Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown
Startup Name Process Name Details
X SBMPOP SBMPop.exeSearchByMedia adware
N SBMX sbmx.exeSoundMAX MPU401 MIDI device emulator for x86 VM DOS games/apps (for Win9x only)
X SBR2009F SystemBooster2009.exe"SystemBooster2009 rogue system suite - not recommended
X sbss Launcher sbss.exe"SideBySide adware"
U SbUsb AudCtrl "RunDll32 sbusbdll.dll RCMonitor"
N sc scrubxp.exe"ScrubXP - utility that deletes safe to remove files
U sc sc.exe"Watchdog 2.0 Software - monitoring program"
U sc run.exe"All-In-One_SPY stealth monitoring software - allows monitoring and recording of all actions performed on a computer. It records all keystrokes
X SC2 scprot4.exe"Added by the AGENT.APP TROJAN!"
? sc23exec sc23exec.exe"Possibly related to a digital camera"
Y SC3300CC SC3300CC.exeSiPix digital camera Twain device driver
X scain s030109.Stub.exe"Delfin Media Viewer adware related"
X ScamDisk SVOHOST.exe"Added by the LEWOR.D WORM!"
X scan mscman.exe"ClientMan parasite variant"
? Scan Detector Pmxdetect.exe"Associated with PrimaScan scanners. Is it required?"
X Scan Register ssms.exe"Added by the RBOT-AT WORM!"
? Scan Wizard button.exe"Associated with Scan Wizard as supplied with Microtek scanners - see also the Scanner Detector and Sdetect entries. What does it do and is it required?"
U Scan2pc Scan2pc.exe"Scan to PC application for the scanning function of multiple multifunction printers from Dell
X ScanDisc satan.exeAdded by the GREGSTAR TROJAN!
X ScanDisk ScanDisk.exe"Added by the GANDA.A WORM! Note - this is not the valid ""ScanDisk"" Win9x/Me standard disk error checker"
X scands32.exe scands32.exe"Added by a variant of the ADCLICKER TROJAN!"
X Scandsk2 scandsk2.exe"Added by the AGOBOT-PK WORM!"
X scandskx.exe scandskx.exe"Added by the DLOADR-ARM TROJAN!"
? ScanFile ??"??"
Y ScanInicio Inicio.exe"Part of Panda Antivirus. Responsible for scanning the boot sector of your disk and your memory at startup to check for viruses that try and load and act before your anti-virus is fully operational. It only adds a fraction of a second to start-up time and is worth leaving active"
N Scanner Detector SDetect.exe"ScanSuite Scanner Detector - part of ScanWizard
Y Scanner File Utility NsCatCom.exe"Kycocera Mita network copier/printer/scanner process to dump scanned documents onto a workstation"
? ScanPanel ScanPanel.exe"Trust Easy Webscan scanner related - what does it do and is it required?"
X Scanreg [filename]"Added by the QQPASS.E TROJAN!"
X ScanRegistry nsrvnt.exe"Added by the NERTE TROJAN! Not to be confused with the real ScanRegistry - which is a vital Windows file. This version has the executable as nsrvnt.exe not scanregw.exe"
X ScanRegistry scanregv.exe"Added by the MASTERLOCK TROJAN!. Not to be confused with the real ScanRegistry - which is a vital Windows file. This version has the executable as scanregv.exe not scanregw.exe"
Y ScanRegistry Scanregw.exeScans the Win98/Me system registry and makes back-ups at start-up - important should the registry become corrupt. Located in %windir%
X ScanRegistry Scanregw.exe"Added by the STATOR WORM! Note - this is not legitimate ScanRegistry entry - which is a vital Windows file. The executable ""Scanregw.exe"" is located in %System%. Runs from the registry RunServices key as opposed to the Run key"
X ScanRegistry N/A"Added by the DINOXI or DINOXI.B WORMS!"
X ScanRegistry scanregw.exe"Added by the NYXEM-D WORM! Note - do not confuse this with the legitimate Windows process scanregw.exe which is always found in the Windows folder on Win9x/ME machines. This worm file is found in %System%"
X ScanRegistry update.exe"Added by the DWNLDR-FZY TROJAN!"
