SvcHost

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X		svchost.exe	"Added by the DELF-UX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%. Note - has a blank entry under the Startup Item/Name field"
X	.mscdr	lsvchost.exe	"Added by the WEBUS.D TROJAN!"
X	.mscdsr	lsvchost.exe	"Added by the BDOOR-CR BACKDOOR!"
X	.svchost	CSRSS.EXE	"Added by the WEBUS.F TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	1	svchost.scr	"Added by the BANCOS.X TROJAN!"
X	333	svchost.exe	"Added by the JD-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Syswm1i"" directory"
X	Administrator	svchost.scr	"Added by the NOVACAL TROJAN!"
X	alpha	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
X	amircivil	svchost.exe�	"Added by the AMIRECIVEL WORM!"
X	Auto Update	svchost.exe	"Added by the DUMARDI-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Auto Updates	svchost.exe	"Added by the CHEUKO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	AvG	svchost323.exe	"Added by the RBOT-ZA WORM!"
X	beta	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
X	Bot Loader	svchostt.exe	"Added by the GAOBOT.ALV WORM!"
X	BSVCHOST	SVCH0ST.EXE	"Added by the VOXOM TROJAN! Notice the digit ""0"" in the filename rather than the upper case ""o"""
X	CashToolbar	svchost.exe	"BrowserAid/CashToolbar adware! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	CDriver	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
X	COM++ System	svchost.exe...	"Added by a variant of the LOVGATE WORM!"
X	Config Loader	svchost2.exe	"Added by the AGOBOT.XE WORM!"
X	Configuration Loader	svchost.exe	"Added by the PARADROP-A WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Configuration Loader	svchost2.exe	"Added by the AGOBOT.JR WORM!"
X	CRC Value Verifier	svchost32.exe	"Added by the RBOT-OA WORM!"
X	CTFMON.EXE	svchost.exe	"Added by the JUEGO-B WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	DDriver	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
X	defragsys	svchost.exe	"Added by the BIFROSE-TH TROJAN! Note - this is not the legitimate svchost.exe process which should normally figure in Msconfig/Startup!"
X	DirectX9	svchost32.exe	"Added by the RBOT.AQG WORM!"
X	Dll Link	svchost.exe	"Added by the AUTOSKY WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Favourites folder"
X	DriverCheck	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	DriverLoad	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	F-Secure 2005	svchost.exe	"Added by the BIFROSE-CH TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	France	svchost.exe	"Added by the MIMAIL.L WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	gamma	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
X	Generic host proccess for windows	SVCHOSTS.EXE	"Added by the SPYBOT-GQ WORM!"
X	Generic Host Process	svchost.exe	"Added by the DLOADER-NX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Generic Host Process for Win32 Services	svchost32.exe	"Added by the AGOBOT.ALH WORM!"
X	GNP Generic Host Process	svchost.exe	"Added by the ZAPCHAS-F BACKDOOR! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	hellfire	svchost.exe	"Added by the LEOX.D TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Host Process	svchost.exe	"Added by the IRCBOT.AGF BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in the Fonts directory"
X	I just want to say I love Milko and I need a drink	svchost.exe	"Added by the CHIKO WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\Administrator\Local Settings\Application Data"
X	ine	svchosts.exe	"Added by the RBOT.BNL WORM!"
X	Internet Config	svchosts.exe	"Added by the SDBOT TROJAN!"
X	Java Update	svchost.exe.exe	"Added by the AGENT-LBS TROJAN!"
X	KAVPersonal	svchost.exe	"Added by the LINEAGE-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Kernel32	svchosts.exe	Added by an unidentified WORM or TROJAN!
X	Kernel32	svchost.exe	"Added by an unidentified WORM or TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %System%\drivers"
X	LocalSystem	svchost.exe	"EHU adware. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	LTM2	SVCHOST32.exe	"Added by the LITMUS.203B TROJAN!"
X	LTM2	SVCHOST�.exe	"Added by the DROPPERFL.A TROJAN!"
X	Micr0s0ft Upd4t4z	svchost32.exe	"Added by the RBOT.ALF WORM!"
X	microsoft	svchost.exe	"Added by the ASTEF or RESPAN WORMS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	Microsoft	svchost.exe	"Added by the ADUYO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft	msvchost.exe	"Added by the RBOT-GAW WORM!"
