Windows Startup Item Database

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
Y	ESSOLO	ESSOLO.exe	Sound card driver that re-instates itself every time it's removed
Y	esspk	esspk.exe	ESS Technology modem speaker driver file. Required to get on-line with this modem
U	EssSpkPhone	essspk.exe	"ESS Technologies Call waiting
?	eSupInit	eSupCmd.exe	"Related to SupportSoft (aka Support.com) ""Real-Time Service Management software"". What does it do and is it required?"
X	ETB Tester	etbtest.exe	"Added by the RBOT-ABR WORM!"
X	etbrun	elit**32.exe [ = random char]	"EliteBar adware"
N	Ethernet	tcaudiag.exe	3Com NIC Installation/Diagnostic MFC application. Diagnostics may be run from the Start -> Programs
X	ethernet	airftp.exe	"Added by a variant of the SDBOT WORM!"
X	ethernet	msnger.exe	"Added by a variant of the SDBOT WORM!"
X	ethernet	msftp.exe	"Added by the SDBOT.BXJ WORM!"
X	Ethernet Drivers	smrrs.exe	"Added by the RBOT-AAK WORM!"
X	Ethernet Drivers	ethernet.exe	"Added by the GAOBOT.CEZ WORM!"
X	Etraffic	JavaRun.exe	"Marketing software from TopMoxie"
Y	eTrust EZ Firewall	efpeadm.exe	"eTrust EZ Firewall"
U	eTrust PestPatrol Active Protection	PPActiveDetection.exe	"PestPatrol real-time protection feature. ""Stops spyware before it infects your system"""
X	eTrust Realtime Monitor	realmon.exe	"Added by the LAZAR.B TROJAN!"
Y	eTrustCIPE	ezdsmain.exe	"eTrust EZ Deskshield from Computer Associates. Protects against malicious email attachments and unauthorized use of email by detecting and blocking unusual behavior"
X	eTunnel	winfw.exe	Added by an unidentified TROJAN!
U	EuroGlot	EuroGlot.exe	"Euroglot - ""multilanguage translating system
?	Event Log	eventlog.exe	"??"
N	Event Planner Reminders	PLNRnote.exe	Sierra Event Planner tray icon
N	Event Reminder	pmremind.exe	A calendar/alarm program that installs with Br�derbund Printmaster
X	EventApplicationCmd	smschk.exe	"Added by the IRCBOT-AO TROJAN!"
U	EVENTLISTENER	EvLstnr.exe	Used with a Nikon digital camera to recognize when the camera is plugged in
N	eventmgr	eventmgr.exe	Used with a Microtek scanner. Manages the scanner's button events. Available via Start -> Programs
X	eventwvr	eventwvr.exe	"Added by the COSIAM_G TROJAN!"
U	Evidence Cleaner	ecleaner.exe	"Evidence Cleaner cleans up tracks left by your PC and Internet activities"
N	Evidence Eliminator	ee.exe	"Evidence Eliminator - cover the tracks of your browsing habits and E-mails if you think you need to. Run manually on a regular basis"
X	Evil	Evil.exe	"Added by the MYTOB.JM WORM!"
N	evntsvc	evntsc.exe	"Application Scheduler installed along with RealOne Player. Once installed
U	EVOLOSTA	EVOLOSTA.EXE	"Evolo Status Monitor for wireless network cards. Allows a user to enter a specific access-point mode SSID
U	Evoluent Mouse Manager	EvoMouExec.exe	"Mouse manager for Evoluent VertcialMouse"
X	EvtHtm	evthtm.exe	Premium rate adult content dialler
U	EW Message Server	msg32.exe	Conexant (older versions are Brooktree) Wavestream Message Server - associated with Conexant based audio devices
N	eWare Startup	iWareStart.exe	"eWare iWare task bar. Not required"
X	ewupdater	ewupdater.exe	"EasyWebSearch adware updater"
X	example	[random filename].exe	"Added by the NUCLEAR TROJAN! Note - this trojan file is found in the WindowsNR or WinntNR folder"
N	Excite Platform	Exlaunch.exe	Loads an Icon in the startup tray that allows you to receive service update notices for Excite@Home if you desire (note that since Excite@Home appears to be winding down this becomes irrelevant). May also allow you to kill the Excite Toolbar that automatically loads in Internet Explorer
?	Excite Private Messenger Pipe	x8impipe.exe	"??"
N	ExciteAssistantEXE	ASSISTANT.EXE	"With Excite Assistant
X	exdl.exe	exdl.exe	"BargainBuddy foistware"
X	exe lptt01	exe.exe	"RapidBlaster variant (in a ""Exe"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	exe ml097e	exe.exe	"RapidBlaster variant (in a ""Exe"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	execfg4	execfg4.exe	"Added by the ELECTRON WORM!"
