Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

Key:

  • L = Legit, O = Open to Debate, X = Malware/Bad
Startup Name Process Name Details
L SQLSERVERAGENT sqlagent.EXERelated to Microsoft SQL Server
X sqlsrvd (sqlsrvdaemon) _sqlexec.exePossible new variant of W32.Spybot.NLX. Location: C:Windows (9XXP) or C:Winnt (NT2000). See Symatec
L SRS Labs License Service srslabslicenseservice.exeRelated to SRS_Labs Audio Service. Note: Located in C:Program FilesCommon FilesSRS Labs Shared
X ssdfghjkl NETDDF.EXEAdded by the SDBOT.BXN WORM! Read the link rootkit type stealth involved.
X ssms SMSS.EXEAdded by the SPYBOT.ADJ WORM! Note: This is not the legitimate Windows process SMSS.EXE (Which is al
L SSO Plus pgpwdmon.exehttp://www.passgo.com/products/sso/index.shtml
X SSODL: eplrr eplrr3.dllhijacker/trojan
X SSODL: Sysctl Desktop Handler ntosv.dllseems to replace the users desktop with an error message regarding spyware
X SSODL: SystemCheck2 vbsys2can also be vbsys/vbsys2 with or without .exe extension. trojan related
L ssrvc ssrvc.exeProgram from Advanced Systems International SAC regarding usb removable storage devices For more inf
X Standalone.exe (Standalone) standalone.exeAdded by the W32/AGOBOT-ADS WORM! Note: Located in C:WindowsSystem (Win9x/Me) C:%WINDIR%System32 (XP
X starter (Protector) scvhostingg.exeAdded by the W32/Forbot-FB WORM!
L StarWind iSCSI Service (StarWindService) StarWindService.exeStarWindService.exe is a process which belongs to Alcohol 120% DVD/CD emulation and burning software
X stchost.exe (moto) stchost.exeAdded by the Troj/Vixup-L TROJAN! Note: This trojan file is found in the Windows or Winnt folder.
Steganos Live Encryption Engine (Version 503) [Service]
L STI Simulator PAStiSvc.exeRelated to STI_Simulator From SystemsTech. Note: Located in C:WINDOWSSystem32
L stllssvr stllssvr.exeRelated to SureThing_CD_Labeler from MicroVision Development Inc. designed for MP3 and DVD buffs Not
L STOPzilla Local Service szntsvc.exeStopzilla Popup Blocker
L STOPzilla Service SZServer.exeRelated to STOPzilla service.
L Streamload Service (StreamloadService) StreamloadService.exeRelated to Streamload_Service from Streamload Inc. Backs up your files and syncs files between compu
L stunnel aa-stunnel.exeRelated to Stunnel encrypt arbitrary TCP connections inside SSL (Secure Sockets Layer)
L StyleXPService StyleXPService.exeRelated to StyleXP a skinning program for Windows XP
X Sub-system Resource) MSVISI.exeAdded by the W32/Tilebot-EY WORM! Note: This Spyware worm is found in the Windows or Winnt folder.
L Sun One Administration Server 5.2 (admin52-serv) ns-httpd.exeRelated to Sun_One Administration server
Sun ONE Directory Server 5.2 (config52)
L Sun ONE Directory Server 5.2 (data52) (slapd-data52) ns-slapd.exeRelated to Sun_One directory server
L Sun ONE Web Server 6.1 (https-NASSRY) (https-NASSRY) webservd-wdog.exeRelated to Sun_ONE_Web_Server from Sun Microsystems inc. Note: located in C:SunWebServer6.1inhttps
Sun ONE Web Server 6.1 Administration Server
L Super Ad Blocker Service SABSVC.EXERelated to SuperAdBlocker.com
X svahost svahost.exeAdded by the Backdoor.Win32.SdBot.aad as identified by Kaspersky TROJAN! Note: This worm rojan is lo
X SVC Module (SVC Module) svchost.exeAdded by the W32/Sdbot-ADG WORM! Note: This is not the legitimate Windows Process. (Which is found i
X svchoct.exe (yuto) svchoct.exeAdded by the Troj/Sdbot-LI TROJAN! Note: located in C:Windows (Win9x/MeXP) C:Winnt (WinNT/2K)
X svchost SVCHOST.EXEAdded by the SDBOT.CNK WORM! Note: This is not the legitimate Windows process svchost.exe (Which is
L svchost inetdll.exeUnknown to me...
