Search Results
(displaying 192 results)
(displaying 192 results)
| Name | Filename | Description | Status |
| Service de l’Assistant Compatibilité des programmes (PcaSvc) | svchost.exe | Related to Program Compatibility Assistant Service This service provides support for the Program Compatibility Assistant (PCA). PCA monitors programs installed and run by the user and detects known compatibility problems. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\PcaSvc.dll | L |
| Gestion des clés et des certificats d'intégrité (hkmsvc) | svchost.exe | Related to Health Key and Certificate Management Provides X.509 certificate and key management services for the Network Access Protection Agent (NAPAgent). Enforcement technologies that use X.509 certificates may not function properly without this service. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\hkmsvc.dll | L |
| Modules de génération de clés IKE et AuthIP (IKEEXT) | svchost.exe | Related to IKE and AuthIP IPsec Keying Modules The IKEEXT service hosts the Internet Key Exchange (IKE) and Authenticated Internet Protocol (AuthIP) keying modules. These keying modules are used for authentication and key exchange in Internet Protocol security (IPsec). Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\IKEEXT.dll | L |
| Assistance IP (iphlpsvc) | svchost.exe | Related to IP Helper Provides tunnel connectivity using IPv6 transition technologies (6to4, ISATAP, Port Proxy, and Teredo), and IP-HTTPS. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\iphlpsvc.dll | L |
| Mappage de découverte de topologie de la couche de liaison (lltdsvc) | svchost.exe | Related to [url=http://wiki.blackviper.com/wiki/Link-Layer_Topology_Discovery_Mapper]Link-Layer Topology Discovery Mapper[/url Creates a Network Map, consisting of PC and device topology (connectivity) information, and metadata describing each PC and device. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\lltdsvc.dll | L |
| Assistance NetBIOS sur TCP/IP (lmhosts) | svchost.exe | Related to TCP/IP NetBIOS Helper Provides support for the NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution for clients on the network, therefore enabling users to share files, print, and log on to the network. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\lmhosts.dll | L |
| TCP/IP NetBIOS Helper Service (LmHosts) | svchost.exe | Related to TCP/IP NetBIOS Helper Provides support for the NetBIOS over TCP/IP (NetBT) service and NetBIOS name resolution for clients on the network, therefore enabling users to share files, print, and log on to the network. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\lmhosts.dll | L |
| Agent de protection d’accès réseau (napagent) | svchost.exe | Related to Network Access Protection Agent The Network Access Protection (NAP) agent service collects and manages health information for client computers on a network. Information collected by NAP agent is used to make sure that the client computer has the required software and settings. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\napagent.dll | L |
| Network Access Protection Agent (napagent) | svchost.exe | Related to Network Access Protection Agent The Network Access Protection (NAP) agent service collects and manages health information for client computers on a network. Information collected by NAP agent is used to make sure that the client computer has the required software and settings. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\napagent.dll | L |
| @%SystemRoot%\system32\netp rof.dll,-246 (netprofm) | svchost.exe | Related to Network List Service Identifies the networks to which the computer has connected, collects and stores properties for these networks, and notifies applications when these properties change. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is the filename \%WINDIR%\%System%\netprof.dll | L |
| Gestionnaire d'identité réseau homologue (p2pimsvc) | svchost.exe | Related to Peer Networking Identity Manager Provides identity services for the Peer Name Resolution Protocol (PNRP) and Peer-to-Peer Grouping services. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\p2pimsvc.dll | L |
| Accès du périphérique d'interface utilisateur (hidserv) | svchost.exe | Related to Human Interface Device Access Enables generic input access to Human Interface Devices (HID), which activates and maintains the use of predefined hot buttons on keyboards, remote controls, and other multimedia devices.[note]This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\hidserv.dll[/note | L |
| Expérience audio-vidéo haute qualité Windows (QWAVE) | svchost.exe | Related to Quality Windows Audio Video Experience Quality Windows Audio Video Experience (qWave) is a networking platform for Audio Video (AV) streaming applications on IP home networks. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\QWAVE.dll | L |
| Carte à puce (SCardSvr) | svchost.exe | Related to Smart Card Manages access to smart cards read by this computer. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\SCardSvr.dll | L |
| Stratégie de retrait de la carte à puce (SCPolicySvc) | svchost.exe | Related to Smart Card Removal PolicySmart Cards are credit card sized with embedded microchips with encoded information to include anything desired, but usually access privledges. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name. | L |
