Windows XP A to Z - http://www.softwaretipsandtricks.com/windowsxp
Start Up Applications S
http://www.softwaretipsandtricks.com/windowsxp/articles/612/1/Start-Up-Applications-S
Super Admin
 
By Super Admin
Published on 03/28/2005
 
Starting with letter S

Start Up Applications S Page 1

Close Program/Task Manager
This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Operating System Differences
A number of entries are repeated due to the way that different operating systems display startup items. For example, WinMe lists "POPROXY.EXE" as "Norton eMail Protect" in both MSCONFIG and the registry whereas WinXP lists it as "Poproxy" in MSCONFIG and "Noeton eMail Protect" in the registry.

To avoid the list becoming too large, all VIRUSES are shown using the registry version which is common to all Windows versions.

Alternatively use your browsers search facility - Ctrl+F for IE users.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

Use your browsers search facility - Ctrl+F for IE users.

X S0undMan svch0st.exe Added by the LOVGATE.AB WORM!
? S24EvMon S24EvMon.exe Event Monitor - supports driver extensions to NIC Driver for wireless adapters. Is it required?
X S3 Internal Chip s3serv.exe Added by the AGOBOT-DD WORM!
? S3apphk S3apphk.exe S3 graphics related?
? S3Hotkey s3hotkey.exe S3 Video driver related. What does it do and is it required?
? S3Mon S3Mon.exe S3DuoVue multi-monitor taskbar helper by S3 Graphics. What does it do and is it required?
N S3TRAY S3Tray.exe S3 display configuration taskbar utility for S3 chipset based graphics cards. Can be run from Start-> Settings -> Control Panel -> Display
? s3tray2 s3tray2.exe Same as the s3tray entry in this table?
? S3TRAYHP S3trayhp.exe S3 Video driver related. What does it do and is it required?
U S4F S4F.exe S4F internet filtering software
X s4helper s4helper.exe Searchcentrix hijacker
? SA Sa3.exe Logitech QuickCam driver. Is it required?
? SA Service SAservice.exe Associated with Cyber Trio and Warner troubleshooting software from G-Tek Technologies and pre-installed on some Packard Bell and NEC PCs. What function does this perform and is it required?
N Sa3dsrv Sa3dsrv.exe 3D sound extension for Windows
X saap saap.exe 180Solutions/N-Case adware variant
N Sabreserver SABSERV.EXE Airline reservation software from Sabre. Available via Start -> Programs
N SAClient RegCon.exe AT&T or ComCast BBClient - monitors system and network-delivered services for availability. Your current network status is displayed on a color-coded web page in near-real time. When problems are detected, you're immediately notified by e-mail, pager, or text messaging
X Safe SafeWin.exe Added by the FOCOSENHA TROJAN!
X SafeGuard Popup Blocker Updater regsvr32 [path] sfgupd.dll SafeguardProtect/Veevo hijacker
X SafeGuard Popup Blocker Updater (required) regsvr32 [path] sfg****.dll [* = ramdom char/digit] SafeGuard Protect/Veevo - hijacker
X SafeGuard Popup Updater (required) regsvr32 [path] sfg****.dll [* = ramdom char/digit] SafeguardProtect/Veevo hijacker
X SafeGuard Popup Updater (required) regsvr32 [path] PDF****.dll [* = random char/digit] SafeguardProtect/Veevo hijacker
N SafeInstall.exe SAFEIN~1.EXE Monitors a download and ensures an newer version of a file isn't replaced by an older one
N SafeOFF SafeOff.exe Provides protection that if user accidentally presses the power switch a dialog will pop up for confirmation
X SafeSearch safesearch.exe AutoSearch parasite variant
X SafeSurfingUpdate SSUpdate.exe DyFuCa/MoneyTree parasite variant
U Safeworld Freedom.exe SafeWorld Internet Security
X Sagate Security Firewall sagate.exe Added by the GAOBOT.BOW WORM!
N SAgent2ExePath SAgent2.exe Seiko Epson printer status agent. Disable if printer is not used often
U SAGENTSERVICE Sagent.exe Added by TinySpyAgent Note - this application must be manually installed
X sagnt sagnt.exe Adware web downloader
X SAHagent Sahagent.exe ShopAtHomeSelect parasite
X SAHBundle bundle.exe ShopAtHomeSelect parasite related
X saie saie.exe 180Solutions/N-Case adware variant
U SAIMON SaiMon.exe Saitek joystick driver
X sain sain.exe 180Solutions/N-Case adware variant
X sais sais.exe 180Solutions/N-Case adware variant
? SaiSmart SaiSmart.exe "Smart Button Special Sauce" - included with the latest software for Saitek game controllers. Related to the "S", "Shift" or "Smart" button. What does it do and is it required?
U SaitekAutoConfigure saicnfig.exe Configuration for Saitek game controllers
X salm salm.exe 180Search adware
X salm salm.exe 180Solutions/N-Case adware variant
U SAMcal SAMcal.exe SamCal - calendar/reminder program
U Sametime Connect Connect.exe IBM Lotus Instant Messaging and Conferencing software
N SandIcon SandIcon.exe SanDisk ImageMate CompactFlash card reader SDDR-31 (USB). Very little use except to place the Sandisk icon beside its drive designation in Windows Explorer. The reader itself will work fine without it. The simplest thing is to just unplug the reader when you're not using it. It may slow the startup by a few nanoseconds, but once the software sees there's no reader, you get back the resources
X sapp sapp.exe 180Solutions/N-Case adware variant
X saSyncMgr rundll32.exe sasync.dll, SyncWait Browser hijacker - redirecting to Searchant.com
U SATARaid SATARaid.exe RAID driver for serial ATA disks on some motherboards such as the DFI Lanparty range. Only loaded if one is using RAID support on SATA drives
X satmat satmat.exe Transponder parasite updater/installer
U SAUpdate SAUpdate.exe Big Brother from Quest Software. System and network monitor
Y SAVAgent SAVAgent.exe Part of Sophos anti-virus software. Required for centrally administered Sophos updates to work correctly, e.g. automatically updating PCs used by dial-in home or out-of-office users
X Save Save.exe SaveNow adware
X SaveDate SaveStartDate.Exe Unidentified adware
X Savenow SaveNow.exe SaveNow adware
X Savenow savenow.exe Added by the SPREDA.B VIRUS!
U Say The Time 5.0 SAYTIME.EXE This program has audio cues for the system clock in male and female voices, customizes the appearance of the system clock, and can synchronize it to a time server regularly
U SB SB.exe Acer Soft Button on Acer Tablet PCs
N SB Audigy 2 Startup Menu /l:eng Related to the Dell OEM version of the Sound Blaster Audigy 2 sound card. If this item is listed and checked in startup, the System32 Folder will appear on every startup. A patch is available - filename R75304.EXE - that fixes the issue. You can find that file at support.dell.com by typing that name in the 'Search' box available there. It addresses the root of the problem in Creative's software and corrects it. Unfortunately there is no direct link to the file, but it's easily available using the search function
X SB Watchdog SBWatchdog.exe Spyware utility installed by the manufacturers of some laptops (Sony) used to monitor browsing habits and send them back to whoever installed it - released by SoftBank. See here for more information
U SBAutoUpdate sbautoupdate.exe SpywareBlaster auto-updater
U SBC Self Support Tool matcli.exe matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, county, etc and gets written to a log file. The SBC Self Support Tool is required to run with the Help and Support program. If you uncheck SBC and and then run Help and Support it will add another SBC entry in the startup menu. If you remove this software in "add/remove programs" some help menus in help and support will not be available. You decide
U SBDrvDet SBDrv.exe Detects the "Easy Front-Panel Audio Connectivity Drive Internal Drive Bay" on the Sound Blaster Audigy 2 Platinium eX. Can be disabled if you don't have one
X SBHC sbhc.exe SuperBar parasite - uninstall available here
N SBMX sbmx.exe SoundMAX MPU401 MIDI device emulator for x86 VM DOS games/apps (for Win9x only)
U SbUsb AudCtrl RunDll32 sbusbdll.dll, RCMonitor Control for Soundblaster MP3 external (USB) sound card
N sc scrubxp.exe ScrubXP - utility that deletes safe to remove files, cookies, browsing history, etc
U sc sc.exe Watchdog 2.0 Software - monitoring program
U sc run.exe All-In-One_SPY stealth monitoring software - allows monitoring and recording of all actions performed on a computer. It records all keystrokes, remembers addresses of Internet pages visited, and maintains a log file listing all applicationsrun on the computer. It can create screenshots and record sounds from the computer's microphone to a sound file
? sc23exec sc23exec.exe Possibly related to a digital camera
Y SC3300CC SC3300CC.exe SiPix digital camera Twain device driver
X scan mscman.exe Spyware/malware, included into the latest version of Grokster, among others. According to research by SpyBot's PMK,  "able to trick ZoneAlarm, auto-clicking it to allow passing through the firewall!"
? Scan Detector Pmxdetect.exe Associated with PrimaScan scanners. Is it required?
? Scan Wizard button.exe Associated with ScanWizard as supplied with Microtek scanners - see also Scanner Detector or SDetect. What does it do and is it required?
X ScanDisk ScanDisk.exe Added by the GANDA.A WORM! Note - this is not the valid "ScanDisk" Win9x/Me standard disk error checker
X scands32.exe scands32.exe Added by a variant of the Adclicker TROJAN!
? ScanFile ?? ??
? ScanInicio Inicio.exe Part of Panda Anti-Virus. Responsible for scanning the boot sector of your disk and your memory at startup to check for viruses that try and load and act before your anti-virus is fully operational. It only adds a fraction of a second to start-up time and is worth leaving active
N Scanner Detector SDetect.exe ScanSuite Scanner Detector - part of ScanWizard, supplied with Microtek scanners. Waits until you press the "GO" button and seems to serve no other purpose. Automatically installed without prompting. Not required if you can start your scanning application before pressing the "GO" button
X Scanreg [filename] Added by the QQPASS.E TROJAN!
X ScanRegistry nsrvnt.exe Added by the NERTE TROJAN!. Not to be confused with the real ScanRegistry - which is a vital Windows file. This version has the executable as nsrvnt.exe not scanregw.exe
X ScanRegistry scanregv.exe Added by the MASTERLOCK TROJAN!. Not to be confused with the real ScanRegistry - which is a vital Windows file. This version has the executable as scanregv.exe not scanregw.exe
Y ScanRegistry Scanregw.exe Scans the system registry and makes back-ups at start-up. Important should the registry become corrupt. The executable "Scanregw.exe" is located in %windir% (where %windir% is the Windows directory - C:Windows or C:Winnt)
X ScanRegistry Scanregw.exe Added by the STATOR WORM! Not to be confused with the legitimate ScanRegistry entry - which is a vital Windows file. The executable "Scanregw.exe" is located in %windir%System (where %windir% is the Windows directory - C:Windows or C:Winnt). Runs from the registry RunServices key as opposed to the Run key
X ScanSpyware v * Scanner.exe Spyware remover (where * = the version number) of dubious repute, see this list of Rogue/Suspect Anti-Spyware Products & Web Sites


