Windows Startup Item Database

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
N	SetHook	SetHook.exe	"Fellowes Neato CD label design software. ""Launch NEATO's MediaFACE II label making software directly from the productname toolbar"""
N	SETI@home	SETI@home.exe	SETI@home is a scientific experiment that uses Internet-connected computers in the Search for Extraterrestrial Intelligence (SETI). You can participate by running a free program that downloads and analyzes radio telescope data
N	seticlient	SETI@home.exe	SETI@home is a scientific experiment that uses Internet-connected computers in the Search for Extraterrestrial Intelligence (SETI). You can participate by running a free program that downloads and analyzes radio telescope data
N	SetIcon	SetIcon.exe	"Installed by a 6-in-1 (4 Media Card slots
N	SetiQueue	Setiqu~1.exe	"Provides work unit buffering for Seti@Home clients - see here for more details"
N	SetiSpy	SetiSpy.exe	"SETI Spy is a little program to ""spy"" on the progress and performance of the SETI@home client. Called a ""spy"" because it is unobtrusive as possible"
X	SetPoint	SetPoint.exe	"Added by the RBOT-BWI WORM!"
X	SETPOINT Logitech Inc	KHALMNP.exe	"Added by the RBOT-AAX WORM!"
?	SetRefresh	SetRefresh.exe	"Found on a Compaq PC. Video refresh rate utility? Is it required?"
X	Setting	sysweb.exe	"Added by the SDBOT.GEN TROJAN!"
N	setup	hphprld.exe ....setup.exe	HP DeskJet Setup - printers function normally without it
X	Setup experation	svchost.exe	"Added by the TOFGER-AW TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder"
X	setupa	runt32.exe	"Added by the QQPASS-K TROJAN!"
X	setupdata	rnll32.exe	"Added by the QQPASS-AC TROJAN!"
N	SetupICWDesktop	icwconn1.exe	Appears to be the "Internet Connection Wizard" from Internet Explorer being set-up as a desktop shortcut. Appears under the RunOnce registry key but is available under Start -> Programs -> Accessories -> Communication (or similar) anyway
X	setupuser	regedit.exe setupuser.log	"Regfile in disguise - another CoolWebSearch parasite variant"
?	setuzp	setuzp.exe	"??"
X	SetVrc	setvrc.exe	"Added by the HUNTOCX WORM!"
X	Sex Teris	st01b.exe	"Added by the REPAD WORM!"
X	Sexnow	Sexnow.exe	"Added by the SENOW-B premium rate adult content dialler"
X	Sexy_Blondes	Sexy_Blondes.exe	"Added by the Sexy DIALER!. Related also to Hot Tarts DIALER!"
X	Sexy_sg	Sexy_sg.exe	Premium rate adult content dialler
X	sf	sf.exe	"SurfEnhance adware component"
N	SFIGUI	SFIGUI.EXE	"Sonic Focus - ""enhances music
X	sfita	sfita.exe	"Added by the FAVADD-H TROJAN! Also known as SurfEnhance adware"
N	SFP	vzSFPWin.EXE	Verizon Online Support Center - prompts for online updates
U	sfpc	sfpc.exe	"Spy4PC is a surveillance software program that monitors user activity
X	SFtrb Service	cftrb32.exe	"Added by the SOBIG.D WORM!"
U	SfWinStartInfo	sfWinStartupInfo.exe	SFIRM32 Online Banking software
U	Sgecrypt	Sgecrypt.exe	"SafeGuard Easy - ""provides total company-wide protection for sensitive information on laptops and workstations. Boot protection
U	Sgeecview	Ecview.exe	"SafeGuard Easy - ""provides total company-wide protection for sensitive information on laptops and workstations. Boot protection
U	sginst	sginst.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
?	SGTBox	SGTBox.exe	"Canon scanner driver. Is it required?"
