srv.exe

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
Y	acEventServ	acevtsrv.exe	"ActivCard Gold from ActivIdentity
U	AltoMB_service	AltoMBsrv.exe	"Alto Memory Booster from Alto Software - boost the computers performance via more intelligent and efficient memory management. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
Y	Aureal A3D Interactive Audio	sa3dsrv.exe	For Aureal based 3D soundcards. A3D sound features won't work with this disabled
Y	avgfwsrv	AVGFWSRV.EXE	"Integrated firewall for the 7.* series of anti-virus products from AVG Technologies. Protects the users computer from outside attacks
Y	AvMaiSrv	Avmaisrv.exe	"Part of Avast! anti-virus software - E-mail scanner"
X	AVPSrv	AVPSrv.exe	"Added by the ONLINE-GEN TROJAN!"
Y	BDOESRV	bdoesrv.exe	"Bitdefender 8 antivirus and firewall"
N	BPServer	G6FTPSrv.exe	"BulletProof FTP Server"
X	catsrv	catsrv.exe	"Added by the PAPLOK TROJAN!"
N	CDANTSRV	CDANTSRV.exe	"C-Dilla License Management software. Used for any program that uses C-dilla Protection
X	Classes	srv.exe	"""Switch"" premium rate adult content dialler variant"
X	CLI Services	clisrv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Client Server Run Time Proccess	csrsrv.exe	"Added by a variant of the SDBOT WORM!"
N	Clipbook Service	Clipsrv.exe	"Supports Windows XP ClipBook Viewer
N	Clipsrv	Clipsrv.exe	"Supports Windows XP ClipBook Viewer
U	CMPDPSRV	CMPDPSRV.EXE	"Printer Driver Plus from ViewAhead Technology (formerly DeviceGuys
X	Configuration Loader	msgcfgsrv.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	CoreSrv	coresrv.exe	"Some IRC trojans/worms use this - see here for more information"
?	CTPDPSRV	CTPDPSRV.EXE	"Compaq A3000 printer driver (in the %System%\spool\DRIVERS\W32\X86 folder). Is it required?"
?	cttdpsrv	cttdpsrv.exe	"??"
U	DigiSrv	DigiSrv.exe	"Related to camera software from DigitalDreams"
X	dxmsrv	dxmsrv.exe	Added by an unidentified WORM or TROJAN!
Y	ffprsrv	ffprsrv.exe	"File and Folder Privacy - is a ""system security utility you can use to password-protect or hide your files and folders with a click of mouse. The program will always prompt to enter your access password when protection is enabled and a user is trying to access a protected file or folder"". If this entry is disabled
Y	ffprsrv.exe	ffprsrv.exe	"File and Folder Privacy - is a ""system security utility you can use to password-protect or hide your files and folders with a click of mouse. The program will always prompt to enter your access password when protection is enabled and a user is trying to access a protected file or folder"". If this entry is disabled
Y	ffpsrv	ffpsrv.exe	"File & Folder Protector - ""great easy-to-use password-protected security utility lets you password-protect certain files and folders
Y	ffpsrv.exe	ffpsrv.exe	"File & Folder Protector - ""great easy-to-use password-protected security utility lets you password-protect certain files and folders
?	FSDPSRV	FSDPSRV.exe	"??"
X	gaSrv	gaSrv.exe	"Detected by Panda as the DOWNLOADER.ALQ TROJAN! Adware downloader"
Y	hffsrv	hffsrv.exe	"Hide Files & Folders - ""great easy-to-use password-protected security utility working at Windows kernel level you can use to password-protect certain files and folders
Y	hffsrv.exe	hffsrv.exe	"Hide Files & Folders - ""great easy-to-use password-protected security utility working at Windows kernel level you can use to password-protect certain files and folders
X	HijSrv32	hijsrv.exe	"Added by the BANKGERM-D TROJAN!"
X	Hostname Manager Server	host32srv.exe	"Added by a variant of the RBOT WORM!"
?	IaNvSrv	IaNvSrv.exe	"Related to the option ROM part of the Intel® Matrix Storage Manager. Located in %ProgramFiles%\Intel\Intel Matrix Storage Manager\OROM\aNvSrv. What does it do and is it required?"
X	imwinsrvc	acpmonsrv.exe	"Added by the SLAPER.E TROJAN!"
