Windows Startup Item Database

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
U	ActMaker	ActMaker25.exe	"ActMaker mouse and keyboard toolkit can record the daily operation of your computer and reduce your workload"
U	ACTray	ACTray.exe	"System Tray icon for ThinkVantage Access Connections - ""allowing users to seamlessly switch between wired and wireless environments
U	Actual Window Minimizer	ActualWindowMinimizerCenter.exe	"Actual Window Minimizer - ""allows minimizing any window to task tray notification area or to the edge of the screen"""
X	ACTX1	v1201.exe	"Added by the VB.IS TROJAN!"
U	ACU	ACU.exe	"Atheros wireless Client Utility For HP Compaq"
U	ACU_QSB	ACU.exe	"Atheros wireless Client Utility For HP Compaq"
U	ACWLIcon	ACWLIcon.exe	Related to IBM ThinkVantage Connectivity Solution
U	Ad Blocker	blocker.exe	"Ad Blocker - blocks popups
U	Ad Blocker Pro	Ad Blocker Pro.exe	Ad Away popup and banner remover
U	Ad Muncher	AdMunch.exe	"Ad Muncher removes adverts
?	Ad Online Guide	adonlineguide.exe	"??"
N	Ad-aware	Ad-aware.exe	"Ad-aware from Lavasoft. Checks your PC for ""Spyware"" which reports back your internet activities to ""base"". Available via Start -> Programs"
X	Ad-Aware	Ad-Aware.exe	"Added by the RBOT-ADJ WORM! Note - this is not the popular Ad-aware spware/adware removal tool and is located in the WinntSystem32 or WindowsSystem32 directory"
N	Ad-Eliminator	ad-eliminator.exe	"Spyware remover - not recommended
U	Ad-Muncher	ADMUNCH.EXE	"Ad Muncher removes adverts
U	Ad-Protect	ad-protect.exe	"Ad-Protect spyware and spam monitoring tool"
U	Ad-watch	Ad-watch.exe	"Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system"
U	AD2KClient	AD2KClient.exe	"Executable for Active Disk from Iomega disk - allows software applications to be run directly from an Iomega Zip� disk. Required if you wish the applications to launch on insertion of a disk"
N	Adaptec DirectCD	Directcd.exe	DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later
N	AdaptecDirectCD	Directcd.exe	DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later
X	AdAware	wini.exe	"Added by the RBOT-XN WORM!"
N	Adaware Bootup	ad-aware.exe	"Ad-aware from Lavasoft. Checks your PC for ""Spyware"" which reports back your internet activities to ""base"". Available via Start -> Programs"
X	Adaware lptt01	adaware.exe	"RapidBlaster variant (in a ""Adaware"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Lavasoft Adaware"
X	Adaware ml097e	adaware.exe	"RapidBlaster variant (in a ""Adaware"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Lavasoft Adaware"
X	Add*.exe [ = random char]	Add*.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Add*32.exe [ = random char]	Add*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	AddClass	AddClass.exe	"CoolWebSearch Addclass parasite variant"
X	AddClass	[Installation_Path]	"Added by the STARTPAGE.F hijacker"
X	AddClass	[path to trojan]	"Added by the SECDL-A TROJAN!"
U	AdDelete	AdDelete.exe	Banner advertisment blocker
X	AdDestroyer	AdDestroyer.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
?	addproxy	addproxy.exe	Related to Adobe Photoshop
?	ADG	ADG.exe	" SoundBlaster Audigy related?"
N	ADGJdet	ADGJDet.exe	Added with SoundBlaster Live! or Audigy soundcards for headphone autodetection
Y	Adiras	Adiras.exe	ADSL USB modem related
X	ADM Library Loader	admlib32.exe	"Added by a variant of the SDBOT TROJAN!"
X	Admanager Controller	AdManCtl.exe	"Adware
X	Admilli Service	AdmilliServ.exe	Windupdates adware variant
X	Administrator	svchost.scr	"Added by the NOVACAL TROJAN!"
X	AdminSoft	sysfile.vbs	"Added by the STARGRUB-A WORM!"
U	admtray.exe	admtray.exe	"Related to Acer Inc. destop tray"
X	Adobe	Adobe.exe	"Added by an unidentified VIRUS
X	Adobe	sysconfig.exe	Added by an unidentified WORM or TROJAN!
X	adobe	gam.exe	Added by an unidentified WORM or TROJAN!
X	Adobe	sysbat32.exe	"Added by the LOWZONES.T TROJAN!"
X	Adobe	zteam.exe	Added by an unidentified TROJAN!
X	Adobe Acrobat Distiller Application	acrotray.exe	"Added by the RANDEX.DFJ WORM!"
