Windows Startup Item Database

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	farmmext	farmmext.exe	"VX2.Transponder parasite updater/installer related"
X	Fash	Fash.exe	Unidentified adware
N	fast	fast.exe	Installs as part of Windows XP PowerToys as an option for very-fast user switching (allowing a keystoke to switch users instead of using the login screen). It is only used for the hot-key switch and yet it hogs 1.5 megs of memory in two separate processes (one run by the user & one by the system). Optional install in PowerToys
N	FAST Defrag	FAST2.EXE	"FastDefrag defragmenting software"
X	Fast Home	svcnvt.exe	"Recognized by Kaspersky antivirus as Trojan-Downloader.Win32.Delf.ks This file may be found in the System folder on 9x machines
X	Fast Search	svcnv.exe	"Homepage
X	Fast start	Ntut.exe	"Adware - recognized by Kaspersky antivirus as Trojan.Win32.Favadd.I"
X	Fast start	svcnt.exe	"Adware - recognized by Kaspersky antivirus as a variant of the FAVADD TROJAN!"
U	FastCache	fc.exe	"FastCache from AnalogX - speeds up browsing by resolving DNS requests locally"
X	FastStart	ntnut32.exe	"Added by the STARTPAGE.L TROJAN!"
X	FastStart	svcnut.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
X	FastStart	svcnut32.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
N	FastTrack Accelerator	SPEED UP.EXE	"FastTrack Accelerator - "speedup" utility for programs that use the FastTrack network such as KaZaA Media Desktop
N	FastUser	fast.exe	Installs as part of Windows XP PowerToys as an option for very-fast user switching (allowing a keystoke to switch users instead of using the login screen). It is only used for the hot-key switch and yet it hogs 1.5 megs of memory in two separate processes (one run by the user & one by the system). Optional install in PowerToys
N	FastUsr	fast.exe	Installs as part of Windows XP PowerToys as an option for very-fast user switching (allowing a keystoke to switch users instead of using the login screen). It is only used for the hot-key switch and yet it hogs 1.5 megs of memory in two separate processes (one run by the user & one by the system). Optional install in PowerToys
U	FatPipe	DHCP	Software enabling high speed internet browsing (2-4 times faster) and internet connection sharing for up to 5 users
U	Fatpipe Dialer	fpdialer.exe	Dailler for Fatpipe - software enabling high speed internet browsing (2-4 times faster) and internet connection sharing for up to 5 users
U	fatrecov	fatrecov.exe	SCKeyLog.j keystroke logger/monitoring program - remove unless you installed it yourself!
U	FaxCenterServer	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software. Incorporated into software by Lexmark
U	FaxCtrl.exe	ASMediaProxyServer.exe	"Part of Avaya's Contact Center Express - ""a multi-channel
N	FaxTalk CallControl 6.0	FTClCtrl.EXE	This allows the software to handle incoming and outgoing communications without requiring the FaxTalk Communicator application to be loaded into memory. Can be started manually
U	FBDirect	FBDirect.exe	"Software that monitors the status of a Visioneer OneTouch scanner button and allows you to scan
?	FBI	FBISM.exe	"Compaq related but what does it do?"
X	fc	runfc.exe	"Added by the CAMPURF WORM!"
X	FCEngine	FCEngine.exe	"CASClient adware"
X	FCHelp	FCHelp.exe	"Added by either FCHelp adware or a variant of it"
X	FCMan	FCMan.exe	"FCHelp adware"
X	FDD SYSTEM	Fdd.exe	"Added by the MYTOB-FO WORM!"
X	Fdr Command Module	sp2.exe	"Added by the SDBOT.WP WORM!"
X	FDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
U	FD_SAP	FD.exe	Reported to be the autopassword program from the Sony Microvault thumb drive
X	feelalright	mirc.exe	"Added by the IRCFLOOD-M WORM!"
U	FEELitDeviceManager	feelitdm.exe	Associated with Immersion TouchSense devices (Logitech Wingman Force Feedback Mouse and possibly other peripherals)
X	fegoze	SVCH0ST.EXE	"Added by the GRAYBIRD.D VIRUS! Note - the filename has the digit 0 rather then the uppercase ""o"""
U	Fellowes Proxy	R3proxy.exe	Installed with Fellowes EasyPoint mouse software. Not necessary for normal functioning of Fellowes mice but it is necessary to use the extended features of all Fellowes mice
X	Fen Startups	fensvc32.exe	"Added by the RANDEX.CCF WORM!"
U	FerrariWallPaper	FerrariWP.exe	Calendar that replaces the default desktop background image. It comes with every Acer Ferrari 3000 laptop. Also downloadable for members of www.ferrari.com
X	ffis	ffisearch.exe	"iSearch ""Desktop Search"" hijacker"
U	FG1_00	frntgate.exe	"FrontGate MX - e-mail spam blocker"
X	fGQEGqHOME	gwwgtp.exe	"Added by the RANKY.J TROJAN!"
