S24evmon

S24EvMon.exe

(Intel)

Service installed on Windows 2000/XP by the drivers for the Intel wireless adapter on laptops where both the onboard network card and wireless adapter are both Intel based.  This service acts as a software “bridge” between the drivers for the network card and those for the wireless port.

Recommendation :
Essential for the proper of your wireless port.  If you do not use your wireless port then you can set the  Startup Mode  of this service to  Manual  on the  Services  tab of  The Ultimate Troubleshooter.

Saea

Saea.exe

See   IWAR.
 

Savedump

SaveDump.exe

(Microsoft)

Microsoft  Windows NT4/2000 SaveDump  utility.  This program will appear on a reboot of your Windows NT4/2000 PC if the PC crashed or rebooted without warning.  As per Microsoft’s description :  On this next reboot  “SAVEDUMP  transfers the Windows crash dump from the paging file to the Memory.dmp file during the system startup. Other programs and services that are started during this process may perform poorly.  If the server is providing services to users, those services may not provide timely responses to client requests.”.   Once  SAVEDUMP  has performed this operation, it normally terminates automatically.

Recommendation :
Unless you have a support contract with Microsoft, the information saved into a dump file by SAVEDUMP will be useless to you as only Microsoft can decipher this information.  Additionally, SAVEDUMP can sometimes significantly hinder the proper booting up of a PC, specifically if that PC is a server, with some services refusing to start.  Lastly, SAVEDUMP will itself sometimes refuse to terminate automatically, thus causing significant performance degradation to the PC while it continues to run.  For all these reasons our recommendation is to disable the  “Save Dump”  feature of Windows 2000 in the following manner :
1)   Click on  “Start \ Run”.
2)   Type   DRWTSN32.
3)   Uncheck all options on the screen that comes up.
4)   Click  OK.
5)   Reboot your PC.

Savscan

SAVScan.exe

(Symantec)

Auto-Protect service for Norton AntiVirus 2004/5 under Windows 2000/XP/2003.  This service scans files for viruses in the background as and when they are accessed or created.

Recommendation : 
Absolutely essential for the protection of your PC against viruses – Leave alone.  Note, however, that the early versions of this background service (October to December 2003) were occasional prone to using excessive amounts of CPU, so ensure that you sometimes do a manual  LiveUpdate  from within Norton AntiVirus 2004/5 in order to pick up the latest software updates (as distinct from the “virus definitions” updates which the automatic LiveUpdate picks up and installs silently in the background).

SBAMSvc

SBAMSvc.exe

(Sunbelt Software)

Sunbelt Anti-Malware Service.  Core Service of Sunbelt Software’s  VIPRE Antivirus + AntiSpyware  security product introduced in 2008.  This service implements the real-time protection of your PC against virustes, spyware, rootkits, and other malware.

Recommendation :
This is the core program of your Sunbelt Software VIPRE Antivirus + AntiSpyware – Leave it alone therefore.  This program normally uses between 22Mb and 46Mb of memory.

Sbhc

SBHC.exe

(Gigatech Software)

SuperBar Internet Explorer Plugin which purports to enhance your web browser (movie listings, password helper, form filler, search engine enhancement & phrase finder).  Note :  this is a different product from the SuperBar Toolbar management and configuration shareware utility of the same name.  Most users who have SuperBar, the IE Plugin, never willingly installed it, it got installed with other software, typically MP3 software.

Recommendation :
At the time of writing, March 2004, we have only seen this program on a handful of PCs, but every time we have come across it we were able to measure performance degradation directly linked to this program.  Although there is now an uninstall program on the Gigatech site, we ourselves uninstalled it by simply deleting the entry on the  Startups  tab of  The Ultimate Troubleshooter, and then deleting the folder  “C:\Program Files\Superbar”.

SCAN32

SCAN32.EXE

(McAfee)

You have the   McAfee On-Demand Antivirus Scanner   currently running, either because you manually started it through the McAfee Control Center, or because it is currently in the middle of a scheduled virus scan of your PC.

Note :   When running, the on-demand virus scan program uses between 30Mb to 83Mb of memory, so if you are experiencing sluggishness while using your PC it may be because there is a virus scan running in the background.

ScardSvr

SCardDrv

Smart Card

Smart Card
Helper

ScardSvr.exe

(Microsoft)

Microsoft’s Smart Card & Smart Card Helper service, also called  Smart Card Resource Management Server.  This service has a dual function :  on the one hand it enables support for old non Plug & Play smart card readers, and on the other hand it also provides support for Plug & Play smart card readers.  Our Thanks to Microsoft for thoroughly confusing descriptions !!  In short :  if you have a Smart Card reader, you should have this service running whatever the age of your reader.

Recommendation :
Essential if you have a Smart Card reader, otherwise disable it by setting it to  Manual  in  “Control Panel \ Administrative Tools \ Services”.

Scardsvr32

Navpw32

Smart Card Helper

ScardSvr32.exe

Navpw32.exe

(???)

You have the   W32.Femot.Worm / W32/MoFei.worm / WORM_MOFEI.A or B   virus.

SCKTSRVR

SCKTSRVR.EXE

(Borland)

Borland Socket Server.  Program usually run as a service and which enables programs running on client computers to communicate with a server program on the network fileserver.  Both the client programs and the server program will typically be written in Borland Delphi  (Note: sometimes both the client and server programs will be running on the same computer or server).

Recommendation :
If this program is running on your PC or server it is almost always because it was installed by software that needs it.  Thus, unless you know the full details as to why this program is running on your PC/server, leave it alone.

Scm

SCM.exe

(Microsoft)

Service Control Manager utility for Microsoft’s SQL Desktop Engine (MSDE) and which allows the user to start and stop SQL Server or the MSDE services from the command prompt or a batch file.

Recommendation :
If it appears in your Task or Services list, it is most probably by design.  Our recommendation, therefore, is to leave it alone.

Scnpanel

ScnPanel.exe

(Artec)

Artec System Tray Scan Panel application which is installed with the drivers for some of their scanners, typically the e+ 48U series.  This System Tray icon enables you to scan directly from the System Tray into a specific application, to email, or to OCR.  You can also do Direct (photo)copies from it, which effectively is scanning directly to the printer.  You can also configure the scanner and the various scanning functions through this icon.

Recommendation :  
Down to end-user preference, although we strongly recommend you never use the  Scan‑to‑email  function; it is buggy and in our experience freezes the PC in most cases !   Read on :  we have also come across many instances where  SCNPANEL  will make the entire PC freeze either when doing any type of printing, or when printing to a printer which has run out of paper.  For all these reasons we ourselves always disable this task on the  Startups  tab of  The Ultimate Troubleshooter  as it is too buggy for comfort.

Scrub2k

Scrub98

Scrub9x

Scrub2k.exe

Scrub98.exe

Scrub9x.exe

(Hewlett-Packard)

“Scrubber” application included with the drivers for some HP DeskJet printers and which gets rid of specific driver files and registry entries for the HP printer that it came with, in case should you have problems installing or de-installing the printer.   This utility is normally intended to be run manually, however sometimes the installation software for a particular DeskJet will use it as a pre-installation cleanup task, and will then in error leave it to auto‑start every time you start your PC.

Recommendation :  
This task should not be in your Task List after a fresh start/restart of your PC.   If it is, delete it in  The Ultimate Troubleshooter  and reboot your PC.

Scsiaccess

SCSIAccess.exe

(Photodex Corporation)

ASPI driver used by Photodex’s  CompuPic  &  ProShow  digital imaging and presentation products.  In earlier versions of the above products, SCSIACCESS was an ever present background program or service installed to enable CompuPic and ProShow to create CDs and DVDs using your CD or DVD Writer.  In 2005 this driver is only used on PCs where the underlying Windows driver is not recent enough.

Recommendation : 
When present this task is essential to the proper functioning of your CompuPic or ProShow software, so leave it alone.

SCTSvc

SCTSvc.exe

(Microsoft)

Windows Steady State Service.  Service installed by the Microsoft   Steady State  add-on software.  Microsoft’s  Steady State  enables the administrator of a family computer that is used by a number of different family members and visitors, to lock down the state of the computer without much technical knowledge.  This ensures that uses of the computer will not be able to damage or completely mess up the configuration and look (desktop) of your computer regardless of what they do or of where they go that they shouldn’t !  This service is the core background program which implements your  Steady State  security.

Recommendation :
Down to end-user preference.  In our experience Microsoft’s  Steady State  has such a performance hit on the PCs that it is installed on, it is our view that it is much preferable for the Administrator of the PC to learn how to create  Power Users  (as distinct from Administrator users)  or else ensure that that there is at least 2Gb of memory installed in the PC (preferably 4Gb) if you want to persevere with Steady State.  Your choice.  This background service normally uses 4Mb to 9Mb of memory.

Note :  the only way to disable  Steady State  is to uninstall it.

Scureapp.exe

Scureapp.exe

(Softex Inc)

Background task which is part of the   OmniPass   software found on laptops for authentication into your laptop using fingerprints, smartcards, or other biometric method.

Recommendation :
Down to end-user requirements.  Read about the  Softex OmniPass Service (OMNISERV.EXE)  on the  Tasks  or  Services  tab of  The Ultimate Troubleshooter  to decide whether you want to have this startup enabled or not on the  Startups  tab of TUT.

Scvhost

Windows Service Host

SCVHOST.exe

(???)

You have the  Backdoor.Sdbot.N  virus, or one of the  Gaobot  viruses, or one of the many other viruses which drop  SCVHOST.EXE  (not to be confused with SVCHOST  further down this page).

SDMainService

SDMainService.exe

(Max Secure Software)

Core background service of the   Max Secure Spyware Detector  anti-spyware program whose role is to scan for malware and remove it.

Recommendation :
Essential for the proper protection of your PC with Spyware Detector – Leave alone therefore if you want real-time protection against anti-spyware.  This background service normally uses anything from 9Mb to 39Mb of memory.  However, note that on the occasional PC this service runs amok and can use as much as 120Mb of memory or more.  If this happens on your PC, try first manually updating  Spyware Detector  software ensuring you also update the program (and not just the spyware definitions).  If the problem remains, then inform Max Secure of the problem.

Sear1

Sear1.exe
 

See   WINSERVN.

seccenter

seccenter.exe

(BitDefender S.R.L)

You have the   BitDefender Security Center   currently open.

(Note :   this process can often remain running in the background and showing on the  Tasks  tab of TUT long after you closed the Security Center – when that is the case you can terminate it to release memory).

Services  (1)

Services.exe

(Microsoft)

Windows 2000/XP/2003/Vista.  This is the Services Control Manager which is responsible for starting, stopping, and interacting with system services.  It’s full path as shown in  The Ultimate Troubleshooter  is either   C:\WINNT\System32\Services.exe  in Windows NT4/2000, or  C:\Windows\System32\Services.exe  in Windows XP/2003/Vista.  Double-click on this task to check it’s path.

Recommendation :
An integral part of the operating system, leave alone.

Services  (2)

Services.exe

(???)

If, regardless of which version of Windows you have, this task appears on the  The Ultimate Troubleshooter,  then you most definitely have a virus such as the   W32.Ahker.B@mm   virus.

