Arcade File Downloads Support Forum
Email
Confirm email
Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown
Startup Name Process Name Details
N S3apphk S3apphk.exeA tool installed alongside the drivers for your S3 video output device. It is not necessary but should be allowed to run unless it is causing problems
U S3Hotkey s3hotkey.exeHotkey system tray icon to enable switching between monitors. Found on laptops with an S3 Twister integrated graphics card
? S3Mon S3Mon.exe"S3DuoVue multi-monitor taskbar helper by S3 Graphics. What does it do and is it required?"
U S3TRAY S3Tray.exeS3 display configuration taskbar utility for S3 chipset based graphics cards. Can be run from Start-> Settings -> Control Panel -> Display
? s3tray2 s3tray2.exe"S3 display configuration taskbar utility for S3 chipset based graphics cards?"
? S3TRAYHP S3trayhp.exe"S3 Video driver related. What does it do and is it required?"
U S3Trayp S3trayp.exeS3 display configuration taskbar utility for S3 chipset based graphics cards. Can be run from Start-> Settings -> Control Panel -> Display
U S4F S4F.exe"FilterPak from S4F Inc - internet filtering software"
X s4helper s4helper.exe"Searchcentrix hijacker"
X s9201 av2008xp.exe"Antivirus 2008 XP rogue security software - not recommended see here"
? SA Sa3.exe"Logitech QuickCam driver. Is it required?"
? SA Service SAservice.exe"Associated with Cyber Trio and Warner troubleshooting software from G-Tek Technologies and pre-installed on some Packard Bell and NEC PCs. What function does this perform and is it required?"
N Sa3dsrv Sa3dsrv.exeFor Aureal based 3D soundcards. A3D sound features won't work with this disabled
X saap saap.exe"NCase adware"
N Sabreserver SABSERV.EXEAirline reservation software from Sabre. Available via Start -> Programs
X sac sac.exe"NCase adware"
X SACC sacc.exe"SurfAccuracy adware"
N SAClient RegCon.exeAT&T or ComCast BBClient - monitors system and network-delivered services for availability. Your current network status is displayed on a color-coded web page in near-real time. When problems are detected you're immediately notified by e-mail pager or text messaging
X sacmemds smcntlwio.exe"Added by the MAILBOT-BZ TROJAN!"
X Safe SafeWin.exe"Added by the FOCOSENHA TROJAN!"
X Safe [path to trojan]"Added by the BANKER-DT TROJAN!"
X SafeGuard Popup Blocker Updater regsvr32 sfgupd.dll"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The ""sfgupd.dll"" file is found in the System (9x/Me) or System32 (NT/2K/XP) folder"
X SafeGuard Popup Blocker Updater (required) regsvr32 sfg****.dll [* = ramdom char]"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in the System (9x/Me) or System32 (NT/2K/XP) folder"
X SafeGuard Popup Updater (required) regsvr32 sfg****.dll [* = random char]"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in the System (9x/Me) or System32 (NT/2K/XP) folder"
X SafeGuard Popup Updater (required) regsvr32 PDF****.dll [* = random char]"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in the System (9x/Me) or System32 (NT/2K/XP) folder"
U SafeHouseSystemTray SDWTRAY.EXE"SafeHouse ""Personal Privacy"" system tray icon - PP protects and hides your private and personal photos videos files and folders by making them ""invisible"" and encrypted"
N SafeInstall.exe SAFEIN~1.EXEMonitors a download and ensures an newer version of a file isn't replaced by an older one
N SafeOFF SafeOff.exeProvides protection that if user accidentally presses the power switch a dialog will pop up for confirmation
X SafeSearch safesearch.exe"SafeSearch.A adware"
Y SafeSpace SafeSpaceSysTray.exe"Part of SafeSpace (from Artificial Dynamics) which ""protects computers from Internet malware infection without the need for signature updates or regular maintenance"""
X SafeStrip SafeStrip.exe"SafeStrip spyware remover - not recommended see here"
X SafeStripReminder SafeStripReminder.exe"SafeStrip spyware remover - not recommended see here"
X SafeSurfingUpdate SSUpdate.exe"MoneyTree parasite - ActiveX control used to download premium-rate dialers"
U SafetyNet ipcTray.exe"Safety.Net from Netveda - ""offers Internet security content security and advanced Internet firewall protection for all your LAN computers and trust controls to block unwanted or harmful applications from accessing the network"""
U SafetyNet_Notifier ipcLn.exe"Safety.Net from Netveda - ""offers Internet security content security and advanced Internet firewall protection for all your LAN computers and trust controls to block unwanted or harmful applications from accessing the network"""
U Safeworld Freedom.exeSafeWorld Internet Security - now no longer available
X Sagate Security Firewall sagate.exe"Added by the GAOBOT.BOW WORM!"