Start Up Applications S Page 2
N SCardSvr scardsvr.exe Related to SmartCard readers and sometimes uses lots of system resources
X SCardSvr SCardSvr32.Exe Added by the MOFEI.B WORM!
N Scheduled Maintenance Scheduled_Maintenance.exe Scheduler for Iolo System Mechanic tweaking utility. It can cleans your registry and deletes temporary files at defined intervals. Available via Start -> Programs
X Scheduling Agent Scheduler.exe Added by the SUBWOOFER TROJAN! Note - this is not the real MS Scheduling agent as the executable is incorrect
X SchedulingAgant MMTASK.EXE Added by the YAB.A TROJAN! Not the valid MusicMatch Jukebox which has the same filename
U SchedulingAgent mstask.exe MS Scheduling Agent displayed as a box with a stopwatch in the System Tray that is only needed if you have regular scheduled disk defragmenting, ScanDisk, etc. Required if you have regularily scheduled events such as weekly virus scans
U SchedulingAgent mstinit.exe MS Scheduling Agent displayed as a box with a stopwatch in the System Tray that is only needed if you have regular scheduled disk defragmenting, ScanDisk, etc. Required if you have regularily scheduled events such as weekly virus scans
U Schmaili Schmaili.exe Schmaili - insert animated smilies into your e-mail
Y SCHWIZEX SCHWIZEX.EXE Part of ConfigSafe - lets you identify changes to the registry, INI files, System asset files, system hardware, network connections, and operating system versions - provides a restore function. This part takes a snapshot of your system following a healthy re-boot
X ScManager scman.exe Added by the FORBOT-CW WORM!
X scopedll scopedll.exe Added by a variant of the CRYPTER.C TROJAN!
N Scotia OnLine Recovery etdirrcv.exe Scotia OnLine Security Software provided by Entrust for Scotiabank. Provides trusted secure access to Scotia OnLine Secure Web sites. *.* represents the version number. Now obsolete after Scotiabank modernised their login process
N Scotia OnLine Security v*.* Recovery etdirrcv.exe Scotia OnLine Security Software provided by Entrust for Scotiabank. Provides trusted secure access to Scotia OnLine Secure Web sites. *.* represents the version number. Now obsolete after Scotiabank modernised their login process
X Scr scr.scr Added by the OPASERV.T WORM!
N ScrapPad Scrappad.exe ScrapPad allows you to quickly and easily record notes, thoughts, messages, and just about anything you want. Use it like you use scrap paper
U Screen Calendar scrcal.exe Screen Calendar allows you to create custom desktop wallpapers with built in active calendar and scheduler
U Screen Guard launch.exe Part of Access Denied security and privacy software
U Screen Guard Message Scan sgms.exe Part of Access Denied security and privacy software
N Screen Saver Control FSScrCtl.exe Installs as part of the Hubble Space Telescope screen saver (and possibly others). Lets you control your installed screensavers from a System Tray icon
N ScreenPrint32 ScreenPrint32.exe ScreenPrint32 screen capture software - can be launched manually
? screxe scruser2k.exe ??
? script script.bat Maybe associated with DOS on a Win9x machine
Y ScriptBlocking SBServ.exe Update to Norton AntiVirus 2001. Detects certain types of script-based viruses without the need for specific virus definitions - such as JavaScript and VBScript. This will help protect you from these viruses even before virus definitions are available. Note - some users complain of problems once the update is installed - refer here for more information
Y ScriptSentry Scriptsentry.exe Script Sentry from Jason's Toolbox. Blocks malicious scripts and allows safe scripts to run. Only required if you want it to check the file associations it guards at startup. It will function regardlessly
U Scroll-In-Mouse V2.0 SCROLL.EXE Toolkit for the Lynx-3D Net scroll mouse from QTronix. Required if you use the special features
X ScrSvr ScrSvr.exe Added by the OPASERV WORM!
X ScrSvrOld [worm filename] Added by the OPASERV WORM!
Y Scsi Scsi.exe SCSI Miniport driver
X scvhost svzhost.exe Added by a variant of the SPYBOT WORM!
X scvhost loader ixplore.exe Added by the SDBOT-CY TROJAN!
X scvhost.exe scvhost.exe Added by the LOHAV-N TROJAN!
X sd32info sd32info.exe Added by the CRYPTER.A TROJAN!
U SDaemon sdaemon.exe PC Security from Tropical Software. 'PC Security™ 5.1 is the ultimate in computer security, offering multiple locking systems for the Windows environment and internet. Lock files, monitor programs' activities, even detect intruders! PC Security offers flexible and complete password protection, "Drag and Drop" support, plus many other handy features'
X SDAv csnss.exe Added by the SERFLOG.C WORM!
X SDAv svhost.exe Added by the SERFLOG.C WORM!
X sdchosts32 vbdd.exe Added by the RANKY.AG TROJAN!
N SDetect SDetect.exe ScanSuite Scanner Detector - part of ScanWizard, supplied with Microtek scanners. Waits until you press the "GO" button and seems to serve no other purpose. Automatically installed without prompting. Not required if you can start your scanning application before pressing the "GO" button
X sdfsdfsdf sp2update.exe Added by a variant of the SPYBOT WORM!
X SDIN Adapter sdin.exe Added by the FORBOT-AP WORM!
? SDJobCheck triggusr.exe Part of CA Unicenter Software Delivery - manage software across various systems, from desktops and servers to PDAs and mobile phones, in a controlled and standardized way - is it required at startup?
X sdkupdate22 SDK0mCORE.exe Added by the FORBOT-DT WORM!
N SDPhotoBar.exe SDPhotoBar.exe SmartDraw Photo - "organize, enhance, print, and share your photos. It's also a powerful graphic editor for creating images and web graphics"
X sdrss sdrss.exe Added by the SDBOT-SQ WORM!
U sealmon sealmon.exe SealedMedia enables you to combine document protection and control with your existing applications - such as Microsoft Word, Microsoft Excel, Microsoft PowerPoint and Email
? Search Hook srchhook.exe ??
X Search Page http://find.naupoint.com Naupoint browser hijacker
X Search-Exe SE.exe Search-Exe hijacker
X Search.vbs Hijacker
X SearchEnhancement scbar.exe IE search hijacker
X searchnav searchnav.exe SearchNav adware - IEFeatures/Popnav variant
X SearchNavVersion searchnavversion.exe SearchNav adware - IEFeatures/Popnav variant
X SearchSetter searchsetter[1].exe Browser hijacker - redirecting to FindWhateverNow.com
X SearchSquire33 SearchUpdate33.exe SearchSquire parasite
X SearchUpgrader SearchUpgrader.exe Hijacker
X Secboot w32tm.exe Added by the HAXDOOR.D TROJAN!
U SecondChance sctray.exe Power Quest Second Chance. Sets checkpoints for saving a backup copy of the registry to a disk so you can restore it if you have a crash
X Secret-Crush start.exe Hijacker that may reset your browser's home page and/or search settings to point to undesired sites
U Secsys Secsys.exe Key Interceptor - surveillance software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it
X secure secure.exe DealHelper adware
N SecureCleanIEClean SCIEClean.exe SecureClean - scans your system for hidden temporary files, deleted email messages, Internet histories and caches
U SecureItPro Secureitpro470p.exe SecureIt Pro - lock your computer when you're not there, to stop malicious users from accessing your desktop
X SecureLogin Mslg32.exe Added by the REDZED WORM!
X Security Accounts Manager SM samsm.exe Added by the SPYBOT.JE WORM!
X Security Agent Manager mssams.exe Added by the RBOT-SV WORM!
N Security iGuard Security iGuard.exe Spyware remover of dubious repute, see this list of Rogue/Suspect Anti-Spyware Products & Web Sites
U Security Manager SecurityManager.exe A ComCast Internet software suite that provides a variety of features (firewall, popup blocker, parental controls etcetera) to help ensure your computer is secure, and your information is kept private
X Security Patches msnkn.exe Added by the RBOT.WW WORM!
X security service syss.exe Added by an unidentified WORM or TROJAN!
Y SECWIZ98 SECWIZ98.EXE Security Wizard 98 by Chris Farmer. Offers you a variety of ways to restrict access to many of the programs and settings on your PC. Available here
? SelfHostUtil slefhost.exe ??
U SeMS SeMS.exe

PCsms - tool that enables you to send sms text messages from your PC to any UK mobile phone

U Sensiva Sensiva.exe Symbol Commander makes the use of your PC, laptop, Tablet PC, and Pocket PC much easier and much faster. It recognizes your handwriting with unparalled performance and executes commands in a snap. Just by using your mouse, pen, or touchpad, simply draw symbols to execute actions instantly
X SENTRY SENTRY.exe From IP Insight. Allows website owners "to instantly determine the precise geographic location, connection speed and detailed demographics of every visitor to your website". Will be detected by most firewalls and the majority of home users should disable it 
X Sepate Security Firewall sepate.exe Added by a variant of the RBOT WORM!
X Serials serials.exe Any one of a variety of worms and trojans
X serpe formatsys.exe Added by the SERFLOG.A WORM!
X serpe msmbw.exe Added by the SERFLOG.A WORM!
X serpe serbw.exe Added by the SERFLOG.A WORM!
Y serrdctl.exe serrdctl.exe "Shared Modem Service Client Event Viewer" - used when a number of PCs have access to a number of modems. Required to be running on each PC for access to the modems
N Serv-U serv-u32.exe FTP server
X Serv-U wssdsu.exe Added by the MANIFEST TROJAN!
X server server.exe Added by the DELTAD.A WORM!
X SERVER.EXE SERVER.EXE Added by the BUSHTRO122 or SMOKODOOR TROJANS!
X serverex Server.txt.vbs Added by the DELTAD.A WORM!
U Service service.exe Added by the ALADINZ.H TROJAN!
X Service services.exe Added by the NETSKY or NETSKY.B WORMS! Note - this is not the legitimate services.exe process which should NOT appear in Msconfig/Startup!
X Service [trojan filename] Added by the KAITEX.E TROJAN!
X Service services.exe Added by the NETSKY or NETSKY.B WORMS! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup!
X Service SYSNT.exe Added by the CHA TROJAN!
N Service Connection sccenter.exe For Compaq PC's. Part of Backweb
N Service Connection bwtray.exe For Compaq PC's. Part of Backweb
X Service Controller Csrrs.exe Added by the GAOBOT.AO WORM!
X Service Host [filename].exe Added by the TORVEL.B WORM!
X Service Host spoolxx.exe Added by the TORVEL WORM!
X Service Host svchost.exe Added by the TORVEL WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
X Service Host Driver svchost.exe Added by the HITON TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
N Service Manager sqlmangr.exe SQL Server Service Manager - provides tray access to SQL server, the server agent and MSDTC. Available via Start -> Programs
X Service Manager dxsound.exe Added by the PROXY-GRIC TROJAN!
X Service Process SVCHOST.EXE Added by the DARKER WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
X Service Process winset.exe Added by a variant of the SPYBOT WORM!
X service updaer qualityz.exe Added by an unidentified VIRUS, WORM or TROJAN! - probably a SPYBOT variant
X Service.exe Service.exe "servedby.advertising" popup generator
U ServiceConfig ispbeg.exe Comcast Transition Wizard. On June 30th, 2003 it will migrate E-mail and web pages from AT&T Broadband Internet to Comcast High-Speed Internet. Until then it will run at startup and then terminate - hence the U recommendation
Y ServiceLayer ServiceLayer.exe Nokia Connectivity Library support task that is needed by NCLTRAY and by the Nokia Connection Manager for either to work properly
X services start.bat Added by the ZCREW TROJAN!
X Services [path to trojan] Added by the METEORSHELL TROJAN!
X Services back32.exe ...service.exe Added by an unidentified VIRUS, WORM or TROJAN! Back32.exe is the baddie whose purpose is to HIDE the MIRC32 server in service.exe
X Services services.exe Added by a number of VIRUSES, WORMS and TROJANS! Note - this is not the legitimate services.exe process which should NOT appear in Msconfig/Startup!
X Services winread.exe Added by an unidentified VIRUS, WORM or TROJAN!
X Services windns.exe Added by a variant of the RBOT WORM!
X Services Controller lsassa.exe Added by the CIADOOR.122 VIRUS!

Start Up Applications S Page 3
X Services Host Scchost.exe Added by the DONK WORM!
X Services Logon services.exe Added by the CROWT.A WORM! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup!
X Services Process services.exe Added by unidentified spyware - recognized by Kaspersky antivirus as Small.X TROJAN! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup!
X Services Startup services.exe Added by the CROWT.A WORM! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup!
X Services Startup svhost33.exe Added by a variant of the RBOT WORM!
X Services.EXE services.exe Added by the KAZPING WORM! Note - this is not the legitimate services.exe process which should NOT appear in Msconfig/Startup!
X services.exe Services.exe Added by the CIADOOR-F TROJAN! Note - this is NOT the legitimate services.exe process, which should NOT figure in Msconfig/Startup!
X Services004 [worm filename] Added by the BUGBROS WORM!
? ServUTrayIcon ServUTray.exe System Tray icon for Serv-U FTP server. Is it required?
X SESync sed.exe Downloadware/SED adware downloader
? SetDefaultMIDI MIDIDef.exe Related to a Soundblaster Audigy soundcards. What does it do and is it required?
? setdefprt setdefprt.exe Related to a Brother printer?
U SetecCertUtil Certutil.exe Setec Web and Email Security. Setec PKI smart card software. The PKI technology enables secure and reliable user identification in services offered through Internet, mobile handsets and digital TV
X setFTPBack createsw.exe Added by the FTP_BMAIL TROJAN!
N SetHook SetHook.exe Fellowes Neato CD label design software. "Launch NEATO's MediaFACE II label making software directly from the productname toolbar"
N SETI@home SETI@home.exe SETI@home is a scientific experiment that uses Internet-connected computers in the Search for Extraterrestrial Intelligence (SETI). You can participate by running a free program that downloads and analyzes radio telescope data
N seticlient SETI@home.exe SETI@home is a scientific experiment that uses Internet-connected computers in the Search for Extraterrestrial Intelligence (SETI). You can participate by running a free program that downloads and analyzes radio telescope data
N SetIcon SetIcon.exe Installed by a 6-in-1 (4 Media Card slots, a floppy drive and a USB connection) device. Constantly updates the icons for the four Media Card slots that it has and is a resource hog
N SetiQueue Setiqu~1.exe Provides work unit buffering for Seti@Home clients - see here for more details
N SetiSpy SetiSpy.exe From the site - 'SETI Spy is a little program I wrote to "spy" on the progress and performance of the SETI@home client. I call it a "spy" because I tried to make it as unobtrusive as possible'
? SetRefresh SetRefresh.exe Found on a Compaq PC. Video refresh rate utility? Is it required?
X Setting sysweb.exe Added by the SDBOT.GEN TROJAN!
N setup hphprld.exe ....setup.exe HP DeskJet Setup - printers function normally without it
X Setup experation svchost.exe Added by the TOFGER-AW TROJAN! Note - this is not the legitimate svchost.exe process, which NOT appear in Msconfig/Startup!
N SetupICWDesktop icwconn1.exe Appears to be the "Internet Connection Wizard" from Internet Explorer being set-up as a desktop shortcut. Appears under the RunOnce registry key but is available under Start -> Programs -> Accessories -> Communication (or similar) anyway
X setupuser regedit.exe setupuser.log Regfile in disguise - another CoolWebSearch parasite variant
? setuzp setuzp.exe ??
X SetVrc setvrc.exe Added by the HUNTOCX WORM!
X Sex Teris st01b.exe Added by the REPAD WORM!
X Sexy_sg Sexy_sg.exe Premium rate adult content dialler
N SFP vzSFPWin.EXE Verizon Online Support Center - prompts for online updates
X SFtrb Service cftrb32.exe Added by the SOBIG.D WORM!
U SfWinStartInfo sfWinStartupInfo.exe