If you have Windows NT4/2000/XP/2003  and  the full path to this program on the  Tasks  tab of  The Ultimate Troubleshooter  is  C:\WinNT\Services.exe 
or
C:\Windows\Services.exe 
or
C:\Windows\inetg\Services.exe 
or
C:\WinNT\inetg\Services.exe 
or
C:\Program Files\Common Files\Services.exe 
or
C:\Documents and Settings\
<anything_here>\Services.exe,

then you also most probably have a virus such as the   W32.Netsky@mm  or  W32.Neveg.B@mm  or  W32.Conycspa@mm   virus.

If you have Windows 95/98/ME  and  this task is running in the background, then you most probably have one of those viruses too.

Servicese

(???)

Sessmgr

RDSessMgr

SessMgr.exe

(Microsoft)

Remote Desktop Help Session Manager.  This service manages and controls  Remote Assistance,  a  “named‑for‑lay‑persons”  subset of Microsoft’s Remote Desktop Sharing technology.  Introduced in Windows XP and also present in Windows 2003 server, but not present, by design, in Windows XP 64-bit.  As per Microsoft :  “Remote Assistance is a technology in Windows XP which enables Windows XP users to help each other over an internal network or over the Internet.  With this tool, one user, called the "Expert," can view the desktop of another user, the "Novice.".   With the Novice's permission, the Expert can even share control of the Novice's computer to resolve issues remotely.  With Remote Assistance, a Help Desk can assist users on the network, which is known as the Offer Remote Assistance feature.”.

Recommendation :
We do not see this feature ever taking off.  The mechanics for an end-user to invite assistance from an Expert are too long-winded and involve too many steps and programs.  In this day and age of speed, speed, and speed, it is faster to drop a quick email, or pick up the phone, to the Help Desk, so we really do not see Microsoft’s Remote Assistance feature getting anywhere fast !   Irrespective of our views, unless Remote Assistance has been set up on your PC by your network manager, or you set it up, then it is 99% certain that you do not need to have this service running.  To disable this service go into  “Control Panel \ Administrative Tools \ Services”,  look for the  Remote Desktop Help Session Manager  service and set it to  Disabled.

SetPoint

SetPoint32

SetPoint.exe

SetPoint32.exe

(Logitech)

Logitech SetPoint Control Center.  System Tray Mouse and Keyboard configuration software which comes with Logitech mice and keyboard (particularly their wireless range) and which enables the user to configure his mouse and keyboard in a non Windows‑standard way with added features such as the ability to have special mouse actions perform specific tasks, or the ability to set up one‑touch keyboard function keys to again perform specific actions such as opening your email program, or starting your Internet browser, or opening your Wordprocessor, etc...

Recommendation :
Down to end-user preference – if you use some of the special features of your Logitech mouse or keyboard, then you need to have this task running.  If, on the other hand, your mouse is  not  wireless and you simply do not use any of the special features of your mouse or keyboard, then you do not need this software – your Logitech mouse and keyboard will work very well without it;  you can therefore disable this task on the  Startups  tab of  The Ultimate Troubleshooter  (or uninstall the Logitech SetPoint software from the  Add/Remove Programs  icon in the Control Panel if you are totally confident you definitely do not use the Logitech SetPoint software).

SetpointII

SetpointII.exe

(Logitech)

Logitech SetPoint Control Center.  System Tray Mouse and Keyboard configuration software which comes with Logitech mice and keyboard (particularly their wireless range) and which enables the user to configure his mouse and keyboard in a non Windows‑standard way with added features such as the ability to have special mouse actions perform specific tasks, or the ability to set up one‑touch keyboard function keys to again perform specific actions such as opening your email program, or starting your Internet browser, or opening your Wordprocessor, etc...

Recommendation :
Down to end-user preference – if you use some of the special features of your Logitech mouse or keyboard, then you need to have this task running.  If, on the other hand, your mouse is  not  wireless and you also do not use any of the special features of your mouse or keyboard, then you do not need this software – your Logitech mouse and keyboard will work very well without it;  you can therefore disable this task on the  Startups  tab of  The Ultimate Troubleshooter  (or uninstall the Logitech SetPoint software from the  Add/Remove Programs  icon in the Control Panel if you are totally confident you definitely do not use the Logitech SetPoint software).

This program normally uses anything from 3Mb to 15Mb of memory.

Sgtbox

SGTBox.exe

(Canon)

Canon’s ScanGear Toolbox System Tray application which comes with Canon scanners.

Recommendation : 
If you no longer have a Canon scanner, de-install via the "Add/Remove Program" icon in the Control Panel.

Shellmon

ShellMon.exe

(AOL)

Task which gets installed with AOL 8.0, AOL 8.1, and AOL 9.x.  At the time of writing, March 2005, we still do not yet know what this task does, and the response from some AOL techs is hilarious :  some of them do not even realise that this program is an AOL program and so they direct you to Microsoft for answers !!!  Stunning.

Recommendation :  
As we are not sure about what it does, we can only recommend you leave this task alone.

Sibc

Sibc.exe
 

See   IWAR.

Sideact

SideACT.exe

(Best Software)

SideACT! is an add-on to the well known ACT! contact manager software.  It enables you to create To-Do lists which are not tied to a contact.  By default the only way to be able to create a To-Do list, or a task, in ACT!, is to attach it to a contact in the ACT! database, which is a problem when you want to use ACT! for a to‑do task that is not contact related, such as :  Talk to the Bank Manager about a loan.  This sort of non-contact related to-do task is exactly what SideACT! was created for and allows you to have.  From ACT! 4.0 and later, SideACT! is installed at the same time as ACT! as a System Tray icon which you click on whenever you want to access your non-contact related To-Do lists.

Recommendation :  
Keep it.  Even if you disable it with  The Ultimate Troubleshooter,  ACT! re-instates it as a startup task when you next open ACT!.

Sisswled

SiSSwLED.exe

(Silicon Integrated Systems – SiS)

System Tray utility for the SiS 900 network cards (these are usually onboard network cards).  This program displays a network usage LED in your System Tray.  This LED lights up whenever network traffic takes place, much in the same way as Windows 2000 and Windows XP provide by default.

Recommendation : 
Network traffic LEDs are quite useful, particularly when troubleshooting problems. Unless you experience problems with this program, leave it running.  If you are using Windows 2000/XP/2003, however, then disable this utility and use the native Windows network traffic LED instead.

SkypePM

SkypePM.exe

(Skype Technologies)

Skype Plugin Manager.  One of the new features introduced in Skype in February/March 2007, is the Extras Gallery.  Extras are third-party plug-ins that let users expand Skype’s functionality (You can see what extras are available at extras.skype.com).  At the time of writing, 31-May-2007, the Gallery is protected against unauthorized copying or unlicensed use by a plug-in manager software framework, this program, which was developed by a company called EasyBits Software.

Recommendation :
Down to end-user requirements.

If you have purchased some Skype Extras, then you will need to leave this program running.

If you have  NOT  purchased Skype Extras, on the other hand, then you should uninstall this program as, at the time of writing, 31-May-2007, it is responsible for a number of problems, including the inability for the PC to hibernate or go into sleep mode, crashes on some PCs, or inability to shut Windows down at the first attempt – you have to tell Windows to shut down twice (double shutdown).  To disable the Skype Plugin Manager, do as follows :

1)   Uninstall Skype.

2)   Re-install Skype.  On the initial first window you should see in the bottom left an  OPTIONS  button.

3)   Click that  OPTIONS  button and uncheck   Install Skype Extras Manager.

4)   Continue with the installation.

5)   That’s it.  You’re done !

SlowDownCPU

SlowDownCPU.exe

(MSI Computer Corporation)

SlowDownCPU utility.  Disastrous motherboard utility found on PCs built with specific MSI motherboards.  This utility is supposed to increase the compatibility of those motherboards with Windows XP SP2.  Well, all it does is generate startup delays,  “Failure to load hardware monitor driver”  errors, random computer crashes or seizures, random shutdowns, and random reboots.  This is a terrible utility !

Recommendation :
Immediately disable this utility, SlowDownCPU, on the  Startups  tab of  The Ultimate Troubleshooter  and reboot.  After a week, if disabling this utility has not caused problems, delete it from the  Startups  tab.

Sm1bg

SM1BG.exe

(Cypress Semiconductor)

Background task installed by the drivers for USB based hard disks or other such storage devices (MP3 players, etc...).  Cypress Semiconductor is the OEM manufacturer who will have made the interface and written the driver for your USB storage device;  this will in turn have been packaged into the product that you bought (an OEM manufacturer is a manufacturer who builds products for other manufacturers to sell under their own badge – it is unlikely, therefore, that your USB storage device will bear the Cypress name).

Recommendation :
Essential for the proper operation of your USB storage device.

Sm56hlpr

SM56Hlpr.exe

(Motorola)

Tray icon which gets installed with the drivers for the Motorola SM56 range of modems.  As with most modem tray icon software, this is of little use and simply clutters the System Tray.

Recommendation : 
Disable using  The Ultimate Troubleshooter.

Smagent

SMAgent.exe

(Analog Devices Inc. – ADI)

SoundMAX System Tray icon which gets installed with the drivers for soundcards or onboard sound based on Analog Devices’ chipsets.   It gives you access to the SoundMAX v4 software suite from the System Tray.

Recommendation :  
Down to end-user preference.   You can disable it with  The Ultimate Troubleshooter.

SmartCenter97

SmartCtr.exe

(Lotus – IBM)

Lotus SmartSuite 97 Toolbar.  As with the Microsoft Office Toolbar, this toolbar initially sits at the top of your screen and gives you access, from that toolbar, to all the programs in the SmartSuite office suite.  Again, as with the Microsoft Office Toolbar, you can customize it to include non-Lotus programs.

Recommendation : 
This is a matter of pure end-user preference.  If you need to you can disable it with  The Ultimate Troubleshooter.

Smath

Smath.exe

(Sun Corporation)

You have the   Open Office MATH   math notation writing program currently open.

Smlogsvc

SysmonLog

SMLogSvc.exe

(Microsoft)

Performance Logs and Alerts service – Windows 2000/XP/2003.  This background service collects performance data from local or remote computers based on scheduled jobs and either writes that data to specific log files, or it triggers an alert, or it does both.  Typically this service is started by performance jobs scheduled in  Administrative Tools \ Performance, or in other Microsoft applications such as the Performance Monitor of Microsoft ISA server or of Microsoft Exchange Server.  If the service is running and is then stopped by the end-user, currently running data collections will terminate and no future scheduled collections will take place. If started, this service will stop automatically when there is no longer any performance data to collect.

Recommendation :
This service will typically be set to  Manual  and should be left as such.  As and when a job is scheduled in the Performance Monitoring section of a particular Microsoft application, that application will start this service as soon as it needs to and the service will later stop automatically when there are no performance monitoring applications that need its services.

Smreminder

Smreminder.exe

(Shockwave.com)

Another registration reminder application, this time from Shockwave’s Shockmachine software.  This background registration reminder program gets installed when you install Shockmachine.

