HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

Key: "Y" - Normally leave to run at start-up "N" - Not required - typically infrequently used tasks that can be started manually if necessary "U" - User's choice - depends whether a user deems it necessary "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs" "?" - Unknown

	Startup Name	Process Name	Details
U	LoadBtnHnd	BtnHnd.exe	Fujitsu Siemens Lifebook laptops have some buttons on the case that can be programmed to execute specified programs (like hotkeys). The buttons can also be used as a combination lock input
X	LoadDBackUp	BcTool.exe	"Added by the GIBE WORM!"
X	loaddll	loaddll.exe	"Winvest spyware"
X	loaddr	[path to trojan]	"Added by the AGENT-DIY TROJAN!"
Y	LoadDvpApi9x	DVPAPI9X.exe	Command AntiVirus for Windows 95/98/Me
X	loader	loader.exe	"Homepage hijacker
X	loader	WMPLAYER.EXE	Unknown baddie - WMPLAYER.EXE is stored in the location and uses the same name as Windows Media Player but that valid Windows program doesn't load at startup
X	loader32	sys*****.exe [***** = random digit]	"Added by the DOMCOM TROJAN!"
X	loader32	Loader32.exe	Added by an unidentified TROJAN!
X	Loaders	HeIp.exe	"Added by the SDBOT-ADB WORM!"
X	loadfax	loadfax.exe	"Added by the WINFLUX-C TROJAN!"
X	LoadFonts	LoadFonts.vbs	Homepage hijacker that changes your homepage to an adult content site
X	LoadFonts	Tahoma.vbs	Homepage hijacker that changes your homepage to an adult content site
U	LoadFujitsuQuickTouch	QuickTouch.exe	Maps the keys on a Fujitsu Siemens Lifebook application panel to various programs and functions
X	LoadGolfCourses	LoadGolfCourses.exe	PlayMiniGolf.com foistware - stealth installed!
X	Loadhg	rundll32.exe	"Added by the LINEAG-ABX TROJAN!"
X	LoadHTML	"rundll32.exe regsvr32.exe	MShtmpre"
X	LoadingAgent	ZipLoader32.exe	"Added by the OBLIVION TROJAN! This executable is one of the most common but there are more"
X	LoadingAgent	msload32.exe	"Added by the OBLIVION TROJAN! This executable is one of the most common but there are more"
X	LoadManager	msload.exe	"Added by the OPASERV.T WORM!"
X	loadMecq0	explorer.exe	"Added by the MUMUBOY.C TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %ProgramFiles%"
X	loadMecq3	rundll32.exe	"Added by the LEGMIR-AS TROJAN! Note - this is not the legitimate rundll32.exe process
X	loadMect1	explorer.exe	"Added by the LINEAGE-L TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %ProgramFiles%"
X	loadMefs	rundll32.exe	"Added by the LEGMIR-JB TROJAN! Note - this is not the legitimate rundll32.exe process
X	loadMefs	smss32.exe	"Added by the FLOOD-EL TROJAN!"
N	LoadMSvcmm	msvcmm32.exe	"Auto-update for Movielink - internet movie rental System Tray access"
X	LoadOrderVerification	[random filename]	"Added by the TRON.A TROJAN!"
U	Loadout Manager	nost_LM.exe	"Manager for the Belkin Nostromo n50 SpeedPad game controller - see here"
X	LoadPFW	wmimgr.exe	"Added by the QEDS-B WORM!"
X	LoadPowerProfile	ASDAPI.EXE	"Added by the CABRO TROJAN! Not to be confused with the valid LoadPowerProfile entry where the command is Rundll32.exe powrprof.dll"
U	LoadPowerProfile	Rundll32.exe powrprof.dll	"Power management specifics such as monitor shut-off
X	LoadPowerProfile	Rundll.exe powerprof.dll	"Added by the LOXOSCAM TROJAN! Note - do not confuse with the valid LoadPowerProfile entry! Notice that the infected version uses ""Rundll.exe"" whereas the uninfected version uses ""Rundll32.exe"""
X	LoadPowerProfile	rundl.exe	"Added by the TOFAZZOL TROJAN! Not to be confused with the valid LoadPowerProfile entry where the command is Rundll32.exe powrprof.dll"
X	LoadPowerProfile	Rundll32.exe	"Added by the MIROOT WORM! Note - do not confuse with the valid LoadPowerProfile entry which has ""powrprof.dll"" appended to the command/data line"
X	LoadPowerScheme	rundll32.exe powerprof.dll CheckPowerProfile	"Ulubione adult content dialer. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
U	LoadQM	loadqm.exe	"Installed with MSN Explorer and loads the MSN Queue Manager. Required to enable the WU AutoUpdate feature. Note that disabling this can sometimes prevent internet sharing working on Win2K Pro SP2. Reports also suggest that removing it will re-enable internet access - hence the ""users choice"" recommendation. If you have problems leave it
X	loads.exe	loads.exe	"MediaMotor adware"
X	loads.exe	medload.exe	"Medload adware"
X	loads.exe	suploads.exe	"Added by the AGENT-BZ TROJAN!"