| @%SystemRoot%\system32\ipna thlp.dll,-106 (SharedAccess) | svchost.exe | Related to Internet Connection Sharing (ICS) Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name. | L |
| @%SystemRoot%\system32\SLUI Notify.dll,-103 (SLUINotify) | svchost.exe | Related to SL UI Notification Service Provides Software Licensing activation and notification. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name. | L |
| Découverte SSDP (SSDPSRV) | svchost.exe | Related to SSDP Discovery SSDP Discovery service is required to see networked resources (Network Discovery) in the "Network" display pane. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\SSDPSRV.dll | L |
| Acquisition d'image Windows (WIA) (stisvc) | svchost.exe | Related to SSDP Discovery Provides image acquisition services for scanners and cameras. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\stisvc.dll | L |
| Téléphonie (TapiSrv) | svchost.exe | Related to Telephony Provides Telephony API (TAPI) support for programs that control telephony devices on the local computer and, through the LAN, on servers that are also running the service. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\TapiSrv.dll | L |
| Services Terminal Server (TermService) | svchost.exe | Related to Terminal Services Allows users to connect interactively to a remote computer. Remote Desktop and Terminal Server depend on this service. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name. | L |
| IPSE Service (Messanger) | svchost.exe | Identified as a variant of the Mal/Emogen-Y TROJAN! Note: Located in \%WINDIR%\ Note: Do not remove the legitimate file in \%WINDIR%\System32\ | X |
| Windows File Depictor and Rotator Service For Service Pack 2 (Windows File Depictor and Rotator) | svchost.exe | Detected as Backdoor.Win32.SdBot.aad by Kaspersky Note: Located in %windir%\repair | X |
| Windows Kernel | svchost.exe | Added by the HackerDefender SDBot TROJAN! Note: ROOTKIT INFECTION Note:This worm\trojan is located in C:\Windows\ Not to be mistaken with svchost.exe which is part of Microsoft an located in C:\WINDOWS\System32\. | X |
| Windows Kernel (Windows Kernel) | svchost.exe | Added by the W32/Rbot-ANO WORM! Note: This is not the legitimate Windows Process. (Which is found in the System32 folder.) This worm\trojan file is found in the Windows or Winnt folder. Note: Read the link, rootkit type stealth involved. | X |
| Windows LAN Service Manager | svchost.exe | Unknow origin | ? |
| Windows Management (Windows Management) | svchost.exe | Added by the Troj/Feutel-AN WORM! Note: This is not the legitimate Windows process(Which is always found in the System32 folder). This worm/trojan file is found in the Windows or Winnt folder. | X |
| Windows Network Mapping Service (NetMap) | svchost.exe | Added by an unidentified TROJAN! of the Sdbot family. This worm\trojan is located in C:\%WINDIR%\system\ folder. Note: This is not the legitimate Windows Process. (Which is found in the System32 folder.) | X |
| Windows Security Drivers (csrs) | svchost.exe | Added by an unknown TROJAN!, Note: This has nothing to do with Microsoft Windows Update and this is not the legitimate Windows Process svchost.exe. (Which is found in the System32 folder.) This trojan file (svchost.exe) is found in the Windows or Winnt folder | X |
| Windows Smrss Service | svchost.exe | Added by an unidentified TROJAN! of the Sdbot family. Note: This worm\trojan is located in C:\%WINDIR%\ folder. Note: This is not the legitimate Windows Process. (Which is found in the System32 folder.) | X |
| WksPatch | Svchost.exe | Added by the W32.Welchia.B or W32.Welchia.C or W32.Welchia.D or W32.Welchia.K WORM! **Note - Service display name is constructed in the form of %string1% %string2% %string3% please see the previous link for the possible combinations | X |
| wuauserv | svchost.exe | W32/SillyFD-D Note: Located in C:\Windows\System\Drivers (Win9x/Me), C:\%WINDIR%\System32\Drivers (XP/WinNT/2K) Note: Read linkReplaces any existing services named "wuauserv" Installs multiple files | X |
| @%SystemRoot%\system32\dwm. exe,-2000 (UxSms) | svchost.exe | Related to Desktop Window Manager Session Manager Provides Desktop Window Manager startup and maintenance services. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\dwm.exe | L |
| Remote TCP/IPv6 (wowsystemcode) | svchost.exe | This is the legitimate svchost.exe which is being used to load the file %windir%\system32\atlcom619_949.dll which is detected by Kaspersky as Trojan-GameThief.Win32.WOW.ceq. | X |
| Security Service (TWNX) | svchost.exe | Added by a variant of the TrojanProxy:Win32/Chumpoke.gen!A malware! Note: The service name (TWNX) is a random 4 letters name.[/name] [note]Located in \%WINDIR%\System32\svcd\ | X |
| .NET Framework Service | svchost.exe | "Trojan-PSW.Win32.Sagic.15" Virus | X |
| ShopGuide Updater Service | svchost.exe | Added by a variant of the Trackware.Rewardnet Note: Located in \%WINDIR%\System32\ | X |
| Dhcp server (DhcpSrv) | svchost.exe | Added by the Virus.Win32.Virut.ce Note: Located in \%WINDIR%\dhcp\ | X |
| Dhcp server (DhcpSrv) | svchost.exe | Added by the Mal/HckPk-A Note: Located in \%WINDIR%\dhcp\ Note: Do not remove the legitimate svchost.exe file which is always found in \%WINDIR%\%System%\ | X |
| FCI | svchost.exe:ext.exe | Identified as (Rootkit.ADS) an Alternate Data Stream. Note: Do not remove the legitimate svchost.exe file which is always found in \%WINDIR%\%System%\ | X |
