| Status | Autorun name | Command | Description |
| U | SBC RoamingClient | SBCFL.exe | Part of AT&T FreedomLink Wi-Fi connection software |
| U | SBC Self Support Tool | matcli.exe | matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address, city, county, etc and gets written to a log file. The SBC Self Support Tool is required to run with the Help and Support program. If you uncheck SBC and then run Help and Support it will add another SBC entry in the startup menu. If you remove this software in "add/remove programs" some help menus in help and support will not be available. You decide |
| N | SBC Yahoo! Connection Manager | ConnectionManager.exe | Used to create and connect your SBC Yahoo DSL connection. This program has been reported to cause problems for some users. If you find that it causes you pc to become slow or unstable you should uninstall it (using Add/Remove programs) and manually connect your DSL connection |
| Y | SBCSTray | SBCSTray.exe | System Tray access to CounterSpy antispyware software |
| U | SBDrvDet | SBDrv.exe | Detects the "Easy Front-Panel Audio Connectivity Drive Internal Drive Bay" on the Sound Blaster Audigy 2 Platinium eX. Can be disabled if you don't have one |
| N | sbdrvdet | sbdrvdet.exe | Checks to see if Creative sound card driver should be updated |
| X | SBHC | sbhc.exe | SuperBar parasite |
| X | SBI | install_sbd_**.exe | Installer for a number of rogue security products and error fixing tools - where ** represents a 2 letter language code, i.e., "en" for English, "de" for German, etc |
| X | SBMPOP | SBMPop.exe | SearchByMedia adware |
| N | SBMX | sbmx.exe | SoundMAX MPU401 MIDI device emulator for x86 VM DOS games/apps (for Win9x only) |
| X | SBR2009F | SystemBooster2009.exe | SystemBooster2009 rogue system suite - not recommended, removal instructions here |
| X | sbss Launcher | sbss.exe | SideBySide adware |
| N | SBSV 2010/02/19-11:02:07 | SwitchBoard.exe | Part of both stand-alone Adobe CS5 products (such as Photoshop) and suites. "SwitchBoard makes it possible for AIR stand-alone applications to work with Creative Suite applications. Whilst testing, it would appear that this entry can be safely disabled as it will be loaded when required but if you experience problems try re-enabling it. There is also a Switchboard service using the same file which forwards messages between AIR and CS applications |
| X | SBUSA | SBUSA.exe | Spam Blocker Utility adware by the people who provide the Hotbar adware |
| U | SbUsb AudCtrl | RunDll32 sbusbdll.dll, RCMonitor | Control for Soundblaster MP3 external (USB) sound card |
| N | sc | scrubxp.exe | ScrubXP - utility that deletes safe to remove files, cookies, browsing history, etc |
| U | sc | sc.exe | Watchdog 2.0 Software - monitoring program |
| U | sc | run.exe | All-In-One_SPY stealth monitoring software - allows monitoring and recording of all actions performed on a computer. It records all keystrokes, remembers addresses of Internet pages visited, and maintains a log file listing all applicationsrun on the computer. It can create screenshots and record sounds from the computer's microphone to a sound file |
| X | SC2 | scprot4.exe | Added by the AGENT.APP TROJAN! |
| ? | sc23exec | sc23exec.exe | Possibly related to a digital camera |
| Y | SC3300CC | SC3300CC.exe | SiPix digital camera Twain device driver |
| X | scain | s030109.Stub.exe | Delfin Media Viewer adware related |
| X | ScamDisk | SVOHOST.exe | Added by the LEWOR.D WORM! |
| X | scan | mscman.exe | ClientMan parasite variant |
| ? | Scan Detector | Pmxdetect.exe | Associated with PrimaScan scanners. Is it required? |
| X | Scan Register | ssms.exe | Added by the RBOT-AT WORM! |
| ? | Scan Wizard | button.exe | Associated with Scan Wizard as supplied with Microtek scanners - see also the Scanner Detector and Sdetect entries. What does it do and is it required? |
| X | Scan&Repair2006.exe | Scan&Repair2006.exe | Scan&Repair Utilities 2006 rogue system utility - not recommended |
| X | Scan119 | Scan119.exe | Scan119 rogue security software - not recommended, removal instructions here |
| U | Scan2pc | Scan2pc.exe | Scan to PC application for the scanning function of multiple multifunction printers from Dell, Samsung, Xerox, Ricoh and others |
| X | ScanDisc | satan.exe | Added by the GREGSTAR TROJAN! |
| X | ScanDisk | ScanDisk.exe | Added by the GANDA.A WORM! Note - this is not the valid "ScanDisk" Win9x/Me standard disk error checker |
| X | scands32.exe | scands32.exe | Added by a variant of the ADCLICKER TROJAN! |
| X | Scandsk2 | scandsk2.exe | Added by the AGOBOT-PK WORM! |
| X | scandskx.exe | scandskx.exe | Added by the DLOADR-ARM TROJAN! |
| ? | ScanFile | ?? | ?? |
