Anti-Spyware Background Processes..

[JD]

Doing some research about a question in another newsgroup, I fired up
Process Explorer, from http://technet.microsoft.com/en-us/sysinternals
and I found a couple of new process running the the background:

SASCORE.exe: The Description is "core service." I run SUPERAntiSpyware
Free as an on-demand scanner and manually update it so I'm curious as to
why this process starts with Windows? The SAS response is: "You need it
for the free edition - leave it set as we set it. The core service
should be left running - that's the bottom line - it uses little memory
or cpu." Anybody here familiar with this service? I can easily set it to
manual or disabled using Control Panel, Administrative Tools, Services.

a2Service.exe: The Description is Emsisoft Anti-Malware Service. I run
Emsisoft Anti-Malware as an on-demand scanner and manually update it so
I'm also curious as to why this process starts with Windows? I haven't
found a real description of what it does. Anybody here familiar with
this service? I can easily set it to manual or disabled using Control
Panel, Administrative Tools, Services.

I'm not a big fan of services that run in the background for no real
reason.

--
JD..

[David H. Lipman]

From: "JD" <JD@example.invalid>

> Doing some research about a question in another newsgroup, I fired up Process Explorer,
> from http://technet.microsoft.com/en-us/sysinternals and I found a couple of new
> process running the the background:
>
> SASCORE.exe: The Description is "core service." I run SUPERAntiSpyware Free as an
> on-demand scanner and manually update it so I'm curious as to why this process starts
> with Windows? The SAS response is: "You need it for the free edition - leave it set as
> we set it. The core service should be left running - that's the bottom line - it uses
> little memory or cpu." Anybody here familiar with this service? I can easily set it to
> manual or disabled using Control Panel, Administrative Tools, Services.
>
> a2Service.exe: The Description is Emsisoft Anti-Malware Service. I run Emsisoft
> Anti-Malware as an on-demand scanner and manually update it so I'm also curious as to
> why this process starts with Windows? I haven't found a real description of what it
> does. Anybody here familiar with this service? I can easily set it to manual or disabled
> using Control Panel, Administrative Tools, Services.
>
> I'm not a big fan of services that run in the background for no real reason.
>

The "a2Service.exe" Emsisoft Anti-Malware Service is for removing malware under a Limited
User Account (LUA).

I don't know know what SASCORE.exe is or what it is used for.


--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp

[Han]

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in
news:j6t1a902nmc@news4.newsguy.com:

> From: "JD" <JD@example.invalid>
>
>> Doing some research about a question in another newsgroup, I fired up
>> Process Explorer, from
>> http://technet.microsoft.com/en-us/sysinternals and I found a couple
>> of new process running the the background:
>>
>> SASCORE.exe: The Description is "core service." I run
>> SUPERAntiSpyware Free as an on-demand scanner and manually update it
>> so I'm curious as to why this process starts with Windows? The SAS
>> response is: "You need it for the free edition - leave it set as we
>> set it. The core service should be left running - that's the bottom
>> line - it uses little memory or cpu." Anybody here familiar with this
>> service? I can easily set it to manual or disabled using Control
>> Panel, Administrative Tools, Services.
>>
>> a2Service.exe: The Description is Emsisoft Anti-Malware Service. I
>> run Emsisoft Anti-Malware as an on-demand scanner and manually update
>> it so I'm also curious as to why this process starts with Windows? I
>> haven't found a real description of what it does. Anybody here
>> familiar with this service? I can easily set it to manual or disabled
>> using Control Panel, Administrative Tools, Services.
>>
>> I'm not a big fan of services that run in the background for no real
>> reason.
>>
>
> The "a2Service.exe" Emsisoft Anti-Malware Service is for removing
> malware under a Limited User Account (LUA).
>
> I don't know know what SASCORE.exe is or what it is used for.

I have SAS paid, and have SASCore64.exe running from system, I believe.