| Net Login (NetLogin) | svchost.exe | Added by the Virus.Win32.Virut.ce Note: Located in \%WINDIR%\ Note: Do not remove the legitimate svchost.exe file which is always found in \%WINDIR%\%System%\ | X |
| Adobe Update Service (AdbUpd) | svchost.exe | Added by the Mal/Generic-A "Your PC Protector" ROGUE! "security software" using false positives as goad to purchase. Note: Located in \%Program Files%\ Note: Do not remove the legitimate svchost.exe file which is always found in \%WINDIR%\%System%\ | X |
| UnistoreSvc_Session1 | svchost.exe | Related to User Data Storage_Session1 from Microsoft Corp. Note: Located in \%Windir%\%System%\ | L |
| DoSvc | svchost.exe | Related to Delivery Optimization from Microsoft Corp. Note: Located in \%Windir%\%System%\ | L |
| nsi | svchost.exe | Related to NSI User-mode interface DLL Microsoft Corporation Note: Located in \%Windir%\%System%\ | L |
| lmhosts | svchost.exe | Related to lmhosts Note: Located in \%Windir%\%System%\ | L |
| AppMgmt | svchost.exe | Related to App Management from Microsoft. Note: Located in \%WINDIR%\%System%\ Note: This service on Vista or Windows 7/8 - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the filename. | L |
| OneSyncSvc_Session2 | svchost.exe | Related to Sync Host_Session2 from Microsoft Corp. Note: Located in \%Windir%\%System%\ | L |
| OneSyncSvc_Session1 | svchost.exe | Related to Sync Host_Session1 from Microsoft Corp. Note: Located in \%Windir%\%System%\ | L |
| PimIndexMaintenanceSvc_Sess ion2 | svchost.exe | Related to PimIndexMaintenanceSvc_Session2 from Microsoft Corp. Note: Located in \%Windir%\%System%\ | L |
| PimIndexMaintenanceSvc_Sess ion1 | svchost.exe | Related to PimIndexMaintenanceSvc_Session1 from Microsoft Corp. Note: Located in \%Windir%\%System%\ | L |
| SensorDataService | svchost.exe | Related to Sensor Data Service from Microsoft Corp. Note: Located in \%Windir%\%System%\ | L |
| UnistoreSvc_Session2 | svchost.exe | Related to User Data Storage_Session2 from Microsoft Corp. Note: Located in \%Windir%\%System%\ | L |
| @%SystemRoot%\System32\Stor Svc.dll,-100 (StorSvc) | svchost.exe | Related to Storage Services. developed by Microsoft Corporation. Note: Located in \%WINDIR%\%System%\ Note: This service on Vista or Windows 7 - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the filename. | L |
| UserDataSvc_Session2 | svchost.exe | Related to User Data Access_Session2 from Microsoft Corp. Note: Located in \%Windir%\%System%\ | L |
| UserDataSvc_Session1 | svchost.exe | Related to User Data Access_Session1 from Microsoft Corp. Note: Located in \%Windir%\%System%\ | L |
| PowerManager | svchost.exe | Added by the WizzWifiHotspot dPUP.Optional.WizzWifiHotspot. Note: Located in \%Windir%\ and Note: Located in \%Windir%\%SysWOW64%\ Note: Do not delete the svchost.exe located in \%Windir%\%System%\ | X |
| Adobe Update Service (AdbUpd) | svchost.exe | Added by the Wireshark Trojan.FakeAlert. Note: Located in \%Program Files%\ | X |
| SvcHost Service Host | svchost.exe | Added by the SearchGo Adware.RuKometa. Note: Located in \%Windir%\Microsoft\ Note: The file as Zero byte Note: Do not delete the svchost.exe located in \%Windir%\%System%\ | X |
| LxssManagerUser_6abeb | svchost.exe | Related to Microsoft Corp. Windows Subsystem for Linux. Note: Located in \%Windir%\%System%\ Note: Do not delete the svchost.exe located in \%Windir%\%System%\ | L |
| LxssManagerUser_85ee6 | svchost.exe | Related to Microsoft Corp. Windows Subsystem for Linux. Note: Located in \%Windir%\%System%\ | L |
| SetPipAtcivator | svchost.exe | Added by the SetPipAtcivator Unidentified malware. Note: Located in \%Windir%\Fonts\ Note: Do not delete the svchost.exe located in \%Windir%\%System%\ | X |
| WebManagementUser_93518f | svchost.exe | Related to Microsoft Corp. ManagementUserInfo Class. Note: Located in \%Windir%\%System%\... | L |
| Fast User Switching Compatibility (FastUserSwitchingCompatibi lity) | svchost.exe | Related to Fast User Switching Compatibility Provides management for applications that require assistance in a multiple user environment. Unless you have several different users on a system, you probably do not even need this service to be running. Note: This service on A XP - 64 bit operating system is launched by svchost.exe. | L |
| @%windir%\system32\inetsrv\ iisres.dll,-30001 (WAS) | svchost.exe | Related to Windows Process Activation Service The Windows Process Activation Service (WAS) provides process activation, resource management and health management services for message-activated applications. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\inetsrv\iisres.dll | L |
| Windows Connect Now - Registre de configuration (wcncsvc) | svchost.exe | Related to Windows Connect Now - Config Registrar WCNCSVC hosts the Windows Connect Now Configuration which is Microsoft's Implementation of Wi-Fi Protected Setup (WPS) protocol. This is used to configure Wireless LAN settings for an Access Point (AP) or a Wi-Fi Device. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\wcncsvc.dll | L |
| Hôte système de diagnostics (WdiSystemHost) | svchost.exe | Related to Diagnostic System Host The Diagnostic System Host is used by the Diagnostic Policy Service to host diagnostics that need to run in a Local System context. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\wdi.dll | L |
