Index Introduction Database Detailed Entries Updates Concise List HJT Forums Rogues Message Board

Windows startup programs - Database search

If you're frustrated with the time it takes your Windows 10/8/7/Vista/XP PC to boot and then it seems to be running slowly you may have too many programs running at start-up - and you have come to the right place to identify them. This is the original start-up programs (as opposed to processes/tasks) list - one of the most accurate and comprehensive. Services are not included - see below. For further information on this and how to identify and disable start-up programs please visit the Introduction page.

See here for further information on random entries - which are typically added by viruses and other malware or unwanted programs.

Last database update :- 31st July, 2017
51731 listed

You can search for any of the following terms to find and display entries in the start-up programs database but the minimum search is 3 characters and you must click on the "Search" button. Results are sorted by the Startup Item/Name field.

Alternatively, you can browse the full database (without the search facility) over a number of pages or you can use the alphabetical index below to list the entries for that letter by the Command/Data field, but the results may take longer to appear due to the number of them:

A | B | C | D | E | F | G | H | I | J | K | L | B | N | O | P | Q | R | S | T | U | V | W | X | Y | Z

NOTE: Searching for common words (i.e. "the" or "where") will mean the results take longer to appear due to the number of them.

Please click on the Search button

234 results found for Y

Startup Item or Name Status Command or Data Description Tested
xpsystemXy.exeCoolWebSearch parasite variantNo
USBGuardXY0tninam.exeDetected by Sophos as W32/Autorun-BHQNo
CSVEU4SNGOKND00TXy1zhitnw.exeDetected by McAfee as W32/Sdbot.worm!lw and by Malwarebytes as Backdoor.IRCBotNo
WindowsUpdateXy248.vbeDetected by Malwarebytes as Backdoor.IRCBot.Gen. The file is located in %AppData%\QTWTHNo
y6FZ43NBFXy6FZ43NBF.exeDetected by McAfee as RDN/Generic.bfr!fl and by Malwarebytes as Backdoor.Agent.RNDNo
4z4pXy9ce8p.exeAdded by the VB-FND TROJAN!No
YACCUYACC.exeYACC (Yet Another Atomic Clock) from Tools&More - freeware utility that synchronizes your PC clock to a high precision atomic time clockNo
YAMAHA AC-XG Power Utility?yacpower.exeYamaha AC-XG soundcard power utility. What does it do and is it required?No
Microsoft Driver SetupXyadrive32.exeDetected by Malwarebytes as Worm.Palevo. The file is located in %Windir%No
yaemu.exeXyaemu.exeAdded by the WIN32.DNSCHANGER.S TROJAN!No
s5r4etygs54retyXyagtser56j.exeDetected by Dr.Web as Trojan.DownLoader7.8222 and by Malwarebytes as Trojan.AgentNo
HAO567XYAHD.exeDetected by Malwarebytes as Backdoor.Agent.YH. The file is located in %CommonFiles%No
BitDefender for Yahoo! MessengerUyahmon.exeBitdefender anti-virus for Yahoo! Messenger - no longer supported at the BitDefender websiteNo
Task ManagerXyahoo.exeAdded by the QUATIM.A WORM!No
WinhostXyahoo.exeDetected by Sophos as Troj/Delf-KM and by Malwarebytes as Trojan.ClickerNo
Winhost1Xyahoo.exeDetected by Sophos as Troj/Delf-KM and by Malwarebytes as Trojan.ClickerNo
Winhost2Xyahoo.exeDetected by Sophos as Troj/Delf-KM and by Malwarebytes as Trojan.ClickerNo
Winhost3Xyahoo.exeDetected by Sophos as Troj/Delf-KM and by Malwarebytes as Trojan.ClickerNo
Winhost4Xyahoo.exeDetected by Sophos as Troj/Delf-KM and by Malwarebytes as Trojan.ClickerNo
Yahoo UpdateXYahoo.exeDetected by Total Defense as the Yahoo! trojan. The file is located in %System%No
Yahoo!MessengerForVistaNYahoo.Messenger.YmApp.exeVersion of Yahoo! Messenger released specifically for Vista users - but now supersededNo
YCentralUYahooCentral.exeYahoo! Central - "alerts you if your default home page, search, or email is changed or if updates are available for your Yahoo! software. You can manage your default Internet settings and get updates to your software from Yahoo!"No
yahoofiles.exeXyahoofiles.exeDetected by Dr.Web as Trojan.Siggen6.7738 and by Malwarebytes as Backdoor.Agent.E. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
Yahoo! FriendNYahooFriend.exeYahoo! Friend - plug-in for Yahoo! Messenger that add lots of emoticons and windows effectsNo
WINTASKXyahooicons.exeDetected by Sophos as W32/Mytob-HMNo
yahoomapsx.exeXyahoomapsx.exeDetected by Malwarebytes as Trojan.SpyEyes. The file is located in %Root%\yahoomapsx.exeNo
WinlogonXYahooMessenger v1.0.exeDetected by Malwarebytes as Trojan.Agent.Trace. The file is located in %ProgramFiles%\redeNo
Yahoo! MessengerNYahooMessenger.exeSystem Tray access to the Yahoo! Messenger instant messengerYes
Yahoo! PagerNYahooMessenger.exeSystem tray access to an older version of the Yahoo! Messenger instant messengerYes
