Start-Up Applications

Unfortunately, due to a change in my circumstances, the startup programs database here at Sysinfo.org will no longer be updated and the off-line downloads are no longer available. The version at Pacman's Portal will, however, continue to be updated and it's recommended that you refer to that site for more up to date information. The reason for this change in policy cannot be disclosed at this time but I hope you have enjoyed using the database here and thank you for your support and kind comments over the years.

If you're frustrated with the time it takes your PC to boot and then it seems to be running slowly you probably have too many programs running at startup - and have come to the right place to identify and disable some of them.

If you are a regular visitor, click HERE to go straight to the list...

Last update :- 29th July, 2011
24133 items listed

Introduction

When most software is installed these days it will often add to the number of programs that run at startup - often including another icon on the System Tray. Many of these are not required for every day PC use and can safely be disabled - examples such as updaters, photo uploaders and printer monitors. Each of these uses part of the system's memory and resources and can lead to a reduction in performance when playing games or editing videos for example.

This page introduces a searchable, comprehensive list of the programs you may find that run when you switch on your PC as typically identified by Windows Defender, MSConfig or the registry "Run" keys - and whether you need them. You may also want to have a look here for useful information on how to identify these programs, how to disable them.

If you reproduce or re-use the information provided here please respect the Copyright information at the base of the pages and indicate to your visitors or the users of your software where you got the information from.

If the pop-up blocker for IE enabled by default some of the off-site links on this site won't work. They're not pop-ups but that's the way it works. Choose Tools → Pop-up Blocker → Pop-up Blocker Settings and set the "filter level" to Medium.

Close Program/Task Manager

NOTE: This is NOT a database of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a database of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try the Process Library from Uniblue, the list at PC Pitstop or one of the many others now available. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSConfig or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Operating System Differences

A number of entries are repeated due to the way that different operating systems display startup items. For example, WinMe lists "POPROXY.EXE" as "Norton eMail Protect" in both MSCONFIG and the registry whereas WinXP lists it as "Poproxy" in MSCONFIG and "Norton eMail Protect" in the registry.

To avoid the database becoming too large, all virus entries are only shown using the registry version which is common to all Windows versions. Otherwise there would be multiple entries for popular filenames that viruses often use - such as "svchost" above for example. Multiple viruses can also use the same startup entries, in this case only those with significant differences (such as file location) are repeated in this database.

As XP uses the first part of the filename and some of these are fairly common this will only be included if it's unique. Take the filename update.exe for example. In the database there are a number of entries, a few of which are in the U or Y category. In this case the same description would have to cover all possibilities - which is not really feasible.

Random startup entry/filename malware

There are viruses and other pests that can add any number of different entries to the startups. They make additional entries under the registry key HKLM\Software\Microsoft\Windows\CurrentVersion\ Run and RunOnce keys, allowing them to run at startup. In all cases below, %System% - refers to the System folder; by default this is C:\Windows\System (Me/9x), C:\Winnt\System32 (2K/NT), or C:\Windows\System32 (7/Vista/XP):

