start

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
Y	!1_ProcessGuard_Startup	procguard.exe	"DiamondCS ProcessGuard security software - stops malicious worms and trojans from being executed silently in the background
X	?ekio Startups	?nksvc32.exe	"Added by the AGOBOT-OV WORM where ? is a random character"
U	Absolute StartUp monitor	ASMon.exe	"Absolute Startup - startup monitor from F-Group Software"
X	adstartup	automove.exe	"Adlogix adware variant"
X	Adstartup	Adstartup.exe	"Adlogix adware"
X	Aim Quick Start	Aim.exe	"Added by the FORBOT-BB WORM! Note - this is not the popular AOL Instant Messenger utility"
X	AIM95 Startup	aim95.exe	"Added by the AGOBOT.AEE WORM!"
N	Album Fast Start	ABMTSR.EXE	"Scanner software
N	AOL Fast Start	AOL.exe	"Fast Start loads the AOL integrated email
X	AOLStart	AOLStart.exe	"Added by the KRAIMER.12 TROJAN!"
U	AQ3HelperStartUp	AQ3HEL~1.EXE	"ScreenScenes ""Aquatica Water Worlds"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	ASTART	astart.exe	ASUS TweakEnable - restores manually changed settings for ASUS based video cards such as overclocking. Only required if you use non-standard settings
X	AStart	AStart	"Added by the VB.AH TROJAN!"
U	ASUS TweakEnable	astart.exe	ASUS TweakEnable - restores manually changed settings for ASUS based video cards such as overclocking. Only required if you use non-standard settings
?	AsusStartupHelp	AsRunHelp.exe	"Unknown ASUS motherboard utility. What does it do and is it required?"
X	ATI Technology Startup	techstart.exe	"Added by the RBOT-AEU WORM!"
N	ATICCC	CLIStart.exe	Puts the ATI Catalyst™ Control Center Icon/Shortcut on the System Tray - available via Start → Programs
X	Auth Starter Ident	startauth.exe	"Added by the RBOT-WP WORM!"
X	Auto CD-ROM Startup	cdaccess.exe	"Added by the SPYBOT.BLA WORM!"
X	Auto Start	dosin.exe	"Added by the SDBOT-GO BACKDOOR!"
X	Auto Start	sndvol32.exe	"Added by the SLINBOT.AX BACKDOOR!"
X	Auto Start	windos.exe	"Added by the SLINBOT.BO BACKDOOR!"
N	AutoCAD	acstart17.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
N	AutoCAD Startup Accelerator	acstart16.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
N	AutoCAD Startup Accelerator	acstart17.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
N	Automatically launches the United Devices Agent when you start your computer	UD.EXE	The United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home but for medical research. Available via Start > Programs
Y	Avast32	Astart32.exe	"Part of Avast! anti-virus software"
U	AVFX Engine	StartFX.exe	"Advanced Video FX - supported by a number of Creative Web Cameras. ""Have more fun by adding a wide range of special effects and backgrounds to your video chat with Advanced Video FX"""
U	BI1HelperStartUp	BI1HEL~1.EXE	"ScreenScenes ""Beach Islands"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	BitDefender_P2P_Startup	BitDefender_P2P_Startup.exe	"Bitdefender anti-virus for P2P clients - no longer supported at the BitDefender website"
X	Blank AntiViri	AUT0EXEC.BAT StartUp	"Added by the BRONTOK-CJ WORM!"
U	BO1HelperStartUp	BO1HEL~1.EXE	"ScreenScenes ""Butterfly Oasis"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	BO1HelperStartUp	Bo1helper.exe	"ScreenScenes ""Butterfly Oasis"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
Y	BOCleanautostart	Boclean.exe	"NSClean's BOClean anti-trojan software"
Y	BootSkin Startup Jobs	BootSkin.exe	"Stardock BootSkin is a program that allows users to change their Windows 2000 and Windows XP boot screens"
X	Bouncer RunStartup	bouncer.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
X	Bouncer RunStartup	LiveUpdate.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
U	BtStart	btstart.exe	"Broadcom (formerly WIDCOMM) Bluetooth Connectivity Software"
N	CACStarter	cacstart.exe	Cash A Check - check writing software
X	ccStart	ccStart.exe	"Added by the AGOBOT-IR WORM!"
X	ccStart	ccInfo.exe	"Added by the AGOBOT-GQ BACKDOOR!"
X	CFDStart	WinMuschi.exe	"WINMUSCHI dialler"
U	cheatmonitor	start.exe	"CheatMonitor surveillance software. Uninstall this software unless you put it there yourself"
X	Classes	mstart.exe	"""Switch"" premium rate adult content dialler variant"
N	CLISTART	CLIStart.exe	Puts the ATI Catalyst™ Control Center Icon/Shortcut on the System Tray - available via Start → Programs
?	Clotusorgreg0	prtStart.exe [path] Orgprt.exe	"IBM Lotus SmartSuite related. In a LotusOrgReg folder. Unclear what exactly it does?"
X	cmonitor	startupmon.exe	"SystemDoctor rogue security software - not recommended
X	ComStart	Trojan Guarder.exe	"TrojanGuarder rogue security software - not recommended"
U	CPQEASYACC	StartEAK.exe	"Easy Access Button Support for Compaq PCs. Allows the use of programmable keys on multimedia keyboards. Required if you use the additional keys"
U	CPQEASYACC	STARTDRV.exe	For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
N	Creative PCI Audio Configuration Utility	starter.exe	"System Tray icon to configure a Creative Soundblaster PCI soundcard. Not required and re-instates itself when un-checked. Try one of the solutions on this special page. Similar to EnsoniqMixer"
N	CTStartup	CTEaxSpl.exe	Splash screen with sound on every boot up. Installed with a Sound Blaster Audigy soundcard
X	dbar_starter	starter.exe	"Deskbar adware - adds a search bar to your Windows taskbar which performs searches on www.w-w-w-dot-com.com"
X	DC6	dc6_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	DC6_check	dc6_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
?	delstart	delstart.exe	"Reportedly part of BT ISP software - what does it do and is it required in startup?"
X	dgtstart	dgtstart.exe	"DigitalNames.g adware"
X	DigitalNames	DigitalNamesStart.exe	"DigitalNames spyware variant"
X	Directx Startup Drivers	direct.exe	"Added by the RBOT.UXL WORM!"
X	Diskstart	Code.exe	Adult content dialler
X	Diskstart	cat.exe	MS-Connect dialler
X	Diskstart	hit.exe	Adult content dialler
X	Diskstart	Snt.exe	Adult content dialler
X	Dll Boot Loader on Startup (do not remove this)	[various filenames]	Added by an unidentified TROJAN!
