| Status | Autorun name | Command | Description |
| X | Startup | svchost.exe | Added by the AGENT-QCK TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %AppData%\Microsoft |
| U | Startup Agent | startupagent.exe | Startup Agent by KillerSoftware - "provides constant monitoring of the startup areas during your Windows session. If Startup Agent has detected changes to your registry or startup files, you will be displayed with a Warning Message and asked if you want to remove those new changes" |
| X | Startup Configuration | [six character filename] | Added by the RBOT-ARV WORM! |
| X | Startup Configuration | wztoid.exe | Added by the RBOT-ASD WORM! |
| ? | Startup Launcher GUI | GUI.exe | Startup manager? |
| U | Startup Manager Scanner | StartupMonitor.exe | Startup-Mechanic Startup monitor - offers boot protection of your PC from harmful trojans, adult-dialers, and other scumware |
| Y | Startup Scan | sensor.exe | Part of older versions of the range of internet security products from Quick Heal - including Total Security, Internet Security and AntiVirus. Optionally scans the system boot area for programs trying to automatically execute before Windows loads and keeps a watch on some system files which are commonly patched (or replaced) by malware. Feature not supported on Windows 7/Vista systems. Also included by vendors who use the Quick Heal engine such as Omniquad and iQon |
| X | Startup Update | Cvshost.exe | Added by the GAOBOT.AO WORM! |
| X | StartupBin | iwnujdss.exe | Added by the SDBOT-XZ WORM! |
| X | StartUpDate | [path to trojan] | Added by the BIFROSE.F BACKDOOR! |
| U | StartupMonitor | StartupMonitor.exe | Mike Lin's StartupMonitor, throws up an alert and asks your permission every time any change is made to your start-up configuration, either in the registry or start menu |
| X | StartupOption | loadsysdisk.exe | Added by the HIDAGENT-B WORM! |
| X | Startwd | rundll32.exe wd081025.dll,Hook | Added by the AGENT.DE TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "wd081025.dll" file is found in %System% |
| X | startwin | startwin.exe | Added by the ANTIMAN.A WORM! |
| X | startwindowskeyuser | rundle2.exe | Added by the JAVAKILLER TROJAN! |
| N | Stat 'n' Perf | StatnPerf.exe | Stat 'n' Perf monitors your internet connection and displays information about sent and received bytes |
| X | StatBar | STATBAR.exe | StatBar (system status bar) allows you to quickly get an overview of your system's condition (memory, CPU, uptime, and much more). Due to the sheer number of resources (over 60%) consumed by this program, it is unsuitable for Windows 9x/Me |
| X | State Service | csrss.exe | Added by the DADOBRA-CP TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir% |
| U | StationPlaylistStudio | SPLStudio.exe | StationPlaylist Studio - "simple to use on-air broadcast playback software for the studio and/or DJ" for small to medium sized radio broadcasters, and internet webcasters |
| X | Statistics | statslist.exe | Added by the OPANKI-S WORM! |
| X | statloads | pgjd83sa.exe | Added by the SDBOT-UM WORM! |
| N | Status Monitor | BrMfcWnd.exe | Brother scanner status monitor - can be started manually |
| U | Status Monitor CLJ1500 | HPPOUMUI.exe | Status monitor for the HP Color LaserJet 1500 printer from Hewlett-Packard - for monitoring printer status, checking ink levels, etc |
| N | Status Monitor XE | ENGSS.EXE | The Xerox Document WorkCentre XE Series Status Monitor displays information about your printer and currently active or waiting print jobs. You can use it to control your printing environment and manage your printing operations. Available via Start -> Programs |
| ? | StatusClient | StatusClient.exe | Part of Hewlett Packard network printer drivers |
| ? | StatusClient 2.6 | StatusClient.exe | Part of Hewlett Packard network printer drivers |
| N | StatusView | StatusView.exe | Status View intra-office messaging |
| N | Stay Connected! | StayCon.exe | More than just a pinger, actually simulates online activity. Supports AOL, NetZero, MSN, ATT WorldNet, CompuServe and many other ISPs as well. Available via Start -> Programs |
| U | StayAlive | StayAlive.Exe | Part of RealSPEED - tweaking utility to speed-up your internet connection. Stay connected even after a period of inactivity on the net |
| U | StayAlive | sa.exe | StayAlive from TFI Technology. "This top-notch tool intercepts crashes when they happen, keeping your programs running so you can save your work." |
| ? | STBVision | STBVisn.exe | Related to the STB Velocity graphics card. What does it do and is it required? |
| N | STBWEBTV | STBWEBTV.EXE | Used to display TV on your PC |
| X | stcinstaller | id53.exe | Added by the SCTHOUGHT.L TROJAN! |
| X | STCLOA~1 | STCLOA~1.EXE | SecondThought adware |
| X | stcloader | stcloader.exe | SecondThought adware |
| Y | STCPO | STCPO.exe | Sophos Sweep antivirus software |
| X | StdAFX | stdafx.exe | Added by the DELBOT-AF WORM! |
| X | stdlib | [filename] | Added by the PERDA-E TROJAN! |