1. PE_BISTRO - adds "XXXX"="C:\WINDOWS\XXXX.EXE" - where XXXX is the randomly chosen filename of the dropped file
2. MAGISTR.A - adds "[Virus file name]"="[Virus Path and file name].EXE"
3. BUGBEAR.A or BUGBEAR.C or BUGBEAR.E - adds ""=%System%\"[random filename].EXE"
4. OPTIXPRO.11 - adds "%Registry entry%"="%Path%\%Filename%"
5. Lop.com homepage hijacker - adds multiple and random startup entries
6. FreeScratchAndWin - adds multiple and random startup entries as it includes LOP above
7. LORAC - adds "[four random characters]"="%Sysdir%\abcdef.exe"
8. MOSUCK - random name and filename in C:\Windows or C:\Winnt
9. DEBORMS.D - adds one of a number of valid Name/Startup Item entries but points to the path of the worm file dropped
10. GIBE.C - adds random name and filename in C:\Windows or C:\Winnt
11. SWEN.A - adds random name and filename
12. ZOMBAM.B - adds random name and filename
13. WANADO or REUR - adds "XXXXXXXX"="%Sysdir%\XXXXXXXX.exe" where X can be any random hexadecimal (0-9, A-F) number
14. SINCOM - adds random name and filename in C:\Windows or C:\Winnt with "Run:Auto" appended to the command/data column entry
15. SOBER family - adds "[random string]"="%system%\[random filename.exe]"
16. BRANCOS.C - adds "win_[4 random characters][4 random numbers 0-9]"="%System%\SYS_386X\[4 random characters][4 random numbers 0-9].exe"
17. IRC.BOT.B - adds random name and filename
18. COREFLOO-C - adds "[random filename]"="rundll32 %SYSTEM% [random filename].dll,Init 1"
19. [random digits].exe = [random digits].exe - 8 random digits, example: 77231997.exe = 77231997.exe. Winpup.exe adult content downloader
20. DRAGONQQ - "[Trojan's filename]"="[Path to the Trojan]", "[Random name]"="C:\WINNT\[Random name].exe", "[Random name]"="C:\Program Files\[Random name].exe" or "[Random name]"="C:\WINDOWS\[Random name].exe"
21. FORMADOR - adds "[executed file name]"="%System%\[executed file name].exe"
22. NETTRASH - adds "[file name]"="[path to filename].exe"
23. OPTIXPRO.13B - adds "[registry value name]"="[path to trojan].exe"
24. MYDOOM.F or MYDOOM.G or MYDOOM.H - adds "[4 to 8 random, lowercase letters]"="[worm filename]"
25. ANNIL - adds random name and filename
26. ANTINNY.G and ANTINNY.K - adds "[random name]"="[path to worm]"
27. KILLAV.D - adds "[Trojan filename]"="%Windir%\[Trojan file name]" where %Windir% is C:\Windows or C:\Winnt
28. MYPOO - adds "[value name]"="[Trojan file name]" where [value name] is configurable
29. BLACKMAL or BLACKMAL.B - adds "[random_file_name1].exe"="%System%\[random_file_name1].exe"
30. ERKEX.A - adds "[random_file_name]"="%System%\[random_file_name].exe"
31. OPASA - adds "[random_file_name]"="%System%\[random_file_name].exe"
32. GAOBOT.ADN - adds random name and filename
33. ADWAHECK - adds "[trojan name]"="%System%\[trojan filename]"
34. GOBOT.A - adds random name and filename in C:\Windows or C:\Winnt
35. Sandboxer adware - adds random name and filename
36. AGENT.B - adds "[1-5 random characters]"="RUNDLL32 %System%\[DLL filename].dll,StreamingDeviceSetup"
37. EXRUNTEL - adds "[original filename]"="%System%\[original filename]"
38. Margoc adware - adds random name and filename
39. Winpup adware - adds random name and filename in %System%
40. KETCH - adds "[word]"="%System%\[word][number].exe"
41. DARBY.B - adds "[random worm filename]"="%System%\[random worm filename]"
42. VUNDO - adds "*[trojan name]"="[trojan path]"
43. BEAKER.A - adds "[5 random lower-case char]"="[5 random lower-case char].exe" in the System, system32, Temp and Fonts sub-directories of %Windir%
44. LIFEFORENOW - adds "[random filename]"="%System%\[random filename].exe"
45. DIMI - adds "[random value name]"="%System%\[random filename].exe"
46. ABEBOT - adds "[random service name]"="[random filename].exe -services"
47. OMEGA - adds "[random value]" = "%Windir%\[random file name].exe"
48. NAMSHARE - adds "[Random service name]" = "[Random file name]"
49. REANET.B - adds "[file name]" = "[path to file name]"
50. BANCOS.Q - adds "[filename prefix]" = "[path to filename]"
51. SPYBOTER.GEN - adds "[key name]" = "[file name of Trojan]"
52. BOTUK - adds "[random characters]Srv32" = "[random characters]srv.exe"
53. MADTOL-A - adds "[trojan filename]" = "%System%\[trojan filename]"
54. HESIVE - adds "[trojan filename]" = "[path to trojan]"

Spyware/Adware/Malware/Foistware & Hijackers

If you want to know more about these types of programs why not start with a search at Wikipedia - the free, community maintained online encyclopedia. Then visit the Safer Networking and BleepingComputer malware forums.

"Status" key

• "Y" - Normally leave to run at start-up
• "N" - Not required or not recommended - typically infrequently used tasks that can be started manually if necessary
• "U" - User's choice - depends whether a user deems it necessary
• "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
• "?" - Unknown

Variables:

• %System% - refers to the System folder; by default this is C:\Windows\System (Me/9x), C:\Winnt\System32 (2K/NT), or C:\Windows\System32 (7/Vista/XP)
• %Windir% - refers to the Windows installation folder; by default this is C:\Windows (7/Vista/XP/Me/9x) or C:\Winnt (2K/NT)
• %UserProfile% - refers to the current user's profile folder; by default this is C:\Documents and Settings\{user} (XP/2K/NT) or C:\Users\{user} (7/Vista)
• %ProgramFiles% - refers to the Program Files folder; typically the path is C:\Program Files

Created by Pacman's Portal