N ScanSoft OmniPage SE 4.0-reminder Ereg.exe ereg.ini"Registration reminder for Ominpage SE version 4 from Scansoft (now Nuance)"
N ScanSoft PaperPort 7 Registration Reminder NAVBrowser.EXE"Registration reminder for PaperPort 7 from Scansoft (now Nuance)"
N ScanSoft PDF Professional 4-reminder Ereg.exe Ereg.ini"Registration reminder for PDF Converter Professional version 4 from Scansoft (now Nuance)"
X ScanSpyware Scanner.exe"ScanSpyware rogue security software - not recommended
X ScanSpyware v3.2 Scanner.exe"ScanSpyware rogue security software - not recommended
X ScanSpyware v3.5 Scanner.exe"ScanSpyware rogue security software - not recommended
U ScanSys32 sb32mon.exe"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
X scApp scApp.exe"Added by the STANDO-E WORM!"
X scApp suchost.exe"Added by the ACNATT.A WORM!"
X scApp wmiprvse.exe"Added by the SILLYFDC-AW WORM!"
N SCardSvr scardsvr.exeRelated to SmartCard readers and sometimes uses lots of system resources
X SCardSvr SCardSvr32.Exe"Added by the MOFEI.B WORM!"
U SCDEmuApp.exe SCDEmuApp.exe"Related to PowerISO - CD/DVD image file processing tool"
U Schdlr32 Schdlr32.exe"Scheduled backups for the NTI Backup Now archiving utility. If a backup job has been scheduled
X scheck45 scheck45.exeRelated to unknown malware - hidden installer associated with it
X schedl schedl.exe"Added by the VB-DVW WORM!"
U schedm schedm.exe"Part of Antivir PersonalEdition Classic anti-virus"
X ScheduIe nrchk.exePremium rate adult content dialler
X ScheduIr msexploren.exe"Added by a variant of the SDBOT WORM!"
X ScheduIr shch.exe"Added by a variant of the SDBOT WORM!"
X ScheduIr svchst.exe"Added by a variant of the SDBOT WORM!"
X ScheduIr winagent.exe"Added by a variant of the SDBOT WORM!"
U Schedule Schedule.exe"Scheduler for Mercury Ez View TV Tuner Card"
N Scheduled Maintenance Scheduled_Maintenance.exe"Scheduler for Iolo System Mechanic tweaking utility. It can cleans your registry and deletes temporary files at defined intervals. Available via Start -> Programs"
X Scheduler expIorer.exe"Added by the TACTSLAY.A TROJAN!"
X Scheduler MSMSGS.EXE"Added by the HOSTBANK-A TROJAN! Note - this particular msmsgs.exe file is located in %System%\Config and should not be mistaken for the MSN Messenger file of the same name which is located in %Program Files%\Messenger"
X Scheduler outIook.exe"Added by the TACTSLAY.A TROJAN!"
X Scheduler svcrhost.exe"Added by the TACTSLAY.A TROJAN!"
X Scheduler svcshost.exe"Added by the TACTSLAY.A TROJAN!"
X Scheduler winagent.exe"Added by the TACTSLAY.B TROJAN!"
U Scheduler Scheduler daemon.exe"Tenebril GhostSurf or SpyCatcher related scheduler - you can schedule daily
X Scheduler msnexploren.exe"Added by the TACTSLAY.B TROJAN!"
X Scheduler sdhch.exe"Added by the TACTSLAY.B TROJAN!"
X Scheduler svchst.exe"Added by the TACTSLAY.B TROJAN!"
X Scheduler Service wsass.exe"Added by the LIOTEN.KX WORM!"
X SchedulerMgr navchk.exePremium rate adult content dialer
U scheduler_monitor init_scheduler.exe"Scheduler for ReaConverter advanced image converter"
U scheduler_proxy Application scheduler_proxy.exe"Found on IBM/Lenovo ThinkCentre/ThinkStation desktops and Thinkpad notebooks. Included with versions of ThinkVantage System Update (for software updates)
X Scheduling Agent Scheduler.exe"Added by the SUBWOOFER TROJAN! Note - this is not the real MS Scheduling agent as the executable is incorrect"
X SchedulingAgant MMTASK.EXE"Added by the YAB.A TROJAN! Not the valid MusicMatch Jukebox which has the same filename"
U SchedulingAgent mstask.exe"MS Scheduling Agent in Win98/Me/2K - displayed as a box with a stopwatch in the System Tray that is only needed if you have regular scheduled disk defragmenting
U SchedulingAgent mstinit.exe"MS Scheduling Agent in WinNT - displayed as a box with a stopwatch in the System Tray that is only needed if you have regular scheduled disk defragmenting
X SchedulingAgent N/A"Added by the DINOXI or DINOXI.B WORMS!"
X SchedulingAgent mstask.exeAdded by unidentified MALWARE! Note - this is not the MS Scheduling Agent in Win98/Me/2K. This one also loads via the HKLM\RunServices registry key but is located in %System% on a WinXP machine - where a file of that name does not normally exist
X SchedulingAgent mstasks.exe"Added by the MSIC BACKDOOR!"
