Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
X(Default)Systrsy.exe"Added by the CDTRAY TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
U2wSysTray2portalmon.exe"2Wire Homeportal user interface"
YAccelerometerSysTrayAppletAccelerometerSt.exeHP 3D DriveGuard uses a digital accelerometer protects your disk drive by parking and halting I/O requests if you drop your PC or if you move your PC with the display lid closed
XActiveDesktopsystray32.exe"Added by the DABOOM WORM!"
NAGEIA PhysX SysTrayTrayIcon.exe"System Tray access to display properties for AGEIA PhysX graphics cards. Unless you change your desktop resolution
XAttuneSystrayattune_st.exe"Aveo Attune automated helpdesk software - adware/spyware"
NbbSysTraybbSysTray.exe"Philips CD-RW related - ""the 'Blue Button' feature gives users the chance to receive convenient online support for their possible device problems or questions"""
XColdlife -icmpSystray.exe"Added by the FLOOD.AV TROJAN! Note - this is not the legitimate systray.exe process"
NCompaqSystraycpqpscp.exeCompaq System Tray icon
NDiskeeperSystrayDkIcon.exe"DisKeeper defragmentation software - can be started manually"
NeMusicClient SystrayeMusicClient.exe"eMusic MP3 download software"
NExtender Resource MonitorRMSysTry.exe"Related to Windows Media Center from Microsoft"
Nhcsystrayhc_tray.exe"Kuma Notifier for the Shootout! game from the History Channel. ""It lets you know whenever there's a new episode that's been released or an announcement from the Kuma team. Just click it to get up-to-the-minute game and event information"""
XInternalSystrayKazza.exe"Added by the OPTIXPRO.12.C BACKDOOR! Note - unlike the valid KaZaA executable
XInternatsystray.exe"Added by the ALADINZ.P TROJAN! Note - this is not the legitimate systray.exe process. If you right-click on the real systray.exe the ""Properties"" reveal it to be a Microsoft file"
ULogMeIn GUILogMeInSystray.exe"RemotelyAnywhere is a remote administration and remote control solution for Windows. It allows access to the host computer via the network (the LAN
?lycosInsideLyc_SysTray.exe"Lycos eMail related - what does it do and is it required?"
UMytekSystrayExePathMyTekSystray.exe"MyTek system tray - web site providing computer tech support in Australia"
UNMPSystrayNMPSystray.exe"System Tray access to NotesMedic from Cassetica Software Inc. - which ""contains a suite of Tools that make life easier when using Lotus Notes"""
?NVRotateSysTraynvsysrot.dll"Related to NVIDIA nView Control Panel. What does it do and is it required?"
UOmega ASIO Control PanelASIOSysTray.exe"System Tray access to the control panel for the Lexicon Omega ASIO (Audio Streaming I/O) desktop recording studio"
NRealJukeboxSystraytsystray.exeSystem Tray icon for RealJukebox
URemote Data BackupsCBSysTray.exe"System Tray access to Remote Data Backups online system/data backup utility"
URemote Data Backups TaskBar IconCBSysTray.exe"System Tray access to Remote Data Backups online system/data backup utility"
YSafeSpaceSafeSpaceSysTray.exe"Part of SafeSpace (from Artificial Dynamics) which ""protects computers from Internet malware infection without the need for signature updates or regular maintenance"""
NSigmatelSysTrayAppstsystra.exeSystem tray program for the Sigmatel Audio sound card. Often found on Dell computers
NSigmatelSysTrayAppsttray.exeSystem tray program for the Sigmatel Audio sound card. Often found on Dell computers
USpokeSysTraySpokeSysTray.exe"Spoke Software client application. Spoke ""uses data in your e-mail and other enterprise information systems to discover the existing relationships of people in your enterprise. It then builds a private
NStacSysTrayStacSysTray.exeSystem Tray control panel for SigmaTel C-Major on-board audio - as used on some Dell and Packard Bell PCs
XSystemsystray.exe"Added by the PISABOY-A TROJAN! Note - this is not the legitimate systray.exe process"
XSystem Traysystray.exe"Added by the FAN-A WORM! Note - the valid Microsoft systray.exe is normally located in %System% and will only run at startup on Win9x/Me systems. This one is located in %Windir%"
XSystem Tray32SysTray32.exe"Added by the REPAD WORM!"