X	Microsoft (R) Windows Configuration Backup Service	svchost.exe	"Added by the RANKY.X TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in either a ""config""
X	Microsoft Corp	svchost.exe	"Added by the PUSHBOT.QD WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Corporation Svchost Service	mssvc.exe	"Added by a variant of the SDBOT WORM! See here"
X	Microsoft Corporation Svchost Service	mswsc.exe	Added by the AGENT.MAB TROJAN!
X	Microsoft dll Host Service	svchost.exe	"Added by the RBOT.BMS BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Genetic Procress	svchost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Genuine Logon	svchost.exe	"Added by the SDBOT.EXT WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Internet Explorer	svchost.exe	"Added by the IRCBOT-AK TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	Microsoft Internet Explorer	svchosts.exe	"Added by the BANCBAN-U TROJAN!"
X	Microsoft Internet Explorer	_svchost.exe	"Added by the TINY.LX TROJAN!"
X	Microsoft Registro	svchostt.exe	"Added by the BANCOS-DH TROJAN!"
X	Microsoft Service Host Manager	32svchost.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Service Host Process	svchost.exe	"Added by the KRYNOS.B WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Help"
X	Microsoft Service Pack2.1	svchost2.exe	"Added by the RBOT.ASN BACKDOOR!"
X	microsoft support	svchostt.exe	"Added by the AGOBOT.AWN WORM!"
X	Microsoft Svchost local services	winoem.exe	"Added by the RBOT-FPE WORM!"
X	Microsoft Svchost local services	nzm23.exe	"Added by the RBOT-GMC WORM!"
X	Microsoft Svchost local services	msnserver.exe	"Added by the RBOT-GPM WORM!"
X	Microsoft Synchronization Manager	svchosts.exe	"Added by the SDBOT-LM WORM!"
X	Microsoft TCP/IP Connection Monitor	svchost32.exe	"Added by the RBOT.KS WORM!"
X	Microsoft Windows SVCHOST	SVCHOST.exe	"Added by the VB.KV WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Microsong	svchosts11.exe	"Added by the SDBOT-EV WORM!"
X	Mircosoft DNS Service	svchost.exe	"Added by the IRCBOT-AK TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	Mircrosoft Svchost32	svchost32.exe	"Added by the RBOT-AZW WORM!"
X	Monitoring Service	svchost.exe	"Added by the CONE.C WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\tasks"
X	msclean	msvchost.exe	"Added by the OPANKI-Q WORM!"
X	mset	svchost.exe	"Added by the BIZEX-F TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""mset"" sub-directory"
X	MSN	svchost.exe	"Added by the PUSHBOT.FA WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	msnager32	svchostt.exe	"Added by the WOMANIZ.E TROJAN!"
X	MStask	svchost.exe	"Added by the LDPINCH-BV TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	MSUpdate	svchosthlp.exe	"Added by the BLASTER.T WORM!"
X	Msupdate	svchosts.exe	"Added by a variant of the TACTSLAY TROJAN!"
X	msvcc	msvchost.exe	"Added by the XOMBE TROJAN!"
X	msvchost	msvchost.exe	"Added by the IRCBOT-AV WORM!"
X	nano	svchost.exe	"Added by the NANO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	NDIS Adapter	svchosttt.exe	"Added by the WOOTBOT.AN WORM!"
X	netservices	svchostn.exe	"Added by the SDBOT.GI WORM!"
X	NetStart	svchost.exe	"Added by the MKAR-A VIRUS! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""NETSTART"" subfolder"
X	Network maneger	svchost.exe	"Added by the AGENT.BX BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Network Service	svchost.exe	"Added by the STARTPA-CC TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	nodriver	SVCHOST.EXE	"Added by the SPYBOT-Z BACKDOOR! Note - this is not the legitimate svchost.exe process which should normally figure in Msconfig/Startup!"
X	NortonVPlus	svchost.exe	"Added by the ROAMER-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	ntuser	svchost.exe	"Added by the POLYCRYP.DY TROJAN!"
