Windows Startup Item Database

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
N	OP12 Reminder	Ereg.exe	"Registration reminder for OmniPage Pro 12 from ScanSoft"
U	OpAgent	OpAgent.exe	"Part of Nuance (was Scansoft) OmniPage Pro document conversion software"
X	Open Service Drivers	opiater.exe	"Added by a variant of the RBOT WORM!"
X	Open Site	opnste.exe	"OpenSite adware"
X	Open Site	opensite.exe	"OpenSite adware"
X	Open2Enter	runme.exe	Adult content dialler
X	Open2Enter	runme2.exe	Adult content dialler
X	OpenGL Drivers	0penGLD.exe	"Added by the YIMP-A WORM!"
X	OpenMstart	mcmgr32.exe	"""Switch"" adult content dialler"
X	OpenMstart	mmgr32.exe	"""Switch"" adult content dialler"
X	OpenMstart	Snt.exe	"""Switch"" premium rate adult content dialler"
N	OpenOffice.org ..*	quickstart.exe	"OpenOffice.org office suite quick start (where ""..*"" is the version number)"
N	OpenOffice.org x	QUICKS~1.EXE	"Displays OpenOffice quick start applet in System tray. Right clicking on the icon allows rapid starting up of components of the OpenOffice suite. Available via Start -> Programs. Will automatically be started when any OpenOffice component is started from Start -> Programs. A resource hog (takes > 16 MB of memory). "x" represents the version number"
U	openvpn-gui	openvpn-gui.exe	"""OpenVPN is a full-featured SSL VPN solution which can accomodate a wide range of configurations
U	Openwares LiveUpdate	LiveUpdate.exe	"Web-update utility as used by various types of software - see here"
N	Operations Typhoon Rising Registration	NOVG.EXE	"Joint Operations registration reminder"
N	Operator	??	"Media Pilot operator
U	Operator	xtmop.exe	Fax/Phone answering facility for Extreem Machine - as supplied with the old Diamond SupraExpress modems. No longer supported
N	OpiStat	OPISTAT.EXE	"OpiStat is a European Research Institute whose goal is to understand consumer needs and opinions better"
X	OPQFile	regedit.exe /s ...rad03FA6.tmp	Unsavoury program that resets your homepage every time you restart - uncheck in MSCONFIG and delete it via a registry edit
X	opr	opr.exe	"MediaMotor adware"
U	OpScheduler	OpScheduler.exe	"Part of Nuance (was Scansoft) OmniPage Pro document conversion software"
X	opsql update check	opsql.exe	"Added by the RBOT-ACJ WORM!"
X	OPTIMIZER	iexplore.exe	"Added by the EVEVINC TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in the System (9x/Me) or System32 (NT/2K/XP) folder"
X	Optimum Online	Netsurf.exe	OptimumOnline ISP software related spyware - displays advertising popups and collects information about user activity
X	Optional Web Drivers For WIN32	phqghume.exe	"Added by a variant of the RBOT WORM!"
U	OPTMOUSEMOUSE	optmouse.exe	"Related to a Samsung optical mouse"
U	Optus Cable Data Monitor	datamonitor.exe	"Allows Optus customers to monitor their actual data usage against Optus' ""data allowance limits"""
U	OptusNetUsage	OptusNet Usage Meter.exe	"Designed specifically for OptusNet users who wish to have their connection monitored on a frequent basis. It can also estimate when you are going to hit your usage limit
N	Opware12	Opware12.exe	"OmniPage Pro 12 from ScanSoft"
N	Opware14	Opware14.exe	"ScanSoft's OmniPage Pro 14 - If running
N	Opware15	Opware15.exe	"Nuance (was ScanSoft) OmniPage Pro 15 document conversion software. If running
N	OpwareSE2	OpwareSE2.exe	"ScanSoft's OmniPage_Pro_14 - If running
X	OrbitUpdate	update.exe	"Xupiter OrbitExplorer toolbar related. Drive-by foistware. Use Spybot S&D
X	OrbitView	view.exe	"Xupiter OrbitExplorer toolbar related. Drive-by foistware. Use Spybot S&D
N	OrderReminder	OrderReminder.exe	The HP Order Reminder utility is installed with the HP LaserJet printer software and allows you to set specific times for reminders to check the current level of toner in the print cartridge - it also contains an Order Now link to a Web page that helps you order supplies online from a reseller of your choice
X	orderShell	order***.exe [ = random char]	"Added by the DLOADR-UN TROJAN!"