Recommendation : 
Delete using  The Ultimate Troubleshooter.

Sms

KernelFaultChk

Sms.exe

(???)

You have the   W32.HLLW.Deadhat / Vesser   virus.

Smss  (1)

Smss.exe

(Microsoft)

Windows 2000/XP/2003/Vista.  SMSS is the Session Manager SubSystem.  SMSS’s purpose is to start, manage, and delete user sessions (or client sessions under Terminal Services).  Under Terminal Services the management part includes dealing with the different subsystems (OS/2, Win32, POSIX) which a client session may wish to run.   The full path to the genuine Microsoft  SMSS  shows in  The Ultimate Troubleshooter  as :   C:\Windows\System32\smss.exe.  If the path is different then you have a virus.  Double-click on this task to check it’s path.

Recommendation :   An integral part of the operating system, leave alone.

Smss  (2)

Services.dll

Smss.exe

(???)

If you have Windows 95/98/ME, then you have a virus.  If you have Windows 2000/XP/2003/Vista and the path to this task shows in  The Ultimate Troubleshooter  as anything other than   C:\Windows\System32\smss.exe, then you have a virus, such as the   W32.Sober.L@mm   virus.  Scan your PC with a good and reputable antivirus program to pick it up.  Double-click on this task to check it’s path.

Smssnt

Smssnt.exe

(???)

You have the  W32.HLLW.Gaobot.EE  virus.

SMSvcHost

NetTcpPortSharing

SMSvcHost.exe

(Microsoft)

.Net TCP/IP Port Sharing Service.  Because of the advanced technical nature of this service, we will just once have a description aimed at the technical user rather than the layman.

When the TCP/IP protocol was first introduced, there were only a handful of applications for it.  From the start TCP/IP used port numbers to differentiate between applications by assigning a unique 16-bit port number to each of these types of application (application protocols). For example, HTTP traffic is standardized to use TCP port 80, FTP uses TCP port 21, SMTP uses port 25, DNS uses port 53, DHCP port 67, and so on. Other applications using TCP as a transport can choose available port numbers, whether standardized or de-facto port numbers, or their own defined port numbers.

The problem, however, is that any application which uses non-standard port numbers, finds itself vulnerable to end-user installation problems as most corporate and personal firewalls block all ports except for the well known ports, and many only allow the HTTP port, port 80, by default.  For the application to then work, the publisher finds itself having to provide detailed installation notes guiding the prospective user through configuring his/her firewall for the application’s own specific ports.

This is why many applications which can work through the HTTP protocol, make use of port 80 which is normally left open by most firewalls.  This in turn is only possible because Windows has for a long time had the ability for multiple HTTP applications on the same physical PC to share HTTP ports.

This particular service, the  .Net TCP Port Sharing Service, implements TCP/IP Port sharing in the manner described above but specifically for .NET applications using the .NET TCP protocol.

Recommendation :
Leave alone unless instructed otherwise.  By default this service is installed with a  Startup Mode  set to  Disabled.  This means this service will never start automatically at Windows boot‑up unless you change its  Startup Mode.  If you find yourself one day installing a program which needs this service, then the program’s installation instructions will guide you specifically through starting this service and configuring it.

Sndsrvc

SNDSrvc.exe

(Symantec)

Symantec Network Driver Service which is part of the 2004/2005 version of Norton Personal Firewall and Norton Internet Security.  According to Symantec this service is only used when you have enabled the scanning of incoming POP3 emails, whether for viruses, threats, or spam.

Recommendation :  
This service will be essential for most home users as they will all most probably have the scanning of incoming emails enabled.  For corporate users, however, there are particular instances when this service could be disabled – liaise with your Network Administrator for more details.  Make sure you occasionally perform  manual  LiveUpdates  on your Norton products as there were stability problems with this service in the first half of 2004.

Snmp

SNMP.exe

(Microsoft)

SNMP Service (Simple Network Management Protocol).  This service/task listens for SNMP requests, obtains the required information and data, and passes it on to the requester.  Additionally the SNMP service can be configured to generate trap messages when specific events occur :  eg. generating an alert trap if a request for information is received from an unrecognized requester.  When configured to generate trap messages, the trap messages are sent to a specific device or computer on the network which runs SNMP management software.

Recommendation :
In general this task/service is of little use on a standalone PC or on a home network where we suggest you disable it with  The Ultimate Troubleshooter  in Windows 95/98/ME, or set this service to Disabled or Manual in Windows NT4 (Control Panel \ Services) and Windows 2000/XP/2003 (Control Panel \ Administrative Tools \ Services).  If a particular software package requires SNMP, and tells you so, simply re-activate the task/service.  If you are on a network, contact your Network Administrator before changing the startup mode of this task/service.

Snmptrap

SNMPTrap.exe

(Microsoft)

This Windows NT4/2000/XP/2003 service listens for SNMP trap messages generated either on this PC or remote PCs, and forwards them to SNMP Management software running on this computer.

Recommendation :
As with the SNMP service, this service is in general of little use on a standalone PC or on a home network where we suggest you set this service to Disabled or Manual in  “Control Panel \ Services”  in Windows NT4, and in  “Control Panel \ Administrative Tools \ Services”  in Windows 2000/XP/2003.  However, if you have and need the SNMP service running, then you only need this service running if you have configured SNMP traps.  If you are an end-user running on a network, consult your Network Administrator before changing the startup mode of this service.  If you do need to use SNMPTRAP, make absolutely sure you have at least Service Pack 4 installed if you use Windows 2000, or Service Pack 1 if you use Windows XP.  In closing, if in doubt, set this service’s startup mode to  Automatic  if you know that you also need the SNMP service running because some application has issued a message to that effect.

snmvtsvc

snmvtsvc.exe

(???)

Sound Movie Server.  At the time of writing, 24‑Jan‑2010, we have not been able to work out where this background service comes from.  Its rarity in our logs (only a dozen users have reported it amongst our hundreds of thousands of users), and the pattern of reporting, suggests that it may have been part of spyware at some point in 2008, spyware which got detected quickly by most antivirus and anti-spyware companies and where the main threat was removed but where this service was left behind.

Recommendation :
As we are not totally certain about this task, the best way to handle it is to disable it (by changing its  Startup Mode  to  Disabled  on the  Services  tab of  The Ultimate Troubleshooter) and then monitor the behaviour of your PC over the next month or so to see if you are missing anything, particularly when dealing with sound and movie and video programs.  If you have any music streamer, check that too.

If disabling this task causes a problem simply change its  Startup Mode  back to the default of  Manual.

Sodd

Sodd.exe
 

See   IWAR.

SoftwareUpdate

SoftwareUpdate.exe

(Apple)

Apple Software Update.  Software Update task which started appearing on PCs in October 2006 and which gets installed in most cases when a user updates  iTunes  and/or  QuickTime.  This program is scheduled to check once a week for updates to iTunes and QuickTime and, when updates are available, a big screen pops up asking you if you want to download and install the updates.

Recommendation :
At the time of writing, 26‑Nov‑2006, everything about this task is annoying.  First, both iTunes and QuickTime tell you, when you use them, that updates are available, so why also have this task which simply duplicates what iTunes and QuickTime already do !!??  Talk of overkill!  Secondly, once this task runs it stays running in the background even when updates are not available and, worse, we have never seen it use less than 16Mb of memory.  On some PCs its consumption of memory goes up to 25Mb or more !   Disable this task immediately as follows (and update iTunes and QuickTime as and when you wish through their  Help \ Check for Updates  menu options) :

1)  Open up the Control Panel.

2)  Open  Scheduled Tasks.

3)  Double-click on the  AppleSoftwareUpdate  scheduled task.

4)  Clear the  Enabled  check box.

5)  Click  OK.

6)  Alternatively, right-click on  AppleSoftwareUpdate  and choose  Delete.
 

Sp2ctr

Sp2ctr.exe

(???)

You have the   Troj/Dluca-M   trojan virus which is picked up primarily on adult websites.  This trojan is not only responsible for numerous popup advertisements, odd behaviour of the PC, extremely slow Internet access,  it also usually downloads further viruses with the result that, on all the PCs where we’ve seen this task, the PC ends up with numerous versions of the same virus.  Typically these other files will be any of the following :   EVTHTM,  HOT_TARTS,  IVVTOWII,  SYSDXVID,  VIRGINS.  The longer the PC is left with this virus, the worst it gets.

Recommendation :
Before you start be aware that the removal of this virus sometimes results in other problems, such as your graphics card installed drivers being corrupted (deliberately by the virus), and similarly with your network card.  So, if there is something urgent you need to do, do it before you start the following removal process :

1)   Ensure that you have a reputable antivirus program and that it has the most up-to-date antivirus definitions  (at the time of writing, 2-Apr-2005, most antivirus programs do not recognize this particular virus, but you will still need an up-to-date antivirus program to run a full virus check at the end of the removal process).

2)   Restart your PC into Safe Mode by pressing  F8  continually after turning your PC ON till you get a menu where  “Safe Mode”  is one of the options.

3)   Go to  “Add/Remove Programs”  in the Control Panel and remove any of the following if present :  SP2CTR,  EVTHTM,  HOT_TARTS,  IVVTOWII,  SYSDXVID,  VIRGINS.

4)   Next, start  The Ultimate Troubleshooter,  switch to the  Startups  tab, and see if any of the above programs are still there.  If they are, for each of them right-click on the entry and choose  Delete from the hard disk the file that this Startup points to  if that option is available.  Once you have deleted the file, right-click again on the entry and this time choose  Delete this Startup Entry.

5)   Once you’ve completed all deletions and removals, click the big green  APPLY  button for your changes to stick.

6)   Close TUT.

7)   Run a full virus scan on your PC while still in Safe Mode as this virus may have downloaded other types of viruses.

8)   Reboot your PC into Normal Mode.


9)   Download  SpyBot  from our  Downloads  library, install it, and run it to rid your PC of any other spyware/adware that may have come with this virus.
 

Spbbcsvc

SPBBCSvc.exe

(Symantec)

Service installed on Windows 2000/XP PCs by Norton AntiVirus 2005 and Norton Internet Security 2005.  We do not yet know what this service does.

Recommendation :  
As we do not know the purpose of this service we can only recommend that you leave it alone.

(Symantec)

Recommendation :
If you have a 600MHz or faster PC, with 128Mb of RAM or more, then, as with Microsoft’s TASKMON, we feel that the supposed benefits of Norton SpeedStart will be negligible if not totally unnoticeable.  If that is you, then we advise you disable Norton SpeedStart either via  The Ultimate Troubleshooter  or within Norton Utilities/SystemWorks.

Speedkey

SpeedKey.exe

(Microsoft)

Background driver task for the Microsoft Internet/Natural/Internet Pro/Office keyboards.  This task is installed by the IntelliType Pro software and implements the shortcut keys and keyboard key re-configurations which you programmed within the IntelliType software.

Recommendation :
Required task if you use the IntelliType software.  If you get illegal operations or other similar problems with SPEEDKEY, download from this Microsoft website the latest version of the IntelliType software – it is likely to resolve most problems you may have with SPEEDKEY.

