Windows Startup Item Database

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
Y	tfswctrl	tfswctrl.exe	"Drive letter access to a UDF packet writer for CD-RW - from HP
X	TFTP***	tftp***	"Added by a variant of the SPYBOT WORM! where *** can be any number"
U	TFunckey	TFuncKey.exe	Deals with the <Fn> - <Function> key combinations on a Toshiba laptop
N	TgAddServer	tgfix.exe	"Software from SupportSoft (aka Support.com) provided to manufacturers (such as Sony (Vaio Support Agent) and Toshiba (Virtual Tech)) and ISPs (such as Comcast
X	tgbcde	module32.exe	"Added by the REIGN.R TROJAN!"
U	Tgcmd	tgcmd.exe	"See also TgAddServer. This part ensures the software is installed correctly (similar to an installation wizard) as reported by Cox Regarded as spyware by some as it has the ability to retrieve user information. Whether it does so depends upon the provider. One Toshiba user reports problems with hibernate on his laptop if disabled - hence the ""U"" recommendation"
U	tgcmdprovidersbc	tgcmd.exe	"See also TgAddServer. This part ensures the software is installed correctly (similar to an installation wizard) as reported by Cox Regarded as spyware by some as it has the ability to retrieve user information. Whether it does so depends upon the provider. One Toshiba user reports problems with hibernate on his laptop if disabled - hence the ""U"" recommendation"
N	TGCMG	??	"Related to Rogers@Home
X	TGDC IE Plugin	tgdc.exe	"ShopForGood spyware - see here"
X	tgkill	tgkill.exe	Comcast (the cable folks who are replacing @home in some parts of the USA) have struck a deal with Tioga to provide an "enhanced" support and self-repairing tool. This is "beta" at present and was made available to download by mistake at present. Remove via Start -> Settings -> Add/Remove Programs
U	Tgsetsite	tgfix.exe	"See also TgAddServer. This part ensures the software is installed correctly (similar to an installation wizard) as reported by Cox Regarded as spyware by some as it has the ability to retrieve user information. Whether it does so depends upon the provider. One Toshiba user reports problems with hibernate on his laptop if disabled - hence the ""U"" recommendation"
N	Thdetrf	thdetr32.exe	"Appears to be related to Lycos advertising"
X	ThE	wind0s.exe	Added by an unidentified WORM or TROJAN!
U	The Easy Bee's Hive	ATCEgSvr.exe	"The Easy Bee is a software that allows you to record Internet navigation sequences
X	The Ethernet	ethernet.exe	"Added by a variant of the SDBOT WORM!"
X	The Intranet	intranet.exe	"Added by a variant of the SDBOT WORM!"
?	TheMainStart	N/A	"??"
X	TheMonitor	[path to trojan]	"Added by the DLOADR-LO TROJAN!"
X	TheMonitor	Duce6.exe	"YourEnhancement downloader"
U	THGuard	TH_Guard.exe	"Resident memory scanning for TrojanHunter"
U	THGuard	THGuard.exe	"Resident memory scanning for TrojanHunter"
U	THOTKEY	THotkey.exe	"Associated with the Fn+ keys on Toshiba laptops. When disabled some keys still worked
Y	ThpSrv	thpsrv.exe	Toshiba Hard Drive Protection Utility - moves the Hard Drive head to a safe position in case of shock or vibration to reduce the risk of damage that could be caused by head-to-disk contact
X	Threaded	intcp32.exe	"Added by the RANDEX.UG WORM!"
U	ThrustTSR	TMTMTSR.exe	"Thrustmaster Thrustmapper. ""The Thrustmapper - t-mapper - icon sits on your taskbar and automatically detects when the joystick is plugged in and configures it accordingly"""
X	Thumbs Plus .	thmbplus**.exe	"Added by the AGOBOT-AAF WORM! ** is a combination of a random digits and characters"
U	TI WLAN	TIWLANCu.exe	"Texas Instruments TI wireless LAN products"
X	tibs3	tibs3.exe	"Premium rate adult content dialler - see here"
X	tibs5	tibs5.exe	"Premium rate adult content dialer - see here"
X	Tiger	Shine.exe	"Added by the HAPPYLOW (or NISHE-A) VIRUS!"
