Windows Startup Item Database

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
N	MMTray	mm_tray.exe	"MusicMatch Jukebox icon in the task tray - digital music player / CD burner and ripper / music organizer / playlist creator"
N	MMTray	MMTray.exe	"Part of Morgan Multimedia Codecs. Only required when the codecs are used"
N	MMTray2K	MMTray2K.exe	"Part of Morgan Multimedia Codecs. Only required when the codecs are used"
N	MMTrayLSI	MMTrayLSI.exe	"Part of Morgan Multimedia Codecs. Only required when the codecs are used"
?	mmusrstp	procrun.exe	"??"
X	mmxp2passion.exe	mmxp2passion.exe	"MediaMotor adware"
X	mmxrun	msosa.exe	Added by an unidentified TROJAN or WORM!
X	mmxrun	mswinindex.exe	"TwoSeven spyware"
X	mnklins	mnklins.exe	"VX2.Transponder parasite updater/installer related"
X	MNPol	mnpol.exe	"Added by the DLUCA.B TROJAN!"
U	MNS	MNS.exe	"Mobile Net Switch enables you to use your computer on more then one network with the click of a button. It allows you to automatically select the correct drive mappings
X	mnsvc	mnsvc.exe	"Added by the AUTOUPDER TROJAN!"
X	mnsvcsp	mnsvcsp.exe	"Added by an unidentified VIRUS
U	Mobile Phone Suite	MobilePhoneSuite.exe	Logitech Mobile Phone Suite
U	mobile PhoneTools	mPhonetools.exe	"Motorola Phone Tools"
N	mobsync	mobsync.exe	"MS Syncrhonization Manager - updates the network copy of materials that were edited offline
X	MOBSYNC32.EXE	mobsync32.exe	"Added by the FINERO TROJAN!"
N	MOD	muamger.exe	"MicroAngelo On Display from Impact Software lets you customize Windows icons. With a few exceptions
U	MOD	muamgr.exe	"Quick access to MicroAngelo 5.0. It can make the background of the icon text transparent and also change the color of the shortcut's text to a color you want. Very useful
X	Modem	locatesvc.exe	"Added by a variant of the SPYBOT WORM!"
X	Modem Driverz Updates	mdmdrv.exe	"Added by a variant of the SDBOT WORM!"
U	MODEMBTR	MODEMBTR.EXE	"Modem Booster from inKline Global to improve ISP connections"
X	Modeminf	Modeminf.exe	"Added by a variant of the CRYPTER.C TROJAN!"
U	ModemOnHold	MOH.EXE	NetWaiting Modem-on-Hold Application
N	ModemUtility	mdmsetpe.exe	System Tray configuration icon for Aztech modems
X	ModularConfig	syscnfg.exe	"Added by an unidentified VIRUS
X	Module Call initialize	"RUNDLL32.EXE reg.dll	ondll_reg"
X	Modulo 00FE0F01 Host Internet	syschost.exe	"Added by the DELF-KW TROJAN!"
N	Money Express	moneyexpress.exe	Part of MS Money. Available via Start -> Programs
N	MoneyAgent	money express.exe	Part of MS Money. Available via Start -> Programs
N	MoneyAgent	mnyexpr.exe	Microsoft Money
N	MoneyStartUp	Money Startup.exe	Microsoft Money
N	MoneyStartUp10.0	Activation.exe	Part of MS Money 2002. Available via Start -> Programs
X	monitor	monitor.exe	"Browser hijacker
U	Monitor	SD Monitor.exe	"""Transfer data quickly between your memory card and your computer with SanDisk's Readers
U	Monitor Apache Servers	ApacheMonitor.exe	Part of the Apache Web Server package. Useful only if you're running such a server on your PC. Available via Start -> Programs
U	Monitor Helper	monitor.exe	"MyLittleSpy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	Monitoring Service	svchost.exe	"Added by the CONE.C WORM! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a ""tasks"" subfolder of the Winnt or Windows folder"
X	Monitormgt	Monitormgt.exe	"Added by the GEMA TROJAN!"