WINDOWSYAHOOXYahooMessenger.exeDetected by McAfee as RDN/Generic.bfr and by Malwarebytes as Backdoor.Agent.YM. Note - this is not the legitimate Yahoo! Messenger which is normally located in %ProgramFiles%\Yahoo!\Messenger. This one is located in %System%\SYSTEM32No
YahooAdobeXYahooMessenger.exeDetected by McAfee as RDN/Generic.bfr!hx and by Malwarebytes as Backdoor.Agent.E. Note - this is not the legitimate Yahoo! Messenger which is normally located in %ProgramFiles%\Yahoo!\Messenger. This one is located in %ProgramFiles%\AdobeYahooNo
YahoocrXYahooMessenger.exeDetected by McAfee as RDN/Generic.bfr!hx and by Malwarebytes as Backdoor.Agent.E. Note - this is not the legitimate Yahoo! Messenger which is normally located in %ProgramFiles%\Yahoo!\Messenger. This one is located in %ProgramFiles%\AdobeYahooNo
YahooMessengerNYahooMessenger.exeSystem Tray access to the Yahoo! Messenger instant messengerYes
Messenger (Yahoo!)NYahooMessenger.exeSystem Tray access to the Yahoo! Messenger instant messengerYes
AdobeYahooXYahooMessenger.exeDetected by McAfee as RDN/Generic.bfr!hx and by Malwarebytes as Backdoor.Agent.E. Note - this is not the legitimate Yahoo! Messenger which is normally located in %ProgramFiles%\Yahoo!\Messenger. This one is located in %ProgramFiles%\AdobeYahooNo
PoliciesXYahooMessengerPluss.exeDetected by McAfee as RDN/Generic Dropper and by Malwarebytes as Trojan.Agent.YMPNo
YahooMessengerPlusXYahooMessengerPluss.exeDetected by Malwarebytes as Trojan.Agent.YMP. The files is located in %ProgramFiles%\YahooMessengerPlus - see examples here and hereNo
yexploremgrXyahoomessengr.exeDetected by McAfee as RDN/Generic.bfr!ey and by Malwarebytes as Backdoor.Agent.ENo
YahooMonitorUYahooMonitor.exeYahoo Messenger Monitor Sniffer surveillance software for the Yahoo! instant messenger. Uninstall this software unless you put it there yourselfNo
Yahoo MessengerXYahoomsg.exeAdded by an unidentified WORM or TROJAN!No
Yahoo Instant MessengarXYahooMsgr.exeDetected by Total Defense as Backdoor.Win32.SdBot.gen. The file is located in %System%No
yahoomsgrXYahoomsngr.exeDetected by Trend Micro as WORM_AGOBOT.AKZNo
Yahoo! PagerNYAHOOM~1.EXESystem tray access to an older version of the Yahoo! Messenger instant messengerNo
YahooPOPsNYahooPOPs.exeYahooPOPs (now YPOPs! - enables free POP3/SMTP access to Yahoo! Mail through a service on localhost that emulates the web interfaceNo
YahooToolbarXYahooToolbar.exeDetected by Kaspersky as Trojan.Win32.Sasfis.amwv and by Malwarebytes as Trojan.Ransom.UPL. Note - this is not a legitimate Yahoo! entry and the file is located in %AppData%No
Yahoo! Widget EngineUYahooWidgetEngine.exeYahoo! Widget Engine lets you run little files called Widgets that can do pretty much whatever you want them toNo
Yahoo! WidgetsUYahooWidgets.exeYahoo! Widgets lets you run little files called Widgets that can do pretty much whatever you want them toNo
yahoo_toolbar lptt01Xyahoo_toolbar.exeRapidBlaster variant (in a "yahoo_toolbar" folder in Program Files). A dedicated "RapidBlaster Killer" removal tool used to be available but quality anti-malware tools will now remove itNo
yahoo_toolbar ml097eXyahoo_toolbar.exeRapidBlaster variant (in a "yahoo_toolbar" folder in Program Files). A dedicated "RapidBlaster Killer" removal tool used to be available but quality anti-malware tools will now remove itNo
yaka.exeXyaka.exeDetected by Kaspersky as Virus.Win32.Virut.ce and by Malwarebytes as Trojan.Agent. The file is located in %AppData%No
NuoyanXYan.exeDetected by Malwarebytes as Trojan.ServStart. The file is located in %System%No
Yankee Clipper IIINYankClip.exeYankee Clipper 3 by InteleXual Software - is a 'powerful Windows clipboard extender/memory- now in its third generation. Handles Pictures, Richtext, URLS, etc - any size. Features printing, drag and drop, optional permanent storage of clippings. Familiar "Outlook" interface. Freeware'No
Yankee Clipper PlusNYANKCLIP.exeOlder version of Yankee Clipper by InteleXual Software - Windows clipboard extender/memoryNo
Yankee Clipper XNYankClip.exeYankee Clipper X by InteleXual Software - is a "super powerful clipboard extender that has a functionality our competitors haven't ever dreamed of yet. Flexibility, reliability and easy to understand layout and settings; those and many more are the most important attributes of YCX"No
yaoaqaXyaoaqa.exeDetected by Malwarebytes as Worm.SFDC. The file is located in %UserProfile% - see hereNo
GoogleChromeAutoLaunch_[ID]Uyappyz.exe"Yappyz is a free application software that provides mobile-like gaming experience on your PC. Install great games. It's easy, simple and secure." Detected by Malwarebytes as PUP.Optional.Yappyz. The file is located in %LocalAppData%\Yappyz\Application. If bundled with another installer or not installed by choice then remove itNo