N SAgent2ExePath SAgent2.exeSeiko Epson printer status agent. Disable if printer is not used often
U SAGENTSERVICE Sagent.exe"TinySpyAgent commercial keystroke logger. Uninstall this software if you did not install it yourself"
X sagnt sagnt.exeAdware web downloader
X SAHagent Sahagent.exe"ShopAtHomeSelect parasite"
X SAHBundle bundle.exe"ShopAtHomeSelect parasite"
X SAHBundle shop1003.exe"ShopAtHomeSelect parasite"
X saie saie.exe"NCase adware"
U SaiMfd SaiMfd.exe"Saitek MFD File System Driver - associated with the Saitek SST (Saitek Smart Technolgy) configuration software for their game controllers. Create a shortcut and run manually when required"
U SAIMON SaiMon.exe"Saitek joystick driver"
X sain sain.exe"NCase adware"
X sais sais.exe"NCase adware"
U SaiSmart SaiSmart.exe"""Smart Button Special Sauce"" - included with the latest software for Saitek game controllers. Related to the ""S"" ""Shift"" or ""Smart"" button and gives gamers extra features on the buttons. Only required if you use this feature"
U SaitekAutoConfigure saicnfig.exe"Configuration for Saitek game controllers"
X Sakemsneql simenu.exe"Added by the SDBOT.BTO WORM!"
X Sakora Sakora.exe"Detected by Microsoft as the GOWELES.A TROJAN! See here"
N SalaatTime SalaatTime.exe"""Salaat Time is a FREE multi-function Islamic application that calculates the prescribed five daily Muslim prayer times as well as Qiblah direction for anywhere in the world"""
X Salestart WAS7Mon.exe"WinAntiSpyware spyware remover - not recommended see here"
X Salestart bm.exe"Misleading security software such as AntiSpywareSuite AntivirusPCSuite SpyGuardPro WinAntiVirus Pro 2006 WinSecureAv and WinSpyControl - not recommended see here"
X Salestart dcpasmon.exe"SystemDoctor misleading security software - not recommended see here"
X Salestart dcsm.exe"PrivacyProtector misleading security software - not recommended see here"
X Salestart mc.exeOnlineHelpmate and ConfidentUser misleading security software - not recommended
X Salestart stm.exe"WinAnonymous spyware remover - not recommended see here"
X Salestart strpmon.exe"Misleading security software such as WinPCDoctor StorageProtector ErrClean and SystemErrorFixer - not recommended"
X salm salm.exe"NCase adware"
X saly saly*****.exeAdded by a variant of the AW.AWK TROJAN!
X Sam-sung Sam-sung.exe"Added by a variant of the SDBOT WORM!"
X SaMail [WORM FILE NAME].vbs"Added by the VBS.LIDO WORM!"
U SAMcal SAMcal.exe"SamCal - calendar/reminder program"
U Sametime Connect Connect.exe"IBM Lotus Sametime - instant messaging and Web conferencing software"
X Samsong Samsong.exe"Added by the SDBOT.BNE WORM!"
X Samsung Samsungs.exe"Added by an IRC TROJAN variant!"
U SandboxieControl Control.exe"SandBoxie - allows data to be read from the hard drive by an application but never written back unless you allow it"
U SandboxieControl SbieCtrl.exe"""SandBoxie runs your programs in an isolated space which prevents them from making permanent changes to other programs and data in your computer"""
N SandIcon SandIcon.exeSanDisk ImageMate CompactFlash card reader SDDR-31 (USB). Very little use except to place the Sandisk icon beside its drive designation in Windows Explorer. The reader itself will work fine without it. The simplest thing is to just unplug the reader when you're not using it. It may slow the startup by a few nanoseconds but once the software sees there's no reader you get back the resources
X SANS Service sansv.exe"Added by the VANEBOT-AH WORM!"
U SansaDispatch SansaDispatch.exe"Sansa Updater - ""The Sansa Updater is an application that checks for the latest firmware updates then downloads and installs the firmware to your Sansa device"""
X Santa Bastards Bitch SANTAS.BITCH.txt"Added by the ATNAS.A WORM!"