--
Best regards
Han
email address is invalid

[David H. Lipman]

From: "Han" <nobody@nospam.not>

> "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in
> news:j6t1a902nmc@news4.newsguy.com:
>
>> From: "JD" <JD@example.invalid>
>>
>>> Doing some research about a question in another newsgroup, I fired up
>>> Process Explorer, from
>>> http://technet.microsoft.com/en-us/sysinternals and I found a couple
>>> of new process running the the background:
>>>
>>> SASCORE.exe: The Description is "core service." I run
>>> SUPERAntiSpyware Free as an on-demand scanner and manually update it
>>> so I'm curious as to why this process starts with Windows? The SAS
>>> response is: "You need it for the free edition - leave it set as we
>>> set it. The core service should be left running - that's the bottom
>>> line - it uses little memory or cpu." Anybody here familiar with this
>>> service? I can easily set it to manual or disabled using Control
>>> Panel, Administrative Tools, Services.
>>>
>>> a2Service.exe: The Description is Emsisoft Anti-Malware Service. I
>>> run Emsisoft Anti-Malware as an on-demand scanner and manually update
>>> it so I'm also curious as to why this process starts with Windows? I
>>> haven't found a real description of what it does. Anybody here
>>> familiar with this service? I can easily set it to manual or disabled
>>> using Control Panel, Administrative Tools, Services.
>>>
>>> I'm not a big fan of services that run in the background for no real
>>> reason.
>>>
>>
>> The "a2Service.exe" Emsisoft Anti-Malware Service is for removing
>> malware under a Limited User Account (LUA).
>>
>> I don't know know what SASCORE.exe is or what it is used for.
>
> I have SAS paid, and have SASCore64.exe running from system, I believe.
>

And you are running a 64bit OS Han ?



--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp

[Han]

"David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in
news:j6t2u002ofk@news4.newsguy.com:

> From: "Han" <nobody@nospam.not>
>
>> "David H. Lipman" <DLipman~nospam~@Verizon.Net> wrote in
>> news:j6t1a902nmc@news4.newsguy.com:
>>
>>> From: "JD" <JD@example.invalid>
>>>
>>>> Doing some research about a question in another newsgroup, I fired
>>>> up Process Explorer, from
>>>> http://technet.microsoft.com/en-us/sysinternals and I found a
>>>> couple of new process running the the background:
>>>>
>>>> SASCORE.exe: The Description is "core service." I run
>>>> SUPERAntiSpyware Free as an on-demand scanner and manually update
>>>> it so I'm curious as to why this process starts with Windows? The
>>>> SAS response is: "You need it for the free edition - leave it set
>>>> as we set it. The core service should be left running - that's the
>>>> bottom line - it uses little memory or cpu." Anybody here familiar
>>>> with this service? I can easily set it to manual or disabled using
>>>> Control Panel, Administrative Tools, Services.
>>>>
>>>> a2Service.exe: The Description is Emsisoft Anti-Malware Service. I
>>>> run Emsisoft Anti-Malware as an on-demand scanner and manually
>>>> update it so I'm also curious as to why this process starts with
>>>> Windows? I haven't found a real description of what it does.
>>>> Anybody here familiar with this service? I can easily set it to
>>>> manual or disabled using Control Panel, Administrative Tools,
>>>> Services.
>>>>
>>>> I'm not a big fan of services that run in the background for no
>>>> real reason.
>>>>
>>>
>>> The "a2Service.exe" Emsisoft Anti-Malware Service is for removing
>>> malware under a Limited User Account (LUA).
>>>
>>> I don't know know what SASCORE.exe is or what it is used for.
>>
>> I have SAS paid, and have SASCore64.exe running from system, I
>> believe.
>>
>
> And you are running a 64bit OS Han ?

I believe so, David. Got a new laptop, ASUS X53E, Intel core i3-2310M @
2.1 GHz, 8 GB RAM, 64 bit Win7 Pro.


