Windows Startup Item Database

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
N	VsEcomrEXE	VSECOMR.EXE	From McAfee VirusScan up to version 4.x. This executable is responsible for the periodic "update" prompts
Y	Vshwin32EXE	VSHWIN32.EXE	From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Communicates between VSSTAT.EXE and the VShield System Scan module. Can be started automatically or available via Start -> Programs
N	VSN	VSN.exe	Software to share photographs across the internet
Y	vsnpstd3	vsnpstd3.exe	"Sonix Inc. Camera Monitor MFC Application"
Y	VSOCheckTask	MCMNHDLR.EXE	"Part of McAfee's SecurityCenter and Virusscan Online. Must be enabled for scanning to work"
N	vspdfprsrv.exe	vspdfprsrv.exe	"Visage PDF Printer"
Y	VsStatEXE	VSSTAT.EXE	From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Communicates between VSSTAT.EXE and the VShield System Scan module. Can be started automatically or available via Start -> Programs
N	vTPass	vtpassld.exe	"Part of vTrails - a live media delivery solution. vTPass is the driver enabling the system to work. If unavailable via Start -> Programs
U	VTPreset	VTPreset.exe	Savage Pro S3 graphics software
U	VTTimer	VTTimer.exe	Driver file for the on-board VIA/S3G KM400/KN400 graphics which enables TV in/out communication
N	vTunerStartUp	vTuner.exe	"vTuner - "an easy way to find and listen to radio and TV broadcasts over the Internet""
X	vuaaa	reg.exe	"Added by a variant of the RBOT WORM!"
X	VVSN	VVSN.exe	"WhenU.Save adware"
U	VZAccess Manager	VZAccess Manager.exe	Verizon Access manager for enterprises
U	VZRemoteCommander	AvRmtCtr.exe	"Related to Sony's VAIO Zone Remote Commander. A non-essential process to the running of the system
X	w32	w32.exe	"Added by the SOKEVEN TROJAN!"
X	W32.Scran	Scran.exe	"Added by the NARCS WORM!"
X	w32alanis	mope.scr	"Added by the SINALA WORM!"
X	W32data	eworo.exe	"Added by a variant of the RBOT WORM!"
X	W32Load	[random filename].scr	"Added by the CASPID WORM!"
X	W32PluginsDownloaderXMLHTTPSelfClearing7520	wiper.exe	"Added by the PROXYSER-M TROJAN!"
X	w32sup	w32sup.exe	Adult content dialler
X	W32Tc	WTC32.scr	"Added by the VOTE.D or VOTE.K WORMS!"
X	W3KNetwork	"rundll32.exe w3knet.dll	dllinitrun"
Y	W75P2PSERVER	W75P2PS.EXE	Printer utility which is required in order to make the printer work correctly
U	W815DM	W815DM.exe	"Enuff Parental Control Software by Akrontech"
U	w98Eject	w98Eject.exe	"Related to USB support for Sigmatel MP3 audio palyer (and others such as SanDisk). It's intent is to ""put away"" the ""disk"" before you unplug it from the USB port
U	wait4IP	wait4IP.exe	"Packard Bell net2Plug allows you to network PCs anywhere in your house"
U	wallchgr.exe wstart	Wallchgr.exe	"WallChanger - wallpaper changer from Blue Tree Software"
X	WallPaper	taskimgr.exe	"Added by the BANKER-GX TROJAN!"
U	WallPaper	WALLPA~1.EXE	"Wallpaper Changer - wallpaper manager that can change your background images on every startup"
U	WallpaperChanger	Wallpaper.exe	"A wallpaper changer and manager utility. There is the Freeware version and the Pro version. The freeware version is completely free. The Pro version is 30-day trialware
N	Wanadoo Messenger.exe	Wanadoo Messenger.exe	Wanadoo ISP instant messenger client
Y	WanMPSvc	WanMPSvc.exe	"An AOL component
X	WAPI	wts*.exe [ = random char]	"PurityScan/Clickspring adware"
N	War FTPD Tray Icon	wartray.exe	"War-ftpd - FTP server"
N	war-ftpd.exe	WAR-FTPD.EXE	"War FTP Daemon from JGAA's Internet - FTP client"
X	Wardo	syslaunch.exe	"Added by the ADCLICKER.G TROJAN!"