X	Adobe Acrobat Reader CFG	[random filename]	"Added by a variant of the RBOT WORM!"
X	Adobe Filter Platform	afilterplatform.exe	"Added by the RBOT-OP WORM!"
U	Adobe Gamma Loader	Adobe Gamma Loader.exe	"Adjusts monitor colours across all programs
N	Adobe Photo Downloader	apdproxy.exe	"Part of Adobe's Photoshop Album or Photoshop Elements packages - starts each time you connect an external image device to your PC (see here)"
N	Adobe Reader Speed Lauch	reader_sl.exe	Speeds up the launch of Adobe (Acrobat) Reader 7
N	Adobe Reader Speed Lauch	READER~1.EXE	Speeds up the launch of Adobe (Acrobat) Reader 7
N	Adobe Reader Speed Launch	reader_sl.exe	"Speeds up the time it takes to load the Adobe Reader application. Your choice
U	Adobe Version Cue CS2	VersionCueCS2Tray.exe	"File manager that's part of Adobe Creative Suite 2 - ""find files fast
X	AdobeA	adobes.exe	"Added by the FLOOD.BA TROJAN!"
X	AdobeFonts	fonts.hta	Browser hijacker - redirecting to Hugesearch.net
X	adobemgr	adobemgr.exe	"Added by the ADCLICKER TROJAN!"
X	AdobeReader	msni.exe	"Added by the RBOT.DAO TROJAN!"
X	AdobeReaderPro	msnxpsp.exe	"Added by the RBOT-ASK or RBOT-AUS WORMS!"
X	AdobeReaderPro	ntkernell32.exe	"Added by the RBOT-ATY WORM!"
X	AdobeReaderPro	msnserve.exe	"Added by the SDBOT-AKH WORM!"
X	AdobeReaderPros	sysmsn.exe	"Added by the RBOT-BGH WORM!"
N	AdobeVersionCue	VersionCueTray.exe	"""An exclusive feature of the Adobe� Creative Suite
X	Adope File Manager	lsasv.exe	Added by an unidentified WORM or TROJAN!
X	adp	adp.exe	"Spyware installed by Net2Phone
X	AdPopup	dcf5678.exe	"Added by the AGENT-FZ TROJAN!"
X	adprot	adprot.exe	"AdBlaster adware"
N	ADQuickAccess	Adtray.exe	After Dark for Windows. Screen saver creation program produced before screen savers became integrated into Win95
X	ADriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	AdRoarUpdate	ARUpdate.exe	"AdRoar adware updater"
X	AdRotator.Application	[path to csrss.exe]	"Added by the SMALL-AQ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup!"
X	AdRotator.Application	services.exe	"Added by FakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in an ""Inetsrv"" subfolder"
X	AdsBlocker	stopAds.exe	"Reported as DILAER.DW by NOD32"
U	ADService	ADService.exe	"Part of Iomega's Active Disk - allows software applications to be run directly from an Iomega Zip� disk. Required if you wish the applications to launch on insertion of a disk"
U	AdsGone	Adsgone.exe	"AdsGone - pop-up stopper"
N	ADSL Diagnostic Tools	mapiicon.exe	System tray access to ADSL modem diagnostic tools. Available via Start -> Programs
?	ADSLSYSTEMTRAY	SystemtrayV100B.exe	"Apparently Annex A ADSL modem related. What does it do and is it required?"
Y	AdslTaskBar	"rundll32.exe stmctrl.dll	TaskBar"
X	AdslTaskBars	taskmng.exe	"Added by the RBOT-AXZ WORM!"
?	ADSL_A2	A2Installed	"Associated with an Integrated Telecom Express (ITeX) ADSL driver installation. What does it do and is it required?"
Y	ADSS	ADSS.exe	"ADSS is part of Access Denied security and privacy software (Access Denied Security Server) that monitors power status and provides some other services for Screen Guard. Important to keep its running while using Access Denied"
X	adstartup	automove.exe	"Adlogix adware variant"
X	adstartup	Adstartup.exe	"Adlogix adware variant"
X	AdStatus Service	AdStatServ.exe	"WindUpdates AdStatus Service adware"
U	AdSubtract	adsub.exe	"AdSubtract blocks ads
X	adtech2005	adtech2005.exe	"Recognized by Kaspersky antivirus as Trojan.Win32.StartPage.aw"
X	adtech2006	adtech2006.exe	"Recognized by Kaspersky antivirus as Clicker.Win32.VB.kc"
X	Adtools Service	AdTools.exe	"Windupdates Adware"
?	ADU	adu.exe	"Related to Cisco Aironet wireless products. What does it do and is it required?"