--
Best regards
Han
email address is invalid

[JD]

David H. Lipman wrote:
> From: "JD"<JD@example.invalid>
>
>> Doing some research about a question in another newsgroup, I fired up Process Explorer,
>> from http://technet.microsoft.com/en-us/sysinternals and I found a couple of new
>> process running the the background:
>>
>> SASCORE.exe: The Description is "core service." I run SUPERAntiSpyware Free as an
>> on-demand scanner and manually update it so I'm curious as to why this process starts
>> with Windows? The SAS response is: "You need it for the free edition - leave it set as
>> we set it. The core service should be left running - that's the bottom line - it uses
>> little memory or cpu." Anybody here familiar with this service? I can easily set it to
>> manual or disabled using Control Panel, Administrative Tools, Services.
>>
>> a2Service.exe: The Description is Emsisoft Anti-Malware Service. I run Emsisoft
>> Anti-Malware as an on-demand scanner and manually update it so I'm also curious as to
>> why this process starts with Windows? I haven't found a real description of what it
>> does. Anybody here familiar with this service? I can easily set it to manual or disabled
>> using Control Panel, Administrative Tools, Services.
>>
>> I'm not a big fan of services that run in the background for no real reason.
>>
>
> The "a2Service.exe" Emsisoft Anti-Malware Service is for removing malware under a Limited
> User Account (LUA).
>
> I don't know know what SASCORE.exe is or what it is used for.
>
>

I set both services to Manual, using Control Panel, Administrative
Tools, Services and both programs seem to work without the services
running. I ended up updating Emsisoft Anti-Mailware from Version
5.1.0.19 to Version 6.0.6.40 and it changed the Service to version 6,
which I also set to Manual.

It also didn't give me an option on the install location. Not a good thing.

Do you use Emsisoft Anti-Mailware? It seems like it's turning into what
I call "crap-ware" where it has a whole slew of questionable things I
had to disable, "Enable Guard on system startup" and "Join the
Anti-Malware Network." What the Hell?

So much for a simple, on-demand, manually updated scanners. 8-)

--
JD..

[David H. Lipman]

From: "JD" <JD@example.invalid>

> David H. Lipman wrote:
>> From: "JD"<JD@example.invalid>
>>
>>> Doing some research about a question in another newsgroup, I fired up Process
>>> Explorer,
>>> from http://technet.microsoft.com/en-us/sysinternals and I found a couple of new
>>> process running the the background:
>>>
>>> SASCORE.exe: The Description is "core service." I run SUPERAntiSpyware Free as an
>>> on-demand scanner and manually update it so I'm curious as to why this process starts
>>> with Windows? The SAS response is: "You need it for the free edition - leave it set as
>>> we set it. The core service should be left running - that's the bottom line - it uses
>>> little memory or cpu." Anybody here familiar with this service? I can easily set it to
>>> manual or disabled using Control Panel, Administrative Tools, Services.
>>>
>>> a2Service.exe: The Description is Emsisoft Anti-Malware Service. I run Emsisoft
>>> Anti-Malware as an on-demand scanner and manually update it so I'm also curious as to
>>> why this process starts with Windows? I haven't found a real description of what it
>>> does. Anybody here familiar with this service? I can easily set it to manual or
>>> disabled
>>> using Control Panel, Administrative Tools, Services.
>>>
>>> I'm not a big fan of services that run in the background for no real reason.
>>>
>>
>> The "a2Service.exe" Emsisoft Anti-Malware Service is for removing malware under a
>> Limited
>> User Account (LUA).
>>
>> I don't know know what SASCORE.exe is or what it is used for.
>>
>>
>
> I set both services to Manual, using Control Panel, Administrative Tools, Services and
> both programs seem to work without the services running. I ended up updating Emsisoft
> Anti-Mailware from Version 5.1.0.19 to Version 6.0.6.40 and it changed the Service to
> version 6, which I also set to Manual.
>
> It also didn't give me an option on the install location. Not a good thing.
>
> Do you use Emsisoft Anti-Mailware? It seems like it's turning into what I call
> "crap-ware" where it has a whole slew of questionable things I had to disable, "Enable
> Guard on system startup" and "Join the Anti-Malware Network." What the Hell?
>
> So much for a simple, on-demand, manually updated scanners. 8-)
>


I stopped using Nick Skrepeto's s software years ago.

