Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

Key:

  • L = Legit, O = Open to Debate, X = Malware/Bad
Startup Name Process Name Details
L avsinc
X avsuite (mssuite) msuite.exeAdded by the W32/Sdbot-ABC WORM! Read the link rootkit type stealth involved.
L AVSync Manager Avsynmgr.exeFrom McAfee VirusScan version 5.x. Runs VirusScan System Tray (Vsstat.exe) WebScanX (Webscanx.exe) V
X AVupdate service interface X2 (avupdate2) avupdate2.sysAdded by the Troj/Hanlo-A TROJAN! Note: This trojan file is located in the System32 folder.
L AvUpdSvc avupdsvc.exePart of Avast! anti-virus software
X “RDRIVâ€Â (rdriv) RDRIV.SYSAdded by the TROJ_ROOTKIT.E TROJAN! Read the link rootkit type stealth involved.
L B's Recorder GOLD Library General Service (bgsvcgen) bgsvcgen.exeRelated to B_H_A_Corp B' Recording Gold for CD/DVD burning and authoring software.
L Backup Exec 8.x Alert Server (BackupExecAlertServer) alertServer.exeRelated to Veritas Software backup tool.
Backup Exec 8.x Notification Server
L Backup Exec Agent Browser (BackupExecAgentBrowser) benetns.exeRelated to the Backup Exec application from Veritas http://www.liutilities.com/products/wintaskspro/
Backup Exec Device & Media Service
L Backup Exec Job Engine (BackupExecJobEngine) bengine.exeBackup service for Veritas Backup Exec. This program is essential in keeping backups up to date and
L Backup Exec Naming Service (BackupExecNamingService) benser.exeVeritas Software Corporation. This is the Backup Exec naming service which is needed in order to ach
Backup Exec Remote Agent for Windows Servers
L Backup Exec Server (BackupExecRPCService) beserver.exeRelated to Veritas Backup Exec. This program is essential in keeping backups up to date and should n
L BackupClientSvc BackupClientSvc.exeRelated to NovaNet_WEB NovaStor Corp. Online Backup Services.
L BackupLauncher) OLlaunch.exeRelated to Intuit Inc. QuickBook - http://www.intuit.com/
X bcrcogqrkyko mueyzrua5.exe
BeatJam Music Server - HTTP
L BeatJam Music Server - UPnP (BeatJamUPnPMusicServer) BeatJamUPnPService.exeSee_BeatJam Justsystem audio software BeatJam.
L Bell & Howell Database Manager (dbmang) DBMANG.EXERelated to Bell_and_Howell
L Bell & Howell Monitor Service (BHMonitorService) monitor.exeRelated to Bell_and_Howell
L BelMonitor Service (BelMonitorService) BANTMonitorSvc.exeRelated to Belarc inc.
L BES Client (BESClient) BESClient.exeRelated to BESClient by BigFix Inc
L BGS_SDService BGS_SDservice.exeRelated BMC Software Inc. - http://www.bmc.com/
L bh611 NT611SVC.EXERelated to Bell_and_Howell
L BigPond Broadband Cable Login bpcService.exeTelstra's BIGPOND_BROADBAND_CABLE
L Biometric Authentication Service DpHost.exeRelated to DigitalPersona Inc.
L BitDefender Communicator xcommsvr.exeRelated to bitdefender Antivirus
L BitDefender Desktop Update Service livesrv.exeUpdate service for BitDefender_Antivirus
L BitDefender Scan Server bdss.exeRelated to Bitdefender antivirus
L BitDefender Virus Shield vsserv.exeRelated to bitdefender (Virusshield)
Black Hole2005 Professional Version (Black Hole2005
Black Hole2005 Professional Version (Black Hole2005
L BlackICE blackd.exeBlack Ice firewall
L BlueSoleil Hid Service BTNtService.exeBlueSoleil is a Bluetooth device manager for Windows. Made by the IVT_Corporation The file associate
X Bluetooth Notification Service (Btnfserv) btserv.exeAdded by the W32/Sdbot-CSD WORM! Note: This worm rojan is located in C:WindowsSystem (Win9x/Me) C:%W
L Bluetooth Service btwdins.exeBluetooth Service
L bobo momopanda platinium antivirus
L Boeing Permissions Elevator elevate.exeThe Boeing Company (internal use)
L Boingo Monitor Service wmonitor.exeBoingo's Free_Wi-Fi_Software
L Bonjour Service mDNSResponder.exeCreate's a network of computers and smart devices. Made by Apple Computer Inc. For more information
X BoolTern (BoolTern) svch0st.exeAdded by the W32/Tilebot-U WORM! Note: This (svch0st.exe) is not the legitimate Windows process (Whi
X Boonty Games Boonty.exeBoonty_Games Used with Boonty box. Will not uninstall from Add/Remove programs. This is from their P
L Broadcom ASF IP monitoring service v3.0.1 basfipm.exeRelated to Broadcom communications - hardware.
