NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

• "Y" - Normally leave to run at start-up
• "N" - Not required - typically infrequently used tasks that can be started manually if necessary
• "U" - User's choice - depends whether a user deems it necessary
• "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
• "?" - Unknown

	Startup Name	Process Name	Details
X		pathex.exe	"Added by the MKMOOSE-A WORM! Note - has a blank entry under the Startup Item/Name field"
	Note the filename has a ""0"" rather than an upper case ""o"""
Inc."	"Microsoft Associates	X	iexplorer.exe
Inc."	"Microsoft NetMeeting Associates	X	NetMeeting.exe
Version	"NVIDIA Compatible Windows Vista Display driver	U	"RUNDLL32.EXE NvCpl.dll
Version	"NVIDIA Compatible Windows7 Display driver	U	"RUNDLL32.EXE NvCpl.dll
X	$WindowsRegKey%update	IEXPLORE.EXE	"Added by the RBOT-EZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	%Temp%	%Temp%delwdef2008.bat	"WinDefender 2008 rogue privacy program - not recommended
X	(default)	"rundll32.exe [path to DLL file]	Do98Work"
X	(Default)	QQUpdate.exe	"Added by the QUADRULE.A WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	msnupdate.exe	"Added by the RBOT-GWT BACKDOOR! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run & HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	*Microsoft Update	ctxma.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	cxma.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wstcl.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wucxt.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wuytc.exe	"Added by the STMU TROJAN!"
Y	*StateMgr	statemgr.exe	Windows ME default for System Restore. Do NOT disable!
X	*windows update	wrauclt.exe	"Added by the RBOT-QU WORM!"
X	*windows update	wuanclt.exe	"Added by the RBOT-PG WORM!"
X	*windows update	wuaucrlt.exe	"Added by the SPYBOT.HUR WORM!"
X	*windows update	wuraclt.exe	"Added by the RBOT-PO WORM!"
X	*windows update	wurauclt.exe	"Added by the RBOT-SY WORM!"
X	*windows update	wsctl.exe	"Added by the SPYBOT.PR WORM!"
X	*windows update	wkmst.exe	"Added by the SDBOT.AVD WORM!"
X	*windows update	wscxt.exe	"Added by the RBOT.AOS WORM!"
X	*windows update	waurclt.exe	"Added by a variant of the RBOT WORM!"
X	*windows update	wuaruclt.exe	"Added by the RBOT-TF WORM!"
X	*WinLogon	[trojan path] ren time:[random number]	"Added by the VUNDO TROJAN!"
X	*winstats	winstats.exe	"Added by the GARGAFX TROJAN!"
X	.msfupdate	msveup.exe	"Added by the ALLOCUP.A WORM!"
X	1	KHATRA.exe	"Added by the AUTOIT-BP WORM!"
X	180ClientStubInstall	[path to trojan]	"180Solutions adware related"
X	2k6 updatz	crss3.exe	"Added by the RBOT-CPD WORM!"
X	2thousandbuck	[path to file]	"Added by the RANKY.L TROJAN!"
X	3.8853E+11	AutomaticUpdates.exe	"Added by the SDBOT-DEN WORM!"
X	360antiarp	[path to trojan]	"Added by the PASTA.AIB TROJAN!"
X	4wd!!!	Natal!.pif	"Added by the OPASERV.AI WORM!"
X	5-megawati	megawati.exe	"Added by the BRONTOK-CR WORM!"
X	5p4m	[path to trojan]	"Added by the LITEBOT-C TROJAN!"
U	802.11g Wireless Adatper	Monitor.exe	"Related to wireless card (802.11) adapter/standard. System Tray icon that provides a shortcut to ""Wireless Connection Status"" and allows to turn WL on and off. Supplier unknown. Adapter is miss-spelled"
N	@Hoc Toolbar	AtHoc.exe	"One-click activated browsing toolbar used by various web-sites. See here for more info"
X	A New Windows Updater	w32NTupdt.exe	"Added by the MYTOB.BM WORM!"
X	a9z1eizA1e	atulabov.exe	"Added by the AGENT-GWD TROJAN!"
X	aa bbcc dde effgghh jj	update.exe	"Added by a variant of the IRCBOT BACKDOOR!"
N	AAATraySaver	TraySaver.exe	"System Tray management utility from Mike Lin which allows you to hide
X	aaprotect	[path to trojan]	"Added by the BANCBAN-MJ TROJAN!"
?	aauclient	ACNUpdater.exe	"Appears to be related to software from Accenture.com"
X	ACCDEFRAGINFO	[path to worm]	"Added by the DARBY-O WORM!"
U	Accelerate	accelerate.exe	Webroot Accelerate - allows you to optimize Windows network registry settings in order to boost surfing speeds. Leave this enabled if you find it improves your connection
X	Access WebControl	[path to file]	"Added by the PPDOOR-M TROJAN!"
N	AccuWeather.comŽ Desktop	AccuWeatherDesktop.exe	"Desktop weather from AccuWeather"
N	AccuWeatherDesktopAlerts	AccuWeatherDesktopAlerts.exe	"Weather alerts for AccuWeather.com Desktop which ""provides you with the most accurate
N	AceGain LiveUpdate	LiveUpdate.exe	"""AceGain LiveUpdate can help to automate and optimize product updates. AceGain LiveUpdate will automatically detect new patch updates
U	Acer ePresentation HPD	ePresentation.exe	"Part of Acer Empowering Technology. Allows you to manage both internal and external displays"
N	Acer Product Registration	ACE1.exe	Acer Product Registration - remove when registration is completed
X	Acrobat	acrmon32.exe	"Added by the SMALL-ECT TROJAN!"
U	Acrobat Assistant	AcroTray.exe	"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
U	Acrobat Assistant 7.0	Acrotray.exe	"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
U	Acrobat Assistant 8.0	Acrotray.exe	"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
X	Acrobat Read	acroup32.exe	"Added by the VANBOT-BQ TROJAN!"
N	Acrobat Speed Launch	acrobat_sl.exe	"Speeds up the time it takes to load Adobe's Acrobat PDF creation and management tool. From version 7.0 onwards"
U	Acronis Popup Blocker	"RunDll32.exe [path] Blocker.dll	Run"
X	Acroread	GoogleUpdate.exe	"Added by the AGENT-JGI TROJAN! Note - this is not the valid Google program which is normally located in %AppData%\Google\Update. This version resides in %Temp%"
N	Activation	Activation.exe	Part of Microsoft Money
X	Active Bit Station	abs.exe	"Added by the MYTOB.BZ WORM!"
X	ActiveX File Registration Service	filereg.exe	"Added by the RBOT-DVD WORM!"
X	ActiveXUpdate	svcss.exe	"Added by a variant of the DEDLER.C TROJAN!"
X	Ad-Eliminator	ad-eliminator.exe	"Ad-Eliminator rogue spyware remover - not recommended
U	Ad-watch	Ad-watch.exe	"Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system"
X	AddClass	[Installation_Path]	"Added by the STARTPAGE.F hijacker"
X	AddClass	[path to trojan]	"Added by the SECDL-A TROJAN!"
X	AddrPlus3	[path] stup.exe [path] Adplus.dll Rundll32	"TCent adware"
X	Administrator	svchost.scr	"Added by the NOVACAL TROJAN!"
X	Administrator	winlogon.exe	"Added by the RUBBLE-C WORM! Note - this is not the legitimate winlogon.exe process
X	Administrator di Dago	Dago.exe	"Added by the PUNYA-B WORM!"
X	Adobe	sysbat32.exe	"Added by the LOWZONES.T TROJAN!"
N	Adobe Acrobat	READER~1.EXE	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
N	Adobe Acrobat	Reader_sl.exe	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
X	Adobe Acrobat Distiller Application	acrotray.exe	"Added by the RANDEX.DFJ WORM!"
X	Adobe Acrobat Reader CFG	[random filename]	"Added by a variant of the RBOT WORM!"
N	Adobe Acrobat Speed Launcher	acrobat_sl.exe	"Speeds up the time it takes to load Adobe's Acrobat PDF creation and management tool. From version 7.0 onwards"
X	Adobe Filter Platform	afilterplatform.exe	"Added by the RBOT-OP WORM!"
N	AdobeUpdater	AdobeUpdater.exe	Automatic updater for Adobe software - run manually
X	AdRoarUpdate	ARUpdate.exe	"AdRoar adware updater"
X	AdRotator.Application	[path to csrss.exe]	"Added by the SMALL-AQ TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	AdRotator.Application	services.exe	"FakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in an ""Inetsrv"" subfolder"
X	AdStatus Service	AdStatServ.exe	"WindUpdates AdStatus Service adware"
X	Adult_Chat	Adult_Chat.exe	Adult content dialler
X	Adult_Chat1	Adult_Chat1.exe	Adult content dialler
X	AdUpdater	sysupudt.exe	Unidentified adware downloader/updater
X	Advanced DHTML Enable	[path to trojan]	"Added by the AGENT.GLQ TROJAN!"
U	Advanced Uninstaller PRO Installation Monitor	monitor.exe	"Innovative Solutions Advanced Uninstaller PRO - ""easy-to-use suite for uninstalling applications and keeping your computer fast
X	advap32	[path to trojan]	"Added by the MUTANT.AT TROJAN!"
U	AEFltrs Application	AESTFltr.exe	"Part of the XP installation of the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
N	AeXAgentLogon	AeXAgentActivate.exe	"Altiris Agent transmits information about your machine for the purpose of asset management and deployment"
N	AGSatellite	AGSatellite.exe	Program from AudioGalaxy that lets you download some MP3s from their server. Available via Start -> Programs
X	AHU	[path to worm]	"Added by the ANACON-B WORM!"
Y	Aiptek Graphics Tablet (USB)	atwtusb.exe	USB interface for Aiptek Graphics Tablet (USB)
?	Air2Data	a2dservice.exe	"Related to the Air2Data Wireless HISA (High-Speed Internet Access) service. What does it do and is it required?"
U	AirPort Base Station Agent	APAgent.exe	"Airport Base Station Agent utility for Apple's AirPort wi-fi basestations. ""Wireless solution for home
?	AlarmWatcher	AlarmWatcher.exe	"Associated with SynTPEnh and SynTPLpr which are from Synaptics for touchpads on laptops. What does it do and is it required?"
X	AlexaToolbar	alt.exe	Identified by Ewido Security Suite (Ewido is now part of AVG Technologies) as the DELF.EB TROJAN!
?	ALFY Accellerator	AlfyAC~1.exe	"??"
U	All Aboard Status	stswin.exe	"All Aboard! Internet Connection Sharing status icon"
X	Allopassw	[path to trojan]	"Added by the RANKY.CU TROJAN!"
U	ALLTEL DSL Check-up Center	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	ALTER DATA	[path] repcale.exe [path] beird.exe	"Added by the IRCFLOOD.CD TROJAN! Both files are located in %System%\ccdew"
N	Aluria's Spyware Eliminator	ASE.exe	"Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU
X	amsgupdate	ams.exe	Added by a variant of the MAILBOT TROJAN!
?	AnnotateCheck	AnnCheck.exe	"Genius Wizard Pen Tablet driver related. Is it required?"
U	AnonymityGateway	Anonymity Gateway.exe	"Anonymity Gateway - privacy protection tool that conceals IP address preventing your surfing habits and your internet activity form being tracked by websites or Internet Service Providers"
X	ansjava	[path to worm]	"Added by the RANDON-AN WORM!"
U	Anti-Trojan-Watch	ATWatch.exe	Anti-Trojan Watch - trojan detector
X	Anti-Virus Update Scheduler	[path to trojan]	"Added by the SPAMMIT-A TROJAN!"
X	Anti-Virus Update Scheduler	winsp3.exe	"Malware - detected by Kaspersky as the AGENT.FP TROJAN!"
X	Anti-Virus Update Scheduler V1.39.12R	[path to trojan]	"Added by the HEPLANE or STAPREW.B TROJANS! - different filenames have been spotted; examples: msvc.exe
U	antidialer.co.uk	Dialer_Watcher.exe	"Dialer_Watcher is an application that allows you to detect dialers on your computer"
X	antike	wingate32.exe	"Added by a variant of the RBOT WORM! See here"
X	Antivirus Installer	[path to trojan]	"Added by the BADGENT-A TROJAN!"
X	AntiVirus Update	updates.exe	"Added by the RBOT-JF WORM!"
X	AntiVirus Update	antivirus.exe	"Added by the RBOT-IF WORM!"
X	Antivirus Updates	avupdchk.exe	"Added by the AGOBOT-IP WORM!"
X	anything	ATITAX.exe	"Added by the FORBOT-DP WORM!"
U	AnyTime	Atw.exe	"AnyTime Organizer Deluxe from Individual Software Inc - ""all the tools you need to organize your calendar
U	AnyTime Organizer	AtDem.exe	"AnyTime Organizer Deluxe from Individual Software Inc - ""all the tools you need to organize your calendar
U	AnyTime Organizer	Atw.exe	"AnyTime Organizer Deluxe from Individual Software Inc - ""all the tools you need to organize your calendar
U	AOL Broadband Check-Up	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	Aol Configuration Loader	aimsng.exe	"Added by the SDBOT-XE WORM!"
X	aolupdater.exe	aolupdater.exe	"Added by a variant of the IRCBOT TROJAN!"
Y	APC UPS Status	Display.exe	"APC PowerChute® Personal Edition status icon"
X	App.EXEName	[path to worm]	"Added by the BODIRU WORM!"
X	AppletINIT	INITIATE.EXE	"Added by the AGOBOT.XV TROJAN!"
Y	Application	mdmsetsp.exe	"Aztech Labs modem driver"
X	Application	csrss.exe	"Added by the BEAGLE.EG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Application Adapter	abvsvc.exe	"Added by the CHECKOUT WORM!"
U	Application Explorer	Naldesk.exe	"Novell Zenworks Application Explorer Executable. ""For almost all users the Novell ZENworks agent (either Application Launcher or Application Explorer) will be run via the user's login script on each successful login. ZENworks is used to periodically deliver software updates and is also used to install the remote management components."""
U	Application Explorer	NalView.exe	"Application Explorer - file manager type access to Novell Application Launcher for installing and updating network residing applications"
X	Application Explorer	appexplr.exe	"Added by the AGENT-NMO TROJAN!"
X	Application In System	Snxmsh.exe	"Added by the AGENT-LNV TROJAN!"
N	Application Launcher	Application Launcher.exe	"System Tray access to the Sony Ericsson PC Suite and HTC Sync mobile phone management utilities. Run manually via the Start Menu (or optional desktop shortcut) before connecting the phone"
X	Application Layer Browser	abgsvc.exe	"Added by the ULPM.FX TROJAN!"
X	Application Layer Gateway Service	algs.exe	"Added by the LINKBOT.M WORM!"
X	Application Layer Scheduler	agtsvc.exe	"Added by the IRCBOT.BJJ BACKDOOR!"
X	Application Layer Services	avrsvc.exe	"Added by the IRCBOT.BJM BACKDOOR!"
X	Application Manager	acnsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Application Manager	apnsvc.exe	"Added by the SMALLTRO.FN TROJAN!"
X	ApplicationProtocolRun	smsbvl32.exe	"Added by the IRCBOT-CX TROJAN!"
X	Aqujyjax	[path to file]	"Added by the RANCK-CQ TROJAN!"
X	ARCHIVE CONTROL	fixupdattr.exe	"Added by the MYTOB.GU WORM!"
X	Arman	[path to worm]	"Added by the IRCBOT-TG WORM!"
N	ashampoo UnInstaller Watcher	UIWatcher.exe	"Part of the Ashampoo® UnInstaller series from Ashampoo GmbH & Co. KG - including UnInstaller Platinum 2
U	ASK	rundll32.exe [path] ASK.dll rdl	"Stealth Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	ASP.NET State Service	csrss.exe	"Added by the DLOADER-QI TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	ASP.NET State Service	crsass.exe	"Added by the BANLOAD-M TROJAN!"
X	ASP.NET State Service	servicos..exe	"Added by the DADOBRA-I TROJAN!"
X	asrupdate.exe	asrupdate.exe	"Added by the VB.ATZ TROJAN!"
N	ASUS Live Update	ALU.exe	ASUS Live Update utility for their motherboards
U	asustweakenable	ATweak.exe	ASUS TweakEnable - restores manually changed settings for ASUS based video cards such as overclocking. Only required if you use non-standard settings
U	AT&T Self Support Tool	matcli.exe	"AT&T Resolution Assistant. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	AT-Watch	ATWatch.exe	Anti-Trojan Watch - trojan detector
X	atapidrv	atapidrv.exe	"Added by the AGOBOT-SL WORM!"
U	atchk	atchk.exe	"AMT Status Message from Intel. Users can manage this
X	atf.exe	pgs.exe	"Part of the PCSecureSystem rogue security software - not recommended. A member of the AVSystemCare family"
X	atf_reinstall	atf.exe	"Part of the AVSystemCare rogue security software - not recommended. See here"
U	Athan	Athan.exe	"Athan - an application that calculates and reminds the five daily Islamic prayer times for anywhere in the world"
U	ATI 2D Component	Ati2mdxx.exe	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. After testing it's exact function isn't known at this time and it doesn't appear to be running even with the startup entry enabled - hence the ""U"" recommendation"
X	ATI Active Graphics Card Monitor	atievx.exe	"Added by the IRCBOT-TL WORM!"
X	ATI AS Filter	msnse.exe	"Added by the RBOT-CCY WORM! Note - modifies the HOSTS file by appending numerous lines
N	ATI CATALYST System Tray	CLI.exe SystemTray	"System Tray access to ATI's Catalyst™ Control Center. Note that this has ""SystemTray"" appended to CLI.exe in the ""Command"" column of MSCONFIG. Not required to run the control center - which is available via a right-click on the desktop"
X	Ati Control Panel	atiphexx.EXE	"Added by the RBOT-BR WORM!"
X	ATI Cpanel	atiphexx.exe	"Added by the AGOBOT-NV WORM!"
U	ATI Desktop Component	ATIPTAXX.EXE	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. Provides System Tray access to display settings (including desktop resolution
N	ATI DeviceDetect	ATIDtct.EXE	Utility meant for future use of the ATI TV WONDER USB 2.0 video driver and can be disabled
X	ATI Display	ATIDisplay.exe	"Added by the BDOOR-AFH BACKDOOR!"
X	ATI Display Driver	atixd.exe	"Added by the RBOT-FOV WORM!"
X	Ati Display Settings	atividx.exe	"Added by the RBOT-GAS WORM!"
N	ATI GART Set-up Utility	Atigart.exe	"Program that checks the motherboard chipset and determines which GART driver bundle to install on ATI video cards. If you have one
U	ATI Launchpad	launchpd.exe	"Convenient way to start all your Multimedia Center applications (DVD
X	ATI Rage3d Pro	AtiRage4dPro.exe	"Added by the AGOBOT-OG WORM!"
Y	ATI Remote Control	ATIRW.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
Y	ATI Remote Control	ATIX10.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
N	ATI Scheduler	Atisched.exe	Component that remains resident in memory and automatically launches the ATI VIDEO PLAYER at a user selected time and date. Delete the shortcut in the Start -> Programs -> Startup folder as well. Functions could re-enable the program to load at start-up and re-introduce the shortcut. Try it and see
N	ATI Task Application	Atitkad.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display
N	ATI Task Application (Atikey)	Atitask.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display
U	ATI Technologies Inc. HydraVision Desktop Manager	HydraDM.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is the HYDRAVISION Desktop Manager - which ""customizes the behaviour of windows and dialog boxes
U	ATI Technologies Inc. HydraVision Viewport	HydraMD.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is HYDRAVISION MultiDesk - which ""creates
X	ATI Technology Startup	techstart.exe	"Added by the RBOT-AEU WORM!"
X	ATI Video Driver Control	atigfx.exe	"Added by the RBOT-FWL WORM!"
X	ATI Video Driver Control	btorrent.exe	"Added by a variant of the IRCBOT TROJAN!"
X	ATI Video Driver Controls	[path to worm]	"Added by the SDBOT-DDS WORM!"
X	ATI VIDEO REGKEY	ati2vid.exe	"Added by the SDBOT.UR WORM!"
?	Ati2cwxx	Ati2cwxx.exe	"For some ATI video cards. Probably used to access features and may not be required - for example the ATI Radeon works fine without it"
X	Ati2evxx	Ati2evxx.com	Added by the BACKDOOR-CPC TROJAN!
X	ati2f104	ati2f104.exe	"Added by the DLOADR-BBW TROJAN!"
U	Ati2mdxx	Ati2mdxx.exe	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. After testing it's exact function isn't known at this time and it doesn't appear to be running even with the startup entry enabled - hence the ""U"" recommendation"
N	ATICCC	cli.exe runtime	"ATI's Catalyst™ CONTROL CENTER. Required if you want to change graphics settings on a regular basis but you must have internet access and Microsoft's .NET framework installed. Note that this has ""runtime"" appended to cli.exe in the ""Command"" column of MSCONFIG. Recommend that start the program manually via Start → Programs → ATI Catalyst Control Center → Advanced → Restart Runtime as it can cause problems when starting Windows"
N	ATICCC	CLIStart.exe	Puts the ATI Catalyst™ Control Center Icon/Shortcut on the System Tray - available via Start → Programs
X	AtiCpanel	atiphexx.exe	"Added by the AGOBOT.IL WORM!"
X	aticpaxx.exe	aticpaxx.exe	"Added by the RBOT-XP WORM!"
U	AtiCwd	AtiCwd.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
U	AtiCwd	AtiCwd32.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
U	AtiCwd	Ati2cwad.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
U	AtiCwd32	AtiCwd.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
U	AtiCwd32	AtiCwd32.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
U	AtiCwd32	Ati2cwad.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
X	AtiDisplayDrv	atidrvxx.exe	"Added by the RBOT-VZ WORM!"
X	atidriver	reaIplayer.exe	"Added by the WARPIGS-E WORM! Note the uppercase ""I"" in the filename
N	AtiGart	Atigart.exe	"Program that checks the motherboard chipset and determines which GART driver bundle to install on ATI video cards. If you have one
N	AtiKey	AtiKey32.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display
N	AtiKey	atiptkad.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Control Panel → Display
N	Atikey	Atitask.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display
U	ATIMACE	MACE.exe	ATI Technologies Control Centre - installed alongside ATI graphics hardware and provides additional configuration options for these devices in the Managed Access to Catalyst™ Environment (MACE) component
U	ATIModeChange	Ati2mdxx.exe	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. After testing it's exact function isn't known at this time and it doesn't appear to be running even with the startup entry enabled - hence the ""U"" recommendation"
X	AtiPanel	atip.exe	"Added by the TACTSLAY.U TROJAN!"
X	atipatxx	atipatxx.exe	"Added by the SMALL-ED TROJAN!"
N	ATIPOLAB	ati2evxx.exe	"Hotkey handler for ATI desktop and mobile graphics chipsets. Users report that most of the hotkeys aren't well documented
U	ATIPOLAB	ati2evae.exe	ATI Polling Program - part of the ATI graphics driver e.g. on some Fujitsu-Siemens Notebooks
N	ATIPOLL	ati2evxx.exe	"Hotkey handler for ATI desktop and mobile graphics chipsets. Users report that most of the hotkeys aren't well documented
U	AtiPTA	Ati2ptxx.exe	"Control panel for the ATI series of video cards allowing access to such features as display resolution
U	ATIPTA	ATIPTAXX.EXE	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. Provides System Tray access to display settings (including desktop resolution
U	AtiPTA	Atiptaab.exe	"Control panel for the ATI series of video cards allowing access to such features as display resolution
U	AtiPTAAA	Ati2ptxx.exe	"Control panel for the ATI series of video cards allowing access to such features as display resolution
U	AtiPTAAA	ATIPTAXX.EXE	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. Provides System Tray access to display settings (including desktop resolution
U	atiptaxx	Ati2ptxx.exe	"Control panel for the ATI series of video cards allowing access to such features as display resolution
U	ATIPTAXX	ATIPTAXX.EXE	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. Provides System Tray access to display settings (including desktop resolution
X	atiptext	atiptext.exe	"Added by the COSIAM-A TROJAN!"
U	AtiQiPcl	AtiQiPcl.exe	Used for hardware DVD decoding on ATI video cards supporting this feature. Not required unless you regularly play DVD's
Y	ATIRmtWndr	ATIX10.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
U	ATISmart	ati2s9ag.exe	"ATI's ""SMARTGART""
U	AtiSound	csrss.exe	"WinSpy surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""ComRoot"" subfolder"
X	atisrc2	windfind.exe	"Added by the WINDFIND-A TROJAN!"
