Windows Startup Item Database

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
U	LocalProxy	proxy4free.exe	"""ProxyTools is a package of Perl network utilities designed mainly to assist those whose Internet access is censored
X	Locator Service	[filename]	"Added by the AGOBOT-KY TROJAN!"
U	Lock My PC	lockpc.exe	"Lock_My_PC - a tool for quick computer locking when you leave it unattended. It shows a lock screen
U	Login	winlog.exe	"Salfeld Child Control 2003 - parental control software"
X	login	[path to trojan]	"Added by the HOTWORD-A TROJAN!"
X	Login	Login.exe	"Added by the BANCBAN-AH TROJAN!"
X	Login Screen Saver	login.scr	"Added by the RBOT-AVN WORM!"
X	Login Service	[path to file]	"Added by the MIGMAF TROJAN!"
X	LoginPassport	Lgnpsp32.exe	"Added by the REDIST.C WORM!"
X	Logitech	Logitech.exe	"Added by the RBOT.BJH WORM!"
X	Logitech Camera	Soundcane.exe	"Added by the SDBOT.MUC WORM!"
X	Logitech Desktop	ApPache.exe	"Added by the RBOT-YP WORM!"
X	Logitech Desktop	IPCONN.EXE	"Added by the SDBOT-WE WORM!"
X	Logitech Desktop Controller	wrcam.exe	"Added by a variant of the RBOT WORM!"
N	Logitech Desktop Messenger	backweb-8876480.exe	"Installed with the software for Logitech products. Automatically checks for software upgrades AND new products
N	Logitech Desktop Messenger	ldmconf.exe	"Installed with the software for Logitech products. Automatically checks for software upgrades AND new products
U	Logitech Hardware Abstraction Layer	Khalmnpr.exe	"For a Logitech Bluetooth wireless mouse. Part of SetPoint that sets the Windows mouse sensitivity to minimum. The idea is that you will use the SetPoint Control Panel to adjust your mouse sensitivity. This setting is maintained separately from the Windows setting
U	Logitech SetPoint	KEM.exe	Keyboard and mouse drivers and utilities for Logitech's latest products - supersedes iTouch and MouseWare on their older products. Required if you use special features such as multimedia keys
U	Logitech Utility	Logi_MwX.exe	Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as "SmartMove". If you disable it and find you don't need it leave it disabled
N	Logitech Wakeup	lgwakeup.exe	Loads at startup and monitors the scanner. When a document is inserted in the scanner the wakeup program feeds the document a fraction of a inch into the scanner and then it launches the control center software. From the control center you can select whether to fax or copy or print the scanned documents. If you uncheck the Logitech wakeup software from the startup it no longer launches the control center or feeds the document a fraction of an inch. You can manually launch the control center software via Start ->Programs and still be able to scan images
X	Logitech Wireless	logitechwls.exe	"Added by the MYTOB-BS WORM!"
U	LogitechCameraAssistant	CameraAssistant.exe	Related to Logitech QuickCams and provides additional configuration options for these devices
U	LogitechCameraService(E)	ElkCtrl.exe	Related to Logitech Camera Service and provides additional configuration options for these devices
N	LogitechDesktopMessenger	LogitechDesktopMessenger.exe	"Installed with the software for Logitech products. Automatically checks for software upgrades AND new products
U	LogitechGalleryRepair	ISStart.exe	"LogitechGalleryRepair/LogitechVideoRepair - part of Logitech Image Studio - installed with Logitech QuickCam cameras. Required from version 8.11 onwards if you use the software to take pictures and capture videos
N	LogitechImageStudioTray	LogiTray.exe	Logitech Image Studio - installed with Logitech QuickCams
X	Logitechs	Logitechs.exe	"Added by the SDBOT.BWE WORM!"
N	LogitechSoftwareUpdate	ManifestEngine.exe	"Updater
U	LogitechVideoRepair	ISStart.exe	"LogitechGalleryRepair/LogitechVideoRepair - part of Logitech Image Studio - installed with Logitech QuickCam cameras. Required from version 8.11 onwards if you use the software to take pictures and capture videos
N	LogitechVideoTray	LogiTray.exe	Logitech Image Studio - installed with Logitech QuickCams
N	LogitechVideo[inspector]	InstallHelper.exe	Logitech QuickCam software installation helper
N	LogiTray	LogiTray.exe	Logitech Image Studio - installed with Logitech QuickCams
U	Logi_Mwx	Logi_MwX.exe	Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as "SmartMove". If you disable it and find you don't need it leave it disabled
U	LogMeIn GUI	LogMeInSystray.exe	"RemotelyAnywhere is a remote administration and remote control solution for Windows. It allows access to the host computer via the network (the LAN
U	LogMeIn GUI	ragui.exe	"RemotelyAnywhere is a remote administration and remote control solution for Windows. It allows access to the host computer via the network (the LAN
X	Logo	[path to trojan]	"Added by the DLOADER-RH TROJAN!"