SFIRM32 Online Banking software

U Sgecrypt Sgecrypt.exe SafeGuard Easy - "provides total company-wide protection for sensitive information on laptops and workstations. Boot protection, pre-boot user authentication and hard disk encryption using powerful algorithms guarantee against unauthorized access and hacker attacks"
U Sgeecview Ecview.exe SafeGuard Easy - "provides total company-wide protection for sensitive information on laptops and workstations. Boot protection, pre-boot user authentication and hard disk encryption using powerful algorithms guarantee against unauthorized access and hacker attacks"
N sginst sginst.exe eAcceleration Stop-Sign related - not recommended, see note
? SGTBox SGTBox.exe Canon scanner driver. Is it required?
U sgtray sgtray.exe StorageGuard from Veritas. Free utility that integrates with Backup MyPC (formerly Backup Exec Desktop), Simple Backup and MS Backup. Provides system tray access and background monitoring - warning you of files that haven't recently been backed up. Required unless you backup manually on a regular basis or have scheduled backups
X shambl3r cnf.bat Added by the REMABL WORM!
X shambl3r* shambl3r.exe Added by the REMABL WORM! where * is 2 to 11
N Share-to-Web Namespace Daemon hpgs2wnd.exe "HP's exclusive Share-to-Web software makes it easy to share content with others through our affiliate Internet websites." In other words an application that allows users to upload scanned images to their personal webpages if desired. Available via Start -> Programs
N Shareaza Shareaza.exe Shareaza P2P client
X sharedprem sharedprem.exe Added by the MAKECALL TROJAN!
Y Sharing and Mapping Software DShmap.exe Intel AnyPoint internet sharing software
N SharkEject AEJCT32.exe Allows you to eject a disk from the Avatar Shark drive from the system tray. When loaded, there is a desktop icon so this isn't required
N Shcenter chcenter.exe IMSI HiJaak - "the easiest way to convert, capture, and manage all your graphic files"
X SheduIer svchst.exe Premium rate adult content dialler
X Shell Shell32.exe Added by the BADSECTOR TROJAN!
X Shell ray.exe Homepage hijacker re-directing browsers to adult content websites
X Shell Tray.exe Homepage hijacker re-directing browsers to adult content websites
X Shell wmedia16.exe Added by the GOLDUN TROJAN!
X Shell Open32.exe Horseserver.net browser hijacker
X Shell Extension spollsv.exe Added by a variant of the LOVGATE WORM!
X Shell32 Shell32.vbs Added by the SCAFENE WORM!
X ShellApi SHELLMSN.EXE Added by the NETDEV.B TROJAN!
X Shellapi32 Shellapi32.exe Added by the NETDEVIL (or NERTE) TROJAN!
X ShellCommand [path to file] Added by the REMCON-A TROJAN!
X ShellEx ShellEx.exe Added by the ANAKHA TROJAN!
X shellsystem shellsystem.exe Added by the UPCHAN TROJAN!
N shicoxp shicoxp.exe Installed with the drivers for multi card readers of various brands. To differentiate between the various card slots on multi slot readers the shicoxp.exe file assigns and loads unique drive icons for the various card slots that are displayed in Windows Explorer
X Shine Shine.exe Added by the HAPPYLOW (or NISHE-A) VIRUS!
? SHINITV shinitv.exe ??
X Shmgrate.exe ibot4.exe Added by the GASTER TROJAN!
N ShockmachineReminder SmReminder.exe Shockmachine is an entertainment playback device that lets you save your favorite Shockwave.com titles and play them back in full-screen mode, off-line, anytime. Could be a registration reminder for the trial version
X Shockwave csrss.exe Added by the SNDOG WORM! Note - this is not the legitimate csrss.exe process, which should not appear in Msconfig/Startup!
N Shockwave Init SWINIT.EXE Part of Macromedia Shockwave. Controls the Shockwave Remote Control Panel. The Remote Control can be activated manually from the Start Menu by locating and selecting Shockwave and then Shockwave Remote under Programs
N ShortKeys 99 SHORTKEY.EXE ShortKeys from Insight Software Solutions - allows you to program keys with text strings
X Showbehind SHOWBEHIND.EXE Advertisement display which can be stopped here
? ShowIcon_SmartDisk Corporation_USB Card Reader v1.14e051 shwicon.exe Card reader for memory cards from digital cameras. Is it required?
U SHPC32 SHPC32.exe Port monitor for Lexmark printers on a USB connection. Ties in with the Printer Control Program. Features like cancelling a print are unavailable if disabled
Y ShStatEXE SHSTAT.EXE From McAfee VirusScan NT 4.x. Handles program communication among VShield components, displays VShield icon. Can be started automatically or available via Start -> Programs
U Shutdownaware shutdownaware.exe Loaded by the SWEEX 6-in-1 Media Card Reader to properly manage the reader while it is connected to your system
U ShutDownPro ShutDownPro.exe ShutDownPro - shutdown, reboot, logoff your System with one mouse click
? Si Meter SIMETER.EXE ??
X si91e44b rundll32.exe [path] si91e44b.dll, EnableRunDLL32 LZIO.com adware downloader
X Sicom Sicom.exe Added by the NETLIP WORM!
U SideACT SideACT.exe SideACT organizer software
X Sidebar Sidebar.exe Searchcentrix hijacker
N SideWinderTrayV4 SWTrayV4.exe MS SideWinder game controller system tray icon. This is specific to version 4 of the software. Available via Start -> Programs
? SigX sigx.exe ??
X SigXC SigX.exe SigX is a "dynamic signature image generated based on whatever data your computer sends it though our SigX program. It can display your current Mp3, current OS, Free Ram, your current time and more"
N Simcast SimcastAlerts.exe Simcast is a free service that allows you to subscribe to information on a large variety of topics. Alerts will appear on your desktop when a channel that you have subscribed to has something to say
U SimpLite-MSN SimpLite-MSN.exe Required if you use the SimpLite add-on to MSN Messenger (SimpLite adds encryption to the instant messaging service)
X Singapore singapore.exe Adds a blue crescent to the taskbar and when double-clicked displays an adult-content web-site. Also known to drop your internet connection and dial an international telephone number. See here for more information. Must be disabled in MSCONFIG before un-installing or it re-instates itself
U SIPPS SIPPSSIPPS.exe Web.de Internet phone utility
N SiS KHooker khooker.exe SiS Keyboard Daemon. System Tray utility which gets installed by the drivers of the latter day SiS VGA cards. Can cause errors at startup and isn't required
U SiS Tray sistray.exe System Tray icon for SiS based graphics. Note - this resides in C:WindowsSystem
U SiS Windows KeyHook keyhook.exe SIS graphics cards related: "Super VGA Keyboard Daemon" - hooks into the keyboard processing chain in order to enable hotkey settings
? SISAM10M SISAM10M.exe ??
N SiSAudio MP_S3.exe WinME patch for an older SiS 961 chipset FERR bug. Enable if you have audio problems
U siscolor color.exe Probably on-board graphics related based upon the SiS chipsets. Has been seen on ASUS motherboards with SiS chipsets and known to cause conflicts if you choose another graphics card and disable the on-board
U siService.exe siService.exe Spam Inspector - anti email spam software

