Sts

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
U	12Ghosts Backup	12backup.exe	"12Ghosts Backup - ""Automatic Backups
U	12Ghosts Clip	12clip.exe	"12Ghosts Clip - ""Screen shots made easy"""
U	12Ghosts JustAWindow	12window.exe	"12Ghosts JustAWindow - ""Cover annoying ads
U	12Ghosts Popup-Killer	12popup.exe	"12Ghosts Popup-Killer"
U	12Ghosts SaveLayout	12autosl.exe	"12Ghosts SaveLayout - ""Always (always!) keep the layout of your desktop icons"""
U	12Ghosts SetColor	12color.exe	"12Ghosts SetColor - ""Change your desktop icon text colors
U	12Ghosts ShowTime	12showtime.exe	"12Ghosts Showtime - ""Enhance the clock in your tray with font formatting
U	12Ghosts Synchronize	12sync.exe	"12Ghosts Synchronize - ""Sync PC clock with an atomic clock over the Internet"""
U	12Ghosts Tower	12tower.exe	"12Ghosts Tower - ""Quickly access and manage all Ghosts (included in all packages)"""
U	12Ghosts TrayProtect	12srvc.exe	"12Ghosts TrayProtect - ""Hide tray icons
U	12Ghosts Wash	12wash.exe	"12Ghosts Wash - ""Protect your privacy
U	All Aboard Status	stswin.exe	"All Aboard! Internet Connection Sharing status icon"
X	AOL Services Hosts	aolserviceshosts.exe	Added by an unidentified WORM or TROJAN!
X	assistse	ASSISTSE.EXE	"CnsMin (Chinese Keywords) hijacker related"
U	Auslogics BoostSpeed	boostspeed.exe	"System Tray access to Auslogics BoostSpeed system optimization utility - which allows you to ""Start programs faster. Speed up computer start time. Increase Internet speed
U	Auslogics BoostSpeed 4	boostspeed.exe	"System Tray access to Auslogics BoostSpeed 4 system optimization utility - which ""Start programs faster. Speed up computer start time. Increase Internet speed
X	BestsellerAntivirus	pgs.exe	"BestsellerAntivirus rogue security software - not recommended
U	BestSync 2008	BestSyncApp.exe	"System Tray access to BestSync® 2008 from Risefly Software - ""a professional utility for synchronizing files between your local folders and Network Drives
N	BJ Printer Status Monitor	Cjstsr.exe	Canon BJ printer status monitor
U	BoostSpeed	boostspeed.exe	"System Tray access to Auslogics BoostSpeed 4 system optimization utility - which ""Start programs faster. Speed up computer start time. Increase Internet speed
X	chostsv	chostsv.exe	"Added by the BANPAES.C TROJAN!"
U	CognizanceTS	"rundll32.exe [path] AsTsVcc.dll	RegisterModule"
X	ComcastSUPPORT	tgkill.exe	Comcast (the cable folks who are replacing @home in some parts of the USA) have struck a deal with Tioga to provide an "enhanced" support and self-repairing tool. This is "beta" at present and was made available to download by mistake at present. Remove via Start -> Settings -> Add/Remove Programs
X	drmsrv32	stmhosts.exe	"Added by the AGENT.AGWU TROJAN!"
X	fastsmell	fastsmell.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X	FastStart	ntnut32.exe	"Added by the STARTPAGE.L TROJAN!"
X	FastStart	svcnut.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
X	FastStart	svcnut32.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
X	fstsvc	"rundll32.exe fstsvc.dll	start"
X	Generic host proccess for windows	SVCHOSTS.EXE	"Added by the SPYBOT-GQ WORM!"
U	GhostSecuritySuite	gss.exe	"Ghost Security Suite - protect the registry from unauthorized reading and modification and other tools"
N	GhostStartService	GhostStartService.exe	"Required to run the Windows based wizard in Norton Ghost - added from the 2003 version. Will start automatically when you run the wizard"
N	GhostStartTrayApp	GhostStartTrayApp.exe	"System Tray access to Norton Ghost - added from the 2003 version"
Y	GhostSurfDelSatellite	DeleteSatellite.exe	"Part of SpyCatcher spyware remover from Tenebril. Prevents rogue programs from sending personal information to a remote user via the Internet. If you use SpyCatcher with real time scanning
X	Hollaback	slvhosts.exe	"Added by the SDBOT.BMO WORM!"
