Windows Startup Item Database

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
U	twister	twister.exe	"Twister ""AntiTrojanVirus"""
N	TwkSCardSrv	SCardS32.Exe	Used with Towitoko SmartCard Readers for card recognition
X	twunk service	twunk16.exe	"Added by the RBOT.BAT WORM!"
X	twunk_32	twunk_32.exe	"Added by the BLACKMAL.C WORM! Note - this malware actually changes the default value data of the Registry ""Run"" key in order to force Windows to launch it at boot. Name field may be empty"
X	Twunk_64	twunk_64.exe	System1060 homepage hi-jacker. Note - this is not a Windows file and is found in a WindowsSystem1060 directory
X	tyack drive	tyack.pif	"Added by the RBOT-AMT WORM!"
N	type32	type32.exe	"For MS programmable keyboards. If you disable Intellitype in Startup
N	TypingSatellite	KBOOST.exe	"Typing Master 2002 background utility that collects typing errors and builds up customised typing lessons for your needs. Available via Start -> Programs"
U	U.S.Robotics WLAN Adapter Configuration Utility	USRWLAN.exe	"U.S.Robotics LAN Adapter - wireless LAN (WLAN) configuration utility"
X	Uate	oocs.exe	"PurityScan/Clickspring adware"
U	UBSShell	UBSShell.exe	UBS (United Bank of Switzerland) banking software
X	UCmd	fallfour.exe	"Added by the SDBOT-AZA WORM!"
U	UCmore XP - The Search Accelerator	"rundll32.exe UCMTSAIE.dll	DllShowTB"
N	UC_SMB	ucstart.exe	Part of IBM Update connector on IBM PCs for updating drivers on a new installation. Once you manually run the IBM Update connector program (shortcut) this entry is removed
N	uc_start	ucstartup.exe	"Auto updater feature for IBM machines that tries to connect to IBM to see if there are any new drivers
U	UD Agent	UD.EXE	The United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home but for medical research. Available via Start > Programs
U	Ueproc32	UEPROC32.exe	Part of Norton Utilities - most likely associated with the Unerase Wizard in older versions
X	UFD Monitor9382	ufdlmon.exe	"Part of USB Flashdisk software - what does it do and is it required?"
?	UFD Utility9382	UFDTool.exe	"Part of USB Flashdisk software - what does it do and is it required?"
?	ugon	aockstrs.exe	"??"
X	uhvjsul.dll	"[path] rundll32.exe [path] uhvjsul.dll	mrpmvyf"
N	Uidler	Uidler.exe	Uniloc Titlewave Browser used with some shareware
N	UIWatcher	UIWatcher.exe	"Ashampoo Uninstaller Suite - installation watcher. Available via Start -> Programs"
U	ujm	nm32.exe	"Stranget keystroke logger/monitoring program - remove unless you installed it yourself! Found in an ""fyt"" subfolder of the Windows or Winnt folder"
X	UKVideo2	ukvideo2.exe	Adult content dialler
?	Ulead AutoDetector v2	monitor.exe	"Related to Ulead Systems Inc.. What does it do and is it required?"
N	Ulead Photo Express x.0 Calendar	calcheck.exe	"Ulead Calendar Checker - part of Ulead Photo Express
N	UltimateZip Quick Start	uzqkst.exe	"UltimateZip - file compression utility"
N	Ultra Hal Assistant 4.5 Startup	HalAsst.exe	"Zabaware Ultra Hal Assistant - artificial intelligence conversation simulator. It is capable of being your digital secretary and companion"
?	UltraDVDMon	DVDMon.exe	"UltraDVD DVD player software - is it required?"
X	Ulubione	sys****.exe	"Ulubione adware"
N	UMAX VistaAccess	vsaccess.exe	VistaAccess gives you quick and easy access to scanning functions right from your desktop
U	UMonit	umonit.exe	Alerts when USB device is plugged in
Y	umxagent	umxagent.exe	"Tiny Personal Firewall V4 - main engine"
Y	umxldra	umxldra.exe	"User mode executive module DLL loader - part of Tiny Personal Firewall V4"
Y	UMXLDRW	UMXLDRW.exe	"Tiny Personal Firewall (pre V4)"
X	un32info	un32info.Exe	"Added by the CRYPTER.A TROJAN!"
X	UNERI	yujixit.exe	"Added by the SDBOT.BOO WORM!"