X	DOGStart	GSDOGST.EXE	"Added by an unidentified VIRUS
Y	DPCProxyLoadOnStartup	dpcstart.exe	"DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access"
Y	Dpcstart	dpcstart.exe	"DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access"
X	DrvStart	HPMedia.exe	"Added by the BANCBAN-QE TROJAN!"
U	DualCoreCenter	StartUpDualCoreCenter.exe	"Unified control center for overclocking both the graphics card and the CPU
N	dwStart	FireWall.exe	"The Shield firewall from pcsecurityshield.com. Not recommended by some (see here) and there are better free alternatives out there such as Zone Alarm. Located in %ProgramFiles%\PCSecurityShield\The Shield Firewall"
X	DW_Start	rwwnw64d.exe	Identified as a variant of the AdWare.Win32.ZenoSearch.am malware
Y	EAFRCliStart	EAFRCliStart.exe	"Related to Encryption Anywhere hard disk encryption products from GuardianEdge"
N	Easy Start Button	esb.exe	Provides functionality on certain laptops that have additional keys. Not required unless you use the extra keys
N	eMuleAutoStart	emule.exe	"eMule - ""one of the biggest and most reliable peer-to-peer file sharing clients around the world. Thanks to it's open source policy many developers are able to contribute to the project
U	EnsoniqMixer	starter.exe	"Puts the Ensoniq mixer in system tray. From Ensoniq Technologies ""Our mixer is a critical part of the soundcard as it fixes sound problems and replaces the MS mixer which can no longer be used"". If you find you don't need it - try one of the solutions on this special page. Similar to Creative PCI Audio Configuration Utility"
U	EpsonPhotoStarter	EPSON_PhotoStarter.exe	Only needed if you want to make full use of the capabilities of an Epson printer that included this
X	ERS	ers_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	ERS_check	ers_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
N	eWare Startup	iWareStart.exe	"eWare iWare task bar. Not required"
X	Explorer	msrstart.exe	"Added by the SOPICLICK TROJAN!"
Y	F-Secure Startup Wizard	FSSW.EXE	"F-Secure antivirus"
X	Fast start	Ntut.exe	"Adware - deteced by Kaspersky as the FAVADD.I TROJAN!"
X	Fast start	svcnt.exe	"Adware - detected by Kaspersky as a variant of the FAVADD TROJAN!"
X	FastStart	ntnut32.exe	"Added by the STARTPAGE.L TROJAN!"
X	FastStart	svcnut.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
X	FastStart	svcnut32.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
X	Fen Startups	fensvc32.exe	"Added by the RANDEX.CCF WORM!"
X	Fenio Startups	fnesvc32.exe	"Added by the AGOBOT-OS BACKDOOR!"
X	FHStart	shdocsvc.exe	"Added by the WINHOUND TROJAN!"
X	FireFox Startup Drivers	wuaclt.exe	"Added by the RBOT.BYX WORM!"
U	FirewallStartup	Firewallstartup.exe	"Innovative Startup Firewall - ""designed to protect your computer from programs that install themselves in the StartUp area of your Windows without asking for your approval. Innovative StartUp Firewall will help you keep your computer clean
U	FMStart	Fmstart.exe	"GFI FAXmaker - native fax connector for Microsoft Exchange Server or for networks
?	FRITZ!DSL Startcenter	StCenter.exe	"FRITZ! ISP software ""StartCenter"" User interface that allows you to manage
X	Gekio Startups	gnksvc32.exe	"Added by the AGOBOT.AFJ WORM!"
U	Getting started with MacDrive	MDGetStarted.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
N	GhostStartService	GhostStartService.exe	"Required to run the Windows based wizard in Norton Ghost - added from the 2003 version. Will start automatically when you run the wizard"
N	GhostStartTrayApp	GhostStartTrayApp.exe	"System Tray access to Norton Ghost - added from the 2003 version"
X	Global Startup	WinDash.EXE	"Detected by Kaspersky as the VB.Q WORM!"
X	Go And Start	svdll32.exe	"Added by the RBOT.AI BACKDOOR!"
Y	gStart	gStart.exe	gStart GPS software from Garmin
X	GStartup	GMT.exe	"Gator spyware component - see here. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	Hekio Startups	Hnksvc32.exe	"Added by the AGOBOT-QE WORM!"
X	hid_start	gzmrotate.dll	"AdRotator/IconAds adware"
U	HijackThis startup scan	HijackThis.exe	"""HijackThis is a free utility which quickly scans your Windows computer to find settings that may have been changed by spyware
U	Hook99startup	hk2re.exe	""Hook99 enables the user to customize the start button. You can change or remove the text and replace the Windows flag on button with icon of your choice. Supports Windows icons
N	HP Image Zone Fast Start	hpqthb08.exe	"Improves the startup time of HP Image Zone. If you disable it
N	HP JetSpeed Autostart	AUTOSTART.EXE	Autostart executable for the old multiplayer game HP Jetspeed
?	HP OfficeJet Series xxx Startup	HPOSTR03.EXE	"xxx represents the series number - such as 700. What does it do and it it required?"
?	HP OfficeJet Series xxx Startup	HPOstr05.exe	"xxx represents the series number - such as 700. What does it do and it it required?"
N	HP Photosmart Premier Fast Start	hpqthb08.exe	"Improves the startup time of HP Image Zone. If you disable it
N	HPStart	hpstart.wsf	This a script used by HP that runs the first time one of their computers is started. Can't imagine why it would be starting up after the first boot
X	Hyper Start	instantmsgrs.exe	"Added by the RBOT-NH WORM!"
U	IDriveE Startup	IDrvieEStartup.exe	"IDrive from Pro Softnet Corporation - free full featured online backup up to 2GB with the option of paying for more storage space and managing multiple accounts"
X	iestart	iexp1orer.exe	"Added by the NEMOG.C TROJAN!"