X	FHPage	shdochp.exe	"Added by the DELF-Ks TROJAN!"
X	FHStart	shdocsvc.exe	"Added by the DELF-Ks TROJAN!"
U	Fhtisxk	fhtisxk.exe	XtraKeys keystroke logger/monitoring program - remove unless you installed it yourself!
U	FieldForms Sync	SyncService.exe	"Resco FieldForms. A solution for building of mobile forms that can be viewed or filled in on the run
X	FiendlyType	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process
X	FILE	abcdefg.exe	"Added by the KELVIR.DD WORM!"
?	file indexing service	msfindfile.exe	"New version of MS FindFast and still a resource hog?"
X	file laoder configuration	rnd32.exe	"Added by the RBOT.BQJ WORM!"
X	File System	taskmqrs.exe	"Added by a variant of the TOXBOT/CODBOT WORM!"
X	File System	taskmqr.exe	"Added by the RBOT.BWQ WORM!"
X	File System Service	wmiprvsc.exe	"Added by the AGOBOT-HZ TROJAN!"
X	File0_0	MD1.exe	"Added by the DLOADER-OR TROJAN!"
X	File1	Dia Claro.htm	"Added by the DLOADER-OR TROJAN!"
N	FileFreedom_Plugin	wtm.exe	"FileFreedom peer-to-peer sharing program"
X	FileManager32	Wscript.exe ..ChkMgr32.vbs	"Added by the NOTUP.A WORM!"
X	FileSoft	Wscript.exe UpdataFiles.vbs	"Added by the SST.B WORM!"
U	FilmLoop	FilmLoopService.exe	"Related to FilmLoop - a photocasting network. Share your pictures with your family and friends"
U	FilterGate	filtergate.exe	"Filtergate internet filtering software - filters sounds
U	Filterguard	Filtrgrd.exe	"An icon located in the lower left of the screen and looks like a lifesaver. This icon is a ""short-cut"" to access the basic features of SOS-Guardian
X	Find	find.exe	"Added by the OPANKI WORM!"
X	Find Fast	Findfast.exe	Complete utter waste of space! Part of MS Office - searches disk drives for Office file types to make opening them easier
Y	Find Virus Launch Program	fvlaunch.exe	"Part of Dr. Solomon's Antivirus"
X	FindHack	[path to trojan]	"Added by the KELVIR-BA TROJAN!"
N	FinePrint Dispatcher vx	FPDISPxA.EXE	"FinePrint - virtual printer for use with any printer. Search for ""dispatcher"" here for more information. If removed
N	FineReader7NewsReaderPro	AbbyyNewsReader.exe	"ABBYY FineReader OCR software"
X	Fire Wall services	[random filename]	"Added by the IRCBOT-QY WORM!"
X	FireFox	firefox.exe	"Added by the RBOT-ATP WORM! Note - this is not the popular FireFox web browser and is located in the System (9x/Me) or System32 (NT/2K/XP) folder"
X	FireFox Service Drivers	ssmss.exe	"Added by a variant of the SDBOT WORM!"
X	FireFox Startup Drivers	wuaclt.exe	"Added by the RBOT.BYX WORM!"
X	Firewall	wmlaunch .exe	"Added by the ELIPTER.A or ELIPTER.B WORMS!"
X	Firewall	wmlaunch .exe	"Added by the ELIPTER.D WORM!"
X	Firewall	SP2 UPDATE.exe	"Added by the ELITPER.E WORM!"
X	Firewall	Firewall.bat	"Added by the YPSAN.G WORM!"
X	firewall	fw_304.exe	"Added by the JQ TROJAN!"
X	Firewall Policy	MidiDef32.exe	"Added by the PIEBOT-A TROJAN!"
X	Firewall Sp2 system	sys32Conf.exe	"Added by the Rbot-ABT WORM!"
X	Firewall Update System1	WinedowsUpdater1.exe	"Added by the RBOT-ARU WORM!"
X	Firewall Updater	msnupdateit.exe	"Added by the RBOT-AAQ WORM!"
X	Firewall.exe	Firewall.exe	Added by the AGENT.AGL WORM!
X	FirewallActivies	csrss.exe	"Added by the BANKER-AQ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a ""3041"" subfolder"
U	FirewallStartup	Firewallstartup.exe	"Innovative Startup Firewall - ""designed to protect your computer from programs that install themselves in the StartUp area of your Windows without asking for your approval. Innovative StartUp Firewall will help you keep your computer clean
X	FirewallSvr	FirewallSvr.exe	"Added by the NETSKY.X or NETSKY.Y WORMS!"
X	firewall_anti	firewall_anti.exe	"Added by the NETDENY-B TROJAN!"
X	FireWire Driver	samx.exe	"Added by the SDBOT.AE WORM!"
X	FireWire Service	nvscv32.exe	"Added by a variant of the SDBOT WORM!"