Start Up Applications S Page 4
? SiSSetCDfmt SiSSetCDfmt.exe Related to a Silicon Integrated Systems Corp (SiS) product?
? SISSoundman Soundman.exe Related to a Silicon Integrated Systems Corp (SiS) product?
U SiSSWLED sisswled.exe System Tray utility for SiS 900 network cards
X sistrai.exe sistrai.exe Added by the PROVA TROJAN!
X sistray sistray.exe Added by the PROVA TROJAN!
U sistray sistray.exe System Tray icon for SiS based graphics. Note - this resides in C:WindowsSystem
X Sistray32 remotehost.pif Added by the HOLCAS.A WORM!
X Sistray32 win.bat Added by the JUMPRED.A WORM!
X sistry sistry.exe Added by the CEBE WORM!
N SiSUSBRG SiSUSBrg.exe SiS USB Registry Patch File - fixes the undetectable problem with SiS USB controller on Windows XP
X sixtysix sixtypopsix.exe Unidentified adware
U SK9910DM SK9910DM.EXE Multi-function keyboard driver. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
U SKDAEMON SKDAEMON.EXE Multi-function keyboard driver. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys 
U skinkers skinkers.exe Selection of desktop messaging/marketing tools with celebrity tie-ins including MTV's "Desktop Ozzy" and Arsenal's "Desktop Wenger" - see here. Leave enabled if you want to receive messages
Y SkyBlaster Scheduler SSFSch.exe For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system
X skynetave.exe skynetave.exe Added by the SASSER.D WORM!
X SkynetRevenge winlogon.scr Added by the NETSKY.AA WORM!
N Skype Skype.exe "Skype is free and simple software that will enable you to make free calls anywhere in the world in minutes"
Y SkySurfer Management Service SmaServ.exe For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system
N SleepManager SleepMgr.exe This program locates free contiguous disk spaces and allocates them for storing BASE MEMORY, EXTENDED MEMORY, VIDEO MEMORY, and SM RAM. It helps the computer come out of hibernate mode
U SlickRun sr.exe "SlickRun is a floating command line utility for Windows. It gives you almost instant access to any program or website. SlickRun allows you to create command aliases (known as MagicWords), so C:Program FilesOutlook Expressmsimn.exe becomes MAIL"
X slide Iexplore.exe Added by the GASLIDE TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which should not appear in Msconfig/Startup unless you add it manually!
N slimp3 SliMP3 Server.exe Slimp3 Server - "presents an entirely new way of accessing and enjoying your music collection. Instead of storing your music on CDs or memory cards, the SliMP3 uses your home network to access the music stored on your PC"
N Slingshot SLINGS~1.EXE Atomica Slingshot - "reference tool with access to dictionary and encyclopedia terms, bios, technical terms, history, geography, and much more"
X slmss slmss.exe SeekSeek search hijacker related - as seen here
X slvchost32 slvchost32.exe Added by an unidentified VIRUS, WORM or TROJAN!
? SM1BG SM1BG.EXE USB driver for downloading from within Napster to portable MP3 players. Is it required to run at startup or can it be run manually?
N Sm56acl sm56hlpr.exe Helper utility for Motorola based SM56 software modems - resides in the System Tray
N Smapp smtray.exe System Tray access for the Compaq/ADI SoundMAX integrated digital audio controller
N Smart Card Service ScardSvr.exe For Smart Card readers. Known to cause problems, especially for Windows 2000 users - see here. Probably not required unless you use such a device regularly
U Smart Connect Monitor SCMon.exe Appears on a Sony Vaio. Smart Connect Version 2.1 enables data transfer between Vaios via i.LINK cable. Smart Connect supports File and Printer Sharing for MS networks. You can copy files from your Vaio to another Vaio or print using a printer connected to a remote Vaio
U Smart Connect Setup SCSetup.exe Appears on a Sony Vaio. Smart Connect Version 2.1 enables data transfer between Vaios via i.LINK cable. Smart Connect supports File and Printer Sharing for MS networks. You can copy files from your Vaio to another Vaio or print using a printer connected to a remote Vaio
N Smart Label O Server ssloserv.exe Part of the printer software for the smart-label printer made by Seiko. Can be disabled safely
N Smart Label RFViewer SSLFVIEW.EXE Part of the printer software for the smart-label printer made by Seiko. Can be disabled safely
N Smart Type Assistant sta.exe Smart Type Assistant - a complex typing automation tool, intended to make your work faster and safer
U Smartalec pcaccel.exe Smartalec PC Accelerator - system optimization utility
N SmartBarXP SmartBarXP.exe SmartBarXP is a bar that runs down the side of your screen, and can be configured to display interactive panels known as 'panes'. These panes include media players, slideshow and image viewing panes, a virtual desktop manager, and live news, weather and stock feeds to mention but a few
N sMaRTcaPs SMARTC~1.EXE sMaRTcaPs from Phoebus LLC - enables you to configure the time needed to depress Caps Lock, Num Lock & Insert keys
? Smarthruengine QS.exe Unknown but disabled without problems
U SmartPCXL pcaccel.exe Smartalec PC Accelerator - system optimization utility
N SMax4 SMax4.exe System Tray icon for SoundMax integrated sound. Sound properties can be accessed through the Start Menu or Control Panel
U SMax4PNP SMax4PNP.exe SoundMax integrated sound. Required if you have custom settings for your sound, such as effects and environments
? smbdpmi smbdpmi.exe IBM Netfinity Director and Universal Management Services related. What does it do and is it required?
Y smc smc.exe Sygate Firewall
Y smc spfsmc.exe Sygate Firewall
Y SMC Service smc.exe Sygate Firewall
Y SMC Service spfsmc.exe Sygate Firewall
X smcserv winsrv.exe Added by the AGOBOT-OU WORM!
Y SmcService smc.exe Sygate Firewall
Y SmcServices smc.exe Sygate Firewall
Y SmcServices spfsmc.exe Sygate Firewall
? Smcsta.exe Smcsta.exe SMC Networks wireless PCI card driver. Is it required?
N Smith Micro try smiptray.exe Smith Micro shared files. Comes with D-Link web cam
U SMS Application Launcher LAUNCH32.EXE Microsoft Systems Management Server - used to manage computers on a network remotely
U SMS Client Service clisvc95.exe When the SMS Client service starts on a domain controller, the Client service modifies the SMSCliToknAcct & user account group membership, user rights, and account comment. The Client service then waits for the synchronization of the comment to verify that the account and user rights are properly set for this account. This account is used to obtain a token to start the SMS Client processes, such as the Software Inventory and Software Distribution agents (MS Systems Management Server)
U SMS Win9x Message Agent ?? This program assigns a user to a Systems Management Server site
U SMS Win9x Message Agent SMSMsg.exe This program assigns a user to a Systems Management Server site
Y Smserial sm56hlpr.exe Motorola based modem driver
N SMSI Loader SMLoader.exe Smith Micro HotFax - fax software
X SMSS smss.exe Added by the FLOOD.F TROJAN! Note - this is not the legitimate Smss.exe system file should normally NOT figure in Msconfig/Startup!
X smss [path to smss.exe] Added by the ALADINZ.F TROJAN! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup!
X SMSSS smsss.exe Added by the SDBOT.ZD WORM!
X SMSSS Loader smsss.exe Added by the AGOBOT.MQ WORM!
X smsys Explorer.exe Added by the CLICKER-C TROJAN! Note - the valid "explorer.exe" is located in C:Windows or C:Winnt whereas this one is located in a C:WindowsTemplate or C:WinntTemplate subdirectory
X smsys vi.exe Adult content dialler
N SMToolbar SMToolbar.exe StartMake.com toolbar
? SmWizard SmWizard.exe SmartWizard MFC Application - associated with C-Media who produce audio chipsets commonly used for on-board sound on motherboards. What does it do and is it required?
X snapple snapple.exe Added by the FORBOT-EG WORM!
? snbr snbr.exe ??
X sncntr sncntr.exe Added by the DLUCA-I TROJAN!
X Sndcompat Sndcompat.exe Added by the GEMA TROJAN!
U SNDMon SNDMon.exe Part of Symantec's LiveUpate (eg, Norton). Not required if you run manual upadtes but probably require if you leave them to run automatically. Also, if one runs a small office network and SNDMon is disabled on one of the computers – then other computers disappear from the network for this computer, including shared devices like printers and scanners. Hence the "U" recommendation
X Sndsaver Sndsaver.exe Added by the GEMA TROJAN!
? sndsrvc SNDSRVC.EXE Part of Norton Personal Firewall and Norton Internet Security - what does it do and is it required?
N Snsicon Snsicon.exe Launches a screensaver program from Second Nature
? SO5 Integrator Pass One sointgr.exe StarOffice 5. See here for more details
? SO5 Integrator Pass Two sointgr.exe StarOffice 5. See here for more details
X Soar Rwon.exe PurityScan/Clickspring adware
X Social Security Agency rpcxsocsa.exe Added by a variant of the RBOT WORM!
X Sock32 sock32.exe Added by the SDBOT TROJAN!
Y SoDA Startup SodaStartup.exe Used by the Rational SoDA project management tool. Unsure of it's actual purpose but it's recommended you leave it enabled if you use the software
N soffice SOFFICE.EXE Displays StarOffice quick start applet in System tray. Right clicking on the icon allows rapid starting up of components of the StarOffice 6.0 suite. Available via Start -> Programs. Automatically started when any StarOffice 6.0 component is started from the Start -> Programs. A resource hog (it eats > 16 MB of memory).
X Soft Profile Inc hxdef.exe... Added by a variant of the LOVGATE WORM!
Y SOFTinst N/A For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out
X Software software.exe Added by the CRABTON-B TROJAN!
Y Solo Sentry Solosent.exe Solo Antivirus
U SoloSchedule Solocfg.exe Scheduler for Solo Antivirus. Leave enabled unless you scan manually on a regular basis
U SoloSysCheck Syscheck.exe Solo antivirus System Integrity Check - Monitors system registry, system.ini, win.ini and startup to protect you from new Internet Worms and Backdoors
X somatic somatic.exe Searchcentrix hijacker
N Sonic A3D Control vrtxctrl.exe Sound related options
N SoniqueQuickStart sqstart.exe Quickstart for Sonique audio player. Available via Start -> Programs
? SonnReg SonnReg.exe Part of E-Color 3Deep for color calibration. Possibly a registration reminder?
? Soot rcea.exe ??
? sophagnt sophagnt.exe Possibly related to Sophocles Screenwriting Software?
X SOS SOS.exe Added by the PHILIS VIRUS!
? SoSyncMonitor SoSyncMonitor.exe SuperOffice related. What does it do and is it required?
X Sound Loader sndloader.exe Added by the AGOBOT-BV WORM!
X Sound services SOUND32.EXE Added by the AGOBOT.GG WORM!
X Sound System WinSound1.exe Added by an unidentified VIRUS, WORM or TROJAN!
X soundcontrl soundcontrl.exe Added by the GAOBOT.AFJ WORM!
X sounddrv sndbdrv3104.exe CoolWebSearch parasite variant
? SoundFusion rundll32 cwcprops.cpl Control panel item for the Terratec DMX Xfire 1024 soundcard (Start -> Settings -> Control Panel) based upon a Cirrus Logic "SoundFusion" DSP. Does it need to run at start-up every time?
? SoundFusion rundll32 hercplgs.cpl, BootEntryPoint Control panel item for Hercules Fortissimo soundcards (Start -> Settings -> Control Panel) based upon a Cirrus Logic "SoundFusion" DSP. Does it need to run at start-up every time?
N soundman soundman.exe System Tray icon for the Realtek AC97 Audio Sound Manager for AC97 onboard audio. Available via Start -> Settings-> Control Panel
N SoundMAX SMax4.exe System Tray icon for SoundMax integrated sound. Sound properties can be accessed through the Start Menu or Control Panel
U SoundMAXPnP SMax4PNP.exe SoundMax integrated sound. Required if you have custom settings for your sound, such as effects and environments
X SoundMixer smvss.exe Added by the DEDLER-G TROJAN!
X Soundmx Soundmx.exe CoolWebSearch parasite variant
X soundtask soundtask.exe Added by the AGOBOT-MD WORM!
X soundtasks soundtasks.exe Added by a variant of the CRYPTER.C TROJAN!
X soundtctrls soundtctrls.exe Added by the AGOBOT-ZV WORM!
X SoundView msdview32.exe Trojan downloader
X sounofts sounofts.exe Added by the AGOBOT-ND WORM!
N SourcePath gwreg.exe Used to update Gateway registry settings for System Restoration Kit and Web update programs
X sp sp.reg IE search hijacker - changes the default search to http://www.gocybersearch.com/
X sp regedit-s .... sp.dll Malicious javascript annoyance that changes the default search engine in IE to one of many including "topsearcher". See here for more and a fix
X sp se.dll, DllInstall Added by the Startpage.M hijacker
U SP TimeSync SP TimeSync.exe SP TimeSync lets you synchronize your computer's clock with any Internet atomic clock (time server)
X SP00LSV Sp00lsv.exe Added by the GRAYBIRD.E TROJAN!
X sp2chk.exe sp2chk.exe Added by the ALUROOT.A TROJAN!
X sp2ctr sp2ctr.exe Added by the DLUCA-M TROJAN!
U Spam Sleuth SpamSleuth.exe Spam Sleuth E-mail spam detection program
U spamihilator spamihilator.exe Spamihilator - spam filter
U SpamPal spampal.exe SpamPal - anti-spam tool
U SpamSubtract SpamSubtract.exe Intermute SpamSubtract - junk email detection and removal program
N spc_w hcm.exe NetZero Search related
N Spdstart Spdstart.exe Norton Utilities Speed Start. "This feature optimizes the start up speed of launching applications, such as Word and Excel."
U Speaking Clock Deluxe SpClDlx.exe Speaking Clock Deluxe - turns your computer into a speaking clock with several languages. It can also keep track of up to 50 alarms that can be set to a time and a date, and be repeated daily, weekly, monthly and yearly
X Special Firewall Service avguard.exe Added by the NETSKY.G WORM!
X SpecialOffers SpecialOffers*.exe [* = digit] SpecialOffers adware
X SpecialOffers SpecialOffers.exe SpecialOffers adware
N Speed racer CTSRReg.exe Software for a Creative sound card
U Speed Tec speedtec.exe Accel SpeedTec from Montana Software speeds up your modem. SpeedTec modifies the Internet Protocol settings in the Windows registry to speed downloads on all modems. If you find this improves your connectivity and download speeds leave this enabled
X SpeedBoss [worm filename] Added by the OPASERV.AD WORM!
U Speedkey SPEEDKEY.EXE Additional keyboard shortcuts on MS programmable keyboard
U SpeedMeter SpeedMeter.exe Application measuring upload and download speed
U SpeedOptimizer spo.exe SpeedOptimizer is designed to optimize and speed-up your Internet data transmission including browsing, streaming, downloading, uploading and e-mail communication
U Speedtouch USB Diagnostics Dragdiag.exe For an external Alcatel ADSL high-speed modem. A diagnostic tool and can be run from the Start menu when required. The only reason it might be useful on startup is if you like seeing an 'at-a-glance' status indicator on the taskbar (the icon is a different colour depending on the status of the device/line)
X Spees1 speedy.scr Added by the OPASERV.Y WORM!
X Spees2 Speedy.bat Added by the OPASERV.AD WORM!
X Spees3 SPEEDY.PIF Added by the OPASERV.AD WORM!
N Spellex Anywhere sa.exe Spellex-Anywhere - adds spell checking functionality to almost any Window program. Create a shortcut and run manually before it's to be used
Y SpIDerMail spiderml.exe DrWeb antivirus Spider Mail e-mail scanner
N Spinner Plus spinner.exe "Spinner Plus lets you listen to over 100 channels of music broadcast from Spinner.com. Spinner Plus uses RealNetwork's G2 technology to provide high-quality online audio. The technology adjusts the audio streaming to match your Internet connection speed, which helps eliminate sound distortion or choppiness". Available via Start -> Programs
X SPINX Wscript.exe OXNEY.B.VBS Added by the YENO.B and YENO.C WORMS!
X SPnt SPnt.exe Premium rate adult content dialler

Start Up Applications S Page 5
U SpokeSysTray SpokeSysTray.exe Spoke Software client application. Spoke "uses data in your e-mail and other enterprise information systems to discover the existing relationships of people in your enterprise. It then builds a private, secure relationship network for each user without any additional manual data entry"
X spoo1sv spoo1sv.exe Added by the SOULJET TROJAN!
X Spool [path to trojan] Added by the RANKY.R TROJAN!
X SPOOL Configuration spoolsvc.exe Added by the SDBOT-KD WORM!
X Spool lptt01 spool.exe Variant of the RapidBlaster parasite (in a "spool" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
X Spool ml097e spool.exe Variant of the RapidBlaster parasite (in a "spool" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
X Spooler Service Spoolsrv.exe Added by the JOINER.C1 TROJAN!
X Spooler Sub System Process SPOOL32.EXE Added by the YAB.A TROJAN!
X Spooler Subsytem App spoolsvc.exe Added by the SDBOT-MM WORM!
X SpoolerSubSystemProcess SpooI32.exe Added by the EHKS.21 keylogger! Note - the "I" between "o" and "3" is a captial "i" not a lower case "L"
X spoolserv spoolserv.exe Added by the SDBOT-PN WORM!
X SpoolService spolsv.exe Added by the AGOBOT-CS WORM!
X Spoolsv Spoolsv.exe Added by the CIADOOR.121 VIRUS! Note - "Spoolsv.exe" is located in the Windows or Winnt directory, and not in System32, like the legitimate Spoolsv.exe system file
X spoolsv scvhosts.exe Added by the SMALL-AW TROJAN!
X spoolsv manager SpoolMgr.exe Added by the ASSIRAL WORM!
X spoolsvr32 csmss.exe Added by the AGENT-AU TROJAN!
X spoolsvr32 csmss32.exe Added by a variant of the AGENT-AU TROJAN!
X SPOOLSVU SPOOLSVU.EXE Added by the Startpage.K hijacker
X spoolsvv spoolsvv.exe Searchcentrix hijacker
X Spore MsNews.vbs Added by the SPORE.A WORM!
X Spore.b Scmhlpr.vbs Added by the SPORE.B WORM!
? SPP run.exe ??
X spp regedit -s spp.reg IE search hijacker - changes the default search to http://www.hotsearchbox.com/ie/
? sppbridge sppbridge.exe Associated with an Anycom bluetooth wireless card on laptops - used for printing to portable printers for example. Is it required or can it be started manually? 
? SprintPort SprintPortA.exe Novatel wireless modem related. What does it do and is it required?
U SPSTEALT SmartProtectorPro.exe Smart Protector Pro - internet privacy tool that erases tracks, MRU lists, etc
? spstore storesp.exe Softprobe - program designed to provide managers with an analysis of an individuals computer use who are under their supervision. This program is NOT related to Winpup
U Spy Blocker spyblocker.exe SpyBlocker blocks the communications of spyware installed on a PC so spyware runs but can't exchange data with the server to which it should report. Ensuring spyware can't communicate is important, as you may find after using Ad-Aware that some applications containing spyware subsystems may not run correctly or at all
X SpyBlast SpyBlast.exe Spyware killer that is in effect autoinstalled foistware, targeted by SpyBot, among others
U SpyBlocker spyblocker.exe SpyBlocker blocks the communications of spyware installed on a PC so spyware runs but can't exchange data with the server to which it should report. Ensuring spyware can't communicate is important, as you may find after using Ad-Aware that some applications containing spyware subsystems may not run correctly or at all
X SpyBlocs SpyBlocs.exe Rogue anti-spyware program
U SpybotSD TeaTimer TeaTimer.exe TeaTimer is a new tool of Spybot S&D - spam filter which perpetually monitors the processes called/initiated. It immediately detects known malicious processes wanting to start and terminates them giving you some options, how to deal with this process in the future
U SpyBotSnD Spybotsd.exe Spybot - Search & Destroy - free multi-spyware removal tool from Patrick Kolla
X Spybott lptt01 spybott.exe Variant of the RapidBlaster parasite (in a "Spybott" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
X Spybott ml097e spybott.exe Variant of the RapidBlaster parasite (in a "Spybott" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
U SpyCop ScanCheck MAIN.EXE SpyCop surveillance software detection - checks to see when your machine was last scanned and if it was more than a week asks if you want to scan
N SpyHunter SpyHunter.exe SpyHunter - spyware remover of somewhat dubious repute, see note
U Spykiller Spykiller.exe Shareware "Spyware remover" of questionable quality and repute. There are better alternatives that are freeware to boot
X SpyNuker Spynuker.exe A "spyware removal program" by TrekBlue, which is being heavily advertised through junk e-mail from its affiliates and misleading fake-dialogue-box web advertising. This is the same company as E-mail marketers ‘TrekData’ and ‘Blue Haven Media’, who distribute spyware through ActiveX drive-by-download on web pages
N SpySpotter SpySpotter.exe Spyware remover of dubious repute, see this list of Rogue/Suspect Anti-Spyware Products & Web Sites
U SpyStopper spystopper.exe SpyStopper - blocks intrusive spyware, Web bugs, worms, scripts, advertisements, and cookies. Protects you from being profiled and tracked
U SpySubtract SpySub.exe SpySubtract - multi spyware removal tool
U SpySweeper SpySweeper.exe Spy Sweeper - detects and removes spyware
X Spyware Spyware.exe

BPS Spyware Remover - reportedly uses an old, "borrowed" SpyBot database. Read this and this. Do not support these guys!