X	order_Shell	order_smey.exe	"Added by the BANKSNIF-H TROJAN!"
?	org5.exe	org5.exe	"Lotus Organizer 5 application file
X	OrgyCam	OrgyCam.exe	Adult content dialler
U	OrigRage128Tweaker	RAGE128TWEAK.EXE	"Third party tweaker for ATI Rage 128 Video cards from http://www.rageunderground.com"
U	ORiNOCO	Cmluc.exe	"Client Manager software for an ORiNOCO wireless LAN card"
X	OS Security	mswind32.pif	"Added by the RBOT-ASU WORM!"
X	OSA	winword.exe	"Added by the KANGAROO-A TROJAN!"
X	Osa32	NTOSA32.exe	"Added by the ANIG WORM!"
?	osCheck	osCheck.exe	"Part of Norton Antivirus. What does it do and is it required?"
U	OSD	OSD.exe	"By Netropa for HP and other brands. Same group as KBD MediaCenter & Touch Manager. Pressing a "hot key" on such a keyboard brings a corresponding panel on the screen for volume
X	OSS	ossproxy.exe	"MarketScore parasite - ActiveX control used to download premium-rate dialers"
X	OSS	rk.exe	"MarketScore parasite - ActiveX control used to download premium-rate dialers"
X	OSS	rlvknlg.exe	"MarketScore parasite - ActiveX control used to download premium-rate dialers"
X	OSSProxy	OSSPROXY.EXE	"MarketScore parasite - ActiveX control used to download premium-rate dialers"
U	OStivityInvAgt	ostivity.exe	"OStivity - "a desktop and server hardware and software asset/inventory solution for small to enterprise sized organizations that need to quickly gain knowledge of 'what's installed' without having to manually touch every computer in the company. The next time the computer logs into the network
X	Osus	acao.exe	"PurityScan/Clickspring adware"
X	Osus	rrup.exe	"PurityScan/Clickspring adware. The executable is located in the user's ""Application Data"" folder or the Program Fileshtwu folder"
X	otcx	otcxxh.exe	"Added by the CAROOL TROJAN!"
X	outlook	outlook.exe	"Added by the SDBOT-RU WORM!"
X	outlook	outlook.exe	"Added by the ALCRA.F WORM! Note - this is not the valid MS Office program which is found in Program FilesMicrosoft OfficeOffice. This file is found in Program FilesOutlook"
X	Outlook Express Config	****.exe [ = random char]	"Added by a variant of the RBOT WORM!"
X	Outlook Express Protocol	look.exe	"Added by the RBOT-ACS WORM!"
X	Outlook Mail Services	express.exe	"Added by the RBOT.CJN WORM!"
X	Outlook Mail Services	outlook.exe	"Added by the RBOT-BKA TROJAN! Note that the valid MS Outlook executeable is located in the Program FilesMicrosoft OfficeOffice directory wheras this one is found in the System (9x/Me) or System32 (NT/2K/XP) folder"
X	OutLooks	InSane.exe	"Added by the SWOOP TROJAN!"
Y	Outpost Firewall	outpost.exe	"Outpost personal firewall"
X	outpostupdate	outpostupdate.exe	"Added by the COSIAM-C TROJAN!"
X	Outwar	syslaunch.exe	Outwar adware downloader
?	OVCJ	ovcj.exe	"??"
N	Overnet	Overnet.exe	"Overnet peer-to-peer (P2P) file sharing program"
X	ovyriwi	telace.exe	"Added by the SDBOT.BVS WORM!"