Spoolsv

SpoolSV.exe

(Microsoft)

Windows 2000/XP/2003/Vista.  This is the Spooler service which manages all fax and print jobs.  Spooling is the process whereby the PC first outputs a print job to a temporary file on the hard disk, a process which completes infinitely quicker than actually printing, and then printing the job thus allowing the end-user to continue with his use of the PC while the job is printing.

Recommendation :
An integral part of the operating system, leave alone.  You will not be able to print if you terminate this background service.

Spoolvse

Start extracting

Spoolvse.exe

(???)

You have a Trojan virus which you picked up probably through the use of file sharing software like KaZaA, or through downloading and installing something from a malicious web page.  At the time of writing, 16‑Jan‑2005, this Trojan is not picked up by the majority of antivirus programs.

Recommendation :  
Get rid of this immediately :

1)   Restart your PC into Safe Mode by pressing  F8  continually after turning your PC ON till you get a menu where  “Safe Mode”  is one of the options  (if you are unable to start your PC into Safe Mode, then try the following in Normal Mode).

2)   Start  The Ultimate Troubleshooter  and go to the  Services  tab if you have Windows 2000/XP/2003, otherwise continue from point (4) below.

3)   If you find a service which starts this task, right-click on it and change the  Startup Mode  to  Disabled.

4)   Go to the  Startups  tab and for each instance of this task (there are sometimes two or three entries for this malicious task) do the following :  right-click on it and choose  Delete from the hard disk the file that this Startup points to;  next, right-click on this entry again and this time choose  Delete this Startup entry.

5)   Click the big green  APPLY  button to make your changes stick.

6)   Reboot your PC into Normal Mode.

7)   Download  Ad-Aware  or  SpyBot  from our  Downloads  library and run it to eliminate all possible adware and spyware.

8)   Make sure you have an up-to-date reputable antivirus program and run a full virus scan on your PC.
 

SpySub

SpySub.exe

(InterMute)

SpySubtract anti-spyware from InterMute (now part of Trend Micro).

Recommendation :
At the time of writing, 7‑Jul‑2005, SpySubtract has now been renamed to  Trend Micro Anti‑Spyware 3.0.  Nevertheless the issue we have with the  SpySubtract  product, at the time of writing, is that it identifies the updater portion of  The Ultimate Troubleshooter  as spyware.  Users have been reporting this to us for the last three to five months and each time we have encouraged them to notify InterMute of the problem and ask for a fix, to no avail.  We have emails from those customers indicating that their complaints to InterMute got nowhere, and the frequency of those emails increased recently.  So we decided to complain officially to both InterMute and Trend Micro, asking them to fix the problem – we got no response whatsoever, and we are still waiting for an answer.  It is on this basis, and on this basis alone, that we recommend you do  not  use SpySubtract.  It may be a good anti‑spyware product overall, but the key to any antivirus, anti‑adware, and anti‑spyware program is that its writers must acknowledge that they will sometimes incorrectly identify software as spyware, and when that happens they must be responsive to customers or software writers’ complaints in addressing the incorrect detection of spyware (also called “false positive”).  This is the strength of companies like Symantec and McAfee where false positive problems like this get fixed before most users have even come across it !   We here are in the same boat, in fact.  If an anti‑spyware software writer does not show this commitment to putting things right quickly, then how can you trust that that program is not causing you problems without you realizing so.  For example :  for months we have been receiving complaints from users indicating that they could not update TUT and that it was causing them a certain amount of inconvenience if not distress sometimes (when a user needed the very latest version to properly address a particular problem) – on trying to update the end‑user would get an error message to the effect that the updater program was not on the hard disk.  We just could not work it out till one day a user advised us that he had worked out what that what was happening was that SpySubtract had deleted our updater program.  If this can happen with TUT, it can happen with any other program which may be an absolutely crucial and vital program to you;  a user other than you may complain to InterMute/Trend Micro about it, but, as our experience shows, it may be months, or never, before you get a fix or acknowledgement.  In our view this is totally unacceptable of an Anti‑spyware company.

We suggest you uninstall SpySubtract and use instead the free and excellent  SPYBOT  which you can download from our  Downloads  library.
 

Sqlservr

SQLServr.exe

(Microsoft)

If you are running on Windows NT4/2000/2003 Server, then this is the  Microsoft SQL Server  service.  If, however, you are running on Windows 95/98/ME/2000Pro/XP, then this the  Microsoft Personal SQL  or  Microsoft SQL Desktop Engine (MSDE)  task running in the background and which enables you to run SQL based applications on a workstation.

Recommendation :
If this is a server operating system, and you do not use Microsoft SQL Server and you do not use Microsoft Exchange either, then set this service to  Disabled  on the  Services  tab of  The Ultimate Troubleshooter.  If this is a workstation, then you can disable or enable this background task on the  Startups  tab of The Ultimate Troubleshooter as and when required.

Ssae

Ssae.exe

See   IWAR.
 

Ssdpsrv

SSDPSRV.exe

(Microsoft)

Part of Windows Millennium Edition.  This program only gets installed if you choose to install the "Universal Plug and Play" sub-component of the Communications component in "Add/Remove Programs \ Windows Setup".  SSDPSRV provides Simple Service Discovery Protocol (SSDP) and General Event Notification Architecture (GENA) services for the Universal Plug and Play functionality and is a component designed for the future generation of Plug and Play devices.

Recommendation : 
If you are using standard Plug and Play devices, you do not need this program.  You can de-install it by un-selecting "Universal Plug and Play" in "Add/Remove Programs \ Windows Setup tab \ Communications".

Ssrc

Ssrc.exe

(Symantec)

Symantec Remote Assist background service.  Service installed by Symantec products such as the Norton Internet Security suite, Norton AntiVirus, Norton 360, etc..   If you call Symantec for support assistance with one of their products, and the Symantec technician is unable to solve the problem by talking you through some solutions, he/she may ask you if you will allow them to connect directly to your PC.  If you decide to allow the Symantec technician to connect to your PC, he/she will ask you to start the Remote Assist Tool which will allow them to connect to your PC.  When you do that this service will also start and will enable the Symantec technician to remotely control your PC.

Recommendation :
Leave alone.  The default  Startup Mode  of this service is set to   Manual  which means that it will not automatically start at every Windows boot-up – it will only start when you start the  Remote Assist  tool to allow a Symantec Support Technician to remotely control your PC, and it will stop as soon as the remote assistance connection is terminated.

StateMgr

StateMgr.exe

(Microsoft)

Microsoft’s PC State Manager Stub.  STATEMGR, present only in Windows Millennium Edition (Windows ME), is not a Task List item, it is purely a startup item which does its job at Windows boot‑up of starting  STMGR, the memory resident part of the PC State Manager, and then terminates while Windows continues booting up.  STATEMGR is part of the Windows ME’s System Restore feature and checks on boot-up how much time has elapsed since the last automatic or manual Restore Point and, if necessary, creates a new Restore Point.  Once Windows has started, its alter ego STMGR then checks whether vital Windows system files were overwritten by older files by a recent installation of 3rd party software, and restores them to their previous level when necessary.

Recommendation :  
Essential to the proper and safe running of your Windows ME PC – leave alone.

Statusclient

StatusClient.exe

(Hewlett-Packard)

Hewlett-Packard Status Client background task/service installed by the drivers for HP LaserJet 1000 series of printers.

Recommendation :
We do not yet know what the role of this task is, so can only recommend that you leave it alone.

STImgBrowser

STImgBrowser.exe

(STOIK Imaging)

You have the   Samsung DigiMax Viewer   currently open, or minimized to the System Tray  (or set as a startup item).  The  Samsung DigiMax Viewer  is a rebranded version of the excellent STOIK Image Browser.  It is a picture browser/viewer bundled with Samsung digital cameras.  Digimax Viewer allows the user to download pictures from the Samsung camera, to browse them through a thumbnail/slide viewer, and to inspect each image by double-clicking it, which presents it into another window.  You can view an image’s shooting data and you can save the image into a different format than the default JPEG format.  You can also view your images in a slide show.  When the DigiMax Viewer is running in the background in the System Tray you can double-click it to open it.  Additionally, if you connect your Samsung Camera it will automatically open up from the System Tray.

Stmgr

STMgr.exe

(Microsoft)

Microsoft’s PC State Manager.  While STATEMGR is a startup item only, this task, STMGR, is the memory resident part of the PC State Manager.  Both STATEMGR and STMGR are part of the Windows ME’s System Restore feature.  STATEMGR checks on boot-up how much time has elapsed since the last automatic or manual Restore Point and, if necessary, creates a new Restore Point.  Once Windows has started, STMGR takes over and checks whether vital Windows system files were overwritten by older files by a recent installation of 3rd party software, and restores them to their previous level when necessary.  Later during the same session, if the PC has been running for a number of days, or if a program being installed requests a Restore Point to be created prior to the installation, then STMGR is invoked and creates a Restore Point.  Finally, STMGR also monitors various other aspects of your system as you are running it.

Recommendation :  
Essential to the proper and safe running of your Windows ME PC – leave alone.

STRAY

STRAY.EXE

(Royal Mail or Deutsche Post)

System Tray icon for Royal Mail’s SmartStamp (UK) or Deutsche Post’s Stampit (Germany) stamp printing software.  Whether it is SmartStamp or Stampit, it is essentially the same software tailored for either the Postal service of the UK (Royal Mail) or the Postal service of Germany (Deutsche Post).  SmartStamp / Stampit allows the user to pre-purchase postage online with a credit card and then print postal stamps directly from a PC or network, thus saving the trip to the Post Office to buy postage stamps.  This program is the icon that sits in the System Tray to enable the user to open the software directly from the System Tray.

Recommendation :
Down to end-user preference.  If you have the SmartStamp / Stampit program icon on your Quick Launch toolbar or on your Start Menu, then you do not need this icon in your System Tray, particularly since it does not make the SmartStamp / Stampit program open any quicker.  You can disable this icon on the  Startups  tab of  The Ultimate Troubleshooter.  This program normally uses between 4Mb to 8Mb of memory.

Stutfix

(CPQ StutFix)

StutFix.exe

(Compaq)

This is a system patch from Compaq for some of their PCs and laptops.  It runs at start-up and fixes sound stutter on those Compaq PCs that experience the problem.

Recommendation : 
If you have it running, it is required, so leave it alone.

Suitest

SuiteSt.exe

(Lotus – IBM)

Lotus SuiteStart 97.  System Tray icons which enable you to start all programs in the Lotus SmartSuite office suite, from the System Tray.

Recommendation : 
A matter of pure user preference.  You can disable it with  The Ultimate Troubleshooter.

SunServer

SunServer.exe

(Sunbelt Software)

This is Sunbelt Software’s   CounterSpy System Tray icon.  Right-clicking on the icon gives you a menu where you can open the main CounterSpy program, run a spyware/adware scan, or disable/enable  Active Protection  (real‑time protection against spyware and adware).  In version 1.5 onward this yellow icon turns red if you disable  Active Protection.  This process is also responsible for downloading updates if you have configured CounterSpy to download updates automatically, and, finally, it is this icon which displays threat alerts, etc....

