Start-Up Applications

(1) If you receive an E-mail with an attachment from pac.man@ntlworld.com or pacman@pacs-portal.co.uk it isn't from me. It's most likely due to somebody elses PC bring infected with a VIRUS such as variants of MYDOOM, NETSKY and BEAGLE which spoof valid E-mail addresses.

(2) If you run Windows XP and have updated to SP2 and have the pop-up blocker for IE enabled by default the off-site links on this site won't work. They're not pop-ups but that's the way it works. Choose Tools -> Pop-up Blocker -> Pop-up Blocker Settings and set the "filter level" to Medium.

If you are a regular visitor, click HERE to go straight to the list...

Last update :- 2008-07-04 18:52:24 Eastern
16937 items listed

If you wish to reproduce or re-use the information provided here by all means do so but please respect the Copyright information at the base of the pages and indicate to your visitors or the users of your software as to where you got the information. You can download an off-line version of the list by clicking on the "Download current list" link on any page.

If you prefer the old format you can still download the ZIP and EXE formats which consist of a single table arranged alphabetically and are recommended for regular visitors anyway.

Introduction

If you were directed by another site straight to this page, please also have a look at the main startup page first at Startup Content. It contains very useful information, including how to identify these programs, how to disable them and the information I need to accept new entries to the list. Submissions can be made via E-mail or the Message Board.

This page presents a searchable, comprehensive list of the programs you may find that run when you switch on your PC as typically identified by MSCONFIG or the registry "Run" keys - and whether you need them.

Close Program/Task Manager

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Operating System Differences

A number of entries are repeated due to the way that different operating systems display startup items. For example, WinMe lists "POPROXY.EXE" as "Norton eMail Protect" in both MSCONFIG and the registry whereas WinXP lists it as "Poproxy" in MSCONFIG and "Noeton eMail Protect" in the registry.

To avoid the list becoming too large, all VIRUSES are shown using the registry version which is common to all Windows versions.

Random startup entry/filename malware

There are viruses and other pests that can add any number of different entries to the startups. They make additional entries under the registry key HKLM\Software\Microsoft\Windows\CurrentVersion\ Run and RunOnce keys, allowing them to run at startup:

1. PE_BISTRO - adds XXXX = "C:\WINDOWS\XXXX.EXE" - where XXXX is the randomly chosen filename of the dropped file
2. MAGISTR.A - adds (Virus Name) = "(Path of Virus)\(Virus Name).EXE"
3. BUGBEAR.A or BUGBEAR.C or BUGBEAR.E - adds (random string) = %system%\(random filename).EXE. %system% is a variable - by default this is C:\Windows\System (Win9x/Me), C:\Winnt\System32 (WinNT/2K), or C:\Windows\System32 (WinXP). The worm locates the System folder and copies itself to that location
4. OPTIXPRO.11 - adds (Registry entry) = "(Path of Virus)\(Filename)"
5. Lop.com homepage hijacker - creates multiple and random startup entries
6. FreeScratchAndWin - creates multiple and random startup entries as it includes LOP above
7. nCase (or n-Case) parasite - creates multiple and random startup entries
8. LORAC - adds "(four random characters)" = "%System%\abcdef.exe" - where abcdef is the volume number of the infected hard drive
9. MOSUCK - random name and filename in C:\Windows or C:\Winnt
10. DEBORMS.D - adds one of a number of valid Name/Startup Item entries but points to the path of the worm file dropped
11. GIBE.C - random name and filename in C:\Windows or C:\Winnt
12. SWEN.A - random name and filename
13. ZOMBAM.B - random name and filename
14. WANADO or REUR - name and filename as XXXXXXXX where X can be any random hexadecimal (0-9, A-F) number
15. SINCOM - random name and filename in C:\Windows or C:\Winnt with "Run:Auto" appended to the command/data column entry
16. SOBER family - adds (random string) = %system%\(random filename.exe)
17. BRANCOS.C - adds win_(4 random characters)(4 random numbers 0-9) ((4 random characters)(4 random numbers 0-9).exe)
18. IRC.BOT.B - random name and filename
19. COREFLOO-C - (random filename) = rundll32 %SYSTEM% (random filename).dll,Init 1
20. (random digits).exe = (random digits).exe - 8 random digits, example: 77231997.exe = 77231997.exe. Winpup.exe adult content downloader
21. DRAGONQQ - "(Trojan's filename)"="(Path to the Trojan)", "(Random name)"="C:\WINNT\(Random name).exe", "(Random name)"="C:\Program Files\(Random name).exe" or "(Random name)"="C:\WINDOWS\(Random name).exe"
22. FORMADOR - adds (executed file name)="%System%\(executed file name).exe"
23. NETTRASH - adds (file name)=(path to filename).exe
24. OPTIXPRO.13B - adds (registry value name)=(path to trojan).exe
25. MYDOOM.F or MYDOOM.G or MYDOOM.H - adds (4 to 8 random, lowercase letters)=(worm filename)
26. ANNIL - random name and filename
27. ANTINNY.G and ANTINNY.K - (random name)=(
28. KILLAV.D - (Trojan filename)="%Windir%\(Trojan file name)
29. MYPOO - (value name)=(Trojan file name) where (value name) is configurable
30. BLACKMAL or BLACKMAL.B - "(random_file_name1).exe"="%System%\(random_file_name1).exe"
31. ERKEX.A - "(random_file_name)"="%System%\(random_file_name).exe"
32. OPASA - "(random_file_name)"="%System%\(random_file_name).exe"
33. GAOBOT.ADN - random name and filename
34. ADWAHECK - "(trojan name)"="%System%\(trojan filename)"
35. GOBOT.A - random name and filename in C:\Windows or C:\Winnt
36. Sandboxer adware - random name and filename
37. AGENT.B - "(1-5 random characters)"="RUNDLL32 %System%\(DLL filename).dll,StreamingDeviceSetup"
38. EXRUNTEL - "[original filename]"="%System%\[original filename]"
39. Margoc adware - random name and filename

Spyware/Adware/Malware/Foistware & Hijackers

Check CastleCops for information about these types of program. They have a very active forum and a list of programs that may remove them here.

If you decide to disable a program and run it manually, and there isn't a shortcut or Start -> Programs entry available you can create your own shortcut.

Updates - recent changes to the entries in this list

Key

• "Y" - Normally leave to run at start-up

• "N" - Not required - typically infrequently used tasks that can be started manually if necessary

• "U" - User's choice - depends whether a user deems it necessary

• "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"

• "?" - Unknown

Created by Paul "Pacman" Collins for Pacman's Portal