X sapp sapp.exe"NCase adware"
U SaskTel Accelerated Dial-up sasktelgui.exe"""Experience faster surfing downloading and e-mail by adding SaskTel Accelerated Dial-up Internet"""
X sasserfix package.exe"Added by the DABBER.B WORM!"
X saSyncMgr rundll32.exe sasync.dll SyncWait"Browser hijacker - redirecting to Searchant.com. Note - the real Tweak UI entry for this is ""rundll32.exe tweakui.cpl tweakmeup"". Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
U SATARaid SATARaid.exeRAID driver for serial ATA disks on some motherboards such as the DFI Lanparty range. Only loaded if one is using RAID support on SATA drives
X satmat satmat.exe"VX2.Transponder parasite updater/installer related"
X sau sau.exe"180Solutions adware related"
U SAUpdate SAUpdate.exe"Big Brother from Quest Software. System and network monitor"
U SAutoLaunchExe SAutoLaunchExe.exeSharp Zaurus PDA related needed to synchronize information with a Desktop or Notebook
Y SAVAgent SAVAgent.exePart of Sophos anti-virus software. Required for centrally administered Sophos updates to work correctly e.g. automatically updating PCs used by dial-in home or out-of-office users
X Save Save.exe"WhenU.Save adware"
X SaveDate SaveStartDate.ExeUnidentified adware
X Savenow SaveNow.exe"WhenU.Save adware"
X Savsvc rundll32.exe savsvc.dllstart"Added by the AKBOT.BE WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""savsvc.dll"" file is found in %System%"
X SAW saw.exe"SmartAdware adware"
U Say The Time 5.0 SAYTIME.EXEThis program has audio cues for the system clock in male and female voices customizes the appearance of the system clock and can synchronize it to a time server regularly
U SB SB.exeAcer Soft Button on Acer Tablet PCs
X SB SpywareBomber.exe"SpywareBomber spyware remover - not recommended see here"
N SB Audigy 2 Startup Menu /l:engRelated to the Dell OEM version of the Sound Blaster Audigy 2 sound card. If this item is listed and checked in startup the System32 Folder will appear on every startup. A patch is available - filename R75304.EXE - that fixes the issue. You can find that file at support.dell.com by typing that name in the 'Search' box available there. It addresses the root of the problem in Creative's software and corrects it. Unfortunately there is no direct link to the file but it's easily available using the search function
X SB Watchdog SBWatchdog.exeSpyware utility installed by the manufacturers of some laptops (Sony) used to monitor browsing habits and send them back to whoever installed it - released by SoftBank
X SB13mini RYZO32.EXE"Added by the SPYBOT-EJ WORM!"
U SBAutoUpdate sbautoupdate.exe"SpywareBlaster auto-updater"
U SBC RoamingClient SBCFL.exe"Part of AT&T FreedomLink Wi-Fi connection software"
U SBC Self Support Tool matcli.exe"matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address city county etc and gets written to a log file. The SBC Self Support Tool is required to run with the Help and Support program. If you uncheck SBC and and then run Help and Support it will add another SBC entry in the startup menu. If you remove this software in ""add/remove programs"" some help menus in help and support will not be available. You decide"
N SBC Yahoo! Connection Manager ConnectionManager.exeUsed to create and connect your SBC Yahoo DSL connection. This program has been reported to cause problems for some users. If you find that it causes you pc to become slow or unstable you should uninstall it (using Add/Remove programs) and manually connect your DSL connection
U SBCSTray SBCSTray.exe"System Tray access to CounterSpy anti-spyware from Sunbelt Software"
U SBDrvDet SBDrv.exe"Detects the ""Easy Front-Panel Audio Connectivity Drive Internal Drive Bay"" on the Sound Blaster Audigy 2 Platinium eX. Can be disabled if you don't have one"
N sbdrvdet sbdrvdet.exeChecks to see if Creative sound card driver should be updated
X SBHC sbhc.exe"SuperBar parasite - uninstall available here"
X SBI install_sbd_en.exeDownloader for a variety of rogue anti-spyware programs
X SBMPOP SBMPop.exeSearchByMedia adware
N SBMX sbmx.exeSoundMAX MPU401 MIDI device emulator for x86 VM DOS games/apps (for Win9x only)
X sbss Launcher sbss.exe"SideBySide adware"
U SbUsb AudCtrl RunDll32 sbusbdll.dll RCMonitorControl for Soundblaster MP3 external (USB) sound card
N sc scrubxp.exe"ScrubXP - utility that deletes safe to remove files cookies browsing history etc"
U sc sc.exe"Watchdog 2.0 Software - monitoring program"
U sc run.exe"All-In-One_SPY stealth monitoring software - allows monitoring and recording of all actions performed on a computer. It records all keystrokes remembers addresses of Internet pages visited and maintains a log file listing all applicationsrun on the computer. It can create screenshots and record sounds from the computer's microphone to a sound file"
X SC2 scprot4.exe"Added by the AGENT.APP TROJAN!"