| Y | STDSB | STDSB.exe | Scrollbar driver for notebooks. If taken out of the Startup, it will not provide scrolling |
| U | Stealth Anonymizer 2.5 | stealth25.exe | Now named Stealther - proxy server agent that lets you travel the Internet with maximum possible privacy |
| X | stealth.dcom.exe | stealth.dcom.exe | Added by the THEALS.A WORM! |
| X | stealth.ddos.exe | stealth.ddos.exe | Added by the THEALS.A WORM! |
| X | stealth.exe | stealth.exe | Added by the THEALS.A WORM! |
| X | stealth.injector.exe | stealth.injector.exe | Added by the THEALS.A WORM! |
| X | stealth.stat.exe | stealth.stat.exe | Added by the THEALS.A WORM! |
| X | stealth.wm.exe | stealth.wm.exe | Added by the THEALS.A WORM! |
| X | stealth.worm.exe | stealth.worm.exe | Added by the THEALS.A WORM! |
| N | Steam | steam.exe | Valve Corporation's STEAM broadband game client. Steam is Valve's new way of getting games into your hands ASAP. Games like Half-Life, Counter-Strike, and Counter-Strike: Condition Zero are all being made available through Steam. Steam games are automatically kept up-to-date with the latest content and revisions. Steam also includes an instant-message client which even works while you're in-game |
| X | steam | steam.exe | Added by the RBOT-AJT WORM! Note - the file steam.exe will be found in %System% and is not associated with Valve Software's game client |
| X | Steam | PACsteam.exe | Added by the AGENT-SF MALWARE! |
| X | Steam.exe | [path to file] | Added by the DRACMETES.A password stealer! |
| X | SteFanie | SteFanie.vbs | Added by the STEFAN WORM! Note - make sure you check the hyperlink as this one copies it's self to numerous dirves and folders |
| ? | stgclean | w32main2.exe | Related to IBM Standard Software Installer. What does it do and is it required? |
| N | Stickies | Stickies.exe | Stickies - "lets you put yellow sticky notes on your Windows desktop, much like the popular Mac OS application. It is very simple, very customizable, and completely free!". Available via Start → Programs |
| U | Stickies | Sticky Notes.exe | Stickies virtual post-it widget for the DesktopX desktop utility from Stardock Corporation. Once started, Sticky Notes.exe loads a file called "DXWidget.exe" and exits |
| N | Sticky Notes | stikynot.exe | Microsoft Sticky Notes - virtual sticky notes tool from Windows Vista. This implementation of the popular yellow "Post-It" tool is part of the Tablet PC features and allows you to enter either handwriting (via a pen or mouse) or record a voice note. AVailable via Start → All Programs |
| U | Sticky Pad | StickyPad.exe | Sticky Pad from Green Eclipse. Place sticky notes on your desktop |
| Y | Sticky Password | stpass.exe | Sticky Password from Lamantine Software - "stores and protects all your personal data (e.g. passwords, user names, contacts, phone numbers, etc.). Sticky Password links passwords and accounts to applications and websites for which they are used. All information is stored in encrypted form in the Database, access to which is protected by a Master Password" |
| Y | Sticky Password Manager | stpass.exe | Sticky Password from Lamantine Software - "stores and protects all your personal data (e.g. passwords, user names, contacts, phone numbers, etc.). Sticky Password links passwords and accounts to applications and websites for which they are used. All information is stored in encrypted form in the Database, access to which is protected by a Master Password" |
| N | StickyNote | StickyNote.exe | Utility that allows you to put yellow "Post-It" type messages on your desktop. Available via Start -> Programs |
| Y | StickyPassword | stpass.exe | Sticky Password from Lamantine Software - "stores and protects all your personal data (e.g. passwords, user names, contacts, phone numbers, etc.). Sticky Password links passwords and accounts to applications and websites for which they are used. All information is stored in encrypted form in the Database, access to which is protected by a Master Password" |
| U | StillImageMonitor | Stimon.exe | Stimon.exe enables a USB still-image device (such as a scanner) to initiate data transfer to a program. For example, if your scanning device has a scan button, it may start a program and begin scanning when you press it. Create a shortcut and start it manually when needed if your scanner otherwise fails to scan. May be required for your USB scanner to work - including all HP scanners and some of their SCSI scanners |
| X | stisrv | stisrv.exe | Added by the RBOT.BQF WORM! |
| X | stlbdist | rundll32exe stlbdist.DLL, DllRunMain | Hijacker pointing to www.searchandclick.com |
| X | stlbupdt | rundll32.exe stlbupdt.DLL,DllRunMain | BrowserAid adware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The "stlbupdt.dll" file is found in %System% |
| N | STManager | drst.exe | Dr. SpeedTouch is some sort of diagnostics software which sends out information to a server which then relays the information back to the program to test the network to see if the SpeedTouch ADSL modem connection is working properly. Not required if connected via Ethernet (and probably USB). Can cause a slow down in Win2K - see here |
