vhost

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	.mscsbl	svhost.exe	"Added by the CMQ TROJAN!"
X	AntiVir	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	Config Loader	scvhost.exe	"Added by the GAOBOT.AE or GAOBOT.AO WORMS!"
X	Config Loader	svhost.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	scvhost.exe	"Added by the AGOBOT-AAE and SDBOT.AR WORMS!"
X	CPVHOST Settings	cpvhost.exe	"Added by a variant of the SDBOT TROJAN!"
X	csvhost.exe	csvhost.exe	"Added by the CIMUZ-BD TROJAN!"
X	CTHELPER	svhost.exe	"Added by the SDBOT-RZ WORM!"
X	ff	svhost32.exe	"Added by the LINEAG-AFF TROJAN!"
X	fzg	svhost32.exe	"Added by the DLOADER.BDK TROJAN!"
X	Generic Host Process2 System Backup	scvhost2.exe	"Added by the RBOT-BAH WORM!"
X	Generic Host Process326a System Backup	scvhost326a.exe	"Added by a variant of the SDBOT WORM!"
X	Generic Service Process	srvhost.exe	"Added by the AGOBOT-FX WORM!"
X	HideRun.exe	Hiderun.exe and svhost.exe and pro.gif	"Added by the BOOHOO WORM!"
X	HKLM\Run	svhost.exe	"Added by the FORBOT-AO BACKDOOR (where HKLM\\Run represents HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run)!"
X	Hollaback	slvhosts.exe	"Added by the SDBOT.BMO WORM!"
X	icq lite	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	internet service	ssvhost.exe	"Added by a variant of the RBOT WORM!"
X	ivHost	taskManager.exe	"Added by a variant of the SPYBOT WORM! See here"
X	ivHost	[6 random letters].exe	"Added by a variant of the SPYBOT WORM! See examples here and here"
X	Jufualt	svhost.exe	"Added by the SDBOT-ADJ WORM!"
X	load	svhost32.exe	"Added by the WOWCRAFT TROJAN!"
X	Load Service	SvHost.exe	"Added by the PESIN-D WORM!"
X	load=	svhost32.exe	"Added by the LINEAGE-AB TROJAN!"
X	LSASS Authority	lsvhosts.exe	"Added by the SDBOT.BCE WORM!"
X	Macromedia Flash Update	scvhost.exe	"Added by a variant of the RBOT WORM!"
X	Messenger Service	nvhost.exe	"Added by the JLOK-A WORM!"
X	Microsof Windows Host	svhost32.exe	"Added by the RBOT.ADY WORM!"
X	Microsoft	svhost.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft AutoUpdater	svhost.exe	"Added by the RBOT.QG WORM!"
X	Microsoft Host Protocol	svhost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Internel Corporat	netvhost.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Internel Corporat	smbvhost.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft LSASS386 Protocol	scvhost32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft machine	scvhost.exe	"Added by the RBOT.AEU TROJAN!"
X	Microsoft SCVHOST32 Protocol	scvhost32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Synchronization Manager	svhost.exe	"Added by the SDBOT-PY WORM!"
X	Microsoft Synchronization Manager 2	svhostc.exe	"Added by the SLINBOT.ST WORM!"
X	Microsoft System NT	svhost.exe	"Added by the SDBOT.COU WORM!"
X	Microsoft TCP Service	scvhost.exe	"Added by the AGOBOT-L WORM!"
X	Microsoft Update	svhost.exe	"Added by the RBOT-PI WORM!"
X	Microsoft Update	scvhost.exe	"Added by the RBOT-AEM WORM!"
X	Microsoft Update Machine	scvhost.exe	"Added by the RBOT-GS WORM!"
X	Microsoft Update Manager	scvhost.exe	"Added by the AGOBOT.AXJ WORM!"
X	Microsoft Updater	svhost.exe	"Added by the AGENT.CDF TROJAN!"
X	Microsoft Windows Updata	scvhost.exe	"Added by the RBOT.CEM BACKDOOR!"
