Windows Startup Item Database

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	Symlcs	[path to file]	"Added by the YASPY-A TROJAN!"
X	SymRun	N/A	"Added by the KANGAROO-A TROJAN!"
X	SymRun	ccApps.exe	"Added by the KAGEN-A TROJAN!"
N	SymTray - Norton SystemWorks	SYMTRAY.EXE	"Keeps all System Tray icons for Norton SystemWorks together to reduce clutter. SystemWorks includes Norton Anti-Virus
U	Sync Data	Hndsync.exe	"Pocket Real Estate - mobile synchronization manager"
X	Sync Server	drwatsoon.exe	"Added by the WATSOON.A TROJAN!"
U	Sync-It	Syncit.exe	"Sync-It - synchronizes the system clock with time servers on the internet"
U	SyncAgent	syncagent.exe	"Ghost Keylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	Synchronization Manage	rservers.exe	"Added by the FORBOT-FM WORM!"
N	Synchronization Manager	mobsync.exe	"Find more information about its use here"
X	syncman	winsync.exe	"Added by the MANCSYN-A TROJAN!"
X	SyncManager	msorunner.exe	"Added by a variant of the TACTSLAY TROJAN!"
X	SyncMon	adslcomdos.exe	"Added by the CLUNKY-A TROJAN!"
X	SyncMon	fixcomdos.exe	"Added by the CLUNKY-B TROJAN!"
?	SynSetup	SynTP.tmp RunOnce.exe	"Probably associated Synaptics touchpads on laptops as for the SynTPEnh and SynTPLpr entries but what does it do and is it required?"
X	Syntax	windows32.exe	"Added by the SDBOT.CQ WORM!"
X	Syntax Script	systacq.exe	"Added by the SDBOT.AI WORM!"
U	SynTPEnh	syntpenh.exe	Synaptics touchpad tray icon. Displays status and provides quick launch to touchpad features such as scrolling and tap zones. Required on IBM Thinkpads with UnltraNav (pointstick and touchpad combo) if you don't want to loose the advanced pointstick features such as scroll
Y	SynTPLpr	syntplpr.exe	Synaptics touchpad driver helper. Required for touchpad features to work
X	sys	regedit /s sys.reg	Hijacker
X	sys	regedit sysdllwm.reg	"CoolWebSearch parasite variant - also detected as the FEMAD-L TROJAN!"
X	Sys Ren	SysRen.exe	"Part of FlashEnhancer adware"
X	sys************* [* = random digit]	sys************.exe [ = random digit]	"WINBO adware"
X	Sys*.exe [ = random char]	Sys*.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Sys*32.exe [ = random char]	Sys*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	sys008	sys008.exe	"Hijacker
X	sys009	sys009.exe	"Added by the STARTPA-ZB TROJAN!"
X	sys201	sys209.exe	"Added by the STARTPA-ZY TROJAN!"
X	Sys29	win**32.exe [ = random char]	"EliteBar adware"
X	sys32	sys32.exe	"Added by the FLUX.E TROJAN!"
X	sys32	sysx32.exe	"Added by the KVEX-A VIRUS!"
U	sys32cmd	sys32win.exe	"Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	sys32dll	sys32dll.exe	"Added by the AIMDES.B WORM!"
U	sys32sql	sys32win.exe	"Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	SysA	win**32.exe [ = random char]	"EliteBar adware"
U	SysAgent	SysAgent.exe	"SYSagent - small utility for retrieving all the hardware and software information required by anyone administering a machine and/or the network it's a part of"
X	SysAI	SysAI.exe	"AproposMedia adware"
U	SysBkup	[path to file]	"Keyspy keystroke logger/monitoring program - remove unless you installed it yourself!"
U	Sysbot	sysbot.exe	"Spector - spying (or monitoring) software to record internet activity"
X	syscfg	syscfg32.exe	"Added by the KWBOT.S WORM!"
X	syscfg34.exe	syscfg34.exe	"Added by the ELECTRON WORM!"
X	Syscheck	win.hta	Browser hijacker
X	syscheck	iexplorer.exe	Added by the AGENT.DM TROJAN!
X	sysclx	ntldrt.exe	"Added by the JLOK-A WORM!"