Brother BidiAgent Service for Resource manager
L Brother Popup Suspend service for Resource manager Brmfrmps.exeBrother printer related
X Browser svchost.exe -k BrowserAdded by the Fuwudoor TROJAN!
L BrSplService brsvc01a.exerelated to Brother Industries Ltd
L BT Modem Lock ModemLock.exeRelated to NetProtector Parental control.
L BUFFALO Wireless Configuration Service (bwcsrv) bwcsrv.exeRelated to BUFFALO_Wireless Configuration Service Note: Located in C:WINDOWSSystem32Drivers
L Buffalo Wireless Service (BWSVC) bwsvc.exeRelated to Buffalo_Wireless_Service The Multimedia Combo Set by SANSUN Industries. Note: Located in
L BullGuard Email Monitoring (BsMailProxy) svchost.exeRelated to BullGuard Antivirus. Note: located in C:Program FilesBullGuard Software
L BullGuard File Monitoring (BsFileSpy) svchost.exeRelated to BullGuard Antivirus. Note: located in C:Program FilesBullGuard Software
L BullGuard Firewall (BsFirewall) svchost.exeRelated to BullGuard Antivirus. Note: located in C:Program FilesBullGuard Software
L BullGuard LiveUpdate (BGLiveSvc) BullGuardUpdate.exeRelated to BullGuard Antivirus. Note: located in C:Program FilesBullGuard Software
L BullGuard Main (BGMainSvc) svchost.exeRelated to BullGuard Antivirus. Note: located in C:Program FilesBullGuard Software
X BusinessC (BusinessContinuity) msstl.exeAdded by the SDBOT.CJR WORM! Read the link rootkit type stealth involved.
L Bytemobile Web Configurator (bmwebcfg) bmwebcfg.exeRelated to Bytemobile Inc. Mobile Content Filtering.
O C-DillaCdaC11BA CDAC11BA.EXEcopy protection software
L C-DillaSrv CDANTSRV.EXEC-Dilla License Management software from MacroVison
L CA ISafe isafe.exeRelated to Computer Associates virus software.
L CA License Client lic98rmt.exeComputer Associates
L CA License Server lic98rmtd.exeComputer associates
L CA Pest Patrol Realtime Protection Service (ITMRTSVC) ITMRTSVC.exeRelated to CA_Pest_Patrol Realtime Protection Service Note: Located in C:Program FilesCAPPRTin
L CachemanXP CachemanXP.exeCachemanXP Memory Manager
L CAILI caili.exerelated to CarryIco Software installed by a flash card reader driver setup utility.
L Canon BJ Memory Card Manager Bjmcmng.exeCanon Bubblejet Memory Card Utility
L Canon Camera Access Library 8 (CCALib8) CALMAIN.exeCanon digital camera software that provides additional configuration options for the devices.
L Canon Driver Information Assist Service CnxDIAS.exeCANON Driver Information Assist Core Module. This file should be found in the Program FilesCanonDIAS
L Canon PIXMA iP6000D Memory Card Manager PDUiP6000DMemCrdMgr.exeRelated to Canon PIXMA iP6000D Bubble Jet printer
L Capture Service (CaptureService) CaptureService.exeRelated to Impact_360 from Witness Systems Inc. Workforce management. Note: Located in C:WINDOWSsyst
L Carbon Copy Scheduler (CarbonCopyScheduler) schdsrvc.exeRelated to Alteris services. http://www.altiris.com
L CarboniteService carboniteservice.exeRelated to Carbonite_online_backup automatically backs up all the the files on your computer.
X Card Adapter (NETDown) smss.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This is not the legitimate Windows Proce
X Cdsys (Cdsys) cdcd.sysAdded by the Troj/Agent-IA TROJAN! Note: This trojan file is found in the System32 folder.
CE-Infosys Security System (CE-Infosys Security
L CeEPwrSvc CeEPwrSvc.exeRelated to TOSHIBA and COMPAL ELECTRONIC INC.