U	MonitorSD	SDMonitor.exe	"Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here"
X	MONPluginSrIvcs	n3monap23.exe	"Added by a variant of the RBOT WORM!"
N	Monstersoundtray	Freectrl.exe	Diamond Multimedia sound card control panel
X	MonTest	vccxzq.exe	"Added by the SDBOT-EA WORM!"
U	MoodBook	mb.exe	"MoodBook is a free Windows utility that brings art to your desktop"
N	moon phase	moon.exe	"Moon Phase - tray icon that indicates the phases of the moon"
X	MoreResults	MoreResults.exe	"MoreResults adware"
N	Morpheus	morpheus.exe	"MusicCity Networks' Morpheus - another peer-to-peer client based on Kazaa. Notable in that this one doesn't seem to install the adware that clog the Kazaa download. They claim they are adware free
X	morphstb	morphstb.exe	"Adware downloader - recognized by Kaspersky antivirus as Trojan-Downloader.Win32.Stubby.c"
X	mosearch	mosearch.exe	"Fast Search in Office XP - similar to the new revision of the Find Fast feature in Office 2000. Fast Search uses the Indexing Services in Office XP to create a catalog of Office files on your computer's hard disk. As with Find Fast - a waste of resources. If it can't be disabled via MSCONFIG try here"
X	Motherboard Config	Ati2xxx.exe	"Added by the RBOT-AIK WORM!"
X	MotherBoard Sounds	Sounds.exe	"Added by the RBOT-AAP WORM!"
N	Motive SmartBridge	mpbtn.exe	"System tray icon for the Virtual Assistant from AT&T Broadband
N	Motive SmartBridge	MotiveSB.exe	"System tray icon for the Virtual Assistant from AT&T Broadband
N	Motive SmartBridge	BTHelpNotifier.exe	"System tray icon for help from BT Broadband
U	MotiveMonitor	motmon.exe	Found on HP/Dell and Compaq systems (and maybe others). MotiveMonitor is used�the suppliers on-line support and allows the agent at the far end to do harddrive/ram/video/etc tests on the computer. Can cause some users problems with IE and Netscape by disabling this - in this case leave it to run. You may also wish to leave it alone if the PC is still within the support period from the manufcaturer. For most users it's not required
N	MotiveSB	MotiveSB.exe	"System tray icon for the Virtual Assistant from AT&T Broadband
U	MotMon	motmon.exe	Found on HP/Dell and Compaq systems (and maybe others). MotiveMonitor is used�the suppliers on-line support and allows the agent at the far end to do harddrive/ram/video/etc tests on the computer. Can cause some users problems with IE and Netscape by disabling this - in this case leave it to run. You may also wish to leave it alone if the PC is still within the support period from the manufcaturer. For most users it's not required
X	motoin	mm15201518.Stub.exe	"Delfin Promulgate adware variant"
U	Motorola Desktop Suite	DesktopSuite.exe	"Related to Motorola Desktop Suite - PC software managing Motorola mobiles such as the A1000"
U	Motorola Desktop Suite mRouter Config	mRouterConfig.exe	"Configuration for Intuwave's mRouter - ""that enables easy connectivity between mobile devices and PCs across Bluetooth
U	Mount Safe & Sound	Fbmount.exe	From McAfee VirusScan version 5.x. Creates back-up sets of critical files in a separate area of a hard drive. If you make regular back-ups it's not needed and can be painful during system start
X	mouse	mouse.exe	"Added by the RBOT-AHJ WORM!"
N	Mouse 32A	Mouse32A.exe	Mouse driver to control mouse functions from Azona. Available via Start -> Programs
N	Mouse Suite 98 Daemon	pelmiced.exe	Mouse driver. Appears to cause a behaviour where the desktop suddenly flips back up when playing DirectX associated games
N	Mouse Suite 98 Daemon	ICO.EXE	Found on Sony Vaio and IBM Thinkpad (and possibly other) laptops and seems to be related to Mouse Suite 98 Daemon according to the properties. Appears to cause a behaviour where the desktop suddenly flips back up when playing DirectX associated games
X	mousebut	mousebut.exe	"Added by the CRYPTER.A TROJAN!"