N	iM Start Center	iM_Tray.exe	Installed with the Sound Blaster Audigy range of soundcards. A radio tuner installed if the user chooses during installation. Available via Start -> Programs -> iM Networks -> iM Radio Tuner
N	ImgStart	ImgStart.exe	"Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs"
U	IMStart	IMStart.exe	"InterMute security software related"
N	InterTrust Quick Start	it_cpq~1.exe	"InterTrust offers something known as Digital Rights Management to control legal software download and other E-commerce related business"
N	Iomega Startup Options	IMGSTART.EXE	"Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs"
U	ISStart	ISStart.exe	"Installed with Logitech's QuickSmart
N	ISUSPM Startup	ISUSPM.exe	"InstallShield is used by a number of software producers to install their programs and manage software updates. This entry searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis"
Y	KavStart	KAVStart.exe	"KingSoft Personal Firewall"
U	keyplusplus	startk.exe	"Key++ Invisible Spy Keylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
N	Konni Symbol Autostart	KonniSymbol.exe	"Gives configuration access to RagTime Solo professional business publishing software. RagTime Solo is the private user version of RagTime 5"
U	Kryptel Component Start	Kicker.exe	"Kryptel encryption software"
N	Launch YahooPOPs! at Windows startup	YAHOOPOPS.EXE	"YahooPOPs - enables free POP3/SMTP access to Yahoo! Mail through a service on localhost that emulates the web interface. Available via Start -> Programs"
U	LexStart	lexstart.exe	Lexmark printer software may add Lexstart.exe in the startup folder to handle print commands that you send to the printer. Sometimes required for the printer to work correctly - not in the case of a Lexmark Z42 for instance
N	LimeWire On Startup	LimeWire.exe	"LimeWire - Peer to Peer (P2P) file-sharing client. Note - as with all P2P sharing programs they are susceptible to various forms of malware"
U	Logitech ClickSmart	ISStart.exe	"Installed with Logitech's QuickSmart webcam software. The exact purpose of this startup entry is unknown at present
U	Logitech ImageStudio	ISStart.exe	"Installed with Logitech's ImageStudio webcam software. The exact purpose of this startup entry is unknown at present
U	Logitech QuickCam	ISStart.exe	"Installed with older versions of Logitech's QuickCam webcam software. The exact purpose of this startup entry is unknown at present
U	LogitechGalleryRepair	ISStart.exe	"Installed with Logitech's ImageStudio webcam software. The exact purpose of this startup entry is unknown at present
U	LogitechVideoRepair	ISStart.exe	"Installed with Logitech's QuickSmart and QuickCam (older versions) webcam software. The exact purpose of this startup entry is unknown at present
N	Lotus QuickStart	smartctr.exe	"Lotus central application
U	Lotus SuiteStart	suitest.exe	Puts the individual Lotus components in the system tray taskbar when you start Windows. Can be disabled via MSCONFIG -> Startup as "Lotus SuiteStart 97 Edition". All individual components available via Start -> Programs
X	lsass	start.bat	"Added by the ZCREW TROJAN!"
X	Lssas Monitoring Startup	LSSAS.EXE	"Added by the RBOT.XJ WORM!"
X	MainStart	svcmfte32.exe	"Added by the STINX-A TROJAN!"
X	MAV_check	mav_startupmon.exe	"Part of the WinAntiVirus Pro 2007 rogue security software - not recommended
X	mav_startupmon	mav_startupmon.exe	"Part of the WinAntiVirus Pro 2007 rogue security software - not recommended
U	McAfee Managed Services Tray	StartMyagtTry.exe	System tray notification for the now obsolete McAfee Managed VirusScan anti-virus and anti-spyware security tool for small businesses. Not required to be protected but you lose notifications
U	MDGetStarted	MDGetStarted.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
U	MDGetStarted.exe	MDGetStarted.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
U	Mediafour MacDrive	MDGetStarted.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
U	MediafourGettingStartedWithMacDrive6	MacDrive.exe	"MacDrive 6 CrossStripe Edition from Mediafour Corporation - ""a perfect way to share files between Mac OS and Windows."" Unlike the standard version of MacDrive 7
N	MessagerStarter Freeserve	StartMessager.exe	Freeserve Messenger
X	Messenger start-up	Msgran.exe	"Added by the GRAMOS WORM!"
X	MHDOGStart	mhdogst.EXE	"Added by an unidentified VIRUS
X	Micosoft Startup	syscall.exe	"Added by the SDBOT-JI WORM!"
X	Micosoft Startup	systall.exe	"Added by the SDBOT-GM BACKDOOR!"
X	Microsoft Office Start	winupdates.exe	"Added by the GAOBOT.BC WORM!"
N	Microsoft Office Startup	osa.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
N	Microsoft Office Startup	Osa9.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
X	Microsoft startup	wmpIayer.exe	Added by the IRCBOT.ACI TROJAN!
X	Microsoft Startup Manager	sysservice.exe	"Added by the AVALANEC TROJAN!"
N	Microsoft Utility Startup	OSA9.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
X	Microsoft Winedows startup	WinKey.exe	"Added by a variant of the SDBOT WORM! See here"
U	ML1HelperStartUp	ML1HEL~1.EXE	"ScreenScenes ""Midnight Lake"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	ML1HelperStartUp	ML1Helper.exe	"ScreenScenes ""Midnight Lake"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	mload	lxmstart.exe	"Added by an unidentified VIRUS
N	MoneyStartUp	Money Startup.exe	Microsoft Money
N	MoneyStartUp10.0	Activation.exe	Part of MS Money 2002. Available via Start -> Programs
X	MS lsass Startup	lsass135.exe	"Added by the RBOT.WM WORM!"
?	MSCRMStartup	Microsoft.Crm.Application.Hoster.exe	"Related to Microsoft Dynamics CRM integrated solutions for Financial
X	MSN Messenger Service Starter	msnmgsr.exe	"Added by the RBOT-AOS WORM!"
X	MSN Messenger Service Startup	msnservice.exe	"Added by a variant of the RBOT WORM! See here"
X	MSN Start	msnmsgr7.exe	"Added by the RBOT-PH WORM!"
X	Msn Startup	msnstartup.exe	"Added by the ARBOT.AA WORM!"
X	MSN8m Startup	msn8m.exe	"Added by a variant of the RBOT WORM!"
X	Msstart	msstart.exe	"Added by the LIVUP.C TROJAN!"
X	MSStartOptimizer	Iexpres.exe	"Added by the DASMIN-E TROJAN!"
X	MSStartOptimizer	WINUPD.EXE	"Added by the DASMIN-E TROJAN!"
X	MSStartOptimizer	SCVHOST.EXE	"Added by the DASMIN-E TROJAN!"
X	Msy Startups	msyh32.exe	"Added by the AGOBOT-QC WORM!"
X	Msy1 Startups	msyj32.exe	"Added by the AGOBOT-QQ WORM!"
