| Introduction | Detailed Entries | Updates | Concise List | HJT Forums | Rogues | Message Board |
INTRODUCTION |
If you are concerned about the poor performance of your Windows computer due to the number of programs that run at system startup then this is the place for you. Such programs typically (but not always) include an icon in the System Tray in the bottom right-hand corner of the screen - next to the clock. The intention of these pages is to provide a central resource for PC users and Tech Support staff alike and the following information is provided:
DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.
If you are a regular visitor, click here to go straight to the PROGRAMS
Paul Collins
(aka Pacman)
Pacman's Portal
E-mails received with an attachment from either pac.man_at_ntlworld.com or pacman_at_pacs-portal.co.uk are not from me (replace the "_at_" with "@" if you want to E-mail me). It's most likely due to somebody else's PC being infected with a VIRUS which spoofs valid E-mail addresses.
WHAT IS THE PROBLEM? |
Virtually all applications you install using the default installation these days decide that they should start-up when Windows starts. If you allow these to take control, you can end up with a situation where (unless you have sufficient memory installed) every other program slows down to be unusable.
The reason for this is that all of these programs use a portion of the system memory and resources which leaves a smaller percentage for other programs once they're opened. On an older system, for example, prior to tweaking I had 33 programs running at start-up with the system resources at 59% and Windows took an age before it was ready for use. Post tweaking I had a mere 10, with system resources back to 92% and Windows was up and running within a minute.
For example, if you regularly take part in online gaming or do a lot of graphics or video editing then resources and memory are normally at a premium. Examples of programs that use up part of system memory and aren't really required (for most users) are:
HOW CAN I IDENTIFY THESE PROGRAMS? |
Before we can prevent these programs from running at start-up and therefore using up system resources we have to identify them. There are a number of methods that can be used and I will accept new entries to the database from any of these. Specific details are provided for some of them below and the operating systems they apply to. All of these can also be used to disable programs from starting and are included in the appropriate section below.
Note - if your User Account (click Start → Control Panel → User Accounts) is a "Limited account" (XP) or "Standard Account" (Vista) you may only have limited access to some of these utilities and will need administrator privileges.
With the introduction of Windows 7, Microsoft now recommends using AutoRuns for controlling which programs run when your computer starts. This utility can be downloaded from here. AutoRuns is a free utility developed by SysInternals and has now been taken under the Microsoft TechNet umbrella.
To use it to identify start-up programs do the following:
AutoRuns
The fields I'm interested (which you can copy and paste) in are:
You can also export the output from AutoRuns as a text file - which I would also accept. Select File → Export As..., note the location and save it as "AutoRuns.txt".
If you right-click on an entry and select Jump to... from the options it will open the location of the Startup Type. For example, if the registry editor is opened you will see a list of items and the 2 columns I'm interested in are Name and Data.
Registry Editor
You can also use the "System Configuration Utility" (referred to as MSConfig from now on) to identify startup programs. MSConfig is available for all Win9x/Me/2K/XP/Vista/7 users (Win95/2K user can use the respective versions from here).
To use it to identify start-up programs do the following:
 |
 |
 |
 |
 |
| Win98 | ME | XP | Vista | Windows 7 |
Note that with all of these you can expand the width of each column by holding down the left mouse button with the cursor on the vertical line between the column headings (where applicable) and then dragging the mouse either left or right before releasing. With the XP, Vista and Windows 7 versions (for which the window cannot be re-sized) you can also double-click on the vertical line between two column headings to maximize the column width.
The columns I'm interested in are:
For Win98 the columns aren't named but the one on the left is the equivalent of "Name" and the one on the right is the equivalent of "Command".
Until the introduction of Windows 7, Microsoft recommended using Windows Defender (or the registry) on systems running XP or Vista for controlling which programs run when your computer starts. This utility can be downloaded for XP from here and is included by default with Vista.
To use it to identify start-up programs do the following:
 |
 |
| XP | Vista |
The fields I'm interested (which you can copy and paste) in are:
You can also use the excellent HijackThis™ (originally by Merijn Bellekom) but now owned by Trend Micro. Read the tutorial and I'm interested in the O4 and F0-F3 sections. A number of sites run dedicated forums for HijackThis™ users who are interested in the other entries.
HijackThis
To use it to identify start-up programs do the following:
Finally, you can also use a startup manager.