X	Mousecntl	mousecntl.exe	"Added by a variant of the CRYPTER.C TROJAN!"
N	MouseCount	MC.exe	"MouseCount by Kittyfeet Software. "Utility for counting how many times us computer junkies click our mouse in a given session/day/week/month/year." Not required"
X	mousedrv	mousedrv.exe	"Added by the CRYPTER.A TROJAN!"
X	MouseDrv	[path to worm]	"Added by the ZOLOAD-B WORM!"
X	MouseDrv	update.exe	"Added by the ZOTOB.N WORM!"
U	mouseElf	MC.exe	"Genius NetScroll mouse driver - required if you use non-standard Windows driver features"
U	mouseElf	mouseElf.exe	System Tray access to the mouse control panel for Genius Netscroll mice. Required if you use non-standard Windows driver features
U	MouseImp	MImpHost.exe	"MouseImp Pro - "A reliable assistant that turns your mouse into a simple
X	mousepad	mousepad.exe	"Added by the CLICKER TROJAN!"
U	Mousinfo	mousinfo.exe	MS mouse information tool - for troubleshooting mouse problems
X	MoussaEvil	[path to file]	"Added by the MUSANUB-A WORM!"
X	MoveSearch	Search.exe	"PigSearch adware"
N	Movielink Manager Uninstall	msvcmm32.exe	"Auto-update for Movielink - internet movie rental System Tray access"
X	MovieM	lmovie.exe	"Added by the BEAGLE.DS WORM!"
X	MovieNetworks	MovieNetworks.exe	"MovieNetworks will connect you by DOMESTIC PREMIUM RATE TELEPHONE NUMBER 900-xxx-xxxx. So you get xxx rated pictures and junk. And it will allow you to stay on the internet on their line and $$$ and remove the C:Program FilesMovieNetworks directory"
X	Movieplace	Movieplace.exe	"MoviePlace malware"
X	Mozila Firefox	firebox.exe	"Added by the RBOT-AIP WORM!"
X	Mozilla Firefox	F1REF0X.EXE	"Added by a variant of the SDBOT WORM!"
N	Mozilla Quick Launch	Netscp6.exe	Netscape 6 and Mozilla browsers
N	Mozilla Quick Launch	Mozilla.exe	Netscape 6 and Mozilla browsers
U	Mozy Status	mozystat.exe	"Mozy - free backup at a secure
X	MP Tcloaxs	mptcloaxs.exe	"Added by the RANDEX.CT WORM!"
X	Mp3 Loader	Sysdata.EXE	"Added by the AVETTE-A VIRUS!"
X	MP3download	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	MPEO	Csinsm32.exe	Automatic logging of installs from Norton CleanSweep - available via Start -> Programs
Y	MPFExe	mpf.exe	McAfee Personal Firewall
Y	MPFExe	MpfTray.exe	McAfee Personal Firewall
Y	MPFTray	MpfTray.exe	McAfee Personal Firewall
X	MPL32 driver	MPL32.exe	"Added by the LOONY-M TROJAN!"
X	MPlay64	mplay64.exe	"Added by the MPLAY64 TROJAN!"
U	MplSetup	MplSetup.exe	Used by Ricoh network printers to enable network printing from the client
X	MPM Manager	MPM.exe	"Added by the DONBOMB.A TROJAN!"
U	MPower	MPower.exe	"MPower from MindBeat. ""Defragments and frees your RAM giving more stability to your system and avoiding needless use of swap file. Willl also benchmark (speed test) your hard disk drives and your CPU load"". MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
X	MPR MSG	mprmsg32.exe	"Added by the MYTOB.CF WORM!"
