sv.exe

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	Adope File Manager	lsasv.exe	Added by an unidentified WORM or TROJAN!
Y	ashMaiSv	ashmaisv.exe	"E-mail scanning part of avast! Antivirus. Starts via a registry ""Run"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
X	Audoi Device Loader	smssv.exe	"Added by the AGOBOT-ZY WORM!"
Y	avast! Web Scanner	Ashwebsv.exe	"Web scanning part of avast! Antivirus. Starts via a registry ""Run"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
X	AVG AntiVirus Updater	avgwusv.exe	"Added by the SILLYFDC.BAX WORM! Note - this is not a legitimare AVG entry"
X	Boot Service	bootsv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Browser Help Svc	BHSV.EXE	"Added by the RBOT-AVQ WORM!"
X	chostsv	chostsv.exe	"Added by the BANPAES.C TROJAN!"
X	Clip Srv	clipsv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Clipsvc	clipsv.exe	"Added by the BLACKHOLE.F BACKDOOR!"
X	Cmpnt	mainsv.exe	"Added by the TOMPAI-C TROJAN!"
X	ControlServiceMgr	csmsv.exe	"Added by the AGENT-XC TROJAN!"
X	eMakeSV	EMAKESV.EXE	"""Switch"" adult content dialer"
X	firewall	spoolsv.exe	"Added by the DIZAN.F VIRUS!"
X	gsv	gsv.exe	Added by the ROBAL 1.0 backdoor TROJAN!
X	huigezi	SP00LSV.EXE	"Added by the GRAYBIRD.J BACKDOOR! Note the digit ""0"" in the command"
X	load=	Spoolsv.exe	"Added by the CIADOOR.B TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %Windir%"
X	machine-debugger	mdmsv.exe	"Added by the AGOBOT-BR WORM!"
X	ManageProtocolCtrl	csmsv.exe	"Added by the LOOKSKY.B TROJAN!"
X	Microsoft DLL Verifier	csrssv.exe	"Added by the RBOT-ATK WORM!"
X	Microsoft Spooler Services	Spoolsv.exe	"Added by a variant of the SPYBOT WORM! See here"
X	MSN Manager	msnmgrsv.exe	"Added by the IRCBOT.BAZ BACKDOOR!"
X	MSN Update Service	msnupdsv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	netsv32	sv.exe	"Added by the DELF.CCD TROJAN!"
X	Ntsysv	ntsysv.exe	"Added by the MIFENG-E TROJAN!"
X	poolsv	poolsv.exe	Added by an unidentified WORM or TROJAN!
X	Print Spooler	Spoolsv.exe	"Added by the CIADOOR.B TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %Windir%"
N	PSIWin2.3 Connection Server	Psconsv.exe	Allows connectivity between a PC and a Psion device. Access can be gained from the Desktop or Start -> Programs
X	Random Interface Network Manager	rinsv.exe	"Added by the DELBOT-L WORM!"
X	Regsv	regsv.exe	Search hijacker - redirecting to scheo.com
X	Regsvc	regsv.exe	Added by an unidentified TROJAN!
X	SANS Service	sansv.exe	"Added by the VANEBOT-AH WORM!"
X	Shell Extension	spollsv.exe	"Added by the LOVGATE.Z WORM!"
X	SP00LSV	Sp00lsv.exe	"Added by the GRAYBIRD.E TROJAN!"
X	spoo1sv	spoo1sv.exe	"Added by the SOULJET TROJAN!"
X	Spooler SubSystem App	spooIsv.exe	"Added by the LINKBOT.M WORM!"
X	SpoolService	spolsv.exe	"Added by the AGOBOT-CS WORM!"
X	Spoolsv	Spoolsv.exe	"Added by the CIADOOR.121 VIRUS! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %Windir%"
X	spoolsv	spoclsv.exe	"Added by the FUJACKS-M WORM!"
X	spoolsv	spoolsv.exe	"Added by the ZAPCHAS-EE TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %Windir%\Temp\spoolsv"
X	spoolsv	spoolsv.exe	"Added by the ANTINNY-BH WORM! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %ProgramFiles%\Messenger"
X	spoolsv	spoolsv.exe	"Added by the OURXIN.C TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in a ""spoolsv"" subfolder"
X	Spoolsv	spoolsv.exe	"Added by the ANTINNY.F WORM! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %Program Files%\Lotus"
X	spoolsv.exe	[random filename]	"Added by the RBOT-JB WORM!"
U	Sprint SmartView	SprintSV.exe	"Sprint SmartView wireless connectivity manager which supports cards from multiple manufacturers including Intel
X	startkey	rtfmsv.exe	"Added by the EDEPOL-C TROJAN!"
X	Sun Java Updater	stacsv.exe	"Added by the BUZUS.DBFM TROJAN!"
X	SunJavaUpdatSched	spoolsv.exe	"Added by the BANCBAN-NP TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %ProgramFiles%\MSN Messenger"
X	SV00LSV	SV00LSV.EXE	"Added by the GRAYBIRD-C TROJAN!"
X	SVCH0ST	spoo1sv.exe	"Added by the VB-HF TROJAN!"
X	SVCHOST	SPOOLSV.EXE	"Added by the BAITAP-A WORM! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %Windir%"
X	svcshare	spoclsv.exe	"Added by the FUJACKS-A VIRUS!"
X	SyBot v2.1 By Sky-Dancer	HPSV.exe	"Added by the ZOTOB.I WORM!"
X	System Update Service	wmiprvsv.exe	"Added by the AGOBOT.YG WORM!"
X	Win32 SSL Driver	winssv.exe	"Added by the FORBOT-BH WORM!"
X	Windows Acer Service	acersv.exe	"Added by the IRCBOT.YFQ BACKDOOR!"
X	Windows Activate System	syssv.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Help Service	winhelpsv.exe	"Added by the RBOT-LP WORM!"
X	Windows Spools SV	winsv.exe	"Added by the RBOT-AUQ WORM!"
X	Windows Spoolsrv Service	spoolmsv.exe	"Added by the SDBOT-ZS WORM!"
X	windows spoolsrv service	spoolssv.exe	"Added by the SDBOT-AWV WORM!"
X	Windows SSL File	winssv.exe	"Added by the WOOTBOT.CA WORM!"
X	Winsock2 driver	SPOLSV.EXE	"Added by the SPYBOT-CM WORM!"
X	WinUpdsv	winupdsv.exe	"Added by the DROPO MACRO!"
X	[random name]	??oolsv.exe	"PurityScan adware"
X	[random name]	spoolsv.exe	"PurityScan adware. Note - this is not the legitimate spoolsv.exe which is always located in %System%"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.