U	Logon Loader	LogonLoader.exe	"Logon Loader - customize boot & login screens"
U	Logon Loader Random	LogonLoader.exe	"Logon Loader - customize boot & login screens"
X	Logon.exe	logon.exe	"Added by the ZINS.A TROJAN!"
U	LogonStudio	logonstudio.exe	"WinCustomize LogonStudio - "Allows Windows XP users to edit
X	LogService	wincalc.exe	"Added by the PAPROXY TROJAN!"
X	LogService	lsass.exe	"Added by the IU TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
U	LogWatch	logwat95.exe	Licensing patch for products installed on NT by Computer Associates such as eTrust. Detects and updates old versions of lic98.dll. Not required if you already have a newer version or the patch has been applied
X	longos	WIWT.EXE	"Added by the BANKER-CD TROJAN!"
Y	Look 'n' Stop	looknstop.exe	"Look 'n' Stop personal firewall"
N	LookNMeet	Agent.exe	"LooknMeet dating service"
X	Lookup_Sys	lookupsys.exe	P04n trojan
N	Lotus Organizer EasyClip	easyclip.exe	""The Easy Clip icon automates the collection of information from sources such as e-mail to create an Organizer address
N	Lotus QuickStart	smartctr.exe	"Lotus central application
U	Lotus SuiteStart	suitest.exe	Puts the individual Lotus components in the system tray taskbar when you start Windows. Can be disabled via MSCONFIG -> Startup as "Lotus SuiteStart 97 Edition". All individual components available via Start -> Programs
X	LowVersionSupport	[filename]	"Added by the LASTRAS TROJAN!"
U	LPManager	LPMGR.exe	"Part of Lenovo's IBM ThinkVantage Productivity Center for - ""guides you to a host of information and tools to help you set up
X	Lpr	Lpr123.exe	"Added by the REMPSTEAL password stealer TROJAN!"
X	Lpr123	Lpr123.exe	"Added by the REMPSTEAL password stealer TROJAN!"
U	LPS	Lps.exe	"Local Port Scanner - ""With LPS you're able to check your computer for open or listening ports"""
U	LPtask	lptask.exe	"Program Lock It And Protect Pro - lock and protect your folders from being opened
X	LRBZ Utility 32	lrbz32.exe	"Added by the AGOBOT-JQ WORM!"
N	LS120 Superdisk	??	"Supposed to accelerate transfer rate on LS-120
X	LSA	wfdmgr.exe	"Added by the MYTOB.C WORM!"
X	LSA	lsa.exe	"Added by the SDBOT-YV WORM!"
X	LSA Service	LSASS.exe	"Added by the AHKER.G WORM! Note - this is not the legitimate lsass.exe process
X	lsa Services	lsa2srv.exe	"Added by the TAME-C WORM!"
X	LSA Shell (Export Version)	LSASS.exe	"Added by several variants of the AHKER WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	LsaManager	lsamgr.exe	"Added by the BEAGLE.DR WORM!"
X	lsass	lsass.exe	"Added by the RATSOU.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a DebugUserMode subfolder of the Winnt or Windows folder"
X	lsass	start.bat	"Added by the ZCREW TROJAN!"
X	lsass	[path to lsass.exe]	"Added by the ALADINZ.F TROJAN! Note - this is not the legitimate lasss.exe process which should NOT appear in Msconfig/Startup!"
X	lsass	lsasrv.exe	"Added by the MYDOOM.AG or MYDOOM.AS or MYDOOM.AU WORMS!"
X	Lsass	woekd.exe	Added by an unidentified WORM or TROJAN!
X	lsass	elite***32.exe	"EliteBar adware"
X	Lsass	Lsass.exe	"Added by the ALCOP-B WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	Lsass	Lsass.exe	"Added by the VOUMIT-A WORM! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a ""mirc32"" folder"
X	LsasS	Sygate.exe	"Added by the SDBOT.BCA WORM!"
X	Lsass	kavmm.exe	"Added by an unidentified WORM or TROJAN! NOTE - do NOT confuse with the legitimate Kaspersky antivirus module as described here. Contrary to this impostor
X	LSASS 32	ISASS32.pif	"Added by the ASSIRAL-C WORM!"
X	LSASS Authority	lshosts32.exe	"Added by the SDBOT-UY TROJAN!"
X	LSASS Authority	lsvhosts.exe	"Added by the SDBOT.BCE WORM!"
X	LSASS Daemon	LSASSd.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	lsass service	lsass2.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	lsass2k Update	lsass2k.exe	"Added by a variant of the RBOT WORM!"
X	LSASS32	Isass32.exe	"Added by the KELVIR.M WORM!"
X	lsass32	lsass32.exe	"Added by the LYDRA-B TROJAN!"
X	lsass64BiT.exe	lsass64BiT.exe	"Added by the FORBOT-CK WORM!"
X	lsassig	lsassig.exe	"Added by the BANCOS-EC TROJAN!"
X	lsasss	lsasss.exe	"Added by the GEEKMY-A TROJAN!"
X	lsasss.exe	lsasss.exe	"Added by the SASSER.E WORM!"