X	ATITech	Active.exe	"Added by the ROAMER-A TROJAN!"
U	atitray	atitray.exe	ATI Tray Tools - allows quick access to ATI graphics card settings
U	AtiTrayTools	atitray.exe	ATI Tray Tools - allows quick access to ATI graphics card settings
X	atiupdate	ATIUPDATE5.EXE	"Added by the DEBESKI.A TROJAN!"
X	atiupdate	msshed32.exe	Added by the DELF.EP downloader TROJAN!
X	ATIUpdater	atiupdxx.exe	"Added by the RBOT-ABX WORM!"
X	Atiupdpl	atiupdpl.exe	"Added by the SMALL.AOS TROJAN!"
X	ativopen	ativopen.exe	Premium rate adult content dialler
Y	ATIX10	atix10.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
U	ATKMEDIA	DMEDIA.EXE	"Driver for the media buttons on the front of some Asus laptops
U	ATKOSD2	ATKOSD2.exe	"On-screen display utility bundled with laptops from ASUS. If this utility is not installed then you will not be able to properly use other AsusTek utilities such as Splendid and Power Gear"
X	Atl**.exe [* = random char]	Atl**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Atl**32.exe [* = random char]	Atl**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	ATM Control	adpn.exe	"Added by the MMS.A WORM!"
N	ATnotes	atnotes.exe	Loads the ATnotes program for virtual sticky notes for your desktop. Available via Start -> Programs
U	Atomic Time Synchronizer	TimeSync.exe	"TimeSync - lets you synchronize your computer's clock with any internet atomic clock"
X	Atomic-x27	Atomic-x27.exe	"Added by the KATOMIK-A WORM!"
X	Atomic-x27C	AtomicpartC.exe	"Added by the KATOMIK-A WORM!"
U	Atomic.exe	Atomic.exe	"Atomic Clock Sync - synchronizes your computer's time with the NIST time server"
N	Atomica	atomica.exe	"Atomica runs from the System Tray and allows the user to find out more about a word or phrase on any screen by pointing at it with the mouse and clicking button one while holding down the Alt key"
U	AtomicTime	ATOMICTIME.EXE	"AtomicTime - utility that synchronizes your PC clock to an atomic clock"
U	AtomSync	atomsync.exe	"AtomSync - ""this NTP client synchronizes your PC clock with an internet atomic time server or with a time server on your LAN"""
U	Atrack	atrack.exe	"New feature of Norton Internet Security (NIS) and Norton Personal Firewall (NPF) 3.0 is the Alert Tracker
U	Atray	Atray.exe	"Active Tray is a utility which lets you configure the system tray. You can also create your own tray icons"
U	ATSpooler	AppsTraka.exe	"DeskTopScout keystroke logger/monitoring program - remove unless you installed it yourself!"
U	ATTBroadbandUpdate	SAUpdate.exe	"Big Brother from Quest Software. System and network monitor"
U	ATTRedUpdate	AutoUpdate.exe	Additional item added to start-ups after AT&T took over the now bankrupt Excite@home high-speed internet service. Included for automatically downloading and installing updates. Leave it unless you plan to regularly run it to check for updates
X	AttuneClientEngine	attune_ce.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	AttuneContentUpdater	attune_cu.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	AttuneDiscovery	attune_di.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	Attunel	Attunel.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	AttuneSystray	attune_st.exe	"Aveo Attune automated helpdesk software - adware/spyware"
N	aTuner	atuner.exe	"aTuner - tweak tool for GeForce based graphics cards"
Y	atwtusb	atwtusb.exe	USB interface for Aiptek Graphics Tablet (USB)
X	AtxBrw	Iexplor.exe	"""Pop Marketing"" adware"
X	Aucompat	Aucompat.exe	"Added by the GEMA TROJAN!"
N	AudioCommander Application	AudioCommander.exe	"System Tray access to the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
U	AudioDrvEmulator	DLLML.exe AudDrvEm.dll	"Related to Creative DLL Module Loader for the Sound Blaster X-Fi (and maybe others). This program is non-essential process to the running of the system
Y	Authentic-ID Toolbar	"rundll32.exe [path] ToolbarATL.dll	LoadTrayIcon"
U	Auto EPSON PictureMate Deluxe on X	E_FATI9TA.EXE	"Epson Status Monitor 3 for the PictureMate Deluxe compact photo printer - for monitoring printer status
U	Auto EPSON Stylus C87 Series on X	E_FATIABL.EXE	"Epson Status Monitor 3 for the Stylus C87 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3500 Series on X	E_FATI9 BL.EXE	"Epson Status Monitor 3 for the Stylus CX3500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3600 Series on X	E_FATI9BE.EXE	"Epson Status Monitor 3 for the Stylus CX3600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3700 Series on X	E_FATIACP.EXE	"Epson Status Monitor 3 for the Stylus CX3700 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3800 Series on X	E_FATIACA.EXE	"Epson Status Monitor 3 for the Stylus CX3800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4200 Series on X	E_FATIAEA.EXE	"Epson Status Monitor 3 for the Stylus CX4200 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4500 Series on X	E_FATI9AP.EXE	"Epson Status Monitor 3 for the Stylus CX4500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4600 Series on X	E_FATI9AA.EXE	"Epson Status Monitor 3 for the Stylus CX4600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4800 Series on X	E_FATIADA.EXE	"Epson Status Monitor 3 for the Stylus CX4800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX5000 Series on X	E_FATIBVA.EXE	"Epson Status Monitor 3 for the Stylus CX5000 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX5500 Series on X	E_FATICAP.EXE	"Epson Status Monitor 3 for the Stylus CX5500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6000 Series on X	E_FATIBIA.EXE	"Epson Status Monitor 3 for the Stylus CX6000 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6600 Series on X	E_FATI9EE.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6600 Series on X	E_FATI9EA.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX7400 Series on X	E_FATICDA.EXE	"Epson Status Monitor 3 for the Stylus CX7400 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX7800 Series on X	E_FATIAFA.EXE	"Epson Status Monitor 3 for the Stylus CX7800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX9400Fax Series on X	E_FATICFA.EXE	"Epson Status Monitor 3 for the Stylus CX9400Fax Series printer - for monitoring printer status
U	Auto EPSON Stylus D78 Series on X	E_FATIBGE.EXE	"Epson Status Monitor 3 for the Stylus D78 Series printer - for monitoring printer status
U	Auto EPSON Stylus D88 Series on X	E_FATIABE.EXE	"Epson Status Monitor 3 for the Stylus D88 Series printer - for monitoring printer status
U	Auto EPSON Stylus DX3800 Series on X	E_FATIACE.EXE	"Epson Status Monitor 3 for the Stylus DX3800 Series printer - for monitoring printer status
U	Auto EPSON Stylus DX4800 Series on X	E_FATIADE.EXE	"Epson Status Monitor 3 for the Stylus DX4800 Series printer - for monitoring printer status
U	Auto EPSON Stylus DX6000 Series on X	E_FATIBIE.EXE	"Epson Status Monitor 3 for the Stylus DX6000 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo 1400 Series on X	E_FATIBUA.EXE	"Epson Status Monitor 3 for the Stylus Photo 1400 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R1800 on X	E_FATI9LA.EXE	"Epson Status Monitor 3 for the Stylus Photo R1800 printer - for monitoring printer status
U	Auto EPSON Stylus Photo R220 Series on X	E_FATIAIE.EXE	"Epson Status Monitor 3 for the Stylus Photo R220 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R2400 on X	E_FATI9SA.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	Auto EPSON Stylus Photo R2400 on X	E_FATI9SE.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	Auto EPSON Stylus Photo R260 Series on X	E_FATIBNA.EXE	"Epson Status Monitor 3 for the Stylus Photo R260 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R280 Series on X	E_FATICKA.EXE	"Epson Status Monitor 3 for the Stylus Photo R280 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R320 Series on X	E_FATI9FA.EXE	"Epson Status Monitor 3 for the Stylus Photo R320 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R340 Series on X	E_FATIAJE.EXE	"Epson Status Monitor 3 for the Stylus Photo R340 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R800 on X	E_FATI9YE.EXE	"Epson Status Monitor 3 for the Stylus Photo R800 printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX420 Series on X	E_FATI9CE.EXE	"Epson Status Monitor 3 for the Stylus Photo RX420 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX680 Series on X	E_FATICJA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX680 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX700 Series on X	E_FATI9IA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX700 Series printer - for monitoring printer status
X	Auto Updat	WindowsSys32.exe	"Added by a variant of the FORBOT WORM!"
X	Auto updat	crcss.exe	"Added by the SDBOT.AAG WORM!"
X	Auto updat	SysDebug.exe	"Added by the FORBOT-BA WORM!"
X	Auto Update	AUP.exe	Added by an unididentified WORM or TROJAN!
X	Auto Update	dma.exe	"Added by the RBOT-AVO WORM!"
X	Auto Update	svchost.exe	"Added by the DUMARDI-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Auto Updater	asclt.exe	"Added by the SLINBOT.CJ BACKDOOR!"
X	Auto Updates	svchost.exe	"Added by the CHEUKO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Auto WinUpdate	taskmrg.exe	"Added by the RBOT-AFA WORM!"
X	AutoAdministrator	SERVICES.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Root%\Application Data\WINDOWS"
N	AutoCAD Startup Accelerator	acstart16.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
N	AutoCAD Startup Accelerator	acstart17.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
X	autoload	windowsupdate.exe	"Added by the POLYCRYP.DY TROJAN!"
X	AutoLoaderEnvoloAutoUpdater	auto_update_loader.exe	"Envolo/AproposMedia adware updater"
N	AutoMate Task Service	automate.exe	"Task scheduler for Unisyn Automate 4 task automation/macro running software. Available via a desktop shortcut or Start → Programs"
U	AutoMate5	Am5HkWnd.exe	"""Automate is the Leading Software for Automation of front and back-office business processes.It provides all the tools necessary to completely automate business processes
U	AutoMate6	AMEM.exe	"AutoMate 6 for automating repetitive tasks"
X	Automated Windows Updates	wauclt.exe	"Added by the GAOBOT.AJD WORM!"
X	Automatic Defrag Manager	defrag.exe	"Added by the RBOT-AKE WORM!"
X	Automatic Media Update	CACHE.RVD	Added by an unidentified WORM/TROJAN!
X	Automatic Media Update	HPLNT32.RVD	Added by an unidentified WORM/TROJAN!
X	Automatic Microsoft Windows Updater	suchost.exe	"Added by the RBOT-EQ WORM!"
X	Automatic Updates	algs.exe	"Added by the IRCBOT-AAM TROJAN!"
X	Automatic Windows Updater	Update.exe	"Added by the GAOBOT.AO WORM!"
N	Automatically launches the United Devices Agent when you start your computer	UD.EXE	The United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home but for medical research. Available via Start > Programs
X	Autopdate	Autopdate.exe	"Added by the RBOT-AGL WORM!"
X	autorundemo	[path to trojan]	"Added by the AGENT-FPX TROJAN!"
N	AutoSpell 5	ASWATC32.EXE	"AutoSpell - spell checker"
X	autoupdate	"rundll32 DATADX.DLL	SHStart"
X	autoupdate	"rundll32 SUPDATE.DLL	SHStart"
X	AutoUpdate	smss.exe	"Added by WINSPY.88! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\debug64"
X	Autoupdate Service	kaka.exe	"Added by the SYMPE-B TROJAN!"
X	Autoupdate Service	[path to trojan]	"Added by the AGENT-CB TROJAN!"
X	AutoUpdate32	services.exe	"Added by WINSPY.88! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\debug64"
X	AutoUpdater	aupdate.exe	"Tinybar variant"
X	AutoUpdater	AutoUpdate.exe	"PeopleonPage foistware"
X	autoupdatev2	[path to file]	"Added by the DROPPER-BM TROJAN!"
X	autoupdatev2	autoupdatev2.exe	"Detected by Kaspersky as the AGENT.FQ TROJAN!"
X	AV	UPDATE-28062004.exe[25 blank spaces].vbs	"Added by the MIDFIN WORM!"
X	AV Client	patch31345.exe	"Added by the MYDOOM.AD WORM!"
X	AV Industry	patch31345.exe	"Added by the MYDOOM.AD WORM!"
X	AV UpDate	Update.exe	"Added by the FUROOT-A TROJAN!"
X	AveoAttune	atmdlusr.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	AVG AntiVirus Updater	avgwusv.exe	"Added by the SILLYFDC.BAX WORM! Note - this is not a legitimare AVG entry"
X	AVG Grisoft Updater	updater.exe	"Added by the AGOBOT-OT WORM!"
X	avnort	formatsys.exe	"Added by the SERFLOG.A WORM!"
X	AVP	[path to trojan]	"Added by the MUTBO-A TROJAN!"
X	avptask	[path to trojan]	"Added by the NOFERE-G TROJAN!"
X	AvSer	msmpatch.exe	"Added by the SERFLOG.B WORM!"
U	AVStation premium	AVStation agent.exe	"Related to Samsung AV Station - instant playback of music
X	AVupdate32 Update	AVupdate32.exe	"Added by the RBOT.CNI TROJAN!"
Y	avx communicator	xcommsur.exe	"Anti-virus part of BitDefender virus scanner/firewall"
U	Awatch	Awatch.exe	"Diagnosis tool that monitors DSL connections
U	AWMON	Ad-Watch.exe	"Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system"
X	b3dUpdate	Zupdate.exe	"Associated with B3d Projector foistware - see here"
N	Babylon Translator	Babylon.exe	"""Babylon-Pro is a powerful information tool that instantly provides relevant information
X	Back Updates	Uninstall.log.vbs	"Added by the YPSAN.D WORM!"
X	Background Intelligent Transfer Service	[path] rundll32.exe	"Added by the VB-ZD TROJAN! Note - this is not the legitimate rundll32.exe process
X	backup	[path to worm]	"Added by the AGOBOT-H WORM!"
X	BADDATE	BADDATE.EXE	"Added by an unidentified VIRUS
X	Band-Aid	[path to file]	"Added by the RANKY.O TROJAN!"
U	Banpopup by Pratik	Banpopup.exe	Banpopup - popup killer
?	Bart Station	station.sbrt	"Related to PeoplePC ISP. May be a dialler for dial-up accounts?"
U	Bart Station	PPCOLink.exe	Dialer for PeoplePC ISP
X	Bat	secure2.bat	"Added by the ZCREW.C TROJAN!"
N	Batchreg1	N/A	"Part of the Windows System Recovery process. Added to the registry via Msbatch.inf. The existence of this key or process after the last reboot during installation indicates an unsuccessful installation
U	BatInfEx	"rundll32.exe [path] BatInfEx.dll	BMMAutonomicMonitor"
U	BatLogEx	"rundll32.exe [path] BatLogEx.DLL	StartBattLog"
X	BatSrv	batserv2.exe	"Detected by Kaspersky as the LOCKSY.M WORM!"
U	Battery Scope	batmgr.exe	Monitors battery levels on a notebook/laptop PC
U	BatteryBar	batterybar.exe	"BatteryBar - displays battery usage
Y	batterymiser	batterymiser.exe	"Battery Miser power management utility for LG Notebooks"
Y	BatteryMiser 5	BatteryMiser5.exe	"Battery Miser 5 power management utility for LG Notebooks"
X	BatzBack	BatzBack.scr	"Added by the BACKZAT WORM!"
U	Bayswap2	TbUpdate.exe	Hot-swappable drive management on Compaq Notebooks which allows you to swap drives without closing down Windows. Only required if you frequently swap bay devices
U	BeatNik Internet Clock	BeatNik.exe	"BeatNik Internet Clock is a Windows clock add-on that supports 'skins'. It can also synchronize your computer's clock with an atomic clock"
X	Beegees Update	beegees.exe	"Added by the SDBOT-ADK WORM!"
U	BelNotify	"rundll32.exe [path] NPBelv32.dll	RunDll32_BelNotify"
X	BeSys	[path to file]	"BeSys adware"
X	bfxtray	[path to trojan]	"Added by the AGENT-GEB TROJAN!"
X	Bharatayuda	GNB.exe	"Added by the BHARAT.A WORM!"
X	BIE	"Rundll32.exe [path] BDSrHook.dll	Rundll32"
?	BigDogPath	VM_STI.EXE	"Bundled with some software for digital cameras that use a USB connection - what does it do and is it required?"
X	BillGatesLoh.exe	BillGatesLoh.exe	"Added by the AGENT-FZO TROJAN!"
Y	BitDefender Communicator	xcommsvr.exe	"BitDefender antivirus"
N	BJ Printer Status Monitor	Cjstsr.exe	Canon BJ printer status monitor
N	BJ Status Monitor 5xx	CJSTRxx.EXE	Canon printer status monitor - where "xx" is different depending upon the version. Not required as you can check the printer status via My Computer -> Printers
N	BlackBerryAutoUpdate	RIMAutoUpdate.exe	"Automatic updates for BlackBerry smartphones
X	blah service	winupdate.exe	"Added by the GAOBOT.BIA WORM!"
X	Blank AntiViri	AUT0EXEC.BAT StartUp	"Added by the BRONTOK-CJ WORM!"
X	BLMessagingIntegration	blengine.exe	"BuddyLinks adware"
X	BlockWatcher	BlockWatcher.exe	"BlockWatcher rogue security software - not recommended
U	BLOG	"rundll32.exe [path] BatLogEx.DLL	StartBattLog"
X	Blue Service	[path to trojan]	"Added by the BANCOS-BCW TROJAN!"
U	BluetoothAuthenticationAgent	"rundll32.exe irprops.cpl
U	BluetoothAuthenticationAgent	"rundll32.exe bthprops.cpl
U	blueyonder Instant Support Tool	matcli.exe	"Blueyonder Instant Support Tool. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	BMail Installation	FTP_back.exe	"Part of iMesh - a file sharing system. Reported by Norton AntiVirus as a trojan. Once deleted does not prevent file sharing working. Older versions of iMesh re-instate this but the newer versions do not"
U	BMMGAG	"RunDll32 [path] pwrmonit.dll	StartPwrMonitor"
U	BMMMONWND	"rundll32.exe [path] BatInfEx.dll	BMMAutonomicMonitor"
N	BMupdate	BMupdate.exe	"Related to the BookmarkCentral entry. Typically added after downloading drivers for Visioneer scanners for example
X	Boarddata	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are often located in %System%"
X	boat32	boat32.exe	"Added by a variant of the RBOT WORM!"
X	BootsCfg	wscript.exe [path] Date.POP.vbs	"Added by the KUULLIO WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbs	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbe	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
U	BootStatus	BOOTST~1.EXE	"Visual Basic program that pops up a small window on startup telling you how many times the machine has been booted that day. Once you exit it
X	boot_reg	[path to file]	"Added by the BANCBAN-CA TROJAN!"
X	Bouncer RunStartup	LiveUpdate.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
X	Bridge	"rundll32.exe [path] Bridge.dll	Load"
U	broadband medic	matcli.exe	"NTL's Broadband Medic. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	Bron-Spizaetus	[path to file]	"Added by the BRONTOK-F WORM!"
X	Bron-Spizaetus	RakyatKelaparan.exe	"Added by the BRONTOK-J or BRONTOK-L WORMS!"
X	BrowserUpdateSched	[random filename]	"ZenoSearch adware"
X	brwdiag	[path to worm]	"Added by the STRATIO-BN WORM!"
X	BT	[path to trojan]	"Added by the LITEBOT-B TROJAN!"
U	BT Broadband Basic Help	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	BT Broadband Desktop Help	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	BT Broadband Help	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	Bug Eliminator	Bug_Elim.exe	"Bug Eliminator - ""performs a complete health check on your computer safely
U	bugwatcher service	bugwatcher.exe	"
U	BullGuard Update	avxlive.exe	"Part of Bullguard antivirus. Leave enabled unless you manually update virus definitions"
X	Bwddwss	[path to trojan]	"Added by the RANKY.BD TROJAN!"
?	BZUtilizationCollector	BZUtilizationCollector.exe	"Part of BlazentAgent from Blazent who provide ""outsourcing governance automation for IT Outsourcing (ITO) relationships"". What does it do and is it required?"
X	C7	[path to worm]	"Added by the MEDIAKILL.A WORM!"
X	CacheLoader	[path to trojan]	"Added by the DLOADER-NZ TROJAN!"
U	CafeStation	CafeStation.exe	"""CafeSuite is the solution for your internet cafe. Our software provides you with ameans to control the workstations
X	calc	"rundll32.exe [path] ntuser.dll	_IWMPEvents@0"
U	CallCenter Main Application	V3calmcp.exe	"""V3 Inc. CallCenter is a free 32-bit
?	CameraApplicationLauncher	CameraApplicationLaunchpadLauncher.exe	"Supports the integrated webcam on IBM/Lenovo Thinkpad notebooks. What does it do and is it required?"
U	Canon MultiPASS Status Monitor	monitr32.exe	Cannon Multi-Pass status monitor - your choice
?	Canon PC1200 iC D600 iR1200G Status Window	CAPM1LAK.EXE	"Cannon printer related - is it required in startup?"
N	CaptureBat	Capture.exe	"!Quick Screen Capture from EtruSoft Inc. - ""allows you to take screenshots from any part of your screen in more than 10 ways
X	cartao	[path to file]	"Added by the DLOADER-QD TROJAN!"
N	Cashsurfers Cashbar Navigator	Cashbar.Exe	"Cashsurfers CashBar Navigator - ""The CashBar rotates banner advertisements once per minute and provides you with access to up to date special offers and deals"""
X	CashToolbar	MSCStat.exe	"Added by the DOWNLOADER-MY TROJAN!"
X	Catalyst Control Centre	atixvdm.exe	"Added by the RBOT.DMW TROJAN!"
X	catsrv	catsrv.exe	"Added by the PAPLOK TROJAN!"
U	CBWAttn	CBWAttn.exe	"Required for Bitware to answer incoming faxes
X	ccUpdate	ccUpdate.exe	"Added by the AGOBOT.YS WORM!"
X	Cdcompat	Cdcompat.exe	"Added by the GEMA TROJAN!"
X	Cekirge	[path to worm]	"Added by the KERGEZ.A WORM!"
U	CertificateRegistration	SafeSignCertReg.exe	SafeSign Certificate Registration Utility for Microsoft Crypto applications
X	cesmain.dll	"Rundll32.exe [path] cmail.dll	Rundll32"
X	cftmon	WindowsUpdate.exe	"Added by the AGENT.AQK BACKDOOR!"
X	Chat login	chatlogin.exe	"Added by the ANTINNY.F WORM!"
N	Chatango	Chatango.exe	"Chatango - ""allows people to be connected in real time through their Web browsers. Include your Chatango contact link or button when you create eBay auctions
U	ChatStat	ChatStat.exe	"ChatStat from ChatStat Technologies
X	Cheatle	GigaByte.exe	"Added by the SHODI.B VIRUS!"
U	cheatmonitor	start.exe	"CheatMonitor surveillance software. Uninstall this software unless you put it there yourself"
N	Check for One Touch Update	wiseupdt.exe	Checks for updates for Visioneer OneTouch scanners
N	Check for TWS Updates	WiseUpdt.exe	Interactive Brokers - check for update to their standalone Java-based trading platform
N	CheckCustomWorksUpdate	CheckCWupdate.exe	"Update checker
X	chkdsk	autoexec.bat	"Added by the ANPES WORM!"
Y	Cingular Communication Manager	CingularCCM.exe	"Cingular Communication Manager - now taken over by AT&T. ""provides a robust set of wireless communication tools for businesses and individuals. With wireless access to email
X	Cisco Systems	[path to worm]	"Added by the AUTORUN.UHR WORM!"
U	ClauerUpdate	ClUpdate.exe	"Automatic updates for the software supporting the Clau-ACCV and Clauer-idCAT digital certificate USB keys"
X	Cleanator	Cleanator.exe	"Cleanator rogue privacy program - not recommended
?	CleanRegPath	CleanReg.exe	"Apparently Annex A ADSL modem related. What does it do and is it required?"
N	CleanSweep Useage Watch	CSUSEM32.EXE	Quarterdeck/Norton CleanSweep component - tracks how often you use files and alerts you to files that have not been used for a specified period of time
N	Client Access Help Update	cwbinhlp.exe	"Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
X	Client Agent	[path to file]	"Added by the PPDOOR-J TROJAN!"
X	Client Server Control Process	[path to trojan]	"Added by the AGENT-HR TROJAN!"
X	Client Server Runtime	[path to worm]	"Added by the POEBOT-KR WORM!"
X	Client Update	wup.exe	"Added by the OPANKI.O WORM!"