U	UnHackMe Monitor	hackmon.exe	"UnHackMe allows you to detect and remove a new generation of 'invisible' Trojan programs called ""rootkits"""
U	Uniblue Quick Access	qaccess.exe	"Quick Access application from UniBlue Systems Ltd - ""helps you account for all processes on your computer by providing an additional plug-in for the Windows task manager"""
U	Uniblue Registry Booster	RegistryBooster.exe	"Uniblue ""Registry Booster is the safest and most trusted solution to clean and optimise your system
X	uninstal	regsvr32 image.dll	"CoolWebSearch parasite variant"
X	Uninstall****	upd.exe	Adult content based screen saver where **** can be any number
N	UninstallAbility	uability.exe	"UninstallAbility uninstaller"
X	UninstallHL	PreUninstallHL.exe	"LinkReplacer/FFinder adware"
X	UninstallQL	PreUninstallQL.exe	"LinkReplacer/FFinder adware"
X	Uninstall_TBPS	TBuninst.exe	"WebSearch Toolbar - HuntBar hijacker
U	UniPrint	SetDfltSettings.exe	"Drivers for Uniprint
U	UniSc	Unisc.exe	McAfee UnInstaller
?	uniucu	uniucu.exe	"??"
X	Universal USB Service	svchost32.exe	"Added by the KELVIR.R WORM!"
X	Unix File Support	init3.exe	"Added by the RBOT-ZN WORM!"
X	unldr16	unldr16.exe	"Added by a variant of the CRYPTER.C TROJAN!"
X	unldr32	unldr32.exe	"Added by a variant of the CRYPTER.C TROJAN!"
U	UnlockerAssistant	UnlockerAssistant.exe	"Related to Unlocker utility to unlock files when the OS reports the file is being used by an other person or program"
N	UnSpyPC	UnSpyPC.exe	"Spyware remover - not recommended
Y	untray	untray.exe	"Command Antivirus related"
N	uoltray	exec.exe	Netzero free ISP software - not required
X	Up Service	up32.pif	"Added by the RBOT-ARI WORM!"
N	UpConfgVer	UpgConf.exe	"Panda Antivirus Platinum. Purpose unclear
X	UpData	wupdata.exe	"Added by the IRCBOT-AA TROJAN!"
X	Update	[original file path]	"Added by the LYNDEGG WORM!"
X	Update	CDUpdater.exe	"""Carpe Diem"" adult premium rate dialler related"
X	Update	Sysupd.exe	Added by the SLACKBOT VIRUS!
X	Update	Zupdate.exe	"Associated with B3d Projector foistware - see here"
X	Update	mshtm.exe	Browser hijacker - redirecting to buldog-search.com
X	Update	UPDATE-28062004.exe[25 blank spaces].vbs	"Added by the MIDFIN WORM!"
X	update	winis.exe	"Added by the RBOT-VD WORM!"
X	update	r00t.exe	"Added by the RBOT-ACO WORM!"
X	UPDATE	WinUpdater5.0.vbs	"Added by the GORMLEZ-A WORM!"
X	UpDate	RAuth.exe	"Added by the DLOADER-UL TROJAN!"
X	Update	csrss.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	Update	csrss.exe	"Added by the MEHEERWAR TROJAN! Note - this is not the legitimate csrss.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is found in a ""winupdate"" subfolder"
X	Update	lsass.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate lsass.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	Update	svchost.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in the Winnt or Windows folder"
X	Update for Windows	[various filenames]	"Added by the LERPA-A WORM! Note - the file name will be one of the following common.exe
?	Update for Works	MSWkstz.exe	"Maybe related to later versions of MS Works?"
N	Update Grokster	WiseUpdt.exe	"Automatically updates the Grokster file sharing software. Beware of adware and spyware when using this type of program
X	Update Install	Schost.exe	"Added by the GAOBOT.AO WORM!"
?	Update local	SetCPQLC.exe	"Running on a Compaq desktop. Any ideas?"
N	Update Manager	UpdateManager.exe	"Searches for updates for the Rogers Yahoo! Browser - can be run manually"
X	update run dos	logon.exe	"Added by a variant of the SDBOT WORM!"
X	Update Run MSword	LOGON.EXE	"Added by the RBOT.TY WORM!"
Y	Update Service	Update.exe	"Loaded by Handybits programs such as EasyCrypto. Re-instates itself every time the program is run so best to leave it enabled. Prevent it dialling out via a firewall"
X	update service	svxhost.exe	"Added by the RBOT-MG WORM!"
X	Update Service	winu32.exe	"Added by the RBOT-MG WORM!"
