Windows Startup Item Database

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	Socket Utility	socket.exe	"Added by the DAEMONI-E TROJAN!"
X	Socket Utility	svchostz.exe	"Added by the DAEMONI-E TROJAN!"
Y	SoDA Startup	SodaStartup.exe	"Used by the Rational SoDA project management tool. Unsure of it's actual purpose but it's recommended you leave it enabled if you use the software"
N	soffice	SOFFICE.EXE	Displays StarOffice quick start applet in System tray. Right clicking on the icon allows rapid starting up of components of the StarOffice 6.0 suite. Available via Start -> Programs. Automatically started when any StarOffice 6.0 component is started from the Start -> Programs. A resource hog (it eats > 16 MB of memory).
X	Soft Profile Inc	hxdef.exe...	"Added by a variant of the LOVGATE WORM!"
X	softIce Update 32	wininits.exe	"Added by the RBOT-ANB WORM!"
U	SoftickPPP	PPPGate.exe	"Softick PPP is a Microsoft Windows driver that allows to establish PPP session between Palm powered devices and Microsoft Windows desktop computer"
Y	SOFTinst	N/A	For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out
U	SoftStuff Wallpaper Changer	softstrt.exe	"AzureBay wallpaper changer"
X	Software	software.exe	"Added by the CRABTON-B TROJAN!"
U	SoftwareStation	station.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
Y	Solo Sentry	Solosent.exe	"Solo Antivirus"
U	SoloSchedule	Solocfg.exe	"Scheduler for Solo Antivirus. Leave enabled unless you scan manually on a regular basis"
U	SoloSysCheck	Syscheck.exe	"Solo antivirus System Integrity Check - Monitors system registry
X	somatic	somatic.exe	"Searchcentrix hijacker"
N	Sonic A3D Control	vrtxctrl.exe	Sound related options
X	Sonic RecordNow!	smsc.exe	"Added by a variant of the SDBOT WORM!"
N	SoniqueQuickStart	sqstart.exe	"Quickstart for Sonique audio player. Available via Start -> Programs"
?	SonnReg	SonnReg.exe	"Part of E-Color 3Deep for color calibration. Possibly a registration reminder?"
X	SonudMan	SonudMan.exe	"Added by the STARTPAGE.Q TROJAN!"
X	SonudMan	WNILOGON.exe	"Added by the QQROB-DC TROJAN! Note - this is not the legitimate winlogon.exe process
X	SonudMon	SonudMon.exe	"Added by the LEWOR-J TROJAN!"
U	SonyPowerCfg	SPMgr.exe	"Related to Sony VAIO Power Management Module installed on laptops and provides additional configuration options for these devices. This program is non-essential process to the running of the system
?	Soot	rcea.exe	"??"
?	sophagnt	sophagnt.exe	"Possibly related to Sophocles Screenwriting Software?"
X	SOProc_RegSoAlertWxLiteNnAj	"rundll32 shell32.dll	ShellExec_RunDLL [path] soproc.exe"
X	SOS	SOS.exe	"Added by the PHILIS VIRUS!"
?	SoSyncMonitor	SoSyncMonitor.exe	"SuperOffice related. What does it do and is it required?"
X	Sound Loader	sndloader.exe	"Added by the AGOBOT-BV WORM!"
X	Sound services	SOUND32.EXE	"Added by the AGOBOT.GG WORM!"
X	Sound System	WinSound1.exe	"Added by an unidentified VIRUS
X	soundcontrl	soundcontrl.exe	"Added by the GAOBOT.AFJ WORM!"
X	sounddrv	sndbdrv3104.exe	"CoolWebSearch parasite variant"
?	SoundFusion	rundll32 cwcprops.cpl	"Control panel item for the Terratec DMX Xfire 1024 soundcard (Start -> Settings -> Control Panel) based upon a Cirrus Logic "SoundFusion" DSP. Does it need to run at start-up every time?"
?	SoundFusion	"rundll32 hercplgs.cpl	BootEntryPoint"
X	SoundFusion	"RunDll32 cwaprops.cpl	C25CrystalControlWnd"
N	soundman	soundman.exe	System Tray icon for the Realtek AC97 Audio Sound Manager for AC97 onboard audio. Available via Start -> Settings-> Control Panel
X	SOUNDMAN Microsoft Help	soun.pif	"Added by the RBOT-AIU WORM!"
N	SoundMAX	SMax4.exe	System Tray icon for SoundMax integrated sound. Sound properties can be accessed through the Start Menu or Control Panel
X	SoundMAX	SoundMAX.exe	"Added by the RIZON-A WORM! Note - this file is placed in the Startup folder itself
X	SoundMax Audio Drivers	SndMAX.exe	"Added by a variant of the SDBOT WORM!"