X	syscm	Syscm.exe	"Vanish adware"
?	SysComp	mssdnl.com	"Unknown but suspect as *.com are not usually run at start up and the name isn't recognized"
X	syscon	syscon.exe	"Added by the APRILCONE.A WORM!"
X	syscon lptt01	syscon.exe	"RapidBlaster variant (in a ""Syscon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	syscon ml097e	syscon.exe	"RapidBlaster variant (in a ""Syscon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	sysconfig	iexplorer.exe	"Added by the CULT.C WORM!"
X	SysConfig	syscfg35.exe	"Added by the KAZMOR.C WORM!"
X	sysconfig	iexplorer.exe	"Added by the CULT.H WORM!"
X	SysConfig	wincfg32.exe	"Added by the SDBOT.ZD WORM!"
U	Sysconfig	Stealth KeySpy.exe	"StealthKeySpy - keystroke logger/monitoring program - remove unless you installed it yourself!"
X	Syscpy	Syscpy.exe	"Firewall-bypassing
X	SysCtl	sysctl.exe	"Added by the AOK TROJAN!"
X	Sysctrls	procdll.exe	"Added by the WEEDBOTZ.14 TROJAN!"
X	sysdat.dll	sysdat.dll.exe	Added by the NISHICA 1.1 TROJAN!
X	SysData	[path to file]	"Added by the RANCK-BA TROJAN!"
X	SysDeskqqfx	qqfx.exe	"Added by the QQPASS.H TROJAN!"
X	SysDeskqqfx	Runddll32.exe	"Added by the CHANGGAME TROJAN!"
X	SysDesktop	fswanQQ.exe	"Added by the QQSEND-A TROJAN!"
X	sysdir	winrun.exe	"Added by the WINBUR.B WORM!"
X	sysdll	[trojan filename]	"Added by the HUGESOT TROJAN!"
X	Sysdpt	sysdpt.exe	"Win32.Crypt trojan downloader"
X	sysdxvid	sysdxvid.exe	"Added by the DLUCA-S TROJAN!"
X	SysEQ	svclgx32.exe	"Added by the IRCBOT-AC TROJAN!"
X	sysfiler	sysfiler.exe	"Added by the RETSAM TROJAN!"
X	SYSfit	SYSfit.exe	"AdShooter adware variant"
X	sysflg32	sysflg32.exe	"Added by a variant of the CRYPTER.C TROJAN!"
X	sysformat	sysformat.exe	"Added by the BAGLE-BK WORM!"
X	sysfrcx	sysfrcx.exe	"Added by the KEYLOG-SCLOG TROJAN!"
X	syshelp	syshelp.exe	"Added by a variant of the LOVGATE WORM!"
X	sysin	[path to file]	"Added by the DSRC-A TROJAN!"
X	sysinfo	sysinfo.exe	"Added by the BEDRILL TROJAN!"
X	sysinfo.exe	sysinfo.exe	"Added by the BEAGLE.V WORM!"
X	SysInit	wininit32.exe	"Added by the XABOT WORM!"
X	sysinit	services.exe	"Added by the NEWLFRM-A TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in an ""golumm"" subfolder"
X	SysInit	svchost.exe	"Added by the STARTPA-BD TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Program Files/Common Files folder"
X	Sysino	lsess.exe	"Added by the FORBOT-BF WORM!"
X	sysint16	sysint16.exe	"Added by the CRYPTER.A TROJAN!"
X	Syskey	sysinit.exe	"Added by the BEAGLE.AX WORM!"
X	Syslib	Syslib.exe	Adult content related downloader trojan
X	Syslog lptt01	Syslog.exe	"RapidBlaster variant (in a ""Syslog"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Syslog ml097e	Syslog.exe	"RapidBlaster variant (in a ""Syslog"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	syslogin.exe	syslogin.exe	"Added by the BAGZ-B WORM!"
U	Sysman	Sysman.exe	"KeyTrap is a surveillance software program that records all keyboard activities. If you didn't install it yourself remove it"
X	sysme	sysme.exe	"Added by the PSW_STEALER_C TROJAN!"
X	sysmem	mmsete.exe	"Added by the NOPIR.C WORM!"
X	sysmem	outlookrem.exe	"Added by the NOPIR-C WORM!"