X svchost.exe (moto) svchost.exeAdded by the Troj/Agent-MD TROJAN! Note: This worm rojan is located in C:%WINDIR%
X svchost.exe (moto) (Random 18-character filename)Added by the Troj/Agent-MD TROJAN!
X svchost.exe (svchost.exe) svchost.exeAdded by the Troj/GrayBird-X TROJAN! Note: This trojan file is found in the Windows or Winnt folder.
X svice txkernel.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This worm rojan is located in C:Windowsi
X SVKP (SVKP) SVKP.sysAdded by the W32/Rbot-AGP or W32/Spybot-FB or W32/Rbot-AJR WORM!
L Sweep for Windows NT Network SWNETSUP.EXESophos AntiVirus Sweep Service
L Sweep for Windows NT Update SWUPDATE.EXESophos AntiVirus Update Service
L SwiftPublish Authorization Service spauthserv.exeRelated to SwiftView Inc.
L Swupdtmr swupdtmr.exeRelated to Toshiba Software Update Manager. Handles the updating of software.
X SX Service (SXServ) sxserv101.exeAdded by the Windir_SXS TROJAN! Note: This worm rojan is located in C:WindowsSystem (Win9x/Me) C:%WI
L Sybase EP Management Agent sybjsvc.exeRelated to EP_Management_Agent from Sybase. Note: Located in C:Program FilesSybaseshared-1_0in
L Sygate Personal Firewall smc.exeRelated to Sygate Firewall.
L SyGateService (SaService) sgserv.exeRelated to Sygate Technologies now owned by Symantec.
L Symantec AntiVirus Rtvscan.exeRelated to Symantec AntiVirus
L Symantec AntiVirus Client Rtvscan.exeSymantec Internet Security Suite
L Symantec AntiVirus Definition Watcher DefWatch.exeRelated to Symantec AntiVirus Software.
L Symantec AppCore Service (SymAppCore) AppSvc32.exeRelated to Symantec_AppCore Service. Note: Located in C:Program FilesCommon FilesSymantec Shared
L Symantec Central Quarantine (qserver) qserver.exeRelated to Norton/Symantec AntiVirus.
L Symantec Client Firewall Proxy Service (SymPxSvc) SymPxSvc.exeRelated to Symantec_Client_Firewall Note: Located in C:Program FilesSymantec_Client_SecuritySymantec
L Symantec Core LC symlcsvc.exeRelated to Norton/Symantec Anti-Virus.
L Symantec Event Manager (ccEvtMgr) ccEvtMgr.exeRelated to Norton/Symantec AntiVirus
L Symantec Ghost Client Agent ngctw32.exeRelated to Norton/Symantec AntiVirus.
L Symantec Ghost Database Service (ngdbserv) dbserv.exehttp://castlecops.com/s855-dbserv_exe.html
L Symantec Ghost Win32 Configuration Server (NGServer) ngserver.exeSymantec/Norton Ghost Console service http://castlecops.com/s2476-ngserver_exe.html
L Symantec IS Password Validation (ISPwdSvc) isPwdSvc.exeRelated to Symantec_IS_Password Validation service. Note: Located in C:Program FilesNorton AntiVirus
L Symantec Lic NetConnect service (CLTNetCnService) ccSvcHst.exeRelated to Symantec_Lic_NetConnect service. Note: Located in C:Program FilesCommon FilesSymantec Sha
Symantec Licensing Detect Internet Connection
L Symantec LiveState Agent for Windows ccmagent.exeRelated to Symantec Incorporated
L Symantec LiveState Recovery VProSvc.exeRelated to Symantec Norton Ghost Note: Located in C:Program FilesSymantecLiveState RecoveryAdvanced
L Symantec Network Drivers Service (SNDSrvc) SNDSrvc.exeSymantecd related
L Symantec Network Proxy ccProxy.exeSymantec Network Proxy
L Symantec Password Validation (ccPwdSvc) ccPwdSvc.exeRelated to Norton/Symantec AntiVirus.
