Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer


NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.


  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown

Startup Name Process Name Details
?00DSKSVR00desksaver.exe saskda"Part of Advanced Desktop Shield
U00DSKSVR01desksaver.exe tray"System Tray access to Advanced Desktop Shield
U12Ghosts SaveLayout12autosl.exe"12Ghosts SaveLayout - ""Always (always!) keep the layout of your desktop icons"""
NAAATraySaverTraySaver.exe"System Tray management utility from Mike Lin which allows you to hide
XAll Sea screen saverTaskTray.exe"Free screensaver
?ASUS Camera ScreenSaverASScrProlog.exe"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
?ASUS Screen Saver ProtectorASScrPro.exe"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
UBUFFALO Power Save Utility for HDHDManage.exe"Power Save utility for Buffalo backup hard discs"
XCpusaveCpusave.exe"Added by the GEMA TROJAN!"
XCpusave32Cpusave32.exe"Added by the GEMA TROJAN!"
XCrnsavascrnsave.pif"Added by the SDBOT-ZV WORM!"
Udesksaverdesksaver.exe"Part of Advanced Desktop Shield
UDeskSaverDeskSaver.exe"DeskSaver from Headway Creative - utility that allows you ""to backup and to restore the icons position easily on the Windows desktop"". The Pro version also includes a ""Taskbar Economizer"" which minimizes an open window to the System Tray instead of the taskbar. Located in %ProgramFiles%\Headway Creative\DeskSaver"
UDeskSaver ProDeskSaver.exe"DeskSaver Pro from Headway Creative - utility that allows you ""to backup and to restore the icons position easily on the Windows desktop"". Includes a ""Taskbar Economizer"" which minimizes an open window to the System Tray instead of the taskbar. Located in %ProgramFiles%\Headway Creative\DeskSaver"
Udesksaver.exedesksaver.exe"Part of Advanced Desktop Shield
UELSAChipGuardelsavect.exe"ChipGuard for ELSA graphics cards - monitoring solution which monitors both the GPU temperature and fan speed
NEnergizer FileSaverEnergizer FileSaver.exe"Energizer FileSaver - UPS back-up utility for Energizer UPS products. From their Tech Support staff this is known to have a memory leak since it's release - with no fix planned! It will grab 2-5 handles per second and crash the average system in less than 3 days - therefore not recommended"
Xfree-save[path to risk]"Freesave security risk that tracks and sends browser information and visited websites on the computer. Uninstall this software unless you put it there yourself"
NGCSGrabClipSave.exe"GrabClipSave screen capture tool"
NIconsaverIconsaver.exe"IconSaver is a desktop icon manager"
XLogin Screen Saverlogin.scr"Added by the RBOT-AVN WORM!"
XM3Development_WhenUSave_InstallerM3Development_WhenUSave_Installer.exe"WhenU.Save adware"
XMatrixScreenSavermss.exeUnidentified malware
XMicrosoft PC Health Remote Assistance File Open & Save controlssfrcdlg32.exe"Added by the RBOT-AVY WORM!"
XMicrosoft Service Disk Cycledisksave.exe"Added by a variant of the IRCBOT TROJAN!"
XMicrosoft System Saver[path to worm]"Added by the RBOT.BSK WORM!"
XMS Screen Saverscrsave.scr"Added by the RBOT-AGT WORM!"
NpdfSaver3pdfSaver3.exe"PDF-XChange - create Adobe compatible PDF files from virtually any Windows software such as MS Word
XPopularScreensaversWallpaper"rundll32 [path] F3SCRCTR.DLLLES"
UPwrsavePwrsave.exeToshiba Power Saver utilities. Required on a laptop if you run of a battery and want to conserve power
XSaveSave.exe"WhenU.Save adware"
XSavelssas.exe"Added by an unidentified TROJAN! See here"
XSaveArmorSaveArmor.exe"SaveArmor rogue security software - not recommended
XSaveDateSaveStartDate.ExeUnidentified adware
XSaveDefenderSaveDefender.exe"SaveDefender rogue security software - not recommended
XSaveDefenseSaveDefense.exe"SaveDefense rogue security software - not recommended
XSaveKeepSaveKeep.exe"SaveKeep rogue security software - not recommended
XSaveKeeperSaveKeeper.exe"SaveKeeper rogue security software - not recommended
XSavenowSaveNow.exe"WhenU.Save adware"
XSaveSoldierSaveSoldier.exe"SaveSoldier rogue security software - not recommended
XScreen Saverscrnsaver.scr"Added by the RBOT-AGP WORM!"
NScreen Saver ControlFSScrCtl.exeInstalls as part of the Hubble Space Telescope screen saver (and possibly others). Lets you control your installed screensavers from a System Tray icon
XScreenSaverPlus"rundll32.exe MSA64CHK.dllDllMostrar"
XService Registry NT Savejdbgmgrnt.exe"Added by the BANCOS-CG TROJAN!"
XService Registry NT Savetaskmgrnt.exe"Added by the BANCOS-BY TROJAN!"
XService Registry NT Saveregeditnt.exe"Added by the BANCOS-BM TROJAN!"
XSndsaverSndsaver.exe"Added by the GEMA TROJAN!"
Uwebsaverlivewebsaverlive.exe"WebSaver Live! is a companion program to Websaver that retrieves information from the Internet on a schedule and displays it on your screen when your computer is idle"
XWhenUSaveSave.exe"WhenU.Save adware"
XWindows ScreensaverService.exe"Added by the KELVIR.P WORM!"
UYou've Got Pictures Screensaverygpsstra.exeAOL You've Got Pictures Screensaver

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.