Naming conventions: The same start-up program can be listed differently depending upon which method you use from those above and which operating system you have. Take the example for the file "Reader_sl.exe" from the screenshots above:
| Method | Name | Source |
| AutoRuns (Autorun entry) | Adobe Reader Speed Launcher | Registry key "Name" |
| HijackThis™ | Adobe Reader Speed Launcher | Registry key "Name" |
| MSConfig (Vista) | Adobe Acrobat | File properties "Product Name" |
| MSConfig (XP) | Reader_sl | First part of filename |
| Registry Editor | Adobe Reader Speed Launcher | Registry key "Name" |
| Windows Defender | Adobe Acrobat | "Display Name" |
From the example above, it may look like Vista's MSConfig and Windows Defender use the same information but they don't. Have a look at the entry for sidebar.exe you have it running on your Vista PC. For MSConfig it's shown as Microsoft® Windows® Operating System whereas for Windows Defender it's Microsoft Windows Sidebar. Therefore, a single program could have as many as 4 different entries in the database.
As XP uses the first part of the filename and some of these are fairly common this will only be included if it's unique. Take the filename update.exe for example. In the database there are a number of entries, a few of which are in the U or Y category. In this case the same description would have to cover all possibilities - which is not really feasible.
Tasks: The database is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL). These display some startup programs AND other background tasks and "Services". This site is concerned with startup programs from the common startup locations shown above ONLY. Please do not submit entries collected from this method as they will not be used. For a list of tasks/processes you should try the Process Library from Uniblue, the list at PC Pitstop or one of the many others now available.
Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.
Services: I won't be including "Services" from the NT/2K/XP/Vista operating systems. I fully understand that some programs with these OS's use "Services" as an alternative to load their component parts at startup but I don't have the time available to include these as well. I recommend you try the following sites for information on services for the relevant operating system:
Viruses: Entries in the program list attributed to viruses are only shown using the registry version which is common to all Windows versions. Otherwise there would be multiple entries for popular filenames that viruses often use - such as "svchost" for example.
Recommended software:
HOW CAN I DISABLE THEM FROM RUNNING AT START-UP? |
After identifying an entry and checking with the database, decide whether you want to prevent it from running at start-up or not. For example, if it's related to your anti-virus protection software, the application won't run correctly without it or a program you use all the time then you want to leave it enabled. Otherwise, you can probably leave them disabled and use the shortcut in the start menu or on the desktop and if necessary, create your own.
If, after checking the database, an entry appears to be virus, spyware or otherwise malware related, check it with your security software first as it may be able to remove it. If you are suspicious and your security software doesn't pick up anything, look at the filename and the entry in the registry in particular. Filenames can be the same as real system files (but in a different location), very similar or random. Entries under the Name column in the registry will often appear to be valid and be particularly suspicious if a system file appears there under the Data column. Finally, if your still suspicious try an on-line file scanner such as that from Kaspersky.
------------------
A number of methods can be prevent programs from running at startup. What these are how you use them is described here. My recommendations are that you try each of the methods listed below in that order. Each method has an indication of which Windows operating system it is applicable to.
The best option is to check if a program gives you an option to disable the function you're interested in - via a right-click on a System Tray icon or maybe an "options" menu within the program. If this isn't available then you have to try something else.
For example, the popular Skype internet telephony/chat program can be disabled via Tools → Options → General Settings → deselect "Start Skype when I start Windows".
If you click on Start → Programs → StartUp (Win9x/Me/NT/2K) or Start → All Programs → StartUp (XP/Vista) you may find programs loading from here via shortcuts. If this is the case, you have two options :-
As stated above, Microsoft currently recommend using AutoRuns for controlling which programs run when your computer starts. AutoRuns will make the changes to the registry you need and provide a recovery mechanism.
To use it to prevent start-up programs from running do the following:
Note that Microsoft don't advocate the use of MSConfig for controlling which programs run when your computer starts:
To use it to identify start-up programs do the following:
Microsoft used to recommend using Windows Defender (or the registry) on systems running XP or Vista for controlling which programs run when your computer starts and it still can be used on those systems.
To use it to prevent start-up programs from running do the following:
There are a number of commercial, shareware and freeware programs widely available to manage start-up program - some of them packaged with other optimization utilities. Each can identify what programs are running at startup and allow you to control them to differing degrees.