L Symantec Proxy Service ccPxySvc.exeRelated to Norton proxy service
L Symantec Quarantine Agent (IcePack) IcePack.exeRelated to Norton/Symantec AntiVirus.
L Symantec Quarantine Scanner (ScanExplicit) ScanExplicit.exeRelated to Norton/Symantec AntiVirus.
L Symantec SecurePort (SymSecurePort) SymSPort.exeRelated to Norton/Symantec AntiVirus.
L Symantec Settings Manager (ccSetMgr) ccSetMgr.exeRelated to Norton/Symantec AntiVirus.
L Symantec SPBBCSvc (SPBBCSvc) SPBBCSvc.exeSymantec Internet Security Service
L Symantec System Center Discovery Service (NSCTOP) NSCTOP.EXERelated to Symantec Corp.
L SymWMI Service SymWSC.exeRelated to Norton/Symantec AntiVirus.
X Syscheck (Syscheck) csrss.exeAdded by the Troj/LdPinch-AL TROJAN! Note: This is not the legitimate Windows process csrss.exe (Whi
X sysmgr64 sysmgr64.exeAdded by the Backdoor.SdBot.xd WORM! as detected by ewido. More here
X sysServer2.0 (sysServer2.0) G_Server2.0.exeAdded by the Troj/Feutel-AK TROJAN! Note: This trojan file is found in the Windows or Winnt folder.
X systeerm (systeerm) systeerm.exeAdded by the Troj/Singu-V TROJAN! Note: This trojan file is found in the Windows or Winnt folder.
? System Commander MBR check WINMBR.EXE
X System Distribution Controller (distribcontrol) disctrl.exeAdded by the W32/Rbot-GAM WORM! Note: Located in C:WindowsSystem (Win9x/Me) C:%WINDIR%System32 (XP/W
X System Driver Service (systemdriver) sysdriver.exeAdded by the W32/Tilebot-GA WORM! Note: This worm rojan is located in C:WindowsSystem (Win9x/Me) C:%
X System Event Dispatcher sgvrfy32.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This worm rojan is located in C:WindowsS
X System Event Messaging svchost.exeSeems to be viral
X System Event Notification Service lsass.exeAdded by the Troj/Agent-AD TROJAN!
X System Internal AntiVirus (SVSAV) svsnt.exeAdded by the Worm/Sdbot.40448.22 WORM! Note: This worm rojan is located in C:WindowsSystem (Win9x/Me
X System Manager Service (SMSC) smsc.exeAdded by the W32/Sdbot-ADY WORM! Note: This worm rojan file is found in the Windows or Winnt folder.
X System Messenger Service (WINSMSC) smsc.exeAdded by the W32/Tilebot-F WORM! Read the link rootkit type stealth involved.
L System Mld (MldServ) sysmlds.exeSee Here
X System Mng Srvc (SMSG) smsg.exeAdded by the W32/Tilebot-AB TROJAN! Note: This trojan file is found in the Windows or Winnt folder.
X System Out systemout.exeTrojan-Spy.Win32.Delf.du
X System Process Monitor (sysprcm) msnprcss.exeAdded by ServiceThreadHandler.Process TROJAN! Note: located in C:WINDOWSSystem32
X System Restore Services lsiss.exeAdded by the W32/Tilebot-HN WORM! Note: This worm rojan is located in C:WindowsSystem (Win9x/Me) C:%
X System Server (System Server) smss.exeAdded by the Troj/Feutel-T TROJAN! Note: This is not the legitimate Windows Process smss.exe. (Which
X system server (system server) MSpass.exeAdded by the Troj/Lineage-BG TROJAN! Note: This trojan file is found in the Windowshelp or Winnthelp
X System Service Monitor (servicemon) servicemon.exeAdded by the W32/Tilebot-GH WORM! Note: This worm rojan is located in C:WindowsSystem (Win9x/Me) C:%
X System Spooler Host services.exeAdded by the W32/Sdbot-COV WORM! Note: This worm rojan is located in C:Windowscursorsmstask (Win9x/M
X System Spooler Host syspool.exeAdded by the W32/Sdbot-COV WORM! Note: This worm rojan is located in C:WindowsSystemdllcache (Win9x/
X System Startup Service (SvcProc) svcproc.exeIdentified as Trojan.Win32.Stervis.b and usually bundled with nail.exe a Abetterinternet adware vari
L System Update (SUService) suservice.exeRelated to Levolo System_update Thinkpad from IBM. More Note: Located in c:program fileslenovosystem
X system32 (system32) system32.exeAdded by the Troj/GrayBird-U TROJAN! Note: This trojan file is found in the Windows or Winnt folder.