| Service de rapport d'erreurs Windows (WerSvc) | svchost.exe | Related to Windows Error Reporting Service Default description of service as seen in services.msc goes here. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\wersvc.dll | L |
| Service de configuration automatique WLAN (Wlansvc) | svchost.exe | Related to WLAN AutoConfig The WLANSVC service provides the logic required to configure, discover, connect to, and disconnect from a wireless local area network (WLAN) as defined by IEEE 802.11 standards. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\wlansvc.dll | L |
| Contrôle parental (WPCSvc) | svchost.exe | Related to Parental Controls This service is a stub for Windows Parental Control functionality that existed in Vista. It is provided for backward compatibility only on Windows 7. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\WPCSvc.dll | L |
| WPDBusEnum | svchost.exe | Related to Portable Device Enumerator Service Enforces group policy for removable mass-storage devices. Enables applications such as Windows Media Player and Image Import Wizard to transfer and synchronize content using removable mass-storage devices. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\wpdbusenum.dll | L |
| Centre de sécurité (wscsvc) | svchost.exe | Related to Security Center The WSCSVC (Windows Security Center) service monitors and reports security health settings on the computer. The health settings include firewall (on/off), antivirus (on/off/out of date), antispyware (on/off/out of date), Windows Update (automatically/manually download and install updates), User Account Control (on/off), and Internet settings (recommended/not recommended). Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\wscsvc.dll | L |
| Windows Update (wuauserv) | svchost.exe | Related to Windows Update Manual updates via Windows Update Version 6 web site still requires Windows Update, Cryptographic Services, Background Intelligent Transfer Service, and Windows Event Log to be running. Place all four in automatic if you do not wish to update manually. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\wuaueng.dll | L |
| Web-Guide Updater Service | svchost.exe | Added by a variant of the Trackware.Rewardnet Note: Located in \%WINDIR%\System32\ | X |
| Network Location Awareness (NLA) (Nla) | svchost.exe | Related to Network Location Awareness (NLA) Collects and stores network configuration and location information, and notifies applications when this information changes. Note: This service on A XP - 64 bit operating system is launched by svchost.exe. | L |
| Windows Firewall/Internet Connection Sharing (ICS) (SharedAccess) | svchost.exe | Related to Windows Firewall/Internet Connection Sharing (ICS) Provides network address translation, addressing, name resolution and/or intrusion prevention services for a home or small office network. Note: This service on A XP - 64 bit operating system is launched by svchost.exe | L |
| Winmgmt | svchost.exe | Related to Windows Management Instrumentation Provides a common interface and object model to access management information about operating system, devices, applications and services. Note: This service Is launched by svchost.exe. | L |
| Portable Media Serial Number Service (WmdmPmSN) | svchost.exe | Related to Portable Media Serial Number Service Retrieves the serial number of any portable media player connected to this computer. Note: This service on A XP - 64 bit operating system is launched by svchost.exe. | L |
| Windows Management Instrumentation Driver Extensions (Wmi) | svchost.exe, Wmi.dll | Related to Windows Management Instrumentation Driver Extension. Provides systems management information to and from drivers. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\wbem\Wmi.dll | L |
| Adobe Update Service (AdbUpd) | svchost.exe | Added by the Sysinternals Antivirus ROGUE! anti-spyware program. Note: Located in \%Program Files%\ Note: Do not remove the legitimate svchost.exe file which is always found in \%WINDIR%\%System%\ | X |
| VTingWinIe | svchost.exe | Added by the Backdoor.Win32.Popwin.bmf Note: Located in \%WINDIR%\%System%\drivers\ Note: Do not remove the legitimate program file in \%WINDIR%\%System%\ | X |
| Adobe Update Service (AdbUpd) | svchost.exe | Added by the Wireshark Antivirus ROGUE! anti-spyware program. Note: Located in \%Program Files%\ Note: Do not remove the legitimate svchost.exe file which is always found in \%WINDIR%\%System%\ | X |
| NTFS-Drivers | svchost.exe | Added by the Backdoor.Win32.Iroffer.ma Note: Located in \%ROOT%\driver\ Note: Do not remove the legitimate svchost.exe file which is always found in \%WINDIR%\%System%\ | X |
| Mespanger | svchost.exe | Added by a variant of the Trojan-Downloader.Win32.Delf.asz Trojan. Note: Located in \%ROOT%\Recyclers\ This infection should not be confused with the legitimate Note: \%WINDIR%\System32\svchost.exe file. | X |
| Generic Host Process (svchost) | SVCHOST.EXE | Added by the SDBOT.CNK WORM! Note: This is not the legitimate Windows process svchost.exe (Which is always found in the System32 folder.) This trojan file is found in the Windows or Winnt folder. Note: Read the link, rootkit type stealth involved. | X |
| Generic Host Process for Win-32 Service | svchost.exe | Added by a variant of the Backdoor.Sdbot family of worms and IRC backdoor Trojans. This infection should not be confused with the legitimate C:\Windows\System32\svchost.exe file. This malware is Note: located in Note: located in \%WINDIR%\ | X |