U	OWCCardbusTray	ocbtray.exe	Icon in the system tray for safely removing PCMCIA cards. Only required if you have a laptop or desktop which includes a PCMCIA card interface
U	OWCWebCamDV	wcdvtray.exe	"WebCamDV from Orange Micro
X	OWMngr	OWMngr.exe	"OnWebMedia/SearchSeekFind advertising foistware"
U	OxigenClientAdmin	Oxigen.exe	Open University Oxigen screensaver admin client. Downloads the latest information from the net to display in the screen saver
X	oz2	oz2.exe	"Added by the MYDOOM.W WORM!"
X	P0w3rF1Y	svchost.exe	"Added by the MM TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
?	P17Helper	"Rundll32 P17.dll	P17Helper"
N	P2P NETWORKING	P2P Networking.exe	Peer to Peer (P2P) sharing of files on the internet
N	P2P Networking	P2P	Peer to Peer (P2P) sharing of files on the internet
X	P2P Networking2	P2P Networking2.exe	P2P Networking2.exe is an advertising program by Joltid. This process monitors your browsing habits and distributes the data back to the author's servers for analysis. This also prompts advertising popups. This program is a registered security risk and should be removed immediately
N	P2P Networking3	P2P Networking3.exe	"P2P Networking
X	p2pnetwork	p2pnetwork.exe	"Added by the ALCAN.A WORM!"
X	p2pnetworking	p2pnetworking.exe	"Added by the RBOT-AFL WORM!"
X	P3p4chk	P3p4chk.exe	"Added by the GEMA TROJAN!"
X	p4mx4	p4mx4.exe	"Added by the CRYPTER.A TROJAN!"
X	PaciSoft	pacis.exe	"PacerD Media/Pacimedia.com adware installer"
?	Packard Bell EverSafe Tray Control	TrayControl.exe	"Packard Bell EverSafe software. What does it do
N	PadTouch	PadExe.exe	Toshiba Touch and Launch - offers easy movement and freedom of programs navigation with TouchPad
U	Pagekeeper Jobs	pkjobs.exe	"PageKeeper Jobs is a separate PageKeeper program that handles the analysis of new documents and keeps track of the location and content of current documents in PageKeeper. Pagekeeper comes bundled with scanners such has HP
U	Pagekeeper Lite	pkjobs.exe	"PageKeeper Jobs is a separate PageKeeper program that handles the analysis of new documents and keeps track of the location and content of current documents in PageKeeper. Pagekeeper comes bundled with scanners such has HP
X	PAgent	PAgent.exe	"Scans your hard drive for the popular P2P file-sharing applications BearShare
N	Pagis Scheduler	Monitor.exe	"Scheduler for the Pagis scanning suite from Scansoft. "
?	pagmstart	client.exe	"Possibly related to this?"
N	Pagoo	PAGOO.EXE	"Pagoo - internet call waiting. Intercepts telephone calls like an answering machine and plays the voice message on your PC. Only required when you're on-line and via dial-up modem"
X	paint.exe	shnlog.exe	"Added by the PUPER-A TROJAN!"
X	PaintingRoom evidence monitor	paintingroom.exe	Paintingroom.com smiley software - not recommended as the site tries to drop a trojan on you...
X	PaintingRoom smile monitor	paintingroom.exe	Paintingroom.com smiley software - not recommended as the site tries to drop a trojan on you...
N	PAL Evidence Eliminator	Cleaner.exe	"PAL Evidence Eliminator - cover the tracks of your browsing habits and E-mails if you think you need to. Run manually on a regular basis"
?	Palm MultiUser Config	Configtool.exe	"MultiUser configuration for a Palm PDA device?. Is it required?"