X	Microsoft Windows Update	scvvhost.exe	"Added by the FORBOT-DH WORM!"
X	Microsoft Windows Update	sccvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updater	suvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft--Updates	sxvhost.exe	"Added by the RBOT-FH WORM!"
X	ms	svhost32.exe	"Added by the LEGMIR-AQO TROJAN!"
X	MS Host Manager	ivhost.exe	"Added by the RBOT-BJN WORM!"
X	msconfig	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	MSN	scvhost.exe	"Added by the IRCBOT-ZW WORM!"
X	MSStartOptimizer	SCVHOST.EXE	"Added by the DASMIN-E TROJAN!"
X	msvhost	aig.exe	"Added by the AIMBOT-BC TROJAN!"
X	NDAv	svhost.exe	"Added by the SERFLOG.C WORM!"
X	net32	svhost.exe	Added by a variant of the Trojan.Clicker family
X	net64	svhoster.exe	"Added by the AGENT.JVF TROJAN!"
X	Network Service	svhost.exe	"Added by the HACDEF-K TROJAN!"
X	NTSF MICROSOFT SYSTEM	scvhost.exe	"Added by a variant of the RBOT WORM!"
X	only23	SCVHOST.exe	"Added by the BCKDR-PUQ BACKDOOR!"
X	Opera addon	svhost.exe	"Added by the AGENT-IBD WORM!"
X	Personal Computer	scvhost.exe	"Added by the RBOT-AJE WORM!"
X	regsrv	scvhost.exe	"Added by the AGOBOT.E WORM!"
X	run=	svhost.exe	"Added by the ADMINCASH.B TROJAN!"
X	S	svhost.exe	"Added by the AGOBOT-LN WORM!"
X	scvhost	svzhost.exe	"Added by a variant of the SPYBOT WORM!"
U	scvhost	scvhost.exe	"Wiretap surveillance software. Uninstall this software unless you put it there yourself"
X	scvhost	scvhost.exe	"Added by the AGOBOT-LI WORM!"
X	scvhost loader	ixplore.exe	"Added by the SDBOT-CY TROJAN!"
X	scvhost.exe	scvhost.exe	"Added by the LOHAV-N TROJAN!"
X	SDAv	svhost.exe	"Added by the SERFLOG.C WORM!"
X	Security Service Process	svhost.exe	"Added by the AGOBOT-LC WORM!"
X	Services Startup	svhost33.exe	"Added by a variant of the RBOT WORM!"
X	Servicio Local	svhost.exe	"Added by the SPYBOT.BGX WORM!"
X	spoolsv	scvhosts.exe	"Added by the SMALL-AW TROJAN!"
X	Srv Host	srvhost.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	srvhost	srvhost.exe	"Added by the LIVUP.A BACKDOOR!"
X	Starter	scvhosting.exe	"Added by the SDBOT.RU WORM!"
X	starter	scvhostingg.exe	"Added by the FORBOT-FB WORM!"
X	startkey	scvhost.exe	"Added by the BIFROSE-PM TROJAN!"
X	SunJavaUpdateSched	scvhost.exe	"Added by the SDBOT-AVX WORM!"
X	SVCHOST	scvhost.exe	"Added by the MYTOB.E or MYTOB.G WORMS!"
X	SVCHost Protocol32	scvhost32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Svchost Windows Remote Services	svhost.exe	"Added by the IRCBOT-IV WORM!"
X	Svchosts	SCVHOST.EXE	"Added by the AGOBOT-RQ BACKDOOR!"
X	SVHOST	svhost.exe	"Added by the MYDOOM.I WORM! The file is located in %System%"
X	SVHOST	SVHOST.EXE	"Added by the ZORI.A VIRUS! The file is located in %System%\SVCHOSTV"
X	Svhost	Svhost.exe	"Added by the VB-ASG WORM! This file is located in a ""Hwnd"" sub-directory of the Root folder (C:\)
X	Svhost Loader	svshost.exe	"Added by the AGOBOT.G WORM!"