X	LoadService	Rest In Peace	"Added by the KANGAROO-A WORM!"
X	LoadService	"Maaf	tempatmu bukan di sin"
X	LoadService	Virus	"Added by the CAGER.A WORM!"
X	LoadSIPS	"rundll32.exe SIPSPI32.dll	SIPSPI32"
?	LoadWatcher	Test.exe	"Reportedly part of a webcam surveillance program that's supposed to test SMTP dialling in the event of an alert? Is this correct?"
X	LoadWatcher	watcher.exe	"Watcher spyware"
X	loadwin	winset.exe	"Added by the QQPASS-I TROJAN!"
X	loadwin	winsys.exe	"Added by the QQPASS-J TROJAN!"
X	LoadWindowsFile	Kernel32.exe	"Added by the DELF.B TROJAN!"
X	LoadWindowsFile	winreg.exe	"Added by the HUPIGON.A BACKDOOR!"
X	Local Area Network	OpenGL.exe	"Added by a variant of the RBOT WORM!"
X	Local Authority Service	lsass.exe	"Added by the MARKTMAN-C TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Local Internet Connection	LIC.exe	"Added by the SDBOT-YA WORM!"
X	LOCAL INTERNET WEB DRIVERS FOR WIN32	phqghume.exe	"Added by a variant of the RBOT WORM!"
X	Local Page	http://find.naupoint.com	"Naupoint browser hijacker"
X	Local runole service	srvc32.exe	"Added by the SMALL-DP TROJAN!"
X	Local Security Authority Servce	lssas.exe	"Added by the POEBOT-T WORM!"
X	Local Security Authority Service	lssas.exe	"Added by the POEBOT-J WORM!"
X	Local Security Authority Service	Isass.exe	"Added by the LINKBOT.M WORM!"
X	Local Service	Intenat.exe	"Added by the NUCLEAR-J TROJAN!"
X	Local Service	services.exe	"Added by the P2PWORM-T WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Cursors"
X	Local-Settings-of-[User Name]	[User Name].exe	"Added by the GAVGENT.A WORM!"
U	LocalProxy	proxy4free.exe	"""ProxyTools is a package of Perl network utilities designed mainly to assist those whose Internet access is censored
X	LocalSystem	svchost.exe	"EHU adware. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	Locator Service	[filename]	"Added by the AGOBOT-KY TROJAN!"
U	Lock My PC	lockpc.exe	"Lock My PC - a tool for quick computer locking when you leave it unattended. It shows a lock screen
X	lofgyh	lofgyh.exe	"Added by the SDBOT-TP WORM!"
U	Logan_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX-4500 Series multifunction printer
X	logg	logo_1.exe	"Added by the PWFUZZ-A WORM!"
X	Logical Disk Detection	mrisvc.exe	"Added by the IRCBOT.AOW BACKDOOR!"
N	Logiciel de transfert d'images KODAK	pts.exe	Looks for Kodak camera connection and media insertion. Available via Start -> Programs
U	Login	winlog.exe	"Salfeld Child Control - parental control software"
X	login	[path to trojan]	"Added by the HOTWORD-A TROJAN!"
X	Login	Login.exe	"Added by the BANCBAN-AH TROJAN!"
X	Login	lala.exe	"Added by the BUGSPR-A TROJAN!"
X	Login Screen Saver	login.scr	"Added by the RBOT-AVN WORM!"
X	Login Service	[path to file]	"Added by the MIGMAF TROJAN!"
X	LoginPassport	Lgnpsp32.exe	"Added by the REDIST.C WORM!"