? sc23exec sc23exec.exe"Possibly related to a digital camera"
Y SC3300CC SC3300CC.exeSiPix digital camera Twain device driver
X scain s030109.Stub.exe"Delfin Media Viewer adware related"
X ScamDisk SVOHOST.exe"Added by the LEWOR.D WORM!"
X scan mscman.exe"ClientMan parasite variant"
? Scan Detector Pmxdetect.exe"Associated with PrimaScan scanners. Is it required?"
X Scan Register ssms.exe"Added by the RBOT-AT WORM!"
? Scan Wizard button.exe"Associated with Scan Wizard as supplied with Microtek scanners - see also the Scanner Detector and Sdetect entries. What does it do and is it required?"
X ScanDisc satan.exeAdded by the GREGSTAR TROJAN!
X ScanDisk ScanDisk.exe"Added by the GANDA.A WORM! Note - this is not the valid ""ScanDisk"" Win9x/Me standard disk error checker"
X scands32.exe scands32.exe"Added by a variant of the ADCLICKER TROJAN!"
X Scandsk2 scandsk2.exe"Added by the AGOBOT-PK WORM!"
X scandskx.exe scandskx.exe"Added by the DLOADR-ARM TROJAN!"
? ScanFile ??"??"
Y ScanInicio Inicio.exe"Part of Panda Antivirus. Responsible for scanning the boot sector of your disk and your memory at startup to check for viruses that try and load and act before your anti-virus is fully operational. It only adds a fraction of a second to start-up time and is worth leaving active"
N Scanner Detector SDetect.exeScanSuite Scanner Detector - part of ScanWizard supplied with Microtek scanners. Waits until you press the "GO" button and seems to serve no other purpose. Automatically installed without prompting. Not required if you can start your scanning application before pressing the "GO" button
Y Scanner File Utility NsCatCom.exe"Kycocera Mita network copier/printer/scanner process to dump scanned documents onto a workstation"
? ScanPanel ScanPanel.exe"Trust Easy Webscan scanner related - what does it do and is it required?"
X Scanreg [filename]"Added by the QQPASS.E TROJAN!"
X ScanRegistry nsrvnt.exe"Added by the NERTE TROJAN! Not to be confused with the real ScanRegistry - which is a vital Windows file. This version has the executable as nsrvnt.exe not scanregw.exe"
X ScanRegistry scanregv.exe"Added by the MASTERLOCK TROJAN!. Not to be confused with the real ScanRegistry - which is a vital Windows file. This version has the executable as scanregv.exe not scanregw.exe"
Y ScanRegistry Scanregw.exeScans the system registry and makes back-ups at start-up. Important should the registry become corrupt. The executable "Scanregw.exe" is located in %windir% (where %windir% is the Windows directory - C:Windows or C:Winnt)
X ScanRegistry Scanregw.exe"Added by the STATOR WORM! Note - this is not legitimate ScanRegistry entry - which is a vital Windows file. The executable ""Scanregw.exe"" is located in %System%. Runs from the registry RunServices key as opposed to the Run key"
X ScanRegistry N/A"Added by the DINOXI or DINOXI.B WORMS!"
X ScanRegistry scanregw.exe"Added by the NYXEM-D WORM! Note - do not confuse this with the legitimate Windows process scanregw.exe which is always found in the Windows folder on Win9x/ME machines. This worm file is found in the System (9x/ME) or System32 (NT/2K/XP) folder"
X ScanRegistry update.exe"Added by the DWNLDR-FZY TROJAN!"
X ScanSpyware v * Scanner.exe"ScanSpyware spyware remover (where * = the version number) - not recommended see here"
X scApp scApp.exe"Added by the STANDO-E WORM!"