X	ExecUser	ExecUser.exe	"Added by a variant of the RBOT WORM!"
?	Execute	delfolders.exe	"??"
X	ExeName32	Warm.scr	"Added by the SCOLD WORM!"
?	exgiwsl	exgiwsl.exe	"??"
U	Exif Launcher	Exiflaquickdcr.exe	USB mass storage driver used by some digital cameras such as the Fuji Finepix. Only required if you use it regularly
U	Exif Launcher	QuickDCF.exe	USB mass storage driver used by some digital cameras such as the Fuji Finepix. Only required if you use it regularly
U	ExitKiller	Ekiller.exe	"Exit Killer - automatically closes pop-up windows in your browser"
?	exmon	hpimoniter.exe	"Some kind of hp digital camera maybe or a photo smart connection probe?"
X	EXPL0RE.EXE	EXPL0RE.EXE	"Added by the POPNO-A TROJAN! Note that the filename is spelled using the digit ""0"" instead of the uppercase letter ""o"""
X	Expl0rer soft	expl0rer.pif	"Added by the RBOT-AQR WORM!"
X	expler	Updadv.exe	"Added by the QQPASS-N TROJAN!"
X	Explkw	expup.exe	Keywords hijacker
X	explore	explore.exe	"Added by any number of VIRUSES
X	Explore	Explorer.exe	"Added by the IRC.FLOOD.G TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually!"
X	Explore	explore.exe	Adult content dialler
X	explore manager	explore.exe	"Added by the DONBOMB.A TROJAN!"
X	explore.exe	Explore.exe	"Added by the GRAYBIRD.G TROJAN!"
X	exploreff.exe	exploreff.exe	"Added by the FINFANSE TROJAN!"
U	explorer	explorer.exe	"Starts Windows Explorer. Unless this has been manually added to startups or added by another program it could be a virus such as PE_BISTRO or DVLDR or MYDOOM.C. Note that it is also not the explorer.exe task/service you'll see when via CTRL+ALT+DEL"
X	explorer	wscript.exe [filename]	Sneaky way to start any VBS script. Many viruses use VBS files
X	Explorer	shellexpl.exe	"Added by the SHELDOR TROJAN!"
X	explorer	expl32.exe	"Added by the RATSOU TROJAN!"
X	Explorer	[path to worm]	"Added by the AUTEX WORM!"
X	Explorer	shellexp.exe	"Added by a variant of the SHELDOR TROJAN!"
X	EXPLORER	EXPL0RER.EXE	"Added by the BEASTDO-Y TROJAN! Note the ""0"" in the filename rather than upper case ""o"""
X	EXPLORER	sys.exe	"Added by the SILLYFDC-A TROJAN!"
X	Explorer	config_.com	"Added by the FLOPPY-D WORM!"
X	Explorer	drv.exe	"Added by the SMALL-FD TROJAN!"
X	explorer	[path to trojan]	"Added by the AGENT-EU TROJAN!"
X	explorer	explorer.exe	"Added by the KEYLOG-AK TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in a ""service"" subfolder of the System folder"
X	EXPLORER	EXPLORER.exe	"Added by the NETHIEF-P TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in a ""SHELLEXT"" subfolder of the System folder"
X	explorer	explorer.exe	"Added by the BLOCKEY-A TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in a ""config"" subfolder of the System folder"
X	explorer	Yinstall.exe	"PurityScan/Clickspring adware"
X	Explorer Loader	explr32.exe	"Added by the AGOBOT.N WORM!"
X	Explorer Loader	explorerl.exe	"Added by the SDBOT-ADI WORM!"
X	Explorer lptt01	explorer.exe	"RapidBlaster variant (in a ""explorer"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually!"
X	EXPLORER MICROSOFT SYSTEM	explore.exe	"Added by a variant of the RBOT WORM!"
X	Explorer ml097e	explorer.exe	"RapidBlaster variant (in a ""explorer"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually!"
X	Explorer soft	explorer.pif	"Added by the RBOT-APK WORM!"
X	Explorer soft	explorer.com	"Added by the RBOT-ARM WORM!"
X	Explorer Updater	IEXPLORE.exe	"Added by the SDBOT-WO WORM! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder"
X	explorer.exe	explorer.exe	"Added by the AGENT-EW or PWS-CY TROJANS! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System (9x/Me) or System32 (NT/2K/XP) folder"
X	explorer.exe	explorer.exe	"Added by the DELF-ACL TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the Program Files folder"
X	Explorer32	Expl32.exe	"Added by the HACKTACK.B TROJAN!"
X	Explorer32	explorer6s4.exe	Added by the Downloader.Win32.Small.biq TROJAN!
X	Explorer32	efsdfgxg.exe	"Added by the CLICKER-Y TROJAN!"