Although I cannot personally recommend an individual program (as I prefer to use options 1 through 3 above) you may find they suit your needs If you want to try a start-up manager, why not select from the list given here.
You can both disable and permanently stop programs from running during start-up by editing the relevant entries from the System Registry using the Registry Editor. This option isn't for the faint hearted and should only be used by those who are comfortable with editing the System Registry and understand what implications any changes may have. If you delete something from the System Registry accidentally, it may be corrupted to the extent that Windows may not re-start at all so beware.
For information about the Windows registry and editing it's contents try the Windows Guide Network registry pages.
To use it to manage start-up programs do the following:
The most common keys you're interested in are as follows:-
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
Occasionally the following keys will also be used - primarily by malware:-
HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Terminal Server\Install\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
In all cases:-
HKLM refers to HKEY_LOCAL_MACHINE
HKCU refers to HKEY_CURRENT_USER
If you want to read more about these registry keys and how they play a part in system start-up, I can suggest the following articles:
For Win98/Me, disabled items were placed in the registry keys named above with a "-" after it, i.e. :-
HKLM\Software\Microsoft\Windows\CurrentVersion\Run-
For XP/Vista this is changed :-
For items that were in the Start → Programs → Startup folder:
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder
You'll find a subkey for each disabled item.
For items loaded from the Registry:
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg
Again, you'll find a subkey for each disabled item.
For Windows 9x/Me the WIN.INI file is located in C:\Windows and can be seen if you have enabled "Show hidden files and folders" via My Computer → Tools → Folder Options then the "View" tab. This file is executed at Windows startup. For Windows NT/2K/XP and Vista their are equivalent places in the registry.
Some valid programs and a lot of viruses load at startup via this method under the [windows] section via "run=" or "load=" as follows:
[windows]
run=hpfsched
run=%Windows%\CapsideRed.pif
load=asistat.exe
Load = "C:\Windows\System32.exe"
Note: From WinMe onwards MSConfig includes the "run=" and "load=" entries so this section is only included for completeness. Only valid "run=" entries are included in the programs list to save against repetition from the many viruses that use this method unless a virus has a unique entry.
For Windows 9x/Me the SYSTEM.INI file is located in C:\Windows and can be seen if you have enabled "Show hidden files and folders" via My Computer → Tools → Folder Options then the "View" tab. This file is executed at Windows startup. For Windows NT/2K/XP and Vista their are equivalent places in the registry.
The only valid entry under the "shell=" line here is:
[boot]
shell=Explorer.exe
However, some virusses use this line to execute themselves at startup. For example:
[boot]
shell=Explorer.exe %Windows%\Capside.exe
This has been added by the CASPID virus and is obviously not desired (where %Windows% is C:\Windows or C:\Winnt.
Note:
If you use HijackThis™ the F0-F3 sections include entries related to the WIN.INI and SYSTEM.INI files and equivalent registry entries - see here for more information. An example malware entry could be:
F2 - REG:system.ini: Shell=Explorer.exe init32m.exe
This relates to the DLSW-B trojan, which has the following registry entry:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Shell
Explorer.exe init32m.exe
Recommended software:
THE PROGRAMS |
The list of applications is available in a number of formats, updated on a monthly basis where possible. For all downloadable formats, right-click and select "Save Target As..." for IE and "Save Link As..." for Firefox. If you're a regular visitor and just need to know what program entries have changed in the full list consult the Monthly Updates.
Please refer to either the on-line database or any of the off-line versions and try to decide for yourself before asking which of your programs should be disabled. If you are still having problems deciding then by all means ask about those specific entries.
If you have some kind of internet filtering software installed some of these pages may not display due to the unfortunate use of certain names by some of the entries. This cannot be helped if the information provided is to be accurate. If that is the case I would suggest you download either the Full-list ZIP, Start_ups.exe or Excel ZIP files which will bypass the filtering.