Yapta TrackerUYaptaClient.exeYapta "make it easy for you to secure the best airfare deals available on the Web. We do this by giving you a tool to "tag" the trips you like while shopping online, then we track prices on these trips and alert you when prices drop"No
TaskmanXyaptm.exeDetected by Sophos as W32/Palevo-Z and by Malwarebytes as Worm.Palevo. Note - this entry adds a HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Taskman" entry which loads the file "yaptm.exe" (which is located in %AppData%)No
UserinitXyapxoeg.exeDetected by McAfee as Generic BackDoor.acx and by Malwarebytes as Trojan.AgentNo
yauimXyauim.exeDetected by Malwarebytes as Worm.SFDC. The file is located in %UserProfile% - see hereNo
HKLMXyava.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%No
HKCUXyava.exeDetected by Malwarebytes as Backdoor.HMCPol.Gen. The file is located in %System%No
ybaixawi.exeXybaixawi.exeDetected by Malwarebytes as Trojan.Banload. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
WebfettiIE Browser Plugin LoaderUybbrmon.exeWebfetti toolbar - powered by the Ask Partner Network toolbars by IAC Applications (was Mindspark). Detected by Malwarebytes as PUP.Optional.MindSpark. The file is located in %ProgramFiles%\Webfetti_52\bar\*.bin - where * represents a number or letter. If bundled with another installer or not installed by choice then remove itNo
yblxrhoj*Xyblxrhoj*.exeDetected by Malwarebytes as Trojan.Downloader - where * represents anything. The file is located in %UserProfile% - see an example hereNo
yblxrhojXyblxrhoj.exeDetected by Malwarebytes as Trojan.Downloader. The file is located in %System%No
yblxrhojXyblxrhoj.exeDetected by Malwarebytes as Trojan.Downloader. The file is located in %UserProfile%No
YBrowserNybrwicon.exeSBC Yahoo! Browser system tray iconNo
!1_ProcessGuard_StartupXyBTAuAr.exeDetected by Malwarebytes as Trojan.Dropper. Note - this is not a legitimate DiamondCS ProcessGuard entry. The file is located in %AppData%No
ctfmon.exeXyBTAuAr.exeDetected by Malwarebytes as Trojan.Dropper. The file is located in %AppData%No
apadusnpXycicahgd.exeDetected by Malwarebytes as Trojan.Zbot.ML. The file is located in %Windir%No
YCMMirag ApplicationUYCMMirage.exePart of YouCam from CyberLink - effects software for webcams. From the CyberLink forum: "YCMMirage.exe is a background process which will monitor if any AP is using our virtual driver. Once it is detected, YCMMirage will launch YouCam, and then YouCam will provide and share the webcam video to client APs"Yes
YCMMirageUYCMMirage.exePart of YouCam from CyberLink - effects software for webcams. From the CyberLink forum: "YCMMirage.exe is a background process which will monitor if any AP is using our virtual driver. Once it is detected, YCMMirage will launch YouCam, and then YouCam will provide and share the webcam video to client APs"Yes
YouCam MirageUYCMMirage.exePart of YouCam from CyberLink - effects software for webcams. From the CyberLink forum: "YCMMirage.exe is a background process which will monitor if any AP is using our virtual driver. Once it is detected, YCMMirage will launch YouCam, and then YouCam will provide and share the webcam video to client APs"Yes
YCR StartXYCR.exeDetected by Dr.Web as Trojan.MulDrop2.50130 and by Malwarebytes as Trojan.Agent.GenNo
YDTMain.exeXYDTMain.exe180Solutions adware related. The file is located in %ProgramFiles%\YDTNo
TaskmanXydwzro.exeDetected by Trend Micro as TROJ_RIMECUD.WLDD and by Malwarebytes as Worm.Palevo. Note - this entry adds a HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Taskman" entry which loads the file "ydwzro.exe" (which is located in %UserProfile%)No
TaskmanXydze.exeDetected by Dr.Web as Trojan.DownLoader10.56234 and by Malwarebytes as Worm.Palevo. Note - this entry adds a HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Taskman" entry which loads the file "ydze.exe" (which is located in %AppData%)No
YEA StartXYEA.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Trojan.STRGenNo
YeaDesktopUYeaDesktop.exeDetected by Malwarebytes as PUP.Optional.YeaDesktop. The file is located in %ProgramFiles%\YeaDesktop. If bundled with another installer or not installed by choice then remove it, removal instructions hereNo
YeaplayerUYeaplayermd.exeDetected by Malwarebytes as PUP.Optional.YeaPlayer. The file is located in %ProgramFiles%\Yeaplayer. If bundled with another installer or not installed by choice then remove itNo
yeayelXyeayel.exeDetected by Malwarebytes as Trojan.FakeAlert. The file is located in %UserProfile% - see hereNo
yeioyiXyeioyi.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %UserProfile%No
MSRegScanUYEKPND.exeEyeCandy Computer Monitor surveillance software. Uninstall this software unless you put it there yourselfNo