X	Instant Access	linewsrv.exe	"InstantAccess premium rate adult content dialer variant"
X	Internet Server	inetsrv.exe	"Added by the STARTPA-EM TROJAN!"
X	LEMSRV	lemsrv.exe	"Added by the IRCBOT-TC TROJAN!"
?	lmpdpsrv	lmpdpsrv.exe	"Related to a Lexmark printer/scanner. Printer sharing server? Is it required?"
X	lsa Services	lsa2srv.exe	"Added by the TAME-C WORM!"
X	lsass	lsasrv.exe	"Added by the MYDOOM.AG or MYDOOM.AS or MYDOOM.AU WORMS!"
X	Memory Allocation Services	cisrv.exe	"Added by the IRCBOT.FC BACKDOOR!"
X	Microsoft	netsrv.exe	"Added by the RBOT-GOS WORM!"
X	Microsoft Client Pc	spoolsrv.exe	"Added by the RBOT-AQM WORM!"
X	Microsoft Int Service	MsIntSrv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Services	lssrv.exe	"Added by the RBOT.CW WORM!"
X	Microsoft Services	lsrv.exe	"Added by the RBOT-BK WORM!"
X	Microsoft Spool Server for Win32	spoolsrv.exe	"Added by the RANDEX.H WORM!"
X	Microsoft Task Manager Daemon	spoolsrv.exe	"Added by the SDBOT.FLL WORM!"
X	Microsoft Update Server	mssrv.exe	"Added by an unidentified VIRUS
X	Microsoft Windows Updater	TMNTSrv.exe	"Added by a variant of the RBOT WORM!"
X	MicrosoftPersonalFirewall	spoolsrv.exe	"Added by the WOOTBOT.DO BACKDOOR!"
X	MsMsgSrv	msmsgsrv.exe	"Added by the CQO TROJAN!"
X	MSN Servicer	msnsrv.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Mss Serv	msssrv.exe	"Added by the SLENFBOT.AA WORM!"
X	MSUpdSrv	msupdsrv.exe	"Browser hijacker
X	MSWinSrv	MSWinSrv.exe	"Added by the MTRON TROJAN!"
U	mynsw	wntsrv.exe	"Net Screen Watcher surveillance software. Uninstall this software unless you put it there yourself"
X	NTsrv.exe	NTsrv.exe	"Added by a variant of the SERVU-O TROJAN!"
Y	oeprsrv	oeprsrv.exe	"Outlook Express Privacy - which ""lets you control access to Outlook Express and its email message database. When you enable protection
Y	oeprsrv.exe	oeprsrv.exe	"Outlook Express Privacy - which ""lets you control access to Outlook Express and its email message database. When you enable protection
Y	oepsrv	oepsrv.exe	"Outlook Express Protector from Ixis Research
Y	oepsrv.exe	oepsrv.exe	"Outlook Express Protector from Ixis Research
Y	oessrv	oessrv.exe	"Outlook Express Security - which is used ""to control access to Outlook Express and its databases. When it is active
Y	oessrv.exe	oessrv.exe	"Outlook Express Security - which is used ""to control access to Outlook Express and its databases. When it is active
X	oe_drop_spam	oesrv.exe	"Dropspam adware"
U	Panda Antispam Server Service	PasSrv.exe	"AntiSpam part of an older version of Panda Internet Security"
Y	Panda Preventium+ Service	PREVSRV.EXE	"Part of the 2004 & 2005 versions of Panda Antivirus and Internet Security"
U	PDVDDXSrv	PDVDDXSrv.exe	"Remote Control background application for Cyberlink's PowerDVD DX - a Dell specific version of their standard PowerDVD product. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control
X	Personal Firwall	ptmedsrv.exe	"Added by the SDBOT.XY WORM!"
X	reggsdg	spoolsrv.exe	"Added by the SDBOT-DI WORM!"
X	regsrv	regsrv.exe	"Added by the OPTIXPRO.11 TROJAN!"
N	Sa3dsrv	Sa3dsrv.exe	For Aureal based 3D soundcards. A3D sound features won't work with this disabled
X	smcserv	winsrv.exe	"Added by the AGOBOT-OU WORM!"
X	smsrv	smsrv.exe	"Added by the AGOBOT-SX WORM!"