N	Clik Status Monitor	toolsclickstat.exe	Part of Iomega Tools to let you know whether an Iomega PocketZip (nee Clik) removable drive cartridge is installed
N	ClipMate5x	ClipMt5x.exe	"Clip Mate 5.x by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs"
N	Clipmate6	CLIPMT60.EXE	"Clip Mate 6 by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs"
N	ClipMate7	ClipMate.exe	"Clip Mate 7 by Thornsoft - utility that allows you to store more than one item in the clipboard"
N	Clipomatic	Clipomatic.exe	"Mike Lin's Clipomatic is a clipboard cache program - it remembers what was copied to the clipboard even after new data is copied
X	clkhost	[path to trojan]	"Added by the WIXUD-B TROJAN!"
?	Clotusorgreg0	prtStart.exe [path] Orgprt.exe	"IBM Lotus SmartSuite related. In a LotusOrgReg folder. Unclear what exactly it does?"
X	ClrSchLoader	[path to file]	"ClearSearch adware"
U	ClUpdate	ClUpdate.exe	"Automatic updates for the software supporting the Clau-ACCV and Clauer-idCAT digital certificate USB keys"
X	cmrss	[path to trojan]	"Added by the DLOADER-QQ TROJAN!"
X	CnsMax	Internat.exe	"Added by the POINTEX TROJAN! Note - the real internat.exe resides in %windir%\system (where %windir% is the Windows directory - C:\Windows or C:\Winnt) whereas this version resides in %windir%"
X	CnsMin	"Rundll32.exe [path] CNSMIN.DLL	Rundll32"
U	Cobian Backup 7 Application	CobBU.exe	"Cobian Backup 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	CognizanceTS	"rundll32.exe [path] AsTsVcc.dll	RegisterModule"
N	CollaborationHost	p2phost.exe	"Signs a user into the People Near Me feature at login in Windows 7 and Vista. People Near Me enables you to use certain peer-to-peer (P2P) programs on a network - that ""identifies people nearby who are using computers and allows those people to send you invitations for programs such as Windows Meeting Space. They can only invite you to participate in programs that are installed on your computer."" Available via Start → Control Panel"
X	COM+ System Application	lsas.exe	"Added by the AGOBOT-MO WORM!"
X	COM+ System Applications	lsas.exe	"Added by the AGOBOT.SE WORM!"
U	Command WorkStation 4	cws 4.exe	"EFI's Command WorkStation makes ""managing demanding workflows easier by centralizing job management. The software automatically identifies the Fiery servers on the network and offers customization options for displaying information"" - for high-end print environments"
N	CommonSDK	RoxWatchTray9.exe	"System Tray access to managing the ""Watched Folders""
Y	Communications_Helper	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	Communications_Helper.exe	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	COMMUNICATOR	Communicator.exe	"Part of Microsoft Office Communicator
U	Compaq Knowledge Center	silent.exe & matcli.exe	""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	Compaq Video CD Watcher	??	For Compaq PC's. MPEG viewer
X	Compatibility Service Process	regsvs.exe	"Added by the GAOBOT.YN WORM!"
X	ComPlus Applications	twain.exe	"Added by the AGENT.AQO TROJAN!"
X	con	[path to trojan]	"Added by the BRAVE-A TROJAN!"
X	Config	TaskUpdate.exe	"Added by the MDROP-BRO TROJAN!"
X	Config Loadation	iEEexplore.exe	"Added by the SDBOT.H TROJAN!"
X	Config Loadatiorin	I3Explorer.exe	"Added by the SDBOT.H TROJAN!"
X	Configuration	explorer32.exe	"Added by the SDBOT-ML WORM!"
X	configuration	apphost.exe	"Added by the SDBOT-VP WORM!"
X	Configuration	ntsys32.exe	"Added by the SDBOT-LN WORM!"
X	Configuration	msgfixs.exe	"Added by the SDBOT-NN WORM!"
X	Configuration Default	Wuxat.exe	"Added by the SPYBOT-CA WORM!"
X	Configuration Driver	scghost.exe	"Added by the SDBOT-DLA WORM!"
X	Configuration File	Winset32.exe	Added by the FLUX.101 TROJAN!
X	Configuration Loaded	wupdated.exe	"Added by the MOEGA or MOEGA.AG or MOEGA.AP WORMS!"
X	Configuration Loaded	lssas.exe	"Added by a variant of the SDBOT WORM!"
X	Configuration Loaded	iexploree.exe	"Added by the SDBOT-KC WORM!"
X	Configuration Loader	aim95.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	cmd32.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	syscfg32.exe	"Added by the SDBOT.B BACKDOOR!"
X	Configuration Loader	service5.exe	"Added by the GAOBOT.AF WORM!"
X	Configuration Loader	lfass.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	sycfg34.exe	"Added by the GAOBOT.AN WORM!"
X	Configuration Loader	wincrt32.exe	"Added by the GAOBOT.BF WORM!"
X	Configuration Loader	windex.exe	"Added by the GAOBOT.BZ WORM!"
X	Configuration Loader	dosrun32.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Service.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Servicess.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sw32.exe	"Added by the AGOBOT.BQ WORM!"
X	Configuration Loader	System.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Winreg.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sysinfo.exe	"Added by the GAOBOT.FQ WORM!"
X	Configuration Loader	microsoft.exe	"Added by the GAOBOT.JB WORM!"
X	Configuration Loader	confgldr.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	configuration loader	winicfg32.exe	"Added by the GAOBOT.RQ WORM!"
X	Configuration Loader	svhst.exe	"Added by the GAOBOT.YC WORM!"
X	Configuration Loader	msgfix.exe	"Added by the GAOBOT.AUS or SDBOT.J or SDBOT-QG WORMS!"
X	Configuration Loader	msnss.exe	"Added by the GAOBOT.AUS WORM!"
X	Configuration Loader	IEXPL0RE.EXE	"Added by the SDBOT BACKDOOR! Note the number ""0"" in the filename"
X	Configuration Loader	loadcfg32.exe	"Added by the SDBOT BACKDOOR! Note the number ""0"" in the filename"
X	Configuration Loader	MSTasks.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	systemry.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	ccSort.exe	"Added by the AGOBOT.SR WORM!"
X	Configuration Loader	smss32.exe	"Added by the AGOBOT.MB WORM!"
X	Configuration Loader	wincffg.exe	"Added by the AGOBOT.A3 WORM!"
X	Configuration Loader	seru32.exe	"Added by the SDBOT-VR WORM!"
X	Configuration Loader	botss.exe	"Added by the SDBOT-XS WORM!"
X	Configuration Loader	ldasp.exe	"Added by the AGOBOT.BH WORM!"
X	Configuration Loader	msgcfgsrv.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	smsai.exe	"Added by the SDBOT-YE WORM!"
X	Configuration Loader	svupdate.exe	"Added by the RANDEX.DXP WORM!"
X	Configuration Loader	crcss.exe	"Added by the AGOBOT.ADG WORM!"
X	Configuration Loader	lexplore.exe	"Added by the RBOT-AGX WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	Configuration Loader	scvhost.exe	"Added by the AGOBOT-AAE and SDBOT.AR WORMS!"
X	Configuration Loader	svchost.exe	"Added by the PARADROP-A WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Configuration Loader	svchost2.exe	"Added by the AGOBOT.JR WORM!"
X	Configuration Loader	dezi.exe	"Added by the SDBOT-OB WORM!"
X	Configuration Loader	mouse.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	msg.exe	"Added by the SDBOT.BT WORM!"
X	Configuration Loader	WinHelper.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	extrac.exe	"Added by the SDBOT-AFP WORM!"
X	Configuration Loader	DVD-Player.exe	"Added by a variant of the SDBOT WORM!"
X	Configuration Loader	IEXPLORE.EXE	"Added by the SDBOT-KW WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Configuration Loader	wincore.exe	"Added by the SDBOT.BHE WORM!"
X	Configuration Loader	configldr.exe	"Added by the AGOBOT-PP TROJAN!"
X	Configuration Loader	ahnhst.exe	"Added by the AGOBOT.MX WORM!"
X	Configuration Loader	ntdm.exe	"Added by the AGOBOT.RV WORM!"
X	Configuration Loader	msnmsgr.exe	"Added by the SDBOT-SO WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Configuration Loader	svschost.exe	"Added by the SDBOT-NS WORM!"
X	Configuration Loader	wump.exe	"Added by the AGOBOT-BU BACKDOOR!"
X	Configuration Loader	WinSys32ys.exe	"Added by the SDBOT.BCS WORM!"
X	Configuration Loader	cvcd.exe	"Added by the AGOBOT-DH BACKDOOR!"
X	Configuration Loader	asnclt32.exe	"Added by the AGOBOT-EB BACKDOOR!"
X	Configuration Loader	soundconf.exe	"Added by the AGOBOT-MH WORM!"
X	Configuration Loader	win32exec.exe	"Added by the SDBOT-LA WORM!"
X	Configuration Loader	mservs.exe	"Added by the SDBOT-NM WORM!"
X	Configuration Loader	update.exe	"Added by the SDBOT-OS WORM!"
X	Configuration Loader	FILENAME.EXE	"Added by the AGOBOT-DQ WORM!"
X	Configuration Loader	explore.exe	"Added by the GAOBOT.GW WORM!"
X	Configuration Loader	msgfixy.exe	"Added by the SLINBOT.QW BACKDOOR!"
X	Configuration Loader	winfix.exe	"Added by the SDBOT-MA WORM!"
X	Configuration Loader	scvh0st.exe	"Added by the AGOBOT-AX WORM!"
X	Configuration Loader	msrun.exe	"Added by the AGOBOT-Y WORM!"
X	Configuration Loader 2	confuldr.exe	"Added by the AGOBOT-FC WORM!"
X	Configuration Loader Service	Winsys32.exe	"Added by the RBOT-YV WORM!"
X	Configuration Loader Service	devl32.exe	"Added by the SDBOT-XY WORM!"
X	Configuration Loader10	ip7.exe	"Added by the AGOBOT-ANZ WORM!"
X	Configuration Loading	svchos1.exe	"Added by the GAOBOT.DK WORM!"
X	Configuration Loading	configldr.exe	"Added by the AGOBOT-EC WORM!"
X	Configuration Loading Service	wscel.exe	"Added by the SDBOT-WJ WORM!"
X	Configuration Loadr	iexplore.exee	Added by an unidentified WORM or TROJAN!
X	Configuration Manager	CNFGLD32.EXE	"Added by the SDBOT TROJAN!"
X	Configuration Manager	Cnfgldr.exe	"Added by the SDBOT TROJAN!"
X	Configuration Manager	cfg32.exe	"BookedSpace parasite. Note - the ""cfg32.exe"" file is located in %Windir%"
X	Configuration Servecie	sewins.exe	"Added by the SDBOT-COH WORM!"
X	Configuration Service	suchost.exe	"Added by the TREB TROJAN!"
X	Configuration Services	mswords.exe	"Added by the SDBOT-YM WORM!"
X	Configuration Update	UPDT32V2.EXE	"Added by the SPYBOT-AA BACKDOOR!"
N	Configuration Utility	CONFIG.EXE	Controls linksys wireless connection. Available from the Desktop
U	Configuration Utility	wlanutil.exe	"NetGear Wireless LAN configuration utility for the MA311 802.11b (and maybe other cards)"
X	Configuration Wizard	Cfgwiz32.exe	"Added by a variant of the HACKTACK TROJAN! Not to be confused with the legitimate MS ""ISDN Configuration Wizard"" (Cfgwiz32.exe)"
X	Configuration32 Loader32	winamp32.exe	"Added by the SDBOT-BIC WORM!"
X	Configurations Asclt	asclt.exe	"Added by the SDBOT-MX WORM!"
N	CONNECTAuto Update	CONNECTScheduler.exe	"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
X	Connectivity Tool	[path to trojan]	"Added by the LITEBOT-E TROJAN!"
X	Controladores	[path to trojan]	"Added by the TELEFO-A TROJAN!"
X	ControlPanel	"rundll32 internat.dll	LoadKeyboardProfile"
X	ControlPanel	"host32.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"cmd32.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"[path to executable] internat.dll	LoadKeyboardProfile"
X	ControlPanel	"popcorn.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"svcc.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"private.exe internat.dll	LoadMouseCarpetProfile"
X	ControlPanel	"twink64.exe internat.dll	LoadKeyboardProfile"
U	CookiePatrol	CookiePatrol.exe	"CookiePatrol - cookie interceptor stopping spyware cookies that used to be part of PestPatrol before CA's aquisition"
X	Core Process Aplication	ccapl.exe	"Added by the QHOSTS.G TROJAN!"
X	Core Process Aplication x16	ccapl16.exe	"Added by the SPYBOT.AFT WORM!"
X	Core Process Aplication x32	ccapl32.exe	"Added by the SRAMLER.E TROJAN!"
N	Corel Desktop Application Director	dadx.exe	The Desktop Application Director (DAD) gives you easy access to all Corel applications - x represents ther version number. Available via Start -> Programs
N	Corel Registration	Remind32.exe	If you don't want to register Corel products and be reminded about it every 2 weeks disable it
N	Corel Registration Reminder	Remind32.exe	If you don't want to register Corel products and be reminded about it every 2 weeks disable it
X	Corporate Microsoft Update	uptask.exe	"Added by the RBOT-GVB WORM!"
U	CPATR10	CPATR10.EXE	"Dritek/Compal ATR10 Easy Button driver. Used on certain laptops (e.g. Toshiba
?	CPortPatch	cppatch.exe	"CPortPatch is a utility is required for Dell laptops that are using a docking station. Is it needed though?"
X	cppc	[path to trojan]	"Added by the VB-NV BACKDOOR!"
X	CPU Watcher	"rundll32.exe cpu.dll	load"
X	CPU Windows Status	cpustats.exe	"Added by a variant of the RBOT WORM!"
X	cqlyg	world_cup_.bat	"Added by the WCUP.A WORM!"
X	crash0001	restorecrashwin32.bat	"Added by the AGENT-ZC TROJAN!"
X	CrashDump	[path to trojan]	"Added by the DROPPER.EAT TROJAN!"
X	Crc32stats Dependencies	Crc32stats.exe	"Added by the MYTOB.GT WORM!"
U	Creata Mail	JMSrvr.exe	"Creata_Mail. Smileys
X	Create A Monster	createAMonster.exe	"Kudd.com CreateAMonster. Reportedly stealth installed and Look2Me adware related"
N	CreateCD	Createcd.exe	Adaptec Easy CD Creator system tray application (pre version 5). Available via Start -> Programs
N	CreateCD50	Createcd50.exe	Adaptec Easy CD Creator version 5 system tray application. Available via Start -> Programs
N	CreateCD_Reminder	reminder.exe	Reminder to create system recovery CD/DVDs on a Sony Vaio laptop or desktop
X	Creates stractures for system management	stacture.exe	"Added by the SDBOT-DHS WORM!"
N	Creative AGP Wizard	agpwiz.exe	Part of Creative's BlasterControl
X	Creative Audio Drivers	creative.exe	"Added by the RBOT-FKR WORM!"
N	Creative Detector	CTDetect.exe	"Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player
N	Creative Launcher	CTLauncher.exe	For Creative Soundblaster Live! series soundcards. Adds a quick-launch bar to the top of the display and a System Tray icon. Available via Start -> Programs
U	Creative Live! Cam Manager	CTLCMgr.exe	"Creative Live! Cam Manager"
U	Creative MediaSource Go	CTCMSGo.exe	"Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
U	Creative MediaSource Go	CTCMSGoU.exe	"Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
N	Creative PCI Audio Configuration Utility	starter.exe	"System Tray icon to configure a Creative Soundblaster PCI soundcard. Not required and re-instates itself when un-checked. Try one of the solutions on this special page. Similar to EnsoniqMixer"
N	Creative Software Update	AutoUpdate.exe	Auto-updater for Creative Labs software
N	Creative WebCam Tray	Camtray.exe	Creative WebCam tray control - can be started manually
X	Creative.exe	Creative.exe	"Added by the PROLIN WORM!"
N	CreativeDiscNotifier	CTNOTIFY.EXE	"For Creative Soundblaster Live! series soundcards. Detects when you insert a CD-ROM
U	CreativeMixer	CTMIX32.EXE	"Creative soundcard System Tray access to
?	CreativeTaskScheduler	CTSched.exe	"Creative Task Scheduler. What does it do and is it required?"
X	Critical Update Check	battlenet.exe	"Added by the DELF-LB TROJAN!"
N	CriticalUpdate	Wucrtupd.exe	"MS Windows Critical Update Notification. If you want to keep Windows up-to-date
X	CriticalUpdate	wucrtupd.exe	"Added by the NOALA.B WORM! Note - this file is located in the Windows or Winnt folder
X	CS Update	copy /Y [path] ActivationManager.dll.upd [path] ActivationManager.dll	Added by an unidentified malware
X	csm Win Updates	csm.exe	"Added by the ZOTOB.B WORM!"
X	ctfmon.exe	msupdate32.exe	"Spy Sheriff/SpywareNO malware
X	ctfmoon	microsoftconfigurator.exe	"Added by the DELF-ALS TROJAN!"
X	CTime	[path to trojan]	"Added by the HTTPDOS TROJAN!"
X	CTUpdate	ctupdclt.exe	"Added by the RBOT-ABG WORM!"
X	Ctykd	[path to file]	"SMALL.SN spyware"
U	CWatch	cw.exe	"ChatWatch - chat monitoring tool"
X	cwingllib	atllsimm.exe	"Added by a variant of the SDBOT WORM!"
U	cwupdate	cwupdate.exe	"ContentProtect from ContentWatch - internet filter"
N	Cyber-shot Viewer Media Check Tool	SPUVolumeWatcher.exe	"Part of the Sony Picture Uility software supplied with Sony Cyber-shot digital cameras. Automatically invokes an import process if the camera is connected and has media on it"
X	cyberfree.exe	****.dat [* = random char]	Unidentified adware
U	CyberLat Ram Cleaner	CLRamCleaner.exe	"CyberLat RAM Cleaner - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
U	CyberLat Ram Cleaner	CyberLat Ram Cleaner 1.1.exe	"CyberLat RAM Cleaner - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
U	CyberPatrolNew	cphq.exe	"""CyberPatrol is one of the most powerful and popular client-based
X	CydoorUpdate	CD_Load.exe	"Adware. Check here for information about Cy-Door and here for a program that can remove it"
X	d3dupdate.exe	bbeagle.exe	"Added by the BEAGLE.A WORM!"
X	Daily Weather Forecast	weather.exe	"Added by the DLOADER-IP TROJAN!"
?	DashBarState	dashIE	"??"
X	Data	System.dat.vbs	"Added by the BISCUIT.A WORM!"
X	data	msngs.exe	"Added by the RBOT-ADQ WORM!"
X	Data File	vdehost.exe	"Added by the SDBOT-DOS TROJAN!"
X	Data Layer 2	datalayer.exe	"Added by the RBOT-BNF WORM! Note - do not confuse with the legitimate Nokia file sharing the same filename - this one is located in %System%"
N	Data LifeGuard	BACKWE~1.EXE	Data LifeGuard diagnostic tools for Western Digital's series of hard drives
N	Data LifeGuard LifeLine Lite installer	DLGLI.EXE	"Backweb installer - see here"
X	Data Protection	datprot.exe	"Data Protection rogue security software - not recommended
X	Data Restore Service	prq8.exe	"Added by the KELVIR.AI WORM!"
X	Data789	Regedit.exe ....data789.tmp	Homepage hijacker
X	DATABASE MySql	[path] repcale.exe [path] beird.exe	"Added by the RANDON-AL WORM! Both files are often located in %System%\qsws"
N	DataCaching	FlashKsk.exe	"SmartMedia Card management from the installation of a SanDisk reader for a camera's SmartMedia card and also adds the "Unplug and Eject Hardware" System Tray icon"
X	DataHealer	DataHealer.exe	"DataHealer rogue security software - not recommended
U	DataKeeper	DataKeeper.exe	"PowerQuest DataKeeper (now owned by Symantec) backup software"
Y	DataLayer	DataLayer.exe	"Part of Nokia PC Suite version 5 - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" Required by the Nokia status/connection monitor (NclTray.exe)"
Y	DataLayer	DATALA~1.EXE	"Part of Nokia PC Suite version 5 - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" Required by the Nokia status/connection monitor (NclTray.exe)"
N	DataViz Inc Messenger	DvzIncMsgr.exe	"Installed with DataViz ""Documents to Go"" software"
N	DataViz Messenger	DvzMsgr.exe	"DataViz Documents to Go - "allows you to use your Word
X	Datcheck	datcheck.exe	"Added by the KEYPANIC TROJAN!"
X	Date Manager	datemanager.exe	"Date Manager - calender program. Spyware/adware based provided by The Gator Corporation. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
?	Datechecker	N/A	"Could be related to this?"
X	DateMakerIntl	DateMakerIntl.exe	Premium rate adult content dialler
X	DateMngr	DATEMNGR.EXE	"Added by the SPYBOT-BR BACKDOOR!"
X	DAupdate	DAupdate.exe	NavEnhance adware
X	DCOM Server	[path to trojan]	"Added by the AGENT-CCQ BACKDOOR!"
X	Dcom System Patch	Microsoft.exe	"Added by the RANDEX.MS WORM!"
X	DealHelperUpdate	DHUpdt.exe	"DealHelper adware"
X	Death.exe	Death.exe	"Added by the DELF-ERW TROJAN!"
U	DeathAdder	razerhid.exe	"Razer DeathAdder gaming mouse driver - required if you use the additional features and programmed keys/macros"
X	DefaultConfiguration	defaultconfh.exe	"Added by the AGOBOT-JC WORM!"
X	defender	[path to trojan]	"Added by the VB-BAQ TROJAN!"
U	defwatch	defwatch.exe	Detects out-of-date virus definitions for Norton Anti-Virus Corporate Edition and runs the Defwatch Wizard. Only required if you don't update the virus definitions manually on a regular basis
U	Dell DataSafe Scheduler	DataSafeOnlineScheduler.exe	"Scheduler for Dell DataSafe™ Online which ""helps protect your music
Y	DellAutomatedPCTuneUp	PTAgnt.exe	"PC TuneUp from Dell - ""silently monitors your system
X	DeluxeCommunications	Dxc.exe	"Deluxe Communications adware - successor to SurfSideKick"
U	DepFrez	frzstate.exe	"Deep Freeze from Faronics Coporation. ""Freezes"" the current software configuration so that an a re-boot all changes made refer back to their original settings. Not required for most users - more likely to be used by system administrators
X	DeskMateAutoUpdate	DeskMateAutoUpdate.exe	"DeskMates: Virtual scantily clad girls enhance your desktop. BargainBuddy adware related"
N	Desktop Architect	DATRAY.EXE	"Desktop theme manager available
N	Desktop Weather	THE WEATHER CHANNEL.exe	"Desktop Weather by The Weather Channel - provides current temperature
N	Desktop Weather 3	THE WEATHER CHANNEL.exe	"Desktop Weather 3 by The Weather Channel - provides current temperature
N	Desktop Weather 3	THEWEA~1.EXE	"Desktop Weather 3 by The Weather Channel - provides current temperature
X	DesktopUpdate	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Device Configuration Loader	msdvc32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	DevicePath	Proyecto1.exe	"Added by the GRUEL WORM!"
X	DevicePath	Root.exe	"Added by the GRUEL WORM!"
X	Devicewin	[path to trojan]	"Added by the BANKER-AEV TROJAN!"
X	dfgfdgrergd	[path to trojan]	"Added by the RANKY.CK TROJAN!"
X	DI2	[path to file]	"BroadcastPC adware"
X	DialUp Network Application	Rnaap.exe	"Added by a variant of the SDBOT WORM!"
X	Diesel	Recalculate.exe	"Added by the LAZAR TROJAN!"
Y	Digital Patrol Update 5	update.exe	"Digital Patrol - ""a powerful anti trojan scanner
U	Direct Update	DUControl.exe	"DirectUpdate dynamic DNS updater"
X	DirectX shell driver	[path to trojan]	"Added by the MARKTMAN-B TROJAN!"
U	DiscUpdateManager	DiscUpdMgr.exe	"Disc Update Manager for Digital interactive's DISCover Console. Provider of on-demand video games"
N	DiscUpdateManager	DiscUpdateMgr.exe	"DISCover from Digital Interactive Systems Corporation Inc. ""The company's patented Drop 'n' Play technology provides a simple
X	Disk Defragmentation Loader	pmsvcr.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Disk Keeper	[path to trojan]	"Added by the SMALL-VE TROJAN!"