X	FireWire Services	nvcsv32.exe	"Added by a variant of the SPYBOT WORM!"
X	First Home Page	http://find.naupoint.com	"Naupoint browser hijacker"
X	FIX	WinFIX1.0.vbs	"Added by the GORMLEZ-A WORM!"
Y	Fix-it	mxtask.exe	"Part of Ontrack's Fix-it Utilities Suite. Loads a System Tray icon that lets you access the full program. Needed if you run the crash guard
Y	Fix-it AV	memcheck.exe	Part of Ontrack's Fix-it Utilities Suite anti-virus. Performs a quick check of memory for signs of any virus. Exits afterward and returns all resources used in one user's experience. Not required but could be left without a drain on resources
U	FjMenu	FjMenu.exe	"From the ""Fujitsu Menu"" tray icon you have instant access to the Control Panel
N	fkSysMon	fksysmon.exe	"fkWrae SysMon - system monitor - ""displays the current memory consumption
X	FlaCPY	flacpy.exe	"FlashEnhancer adware variant"
?	FLASH32	-flash32.exe	"??"
U	FlashEnc	FlashEnc.exe	"Supplied with EasyDisk USB pen devices. The utility manages the encryption and compressed folders options. It will create these folders if running on the USB key without permission
X	Flashget Download Manager	Flashget.exe	"Added by the RBOT-AGZ WORM!"
N	FlashPath Monitor	SDSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
N	FlashPath Monitor	FLSHSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
N	FlashPath Status	SDSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
N	FlashPath Status	FLSHSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
X	FlenCPY	flencpy.exe	"FlashEnhancer adware variant"
U	Flexicd	Flexicd.exe	"CD player - part of the Win95 Power Toys"
U	FLMK08KB	MMKEYBD.EXE	Multimedia keyboard manager. Required if you use the additional keys
U	FLMOFFICE4DMOUSE	moffice.exe	"Micro Innovations mouse management"
U	FLMOFFICE4DMOUSE	mouse32a.exe	"Micro Innovations mouse management"
?	FLMTRUSTKB	KbdAp32A.exe	"Keyboard utility for a Trust brand keyboard. What does it do and is it required?"
U	FLMTRUSTMOUSE	mouse32a.exe	Mouse utility for a Trust brand mouse
X	FlnCPY	flncpy.exe	"FlashEnhancer adware variant"
X	FLooDNeT	FLooDeR.exe	"Added by the ENDOOL TROJAN!"
X	Floppy Master	[path to trojan]	"Added by the ZONIT-F TROJAN!"
?	Flow Go TV	flogotv.exe	"??"
X	flps	flps.vbs	"Added by the BYRON WORM!"
X	flpycntl	flpycntl.exe	"Added by the CRYPTER.C TROJAN!"
?	FLSVCI	FLSVCI.exe	"??"
Y	FltProcess	msinet.exe	"Part of Cyber Patrol internet filtering software to restrict access to certain types of material on the internet. It can be disabled but do not ask how it's done"
X	FlyswatDesktop	flydesk.exe	Advertising spyware
U	FmctrlTray	Fmctrl.EXE	Genius SM-Live Control Panel. Enhances audio output through Genius sound cards (makes a big difference and worth the 3MB Ram used)
X	fmnwebassist	fmnwebassist.exe	Adware popup generator
U	FMStart	Fmstart.exe	"GFI FAXmaker - native fax connector for Microsoft Exchange Server or for networks
X	FMSZ	fmsz.exe	"Added by the FMSZ TROJAN!"
X	fnmwebassist	fnmwebassist.exe	"WinPL adware"
?	Focus	Focus.exe	"ISDN configuration wizard?"
X	Folder Service	wssdtu.exe	"Added by the MANIFEST TROJAN!"
U	Folder View	folderview.exe	"Folder View enhances the Windows file Explorer by making all folders you need available in a single click"
U	FolderClone v..*	folderclone.exe	"Folderclone backup and synchronization software"
N	Folding@home	WINFAH.EXE	"Folding@Home is a distributed computing project which studies protein folding
N	FoneSyncSystemTray	FoneSyncSystemTray.exe	System Tray icon for Nokia FoneSync utility for the 7160/7190 mobiles. Useful to send data from/to the cell phone and the computer. You can use it to backup data or even to input data through the computer keyboard (which naturally is much more comfortable). Run manually when required
X	FontFix	fontfix.exe	"Added by an unidentified VIRUS
N	fontnav	FontNav.exe	"FontsLoader	ldfnt32.hta	Unidentified malware
X	FONTVIEW	FONTVIEW.EXE	"Added by the OPASERV.T WORM!"
U	FooBar 1.0	FooBar.exe	"FooBar - ""combines fifteen high-quality productivity tools in a single toolbar that floats on your desktop or runs in the Windows task bar"""
X	foobin lptt01	adaware.exe	"RapidBlaster variant (in a ""foo1"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.