U	MW1HelperStartUp	Mw1helper.exe	"ScreenScenes ""Magic Waterfall"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	MW1HelperStartUp	MW1HEL~1.EXE	"ScreenScenes ""Magic Waterfall"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
N	NB Start Menu	STARTM.EXE	Part of McAfee Nuts & Bolts. Provides the same control as MSCONFIG and can be used instead if you have N&B
X	NeroAutoStartClient	NeroASM.exe	"Added by the AGOBOT.VG WORM!"
U	NeroHomeFirstStart	NMFirstStart.exe	"Associated with Nero Scout
U	NetPanel	Starter.exe	"Gemius surveillance software. Uninstall this software unless you put it there yourself"
X	NetStart	svchost.exe	"Added by the MKAR-A VIRUS! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""NETSTART"" subfolder"
X	New.net Startup	"rundll32 [path] NEWDOT~1.DLL	ClientStartup"
X	New.net Startup	"rundll32 [path] NEWDOT~1.DLL	NewDotNetStartup"
X	New.net Startup	"rundll32 [path] NEWDOT~2.DLL	ClientStartup"
X	New.net Startup	"rundll32 [path] NEWDOT~2.DLL	NewDotNetStartup"
U	NMFirstStart	NMFirstStart.exe	"Associated with Nero Scout
N	Nokia FastStart	NokiaMusic.exe	"Part of the Nokia Music music manager. ""With Nokia Music
X	Norton AV Protection Startup	Ati2xxx.exe	"Added by a variant of the RBOT WORM!"
X	Norton Start	ccStart.exe	"Added by the SDBOT-OX WORM!"
U	Notebook Maximizer	maximizer_startup.exe	Toshiba Notebook Maximizer software - adjust settings to save battery power and increase efficiency
X	Nvidia Startup Manager	ksvc32.exe	"Added by the AGENT-IWD TROJAN!"
U	OAKSTART	OAKSTART.EXE	Sets the spindown timeout and access speeds at startup and displays a splash screen for CD-RW.
N	Office Startup	osa.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
X	Office Startup	Exploer.exe	"Added by the GAOBOT.BV WORM! Note the different filename to the valid MS Office entries"
N	Office Startup	Osa9.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
N	OM2_Monitor	FirstStart.exe	"Olympus Master 2 - digital camera management tools"
N	OmgStartup	omgstartup.exe	Sony program called OpenMG Jukebox - player and music organizer
N	OM_Monitor	FirstStart.exe	"Olympus Master 1 - digital camera management tools"
X	OpenMstart	[path to dialler]	"""Switch-E"" premium rate adult content dialer"
N	OpenOffice.org ..*	quickstart.exe	"OpenOffice.org office suite quick start (where ""..*"" is the version number)"
N	OptiCAL Startup	OptiCAL.exe	"OptiCAL monitor calibration software from ColorVision for advanced amateurs
U	P2kAutostart	P2kAutostart.exe	"P2kCommander a filemanager application for Motorola p2k mobile phones"
?	pagmstart	client.exe	"??"
N	PCStart	Pcm25.exe	"Runs as part of PCMonitor which is a program for monitoring your activity on your system. It makes screen dumps and key logging. It can hang-up your system because the screen dump page gets VERY big"
X	pctp_check	startmon.exe	"Part of the PcTurboPro rogue system optimization tool - not recommended
N	PhotoCAL Startup	PhotoCAL.exe	"PhotoCAL wizard driven monitor calibration software from ColorVision for beginners and photo enthusiasts"
U	PLXSTART	PLXSTART.EXE	Sets the spindown timeout and access speeds at startup and displays the "Plextor Manager 2000" splash screen for Plextor CD-RW.
X	pnpsvc_lock	startsvs.exe	Browser hijacker
N	PowerArchiver Tray	PASTARTER.EXE	"System Tray access to PowerArchiver from ConeXware
N	PowerQuest Startup Utility	PQINIT.EXE	"From a visitor - "This seems to be installed when you install Power Quest Partition Magic. I think that it implements the changes when you use the magic mover app. If you don't have any mappings set up
X	precpop2	starter.exe	"PrecisionPop adware"
X	print sharing	start.bat	"Added by the ZCREW TROJAN!"
U	ProPort Startup	ProPort.exe	"Proport is a port monitor/protector. Monitors an infinite amount of ports for trojans and nukes. Some additional features are auto connection-kill
U	QDM	QdmStart.exe	"QDM (QDI Desktop Manager) - part of QDI ManageEasy for QDI's series of motherboards for monitoring PSU
U	QDMStart	QdmStart.exe	"QDM (QDI Desktop Manager) - part of QDI ManageEasy for QDI's series of motherboards for monitoring PSU
U	QTaskStartup	qtask.exe	"Feature of Quicken.com Brokerage to customize and display Desktop Alerts and icon. It is not required for the Quicken Program to run correctly
Y	Quick Heal Startup Scan	QHSTRT32.EXE	"Quick Heal - virus scanner"
Y	Quick Startup	Fquick32.exe	For a Nisis G6 USB Graphics Tablet. Re-enables itself if disabled therefore best left alone
N	Quicken Startup	QWDLLS.EXE	Quicken option to load DLLs at startup
X	Registry Startup Check	checkreg.exe	"Added by the REMLOAD-A or DANMEC-B TROJANS!"
X	Registry Value Name Start	MsPMSPSa.exe	"Added by a variant of the SDBOT WORM!"
X	Regkey for autostart	winservice.exe	"Added by the RBOT-NU WORM!"
?	RemStart	remstart.exe	"Part of McAfee's Remote Desktop 32 Agent application. What does it do and is it required?"
?	Restart Watch	Watch.exe	"Associated with an Eicon Networks Diva ISDN or ADSL modem. What does it do and is it required?"
U	Restart WSC Setting	wscrestp.exe	"WinStart Commander - part of Ultra WinCleaner Utility Suite. Starts Windows faster and controls hidden programs to boost performance and prevent system slow downs and crashes"
?	Restart_VS	Viewsonic.exe	Could be a left-over from the installation of a Viewsonic flat panel display
U	RivaTunerStartupDaemon	RivaTuner.exe	"Part of RivaTuner - a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This entry is for XP and applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
U	RivaTunerStartupDaemon	RivaTunerWrapper.exe	"Part of RivaTuner - a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This entry is for Vista and loads the main application (RivaTuner.exe) to apply overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
U	RKLG Startup	klg.exe	"Local Keylogger Pro keystroke logger/monitoring program - remove unless you installed it yourself!"