| X | stmha | wkfxi.js | Added by the SPETH WORM! |
| X | stonedrv | stonedrv.exe | Added by the COSIMA-K TROJAN! |
| X | StopingSpy | StopingSpy.exe | StopingSpy rogue security software - not recommended, removal instructions here |
| U | StopSignPopupBlocker | sspopupblockerctrl.exe | Pop-up blocker function of eAcceleration Stop-Sign security software - previously not recommended (see here). It has now been delisted, so make sure you have the latest version - hence the "U" recommendation |
| U | StopSignSsFwMon | Rundll32.exe [path] ssfwmon.dll,VerifyStatus | eAcceleration Stop-Sign security software related - previously not recommended (see here). It has now been delisted, so make sure you have the latest version - hence the "U" recommendation |
| U | StopSignSsSsMon | Rundll32.exe [path] ssssmon.dll,VerifyStatus | eAcceleration Stop-Sign security software related - previously not recommended (see here). It has now been delisted, so make sure you have the latest version - hence the "U" recommendation |
| U | StopSignSsTsMon | Rundll32.exe [path] sstsmon.dll,VerifyStatus | eAcceleration Stop-Sign security software related - previously not recommended (see here). It has now been delisted, so make sure you have the latest version - hence the "U" recommendation |
| U | StopSignStatus | Rundll32.exe [path] stopsinfo.dll,VerifyStatus | Installer for eAcceleration Stop-Sign security software - previously not recommended (see here). It has now been delisted, so make sure you have the latest version - hence the "U" recommendation |
| U | STOPzilla | Stopzilla.exe | StopZilla! - pop-up killer |
| U | STOPzilla Service | SZNTSVC.EXE | StopZilla! - pop-up killer |
| U | StorageGuard | sgtray.exe | StorageGuard from Veritas. Free utility that integrates with Backup MyPC (formerly Backup Exec Desktop), Simple Backup and MS Backup. Provides system tray access and background monitoring - warning you of files that haven't recently been backed up. Required unless you backup manually on a regular basis or have scheduled backups |
| U | StorageManager | StorageManager.exe | Storage Manager software for the Belkin F5D8235 & F5D8635 N+ Wireless (Modem) Routers - which include a single USB port for attaching a storage device (flash drive or external hard drive). This provides network-attached storage capabilities without having to purchase an expensive NAS |
| X | StorageProtector | SysRep.exe | StorageProtector rogue system error and cleaning utility - not recommended, removal instructions here. A member of the ErrClean family |
| U | StormCodec_Helper | StormSet.exe | Storm Codec is a codec pack for Windows |
| Y | stpass | stpass.exe | Sticky Password (from Lamantine Software), Kaspersky Password Manager and My Password Manager in an earlier version of Kaspersky PURE (both by Kaspersky Lab and based upon Sticky Password). Password management utilities which automate the process of entering passwords and other data into websites and saves the user from going to the trouble of creating and remembering multiple passwords |
| ? | STPMGR | STPMGR.EXE | Part of SafeTP which is transparent FTP security software. Does it need to be running permanently or can it be started manually via Start -> Programs |
| X | stratas | xmconfig.exe | Added by the RBOT-AHR WORM! |
| X | stratas | lockx.exe | Added by the SDBOT-ADD WORM! |
| X | Stratas | ggfig.exe | Added by the OPANKI.W WORM! |
| X | StreamAppliance | wuauclt14.exe | Added by the RBOT-GMB WORM! |
| X | StreamAppliance | wuauclt16.exe | Added by the RBOT-GME WORM! |
| N | Streamload Downloader | SlDB.exe | Downloader for MediaMax (was Streamload) - "gives you a private and secure place to upload, store, access, and share your personal videos, photos, movies, music, and files" |
| N | Streamload Uploader | StreamMgr.exe | Uploader for MediaMax (was Streamload) - "gives you a private and secure place to upload, store, access, and share your personal videos, photos, movies, music, and files" |
| X | Streams Drivers | [trojan filename] | Added by the RESTARTER.E TROJAN! |
| U | StreamZap Remote | zremote.exe | StreamZap PC Remote - control Windows Media Player, iTunes, RealPlayer, Winamp, PowerPoint, MusicMatch Jukebox, and many other multimedia applications |
| U | StrgSync.exe | StrgSync.exe | SimpleTech Inc's StorageSync backup software - backs up an entire PC, or selected files and folders |
| X | strkjhk | sdflkj3.exe | Added by an unidentified WORM or TROJAN - see here |
| X | strmsnmgrs | msnxmsgrsc.exe | Added by the SDBOT.JDR WORM! |
| X | strmsnmsgr | msnmsgrs.exe | Added by the RBOT-ACQ WORM! |
| X | strmsnmsgrs | msnmsgrsc.exe | Added by a variant of the RBOT WORM! |
| X | strmsnnms | msnmegrs.exe | Added by the SDBOT-YU TROJAN! |
| X | strmsnnrs | msnmcgrs.exe | Added by the RBOT-ACT TROJAN! |
| X | strmsoums | msnmegrse.exe | Added by the SDBOT-ZK TROJAN! |
| X | Strng32 | strngbox.exe | Added by the STRANO WORM! |