X	Disk Panel Configuration	dpcsvc.exe	"Added by the IRCBOT.BSQ BACKDOOR!"
X	Diskstart	cat.exe	MS-Connect dialler
X	Dispatcher	dispatcher.exe	"Added by the DLOADR-AS TROJAN!"
X	DivX Updater	DivX.Exe	"Added by the NALDEM TROJAN or MASTAK VIRUS!"
N	DlaTray	Dlatray.exe	"System Tray access to DLA - Drive letter access to HP's and Veritas' version of DirectCD. Does the same thing as DirectCD. From HP - ""This is a needed file as it controles the readability of the Combo drives. Without this file loading the end user will be able to burn CD's but wont be able to read them. The drive itself will be able to read store bought master Cd's without the file but not burnt ones"""
Y	DLBTCATS	"rundll32 [path] DLBTtime.dll	_RunDLLEntry@16"
Y	DLBUCATS	"rundll32 [path] DLBUtime.dll	_RunDLLEntry@16"
Y	DLBXCATS	"rundll32 [path] DLBXtime.dll	_RunDLLEntry@16"
Y	DLCCCATS	"rundll32 [path] DLCCtime.dll	_RunDLLEntry@16"
Y	DLCDCATS	"rundll32 [path] DLCDtime.dll	_RunDLLEntry@16"
Y	DLCFCATS	"rundll32 [path] DLCFtime.dll	_RunDLLEntry@16"
Y	DLCGCATS	"rundll32 [path] DLCGtime.dll	_RunDLLEntry@16"
Y	DLCICATS	"rundll32 [path] DLCItime.dll	_RunDLLEntry@16"
Y	DLCJCATS	"rundll32 [path] DLCJtime.dll	_RunDLLEntry@16"
Y	DLCQCATS	"rundll32 [path] DLCQtime.dll	_RunDLLEntry@16"
Y	DLCXCATS	"rundll32 [path] DLCXtime.dll	_RunDLLEntry@16"
N	DLHelperEXE	WATCH.exe	Download helper distributed with some software that allows the software installation to redirect download locations. Not required once the installation is finished
X	DLL Service Manager	[path to worm]	"Added by the RPCBOT.F TROJAN!"
X	DllExecutable	[path to file]	"Added by the VB-SP WORM!"
X	DLLUPDATE32	dllupdate32.exe	"Added by the AGOBOT.IA WORM!"
X	dm_service	[path to file]	"Added by the MITGLIEDER.P TROJAN!"
Y	DNE Binding Watchdog	"rundll dnes.dll	DnDneCheckBindings"
Y	DNE DUN Watchdog	"rundll dnes.dll	DnDneCheckDUN13"
N	DocuMagix Init	PWATCH.EXE	"PaperMaster is an application for the PC designed to automate the process of organizing
?	Dosbat	??	"??"
N	Download Accelerator Manager Free Edition	dam.exe	"Download Accelerator Manager Free Edition from Tensons Corp"
N	Download Accelerator Plus 5.0	DAP.exe	"Download Accelerator Plus from Speedbit. Download manager for resuming downloads
N	DownloadAccelerator	DAP.EXE	"Download Accelerator Plus from Speedbit. Download manager for resuming downloads
X	Downxz	Downxz.bat	"Added by the MYDOOM.W WORM"
Y	DPASUpdate	DPASAutoUpdate.exe	"Automatic updates for DefenderPro AntiSpy spyware remover - now incorporated Defender Pro 15-in-1 and 5-in-1"
X	DR service	[path to worm]	"Added by the RBOT-CZT WORM!"
X	DRam prosessor	WindowsUpdate.exe	"Added by the RBOT-BBZ WORM!"
X	DRam prosessor	msupdate.exe	"Added by the DELF-FAW TROJAN!"
X	DRam rar proc	winupdaterar.exe	"Added by a variant of the IRCBOT TROJAN!"
X	DRam rare proc	updaterarwin.exe	"Added by the RBOT-GQW WORM!"
X	drin	[path to trojan]	"Added by the SMALL.DPB TROJAN!"
X	DriverPath	system32.exe	"Added by the PRORAT-S TROJAN!"
X	DrWatson	drwatson_.exe	"Added by the LOHAV-S TROJAN!"
X	DrWatson	drwatson_32.exe	"Added by the LOHAV-S TROJAN!"
X	DSAcass	[path to file]	"Added by the RANKY.M TROJAN!"
U	dscactivate	dsca.exe	Dell Support Agent offers additional support and update features for your Dell computer or laptop
X	Dskcompat	Dskcompat.exe	"Added by the GEMA TROJAN!"
X	DSKEY	[path to trojan]	"Added by the STARTER-G TROJAN!"
U	DSLSTATEXE	dslstat.exe	System tray connection status for ADSL modems from Eicon Networks (as used by BT Broadband for example)
X	DsmSer	msmpatch.exe	"Added by the SERFLOG.B WORM!"
X	DSS	[path to trojan]	"Added by the DSSDOOR-C TROJAN!"
U	DT 11Mbps WLAN PC Card Station	DTCARDMonitor.exe	11Mbps PC Card based wireless LAN connection monitor - possibly from Deutsche Telekom
U	DT 11Mbps WLAN USB Station	DTUSBMonitor.exe	11Mbps USB based wireless LAN connection monitor - possibly from Deutsche Telekom
N	Dulux WeatherShield WeatherDesk	weather.exe	"Dulux WeatherShield WeatherDesk - latest weather information from across Australia"
X	Dvdcompat	Dvdcompat.exe	"Added by the GEMA TROJAN!"
N	DW4	Weather.exe	"Desktop Weather 4 by The Weather Channel - provides current temperature
N	DW4	DesktopWeather.exe	"Desktop Weather 4 by The Weather Channel - provides current temperature
N	DW6	DesktopWeather.exe	"Desktop Weather 6 by The Weather Channel - provides current temperature
U	DWHeartbeatMonitor	DWHeartbeatMonitor.exe	DWHeartbeatMonitor.exe is installed alongside the Weather.com instant messaging utility. This is a non-essential process. Disabling or enabling this is down to user preference
X	Dx8compat	Dx8compat.exe	"Added by the GEMA TROJAN!"
N	DXM6Patch_981116	p_981116.exe	"Win32 cabinet self extractor. More info here"
X	Dxupdate.exe	Dxupdate.exe	"Added by the MAFEG WORM!"
U	DynDNS Updater	DynDNS.exe	"Dynamic DNS IP address updater tool
N	DynDNS-Updater Traytool	ddutray.exe	"DynDNS updater tray icon - allows easy configuration of the Dynamic DNSSM service. Can be run manually"
N	E-Color Registration	SonnReg.exe	"Registration for Colorific® and 3Deep® monitor calibration sofware from E-Color. Now superseded by ColorWizzard™ and 3DxWizzard™"
U	e-Surveiller Station	estation.exe	"ESurveiller - surveillance software. Uninstall this software unless you put it there yourself"
U	eanth_critical_update_alert	sys_alert.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
U	eanth_critical_update_alert	EANTHO~1.EXE	"eAcceleration Stop-Sign security software related - previously not recommended (see here). It has now been delisted
U	eanth_system_patcher	sys_alert.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
N	Easy CD Creator	RoxAssist.exe	"Roxio Assistant is designed to correct engine initialization errors in Easy CD & DVD Creator 6. If the engine does not initialize
X	EasyDates	EasyDates.exe	Premium rate adult content dialler
X	EasyDates_gb	EasyDates_gb.exe	"""Edate-A"" premium rate adult content dialler"
X	EasyDates_nl	EasyDates_nl.exe	Adult content dialler
X	EasySearchBar	ESBUpdate.exe	EasySearchBar adware downloader
X	EbatesMoeMoneyMaker	wjview ...Code	"Ebates adware"
X	EbatesMoeMoneyMaker0	EbatesMoeMoneyMaker0.exe	"Ebates adware"
X	ebmmm	ebatesmmmv.exe	"Ebates adware"
U	eDataSecurity Loader	eDSloader.exe	"Part of Acer Empowering Technology. ""Acer eDataSecurity Management is a handy file encryption utility that protects files from being accessed by unauthorized persons
X	educational writer	[random filename]	"Added by the RBOT-LZ WORM!"
X	Efata	[random 5 characters].exe	"Added by the FLUKAN-D WORM!"
U	EFI Job Monitor	"[path] efjm.dll	run"
N	EgisTecLiveUpdate	EgisUpdate.exe	"Software updater for biometric and data encryption products from EgisTec Inc"
U	Eicon NetworksLAN_DAEMON	watch.exe	"Associated with an Eicon Networks ISDN or ADSL modem. Watch protocols your connection with numbers and duration. You need callvu.exe (from Start Menu) to see your connection statistics. You can manually start watch.exe before you go online. Needs diinfo.exe (started by DiTask) to work correctly which can be started manually"
U	Eicon TechnologyLAN_DAEMON	watch.exe	"Associated with an Eicon Networks ISDN or ADSL modem. Watch protocols your connection with numbers and duration. You need callvu.exe (from Start Menu) to see your connection statistics. You can manually start watch.exe before you go online. Needs diinfo.exe (started by DiTask) to work correctly which can be started manually"
X	eixfi	china.bat	"Added by the WCUP.A WORM!"
X	element furth	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are often located in %System%\vert"
U	EMBASSY Trust Suite Secure Update	AutoUpdate.exe	"Updates for Wave Systems Corp. Embassy Trust Suite - ""delivers advanced levels of security to the client PC using the TPM security chip found on most enterprise PCs today"""
X	eMCryT Sh3ars Panagers	[path to worm]	"Added by the RBOT-AWI WORM!"
?	encapsulated command tool	wintr.com	"??"
X	Enumerate Service	wsys.exe	"Added by the MANIFEST TROJAN!"
U	EPSON PictureMate Deluxe	E_FATI9TA.EXE	"Epson Status Monitor 3 for the PictureMate Deluxe compact photo printer - for monitoring printer status
U	EPSON Status Monitor 3	E_[various].EXE	"Epson Status Monitor 3 for their range of printer and AIO devices - for monitoring printer status
N	EPSON Status Monitor 3 Environment Check	e_srcv03.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check	e_srcv02.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check 2	e_srcv03.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check 2	e_srcv02.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
U	EPSON Stylus C120 Series	E_FATICCA.EXE	"Epson Status Monitor 3 for the Stylus C120 Series printer - for monitoring printer status
U	EPSON Stylus C67 Series	E_FATIAAL.EXE	"Epson Status Monitor 3 for the Stylus C67 Series printer - for monitoring printer status
U	EPSON Stylus C87 Series	E_FATIABL.EXE	"Epson Status Monitor 3 for the Stylus C87 Series printer - for monitoring printer status
U	EPSON Stylus CX2900 Series	E_FATIBFP.EXE	"Epson Status Monitor 3 for the Stylus CX2900 Series printer - for monitoring printer status
U	EPSON Stylus CX3500 Series	E_FATI9 BL.EXE	"Epson Status Monitor 3 for the Stylus CX3500 Series printer - for monitoring printer status
U	EPSON Stylus CX3600 Series	E_FATI9BE.EXE	"Epson Status Monitor 3 for the Stylus CX3600 Series printer - for monitoring printer status
U	EPSON Stylus CX3700 Series	E_FATIACP.EXE	"Epson Status Monitor 3 for the Stylus CX3700 Series printer - for monitoring printer status
U	EPSON Stylus CX3800 Series	E_FATIACA.EXE	"Epson Status Monitor 3 for the Stylus CX3800 Series printer - for monitoring printer status
U	EPSON Stylus CX3900 Series	E_FATIBEP.EXE	"Epson Status Monitor 3 for the Stylus CX3900 Series printer - for monitoring printer status
U	EPSON Stylus CX4200 Series	E_FATIAEA.EXE	"Epson Status Monitor 3 for the Stylus CX4200 Series printer - for monitoring printer status
U	EPSON Stylus CX4500 Series	E_FATI9AP.EXE	"Epson Status Monitor 3 for the Stylus CX4500 Series printer - for monitoring printer status
U	EPSON Stylus CX4600 Series	E_FATI9AA.EXE	"Epson Status Monitor 3 for the Stylus CX4600 Series printer - for monitoring printer status
U	EPSON Stylus CX4700 Series	E_FATIADL.EXE	"Epson Status Monitor 3 for the Stylus CX4700 Series printer - for monitoring printer status
U	EPSON Stylus CX4800 Series	E_FATIADA.EXE	"Epson Status Monitor 3 for the Stylus CX4800 Series printer - for monitoring printer status
U	EPSON Stylus CX5000 Series	E_FATIBVA.EXE	"Epson Status Monitor 3 for the Stylus CX5000 Series printer - for monitoring printer status
U	EPSON Stylus CX5500 Series	E_FATICAP.EXE	"Epson Status Monitor 3 for the Stylus CX5500 Series printer - for monitoring printer status
U	EPSON Stylus CX6000 Series	E_FATIBIA.EXE	"Epson Status Monitor 3 for the Stylus CX6000 Series printer - for monitoring printer status
U	EPSON Stylus CX6500 Series	E_FATI9EP.EXE	"Epson Status Monitor 3 for the Stylus CX6500 Series printer - for monitoring printer status
U	EPSON Stylus CX6600 Series	E_FATI9EE.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	EPSON Stylus CX6600 Series	E_FATI9EA.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	EPSON Stylus CX7000F Series	E_FATIBKA.EXE	"Epson Status Monitor 3 for the Stylus CX7000F Series printer - for monitoring printer status
U	EPSON Stylus CX7400 Series	E_FATICDA.EXE	"Epson Status Monitor 3 for the Stylus CX7400 Series printer - for monitoring printer status
U	EPSON Stylus CX7800 Series	E_FATIAFA.EXE	"Epson Status Monitor 3 for the Stylus CX7800 Series printer - for monitoring printer status
U	EPSON Stylus CX8300 Series	E_FATICEP.EXE	"Epson Status Monitor 3 for the Stylus CX8300 Series printer - for monitoring printer status
U	EPSON Stylus CX8400 Series	E_FATICEA.EXE	"Epson Status Monitor 3 for the Stylus CX8400 Series printer - for monitoring printer status
U	EPSON Stylus CX9300F Series	E_FATICFP.EXE	"Epson Status Monitor 3 for the Stylus CX9300F Series printer - for monitoring printer status
U	EPSON Stylus CX9400Fax Series	E_FATICFA.EXE	"Epson Status Monitor 3 for the Stylus CX9400Fax Series printer - for monitoring printer status
U	EPSON Stylus D68 Series	E_FATIAAE.EXE	"Epson Status Monitor 3 for the Stylus D68 Series printer - for monitoring printer status
U	EPSON Stylus D78 Series	E_FATIBGE.EXE	"Epson Status Monitor 3 for the Stylus D78 Series printer - for monitoring printer status
U	EPSON Stylus D88 Series	E_FATIABE.EXE	"Epson Status Monitor 3 for the Stylus D88 Series printer - for monitoring printer status
U	EPSON Stylus DX3800 Series	E_FATIACE.EXE	"Epson Status Monitor 3 for the Stylus DX3800 Series printer - for monitoring printer status
U	EPSON Stylus DX4000 Series	E_FATIBEE.EXE	"Epson Status Monitor 3 for the Stylus DX4000 Series printer - for monitoring printer status
U	EPSON Stylus DX4400 Series	E_FATICAE.EXE	"Epson Status Monitor 3 for the Stylus DX4400 Series printer - for monitoring printer status
U	EPSON Stylus DX4800 Series	E_FATIADE.EXE	"Epson Status Monitor 3 for the Stylus DX4800 Series printer - for monitoring printer status
U	EPSON Stylus DX5000 Series	E_FATIBVE.EXE	"Epson Status Monitor 3 for the Stylus DX5000 Series printer - for monitoring printer status
U	EPSON Stylus DX6000 Series	E_FATIBIE.EXE	"Epson Status Monitor 3 for the Stylus DX6000 Series printer - for monitoring printer status
U	EPSON Stylus DX7000F Series	E_FATIBKE.EXE	"Epson Status Monitor 3 for the Stylus DX7000F Series printer - for monitoring printer status
U	EPSON Stylus DX7400 Series	E_FATICDE.EXE	"Epson Status Monitor 3 for the Stylus DX7400 Series printer - for monitoring printer status
U	EPSON Stylus DX8400 Series	E_FATICEE.EXE	"Epson Status Monitor 3 for the Stylus DX8400 Series printer - for monitoring printer status
U	EPSON Stylus Photo 1400 Series	E_FATIBUA.EXE	"Epson Status Monitor 3 for the Stylus Photo 1400 Series printer - for monitoring printer status
U	EPSON Stylus Photo R1800	E_FATI9LA.EXE	"Epson Status Monitor 3 for the Stylus Photo R1800 printer - for monitoring printer status
U	EPSON Stylus Photo R220 Series	E_FATIAIE.EXE	"Epson Status Monitor 3 for the Stylus Photo R220 Series printer - for monitoring printer status
U	EPSON Stylus Photo R240 Series	E_FATIAHE.EXE	"Epson Status Monitor 3 for the Stylus Photo R240 Series printer - for monitoring printer status
U	EPSON Stylus Photo R2400	E_FATI9SA.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	EPSON Stylus Photo R2400	E_FATI9SE.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	EPSON Stylus Photo R260 Series	E_FATIBNA.EXE	"Epson Status Monitor 3 for the Stylus Photo R260 Series printer - for monitoring printer status
U	EPSON Stylus Photo R280 Series	E_FATICKA.EXE	"Epson Status Monitor 3 for the Stylus Photo R280 Series printer - for monitoring printer status
U	EPSON Stylus Photo R285 Series	E_FATICKE.EXE	"Epson Status Monitor 3 for the Stylus Photo R285 Series printer - for monitoring printer status
U	EPSON Stylus Photo R320 Series	E_FATI9FA.EXE	"Epson Status Monitor 3 for the Stylus Photo R320 Series printer - for monitoring printer status
U	EPSON Stylus Photo R340 Series	E_FATIAJE.EXE	"Epson Status Monitor 3 for the Stylus Photo R340 Series printer - for monitoring printer status
U	EPSON Stylus Photo R380 Series	E_FATIBOA.EXE	"Epson Status Monitor 3 for the Stylus Photo R380 Series printer - for monitoring printer status
U	EPSON Stylus Photo R800	E_FATI9YE.EXE	"Epson Status Monitor 3 for the Stylus Photo R800 printer - for monitoring printer status
U	EPSON Stylus Photo RX420 Series	E_FATI9CE.EXE	"Epson Status Monitor 3 for the Stylus Photo RX420 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX430 Series	E_FATI9CP.EXE	"Epson Status Monitor 3 for the Stylus Photo RX430 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX530 Series	E_FATIAGP.EXE	"Epson Status Monitor 3 for the Stylus Photo RX530 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX640 Series	E_FATIAME.EXE	"Epson Status Monitor 3 for the Stylus Photo RX640 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX680 Series	E_FATICJA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX680 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX700 Series	E_FATI9IA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX700 Series printer - for monitoring printer status
U	EPSON Stylus SX200 Series	E_FATIEFE.EXE	"Epson Status Monitor 3 for the Stylus SX200 Series printer - for monitoring printer status
U	EPSON SX100 Series	E_FATIEDE.EXE	"Epson Status Monitor 3 for the SX100 Series printer - for monitoring printer status
U	EPSON TX100 Series	E_FATIEDP.EXE	"Epson Status Monitor 3 for the TX100 Series printer - for monitoring printer status
U	EPSON WorkForce 30 Series	E_FATIEEA.EXE	"Epson Status Monitor 3 for the WorkForce 30 Series printer - for monitoring printer status
U	EPSON WorkForce 500 Series	E_FATIEQA.EXE	"Epson Status Monitor 3 for the WorkForce 500 Series printer - for monitoring printer status
U	EPSON WorkForce 600 Series	E_FATIEKA.EXE	"Epson Status Monitor 3 for the WorkForce 600 Series printer - for monitoring printer status
Y	eSafe Protect	ESPWatch.exe	"eSafe from Aladdin - internet security for gateway and E-mail servers"
U	eScan Updater	Trayicos.exe	"MicroWorld eScan antivirus updater - allows users to automatically download updates and set the auto time interval for downloads"
X	Especial	Deneca.bat	"Added by the DELUZ VIRUS!"
U	eTrust PestPatrol Active Protection	PPActiveDetection.exe	"PestPatrol real-time protection feature. ""Stops spyware before it infects your system"""
X	EventApplicationCmd	smschk.exe	"Added by the IRCBOT-AO TROJAN!"
N	Evidence Eliminator	ee.exe	"Evidence Eliminator - cover the tracks of your browsing habits and E-mails if you think you need to. Run manually on a regular basis"
X	ewupdater	ewupdater.exe	"EasyWebSearch adware updater"
N	Excite Platform	Exlaunch.exe	Loads an Icon in the startup tray that allows you to receive service update notices for Excite@Home if you desire (note that since Excite@Home appears to be winding down this becomes irrelevant). May also allow you to kill the Excite Toolbar that automatically loads in Internet Explorer
?	Excite Private Messenger Pipe	x8impipe.exe	"??"
X	ExFilter	"Rundll32.exe [path] cdnspie.dll	ExecFilter"
X	Expatch	[random filename]	"Added by the PWSLMIR-G TROJAN!"
X	Explorer	[path to worm]	"Added by the AUTEX WORM!"
X	explorer	[path to trojan]	"Added by the AGENT-EU TROJAN!"
X	Explorer	TXP1atform.exe	"Added by the FUJACKS.CA VIRUS!"
X	Explorer 2238	[path to trojan]	"Added by the AGENT-CPI TROJAN!"
X	Explorer Updater	IEXPLORE.exe	"Added by the SDBOT-WO WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
U	E_S[numbers]	[path] E_[various].EXE [path] E_S[numbers].tmp	"Temporary entry related to Epson Status Monitor 3 for their range of printer and AIO devices - for monitoring printer status
U	F-PROT Antivirus Tray application	FProtTray.exe	"System Tray access to F-PROT Antivirus"
X	F-Secure Gatekeeper	[malware name].exe	"Added by the NUWAR.AXQ WORM!"
X	f94mggfhfghodftdf	[path to trojan]	"Added by the SMALL.JHZ TROJAN!"
U	Fabrik Ultimate Backup Status	fabrikhomestat.exe	"Status monitor for Fabrik Ultimate Backup from Fabrik Inc. ""No matter what happens to the drive on your desk - a spilled drink
N	FastTrack Accelerator	SPEED UP.EXE	"FastTrack Accelerator - ""speedup"" utility for programs that use the FastTrack network such as KaZaA Media Desktop
X	faT	faT.exe	"Added by the BANKER-DFP TROJAN!"
X	fat.exe	fat.exe	"Part of the WinAntiVirus Pro 2006 and WinAntiVirus Pro 2007 rogue security programs - not recommended
X	Fat32 Microsoft	fat32.exe	"Added by the RBOT-EL WORM!"
U	FatPipe	DHCP	Software enabling high speed internet browsing (2-4 times faster) and internet connection sharing for up to 5 users
U	Fatpipe Dialer	fpdialer.exe	Dailler for Fatpipe - software enabling high speed internet browsing (2-4 times faster) and internet connection sharing for up to 5 users
U	fatrecov	fatrecov.exe	SCKeyLog.j keystroke logger/monitoring program - remove unless you installed it yourself!
X	fddddHOME	dxxatp.exe	"Added by the RANKY.AA TROJAN!"
X	FestPlattenCleaner	SysRep.exe	"FestPlattenCleaner
X	FestplattenReiniger	GDC.exe	"FestplattenReiniger
X	ff	[path to worm]	"Added by the RBOT-XL WORM!"
U	FG1_00	frntgate.exe	"FrontGate MX - e-mail spam blocker"
X	file laoder configuration	rnd32.exe	"Added by the RBOT.BQJ WORM!"
N	filehippo.com	UpdateChecker.exe	"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
N	FileHippo.com Update Checker	UpdateChecker.exe	"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
X	FileSoft	Wscript.exe UpdataFiles.vbs	"Added by the SST.B WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""UpdataFiles.vbs"" file is located in %Windir%"
U	FilterGate	filtergate.exe	"Filtergate internet filtering software - filters sounds
X	FindHack	[path to worm]	"Added by the KELVIR-BA WORM!"
U	FinePrint Dispatcher v4	fpdisp4a.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 4.x of the software. ""FinePrint saves ink
U	FinePrint Dispatcher v4	fpdisp4.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 4.x of the software. ""FinePrint saves ink
U	FinePrint Dispatcher v5	fpdisp5a.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 5.x of the software. ""FinePrint saves ink
X	FireExplore Update	FireExplore.exe	"Added by a variant of the RBOT WORM!"