X	NvClipRsv	svchost.exe	"Added by the DUMARU-K WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Online Service	svchost.exe	"Added by the HOSTIDEL.B or HOSTIDEL.C or TARNO.B TROJANS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	P0w3rF1Y	svchost.exe	"Added by the BDOOR-MM BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Perfomance Settings	svchost.exe	"Added by the TOFGER-AP TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Photoshop	svchost.exe	"Added by the CDOPEN-E TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%"
X	PolicyRun	svchost.exe	"Added by the SILLYFDC-AW WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	PowerManager	svchost.exe	"Added by the JEEFO VIRUS! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Processor	svchost.exe	"Added by the AGENT-KIR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in the root directory (i.e. C:\ or D:\)"
X	Recoveru systems	svchost.exe	"Added by the SMALL.DDX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
X	regedit	svchost.exe ccRegVfy	"Added by the HOTWORD.B TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is also located in %System% but has a space at the beginning of the filename"
U	RegHelp	svchosts.exe	"SpyGraphica spy software - ""Stealth monitoring of ALL PC or Network Activity with DVD-like playback. EVERY keystroke can be e-mailed in a detailed activity report every 15 minutes...anywhere in the world."""
X	renascimento	svchost.exe	"Added by the BANKER.GAX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Help"
X	reseurce	svchost.exe	"Added by the LINEAGE-FV TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Runner	svchost.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	sds20	svchost.exe	"InlookExpress logs keystrokes and captures screenshots. If you didn't install this yourself remove it. Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in C:\sds20"
X	Service Host	svchost.exe	"Added by the TORVEL WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Service Host	svchost.exe	"Added by the DAOSER-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %System%\Services\{C922CCC4-CF61-4589-A0D1-828160704853}"
X	Service Host	svchost.exe	"Added by the DAOSER-C TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %System%\Services\[random]"
X	Service Host	svchosts.exe	"PornCleanser spyware"
X	Service Host Driver	svchost.exe	"Added by the HITON TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Service Process	SVCHOST.EXE	"Added by the DARKER WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Service Process	svchost.exe	"Added by the DCMBOT-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""config"" subfolder"
X	services	Svchosts.exe	"Added by the SDBOT-N TROJAN!"
X	Services	svchost.exe	"Added by the REPER-B WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Services Host	svchost32.exe	"Added by the AGOBOT-TG WORM!"
X	Services host	svchost.com	"Added by the RBOT-EU WORM!"
X	Setup experation	svchost.exe	"Added by the TOFGER-AW TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Shell	Explorer.exe svchost.exe	"Added by the DOYORG BACKDOOR! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The legitimate svchost.exe process is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Shell	svchost.exe	"Added by the GOLDSPY-B TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	SNP Generic Host Process	svchost.exe	"Added by the ZAPCHAS-O TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	Socket Utility	svchostz.exe	"Added by the DAEMONI-E TROJAN!"
X	spoolsv	svchost.exe	"Added by the DLOADER-FI TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\HELP"
U	Srv32Win	Svchost.exe	"Realtime-Spy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	SSL	svchost.exe	"Added by an unidentified VIRUS
X	ssvchost	ssvchost.exe	"Added by the HELIOS.B TROJAN!"
X	Start Upping	SVCHOSTES.EXE	"Added by the RBOT-NB WORM!"
X	startkey	svchost32.exe	"Added by a variant of the SDBOT WORM!"
X	startkey	svchost.exe	"Added by the AGENT-FPL TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	SVC	svchost.exe	"ElfSpy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	SVCHOST	svchost.exe	"System1060 homepage hi-jacker. Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\System1060"
X	svchost	svchost.exe	"Added by many TROJANS amd WORMS
X	SVCHOST	mrowyekdc.exe	"Added by the GOTORM WORM!"
X	svchost	Svch0st.exe	"Added by the GRAYBIRD and GRAYBIRD.B TROJANS! Note - the filename has the digit 0 rather then the uppercase ""o"""
X	svchost	[path to trojan]	"Added by the HAZZER TROJAN!"
X	svchost	ADMAGIC.EXE	"Added by the SMIBAG WORM!"
X	Svchost	winhost.exe	"Added by the LOLAWEB.A TROJAN!"
X	Svchost	svchost.exe	"Added by the MOZE-A WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	SVCHOST	var.txt.exe	"Added by the LDPINCH.C TROJAN!"
X	Svchost	svchosl.pif	"Added by the INZAE.A or INZAE.B WORMS!"
X	svchost	[path] SETUP.EXE	"Added by the SETCLO WORM!"
X	SVCHOST	scvhost.exe	"Added by the MYTOB.E or MYTOB.G WORMS!"
X	SVCHOST	taskgmr.exe	"Added by the MYTOB.F or MYTOB.H WORMS!"
X	svchost	olehelp.exe	"Added by the BOOKMARKER.G TROJAN!"
X	SVCHOST	updater32.exe	"Added by the RANTS.A WORM!"