N Spyware Begone SpywareBeGone.exe Spyware BeGone - free spyware removal utility. Not recommended - see note
N Spyware Begone freescan.exe Spyware BeGone - free spyware removal utility. Not recommended - see note
U Spyware Doctor spydoctor.exe Spyware Doctor spyware remover
U Spyware Doctor swdoctor.exe Spyware Doctor spyware remover
U Spyware Guard Control Panel spywar~1.exe

"SpywareGuard provides a real-time protection solution against spyware"

X Spyware Nuker Installer SpywareNukerInstaller.exe

A "spyware removal program" by TrekBlue, which is being heavily advertised through junk e-mail from its affiliates and misleading fake-dialogue-box web advertising. This is the same company as E-mail marketers ‘TrekData’ and ‘Blue Haven Media’, who distribute spyware through ActiveX drive-by-download on web pages

X Spyware remover Remove_spyware.exe Unidentified, but not known to belong to any known spyware remover, and strongly suspected to be adware related!
U Spyware Scanner AseScanner.exe Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU, the well known adware company, see here and here
X Spyware Slayer SpywareSlayer.Exe Spyware remover of dubious repute, see this list of Rogue/Suspect Anti-Spyware Products & Web Sites
N Spyware Stormer SpywareStormer.Exe SpywareStormer spyware remover. Not recommended - see here
X Spyware Vanisher FreeScanner.exe Spyware remover of dubious repute, see this list of Rogue/Suspect Anti-Spyware Products & Web Sites
U SpywareGuard sgmain.exe

"SpywareGuard provides a real-time protection solution against spyware"

X SpywareGuard winproc32.exe Startpage adware Trojan
X Spywareguard lptt01 Spywareguard.exe Variant of the RapidBlaster parasite (in a "Spyguard" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
X Spywareguard ml097e Spywareguard.exe Variant of the RapidBlaster parasite (in a "Spyguard" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
X SpywareGuardPlus winmm64.exe StartPage.ht homepage hijacker
N SpywareKilla SpywareKilla.exe Spyware remover of ill repute. For more info about it do a search for 'SpyareKilla' at this web page on "Rogue/Suspect Anti-Spyware Products & Web Sites"
U SPYWATCH SpyWatch.exe

BPS Spyware Remover - reportedly uses an old, "borrowed" SpyBot database. Read this and this. Do not support these guys!

X SQConfigChecker cc.exe Xupiter SQWire variant - adware and homepage hijacker. Note - cannot be removed via the Xupiter website in the same way as other Xupiter variants
X SQInstaller SQInstaller.exe Xupiter hijacker
N SQL Server scm.exe SQL Server Service Control Manager. Available via Start -> Programs
X SQUpdatesChecker uc.exe Xupiter SQWire variant - adware and homepage hijacker. Note - cannot be removed via the Xupiter website in the same way as other Xupiter variants
X sqvynikp sqvynikp.exe Free_Scratch_Cards foistware
? sr1exe updtSup3.exe Found on a Dell computer, in a Documents and SettingsAll UsersApplication DataDellAlert2 subfolder
X sr64 ********. exe Adware, as yet unidentified
X SrchfstUpdate srchupdt.exe SearchFast adware downloader
? SRFirstRun rundll32 srclient.dll, CreateFirstRunRp Created by execution of the Windows XP sr.inf file, which installs the Windows XP System Restore feature, needed for example when installing System Restore into Windows Server 2003. Does this indeed need to run at every bootup?
U Srmclean srmclean.exe Srmclean helps in the installation and execution of the SoundMax SoftPaq for Compaq/ADI SoundMax Integrated Digital Audio. According to Compaq - "If you disable the entry from loading into startup, then you will not be able to use the features of the sound card"
X SRNG srng.exe Search hijacker - see here
U SRP Startup srrpro.exe System Restore Remover Pro allows you to safely and easily remove System Restore and various other Windows Millennium "features." This is enabled if you tick the "Remove unnecessary System Restore information on startup" box. Available via Start -> Settings -> Control Panel
Y SRS Applet SrsTray.Exe S3 Sonic Vibes sound card drivers - if disabled you loose sound
X Srv RPCrom NClienti386.exe Added by the WATSOON.A TROJAN!
X Srv32 Srv32.exe Added by the OPASERV.J WORM!
X Srv32 Srv32.exe Added by the OPASERV.S WORM!
X Srv32 spool service runsrv32.exe Topantispyware.com malware, recognized by Kaspersky antivirus as Trojan-Clicker.Win32.Spyre.b
X Srv32 spool service spoolsrv32.exe Topantispyware.com malware, recognized by Kaspersky antivirus as Trojan-Clicker.Win32.Spyre.b
X Srv32Old [worm filename].PIF Added by the OPASERV.J WORM!
U Srv32Win SpyAgent4.exe SpyAgent - monitoring software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it
U Srv32Win Svchost.exe Realtime-Spy keylogger (monitoring program). Given a "U" recommendation because it depends if you intentionally installed it. If you didn't treat it as "X" and uninstall or remove
X Srv32Win sysdiag.exe NetVizor keystroke logger
X srvexc.exe srvexc.exe Added by the SERVSAX TROJAN!
X ssate.exe irun4.exe Added by the BEAGLE.J WORM!
X ssate.exe winsys.exe Added by the BEAGLE.K WORM!
N SSBkgdUpdate SSBkgdupdate.exe ScanSoft OmniPage auto updater. Can be disabled using the main program's options
? SSC_UserPrompt UsrPrmpt.exe Part of Symantec (Norton) Security Centre. What does it do, and is it required?
Y Ssd Std.exe Stealthdisk - file and folder hiding/locking utility
? ssdiag ssdiag.exe Equinox "Configuration and DOS Diagnostic for DOS and Windows platforms"
N SSDPSRV ssdpsrv.exe Simple Service Discovery Protocol (SSDP) and General Event Notification Architecture (GENA) services for network plug and play functionality. Starts up a web server on port 5000. Used by Universal Plug and Play (for network device discovery). To remove this program, open Add/Remove Programs, select either Communications (Me) or Networking Services (XP), and remove the checkmark next to Universal Plug and Play
X ssgrate.exe system.exe Added by the MITGLIEDER.C TROJAN!
X ssgrate.exe irun.exe Added by the MITGLIEDER.D TROJAN!
X ssgrate.exe irun4.exe Added by the MITGLIEDER.F TROJAN!
X ssgrate.exe sysdoor.exe Added by the MITGLIEDER.N TROJAN!
X ssgrate.exe winerdir.exe Added by the MITGLIEDER.O TROJAN!
X SSK Service winssk32.exe Added by the SOBIG.E WORM!
X SSL svchost.exe Added by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
U ssmmgr ssmmgr.exe Samsung printer monitor - for checking ink levels, etc.
X sstata dwdas.exe Added by the DASDA TROJAN!
X SStb.exe SStb.exe Adpowerzone.com "ServerSide" keyword hijacker
N sstray sstray.exe nVidia nForce Taskbar Utility - quick access to the nForce2 "Sound Storm" control panel and related utilitys
X SSUpdate SSUpdate.exe DyFuCa/MoneyTree parasite variant
X ssvchost ssvchost.exe Added by the HELIOS.B TROJAN!
X SSWPlauncher comet.exe /app:SSWPlauncher CometCursor by Comet Systems
N Stacmon Stacmon.exe Installed with the drivers for a SigmaTel C-Major Audio card (on a Dell Inspiron 600m PC for example). Appears as though it can be disabled with no ill effects
Y Start Quick95.exe For a Nisis G6 USB Graphics Tablet. Re-enables itself if disabled therefore best left alone
X Start windows.vbs Homepage hijacker
? start start.exe ??
X start extracting spoolvse.exe Added by a variant of the RBOT WORM!

