Startup

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
Y	!1_ProcessGuard_Startup	procguard.exe	"DiamondCS ProcessGuard security software - stops malicious worms and trojans from being executed silently in the background
X	?ekio Startups	?nksvc32.exe	"Added by the AGOBOT-OV WORM where ? is a random character"
U	Absolute StartUp monitor	ASMon.exe	"Absolute Startup - startup monitor from F-Group Software"
X	adstartup	automove.exe	"Adlogix adware variant"
X	Adstartup	Adstartup.exe	"Adlogix adware"
X	AIM95 Startup	aim95.exe	"Added by the AGOBOT.AEE WORM!"
U	AQ3HelperStartUp	AQ3HEL~1.EXE	"ScreenScenes ""Aquatica Water Worlds"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
?	AsusStartupHelp	AsRunHelp.exe	"Unknown ASUS motherboard utility. What does it do and is it required?"
X	ATI Technology Startup	techstart.exe	"Added by the RBOT-AEU WORM!"
X	Auto CD-ROM Startup	cdaccess.exe	"Added by the SPYBOT.BLA WORM!"
N	AutoCAD Startup Accelerator	acstart16.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
N	AutoCAD Startup Accelerator	acstart17.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
U	BI1HelperStartUp	BI1HEL~1.EXE	"ScreenScenes ""Beach Islands"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	BitDefender_P2P_Startup	BitDefender_P2P_Startup.exe	"Bitdefender anti-virus for P2P clients - no longer supported at the BitDefender website"
X	Blank AntiViri	AUT0EXEC.BAT StartUp	"Added by the BRONTOK-CJ WORM!"
U	BO1HelperStartUp	BO1HEL~1.EXE	"ScreenScenes ""Butterfly Oasis"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	BO1HelperStartUp	Bo1helper.exe	"ScreenScenes ""Butterfly Oasis"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
Y	BootSkin Startup Jobs	BootSkin.exe	"Stardock BootSkin is a program that allows users to change their Windows 2000 and Windows XP boot screens"
X	Bouncer RunStartup	bouncer.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
X	Bouncer RunStartup	LiveUpdate.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
X	cmonitor	startupmon.exe	"SystemDoctor rogue security software - not recommended
N	CTStartup	CTEaxSpl.exe	Splash screen with sound on every boot up. Installed with a Sound Blaster Audigy soundcard
X	DC6	dc6_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	DC6_check	dc6_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	Directx Startup Drivers	direct.exe	"Added by the RBOT.UXL WORM!"
X	Dll Boot Loader on Startup (do not remove this)	[various filenames]	Added by an unidentified TROJAN!
Y	DPCProxyLoadOnStartup	dpcstart.exe	"DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access"
U	DualCoreCenter	StartUpDualCoreCenter.exe	"Unified control center for overclocking both the graphics card and the CPU
X	ERS	ers_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	ERS_check	ers_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
N	eWare Startup	iWareStart.exe	"eWare iWare task bar. Not required"
Y	F-Secure Startup Wizard	FSSW.EXE	"F-Secure antivirus"
X	Fen Startups	fensvc32.exe	"Added by the RANDEX.CCF WORM!"
X	Fenio Startups	fnesvc32.exe	"Added by the AGOBOT-OS BACKDOOR!"
X	FireFox Startup Drivers	wuaclt.exe	"Added by the RBOT.BYX WORM!"
U	FirewallStartup	Firewallstartup.exe	"Innovative Startup Firewall - ""designed to protect your computer from programs that install themselves in the StartUp area of your Windows without asking for your approval. Innovative StartUp Firewall will help you keep your computer clean
X	Gekio Startups	gnksvc32.exe	"Added by the AGOBOT.AFJ WORM!"
X	Global Startup	WinDash.EXE	"Detected by Kaspersky as the VB.Q WORM!"
X	GStartup	GMT.exe	"Gator spyware component - see here. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	Hekio Startups	Hnksvc32.exe	"Added by the AGOBOT-QE WORM!"
U	HijackThis startup scan	HijackThis.exe	"""HijackThis is a free utility which quickly scans your Windows computer to find settings that may have been changed by spyware
U	Hook99startup	hk2re.exe	""Hook99 enables the user to customize the start button. You can change or remove the text and replace the Windows flag on button with icon of your choice. Supports Windows icons
?	HP OfficeJet Series xxx Startup	HPOSTR03.EXE	"xxx represents the series number - such as 700. What does it do and it it required?"