X	Spool Manager	spoolsrv.exe	"Added by the BANKER-FR TROJAN!"
X	Spooler Service	Spoolsrv.exe	"Added by the JOINER.C1 TROJAN!"
X	spoolsrv.exe	spoolsrv.exe	Added by an unidentified WORM or TROJAN! Located in %System%
N	SSDPSRV	ssdpsrv.exe	"Simple Service Discovery Protocol (SSDP) and General Event Notification Architecture (GENA) services for network plug and play functionality. Starts up a web server on port 5000. Used by Universal Plug and Play (for network device discovery). To remove this program
U	Start Service	upssrv.exe	"Cyber Power PowerPanelPlus software. ""During a power failure the system automatically saves and closes open files within the battery backup time and safely powers down your computer"""
X	stisrv	stisrv.exe	"Added by the RBOT.BQF WORM!"
X	System Profile	Regsrv.exe	"Added by a variant of the OPTIX TROJAN!"
Y	ThpSrv	thpsrv.exe	Toshiba Hard Drive Protection Utility - moves the Hard Drive head to a safe position in case of shock or vibration to reduce the risk of damage that could be caused by head-to-disk contact
U	TMESRV.EXE	TMESRV11.EXE	Toshiba utility related to inserting and removing a laptop from a docking station. Not required if you don't use a docking station
U	TMESRV.EXE	TMESRV21.EXE	Toshiba utility related to inserting and removing a laptop from a docking station. Not required if you don't use a docking station
U	TMESRV.EXE	TMESRV31.EXE	Toshiba utility related to inserting and removing a laptop from a docking station. Not required if you don't use a docking station
U	TMExLogon	TMESRV.EXE	Toshiba utility related to inserting and removing a laptop from a docking station. Not required if you don't use a docking station
X	tsrv	tsrv.exe	"Added by the WAREZOV.W WORM!"
X	User Sharing Server	usnsrv.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Userfile Sharing Serv	usnsrv.exe	"Added by a variant of the IRCBOT TROJAN! See here"
U	USIUDF_Eject_Monitor	USISrv.exe	"Added by Ulead DVD Moviefactory. This program monitors your DVD or CD drives and alerts when you eject the media or have no media present"
N	vspdfprsrv.exe	vspdfprsrv.exe	"Visage PDF Printer"
X	WIN USB SUPPORT	grxsrv.exe	"Added by a variant of the RBOT WORM!"
X	Win32	msnsrv.exe	"Added by a variant of the SDBOT WORM!"
X	windll	windotnetsrv.exe	"Added by the AUTORUN-ANO WORM!"
X	Windows DLL Tracker	spoolsrv.exe	"Added by a variant of the WOOTBOT WORM!"
X	Windows Manager	winsrv.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Windows PNP Server	pnpsrv.exe	"Added by the RBOT-AKM WORM!"
X	Windows Server Drivers	syssrv.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Services	winsyssrv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Spool Server	spoolsrv.exe	"Added by the SDBOT-ACT WORM!"
X	Windows SpoolaPrint Service	spoolasrv.exe	"Added by the SDBOT-AYD WORM!"
X	Windows Spooler	SPOOLSRV.EXE	"Added by the SPYBOT.P WORM!"
X	Windows SpoolPrint Service	spoolersrv.exe	"Added by the SDBOT-ZT WORM!"
X	Windows SpooltPrint Service	spooltsrv.exe	"Added by the SDBOT-AYE WORM!"
X	Windows Streams Server	localsrv.exe	"Added by the SDBOT.LN WORM!"
X	Windows Time Server	TimeSRV.exe	"Added by the SPYBOT.DNC WORM!"
X	winregsrv	winregsrv.exe	"Added by the SYNRG TROJAN!"
X	Winsrv	winsrv.exe	"Added by the OPASERV.T WORM!"
X	winsrv	winsrv.exe	"Added by the NETSNAK-B TROJAN!"
X	wmisrv	wmisrv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	xxsrSrv32	xxsrsrv.exe	"Added by the BANCSDE-E TROJAN!"
X	[12 random characters]	audiosrv.exe	"IeDriver adware variant"
X	[3 random char]srv32	[3 random char]srv.exe	"Added by the BANCOS.N TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.