L CentennialClientAgent CAgent32.exeRelated to Centennial UK Limited - http://www.centennial.co.uk/
L CentennialIPTransferAgent xferwan.exeRelated to Centennial UK Limited - http://www.centennial.co.uk/
L cFosSpeed System Service (cFosSpeedS) spd.execFos_Software Internet acceleration program related. Note: May be necessary for the software to work
X change me please (VIRUS) sysdat.exeAdded by the W32/Tilebot-L WORM!
O Charter High-Speed Security Suite SERVIC~1.EXERelated to F-Secure Backweb application
X chckntfs chckntfs.exeAdded by the W32/Tilebot-EF WORM! Note: This worm rojan is located in C:%WINDIR%
X chkext(chkext) (chkext) chkext.exeAdded by the W32/Sdbot-CRW WORM! Note: This worm rojan is located in C:WindowsSystem (Win9x/Me) C:%W
X Chong3 Me (MlCR0SOFTS UPDATE) N0RTAN.EXEAdded by the SDBOT.CNM WORM! Read the link rootkit type stealth involved.
X Chong3 Me (MlCR0SOFTS UPDATEe) lexplarer.exeAdded by the SDBOT.CWB WORM! Read the link rootkit type stealth involved.
L cics.REGION1 cicssvc.exeRelated to IBM Corp.
L cics.REGION2 cicssvc.exeRelated to IBM Corp.
L cicssfs.SCMMC223 cicssfssvc.exeRelated to IBM Corp.
L cidaemon cidaemon.exeMicrosoft Indexing Service filter daemon
L cidaemon .exeMicrosoft Indexing Service filter daemon
L Cisco Configuration Service (CCS) ccs.exeRelated to Related to Cisco_Systems Note: Located in C:WINDOWSsystem32
L Cisco Systems Inc. STC Agent (STCAgent) agent.exeRelated to Cisco Systems inc. SSL VPN Client Note: located in C:Program FilesCisco SystemsSSL VPN Cl
L Cisco Systems Inc. VPN Service cvpnd.exepart of Cisco VPN
L Citrix CPU Utilization Mgmt/CPU Rebalancer (CTXCPUBal) ctxcpubal.exeRelated to Citrix MetaFrame
L Citrix CPU Utilization Mgmt/Resource Mgmt (ctxcpuSched) ctxcpusched.exeRelated to Citrix MetaFrame
Citrix CPU Utilization Mgmt/User-Session Sync
L Citrix Print Manager Service (cpsvc) CpSvc.exeRelated to Citrix MetaFrame control Printer Management.
L Citrix SMA Service SmaService.exeRelated to Citrix MetaFrame
L Citrix Virtual Memory Optimization CtxSFOSvc.exeRelated to Citrix MetaFrame Monitors all DLLs on a server to find where collisions are occurring
L Citrix WMI Service (CitrixWMIService) ctxwmisvc.exeRelated to Citrix MetaFrame
L Citrix XML Service (CtxHttp) ctxxmlss.exeRelated to Citrix MetaFrame
L Citrix XTE Server (CitrixXTEServer) XTE.exeRelated to Citrix MetaFrame
L CL500_510 Remote Server KaNTSRV.exeRelated to Panasocic_Color_Laser_Printer server. Note: Located in C:PROGRAM FILESPANASONICREMOTE SER
L Client Network (CdmService) cdmsvc.exeRelated to Citrix MetaFrame maps client drives and peripherals for access in ICA sessions.
X Client Server Runtime Proces csrss.exeAdded by the WORM_SDBOT.BTI WORM! Note: This worm rojan is located in C:%WINDIR% folder. Malicious a
L Client Server Runtime Process csrss.exeMicrosoft Client Server Runtime Process
X Client Server Runtime Service (csrss32) csr.exeAdded by the W32/Sdbot-AFM WORM! Note: This worm file is found in the Windows or Winnt folder.
L Client Update Service for Novell cusrvc.exeRelated to Novel server.
L Cliente de seguimiento de vinculos distribuidos services.exeSpanish Windows 2000 distributed links tracking client
L Cliente DHCP services.exeSpanish Windows 2000 DHCP client
L Cliente DNS services.exeSpanish Windows 2000 DNS client
X Clients Server Runtime Process csrss.exeAdded by the W32/Sdbot-CPF WORM! Note: This worm rojan is located in C:%WINDIR% This is not the legi
X Clients Server Runtime Process (Windows Internet) csrss.exeAdded by the W32/Sdbot-CPF WORM! Note: This worm rojan is located in C:%WINDIR% folder.
X clmss (Content List Management Sub System) clmss.exeAdded by the W32/Tilebot-AO WORM! Note: This worm file is found in the Windows or Winnt folder. Read
X Codec WINCODEC.EXEAdded by the SDBOT.CJO WORM! Read the link rootkit type stealth involved.
