sa.exe

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	.mscdr	lassa.exe	"Added by the WEBUS.C TROJAN!"
X	180sa	180sa.exe	"180Search adware"
X	Antivirus	MSA.exe	"MS Antivirus rogue security software - not recommended
X	ASocksrv	SocksA.exe	"Added by the VB.CBW WORM!"
U	Auto EPSON Stylus Photo R2400 on X	E_FATI9SA.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
X	Depassx	Xfsa.exe	"Added by the SDBOT-SK WORM!"
X	disnisa	disnisa.exe	"Added by the DORF-AE WORM!"
X	dsa	dsa.exe	Homepage hijacker - redirecting to downseek.com
U	EPSON Stylus Photo R2400	E_FATI9SA.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
X	HotbarSA	HotbarSA.exe	"Hotbar adware"
X	javawsa.exe	javawsa.exe	"Added by the BANK-Y TROJAN!"
X	Lisa	Lisa.exe	"Added by the SCOM-D premium rate adult content dialler"
X	LSA	lsa.exe	"Added by the SDBOT-YV WORM!"
X	Microsoft Client/Server Runtime Server Subsystem	csrssa.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
N	Microsoft Office	osa.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
X	Microsoft Office quick launch	OSA.exe	"Added by the VBOT.A BACKDOOR! Note that OSA.exe was used in older versions of Office to launch common components to help speed up the launch but it is no longer normally used - see here. This file is located in a valid MS Office 2003 (aka Office 11) directory - %Program Files%\Microsoft Office\OFFICE11 - and may overwrite a valid file"
N	Microsoft Office Startup	osa.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
X	Microsoft quick launch	OSA.exe	"Added by a variant of the VBOT.A BACKDOOR! Note that OSA.exe was used in older versions of Office to launch common components to help speed up the launch but it is no longer normally used - see here. This file is located in a valid MS Office 2003 (aka Office 11) directory - %Program Files%\Microsoft Office\OFFICE11 - and may overwrite a valid file"
X	Microsoft System Security Agent	MSTSA.EXE	"Added by the RBOT.CCM WORM!"
X	mmxrun	msosa.exe	Added by an unidentified TROJAN or WORM!
X	MS LARISSA	MS_LARISSA.exe	"Added by the ASSIRAL.B WORM!"
X	msfindosa.exe	msfindosa.exe	"Added by the DOWNLOADER-BS TROJAN!"
X	MS_LARISSA	MS_LARISSA.exe	"Added by the ASSIRAL WORM!"
X	nisdisa	nisdisa.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X	NordBull	msa.exe	"Added by the DLOADR-CSV TROJAN!"
X	Norton Updater	lsa.exe	"Added by a variant of the RBOT WORM!"
N	Office Startup	osa.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
U	PCRecSA	PCRecSA.exe	"Part of the IBM/XPoint Rapid Restore backup utility. If you choose
X	Registry Value Name Start	MsPMSPSa.exe	"Added by a variant of the SDBOT WORM!"
X	SeekmoSA	SeekmoSA.exe	"180Solutions.Seekmo adware variant - also see here"
X	Services Controller	lsassa.exe	Added by the CIADOOR.122 VIRUS!
X	Session Manager Subsystem	smssa.exe	"Added by the RBOT-AGS WORM!"
X	Social Security Agency	rpcxsocsa.exe	"Added by a variant of the RBOT WORM!"
N	Spellex Anywhere	sa.exe	"Spellex-Anywhere - adds spell checking functionality to almost any Window program. Create a shortcut and run manually before it's to be used"
X	statloads	pgjd83sa.exe	"Added by the SDBOT-UM WORM!"
U	StayAlive	sa.exe	"StayAlive from TFI Technology. "This top-notch tool intercepts crashes when they happen
N	Surveysa	surveysa.exe	"Found on Sony laptops
X	System Update Service	wmiprvsa.exe	"Added by the AGOBOT-RG TROJAN!"
X	Systes	jrdtifkkxbbsa.exe	"Added by the RBOT-ADC WORM!"
X	USA	usa.exe	"USAntiSpy rogue security software - not recommended
X	Ussi	rwsa.exe	"PurityScan adware"
X	Win32 LSA Driver	lsa.exe	"Added by the FORBOT-FJ WORM!"
X	WinDLL (asdfsa.exe)	"rundll32.exe asdfsa.exe	start"
X	Windows Media Player	msa.exe	"Added by the RBOT-SI WORM!"
X	Windows Update Center	W32RSA.exe	Added by an unidentified WORM or TROJAN!
X	Windoxs Update Center	W32RfSA.exe	"Added by a variant of the SDBOT WORM!"
X	WinTools	WToolsA.exe	"Wintools adware"
X	WNSI	rwsa.exe	"PurityScan adware"
X	ZangoSA	ZangoSA.exe	"Zango Search Assistant adware"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.