X	update service	winx.exe	"Added by a variant of the RBOT WORM!"
?	Update TUT	WiseUpdt.exe	"??"
X	Update ver 1.0	Swap.exe	"Added by the SWAP-C WORM!"
X	Update Windows	EXPLORE.EXE	"Added by a variant of the SDBOT WORM!"
X	Update Windows	EXPLORE.EXE	"Added by a variant of the SDBOT WORM!"
X	Update.exe	ravseuper.exe	"Added by the QQPASS-P TROJAN!"
X	Update32	configs.exe	"Hijacker
X	UpdateCheck	winstall.exe	"Added by the SPYBOT-CY WORM!"
X	UpdateComponent	CNF UPD.EXE	Added by the SPYBOT.GEN VIRUS!
?	UpdateFW	fwdload.exe	"Appears to be firmware update software for a Network Associates ATMbook OC-3 SMF Interface Module?"
?	UPDATEHOOK	Rundll32.exe	"??"
X	updatelavasoft	updatelavasoft.exe	"CoolWebSearch parasite variant - redirecting to lalasearch.com"
U	UpdateManager	sgtray.exe	"StorageGuard from Veritas (this version by Sonic). Free utility that integrates with Backup MyPC (formerly Backup Exec Desktop)
X	UpdateMedia	UpdateMedia.exe	"MediaUpdate foistware"
X	UpdateMgr	updmgr.exe	"Added by the SouthBeachTel premium rate adult content dialer"
N	updateMgr	AdobeUpdateManager.exe	Automatic updates for the Adobe Reader file viewer
N	updatemgr.exe	updatemgr.exe	"Once a month
X	UPDATEMSN	svhost.exe	Added by an unidentified WORM or TROJAN!
X	updater	wupdater.exe	"eUniverse/KeenValue adware"
?	updater	updater.exe	"??"
X	Updater	adservernow.exe	"AdServerNow adware"
X	updater	wisvc.exe	"Added by the ORSE-A TROJAN!"
X	Updater Service Process	svhost32.exe	"Added by the AGOBOT.TY WORM!"
X	updater32	winload32.exe	"Added by the CULT.M WORM!"
X	updatereal	realupdate.exe	Chinese originated adware
X	Updates	msupdate.exe	"CoolWebSearch parasite variant"
N	Updates from HP	backweb*****.exe	"See here - ""messaging service that automatically sends you support information
N	Updatestats	Updatestats.exe	"Statblaster - ""Get officially liscensed MLB pitch-by-pitch real time updates from every stadium around the league. StatBlaster provides live streaming statistics for each fantasy matchup you want tracked either in one league or across all your leagues"""
X	UpdateStats	UpdateStats.exe	"SeekSeek search hijacker related - see here"
N	updatev01	updatev01.exe	Ultra-networks.com software updater/downloader
?	Updatewiz	updatewiz.exe	"??"
N	UPDATE~1	updatemgr.exe	"Once a month
X	upddateit	winit.exe	"Added by the RBOT-MS WORM!"
X	Updmgr	updmgr.exe	"eUniverse/KeenValue adware"
X	updmgr	rvupdmgr.exe	"eUniverse/KeenValue adware"
X	upDpacketo	services.exe	"Added by the NAFBOT-A TROJAN! Note - this is not the legitimate services.exe process which is always located in the System (9x/Me) or System32 (NT/2K/XP) folder and should not normally figure in Msconfig/Startup! This file is located in a ""TEMPER"" subfolder of the Windows or Winnt folder"
N	UpdReg	Updreg.exe	Reminder to register Creative Labs SoundBlaster Live! cards
X	UpdSys	[random filename]	Added by the BJ TROJAN!
X	Updt Service	updt.pif	"Added by the RBOT-AYU WORM!"
X	updwebmin	updwebmin.exe	"Added by the BACKDOOR.GEN TROJAN!"
?	UPERVGAS	UPERVGAS.exe	"??"
X	Upgrade Sarvice	sxchost.exe	"Added by a variant of the TOFGER-I TROJAN!"
X	Upgrade Service	sxchost.exe	"Added by the TOFGER-I TROJAN!"
X	Upgrade Service	winupd.exe	"Added by the TOFGER-U TROJAN!"
X	upme	[filename]	"Added by the MUGLY.F WORM!"
X	Upme	DLLMAN.EXE	"Added by the MUGLY.I WORM!"
X	UPnP Manager	upnpman.exe	"Added by a variant of the AGOBOT WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.