siemens that ""allows ACUSON Cypress cardiovascular system PLUS users to store
X	D SYSTEM	dd.exe	"Added by the MYTOB-FN WORM!"
Y	D-Link Air USB Utility	AirCFG.exe	D-Link wireless PCI adapter related
Y	D-Link Air Utility	AirCFG.exe	D-Link wireless PCI adapter related
N	D-Link AirPlus DWL-650+ Utility	WLANMON.exe	D-Link Air Plus Wireless PC modem connection monitor
Y	D-Link AirPlus G	AirGCFG.exe	D-Link Airplus Wireless Router driver
Y	D-Link AirPlus G Wireless Utility	AirPlus.exe	"D-Link AirPlus G wireless configuration and monitoring utility"
U	D-Link AirPlus XtremeG	AirPlusCFG.exe	D-Link AirPlus XtremeG wireless configuration utility
N	D066UUtility	D066UUTY.EXE	TWAIN driver for the CanoScan D660U flatbed scanner. Start scanning via your scanner management software
X	D3*.exe [ = random char]	D3*.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	D3*32.exe [ = random char]	D3*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	d3dupdate.exe	bbeagle.exe	"Added by the BEAGLE.A WORM!"
U	D4	D4.exe	"Dimension 4 - network time synchronization freeware - starts-up
N	DACONFIGEXE	daconfig.exe	3Com NIC Diagnostics. Available via Start -> Programs

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.