YellowSend User InterfaceUYellowSendUI.exeYellowSend by CMI Limited - "With YellowSend YOU CAN SEND AnyFile, AnySize, AnyWhere." Detected by Malwarebytes as PUP.Optional.YellowSend. The file is located in %ProgramFiles%\YellowSend. If bundled with another installer or not installed by choice then remove it, removal instructions hereNo
AbcoysXYemdphs.exeDetected by Dr.Web as Trojan.KeyLogger.22238 and by Malwarebytes as Trojan.Agent.RNDNo
yemikXyemik.exeDetected by Malwarebytes as Backdoor.Bot. The file is located in %UserProfile% - see hereNo
YesXYes.exeDetected by Dr.Web as Trojan.Siggen3.8833 and by Malwarebytes as Trojan.AgentNo
y1959sarXyesbron.comDetected by Sophos as W32/Brontok-AKNo
[random]Xyesbron.comDetected by Sophos as W32/Brontok-AINo
Tok-Cirrhatus-1959sarcXyesbron.comDetected by Sophos as W32/Brontok-RNo
YesFileXYesFile.exeDetected by Dr.Web as Trojan.DownLoader7.29662No
yespopupXyespopup.exeDetected by Malwarebytes as Adware.YesPopUp. The file is located in %ProgramFiles%\yespopupNo
EcatXyetenyve.exeDetected by Trend Micro as WORM_SDBOT.AXQNo
yfcsxfd.zipXyfcsxfd.zipDetected by Dr.Web as Trojan.DownLoader11.31582 and by Malwarebytes as Trojan.Banker.E. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
ygfhf hjfdf.vbsXygfhf hjfdf.vbsDetected by Malwarebytes as Trojan.Agent.ST. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
FrameXYgfx.exeDetected by McAfee as RDN/Ransom!de and by Malwarebytes as Backdoor.Agent.DCENo
TaskmanXygmdrm.exeDetected by Sophos as W32/Palevo-BS and by Malwarebytes as Worm.AutoRun. Note - this entry adds a HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Taskman" entry which loads the file "ygmdrm.exe" (which is located in %AppData%)No
You've Got Pictures ScreensaverUygpsstra.exeAOL You've Got Pictures ScreensaverNo
ylbroohtXygtowvqtssd.exeDetected by Sophos as Troj/Agent-NFXNo
MSZPUEFDIFLXYGXJNoO.exeDetected by McAfee as RDN/Generic BackDoor!bbn and by Malwarebytes as Backdoor.Agent.DCENo
BGBGBGBCFAZSXDCXyhfsazxcxcxvbvbv.exeDetected by McAfee as RDN/Generic PWS.y!b2k and by Malwarebytes as Trojan.Agent.RNDNo
Winamp UpdateXyhn.exeDetected by Sophos as W32/Sdbot-ACRNo
YhsmilesNYHsmiles.exeEmoticons utility for Yahoo! MessengerNo
zzfjsdalkjXyhtx.exeDetected by Malwarebytes as Trojan.Agent.AI. The file is located in %UserTemp%\zzfjsdalkjNo
AzixegoiraXyikylohi.exeDetected by Trend Micro as WORM_SDBOT.ASPNo
YIM StartXYIM.exeDetected by Dr.Web as Trojan.KeyLogger.10341No
Flash_Player_InstallXying.exeDetected by PrevX (now part of Webroot) as Constructor VC2000 malware. The file is located in %Windir%No
yingXying.exeDetected by PrevX (now part of Webroot) as Constructor VC2000 malware. The file is located in %Windir%No
svchostXying.exeDetected by PrevX (now part of Webroot) as Constructor VC2000 malware and by Malwarebytes as Backdoor.Bot.E. The file is located in %Windir%No
explorerXYinstall.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %UserProfile%\DesktopNo
internet.exeXyinyin3345.vbsDetected by Symantec as X97M.YiniNo
(Default)XyIwSaKyz.exeDetected by Malwarebytes as Trojan.MSIL.BRE. Note - this malware actually changes the value data of the "(Default)" key in HKCU\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank and the file is located in %UserTemp%No
shellXYKHAWSk.exe,explorer.exeDetected by Malwarebytes as Hijack.ShellA.Gen. Note - this entry adds an illegal HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon "Shell" entry. The value data points to "explorer.exe" (which is a legitimate file located in %Windir% and shouldn't be deleted) and "YKHAWSk.exe" (which is located in %AppData%\KdkgtxPf)No
MSRegScanUYKPND.exeYKPMD surveillance software. Uninstall this software unless you put it there yourselfNo
YkwkwiXYkwkwi.exeDetected by Malwarebytes as Worm.Dorkbot. The file is located in %AppData%\MicrosoftNo
YLive.exeNYlive.exeYahoo! Assistant (formerly 3721 Internet Assistant) - not recommendedNo
ylyleXylyle.exeDetected by Malwarebytes as Trojan.Agent.E. The file is located in %LocalAppData%\ylyleNo
Yahoo! MailUYMailAdvisor.exeYahoo! Mail Advisor - informs you of any changes to your Yahoo! Mail settings (i.e., if your default mail client changes). Bundled with some Yahoo! programs, Toolbar or MessengerNo
YMailAdvisorUYMailAdvisor.exeYahoo! Mail Advisor - informs you of any changes to your Yahoo! Mail settings (i.e., if your default mail client changes). Bundled with some Yahoo! programs, Toolbar or MessengerNo
Yahoo Chat ProtectionXYMChatProtecter.exeDetected by Malwarebytes as Trojan.Agent.E. The file is located in %Windir%\Yahoo Chat ProtectionNo
InternalSystrayXymessenger2.exeDetected by Malwarebytes as Trojan.Agent.E. The file is located in %System%No
ymetrayNymetray.exeSystem Tray access to the Yahoo! Music engine (which became Yahoo! Music Jukebox) freeware music player by Yahoo!No
YmEwGJXgpidLPIXYmEwGJXgpidLPI.exeAdded by the FAKEAV-CYN TROJAN!No
Windows LoL LayerXymllh.exeDetected by Sophos as W32/Rbot-FSU and by Malwarebytes as Backdoor.BotNo