--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp

[JD]

David H. Lipman wrote:
> From: "JD"<JD@example.invalid>
>
>> David H. Lipman wrote:
>>> From: "JD"<JD@example.invalid>
>>>
>>>> Doing some research about a question in another newsgroup, I fired up Process
>>>> Explorer,
>>>> from http://technet.microsoft.com/en-us/sysinternals and I found a couple of new
>>>> process running the the background:
>>>>
>>>> SASCORE.exe: The Description is "core service." I run SUPERAntiSpyware Free as an
>>>> on-demand scanner and manually update it so I'm curious as to why this process starts
>>>> with Windows? The SAS response is: "You need it for the free edition - leave it set as
>>>> we set it. The core service should be left running - that's the bottom line - it uses
>>>> little memory or cpu." Anybody here familiar with this service? I can easily set it to
>>>> manual or disabled using Control Panel, Administrative Tools, Services.
>>>>
>>>> a2Service.exe: The Description is Emsisoft Anti-Malware Service. I run Emsisoft
>>>> Anti-Malware as an on-demand scanner and manually update it so I'm also curious as to
>>>> why this process starts with Windows? I haven't found a real description of what it
>>>> does. Anybody here familiar with this service? I can easily set it to manual or
>>>> disabled
>>>> using Control Panel, Administrative Tools, Services.
>>>>
>>>> I'm not a big fan of services that run in the background for no real reason.
>>>>
>>>
>>> The "a2Service.exe" Emsisoft Anti-Malware Service is for removing malware under a
>>> Limited
>>> User Account (LUA).
>>>
>>> I don't know know what SASCORE.exe is or what it is used for.
>>>
>>>
>>
>> I set both services to Manual, using Control Panel, Administrative Tools, Services and
>> both programs seem to work without the services running. I ended up updating Emsisoft
>> Anti-Mailware from Version 5.1.0.19 to Version 6.0.6.40 and it changed the Service to
>> version 6, which I also set to Manual.
>>
>> It also didn't give me an option on the install location. Not a good thing.
>>
>> Do you use Emsisoft Anti-Mailware? It seems like it's turning into what I call
>> "crap-ware" where it has a whole slew of questionable things I had to disable, "Enable
>> Guard on system startup" and "Join the Anti-Malware Network." What the Hell?
>>
>> So much for a simple, on-demand, manually updated scanners. 8-)
>>
>
>
> I stopped using Nick Skrepeto's s software years ago.
>

He's the author of SAS or Emsisoft Anti-M?

Besides your Multi-AV scanning tool, do you have a on-demand, manual
update anti-malware program that you like?


--
JD..

[David H. Lipman]