Start Up Applications S Page 6
N Start Getright getright.exe See Getright Tray Icon
X Start Page http://find.naupoint.com Naupoint browser hijacker
Y Start RF Wireless Keyboard ktrexe.exe Yuanxun Electronics RF wireless keyboard driver
Y Start RF Wireless Mouse cm20.exe Yuanxun Electronics RF wireless mouse driver
U Start Service upssrv.exe Cyber Power PowerPanelPlus software. "In the event of a power outage, PowerPanelPlus Software automatically saves and closes all open files, and then shuts down the computer system in an intelligent and orderly manner"
U Start Up Cop startcop.exe StartUp Cop - startup manager
X start uploading smsss.exe Added by a variant of the SDBOT WORM!
X Start Upping taskmrg.exe Added by the RBOT-MA WORM!
X Start Upping SVCHOSTES.EXE Added by the RBOT-NB WORM!
X Start Upping taksmgr.exe Added by the RBOT-QK WORM!
X Start Uppings svcchosts.exe Added by the SDBOT.VY WORM!
X Start Uppings mssupdate.exe Added by a variant of the RBOT WORM!
N Start Wingman Profiler lwtest.exe Logitech Wingman software required to operate Logitech joysticks and gamepads.  Unless you're a hard-core gamer, it's best to leave it unchecked
N Start Wingman Profiler lwemon.exe    Logitech Wingman software required to operate Logitech joysticks and gamepads.  Unless you're a hard-core gamer, it's best to leave it unchecked
U Startacc startacc.exe Launches Webroot's Accelerate 2000 software that "speeds up your Internet connection by up to 300%". Leave enabled if you find it improves internet connection
Y StartEAK StartEAK.exe Easy Access Button Support for Compaq PCs. Required if you use these
X starter scvhosting.exe Added by the IRCBOT.E TROJAN!
X Starter scvhosting.exe Added by the SDBOT.RU WORM!
N startl.exe startl.exe Lingocom LingoWare - translates any application into your language
X StartMenu s_menu.exe Added by a variant of the DELF-A TROJAN!
X startpage startpage.exe Browser hijacker - redirecting to pages2start.com
U STARTPAGE start1.exe NoSpy.org - prevents spyware from changing your startpage and other browser properties. The start1.exe file is located in a NOSPY.ORG folder
U StartStop STARTSTOP.EXE StartStop from TFI Technology - startup manager
U StartSurfing STARTS.exe Start Surfing allows you to protect your privacy while surfing and searching the Internet by acting as a "filter" between you and the website you are visiting. Startsurfing acts as your shield from Pop Up Windows, Mouse Traps, Window Resizing, and scripts that attempt to record your personal information. Available via Start -> Programs
N Startup ?? Related to an Iomega drive
? Startup Launcher GUI GUI.exe Startup manager?
X Startup Update Cvshost.exe Added by the GAOBOT.AO WORM!
U StartupMonitor StartupMonitor.exe Mike Lin's StartupMonitor, throws up an alert and asks your permission every time any change is made to your start-up configuration, either in the registry or start menu
X startwindowskeyuser rundle2.exe Added by the JAVAKILLER TROJAN!
N Stat 'n' Perf StatnPerf.exe Stat 'n' Perf monitors your internet connection and displays information about sent and received bytes
X StatBar STATBAR.exe StatBar (system status bar) allows you to quickly get an overview of your system's condition (memory, CPU, uptime, and much more). Due to the sheer number of resources (over 60%) consumed by this program, it is unsuitable for Windows 95/98/SE/Me
N Status Monitor BrMfcWnd.exe Brother scanner status monitor - can be started manually
N Status Monitor XE ENGSS.EXE The Xerox Document WorkCentre XE Series Status Monitor displays information about your printer and currently active or waiting print jobs. You can use it to control your printing environment and manage your printing operations. Available via Start -> Programs
? StatusClient StatusClient.exe Part of Hewlett Packard network printer drivers
? StatusClient 2.6 StatusClient.exe Part of Hewlett Packard network printer drivers
N Stay Connected! StayCon.exe More than just a pinger, actually simulates online activity. Supports AOL, NetZero, MSN, ATT WorldNet, CompuServe and many other ISPs as well. Available via Start -> Programs
U StayAlive sa.exe StayAlive from TFI Technology. "This top-notch tool intercepts crashes when they happen, keeping your programs running so you can save your work."
? STBVision STBVisn.exe Related to the STB Velocity graphics card. What does it do and is it required?
N STBWEBTV STBWEBTV.EXE Used to display TV on your PC
X stcinstaller id53.exe Added by the SCTHOUGHT.L TROJAN!
X stcloader stcloader.exe Popup adware by 2ndThought software
X stcloader STCLOA~1.exe Popup adware by 2ndThought software
X STCLOA~1 stcloader.exe Popup adware by 2ndThought software
X STCLOA~1 STCLOA~1.exe Popup adware by 2ndThought software
Y STCPO STCPO.exe Sophos Sweep antivirus software
U Stealth Anonymizer 2.5 stealth25.exe Now named Stealther - proxy server agent that lets you travel the Internet with maximum possible privacy
N Steam steam.exe Valve Software's STEAM broadband game client. Steam is Valve's new way of getting games into your hands ASAP. Games like Half-Life, Counter-Strike, and Counter-Strike: Condition Zero are all being made available through Steam. Steam games are automatically kept up-to-date with the latest content and revisions. Steam also includes an instant-message client which even works while you're in-game
N Stickies STICKIES.EXE Stickies - utility that allows you to put yellow "Post-It" type messages on your desktop and can be used to set reminders. Available via Start -> Programs
N Sticky Notes stikynot.exe Microsoft Sticky Notes - virtual sticky notes tool
N StickyNote StickyNote.exe Utility that allows you to put yellow "Post-It" type messages on your desktop. Available via Start -> Programs
U StillImageMonitor Stimon.exe Stimon.exe enables a USB still-image device (such as a scanner) to initiate data transfer to a program. For example, if your scanning device has a scan button, it may start a program and begin scanning when you press it. Create a shortcut and start it manually when needed if your scanner otherwise fails to scan. May be required for your USB scanner to work - including all HP scanners and some of their SCSI scanners
X stlbdist rundll32exe stlbdist.DLL, DllRunMain Hijacker pointing to www.searchandclick.com
X stlbupdt rundll32.exe stlbupdt.DLL, DllRunMain BrowserAid/Startium parasite
N STManager drst.exe Dr. SpeedTouch is some sort of diagnostics software which sends out information to a server which then relays the information back to the program to test the network to see if the SpeedTouch ADSL modem connection is working properly. Not required if connected via Ethernet (and probably USB). Can cause a slow down in Win2K - see here
X stmha wkfxi.js Added by the SPETH WORM!
N StopSignStatus stopsinfo.dll", VerifyStatus eAcceleration Stop-Sign related - not recommended, see note
U STOPzilla Stopzilla.exe StopZilla! - pop-up killer
U STOPzilla Service SZNTSVC.EXE StopZilla! - pop-up killer
U StorageGuard sgtray.exe StorageGuard from Veritas. Free utility that integrates with Backup MyPC (formerly Backup Exec Desktop), Simple Backup and MS Backup. Provides system tray access and background monitoring - warning you of files that haven't recently been backed up. Required unless you backup manually on a regular basis or have scheduled backups 
? STPMGR STPMGR.EXE Part of SafeTP which is transparent FTP security software. Does it need to be running permanently or can it be started manually via Start -> Programs
X Strng32 strngbox.exe Added by the STRANO WORM!
X StubPath Sservice.exe Added by the PRORAT TROJAN!
U StyleXP StyleXP.exe StyleXP allows you customize the way WinXP looks. If disabled via msconfig it re-instates itself at reboot, therefore uninstall it if you don't want it
N Subtract the Ads AdSub.exe Removes adverts from web pages. Although useful - not required
U Suitcase Startup Suitcase.exe Suitcase. System font manager start up utility. Used for dynamic managment of fonts on your system
X Suite SuiteOffices.exe Added by the LAZAR TROJAN!
X SULFNBJ.EXE SULFNBJ.EXE Added by the PE_MAGISTR.DAM VIRUS!
X SunJavaUpdate smvss.exe Added by the DEDLER-G TROJAN!
N SunJavaUpdateSched jusched.exe Checks with Sun's Java updates site to see if newer Java versions are available. Visit http://java.sun.com or just run the Java Plug-In Control Panel
U Sunkist shwicon98.exe Card reader for memory cards from digital cameras, etc
U Sunkist2k shwicon2k.exe Card reader for memory cards from digital cameras, etc
? SupaDial SupaDial.exe SupaNet.com modem driver related - is it required?
N Supastatus status.exe Supanet ISP software
U Super Popup Blocker popkill.exe Saga Super Popup Blocker - pop-up stopper
U SuperAdBlocker SAdBlock.exe SuperAdBlocker
X SuperBar.Component [path to services.exe] Added by the SMALL-AQ TROJAN!
U Supercleaner Supercleaner.exe Supercleaner - all in one disk cleaner for your computer
U SuperCool Compress Backup Main.exe "SuperCool Zip Backup software is a data backup,restore and file synchronization program"
X supernews12 newsd32.exe Unidentified adware
X Supernova [worm filename] Added by the SURNOVA (or SUPOVA) WORM!
X superslut msslut32.exe Added by the SLUTER-A WORM!
U SuperSpamKiller Pro Ssk.exe SuperSpamKiller Pro email spam blocker
X Supervisor.exe Supervisor.exe Has been reported to be associated with various antitrojan software like ATS and PC Doorguard. If so it's required in Startup - any further information is welcome
X supporter5 supporter5.exe Part of eScorcher anti-virus software- responsible for updates of new virus bases each time you logon to the web. Used to collect information about the user and therefore treated as spyware - now the web-site is dead
U SureCleanProfessional SRClean.exe SureClean PC and Internet tracks cleaner
U Sureshotpopupkiller Stopthepop.exe Stop-the-Pop-Up popup blocker
X SurfBuddy rundll32 [path] sbuddy.dll SurfBuddy adware - not to be confused with the legitimate SurfBuddy application by SurfApps!
U SurfChoice SCMan.exe SCMan is a utility that can control services on WinNT from the command line. This utility can create, start, pause, stop, delete services. Furthermore it can retrieve a service's current state, get the displayname for a service and vice versa
X Surfer lptt01 surfer.exe Variant of the RapidBlaster parasite (in a "mssurfer" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
X Surfer ml097e surfer.exe Variant of the RapidBlaster parasite (in a "mssurfer" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
U SurfinGuard Pro winsfcm.exe SurfinGuard Pro - internet protection software
U SurfSecret ss2-full.exe "House-cleaning utility that enables you to keep your computer usage to yourself. Runs quietly from the system tray, eliminating tell-tale files at a regular interval of your choosing. You can set it to clear your Internet cache files, cookies, history, temp folder, etc. It can also clear the history of your Run and Find menus, in addition to the AOL cache"
X SurfSideKick 2 Ssk.exe SurfSideKick adware
U SurfStream SurfStream.exe Conceiva "SurfStream lets you surf the Web faster. It contains a fully featured proxy server that lets you surf the Web significantly faster. It also blocks all pop-up windows and banner ads from Web pages. An intelligent tune-up tool automatically analyzes and optimizes your computer's Internet connection and TCP/IP settings"
X Surs awab.exe PurityScan/Clickspring adware
? Surveysa surveysa.exe Found in the SonyVaiosurvey directory on a Sony Vaio PC. What does it do and is it required?
X Susp Susp.exe Transponder parasite updater/installer
X Sustem explorer.exe Added by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate Windows Explorer (explorer.exe) which would only be in startups if you added it manually
X SustemUpdate explorer.exe Added by an unidentified VIRUS, WORM or TROJAN! Note - this is not the legitimate Windows Explorer (explorer.exe) which would only be in startups if you added it manually
X SVA Player SVAplayer.exe QuickFlicks Streaming Player - regarded as spyware. See here for details of how to disable or uninstall it
X Svc svc.exe Hijacker, Clientman parasite variant, redirecting to madfinder.com. Detected by Symantec as the MADFIND TROJAN!
X SVC Service svcinit.exe Added by the SINIT TROJAN!
X SVC Service svcinit.exe CoolWebSearch parasite variant
X SVC Service svcpack.exe CoolWebSearch parasite variant
X SVC Socks mstaskm.exe CoolWebSearch parasite variant