X	Firevall Administrating	rndll.exe	"Added by the PUSHBOT-B WORM!"
X	Firewall	SP2 UPDATE.exe	"Added by the ELITPER.E WORM!"
X	Firewall	Firewall.bat	"Added by the YPSAN.G WORM!"
X	Firewall Administrating	infocard.exe	"Added by the AUTORUN-AYV WORM! Note - this is not the valid InfoCard Service which is part of the .NET Framework from Microsoft and uses the same filename"
X	Firewall auto setup	[path to trojan]	"Added by the AGENT-GLY TROJAN!"
X	Firewall Update System1	WinedowsUpdater1.exe	"Added by the RBOT-ARU WORM!"
X	Firewall Updater	msnupdateit.exe	"Added by the RBOT-AAQ WORM!"
X	fjdslssdfd	mat2.exe	"Added by the SLAPEW.C TROJAN!"
X	Flash Driver	[path to trojan]	"Added by the AGENT.CWVT TROJAN!"
X	Flash Media	[path to trojan]	"Added by the IRCBOT.AUR TROJAN!"
X	Flash Player2	[path to worm]	"Added by the IRCBOT.PD WORM!"
N	FlashPath Monitor	SDSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
N	FlashPath Monitor	FLSHSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
N	FlashPath Status	SDSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
N	FlashPath Status	FLSHSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
X	Floppy Master	[path to trojan]	"Added by the ZONIT-F TROJAN!"
X	FlyswatDesktop	flydesk.exe	Advertising spyware
X	FolderRaper	[path to worm]	"Added by the VB.GOZ WORM!"
N	FotoStation Easy AutoLaunch	FotoStation Easy AutoLaunch.exe	Installed with a Nikon digital camera. Used to collect photos uploaded from camera program NkVwMon.exe. If your camera is not connected (via USB port) you do not need this program loaded either
X	free-save	[path to risk]	"Freesave security risk that tracks and sends browser information and visited websites on the computer. Uninstall this software unless you put it there yourself"
X	FreeAttention	eqsefeqe.exe	Added by an unidentified WORM or TROJAN!
X	fsdsft	[path to backdoor]	"Added by the RANKY.S BACKDOOR!"
U	Fujitsu Hotkey Utility	IndicatorUty.exe	"Fujitsu Hotkey Utility displays icons on the screen when you use hotkeys on a Fujitsu Siemens Lifebook
X	game	patcher.scr	"Added by the PSW-ED TROJAN!"
X	Games Acceleration	svshost.exe	"EasySearch adware"
X	Games Acceleration	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Games Acceleration	svshost1.exe	"Added by the DLOADR-AWD TROJAN!"
X	Games toolbar	rundll32.exe [path] tbGame.dll DllShowTB	"Topconverting.com/180Search ""Games Toolbar"" adware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
U	GARO Status Monitor	cnwism.exe	Print monitor for certain Canon printers
X	Gate Personal Firewall	Systpl.exe	"Added by the RBOT.ADC WORM"
N	Gateway Extended Warranty	GWCares.exe	Gateway Extended Warranty reminder
X	Gator	gator.exe	"Gator eWallet adware. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	Gator eWallet	gator.exe	"Gator eWallet adware. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	GDAX	[path to backdoor]	"Added by the RANKY.K TROJAN!"
X	genserv path	sdqdqg.exe	"Added by the SDBOT-RF WORM!"
Y	GhostSurfDelSatellite	DeleteSatellite.exe	"Part of SpyCatcher spyware remover from Tenebril. Prevents rogue programs from sending personal information to a remote user via the Internet. If you use SpyCatcher with real time scanning
X	GigaByte	Cheatle.exe	"Added by the SHODI.B VIRUS!"
U	Giganews Accelerator	GiganewsAccelerator.exe	"Giganews Accelerator from Giganews
Y	Gilat SOM Enumerator	dllhost.exe	For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system
Y	GilatFTC	ftc.exe	For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system
X	gimmygames	[path to trojan]	"Added by the DLOADR-LN TROJAN!"
U	Google IME Autoupdater	GooglePinyinDaemon.exe	"Google Pinyin Input Method Editor (IME) - allows a user to input Chinese characters by entering the pinyin of a Chinese character (with or without tone
N	Google Update	GoogleUpdate.exe	"Update manager for the range of tools available from Google - such as the Chrome web browser and Picasa photo manager. Located in %AppData%\Google\Update"
X	Google Update	GoogleUpdate.exe	"Added by the BUZUS.DBFM TROJAN! Note - this is not the valid Google program which is normally located in %AppData%\Google\Update. This version resides in %System%"
N	Google Updater	GOOGLE~1.EXE	"Downloads and installs updates for Google applications (Google Earth
N	Google Updater	GoogleUpdater.exe	"Downloads and installs updates for Google applications (Google Earth
X	GoogleUpdater3	GoogleMapper.exe	"Added by the ROUTROBOT WORM!"
X	gotnewupdate000.exe	gotnewupdate000.exe	"Added by the FAKEAV-BGA TROJAN!"
X	GP Updater	gpupdater.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
?	gramdate	2Stop.exe	"??"
X	Graphic Update	openglx.exe	"Added by the IRCBOT.AMU WORM!"
X	GreasyPalmUpdate	GreasyPalmUpdate.exe	"SearchFast adware"
X	GreatDefender	GreatDefender.exe	"GreatDefender rogue security software - not recommended
X	GreatDefender.exe	GreatDefender.exe	"GreatDefender rogue security software - not recommended
X	GreatDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Gremlin	intrenat.exe	"Added by the DOOMJUICE WORM!"
?	GSISETUP	[path] GsiInst.exe INSTALL [path] V205Res 13	"BT Voyager ADSL modem related - what does it do and is it required?"
X	gssomatic	gssomatic.exe	"Searchcentrix hijacker"
N	Gtwatch	gtwatch.exe	Associated with a Mustec scanner and not required
Y	GuardGui Application	GuardGui.exe	"System Tray access to the main user interface for Ashampoo® AntiVirus from Ashampoo GmbH & Co. KG."
X	HanUpdate	hanz.exe	"Added by the RBOT-GLJ WORM!"
X	HataDuzelticisi	SysRep.exe	"HataDuzelticisi
X	HATAPE	[path to trojan]	"Added by the BANKER-QF TROJAN!"
X	helper.dll	rundll32.exe [path] helper.dll	"CnsMin (Chinese Keywords) hijacker related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
U	Hibernation	hib32.exe	"Reduces the power consumption when the laptop isn't being used to preserve battery power. Similar programs on other laptops reduce the processor clock rate
X	hid_start	gzmrotate.dll	"AdRotator/IconAds adware"
Y	HighPoint ATA RAID Management Software	raidman.exe	"HighPoint RAID management - hard disk striping/mirroring utility for increased performance and reliability. See here for more information on RAID"
X	himem.exe	[path to worm]	"Added by the STRATION-FW WORM!"
X	HKLMRun	windowsupdate.exe	"Added by the FORBOT-BJ WORM (where HKLM\Run represents HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run)!"
X	HLL Data Parameter	hllcxpa.exe	"Added by the RBOT.AFG WORM!"
N	Home Theater SchSvr	SchSvr.exe	"WinScheduler is installed with Home Theater Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
X	Hotfix Updat	svdhost32.exe	"Added by the GAOBOT.ZW WORM!"
X	HotKeysCmds	[path to worm]	"Added by the PAHATIA-A WORM!"
U	HP Instant Support	matcli.exe	""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	HP Presentation Ready	PresRdy.exe	HP Omnibook related: "Press a dedicated button above the keyboard and the system will instantly load your presentation software and change the screen resolution to match your display device"
U	HP ScanPatch	HPScanFix.exe	"Program that starts up and automatically fixes earlier versions of the Scanjet 5100c software. If a Scanjet 5100C scanner is not going to be used
N	HP software update	HPWuSchd2.exe	HP software updates. If a shortcut doesn't exist create your own and run it manually
N	HP software update	HPWuSchd.exe	"HP software updates. If a shortcut doesn't exist
N	HP Status	hpstatus.exe	HP Printer Status and Alerts
?	HP Status Server	hpboid.exe	"Copied during installation of HP Inkjet Printer Drivers in Win2K/XP. What does it do and is it required?"
X	HP Update Assistant	HPAware.exe	Added by the MRO TROJAN!
N	HP Updates	??	"On HP PCs
N	HP_dla	dlatray.exe	"On HP PCs
U	HTpatch	htpatch.exe	HTpatch.exe is part of the SiS AGP patch - BUT unless your processor (and motherboard) supports HyperThreading (HT) and this feature is enabled it will actually SLOW your graphics card by around 6%
U	HughesNet Tools	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	hxadsec	[path to trojan]	"Added by the ADCLICK-AP TROJAN!"
X	ibin	[path to trojan]	"Added by the PERDA-C TROJAN!"
U	IBM ThinkPad EasyEject Support Application	EzEjMnAp.Exe	"EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
U	IBM TrackPoint Accessibility Features	tp4ex.exe	"Supports accessibility features for the TrackPoint stick and associated buttons on IBM/Lenovo ThinkPad notebooks. If features such as ""Click Sound""
?	IBM Warranty Notification	ERTS0749.exe	"IBM Warranty Notification - presumably it's a reminder to either register or that warranty is about to expire?"
X	icifati	yujixit.exe	"Added by the SDBOT.ZZH WORM!"
N	Icon Animation	HDE.EXE	Part of McAfee Nuts & Bolts. Provides entertaining animation of your desktop icons
Y	iconcache	icon.bat	"Related to the Vista Customization Pack"
X	ICQ Center	[path to worm]	"Added by the RANDIN WORM!"
X	ICQ Chat Service	icqjdhs.exe	"Added by a variant of the RBOT WORM!"
X	IcqBeta	webcamupdate.exe	Added by an unidentified TROJAN!
X	ICQMsn	[path to trojan]	"Added by the RANCK-AH TROJAN! The most common example is ""cbfks.exe"" located in %System%"
X	icrosoft Windows DLL Services Configuration	poker3.exe	"Added by the SDBOT-AER WORM!"
X	IDTemplates	IDTemplate.exe	"Added by the BRONTOK-H WORM!"
X	IE Java Update	iejava.exe	"Added by the AGENT-HD TROJAN!"
X	IE Menu Extension toolbar	rundll32.exe [path] tbextn.dll DllShowTB	"Topconverting.com/180Search ""IEMenuExtension"" toolbar. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	IEAgent update check	iewatch.exe	"Added by the BOMKA TROJAN!"
X	IEexplorer AUpdate	IEexplore32.exe	"Added by the RBOT-GRE WORM!"
X	IEFeatures	IEFeatures.exe	"Added by the POPMON.A TROJAN! - also known as PopMonster adware"
X	IEFeatures	Internetfeatures.exe	"Added by the POPMON.A TROJAN! - also known as PopMonster adware"
X	ieupdate	MCP****.exe [**** = random char]	"Added by the ASOXY TROJAN!"
X	ieupdate	mcpdll32.exe	Adware downloader trojan
X	ieupdate	[random filename]	"Added by the AGENT-C BACKDOOR!"
X	ieupdates	ieupdates.exe	"Added by a number of TROJANS such as DWNLDR-HGI and AGENT-HGA and the Antivirus 2009 rogue security software - see here"
X	IEXPLORE.EXE	[path to trojan]	"Added by the BANCOS-CJ TROJAN!"
X	igamatu	ekor.exe	"Added by the SDBOT.AQ TROJAN!"
X	igamatu	atecaca.exe	"Added by the IRCBOT.R WORM!"
U	IKL	rundll32.exe [path] IKL.dll	"IKL surveillance software. Uninstall this software unless you put it there yourself"
X	Image	"rundll32 [path] [trojan filename]	Install"
X	ImagePath	taskbarmngr.exe	"Added by the SDBOT-XB WORM!"
U	Imatio	imation.exe	"Imation Disk Manager - enables you to create a password protected area on your Imation USB flash drive"
X	imchat	imchat.exe	"Added by a variant of the IRCBOT TROJAN!"
N	Imesh Auto Update	??	"Update check for the Imesh file sharing system. Turn the update off under ""options"""
X	imgit	[path to file]	"Added by the BANKER-EM TROJAN!"
X	IMJPMIG6.1	HelpCat.exe	"Added by the BESVERIT WORM!"
X	imonitor	[path to trojan]	"Added by the IMONI-A TROJAN!"
X	Indexindicator	Indexindicator.exe	"Added by the LAZAR TROJAN!"
U	IndicatorUty	IndicatorUty.exe	"Fujitsu Hotkey Utility displays icons on the screen when you use hotkeys on a Fujitsu Siemens Lifebook
X	Inet DataBase	Inetdbs.exe	"Added by the QEDS WORM!"
X	INFO DATA	apc.exe	"Added by the RANDON.B WORM!"
X	InfoData	"rundll32.exe ********.dll	realset [* = random char]"
X	Information Update	iu.exe	"Detected by Kaspersky as the CENTIM.CH TROJAN!"
X	Init	[path to trojan]	"Added by the DROPPER.EAT TROJAN!"
N	InkWatch	InkWatch.exe	Associated with Canon (and maybe other) printers. Tells you when the ink's running low and asks if you want to buy another cartridge on-line
X	Install part II	updates.exe	"Added by the RELFEERWORM!"
X	InstallProgram	[path to trojan]	"Added by the AGENT-HHU TROJAN!"
X	Installs SP2	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are located in %System%\qpalsp"
X	Installs SP4	[path] repcale.exe [path] p0rd.exe	"Added by the RANDON-AK WORM! Both files are located in %System%\ekrlgc"
X	Instance 001	[path to worm]	"Added by the ALASROU-A WORM!"
N	Instant Update Center	reminder.exe	"Event reminder for calendar dates
U	Instant Wireless Configuration Utility	WUSB11cfg.exe	"Utility used by the LINKSYS LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
U	Instant Wireless Configuration Utility	WPC11Cfg.exe	"Utility used by the LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
X	instit	instit.bat	"Added by the OPASERV.H WORM!"
X	instit	INSTIT.BAT	"Added by the OPASERV.K WORM!"
X	Intec Service Drivers	[path to worm]	"Added by the RBOT-GLU WORM!"
X	Intec Services Drivers	msupdate22e.exe	"Added by the RBOT-CGC WORM!"
X	InterceptedSystem	[path to worm]	"Added by the ANACON-B WORM!"
X	internat	internat.exe	"Added by the LYDRA-F TROJAN! Note - the real internat.exe resides in %windir%\system (where %windir% is the Windows directory - C:\Windows or C:\Winnt) whereas this version resides in %windir%"
X	Internat	systray.exe	"Added by the ALADINZ.P TROJAN! Note - this is not the legitimate systray.exe process. If you right-click on the real systray.exe the ""Properties"" reveal it to be a Microsoft file"
X	Internat	msgsrv32.exe	"Added by the NYRUBOT-A BACKDOOR! Note - this is not the legitimate msgsvr32.exe process on a Win9x/Me system which should not appear in MSConfig/startup!"
X	Internat	[trojan filename]	"Added by the CMJSPY-Y TROJAN!"
X	Internat Conf	bootconf.exe	"Homepage hijacker
N	internat.exe	internat.exe	"Microsoft language selection icon in system tray
X	Internat.exe	internat.exe	"Added by the NETSNAKE TROJAN! Note - the real internat.exe resides in %windir%system (Win98/Me) or %windir%System32 (WinNT/2K/XP) (where %windir% is the Windows directory - C:\Windows or C:\Winnt) and has a ""?"" icon wheras this version resides in %windir% and has a ZIP icon"
X	Internet Application Driver	expIorer.exe	"Added by the IRCBOT-WK TROJAN!"
X	Internet Connection Wizard	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
U	Internet Download Accelerator	ida.exe	"Internet Download Accelerator download manager"
X	Internet Explorer Auto-Update	updt32v5.exe	"Added by the SPYBOT-AB BACKDOOR!"
X	Internet Explorer Configuration	IEXPLORE.EXE	"Added by the SDBOT-UL WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Internet Explorer Updater	lexbac.exe	"Added by the DOWNLOAD TROJAN!"
X	Internet Explorer Updater	iexplorer.exe	"Added by the REUR.B WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Internet Mail and News	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Internet Protocol Configuration Loader	ipcl32.exe	"Added by the SDBOT TROJAN!"
X	InternetGetConnectedState	winupdate.exe	"Added by the SDBOT-JN WORM!"
X	InternetGetConnectedStateEx	winupdate.exe	"Added by the SDBOT-JN WORM!"
X	Inters Configuration Loader	RCL0ADERS.exe	"Added by the SDBOT-KX WORM!"
X	Intrenat	Intrenat.exe	"Added by the LEMIR.E TROJAN!"
N	Introduction-Registration	??	"For Compaq PC's. Should only run first time
X	IntSys1	[path to trojan]	"Added by the BANLOA-ASE TROJAN!"
U	Iomega Automatic Backup	ibackup.exe	"Iomega Automatic Backup - automatic backups for use with Iomega portable HDD"
U	Iomega Automatic Backup 1.0.1	ibackup.exe	"Iomega Automatic Backup - automatic backups for use with Iomega portable HDD"
N	Iomega Watch	IOWATCH.EXE	Used by Iomega drives. Available via Start -> Programs
N	IPO3	IP Operator 2005.exe	"
?	iPodWatcher	iPodWatcher.exe	"Associated with Apple's iPod® player. Detects when the iPod® is connected?"
X	IPSEC Configuration	wsupdate.exe	"Added by the AGOBOT-IQ WORM!"
X	IPTable Configuration	Winipcfgs.exe	"Added by a variant of the RBOT WORM!"
N	iRiver Updater	Updater.exe	"Updates for the iRiver Music Manager - used with their digital music players"
X	Irwftp	[path to trojan]	"Added by the BANCOS-AP TROJAN!"
U	isDeleteMe	isDel.bat	Used by Norton Internet Security to remove certain files and directories on reboot when uninstalling their product
U	ISDNwatch	IWatch.exe	"FRITZ!X ISDNWatch - ""dialing filter for more security and control on the ISDN PC. The PC is doubly protected against dialer programs and premium-service numbers: ISDNWatch allows the user to block calls to and from both individual numbers and whole number blocks"""
N	ISSI EZUpdate Service	issimsvc.exe	Part of IBM Global Services - used internally by IBM for automatic updating of software and Microsoft patching
X	ixproxy	[path to trojan]	"Added by the XORPIX-A TROJAN!"
X	Java (VM) v6.9	jav.bat	"Added by the AGENT-GZK TROJAN!"
X	Java Application	vssmf32.exe	"Added by the SPIGOT BACKDOOR!"
X	Java Auto Update	ujm.exe	"Added by the SDBOT-ADH WORM!"
X	Java update	javaqs.exe	"Added by the SWARLEY.A WORM!"
X	Java Update	keeper.exe	"Added by the AGENT-DIS TROJAN!"
X	Java Update	svchost.exe.exe	"Added by the AGENT-LBS TROJAN!"
X	Java Update	hostwww.exe.exe	"Added by the AGENT-MFH TROJAN!"
X	Java VM v6.9.2	jav.bat	"Added by the DWNLDR-HLM TROJAN!"
X	Java VM v6.91	jav.bat	"Added by the DWNLDR-HLL TROJAN!"
N	Java(TM) Platform SE 6	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
N	Java(TM) Platform SE 6 U*	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now. U* represents the update version
N	Java(TM) Platform SE Auto Updater 2 0	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
X	Java32 Configuration Loader	msnmesgr.exe	"Added by a variant of the RBOT WORM!"
X	JavaTray	traymgr.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	JavaUpdate0.07	[filename]	"Added by the JUPDATE TROJAN!"
X	JavaUpdateSched	jusched32.exe	"Added by the BCKDR-CKB BACKDOOR!"
Y	JetAdmin Discovery Indicator	HPJETDSC.EXE	"HP JetAdmin software for HP JetDirect Print Servers. HPJETDSC.EXE is the file necessary for the JetAdmin Discovery Indicator (paper airplane in the taskbar). It gets launched automatically through the registry
X	jijbl	ezlwy.bat	"Added by the REDDW WORM!"
X	jon315	[path to trojan]	"Added by the MAILBOT-BI TROJAN!"
X	jpgdiag	[path to worm]	"Added by the STRATION-AN WORM!"
X	jusched	[path to trojan]	"Added by the BANKER-BWR TROJAN!"
X	KAT	KAT.vbs	"Added by the SOAD-D WORM!"
U	KatMouse	KatMouse.exe	"KatMouse - utility to enhance the functionality of mice with a scroll wheel
N	KAZAA	[path] kpp.exe [path] kazaalite.kpp	"System Tray access to later versions of the Kazaa Lite P2P file sharing utility - namely the K++ and Resurrection variants. Kazaa Lite is the unauthorized modification of the original Kazaa Media Desktop - with the malware removed"
X	Kazaa Download Accelerator Updater (required)	regsvr32 kdp****.dll [* = random char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
U	KClient	kstatus.exe	KClient Kerberos client software for Win32 systems. It provides the libraries and utilities needed to use Kerberos-based PC applications developed by Computing Services such as KWeb and NiftyTelnet
U	KE9801	DriBat32.exe	KE9801 multimedia keyboard driver - required if you use the multimedia keys
X	Kernel	Update.exe	"Added by the DELF-FN TROJAN!"
X	kernel system daemon	ACTIVAT0R.exe	"Added by the RANDEX.AW WORM!"
X	KernelRuntime	[path to worm]	"Added by the MYTOB-JO WORM!"
X	keyboard	[path to trojan]	"Added by the DLOADR-AOZ TROJAN!"
?	Keyboard Status	KeyStat.exe	"Multimedia keyboard manager for Medion desktop and notebook PCs? Located in %ProgramFiles%\Medion\KeyStat"
U	KeyPatrol	KeyPatrol.exe	"KeyPatrol - key logger detector using both behavioral and pattern-matching algorithms that used to be part of PestPatrol before CA's aquisition"
X	kfienq	masbl.bat	"Added by the KIFER TROJAN!"
X	KHATARNAK Loader	KHATARNAK.exe	"Added by the AUTORUN.ACO WORM!"
X	Kiamat Sudah Dekat_16_04	ISASS.exe	"Added by the PAHATIA.B WORM!"
X	klop	[path to file]	"Added by the AGENT-WQ TROJAN!"
N	Kodak Batch Transfer	pezdow1.exe	Part of "Kodak Picture Easy" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC
N	Kodak Picture Easy *.* Batch Transfer	PezDownload.exe	"Part of ""Kodak Picture Easy"" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC. *.* represents the version"
N	Kodak Software Updater	backweb*****.exe	"Software updater for Kodak Easyshare digital cameras"
N	KODAK Software Updater	Kodak Software Updater.exe	"Software updater for Kodak Easyshare digital cameras"
U	Komunikator	tlen.exe	"Tlen - a Polish language instant messaging client"
X	ksrlnhm	zxatgso.exe	"Added by the DLOADER-LI TROJAN!"
X	lameshit	[path to trojan]	"Added by the LOWZONE-H TROJAN!"
X	LanGuard	[path to trojan]	"Added by the DLOADER-VO TROJAN!"
?	LanzarL2007	[path] setup.exe	"??"
?	Lasb	ewat.exe	"??"
X	LAsIAf32	RePEAtLD.exe	"Added by the REPEATLD WORM!"
?	Later	later.exe	"??"
N	Launch Application	LaunchApplication.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
N	Launch YahooPOPs! at Windows startup	YAHOOPOPS.EXE	"YahooPOPs - enables free POP3/SMTP access to Yahoo! Mail through a service on localhost that emulates the web interface. Available via Start -> Programs"
N	LaunchApplication	LaunchApplication.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
U	Lavasoft Adwatch	Ad-watch.exe	"Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system"
X	LetsRock	[path to trojan]	"Added by the RANKY.Y BACKDOOR!"
X	Letum	[path to worm]	"Added by the LETUM.A WORM!"
N	LG Intelligent Update	autoupdate.exe	"Automatic update utility for LG Notebooks"
U	LGODDFU	fwupdate.exe	Auto firmware update program for LG Electronics CD-ROM/DVD writer
X	Life FireWall Update1	FireWall-Update1.exe	"Added by the RBOT-ARS WORM!"
U	LifeChat	LifeChat.exe	"Support software for Microsoft's ""LifeChat"" headsets - which are optimized for use with Windows Live Messenger"
X	Litebot	[path to trojan]	"Added by the LITEBOT-A TROJAN!"