U	SoundMAXPnP	SMax4PNP.exe	"SoundMax integrated sound. Required if you have custom settings for your sound
X	SoundMixer	smvss.exe	"Added by the DEDLER-G TROJAN!"
X	Soundmx	Soundmx.exe	"CoolWebSearch Tapicfg parasite variant"
X	soundtask	soundtask.exe	"Added by the AGOBOT-MD WORM!"
X	soundtasks	soundtasks.exe	"Added by a variant of the CRYPTER.C TROJAN!"
X	soundtctrls	soundtctrls.exe	"Added by the AGOBOT-ZV WORM!"
X	SoundView	msdview32.exe	Trojan downloader
X	sounofts	sounofts.exe	"Added by the AGOBOT-ND WORM!"
X	sountskmanager	sountaskmgr	Added by an unidentified WORM or TROJAN!
N	SourcePath	gwreg.exe	Used to update Gateway registry settings for System Restoration Kit and Web update programs
X	sp	sp.reg	IE search hijacker - changes the default search to http://www.gocybersearch.com/
X	sp	regedit-s .... sp.dll	"Malicious javascript annoyance that changes the default search engine in IE to one of many including ""topsearcher"". See here for more and a fix"
X	sp	"se.dll	DllInstall"
X	sp	"rundll32 (Path to Trojan DLL)	DllInstall"
U	SP TimeSync	SP TimeSync.exe	"SP TimeSync lets you synchronize your computer's clock with any Internet atomic clock (time server)"
X	SP00LSV	Sp00lsv.exe	"Added by the GRAYBIRD.E TROJAN!"
U	SP2 Connection Patcher	SP2ConnPatcher.exe	Changes limit of concurrent TCP connections of Windows Service Pack 2
X	SP2 data	[path] repcale.exe [path] apc.exe	"Added by a variant of the RANDON.AN WORM!"
X	SP2 Firewall/Internet Updater	crssrs.exe	"Added by the RBOT.BJO WORM!"
X	sp2chk.exe	sp2chk.exe	"Added by the ALUROOT.A TROJAN!"
X	sp2ctr	sp2ctr.exe	"Added by the DLUCA-M TROJAN!"
X	sp2fwxp	sp2fwxp.exe	Added by the SMALL.ABW TROJAN!
X	sp2update	sp2update.exe	"SP2Update adware! Tracks URLs visited and search terms entered into Internet Explorer"
X	Spam Blocker for Outlook Express	SBInst.exe	"HotBar related"
X	SPAM FIREWALL	mfirewall.exe	"Added by the SDBOT.AOU WORM!"
U	Spam Sleuth	SpamSleuth.exe	Spam Sleuth E-mail spam detection program
X	SpamBlocker	SbOEAddOn.exe	"Related to Hotbar's Weather Forecast tool for your desktop"
U	SPAMfighter Agent	SFAgent.exe	"SPAMfighter anti email spam filter"
U	spamihilator	spamihilator.exe	"Spamihilator - spam filter"
U	SpamPal	spampal.exe	"SpamPal - anti-spam tool"
U	SpamSubtract	SpamSubtract.exe	"Intermute SpamSubtract - junk email detection and removal program"
N	spc_w	hcm.exe	"NetZero Search Enhancement related"
N	spc_w	blspc.exe	"NetZero Search Enhancement related"
N	spc_w	nzspc.exe	"NetZero Search Enhancement related"
N	Spdstart	Spdstart.exe	"Norton Utilities Speed Start. "This feature optimizes the start up speed of launching applications
U	Speaking Clock Deluxe	SpClDlx.exe	"Speaking Clock Deluxe - turns your computer into a speaking clock with several languages. It can also keep track of up to 50 alarms that can be set to a time and a date
X	Special Firewall Service	avguard.exe	"Added by the NETSKY.G WORM!"
X	SpecialOffers	SpecialOffers.exe [ = digit]	"SpecialOffers adware"
X	SpecialOffers	SpecialOffers.exe	"SpecialOffers adware"
X	specific	specixic.exe	"Added by a variant of the SDBOT WORM!"
N	Speed racer	CTSRReg.exe	Software for a Creative sound card
U	Speed Tec	speedtec.exe	"Accel SpeedTec from Montana Software speeds up your modem. SpeedTec modifies the Internet Protocol settings in the Windows registry to speed downloads on all modems. If you find this improves your connectivity and download speeds leave this enabled"
X	SpeedBoss	[worm filename]	"Added by the OPASERV.AD WORM!"