N	lsburnwatcher	lsburnwatcher.exe	Used for automatically updating HP programs
X	lsess	lsess.exe	"Added by the SINNAKA.A WORM!"
X	lsmass	lsmass.exe	"Added by the WALLOP-B TROJAN!"
X	lsmss.exe	lsmss.exe	"Added by the PROXY-GG TROJAN!"
U	LSPFix	LSPmonitor.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
X	lspins	igps.exe	Reported as the VB.KC TROJAN by Kapersky Anti-Virus
U	LSPmonitor	LSPmonitor.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
X	lssass	lssas.exe	"Added by the AGOBOT.RL WORM!"
X	LSvr	LSvr.exe	"PowerStrip foistware"
Y	LT DAEMON	ltdaemon.exe	Acts as a data spooler for the DSL modem (similar to a cache). Do not uncheck if the DSL modem is being used
X	LTDMgr	LTDMgr.exe	"PowerStrip foistware"
X	LTM2	MSGSRV32.EXE	"Added by the LITMUS.A TROJAN! Note - MSGSRV32.EXE in this case is in a Litmus sub-directory and is not to be confused with the valid version in C:WindowsSystem"
X	LTM2	MPGSRV32.EXE	"Added by the LITMUS.201 TROJAN!"
X	LTM2	MSGSRV320.EXE	"Added by the LITMUS.C TROJAN!"
X	LTM2	winupdate.exe	"Added by the LITMUS.203 TROJAN!"
X	LTM2	bible.exe	"Added by the LITMUS.203 TROJAN!"
X	LTM2	winscan.exe	"Added by the LITMUS-B TROJAN!"
U	LtMoh	Ltmoh.exe	Modem On Hold utility - manages incoming/outgoing voice calls on a single phone line while being connected to the internet
Y	LTMSG	ltmsg.exe	"One of the ""popular"" WinModem series. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information"
Y	Lto Manager	DesktopLtoManager.exe	"Related to Global Positioning System (GPS) found on HP iPAQ hw6500 unit and others"
N	LTSMMSG	LTSMMSG.exe	"Lucent Tech. Soft Modem Messaging application - may be found on Fujitsu Lifebook
X	LTSMSG	Shell32.exe	"Added by the LEMIR.B TROJAN!"
X	LTT2	rundll32.exe	"Added by the LINEAGE-BI TROJAN!"
Y	LTWinModem1	ltmsg.exe	"One of the ""popular"" WinModem series. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information"
X	ltwob	formatsys.exe	"Added by the SERFLOG.A WORM!"
X	ltwob	msmbw.exe	"Added by the SERFLOG.A WORM!"
X	ltwob	serbw.exe	"Added by the SERFLOG.A WORM!"
U	LUGuard	LUGuard.exe	"PC-Duo Remote Control enables your help desk technicians to take instant control of any remote desktop PC at any location across the LAN
X	lup	lup.exe	"Added by the IRCBOT_GEN WORM!"
Y	Lusetup	LUSetup.exe	"Symantec LiveUpdate installer - required to install a new version of the application. Will only run once
U	LVComs	lvcoms.exe	Lvcomm server. Related to Logitech Quick Cam - works fine without it but it is needed for the Logitech ImageStudio software to connect to the camera
U	LVCOMSX	LVCOMSX.EXE	"It provides extra functionality for Logitech multimedia webcam devices. It is non-essential to the running of the system
U	LWBMOUSE	lwbwheel.exe	Mouse driver - required if you use non-standard Windows driver features
U	LWBMOUSE	MOUSE32A.EXE	Mouse driver - required if you use non-standard Windows driver features
N	Lwinst Run Profiler	lwtest.exe	Logitech Wingman Profiler for the Logitech joysticks. Available via Start -> Programs
?	lxamsp32	lxamsp32.exe	"Associated with a Lexmark Printer - is it required?"
?	LXbbmgr	LXbbmgr.exe	"Lexmark printer button manager? Is it required?"
?	LXBLKsk	LXBLKsk.exe	"Lexmark related. What does it do
Y	lxbrbmgr	lxbrbmgr.exe	Lexmark printer button manager. Required for correct operation
?	LXBRKsk	LXBRKsk.exe	"Lexmark printer related. What does it do and is it required?"
?	LXBSCATS	"rundll32 [path] LXBStime.dll	_RunDLLEntry@16"
?	LXBTCATS	"rundll32 [path] LXBTtime.dll	_RunDLLEntry@16"
?	LXCCCATS	"rundll32 [path] LXCCtime.dll	_RunDLLEntry@16"
U	lxccmon.exe	lxccmon.exe	Lexmark 3300 series printers/scanners
U	LXCGCATS	LXCGtime.dll	Lexmark printing software - reports back on printer and cartridge useage
?	lxcgmon.exe	lxcgmon.exe	Lexmark printer related - what does it do and is it required?
N	LXSUPMON	LXSUPMON.EXE	Lexmark Printer. The printer should work fine without it

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.