U	RNBOStart	sentstrt.exe	Program used to initialise the VxD virtual driver for Sentinel drivers associated with Rainbow H/W keys that plug-in to the parallel port. These are usually supplied with workplace design tools and restrict the use of the software only to the machine to which the H/W key is connected. Required if you have such tools
?	RTStartMute	N/A	"??"
U	Run StartupMonitor	StartupMonitor.exe	"Mike Lin's StartupMonitor
U	Sabre Printing Start	Sabstart.exe	"Part of the Sabre computer reservations system/global distribution system (GDS) - used by airlines
U	Sabre Task Tray Icon	Sabstart.exe	"Part of the Sabre computer reservations system/global distribution system (GDS) - used by airlines
X	Salestart	WAS7Mon.exe	"Part of the WinAntiSpyware 2007 rogue spyware remover - not recommended"
X	Salestart	bm.exe	"Part of the AVSystemCare rogue security software and other members of this family. See here for more examples"
X	Salestart	dcpasmon.exe	"SystemDoctor rogue security software - not recommended
X	Salestart	dcsm.exe	"Part of the PrivacyProtector and DriveCleaner rogue security tools"
X	Salestart	mc.exe	"Part of SecurePCCleaner
X	Salestart	stm.exe	"Part of SecurePCCleaner
X	Salestart	strpmon.exe	"Part of the ErrClean rogue system error and cleaning utility and other members of this family. See here for more examples"
X	Salestart	stmon.exe	"Part of rogue software including members of the AVSystemCare security suite family (see here for examples) and the PcRaiser and SystemOptimizer2008 optimization utilities"
X	Salestart	mav_startupmon.exe	"Part of the WinAntiVirus Pro 2007 rogue security software - not recommended
X	Salestart	PASmon.exe	"Part of rogue security tools
X	Salestart	dcmon.exe	"SystemDoctor rogue security software - not recommended
X	Salestart	startmon.exe	"ErrorProtector rogue system error and cleaning utility - not recommended"
X	SaveDate	SaveStartDate.Exe	Unidentified adware
N	SB Audigy 2 Startup Menu	/l:eng	"Related to the Dell OEM version of the Sound Blaster Audigy 2 sound card. If this item is listed and checked in startup
X	Secret-Crush	start.exe	Hijacker that may reset your browser's home page and/or search settings to point to undesired sites
X	Secure32	Shell32.com StartUp	"Added by the BRONTOK-CJ WORM!"
X	Secure64	Regedit32.com StartUp	"Added by the BRONTOK-CJ WORM!"
X	services	start.bat	"Added by the ZCREW TROJAN!"
X	Services Start2	odcwinst.exe	"Added by the PYSKE-D WORM!"
X	Services Startup	services.exe	"Added by the CROWT.A WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files"
X	Services Startup	svhost33.exe	"Added by a variant of the RBOT WORM!"
X	Services32 Startup	win32dll.exe	"Added by the SDBOT-XO WORM!"
U	SfWinStartInfo	sfWinStartupInfo.exe	SFIRM32 Online Banking software
X	Skype Startup	skyp.exe	"Added by the VANBOT-C WORM!"
X	SkypeStartup	Skype.exe	"Added by the PYKSE-A WORM!"
N	Smart Start UP	PnPDetect.exe	"Part of Presto! Mr.Photo - ""an ideal program for creating
U	SMPAutoStart	smpdemo.exe	"Smart Phone Recorder demo from KenGolf.com. Answering Machine
X	SMSERIALSTARTER	win32st.exe	"Added by the FAKEALERT-AH TROJAN! Installed with the SpyBurner spyware remover - which is not recommended
X	SMSERIALWORKERSTART	shellexcon.exe	"Added by the FAKEALERT-AH TROJAN! Installed with the SpyBurner spyware remover - which is not recommended
X	SMSERIALWORKERSTARTER	winstrse.exe	"Added by the RENOS.IC TROJAN! Installed with the SpyBurner spyware remover - which is not recommended
X	SMSERIALWORKSTARTER	comsysobj.exe	"Added by the FAKEALERT-AH TROJAN! Installed with the SpyBurner spyware remover - which is not recommended
Y	SoDA Startup	SodaStartup.exe	"Used by the IBM Rational SoDA project management tool. Unsure of it's actual purpose but it's recommended you leave it enabled if you use the software"
N	SoniqueQuickStart	sqstart.exe	"Quickstart for the discontinued Sonique audio player. Available via Start -> Programs"
X	spa_start	Rundll32.exe spads.dll	"IconAds adware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""spads.dll"" file is located in the Winnt or Windows folder"
X	spa_start	Rundll32.exe sprt_ads.dll	"Superiorads adware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""sprt_ads.dll"" file is located in %System%"
N	Spdstart	Spdstart.exe	"Norton Utilities Speed Start. "This feature optimizes the start up speed of launching applications
U	SRP Startup	srrpro.exe	"System Restore Remover Pro allows you to safely and easily remove System Restore and various other Windows Millennium ""features"". This is enabled if you tick the ""Remove unnecessary System Restore information on startup"" box. Available via Start -> Settings -> Control Panel"
Y	Start	Quick95.exe	For a Nisis G6 USB Graphics Tablet. Re-enables itself if disabled therefore best left alone
X	Start	windows.vbs	Homepage hijacker
?	start	start.exe	"??"
X	start	sdcc.exe	Added by the AGENT.CSX TROJAN!
X	start	isfmntr.exe	"Added by the ZLOB.MEDIA-CODEC TROJAN! This purports to be a Windows Media Player upgrade (with names such as ""iCodecPack""
X	start	sbmntr.exe	"Added by the ZLOB.MEDIA-CODEC TROJAN! This purports to be a Windows Media Player upgrade (with names such as ""iCodecPack""
X	start	iebtm.exe	"Added by the ZLOB.MEDIA-CODEC TROJAN! This purports to be a Windows Media Player upgrade (with names such as ""iCodecPack""
X	Start aThe Roll	enotxa2.exe	"Added by the RBOT-PV BACKDOOR!"
X	Start aThx Roll	f0mered.exe	"Added by the RBOT.AAV WORM!"
X	Start CurePCSolution	CurePCSolution.exe	"CurePCSolution spyware remover - not recommended
X	start extracting	spoolvse.exe	"Added by the RBOT-XF WORM!"
X	start extracting	spoolvs.exe	"Added by the RBOT.BAN WORM!"
X	start extracting	mcafee.exe	"Added by the RBOT.FO BACKDOOR! Note - this is not a valid McAfee program and is located in %System%"
N	Start Getright	getright.exe	"Entry added with older versions of the GetRight download manager from Headlight Software
X	Start It Upping	svchosets.exe	"Added by a variant of the RBOT WORM!"