U	TiKL	tikl.exe	"TinyKeylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	Time Manager	TimeManager.exe	"Added by the MYTOB-BV WORM!"
X	Time Zone Synchronization	wscript zshell.js	"Added by the NETDEX-A TROJAN!"
U	TimeCalendar	tc.exe	"TimeCalendar digital planner"
N	Timed Backups Manager Startup	BACKTIME.EXE	"Backup Plus - backup software"
U	TimeLeft	TimeLeft.exe	"TimeLeft is a countdown
U	Timemanager.exe	Timemanager.exe	"Time Manager will let you track billable and non-billable time by customer
N	TimeOnline	TIMEONLINE.EXE	Lightman Groups's TimeOnline monitor. For dial-up users to monitor time spent on the net. Available via Start -> Programs
X	TIMER	TIMER.EXE	"Added by the TIMESE.AG WORM!"
X	Timer	comm.exe	"Added by the IP TROJAN!"
X	Timer	timed.exe	"Added by the LV TROJAN!"
X	Timer	msncomm.exe	"Added by the WEBDOR.AK TROJAN!"
X	TimeService	trun.exe	"TlfLic-A premium rate adult content dialler"
X	TimeSink Add Client	TSADBOT.EXE	Advertising spyware
X	timessquare	timessquare.exe	Reported as Trojan.Win32.StartPage.aw by Kaspersky Anti-Virus
X	TimeSyncApp	TimeSynchronize.exe	"DealHelper adware"
N	TimeUp	Timeup.exe	"TimeUp - internet online timer"
U	Timezone	TimeZone.exe	"Microsoft Daylight Saving Time Update Utility - see here"
N	TINTSETP	TINTSETP.EXE	"Part of Microsoft's Input Message Editor (IME) for translating Japanese/Chinese text in IE
X	Tiny AV	fooding.exe	"Added by the NETSKY.I WORM!"
Y	Tiny Personal Firewall	persfw.exe	"Tiny Personal Firewall"
U	tinySpell	tinyspell.exe	"Tinyspell - ""allows you to easily and quickly check the spelling of words in any Windows application. Monitors your typing on the fly
U	TiomanExe	Tioman.Exe	"Agate Tioman - warm and hot swap removable bay device manager for IBM laptops"
N	Tips	mousetips.exe	Suggests tips on using your mouse
U	TiTleBarClock	TiTleBarClock.exe	"TitleBarClock displays the day/month/time and free physical RAM on the right hand side of an open window
U	TitleTime	TiTime.exe	"""TitleTime adds the current date and/or time to the Caption of the currently active application window. Additional options are a second clock (with a different time)
N	Tivoli	LCFEP.EXE	"Tivoli 'TME' System Tray icon - ""'lcfep' is the program that displays statistics about the Endpoint. Apparently stopping/removing this process has no impact on the Endpoint itself which will continue to function normally"""
U	TivoServer	TiVoServer.exe	"Tivo Server - installed with the TiVo Home Media Option. It streams audio files to your television/home theater from your PC"
U	TivoTransfer	TivoTransfer.exe	"Tivo Transfer Service. TiVo Desktop is an easy-to-use application that lets you publish and share digital music
U	TIxDSL	tidslmon.exe	Actiontec DSL modem. Associated with High Speed AOL DSL. Used to get line sync with the Actiontec DSL USB Modem. Available via Start -> Programs
N	TizzleTalk	TizzleTalk.exe	"TizzeTalk is a dialect translator for Yahoo
X	tjstartup	[path to file]	"Added by the TJSERV.C TROJAN!"
N	TkBell.Exe	evntsvc.exe	"Application Scheduler installed along with RealOne Player. Once installed
N	TkBell.Exe	realsched.exe	"Application Scheduler installed along with RealOne Player. Once installed
N	TkBell.Exe	tkbell.exe	"Application Scheduler installed along with RealOne Player. Once installed
N	TkBellExe	evntsvc.exe	"Application Scheduler installed along with RealOne Player. Once installed
N	TkBellExe	realsched.exe	"Application Scheduler installed along with RealOne Player. Once installed
N	TkBellExe	tkbell.exe	"Application Scheduler installed along with RealOne Player. Once installed
X	TkNetDriver Monitor	lexbce.exe	"Added by the SDBOT-ADF WORM!"