X	Live update monitor	srvany32.exe	"Added by the AGOBOT.AFM WORM!"
X	live update monitor	umxlu32.exe	"Added by the AGOBOT.ADK WORM!"
U	LiveUpdate	LiveUpdate.exe	"Web-update utility as used by various types of software - see here"
X	LiveUpdate	[Windows username]05.exe	"Added by the LINEAGE TROJAN!"
X	LiveUpdate	smss.exe	"Added by the VB.BAU BACKDOOR! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\isas"
N	LiveUpdate	Copyer.exe	"Samsung PC Studio is a Windows-based PC program package that you can use easily to manage personal data and multimedia files by connecting a Samsung Electronics Mobile phone (GSM/GPRS/UMTS) to your PC. You can launch the update manually - see the instructions
X	LiveUpdate32	services.exe	"Added by the VB.BAU BACKDOOR! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\isas"
X	Livre	Dibane.bat	"Added by the BANEDI VIRUS!"
X	lk3h1	[path to file]	"Added by the MOSUCK-G TROJAN!"
N	LM Status	LMSTATUS.EXE	Xerox WorkCenter XE - language monitor status application
N	LMSTATUS	LMSTATUS.EXE	Xerox WorkCenter XE - language monitor status application
X	lnternet Update	lExplore.exe	"Added by the RBOT-GRH WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	load	[path to worm]	"Added by the KELVIR.AI WORM!"
X	load	Internat.exe	"Added by the WOWCRAFT TROJAN!"
X	load	KHATRA.exe	"Added by the ORBINA-A WORM!"
U	load=	asistat.exe	Status monitor for an NEC SuperScript printer
X	load=	msater.exe	"Added by the RETSAM TROJAN!"
?	Load=	wtfeat.exe	"Associated with the Wintab Digitizer"
X	loaddr	[path to trojan]	"Added by the AGENT-DIY TROJAN!"
X	LoadOrderVerification	[random filename]	"Added by the TRON.A TROJAN!"
?	LoadWatcher	Test.exe	"Reportedly part of a webcam surveillance program that's supposed to test SMTP dialling in the event of an alert? Is this correct?"
X	LoadWatcher	watcher.exe	"Watcher spyware"
X	Local Service	Intenat.exe	"Added by the NUCLEAR-J TROJAN!"
X	Locator Service	[filename]	"Added by the AGOBOT-KY TROJAN!"
X	login	[path to trojan]	"Added by the HOTWORD-A TROJAN!"
X	Login Service	[path to file]	"Added by the MIGMAF TROJAN!"
Y	Logitech	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
N	Logitech . Product Registration	eReg.exe	"Registration reminder from Leader Technologies for Logitech software such as SetPoint for their range of wired and wireless keyboards and pointing devices (mice
Y	LogitechCommunicationsManager	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	LogitechRegisterVideoApplications	InstallHelper.exe	Entry added when you install versions of the Logitech QuickCam webcam software and used to register video applications that can use the webcam on the first reboot after installing the software
N	LogitechSoftwareUpdate	ManifestEngine.exe	"Automatic updater for versions of Logitech QuickCam webcam software. Check for updates via the System Tray icon - see the LogitechVideoTray entry"
X	Logo	[path to trojan]	"Added by the DLOADER-RH TROJAN!"
X	LogonAdministrator	imoet.exe	"Added by the RAHIWI.A WORM!"
X	LogonAdministrator	CSRSS.EXE	"Added by the KORRON.B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
U	LogWatch	logwat95.exe	Licensing patch for products installed on NT by Computer Associates such as eTrust. Detects and updates old versions of lic98.dll. Not required if you already have a newer version or the patch has been applied
N	LowRateVoip	LowRateVoip.exe	"LowRateVoip - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X	lsass	start.bat	"Added by the ZCREW TROJAN!"
X	lsass	[path to lsass.exe]	"Added by the ALADINZ.F TROJAN! Note - this is not the legitimate lasss.exe process which should NOT appear in Msconfig/Startup!"
X	LsasS	Sygate.exe	"Added by the SDBOT.BCA WORM!"
X	lsass2k Update	lsass2k.exe	"Added by a variant of the RBOT WORM!"
Y	lsburnwatcher	lsburnwatcher.exe	"HP software which helps one create labels after a music CD is burned using LightScribe discs. If you want to use LightScribe labeling
Y	LSBWatcher	lsburnwatcher.exe	"HP software which helps one create labels after a music CD is burned using LightScribe discs. If you want to use LightScribe labeling
X	LTM2	winupdate.exe	"Added by the LITMUS.203 TROJAN!"
X	ltwob	formatsys.exe	"Added by the SERFLOG.A WORM!"
Y	LXBSCATS	"rundll32 [path] LXBStime.dll	_RunDLLEntry@16"
Y	LXBTCATS	"rundll32 [path] LXBTtime.dll	_RunDLLEntry@16"
Y	LXBUCATS	"rundll32 [path] LXBUtime.dll	_RunDLLEntry@16"
Y	LXBXCATS	"rundll32 [path] LXBXtime.dll	_RunDLLEntry@16"
Y	LXBYCATS	"rundll32 [path] LXBYtime.dll	_RunDLLEntry@16"
Y	LXCCCATS	"rundll32 [path] LXCCtime.dll	_RunDLLEntry@16"
U	LXCDCATS	"rundll32 [path] LXCDtime.dll	_RunDLLEntry@16"
Y	LXCECATS	"rundll32 [path] LXCEtime.dll	_RunDLLEntry@16"
Y	LXCFCATS	"rundll32 [path] LXCFtime.dll	_RunDLLEntry@16"
Y	LXCGCATS	"rundll32 [path] LXCGtime.dll	_RunDLLEntry@16"
Y	LXCJCATS	"rundll32 [path] LXCJtime.dll	_RunDLLEntry@16"
Y	LXCQCATS	"rundll32 [path] LXCQtime.dll	_RunDLLEntry@16"
Y	LXCRCATS	"rundll32 [path] LXCRtime.dll	_RunDLLEntry@16"
Y	LXCTCATS	"rundll32 [path] LXCTtime.dll	_RunDLLEntry@16"
Y	LXCYCATS	"rundll32 [path] LXCYtime.dll	_RunDLLEntry@16"
Y	LXDBCATS	"rundll32 [path] LXDBtime.dll	_RunDLLEntry@16"
Y	LXDCCATS	"rundll32 [path] LXDCtime.dll	_RunDLLEntry@16"
Y	LXDDCATS	"rundll32 [path] LXDDtime.dll	_RunDLLEntry@16"
Y	LXDICATS	"rundll32 [path] LXDItime.dll	_RunDLLEntry@16"
U	LXDJCATS	"rundll32 [path] LXDJtime.dll	_RunDLLEntry@16"
X	LzioMediaUpdater	LzioMediaUpdater.exe	"LZIO.com adware downloader"
X	M1cr0s0ft Upd4t4zS	update32.exe	"Added by the RBOT-MI WORM!"
U	MacDrive application	MacDrive.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
?	MacDrive7.0.4TimeOutPatch	TimeOutPatch.EXE	"Part of MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
X	Macfee Security Patch	Mpfsheild.exe	"Added by the RBOT-NP WORM!"
X	Machine Update Soft	wusas.exe	Added by an unidfentified WORM!
X	Macromedia Critical Updater	rarww.exe	"Added by a variant of the RBOT WORM!"
X	Macromedia Flash Update	scvhost.exe	"Added by a variant of the RBOT WORM!"
N	Macrovision Update Service	issch.exe	"InstallShield is used by a number of software producers to install their programs and manage software updates. This entry runs scheduled searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis"
N	Macrovision Update Service	ISUSPM.exe	"InstallShield is used by a number of software producers to install their programs and manage software updates. This entry searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis"
U	MagicFormation	MagicFormation.exe	"MagicFormation from Tokyo Downstairs - a docking program that allows you to group icons in a ring anywhere on the desktop using mouse gestures to access things like My Documents
U	MagicFormation.exe	MagicFormation.exe	"MagicFormation from Tokyo Downstairs - a docking program that allows you to group icons in a ring anywhere on the desktop using mouse gestures to access things like My Documents
X	MailBlocker	[path to trojan]	"Added by the AGENT-LRJ TROJAN!"
Y	MailScan Dispatcher	Launch.exe	"MicroWorld MailScan Dispatcher splits each e-mail message into various components such as the header
X	Malware Catcher 2009	MCatcher.exe	"Malware Catcher 2009 rogue security software - not recommended
X	Mascro soft SDK updates2	SDKrepair2.exe	"Added by the SDBOT.BXM WORM!"
X	Master Card Updaate 32	Mastercard32.exe	"Added by a variant of the RBOT WORM!"
U	Matador	mlfbuddy.exe	"MailFrontier - anti-spam application"
U	Matador	mantispm.exe	"MailFrontier Desktop (Matador) email spam blocker software"
U	Matrix Screen Locker	matrix.exe	"Matrix Screen Locker is a system tray application that allows for quick and secure PC lock when you wish. The screen does a ""matrix style"" scrolling characters effect when the lock is running"
X	MatrixScreen	[filename]	"Added by the MATRIXSCREEN TROJAN!"
X	MatrixScreenSaver	mss.exe	Unidentified malware
N	Matrox Color Control	hgcctl95.exe	For Matrox video cards. Quick access to changing colors
N	Matrox Control Center	mgactrl.exe	For Matrox video cards. Quick access to settings
N	Matrox Diagnostic	mgadiag.exe	For Matrox video cards. Quick access to diagnostics
N	Matrox Powerdesk	PDesk.exe	"""Matrox PowerDesk software provides extra multi-display desktop management controls"""
N	Matrox PowerDesk 8	matrox.powerdesk.exe	"""Matrox PowerDesk software provides extra multi-display desktop management controls"""
N	Matrox PowerDesk SE	Matrox.PowerDesk SE.exe	"Matrox PowerDesk SE - multi-display desktop management controls"
N	Matrox QuickDesk	mgaqdesk.exe	For Matrox video cards. Quick access to tweak your card to your liking
X	Mcafee Antivirus Monitoring System326	VSStatmn326.exe	"Added by a variant of the SDBOT WORM!"
X	Mcafee Antivirus Monitoring System32mn	VSStatmn32.exe	"Added by a variant of the RBOT WORM!"
Y	McAfee Application Installer	mcappins.exe	Used by older versions of McAfee internet security related products to clean up installation files that are no longer required once the product is installed. This entry will normally only appear once the product has been installed before the system is rebooted
U	McAfee Backup	McAfeeDataBackup.exe	"McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
U	McAfee Backup and Restore	McAfeeDataBackup.exe	"McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
U	McAfee Data Backup	LogOnHook.exe	"Part of McAfee Data Backup (now Online Backup) - which ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection. The exact purpose of this entry is unknown at present but it unloads after startup"
U	McAfee Data Backup	McAfeeDataBackup.exe	"McAfee Data Backup (now Online Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
U	McAfee Online Backup	MOBKstat.exe	"System Tray access to McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
U	McAfee Online Backup Status	MOBKstat.exe	"System Tray access to McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
Y	McAfee SecurityCenter	McUpdate.exe	Automatic virus definition and software updates/upgrades for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online
U	McAfee.InstantUpdate.Monitor	RuLaunch.exe	"Instant Updater for McAfee's VirusScan
U	McAfeeDataBackup	McAfeeDataBackup.exe	"McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
Y	McAfeeUpdaterUI	UpdaterUI.exe	McAfee common updater user interface
Y	McAfeeUpdaterUI	UdaterUI.exe	Updater user interface for McAfee's VirusScan Enterprise corporate anti-virus and anti-spyware security tool
X	Mcrosoftr Update	Mcrosoftr.exe	"Added by a variant of the RBOT WORM!"
Y	McUpdate	McUpdate.exe	Automatic virus definition and software updates/upgrades for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online
Y	MCUpdateExe	McUpdate.exe	Automatic virus definition and software updates/upgrades for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online
X	MCX Update	wisp.exe	"Added by the RBOT-AQH WORM!"
X	mdetect	[path to trojan]	"Added by the SPABOT TROJAN!"
U	Media Codec Update Service	update.exe	"Windows Essentials Codec Pack 1.0 is a collection of the most commonly needed video and audio codecs. This program allows keeps these codecs updated"
X	Media Gateway	MediaGateway.exe	"WindUpdates MediaPass adware"
X	Media Player Update	xpsp1mfh.exe	"Added by a variant of the RBOT WORM!"
X	Media Software UPdater	sscs.exe	"Added by the RBOT-ABE WORM!"
X	MEDIA32	[path to trojan]	"Added by the PURSCAN-Z TROJAN!"
N	MediaFace Integration	Sethook.exe	"Fellowes Neato® cd label design software. ""Launch NEATO's MediaFACE II label making software directly from the productname toolbar"""
U	Mediafour Mac Volume Notifications	MACVNTFY.EXE	"Part of MacDrive 6 CrossStripe Edition from Mediafour Corporation - ""a perfect way to share files between Mac OS and Windows."" Unlike the standard version of MacDrive 7
U	Mediafour XPlay Tray Notification Icon	Xptryicn.exe	"Mediafour Xplay - allows you to use an Apple iPod digital music player with a PC running Windows. If not used regularily start manually before connecting the iPod"
U	Mediafour XPlay Tray Notification Icon	Xptryicn.exe	"Xplay 2 from Mediafour Corporation - ""expands what you can do with any iPod
X	MediaPath	Proyecto1.exe	"Added by the GRUEL WORM!"
X	MediaPath	Root.exe	"Added by the GRUEL WORM!"
X	MediaPlayeS	MediaPlayer_update.exe	"Added by the STARTER-K TROJAN!"
X	Memory Allocation Host	cihost.exe	"Detected by Avast as a variant of the IRCBOT-CHZ WORM!"
X	Memory Allocation Server	ciserv.exe	Added by an unidentified malware
X	Memory Allocation Services	cisrv.exe	"Added by the IRCBOT.FC BACKDOOR!"
X	Memory relocation service	reloc32.exe	"Added by the RELFEERWORM!"
N	Memory Stick Monitor	MSTAT.exe	"Used with the Sony floppy disk adapter for memory sticks
U	Memory Stick Monitor	MSstat.exe	Sony/SmartDisk memorystick-floppydisk-adapter software - allows you to read memorysticks in a normal floppydrive
X	Memory Watcher	MemoryWatcher.exe	"MemoryWatcher spyware"
X	Messenger Gateway	msmgs.exe	"Added by the AGENT-IGK TROJAN!"
X	Messenger Service Updater	svshost.exe	"Added by the MYTOB.GC WORM!"
X	Micosoft Data Core	runservice.exe	"Added by the IRCBOT.BK WORM!"
X	Micosoft Data Core stuff	svshosts.exe	"Added by the RBOT.FZA WORM!"
X	Micr Update	soundblaster.exe	"Added by the SDBOT.NP WORM!"
X	Micr Update System	upwin.exe	"Added by the SDBOT.YS WORM!"
X	Micrcoft Updat	spoolsae.exe	"Added by the RBOT-AIB WORM!"
X	Micrcoft Updat	spoolsaex.exe	"Added by the RBOT-AJM WORM!"
X	Micrcoft Updat	Internet.exe	"Added by the RBOT-ANA WORM!"
X	Micrcsoft Certificate Services	cflmon.exe	"Added by the RBOT-FWV WORM!"
X	Micro Office	[path to trojan]	"Added by the BANCBAN-QC TROJAN!"
X	Micro Update	dailin.exe	"Added by the RBOT-ER WORM!"
N	microAttuneDownload	atmdlusr.exe	"Application Launcher
U	MicroDialler	atdialler1.exe	"Part of the Freeserve Connection Kit - changes the dial-up for Freeserve AnyTime if access problems are encountered"
X	Microfot Update	winldx32.exe	"Added by a variant of the RBOT WORM!"
X	Microft Update 32	winssx.exe	"Added by the RBOT-AQS WORM!"
X	Micromedia Flash Update	wdfmrg.exe	"Added by a variant of the SDBOT WORM!"
X	Micromedia Flash Update	xptxt.exe	"Added by the RBOT-GAB WORM!"
X	Microoft Timing	pupdate.exe	"Added by a variant of the RBOT WORM!"
X	MICROSFT ANTIVIRUS UPDATE SUPPORT	[random 10-letter filename].EXE	"Added by the RBOT-AQA WORM!"
X	MICROSFT ANTIVIRUS UPDATE SUPPORT	MSGUPDATED.EXE	"Added by the RBOT-APZ WORM!"
X	Microsft Corporation Version 2001.12.4414	comrel.exe	"Added by a variant of the SDBOT TROJAN!"
X	Microsft Corporation Version 2002.12.2414	comserv.exe	"Added by a variant of the SLAPER TROJAN!"
X	MICROSFT MX UPDATE SUPPORT	taskmngrs.exe	"Added by the RBOT-AUZ WORM!"
X	MICROSFT MX UPDATE SUPPORT	winmx32.EXE	"Added by the IRCBOT-FD WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	[random filename]	"Added by the RBOT-ASM or RBOT-AUW WORMS!"
X	MICROSFT RAMA UPDATE SUPPORT	MSN32.EXE	"Added by the RBOT-AWJ WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	mtakthmyn.EXE	"Added by the RBOT-AUJ WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	MSGUPDAT32.EXE	"Added by the RBOT-BBB WORM!"
X	microsft windows updates	mwupdate32.exe	"Added by a variant of the TOXBOT/CODBOT WORM!"
X	Microsof Value	nmatt.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft	MSUPDATE.exe	Added by an unidentified WORM or TROJAN!
X	Microsoft	updater.exe	"Added by the RBOT-GHP WORM!"
X	Microsoft	internetdat.exe	"Added by the RBOT.ETY BACKDOOR!"
X	Microsoft	MicrosoftCorporation.exe	"Added by the KILLFILES.AED TROJAN!"
X	Microsoft (C) HTML Application host	[random filename]	"Added by the RBOT-YB WORM!"
X	Microsoft (R) Windows Configuration Backup Service	svchost.exe	"Added by the RANKY.X TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in either a ""config""
X	Microsoft (R) Windows Network Latency Controller	1.tmp	"Added by a generic password stealer TROJAN - see here"
X	Microsoft (R) Windows Network Latency Controller	nlc.exe	"Added by a generic password stealer TROJAN - see here"
X	Microsoft (R) Windows Network Latency Controller	sp2vc.exe	"Added by a generic password stealer TROJAN - see here"
X	Microsoft (R) Windows Protected Content Restoration Service	services.exe	"Added by the AGENT.AGV BACKDOOR! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\etc"
X	Microsoft (R) Windows TCP/IP Socket Driver	[path to trojan]	"Added by the PROXY-DD TROJAN!"
X	Microsoft (R) Windows Update Service	wuauclt.exe	"Added by a variant of the SDBOT WORM! Note - this is not the legitimate wuauclt.exe process
X	Microsoft (R) Windows Vista/NT Runtime Compatibility Service	nrcs.exe	"Added by the RANKY.X TROJAN!"
X	Microsoft .NET Confingurator	msnconf.exe	"Added by an unidentified VIRUS
X	Microsoft 16Bit Update	wuapdate16.exe	"Added by the RBOT.CZ WORM!"
X	Microsoft 64 Bit Runtime Updater	wupdt64.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft ActiveX Debugger NT	[path to trojan]	"Added by the BANCOS-DO TROJAN!"
X	Microsoft Ansti Update	msie.exe	"Added by the RBOT-LE WORM!"
X	Microsoft Application Center	mappc.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Application Manager	msapl32.exe	"Added by the BROPIA-AE TROJAN!"
X	Microsoft AUT Update	MSlti32.exe	"Added by the RBOT-X WORM!"
X	Microsoft AUT Update	MSlti16.exe	"Added by the RBOT.EB WORM!"
X	Microsoft auto update	winupdate.exe	"Added by the BMBOT TROJAN!"
X	Microsoft Auto Update	WINHLP16.EXE	"Added by the RBOT.GY WORM!"
X	Microsoft auto update	wuauclt.exe	"Added by the CULT-B TROJAN! Note - this is not the legitimate wuauclt.exe process
X	Microsoft Automatic Update Serivce	msautou.exe	"Added by the RBOT-AOB WORM!"
X	Microsoft Automatic Updater	Explorer.exe	"Added by the RBOT-SG WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft AutoUpdater	svhost.exe	"Added by the RBOT.QG WORM!"
X	Microsoft Calculator	calc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Configoration Service	msconfigs.exe	"Added by the RBOT-ETT WORM!"
X	Microsoft Configuration	msconfig32.exe	"Added by the SDBOT.MQ WORM!"
X	Microsoft Configuration 35	microsot1.exe	"Added by an unidentified TROJAN!"
X	Microsoft Configuration Wizard	taskmrg.exe	"Added by the SDBOT-MX TROJAN!"
X	Microsoft Corp SQL Certificates	sqlcer.exe	"Added by the ZYBOT-C WORM!"
X	Microsoft Corp SSL Certificates	windowz.exe	"Added by the RBOT-GCZ WORM!"
X	Microsoft Corp TLS Certificates	msauth.exe	"Added by the RBOT-GAC WORM!"
X	Microsoft Corp Updates	wupdates.exe	"Added by the RBOT-AUU WORM!"
X	Microsoft Corporaticn SQL Handler	sqlhandler.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Corporation	[random filename]	"Added by various VIRUSES
X	Microsoft Corporation	jview.exe	"Added by the RBOT-AOD WORM!"
X	Microsoft Corporation Svchost Service	mssvc.exe	"Added by a variant of the SDBOT WORM! See here"
X	Microsoft Corporation Svchost Service	mswsc.exe	Added by the AGENT.MAB TROJAN!
X	Microsoft Corporation SYM monitor	mssym.exe	"Added by the RBOT-GDB WORM!"
X	Microsoft CPU Over Heat Manager	CPU.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Data Helper	cihost.exe	"Malware
X	Microsoft Data Machine	csdata32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Database Handler	mssql32.exe	"Added by the RANDEX.AX WORM!"
X	Microsoft Datalog Application	msdata.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Directx	directxat.exe	"Added by the SDBOT-BXF WORM! Note - disables autostart for the SharedAccess service and deactivates the Microsoft Internet Connection Firewall (ICF)"
X	Microsoft DirectX	wupdate.exe	"Added by the RBOT-L WORM!"
X	Microsoft DLL Authentification	dllsecure.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft driver update	Mshome.exe	Added by the SDBOT.BL WORM!
X	Microsoft explorer Update	internal.exe	Added by an unidentified WORM or TROJAN!
X	Microsoft Features	ms32cfg.exe	"Added by the RBOT.HO WORM!"
X	Microsoft Features	msie.exe	"Added by a variant of the RBOT WORM!"
Y	MICROSOFT FIREWALL CLIENT	ISATRAY.EXE	"MS Internet Security and Acceleration Server - see here"
X	Microsoft Generic Update Manager	wupdate.exe	"Added by the RBOT-AWC TROJAN!"
X	Microsoft Incroporate	mfs.exe	"Added by the RBOT-ANF WORM!"
X	Microsoft Information	securenet.exe	"Added by the SDBOT.AJM WORM!"
X	Microsoft Information Check	microsoft.exe	"Added by the IRCBOT.AUH TROJAN!"
X	Microsoft Initialization Service	initsvc.exe	"Added by the IRCBOT.AXK BACKDOOR!"
X	Microsoft Initialization Services	initserv.exe	"Added by the IRCBOT-ABO TROJAN!"
X	Microsoft Internel Corporat	netvhost.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Internel Corporat	smbvhost.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Internet Acceleration Utility	iau.exe	"EasySearch adware"
X	Microsoft Internet Acceleration Utility	[path to file]	"Added by the AGENT-CX TROJAN!"
X	Microsoft Internet Acceleration Utility	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Microsoft Internet Explorer	[path to trojan]	"Added by the BANCBAN-AS TROJAN!"
X	Microsoft Internet Explorer Update	ieupdate.exe	"Added by the SHEUR.MH TROJAN!"
X	Microsoft Internet Firewall Update	updater.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft IT Update	win64.exe	"Added by the RBOT.GA WORM!"
X	Microsoft IT Update	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft IT Update	IEserv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft IT Update	msupdate.exe	"Added by the RBOT-FE WORM!"
X	Microsoft IT Update	winn43.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft IT Update	svchsst.exe	"Added by the RBOT-DH WORM!"
X	Microsoft IT Update	win43.exe	"Added by the RBOT-SA WORM!"