userinitXymovpa.exeDetected by McAfee as Generic.mfr and by Malwarebytes as Trojan.AgentNo
Yahoo!Xymsgr_tray.exeDetected by Trend Micro as BKDR_RARSTONE.A. Note - this is not the legitimate ymsgr_tray.exe process which is normally located in %ProgramFiles%\Yahoo!\Messenger - this one is located in %System%No
SamLogic VI 2012XYmsgr_tray.exeDetected by McAfee as RDN/Generic.bfr and by Malwarebytes as Backdoor.IRCBot.SMGenNo
YhooUpdatesXymsmsgs.exeAdded by the AGENT.AN TROJAN!No
Yahoo! MessangerXymsngr32.exeDetected by Trend Micro as WORM_WOOTBOT.HY. Note - this should not be confused with Yahoo! MessengerNo
YhooUapdatesXymssmsgs.exeAdded by a variant of the AGENT.AN trojan. The file is located in %System%No
ynavmrcd.exeXynavmrcd.exeDetected by Sophos as Troj/Dloadr-AVCNo
%LocalAppData%\yndswiner.exeXyndswiner.exeDetected by Malwarebytes as Trojan.Banker. The file is located in %LocalAppData%No
WIMMUN32XynjIQV8QvC2.exeAdded by the GBOT-I TROJAN!No
bb2fXynjolbpa.exeDetected by Malwarebytes as Trojan.Backdoor.BHI. The file is located in %System%No
yoXyo.exeDetected by McAfee as Generic PWS.yNo
YodaoDictNYodaoDict.exeYoudao dictionary is launched as an online dictionary-like software and other related services including whole-paragraph translation. Translation is based on the data from Youdao search engine and other massive web data generated by data mining and natural language processing." Incorporates support for 5 languages which can switch freely - Chinese, English, Japanese, Korean and FrenchNo
Microsoft Driver SetupXyodrive32.exeDetected by Malwarebytes as Worm.Palevo. The file is located in %Windir%No
Yontoo DesktopUYontooDesktop.exeYontoo Desktop - now discontinued. Detected by Malwarebytes as PUP.Optional.Yontoo. The file is located in %AppData%\Yontoo. If bundled with another installer or not installed by choice then remove itNo
YOPNyop.exeDashboard Module for SBC Yahoo! Online ProtectionNo
Yostamb57484.exeXYostamb57484.exeDetected by Malwarebytes as Trojan.Banker. The file is located in %AppData%No
YouCamNYouCam.exeSystem Tray access to YouCam from CyberLink - effects software for webcamsYes
YouCam TrayNYouCam.exeSystem Tray access to YouCam from CyberLink - effects software for webcamsYes
CyberLink YouCam TrayNYouCamTray.exeSystem Tray access to YouCam from CyberLink - effects software for webcamsYes
YouCam Mirror Tray iconNYouCamTray.exeSystem Tray access to YouCam from CyberLink - effects software for webcamsYes
YouCamTrayNYouCamTray.exeSystem Tray access to YouCam from CyberLink - effects software for webcamsYes
YouPinXYouPin.exeDetected by McAfee as RDN/Downloader.a!g and by Malwarebytes as Trojan.Downloader.YPNo
KrisXYouPin2.exeDetected by Sophos as Troj/Agent-AAPG and by Malwarebytes as Trojan.Agent.YPNNo
UPNPXYourFucked.exeDetected by Malwarebytes as Trojan.PasswordStealer.E. The file is located in %System%\Chrome - see hereNo
skypeUpdaterXyoutoba craft.exeDetected by Malwarebytes as Backdoor.SpyNet. The file is located in %ProgramFiles%\program filesNo
PoliciesXyoutoba craft.exeDetected by Malwarebytes as Backdoor.Agent.PGen. The file is located in %ProgramFiles%\program filesNo
YouTube NotifierXYouTube Notifier.exeDetected by Dr.Web as Trojan.DownLoader11.29048 and by Malwarebytes as Trojan.MSIL.Ransom.BlockerNo
YOUTUBE.PLAYER.exeXYOUTUBE.PLAYER.exeDetected by Symantec as Trojan.Dugenpal and by Malwarebytes as Trojan.Inject. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
GoobzoYouTubeAcceleratorNYouTubeAccelerator.exeYouTube Accelerator by Goobzo LTDNo
Java(TM) Update SchedulerXYouTubeConverter.exeDetected by McAfee as W32/Shadebot and by Malwarebytes as Backdoor.Agent.Gen. The file is located in %AppData%No
youtube_net_01002aqui01542.exeXyoutube_net_01002aqui01542.exeDetected by Dr.Web as Trojan.DownLoader10.17738 and by Malwarebytes as Trojan.Downloader.E. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
you_tube_videos_engracados_#.exeXyou_tube_videos_engracados_#.exeDetected by Malwarebytes as Trojan.Downloader.E - where # represents one or more digits. Note - the file is located in %UserStartup% and its presence here ensures it runs when Windows starts - see an example hereNo
you_tube_videos_engracados_0544454.exeXyou_tube_videos_engracados_0544454.exeDetected by Dr.Web as Trojan.DownLoader10.50495 and by Malwarebytes as Trojan.Downloader.E. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
Yahoo MessengerXYPager.exeDetected by Sophos as W32/Rbot-QO. Note - this is not the older version of Yahoo! Messenger which has the same filename and is located on %ProgramFiles%\Yahoo!\Messenger. This one is located in %System%No
Yahoo! MessengerNypager.exeSystem tray access to an older version of the Yahoo! Messenger instant messengerYes