L Cognos ReportNet cogbootstrapservice.exeRelated to Cognos_ReportNet Business Intelligence software. Note: located in C:Program FilesCognoscr
L ColdFusion Graphing Server JRun.exeRelated to MacroMedia_ColdFusion products. Made by MacroMediaInc.
ColdFusion Management Repository Server (ColdFusion
L ColdFusion Management Service CANamingAdapter.exeRelated to MacroMedia_ColdFusion products. Made by MacroMediaInc.
L ColdFusion Monitoring Service (ClusterCATS Service) ccmgr.exeRelated to MacroMedia_ColdFusion products. Made by MacroMediaInc.
L ColdFusion MX Application Server jrunsvc.exeRelated to Macromedia Cold Fusion software.
L ColdFusion MX ODBC Server swstrtr.exeRelated to Macromedia Cold Fusion software.
L COM Host comHost.exeRelated to Norton/Symantec Internet Security
X COM Message Transfer (mscommt) svchost.exe -k mscommtAdded by the Troj/Dbit-A TROJAN!
X COM+ Component Service (COMCSVC) winmgnt.exeAdded by unknown malware the file winmgnt.exe may be a Serv-U FTP server used to download other mali
X COM+ Messages svchosts.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This worm rojan is located in C:WindowsS
X COM+ System Service (COMSS) SSMS.EXEAdded by unknown malware. File location is in the System32 folder.
X COM+ System Service (DLLHOST) dllhost.exeAdded by the Backdoor.Win32.SdBot.xd as identified by Kaspersky TROJAN! Note: This worm rojan is loc
X Command Service (cmdService) command.exeAdware
L CommServer CommSvr.exeRelated to the HiPath 1220 digital PBX system from Siemens. For more information Click_Here File loc
L Comodo Application Agent (CmdAgent) cmdagent.exeRelated to Comodo_Firewall from Comodo. Note: Located in C:Program FilesComodoFirewall
L Compaq Advisor compaq-rba.exeRelated to Compaq
L Compaq DMI Web Agent WebDmi.exeRelated to Compaq Computer.
L Compaq Local Alerter cpqalert.exeRelated to Compaq Computer. Allows for fault performance and configuration management. Recommended f
O Compaq Remote Diagnostics Enabling Agent Cpqdfwag.exeRelated to Compaq diagnostics utility.
X Compatibil) svchost.exeAdded by the Troj/Keylog-AT TROJAN! Note: This is not the legitimate Windows process svchost.exe (Wh
L Compuware Open Server cwjboss.exeCompuware Serversoftware
X comrepl comrepl32.exeAdded by the W32/Rbot-DNH WORM! Note: This worm rojan is located in C:%WINDIR% folder.
X comrepl comreplsvc.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This worm rojan is located in C:%WINDIR%
X Config Loader scvhost.exeseveral Agobot variants
L ConfigFree Service CFSvcs.exeToshiba related
X Configuration Loader (bF) wincrt32.exeVirus and Trojan tools. http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_AGOBOT.
X Configuration Loading svchos1.exeseveral Agobot variants
L Connected Agent Service (AgentSrv) AgentSrv.EXERelated to Connected Corporation. - http://www.connected.com/
L Connected Launcher CBlaunch.exeConnected backup software
L Connected RegCap CBRegCap.EXEConnected backup software
X Connection Rese webadmin.exeW32/Forbot-FY adds this with a display name of Website Administrator Info.
L Content Index service cisvc.exeMicrosoft Content Index service
L Content Monitoring Tool msCMTSrvc.exeCompaq CMTS
L ContentProtect (CwCpSvc20) cwsvc.exeRelated to ContentWatch Parental Control Internet Filter.
L Contivity VPN Service Extranet_serv.exeRelated to Novel server.