X systemboot (systemboot) System.exeAdded by the SDBOT.CDM WORM! Read the link rootkit type stealth involved.
X SystemManager SYSMANAGER.EXEAdded by the SDBOT.CGG WORM! Read the link rootkit type stealth involved.
L Systems Management Data Manager (dcstor32) dcstor32.exeRelated to Dell Open Management system. http://www.what-process.com/process-info.aspx?p=dcstor32.exe
L Systems Management Event Manager (dcevt32) dcevt32.exeRelated to Dell Open Management system. http://www.what-process.com/process-info.aspx?p=dcevt32.exe
L SystemSuite Task Manager MXTask.exeRelated to Ontrack Inc.
X sytem32 (sytem32) svost.exeAdded by the Troj/Feutel-Z TROJAN! Note: This trojan file is found in the Windows or Winnt folder.
L TabletService Tablet.exeRelated to Wacom Technology Corp.
L TabletServiceWacom Wacom_Tablet.exe

is used by wacom tablets which are very common with artists

L Talking Alarm Clock user logon monitor AlarmMonitor.exeRelated to Cinnamon software inc. http://www.cinnamonsoftware.com/
L Tango Service TangoService.exeRelated to Efficient Networks by Siemens
L TapeWare TWWINSDR.EXERelated to Yosemite_Technologies TapeWare backup system.
L Tardis time service tardisnt.exeTardisNT time sync service.
L Tarjeta inteligente SCardSvr.exeSpanish Windows 2000 smartcard
X Task Manager Help (TskHlp) taskmgr.exeBackdoor.ServU-based : Location: C:wutemp askmgr.exe Note: The Windows file taskmgr.exe is located i
L Task Manager Lite TSKMAN.exeEntry is related to PC Phone Home by Brigadoon Security Group. For more info Click_Here
X Task Manager Message Service (TSKMS) taskms.exeAdded by the Worm/Aimbot.ER WORM! Note: This worm rojan is located in C:%WINDIR% Steal Information
X Tasker) eiRecvr.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This worm rojan is located in C:%WINDIR%
X TASKESV (TESV) taskcntr.exeAdded by the W32/Tilebot-S WORM! Note: This worm rojan file is found in the Windows or Winnt folder.
X taskmng (svchost) svchost.exeAdded by the W32/Tilebot-AW WORM! Read the link rootkit type stealth involved.
L Tb2 Launch (Tb2Launch) tb2launch.exeRelated to Timbuktu_Pro Remote Control Software
L tbaspi tbaspi.exeRelated to Voyetra_Turtle_Beach Audio and Video products.
X TCP and UDP Supp0rt tccpip.exeAdded by the Trojan.BHOPlugin/Terp.Process TROJAN! Note: Located in C:WindowsSystem (Win9x/Me) C:%WI
X TCP and UDP Support tcpip.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This worm rojan is located in C:WindowsS
L TCP/IP Print Server tcpsvcs.exetcpsvcs.exe is a part of Microsoft Windows networking components. This essential system process is i
X TCP/IP Printer Helper (tcpprint) prinsvc.exeAdded by an unidentified TROJAN! Note: of the Win32/Rbot Note: This worm rojan is located in C:Windo
X TCPIP route manager (internat) internat.exeAdded by the Troj/Lydra-R TROJAN! Note: This trojan file is found in the Windows or Winnt folder.
X TCPIPSTACK TCPIPSTACK.EXEAddec by the W32/Sdbot-CPO WORM! Note: This worm rojan is located in C:%WINDIR% folder.
X TCPservice (msftcpip) msftcpip.sysAdded by the Troj/Haxdoor-AI TROJAN!
X TdiHook Update Driver (_tdiserv_HOOK) TdiUpdate.sysAdded by the W32.Tdiserv.A WORM! Read the link rootkit type stealth involved.