X	loginui32	loginui32.exe	"Added by the LONGNU.A TROJAN!"
X	Logitech	Logitech.exe	"Added by the RBOT.BJH WORM!"
Y	Logitech	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
N	Logitech . Product Registration	eReg.exe	"Registration reminder from Leader Technologies for Logitech software such as SetPoint for their range of wired and wireless keyboards and pointing devices (mice
U	Logitech BT Wizard	LBTWiz.exe	"Bluetooth connection manager for Logitech based bluetooth wireless products"
X	Logitech Camera	Soundcane.exe	"Added by the SDBOT.MUC WORM!"
?	Logitech Camera Software	ElkCtrl.exe	Entry added when you install versions of the Logitech QuickCam webcam software. It's exact purpose is unknown at the present time
U	Logitech ClickSmart	ISStart.exe	"Installed with Logitech's QuickSmart webcam software. The exact purpose of this startup entry is unknown at present
U	Logitech ClickSmart	LogiTray.exe	"System Tray access to My Logitech Pictures
U	Logitech ClickSmart	LVCOMS.EXE	Entry added when you install Logitech ClickSmart webcam software. It allows the camera to be accessed by both the Logitech software and (amongst others) NetMeeting and Windows Movie Maker. If you don't use the camera on a daily basis create your own shortcut and run it manually when required
X	Logitech Desktop	ApPache.exe	"Added by the RBOT-YP WORM!"
X	Logitech Desktop	IPCONN.EXE	"Added by the SDBOT-WE WORM!"
X	Logitech Desktop Controller	wrcam.exe	"Added by a variant of the RBOT WORM!"
N	Logitech Desktop Messenger	setup-8876480.exe	"Installer for Logitech Desktop Messenger included with older versions of the software for Logitech products - which automatically checks for software upgrades and new products
N	Logitech Desktop Messenger	ldmconf.exe	"Installed with older versions of the software for Logitech products. Configures the options for Logitech Desktop Messenger to activate notifications about software upgrades and/or new products
N	Logitech Desktop Messenger	LogitechDesktopMessenger.exe	"Installed with the software for Logitech products. Automatically checks for software upgrades and new products
N	Logitech Desktop Messenger Agent	ldmconf.exe	"Installed with older versions of the software for Logitech products. Configures the options for Logitech Desktop Messenger to activate notifications about software upgrades and/or new products
N	Logitech Gaming Software	LWEMon.exe	Part of Logitech Gaming Software (formerly Wingman Software) for their range of game controllers. Starts the profiler (button configuration) and loads the last used profile at start-up - including System Tray access. Unless you're a hard-core gamer it's best to leave it disabled and load when needed
U	Logitech Hardware Abstraction Layer	KHALMNPR.EXE	"Part of Logitech's SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice
U	Logitech Harmony Remote	HarmonyClient.exe	"Logitech
U	Logitech Harmony Remote Software 7	HARMON~1.EXE	"Logitech
U	Logitech ImageStudio	ISStart.exe	"Installed with Logitech's ImageStudio webcam software. The exact purpose of this startup entry is unknown at present
U	Logitech ImageStudio	LogiTray.exe	"System Tray access to ImageStudio
U	Logitech ImageStudio	LVCOMS.EXE	Entry added when you install Logitech ImageStudio webcam software. It allows the camera to be accessed by both the Logitech software and (amongst others) NetMeeting and Windows Movie Maker. If you don't use the camera on a daily basis create your own shortcut and run it manually when required
U	Logitech QuickCam	CameraAssistant.exe	"Entry added when you install versions of the Logitech QuickCam webcam software and used to configure and tweak your webcam settings. Includes support for the Quick Assistant - which launches when a video application (such as video conferencing in an instant messaging client) accesses to camera so you can quickly fine tune face tracking and zoom
U	Logitech QuickCam	ISStart.exe	"Installed with older versions of Logitech's QuickCam webcam software. The exact purpose of this startup entry is unknown at present
U	Logitech QuickCam	LogiTray.exe	"System Tray access to My Logitech Pictures
U	Logitech QuickCam	LVCOMS.EXE	Entry added when you install older versions of Logitech QuickCam webcam software. It allows the camera to be accessed by both the Logitech software and (amongst others) NetMeeting and Windows Movie Maker. If you don't use the camera on a daily basis create your own shortcut and run it manually when required
U	Logitech QuickCam	LVComSX.exe	Entry added when you install versions of the Logitech QuickCam webcam software - allows the full camera features (such as face tracking) to be accessed by both the Logitech software and (amongst others) NetMeeting and Windows Movie Maker. If you don't use the camera on a daily basis create your own shortcut and run it manually when required