Start Up Applications S Page 7
X Svced Svced.exe Added by the DELF.F TROJAN!
X SvcH0st msexploren.exe Added by the BACKDOOR-CGZ TROJAN!
X svchost Svch0st.exe Added by the GRAYBIRD.B TROJAN!
X SVCHOST svchost.exe System1060 homepage hi-jacker. Found in a WindowsSystem1060 directory. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
X svchost svchost.exe Added by the MORB WORM or TARNO TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
X SVCHOST mrowyekdc.exe Added by the GOTORM WORM!
X svchost Svch0st.exe Added by the GRAYBIRD TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
X svchost [path to trojan] Added by the HAZZER TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
X svchost ADMAGIC.EXE Added by the SMIBAG WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
X Svchost winhost.exe Added by the LOLAWEB.A TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
X Svchost svchost.exe Added by the MOXE-A WORM! This is not the valid svchost.exe as described here
X SVCHOST var.txt.exe Added by the LDPINCH.C TROJAN!
X Svchost svchosl.pif Added by the INZAE.A or INZAE.B WORMS!
X svchost [path] SETUP.EXE Added by the SETCLO WORM!
X svchost [path] SETUP.EXE Added by the SETCLO WORM!
X SVCHOST scvhost.exe Added by the MYTOB.E and MYTOB.G WORMS!
X SVCHOST taskgmr.exe Added by the MYTOB.F or MYTOB.H WORMS!
X svchost.exe svchost32.exe CoolWebSearch parasite related. Note - this is not the valid svchost.exe as described here
X svchost1 svchost1.exe Added by the AGOBOT.ZZ WORM!
X SvcHost32 svchost32.exe Added by the MIMAIL.I or MIMAIL.J WORMS!
X svchost64 svchost64.exe Added by the SDBOTER.G VIRUS!
X svchostr svchostr.exe Added by an unidentified WORM or TROJAN!
X svcinfo svcinfo.exe Added by the CRYPTER.A TROJAN!
X svcroot svcroot.exe Added by the KEYLOG-AC TROJAN!
X svcsys32 svcsys32.exe Added by the AGOBOT-LL WORM!
X svcwinprocess32 [path to worm] Added by the UPERING WORM!
X SVHOST svhost.exe Added by the MYDOOM.I WORM!
X SVHOST SVHOST.EXE Added by the ZORI.A VIRUS!
X Svhost Loader svshost.exe Added by the AGOBOT.G WORM!
? SVIDC32M SVIDC32M.exe ??
X sVideo2 vxdrun6.exe Switch premium rate adult content dialer
? SVM Pop svmpop.exe ??
X svphost.exe svphost.exe Added by the AGENT.CS TROJAN!
X svrrun svrrun.exe Adware hailing from Deskwizz.com
X svshost svshost.exe Added by an unidentified VIRUS, WORM or TROJAN!
X svshost32 msgrsv32.exe Added by the RANKY.AJ TROJAN!
X svshostdriver svshost.exe Added by the SDBOT-HN TROJAN!
X svwin32 unninst32.exe Added by the AGOBOT-NF WORM!
X SVX Control Service svxhost.exe Added by the FORBOT-K WORM!
N Swap Nut javaw.exe SwapNut is a peer-to-peer file sharing and searching utility developed and marketed by File Metrics, Inc. Users can search for and find almost any type of digital file (audio, video, photos etc.) through a secure peer-to-peer network
X SWCaller SWcaller.exe Homepage hijacker - see here
X SWCaller Swcaller2.exe Homepage hijacker - see here
N SWd winwd.exe PC Security from Tropical Software - lock files, password protect, etc
Y Sweep95 ICLOAD95.EXE Part of Sophos ant-virus sofware
X Swf32 AVupdate.exe Added by the MERKUR WORM!
X Swf32 _backup.exe Added by the SYMTEN WORM!
X SwimSuitNetwork SwimSuitNetwork.exe Advertising spyware
U Switch Off swoff.exe Switch Off - tray-based system utility that can automatically perform various frequently used operations like shutdown or restart your computer, disconnect your current dialup connection, lock workstation, etc
N Switchboard.com Toolbar AtHoc.exe Toolbar for the on-line version of Yellow Pages in the US - Switchboard.com
X sws.exe [random filename] Haldex type adult content dialler
N SwTray SWTRAY.EXE MS SideWinder game controller system tray icon. Available via Start -> Programs. May have the version number after it
N SWTrayV4 SWTrayV4.exe MS SideWinder game controller system tray icon. This is specific to version 4 of the software. Available via Start -> Programs
? SXGDSENU sxgdsenu.exe Yamaha SXG soundcard driver
? SxgTkBar sxgtkbar.exe Yamaha SXG soundcard driver
? Sxplog sxpstub.exe Part of CA Unicenter Software Delivery - manage software across various systems, from desktops and servers to PDAs and mobile phones, in a controlled and standardized way - is it required at startup?
X SYDNEY [file path] Added by the SYNEY WORM!
X Sygate Personal Firewall Win32x.exe Added by the RBOT-KZ WORM!
X Sygate Personal Firewall system32.exe Added by the RBOT.VI WORM!
X Sygate Personal Firewall sysgut.exe Added by the SDBOT.WM WORM!
X Sygate Personal Firewall Sygate.exe Added by the RBOT-PN WORM!
X Sygate Personal Firewall Mcafeeupdate.exe Added by the RBOT.YN WORM!
X Sygate Personal Firewall Sygate32.exe Added by the SDBOT.WW WORM!
X Sygate Personal Firewall Start services32.exe Added by the RBOT-MB WORM!
X Sygate Personal Firewall Start servic.exe Added by the RBOT-RY WORM!
X Sygate Personals Firewalls ccsrn.exe Added by a variant of the RBOT WORM!
U SyGateService sgserv95.exe SyGate is a useful little program that lets you share an internet connection over an intranet. Is it needed - it saves a lot of headache to just let SyGate load at startup. Available via Start -> Programs
X Symantec Anti Virus symantec32.exe Added by a variant of the WOOTBOT WORM!
X Symantec Configuration Loader ccApp32.exe Added by a variant of the GAOBOT WORM!
Y Symantec Core LC symlcsvc.exe Part of Norton AntiVirus 2004. What does it do?
N Symantec Fax Starter Edition Port OLFSNT40.EXE Offers a virtual printer as a fax machine. Can be run via a desktop shortcut
U Symantec NetDriver Monitor SNDMon.exe Part of Symantec's LiveUpate (eg, Norton). Not required if you run manual upadtes but probably require if you leave them to run automatically. Also, if one runs a small office network and SNDMon is disabled on one of the computers – then other computers disappear from the network for this computer, including shared devices like printers and scanners. Hence the "U" recommendation
X Symantec Security symantec32.exe Added by the RANDEX.PR or RANDEX.YR WORMS!
X Symantec Security Addon nvsvc.exe Added by a variant of the AGOBOT/GAOBOT WORM!
X Symantec Security Routine Addon for Microsoft Windows navpxaw32.exe Added by the AGOBOT-GJ TROJAN!
X Symantec Service ccApp.exe Added by the AKHER.D WORM! Note - this is also not the valid Norton AV file with the same filename
X SymAV SymAV.exe Added by the NETSKY.U WORM!
U SymKeepAlive CKA.exe Part of Norton SystemWorks 2003 - keeps a dial-up modem connection alive
N SymTray - Norton SystemWorks SYMTRAY.EXE Keeps all System Tray icons for Norton SystemWorks together to reduce clutter. SystemWorks includes Norton Anti-Virus, Norton Utilities and Norton CleanSweep - mentioned elsewhere here. Personally I only have Norton eMail Protect running which doesn't need SymTray
U Sync Data Hndsync.exe Pocket Real Estate - mobile synchronization manager
X Sync Server drwatsoon.exe Added by the WATSOON.A TROJAN!
U Sync-It Syncit.exe Sync-It - synchronizes the system clock with time servers on the internet
U SyncAgent syncagent.exe Ghost Keylogger (monitoring program). Given a "U" recommendation because it depends if you intentionally installed it. If you didn't treat it as "X" and uninstall or remove
N Synchronization Manager mobsync.exe Find more information about its use here
? SynSetup SynTP.tmp RunOnce.exe Probably associated Synaptics touchpads on laptops as for the SynTPEnh and SynTPLpr entries but what does it do and is it required?
X Syntax Script systacq.exe Added by the SDBOT.AI WORM!
U SynTPEnh syntpenh.exe Synaptics touchpad tray icon. Displays status and provides quick launch to touchpad features such as scrolling and tap zones. Required on IBM Thinkpads with UnltraNav (pointstick and touchpad combo) if you don't want to loose the advanced pointstick features such as scroll
Y SynTPLpr syntplpr.exe Synaptics touchpad driver helper. Required for touchpad features to work
X sys regedit /s sys.reg Hijacker
X sys sysdllwm.reg CoolWebSearch parasite variant
X Sys Ren SysRen.exe Unidentified malware
X Sys29 win***32.exe [* = random char] EliteBar adware
X sys32 sys32.exe Added by the FLUX.E TROJAN!
U sys32cmd sys32win.exe Active Keylogger monitoring software - also see here. From the Symantec article: "This spyware program must be manually installed. However, there are several known programs that have Spyware.ActiveKeylog within them and that install it as the program itself is installed". Disable/remove if you didn't install it
X sys32dll sys32dll.exe Added by the AIMDES.B WORM!
X SysA win***32.exe [* = random char] EliteBar adware
U SysAgent SysAgent.exe SYSagent - small utility for retrieving all the hardware and software information required by anyone administering a machine and/or the network it's a part of
X SysAI SysAI.exe AproposMedia adware - also creates SysAI folder in Program Files where the SysAI.exe is also located
U Sysbot sysbot.exe Spector - spying (or monitoring) software to record internet activity
X syscfg syscfg32.exe Added by the KWBOT.S WORM!
X syscfg34.exe syscfg34.exe Added by the ELECTRON WORM!
X Syscheck win.hta Browser hijacker
X syscheck iexplorer.exe Added by the AGENT.DM TROJAN!
X syscm Syscm.exe Vanish adware
? SysComp mssdnl.com Unknown but suspect as *.com are not usually run at start up and the name isn't recognized
X syscon lptt01 syscon.exe Variant of the RapidBlaster parasite (in a "Syscon" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
X syscon ml097e syscon.exe Variant of the RapidBlaster parasite (in a "Syscon" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
X sysconfig iexplorer.exe Added by the CULT.C WORM!
X SysConfig syscfg35.exe Added by the KAZMOR.C WORM!
X sysconfig iexplorer.exe Added by the CULT.H WORM!
X SysConfig wincfg32.exe Added by the SDBOT.ZD WORM!
U Sysconfig Stealth KeySpy.exe Added by StealthKeySpy commercial keylogger
X Syscpy Syscpy.exe Firewall-bypassing, proxied spam relayer. Detected by Symantec as the HOGLE TROJAN!
X SysCtl sysctl.exe Added by the AOK TROJAN!
X Sysctrls procdll.exe Added by the WEEDBOTZ.14 TROJAN!
X sysdir winrun.exe Added by the WINBUR.B WORM!
X Sysdpt sysdpt.exe Win32.Crypt trojan downloader
X sysfiler sysfiler.exe Added by the RETSAM TROJAN!
X SYSfit SYSfit.exe AdShooter adware variant
X sysflg32 sysflg32.exe Added by a variant of the CRYPTER.C TROJAN!
X syshelp syshelp.exe Added by a variant of the LOVGATE WORM!
X sysinfo sysinfo.exe Added by the BEDRILL TROJAN!
X sysinfo.exe sysinfo.exe Added by the BEAGLE.V WORM!
X SysInit wininit32.exe Added by the XABOT WORM!
X sysinit services.exe Added by the NEWLFRM-A TROJAN! Note - this is not the legitimate services.exe process, which should not appear in Msconfig/Startup!

Start Up Applications S Page 8
X Sysino lsess.exe Added by the FORBOT-BF WORM!
X sysint16 sysint16.exe Added by the CRYPTER.A TROJAN!
X Syskey sysinit.exe Added by the BEAGLE.AX WORM!
X Syslib Syslib.exe Adult content related downloader trojan
X Syslog lptt01 Syslog.exe Variant of the RapidBlaster parasite (in a "Syslog" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
X Syslog ml097e Syslog.exe Variant of the RapidBlaster parasite (in a "Syslog" folder in Program Files). It is not recommended you manually uninstall RapidBlaster but use RapidBlaster Killer - see here
X syslogin.exe syslogin.exe Added by the BAGZ-B WORM!
U SysMetrix SysMetrix.exe SysMetrix - skinnable clock and metering application. It monitors and reports on a great number of statistics
X sysmon sysmon.exe Added by the BIZEX WORM!
X Sysmon rpcmon.exe Added by the RANDEX.ATX WORM!
X sysmon sysmon44.exe Added by a variant of the BACKDOOR-CBA TROJAN!
X sysmonnt sysmonnt.exe Transponder parasite related
X SysMonXP SysMonXP.exe Added by the NETSKY.Q WORM!
X sysnate sysnate.exe Added by the MEDIAS TROJAN!
X SysOps SysOps Added by the MSNCORRUPT TROJAN!
X syspath drv.exe Added by the SOBER WORM!
U SysPilot fdxxl.exe G Data "PC Spion" - monitoring and surveillance software, captures all users activity on the PC, see here. Disable/remove if you didn't install it yourself!
X sysPnP bootconf.exe Homepage hijacker, redirecting to coolwwwsearch.com; see for example here
X SysPnP rundll32 setupapi, InstallHinfSection.... oemsyspnp.inf Search hijacker - see here
Y SysPool Mssvc.exe StealthDisk - hides folders, files and applications. Will also encrypt them for better protection
X SysProtect System.exe Added by the NETSPY TROJAN!
X SysR sysmd.exe Adult content based "foistware" (adds hidden components to your system)
X SysReg SysReg.exe Added by the CHEKIN TROJAN!
X SysReg SysReg.exe SearchSeekFind textual marketing foistware
X Sysres Sysres.exe Added by the LOGMOD TROJAN!
X SysRes TASKMANAGER.exe Added by the ELIPTER.A WORM!
X SysRes WWE DIVAS.exe Added by the ELIPTER.D WORM!
X SysScan bvt.exe Added by the AUTOUPDER TROJAN!
X SysSearch Regedit.exe -s [path] pcsearch.reg Added by the StartPage-FN browser hijacker
X SysSearch REGEDIT.EXE -s [path] sysreg.reg Added by the STARTPA-ME TROJAN!
X sysser [path to file] Added by the RAHACK WORM!
X SysService SysService.exe Added by the DELF family of TROJANS!
X SysService32 SysService32.exe Added by the KINDAL VIRUS!
X SysService32 ln32k.dll Added by the KINDAL VIRUS!
X SysService32l systask32l.exe Added by the THEUG WORM!
X SYSsfitb SYSsfitb.exe Searchforit browser hijacker
X SysStrt systemc.exe Added by the AGOBOT-QA TROJAN!
X System run322.exe Added by the LANFILT TROJAN!
X System system.exe Added by various WORMS and TROJANS!
X system regedit -s system.dll Homepage hijacker
X system systemsearch.hta Jetseeker.com hijacker
X System dcomx.exe Added by the CIREBOT TROJAN!
X system Explorer.exe Added by the GRAYBIRD TROJAN! Note - this is located in this is located in C:WindowsSystem (Win9x/Me), C:WinntSystem32 (WinNT/2K), or C:WindowsSystem32 (WinXP) rather than the valid Windows Explorer which is located in C:Windows or C:Winnt
X System YPager.exe Added by the JUNTADOR.K TROJAN! Note - this is not Yahoo! Messenger
X system outlook.exe Added by the MIMAIL.Q WORM! Note that Microsoft's outlook.exe resides in the Program Files sub-directory wheras this resides in C:Windows or C:Winnt
X System Atira.exe Added by the KOTIRA VIRUS!
X SYSTEM lsas.exe Added by the SPYBOT.CJ WORM!
X System kernels32.exe Added by the DLOADER-FC TROJAN!
X System sysctrl.exe Added by WinGuardian. Note - this commercial keylogger is no longer made or sold by Webroot but older copies may still be in existance, those copies will be identified as spyware
X System 64 Driver for Games sys64dvr.exe Added by the SDBOT TROJAN!
X System Applications Profile sap.exe Added by the RBOT-QF WORM!
X System Backup msystem.exe Adult content dialler
X System Cache SysCache.exe Added by an unidentified VIRUS, WORM or TROJAN!
U System Check Rundll32.exe SysDll32.dll, SystemCheck XPCSpy Pro keylogger, surveillance and monitoring software
X system check updater.exe Unidentified adware downloader
X System Config Manager crss.exe Added by the AGOBOT.GH WORM!
X System Config Manager smssl.exe Added by the AGOBOT-ZJ WORM!
X System Configuration iexplore.exe Added by the RANDEX.AD WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process, which should not appear in Msconfig/Startup unless you add it manually!
X System Database administration systemDA.exe Added by the DERDERO.B WORM!
X System Database Administration Support Process sysdasp.exe Added by the DERDERO.C WORM!
X System Diagnostics sysdiag32.exe Added by the SDBOT.GEN TROJAN!
N System DLF cpqdiaga.exe Compaq Diagnostic record system utility which allow you to view information about your computer's hardware and software configuration. Available via Start -> Programs
X System Document Application nmod.exe Added by the SDBOT-ABB WORM!
X System Document Application msdocument.exe Added by the RANDEX.COX WORM!
X System driver Messenger.exe Added by a variant of the SMALL.BJ TROJAN!
X System Efficiency Monitor mscedit32.exe Added by the SDBOT.P TROJAN!
X System Efficiency Monitor mscommand.exe Added by the KWBOT.P WORM!
X System Executable DLL Library EXECDLL32.exe Added by the RANDEX.AZ WORM!
X System Failure Statistic cnstat.exe Added by the RBOT-LF WORM!
X System File Drivers nvsysvc32.exe Added by the AGOBOT.WJ WORM!
X System Handler LSASS.EXE Added by the NIMOS WORM! Note - this is not the legitimate Lsass.exe system file should normally NOT figure in Msconfig/Startup!
X System Host Service svchost.exe Added the the CONE.F WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
X System Information Manager Navcpe.exe Added by the SDBOT-QB WORM!
X System Information Manager Msbb.exe Added by a variant of the BACKDOOR.IRC.BOT TROJAN!
X System Initialization msmsgri32.exe Added by the RANDEX.D WORM or ROXY or ROXY.B TROJANS!
X System Initialization payload.dat Added by the RANDEX.D WORM or ROXY or ROXY.B TROJANS!
U System LifeGuard Scheduler Slsched.exe System LifeGuard scheduler
X System Log Event csrss32.exe Added by the AGOBOT-JI WORM!
X System Manager svchost.exe Added by the BANKER-AE TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
X system manager System.exe Added by the FORBOT-BO WORM!
X System Manager winsrv32.exe Added by an unidentified WORM or TROJAN!
U System Mechanic Popup Stopper Popupstopper.exe Iolo "System Mechanic" popup stopper
U System Monitor SYSMON.EXE Comes with some Aopen motherboards. Monitors CPU temp, voltage and fan speed. Warns if any become abnormal
X System Monitor Sysmon16.exe Added by the SDBOT TROJAN!
X System MScvb mscvb32.exe Added by the SOBIG.C WORM!
X System Networking sysnet.exe Added by the RBOT.API WORM!
X System Profile Regsrv.exe Added by a variant of the OPTIX TROJAN!
X System Restore svcnet.exe Added by the TIBICK WORM!
X System Restore Data [path] repcale.exe [path] beird.exe Added by the RANDON.AN WORM!
X System Service MSREXE.EXE Added by the AML TROJAN!
X system service spoolcrv.cpl Added by the INSPIR.11 TROJAN!
X System Service systems.exe Added by the AGOBOT.VZ WORM!
X System Soap Pro soap.exe System Soap Pro internet cleaning software. Bundles foistware like HTTPER and Zipclix - best avoided
U System startup charmapx.exe Only required if using an oriental language
X System Startup Voltio.exe Added by the RBOT.NJ WORM!
X System Stats SystemStats.exe Added by a variant of the WOOTBOT WORM!
X System Terminal SYSTEM2.EXE Added by the SPYBOT-BZ TROJAN!
X System time updator CSysTime.exe Added by the RANDEX.S WORM!
X System Toolkit Systools.exe Added by the RONOPER-G WORM!
X System Tray msccn32.exe Added by the PALYH.A WORM! Warning - spreading via infected E-mail attachments with the sender address faked as support@microsoft.com. Note - this is not the valid SystemTray (SysTray.exe)
X System Tray Services spooles32.exe Added by the AGOBOT.ZH WORM!
X System Tray32 SysTray32.exe Added by the REPAD WORM!
X System Update [filename].exe CoolWebSearch parasite variant
X System Update [random filename] Added by the KORGO.W or KORGO.X WORMS!
X System Update wupdmgr.exe Added by the SOROMO-A TROJAN!
X System Update [random filename] Added by the SOROMO-A TROJAN!
X System Update Service wmiprvsa.exe Added by the AGOBOT-RG TROJAN!
X System Update2 explorer.exe Added by the AUTOTROJ-C TROJAN!
X System Update2 services.exe Added by the AUTOTROJ-C TROJAN!
X System Update2 svchost.exe Added by the AUTOTROJ-C TROJAN!
X System Update2 system.exe Added by the AUTOTROJ-C TROJAN!
X System Update2 taskman.exe Added by the AUTOTROJ-C TROJAN!
X System Update2 taskmon.exe Added by the AUTOTROJ-C TROJAN!
X System Update2 update.exe Added by the AUTOTROJ-C TROJAN!
X System Update2 webcheck.exe Added by the AUTOTROJ-C TROJAN!
X System Update2 wininet.exe Added by the AUTOTROJ-C TROJAN!
X System Update2 winlogon.exe Added by the AUTOTROJ-C TROJAN!
X System Update2 winspool.exe Added by the AUTOTROJ-C TROJAN!
X System Update2 wupdmgr.exe Added by the AUTOTROJ-C TROJAN!
X System Updater Service wmiprvsw.exe Added by the GAOBOT.AFC WORM!
X System Uptime Server SYSENTRY.EXE Added by the RBOT.LK WORM!
X System Uptime Server SYSENTRY32.EXE Added by the RBOT.LK WORM!
X system xp acdsee demo.exe Added by the SALGA.A WORM!
X System-Config msptmf32.com Added by the LIOTEN.FA WORM!
X System-Service EXPLORER.SCR Added by the BENJAMIN WORM! KaZaA file-sharing users beware!
X system. system..exe Added by the OPTIXPRO.13.C TROJAN!
X system... system...exe Added by the OPTIXPRO.13.C TROJAN!
X System.exe System.exe Added by various WORMS and TROJANS!
X System32 system.exe Added by the BUSHTRO122 TROJAN!
X System32 System32.exe Added by any number of WORMS or TROJANS!
X System32 sysdiag.exe SpyAgent.B spyware
X System32 system32,1.exe Added by an unidentified VIRUS, WORM or TROJAN!
X system32 NeT-BoT.exe Added by the AGOBOT-LJ WORM!
X system32.dll systeminit.exe CoolWebSearch hijacker re-directing to your-search.info
X system32.dll sysdll32.exe CoolWebSearch parasite related. Redirecting to wholeworldmarket.com, most likely other domains as well
X system32.exe services32.exe Added by a variant of the BACKDOOR.IRC.BOT TROJAN!
X System32Dll DLL32SYS.EXE Added by the SPYBOT-CZ WORM!
X System32Ex System32Ex.exe Added by the IRCCONTACT TROJAN!
X System33 FB_PNU.EXE Added by the NICHELLO-A WORM!
X SystemAdministration Wincmp32.exe Added by the ASYLUM TROJAN!
U SystemAgent Sage.exe "Microsoft Plus! System Agent automatically tunes your system, performing tasks such as disk optimization and error correction. It can also run any application at prescheduled times"
X SystemBackup mtx.exe Added by the MTX VIRUS/WORM!
X SystemBackup MicroLog.exe Added by the MICROLOG.A TROJAN!
? SystemBoot ladies.htm Unknown but sounds very suspicious??
X SystemBoot Mshta.exe ...filename.hta Adult content dialler
X SystemCheck Systemcheck.exe Added by the LAVITS WORM!
X SystemChecker Syschk.exe Added by the GALIL.F WORM!
X SystemCONF98i SystemCONF98i.exe Added by the GLITCH BOT TROJAN!
X SystemDebug Sysdeb32.exe Added by the SYSBUG TROJAN!
X SystemDll SystemDll.exe Added by the LOXOSCAM TROJAN!