X	SVCHOST	SPOOLSV.EXE	"Added by the BAITAP-A WORM! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %Windir%"
X	SvcHost	svchost32.exe	"Added by the AGOBOT-TM WORM!"
X	svchost	svchost.exe	"Added by the BANCBAN-HL TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\config"
X	SVCHOST	MDM.EXE	"Added by the LCJUMP-A WORM! Note - this is not the legitimate Machine Debug Manager (mdm.exe) process which is located in %ProgramFiles%\Common Files\Microsoft Shared\VS7Debug (98/Me/XP/Vista) or %System% (Me only). This one is located in %Windir%"
X	svchost	[path to explorer.exe]	"Added by the UNREAL-A TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually!"
X	svchost	rundll16.exe	"Added by the STARTPA-PB TROJAN!"
X	Svchost	svchost.exe	"Added by the ADCLICK-AM TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Internet Explorer"
X	svchost	svchost.exe	"Added by the BDOOR-ES BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Microsoft"" subfolder"
X	svchost	svchost.exe	"Added by the DLOADER-EV TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%"
X	svchost	winhelp.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	Svchost	svchots.exe	"Added by the RBOT.ADK WORM!"
X	svchost	ying.exe	"Constructor VC2000 malware"
X	svchost	inetinfo.scr	"Added by the ODELUD WORM!"
X	SVCHOST	svchost64.exe	"Added by the STARTP-G TROJAN!"
X	svchost	svchost.com	"Added by the BANLOA-ABL TROJAN!"
X	svchost	win.exe	"Added by the VBSAUTO-A WORM!"
U	svchost	svchost.exe	"Infine Keylogger surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup. This one is located in an ""svc"" subfolder"
X	svchost	logon.exe	"Added by the SLEGON WORM!"
X	svchost	svcst.exe	"Added by the AGENT-LIL WORM!"
X	svchost	svchost.exe	"Added by the VB-EOK TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""MsDtds"" sub-directory"
X	svchost	windowsrx.exe	"Added by the AGOBOT-MZ WORM!"
X	SVCHOST	SERVlCES.EXE	"Added by the DELF-LF BACKDOOR! Note that the filename has a lower case ""L"" in place of an upper case ""i"""
X	svchost Agent	svchost.exe	"Added by the AUTORUN-DB WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""28463"" sub-folder"
X	svchost connection monitor	svchost32.exe	"Added by a variant of the SDBOT WORM!"
X	SVCHOST Generic application	svchost.exe	"Added by the DAEMONI-K TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	svchost Netware Manager	svchost.exe	"Added by the EXVID.A WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	SVCHost Protocol32	scvhost32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Svchost Service	svchost.exe	"Added by the VB-DVQ WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\help"
X	Svchost Windows Remote Services	svhost.exe	"Added by the IRCBOT-IV WORM!"
X	svchost.exe	svchost32.exe	"CoolWebSearch Svchost32 parasite variant"
X	SVCHOST.EXE	SVCHOST.EXE	"Added by the WRMSCAN-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	svchost.exe	[path to executeable]	"Added by the BANKER-MO TROJAN!"
X	svchost.exe	svchost.exe	"Added by the ZAPCHAS-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	svchost.exe	swchost.exe	"Added by the SADELPHI-A TROJAN!"
X	svchost.exe	svchost.exe	"Added by the VIRUT.CF WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""3361"" subfolder"
X	SVCHOST.EXE	svchost.exe	"Added by the SILLYFDC.BBI WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Conf"" sub-directory"
X	svchost.exe	svcnost.exe	"Added by the MISLEAD-A TROJAN!"
X	svchost1	svchost1.exe	"Added by the AGOBOT.ZZ WORM!"
X	SVCHost2	svchost2.exe	"Added by the RBOT.BLC WORM!"
X	SvcHost32	svchost32.exe	"Added by the MIMAIL.I or MIMAIL.J WORMS!"
X	svchost32.exe	svchost32.exe	"Added by the ASSASIN.20B BACKDOOR!"
X	svchost64	svchost64.exe	Added by the SDBOTER.G VIRUS!
X	svchosta	svchosta.exe	"Added by the SNIFFER-I TROJAN!"
X	svchostb	svchostb.exe	"Added by the SNIFFER-J TROJAN!"
X	SvcHostDHCP	svchost32.exe	"Added by the ASSASIN.20B BACKDOOR!"