N	Palm.exe	Palm.exe	"Palm Desktop Software for use with Palm handheld devices. Available via Start -> Programs"
N	palmOne Registration	register.exe	"Registration reminder for Palm products"
X	PalNetaware	pnetaware.exe	"PalTalk adware - as included in Morpheus
N	PaltalkNetaware.exe	PALNETAW~1.EXE	Voice chat program. This program stores all buddy list info apparently on the server itself so you never lose your buddy list should you need to reinstall the program due for whatever reason or even reformat. Available via Start -> Programs. Delete the shortcut in Start -> Programs -> StartUp as well otherwise it will be reinstated
U	pamela.exe	pamela.exe	"Pamela is a plug-in or add-on that adds features to Skype peer to peer voice service"
U	Panasonic Communications Utility	Mfpscdl.exe	"Port manager for Panasonic Panafax fax_machines"
U	Panasonic HotKey Manager	HKEYAPP.EXE	HotKey management for Panasonic rugged mobile PCs
U	Panda Antispam Server Service	PasSrv.exe	"AntiSpam software
Y	Panda Cleaner	pavdr.exe	"Panda Antivirus related - possibly Panda ActiveScan"
Y	Panda Preventium+ Service	PREVSRV.EXE	"Panda Titanium Antivirus"
U	Panda Scheduler	pavsched.exe	"Panda Antivirus scan scheduler. Required if this is your virus scanner program and you have scans scheduled on a regular basis. I recommend that you scan manually so you don't need this but if you tend to forget then leave it"
X	Panda Software Intrenet	panda.pif	"Added by the RBOT-ATZ WORM!"
X	PandaAVEngine	PandaAVEngine.exe	"Added by the NETSKY.R WORM!"
U	PandaScheduler	pavsched.exe	"Panda Antivirus scan scheduler. Required if this is your virus scanner program and you have scans scheduled on a regular basis. I recommend that you scan manually so you don't need this but if you tend to forget then leave it"
U	Pando	Pando.exe	"""Pando is free software that lets you send and receive files and folders of any size* with your existing email address"""
X	Pantera	pantera.exe	"Added by the SDBOT.AYN WORM!"
N	Paperport	runppdrv.exe	"Loads the drivers associated with monitoring scanner status associated with PaperPort software. Can be a resource hog - see here"
N	PaperPort PTD	pptd40nt.exe	"PaperPort" software associated with scanners
N	PaperQuote System Tray Icon	PQTRAY.EXE	PaperQuote is a "wallpaper" changer with daily quotes that are either for inspiration or motivation
X	Parallel Tasking	ptask.exe	"Added by the SMALL-CJ TROJAN!"
U	PartSeal	PartSeal.exe	System backup for Sony Vaio PCs. Adds a recovery mechanism for users over and above any System Restore features - allowing users to revert a drive back to the state it was when bought form the factory by hitting F10. The user obviously loses any data stored if not backed-up elsewhere
U	Password Door Loader	PDMonitor.exe	"Password Door - password protection software"
N	PasteLister	plister.exe	"PasteLister - clipboard extender. Start manually when required"
X	Patch	patch.exe	"Added by the NETBUS WORM!"
X	Patches Value	WinGamed.exe	"Added by the SDBOT.BR WORM!"
?	Path	lide.exe	"??"
X	pathname	pathname.exe	"Added by the IRCCONTACT TROJAN!"
?	PathNvidiaTV	patchnvidiaTVout.exe	Appears to be related to Nvidia Gigabyte Video card. Typical file location is the Program FilesGigabyteNvidia folder
X	PAV.EXE	%Number%	"Added by the KITRO.D (or ARGEN.A) WORM! %Number% can be any number"
Y	PAV.EXE	PAV.EXE	"PER Antivirus"
Y	PAVFIRES	PavFires.exe	"Panda Antivirus"
Y	PAVFNSVR	PavFnSvr.exe	"Panda Titanium Antivirus"
Y	Pavkre9x	pavkre9x.exe	"Panda Titanium Antivirus"
Y	PavProc	PavPrS9x.exe	"Panda Titanium Antivirus"
Y	PavProt	PavProt.exe	"Panda Titanium Antivirus"
Y	Pavprot9	Pavprot9.exe	"Panda Titanium Antivirus"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.