N	tkonnect	TKONNECT.EXE	"Dialer for the Tiscali internet service provider. Available as a desktop shortcut"
X	tlc	update911.js	Hijacker installer
?	TlcR	avp.exe	"??"
U	tlntsvr	tlntsvr.exe	"Microsoft program associated with Telnet"
U	TLogonPath	tb2logon.exe	"Timbuktu Pro - remote desktop access software"
U	TM Outbreak Agent	TMOAgent.exe	Trend Micro Internet Security anti-virus software virus outbreak warnings. Notifies users of virus outbreaks and offers to update the scanner
U	TMA distribution	cfinst.exe	Part of Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicating between the core server and managed clients
X	tmax	pupdate.exe	Adware pop-up generator
X	tmchook	tmchook.exe	Detected by Kaspersky as the TrojanDownloader.Win32.VB.aa VIRUS!
?	TMEEJME	TMEEJME.EXE	"Found in a ToshibaTME3 directory. Toshiba Mobile Extension related?"
?	TMERzCtl	TMERzCtl.EXE	"Found in a ToshibaTME3 directory. Toshiba Mobile Extension related?"
U	TMESBS	TMESBS21.exe	Toshiba Mobile Extension Selectable Bay Service for WinXP - support for docking stations. Not required if you don't use a docking station
?	TMESBS32	TMESBS32.EXE	"Found in a ToshibaTME3 directory. Toshiba Mobile Extension related?"
U	TMESRV31	TMESRV31.EXE	Toshiba utility related to inserting and removing a laptop from a docking station. Not required if you don't use a docking station
U	TMExLogon	TMESRV.EXE	Toshiba utility related to inserting and removing a laptop from a docking station. Not required if you don't use a docking station
?	Tmmkb	Tmmkysvr.exe	"Toshiba multi-media keyboard software - possibly including creating keyboard shortcuts?"
X	TmNetDriver Monitor	exbce.exe	"Added by the SDBOT-ABR WORM!"
X	Tmntsrv32	Tmntsrv32.exe	"Hijacker
U	TMOUSE	tmouse.exe	"Component of the Toshiba Mouse Control that allows users with an AccuPoint mouse to scroll MS-scroll-compatible documents by holding CTRL + ALT and moving the AccuPoint up or down. It also allows zooming by holding CTRL + SHIFT and moving the AccuPoint up or down. Disabling this item has no adverse effects
Y	tmproxy	tmproxy.exe	"Trend Micro PC-cillin 2003 antivirus software"
N	TMTMTSR	TMTMTST.exe	"Installed with Thrustmaster game controllers. It launches the Thrustmapper utility. Not required if you install the "driver only" from Thrustmaster website"
U	TNTClk	TNTCLK.exe	"Overclocking program for TNT
U	ToADiMon.exe	ToADiMon.exe	T-Online ISP software connection assistant
U	Toggler	toggler.exe	"""Toggler allows you to gain control over your Caps Lock
X	Tok-Cirrhatus	IDTemplate.exe	"Added by the RONTOKBRO.A WORM!"
X	Tok-Cirrhatus	smss.exe	"Added by the BRONTOK-A WORM and variants! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the ""Documents and Settings[User]Local SettingsApplication Data"" folder"
X	Tok-Cirrhatus	[path to file]	"Added by the BRONTOK-F WORM!"
X	Tok-Cirrhatus-1959	br4941on.exe	"Added by the BRONTOK-J WORM!"
X	Tok-Cirrhatus-1959sarc	sv711224030r.exe	"Added by the BRONTOK-R WORM!"
X	Tok-Cirrhatus-2784	br6591on.exe	"Added by the BRONTOK-L WORM!"
X	Tok-Cirrhatus-2784	smss.exe	"Added by the BRONTOK-S WORM! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the ""Documents and Settings[User]Local SettingsApplication Data"" folder"
X	Tok-Cirrhatus-[4 random digits]	br[4 random digits]on.exe	"Added by the BRONTOK-M WORM!"
?	TomcatStartup	hpbpsttp.exe	"Apache Tomcat web server
?	TomcatStartup 2.5	hpbpsttp.exe	"Apache Tomcat web server
?	Tommorrow	tomorrow.exe	"??"
