Start-Up Applications - All

Last update :- 13th November, 2003
3738 items listed

Introduction

This page presents a searchable, comprehensive list of the programs you may find that run when you switch on your PC as typically identified by MSCONFIG or the registry "Run" keys - and whether you need them.

Close Program/Task Manager

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 4 Standard/Professional from LIUtilities or the list at AnswersThatWork

Operating System Differences

A number of entries are repeated due to the way that different operating systems display startup items. For example, WinMe lists "POPROXY.EXE" as "Norton eMail Protect" whereas WinXP lists it as "Poproxy"

Random startup entry/filename viruses

There are viruses and other pests that can add any number of different entries to the startups. They make additional entries under the registry key HKLM\Software\Microsoft\Windows\CurrentVersion\ Run and RunOnce keys, allowing them to run at startup:

(1) PE_BISTRO - adds XXXX = "C:\WINDOWS\XXXX.EXE" - where XXXX is the randomly chosen filename of the dropped file
(2) MAGISTR.A - adds <Virus Name> = "<Path of Virus>\<Virus Name>.EXE"
(3) BUGBEAR - adds <random string> = %system%\<random filename>.EXE. %system% is a variable - by default this is C:\Windows\System (Win9x/Me), C:\Winnt\System32 (WinNT/2K), or C:\Windows\System32 (WinXP). The worm locates the System folder and copies itself to that location
(4) OPTIXPRO.11 - adds <Registry entry> = "<Path of Virus>\<Filename>"
(5) Lop.com homepage hijacker - creates multiple and random startup entries
(6) FreeScratchAndWin - creates multiple and random startup entries as it includes LOP above
(7) nCase (or n-Case) parasite - creates multiple and random startup entries
(8) LORAC - adds "<four random characters>" = "%System%\abcdef.exe" - where abcdef is the volume number of the infected hard drive
(9) MOSUCK - random name and filename in C:\Windows or C:\Winnt
(10) DEBORMS.D - adds one of a number of valid Name/Startup Item entries but points to the path of the worm file dropped
(11) GIBE.C - random name and filename in C:\Windows or C:\Winnt
(12) SWEN.A - random name and filename
(13) ZOMBAM.B - random name and filename
(14) WANADO or REUR - name and filename as XXXXXXXX where X can be any random hexadecimal (0-9, A-F) number
(15) SINCOM - random name and filename in C:\Windows or C:\Winnt with "Run:Auto" appended to the command/data column entry
(16) SOBER - adds <random string> = %system%\<random filename.exe>
(17) BRANCOS.C - adds win_<4 random characters><4 random numbers 0-9> (<4 random characters><4 random numbers 0-9>.exe)
(18) IRC.BOT.B - random name and filename
(19) COREFLOO-C - <random filename> = rundll32 %SYSTEM% <random filename>.dll,Init 1

Spyware/Adware/Malware/Foistware & Hijackers

Check SpywareInfo for information about these types of program. They have a very active forum and a list of programs that may remove them here

o-----------------------------o

This search works with IE4+, NS4 and Mozilla/NS7+ but not NS6. Alternatively use your browsers search facility - Ctrl+F for IE users.

Key:

• "Y" - Normally leave to run at start-up

• "N" - Not required - typically infrequently used tasks that can be started manually if necessary

• "U" - User's choice - depends whether a user deems it necessary

• "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"

• "?" - Unknown

Alphanumeric index

Back to search

Back to search