X	MPREXE	MPREXE.EXE	"Added by the OPASERV.T WORM! Note - this is not the legitimate Mprexe.exe system file"
Y	MPREXE.exe	mprexe.exe	"WIN32 Network Service Interface Process. MPREXE.exe enables the computer to have multiple clients/protocols for networks. There are some problems with it sometimes though - see here and here. Note - why some people have it listed in start-up programs I don't know but I was asked to include it here. It automatically runs in the background. NOTE : sometimes it will appear in start-ups if you have a virus"
X	MprHTML	MprHTML.exe	"Added by a variant of the VAGRNOCKER TROJAN!"
X	mprocessor	mprocessor.exe	InstallDollars.com foistware
U	MPSExe	mscifapp.exe	McAfee.com Privacy Service - "combines personal identifiable information (PII) protection with online advertisement blocking and content filtering"
Y	MpsOnn	MpsOnn.exe	Canon printer driver
?	MPT	MPT.exe	"??"
X	MPtask Services	mptask.exe	"Added by the LALA or AOT TROJANS!"
N	MPTBox	MPTBOX.EXE	Cannon Multi-Pass toolbox - a button bar
X	mptsgsvc.exe	mptsgsvc.exe	"Hacker Tool - detected by TDS-3 antitrojan as ""HackTool.Win32.Hidd.j"""
N	MPXTray	mpxptray.exe	"Windows Media Player PowerToy which is run from the taskbar. It can be used to hide Windows Media Player (when in use) and choose various standard buttons (play/pause
U	MP_STATUS_MONITOR	monitr32.exe	Cannon Multi-Pass status monitor - your choice
X	mqbkup	mqbkup.exe	"Added by the OPASERV.K WORM!"
N	mrtMngr	mrtMngr.exe	Maintenance Release Task Manager for Intuit's QuickBooks or Quicken
U	MRU-Blaster Scheduler	scheduler.exe	"Scheduler for MRU-Blaster - ""a program made to do one large task - detect and clean MRU (most recently used) lists on your computer"""
N	MRU-Blaster Silent Clean	mrublaster.exe	"MRU-Blaster - performs silent cleaning of MRU lists at boot"
U	MRUBlaster	indexcleaner.exe	"MRU-Blaster related - runs once in order to delete the index.dat file in the Temporary Internet Files and/or Cookies folder"
X	MS Auto-IPSec Protection	MSASP32.exe	"Added by the RBOT-AER WORM!"
X	MS Autoloader 32	MSAuto32.exe	"Added by the SPYBOT.BD WORM!"
X	Ms Builders	Wupated.exe	"Added by the AGOBOT-SS WORM!"
X	MS Config Loader	svchos1.exe	"Added by the AGOBOT.R WORM!"
X	MS Config Loader	MSWin32bck.exe	"Added by the GAOBOT.AA WORM!"
X	MS Config Loader	svcrhost.exe	"Added by a variant of the RBOT WORM!"
X	MS Config Service	Msloader32.exe	"Added by the RBOT-KJ WORM!"
U	MS Config v13	lrbz32.exe	"Added by the GAOBOT.AOL WORM!"
X	MS Configuration	MSFramer.exe	"Added by the RANDEX.OL WORM!"
X	Ms Configuration	microsoftsa32.exe	"Added by the KELVIR.X WORM!"
X	MS DATABASE	MSDATA32.EXE	"Added by a variant of the SDBOT WORM!"
X	MS Decryption Software	active.exe	"MediaTickets adware variant"
X	MS DirectX Sound Drivers	msdrvdx.exe	"Added by the RBOT.BCX WORM!"
X	MS DLL Library Manager	dllsys64.exe	"Added by the RANKY TROJAN!"
X	MS Domain Name Server Deamon	MSDNSD32.exe	"Added by the RBOT-CMZ WORM!"
X	MS DVD DirectX Dll Drivers	mdxdl.exe	"Added by the SDBOT-XI WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.