Yahoo! PagerNypager.exeSystem tray access to an older version of the Yahoo! Messenger instant messengerYes
ypagerNypager.exeSystem tray access to an older version of the Yahoo! Messenger instant messengerYes
Ypager.exeNypager.exeSystem tray access to an older version of the Yahoo! Messenger instant messengerYes
SystemXYPager.exeDetected by Trend Micro as TROJ_JUNTADOR.K and by Malwarebytes as Trojan.FakeAlert. Note - this is not the older version of Yahoo! Messenger which has the same filename and is located on %ProgramFiles%\Yahoo!\MessengerNo
ypagerXypagerr.exeDetected by Malwarebytes as Trojan.Backdoor. The file is located in %Windir%\system3232No
yahoo inc.Xypages.exeAdded by a variant of the SDBOT.62235D21 WORM!No
YPCUypc.exeYahoo Parental controls - "Let you decide what type of sites and Yahoo! services your kids can access"No
222qo3jXypgz2y.exeAdded by the AGENT-RFJ TROJAN!No
YPOPsUYPOPsYPOPs! - an application that provides POP3 access to Yahoo! Mail. Yahoo! Mail disabled free access to its POP3 service in 2002. This application emulates a POP3 server and enables popular email clients like Outlook, Netscape, Eudora, Mozilla, etc., to download email from Yahoo! accountNo
YPOPsUYPOPs.exeYPOPs! - an application that provides POP3 access to Yahoo! Mail. Yahoo! Mail disabled free access to its POP3 service in 2002. This application emulates a POP3 server and enables popular email clients like Outlook, Netscape, Eudora, Mozilla, etc., to download email from Yahoo! accountNo
yqbcfolmuryzdhbzilziXyqbcfolmuryzdhbzilzi.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %AppData%\yqbcfolmuryzdhbzilziNo
yqClQMLyEMRydSoXyqClQMLyEMRydSo.exeAdded by the FAKEAV-DVB TROJAN!No
Yahoo HP Reminder [version]?yr.exeThe file is located in %ProgramFiles%\YAHOO!\YIP2\HP\ENCWAR\PROGRAMNo
zzx2mXyriryc5.exeDetected by McAfee as W32/Virut.n.gen and by Malwarebytes as Trojan.DownloaderNo
WinFix serviceXyrkjbvdlb.exeDetected by Dr.Web as Trojan.DownLoader8.40974No
ySlFzoUdechSMXySlFzoUdechSM.exeDetected by Malwarebytes as Trojan.Dropper.PI. The file is located in %AppData%No
UpdateUYSPackage.exeYellowSend by CMI Limited - "With YellowSend YOU CAN SEND AnyFile, AnySize, AnyWhere." Detected by Malwarebytes as PUP.Optional.Package. The file is located in %AppData%\YSPackage. If bundled with another installer or not installed by choice then remove it, removal instructions hereNo
Windows LogonXyt-c.exeDetected by McAfee as Generic.dx!b2ufNo
MicrosoftSecurityXyt.exeDetected by McAfee as Generic.dx!b2uf and by Malwarebytes as Backdoor.MessaNo
Y!TunnelBasicUYTBasic.exeY!TunnelBasic add-on for Yahoo! Messenger from Digital Asphyxia and Chet Simpson - adds features such as enhanced privacy, custom filtering and extensive visual improvements. No longer availableNo
ytbnstartUytbnstart.exeDetected by Malwarebytes as PUP.Optional.YouTubian. The file is located in %ProgramFiles%\YouTubianDl and %ProgramFiles%\YouTubianDl\x64. If bundled with another installer or not installed by choice then remove itNo
WindowsNetworkXYTDownload.exeDetected by McAfee as RDN/Generic.dx and by Malwarebytes as Backdoor.Agent.DCGenNo
YTDownloaderUYTDownloader.exeDetected by Malwarebytes as PUP.Optional.Goobzo. The file is located in %ProgramFiles%\YTDownloader. If bundled with another installer or not installed by choice then remove itNo
RabipykuoXyten.exeDetected by Malwarebytes as Trojan.Ransom. The file is located in %AppData%\YqeccNo
ytewcxzswXytewcxzsw.exeAdded by the ONLINEG.YCL TROJAN!No
Y!TunnelProUYTPro.exeY!TunnelPro add-on for Yahoo! Messenger from Digital Asphyxia and Chet Simpson - adds features such as enhanced privacy, custom filtering and extensive visual improvements. No longer availableNo
YTrayMagic Lite 1YYTRAYMAGIC.EXEYTrayMagic from YoconSoft automatically restores your tray icons after an Explorer (the windows shell) crash. Leave to run at startup since only those icons that are in the taskbar after YTrayMagic has initialized will be restoredNo
WIN UPDOATAXytsdls.exeDetected by McAfee as RDN/Generic PWS.y and by Malwarebytes as Trojan.Agent.WUNo
Y!TunnelProUYTunnelPro.exeY!TunnelPro add-on for Yahoo! Messenger from Digital Asphyxia and Chet Simpson - adds features such as enhanced privacy, custom filtering and extensive visual improvements. No longer availableNo
userinitXytvpoh.exeDetected by McAfee as Generic.bfr and by Malwarebytes as Trojan.AgentNo
yuiabctXyuiabct.exeDetected by Dr.Web as Trojan.Inject.56593No
uneriXyujixit.exeDetected by Trend Micro as WORM_SDBOT.BOONo
icifatiXyujixit.exeDetected by Trend Micro as WORM_SDBOT.ZZHNo
DuweculeyXyujixit.exeDetected by Trend Micro as WORM_SDBOT.BRPNo
sayimiciXyujixit.exeAdded by a variant of W32/Sdbot.worm. The file is located in %System%No
upyxoXyujixit.exeDetected by Trend Micro as WORM_SDBOT.BIXNo
lifyXyujixit.exeAdded by a variant of W32/Sdbot.worm. The file is located in %System%No
