svhost.exe

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	.mscsbl	svhost.exe	"Added by the CMQ TROJAN!"
X	Config Loader	svhost.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	csvhost.exe	csvhost.exe	"Added by the CIMUZ-BD TROJAN!"
X	CTHELPER	svhost.exe	"Added by the SDBOT-RZ WORM!"
X	HideRun.exe	Hiderun.exe and svhost.exe and pro.gif	"Added by the BOOHOO WORM!"
X	HKLM\Run	svhost.exe	"Added by the FORBOT-AO BACKDOOR (where HKLM\\Run represents HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run)!"
X	internet service	ssvhost.exe	"Added by a variant of the RBOT WORM!"
X	Jufualt	svhost.exe	"Added by the SDBOT-ADJ WORM!"
X	Load Service	SvHost.exe	"Added by the PESIN-D WORM!"
X	Microsoft	svhost.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft AutoUpdater	svhost.exe	"Added by the RBOT.QG WORM!"
X	Microsoft Host Protocol	svhost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Synchronization Manager	svhost.exe	"Added by the SDBOT-PY WORM!"
X	Microsoft System NT	svhost.exe	"Added by the SDBOT.COU WORM!"
X	Microsoft Update	svhost.exe	"Added by the RBOT-PI WORM!"
X	Microsoft Updater	svhost.exe	"Added by the AGENT.CDF TROJAN!"
X	NDAv	svhost.exe	"Added by the SERFLOG.C WORM!"
X	net32	svhost.exe	Added by a variant of the Trojan.Clicker family
X	Network Service	svhost.exe	"Added by the HACDEF-K TROJAN!"
X	Opera addon	svhost.exe	"Added by the AGENT-IBD WORM!"
X	run=	svhost.exe	"Added by the ADMINCASH.B TROJAN!"
X	S	svhost.exe	"Added by the AGOBOT-LN WORM!"
X	SDAv	svhost.exe	"Added by the SERFLOG.C WORM!"
X	Security Service Process	svhost.exe	"Added by the AGOBOT-LC WORM!"
X	Servicio Local	svhost.exe	"Added by the SPYBOT.BGX WORM!"
X	Svchost Windows Remote Services	svhost.exe	"Added by the IRCBOT-IV WORM!"
X	SVHOST	svhost.exe	"Added by the MYDOOM.I WORM! The file is located in %System%"
X	SVHOST	SVHOST.EXE	"Added by the ZORI.A VIRUS! The file is located in %System%\SVCHOSTV"
X	Svhost	Svhost.exe	"Added by the VB-ASG WORM! This file is located in a ""Hwnd"" sub-directory of the Root folder (C:\)
X	svhost updates	Svhost.exe	"Added by a variant of the RBOT WORM!"
X	SymantecFilterCheck	svhost.exe	"Added by the BANKER-EEO TROJAN!"
X	SysTray	svhost.exe	"Added by the RAJILO-A WORM!"
X	UPDATEMSN	svhost.exe	Added by an unidentified WORM or TROJAN!
X	Windows Messanger Control Center	svhost.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Security Manager	svhost.exe	"Added by the GAOBOT.ALU WORM!"
X	Windows update config	svhost.exe	"Added by the SDBOT-PF WORM!"
X	WINTASK	msvhost.exe	"Added by the MYTOB-AR WORM!"
X	WinUpdate	svhost.exe	"Added by a variant of the SDBOT WORM!"
X	WSVCHO	svhost.exe	"Added by the SPYBOT-OQ WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.