U	Start Network Scanner Tool	sdFTP.exe	"Part of
X	Start Page	http://find.naupoint.com	"Naupoint browser hijacker"
X	Start Page	svcnt32.exe	"Homepage hijacker
Y	Start RF Wireless Keyboard	ktrexe.exe	Yuanxun Electronics RF wireless keyboard driver
Y	Start RF Wireless Mouse	cm20.exe	Yuanxun Electronics RF wireless mouse driver
U	Start Service	upssrv.exe	"Cyber Power PowerPanelPlus software. ""During a power failure the system automatically saves and closes open files within the battery backup time and safely powers down your computer"""
X	Start The Roll	enotax2.exe	"Added by the RBOT.XO WORM!"
U	Start Up Cop	startcop.exe	"
X	start uploading	smsss.exe	"Added by a variant of the SDBOT WORM!"
X	start uploading	crsss.exe	"Added by the RBOT-SZ WORM!"
X	Start Upping	taskmrg.exe	"Added by the RBOT-MA WORM!"
X	Start Upping	SVCHOSTES.EXE	"Added by the RBOT-NB WORM!"
X	Start Upping	taksmgr.exe	"Added by the RBOT-QK WORM!"
X	Start Upping	mcrt32.exe	"Added by a variant of the SPYBOT WORM!"
X	Start Upping	windupds.exe	"Added by the SDBOT.AFH WORM!"
X	Start Upping	windupdts.exe	"Added by a variant of the RBOT WORM!"
X	Start Upping	xdcc.exe	"Added by the SPYBOT.OY WORM!"
X	Start Upping	spoolnt.exe	"Added by the RBOT-TM WORM!"
X	Start Upping	iexplorerupdt.exe	"Added by the RBOT-RR WORM!"
X	Start Uppings	svcchosts.exe	"Added by the SDBOT.VY WORM!"
X	Start Uppings	mssupdate.exe	"Added by a variant of the RBOT WORM!"
N	Start Wingman Profiler	lwtest.exe	"Logitech Wingman software required to operate Logitech joysticks and gamepads. Unless you're a hard-core gamer
N	Start Wingman Profiler	LWEMon.exe	Part of Logitech Gaming Software (formerly Wingman Software) for their range of game controllers. Starts the profiler (button configuration) and loads the last used profile at start-up - including System Tray access. Unless you're a hard-core gamer it's best to leave it disabled and load when needed
X	Start Xp Setup	msxp.exe	"Added by the RBOT.AKK WORM!"
U	Startacc	startacc.exe	"Launches Webroot's Accelerate 2000 software that ""speeds up your Internet connection by up to 300%"". Leave enabled if you find it improves internet connection"
N	StartCCC	CLIStart.exe	Puts the ATI Catalyst™ Control Center Icon/Shortcut on the System Tray - available via Start → Programs
X	startdrv	startdrv.exe	"Added by the DROPRK-A TROJAN!"
U	StartEAK	StartEAK.exe	"Easy Access Button Support for Compaq PCs. Allows the use of programmable keys on multimedia keyboards. Required if you use the additional keys"
U	StartEase	StartEase.exe	"
X	startemdoit	[path to trojan]	"Added by the DLOADR-AVP TROJAN!"
X	Starter	scvhosting.exe	"Added by the SDBOT.RU WORM!"
X	starter	scvhostingg.exe	"Added by the FORBOT-FB WORM!"
X	starter	iexplore.exe	"Added by the FORBOT-DU WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
U	StartFoxie	StartFoxie.exe	"Foxie Suite from Softonic International. ""This suite of free tools comes in the form of an Internet Explorer add-on and includes a mix of powerful security enhancements"""
X	Starting up	wvsvc.exe	"Added by the RBOT-NF WORM!"
X	startkey	svcmgr.exe	"Added by the HIPPER-B TROJAN!"
X	startkey	update.exe	"Added by the BIFROSE-DG TROJAN!"
X	startkey	XMCHAI.EXE	"Added by the BIFROSE-AO TROJAN!"
X	startkey	explore32.exe	"Added by the BDOOR-MT BACKDOOR!"
X	startkey	CKOTS.exe	"Added by the BIFROSE-HM TROJAN!"
X	StartKey	pligde.exe	"Added by the BIFROSE.E TROJAN!"
X	startkey	RunWinRaR.exe	Added by a variant of the BIFROSE-LV TROJAN!
X	startkey	Mysia.exe	Added by the CEP TROJAN!
X	startkey	explorer.exe	"Added by the BCKDR-MLD BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	startkey	furzi.exe	"Added by the BIFROSE-OK TROJAN!"
X	startkey	krnl.exe	"Added by the BIFROSE-S TROJAN!"
X	startkey	royale.exe	"Added by a variant of the SDBOT WORM!"
X	startkey	rtfmsv.exe	"Added by the EDEPOL-C TROJAN!"
X	startkey	scvhost.exe	"Added by the BIFROSE-PM TROJAN!"
X	startkey	server.exe	"Added by the BIFROSE-DB TROJAN!"
X	startkey	win32i.exe	"Added by the BIFROSE-R TROJAN!"
X	startkey	winampXP.exe	"Added by the BIFROSE-OY TROJAN!"
X	startkey	svchost32.exe	"Added by a variant of the SDBOT WORM!"
X	startkey	winlogin.exe	"Added by the BIFROSE-PM TROJAN!"
X	startkey	antivir.exe	"Added by the BIFROSE-TO TROJAN!"
X	startkey	svchost.exe	"Added by the AGENT-FPL TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	StartKey	msnmsie.exe	"Added by the BIFROSE.M BACKDOOR!"
N	startl.exe	startl.exe	"Lingocom LingoWare - translates any application into your language"
X	StartMenu	deamon.exe	"Added by the TACTSLAY.C TROJAN!"
X	StartMenu	msgaol.exe	"Added by the TACTSLAY.C TROJAN!"
X	StartMenu	s_menu.exe	"Added by the TACTSLAY.C TROJAN!"
X	StartMenu	browse.exe	"Added by the DROWSY-C TROJAN!"
X	startpage	startpage.exe	Browser hijacker - redirecting to pages2start.com
U	STARTPAGE	start1.exe	"NoSpy.org - prevents spyware from changing your startpage and other browser properties. The start1.exe file is located in a NOSPY.ORG folder"
X	StartReplySystem	loadnewmessage.exe	"Added by the HIDAGENT-B WORM!"