U	sgtray	sgtray.exe	"StorageGuard from Veritas. Free utility that integrates with Backup MyPC (formerly Backup Exec Desktop)
X	shambl3r	cnf.bat	"Added by the REMABL WORM!"
X	shambl3r*	shambl3r.exe	"Added by the REMABL WORM! where * is 2 to 11"
X	Shania	Shania.vbs	"Added by the SHANIA VIRUS! - NOTE: this malware actually changes the default value data of the Registry ""Run"" key in order to force Windows to launch it at boot. Name field may be empty"
N	Share-to-Web Namespace Daemon	hpgs2wnd.exe	""HP's exclusive Share-to-Web software makes it easy to share content with others through our affiliate Internet websites."" In other words an application that allows users to upload scanned images to their personal webpages if desired. Available via Start -> Programs"
N	Shareaza	Shareaza.exe	"Shareaza P2P client"
U	Shareaza	bindata.exe	"Shareaza P2P client related"
X	sharedprem	sharedprem.exe	"Added by the MAKECALL TROJAN!"
Y	Sharing and Mapping Software	DShmap.exe	"Intel AnyPoint internet sharing software"
N	SharkEject	AEJCT32.exe	"Allows you to eject a disk from the Avatar Shark drive from the system tray. When loaded
U	SharpTray	SharpTray.exe	"Part of Shcenter	chcenter.exe	"IMSI HiJaak - ""the easiest way to convert
X	SheduIer	svchst.exe	Premium rate adult content dialler
X	SheduIer	shch.exe	"Added by the EB TROJAN!"
X	SheduIer	winagent.exe	"Added by the EB TROJAN!"
X	Shedule Connection	arpo412.exe	"Added by the PPDOOR-R WORM!"
X	Sheduler	nerocheck.exe	"Added by the TACTSLAY.B TROJAN!"
X	Shell	Shell32.exe	"Added by the BADSECTOR TROJAN!"
X	Shell	ray.exe	Homepage hijacker re-directing browsers to adult content websites
X	Shell	Tray.exe	Homepage hijacker re-directing browsers to adult content websites
X	Shell	wmedia16.exe	"Added by the GOLDUN TROJAN!"
X	Shell	Open32.exe	"Added by the SMALL-DL TROJAN!"
X	Shell	Explorer.exe sound_drive16.exe	"Added by the GP TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System subfolder"
X	Shell	"Explorer.exe	msmsgs.exe"
X	Shell	Explorer.exe [path] svchost.exe	"Added by the DOYORG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in the Winnt or Windows folder"
X	shell	explorer.exe	"Added by the KAKKEYS TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the System32 subfolder"
X	Shell	iexplore.exe	"Added by the KIPIS-U TROJAN! Note - this is not the legitimate Internet Explorer iexplore.exe process which is always located in the Program FilesInternet Explorer folder and should not normally figure in Msconfig/Startup! This file is located in a ""Microsoft"" subfolder"
X	Shell	ibm0000.exe [ = digit]	"Added by the TORPIG-C and TORPIG-J TROJANS! Filenames spotted include ibm00001.exe
X	Shell	taskmrg.exe	"Added by the BANCBAN-FT TROJAN!"
X	Shell	Explorer.exe winupdate.exe	"Added by the AGENT-FD TROJAN!"
X	Shell	ibm[RANDOM 5 DIGIT NUMBER].exe	"Added by the ANSERIN TROJAN!"
X	Shell	svchost.exe	"Added by the GOLDSPY-B TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	Shell API32	svcnet.exe	"Added by the TIBICK.C WORM!"
X	Shell Extension	spollsv.exe	"Added by a variant of the LOVGATE WORM!"
X	Shell Tray Window	ShellTraywnd.exe	"Added by the STULTDOR-A TROJAN!"
X	shell update	shellexec.exe	"Added by the AGOBOT-TH WORM!"
X	Shell32	Shell32.vbs	"Added by the SCAFENE WORM!"