X	hostserv	hostserv.exe	"Added by the RBOT.BPZ WORM!"
X	hostserv	wiz98.exe	"Added by a variant of the SDBOT WORM!"
U	HostsFileMgr	winHostsEdit.exe	"AdBin from Gilmore Software Development. An easy solution to managing your Window's hosts file"
U	HostsMan	hm.exe	"""HostsMan is a freeware application that lets you manage your Hosts file with ease"". It is mainly intended to block specific domains (mostly advertising servers) by redirecting them to localhost
X	HostSrv	sachostx.exe	"Added by the LOOKSKY.H WORM! Drops multiple files in %System%"
X	HostSrv	sachostx.exe	"Added by the LOOKSKY.A or LOOKSKY.F or LOOKSKY.G WORMS!"
X	HostSrv	sachostx.exe...	"Added by the LOOKSKY.E WORM!"
X	HostSVC syse	HostSVC.exe	"Added by the RBOT-ANZ WORM!"
X	IExploer	svshosts.exe	"Added by the IRCBOT.BT TROJAN!"
X	ine	svchosts.exe	"Added by the RBOT.BNL WORM!"
X	Internet Config	svchosts.exe	"Added by the SDBOT TROJAN!"
N	ISDN Monitor	Linksts.exe	"Tray icon which gets installed when you install the drivers for Asuscom internal ISDN modem cards (or rebadged Asuscom ISDN cards
X	IST Service	istsvc.exe	"ISTBar adware"
X	Kernel32	svchosts.exe	Added by an unidentified WORM or TROJAN!
N	Linksts	linksts.exe	"Tray icon which gets installed when you install the drivers for Asuscom internal ISDN modem cards (or rebadged Asuscom ISDN cards
X	LSASS Authority	lshosts32.exe	"Added by the SDBOT-UY TROJAN!"
X	LSASS Authority	lsvhosts.exe	"Added by the SDBOT.BCE WORM!"
X	Micosoft Data Core stuff	svshosts.exe	"Added by the RBOT.FZA WORM!"
X	Microsoft Hosts Service	Isass.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Internet Explorer	svchosts.exe	"Added by the BANCBAN-U TROJAN!"
X	Microsoft Lmhosting Service	lmhosts.exe	"Added by the RBOT-RC WORM!"
X	Microsoft Synchronization Manager	svchosts.exe	"Added by the SDBOT-LM WORM!"
X	Microsoft System Security Agent	MSTSA.EXE	"Added by the RBOT.CCM WORM!"
X	Microsong	svchosts11.exe	"Added by the SDBOT-EV WORM!"
X	MS Hosts	msthosts.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	MS Updates	syshosts.exe	"Added by the MYDOOM.Y WORM!"
X	Mshosts	Mshosts.exe	"Added by the STARTPAG.CF TROJAN!"
X	mstsdsc.exe	mstsdsc.exe	"Added by the CIMUZ-CD TROJAN!"
X	Msupdate	svchosts.exe	"Added by a variant of the TACTSLAY TROJAN!"
U	NeroHomeFirstStart	NMFirstStart.exe	"Associated with Nero Scout
U	NMFirstStart	NMFirstStart.exe	"Associated with Nero Scout
N	Nokia FastStart	NokiaMusic.exe	"Part of the Nokia Music music manager. ""With Nokia Music
N	OM2_Monitor	FirstStart.exe	"Olympus Master 2 - digital camera management tools"
N	OM_Monitor	FirstStart.exe	"Olympus Master 1 - digital camera management tools"
X	pestsweeper	pestsweeper.exe	"PestSweeper rogue security software - not recommended
X	PostSetupCheck	Rundll32.exe atgban.dll	"TrafficSol adware variant. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""atgban.dll"" file is found in %System%"
X	postSetupCheck	Rundll32.exe gzmrt.dll	"TrafficSol adware variant. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""gzmrt.dll"" file is found in %System%"
X	PostSetupCheck	Rundll32.exe cpmsky.dll	"TrafficSol adware variant. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""cpmsky.dll"" file is found in %System%"
X	postsos	post.exe	"Added by the TATERF-Z WORM!"
U	RegHelp	svchosts.exe	"SpyGraphica spy software - ""Stealth monitoring of ALL PC or Network Activity with DVD-like playback. EVERY keystroke can be e-mailed in a detailed activity report every 15 minutes...anywhere in the world."""