Recommendation : 
First :  this process is absolutely essential to the proper protection of your PC with CounterSpy, so if your PC is of a good enough specifications (read on), you should leave this process running.  Onto the issues we have with CounterSpy :  at the time of writing, 30‑Oct‑2005, using version 1.5, we found three main problems with CounterSpy during extensive testing :

1)  The first issue is that the CounterSpy processes took a total of  57Mb to 68Mb  between themselves on our test Windows 2000 and Windows XP PCs  (as shown on the  Tasks  tab of our Ultimate Troubleshooter) !!!  Every single time.  This is absolutely staggering for what is only anti‑spyware/adware software – 25% of your memory space on a 256Mb PC !   Even if there weren’t other issues, this program is, in our opinion, not for PCs with only 256Mb of RAM, and not for PCs below 2GHz.

2)   The above problem is made worse by the fact that you cannot prevent some of the background processes from running – if this icon is running then the other two background processes,  SUNPROTECTIONSERVER  and  SUNTHREATENGINE  also run even if you have disabled all  real‑time protection  from within CounterSpy.  This is crazy – you can turn off features but that still does not terminate the memory hungry programs which implement those features !

3)   Unfortunately it gets worse, and the following is the part that specifically annoyed us :  having noted how much memory CounterSpy was using, and the fact that disabling  Active Protection  and all other real‑time settings had no effect on getting rid of the two unwanted CounterSpy processes, we decided to disable this process on the  Startups  tab of  The Ultimate Troubleshooter  because there is no option within CounterSpy to enable or disable automatic startup with Windows – we simply wanted to use CounterSpy as a spyware & adware scanner to run when we wanted to, not automatically.  We rebooted :  no SUNSERVER icon in the System Tray and no CounterSpy SUNSERVER background process.  Aim achieved.  Or so we thought.  We then checked the  Tasks  tab of TUT only to find that  SUNPROTECTIONSERVER  and  SUNTHREATENGINE  were still loaded and using 50Mb of RAM !!   This is because Sunbelt Software loads them, against all de‑facto conventions of “trusted behaviour”, through the Windows Registry Key  HKLM \ Microsoft \ Windows \ CurrentVersion \ SharedDLLs.  We were aghast – no average Windows user would be able to work this out, whether they used TUT, MSConfig, or otherwise !   But it got worse :  we then opened the main CounterSpy program, did a scan to see if it would pick up the spyware we had deliberately installed, we rebooted, and then found that the mere process of opening the main CounterSpy program, re‑inserts the System Tray icon, SUNSERVER, as a startup on the  Startups  tab of TUT.  Software behaviour where you can’t turn off the software unless you uninstall it, where the software re‑installs itself as a startup every time you use it, and where the software uses non-conventional automatic startup methods hidden from most Windows and 3^rd party startup configuration programs, is the typical behaviour of some of the worst spyware and adware programs, and, at the time of writing, CounterSpy behaves just the same !

Conclusion :  CounterSpy looks great initially.  Aside from one or two clunky items, the interface is nice, both in the CounterSpy main program and in the alerts.  All of this, however, is let down by everything mentioned in this text.  We simply would not use this product unless all the above problems were corrected.  Our recommendation, therefore, is that if you have already paid the money for the product, then stay with it, but if you feel as strongly as we do about all the issues mentioned in this text, then put pressure on Sunbelt Software to put all the above right so they can turn this incredibly frustrating product into a great product (all independent reviews seem to suggest “top of the class” spyware/adware detection rates).  If, however, you are simply evaluating the product, then duplicate our tests, and if the product has still not changed its behaviour, find another product or tell Sunbelt Software how you feel.

Support

DwlClient

Support.exe

(Dell)

Background task for the Dell Support application installed on certain models of Dell PCs since October 2002.  At the time of writing, 4-Apr-2004, Dell’s definition of Dell Support is as follows :  “The Dell Support 2.0 application is designed to provide you with answers to questions about your specific systems as well as guide you through troubleshooting hardware or software problems.....  To ensure Dell Support always provides you with the best in technical support and how‑to material, the Dell Support application will send Dell Support Usage Information from your PC to Dell.  This information will let us know what technical support materials are effective in helping you and which are not.  No other information outside of Dell Support usage is sent.  Dell treats this information as strictly confidential and will not share it with anyone.”.

Recommendation :
We are against any sort of usage statistics collection  “by stealth” which is one of the things this task does (constantly generating firewall alerts about  SUPPORT.EXE  trying to access the Internet).  As Microsoft, Novell, and many others have shown, it is possible to collect usage information statistics by simply having a question in each support document asking the end-user to click  “Yes/No”  to the question  “Was this document useful ?”.  Additionally, on some systems this task is responsible for startup error messages.  Our recommendation, therefore, is to disable this task on the  Startups  tab of  The Ultimate Troubleshooter  irrespective of the fact that you can modify usage information settings in  “Quick Links \ User Settings”  in Dell Support.  If you need to have Dell Support running while talking to a Dell technician, simply start it through  “Start \ Programs \ Dell Applications \ Support \ Support”.

SvcGuiHlpr

SvcGuiHlpr.exe

(IBM or Lenovo)

ThinkVantage Access Connections Service GUI Helper.  Task spawned by the Access Connections service, ACSVC, and whose role is to provide background interaction or feedback to the end-user.

Recommendation :
Leave alone – this task is required by its parent task which started it.

Svch0st

Svch0st.exe

(???)

Note :  the letter between the  “h”  and the  “s”  in the name of the file is a  zero, not the letter “o”.

You have one of the  Backdoor.Graybird  viruses, or the   W32.Mydoom.Bi@mm   virus, or one of the many other viruses which run as this filename.

Configuration Loading

(???)

Svchost (1)

Svchost.exe

(Microsoft)

Service Host – Generic Host Process for Win32 Services.  The full path to this file should be shown in  The Ultimate Troubleshooter  as  C:\WinNT\System32\Svchost.exe   or   C:\Windows\System32\Svchost.exe  (you can double-click on this entry to view the full path).  Windows 2000/XP/2003/Vista.

SVCHOST is difficult, if not impossible, to explain in layman easy-to-understand-by-everyone terms.  So this process is one of the rare processes where Plain English is simply not possible – we will have to go technical !

SVCHOST is a generic process which acts as a host for processes that run from DLLs rather than EXEs.  At startup SVCHOST checks the Services portion of the Registry to construct a list of DLL-based services that it needs to load, and then loads them.  There can be many instances of SVCHOST running, as there will be one instance of SVCHOST for every DLL-based service or grouping of services (the grouping of services is determined by the programmers who wrote the services in question).

In TUT you can find out what DLL-based services this  SVCHOST  is running by hovering the mouse over this entry in the  Task Name  column (after a little delay a popup will appear which shows you the hosted services).

If you do not have TUT, then under Windows XP Professional and Windows 2003/Vista you can find out what DLL-based services SVCHOST is running by typing  Tasklist /SVC  at a Command/MS‑DOS Prompt  (this command is not available in Windows XP Home), while under Windows 2000 you need to use the  TLIST –s  command from a Command Prompt (MS-DOS Prompt)  (depending on how Windows 2000 was installed you may need to download TLIST from the Microsoft website or install it from one of the miscellaneous folders on the Windows 2000 CD).

Recommendation :
An integral part of the operating system, leave alone – multiple instances of SVCHOST is a normal occurrence.

If you experience SVCHOST errors (extremely rare in 2008 onwards), the problem is most likely not with SVCHOST but with the DLLs it is hosting.  However, if you experience a lot of SVCHOST errors, and particularly, if the full path to  SVCHOST.EXE  is not any of the above, then you most likely have a virus.

Svchost (2)

SVCHOST.EXE

(???)

Many viruses masquerade themselves as SVCHOST to escape detection.  Some have names that are similar, such as SCCHOST, others actually drop a program file called SVCHOST in the Windows folder or a Windows sub‑folder.

Recommendation :
The first recommendation is a simple one :  always have a good antivirus product which is regularly updated (automatically preferably) and always renew your updates subscription when it expires.  To detect if you have a virus that calls itself SVCHOST, first see if its full path shows up in  The Ultimate Troubleshooter  as either  C:\WinNT\System32\Svchost.exe   or   C:\Windows\System32\Svchost.exe  – if it does not, then it is almost certain you have a virus.  Secondly, if you have  SVCHOST  as an entry on the  Startups  tab of The Ultimate Troubleshooter, then you definitely have a virus.  Thirdly, if you have Windows 95/98/ME rather than Win2000/XP/2003, then it is also almost certain you have a virus.  Lastly, go to the  Services   tab of   The Ultimate Troubleshooter  and look for the following service – if you find it then you probably have a virus too :  System Important Message service

Double-click on this task to check it’s path.

SVCHOST

(AudioSrv  service)

Svchost.exe

(Microsoft)

Windows Audio service.  Put simply, this service provides sound in Windows – it is the interface between your soundcard, Windows, and your speakers.  If you want sound in Windows, this service must be running.

Recommendation :
All end-users will want this service running so that they can have sound – after all, a user can turn sound OFF or ON through the speaker icon in the System Tray.  It is a different story as regards servers where, often, sound is never used or always turned off.  Therefore, if this is a server, e.g. Windows 2000 Server or Windows 2003 Server, and you never have the sound turned ON and you want to save memory and CPU cycles, simply set the  Startup Mode  of this service to  Disabled  or  Manual.

SVCHOST

(BITS  service)

Svchost.exe

(Microsoft)

Background Intelligent Transfer Service.   Service used by Microsoft software to transfer files transparently in the background from the Microsoft servers to your computer – the service has the ability to resume interrupted transfers without restarting at the beginning, hence the  “Intelligent”.  In the majority of cases this service is used by Windows or a Microsoft program to update your computer :  Windows Update uses it, and so does MSN Explorer on all versions of Windows which have this service.  On Windows 2000/XP/2003 this service normally has a  Startup Mode  of  Manual  and is started only when Windows or a Microsoft program requires its services.  On Windows Vista the default  Startup Mode  is  Automatic  as the architecture of Vista is such that there are many processes within Vista which make use of this service, and it is therefore more efficient to have the service running at all times rather than have it constantly starting up and stopping.

Recommendation :
Leave alone.

SVCHOST

(DNSCache  service)

Svchost.exe

(Microsoft)

DNS Client & DNS cache service.  The Domain Name System (DNS) client service resolves and caches domain names.  A domain name is something like  yahoo.com,  AnswersThatWork.com, CNN.com, BBC.co.uk,   etc...  Each of those domain names have a corresponding IP address.  Computers, networks, websites, servers, all converse with each other using IP addresses – they cannot talk to each other using names, they talk to each other using IP addresses, sometimes loosely called “network address”.  You can liken an IP address to a telephone number.  So when you type in  www.cnn.com  into your browser, your computer will not be able to take you to the CNN website until it knows the IP address of CNN.com as IP addresses is all it knows to use.  What happens therefore is that this service queries your ISP’s servers (or your corporate servers) saying :  “I want to access cnn.com, can you tell me its IP address”.  Once it has the IP address for CNN.com, your computer uses that IP address and talks to the CNN.com servers and says :  “I want page XYZ for my user”.   The process of equating a user-friendly domain name (BBC.CO.UK) to a computer-friendly IP address (132.185.132.21) is called  “Domain Name Resolution”.  A similar process occurs when computers talk to each other over an internal network.