Start Up Applications S Page 9
X systemdrv ms32sys.exe Added by an unidentified WORM or TROJAN - most likely GAOBOT variant
X SystemEmergency [various filenames] SmartSearch - a CoolWebSearch parasite variant
X SystemExplorer explore.exe Homepage hijacker - file located in the "Services" folder in Common Files
X SystemFTP VSENMB.exe Malware (ie, malicious software).  Also changes the system.ini Shell line to read Shell=Explorer.exe VSENMB.exe, and it hacks the Winstart.bat as well
X SystemInit iservc.exe Added by the FIZZER WORM!
X Systemiom Updater Systemiom.exe Added by the SPYBOT.TY WORM!
X SystemLoad32 sysload32.exe Added by the MIMAIL.E WORM!
X SystemManager Sysman32.exe Added by the DOWNLOADER-BW.B TROJAN!
X SystemMap32 Netisp32.vbs Added by the REDIST.C WORM!
X SystemMD md.exe Homepage hijacker
X SystemMonitor Sysmon32.exe Added by the AIDID.A WORM!
X SystemNetwork NETSERV.EXE Added by the NETCONTROL VIRUS!
? SystemReg PROCES.EXE ??
X SystemReg svchost.exe Added by the DEWIN.E TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!
X SystemReg WINREG.EXE Added by the DEWIN.A TROJAN!
X Systems scchost.exe Added by the DAEMOZ.A TROJAN!
X Systems Restart slchost.exe Added by the BANCOS.RF TROJAN!
X Systems Restart spchost.exe Added by a variant of the BANCOS.RF TROJAN!
X Systems Restart Rundll32.exe beem.dll, DllRegisterServer Browser hijacker - the file serves to register a dll implemented as a browser plugin
X Systems Restart Rundll32.exe snim.dll, DllRegisterServer Added by the Startpage.I hijacker
U Systems.exe Systems.exe Keyboard Spectator - monitoring software that creates records of everything people do on a computer, ie, spying or monitoring depending upon how you call it
U SystemSafe Syssafe.exe System Safety Monitor - system monitoring tool with additional application firewalling
X SYSTEMSars32 csrss.exe Added by the AHLEM.A WORM! Note - this is not the legitimate csrss.exe process which should NOT appear in Msconfig/Startup!
X SystemSAS System32.exe Added by the KWBOT.C WORM!
X SystemSearch regedit.exe -s c:ie.reg Installs a Seachxl.com browser page hijack
X SystemSearch regedit.exe -s c:sys.reg Installs a i--search.com browser page hijack
X SystemService msocfg.exe Premium rate adult content dialler
X SystemService navchk.exe Premium rate adult content dialler
X SystemService qservice.exe Premium rate adult content dialler
X SystemService shman.exe Premium rate adult content dialler
X SystemSettingf TRUG.vbs Added by the TRUG.B MACRO!
U SystemSuite Task Manager MXTASK.EXE vcom (nee Ontrack) SystemSuite - PC maintenance and security. Use the program's configuration options to enable only the parts you want running all the time - such as Virusscanner Pro
X SystemTasks filez.exe Adult content dialler
X SystemTasks sexypicz.exe Adult content dialler
X SystemTasks loaded.exe Adult content dialler
X Systemtra Systra.exe Added by a variant of the LOVGATE WORM!
X SystemTra CDPlay.EXE Added by a variant of the LOVGATE WORM!
U SystemTray SysTray.Exe SYSTRAY.EXE - System Tray Services. Provides the Volume Control, PC Card Status, Power Management and other icons that reside in the System Tray (see here). SYSTRAY.EXE may be disabled if none of these services are required. It will launch as and when required if you later enable the icons. If you need these items they're available via Start -> Settings -> Control Panel
X SystemTray SystemTray.exe Added by the BIGFOOT TROJAN! Note - this is not the valid SystemTray (SysTray.exe)
X SystemTray SysTray.exe Added by the ALADINZ.P TROJAN! Note - this is not the valid System Tray (systray.exe) which resides in C:WindowsSystem (Win9x/Me), C:WinntSystem32 (WinNT/2K) or C:WindowsSystem32 (WinXP). If you right-click on the real systray.exe the "Properties" reveal it to be a Microsoft file
N SystemUpd SystemUpd.exe Updater for Swapoo.com, a kind of Napster for games
X SystemWideHook for Windows NT %WinHook32.exe Added by the MYDOOM.AC WORM!
U SystemWizard Sniffer Sniffer.exe SystemWizard for Win98/ME from SystemSoft - diagnoses and solves hardware and software problems on a PC
X systemyom Updater systemyom.exe Added by a variant of the BACKDOOR.IRC.BOT TROJAN!
X SYSTEMZ Patch SYSZ.exe Added by the ALADINZ.P TROJAN!
U System_Messages pprsen.exe TerminatorX - "offers an easy and effective method of stopping users running predetermined file sharing programs like KaZaA, messenger programs, chat rooms and the like"
X Systesms.exe systesms.exe Added by the RBOT-HI WORM!
N Systest Systest.exe Clean Space temp files cleaner
X systhread winkernal.exe Added by the LIAMED WORM!
X SysTime systime.exe CoolWebSearch parasite variant
X Systmesy Systmesy.exe Added by the RBOT-KQ WORM!
X Systoan32 systoan.exe Added by an unidentified VIRUS, WORM or TROJAN!
? systr32 systr32.exe ??
? systrax systrax.exe ??
X Systray Systray_.Exe Added by the KERGEZ.A WORM!
X Systray [filename.exe] Winfavorites adware
X SYSTRAY UNMT.EXE Added by the SDBOT WORM!
U SysTray SysTray.Exe SYSTRAY.EXE - System Tray Services. Provides the Volume Control, PC Card Status, Power Management and other icons that reside in the System Tray (see here). SYSTRAY.EXE may be disabled if none of these services are required. It will launch as and when required if you later enable the icons. If you need these items they're available via Start -> Settings -> Control Panel
X SysTray Snnpapi.exe Added by an unidentified TROJAN!
X Systray driver systray.exe Added by the MUTEBOT TROJAN! Note - this is not the real SystemTray which shares the same filename
X SystrayServices Msxpw.exe Added by the CITOR WORM!
X systree systree Added by the BANCOS.L TROJAN!
X Systry [path to worm] Added by the AUTEX WORM!
X SYStry spoolsvr.exe Added by the SDBOT.GN WORM!
X Systryt [path to worm] Added by the AUTEX WORM!
X sysu sysu.exe Dynamic Desktop Media adware - see here
X SysUpd Sysupd.exe VirtuMonde adware
X Sysvupex Sysvupex.exe Added by the MEDIAS TROJAN!
U SysW8 csta.exe Clean Space - privacy and perfomance enhancer
U SYSWB6 SYSWB6.exe We-Blocker - gives parents the opportunity to monitor their children's Internet access and provide them with age-appropriate content, while filtering out sites that contain adult content
X SysWin SysWin.exe Added by the IRCCONTACT TROJAN!
X syswin32 syswin32.exe Added by a variant of the SPYBOT WORM!
X Syswindow Syswindow.exe Added by the COW TROJAN!
X SYS_CLEAN Service.exe Added by the FLOPCOPY WORM!
U SZMsgSvc.exe SZMsgSvc.exe StopZilla! - pop-up killer