Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer


NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.


  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown

Startup Name Process Name Details
Nload=adw30.exeAfter Dark for Windows - screen saver program. Popular before screen savers were integrated into Win95
Uload=asistat.exeStatus monitor for an NEC SuperScript printer
Uload=esspk.exe"Speakerphone capability through a soundcard for an ESS modem"
Yload=hotkey.exeSolo 5300 display driver for Win2K on some Gateway laptops
Nload=HPWHRC.EXELoads the Status Window software for the HP Laserjet printers
?load=WPSLOAD.EXE"Windows printing system that comes with the setup for Canon BJC series on the manufacturer's disk"
Nload=vi_grm.exeMonitor drivers for Trio2x/3x based video cards - displays control panel for quick access to display settings
?load=WINOSCFG.EXE"Could it be something to do with configuring Windows on a new PC from an OEM supplier?"
Yload=wpshrc.exeRequired to prevent configuration errors on a Compaq LBP-660 and LBP-460 parallel port laser printers (and maybe others)
Yload=Bfrecv.exeBitware modem driver
Xload=msater.exe"Added by the RETSAM TROJAN!"
Xload=shambl3r.exe"Added by the REMABL WORM!"
Xload=Spoolsv.exe"Added by the CIADOOR.B TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %Windir%"
?Load=wtfeat.exe"Associated with the Wintab Digitizer"
Yload=AICLIENT.EXE"Asset Insight from Tangram - asset managing software. Required if an organisation is running a centrally administered asset management system"
Xload=hint.exe"Added by the ATAK WORM!"
Xload=win32exec.exe"Added by the BITTER WORM!"
Xload=a1g.exe"Added by the ATAK.B WORM!"
Xload=dapdll.exe"Added by the ATAK.E WORM!"
Xload=svhost32.exe"Added by the LINEAGE-AB TROJAN!"
Yload=01comm32.exe"Related to Elsa CommPro (Communicate Pro) access software for Microlink modems - this software contains answering machine and fax functions
Xload=inetinfo.exe"Added by the PROXY-GG TROJAN!"
Xload=Kerne14.exe"Added by the LINEAGE-BA TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.