U	StartSecurDoc	SDPin.exe	"SecurDoc from WinMagic Inc - ""Provides full disk encryption to protect sensitive information stored on laptops
U	StartStop	STARTSTOP.EXE	"StartStop from TFI Technology - startup manager"
U	StartSurfing	STARTS.exe	"Start Surfing allows you to protect your privacy while surfing and searching the Internet by acting as a "filter" between you and the website you are visiting. Startsurfing acts as your shield from Pop Up Windows
N	Startup	??	Related to an Iomega drive
X	Startup	WinlogonStartup	Unidentified malware
X	Startup	mirc.exe	"Added by the FLOOD-EU TROJAN! An uninstall option for mirc.exe can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as mIRC. This one puts 10 files in the Windows or Winnt folder"
X	Startup Configuration	[six character filename]	"Added by the RBOT-ARV WORM!"
X	Startup Configuration	wztoid.exe	"Added by the RBOT-ASD WORM!"
?	Startup Launcher GUI	GUI.exe	"Startup manager?"
U	Startup Manager Scanner	StartupMonitor.exe	"Startup-Mechanic Startup monitor - offers boot protection of your PC from harmful trojans
Y	Startup Scan	Sensor.EXE	"AntiVirus Quick Heal - scheduling agent"
X	Startup Update	Cvshost.exe	"Added by the GAOBOT.AO WORM!"
X	StartupBin	iwnujdss.exe	"Added by the SDBOT-XZ WORM!"
X	StartUpDate	[path to trojan]	"Added by the BIFROSE.F BACKDOOR!"
U	StartupMonitor	StartupMonitor.exe	"Mike Lin's StartupMonitor
X	StartupOption	loadsysdisk.exe	"Added by the HIDAGENT-B WORM!"
X	Startwd	"rundll32.exe wd081025.dll	Hook"
X	startwin	startwin.exe	"Added by the ANTIMAN.A WORM!"
X	startwindowskeyuser	rundle2.exe	"Added by the JAVAKILLER TROJAN!"
U	Suitcase Startup	Suitcase.exe	"Suitcase - system font manager start up utility. Used for dynamic managment of fonts on your system"
X	Sygate Personal Firewall Start	services32.exe	"Added by the RBOT-MB WORM!"
X	Sygate Personal Firewall Start	servic.exe	"Added by the RBOT-RY WORM!"
N	Symantec Fax Starter Edition Port	OLFSNT40.EXE	Offers a virtual printer as a fax machine. Can be run via a desktop shortcut
U	SynTPStart	SynTPStart.exe	Synaptics Pointing Device starter belonging to Synaptics Pointing Device Driver
X	SysStart	[random filename]	"ZenoSearch adware"
X	SysStart	syswin.exe 1	"Added by the AUTORUN-EY WORM!"
X	System File Startup	sys32.exe	"Added by the RBOT.OTL WORM!"
U	System Mechanic Startup Guard	StartupGuard.exe	"System Mechanic Startup Guard protects the Window's startup locations from being modified by viruses
U	System startup	charmapx.exe	Only required if using an oriental language
X	System Startup	Voltio.exe	"Added by the RBOT.NJ WORM!"
X	System Startup	kimochi.exe	"Added by a variant of the RBOT WORM!"
X	System Startup	sys.exe	"Added by a variant of the IRCBOT TROJAN!"
X	System Startup Manager	smcss.exe	"Added by the RBOT.AMD WORM!"
X	System32 Runtime StartUp	sysrs.exe	"Added by the AGOBOT.ANW WORM!"
X	Systems Restart	slchost.exe	"Added by the MULTIDROP.C TROJAN!"
X	Systems Restart	spchost.exe	Added by an unidentified WORM or TROJAN!
X	Systems Restart	"Rundll32.exe beem.dll	DllRegisterServer"
X	Systems Restart	"Rundll32.exe snim.dll	DllRegisterServer"
X	Systems Restart	"Rundll32.exe zolk.dll	DllRegisterServer"
X	Systems Restart	"Rundll32.exe boln.dll	DllRegisterServer"
X	TA_Start	[random filename]	"Zeno Think-Adz adware"
U	TB2PROEXE	tb2start.exe	"Timbuktu Pro - remote desktop access software"
U	TDKSTART	TDKSTART.EXE	Sets the spindown timeout and access speeds at startup and displays a splash screen for CD-RW.
?	TheMainStart	N/A	"??"
N	Timed Backups Manager Startup	BACKTIME.EXE	"Backup Plus - backup software"
X	tjstartup	[path to file]	"Added by the TJSERV.C TROJAN!"
?	TomcatStartup	hpbpsttp.exe	"Apache Tomcat web server
?	TomcatStartup 2.5	hpbpsttp.exe	"Apache Tomcat web server
X	ToPicks Starter	Idhost.exe	"TOPicks adware"
X	Total Protect 2009	pcpc_starter.exe	"Total Protect 2009 rogue security software - not recommended
N	ucstartup	ucstartup.exe	"IBM Update Connector - old auto updater feature for IBM machines that connects to IBM to see if there are any new drivers
N	ucstartup.exe	ucstartup.exe	"IBM Update Connector - old auto updater feature for IBM machines that connects to IBM to see if there are any new drivers
N	UC_SMB	ucstart.exe	Part of IBM Update connector on IBM PCs for updating drivers on a new installation. Once you manually run the IBM Update connector program (shortcut) this entry is removed
N	UC_Start	ucstartup.exe	"IBM Update Connector - old auto updater feature for IBM machines that connects to IBM to see if there are any new drivers
N	UltimateZip Quick Start	uzqkst.exe	"UltimateZip - file compression utility"
N	Ultra Hal Assistant 4.5 Startup	HalAsst.exe	"Zabaware Ultra Hal Assistant - artificial intelligence conversation simulator. It is capable of being your digital secretary and companion"
X	UserInit StartUp	rpcxuisu.exe	"Added by a variant of the SDBOT WORM!"
X	Vekio Startups	Pnksvc32.exe	"Added by the AGOBOT.AJG WORM!"
Y	Vet Start Up	vet98.exe	"Computer Associates "InnoculateIT" and Vet Anti-Virus virus software. This option will slow down your system
Y	Vet Start Up	vet32.exe	"Computer Associates "InnoculateIT" and Vet Anti-Virus virus software. This option will slow down your system
X	VGA Startup	vgacard.exe	"Added by a variant of the RBOT WORM!"