X SchijfBewaker SysRep.exe"SchijfBewaker
X SchijfControleur GDC.exe"SchijfControleur Dutch rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
U Schmaili Schmaili.exe"Schmaili - insert animated smilies into your e-mail"
X schost [path to trojan]"Added by the TJSERV.D TROJAN!"
N SchSvr SchSvr.exe"WinScheduler is installed with Home Theater or WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
Y SCHWIZEX SCHWIZEX.EXE"Part of ConfigSafe - lets you identify changes to the registry
X sck121 helpsyss.exeAdded by a variant of the MAILBOT TROJAN!
N sclauncher sclauncher.exe"SimpleCenter digital media player/manager that supports the iPod
X sclick sclick.exe"Added by the FAKEALERT TROJAN!"
X ScManager scman.exe"Added by the FORBOT-CW WORM!"
X scopedll scopedll.exe"Added by a variant of the CRYPTER.C TROJAN!"
N Scotia OnLine Recovery etdirrcv.exe"Scotia OnLine Security Software provided by Entrust for
N Scotia OnLine Security v*.* Recovery etdirrcv.exe"Scotia OnLine Security Software provided by Entrust for
X Scr scr.scr"Added by the OPASERV.T WORM!"
N ScrapPad Scrappad.exe"ScrapPad allows you to quickly and easily record notes
X scrbmk [path to trojan]"Added by the DLOADER-VP TROJAN!"
U Screen Calendar scrcal.exe"Screen Calendar allows you to create custom desktop wallpapers with built in active calendar and scheduler"
U Screen Guard launch.exe"Part of Access Denied security and privacy software"
U Screen Guard Message Scan sgms.exe"Part of Access Denied security and privacy software"
X Screen Saver scrnsaver.scr"Added by the RBOT-AGP WORM!"
N Screen Saver Control FSScrCtl.exeInstalls as part of the Hubble Space Telescope screen saver (and possibly others). Lets you control your installed screensavers from a System Tray icon
N ScreenHunter 4.0 Free ScreenHunter.exe"""ScreenHunter 4.0 Free is a completely free screen capture software for you to easily take screenshots"""
N ScreenPrint32 ScreenPrint32.exe"ScreenPrint32 screen capture software - can be launched manually"
X ScreenSaverPlus "rundll32.exe MSA64CHK.dllDllMostrar"
? screxe scruser2k.exe"??"
? script script.bat"Maybe associated with DOS on a Win9x machine"
Y ScriptBlocking SBServ.exe"Update to Norton AntiVirus 2001. Detects certain types of script-based viruses without the need for specific virus definitions - such as JavaScript and VBScript. This will help protect you from these viruses even before virus definitions are available. Note - some users complain of problems once the update is installed - refer here for more information"
Y ScriptSentry Scriptsentry.exe"Script Sentry from Jason's Toolbox. Blocks malicious scripts and allows safe scripts to run. Only required if you want it to check the file associations it guards at startup. It will function regardlessly"
U Scroll-In-Mouse V2.0 SCROLL.EXE"Toolkit for the Lynx-3D Net scroll mouse from QTronix. Required if you use the special features"
X scroller fpapli.exe"CoolWebSearch parasite variant"
X scrss scrss.exe"Added by the HACDEF-R TROJAN!"
X scrsvc scrsvc.exe"Added by the AGENT-DS TROJAN!"
X ScrSvr ScrSvr.exe"Added by the OPASERV WORM!"
X ScrSvrOld [worm filename]"Added by the OPASERV WORM!"
Y Scsi Scsi.exeSCSI Miniport driver
X scssrr.exe Services.exe"Added by the VB-EMX TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X sctrlmgr sescmgr.exe"Added by a variant of the DWNLDR-GAH TROJAN!"
Y SCTUINotify SCTUINotify.exe"Part of Windows SteadyState
X scvhost svzhost.exe"Added by a variant of the SPYBOT WORM!"
U scvhost scvhost.exe"Wiretap surveillance software. Uninstall this software unless you put it there yourself"
X scvhost scvhost.exe"Added by the AGOBOT-LI WORM!"
X scvhost loader ixplore.exe"Added by the SDBOT-CY TROJAN!"
X scvhost.exe scvhost.exe"Added by the LOHAV-N TROJAN!"
X Scvsrv32 scvsrv32.exe"Added by the AGOBOT-PM BACKDOOR!"
X sd32info sd32info.exe"Added by the CRYPTER.A TROJAN!"