X	svchostdll.scr	svchostdll.scr	"Added by the BANCBAN-FM TROJAN!"
X	SvcHosto	v1rg1n.exe	"Added by the AGOBOT-TK WORM!"
X	svchostr	svchostr.exe	Added by an unidentified WORM or TROJAN!
X	svchosts	svchosts.exe	"Added by the BANCBAN-DC or BANKER-ED TROJANS!"
X	Svchosts	SCVHOST.EXE	"Added by the AGOBOT-RQ BACKDOOR!"
X	svchosts.exe	svchosts.exe	"Added by the AGOBOT-JN WORM!"
X	svchosts.scr	svchosts.scr	"Added by the BANCBAN-DQ TROJAN and variants!"
X	SysInit	svchost.exe	"Added by the STARTPA-BD TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files"
X	System	SVCHOST.EXE	"Added by the LDPINCH-AU TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	system configure	svchost.exe	"Added by the LINEAGE-C TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	System Efficiency Monitor	svchostx.exe	"Added by the KWBOT.E WORM!"
X	System Host Service	svchost.exe	"Added by the CONE.F WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\tasks"
X	System Manager	svchost.exe	"Added by the BANKER-AE TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System Process	svchost.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System Update2	svchost.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	System32	svchost.exe	"Added by the ZAPCHAS-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	SystemCheck	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	SystemDriverCheck	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	SystemDriverLoad	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	SystemReg	svchost.exe	"Added by the DEWIN.E BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	sys_up1	svchostsys.exe	"Added by the MULTIDR-FL TROJAN!"
X	Task Manager	svchost.exe	"Added by the SOHANA-P WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Task Monitoring Service	svchost.exe	"Added by the CONE.D WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\tasks"
U	THCS	svchost.exe	"AllMonitor surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup. This one is located in a ""drivers\imon"" subfolder"
X	Universal USB Service	svchost32.exe	"Added by the KELVIR.R WORM!"
X	Update	svchost.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	valuename	svchosts.exe	"Added by a variant of the SDBOT WORM!"
X	Video Driver	svchost.exe	"Added by an unidentified WORM or TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	virtual-machine	svchosts.exe	"Added by the RBOT-US WORM!"
X	Win32 Driver	svchosts.exe	"Added by the FORBOT-FD WORM!"
X	Win32 Svchosts Driver	svchosts.exe	"Added by the FORBOT-FO WORM!"
X	Win32 Update	svchosts.exe	"Added by a variant of the SDBOT WORM!"
X	win32 update service	svchostt.exe	"Added by a variant of the SDBOT WORM!"
X	Win32 USB2 Driver	svchosting.exe	"Added by the FORBOT-J or SDBOT.HU WORM!"
U	WinAppLog	svchost.exe	"StingKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	WinDLL (svchost.dll)	"rundll32.exe svchost.dll	start"
X	window2	ssvchost.exe	"Added by the IRCBOT.H TROJAN!"
X	windows	svchost.exe	"Added by the SLOMIRC-A WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Default Configuration	svchost.exe	"Added by the DLOADER-U TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Windows DLL Services	svchost.exe	"AGENT.H spyware. Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Windows Driver Adapter	svchost.exe	"Added by the ANTINNY-K WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	Windows Executer	svchostie.exe	"Added by the EGGDROP.V BACKDOOR!"
X	Windows Firewall	svchost.exe	"Added by the PROXY-HT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Help Manager	svchost32.exe	"Added by the RBOT-OZ WORM!"
X	Windows Host Service	svchoste.exe	"Added by the KELVIR.BF WORM!"
X	Windows Host Service	svchosts32.exe	"Added by the KELVIR.AW WORM!"
X	Windows Internet Manager	svchost.exe	"Added by the IRCBOT-AAC TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Logon Procedure	Svchoste.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Logon Procedure	Svchosta.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Security Manager	svchost.exe	"Added by the ANTINNY.AX WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Microsoft"" subfolder"
X	Windows Service	svchost.exe	"Added by the SPYBOT-AW TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Windows Service Host	svchost.exe	"Added by the CONE.B WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Service Host	svchost.exe	"Added by the KALEL-C WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	Windows Services	svchosts.exe	"Added by the AGOBOT-KL TROJAN!"
X	Windows Services Host	svchost.exe	"Added by the CONE or CONE.E WORMS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	Windows Stortup	svchost.exe	"Added by the TOGER-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows svchost	avserv.exe	"Added by the PUSHBOT.FM WORM!"
