Windows Startup Item Database

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	spoolsv manager	SpoolMgr.exe	"Added by the ASSIRAL WORM!"
X	spoolsv service	spoolsv32.exe	"Added by the RBOT-AHP WORM!"
X	SPOOLSV32	SPOOLSV32.EXE	"Added by the CWS-I or HAZIF-B TROJANS!"
X	spoolsvc	spoolsvc.exe	"Added by the DROPPER-AT TROJAN!"
X	spoolsvr32	csmss.exe	"Added by the AGENT-AU TROJAN!"
X	spoolsvr32	csmss32.exe	"Added by a variant of the AGENT-AU TROJAN!"
X	spoolsvs.exe	spoolsvs.exe	"Added by the DLOADER-RK TROJAN!"
X	SPOOLSVU	SPOOLSVU.EXE	"Added by the STARTPAGE.K hijacker"
X	spoolsvv	spoolsvv.exe	"Searchcentrix hijacker"
X	Spoolvs	spoolvs.exe	"Added by the SDBOT.AUS WORM!"
X	Spore	MsNews.vbs	"Added by the SPORE.A WORM!"
X	Spore.b	Scmhlpr.vbs	"Added by the SPORE.B WORM!"
?	SPP	run.exe	"??"
X	spp	regedit -s spp.reg	IE search hijacker - changes the default search to http://www.hotsearchbox.com/ie/
?	sppbridge	sppbridge.exe	"Associated with an Anycom bluetooth wireless card on laptops - used for printing to portable printers for example. Is it required or can it be started manually? "
?	SprintPort	SprintPortA.exe	"Novatel wireless modem related. What does it do and is it required?"
U	SpriteService	SpriteService.exe	"Sprite Backup is a backup application for Windows Mobile Pocket PC or Smartphone"
U	SPSTEALT	SmartProtectorPro.exe	"Smart Protector Pro - internet privacy tool that erases tracks
?	spstore	storesp.exe	"Softprobe - program designed to provide managers with an analysis of an individuals computer use who are under their supervision. This program is NOT related to Winpup"
U	Spy Blocker	spyblocker.exe	"SpyBlocker blocks the communications of spyware installed on a PC so spyware runs but can't exchange data with the server to which it should report. Ensuring spyware can't communicate is important
U	Spy Protector	SpyProtector.exe	"Included in the full version of Security Task Manager
N	Spy-Control	Spy-Control.exe	"Spyware remover - not recommended
U	Spy-Keylogger	skl.exe	"SpyKeylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
N	SpyAxe	spyaxe.exe	"Spyware remover - not recommended
N	SpyBan	SpyBan.exe	"Spyware remover - not recommended
X	SpyBlast	SpyBlast.exe	"Spyware killer that is in effect autoinstalled foistware
U	SpyBlocker	spyblocker.exe	"SpyBlocker blocks the communications of spyware installed on a PC so spyware runs but can't exchange data with the server to which it should report. Ensuring spyware can't communicate is important
N	SpyBlocs	SpyBlocs.exe	"Spyware remover - not recommended
N	SpyBlocs3.0	SpyBlocs3.0.exe	"Spyware remover - not recommended
Y	SpybotSD TeaTimer	TeaTimer.exe	"TeaTimer is a permanent process and registry monitor of Spybot S&D - spam filter which perpetually monitors the processes called/initiated. processes wanting to start and terminates them giving you some options
U	SpyBotSnD	Spybotsd.exe	"Spybot - Search & Destroy - free multi-spyware removal tool from Safer Networking Ltd."
X	Spybott lptt01	spybott.exe	"RapidBlaster variant (in a ""Spybott"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Spybott ml097e	spybott.exe	"RapidBlaster variant (in a ""Spybott"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	SpyClean	1ClickSpyClean.exe	"1 Click Spy Clean uses a database that was stolen from SpybotS&D. Not recommended
U	SpyCop ScanCheck	MAIN.EXE	"SpyCop surveillance software detection - checks to see when your machine was last scanned and if it was more than a week asks if you want to scan"
U	SpyEmergency	SpyEmergency.exe	"SpyEmergency security software from Netgate"
X	SpyEx	Winllogo.exe	"Added by the PRSKEY-A WORM!"