N	Logitech QuickCam	ManifestEngine.exe	"Automatic updater for versions of Logitech QuickCam webcam software. Check for updates via the System Tray icon - see the LogitechVideoTray entry"
U	Logitech SetPoint	KEM.exe	Keyboard and mouse drivers and utilities for Logitech's latest products - supersedes iTouch and MouseWare on their older products. Required if you use special features such as multimedia keys
U	Logitech SetPoint	KHALMNPR.EXE	"Part of Logitech's SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice
U	Logitech SetPoint	Setpoint.exe	"Logitech SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice
U	Logitech Utility	Logi_MwX.exe	"Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as ""SmartMove"". If you disable it and find you don't need it leave it disabled"
N	Logitech Vid	Vid.exe	"""Logitech Vid™ is the fast
N	Logitech Wakeup	lgwakeup.exe	Loads at startup and monitors the scanner. When a document is inserted in the scanner the wakeup program feeds the document a fraction of a inch into the scanner and then it launches the control center software. From the control center you can select whether to fax or copy or print the scanned documents. If you uncheck the Logitech wakeup software from the startup it no longer launches the control center or feeds the document a fraction of an inch. You can manually launch the control center software via Start ->Programs and still be able to scan images
X	Logitech Wireless	logitechwls.exe	"Added by the MYTOB-BS WORM!"
U	LogitechCameraAssistant	CameraAssistant.exe	"Entry added when you install versions of the Logitech QuickCam webcam software and used to configure and tweak your webcam settings. Includes support for the Quick Assistant - which launches when a video application (such as video conferencing in an instant messaging client) accesses to camera so you can quickly fine tune face tracking and zoom
?	LogitechCameraService(E)	ElkCtrl.exe	Entry added when you install versions of the Logitech QuickCam webcam software. It's exact purpose is unknown at the present time
Y	LogitechCommunicationsManager	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
N	LogitechDesktopMessenger	LogitechDesktopMessenger.exe	"Installed with the software for Logitech products. Automatically checks for software upgrades and new products
U	LogitechGalleryRepair	ISStart.exe	"Installed with Logitech's ImageStudio webcam software. The exact purpose of this startup entry is unknown at present
U	LogitechImageStudioTray	LogiTray.exe	"System Tray access to ImageStudio
N	LogitechQuickCamRibbon	QuickCam10.exe	"Loads versions of the Logitech QuickCam webcam software and is required to support features such as face tracking. If enabled
N	LogitechQuickCamRibbon	LWS.exe	"Loads versions of the Logitech Webcam Software and is required to support features such as face tracking. If enabled
N	LogitechQuickCamRibbon	Quickcam.exe	"Loads versions of the Logitech QuickCam webcam software and is required to support features such as face tracking. If enabled
Y	LogitechRegisterVideoApplications	InstallHelper.exe	Entry added when you install versions of the Logitech QuickCam webcam software and used to register video applications that can use the webcam on the first reboot after installing the software
X	Logitechs	Logitechs.exe	"Added by the SDBOT.BWE WORM!"
N	LogitechSoftwareUpdate	ManifestEngine.exe	"Automatic updater for versions of Logitech QuickCam webcam software. Check for updates via the System Tray icon - see the LogitechVideoTray entry"
U	LogitechVideoRepair	ISStart.exe	"Installed with Logitech's QuickSmart and QuickCam (older versions) webcam software. The exact purpose of this startup entry is unknown at present
U	LogitechVideoTray	LogiTray.exe	"System Tray access to My Logitech Pictures
U	LogitechVideo[inspector]	InstallHelper.exe	Entry added when you install versions of the Logitech QuickCam webcam software and used to monitor and register video applications that can use the webcam. It isn't normally running but you could disable it and re-enable it before you install supported applications
U	LogiTray	LogiTray.exe	"System Tray access to My Logitech Pictures
U	Logi_MwX	Logi_MwX.exe	"Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as ""SmartMove"". If you disable it and find you don't need it leave it disabled"
U	LogMeIn GUI	LogMeInSystray.exe	"RemotelyAnywhere is a remote administration and remote control solution for Windows. It allows access to the host computer via the network (the LAN
U	LogMeIn GUI	ragui.exe	"RemotelyAnywhere is a remote administration and remote control solution for Windows. It allows access to the host computer via the network (the LAN
X	Logo	[path to trojan]	"Added by the DLOADER-RH TROJAN!"