L Contour Shuttle Device Engine (ShuttleEngine) ShuttleEngine.exeRelated to Contou_Design
L COSIDS_TB TbMux32.exeRelated to http://www.transaction.de/
O coste martinr.coste@neuf.frantivirus
Cox High Speed Internet Security Suite System Service
X cpanelx (Microsoft Control Panel) cpanelx.exeAdded by a variant of the W32/SDBOT WORM! Note: This worm file is found in the Windows or Winnt fold
L cpqdmi cpqdmi.exeCompaq version of the Desktop Management Interface
L CQG Installation Service cqginsts.exeRelated to CQG Inc. CQG provides extensive historical data online for charting and technical analysi
L crauto crauto.exeBackground task of the Paragon Encrypted Disk software which enables you to have encrypted virtual h
L Creative Labs Licensing Service CreativeLicensing.exeRelated to Creative Labs Licensing Service. Note: located in C:Program FilesCommon FilesCreative Lab
L Creative Service for CDROM Access CTsvcCDA.exeCreative Service for CDROM Access
X crss32.exe crss32.exeAdded by the W32/Tilebot-GT WORM! Note: This worm rojan is located in C:%WINDIR%
L Crypkey License crypserv.exeCrypKey Software Licensing System from Cobalt Systems
L Cryptainer service (ssoftservice) ssoftsrv.exeOwner:Cypherix Cypherix Encryption Software
X Cryptic Protected Storage (CryptProtectedService) cpstorage.exeAdded by the W32/Tilebot-HO WORM! Note: This worm rojan is located in C:WindowsSystem (Win9x/Me) C:%
X Cryptographic Engine (EngSvc) csvc.exeAdded by an unidentified TROJAN! Note: of the Win32/Rbot Family. Note: This worm rojan is located in
L Crystal Cache Server cacheserver.exeCrystal Decisions Cache Server
L Crystal Event Server EventServer.exeCrystal Decisions Event Server
L Crystal Input File Repository Server inputfileserver.exeCrystal Decisions File Repository Server
L Crystal Management Server CrystalMS.exeCrystal Decisions Management Server
L Crystal Output File Repository Server outputfileserver.exeCrystal Decisions Output File Repository Server
L Crystal Page Server (pageserver) pageserver.exeRelated to Crystal Decisions Page Server. Now owned by Business_Objects Note: Located in C:Program F
L Crystal Program Job Server ProgramServer.exeCrystal Decisions Job Server
L Crystal Report Application Server crystalras.exeCrystal Decisions Report Application Server
L Crystal Report Job Server JobServer.exeCrystal Decisions Report Job Server
L Crystal Web Component Server (WebCompServer) WebCompServer.exeRelated to Crystal Decisions Enterprise software. Now owned by Business_Objects Note: Located in C:P
X CTI Central Management cti.exeLowers IE security settings
L Curtains for Windows System Service (CurtainsSysSvc) CurtainsSysSvcNt.exeRelated to Authentium Inc. http://www.authentium.com/
L CVSNT 2.5.01.1927 Dispatch service (cvsnt) cvsservice.exeRelated to CVS_on_NT service Machines. From March Hare Software. Note: Located in C:Program FilesCVS
L CVSNT 2.5.01.1927 locking service (cvslock) cvslock.exeRelated to CVS_on_NT service Machines. From March Hare Software. Note: Located in C:Program FilesCVS
L CWAFAdminController CWAFAdminController.exeCompuware Seversoftware
L CWAFAdminMonitor CWAFAdminMonitor.exeCompuware Serversoftware
L CWAFEventRouter cwafservice.exeCompuware Serversoftware
L CWAFNotesService CWAFNotesService.exeCompuware Serversoftware
L CWAFReportScheduler CWAFSchedService.exeCompuware Serversoftware
L CWAFRmiRegistry CWAFRmiRegistry.exeCompuware Serversoftware
L CWShredder Service CWShredder.exeCWShredder tool from Trend Micro.
L CXPT_Service - Cyberspace Headquarters LLC wcservice.exeRelated to Internet_Security Suite from COSMI Corp.
L CyberArmor Run Service casvc.exeCyberArmor an Enterprise Class Personal Firewall
L Cyberhawk CHService.exeRelated to Cyberhawk from Novatix Protects against Viruses Spyware Identity Theft. Note: Located in
L CyberLink Background Capture Service (CBCS) (CLCapSvc) CLCapSvc.exeRelated to CyberPower Systems Inc. - http://www.powercinema.com/english/index.jsp
L CyberLink Media Library Service CLMLServer.exeRelated to CyberPower Systems Inc. - http://www.powercinema.com/english/index.jsp
L Cyberlink RichVideo Service(CRVS) (RichVideo) RichVideo.exeCyberLink RichVideo is an advanced technology designed to save precious video editing time.
L CyberLink Task Scheduler (CTS) (CLSched) CLSched.exeRelated to CyberPower Systems Inc. - http://www.powercinema.com/english/index.jsp
L CYGWIN cygserver (cygserver) cygrunsrv.exeRelated to Cygwin_RedHat powerful tools to assist developers in migrating applications from UNIX®/Li
L CypressLink CypressLinkService.exeRelated to Related to CypressViewer from Siemens. Medical software. Note: Located in C:Program Files