XSystemtraSystra.exe"Added by the LOVGATE-W WORM!"
USystemTraySysTray.Exe"For Win9x/Me - System Tray Services. Provides the Volume Control
XSystemTraySysTray.exe"Added by the ALADINZ.P TROJAN! Note - this is not the legitimate systray.exe process. If you right-click on the real systray.exe the ""Properties"" reveal it to be a Microsoft file"
XSystemTray MonitorSysTraymon.exe"Added by a variant of the SPYBOT WORM! See here"
XsystrSYSERVER.exe"Added by the VB-DQY WORM!"
Xsystr2SERVICE.exe"Added by the VB-DQY WORM!"
?systr32systr32.exe"??"
Xsystrans[path to trojan]"Added by the STARTPA-GZ TROJAN!"
XsystrasxCONSOLES.EXE"Added by the SDBOT-NW WORM!"
?systraxsystrax.exe"??"
XSystraySystray_.Exe"Added by the KERGEZ.A WORM!"
XSystray[filename.exe]"Winfavorites adware"
XSYSTRAYUNMT.EXE"Added by the DLOADER-LQ TROJAN!"
XSysTraySysTray.Exe"Added by the BANCBAN-JV TROJAN! Note - this is not the legitimate systray.exe process from Win9x/Me systems which would appear in the Name/Startup Item field as SystemTray in the registry ""Run"" keys and MSConfig. If you right-click on the real systray.exe the ""Properties"" reveal it to be a Microsoft file"
XSysTraySnnpapi.exeAdded by an unidentified TROJAN!
XSystrayw32explorer.exe"Added by the RBOT-AJY WORM!"
XSystraySteFanie.vbs"Added by the STEFAN WORM! Note - make sure you check the hyperlink as this one copies it's self to numerous dirves and folders"
XSystrayKAT.vbs"Added by the SOAD-D WORM!"
XSysTraysvhost.exe"Added by the RAJILO-A WORM!"
XSysTraysystem.exe"Added by the DELF.E TROJAN!"
Xsystraysystem234.exe"Added by the AUTORUN.AEV WORM!"
Usystraywinlogin.exe"KidControl surveillance software. Uninstall this software unless you put it there yourself"
Usystraysystray.exeDell Mobile Broadband wireless configuration utility - located in %ProgramFiles%\Dell\Dell Mobile Broadband
XSystray driversystray.exe"Added by the MUTEBOT TROJAN! Note - this is not the legitimate systray.exe process"
XSystrayServicesMsxpw.exe"Added by the CITOR WORM!"
USYSTRAYXSysTrayX.EXE"""SystrayX helps you hide some of the less used icons from the system tray (the hidden icons can still be seen and used in the special SysTrayX menu but will no longer permanently take precious space from your system tray)"""
Xsystreesystree.exe"Added by the BANCOS.L TROJAN!"
XSystry[path to worm]"Added by the AUTEX WORM!"
XSystryt[path to worm]"Added by the AUTEX WORM!"
XupdateWinssystrey.exe"Added by the RANDON WORM!"
Xwin32inisystroy.exe"Added by the IRC.ALADINZ.C TROJAN!"
XWindows SYStryspoolsvr.exe"Added by the SDBOT.GN BACKDOOR!"
XWindows SYStrysystry.exe"Added by the SDBOT-E WORM!"
UX1 System TrayX1Systray.exe"Part of X1's Enterprise Desktop Search Resource Center. An enterprise desktop search engine"
X[various names]SYSTRAV.exe"Wareout - malware masquerading as a spyware and dialer remover"


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.