U SDaemon sdaemon.exe"PC Security™ from Tropical Software - ""is the ultimate in computer security
U SDAutoLiveupdate LiveUpdateSD.exe"Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here"
X SDAv csnss.exe"Added by the SERFLOG.C WORM!"
X SDAv svhost.exe"Added by the SERFLOG.C WORM!"
X sdchosts32 vbdd.exeAdded by the RANKY.AG TROJAN!
? SDClientMonitor sdclientmonitor.exe"Related to LANDesk Management Suite from LANDesk Software Ltd. What does it do and is it required?"
N SDetect SDetect.exe"ScanSuite Scanner Detector - part of ScanWizard
X sdfgsdfg hey.exe"Added by the AGOBOT-OR WORM!"
X sdfsdfsdf sp2update.exe"Added by a variant of the SPYBOT WORM!"
X SDIN Adapter sdin.exe"Added by the FORBOT-AP WORM!"
? SDJobCheck triggusr.exe"Part of CA Unicenter Software Delivery - manage software across various systems
X SDK Codre Function22 sdkimddprovment2.exe"Added by the SDBOT-YJ WORM!"
X SDK Core Component sdkcore.exe"Added by the SDBOT-WC WORM!"
X SDK Core Function sdkimprovment.exe"Added by the RBOT.BHL WORM!"
X SDK Core Function2 sdkimprovment2.exe"Added by the SPYBOT.OGX WORM!"
X Sdk**.exe [* = random char] Sdk**.exe [* = random char]"CoolWebSearch/HomeSearch adware - for examples
X Sdk**32.exe [* = random char] Sdk**32.exe [* = random char]"CoolWebSearch/HomeSearch adware - for examples
X SDKcore Update Components2 SDKC0R3.exe"Added by the RBOT-ABA WORM!"
X SDKCprords SDKc55rezzz.exe"Added by the RBOT.VD WORM!"
X sdkupdate22 SDK0mCORE.exe"Added by the FORBOT-DT WORM!"
X SDKz0r SDKc55rezzz2.exe"Added by the SDBOT-UN WORM!"
? SDMSSplash launcher.exe"Part of HP's Smart Desktop Management System - ""Preloaded on select business desktops
N SDPhotoBar.exe SDPhotoBar.exe"SmartDraw Photo (now FotoFinsh) - ""organize
X SDR6V_Check udcsdr.exe"Part of the DriveCleaner rogue security software - not recommended
X SDR6_Check udcsdr.exe"Part of the DriveCleaner rogue security software - not recommended
X sdrss sdrss.exe"Added by the SDBOT-SQ WORM!"
U sds20 svchost.exe"InlookExpress logs keystrokes and captures screenshots. If you didn't install this yourself remove it. Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in C:\sds20"
X SdScans** stup_tmp.#32"Added by the SDSCAN.A TROJAN - where ** are random upper case letters"
U SDTray sdtray.exe"RSA Keon Web PassPort - software that allows organizations to use digital certificates in a Web-based environment to help ensure that their transactions are authentic
Y SDTray SDTrayApp.exe"System Tray access to an older version of Spyware Doctor antispyware from PC Tools"
X sdxsys32 sdxsys32.exe"Added by the BROGGER-A TROJAN!"
U sealmon sealmon.exe"SealedMedia enables you to combine document protection and control with your existing applications - such as Microsoft Word
X Search Bar taskbar.exe"Added by the OPANKI-F WORM!"
X Search Defender SearchDefender.exe"Installed by SpeedItUp without permission
? Search Hook srchhook.exe"??"
X Search Page http://find.naupoint.com"Naupoint browser hijacker"
U Search Protection SearchProtection.exe"""Yahoo! Search Protection will alert you if an attempt is made to change your default browser search engine from Yahoo!"""
X Search-Exe SE.exe"Search-Exe hijacker"
X Search.vbs Hijacker
X SearchAndDestroyMFC Search And Destroy.exe"Search And Destroy rogue security software - not recommended
X SearchAndDestroyScheduler SearchAndDestroy.exe"Search And Destroy rogue security software - see here and here"
X SearchAndDestroyT SearchAndDestroy.exe"Search And Destroy rogue security software - see here and here"
X searchbar vnmispoisn downloader.exeSearchBarCash adware variant
X SearchClick [trojan filename]"Added by the AGENT-DWR TROJAN!"