NOTE: These downloads are
password protected and free to anyone producing a mirror or free utility. If you
produce a commercial/shareware utility please contact me to discuss options. If
you don't fall into any of these categories and want to download any of these
files you will need to either make a donation of $15/year or more via PayPal (or
E-mail me) and you will be provided with the login details which will change at
the beginning of each year. For your donation you'll receive:
The downloads were first made available for download back in 2003 and have been available free of charge and downloaded thousands of times. I believe they are unique as to my knowledge, no similar site offers such a resource as the lists they offer are on-line only. Donations will go towards researching new and existing entries for the database, creating these files and hosting/bandwidth costs. The database is (and will remain) free to access. |
| Please consider making a donation if you find the information presented here useful to you. Thanks in advance if you do. |
The SHA-1 (or Secure Hash Algorithm) number shown for each file above is the unique identifier for the current version of that file. If you have older versions the SHA-1 will not match and I recommend you get the current version. I have included these to verify that I created these files and can verify that they are free of viruses or other malware. If you want a simple utility to read the SHA-1 hash of a file try HashTab (by Cody Batt).
All programs are listed alphabetically according to Display Name (Windows Defender), Name/Startup Item (MSConfig), Autorun Entry (AutoRuns) or Name (Registry) rather than "Command" or "<filename>.exe".
Entries in the tables highlighted with a ? and those in red indicate that they are unfinished. This may be due to:
For the next few months and foreseeable future I'll be verifying many of the Y, U, N & ? entries via virtual machines. If you can help fill in the missing information then please E-mail me or use the Message Board. In particular, if you can verify or identify those entries that are hardware specific - such as laptops, motherboards and graphics cards - I'm particularly interested as I obviously don't have access to these.
There are an ever-increasing number of rogue security products (including anti-virus, anti-spyware and privacy tools) appearing now such as the WinAntiVirus and WinAntiSpyware series - which use scare tactics or false warnings to trick the user into installing and paying for these poor quality products. Many of the removal guides for these rogues in the database use MalwareBytes Anti-Malware, which incorporates the functionality from their now discontinued RogueRemover products:
Recommended software:
NEW & UPDATED ENTRIES |
PLEASE READ THIS before submitting new programs to be added to the list. Submissions can be made via E-mail or the Message Board. Note that HJT logs are handled on a separate message board here.
The following information would be useful:
Recommended software:
OFF-SITE LINKS |
Please be aware that any of the links below will open a new browser window.
The following sites proved very useful when creating this site:
Recommended software:
RECOMMENDED SOFTWARE |
Note: Some of the links below are affiliate links which will take offer you the opportunity to purchase the appropriate product. You can find out further information about the product in question elsewhere on that site.
This section deals with both stand-alone startup managers and those included as part of a suite of other optimization utilities.
-----------------------------
With over 13,000 of the database entries given an "X" category because they're some form of virus, trojan, worm, spyware, rogue or other malware it shows the importance of having a good security software.
I'm not going to recommend a particular suite or stand-alone piece of software above any other and suggest you look at each of the products and what it contains, search for some reviews and decide for yourself. Personally, I think security software is one of those products that I don't mind paying for - because of the peace of mind it gives you.
To offer value to the customer, the major commercial companies offer combined packages including anti-virus, anti-spyware, anti-spam, firewall and other useful utilities. For those who want a combined package from a reputable supplier and don't want to rely on keeping separate, individual products up-to-date this may be the best option. Which ever you use, keep it updated regularly and any subscriptions renewed where applicable.
I personally wouldn't recommend renewing a subscription for a product that's more than 2 years old. If you like the software you're using, then buy the latest version as the core technologies incorporated are likely to have significantly improved. For example, I recently had to help a customer who'd just renewed his subscription to Norton Internet Security 2006 - thinking it would provide adequate protection. Somehow, the PC became infected with a trojan that downloaded and installed a version of the WinAntiVirus rogue. After re-building his system I installed a current suite and scanned the old files I'd retained on a USB hard disk and it detected and deleted ~40 infected files.
Personally, the suites I use and recommend on my home and test systems are from Kaspersky and Emsisoft, click the banners below for more details::
If you have favourite stand-alone security products and prefer to pick and choose then those are also available.
Useful virus information search links (as used for most of the virus entries in the database) are provided by Symantec, Sophos, Trend Micro, CA, McAfee & ThreatExpert.
Useful adware/spyware links:
Counterexploitation - "Actively protect your rights. Do not let the Man keep you down. Do what is good and right, not what some authority figure tells you is good and right. Challenge the belief systems of yourself and your society. Stay informed and keep others informed. Use logic and reason for positive social change. And above all, don't take crap from anybody!" Good site for learning more about spyware, other silent install apps and "craputers". Slightly controversial in places but useful resource.