?	HP OfficeJet Series xxx Startup	HPOstr05.exe	"xxx represents the series number - such as 700. What does it do and it it required?"
U	IDriveE Startup	IDrvieEStartup.exe	"IDrive from Pro Softnet Corporation - free full featured online backup up to 2GB with the option of paying for more storage space and managing multiple accounts"
N	Iomega Startup Options	IMGSTART.EXE	"Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs"
N	ISUSPM Startup	ISUSPM.exe	"InstallShield is used by a number of software producers to install their programs and manage software updates. This entry searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis"
N	Launch YahooPOPs! at Windows startup	YAHOOPOPS.EXE	"YahooPOPs - enables free POP3/SMTP access to Yahoo! Mail through a service on localhost that emulates the web interface. Available via Start -> Programs"
N	LimeWire On Startup	LimeWire.exe	"LimeWire - Peer to Peer (P2P) file-sharing client. Note - as with all P2P sharing programs they are susceptible to various forms of malware"
X	Lssas Monitoring Startup	LSSAS.EXE	"Added by the RBOT.XJ WORM!"
X	MAV_check	mav_startupmon.exe	"Part of the WinAntiVirus Pro 2007 rogue security software - not recommended
X	mav_startupmon	mav_startupmon.exe	"Part of the WinAntiVirus Pro 2007 rogue security software - not recommended
X	Micosoft Startup	syscall.exe	"Added by the SDBOT-JI WORM!"
X	Micosoft Startup	systall.exe	"Added by the SDBOT-GM BACKDOOR!"
N	Microsoft Office Startup	osa.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
N	Microsoft Office Startup	Osa9.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
X	Microsoft startup	wmpIayer.exe	Added by the IRCBOT.ACI TROJAN!
X	Microsoft Startup Manager	sysservice.exe	"Added by the AVALANEC TROJAN!"
N	Microsoft Utility Startup	OSA9.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
X	Microsoft Winedows startup	WinKey.exe	"Added by a variant of the SDBOT WORM! See here"
U	ML1HelperStartUp	ML1HEL~1.EXE	"ScreenScenes ""Midnight Lake"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	ML1HelperStartUp	ML1Helper.exe	"ScreenScenes ""Midnight Lake"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
N	MoneyStartUp	Money Startup.exe	Microsoft Money
N	MoneyStartUp10.0	Activation.exe	Part of MS Money 2002. Available via Start -> Programs
X	MS lsass Startup	lsass135.exe	"Added by the RBOT.WM WORM!"
?	MSCRMStartup	Microsoft.Crm.Application.Hoster.exe	"Related to Microsoft Dynamics CRM integrated solutions for Financial
X	MSN Messenger Service Startup	msnservice.exe	"Added by a variant of the RBOT WORM! See here"
X	Msn Startup	msnstartup.exe	"Added by the ARBOT.AA WORM!"
X	MSN8m Startup	msn8m.exe	"Added by a variant of the RBOT WORM!"
X	Msy Startups	msyh32.exe	"Added by the AGOBOT-QC WORM!"
X	Msy1 Startups	msyj32.exe	"Added by the AGOBOT-QQ WORM!"
U	MW1HelperStartUp	Mw1helper.exe	"ScreenScenes ""Magic Waterfall"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	MW1HelperStartUp	MW1HEL~1.EXE	"ScreenScenes ""Magic Waterfall"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	New.net Startup	"rundll32 [path] NEWDOT~1.DLL	ClientStartup"
X	New.net Startup	"rundll32 [path] NEWDOT~1.DLL	NewDotNetStartup"
X	New.net Startup	"rundll32 [path] NEWDOT~2.DLL	ClientStartup"
X	New.net Startup	"rundll32 [path] NEWDOT~2.DLL	NewDotNetStartup"
X	Norton AV Protection Startup	Ati2xxx.exe	"Added by a variant of the RBOT WORM!"
U	Notebook Maximizer	maximizer_startup.exe	Toshiba Notebook Maximizer software - adjust settings to save battery power and increase efficiency
X	Nvidia Startup Manager	ksvc32.exe	"Added by the AGENT-IWD TROJAN!"