iyelejivXyujixit.exeDetected by Trend Micro as WORM_SDBOT.BJKNo
uwyw.exeXyujixit.exeDetected by Trend Micro as WORM_SDBOT.BGBNo
jeteXyujixit.exeDetected by Trend Micro as WORM_SDBOT.BRTNo
Windows Live MessengerXyUKTNyKxCNAAyIg.exeDetected by Dr.Web as Trojan.AVKill.24470 and by Malwarebytes as Trojan.MSILNo
Yumgo's Homepage Protector V1UYumgoHomepageProtector.exeYumgo's Homepage ProtectorNo
LIVECOMMXyupdate.exeDetected by McAfee as RDN/Ransom!do and by Malwarebytes as Backdoor.Agent.ENo
iexplorerXyupdater.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %ProgramFiles%\yahoo!\messenger but this it not the legitimate automatic updater for older versions of Yahoo! Messenger which has the same filename and location and it loads via the HKLM\Run, HKLM\RunOnce & HKLM\RunOnceEx keysNo
\YUR##.exeXYUR##.exeDetected by Malwarebytes as Trojan.Agent - where # represents a digit and the file is located in %System%No
\YUR#.exeXYUR#.exeDetected by Malwarebytes as Trojan.Agent - where # represents a digit and the file is located in %System%No
zoUlzQvPyDXYURJ51t.exe.lnkDetected by Malwarebytes as Trojan.Agent. The file is located in %AppData%\MnupDGYoNo
YvkSwmbiXyvkswmbi.exeDetected by Malwarebytes as Trojan.Agent. The file is located in %LocalAppData%\qpvdmmruNo
yvkswmbi.exeXyvkswmbi.exeDetected by Malwarebytes as Trojan.Agent. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
userinitXywcugnt.exeDetected by McAfee as Generic.bfr and by Malwarebytes as Trojan.AgentNo
Microsoft Driver SetupXywdrive32.exeDetected by Malwarebytes as Worm.Palevo. The file is located in %Windir%No
Windows Service AgentXywgma.exeDetected by Trend Micro as BKDR_RBOT.DZT and by Malwarebytes as Backdoor.Bot. The file is located in %System%No
YWjcrFuitUsqdavXYWjcrFuitUsqdav.exeDetected by Sophos as Mal/FakeAV-LI and by Malwarebytes as Rogue.Agent.SANo
Windows YWN MonitorUywnmon32.exeDetected by Malwarebytes as PUP.Optional.OpenJDKExplorer. The file is located in %ProgramFiles%\Open JDK Explorer. If bundled with another installer or not installed by choice then remove itNo
ywnmon32Uywnmon32.exeDetected by Malwarebytes as PUP.Optional.OpenJDKExplorer. The file is located in %ProgramFiles%\Open JDK Explorer. If bundled with another installer or not installed by choice then remove itNo
ywnmon32.exeUywnmon32.exeDetected by Malwarebytes as PUP.Optional.OpenJDKExplorer. The file is located in %ProgramFiles%\Open JDK Explorer. If bundled with another installer or not installed by choice then remove itNo
ywwvc.exeXywwvc.exeDetected by Sophos as Troj/StartPa-HRNo
ywzizdonXywzizdon.exeFree_Scratch_Cards foistwareNo
yxrafcbx.zipXyxrafcbx.zipDetected by Dr.Web as Trojan.DownLoader11.25730 and by Malwarebytes as Trojan.Downloader.MG. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
yxtarjsg.zipXyxtarjsg.zipDetected by Malwarebytes as Trojan.Zip. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
YY.exeXYY.exeDetected by Malwarebytes as Trojan.Agent.NR. Note - the file is located in %AllUsersStartup% and its presence there ensures it runs when Windows starts - see hereNo
yyyyyyyyyyy.exeXyyyyyyyyyyy.exeDetected by Malwarebytes as Trojan.Injector. Note - the file is located in %UserStartup% and its presence there ensures it runs when Windows startsNo
yz.exeXyz.exeDetected by McAfee as PWS-LegMir.dll and by Malwarebytes as PasswordStealer.LmirNo
Y'z DockUYzDock.exeY'z Dock by M.Yamaguchi - "is a program launcher like the dock in MacOS X. This was the first ever dock launcher made for Windows"No
YzDockUYzDock.exeY'z Dock by M.Yamaguchi - "is a program launcher like the dock in MacOS X. This was the first ever dock launcher made for Windows"No
YZHXYZH.exeDetected by Sophos as W32/LegMir-BMNo
YZH.SYSXYZH.exeAdded by the PHILIS.C VIRUS!No
Session TPM Control Compatibility PerformanceXyzhzapafx.exeDetected by McAfee as Generic.bfr!ei and by Malwarebytes as Trojan.AgentNo
YzShadowUYzShadow.exeY'z Shadow by M.Yamaguchi - 'adds a shadow effect to the windows in pursuit of the "beauty of a shadow". It also allows the user the option of making menus transparent'No
Y'z ShadowUYzShadow.exeY'z Shadow by M.Yamaguchi - 'adds a shadow effect to the windows in pursuit of the "beauty of a shadow". It also allows the user the option of making menus transparent'No
FRAMEWORKSXYZT1XPVEI2.exeDetected by McAfee as Generic Malware.mr and by Malwarebytes as Backdoor.MessaNo
YzToolBarUYzToolBar.exeY'z Toolbar by M.Yamaguchi - "allows the user to change the toolbar icons in Explorer and Internet Explorer. The user can also create and add their own themes"No
Y'z ToolbarUYzToolBar.exeY'z Toolbar by M.Yamaguchi - "allows the user to change the toolbar icons in Explorer and Internet Explorer. The user can also create and add their own themes"No
y_updaterXy_updater.exeDetected by Microsoft as TrojanSpy:Win32/Worsmep.ANo