X	AdultX	AdultX.exe	Adult content dialler and hijacker
X	Adult_Chat	Adult_Chat.exe	Adult content dialler
X	Adult_Chat1	Adult_Chat1.exe	Adult content dialler
X	AdUpdater	sysupudt.exe	Unidentified adware downloader/updater
U	ADUserMon	ADUserMon.exe	"Part of Iomega's Active Disk - allows software applications to be run directly from an Iomega Zip� disk. Required if you wish the applications to launch on insertion of a disk"
X	Advanced DHTML Enable	exo32.exe	Added by an unidentified TROJAN!
X	Advanced Internet Protocol	cerf.exe	"Added by a variant of the SPYBOT WORM!"
X	Advanced Protection System	advpsys.exe	"Added by a variant of the RBOT WORM!"
U	Advanced Spyware Remover	Asr.exe	"Advanced Spyware Remover anti spyware tool"
X	Advanced Tool Checks	advchks.exe	"Added by a variant of the RBOT WORM!"
N	Advanced Tools Check	ADVCHK.EXE	Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget
U	Advanced Uninstaller PRO Installation Monitor	monitor.exe	"Innovative Solutions Advanced Uninstaller PRO - ""easy-to-use suite for uninstalling applications and keeping your computer fast
X	Advapi	Advapi.exe	"Added by the NETDEVIL.12 WORM!"
N	ADVCHK	ADVCHK.EXE	Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget
U	Advertising Killer	Akiller.exe	"Advertising Killer - popup stopper"
X	advmon32	advmon32.exe	"Added by a variant of the CRYPTER.C TROJAN!"
U	Adware Agent	adware agent.exe	"Adware Agent popup blocker"
N	Adware Spy	AdwareSpy.exe	"Adware remover - not recommended
U	AdwareAlert	AdwareAlert.Exe	"Adware program
U	AdwareDelete	adwaredelete.exe	"Adware remover - not recommended
?	Aeiwlsta.exe	Aeiwlsta.exe	"IBM High Rate Wireless LAN Adapter driver. Is it required?"
N	AELaunch	AELaunch.exe	"Audio Applications Launcher for the Philips Acoustic Edge soundcard"
X	AERVICESN	AERVICESN.exe	"Added by the RANDON-AO WORM!"
N	AeXAgentLogon	AeXAgentActivate.exe	"Altiris Agent transmits information about your machine for the purpose of asset management and deployment"
?	AeXSWDUsr	AeXSWDUsr.exe	"Altiris Express NS Client Manager software. Is it required?"
U	AEZBProc	aptezbp.exe	"IBM Aptiva keyboard customizer - enables certain special buttons on keyboard for CD operation
U	AFAFilter	windefault.exe	"AFAFilter - internet filter software"
N	Agent	Agent.exe	"Cyberlink's Power VCR II 3.0 is a TV tuner recording utility. If you want to schedule recordings you'll need this
X	Agent Browser	[random filename]	Added by the PPdoor.M-bdr backdoor TROJAN!
X	Agent Explorer	[random filename]	Unidentified adware
?	Agente	Remupd.exe	"Part of Panda Antivirus Titanium. Is this an update reminder (guess because of the name)
X	agentsvr	agentsvr.exe	"Malware
U	AgfaCLnk	AgfaCLnk.exe	For Agfa digital cameras connected via USB. Enables Windows to access the contents of the memory stick (while the stick's still on the camera) via a virtual drive
X	agp	agp32.exe	"Added by the GAOBOT.SY WORM!"
Y	AGRSMMSG	AGRSMMSG.exe	IBM AMR modem driver
N	AGSatellite	AGSatellite.exe	Program from AudioGalaxy that lets you download some MP3s from their server. Available via Start -> Programs
U	ahfp	ahfp.exe	"Advanced Hide Folders - "is powerful file security program. It allows to hide folders or hide files. Advanced Hide Folders is very useful to keep your personal data away from others. Others will not know where your personal files exist and they will not be able to accidentally view
U	ahfprog	ahfp.exe	"Advanced Hide Folders - "is powerful file security program. It allows to hide folders or hide files. Advanced Hide Folders is very useful to keep your personal data away from others. Others will not know where your personal files exist and they will not be able to accidentally view
Y	AHNSD	AhnSD.exe	"AhnLab V3 antivirus updater - leave enabled unless you manually update on a regular basis"
?	AHNUE	AHNUE.exe	"??"
N	AHQInit	ahqinit.exe	Part of AudioHQ for the Soundblaster Live!. Appears as though it makes the AudioHW toolbar drop down from the top of the desktop and isn't required
X	Ahst	iebs.exe	"PurityScan/Clickspring adware"
X	AHU	[path to worm]	"Added by the ANACON-B WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.