N	Office Startup	osa.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
X	Office Startup	Exploer.exe	"Added by the GAOBOT.BV WORM! Note the different filename to the valid MS Office entries"
N	Office Startup	Osa9.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
N	OmgStartup	omgstartup.exe	Sony program called OpenMG Jukebox - player and music organizer
N	OptiCAL Startup	OptiCAL.exe	"OptiCAL monitor calibration software from ColorVision for advanced amateurs
N	PhotoCAL Startup	PhotoCAL.exe	"PhotoCAL wizard driven monitor calibration software from ColorVision for beginners and photo enthusiasts"
N	PowerQuest Startup Utility	PQINIT.EXE	"From a visitor - "This seems to be installed when you install Power Quest Partition Magic. I think that it implements the changes when you use the magic mover app. If you don't have any mappings set up
U	ProPort Startup	ProPort.exe	"Proport is a port monitor/protector. Monitors an infinite amount of ports for trojans and nukes. Some additional features are auto connection-kill
U	QTaskStartup	qtask.exe	"Feature of Quicken.com Brokerage to customize and display Desktop Alerts and icon. It is not required for the Quicken Program to run correctly
Y	Quick Heal Startup Scan	QHSTRT32.EXE	"Quick Heal - virus scanner"
Y	Quick Startup	Fquick32.exe	For a Nisis G6 USB Graphics Tablet. Re-enables itself if disabled therefore best left alone
N	Quicken Startup	QWDLLS.EXE	Quicken option to load DLLs at startup
X	Registry Startup Check	checkreg.exe	"Added by the REMLOAD-A or DANMEC-B TROJANS!"
U	RivaTunerStartupDaemon	RivaTuner.exe	"Part of RivaTuner - a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This entry is for XP and applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
U	RivaTunerStartupDaemon	RivaTunerWrapper.exe	"Part of RivaTuner - a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This entry is for Vista and loads the main application (RivaTuner.exe) to apply overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
U	RKLG Startup	klg.exe	"Local Keylogger Pro keystroke logger/monitoring program - remove unless you installed it yourself!"
U	Run StartupMonitor	StartupMonitor.exe	"Mike Lin's StartupMonitor
X	Salestart	mav_startupmon.exe	"Part of the WinAntiVirus Pro 2007 rogue security software - not recommended
N	SB Audigy 2 Startup Menu	/l:eng	"Related to the Dell OEM version of the Sound Blaster Audigy 2 sound card. If this item is listed and checked in startup
X	Secure32	Shell32.com StartUp	"Added by the BRONTOK-CJ WORM!"
X	Secure64	Regedit32.com StartUp	"Added by the BRONTOK-CJ WORM!"
X	Services Startup	services.exe	"Added by the CROWT.A WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files"
X	Services Startup	svhost33.exe	"Added by a variant of the RBOT WORM!"
X	Services32 Startup	win32dll.exe	"Added by the SDBOT-XO WORM!"
U	SfWinStartInfo	sfWinStartupInfo.exe	SFIRM32 Online Banking software
X	Skype Startup	skyp.exe	"Added by the VANBOT-C WORM!"
X	SkypeStartup	Skype.exe	"Added by the PYKSE-A WORM!"
Y	SoDA Startup	SodaStartup.exe	"Used by the IBM Rational SoDA project management tool. Unsure of it's actual purpose but it's recommended you leave it enabled if you use the software"
U	SRP Startup	srrpro.exe	"System Restore Remover Pro allows you to safely and easily remove System Restore and various other Windows Millennium ""features"". This is enabled if you tick the ""Remove unnecessary System Restore information on startup"" box. Available via Start -> Settings -> Control Panel"
N	Startup	??	Related to an Iomega drive
X	Startup	WinlogonStartup	Unidentified malware
X	Startup	mirc.exe	"Added by the FLOOD-EU TROJAN! An uninstall option for mirc.exe can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as mIRC. This one puts 10 files in the Windows or Winnt folder"
X	Startup Configuration	[six character filename]	"Added by the RBOT-ARV WORM!"
X	Startup Configuration	wztoid.exe	"Added by the RBOT-ASD WORM!"
?	Startup Launcher GUI	GUI.exe	"Startup manager?"
U	Startup Manager Scanner	StartupMonitor.exe	"Startup-Mechanic Startup monitor - offers boot protection of your PC from harmful trojans
Y	Startup Scan	Sensor.EXE	"AntiVirus Quick Heal - scheduling agent"
X	Startup Update	Cvshost.exe	"Added by the GAOBOT.AO WORM!"
X	StartupBin	iwnujdss.exe	"Added by the SDBOT-XZ WORM!"
X	StartUpDate	[path to trojan]	"Added by the BIFROSE.F BACKDOOR!"
U	StartupMonitor	StartupMonitor.exe	"Mike Lin's StartupMonitor
X	StartupOption	loadsysdisk.exe	"Added by the HIDAGENT-B WORM!"