X	Microsoft IT Update	windows.exe	"Added by the RBOT-JM WORM!"
X	Microsoft IT Update	winsyst32.exe	"Added by the RBOT-FC WORM!"
X	Microsoft IT Update	Rhost32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Java Windows Update	[filename]	"Added by the RBOT-DZ WORM!"
U	Microsoft Location Finder	LocationFinder.exe	"Microsoft Location Finder ""is a client-side application that turns a regular WiFi enabled laptop
X	Microsoft LV	[path to file]	"Added by the BDOOR-BDL BACKDOOR!"
X	Microsoft Machine	updata.exe	"Added by the RBOT-DJ WORM!"
X	Microsoft MachineUpdatese	tempes.exe	"Added by the RBOT.EWN BACKDOOR!"
X	Microsoft Management Console	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Microsoft MSUPDATE	SpoolSvc.exe	"Added by the SXTB-A TROJAN!"
X	Microsoft NT Update	winexec32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Office Start	winupdates.exe	"Added by the GAOBOT.BC WORM!"
X	Microsoft Patch Update	bootini.exe	"Added by the RBOT-FMN WORM!"
X	Microsoft PCHealth32	[path to file]	"Added by the NICE-A TROJAN!"
X	Microsoft PSTCP32 Data	pstcp32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Redirect	[path to file]	"Added by the BANKER-FW TROJAN!"
X	Microsoft Security Hot Fix Update	mshotfix.exe	"Affilred adware"
X	Microsoft Security Monitor Process	windowsupdate.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Security Update	security32.exe	"Added by the DELF-JJ TROJAN!"
X	Microsoft Server Applacations	msnmsg.exe	"Added by the AGOBOT.BBM WORM!"
X	Microsoft Server Applacations	wuauct1.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Server Applacations	lsasss.exe	"Added by the RBOT-AQQ WORM!"
X	Microsoft Server Applacations	Q8See.exe	"Added by the SPYBOT.GEN3 TROJAN!"
X	Microsoft Server Applacations	cli.exe	"Added by the RBOT-GAQ WORM!"
X	Microsoft Server Application	Sound.exe	"Added by the RBOT-NE WORM!"
X	Microsoft Service Information	msnservices.exe	"Added by the RBOT.ID WORM!"
X	Microsoft Software Update	nmon.exe	"Added by the RBOT.HZ WORM!"
X	Microsoft standard protector	[path to trojan]	"Added by the STOX-C TROJAN!"
X	Microsoft Synchronization Manager	asgard.exe	"Added by the SDBOT-AEA WORM!"
X	Microsoft Synchronization Manager	bot.exe	"Added by the SDBOT.IH WORM!"
X	Microsoft Synchronization Manager	netscape.exe	"Added by the RANDEX.AE WORM!"
X	Microsoft Synchronization Manager	slhost.exe	"Added by the SDBOT.YH WORM!"
X	Microsoft Synchronization Manager	svhost.exe	"Added by the SDBOT-PY WORM!"
X	Microsoft Synchronization Manager	WinLoginnn.exe	"Added by the SPYBOT.FO WORM!"
X	Microsoft Synchronization Manager	winupdate.exe	"Added by the SDBOT.ER WORM!"
X	Microsoft Synchronization Manager	xXx.exe	"Added by the SDBOT-KZ WORM!"
X	Microsoft Synchronization Manager	___synmgr.exe	"Added by the MASLAN.A or MASLAN.C WORMS!"
X	Microsoft Synchronization Manager	al.exe	"Added by the OPTXPRO.132 TROJAN!"
X	Microsoft Synchronization Manager	win.exe	"Added by the SDBOT.AK WORM!"
X	Microsoft Synchronization Manager	java.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Synchronization Manager	svchosts.exe	"Added by the SDBOT-LM WORM!"
X	Microsoft Synchronization Manager	winlogon32.exe	"Added by the SDBOT.AEU WORM!"
X	Microsoft Synchronization Manager	svxhost.exe	"Added by the SDBOT-ZU WORM!"
X	Microsoft Synchronization Manager	wincfg32.exe	"Added by the SDBOT.DO WORM!"
X	Microsoft Synchronization Manager	screen.exe	"Added by the SDBOT-ACO WORM!"
X	Microsoft Synchronization Manager	devldr32.exe	"Added by a variant of the RBOT WORM! Note - do not confuse with the legitimate Creative Labs devldr32.exe file"
X	Microsoft Synchronization Manager	explorer.exe	"Added by the SDBOT-AEA WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft Synchronization Manager	firewire.exe	"Added by the SDBOT-AFC WORM!"
X	Microsoft Synchronization Manager	wmedia.exe	"Added by the SDBOT.BFC WORM!"
X	Microsoft Synchronization Manager	win932.exe	"Added by the SDBOT.AH WORM!"
X	Microsoft Synchronization Manager	mircup.exe	"Added by the SDBOT.BQD WORM!"
U	Microsoft Synchronization Manager	mobsync.exe	"Microsoft Synchronization Manager for 2K/XP - used to update network copies of materials that were edited offline
X	Microsoft Synchronization Manager	alien.exe	"Added by the SDBOT-MV BACKDOOR!"
X	Microsoft Synchronization Manager	microsoft.exe	"Added by the SDBOT-OM WORM!"
X	Microsoft Synchronization Manager 2	svhostc.exe	"Added by the SLINBOT.ST WORM!"
X	Microsoft System Administration	system.exe	"Added by a variant of the IRCBOT BACKDOOR!"
N	Microsoft System Configuration Utility	msconfig.exe	Entry that appears when you uncheck an item in the MSConfig Startup group and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode. Located in %System% (98/Me/Vista) or %Windir%\PCHealth\HelpCtr\Binaries (XP)
X	Microsoft System DLL Services Configuration	windir32.exe	"Added by the SDBOT-ACY TROJAN!"
X	Microsoft System Restore Configuration	CBRSS.EXE	"Added by a variant of the SPYBOT WORM!"
X	Microsoft System Saver	[path to worm]	"Added by the RBOT.BSK WORM!"
X	Microsoft System Update	sysupdate.exe	"Added by the SDBOT.DG WORM!"
X	Microsoft System32 Update	cmsrg.exe	"Added by the RBOT-GN WORM!"
X	Microsoft Taskmanager Updater	keyboard.exe	"Added by the RBOT-ALU WORM!"
X	Microsoft UMA Update	MSuma32.exe	"Added by the RBOT.FS WORM!"
X	Microsoft Updat3	mswkst32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	Microsoft.exe	"Added by the GAOBOT.AFJ WORM!"
X	Microsoft Update	mssmgrd.exe	"Added by the SDBOT.JT WORM!"
X	Microsoft Update	mvsc.exe	"Added by the SPYBOT.DAZ WORM!"
X	Microsoft Update	ascdl.exe	"Added by the GAOBOT.SY WORM!"
X	Microsoft Update	Isac.exe	"Added by the RBOT-AU WORM!"
X	Microsoft Update	automgr32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	mediap.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	Microsoftx.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	msconfg.exe	"Added by the RBOT.H WORM!"
X	Microsoft Update	Mslti32.exe	"Added by the RBOT-LX WORM!"
X	Microsoft Update	muamgrd.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update	navmgrd.exe	"Added by the SDBOT.DP TROJAN!"
X	Microsoft Update	Smss32.exe	"Added by the RBOT-CB WORM!"
X	Microsoft Update	sys32cfg.exe	"Added by the RBOT.DR WORM!"
X	Microsoft Update	VPC32.EXE	"Added by the AGOBOT.XM WORM!"
X	Microsoft Update	winsys32.exe	"Added by the RBOT.BD WORM!"
X	Microsoft Update	wuamgrd.exe	"Added by the RBOT-LK WORM!"
X	Microsoft Update	wuammgr32.exe	"Added by the RBOT-AW WORM!"
X	Microsoft Update	wudmate.exe	"Added by the RBOT.AP WORM!"
X	Microsoft Update	msawindows.exe	"Added by the GAOBOT.AFJ WORM!"
X	Microsoft Update	msiwin84.exe	"Added by the GAOBOT.AFJ WORM!"
X	Microsoft Update	wuamgrd32.exe	"Added by the RBOT.ZB WORM!"
X	Microsoft Update	NAV.exe	"Added by the RBOT-IV WORM!"
X	Microsoft Update	systemi32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update	xpupdate.exe	"Added by the RBOT-QE WORM!"
X	Microsoft Update	webm.exe	"Added by the SDBOT.WK WORM!"
X	Microsoft Update	wuagrd.exe	"Added by the RBOT-FK WORM!"
X	Microsoft Update	aaupdt.exe	"Added by the RBOT-RQ WORM!"
X	Microsoft Update	lsac.exe	"Added by the GAOBOT.XW WORM!"
X	Microsoft Update	Mupdate.exe	"Added by the RBOT-AG WORM!"
X	Microsoft Update	prowind32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update	snlogsvc.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	svhost.exe	"Added by the RBOT-PI WORM!"
X	Microsoft Update	wauguard.exe	"Added by the RBOT.AEE WORM!"
X	Microsoft Update	winscv.exe	"Added by the RBOT-BH WORM!"
X	Microsoft Update	winsys.exe	"Added by the RBOT-GV WORM!"
X	Microsoft Update	wserv32.exe	"Added by the RBOT.AF WORM!"
X	Microsoft Update	wtm32.exe	"Added by the RBOT-AQ WORM!"
X	Microsoft Update	wumgrd.exe	"Added by the SDBOT-KY WORM!"
X	Microsoft Update	wuampd.exe	"Added by the RBOT-UT WORM!"
X	Microsoft Update	msupdate32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update	Botnet.exe	"Added by the RBOT.AFL WORM!"
X	Microsoft Update	sghost.exe	"Added by the SDBOT.AKV WORM!"
X	Microsoft Update	update_w.exe	"Added by the RBOT-EW WORM!"
X	Microsoft Update	windows24.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	wingrd32.exe	"Added by the RBOT-DW WORM!"
X	Microsoft Update	wssvr.exe	"Added by the RBOT-OD WORM!"
X	Microsoft Update	wuamagr32.exe	"Added by the SPYBOT.CG WORM!"
X	Microsoft Update	WinUpdate32.exe	"Added by the RBOT-TI WORM!"
X	Microsoft Update	wkfix.exe	"Added by the RBOT-ABZ WORM!"
X	Microsoft Update	Kkk.exe	"Added by the RBOT-AHL WORM!"
X	Microsoft Update	mcupdate.exe	"Added by the RBOT.XT WORM! Note - this file is located in %System% and should not be confused with the McAfee antivirus executable as described here"
X	Microsoft Update	Micr0s0ft.exe	"Added by the AGOBOT.AAR WORM!"
X	Microsoft Update	Msnmsngr.exe	"Added by the RBOT.BQS WORM!"
X	Microsoft Update	msupdate32.exe	"Added by the SPYBOT.LZ WORM!"
X	Microsoft Update	scvhost.exe	"Added by the RBOT-AEM WORM!"
X	Microsoft Update	svghost.exe	"Added by the RBOT.BUJ WORM!"
X	Microsoft Update	sys.exe	"Added by the RBOT-AJ WORM!"
X	Microsoft Update	up2dat5.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	winamp.exe	"Added by a variant of the RBOT WORM! Note - this is NOT the popular Winamp media player"
X	Microsoft Update	win-mang.exe	"Added by the RBOT-AFK WORM!"
X	Microsoft Update	winupdater.exe	"Added by the RBOT.BIN WORM!"
X	Microsoft Update	wuamk0032.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	wuamk032.exe	"Added by the RBOT-AHD WORM!"
X	Microsoft Update	wuamk0p32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	wuamkop.exe	"Added by the RBOT-AFI WORM!"
X	Microsoft Update	wuamkop32.exe	"Added by the RBOT.BGU WORM!"
X	Microsoft Update	wuampkd.exe	"Added by the SDBOT.BBX WORM!"
X	Microsoft Update	svzhost.exe	"Added by the RBOT.OX WORM!"
X	Microsoft Update	win32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	wininit.exe	"Added by the RBOT-AKR WORM!"
X	Microsoft Update	wuamgrd3.exe	"Added by the RBOT-AMC WORM!"
X	Microsoft Update	Wudates.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	ms.exe	"Added by the SDBOT.CC WORM!"
X	Microsoft Update	wuagmsd.exe	"Added by the RBOT-AX WORM!"
X	Microsoft Update	cmss.exe	"Added by the RBOT-ATQ WORM!"
X	Microsoft Update	wuamgrb.exe	"Added by the RBOT-AZE WORM!"
X	Microsoft Update	WINDOC.EXE	"Added by the SDBOT.PF WORM!"
X	Microsoft Update	phqghumea.exe	"Added by the SDBOT.AFO WORM!"
X	Microsoft Update	system32.exe	"Added by the RBOT.IS WORM!"
X	Microsoft Update	bling.exe	"Added by the RBOT-AVK WORM!"
X	Microsoft Update	Sygate.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	update.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	WinDrv32.exe	"Added by the RBOT.EGW WORM!"
X	Microsoft Update	devmks32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft update	winupdate.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	msupdate.exe	"Added by the BOROBOT-I TROJAN!"
X	Microsoft Update	mixer.exe	"Added by the RBOT-AIR WORM!"
X	Microsoft Update	taskmgr32.exe	"Added by the RBOT-CV WORM!"
X	Microsoft Update	drive.exe	"Added by the BIFROSE-PN WORM!"
X	Microsoft Update	wangard.exe	"Added by the RBOT-LH WORM!"
X	MICROSOFT UPDATE	WUAGTRD.EXE	"Added by the RBOT-CJ WORM!"
X	Microsoft Update	spool.exe	"Added by the AGENT-GJC TROJAN!"
X	Microsoft Update	bnmveqfts.exe	"Added by the BANLOAD.KWQ TROJAN!"
X	Microsoft Update	dqbxhupdt	"Added by a variant of the SDBOT WORM! See here"
X	Microsoft Update	enule.exe	"Added by the IRCBOT.DU BACKDOOR!"
X	Microsoft Update	explorer.exe	"Added by the RBOT.AEU BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft Update	imchemaoa.exe	"Added by the BANLOAD.KWQ TROJAN!"
X	Microsoft Update	livemessenger.com	"Added by the ADLOAD-LN TROJAN!"
X	Microsoft Update	msnmsgl.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Update	nnwyaupdt	"Added by the RBOT.RHK BACKDOOR!"
X	Microsoft Update	ntservice.exe	"Added by the AGENT-DIS TROJAN!"
X	Microsoft Update	rundll32.dll	"Added by the CIADOOR.GN BACKDOOR!"
X	Microsoft Update	wuamgrdx.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Update	wutr.exe	"Added by the SPYBOT.AAR WORM!"
X	Microsoft Update	SetPoints.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Update	system.exe	"Added by a variant of the RBOT WORM! See here"
X	Microsoft Update	service.exe	"Added by a variant of the RBOT WORM! See here"
X	Microsoft Update	msgn.exe	"Added by the RBOT.RQ BACKDOOR!"
X	Microsoft Update	wuamgrd16.exe	"Added by the RBOT-BQ WORM!"
X	Microsoft Update	windows32.exe	"Added by the RBOT-BHQ WORM!"
X	Microsoft Update	winsyst.exe	"Added by the RBOT-DL WORM!"
X	Microsoft Update 23	NtKernelSystem.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 23	spoolvs.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	explore32.exe	"Added by the SPYBOT.CYM WORM!"
X	Microsoft Update 32	MSupdate32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update 32	wininit.exe	"Added by the RBOT-ANY WORM!"
X	Microsoft Update 32	wininit32.exe	"Added by the RBOT-AKJ WORM!"
X	Microsoft Update 32	[path to file]	"Added by the RBOT-AJJ WORM!"
X	Microsoft Update 32	mscnfg.exe	"Added by the RBOT-ALM WORM!"
X	Microsoft Update 32	servic.exe	"Added by the RBOT-AXN WORM!"
X	Microsoft Update 32	winitXP32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	mssetup32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	wiit.exe	"Added by the RBOT-AMS WORM!"
X	Microsoft Update 32	explorer.exe	"Added by the RBOT-ARF WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft Update 32	network.exe	"Added by the RBOT-ARZ WORM!"
X	Microsoft Update 32	om4r.exe	"Added by the RBOT-AQP WORM!"
X	Microsoft Update 32	winin.exe	"Added by the RBOT-ARR WORM!"
X	Microsoft Update 32	wuinit.exe	"Added by the AGOBOT-UE WORM!"
X	Microsoft Update 32	neta.exe	"Added by the RBOT-AMI WORM!"
X	Microsoft Update 32	spoolvs.exe	"Added by the RBOT-BBQ WORM!"
X	Microsoft Update 32	rundll32.exe	"Added by the RBOT.AIE BACKDOOR! Note that this BACKDOOR modifies the file rundll32.exe
X	Microsoft Update 32	taskMangr.exe	"Added by the RBOT.AIE BACKDOOR!"
X	Microsoft Update 32	winssx.exe	"Added by the RBOT-ARW WORM!"
X	Microsoft Update 33	init.exe	"Added by the RBOT-ATT WORM!"
X	Microsoft Update 64 BIT	wininit32.exe	"Added by the RBOT-AHE WORM!"
X	Microsoft Update 64 BIT	winman32.exe	"Added by the RBOT-AKI WORM!"
X	Microsoft Update 64 BIT	schvost.exe	"Added by the RBOT.CAU WORM!"
X	Microsoft Update 64 BIT	winl32xe.exe	"Added by the RBOT-AQO WORM!"
X	Microsoft Update Clinic	svsipconfig.exe	"Added by the RBOT.BR WORM!"
X	MICROSOFT UPDATE CONFIGURATION	WIN32SNC.EXE	"Added by the RBOT-AI WORM!"
X	Microsoft Update Control	Ms64.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Debugger	wincfg32.exe	"Added by the SPYBOT.ZC WORM!"
X	Microsoft Update Device	flolo.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Update Device Drivers	wuauclt.exe	"Added by a variant of the SDBOT WORM! Note - this is not the legitimate wuauclt.exe process
X	Microsoft Update DLL	rxxhost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Drivers	explorers.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update Emulator	kern-mxe.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Emulator	wuaddsff.exe	"Added by the RBOT-GX WORM!"
X	Microsoft Update Event	svnhost.exe	"Added by the AGOBOT-GW BACKDOOR!"
X	Microsoft Update Loader	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Loaders 2005	winusers.exe	"Added by the RBOT-AIQ WORM!"
X	Microsoft Update Loaders 2006	winusersystem32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update Machine	expl0rer.exe	"Added by the SDBOT.OK WORM!"
X	Microsoft Update Machine	rxhost.exe	"Added by the RBOT.FC WORM!"
X	Microsoft Update Machine	servicz.exe	"Added by the RBOT-HU WORM!"
X	Microsoft Update Machine	SP2.exe	"Added by the SPYBOT.FP WORM!"
X	Microsoft Update Machine	winini.exe	"Added by the RBOT-KV WORM!"
X	Microsoft Update Machine	xvshost.exe	"Added by the RBOT.QP WORM!"
X	Microsoft Update Machine	memstat.exe	"Added by the RBOT-OM WORM!"
X	Microsoft Update Machine	ntce.exe	"Added by the RBOT-FA WORM!"
X	Microsoft Update Machine	system03.exe	"Added by the RBOT-NM WORM!"
X	Microsoft Update Machine	wuawx.exe	"Added by the RBOT-CE WORM!"
X	Microsoft Update Machine	zonealarm.exe	"Added by the RBOT-BZ WORM! Note - this is not the valid Zone Labs firewall program!"
X	Microsoft Update Machine	systemll.exe	"Added by the RBOT-JT WORM!"
X	Microsoft Update Machine	winupdt.exe	"Added by the RBOT-FP WORM!"
X	Microsoft Update Machine	svshost.exe	"Added by the RBOT.AK WORM!"
X	Microsoft Update Machine	wuamgd.exe	"Added by the SDBOT.HQ WORM!"
X	Microsoft Update Machine	wupdt32x.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update Machine	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	linux.exe	"Added by the RBOT-IM WORM!"
X	Microsoft Update Machine	lmrss.exe	"Added by the RBOT-DY WORM!"
X	Microsoft Update Machine	windowsu.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	wininigo.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	winmgr.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	Winmsixp32.exe	"Added by the RBOT.DN WORM!"
X	Microsoft Update Machine	Winregs32.exe	"Added by the RBOT.DN WORM!"
X	Microsoft Update Machine	winxpini.exe	"Added by the RBOT-OB WORM!"
X	Microsoft Update Machine	wuamgrd.exe	"Added by the RBOT-HE WORM!"
X	Microsoft Update Machine	wuagrd.exe	"Added by the RBOT-GF WORM!"
X	Microsoft Update Machine	LANWAKE.EXE	"Added by the RBOT-QZ WORM!"
X	Microsoft Update Machine	scvhost.exe	"Added by the RBOT-GS WORM!"
X	Microsoft Update Machine	winhost.exe	"Added by the RBOT-GK WORM!"
X	Microsoft Update Machine	winss.exe	"Added by the RBOT.JU WORM!"
X	Microsoft Update Machine	WUAMGRDXS.EXE	"Added by the RBOT-GL WORM!"
X	Microsoft Update Machine	crss32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	lsasse.exe	"Added by the RBOT-DI WORM!"
X	Microsoft Update Machine	qwerty.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	rxxhost.exe	"Added by the RBOT.EP WORM!"
X	Microsoft Update Machine	servicez.exe	"Added by the SPYBOT.BI WORM!"
X	Microsoft Update Machine	spoolserv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	Systemnt.exe	"Added by the RBOT.DA WORM!"
X	Microsoft Update Machine	systemse.exe	"Added by the RBOT-BD WORM!"
X	Microsoft Update Machine	taskmngrs.exe	"Added by the RBOT-CR WORM!"
X	Microsoft Update Machine	windowsup.exe	"Added by the RBOT-FV WORM!"
X	Microsoft Update Machine	wuamgard.exe	"Added by the SPYBOT.CS WORM!"
X	Microsoft Update Machine	wupdate32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	system.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	TMEMSER.EXE	"Added by the RBOT-NQ WORM!"
X	Microsoft Update Machine	winnie.exe	"Added by the RBOT-ACD WORM!"
X	Microsoft Update Machine	winortho.exe	"Added by the RBOT-NW WORM!"
X	Microsoft Update Machine	wins32.exe	"Added by the RBOT.EZ WORM!"
X	Microsoft Update Machine	serviz.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	TASKMAN4.EXE	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	wftestb.exe	"Added by the RBOT-AFZ WORM!"
X	Microsoft Update Machine	Win32.exe	"Added by the SDBOT.UV WORM!"
X	Microsoft Update Machine	windns.exe	"Added by the RBOT.EF WORM!"
X	Microsoft Update Machine	MSOICONS.EXE	"Added by the RBOT.AWS WORM! Note - do no confuse with the legitimate Msoicons.exe file described here. The latter should not normally figure in Msconfig/Startup!"
X	Microsoft Update Machine	WINSVC32.EXE	"Added by the RBOT.CU WORM!"
X	Microsoft Update Machine	ntsystem.exe	"Added by the RBOT.GF WORM!"
X	Microsoft Update Machine	winupdte.exe	"Added by the RBOT-GKL WORM!"
X	Microsoft Update Machine	jkfrnz.exe	"Added by the RBOT-GOZ WORM!"
X	Microsoft Update Machine	wlimyc.exe	"Added by the RBOT-GQN WORM!"
X	Microsoft Update Machine	xagwxzy.exe	"Added by the RBOT.S WORM!"
X	Microsoft Update Machine	jkydxg.exe	"Added by the RBOT.AEA BACKDOOR!"
X	Microsoft Update Machine	opmmve.exe	"Added by the KOLABC.DES WORM!"
X	Microsoft Update Machine	paxrxo.exe	"Added by the PUSHBOT.A WORM!"
X	Microsoft Update Machine	psmszw.exe	"Added by the KOLABC.CC WORM!"
X	Microsoft Update Machine	syadpo.exe	"Added by the CIADOOR.GN BACKDOOR!"
X	Microsoft Update Machine	systemi.exe	"Added by the BUZUS.JKU TROJAN!"
X	Microsoft Update Machine	thvfyq.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	ubthec.exe	"Added by the AGENT.AWZ TROJAN!"
X	Microsoft Update Machine	winmngr.exe	"Added by the RBOT.GKQ BACKDOOR!"
X	Microsoft Update Machine	gbhglj.exe	"Added by the IRCBOT-ZJ TROJAN!"