X	WareOut	WareOut.exe	"Wareout - malware masquerading as a spyware and dialer remover"
N	warez	warez.exe	"Warez P2P client"
U	Warner	warner.exe	Also known as "CyberWarner". From G-Tek Technologies and pre-installed on some Packard Bell PCs. Protects critical files
U	Warnet	warnet.exe	"Warnet - system cleanup software"
U	Warning: do not remove it!	fpplock.exe	"Part of Folder Password Expert by ZQS Software Team - ""a software program to restrict access to the folders that contain your sensitive data"""
Y	Warning: do not remove it! (system)	cfpsys.exe	"Folder Password Protect - a program that lets you set a password on folders of your choice"
N	WARSVR	war-ftpd.exe	""War FTP Daemon - the original free FTP server for windows"""
U	WashAndGo - Cleanup of old Backupfiles	checker.exe	"WashAndGo - temp file cleaner"
U	Washer	washer.exe	"Windows Washer from Webroot Software. Useful utility that deletes safe to remove files
N	Washerie.exe	washerie.exe	"Cookie Washer for Internet Explorer from Webroot Software. Light version of Windows Washer
U	washindex	washidx.exe	"Windows Washer from Webroot Software. Useful utility that deletes safe to remove files
X	Wast	wast.exe	Grokster ads updater
N	Watch	watch.exe	Found to be used by a Trust USB scanner for auto starting the scanning software when the lid is lifted
U	Watch	1200UBWATCH.EXE	Button press monitor for the Mustek 1200 UB Scanner
N	Watch Dog Program	watchdog.exe	For Compaq PC's. Associated with Compaq's internet services. Not required if you don't use services provided by them and may not be required even if you do
N	Watchdog	Watchdog.exe	"Definitely part of the Mustek scanner drivers and software (for 600 III EP Plus and maybe others)
?	WatchDog	watchdog.exe	"Part of Motorola ""Mobile Phone Tools"" v3 - in a ""Mobiile Phone Tools"" sub-directory of Program Files"
?	WatchDog	DVDCheck.exe	"Related to an Intervideo program. What does it do and is it required in startup?"
N	WaveTop Launcher	WaveTop.exe	"WaveTop - "Get push content from TV without an Internet connection" - now possibly a defunct system in the US included as an optional part of WebTV in Win98"
N	WaveTop Receiver 1	N/A	"WaveTop - ""Get push content from TV without an Internet connection"" - now possibly a defunct system in the US included as an optional part of WebTV in Win98"
N	WaveTop Receiver 2	N/A	"WaveTop - ""Get push content from TV without an Internet connection"" - now possibly a defunct system in the US included as an optional part of WebTV in Win98"
N	WaveTop Upload Manager	N/A	"WaveTop - ""Get push content from TV without an Internet connection"" - now possibly a defunct system in the US included as an optional part of WebTV in Win98"
N	Wbiff	Wbiff.exe	"Wbiff! E-mail checker - automatically checks your e-mail and notifies you if any new e-mail has been received"
U	Wbutton	Wbutton.exe	Turns on and off the integrated WiFi on Acer (and other laptops)
N	WCESCOMM	WCESCOMM.EXE	Active sync for use with Windows CE based palm PC
X	WCESMngr	spoolsb.exe	"Added by the AGOBOT-QZ WORM!"
X	WCESMngr	WCEMNGR.EXE	"Added by the AGOBOT-QX WORM!"
U	wcmdmgr	wcmdmgrl.exe	"Web Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case"
N	wcmdmgr.exe	wcmdmgr.exe	"Web Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case"
U	wcmdmgrl	wcmdmgrl.exe	"Web Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case"
U	WCOLOREAL	coloreal.exe	"Makes colours sharper and brighter
?	WCPC	wintsvcc.exe	"??"
X	WCPI	wintsvit.exe	"PurityScan/Clickspring adware"
X	WCPS	Wint*.exe [ = random char]	"PurityScan/Clickspring adware"
X	WCPT	wintsvtr.exe	"PurityScan/Clickspring adware"
X	wcsys	wcsys.exe	"Added by the KEYLOG-AP TROJAN!"
U	WD Button Manager	WDBtnMgr.exe	Button manager installed with a western digital external disk drive. Allows you to back up your system with one click
X	WDInfo	wdinfo.exe	"Added by the DLUCA.B TROJAN!"
X	WDNS SYSTEM	nibie.exe	"Added by the MYTOB-BY WORM!"
X	WDNS SYSTEM	skybotx.exe	"Added by the MYTOB-BY WORM!"
X	WDNS SYSTEM	wdns33.exe	"Added by the MYTOB-BY WORM!"
X	wdskctl	wdskctl.exe	IEPlugin spyware
X	wdwctrl	wdwctrl.exe	"Added by the DLUCA.E TROJAN!"
N	WEATHER	WEATHER.EXE	"Weatherbug provides current outdoor temperature in the System Tray
N	WeatherCast	Weather.exe	Weather reporting in the System Tray. Available via Start -> Programs. Installed via Radlight
X	WeatherOnTray	WeatherOnTray.exe	"Hotbar's Weather Forecast tool for your desktop - adware"
X	WeatherOnTray	SbWeatherOnTray.exe	"Related to Hotbar's Weather Forecast tool for your desktop"
N	Weatherscope	Weatherscope.exe	"WeatherScope - ""displays your current local temperature in the system tray of your computer (near the clock) whenever you are online!"" Not recommended as it bundles GAIN adware. You can get the adware free version for a whopping $30.."
N	WeatherWatcher	ww.exe	"WeatherWatcher - weather reporting in the System Tray"
X	web	*****.exe [ = random char]	"Added by a variant of the EASTO.A TROJAN!"