| Y | ScanInicio | Inicio.exe | Part of Panda Antivirus. Responsible for scanning the boot sector of your disk and your memory at startup to check for viruses that try and load and act before your anti-virus is fully operational. It only adds a fraction of a second to start-up time and is worth leaving active |
| U | SCANMSG | SCANMSG.EXE | Part of older versions of the range of internet security products from Quick Heal - including Total Security, Internet Security and AntiVirus. Enables the "Quick Heal messenger service which provides important information about latest threats, updates and other information related to Quick Heal." Also included by vendors who use the Quick Heal engine such as Omniquad and iQon |
| N | Scanner Detector | SDetect.exe | ScanSuite Scanner Detector - part of ScanWizard, supplied with Microtek scanners. Waits until you press the "GO" button and seems to serve no other purpose. Automatically installed without prompting. Not required if you can start your scanning application before pressing the "GO" button |
| Y | Scanner File Utility | NsCatCom.exe | Kycocera Mita network copier/printer/scanner process to dump scanned documents onto a workstation |
| ? | Scanner Reminder | remind.exe | Part of older versions of the range of internet security products from Quick Heal - including Total Security, Internet Security and AntiVirus. Also included by vendors who use the Quick Heal engine such as Omniquad and iQon. What does it do and is it required? |
| ? | ScanPanel | ScanPanel.exe | Trust Easy Webscan scanner related - what does it do and is it required? |
| X | Scanreg | [filename] | Added by the QQPASS.E TROJAN! |
| X | ScanRegistry | nsrvnt.exe | Added by the NERTE TROJAN! Not to be confused with the real ScanRegistry - which is a vital Windows file. This version has the executable as nsrvnt.exe not scanregw.exe |
| X | ScanRegistry | scanregv.exe | Added by the MASTERLOCK TROJAN!. Not to be confused with the real ScanRegistry - which is a vital Windows file. This version has the executable as scanregv.exe not scanregw.exe |
| Y | ScanRegistry | Scanregw.exe | Scans the Win98/Me system registry and makes back-ups at start-up - important should the registry become corrupt. Located in %windir% |
| X | ScanRegistry | Scanregw.exe | Added by the STATOR WORM! Note - this is not legitimate ScanRegistry entry - which is a vital Windows file. The executable "Scanregw.exe" is located in %System%. Runs from the registry RunServices key as opposed to the Run key |
| X | ScanRegistry | N/A | Added by the DINOXI or DINOXI.B WORMS! |
| X | ScanRegistry | scanregw.exe | Added by the NYXEM-D WORM! Note - do not confuse this with the legitimate Windows process scanregw.exe which is always found in the Windows folder on Win9x/ME machines. This worm file is found in %System% |
| X | ScanRegistry | update.exe | Added by the DWNLDR-FZY TROJAN! |
| N | ScanSoft OmniPage SE 4.0-reminder | Ereg.exe ereg.ini | Registration reminder for Ominpage SE version 4 from Scansoft (now Nuance) |
| N | ScanSoft PaperPort 7 Registration Reminder | NAVBrowser.EXE | Registration reminder for PaperPort 7 from Scansoft (now Nuance) |
| N | ScanSoft PDF Professional 4-reminder | Ereg.exe Ereg.ini | Registration reminder for PDF Converter Professional version 4 from Scansoft (now Nuance) |
| X | ScanSpyware | Scanner.exe | ScanSpyware rogue security software - not recommended, removal instructions here. Also see here, here and here |
| X | ScanSpyware v3.2 | Scanner.exe | ScanSpyware rogue security software - not recommended, removal instructions here. Also see here, here and here |
| X | ScanSpyware v3.5 | Scanner.exe | ScanSpyware rogue security software - not recommended, removal instructions here. Also see here, here and here |
| U | ScanSys32 | sb32mon.exe | Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself! |
| X | scApp | scApp.exe | Added by the STANDO-E WORM! |
| X | scApp | suchost.exe | Added by the ACNATT.A WORM! |
| X | scApp | wmiprvse.exe | Added by the SILLYFDC-AW WORM! |
| N | SCardSvr | scardsvr.exe | Related to SmartCard readers and sometimes uses lots of system resources |
| X | SCardSvr | SCardSvr32.Exe | Added by the MOFEI.B WORM! |
| U | SCDEmuApp.exe | SCDEmuApp.exe | Related to PowerISO - CD/DVD image file processing tool |
| U | Schdlr32 | Schdlr32.exe | Scheduled backups for the NTI Backup Now archiving utility. If a backup job has been scheduled, this entry places an icon in the System Tray and will automatically load the main program and execute the backup at the set time - as long as the backup media is present |
| X | scheck45 | scheck45.exe | Related to unknown malware - hidden installer associated with it |
| X | schedl | schedl.exe | Added by the VB-DVW WORM! |
| U | schedm | schedm.exe | Part of Antivir PersonalEdition Classic anti-virus |
| X | ScheduIe | nrchk.exe | Premium rate adult content dialler |