U	Suitcase Startup	Suitcase.exe	"Suitcase - system font manager start up utility. Used for dynamic managment of fonts on your system"
X	System File Startup	sys32.exe	"Added by the RBOT.OTL WORM!"
U	System Mechanic Startup Guard	StartupGuard.exe	"System Mechanic Startup Guard protects the Window's startup locations from being modified by viruses
U	System startup	charmapx.exe	Only required if using an oriental language
X	System Startup	Voltio.exe	"Added by the RBOT.NJ WORM!"
X	System Startup	kimochi.exe	"Added by a variant of the RBOT WORM!"
X	System Startup	sys.exe	"Added by a variant of the IRCBOT TROJAN!"
X	System Startup Manager	smcss.exe	"Added by the RBOT.AMD WORM!"
X	System32 Runtime StartUp	sysrs.exe	"Added by the AGOBOT.ANW WORM!"
N	Timed Backups Manager Startup	BACKTIME.EXE	"Backup Plus - backup software"
X	tjstartup	[path to file]	"Added by the TJSERV.C TROJAN!"
?	TomcatStartup	hpbpsttp.exe	"Apache Tomcat web server
?	TomcatStartup 2.5	hpbpsttp.exe	"Apache Tomcat web server
N	ucstartup	ucstartup.exe	"IBM Update Connector - old auto updater feature for IBM machines that connects to IBM to see if there are any new drivers
N	ucstartup.exe	ucstartup.exe	"IBM Update Connector - old auto updater feature for IBM machines that connects to IBM to see if there are any new drivers
N	UC_Start	ucstartup.exe	"IBM Update Connector - old auto updater feature for IBM machines that connects to IBM to see if there are any new drivers
N	Ultra Hal Assistant 4.5 Startup	HalAsst.exe	"Zabaware Ultra Hal Assistant - artificial intelligence conversation simulator. It is capable of being your digital secretary and companion"
X	UserInit StartUp	rpcxuisu.exe	"Added by a variant of the SDBOT WORM!"
X	Vekio Startups	Pnksvc32.exe	"Added by the AGOBOT.AJG WORM!"
X	VGA Startup	vgacard.exe	"Added by a variant of the RBOT WORM!"
N	vTunerStartUp	vTuner.exe	"vTuner - "an easy way to find and listen to radio and TV broadcasts over the Internet""
N	WFGStartup	WFGStartup.exe	"
X	Win startup	mscfg32.exe	"Added by the SPYBOT-AE WORM!"
X	Win Startup	WINCFG32.EXE	"Added by the SPYBOT-CL WORM!"
X	Windows Audio Startup	nndsvc.exe	"Added by the IRCBOT-AAE TROJAN!"
X	Windows CODE Fix Msy Startups	msyh32.exe	"Added by the AGOBOT.AKK WORM!"
X	Windows Messenger Live Startup	windowslivemsn.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Windows Messenger Live Startup	windowsmsnlive.exe	"Added by the DELF.DAX TROJAN!"
X	Windows MSConfig Startup Logger	winlog.exe	"Added by the RBOT.BCU WORM!"
X	Windows Registry Startup	wind32.exe	"Added by the AGOBOT-BZ WORM!"
X	Windows Startup	winsta~1.exe	"GoHip foistware"
X	Windows Startup	winstartup.exe	"GoHip foistware"
X	Windows Startup	Wdrun32.exe	"Added by the GAOBOT.AO WORM!"
X	Windows Startup	services21.exe	"Added by the AGOBOT-MX WORM!"
X	Windows Startup	Winsys32.exe	"Added by the RBOT.AAB WORM!"
X	Windows Startup 32 Bits	sysrun32.exe	Added by a variant of the DARKSUN TROJAN!
X	WindowsServicesStartup	svchost.exe	"Added by the ECUP WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
X	Winsock Startup	Main2.exe	"Added by a variant of the SDBOT WORM!"
X	WinSysStartUpWKbLw	TaskSystemDll.Exe	"Added by the BACKZAT.G WORM!"
?	xkstartup	"RunDll32 InstZ82.dll	SetUsbPrinterPort"
X	Xupiter Startup	XupiterStartup.exe	"Xupiter - adware and homepage hijacker. Use Spybot S&D
X	xupiterstartup2003	xupiterstartup2003.exe	"Xupiter - adware and homepage hijacker. Use Spybot S&D
X	Zekio Startups	znksvc32.exe	"Added by the AGOBOT-AGI WORM!"
X	Zekio Startups	condll.exe	"Added by the AGOBOT-AGD WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.