| Generic Host Process For Win32 Services (Generic Host Process) | svchost.exe | Added by the W32/Tilebot-DM WORM! Note: This worm\trojan is located in C:\%WINDIR%\ folder. Note: This is not the legitimate Windows Process. (Which is found in the System32 folder.) | X |
| Hardware Detection (Serv-U) | svchost.exe | Reported by Kaspersky Anti-Virus as Win32.Serv-U.gen Note: This is not the legitimate Windows process (Which is always found in the System32 folder). This file is found in the System32\drivers\etc\data\ folder. | X |
| Host Process for Win32 Services | svchost.exe | Added by a variant of the SDBOT Note: Located in \%WINDIR%\system\ Note: Use SDFix under supervision. | X |
| Human Interface Device Access (hidserv) | svchost.exe | Related to Human Interface Device Access Enables generic input access to Human Interface Devices (HID), which activates and maintains the use of predefined hot buttons on keyboards, remote controls, and other multimedia devices. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\hidserv.dll | L |
| ICF | svchost.exe:exe.exe | Added by the Trojan.DoS.Win32.Opdos TROJAN! Note: DO NOT DELETE THE FILE\%WINDIR%\System32\svchost.exe | X |
| kingxxx | svchost.exe | Troj/PWS-ACY , http://www.sophos.com/security/analyses/trojpwsacy.html Note: Located in %programfiles%\windows media player | X |
| generic host process (svchost) | svchost.exe | Added by the W32/Tilebot-BB WORM! Note: This is not the legitimate Windows process svchost.exe (Which is always found in the System32 folder.) This worm\trojan file is found in the Windows or Winnt folder. Note: Read the link, rootkit type stealth involved. | X |
| Messager | svchost.exe | Identified as a variant of the Trojan:Win32/Small.gen!AG malware. Note: Located in \%Temp%\ This infection should not be confused with the legitimate C:\Windows\System32\svchost.exe file. Note: Use SDFix under supervision. | X |
| Messander | svchost.exe | Added by a variant of the Trojan-Downloader.Win32.Delf.asz Trojan. Note: Located in \%ROOT%\Recyclers\ ,or \%ROOT%\Recyclers\. This infection should not be confused with the legitimate Note: \%WINDIR%\System32\svchost.exe file. | X |
| Messanger | svchost.exe | Added by a variant of the Trojan-Downloader.Win32.Delf.asz Trojan. Note: Located in \%ROOT%\Recyclers\ This infection should not be confused with the legitimate Note: \%WINDIR%\System32\svchost.exe file. | X |
| Messssanger | svchost.exe | Added by a variant of the Trojan-Downloader.Win32.Delf.asz Trojan. Note: Located in \%ROOT%\Recyclers\ This infection should not be confused with the legitimate Note: \%WINDIR%\System32\svchost.exe file. | X |
| Network Connections Sharing (RpcTftpd) | svchost.exe | Added by the W32.Welchia WORM! **Note - This service will be set to start manually | X |
| Network DDE DSMA (NetDDEdsma) | svchost.exe | Added by the W32/Sdbot-BMG WORM! Note: This is not the legitimate Windows Process. (Which is found in the System32 folder.) This worm file is found in the Windows or Winnt folder. | X |
| NVIDIA Driver Service¡¡ (NVSv ) | svchost.exe | Added by an unidentified TROJAN! of the Sdbot family. Note: This worm\trojan is located in C:\%WINDIR%\ | X |
| BullGuard Firewall (BsFirewall) | svchost.exe | Related to BullGuard Antivirus. Note: located in C:\Program Files\BullGuard Software\ | L |
| .NET Framework Service (.NET Connection Service) | svchost.exe | Added by an unidentified TROJAN! of the Sdbot family. Note: This worm\trojan is located in C:\%WINDIR%\ Note: NoteThe proper location for that operating file is in C:\%WINDIR%\System32 | X |
| NlaSvc | svchost.exe | Related to NLASvc Service Microsoft Corp Note: Located in \%Windir%\%System%\ | L |
| @%SystemRoot%ehomeehstart.d ll,-101 (ehstart) | svchost.exe | Windows Media Center Service Launcher in the Windows Vista edition | L |
| @%SystemRoot%system32qwave. dll,-1 (QWAVE) | svchost.exe | Related to Quality Windows Audio Video Experience Quality Windows Audio Video Experience (qWave) is a networking platform for Audio Video (AV) streaming applications on IP home networks. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\QWAVE.dll | L |
| @%SystemRoot%\ehome\ehstart .dll,-101 (ehstart) | svchost.exe | Part of Windows Vista | L |
| Alerter | svchost.exe | Notifies selected users and computers of administrative alerts. If the service is stopped, programs that use administrative alerts will not receive them. If this service is disabled, any services that explicitly depend on it will fail to start. | L |
| BullGuard Email Monitoring (BsMailProxy) | svchost.exe | Related to BullGuard Antivirus. Note: located in C:\Program Files\BullGuard Software\ | L |
| BullGuard File Monitoring (BsFileSpy) | svchost.exe | Related to BullGuard Antivirus. Note: located in C:\Program Files\BullGuard Software\ | L |
| Windows Configuration Loader (Windows Configuration Loader) | SVCHOST.EXE | Added by the RBOT.BZF WORM! Note: This is not the legitimate Windows process SVCHOST.EXE (Which is always found in the System32 folder.) This worm file is found in the Windows or Winnt folder. Note: Read the link, rootkit type stealth involved. | X |
| BullGuard Main (BGMainSvc) | svchost.exe | Related to BullGuard Antivirus. Note: located in C:\Program Files\BullGuard Software\ | L |