U	SpeedItUp	SPEEDITUP.EXE	"Speed It Up - ""all in one Speed Booster designed to significantly increase the speed of your computer and boost your PC available memory"""
U	Speedkey	SPEEDKEY.EXE	Additional keyboard shortcuts on MS programmable keyboard
U	SpeedMeter	SpeedMeter.exe	Application measuring upload and download speed
U	SpeedOptimizer	spo.exe	"SpeedOptimizer is designed to optimize and speed-up your Internet data transmission including browsing
U	SpeedswitchXP	SpeedswitchXP.exe	"SpeedswitchXP is a CPU frequency control for notebooks running Windows XP"
U	Speedtouch USB Diagnostics	Dragdiag.exe	For an external Alcatel ADSL high-speed modem. A diagnostic tool and can be run from the Start menu when required. The only reason it might be useful on startup is if you like seeing an 'at-a-glance' status indicator on the taskbar (the icon is a different colour depending on the status of the device/line)
U	SpeedUpMyPC	SpeedUpMyPC.exe	"SpeedUpMyPC ""automatically fine-tunes all your resources including hardware
X	Spees1	speedy.scr	"Added by the OPASERV.Y WORM!"
X	Spees2	Speedy.bat	"Added by the OPASERV.AD WORM!"
X	Spees3	SPEEDY.PIF	"Added by the OPASERV.AD WORM!"
N	Spellex Anywhere	sa.exe	"Spellex-Anywhere - adds spell checking functionality to almost any Window program. Create a shortcut and run manually before it's to be used"
Y	SpIDerMail	spiderml.exe	"DrWeb antivirus Spider Mail e-mail scanner"
N	Spinner Plus	spinner.exe	""Spinner Plus lets you listen to over 100 channels of music broadcast from Spinner.com. Spinner Plus uses RealNetwork's G2 technology to provide high-quality online audio. The technology adjusts the audio streaming to match your Internet connection speed
X	SPINX	Wscript.exe OXNEY.B.VBS	"Added by the YENO.B and YENO.C WORMS!"
X	SPnt	SPnt.exe	Premium rate adult content dialler
U	SpokeSysTray	SpokeSysTray.exe	"Spoke Software client application. Spoke ""uses data in your e-mail and other enterprise information systems to discover the existing relationships of people in your enterprise. It then builds a private
X	spolsvr2	spolsvr2.exe	"Added by the EVILSOCK.10 TROJAN! Note - this malware actually changes the default value data of the Registry ""Run"" key in order to force Windows to launch it at boot. Name field may be empty"
X	spoo1sv	spoo1sv.exe	"Added by the SOULJET TROJAN!"
X	Spool	[path to trojan]	"Added by the RANKY.R TROJAN!"
U	Spool	wys.exe	"WhileUSurf adware"
X	SPOOL Configuration	spoolsvc.exe	"Added by the SDBOT-KD WORM!"
N	Spool Loader	spool.exe	"Added by a variant of the RBOT WORM!"
X	Spool LoadKIt	spoolv.exe	"Added by a variant of the RBOT WORM!"
X	Spool lptt01	spool.exe	"RapidBlaster variant (in a ""spool"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Spool Manager	spoolsrv.exe	"Added by the BANKER-FR TROJAN!"
X	Spool ml097e	spool.exe	"RapidBlaster variant (in a ""spool"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Spool32	pool32.exe	"Added by the ASSASIN-F TROJAN!"
X	spoolax	[path to trojan]	"Added by the PERDA-D TROJAN!"
X	Spooler Service	Spoolsrv.exe	"Added by the JOINER.C1 TROJAN!"
X	Spooler Sub System Process	SPOOL32.EXE	"Added by the YAB.A TROJAN!"
X	Spooler Subsystem	spoolsub.exe	"Added by the SDBOT-ABG TROJAN!"
X	Spooler SubSystem App	spoolsvc.exe	"Added by the POEBOT-J WORM!"
X	Spooler SubSystem App	spooIsv.exe	"Added by the LINKBOT.M WORM!"
X	Spooler SubSystem Application	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler Subsytem App	spoolsvc.exe	"Added by the SDBOT-MM WORM!"
X	SpoolerSubSystemProcess	SpooI32.exe	"Added by the EHKS.21 keylogger! Note - the "I" between "o" and "3" is a captial "i" not a lower case "L""
X	Spools Service Controller	spools.exe	"Added by the KASSBOT-C WORM!"
X	spoolserv	spoolserv.exe	"Added by the SDBOT-PN WORM!"
X	SpoolService	spolsv.exe	"Added by the AGOBOT-CS WORM!"
X	Spoolsv	Spoolsv.exe	"Added by the CIADOOR.121 VIRUS! Note - ""Spoolsv.exe"" is located in the Windows or Winnt directory
X	spoolsv	scvhosts.exe	"Added by the SMALL-AW TROJAN!"
X	spoolsv	svchost.exe	"Added by the DLOADER-FI TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a ""HELP"" subfolder of the Winnt or Windows folder"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.