As you will have guessed by now, a computer spends a lot of time resolving domain names, almost every time you click on a link on a web page or that you enter an address in your browser’s address bar.  If your PC always had to resolve these domain names via your ISP’s server every single time, Internet access would be very very slow.  This is where another feature of this service comes in.  It  “caches”  already resolved domain names, ie. it keeps in memory a table of domain names you have recently accessed and their corresponding IP addresses so that when you access further pages on a website you have already visited, or come back to that website, your PC does not spend time querying your ISP and waiting for the response, it has the answer instantly.  As times goes by, this service also ensures that its domain name resolution table is kept up to date in case a particular website has been moved to a different server or to a different webhosting company, taken out of service, etc..

There are a few other technical issues that this service is also involved in but it is already clear that this service is intrinsic to the ability of your PC to interact with other PCs and servers over a network, whether that network is an internal network, or the Internet.

Recommendation :
Crucial to the ability of your PC to work on a network or on the Internet – Leave alone.

SVCHOST

(Dot3Svc service)

Svchost.exe

(Microsoft)

Dot3Svc Wired Auto-Config Service.  Background Windows XP SP3 Service which enables and manages wired network connections  (ie. connections via network cable through a network port on a PC or laptop, through a network card, or PCMCIA LAN adapters).  This service was introduced by Service Pack 3 for Windows XP (wired network connections were managed by the WZCSVC Wireless Zero Configuration Service under Windows XP SP2).  Without this service your network cards/adapters will not show in  Network Connections  and you simply won’t be able to connect to any network via network cable.

Recommendation :
If the  Startup Mode  of this service is set to  Manual  immediately set it to  Automatic  on the  SERVICES  tab of TUT.  The Microsoft Quality Control department dropped the ball on this one and introduced this service in XP SP3 with a default  Startup Mode  of  Manual.  This does not actually cause a problem on home PCs as other background services eventually start this service at Windows boot‑up with the result that the end-user does not experience any problems connecting to the network via network cable.  In corporate networks, however, running Windows 2003 or Windows 2008 servers and Group Policies, if this service is not set to  Automatic  users will often run into situations where they cannot login to the network because Group Policies are attempting to control the PC but this service has not yet started and the PC is therefore unable to connect to the domain controllers (the Windows 2003/2008 servers).  When you consider that Windows 2003 Server, Windows 2008 Server, and Windows XP are all Microsoft products and that Group Policies are the Microsoft recommended procedures for implementing Windows 2003 Server and Windows 2008 Server networks, this oversight is absolutely unbelievable !

SVCHOST

(LMHosts  service)

Svchost.exe

(Microsoft)

TCP/IP NetBIOS Helper service.  We cannot better Microsoft’s own description of this service :  “Provides support for NetBIOS over TCP/IP (NetBT) and NetBIOS name resolution for clients on your network thus enabling users to share files, printers, and log on to the network. The TCP/IP NetBIOS Helper service provides support for the NetBT service by performing DNS name resolution and pinging a set of IP addresses that return a list of accessible IP addresses.  If this service is stopped or disabled, NETBTs clients, including Server, Netlogon and Messenger, will stop responding. As a result, you may not be able to share files, printers and logon.”.

Recommendation :
Essential for the ability of your PC to network – Leave alone.

SVCHOST

(PML Driver HPZ12  service)

Svchost.exe

(Microsoft)

HP PML Driver Service.  Background service installed by the drivers for a variety of HP printers, ranging from the HP PSC 2100, 2200, 4100, and 6100 series of multifunction printers, to DeskJet 6600 and 6800 series, PhotoSmart series, All‑in‑One OfficeJets, etc....  This task handles non‑printing related two-way communications between the PC and the HP printer.  Typically, on DeskJet and InkJet printers it will handle status-type communications such as ink levels, paper‑empty conditions, etc..., and will feed that information back to an HP icon in the System Tray.  In the case of more advanced printers, such as All‑in‑One printers or PhotoSmart printers, it handles additional non‑printing related communications such as scanning and photocopying events, access to the card reader, etc...

Recommendation :
Because of its role as, effectively, a printer status information gathering task, this task should be left running since, without it, you will  not get useful information from the System Tray HP icon for your printer which will think the printer is disconnected.

However, some versions of this task have been more than problematic, with serious conflicts with specific software packages (Sage Accounting with some versions of this task), or with  “Unable to Start driver”  errors on boot-up.

First,  DO NOT  run this service on a network fileserver running a server operating system like Windows 2000 Server or Windows 2003 Server (or SBS2000, SBS2003).  Our experience of this task on a network fileserver is not good at all – the list of problems includes print jobs that “vanish”, gobbledygook printing, print jobs getting stuck in print queues, and miscellaneous other network printer and printing problems.

If this is not a network fileserver, and you experience problems with this service, first ensure that your firewall allows this task to communicate – if your firewall is preventing the task from talking to things external to the PC then this task will not work properly  (Note: at the time of writing, 19‑Nov‑2007, the Windows XP and Norton Firewalls allow this task to communicate by default, so you should not need to configure them).  Next, if you still have problems, see on our  Drivers  page if there are newer drivers for your printers which might correct the problem.  If problems still remain after the above then disable this task.

You can disable this service by setting its  Startup Mode  to  Disabled  on the  Services  tab of  The Ultimate Troubleshooter.

As Hewlett‑Packard themselves state :   “Most if not all printing functions will work without it, and print quality and speed are not affected by this. However, other functions of the printer driver may be disabled. If a feature is noticed to be missing, the PML driver service can be manually started as described above. Remember to disable the PML driver service again before restarting the computer”.

SVCHOST

(RemoteRegistry Service)

Svchost.exe

(Microsoft)

Remote Registry Service.  Service which is part of Windows.  As per Microsoft’s excellent explanation :  “Enables remote users to modify registry settings on your computer, provided the remote users have the required permissions. The Remote Registry service is primarily used by remote administrators and for performance counters.  If this service is stopped or disabled, modifying the registry will only be allowed on the local computer. If this service is disabled, it will not affect registry operations on your local computer. Other computers or devices will no longer be able to connect to your local computer’s registry.”.

For those who do not know, the Windows Registry is a database in which Windows stores all its settings :  details of your hard disk, graphics card and other hardware, your Windows Registration key, all the software installed, all the Windows Updates installed, how you like Microsoft Word to open (full size or a specific reduced size), users, printers, etc.., etc...  It is that database which TUT queries to give you the information on the  System Info  tab.

Recommendation :
Such a description, even though correct, can sound scary :  What!  A remote user modifying my Windows registry !!!   The truth is rather simpler :  no remote user can change your PC’s Windows Registry without first being able to connect with the right username and password and  having Administrator rights.

On a more pragmatic level this service is absolutely crucial to the ability of your PC to network to other computers on a Windows network or to connect to corporate networks, or the ability for your IT Manager to remotely change settings on your PC and, for the technically advanced, for Group Policies to work (the Domain Controller uses the Remote Registry Service to apply group policies – ditto with NetWare server policies).

Provided you have basic security on your network (all users have secure passwords, and users you would not trust your credit card with are not Administrators on the network!) then you should leave this service set to its default  Startup Mode  of  Automatic.

SVCHOST

(SamSs service)

Svchost.exe

(Microsoft)

Security Accounts Manager service.  The Microsoft SAM service (Security Accounts Manager) is a protected service that manages users and groups in Windows.

On a 2000/XP/Vista PC or non-domain controller Windows 2000/2003/2008 server, the users and groups account information is stored in the Windows Registry, while on Domain Controller Windows 2000/2003/2008 servers, it is stored in Active Directory.

Recommendation :
The entire security of Windows 2000/XP/2003/Vista/2008 is based on users and groups.  Everything about Windows is about which user you are logged in as, what security rights you have. which applications are configured for you, what your own user desktop is about, what your  “My Documents”  is, etc.., etc...   To repeat, therefore, everything that you do in Windows is underpinned totally by which user you are logged in as.

In other words, this particular service is the bedrock of Windows – you kill this service and you kill your PC or server stone dead.  You won’t even be able to login into Safe Mode to go back to a previous restore point.  You won’t even be able to restart this service – your PC or server will shut down or freeze instantly.  It will be the end of this PC or server as you knew it !!

So, if the above was not clear enough, then here it is again :   LEAVE THIS SERVICE WELL WELL ALONE !!!

SVCHOST

(SENS service)

Svchost.exe

(Microsoft)

System Event Notification Service (SENS).  Microsoft service which tracks various system events and notifies programs which need to know about those events.  For instance, this service will track the disconnection of a device from a USB port and notify programs that need to know about this, Windows itself as a start, and, say, your Nokia PC Suite because, for example, you have just unplugged your Nokia cell phone.  Another example will be this service being told by your laptop’s wireless that you have just lost your wireless signal, this service in turn informs Windows of this event, and Windows pops up a warning bubble telling you you have been disconnected.

Recommendation :
Everything in Windows is about events, the event of you, the user, clicking on an icon in the Taskbar in order to switch to another program, the event of your disk becoming full, the event of a music CD having been inserted into the PC and Windows automatically starting your favourite music player, the event of your connection to the Internet becoming broken, etc..., etc...

This service is therefore an absolutely critical core service of Windows – if you terminate it you effectively break Windows.

Leave well alone therefore.

SVCHOST

(TapiSrv service)

Svchost.exe

(Microsoft)

Telephony API service.  Microsoft background service which handles dial-up communications, VPN communications, Remote Access connections out of your PC and into your PC, Microsoft Windows and Product Activation, Microsoft Genuine Windows Checks, and Fax services.

Recommendation :
Leave alone.  This service has a default  Startup Mode  of  Manual  and will therefore only ever run when something else in Windows needs it to run.  In practice, however, you will find that this service is almost always running as, in nowadays Internet connected world, there is almost always some feature of Windows which needs this service to be running and which consequently starts it.

SVCHOST

(TrkWks service)

Svchost.exe

(Microsoft)

Distributed Link Tracking Client service (TrkWks).  Microsoft background service whose role is to aid in the tracking of links to files on Windows servers.

Distributed Link Tracking is the mechanism whereby end-users on a corporate network with one or more Windows file servers (running the Windows 2000/2003 server operating system) can create links on their desktops, or in their local filing system, which point to files and folders on network drives on the Windows server(s).  If the files or folders on the server are moved to different parts of the server, or to another server in the same Active Directory domain, the servers track where the files used to be, and where they are now, so as to ensure that links on the end-users’ PCs still resolve to those files.  The end-users do not realise that the files have moved, and the links on their desktops or filing system, still work.

Note that for this technology to work the  Distributed Link Tracking Server  service on the server(s) involved needs to be running.

Recommendation :
For a start, if you are a Home User or if your PC only links to other Windows XP or Windows Vista PCs, you do not need to read any further – there is no point for this service to be running and using valuable resources as it only ever works if your PC is connected to a Windows server (a server running the Windows 2000 Server, or Windows 2003 server, or Windows 20008 server operating system).  Disable it by setting its  Startup Mode  to  Disabled  on the  The Ultimate Troubleshooter.