N	SpyFighterMonitor	SpyFighter.exe	"Spyware remover - not recommended
N	SpyFighterUpdate	AutoUpdate.exe	"Spyware remover - not recommended
N	SpyHunter	SpyHunter.exe	"Enigma SpyHunter - not recommended
U	Spykiller	Spykiller.exe	"Shareware ""Spyware remover"" of questionable quality and repute. There are better alternatives that are freeware to boot"
X	SpyNuker	Spynuker.exe	"A ""spyware removal program"" by TrekBlue
N	SpyOnThis Monitor	SpyOnThisMonitor.exe	"Spyware remover - not recommended
X	SpySheriff	SpySheriff.exe	"SpySheriff malware"
N	SpySpotter	SpySpotter.exe	"Spyware remover - not recommended
U	SpyStopper	spystopper.exe	"SpyStopper - blocks intrusive spyware
U	SpySubtract	SpySub.exe	"SpySubtract - multi spyware removal tool"
U	SpySweeper	SpySweeper.exe	"Spy Sweeper - detects and removes spyware"
U	SpySweeperEnterprise	SpySweeperUI.exe	"User interface for Spy Sweeper Enterprise edition - ""a centrally managed
X	SpyTrooper	SpyTrooper.exe	"SpyTrooper - malware posing as a spyware remover
X	Spyware	Spyware.exe	" BPS Spyware Remover - reportedly uses an old
N	Spyware Begone	SpywareBeGone.exe	"Spyware remover - not recommended
N	Spyware Begone	freescan.exe	"Spyware remover - not recommended
U	Spyware Doctor	spydoctor.exe	"Spyware Doctor spyware remover"
U	Spyware Doctor	swdoctor.exe	"Spyware Doctor spyware remover"
U	Spyware Guard Control Panel	spywar~1.exe	" "SpywareGuard provides a real-time protection solution against spyware"""
U	Spyware Nuker	swn2.exe	"Spyware removal program by TrekBlue. Previously not recommended but the latest version was delisted here"
U	Spyware Nuker Installer	SpywareNukerInstaller.exe	"Spyware removal program by TrekBlue. Previously not recommended but the latest version was delisted here"
X	Spyware remover	Remove_spyware.exe	"Unidentified
U	Spyware Scanner	AseScanner.exe	"Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU
U	SpyWare Shield	Shield.exe	"Acronis Privacy Expert Spyware Shield prevents spyware and other suspicious programs from being installed on PCs"
N	Spyware Slayer	SpywareSlayer.Exe	"Spyware remover - not recommended
N	Spyware Soft Stop	Spyware Soft Stop.exe	"Spyware remover - not recommended
N	Spyware Stormer	SpywareStormer.Exe	"Spyware remover - not recommended
N	Spyware Vanisher	FreeScanner.exe	"Spyware remover - not recommended
U	Spyware X-terminator	SpywareX.exe	"Spyware X-terminator - spyware remover"
N	Spyware-Cop	Spyware-Cop.exe	"Spyware remover - not recommended
N	SpywareBot	SpywareBot.exe	"Spyware remover - not recommended
U	spywarefighterguard	spfprc.exe	Spyware Fighter - anti spyware program
U	SpywareGuard	sgmain.exe	" "SpywareGuard provides a real-time protection solution against spyware"""
X	SpywareGuard	winproc32.exe	"Startpage adware Trojan"
X	SpywareGuard	deinst_qfe001.exe	"Added by a variant of the Win32.Small TROJAN! - Do NOT confuse with the legitimate SpywareGuard application"
X	Spywareguard lptt01	Spywareguard.exe	"RapidBlaster variant (in a ""Spyguard"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Spywareguard ml097e	Spywareguard.exe	"RapidBlaster variant (in a ""Spyguard"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	SpywareGuardPlus	winmm64.exe	StartPage.ht homepage hijacker
N	SpywareKilla	SpywareKilla.exe	"Spyware remover - not recommended
N	SpywareNo	SpywareNo.exe	"Spyware remover - not recommended
N	SpywareQuake	SpywareQuake.exe	"Spyware remover - not recommended
N	SpywareStrike	SpywareStrike.exe	"Spyware remover - not recommended
U	SPYWATCH	SpyWatch.exe	" BPS Spyware Remover - reportedly uses an old
X	SQConfigChecker	cc.exe	"Xupiter SQWire toolbar related. Use Spybot S&D
X	SQInstaller	SQInstaller.exe	"Xupiter SQWire toolbar related. Use Spybot S&D
N	SQL Server	scm.exe	SQL Server Service Control Manager. Available via Start -> Programs
X	SQL Server Service	sql.exe	"Added by the RBOT-ADF"
X	sqservices	wins32.exe	"Added by the PROGENT-B TROJAN!"