X SearchEnhancement scbar.exe"SCBar foistware"
X SearchMP3 "rundll32.exe MSA64CHK.dllDllMostrar"
X searchnav searchnav.exeSearchNav adware - IEFeatures/Popnav variant
X SearchNavVersion searchnavversion.exeSearchNav adware - IEFeatures/Popnav variant
X SearchNet_Up ServeUp.exe"SearchNet adware"
U SearchProtection SearchProtection.exe"""Yahoo! Search Protection will alert you if an attempt is made to change your default browser search engine from Yahoo!"""
X SearchSetter searchsetter[1].exeBrowser hijacker - redirecting to FindWhateverNow.com
X SearchSettings SearchSettings.exe"Vendio ""Search Settings"" foistware - reportedly installed without notice
X SearchSpy SearchSpyMenu.exe"SearchSpy rogue spyware remover - not recommended"
X SearchSquire[number] SearchSquire[number].exe"SearchSquire adware"
X SearchUpgrader SearchUpgrader.exeHijacker
X Secboot w32tm.exe"Added by the HAXDOOR.D TROJAN!"
X secboot mszx23.exe"Added by a variant of the HAXDOOR.BC TROJAN!"
X secboot vtd 16.exe"Added by the HAXDOOR-AE TROJAN!"
X secdrive.exe secdrive.exe"Added by a variant of the SPYBOT WORM! See here"
U Second Copy 2000 SecCopy.exe"Related to Second Copy? - a files/folders backup utility"
U SecondChance sctray.exe"Power Quest Second Chance. Sets checkpoints for saving a backup copy of the registry to a disk so you can restore it if you have a crash"
X Secret Secret.exe"Added by the DELF-LW TROJAN!"
X Secret-Crush start.exeHijacker that may reset your browser's home page and/or search settings to point to undesired sites
U SECRETMAKER secretmaker.exe"Secretmaker is a combination of eight privacy-defending programs
U SecretSmileys ss.exe"""Secret Smileys is an add-on for AIM that provides users access to 1000's of new Smileys that can be viewed by anyone using a current version of AIM. Secret Smileys also adds other features such as logging of IM conversations
X secserv.exe secserv.exe"Detected by Panda as an EasySearch adware variant. Note - EasySearch modifies the Internet Explorer settings and may download programs onto the infected computer"
X secsvc32 secsvcnt.exe"Added by the GLOBAL PATROL TROJAN!"
U Secsys Secsys.exe"UltraSoft Key Interceptor surveillance software - uninstall this unless you put it there yourself!"
U SecurDisc NBHGui.exe"Part of the Nero multimedia suite backup function - ""Recover your data quickly and easily and create discs that are password protected. SecurDisc technology gives you peace of mind"""
X secure [random].exe"DealHelper adware"
X secure svshost.exe"Added by the RBOT-AFO WORM!"
X Secure AntiVirus Pro av.exe"Secure AntiVirus Pro rogue security software - not recommended
X secure socket layer wins32a.exe"Added by an IRCBOT TROJAN!"
X Secure Socket Layer Certification sslcert.exe"Added by the VANEBOT-AN WORM!"
X Secure System integitor.exe"Added by the AGOBOT.ACI WORM!"
X Secure32 Shell32.com StartUp"Added by the BRONTOK-CJ WORM!"
X Secure64 Regedit32.com StartUp"Added by the BRONTOK-CJ WORM!"
N SecureClean4RegManager scregmanager4.exe"WhiteCanyon SecureClean 4 disk cleaner - clean hard drive data
N SecureClean4Tray sctray4.exe"WhiteCanyon SecureClean 4 disk cleaner - clean hard drive data
X SecureCleaner SecureCleaner.exe"SecureCleaner spyware remover - not recommended
N SecureCleanIEClean SCIEClean.exe"SecureClean - scans your system for hidden temporary files
X SecureExpertCleaner sec.exe"Secure Expert Cleaner rogue privacy program - not recommended
X SecureFighter SecureFighter.exe"SecureFighter rogue security software - not recommended
U SecureItPro Secureitpro470p.exe"SecureIt Pro - lock your computer when you're not there
X SecureKeeper SecureKeeper.exe"SecureKeeper rogue security software - not recommended
X SecureLogin Mslg32.exe"Added by the REDZED WORM!"
U SecureOnlineAccountNumbers SOAN.exe"Related to Secure Online Account Numbers by Discover(R) Card from Orbiscom Ltd. Secure and innovative payment solutions"
X SecurePcAv SecurePcAv.exe"SecurePcAv rogue security software - not recommended
X SecurePCCleaner GDC.exe"SecurePCCleaner rogue privacy tool - not recommended
U SecurePCSolutionsBootCheck BootCheck.exe"1 Click Fixer PLUS from Secure PC Solutions ""takes the guesswork out of locating and solving problems in the Windows registry"""

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list