X	ToP	LSASS.exe	"Added by the WOWCRAFT.C TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
?	ToPassSrv	Pktopass.exe	"Related to Caere Pagekeeper scanning software (now taken over by Scansoft)
U	TopDesk	TopDesk.exe	"TopDesk - puts an icon in your system tray that when clicked upon
X	ToPicks Starter	Idhost.exe	"TOPicks adware"
X	topmoxie	JavaRun.exe	"Marketing software from TopMoxie"
X	TopSearch	TopSearch.exe	"TopSearch adware variant"
N	Tor	tor.exe	"Tor anonymous internet communication system. Shortcut available via Start -> Programs"
X	tor anonymous proxy	tor32.exe	"Added by the SDBOT-ADR WORM!"
X	Torjan Program	[path to trojan]	"Added by the LEGMIR-BO TROJAN!"
X	Torjan Program	smss.exe	"Added by the WOWCRAFT.B TROJAN! Note - this is not the legitimate smss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	Torjan Program	WINLOGON.EXE	"Added by the WOWCRAFT.D TROJAN! Note - this is not the legitimate winlogon.exe process
N	TOSCDSPD	toscdspd.exe	"Related to Toshiba laptop CD/DVD drivers. This is a non-essential process. Disabling or enabling this is down to user preference"
U	TOSHIBA Accessibility	FnKeyHook.exe	"""Allows you to use the Fn key to create a hot key combination with one of the function keys without pressing the two keys simultaneously as is usually required. Using Accessibility lets you make the Fn key a sticky key
Y	Toshiba Fan	fan.exe	Toshiba untilty to keep the fan on a laptop running if they fail to detect there is too much heat
U	Toshiba Key State	KEYSTATE.EXE	"Displays an icon in the System Tray indicating the state of the CAPS LOCK key. Can be handy on (e.g.
N	ToshibaPinger	pinger.exe	"Pinger is the resident program for Toshiba Upgrades. Periodically checks to see if there are any software/driver upgrades for your particular computer model. If it finds any
U	TOSHIBSU	Toshibsu.exe	"Reduces the power consumption when the laptop isn't being used to preserve battery power. Hibernate function doesn't work if this is disabled. Similar programs on other laptops reduce the processor clock rate
U	TosHKCW	TosHKCW.exe	Toshiba Hot Key Change/Control Wireless. Permits you to use a hot key to activate/deactivate built-in 802.11b wireless transmission on a laptop (if installed)
Y	TosMem	tosmem.exe	Toshiba laptop related. Win98/Me ACPI system can not hibernate or go on standby if all of the physical memory lower than 640KB is locked. This utility allocates and locks three pages on boot and then releases them on standby/hibernation for ACPI.SYS in order to solve the above problem
U	TosRotation	TRot.exe	TOSHIBA Rotation Utility - allows users to rotate a notebook's screen image 180 degrees in order to share information on the screen with others seated across a table or desk
U	TotRecSched	TotRecSched.exe	"Scheduler for Total Recorder - allows automatic recording of a show at a given time for later playback or you can use the scheduler as an alarm"
Y	ToUcamVProperty	VProperty.exe	"Philips Web Camera model name pcvc740k
U	Touch Manager	WinLED.exe	Dell keyboard utility. Disabling can result in loss of screen saver and power saver functionality
U	TouchED	TouchED.exe	TouchPad On/Off Utility on a Toshiba laptop
N	tour	regedit ..tour.reg	Edits registry values to keep the WinMe tour in Task Scheduler
N	Tour	wincool.exe	"Component of WinME that's annoying as hell. Pop's up a prompt to play the C:WINDOWSApplication DataMicrosoftINTROCONTENT.HTA that plays a full screen version of the WinME product preview Windows Media video file that cannot be stopped to my knowledge until it finishes. That prompt will keep popping up after an install/reinstall of WinME until you give in and watch the thing. It also puts a task scheduler entry to run that annoying thing every 30 minutes
N	tourpath	regedit /s [path] tour.reg	"Edits registry values to keep the Win 2000 ""tour"" in Task Scheduler"
U	TP4EX	tp4ex.exe	Adds accessibility options for an IBM TrackPoint
U	tp4mon	tp4mon.exe	"Supports the ""pointer stick"" in lieu of a mouse on an IBM ThinkPad laptop. Necessary for the ""scroll"" button to work"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.