U	Vista Start menu	VistaStartMenu.exe	"""Vista Start Menu is the convenient alternative to the plain Start menu you find in Windows XP and Windows Vista"". You have the option to either replace standard Start Menu or run it independently and can load at boot time or run it manually"
U	ViStart	ViStart.exe	"ViStart (Vista Start Menu for XP) adds a Vista style Start Menu for Windows XP users and can be loaded at boot time or started manually"
U	ViStart - The Vista Start Menu	ViStart.exe	"ViStart (Vista Start Menu for XP) adds a Vista style Start Menu for Windows XP users and can be loaded at boot time or started manually"
U	VistaStartMenu	VistaStartMenu.exe	"""Vista Start Menu is the convenient alternative to the plain Start menu you find in Windows XP and Windows Vista"". You have the option to either replace standard Start Menu or run it independently and can load at boot time or run it manually"
N	vTunerStartUp	vTuner.exe	"vTuner - "an easy way to find and listen to radio and TV broadcasts over the Internet""
U	wallchgr.exe wstart	Wallchgr.exe	"WallChanger - wallpaper changer from Blue Tree Software"
N	WFGStartup	WFGStartup.exe	"
X	Win startup	mscfg32.exe	"Added by the SPYBOT-AE WORM!"
X	Win Startup	WINCFG32.EXE	"Added by the SPYBOT-CL WORM!"
X	Win32KernelStart	microsoft.exe	"Added by the DELF-EWZ TROJAN!"
X	Windeows NetStart Service2	tesakrmger.exe	"Added by the RBOT-AMY WORM!"
X	WinDLL (start0s.exe)	"rundll32.exe start0s.exe	start"
X	Windows Audio Startup	nndsvc.exe	"Added by the IRCBOT-AAE TROJAN!"
X	Windows Autostart Loader	notepad32.exe	"Added by a variant of the RBOT WORM!"
X	Windows CODE Fix Msy Startups	msyh32.exe	"Added by the AGOBOT.AKK WORM!"
X	Windows Host32 Starter	hostserv.exe	"Added by the SDBOT-WU WORM!"
X	Windows Loader	wstart32.exe	"Added by the GAOBOT.CA WORM!"
X	Windows Messenger Live Startup	windowslivemsn.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Windows Messenger Live Startup	windowsmsnlive.exe	"Added by the DELF.DAX TROJAN!"
X	Windows Messenger Starter	wmvsvc.exe	"Added by the DELF.DAX TROJAN!"
X	Windows MSConfig Startup Logger	winlog.exe	"Added by the RBOT.BCU WORM!"
X	Windows NetStart Service	winsN2S.exe	"Added by the RBOT-ZX WORM!"
X	Windows NetStart Service2	winsN2S.exe	"Added by the RBOT-ABN WORM!"
X	Windows NetStart Service2	winsN2SD.exe	"Added by a variant of the RBOT WORM!"
X	Windows Registry Startup	wind32.exe	"Added by the AGOBOT-BZ WORM!"
X	Windows Service	dstart4.exe	Added by an unidentified TROJAN!
X	Windows Start Server 2000	traficy.exe	"Added by the RBOT-AHM WORM!"
X	Windows Startup	winsta~1.exe	"GoHip foistware"
X	Windows Startup	winstartup.exe	"GoHip foistware"
X	Windows Startup	Wdrun32.exe	"Added by the GAOBOT.AO WORM!"
X	Windows Startup	services21.exe	"Added by the AGOBOT-MX WORM!"
X	Windows Startup	Winsys32.exe	"Added by the RBOT.AAB WORM!"
X	Windows Startup 32 Bits	sysrun32.exe	Added by a variant of the DARKSUN TROJAN!
X	Windows User Starter	winuser32.exe	"Added by the RBOT.SN WORM!"
X	Windows Workstation Start Service	mslanmgr.exe	"Added by a variant of the RBOT WORM!"
X	Windows32KernelStart	wks.exe	"Added by the LAPURD TROJAN!"
X	WindowsServicesStartup	svchost.exe	"Added by the ECUP WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
Y	WinFaxAppPortStarter	wfxsnt40.exe	WinFax 10.0 and maybe earlier versions. Used to initiate the WinFax port to enable printing to the WinFax printer (send a fax) from any application.
X	Winsock Startup	Main2.exe	"Added by a variant of the SDBOT WORM!"
X	WinStart	services.exe	"Added by the SOBER.O WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Connection Wizard\Status and note the space at the beginning of the ""Startup Item"" field"
X	WinStart	WinStart.exe	"From IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words
X	WinStart	Wscript.exe WinStart.vbs	"Added by the CIAN.C WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""WinStart.vbs"" file is located in %System%"
X	WinStart	winstart32.exe	"Added by the PUROL WORM!"
X	WinStart	WinStart.pif	"Added by the CONE.E WORM!"
X	winstart	winstart.exe	"Added by the SCKEYLO-AB TROJAN!"
X	WinStart001	WinStart001.exe	"From IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words
X	WinStart001.EXE	WinStart001.exe	"From IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words
X	WinSysStartUpWKbLw	TaskSystemDll.Exe	"Added by the BACKZAT.G WORM!"
U	WireLessMouse	StartAutorun.exe MouseDrv.exe	"Related to WireLess Mouse Multimedia Combo Set by SANSUN Industries"
X	wormexe	winstart.exe	"Added by the EARLYBIRD WORM!"
?	xkstartup	"RunDll32 InstZ82.dll	SetUsbPrinterPort"
X	xmstart	xuming.exe	"Added by the GMIN-A WORM!"
X	xpstart	wini.exe	"Added by the PICRATE.A WORM!"
X	Xupiter Startup	XupiterStartup.exe	"Xupiter - adware and homepage hijacker. Use Spybot S&D
X	xupiterstartup2003	xupiterstartup2003.exe	"Xupiter - adware and homepage hijacker. Use Spybot S&D
X	Zekio Startups	znksvc32.exe	"Added by the AGOBOT-AGI WORM!"
X	Zekio Startups	condll.exe	"Added by the AGOBOT-AGD WORM!"
X	ZStart	[various filenames]	"VX2.Transponder parasite updater/installer related"
X	Zstart	cxdxregt.exe	"ZenoSearch adware"
X	Z_Start	[random filename]	"ZenoSearch adware"
X	[Randomly chosen existing folder name]	_start.exe	"Added by the ANTINNY-L WORM!"
X	[various names]	dstart2.exe	"Adware - detected by Kaspersky as the SMALL.ALW TROJAN!"
X	[various names]	StartCpl.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	startman.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	_WinStart	services.exe	"Added by the SOBER.O WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Connection Wizard\Status"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.