| Client de suivi de lien distribué (TrkWks) | svchost.exe | Related to Distributed Link Tracking Client Maintains links between NTFS files within a computer or across computers in a network. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\TrkWks.dll | L |
| DNS Server (DNS Server) | svchost.exe | Added by the Troj/Feutel-Y TROJAN! Note: This is not the legitimate Windows Process. (Which is found in the System32 folder.) This trojan file is found in the Windows or Winnt folder. | X |
| FastUserSwitchingCompatibil (Fast User Switching Compatibil) | svchost.exe | Added by the Troj/Keylog-AT TROJAN! Note: This is not the legitimate Windows process svchost.exe (Which is always found in the System32 folder.) This trojan file is found in the Windows or Winnt folder. | X |
| FFI | svchost.exe:exm.exe | Added by Trojan.DoS.Win32.Opdos TROJAN! Note: Please notethat this infection is an Alternate Data Stream file attached to the legitimate C:\Windows\System32\svchost.exe file. Note: Do not deletethe svchost.exe file as Windows will not operate correctly without it. | X |
| GbpSv | svchost.exe | Troj/Banker-EFM Note: Read the link, steals information Note: Located in %windir% | X |
| General Socket Service | SVCHOST.EXE | Mal/HckPk-A | X |
| Task Scheduler (Schedule) | svchost.exe | Added by a variant of the WORM_SOCKS.D WORM! Note: Located in \%WINDIR%\System32\drivers\ Note: Use SDFix under supervision. Do not delete the the legitimate file in C:\WINDOWS\System32\svchost.exe | X |
| SVCHOST | svchost.dll | Troj/Agent-GCZ Note: Located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (Vista/XP/WinNT/2K) | X |
| svchost.exe | svchost | Added by the Troj/Hupigo-AF Trojan Note: Read the link, allows remote access | X |
| PaintReport (PRSvc) | svchost.exe | Added by an unidentified TROJAN! of the Sdbot family. Note: This is not the legitimate Windows Process. (Which is found in the System32 folder.) This worm\trojan file is found in the Windows or Winnt folder. | X |
| svchost.exe (moto) | svchost.exe | Added by the Troj/Agent-MD TROJAN! Note: This worm\trojan is located in C:\%WINDIR%\ | X |
| svchost.exe (svchost.exe) | svchost.exe | Added by the Troj/GrayBird-X TROJAN! Note: This trojan file is found in the Windows or Winnt folder. | X |
| svchost | svchost.exe | Troj/Hupigon-CK Note: Located in %windir% Note: Read the link, allows remote access | X |
| System Event Messaging | svchost.exe | Seems to be viral | X |
| System Scheduler (SysSch) | svchost.exe | W32/DelCyc-A Note: Located in C:\Windows\Offline Web Pages (Win9x/Me), C:\%WINDIR%\Offline Web Pages (Vista/XP/WinNT/2K)Allows remote access | X |
| SVC Module (SVC Module) | svchost.exe | Added by the W32/Sdbot-ADG WORM! Note: This is not the legitimate Windows Process. (Which is found in the System32 folder.) This worm file is found in the Windows or Winnt folder. | X |
| Smart Card Reader Helper (scrhcust) | svchost.exe | Troj/Zapchas-DO Note: Located in %Root%\RECYCLED\S-1-5-21-3252328098-71414409-2463015037-500\Allows others to access the computer | X |
| taskmng (svchost) | svchost.exe | Added by the W32/Tilebot-AW WORM! Note: Read the link, rootkit type stealth involved. | X |
| Server Management Service | svchost.exe | Added by an unidentified TROJAN! of the Sdbot family. Note: This worm\trojan is located in C:\%WINDIR%\ folder. Note: This is not the legitimate Windows Process. (Which is found in the System32 folder.) | X |
| Security Windows services (WinSecurServ05) | svchost.exe | Unknown malware Note: Located in \%WINDIR%\System32\Microsoft\ This infection should not be confused with the legitimate \%WINDIR%\System32\svchost.exe file. Note: Use SDFix under supervision. | X |
| Security Service (JVWC) | svchost.exe | Added by a variant of the TrojanProxy:Win32/Chumpoke.gen!A malware Note: This worm\trojan is located in \%WINDIR%\System32\svcd\ | X |
| Remote Procadure Call (RPC) (RpeSs) | svchost.exe | Troj/Hupigo-UN Note: Read the link, steals information Note: Located in %windir% | X |
| RasAt (Remote Connection) | svchost.exe | Added by the Troj/Singu-AF TROJAN! | X |
| Windows Configuration Manager (ConfigMgr) | svchost.exe | Added by an unidentified TROJAN! of the Sdbot family. Note: This worm\trojan is located in C:\Windows\System (Win9x/Me), C:\%WINDIR%\System32 (XP/WinNT/2K) | X |
| Windows Configuration Backup Service (CfgBackupSvc) | svchost.exe | Added by an unknown variant of a backdoor TROJAN! Note: This worm\trojan is located in C:\%WINDIR%\CONFIG\ This is not the legitimate Windows Process. (Which is found in the System32 folder.) | X |
| Window Net Dns (MyDNS) | svchost.exe | Detected as Trojan.Win32.Delf.bhp by Kaspersky Note: Located in %programfiles%\Outlook Express or %programfiles%\Internet Explorer - not to be confused with the legitimate svchost.exe located in %windir%\system32 | X |
| Window Image Worker (windownetpker) | svchost.exe | Identified by Kaspersky Antivirus as a variant of the Trojan.Win32.Delf.amr malware. Note: Located in \%Program Files%\Internet Explorer\ This infection should not be confused with the legitimate \%WINDIR%\System32\svchost.exe file. | X |
| Window Domain Services (windowndns) | svchost.exe | Unknown malware. This infection should not be confused with the legitimate C:\Windows\System32\svchost.exe file. This malware is Note: located in \%Program Files%\Internet Explorer\ | X |