X tdongbot (tdongbot) Internet.exeAdded by the Backdoor.Sdbot.AS TROJAN! Note: This trojan file is found in the System32 folder.
L technology by Sony DADC (UserAccess) useraccess.exeRelated to Sony DADC Blu-ray Disc is the next generation optical disc format.
L Telnet tlntsvr.exeSpanish Windows 2000 telnet
L Tenebril antispyware satellite (TNBRLDS) DeleteSvc.exeAnti-spyware satellite is part of the Tenebril SpyCatcher application. Made by Tenebril Inc. For mor
X Terminal Connections (terms) terminals.exeAdded by the Backdoor.SdBot.xd as identified by ewido. TROJAN! Note: This worm rojan is located in C
X The Sims 2 thesims2.exeAdded by the W32/Sdbot-CPM WORM! Note: This worm rojan is located in C:%WINDIR%System32dllCache (XP/
L ThinkPad Modem Service (ThinkPadModemService) MWMDMSVC.EXEIBM ThinkPad Modem Software - http://www.fileproperties.com/m/mwmdmsvc.exe.htm
L ThinkVantage System Update (UCLauncherService) UCLauncherService.exeRelated to Lenovo ThinkVantage Technologies. ThinkVantage Technologies help make ThinkPad/ThinkCentr
X this change me (trojans) realplayers.exeAdded by an unidentified TROJAN! of the Sdbot family. Note: This worm rojan is located in C:%WINDIR%
L THKEYS thkeys.exeRelated to Toshiba_Applet_Hotkeys Note: Located in C:Program FilesToshibaToshiba Applet
L THotkey THOTKEY.EXERelated to The Fn keys on Toshiba laptops
L TI Wlan Service tiwlnsvc.exeRelated to Texas Instruments wireless LAN software.
X Time Service (Time) dior4f4gbwnewofas.exeAdded by the HackerDefender SDBot TROJAN! ROOTKIT INFECTION Note: This worm rojan is located in Note
L TIS 2000 Apache Web Server ApchT2kW.exeRelated to Apache web server - http://www.apache.org/
L TiVo Beacon TiVoBeacon.exeRelated to TiVo Inc. TV entertainment.
L TMA Distribution lcfinst.exeRelated to Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicati
L TME3SRV tme3srv.exeRelated to Toshiba Inc. notebooks
L Tmesbs32 Tmesbs32.exeRelated to Toshiba Corporation
L Tmesrv3 Tmesrv31.exeRelated to Toshiba Corporation
L Tomcat (cws3) (Tomcatcws3) tomcat.exeRelated to Apache_tomcat Owner: Alexandria Software Consulting
L Tornado Registry wtxregds.exeThis registry allows the Tornado tools to establish a connection with the target servers.
L TOSHIBA Application Service TAPPSRV.exeRelated to Toshiba Inc. notebooks
L TOSHIBA Bluetooth Service TosBtSrv.exe

ThpSrv.exe

Related to The Toshiba_HDD_Protection TOSHIBA HDD Protection&hl=en&lr=lang_en|lang_fr system is an i
L TOSHIBA Optical Disc Drive Service (TODDSrv) TODDSrv.exeRelated to Toshiba_Optical_Disk_service RAID Backup utility. Note: Located in C:WINDOWSsystem32TODDS
L TOSHIBA RAID Service (kraidsvc) kraidsvc.exeRelated to Toshiba_Raid_Service Note: Located in C:Program FilesTOSHIBATOSHIBA RAIDService
X Trace network connections (ACCRA) mocih.exeAdded by the Chimo.B TROJAN!
L Track-It! Remote Control wuser32.exeRelated to Quicken/Intuit Inc. - http://www.quicken.com/
L Track-It! Workstation Manager TIRemoteService.exeRelated to Quicken/Intuit Inc. - http://www.quicken.com/
L Transcoding and Broadcast Service (Transcode360) transcode360.exeTranscode360 Designed for Windows XP Media Center Edition 2005 and the Xbox 360 Transcode 360 aims t
Transparent Screen Lock PRO Service (TSL PRO Lock
L TrapRcvr trthread.exeRelated to the monitoring a particular system performance. See here
L TrayMan ntstart.exeTray Manager lets you put systemtray icons into a submenu to save space
L Trend Micro Central Control Component PcCtlCom.exeRelated to Trend Micro Incorporated.