Similarly, if your PC only ever connects to Linux or NetWare servers, then this service has no use and should be disabled.

Additionally, many non-Microsoft and non-Symantec backup programs have problems on home PCs when the Distributed Link Tracking client is running and the PC is not connected to a Windows server, and the user performs a file restore – file corruption sometimes occurs.  Disabling this TrkWks service usually solves these problems.

For all other users, in our view there are far too many negatives about the consequences of implementing this technology to even want to implement it.  It is no surprise, therefore, that the server-side equivalent of this service is disabled by default when Windows 2003 Server or Windows 2008 Server is installed from scratch (it used to be turned ON by default on Windows 2000 servers).  The main problem with the Distributed Link Tracking technology is that, on the fileserver, a significant amount of information is stored in Active Directory for every link that is being tracked.  If there are more than one server in the Active Directory domain, then Distributed Link Tracking objects are stored on each of the servers, and on all the global catalogs.  On systems with large numbers of users, and where many users have links to files and folders on the fileserver, the Distributed Link Tracking information stored in Active Directory can often grow to gigabytes, thereby reducing the performance of Active Directory.  And it gets worse :  every time a link is referenced on the end-user PC, a Distributed Link Tracking query is made even if the file or folder on the server has not moved – another server and network traffic penalty.

If the above is not enough to discourage Network System Administrators from implementing Distributed Link Tracking, the most important argument against Distributed Link Tracking is the fact that Distributed Link Tracking was effectively only implemented to support  lazy Network Administrators.  If a network administrator needs to move folders from one place on a server to another place on the server or another server, or to network attached storage, then he/she should use group policies and scripting to update network drive links, and folder and file links on the end-user PCs.  A good Network Administrator should not only always be aware of what users do with the network filing system, but he/she should also have a full picture of what the filing system is and where it is.  Distributed Link Tracking, on the other hand, blurs this knowledge and encourages ignorance of how the end-users use the network filing systems, all of this at a very high cost to Active Directory, Global Catalogs, and network traffic – it really makes no sense to implement Distributed Link Tracking.

So, if you are an end-user on a corporate network, and this TrkWks service is enabled, leave it alone and talk to your Network System Administrator – it is not your place to meddle with the status of this service.  In all other cases this TrkWks service, a relic from the days of Windows 2000 servers, should be disabled.

SVCHOST

(Winmgmt service)

Svchost.exe

(Microsoft)

Windows Management Instrumentation service (WINMGMT).  Windows Management Instrumentation (WMI) provides a standard Windows method of accessing system information such as hardware devices, user accounts, Windows services, running programs, networking, performance information, event monitors, and application monitors.  Thus, for instance, if you wanted to write a product which detailed which hard disks your PC has, their capacity, manufacturer, and other miscellaneous information, your program could use WMI scripting to retrieve the information from your PC.  In fact you could use WMI for something as simple as finding how much spare hard disk space you have.  WMI is used by Windows itself and all sorts of third party programs.  This service accesses the WMI repository or writes new information to it.

Recommendation :
The Windows Management Instrumentation service is crucial to the proper functioning of the majority of Windows own programs and of third party programs.  Many features of Windows itself will not work if you stop this service.  Leave alone therefore.

Svhost

Svhost Loader

Svhost.exe

(???)

You have a virus which could be any of a number of them, such as :   Backdoor.Socksbot,  Bat.Boohoo.Worm, W32.Bolgi.Worm, and a few more.

Svrload

Svrload.exe

(???)

Trojan horse program picked up through file sharing programs such as KaZaa and which sends information from your PC and also provides unauthorised access to your PC.  The program comes primarily through pirate copies of software downloaded via file sharing programs.  On Windows 95/98/ME PCs, if you press  Ctrl+Alt+Del  to bring up the Task List, this program will show up as a task whose name is made up of strange numbers and letters, such as   A456E124F1  or   687AF68632.

Recommendation :
This program is not widely distributed and as a result is not known by most antivirus software manufacturers.  It is known to cause slow internet performance (since it is so busy sending data from your PC, or giving access to your PC) or startup and shutdown errors.  To get rid of this program first terminate it on the  Tasks  tab of  The Ultimate Troubleshooter, then delete the program from your hard disk, and finally delete this entry from the  Startups  tab of  The Ultimate Troubleshooter.   If you are unable to terminate the program, which sometimes happens, then disable it on the  Startups  tab of The Ultimate Troubleshooter, then restart your PC, go back into The Ultimate Troubleshooter, note the location of the program and delete it from your hard disk, and finally delete its entry from the  Startups  tab of The Ultimate Troubleshooter.

Sxgdsenu

Sxgdsenu.exe

(?)

MIDI driver for sound cards based on the Yamaha XG chipset.

Recommendation : 
As the XG chipset is an old chipset, we have not had the opportunity to verify what this background task really does.  As a result the only recommendation we can make is that you leave it alone.  Or, if this task appears on your PC and you are prepared to experiment, you could try disabling it with  The Ultimate Troubleshooter  and see if you suffer sound problems.

Symlcsvc

Symlcsvc.exe

(Symantec)

New task which is part of the 2004/5 editions of Norton security products  (Norton AntiVirus 2004/5, Norton Internet Security 2004/5, Norton Personal Firewall 2004/5).

Recommendation : 
We do not yet know what this task does.  We can only therefore recommend that you leave it alone.

Symwsc

SymWSC.exe

(Symantec)

Symantec WMI Service  installed by Norton AntiVirus, Norton Personal Firewall, and Norton Internet Security on Windows 2000/XP PCs.  This update to these Norton security products first appeared in mid‑August 2004 and supports the Microsoft Windows Security Center introduced in Service Pack 2 for Windows XP and which is in principle also earmarked for Windows 2000.  When this service is running, the Windows Security Center is able to query your Norton AntiVirus software in order to report whether your antivirus software is up-to-date, whether your subscription has run out or is about to run out, and whether you should be downloading program updates (in addition to the virus definition updates that the software downloads itself automatically).

Recommendation :
While initially a good idea in principle, the Windows Security Center with its constant reminders has proved to be a nuisance as the major antivirus manufacturers, while providing integration with the Windows Security Center, actually prefer that you use their own Security Center software, and the majority in fact recommend that you disable the Windows Security Center so that you do not end up with warnings from both the Windows Security Center and their own Security Center, and, more importantly, so that they can provide you with more comprehensive feedback than they could through the Windows Security Center.  We agree with Symantec, and the other vendors, on this issue.  If you have this service actually running it will be primarily because you did not answer  YES  to the question which one of the Norton updates will have asked you :  “We recommend that you disable the Windows Security Center”.

Firstly, if you are on Windows 2000 Service Pack 4 or earlier, or on Windows XP Service Pack 1, this service is of no use to you and you should therefore disable it.   You can disable this service by setting its  Startup Mode  to  Disabled  on the  Services  tab of  The Ultimate Troubleshooter.

If you are on Windows XP Service Pack 2, then we recommend you disable the Windows Security Center for anything that is duplicated by your Norton software :

1)   Double-click the  Security Center  icon in the Control Panel.

2)   Click  Change the way the Security Center alerts me.

3)   If you use Norton AntiVirus, uncheck  Virus Protection.  If you also use the Norton Personal Firewall, uncheck  Firewall.  If you have Norton Internet Security, uncheck both  Firewall  and  Virus Protection.

4)  Click OK to make your changes stick.

5)   Go to the  Services  tab of TUT and change the  Startup Mode  for this service to  Manual – now that you have disabled the Windows Security Center reporting in steps (1) to (4), this service no longer needs to run since the Windows Security Center will no longer be requesting feedback.
 

Syncclk

SyncClk.exe

(Compaq)

Synchronize Clock background task which is part of Compaq’s Digital Dashboard – this task synchronizes your PC’s clock with a time source on the Internet.  Compaq users – Compaq Digital Dashboard has two main features :  time synchronization from the Internet and turning on the mail LED when POP3 mail has been received.  Although present in many Compaq PCs, it is our experience that very few users are aware of the Compaq Digital Dashboard software (the icon is in the Control Panel); as a result we have found very few users running this particular task.

Recommendation :  
Down to end-user preference.  You can disable  SYNCCLK  by disabling time synchronization in the Digital Dashboard icon in the Control Panel.  Alternatively, you can also disable the task with  The Ultimate Troubleshooter.

SynToshiba

SynToshiba.exe

(Synaptics)

Synaptics Pointing Device Driver.  Synaptics TouchPad, Mouse, and Multimedia sidebar Enhancements driver for Toshiba laptops.  The TouchPad and Mouse (whether you are using an external mouse or your finger on the touchpad)  actually work perfectly well without this program.  The main purpose of this program, however, is to enable the user to configure the special features through the  Mouse  icon in the Control Panel, such as, for example, the Media Center keyboard touchbar on the Media Centre laptop keyboard on some laptops.

Recommendation :
Leave alone as you will not be able to open the  Mouse  icon in the Control Panel if this is not running (you will get an  “Unable to connect to the Synaptics Pointing Device Driver”  error), nor will you be able to configure the behaviour of the Media Centre keyboard touchbar.  This program uses between 3Mb to 4Mb of memory.

SynTPStart

SynTPStart.exe

(Synaptics)

Synaptics Pointing Device Starter.  Synaptics TouchPad, Mouse, and Multimedia sidebar Enhancements driver for laptops.  The TouchPad and Mouse (whether you are using an external mouse or your finger on the touchpad)  actually work perfectly well without this program.  The main purpose of this program, however, is to enable the user to configure the special features through the  Mouse  icon in the Control Panel, such as, for example, the Media Center keyboard touchbar on the right-hand side of your Media Centre laptop keyboard on some laptops.

Recommendation :
Leave alone as you will not be able to open the  Mouse  icon in the Control Panel if this is not running (you will get a  “Unable to connect to the Synaptics Pointing Device Driver”  error), nor will you be able to configure the behaviour of the Media Centre keyboard touchbar.  This program uses between 4Mb to 7Mb of memory.

Sysdoc32

SysDoc32.exe

(Symantec)

Norton System Doctor.  Part of Norton Utilities. Heavy on resources in our opinion.

Recommendation : 
Disable it in  The Ultimate Troubleshooter  – you can run it manually through the Norton Utilities.

Sysmonxp

SysMonXP.exe

(???)

You have the   W32.Netsky.Q@mm   virus.

System  (1)

N/A

(Microsoft)

Windows NT4/2000/XP/2003 only.  A collective name for all operating system kernel threads.

Recommendation :
The Operating System !!   Leave alone.

System  (2)

Win_api_driver

System.exe

(???)

You have one of the   Trojan.Download.Revird / Trojan.Mitglieder.C / Backdoor.Tuxder  viruses (or some other virus).

System Idle Process

N/A

(Microsoft)

Windows NT4/2000/XP/2003 only.  This is a process which runs on each CPU in your PC/Server and whose sole purpose is to total up the amount of time when the processor is not doing anything.  In Task Manager (Task List) this process usually accounts for the majority of processor time.