X	SysMemory manager	mdms.exe	"Added by the CIMUZ-D TROJAN!"
U	SysMetrix	SysMetrix.exe	"SysMetrix - skinnable clock and metering application. It monitors and reports on a great number of statistics"
X	sysMett1	explorer.exe	"Added by the LEGMIR-Y TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the Program Files folder"
X	sysmngr32	sys64mnger.exe	"Added by a variant of the RBOT WORM!"
X	sysmntrc	sysmntrc.exe	"Added by the BANCOS-FX TROJAN!"
X	sysmod	sysmod.exe	"Added by the SPYBOT-DU WORM!"
X	sysmon	sysmon.exe	"Added by the BIZEX WORM!"
X	Sysmon	rpcmon.exe	"Added by the RANDEX.ATX WORM!"
X	sysmon	sysmon44.exe	"Added by a variant of the BACKDOOR-CBA TROJAN!"
X	SysMon	wowexece.exe	"Added by the MULAN-A TROJAN!"
X	sysmon12	[various filenames]	"Wareout - malware masquerading as a spyware and dialer remover"
X	sysmonnt	sysmonnt.exe	"SearchPounder sends keywords typed into HTML forms and popular Internet search engines to a remote server"
X	SysMonXP	SysMonXP.exe	"Added by the NETSKY.Q WORM!"
X	sysnate	sysnate.exe	"Added by the MEDIAS TROJAN!"
X	Sysnet	snuninst.exe	Unidentified adware
X	sysnet	sysnet.exe	"CasClient adware - also detected as the CMAPP TROJAN!"
X	sysobj.exe	sysobj.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	SysOps	SysOps	"Added by the MSNCORRUPT TROJAN!"
X	syspare	syspare.exe	"Added by the BIFROSE-AN TROJAN!"
X	syspath	drv.exe	"Added by the SOBER WORM!"
X	sysPersonalFirewall	msnmssgr.exe	"Added by a variant of the RBOT WORM!"
X	sysPersonalFirewall	system.exe	"Added by the WOOTBOT.FH WORM!"
X	sysPersonalFirewall	tskm0nitor.exe	"Added by a variant of the RBOT WORM!"
U	SysPilot	fdxxl.exe	"G Data ""PC Spion"" - monitoring and surveillance software
X	sysPnP	bootconf.exe	"Homepage hijacker
X	SysPnP	"rundll32 setupapi	InstallHinfSection.... oemsyspnp.inf"
X	syspol	syspol.exe	"Added by the DREMN-B TROJAN! Note - this malware actually changes the default value data of the Registry ""Run"" key in order to force Windows to launch it at boot. Name field may be empty"
Y	SysPool	Mssvc.exe	"StealthDisk - hides folders
X	SysPool	MSSVC32.EXE	"Added by the BANCBAN-IO TROJAN!"
X	SysProtect	System.exe	"Added by the NETSPY TROJAN!"
X	SysProtect	syp.exe	"SysProtect is detected as a ""potentially unwanted program"". It purports to be an system repair/maintenance application
X	syspw32.exe	syspw32.exe	"Added by the APPFLET.A WORM!"
X	Sysqq	LSESS.exe	"Added by the FORBOT-BF WORM!"
X	SysR	sysmd.exe	"Ulubione adult content dialer"
X	SysReg	SysReg.exe	"Added by the CHEKIN TROJAN!"
X	SysReg	SysReg.exe	"SearchSeekFind textual marketing foistware"
X	Sysres	Sysres.exe	"Added by the LOGMOD TROJAN!"
X	SysRes	TASKMANAGER.exe	"Added by the ELIPTER.A or ELIPTER.B WORMS!"
X	SysRes	WWE DIVAS.exe	"Added by the ELIPTER.D WORM!"
X	SysRes	IExpIore .exe	"Added by the ELITPER.E WORM!"
X	SysScan	bvt.exe	"Added by the AUTOUPDER TROJAN!"
X	SysSearch	Regedit.exe -s [path] pcsearch.reg	"Added by the StartPage-FN browser hijacker"
X	SysSearch	REGEDIT.EXE -s [path] sysreg.reg	"Added by the STARTPA-ME TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.