X	sdchosts32	vbdd.exe	Added by the RANKY.AG TROJAN!
X	Service Host	svchosts.exe	"PornCleanser spyware"
X	services	Svchosts.exe	"Added by the SDBOT-N TROJAN!"
N	SigmatelSysTrayApp	stsystra.exe	System tray program for the Sigmatel Audio sound card. Often found on Dell computers
X	spoolsv	scvhosts.exe	"Added by the SMALL-AW TROJAN!"
X	Start Uppings	svcchosts.exe	"Added by the SDBOT.VY WORM!"
U	StationPlaylistStudio	SPLStudio.exe	"StationPlaylist Studio - ""simple to use on-air broadcast playback software for the studio and/or DJ"" for small to medium sized radio broadcasters
U	StopSignSsTsMon	"sstsmon.dll	VerifyStatus"
X	Sts	iwnujdss2.exe	"Added by the SDBOT-YI WORM!"
X	svchosts	svchosts.exe	"Added by the BANCBAN-DC or BANKER-ED TROJANS!"
X	Svchosts	SCVHOST.EXE	"Added by the AGOBOT-RQ BACKDOOR!"
X	svchosts.exe	svchosts.exe	"Added by the AGOBOT-JN WORM!"
X	svchosts.scr	svchosts.scr	"Added by the BANCBAN-DQ TROJAN and variants!"
X	Svhost Service Server	svhostser.exe	"Added by a variant of the RBOT WORM! See here"
X	Sygate Personal Firewall	hostserv.exe	"Added by the RBOT.BKO WORM!"
X	sys_up1	svchostsys.exe	"Added by the MULTIDR-FL TROJAN!"
X	Terminal Services	mstscc.exe	"Added by the SDBOT-CZW WORM!"
X	TrustSoldier	TrustSoldier.exe	"TrustSoldier rogue security software - not recommended
X	valuename	svchosts.exe	"Added by a variant of the SDBOT WORM!"
X	Vhosts Protection	vhosts.exe	Added by an unidentified WORM or TROJAN!
X	virtual-machine	svchosts.exe	"Added by the RBOT-US WORM!"
X	vschost	vschosts.exe	"Added by the VIPSY-A TROJAN!"
X	Win32 Driver	svchosts.exe	"Added by the FORBOT-FD WORM!"
X	Win32 Svchosts Driver	svchosts.exe	"Added by the FORBOT-FO WORM!"
X	Win32 Update	svchosts.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Host	hosts.exe	"Added by the KELVIR.U WORM!"
X	Windows Host Device	hostsvc.exe	"Added by the ZOOTY-A WORM!"
X	Windows Host Service	scvhosts.exe	"Added by the SPYBOT.NLI WORM!"
X	Windows Host Service	svchosts32.exe	"Added by the KELVIR.AW WORM!"
X	Windows Host32 Starter	hostserv.exe	"Added by the SDBOT-WU WORM!"
X	Windows Hosts	hosts.exe	"Added by the KELVIR-O TROJAN!"
X	Windows Hosts	winhosts.exe	"Added by a variant of the IRCBOT TROJAN!"
?	Windows Print Spooler	SCVHOSTS.EXE	"Suspicious due to the similarity to the valid ""svchost.exe"" file"
X	Windows Registery Center	svhchosts.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services	svchosts.exe	"Added by the AGOBOT-KL TROJAN!"
X	Windows Services Hosts	svhosts.exe	"Added by the SDBOT-YH TROJAN!"
X	Windows Update	svchosts.exe	"Added by the FRUCTA TROJAN!"
X	WindowsDiskLog	cstsm.exe	"Added by the STINX-C or STINX-D TROJANS!"
X	WindowsRegKey update	svchoosts.exe	"Added by the RBOT.ADB WORM!"
X	WindowsSystem32	svchosts.exe	"Added by the AGENT-EDA TROJAN!"
X	WindowsUpdatesvchostss	svchostss.exe	"Added by the AGENT-HZ TROJAN!"
X	WNSA	wnsts*.exe [ = random char]	"PurityScan adware"
X	Yahoo Messengger	scvhosts.exe	"Added by the SOHANNA-AH WORM!"
X	Yahoo Messengger	scvshosts.exe	"Added by the TRAX-A WORM!"
X	[random characters]	systs.exe	"Added by the AGENT-GDC TROJAN!"
X	[various names]	svchostss.exe	"Added by a variant of the RBOT WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.