X	shell32	ntldrt.exe	"Added by the JLOK-A WORM!"
X	Shell32	iexplore.exe	"Added by the IRCBOT-AY TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) process
X	ShellApi	SHELLMSN.EXE	"Added by the NETDEV.B TROJAN!"
X	Shellapi32	Shellapi32.exe	"Added by the NETDEVIL (or NERTE) TROJAN!"
X	Shellapi32	mcvsrte.exe	Added by an unidentified WORM! Note - do not confuse with the McAfee SecurityCenter file of the same name
X	ShellCommand	[path to file]	"Added by the REMCON-A TROJAN!"
X	ShellEx	ShellEx.exe	"Added by the ANAKHA TROJAN!"
X	ShellOS	A+++.exe	Added by the AV TROJAN!
X	ShellRun	lexplore_.exe	"Added by the MSNOPT-A TROJAN!"
X	ShellRun32	iexplore.exe	"Added by the IRCBOT-AY TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) process
X	Shellspl	lsas.exe	"Added by the YALER-A TROJAN!"
X	Shellspl	spools.exe	"Added by the PROXAGE-A TROJAN!"
X	shellsystem	shellsystem.exe	"Added by the UPCHAN TROJAN!"
X	shhost	shhost.exe	"Added by the AGENT.CE TROJAN!"
N	shicoxp	shicoxp.exe	Installed with the drivers for multi card readers of various brands. To differentiate between the various card slots on multi slot readers the shicoxp.exe file assigns and loads unique drive icons for the various card slots that are displayed in Windows Explorer
X	Shine	Shine.exe	"Added by the HAPPYLOW (or NISHE-A) VIRUS!"
?	SHINITV	shinitv.exe	"??"
X	Shmgrate.exe	ibot4.exe	"Added by the GASTER TROJAN!"
N	ShockmachineReminder	SmReminder.exe	"Shockmachine is an entertainment playback device that lets you save your favorite Shockwave.com titles and play them back in full-screen mode
X	Shockwave	csrss.exe	"Added by the SNDOG WORM! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
N	Shockwave Init	SWINIT.EXE	Part of Macromedia Shockwave. Controls the Shockwave Remote Control Panel. The Remote Control can be activated manually from the Start Menu by locating and selecting Shockwave and then Shockwave Remote under Programs
N	ShortKeys 99	SHORTKEY.EXE	"ShortKeys from Insight Software Solutions - allows you to program keys with text strings"
Y	sHotKey	sHotKey.exe	"Special function key manager for Chicony keyboards - see here"
X	Showbehind	SHOWBEHIND.EXE	"Advertisement display which can be stopped here"
X	ShowFF	ShowFF.exe	"Added by the Adware.FFToolBar adware toolbar"
?	ShowIcon_Justrams_USB Product Driver v2.12r012	shwicon.exe	"Related to Just Rams USB product driver. Is it required?"
?	ShowIcon_SmartDisk Corporation_USB Card Reader v1.14e051	shwicon.exe	"Card reader for memory cards from digital cameras. Is it required? "
U	ShowLOMControl	[strange symbol]	"Note that there is a strange symbol in the command field. HKLMSoftwareMicrosoftWindowsCurrent VersionRunShowLOMControl Reg_DWORD 0x00000001 (1) LOM = LAN on Motherboard.It mean Show ""LAN on Motherboard"" Control.On systems where you can install an external LAN interface
X	Showme	Ruden.vbs	"Added by the HANDLE-A VIRUS!"