Y	Logoff	SCTUINotify.exe	"Part of Windows SteadyState
U	Logon Loader	LogonLoader.exe	"Logon Loader - customize boot & login screens"
U	Logon Loader Random	LogonLoader.exe	"Logon Loader - customize boot & login screens"
X	Logon.exe	logon.exe	"Added by the ZINS.A TROJAN!"
X	Logon	CSRSS.EXE	"Added by the BRONTOK-BH WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X	LogonAdministrator	imoet.exe	"Added by the RAHIWI.A WORM!"
X	LogonAdministrator	CSRSS.EXE	"Added by the KORRON.B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
U	LogOnHook	LogOnHook.exe	"Part of McAfee Data Backup (now Online Backup) - which ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection. The exact purpose of this entry is unknown at present but it unloads after startup"
X	Logonrepclient1	CSRSS.EXE	"Added by the BRONTOK-BT WORM and variants! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X	Logonsara	csrss.exe	"Added by the BRONTOK-BS WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
U	LogonStudio	logonstudio.exe	"WinCustomize LogonStudio - "Allows Windows XP users to edit
X	logonUiInit	Rundll32.exe rgtndz.dll	"Identified as a variant of the Trojan-Clicker.Win32.Agent.bqy malware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""rgtndz.dll"" file is found in %System%"
X	LogService	wincalc.exe	"Added by the PAPROXY TROJAN!"
X	LogService	lsass.exe	"Added by the BDOOR-IU BACKDOOR! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	LogService	lsrss.exe	"Added by the PAPROXY-D TROJAN!"
U	LogService	LogService.exe	"SmartKeylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
U	LogWatch	logwat95.exe	Licensing patch for products installed on NT by Computer Associates such as eTrust. Detects and updates old versions of lic98.dll. Not required if you already have a newer version or the patch has been applied
X	lololol	_hideme_imhiddenlololol.exe	"Added by the HIDEME-A TROJAN!"
X	longos	WIWT.EXE	"Added by the BANKER-CD TROJAN!"
Y	Look 'n' Stop	looknstop.exe	"Look 'n' Stop personal firewall"
N	LookNMeet	Agent.exe	"LooknMeet dating service"
X	Lookup_Sys	lookupsys.exe	P04n trojan
X	LosMejoresMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	LotsOfGames	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	LotsOfJokes	"rundll32.exe MSA64CHK.dll	DllMostrar"
N	Lotus Organizer EasyClip	easyclip.exe	""The Easy Clip icon automates the collection of information from sources such as e-mail to create an Organizer address
N	Lotus QuickStart	smartctr.exe	"Lotus central application
U	Lotus SuiteStart	suitest.exe	Puts the individual Lotus components in the system tray taskbar when you start Windows. Can be disabled via MSCONFIG -> Startup as "Lotus SuiteStart 97 Edition". All individual components available via Start -> Programs
X	LotusHlp	LotusHlp.exe	"Added by the WINKO.AO WORM!"
X	LOVE	LOVE.EXE	"Added by the VB-ZQ TROJAN!"
X	LoveHebeA	vistaAA.exe	"Added by the LOZAVITA TROJAN!"
N	LowRateVoip	LowRateVoip.exe	"LowRateVoip - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X	LowRiskFileTypes	sysguard.exe	"Added by the FAKEAV-UY TROJAN!"
X	LowVersionSupport	[filename]	"Added by the LASTRAS TROJAN!"
U	LPMailChecker	LPMLCHK.exe	"Part of Lenovo's ThinkVantage® Productivity Center on their ThinkPad notebooks or ThinkCentre desktops. Checks for incoming e-mail and blinks the ThinkVantage button LED"
U	LPManager	LPMGR.exe	"Part of Lenovo's (was IBM) ThinkVantage Productivity Center - ""guides you to a host of information and tools to help you set up
X	Lpr	Lpr123.exe	"Added by the REMPSTEAL password stealer TROJAN!"
X	Lpr123	Lpr123.exe	"Added by the REMPSTEAL password stealer TROJAN!"