X	SQUpdatesChecker	uc.exe	"Xupiter SQWire toolbar related. Use Spybot S&D
X	sqvynikp	sqvynikp.exe	Free_Scratch_Cards foistware
Y	SR Agent	AGENTSVC.EXE	"Related to Secure Resolutions - desktop virus protection"
Y	Sr Agent	SrLogon.exe	"Related to Secure Resolutions - desktop virus protection"
?	sr1exe	updtSup3.exe	"Found on a Dell computer
X	sr64	********. exe	"Adware
X	SrchfstUpdate	srchupdt.exe	SearchFast adware downloader
X	sre	"rundll32.exe sre.dll	Register"
?	srePostpone	"rundll32.exe [path] srescan.dll	DoSpecialAction"
?	SRFirstRun	"rundll32 srclient.dll	CreateFirstRunRp"
U	Srmclean	srmclean.exe	"Srmclean helps in the installation and execution of the SoundMax SoftPaq for Compaq/ADI SoundMax Integrated Digital Audio. According to Compaq - ""If you disable the entry from loading into startup
X	SRNG	srng.exe	"ShopNavSearch.Srng search hijacker"
U	SRP Startup	srrpro.exe	"System Restore Remover Pro allows you to safely and easily remove System Restore and various other Windows Millennium "features." This is enabled if you tick the "Remove unnecessary System Restore information on startup" box. Available via Start -> Settings -> Control Panel"
Y	SRS Applet	SrsTray.Exe	S3 Sonic Vibes sound card drivers - if disabled you loose sound
X	srshost.exe	srshost.exe	"Added by a variant of the RBOT-ASW WORM!"
X	Srv RPCrom	NClienti386.exe	"Added by the WATSOON.A TROJAN!"
X	Srv32	Srv32.exe	"Added by the OPASERV.J WORM!"
X	Srv32	Srv32.exe	"Added by the OPASERV.S WORM!"
X	Srv32 spool service	runsrv32.exe	"Topantispyware.com malware - recognized by Kaspersky antivirus as Trojan-Clicker.Win32.Spyre.b"
X	Srv32 spool service	spoolsrv32.exe	"Added by the SPYRE.B TROJAN!"
X	Srv32 spool service	[path to trojan]	"Added by the DLOADER-LB TROJAN!"
X	Srv325	Srv325.exe	"Added by the AGOBOT-PR WORM!"
X	Srv32Old	[worm filename].PIF	"Added by the OPASERV.J WORM!"
U	Srv32Win	SpyAgent4.exe	"SpyAgent - monitoring software that creates records of everything people do on a computer
U	Srv32Win	Svchost.exe	"Realtime-Spy keystroke logger/monitoring program - remove unless you installed it yourself! Note - this is not the svchost.exe process that normally doesn't appear in Msconfig/Startup!"
U	Srv32Win	sysdiag.exe	"SpyAgent surveillance software - uninstall this software unless you put it there yourself!"
U	srv32win	win16dll.exe	"Screenspy captures screenshots silently. If you didn't install this yourself remove it"
X	Srvce Pack Updte	svcpack.exe	"Added by a variant of the RBOT WORM!"
X	srvexc.exe	srvexc.exe	"Added by the SERVSAX TROJAN!"
U	srvprc	srvprc.exe	"Added by the ActMon surveillance software. Uninstall this software unless you put it there yourself"
N	srxTray	srxTray.exe	"Titan FTP Server - FTP server"
?	SsAAD.exe	SsAAD.exe	"Sony SonicStage software related - ""Atrac Hard Disk Monitor"". What does it do and is it required?"
X	ssate.exe	irun4.exe	"Added by the BEAGLE.J WORM!"
X	ssate.exe	winsys.exe	"Added by the BEAGLE.K WORM!"
N	SSBkgdUpdate	SSBkgdupdate.exe	ScanSoft OmniPage auto updater. Can be disabled using the main program's options
U	SSC Service Utility	ssc_serv.exe	"SSC Service Utility is a printer utility for refilled Epson cartridges"
U	SSCFBTN.EXE	SSCFBTN.EXE	"Samsung smarthru software
Y	sscRun	SSCRun.exe	AOL's firewall
Y	SSC_UserPrompt	UsrPrmpt.exe	"Part of Symantec's AntiVirus suite and comes usually with a product update
Y	Ssd	Std.exe	"Stealthdisk - file and folder hiding/locking utility"
?	ssdiag	ssdiag.exe	"Equinox "Configuration and DOS Diagnostic for DOS and Windows platforms""
N	SSDPSRV	ssdpsrv.exe	"Simple Service Discovery Protocol (SSDP) and General Event Notification Architecture (GENA) services for network plug and play functionality. Starts up a web server on port 5000. Used by Universal Plug and Play (for network device discovery). To remove this program
X	ssgrate.exe	system.exe	"Added by the MITGLIEDER.C TROJAN!"
X	ssgrate.exe	irun.exe	"Added by the MITGLIEDER.D TROJAN!"
X	ssgrate.exe	irun4.exe	"Added by the MITGLIEDER.F TROJAN!"
X	ssgrate.exe	sysdoor.exe	"Added by the MITGLIEDER.N TROJAN!"
X	ssgrate.exe	winerdir.exe	"Added by the MITGLIEDER.O TROJAN!"
X	ssgrate.exe	winsystems.exe	"Added by the BAGLEDL-J TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.