Trend Micro Management Infrastructure (TrendMicro
L Trend Micro Personal Firewall TmPfw.exeRelated to Trend Micro Inc.
L Trend Micro Protection Against Spyware (PcScnSrv) PcScnSrv.exeRelated to Protection_Against_Spyware from Trend Micro. Note: Located in C:Program FilesTREND MICROI
L Trend Micro Proxy Service tmproxy.exeRelated to Trend Micro Inc.
L Trend Micro Real-time Service Tmntsrv.exeRelated to Trend Micro Incorporated.
X TrkSvr svchost.exe -k TrkSvrAdded by the Fuwudoor TROJAN!
X TrkWks svchost.exe -k TrkWksAdded by the Fuwudoor TROJAN!
Trlokom Central Management Helper 1.3.8 0
L TrueVector Basic Logging Client (minilog) minilog.exeRelated to Zone_Alarm_Firewall from Zone Labs Inc.
L TrueVector Internet Monitor vsmon.exeZone Alarm Firewall
L Trusted Platform Core Service (IFXTCS) IFXTCS.exeRelated to Trusted Platform Core Service from Infineon Technologies. Note: Located in C:WINDOWSsyste
X tsecure tsecure.exeAdded by the W32/Tilebot-B WORM! Note: Gives the fake description Terminal Security. Read the link r
L TSI Remote Control Service (TSIRCSRV) TSIRCSRV.EXERelated to Laplink_Gold Software Inc. Connect to other Laplink-enabled computers over any connection
X TskScheduler taskshed.exeAdded by the W32/Tilebot-FN WORM! Note: This worm rojan is located in C:%WINDIR% folder.
L TSMService tsmsvc.exeT-DSL SpeedManager from T-Com_T-Online Note: File location is in the Program FilesT-DSL SpeedManager
L TSS Core Service (TSSCoreService) ibmtcsd.exeRelated to IBM ThinkVantage Client
L TuneUp WinStyler Theme Service WinStylerThemeSvc.exePart of TuneUp Utilities
L TVT Backup Service rrservice.exeRelated to IBM ThinkVantage Rescue and Recovery
L TVT Scheduler tvtsched.exeRelated to IBM ThinkVantage Scheduler
L twdns named.exeRelated to TreeWalk_DNS TreeWalk DNS is a Domain Name Server program which fetches and converts Web
L TZO Client (TZONTService) TZO_NT_Service.exeRelated to TZO_DNS a leading Dynamic DNS (DDNS) service provider.
X UDP Sub Packet Classifier (UDPSPC) MSUDPSPC.EXEAdded by the SDBOT.CBF WORM! Read the link rootkit type stealth involved.
L UDS Environment Manager 5.0.14 nodemgr.exeRelated to Forte_4GL_System from Sun Microsystems Inc.
L UDS Environment Manager 5.1.3 nodemgr.exeRelated to Forte_4GL_System from Sun Microsystems Inc.
L UDS Repository Manager 5.0.14 rpserver.exeRelated to Forte_4GL_System from Sun Microsystems Inc.
L UDS Repository Manager 5.1.3 rpserver.exeRelated to Forte_4GL_System from Sun Microsystems Inc.
L Ulead Burning Helper ULCDRSvr.exeUlead DVD Burning Service
L Ulead Burning Helper (UleadBurningHelper) ULCDRSvr.exeRelated to Ulead_DVD_workshop allows the writing to DVD and CD media.
L Unicenter Message Queuing Server cam.exeRelated to Computer Associates Inc.
L Unicenter Remote Control Host (rcHost) rcHost.exeRelated to Unicenter_Remote_Control_Host From Computer Associates Note: Located in C:BA_MGMTTNGRCORC
L Unicenter Software Delivery SDSERV.EXERelated to Unicenter Asset Management by Computer_Associates
X Universal Serial Bus Control Protocol (pnpext) smrs.exeAdded by the Troj/Bdoor-JD TROJAN!
? Unknown wisptis.exe
L Unknown owner wtxregds.exepart of development software for microprocessors.
L UnrealIRCd wircd.exeRelated to UnrealIRCd