| Power Adapter (ADIDown) | svchost.exe | Troj/Maran-AB Note: Read the link, steals information | X |
| Power Adapter (ADIDown) | svchost.exe | Troj/Maran-AW Note: Located in C:\Windows (Win9x/Me), C:\%WINDIR% (XP/WinNT/2K) | X |
| Power Manager (PowerManager) | svchost.exe | Added by an unidentified TROJAN! of the Sdbot family. Note: This worm\trojan is located in C:\%WINDIR%\ folder. | X |
| W32Time | svchost.exe -k W32Time | Added by the Fuwudoor TROJAN! | X |
| TrkSvr | svchost.exe -k TrkSvr | Added by the Fuwudoor TROJAN! | X |
| TrkWks | svchost.exe -k TrkWks | Added by the Fuwudoor TROJAN! | X |
| Security Center (wscsvc) | svchost.exe, wscsvc.dll | Related to Security Center The WSCSVC (Windows Security Center) service monitors and reports security health settings on the computer. The health settings include firewall (on/off), antivirus (on/off/out of date), antispyware (on/off/out of date), Windows Update (automatically/manually download and install updates), User Account Control (on/off), and Internet settings (recommended/not recommended). Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\wscsvc.dll | L |
| Wireless Zero Configuration (WZCSVC) | svchost.exe, WZCSVC.dll | Related to Wireless Zero Configuration Provides automatic configuration for the 802.11 adapters. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\WZCSVC.dll | L |
| Network Provisioning Service (xmlprov) | svchost.exe, xmlprov.dll | Related to Network Provisioning Service Manages XML configuration files on a domain basis for automatic network provisioning. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\xmlprov.dll | L |
| Browser | svchost.exe -k Browser | Added by the Fuwudoor TROJAN! | X |
| AppMgmt | svchost.exe -k AppMgmt | Added by the Fuwudoor TROJAN! | X |
| @%SystemRoot%system32seclog on.dll,-7001 (seclogon) | svchost.exe, seclogon.dll | Related to Secondary Logon Enables starting processes under alternate credentials. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\schedsvc.dll | L |
| SSDP Discovery Service (SSDPSRV) | svchost.exe, ssdpsrv.dll | Related to SSDP Discovery Service Enables discovery of UPnP devices on your home network. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\ssdpsrv.dll | L |
| COM Message Transfer (mscommt) | svchost.exe -k mscommt | Added by the Troj/Dbit-A TROJAN! | X |
| dmserver | svchost.exe -k dmserver | Added by the Fuwudoor TROJAN! | X |
| Disk Monitor Services (DiskMon32) | svchost.exe -k dmon | Added by the Hanmon TROJAN! Note: This trojan file is found in the System32 folder. | X |
| Desktop Window Manager Session Manager (UxSms) | svchost.exe -k LocalSystemNetworkRestricted | Part of Windows Vista Note: Located in C:\%WINDIR%\System32 | L |
| DCOM Server Process Launcher (DcomLaunch) | svchost.exe -k DcomLaunch | Part of Windows Vista Note: Located in C:\%WINDIR%\System32 | L |
| Cryptographic Services (CryptSvc) | svchost.exe -k NetworkService | Part of Windows Vista Note: Located in C:\%WINDIR%\System32 | L |
| COM+ Event System (EventSystem) | svchost.exe -k LocalService | Part of Windows Vista Note: Located in C:\%WINDIR%\System32 | L |
| Certificate Propagation (CertPropSvc) | svchost.exe -k netsvcs | Part of Windows Vista Note: Located in C:\%WINDIR%\System32 | L |
| Removable Storage (NtmsSvc) | svchost.exe, NtmsSvc.dll | Related to Removable Storage Manages and catalogs removable media and operates automated removable media devices. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\NtmsSvc.dll | L |
| ntmssvc | svchost.exe -k ntmssvc | Added by the Fuwudoor TROJAN! | X |
| Routing and Remote Access (RemoteAccess) | svchost.exe, rasctrs.dll | Related to Routing and Remote Access Allows computers to dial in to the local computer through a modem (or other devices) to access the local network using a standard or VPN connection. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is the filename \%WINDIR%\%System%\rasctrs.dll | L |
| Routage et accès distant (RemoteAccess) | svchost.exe rasctrs.dll | Related to Routing and Remote Access Allows computers to dial in to the local computer through a modem (or other devices) to access the local network using a standard or VPN connection. Note: This service on Vista - 64 bit operating system is launched by svchost.exe, but the actual application is what is the filename \%WINDIR%\%System%\rasctrs.dll. | L |
| NetLogon | svchost.exe -k NetLogon | Added by the Fuwudoor TROJAN! | X |
| MS Internet Countermeasures Framework (ICF) | \System32:svchost.exe | Added by an unidentified TROJAN! of the Sdbot family. Note Note: DO NOT delete the svchost.exe file. | X |
| Messenger | svchost.exe -k Messenger | Added by the Fuwudoor TROJAN! | X |
| ProtectedStorage | svchost.exe -k ProtectedStorage | Added by the Fuwudoor TROJAN! | X |
| LmHosts | svchost.exe -k LmHosts | Added by the Fuwudoor TROJAN! | X |
| WebClient | svchost.exe, webclnt.dll | Related to WebClient Enables Windows-based programs to create, access, and modify Internet-based files. Note: This service on Vista and XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\webclnt.dll | L |
| IPRIP (IPRIP) | svchost.exe -k netsvcs | Added by the Backdoor.Ripgof TROJAN! Note: Read the link, rootkit type stealth involved. | X |