Notes & Warnings

If you can help identify new entries and verify/identify those entries with a "?" status (especially hardware specific - such as laptops and motherboards) then please E-mail us (startups_at_pacs-portal_dot_co_dot_uk).

"Status" key:

Variables:

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. We will not be held responsible if changes you make cause a system failure.

WARNING: This is NOT a list of tasks/processes taken from the Task Manager (CTRL+SHIFT+ESC) "Processes" tab. This displays some startup programs AND other background tasks and "Services". These pages are concerned with startup programs from the common startup locations shown above ONLY. Please do not submit entries collected from this method as they will not be used. For a list of tasks/processes you should try the list at PC Pitstop, the Process Library from Uniblue or one of the many others now available.

Therefore, before ending a task/process via CTRL+SHIFT+ESC just because it has an "X" recommendation, please check whether it's in the registry or common startup locations first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+SHIFT+ESC. If in doubt, don't do anything.

To avoid the database becoming too large, all malware entries are only shown using the registry version which is common to all Windows versions. Otherwise there would be multiple entries for popular filenames that viruses often use - such as "svchost.exe" above for example. Multiple malware can also use the same start-up entries, in this case only those with significant differences (such as file location) are repeated in this database.

As more than 25K entries in this database related to malware you should use a quality internet security package. Which ever you choose, keep it updated and get the latest version at least every two years.

There are a number of virus and malware entries listed in this database where specific removal instructions haven't been given. If this is the case then you could try ComboFix, a program written by sUBs that can remove many different types of Trojans and Worms. See here for a tutorial on how to use the program.

NOTE: A number of entries are repeated due to the way that different operating systems display startup items. For example, WinMe lists "POPROXY.EXE" as "Norton eMail Protect" in both MSCONFIG and the registry whereas WinXP lists it as "Poproxy" in MSCONFIG and "Norton eMail Protect" in the registry.

SERVICES: "Services" from the Windows 8/7/Vista/XP/2K/NT operating systems are not included. We fully understand that some programs with these OS's use "Services" as an alternative to load their component parts at startup but these are handled in a different way. We recommend you try BlackViper for information on services for the relevant operating systems.

Copyright

Presentation, format & comments Copyright © 2001 - 2017 Pacman's Portal
Portions Copyright © Peter Forrest, Denny Denham, Sylvain Prevost, Tony Klein, CastleCops & Bleeping Computer
Powered by Malwarebytes
All rights reserved

Valid XHTML 1.0 Transitional

Privacy Policy Site Map Home