X	exporet	winset.exe	"Added by the QQPASS-I TROJAN!"
U	Express ClickYes	ClickYes.exe	"""Express ClickYes is a handy tool that runs in the system tray automatically clicks the Yes button for the Outlook Security security prompt
U	Exshow95	EXSHOW95.exe	Support software for some of the Kensington mice. Provides access to extra features like those available with enhanced Logitech and MS devices
X	External Dependencies	External.exe	"Added by the MYTOB.EC WORM!"
U	ExtraDNS	ExtraDNS.exe	"ExtraDNS - DNS configuration tool"
?	Extranet AutoDial	AutoExt.exe	Nortel Networks Contivity Extranet Switching Software
?	ExxtremeHelperDemon	exxdemon.exe	"Creative Exxtreme graphics card related?"
N	Eye Tide Launcher	oneeyetideone.exe	Nascar wallpaper
Y	EZ Firewall	ca.exe	"eTrust EZ Armor Internet Security"
N	ezagent	ezagent.exe	"EzVCR recording software for the ASUS TV FM card. Available via Start -> Programs"
N	EzButton	EzButton.EXE	EZbutton is a quick launcher for the Media player app that comes with certain laptops
N	EZDesk	EZDESK.EXE	"Utility that remembers icon locations for each user and resolution. Available here"
N	EzEjMnAp	EzEjMnAp.exe	"For IBM Thinkpad Notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
X	eZmmod	mmod.exe	"eZula TopText adware"
?	EZNORUN	EZNORUN.EXE	"Easy Internet related?"
N	EzPrint	ezprint.exe	Configuration options for Lexmark printing devices
Y	ezPS_Px	ezSP_PxEngine.exe	"Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings"
Y	ezPS_Px	ezSP_Px.exe	"Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings"
Y	ezShieldProtector for Px	ezSP_Px.exe	"Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings"
Y	ezShieldProtector for Px	ezSP_PxEngine.exe	"Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings"
U	EZSMART App	ezsmart.exe	EZ-S.M.A.R.T. hard drive monitoring software from StorageSoft - appears to be no longer supported
X	ezula	eZmmod.exe	"eZula TopText adware"
X	eZulaMain	eZulaMain.exe	"eZula TopText adware"
X	eZuluMain	eZuluMain.exe	Comes with "KaZaA" installation. Advertising Spyware. Not required but KaZaA won't work
X	eZWO	wo.exe	"eZula TopText adware"
U	E_S10IC2	E_S10IC2.exe	"Epson Stylus C44 Series printer monitor - for checking ink levels
U	E_S23	E_SICN03.exe	"Epson printer status monitor - for checking ink levels
U	E_S4I2F1	E_S4I2F1.exe	"Epson Status Monitor 3 for the Epson Stylus Photo R300 (and probably others) printers - monitors the status of ink levels
N	E_S4I2G1	E_S4I2G1.EXE	"Epson Status Monitor 3 for the Epson Stylus CX5400 printer/scanner/copier (and probably others) - monitors the status of ink levels
U	E_SOEIC1	E_SOEIC1.exe	"Epson Stylus printer monitor - for checking ink levels
X	F-Secure 2005	svchost.exe	"Added by the BIFROSE-CH TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
Y	F-Secure 2006	fspex.exe	"F-Secure Anti-Virus automatic updater"
U	F-Secure Management Agent	FSMA32.EXE	"F-Secure Antivirus - F-Secure Policy Manager provides tools for administering F-Secure software products"
Y	F-Secure Manager	FSM32.EXE	"F-Secure Antivirus - carry out scheduled virus scans automatically"
Y	F-Secure Startup Wizard	FSSW.EXE	"F-Secure antivirus"
Y	F-Secure TNB	TNBUtil.exe	"F-Secure antivirus"
Y	F-StopW	F-StopW.exe	"F-Prot anti-virus background scanner by F-Risk Software"
U	f1Tray.exe	F1TRAY.EXE	"System Tray icon for FusionOne's MightyPhone software. ""MightyPhone is a concept for wirelessly synchronizing the data on your mobile phone with your web-based or PC based organizer"""
X	f607	f607.exe	"Added by the URAT.B TROJAN!"
X	f73cdc8ee94e	btsendto.exe	Associated with mysearchnow.com/searchbar.html
U	FamilyKeyLogger	cisvc.exe	"Family Keylogger is a program that lets you record to a special file and then view all the keystrokes typed by everyone using your computer. Keystroke logger/monitoring program - remove unless you installed it yourself!"
X	Fantasia injector	wincfg.exe	"Added by the AGOBOT.US WORM!"
?	fapmon	fapmon.exe	"Fair Access Policy monitor for DirecPC/DirecWay internet access"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.