hosts.exe

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	AOL Services Hosts	aolserviceshosts.exe	Added by an unidentified WORM or TROJAN!
X	drmsrv32	stmhosts.exe	"Added by the AGENT.AGWU TROJAN!"
X	Generic host proccess for windows	SVCHOSTS.EXE	"Added by the SPYBOT-GQ WORM!"
X	Hollaback	slvhosts.exe	"Added by the SDBOT.BMO WORM!"
X	IExploer	svshosts.exe	"Added by the IRCBOT.BT TROJAN!"
X	ine	svchosts.exe	"Added by the RBOT.BNL WORM!"
X	Internet Config	svchosts.exe	"Added by the SDBOT TROJAN!"
X	Kernel32	svchosts.exe	Added by an unidentified WORM or TROJAN!
X	LSASS Authority	lsvhosts.exe	"Added by the SDBOT.BCE WORM!"
X	Micosoft Data Core stuff	svshosts.exe	"Added by the RBOT.FZA WORM!"
X	Microsoft Internet Explorer	svchosts.exe	"Added by the BANCBAN-U TROJAN!"
X	Microsoft Lmhosting Service	lmhosts.exe	"Added by the RBOT-RC WORM!"
X	Microsoft Synchronization Manager	svchosts.exe	"Added by the SDBOT-LM WORM!"
X	MS Hosts	msthosts.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	MS Updates	syshosts.exe	"Added by the MYDOOM.Y WORM!"
X	Mshosts	Mshosts.exe	"Added by the STARTPAG.CF TROJAN!"
X	Msupdate	svchosts.exe	"Added by a variant of the TACTSLAY TROJAN!"
U	RegHelp	svchosts.exe	"SpyGraphica spy software - ""Stealth monitoring of ALL PC or Network Activity with DVD-like playback. EVERY keystroke can be e-mailed in a detailed activity report every 15 minutes...anywhere in the world."""
X	Service Host	svchosts.exe	"PornCleanser spyware"
X	services	Svchosts.exe	"Added by the SDBOT-N TROJAN!"
X	spoolsv	scvhosts.exe	"Added by the SMALL-AW TROJAN!"
X	Start Uppings	svcchosts.exe	"Added by the SDBOT.VY WORM!"
X	svchosts	svchosts.exe	"Added by the BANCBAN-DC or BANKER-ED TROJANS!"
X	svchosts.exe	svchosts.exe	"Added by the AGOBOT-JN WORM!"
X	valuename	svchosts.exe	"Added by a variant of the SDBOT WORM!"
X	Vhosts Protection	vhosts.exe	Added by an unidentified WORM or TROJAN!
X	virtual-machine	svchosts.exe	"Added by the RBOT-US WORM!"
X	vschost	vschosts.exe	"Added by the VIPSY-A TROJAN!"
X	Win32 Driver	svchosts.exe	"Added by the FORBOT-FD WORM!"
X	Win32 Svchosts Driver	svchosts.exe	"Added by the FORBOT-FO WORM!"
X	Win32 Update	svchosts.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Host	hosts.exe	"Added by the KELVIR.U WORM!"
X	Windows Host Service	scvhosts.exe	"Added by the SPYBOT.NLI WORM!"
X	Windows Hosts	hosts.exe	"Added by the KELVIR-O TROJAN!"
X	Windows Hosts	winhosts.exe	"Added by a variant of the IRCBOT TROJAN!"
?	Windows Print Spooler	SCVHOSTS.EXE	"Suspicious due to the similarity to the valid ""svchost.exe"" file"
X	Windows Registery Center	svhchosts.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services	svchosts.exe	"Added by the AGOBOT-KL TROJAN!"
X	Windows Services Hosts	svhosts.exe	"Added by the SDBOT-YH TROJAN!"
X	Windows Update	svchosts.exe	"Added by the FRUCTA TROJAN!"
X	WindowsSystem32	svchosts.exe	"Added by the AGENT-EDA TROJAN!"
X	Yahoo Messengger	scvhosts.exe	"Added by the SOHANNA-AH WORM!"
X	Yahoo Messengger	scvshosts.exe	"Added by the TRAX-A WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.