2-Spyware,com - "The 2-Spyware.com project is all about spyware and malware removal. It is one of the largest sources of security information on the Internet that provides clear and professionally written parasite removal instructions, anti-spyware software reviews and relevant articles - everything you should know about spyware and malware." - including their list of rogue/suspect security programs
Darnit - Sandra Hardmeier is one Microsoft's Most Valued Professionals (MVP) and this page on her site is dedicated to spyware/adware/malware, hijackers and other annoyances
Spyware Warrior - "Here you'll find a wealth of resources to help you fight spyware and adware" - including their list of rogue/suspect anti-spyware programs. Not updated since 2006 but still relevant
SpywareGuide - "is the leading public reference site for spyware and greynet research, details about spyware, adware and greynet applications and their behaviours, all compiled in an extensive updated database"
Spyware & Adware - "People think that there is actually no difference between spyware and adware"
This section deals with other software I can recommend for keeping your system in tip-top condition, some of which I personally use and recommend.
Recommended software:
TESTIMONIALS |
RECOMMENDED BY:
|
|
|
|
|
|
|
|
|
| Lockergnome | Langa List | Scot's Newsletter | PC Fear Factor | Backwash | Geek News Central |
Mac's Picks of the Week | The Healthy PC | Microsoft® Windows® XP Inside Out |
Here are just a small sample of the comments I've received over the years from visitors who have found the site and list useful:
"Just wanted to let you know that I've come across your startup applications page and think you've done a fantastic job in putting such a comprehensive list together." - Matt
"THANK YOU SOOOO MUCH for providing this website and it's incredibly useful information. I have long wanted to clean up my start up but didn't know what all that "jibberish" stood for. I was afraid to do anything and tolerated my so very slow start up." - Chris E
"I think the startup list you made is a great resource, it's not the first time I found it useful while trying to eliminate a suspicious task. Great job!" - Zoltan
"Thanks for providing such a great resource---I use your startup list all the time, and it has saved my computer from countless unnecessary memory-hogs. Keep up the good work." - Steve K
"Great site! Microsoft referred me to you!! Have a pint on me." - Thomas P
OTHER USEFUL LINKS |
Tasks/Processes:
Faber Toys - lists all running processes and uses information from the Startup List in the "AutoRun" section. In a planned release it will link directly to information on the site
Others:
Media Ivestigator (by Data Recovery Systems) - "Whether you've lost pictures of special moments in your friends and family's lives captured with your digital camera or accidentally deleted files on your PDA's memory card, we understand that you want file recovery software that will recover your files as quickly, easily and cheaply as possible".
MagicTweak (by Efreesky Software) - "MagicTweak is a special program designed to optimize and personalize Microsoft Windows. It provides one-stop, instant access to a variety of Windows settings that can be altered for a friendlier Windows environment".
Protonic.com - "An online community that provides technical support to computer users for free. We prefer to call our users "Clients," because we have the philosophy that, despite our service being free, you should still receive the highest quality technical support"
NoDevice.com - "We make it really simple to find the driver you need by indexing all our device driver links by company name AND by device type."
Internet Security Blog - "A regularly updated blog about Internet security, malware removal, spyware information, tips and tricks to keep you safe."
 I am pleased to
announce that Pacman's Portal Start Up Tips is recommended as a critical tool for keeping your computer in top shape in
Alan Luber's book, PC Fear Factor: The Ultimate PC Disaster Prevention Guide. This comprehensive, uncompromising guide to PC
disaster prevention and recovery is written in clear, non-technical language that anyone can understand. It provides detailed,
step-by-step instruction on how to prevent most computer disasters, and how to recover quickly, easily, and completely from unavoidable
computer disasters. |
||
| Read the Introduction | Learn More About the Book | Buy the Book |
This site is used by Tech Support staff from or recommended to their clients by the following organizations (amongst others). Some of the logos are hyperlinked to the appropriate site:-
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
Please note that none of the above organizations sponsor this site. If you would like your organization shown here along with a link then please let me know. If you would like your logo removed please let me know.
Copyright © Paul Collins, 2001 - 2010
Pacman's Portal
All rights reserved
| Privacy Policy | Site Map | Home |
