Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer


NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.


  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown

Startup Name Process Name Details
Nrun=cmmpu.exeMIDI emulator driver for the integrated sound chip by C-Media based on the CMI-8330 chip set normally found in cheap motherboards. Also installed as part of the software for a Guillemot Maxi Muse sound card (PCI)
Nrun=hpfschedHPFSCHED is a small TSR that will remind you to clean the cartridges in your DeskJet from time to time in order to keep print quality high. It can be removed from the run line in win.ini if you do not want that feature
Nrun=lxdboxcp.exeLexmark DOS-Printing Control Program for the Lexmark 2050. Only required if you need to print from DOS
Nrun=pcfix2k.exepcfix2k splash screen
Xrun=ptlseq.cpl"PhoenixNet BIOS adware. See here"
Urun=ramsys.exe"Advanced Startup Manager from Rays Lab"
?run=wallflip.exe"Desktop wallpaper changer?"
Xrun=svcinit.exe"CoolWebSearch parasite variant"
Xrun=fntldr.exe"CoolWebSearch Tapicfg parasite variant"
Yrun=smsrun16.exe"Microsoft Systems Management Server (SMS) related - program that reads SMSRUN16.INI on clients running Win 3.1
Xrun=RAVMOND.exe"Added by the LOVGATE-F WORM!"
Xrun=dec25.exe"Added by the ATAK.F WORM!"
?run=LXBTppls.exe"Reportedly part of Lexmark printer software - what does it do and is it required?"
Nrun=fmedia.exeFMedia FaxWorks related - can be run manually
Yrun=wswpd.exe"Used with some models of Panasonic
Xrun=cyxid98.exeUnidentified malware
Xrun=info32.exe"CoolWebSearch Tapicfg parasite variant""Added by the GAGGLE.E WORM!"
Xrun=RegistryReminder.exe"Added by the APSTROJAN.OB TROJAN!"
Xrun=sec5dec.exe"Added by the ATAK.G WORM!"
Xrun=wmplayer.exe"CoolWebSearch Smartsearch parasite variant""Added by the HOLCAS.A WORM!" browser hijacker
Xrun=msoffice.exe"Added by the ADWARELOADER TROJAN! Note - do not confuse with the legitimate Microsoft Office file
Xrun=DRDOOM.EXE"Added by the SEMAPI-A WORM!"
Xrun=svhost.exe"Added by the ADMINCASH.B TROJAN!"
Xrun=dllreg.exe"Added by the DUMARU-L TROJAN!"
Xrun=Celine.scr"Added by the CELINE-A TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.