X	WEB DRIVERS FOR WIN32	phqgh.exe	"Added by a variant of the RBOT WORM!"
X	Web Offer	ezPopStub.exe	"eZula TopText adware"
X	Web Offer	ezStub.exe	"eZula TopText adware"
X	Web Offer	EZSTUB22.EXE	"eZula TopText adware"
X	Web Offer	vl_ezstub.exe	"eZula TopText adware"
?	Web Search	??	"??"
X	Web Service	[random filename].exe	"Added by the ADMINCASH TROJAN!"
X	Web Service	sm.exe	"Added by the BUBE-F VIRUS!"
X	Web Service	MSXMIDI.EXE	"CoolWebSearch parasite variant
U	Web2Pop	Web2Pop.exe	"Web2Pop allows you to retrieve your web-based accounts messages to read them in your favorite e-mail client"
Y	web3trap	web3trap.exe	"PC-Cillin 2000 anti-virus software -> ActiveX filter. Guards against malicious ActiveX programs
X	webalize	webalize.exe	"Searchcentrix hijacker"
N	WebArmyKnife	WAK.exe	"Web Army Knife - a suite of web site developer's tools"
X	webassist	webassist.exe	Adware popup generator
X	webcam	webcam.exe	"Added by the MONAD-A TROJAN! Note - this malware actually changes the default value data of the Registry Run and RunServices keys in order to force Windows to launch it at boot. Name field may be empty"
?	Webcam Go Sti Service Application	wbcgosvc.exe	"Control software for the portable Creative Video Blaster Webcam Go digital camera/PC web cam. What does it do and is it required?"
N	WebcamRT.exe	WEBCAMRT.exe	For Logitech Web Cams. Not required - camera works fine without it
X	Webcelerator	webcel.exe	"Webcelerator from eAcceleration speeds your Web browsing by both remembering where you have been and anticipating where you will go. Only needed if you find it improves web browsing. Now no longer available and supported and when available was classed as spyware - see here"
X	WebCheck	WebCheck.pif	"Added by the CONE.C or CONE.F WORMS!"
X	WebCpr0	WebCpr0.exe	"WebRebates adware"
X	Webdav.exe	webdav.exe	IRC DDoS bot which gives the hacker full control over your system
U	WebExRemoteAccessAgent	raagtapp.exe	"Related to Web Meetings from WebEx Communications
X	WebHancer Agent	whagent.exe	"System Tray application that starts up Webhancer software. Software that optimizes your web browser and is also advertising spyware that you can find out about here"
X	webHancer Survey Companion	whSurvey.exe	"WebHancertrackware - traffic measurement service that uses a client agent that is stealth installed on user machines
X	WebInstall	WebInstall.exe	ClipGenie adware downloader
X	WebInstall2	WebInstall.exe	ClipGenie adware downloader
N	WebKey	WebKey.exe	"WebKey from JB Utilities. Utility to keep track of login data required when browsing the internet"
N	WebLink	WebLink.exe	"Softex WebLink is a ""cost-effective way to provide software updates
N	WebOutfitterTray	sttray.exe	"Intel WebOutfitter service System Tray icon"
N	Webposition Gold 2	wpsche~1.exe	"Scheduler for Web Position Gold - utility to help optimize the position of web-sites in search engines"
X	WebRebates0	WebRebates0.exe	"WebRebates adware"
X	WebRun	[random filename]	"Added by the ADWARELOADER TROJAN!"
U	websaverlive	websaverlive.exe	"WebSaver Live! is a companion program to Websaver that retrieves information from the Internet on a schedule and displays it on your screen when your computer is idle"
X	WebSavingsfromEbates	WebSavingsfromEbatesrun.exe	"Web Savings From Ebates Software
X	WebSavingsFromEbates0	WebSavingsFromEbates0.exe	"Web Savings From Ebates Software
U	WebScan	DEFSCANGUI.EXE	"eAcceleration Stop-Sign security software related. Previously not recommended
U	webscan	stopsignav.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
Y	WebScanX	WebScanX.exe	"From McAfee VirusScan up to version 4.x. Provides functionality for VShield Download Scan and Internet Filter modules. Enables internet scanning. Guards against malicious ActiveX programs
X	websearch	wjview ...websearch.exe	"""Web Savings"" From Ebates Software
N	WebSecureAlert	WebSecureAlert.exe	"WebSecureAlert - ""helps to protect your browser security by monitoring for unauthorized tampering with Internet Explorer's security settings
?	WebServer	VBI_SE~1.EXE	"Related to a Pinnacle sound card. What does it do and is it needed?"
U	Webshots	Webshots Tray.exe	"Webshots - software that displays photos as your screensaver and wallpaper
U	Webshots	websho~1.exe	"Webshots - software that displays photos as your screensaver and wallpaper
U	Webshots	Launcher.exe	"Webshots - software that displays photos as your screensaver and wallpaper
X	Website Administrator Info	webadmin.exe	"Added by the FORBOT-FY WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.