X	Svhost Service Server	svhostser.exe	"Added by a variant of the RBOT WORM! See here"
X	svhost updates	Svhost.exe	"Added by a variant of the RBOT WORM!"
X	svhost windows services	svhost8.exe	"Added by the RBOT-WQ WORM!"
X	svhost1	mdsn.exe	"Added by the VB-EPK TROJAN!"
X	svhost32	svhost32.exe	"Added by the AUTORUN-AWY WORM!"
X	SymantecFilterCheck	svhost.exe	"Added by the BANKER-EEO TROJAN!"
X	System Host	scvhost.exe	"Added by a variant of the RBOT WORM!"
X	SystemTray	lsvhostwinlk.exe	"Added by a variant of the SPYBOT WORM!"
X	SystemWindows	scvhost.exe	"Added by the SILLYFDC-CG WORM!"
X	SysTray	svhost.exe	"Added by the RAJILO-A WORM!"
X	Task Manager	svhost32.exe	"Added by the TERMX.A WORM!"
X	Update Checker	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	UPDATEMSN	svhost.exe	Added by an unidentified WORM or TROJAN!
X	Updater Service Process	svhost32.exe	"Added by the AGOBOT.TY WORM!"
X	UsbD	svhost32.exe	"Added by the AGENT.IB TROJAN!"
X	vhost	host.exe	"Peppi adware"
X	Vhosts Protection	vhosts.exe	Added by an unidentified WORM or TROJAN!
X	WinDLL (scvhost32.dll)	"rundll32.exe scvhost32.dll	start"
X	Windows Firewalll	scvhost.exe	"Added by the RBOT-EK WORM!"
X	Windows Firewalll	svvhost.exe	"Added by a variant of the RBOT WORM!"
X	Windows Host Service	scvhosts.exe	"Added by the SPYBOT.NLI WORM!"
X	Windows Messanger Control Center	svhost.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
?	Windows Print Spooler	SCVHOSTS.EXE	"Suspicious due to the similarity to the valid ""svchost.exe"" file"
X	Windows Security Manager	svhost.exe	"Added by the GAOBOT.ALU WORM!"
X	Windows Service	svvhost.exe	"Added by the AGOBOT-HL WORM!"
X	Windows Service Host	scvhost.exe	"Added by the SDBOT.N TROJAN!"
X	Windows Services	scvhoste.exe	"Added by the SPYBOT.OBZ WORM!"
X	Windows Services	svhost33.exe	"Added by the RBOT.AFN WORM!"
X	Windows Services Hosts	svhosts.exe	"Added by the SDBOT-YH TROJAN!"
X	Windows SQL management 1.33	scvhost.exe	"Added by the SPYBOT-OB WORM!"
X	Windows UDP Control Center	scvhost.exe	"Added by the PUSHBOT.EH WORM!"
X	Windows Update	scvhost.exe	"Added by the SDBOT-XT WORM!"
X	Windows update config	svhost.exe	"Added by the SDBOT-PF WORM!"
X	Windows Update System Shell	svhostcs32.exe	"Added by the RBOT-AAZ WORM!"
X	Winmgr.exe	scvhost.exe	"Added by the AGOBOT.AFG WORM!"
X	Winsock Driver	scvhost.exe	"Added by the RBOT.AEU BACKDOOR!"
X	WINTASK	msvhost.exe	"Added by the MYTOB-AR WORM!"
X	WinUpdate	svhost.exe	"Added by a variant of the SDBOT WORM!"
X	wl	svhost32.exe	"Added by the WOWPWS-AF TROJAN!"
X	wm	svhost32.exe	"Added by the LINEAGE.CIS TROJAN!"
X	WSVCHO	svhost.exe	"Added by the SPYBOT-OQ WORM!"
X	xy	svhost32.exe	"Added by the LINEAG-ABB TROJAN!"
X	Yahoo Messengger	RVHOST.exe	"Added by the SILLYFDC-G WORM!"
X	Yahoo Messengger	SCVHOST.exe	"Added by the SOHANA-V WORM!"
X	Yahoo Messengger	scvhosts.exe	"Added by the SOHANNA-AH WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.