| X | ScheduIr | msexploren.exe | Added by a variant of the SDBOT WORM! |
| X | ScheduIr | shch.exe | Added by a variant of the SDBOT WORM! |
| X | ScheduIr | svchst.exe | Added by a variant of the SDBOT WORM! |
| X | ScheduIr | winagent.exe | Added by a variant of the SDBOT WORM! |
| U | Schedule | Schedule.exe | Scheduler for Mercury Ez View TV Tuner Card |
| N | Scheduled Maintenance | Scheduled_Maintenance.exe | Scheduler for Iolo System Mechanic tweaking utility. It can cleans your registry and deletes temporary files at defined intervals. Available via Start -> Programs |
| X | Scheduler | expIorer.exe | Added by the TACTSLAY.A TROJAN! Note that the filename has a capital "i" in it |
| X | Scheduler | MSMSGS.EXE | Added by the HOSTBANK-A TROJAN! Note - this particular msmsgs.exe file is located in %System%\Config and should not be mistaken for the MSN Messenger file of the same name which is located in %Program Files%\Messenger |
| X | Scheduler | outIook.exe | Added by the TACTSLAY.A TROJAN! Note that the filename has a capital "i" in it |
| X | Scheduler | svcrhost.exe | Added by the TACTSLAY.A TROJAN! |
| X | Scheduler | svcshost.exe | Added by the TACTSLAY.A TROJAN! |
| X | Scheduler | winagent.exe | Added by the TACTSLAY.B TROJAN! |
| U | Scheduler | Scheduler daemon.exe | Tenebril GhostSurf or SpyCatcher related scheduler - you can schedule daily, weekly, monthly or one-time only cleanings |
| X | Scheduler | msnexploren.exe | Added by the TACTSLAY.B TROJAN! |
| X | Scheduler | sdhch.exe | Added by the TACTSLAY.B TROJAN! |
| X | Scheduler | svchst.exe | Added by the TACTSLAY.B TROJAN! |
| X | Scheduler Service | wsass.exe | Added by the LIOTEN.KX WORM! |
| U | scheduler_monitor | init_scheduler.exe | Scheduler for ReaConverter advanced image converter |
| U | scheduler_proxy Application | scheduler_proxy.exe | Found on IBM/Lenovo ThinkCentre/ThinkStation desktops and Thinkpad notebooks. Included with versions of ThinkVantage System Update (for software updates), Rescue and Recovery (backup and system recovery), Message Center Plus and maybe others. It's exact function isn't known but if disabled, the "plan updates" button in the IBM System Update software will no longer be available, though the software will continue run properly |
| X | SchedulerMgr | navchk.exe | Premium rate adult content dialer |
| X | Scheduling Agent | Scheduler.exe | Added by the SUBWOOFER TROJAN! Note - this is not the real MS Scheduling agent as the executable is incorrect |
| X | SchedulingAgant | MMTASK.EXE | Added by the YAB.A TROJAN! Note - this is not the legitimate MusicMatch Jukebox file which has the same filename and is normally located in %ProgramFiles%\Musicmatch\Musicmatch Jukebox. This one is located in %Windir% |
| U | SchedulingAgent | mstask.exe | MS Scheduling Agent in Win98/Me/2K - displayed as a box with a stopwatch in the System Tray that is only needed if you have regular scheduled disk defragmenting, ScanDisk, etc. Required if you have regularily scheduled events such as weekly virus scans. Located in %System% and loads via the HKLM\RunServices registry key |
| U | SchedulingAgent | mstinit.exe | MS Scheduling Agent in WinNT - displayed as a box with a stopwatch in the System Tray that is only needed if you have regular scheduled disk defragmenting, ScanDisk, etc. Required if you have regularily scheduled events such as weekly virus scans. Located in %System% and loads via the HKLM\Run registry key with "/firstlogon" appended. Can also appear in WinXP (based upon the number of examples in a Google search) and rarely in Win98/Me/2K but we haven't seen it |
| X | SchedulingAgent | N/A | Added by the DINOXI or DINOXI.B WORMS! |
| X | SchedulingAgent | mstask.exe | Added by unidentified MALWARE! Note - this is not the MS Scheduling Agent in Win98/Me/2K. This one also loads via the HKLM\RunServices registry key but is located in %System% on a WinXP machine - where a file of that name does not normally exist |
| X | SchedulingAgent | mstasks.exe | Added by the MSIC BACKDOOR! |
| N | SCHelper.exe | SCHelper.exe | Spyware Cease spyware remover. Previous versions were regarded as a rogue (see here) because it reported false or exaggerated system security threats but the latest version tested (6.5.1) has a new interface and produces no exaggerated threats on a clean system. Not recommended due to the past history |
| X | SchijfBewaker | SysRep.exe | SchijfBewaker, Dutch rogue system error and cleaning utility - not recommended. A member of the ErrClean family |
| X | SchijfControleur | GDC.exe | SchijfControleur Dutch rogue privacy tool - not recommended. A member of the PCPrivacyTool family |
| U | Schmaili | Schmaili.exe | Schmaili - insert animated smilies into your e-mail |
| X | schost | [path to trojan] | Added by the TJSERV.D TROJAN! |