U	LPS	Lps.exe	"Local Port Scanner - ""With LPS you're able to check your computer for open or listening ports"""
U	LPtask	lptask.exe	"Program Lock It And Protect Pro - lock and protect your folders from being opened
X	LRBZ Utility 32	lrbz32.exe	"Added by the AGOBOT-JQ WORM!"
N	LS120 Superdisk	??	"Supposed to accelerate transfer rate on LS-120
X	LSA	wfdmgr.exe	"Added by the MYTOB.C WORM!"
X	LSA	lsa.exe	"Added by the SDBOT-YV WORM!"
X	LSA	msdn.exe	Added by an unidentified malware
X	LSA Service	LSASS.exe	"Added by the AHKER.G WORM! Note - this is not the legitimate lsass.exe process
X	lsa Services	lsa2srv.exe	"Added by the TAME-C WORM!"
X	LSA Shell (Export Version)	LSASS.exe	"Added by the AHKER.K WORM and variants. Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	LSA Shellu	lsass.exe	"Added by the AUTORUN-CW WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%"
X	LsaManager	lsamgr.exe	"Added by the BEAGLE.DR WORM!"
X	lsas	lsas.exe	"Added by the BIGFAIRY-C WORM!"
X	LSAShell	lsass.exe	"Added by the DAPROSY WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	lsass	lsass.exe	"Added by the RATSOU.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Debug\UserMode"
X	lsass	start.bat	"Added by the ZCREW TROJAN!"
X	lsass	[path to lsass.exe]	"Added by the ALADINZ.F TROJAN! Note - this is not the legitimate lasss.exe process which should NOT appear in Msconfig/Startup!"
X	lsass	lsasrv.exe	"Added by the MYDOOM.AG or MYDOOM.AS or MYDOOM.AU WORMS!"
X	Lsass	woekd.exe	Added by an unidentified WORM or TROJAN!
X	lsass	elite***32.exe	"EliteBar adware"
X	Lsass	Lsass.exe	"Added by the ALCOP-B WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Lsass	Lsass.exe	"Added by the VOUMIT-A WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Root%\mirc32"
X	LsasS	Sygate.exe	"Added by the SDBOT.BCA WORM!"
X	Lsass	kavmm.exe	"Added by an unidentified WORM or TROJAN! NOTE - do NOT confuse with the legitimate Kaspersky antivirus module as described here. Contrary to this impostor
X	Lsass	LSASS.EXE	"Added by the PUNYA-B WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %AppData%"
X	LSASS 32	ISASS32.pif	"Added by the ASSIRAL-C WORM!"
X	Lsass 32 Manager	lsass32.exe	"Added by the SDBOT.EOG WORM!"
X	lsass 32-biT	lsass32.exe	"Added by the RBOT.QGC WORM!"
X	LSASS Authority	lshosts32.exe	"Added by the SDBOT-UY TROJAN!"
X	LSASS Authority	lsvhosts.exe	"Added by the SDBOT.BCE WORM!"
X	LSASS Daemon	LSASSd.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	lsass service	lsass2.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	lsass16	lsass16.exe	"Added by the BANKER-BXX TROJAN!"
X	lsass2k Update	lsass2k.exe	"Added by a variant of the RBOT WORM!"
X	LSASS32	Isass32.exe	"Added by the KELVIR.M WORM!"
X	lsass32	lsass32.exe	"Added by the LYDRA-B TROJAN!"
X	lsass64BiT.exe	lsass64BiT.exe	"Added by the FORBOT-CK WORM!"
X	lsassig	lsassig.exe	"Added by the BANCOS-EC TROJAN!"
X	lsasss	lsasss.exe	"Added by the GEEKMY-A TROJAN!"
X	lsasss.exe	lsasss.exe	"Added by the SASSER.E WORM!"
Y	lsburnwatcher	lsburnwatcher.exe	"HP software which helps one create labels after a music CD is burned using LightScribe discs. If you want to use LightScribe labeling
Y	LSBWatcher	lsburnwatcher.exe	"HP software which helps one create labels after a music CD is burned using LightScribe discs. If you want to use LightScribe labeling
X	lsess	lsess.exe	"Added by the SINNAKA.A WORM!"
X	lsmass	lsmass.exe	"Added by the WALLOP-B TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.

Powered By Pac's Startup list