Recommendation : 
An integral part of the operating system, leave alone.

Systray  (1)

SysTray.exe

(Microsoft)

This program runs the Windows System Tray, which is that part of the Task Bar where the Time is displayed.  The System Tray is often used by other installed programs for their icons to be displayed in it.

Recommendation :
Leave untouched.

Systray  (2)

Systray driver

Systray.exe

(???)

You may have the   Backdoor.IRC.Mutebot   virus, or one of the many other viruses which pose as  SYSTRAY, particularly if this entry is found on the  Startups  tab of  The Ultimate Troubleshooter.

Recommendation :
Simply make sure you have daily updated reputable antivirus software – it will pick up viruses posing as SYSTRAY.

SZCompanion

SZCompanion.exe

(International Software Systems Solutions)

You have the   STOPZilla Advanced Configuration Options   window currently open.

SZOptions

SZOptions.exe

(International Software Systems Solutions)

You have the   STOPzilla Basic Configuration Options   window currently open.

All of the tasks below, and many more, although not detailed on this page, are explained in full in The Ultimate Troubleshooter.

The Ultimate Troubleshooter (TUT), has the full database in a remarkably easy and pleasing interface which makes the process of fine tuning your PC, or troubleshooting your computer's problems, a snip.  Get it here.

S3Hotkey.exe,  S3Tray.exe,  S3Tray2.exe,  S3Trayp.exe,  SABSVC.exe,  Sachostx.exe,  SADBLOCK.exe,  Safari.exe,  SafeWin.exe,  Sagate.exe,  SAgent4.exe,  Sagent95.exe,  SAgentNT.exe,  SamSs,  Samx.exe,  Saproxy.exe,  SAService.exe,  Saus.exe,  SAVAdminService.exe,  SavRoam.exe,  SavService.exe,  SayTime.exe,  SAYTIMEMAIN.EXE,  SBAMTray.exe,  Sbase.exe,  SBAutoUpdate.exe,  SBBServ.exe,  SBCSSvc.exe,  SBCSTray.exe,  SBDrvDet.exe,  SbPFCL.exe,  SbPFLnch.exe,  SbPFSvc.exe,  SBrowser.exe,  Sbscrexe.exe,  SBSingle.exe,  SC_Acrobat.exe,  Scalc.exe,  Scalpe91.exe,  ScannerFinder.exe,  ScanningProcess.exe,  Sched.exe,  Schedhlp.exe,  Schedm.exe,  Schedul2.exe,  Schedule Service,  Scheduler.exe,  Scheduler_Proxy.exe,  SchedulerSvc.exe,  SchTasks.exe,  Scmhlpr.vbs,  Scran.exe,  ScreenshotCaptor.exe,  Scrigz.exe,  Scrnsaver.scr,  ScrubXP.exe,  SCService.exe,  Scvhosts.exe,  SDActiveMonitor.exe,  Sdclt.exe,  Sdhelp.exe,  Sdiapp.exe,  Sdraw.exe,  SDService.exe,  SDSetup.exe,  SDTrayApp.exe,  SDWinSec.exe,  Rundll32.exe Se.dll,  SeaMonkey.exe,  SEAMON~1.exe,  SeaPort.exe,  SearchIndexer.exe,  Searchfilterhost.exe,  SearchProtection.exe,  Searchprotocolhost.exe,  Sec5dec.exe,  SecCopy.exe,  SecLogon Service,  Sectoriate.exe,  Secure.exe,  Secure2.bat,  SecuritySuite.exe,  SENS,  Sempalong.exe,  Servce.exe,  Servcs.exe,  Service.exe,  Servicec.exe,  Servic~1.exe,  Servicestub.exe,  Sesnot.exe,  SetIcon.exe,  SetPoint.exe,  Setv.exe,  SFAgent.exe, SfCtlCom.exe,  SFUS.exe,  Sgbhp.exe,  SGBXCOMS.exe,  Sgmain.exe,  SharedAccess Service,  Shareaza.exe,  Shell32.exe,  Shell32.vbs,  ShellHWDetection Service,  SHOTKEY.exe,  Shpc32.exe,  ShStat.exe,  ShuttleEngine.exe,  ShuttleHelper.exe,  SHUTZ.exe,  Shwicon.exe,  Shwicon2k.exe,  Shwicon98.exe,  ShwiconEM.exe,  Shicoxp.exe,  Sibc.exe,  Sibelius.exe,  Sidebar.exe,  Sidekick.exe,  Simpress.exe,  SiteAdv.exe,  Skdaemon.exe,  Skinker.exe,  Skinkers.exe,  Skybot.exe,  Skybotx.exe,  Skynetave.exe,  Skype.exe,  SkyTel.exe,  Slchost.exe,  Slmdmsr.exe,  SLRUNDLL.exe,  SLsvc.exe,  SMax4.exe,  SmartClock.exe, SmartPOP2SMTP.exe,  SmartRAM.exe,  SmartStamp.exe,  SMax4PnP.exe,  SmcGUI.exe,  Smoc.exe,  SmoothView.exe,  SMSystemAnalyzer.exe,  SMSMessage.exe,  Smvalid.exe,  SnagIt32.exe,  SnagitEditor.exe,  SnagPriv.exe,  Sndmon.exe,  SndVol32.exe,  SNDWarn.exe,  SnippingTool.exe,  Soffice.bin,  Soffice.exe,  Softsqueeze.exe,  Sol.exe,  SolidConverterPDFService.exe,  SolidPdfService.exe,  SolidWorksLicensing.exe,  SolidWorksLicTemp.0001,  Sonar.exe,  SonarPdr.exe,  SonudMan.exe,  SonyTray.exe,  SoundMax.exe,  Spkrmon.exe,  Sp00lsv32.pif,  SP2 Update.exe,  Sp2ctr.exe,  SPAMCFG.exe,  Spamkiller.exe,  SpamPal.exe,  SpamSub.exe,  SpamSubtract.exe,  SpClDlx.exe,  SpeedUpMyPC.exe,  Spider.exe,  SpiderSolitaire.exe,  Spoo1sv.exe,  Spoolcll.exe,  Spoolserv.exe,  Spoolsvu.exe,  SPPSvc.exe,  SprtCmd.exe,  SprtSvc.exe,  SPUpdSvc.exe,  Spvspool.exe,  SpybotSD.exe,  SpyderBar.exe,  SpyEraser.exe,  SpySweeper.exe,  SpySweeperUI.exe,  SpywareBlaster.exe,  SpywareDetector.exe,  Sqladhlp.exe,  Sqladhlp90.exe,  SQLAgent.exe,  SQLAGENT90.EXE,  Sqlbrowser.exe,  Sqltob.exe,  Sqlwriter.exe,  SR_GUI.exe,  SR_Service.exe,  SR_Watchdog.exe,  Sraid.exe,  Srservice Service,  SRSLabsLicenseService.exe,  Srvhandle.exe,  SrvLoad.exe,  SrvLnch.exe,  SSBkgdupdate.exe,  SSCEvtHdlr.exe,  SSCRun.exe,  SSDPSRV Service,  SSMMgr.exe,  SSPDSRV,  SSstd8.exe,  Ssttare.exe,  SSU.exe,  STacSV.exe,  Stagmr.exe,  Stampit.exe,  StartmyAgtTry.exe,  StartRegistryBooster.exe,  Startup.exe,  StartupCopPro.exe,  StartupMonitor.exe,  StchCtrl.exe,  STDSB.exe,  Steam.exe,  SteFanie.vbs,  Stickies.exe,  Sticky32.exe,  Stisvc Service,  Stllssvr.exe,  STOPzilla.exe,  Store.exe,  STSysTra.exe,  STTray.exe,  STTTSM.EXE,  Suchost.exe,  SuiteOffices.exe,  sunasDtServ.exe,  sunasServ.exe,  SunProtectionServer.exe,  SunThreatEngine.exe,  SUP_SmartRAM.exe,  SUPERAntiSpyware.exe,  SureType.exe,  SUService.exe,  Svc.exe,  Svcdata.exe,  Svchos.exe,  Svchosp.exe,  Svchost.exe,  Svchost.com,  Svchost.scr,  Svchosthlp.exe,  Svchosts.exe,  Svchostt.exe,  Svchsot.exe,  Svcinit.exe,  Svcmdx32.exe,  Svcntaux.exe,  Svcxnv32.exe,  Svdhost32.exe,  Svhost32.exe,  Svhst.exe,  SViewpro.exe,  Svohcst.exe,  Svshost.exe,  Svxhost.exe,  Swchost.exe,  Swdoctor.exe,  Swdsvc.exe,  Swift To-Do List.exe,  Switcher.exe,  Swriter.exe,  SWTrayV4.exe,  Swupdtmr.exe,  Sychost.exe,  Symantec32.exe,  SymAV.exe,  SymSnapService.exe,  SyncServices.exe,  SynTPHelper.exe,  Sys16.exe,  Sys32.exe,  Syscon.exe,  Sysconf.exe,  Sysdoor.exe,  Sysdxvid.exe,  Sysformat.exe,  Sysinfo.exe,  Sysinit.exe,  Syslog32.exe,  Syslogin.exe,  SysMech.exe,  SysMech4.exe,  SysMech5.exe,  SysMech6.exe,  SysMech7.exe,  Sysmon.exe,  Sysmon.exe,  Sysmsvc.exe,  Syspol.exe,  Sysprep.exe,  Systacq.exe,  System.com,  System copy.exe,  System7.bat,  System.Update.exe.exe,  System32.exe,  System32.vbs,  System32Driver32.exe,  SystemBooster.exe,  SystemGuardAlerter.exe,  Systems.exe,  Systra.exe,  Sysvcs.exe,  Syswrun4x.exe,  SYSZ.exe,  SZBlkLst.exe,  Szchost.exe,  SZEventLog.exe,  SZNTSvc.exe,  SZQuarantine.exe,  SZServer.exe
 

PRESS & RADIO

September 2009
AskJack Blog,
The Guardian, UK

May 2009
Courier Mail, Brisbane, Australia

October 2008
The Philadelphia Bulletin

September 2008
NetworkWorld.com
——
VNUnet.com
London, UK

February 2008
The Wall Street Journal

September 2007
TechByter Worldwide

August 2007
IT Week Labs Blog
London, UK

June 2007
On Computers
Joy&Bob Schwabach
——
Simplehelp.net
——
Courier Mail, Brisbane

May 2007
Christopher Null
at Yahoo!Tech

January 2007
WFAA.com TV
Dallas/Fort Worth  Texas

2006
TechNewsWorld.com
——
Developer Shed
——
The Wall Street Journal
——
WTVN Radio
Columbus, Ohio

2005
WorldStart Computer Tips
——
A-Clue.com
——
Corante.com
——
PC Magazine
'Top 100 Classics'
——
Infodad.com

2004
PC Magazine
'Top 100 Classics'
——
The Examiner (Texas)
——
St Petersburgh Times
——
ToledoBlade (Ohio)
——
Office Zealot
——
Kevin Respecki
——
Mike McBride Online