U	ShowWnd	ShowWnd.exe	"Found on Gateway computers (and maybe others) - see here. ""Showwnd is included with the Chicony keyboard software and is used by the software to stop the keyboard driver's taskbar entry from reappearing. It is not necessary to remove the keyboard software
U	SHPC32	SHPC32.exe	Port monitor for Lexmark printers on a USB connection. Ties in with the Printer Control Program. Features like cancelling a print are unavailable if disabled
Y	ShStatEXE	SHSTAT.EXE	"From McAfee VirusScan NT 4.x. Handles program communication among VShield components
U	Shutdownaware	shutdownaware.exe	"Loaded by the SWEEX 6-in-1 Media Card Reader to properly manage the reader while it is connected to your system"
U	ShutDownPro	ShutDownPro.exe	"ShutDownPro - shutdown
N	Si Meter	SIMETER.EXE	"si91e44b	"rundll32.exe [path] si91e44b.dll	EnableRunDLL32"
U	SIA2006	SIA2006.exe	"Part of Steganos Internet Anonym privacy software"
U	SIAPRO6	sia.exe	"Steganos Internet Anonym privacy software"
X	Sicom	Sicom.exe	"Added by the NETLIP WORM!"
U	SideACT	SideACT.exe	"SideACT organizer software"
X	Sidebar	Sidebar.exe	"Searchcentrix hijacker"
N	SIDEBAR	dsidebar.exe	"""Desktop Sidebar provides you with instant access to the information you most desire by grabbing data from your PC and the internet. The result is a dynamic visual display you configure and control"""
N	SideWinderTrayV4	SWTrayV4.exe	MS SideWinder game controller system tray icon. This is specific to version 4 of the software. Available via Start -> Programs
?	SigmatelSysTrayApp	stsystra.exe	"Related to Sigmatel. Appears to come preloaded"
?	SigX	sigx.exe	"??"
X	SigXC	SigX.exe	"SigX is a ""dynamic signature image generated based on whatever data your computer sends it though our SigX program. It can display your current Mp3
N	Simcast	SimcastAlerts.exe	"Simcast is a free service that allows you to subscribe to information on a large variety of topics. Alerts will appear on your desktop when a channel that you have subscribed to has something to say"
U	SimpLite-MSN	SimpLite-MSN.exe	Required if you use the SimpLite add-on to MSN Messenger (SimpLite adds encryption to the instant messaging service)
X	Singapore	singapore.exe	"Adds a blue crescent to the taskbar and when double-clicked displays an adult-content web-site. Also known to drop your internet connection and dial an international telephone number. See here for more information. Must be disabled in MSCONFIG before un-installing or it re-instates itself"
U	SIPPS	SIPPSSIPPS.exe	Web.de Internet phone utility
X	SiS Dns	dnssvc.exe	"Added by the DLOADER-UE TROJAN!"
N	SiS KHooker	khooker.exe	SiS Keyboard Daemon. System Tray utility which gets installed by the drivers of the latter day SiS VGA cards. Can cause errors at startup and isn't required
X	SiS Mpc Service	mpcsvc.exe	Added by an unidentified WORM or TROJAN!
U	SiS Tray	sistray.exe	System Tray icon for SiS based graphics. Note - this resides in C:WindowsSystem
U	SiS Windows KeyHook	keyhook.exe	"SIS graphics cards related: ""Super VGA Keyboard Daemon"" - hooks into the keyboard processing chain in order to enable hotkey settings"
Y	SiS7012Utility	SiSAudUt.exe	SiS Corporation sound card driver
?	SISAM10M	SISAM10M.exe	"??"
N	SiSAudio	MP_S3.exe	WinME patch for an older SiS 961 chipset FERR bug. Enable if you have audio problems
U	siscolor	color.exe	Probably on-board graphics related based upon the SiS chipsets. Has been seen on ASUS motherboards with SiS chipsets and known to cause conflicts if you choose another graphics card and disable the on-board
U	siService.exe	siService.exe	"Spam Inspector - anti email spam software"
?	SiSPower	"Rundll32.exe SiSPower.dll	ModeAgent"
U	SiSRaid	SRaid.exe	"Related to the SIS Raid system from Silicon Integrated Systems"
?	SiSSetCDfmt	SiSSetCDfmt.exe	"Related to a Silicon Integrated Systems Corp (SiS) product?"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.