From: "JD" <JD@example.invalid>

> David H. Lipman wrote:
>> From: "JD"<JD@example.invalid>
>>
>>> David H. Lipman wrote:
>>>> From: "JD"<JD@example.invalid>
>>>>
>>>>> Doing some research about a question in another newsgroup, I fired up Process
>>>>> Explorer,
>>>>> from http://technet.microsoft.com/en-us/sysinternals and I found a couple of new
>>>>> process running the the background:
>>>>>
>>>>> SASCORE.exe: The Description is "core service." I run SUPERAntiSpyware Free as an
>>>>> on-demand scanner and manually update it so I'm curious as to why this process
>>>>> starts
>>>>> with Windows? The SAS response is: "You need it for the free edition - leave it set
>>>>> as
>>>>> we set it. The core service should be left running - that's the bottom line - it
>>>>> uses
>>>>> little memory or cpu." Anybody here familiar with this service? I can easily set it
>>>>> to
>>>>> manual or disabled using Control Panel, Administrative Tools, Services.
>>>>>
>>>>> a2Service.exe: The Description is Emsisoft Anti-Malware Service. I run Emsisoft
>>>>> Anti-Malware as an on-demand scanner and manually update it so I'm also curious as
>>>>> to
>>>>> why this process starts with Windows? I haven't found a real description of what it
>>>>> does. Anybody here familiar with this service? I can easily set it to manual or
>>>>> disabled
>>>>> using Control Panel, Administrative Tools, Services.
>>>>>
>>>>> I'm not a big fan of services that run in the background for no real reason.
>>>>>
>>>>
>>>> The "a2Service.exe" Emsisoft Anti-Malware Service is for removing malware under a
>>>> Limited
>>>> User Account (LUA).
>>>>
>>>> I don't know know what SASCORE.exe is or what it is used for.
>>>>
>>>>
>>>
>>> I set both services to Manual, using Control Panel, Administrative Tools, Services and
>>> both programs seem to work without the services running. I ended up updating Emsisoft
>>> Anti-Mailware from Version 5.1.0.19 to Version 6.0.6.40 and it changed the Service to
>>> version 6, which I also set to Manual.
>>>
>>> It also didn't give me an option on the install location. Not a good thing.
>>>
>>> Do you use Emsisoft Anti-Mailware? It seems like it's turning into what I call
>>> "crap-ware" where it has a whole slew of questionable things I had to disable, "Enable
>>> Guard on system startup" and "Join the Anti-Malware Network." What the Hell?
>>>
>>> So much for a simple, on-demand, manually updated scanners. 8-)
>>>
>>
>>
>> I stopped using Nick Skrepeto's s software years ago.
>>
>
> He's the author of SAS or Emsisoft Anti-M?
>
> Besides your Multi-AV scanning tool, do you have a on-demand, manual update anti-malware
> program that you like?
>

Nick Skrepeto is the author of SAS but it has been sold off. Now Nick can race his car
all he wants.

To the best of my knowledge, Christian Mairoll is the author of Emsisoft.

If I had another manually updated anti-malware program that I liked, I would replace
Kaspersky's DOS based scanner with it in my Mulkti-AV Scanning Tool.

--
Dave
Multi-AV Scanning Tool - http://multi-av.thespykiller.co.uk
http://www.pctipp.ch/downloads/dl/35905.asp

[VanguardLH]

JD wrote:

> Doing some research about a question in another newsgroup, I fired up
> Process Explorer, from http://technet.microsoft.com/en-us/sysinternals
> and I found a couple of new process running the the background:
>
> SASCORE.exe: The Description is "core service." I run SUPERAntiSpyware
> Free as an on-demand scanner and manually update it so I'm curious as to
> why this process starts with Windows? The SAS response is: "You need it
> for the free edition - leave it set as we set it. The core service
> should be left running - that's the bottom line - it uses little memory
> or cpu." Anybody here familiar with this service? I can easily set it to
> manual or disabled using Control Panel, Administrative Tools, Services.

I think the sascore process showed up after some update in August. It
looks like it was there before in the Pro version and then got added in
August via update to the free version. Although claimed for use during
real-time protection, it's now there for the the free version that
doesn't have real-time protection. Despite going through all of its
configuration settings, it WILL be running processes on Windows startup.
Also, from what I've read (since I don't have it anymore), SAS will
re-insert its startup process. So you disable/delete it but SAS puts it
back in. I use WinPatrol and can have it *permanently* disable an item.
If it shows up again, WinPatrol will disable it again (before you reboot
and it loads again). For example, Apple's sticks its worthless
qttask.exe into the registry as a startup item and it will reappear (I
forget the event that reinstates this entry, like you run their program,
it's config, or due to an update), so I disable it in WinPatrol. If
WinPatrol sees it show up again as a startup entry then it disables it
again. From other users, sascore is NOT required despite the claims of
SAS techs but it keeps trying to reinstate itself so you need to keep
disabling it (unless you use something automatic to do that, like
WinPatrol). When queried about the purpose of this background process,
SAS won't elucidate. That's no big surprise since many anti-malware
authors rely on secrecy (and not help malware authors) rather than
robustness to deter anti-malware.