X	Windows svchost	ctfmon32.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows svchost	happy2008.exe	"Added by the PUSHBOT.AM WORM!"
X	Windows svchost	service.exe	"Added by the PUSHBOT.DU WORM!"
X	Windows svchost	serviceaaa.exe	"Added by the PUSHBOT.ER WORM!"
X	Windows svchost	servicean.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows svchost	svchost.exe	"Added by the IRCBOT-ZQ WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows svchost	ups.exe	"Added by the PUSHBOT.A WORM!"
X	Windows svchost	upss.exe	"Added by the PUSHBOT.GJ WORM!"
X	Windows svchost	serviceam.exe	"Added by the PUSHBOT.EY WORM!"
X	Windows svchost	svchostx.exe	"Added by the PUSHBOT.CC WORM!"
X	Windows Svchost Authority	slsass.exe	"Added by the RBOT-UA WORM!"
X	WINDOWS SYSTEM	svchost2.exe	"Added by the MYTOB.OZ WORM!"
X	Windows Taskmanager	svchost.exe	"Added by the IMBOT.AC WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Update	svchosts.exe	"Added by the FRUCTA TROJAN!"
X	Windows Xp Service Pack 2	svchost.exe	"Added by the XPLOS-A TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	WindowsExplorer	svchost.exe	"Messenger Blocker rogue security software - not recommended. Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\System"
X	WindowsRegKey update	svchostc.exe	"Added by the RBOT.IF WORM!"
X	WindowsServicesStartup	svchost.exe	"Added by the ECUP WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
X	WindowsSystem32	svchosts.exe	"Added by the AGENT-EDA TROJAN!"
X	WindowsUpdate	svchost.exe	"Added by the ASTEF or RESPAN WORMS or AGENT-V TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	WindowsUpdate	svchost.exe	"Added by the BDOOR-IK BACKDOOR! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	WindowsUpdate	svchostw.exe	"Added by the COBFINN_B TROJAN!"
X	WindowsUpdatem2	svchost.exe	"Added by an unidentified WORM or TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	WindowsUpdatesvchostss	svchostss.exe	"Added by the AGENT-HZ TROJAN!"
X	Winlogon Shell	Explorer.exe svchost.exe	"Added by the KIPIS.M WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""1032"" sub-folder"
X	WINRUN	svchost32.exe	"Added by the MYTOB-AI WORM!"
X	winservice	svchost.exe	"Added by the CVK BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""services"" sub-folder"
U	WinService32	svchost.exe	"007 Spy Software - ""stealthy monitoring program which allows you to secretly track all activities of computer users and automatically deliver logs to you via Email or FTP"""
X	WinUp	svchost.exe	"Added by the SILLY.BR WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This file is located in a ""4350"" sub-folder"
X	wlinles	svchost.exe	"Added by the LIJI-A WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in the ""spool"" sub-folder"
X	wnddrv	svchost.exe	"Added by an unidentified TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	WSAConfiguration	svchostt.exe	"Added by the AGOBOT.ZT WORM!"
X	WSAConfiguration	svchostx.exe	"Added by the AGOBOT-JV BACKDOOR!"
X	wsock32	svchost.exe	"Added by the HORST-A WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	xor	svchost.exe	"Added by the XORDOOR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""xor"" subfolder"
X	Yahoo Messenger	svchost32.exe	"Added by the SOHANA-P WORM!"
X	Zone Labs Client Ex	svchost.exe	"Added by the NETSKY.F WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	zztp	svchost.exe	"Added by the TANNICK.B TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	[filename]	svchost.scr	"Added by the BANKER-CC TROJAN!"
X	[original filename]	svchost.scr	"Added by the BANCBAN-CX TROJAN!"
X	[random name]	svchost.exe	"Added by the BANCBAN-JC TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\config"
X	[random]	svchost.scr	"Added by the BANCBAN-CY TROJAN!"
X	[trojan name]	svchost.exe	"Added by the BANCBAN-CI TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	[various names]	svchostss.exe	"Added by a variant of the RBOT WORM!"
X	_svchost.con	svchost.com	"Added by the ERKEZ.C WORM!"
X	_System_Run	_svchost_.exe	"Added by the LINEAGE-Z TROJAN!"
X	{357AA41A-B7A8-4632-A27D-5B980B25CF43}	[path to svchost.exe]	"Added by the SMALL-AQ TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.