| Logical Disk Manager (dmserver) | svchost.exe, dmserver.dll | Related to Logical Disk Manager Detects and monitors new hard disk drives and sends disk volume information to Logical Disk Manager Administrative Service for configuration. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\dmserver.dll | L |
| Error Reporting Service (ERSvc) | svchost.exe, ERSvc.dll | Related to Error Reporting Service Allows error reporting for services and applictions running in non-standard environments. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\ERSvc.dll | L |
| Help and Support (helpsvc) | svchost.exe, helpsvc.dll | Related to Help and Support Enables Help and Support Center to run on this computer. If this service is stopped, Help and Support Center will be unavailable. If this service is disabled, any services that explicitly depend on it will fail to start. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\helpsvc.dll | L |
| Network Connections (Netman) | svchost.exe, Netman.dll | Related to Network Connections Manages objects in the Network and Dial-Up Connections folder, in which you can view both local area network and remote connections. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\Netman.dll | L |
| Windows Time (W32Time) | svchost.exe, w32time.dll | Related to Windows Time Maintains date and time synchronization on all clients and servers in the network. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\w32time.dll | L |
| Remote Access Auto Connection Manager (RasAuto) | svchost.exe, RasAuto.dll | Related to Remote Access Auto Connection Manager Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\RasAuto.dll | L |
| RasMan | svchost.exe, RasMan.dll | Related to Remote Access Connection Manager This service is required if you use Windows Firewall/Internet Connection Sharing. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\RasMan.dll | L |
| Remote Registry (RemoteRegistry) | svchost.exe, regsvc.dll | Related to Remote Registry Enables remote users to modify registry settings on this computer. If this service is stopped, the registry can be modified only by users on this computer. If this service is disabled, any services that explicitly depend on it will fail to start. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\regsvc.dll | L |
| Remote Procedure Call (RPC) (RpcSs) | svchost.exe, RpcSs.dll | Related to Remote Procedure Call (RPC) The RPCSS service is the Service Control Manager for COM and DCOM servers. It performs object activations requests, object exporter resolutions and distributed garbage collection for COM and DCOM servers. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\RpcSs.dll | L |
| Task Scheduler (Schedule) | svchost.exe, schedsvc.dll | Related to Task Scheduler Enables a user to configure and schedule automated tasks on this computer. The service also hosts multiple Windows system-critical tasks. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\schedsvc.dll | L |
| System Event Notification (SENS) | svchost.exe, Sens.dll | Related to System Event Notification Tracks system events such as Windows logon, network, and power events. Notifies COM+ Event System subscribers of these events. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\Sens.dll | L |
| Shell Hardware Detection (ShellHWDetection) | svchost.exe, shsvcs.dll | Related to Shell Hardware Detection Provides notifications for AutoPlay hardware events. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\shsvcs.dll | L |
| System Restore Service (srservice) | svchost.exe, Srsvc.dll | Related to System Restore Service Performs system restore functions. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\Srsvc.dll | L |
| Windows Image Acquisition (WIA) (stisvc) | svchost.exe, stisvc.dll | Related to Windows Image Acquisition (WIA) Provides image acquisition services for scanners and cameras. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\stisvc.dll | L |
| Telephony (TapiSrv) | svchost.exe, TapiSrv.dll | Related to Telephony Provides Telephony API (TAPI) support for programs that control telephony devices on the local computer and, through the LAN, on servers that are also running the service. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\TapiSrv.dll | L |
| Terminal Services (TermService) | svchost.exe, termsrv.dll | Related to Terminal Services Allows users to connect interactively to a remote computer. Remote Desktop and Terminal Server depend on this service. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\termsrv.dll | L |
| Themes | svchost.exe, themeservice.dll | Related to Themes Provides user experience theme management. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\themeservice.dll | L |
| Universal Plug and Play Device Host (upnphost) | svchost.exe, upnphost.dll | Related to Universal Plug and Play Device Host Provides support to host Universal Plug and Play devices. Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\upnphost.dll | L |
| Net Driver HPZ12 | svchost.exe, HPZipm12.exe, HPZinw12.dll | Related to Hewlett-Packard PML Driver HPZ12 Service. Note: Located in \%WINDIR%\%System%\ Note: This service on A XP - 64 bit operating system is launched by svchost.exe, but the actual application is what is listed as the service name with the filename \%WINDIR%\%System%\HPZipm12.exe | L |
| Policy Agent | svchost.exe -k Policy Agent | Added by the Fuwudoor TROJAN! | X |
| svchost.exe | svchost (no file extension) | Troj/Hupigo-AF Note: Located in C:\Windows The file will show no extension | X |