Even if you address the sascore process, SAS also installs a system hook
when it installs. It doesn't matter if you configure it to be passive
or not. It still injects a hook into the system. I'd have to install
it again and monitor that install. I suspect I either saw it using
Resplendence's Hook Analyzer (as a system API hook) or SysInternal's
AutoRun (as a "shell execute" hook). I just remember finding it despite
trying to keep SAS Free completely quiescent when not loaded.

Despite their claim that these measures were needed for SAS to attempt
to get "below" any existing active malware to ensure SAS could detect
and eradicate the malware, I wanted a completely passive on-demand
secondary anti-malware scanner. So I uninstalled SAS (and used the
snapshot recorded in Zsoft Uninstaller to eliminate any remnant registry
entries and files after the normal uninstall).

> a2Service.exe: The Description is Emsisoft Anti-Malware Service. I run
> Emsisoft Anti-Malware as an on-demand scanner and manually update it so
> I'm also curious as to why this process starts with Windows? I haven't
> found a real description of what it does. Anybody here familiar with
> this service? I can easily set it to manual or disabled using Control
> Panel, Administrative Tools, Services.
>
> I'm not a big fan of services that run in the background for no real
> reason.

It seems you are mixing two anti-malware products together in your post:
SuperAntispyware (SAS) and a-Squared (Emsisoft). It's been way too long
since I trialed a-Squared to remember anything about that software.

From what I read, this is used to run A2 while logged on under a limited
user account (LUA). If you're always logged on under an admin-level
account, see if setting this service to "manual" startup mode has not
detrimental affects on using A2. Automatic means it gets loaded when
Windows is started (and before you login). That only means it gets
loaded, not that it remains loaded (some will load, do some checks, and
unload). Manual means it won't be loaded until called, so when you load
A2 then it'll call this service to load it. Of course, once the service
is started and running doesn't mean its gets stopped when you exit the
application. I suspect if you set the service to manual (service not
running when you start Windows) and then right-click on a folder or file
to select the A2 content menu entry to scan the file, the A2 service
gets loaded and it will continue running even after the scan has
completed. So if you use anything of A2 then the service gets started
and continues running until the next time you restart Windows. So
consider if the process' memory footprint is really that bad that you
need to keep the service from loading on Windows startup since anytime
you use A2 will start the service, anyway.

So how many security products did you install on your host? If you're
only using some of them as only on-demand scanners, why not look at
using their online scanners? http://www.emsisoft.com/en/software/ax/ for
A2 but many other AV vendors have online detect-only scanners. They
still require installing a client, like an ActiveX control, that
downloads their newest signatures, but it only does a scan and nothing
of it is running before or after the scan. Of course, that also means
any currently active malware could deter, affect, or corrupt their
client regarding the detection and eradication of the pest. Many online
scanners only tell you about a pest and won't get rid of it since the
full client isn't running on your host; however, unless they say you are
infected then you don't need their full client. The detection rate is
the same (but doesn't do the cleanup provided by the full client).
That's about as quiescent a *scanner* as you can get when not using it.

A word of caution about using online scanners: use an install monitor to
record their changes. The prevalent majority of online scanner provide
no uninstaller. They install a small detect-only client on your host
either as an app or browser add-on (AX for Internet Explorer). I've
found way too many browser helpers, add-ons, AX controls, or even helper
apps (clients) don't add an entry to the Add/Remove Programs applet (no
entry under the Uninstall registry key) so you're stuck with them unless
you used something to record their installation that you can then later
use to eradicate them. I use Zsoft Uninstaller (free). There are
payware uninstall tools, too, that will monitor installations (e.g.,
Revo Unintaller and Total Uninstaller). If you're using a 64-bit
version of Windows, make sure you use an uninstaller that supports it
(Zsoft is too old and Revo free is an old version that doesn't support
Win x64).