X scApp suchost.exe"Added by the ACNATT.A WORM!"
N SCardSvr scardsvr.exeRelated to SmartCard readers and sometimes uses lots of system resources
X SCardSvr SCardSvr32.Exe"Added by the MOFEI.B WORM!"
U SCDEmuApp.exe SCDEmuApp.exe"Related to PowerISO - CD/DVD image file processing tool"
X scheck45 scheck45.exeRelated to unknown malware - hidden installer associated with it
X schedl schedl.exe"Added by the VB-DVW WORM!"
U schedm schedm.exe"Part of Antivir PersonalEdition Classic anti-virus"
X ScheduIe nrchk.exePremium rate adult content dialler
X ScheduIr msexploren.exe"Added by a variant of the SDBOT WORM!"
X ScheduIr shch.exe"Added by a variant of the SDBOT WORM!"
X ScheduIr svchst.exe"Added by a variant of the SDBOT WORM!"
X ScheduIr winagent.exe"Added by a variant of the SDBOT WORM!"
U Schedule Schedule.exe"Scheduler for Mercury Ez View TV Tuner Card"
N Scheduled Maintenance Scheduled_Maintenance.exe"Scheduler for Iolo System Mechanic tweaking utility. It can cleans your registry and deletes temporary files at defined intervals. Available via Start -> Programs"
X Scheduler expIorer.exe"Added by the TACTSLAY.A TROJAN!"
X Scheduler MSMSGS.EXE"Added by the HOSTBANK-A TROJAN! Note - this particular msmsgs.exe file is located in the WindowsSystem32Config or WinntSystem32Config folder and should not be mistaken for the MSN Messenger file of the same name!"
X Scheduler outIook.exe"Added by the TACTSLAY.A TROJAN!"
X Scheduler svcrhost.exe"Added by the TACTSLAY.A TROJAN!"
X Scheduler svcshost.exe"Added by the TACTSLAY.A TROJAN!"
X Scheduler winagent.exe"Added by the TACTSLAY.B TROJAN!"
U Scheduler Scheduler daemon.exe"Tenebril GhostSurf or SpyCatcher related scheduler - you can schedule daily weekly monthly or one-time only cleanings"
X Scheduler msnexploren.exe"Added by the TACTSLAY.B TROJAN!"
X Scheduler sdhch.exe"Added by the TACTSLAY.B TROJAN!"
X Scheduler svchst.exe"Added by the TACTSLAY.B TROJAN!"
X Scheduler Service wsass.exe"Added by the LIOTEN.KX WORM!"
X SchedulerMgr navchk.exePremium rate adult content dialer
U scheduler_monitor init_scheduler.exe"Scheduler for ReaConverter advanced image converter"
X Scheduling Agent Scheduler.exe"Added by the SUBWOOFER TROJAN! Note - this is not the real MS Scheduling agent as the executable is incorrect"
X SchedulingAgant MMTASK.EXE"Added by the YAB.A TROJAN! Not the valid MusicMatch Jukebox which has the same filename"
U SchedulingAgent mstask.exeMS Scheduling Agent displayed as a box with a stopwatch in the System Tray that is only needed if you have regular scheduled disk defragmenting ScanDisk etc. Required if you have regularily scheduled events such as weekly virus scans
U SchedulingAgent mstinit.exeMS Scheduling Agent displayed as a box with a stopwatch in the System Tray that is only needed if you have regular scheduled disk defragmenting ScanDisk etc. Required if you have regularily scheduled events such as weekly virus scans
X SchedulingAgent N/A"Added by the DINOXI or DINOXI.B WORMS!"
U Schmaili Schmaili.exe"Schmaili - insert animated smilies into your e-mail"
X schost [path to trojan]"Added by the TJSERV.D TROJAN!"
N SchSvr SchSvr.exe"WinScheduler is installed with Home Theater or WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card you will need it. Available via Start -> Programs"
Y SCHWIZEX SCHWIZEX.EXE"Part of ConfigSafe - lets you identify changes to the registry INI files System asset files system hardware network connections and operating system versions - provides a restore function. This part takes a snapshot of your system following a healthy re-boot"
X sck121 helpsyss.exeAdded by a variant of the MAILBOT TROJAN!
X sclick sclick.exe"Added by the FAKEALERT TROJAN!"
X ScManager scman.exe"Added by the FORBOT-CW WORM!"
X scopedll scopedll.exe"Added by a variant of the CRYPTER.C TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list