X	Microsoft Update Machine	wuamgdr.exe	"Added by the RBOT-IO BACKDOOR!"
X	Microsoft Update Manager	WINRLS.EXE	"Added by the RBOT-AF WORM!"
X	Microsoft Update Manager	svshost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Manager	scvhost.exe	"Added by the AGOBOT.AXJ WORM!"
X	Microsoft Update Manager	scvideo.exe	"Added by the SDBOT-CVP TROJAN!"
X	Microsoft Update Mechene	Updatez.exe	"Added by the RBOT-GI WORM!"
X	Microsoft Update Module	rundll24.exe	"Added by the RBOT-PS WORM!"
X	Microsoft Update Process	wmipcvse.exe	"Added by the AGOBOT-JF TROJAN!"
X	Microsoft Update Security Patch	mssecurityupdatepatch.exe	Added by the AGENT.EF TROJAN!
X	Microsoft Update Server	mssrv.exe	"Added by an unidentified VIRUS
X	Microsoft Update Service	csrss32.exe	"Added by the AGOBOT-HC WORM!"
X	Microsoft Update Service	mswin32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft update service	systemm.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update SERVICE	phqghum.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Service	msupdate.pif	"Added by the RBOT-AQB WORM!"
X	Microsoft Update Service	wmiprvre.exe	"Added by the AGOBOT-NN WORM!"
X	Microsoft Update Services	wcsnfty.exe	"Added by the RBOT-AGK WORM!"
X	Microsoft Update Services	wsnfty.exe	"Added by the RBOT-AFU WORM!"
X	Microsoft Update Time	wuam.exe	"Added by the RBOT-M WORM!"
X	Microsoft Update USB2	wuammgrd32.exe	"Added by the RBOT-ADT WORM!"
X	Microsoft Update v2.6	lxxex.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Win32a	winupdate32a.exe	"Added by the RBOT-LO WORM!"
X	Microsoft Update Win32x	winupdate32x.exe	"Added by the RBOT-AJN WORM!"
X	Microsoft Update32	wuamgrd32.exe	"Added by the RBOT-PU WORM!"
X	Microsoft Updater	winsys32.exe	"Added by the RBOT.RL WORM!"
X	Microsoft Updater	msconsole.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Updater	svhost.exe	"Added by the AGENT.CDF TROJAN!"
X	Microsoft Updater	vbcjlg.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Updater	wuamgrds.exe	"Added by the RBOT.A WORM!"
X	Microsoft Updater	winupdate.exe	"Added by the AGENT-KIR TROJAN!"
X	Microsoft Updater Resources	WinFixd32.exe	"Added by the SPYBOT.CA WORM!"
X	Microsoft Updater v2	[path to worm]	"Added by the AUTORUN-BCI WORM!"
X	Microsoft UPDATER32	lsass.exe	"Added by the RANDEX.AR WORM! Note - this is not the legitimate Lsass.exe system file should normally NOT figure in Msconfig/Startup!"
X	Microsoft UPDATER32	LSASS32.EXE	"Added by the RANDEX.AR WORM!"
X	Microsoft Updaters	tskmgr.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updaters	sysconfigs.exe	"Added by the RBOT-DF TROJAN!"
X	Microsoft Updaters Pros	WINDLL32XP.EXE	Added by the SPYBOTTER.GEN VIRUS!
X	Microsoft Updates	systemc32.exe	"Added by the RBOT-GR WORM!"
X	Microsoft Updates	wkssvr.exe	"Added by the RBOT.R WORM!"
X	Microsoft Updates	wkssvrs.exe	"Added by the RBOT-EB WORM!"
X	Microsoft Updates	wuamgrd.exe	"Added by the RBOT-CO WORM!"
X	Microsoft Updates	wtemp32.exe	"Added by the RBOT-AHQ WORM!"
X	Microsoft Updates	svehost.exe	"Added by the RBOT-GRW WORM!"
X	Microsoft Updates	svshost.exe	"Added by the AGOBOT-AIW WORM!"
X	Microsoft Updates	svdhost.exe	"Added by the RBOT-GVH WORM!"
X	Microsoft Updates	service.exe	"Added by the POISON.HPT BACKDOOR!"
X	Microsoft Updates	[worm filename]	"Added by the AGOBOT-AIZ WORM!"
X	Microsoft Updates	wgcptsud.exe	"Added by the RBOT-GTF WORM!"
X	Microsoft Updates	winit.exe	"Added by the SDBOT-CSB WORM!"
X	Microsoft Updates 2 USB	wgafixer.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updates 5 USB	sp3fixer.exe	"Added by the RBOT-ADS WORM!"
X	Microsoft UpdateS Machine	wgrd.exe	"Added by the RBOT-FI WORM!"
X	Microsoft Updates Resources	WinFixIDs.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updating	navguard.exe	"Added by the RBOT.HW WORM!"
X	Microsoft Updating	syswr.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updating	wuamguards.exe	"Added by the RBOT-BY WORM!"
X	Microsoft Updating Client	websvc.exe	"Added by the RBOT.AQ WORM!"
X	Microsoft Updating Machine	sysc0de.exe	"Added by the RBOT.RB WORM!"
X	Microsoft Updatting	miroupdate.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft upnp Update	msie.exe	"Added by the RBOT-LQ WORM!"
X	Microsoft UpToDate Driver (32-bits)	[random filename].exe	"Added by the SPYBOT.LXJ WORM!"
X	Microsoft Vertupdate	MSvert32.exe	"Added by the MYTOB-CY WORM!"
X	Microsoft Vista Upgrade Validation Service	cfmon.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Visual Application	vpcrtf.exe	"Added by the IRCBOT-XJ TROJAN!"
X	Microsoft web update	webmsn.exe	"Added by the RBOT-EMQ WORM!"
X	Microsoft Win Corp TLS Verification	mswintls.exe	"Added by the RBOT-GCT WORM!"
X	Microsoft Win Update	WinUP.exe	"Added by the RBOT-BPR WORM!"
X	MicroSoft Wind0ws Updater	winsupdater.exe	"Added by a variant of the RBOT WORM!"
X	MicroSoft Window Updater	winsupdater.exe	"Added by the RBOT-ZZ WORM!"
X	Microsoft Windows	atup	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows	[path to file]	"Added by the BDOOR-LI BACKDOOR!"
X	Microsoft Windows 32 Update	win32update.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows Communicator for NT/XP	wincomm.exe	"Added by the RBOT.ATH WORM!"
X	Microsoft Windows DLL Services Configuration	newdll.exe	"Added by the SDBOT-ZR WORM!"
X	Microsoft Windows DLL Services Configuration	newdll2.exe	"Added by the SDBOT-ABD WORM!"
X	Microsoft Windows DLL Services Configuration	poker.exe	"Added by the SDBOT-ZY WORM!"
X	Microsoft Windows DLL Services Configuration	poker3.exe	"Added by the SDBOT-AAH WORM!"
X	Microsoft Windows DLL Services Configuration	proxy.exe	"Added by the SDBOT-ZL WORM!"
X	Microsoft Windows DLL Services Configuration	windir32.exe	"Added by the SDBOT.BHF WORM!"
X	Microsoft Windows DLL Services Configuration	windir32a.exe	"Added by a variant of the SDBOT.BHF WORM!"
X	Microsoft Windows DLL Services Configuration	windll32.exe	"Added by the SDBOT.BHD WORM!"
X	Microsoft Windows DLL Services Configuration	winDSL.exe	"Added by the SDBOT-ZG WORM!"
X	Microsoft Windows DLL Services Configuration	dllmanager32.exe	"Added by the SDBOT-BTU WORM!"
X	Microsoft Windows Express	Microsoft Update	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Windows Game Updater	msgame32.exe	"Added by a variant of the RBOT WORM!"
U	Microsoft Windows Media Player Network Sharing Service Configuration Application	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	Microsoft Windows Secure Update	rpcxwinupdt.exe	Added by an unidentified WORM or TROJAN!
X	Microsoft Windows Updata	scvhost.exe	"Added by the RBOT.CEM BACKDOOR!"
X	Microsoft Windows Updata	windows.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Updata	[5 random letters].exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update	rundlls.exe	"Added by the HABRACK WORM!"
X	Microsoft Windows Update	msoffice2.exe	"Added by the RBOT-GB WORM!"
X	Microsoft Windows Update	spools.exe	"Added by the SDBOT.TD WORM!"
X	Microsoft Windows Update	svchos.exe	"Added by the SDBOT.AC WORM!"
X	Microsoft Windows Update	svcshost.exe	"Added by the FORBOT-CF WORM!"
X	Microsoft Windows Update	svmhost.exe	"Added by the FORBOT-CH WORM!"
X	Microsoft Windows Update	svshost.exe	"Added by the WOOTBOT.CJ WORM!"
X	Microsoft Windows Update	msnmessenger.exe	"Added by the SDBOT.AJ WORM!"
X	Microsoft Windows Update	msnwun.exe	"Added by the SDBOT-RM WORM!"
X	Microsoft Windows Update	scvvhost.exe	"Added by the FORBOT-DH WORM!"
X	Microsoft Windows Update	swwhost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update	MSNMSGR.EXE	"Added by the SDBOT-WM WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Microsoft Windows Update	svzhost.exe	"Added by the FORBOT-EV WORM!"
X	Microsoft Windows Update	sccvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update	scrhost.exe	"Added by the RBOT-AOW WORM!"
X	Microsoft Windows Update	mnswinsx.exe	"Added by the RBOT-AWH WORM!"
X	MICROSOFT Windows update	pdate.exe	"Added by the RBOT.BZT WORM!"
X	Microsoft Windows Update	srshost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update	rhost32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows Update	windowsupdate.exe	"Added by the AGOBOT.ON WORM!"
X	Microsoft Windows Update	servcs.exe	"Added by the SDBOT.AL BACKDOOR!"
X	Microsoft Windows Update	syssinfos.exe	"Added by the RBOT-FWR WORM!"
X	Microsoft Windows Update Application	wuap.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update Client	csrss.exe	"Added by the KEBEDE-G WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Systems32"
X	Microsoft Windows Update Client	services.exe	"Added by the AUTORUN.DVE WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Windows Update Logon	win-logon.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update Service	wupdmgr32.exe	"Added by the DOS.AUTOCAT TROJAN!"
X	Microsoft Windows Update Service	msnmsg.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Windows Update x86	[various filenames]	"Added by a variant of the RBOT WORM! Filenames seen include (but are not limited to firefox.exe
X	Microsoft Windows Update XP64	********.exe [* = random char]	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update XP64	updatexp64.exe	"Added by the SDBOT-AIM WORM!"
X	Microsoft Windows Update XP64	Lcuninst.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update XP64	mzhxlixm.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updater	winupdgm.exe	"Added by the GAOBOT.BI WORM!"
X	Microsoft Windows Updater	WINIUPDATES.EXE	"Added by the RBOT-KK WORM!"
X	Microsoft Windows Updater	WINUPDATE.EXE	"Added by the RBOT-LI WORM!"
X	Microsoft Windows Updater	TMNTSrv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Updater	win32upd.exe	"Added by the RBOT-EC WORM!"
X	Microsoft Windows Updater	msnupdateit.exe	"Added by the AGOBOT-RL WORM!"
X	Microsoft Windows Updater	windates.exe	"Added by the SDBOT.TE WORM!"
X	Microsoft Windows Updater	spoolvs.exe	"Added by the RBOT.ACQ WORM!"
X	Microsoft Windows Updater	suvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updater	winfix.exe	"Added by the RBOT-CM WORM!"
X	Microsoft Windows updaterD	log32zx.exe	"Added by the MYDOOM.W WORM!"
X	Microsoft Windows Updates	explorer32.exe	"Added by the SDBOT.VQ WORM!"
X	Microsoft Windows Updates	wsap32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updating System	msresource.exe	"Added by the RBOT-EAM WORM!"
X	Microsoft Windows Workstation	devcode.exe	"Added by the RBOT-AWL WORM!"
X	Microsoft Windows XP Configuration Loader	m32svco.exe	"Added by the SDBOT.WORM!.48548 WORM!"
X	Microsoft Winedows Updateing	NinKey.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft winsupdater	WINSUPDATER.EXE	"Added by the SPYBOTER.FB BACKDOOR!"
X	Microsoft WinUpdate	mntcgf032.exe	"Added by the RBOT-PF WORM!"
X	Microsoft WinUpdate	svh0st.exe	"Added by the SPYBOT.DL WORM!"
X	Microsoft WinUpdate	syslx32.exe	"Added by an unidentified VIRUS
X	Microsoft WinUpdate	syswin32.exe	"Added by the RBOT-HO WORM!"
X	Microsoft WinUpdate	spfix.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft WinUpdate	Winamp61.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft WinUpdate	Winupd32.exe	"Added by the RBOT.MQ WORM!"
X	Microsoft WinUpdate	WinNTinit32.exe	"Added by the RBOT.VS WORM!"
X	Microsoft WinUpdate	msupdte.exe	"Added by an unidentified TROJAN! See examples here & here"
X	Microsoft WinUpdates	serm32.exe	"Added by the RBOT.GE WORM!"
N	Microsoft Works Update Detection	wkdetect.exe	Checks for updates to MS Works
X	Microsoft WPCEmail	[path to trojan]	"Added by the SNIFFER-N TROJAN!"
X	Microsoft WWW	[path to trojan]	"Added by the AGENT-DRI TROJAN!"
X	Microsoft Wxdate	Syswu32.exe	"Added by the SPYBOT.HZ WORM!"
X	Microsoft X Update	wuamkoppnp.exe	"Added by the RBOT-ANI WORM!"
X	Microsoft--Updates	sxvhost.exe	"Added by the RBOT-FH WORM!"
X	Microsoft-Update	wngard.exe	"Added by the RBOT-JV WORM!"
X	Microsoft-Updates	svxhost.exe	"Added by the RBOT-CT WORM!"
X	MicrosoftCorp	update.exe	"Added by the AUTORUN-ASG WORM!"
X	MicrosoftCorp	wupdate.exe	"Added by the AGENT-LAY TROJAN!"
X	MicrosoftKs	Drivers.bat	"Added by the SHUTDOWN-F TROJAN!"
X	MicrosoftMultimediaTask	Mmtask.exe	Adware downloader - not the valid MusicMatch Jukebox which shares the same filename
X	MicrosoftNAPC	update.exe	"Added by the AUTORUN-ASG WORM!"
X	MicrosoftNAPC	wupdate.exe	"Added by the AGENT-LAY TROJAN!"
X	Microsofts Updates	lsasss.exe	"Added by the RBOT-AEX WORM!"
X	Microsofts Updatez	cmsssr.exe	"Added by an unidentified VIRUS
X	Microsofts Updatez	exploirez.exe	"Added by a variant of the RBOT WORM!"
X	MicrosoftServiceManager	msupdat.exe	"Added by the YAHA.AA WORM!"
X	MicrosoftUpdate	syshelper.exe	"Added by the WOOTBOT.AC WORM!"
X	MicrosoftUpdate	WinUp32.exe	"Added by an unidentified VIRUS
X	MicrosoftUpdate	MicrosoftUpdate.exe	"Added by the BANKER-EHC TROJAN!"
X	MicrosoftUpdate	windll.exe	"Added by the RBOT-IH WORM!"
X	MicrosoftUpdate	RBuilder.exe	"Added by the DLOADR-BMV TROJAN!"
X	MicrosoftUpdate	svhest.exe	"Added by the RBOT-ES WORM!"
X	MicrosoftUpdate	downnew.exe	"Added by the TANTO-D TROJAN!"
X	MicrosoftUpdates	[path to trojan]	"Added by the DELF-LO TROJAN!"
X	MicrosoftUpdates	syshelped.exe	"Added by the FORBOT-AZ WORM!"
U	MicrosoftŽ WindowsŽ Operating System	Sidebar.exe	"Windows Sidebar is a pane on the side of the Microsoft Windows Vista desktop where you can keep your gadgets organized and always available. In Windows 7 this feature is known as Desktop Gadgets and each gadget can be placed anywhere on the desktop. If the file isn't located in %ProgramFiles%\Windows Sidebar or you're using other versions of Windows it could be part of the Searchcentrix hijacker"
N	MicrosoftŽ WindowsŽ Operating System	"RunDLL32.exe ehuihlp.dll	BootMediaCenter"
N	MicrosoftŽ WindowsŽ Operating System	p2phost.exe	"Signs a user into the People Near Me feature at login in Windows 7 and Vista. People Near Me enables you to use certain peer-to-peer (P2P) programs on a network - that ""identifies people nearby who are using computers and allows those people to send you invitations for programs such as Windows Meeting Space. They can only invite you to participate in programs that are installed on your computer."" Available via Start → Control Panel"
U	MicrosoftŽ WindowsŽ Operating System	ehTray.exe	"Media Center Tray Applet - part of Windows Media Center on XP MCE
N	MicrosoftŽ WindowsŽ Operating System	"rundll32.exe oobefldr.dll	ShowWelcomeCenter"
N	MicrosoftŽ WindowsŽ Operating System	stikynot.exe	"Microsoft Sticky Notes - virtual sticky notes tool from Windows Vista. This implementation of the popular yellow ""Post-It"" tool is part of the Tablet PC features and allows you to enter either handwriting (via a pen or mouse) or record a voice note. AVailable via Start → All Programs"
U	MicrosoftŽ WindowsŽ Operating System	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	Microsotufed Update 32	windinit.exe	"Added by the RBOT-CTJ WORM!"
X	Microszoft Update Mach1nezs	svchst.exe	"Added by the RBOT-ED WORM!"
?	MigrationVendorSetupCaller	"rundll32.exe migrate.dll	CallVendorSetupDlls"
X	minimo	[path to file]	"Added by the MOSUCK-X TROJAN!"
X	Miosf Update	wimsqaad.exe	"Added by the SDBOT.AG TROJAN!"
X	Mirate Sp 2 Information	miratesp2.exe	"Added by the RBOT.QH WORM!"
X	Mircosoft Update	wuampkd.exe	"Added by a variant of the SDBOT WORM!"
X	MistikotitaTuIpologisti	GDC.exe	"MistikotitaTuIpologisti Greek rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	ml34	[path to trojan]	"Added by the MAILBOT-BH TROJAN!"
N	Mobile Connectivity Suite	Application Launcher.exe	"System Tray access to the HTC Sync mobile phone management utility for models including the Hero
U	Mobipocket Reader Notifications	readernotify.exe	"Part of Mobipocket Reader - ""Store all your eBooks
X	Modem	locatesvc.exe	"Added by a variant of the SPYBOT WORM!"
X	Modem Driverz Updates	mdmdrv.exe	"Added by a variant of the SDBOT WORM!"
X	Modifiet Amateur HTPB	wuaclt.exe	"Added by the IRCBOT.AYS WORM!"
N	MoneyStartUp10.0	Activation.exe	Part of MS Money 2002. Available via Start -> Programs
X	Monitor calibration	AV1i.exe	"Anti-Virus-1 rogue security software - not recommended
X	Motherboard Config	Ati2xxx.exe	"Added by the RBOT-AIK WORM!"
X	MouseDrv	[path to worm]	"Added by the ZOLOAD-B WORM!"
X	MouseDrv	update.exe	"Added by the ZOTOB.N WORM!"
X	MoussaEvil	[path to file]	"Added by the MUSANUB-A WORM!"
X	Mozilla Firebird v0.8 Internet Browser	netstats.exe	"Added by the IRCBOT.MC TROJAN!"
U	Mozy Status	mozystat.exe	"Mozy - free backup at a secure
X	Mp3 Loader	Sysdata.EXE	"Added by the AVETTE-A VIRUS!"
X	MPatrolPRO	MPatrolPRO.exe	"MalwarePatrol Pro rogue security software - not recommended
U	MP_STATUS_MONITOR	monitr32.exe	Cannon Multi-Pass status monitor - your choice
X	Ms Builders	Wupated.exe	"Added by the AGOBOT-SS WORM!"
X	MS Configuration	MSFramer.exe	"Added by the RANDEX.OL WORM!"
X	Ms Configuration	microsoftsa32.exe	"Added by the KELVIR.X WORM!"
X	MS Configuration Utility	msconfig32.exe	"Added by the WOOTBOT.DY WORM!"
X	MS DATABASE	MSDATA32.EXE	"Added by a variant of the SDBOT WORM!"
X	MS HTML	mslat.exe	"Added by the LATINUS.SVR TROJAN!"
X	MS HTML Location Class	MSHTML32.exe	"Added by the RBOT-YD WORM!"
X	Ms Java Update For Windows NT/XP	msijavaupdt32.exe	"Added by the RANDEX.AF WORM!"
X	MS Security Update 993	msident.exe	"Added by a variant of the SDBOT WORM!"
X	MS UniX	navupdate64.exe	"Added by the RBOT.CRZ BACKDOOR!"
X	MS Unix Binary	msnupdate.exe	"Added by the RBOT-AAM WORM!"
X	MS Unix Binary	outlookexpressupdate.exe	"Added by the RBOT-YU WORM!"
X	MS Unix Binary	Win32Update.exe	"Added by the RBOT-BAS WORM!"
X	MS Unix Binary	Norton2005Update.exe	"Added by a variant of the RBOT WORM!"
X	MS Unix Binary	trmupdate.exe	"Added by the RBOT-ACC WORM!"
X	MS Update	syshost.exe	"Added by the EVAMAN-F WORM!"
X	Ms Update WinServices NT/XP	winservnt32.exe	"Added by the VANEBOT-G WORM!"
X	MS UPDATER	update.exe	"Added by the RBOT-VC WORM!"
X	MS Updates	mscache.exe	Spyware web downloader
X	MS Updates	syshosts.exe	"Added by the MYDOOM.Y WORM!"
X	MS Updates	aupd.exe	Spyware web downloader
X	MS Updating Utility	msupdater.exe	"Added by the RBOT-XR WORM!"
X	ms window update	******.exe [* = random character]	"Added by a variant of the RBOT WORM!"
X	MS windows Data list process	MSDATLST.exe	Added by an unidentified WORM or TROJAN!
X	MS Windows Security Updater	updater.pif	"Added by the RBOT-AKY WORM!"
X	MS Windows Update	scguard.exe	"Added by the RBOT-YZ WORM!"
X	MS-patch	msconfig32.exe	"Added by the RBOT-AUF WORM!"
X	MS-patch	mspatch32.exe	"Added by the RBOT-AWF TROJAN!"
X	msbsc	[path to trojan]	"Added by the BANKER-DF TROJAN!"
X	msconfig	msconfig.bat	"Added by the PAHATIA.B WORM!"
X	MSConfig Manager	msupdate.exe	"CoolWebSearch parasite variant"
X	msconfig service	MSupdate32.exe	"Added by a variant of the SPYBOT WORM!"
X	msconfigurator	ctfsdk.exe	"Added by the DELF-ALS TROJAN!"
?	MSCRMStartup	Microsoft.Crm.Application.Hoster.exe	"Related to Microsoft Dynamics CRM integrated solutions for Financial
X	MSDatabla	vadasq.exe	"Added by the LIOTEN.IK WORM!"
X	msdir32	msdir32.bat	"Added by the ROOKIE-A TROJAN!"
X	MSDNMess	[path to trojan]	"Added by the RANKY.BA TROJAN!"
X	MsgApi	[path to file]	"Added by the DEDLER-D TROJAN! The most common filenames seen are ""csmss.exe"" and ""csmrs.exe""
X	Msgmgr	[path to worm]	"Added by the BABYBEAR WORM!"
X	MSI Configuration	msiconf.exe	"Added by the AGENT.AKSZ TROJAN!"
?	MSLIB32	mswatch32.exe	"??"
X	msliveupdate	msliveupdate.exe	"Added by the AGOBOT.ALT WORM!"
X	msmsgss	[path to trojan]	"Added by the RANKY.G BACKDOOR!"
X	MSN	netstats.exe	"Added by the IRCBOT.UXP WORM!"
X	MSN Administration For Windows	msnadp32.exe	"Added by the BROPIA.W WORM!"
X	MSN Auto-Updater	msnaupdater.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	MSN Auto-Updater	msnupdates.exe	"Added by the AUTORUN.WORM.GEN WORM!"
X	MSN Communication Manager	msncommgr.exe	"Added by an unidentified WORM or TROJAN! See here"
X	MSN Configuration	msnconfig.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Msn Configuration Loader	msngms.exe	"Added by the KELVIR.T WORM!"
X	MSN Configuration Loader	msmsncfg.exe	"Added by the AGOBOT-KX BACKDOOR!"
X	MSN Database Client	msndbcli.exe	"Added by an unidentified WORM or TROJAN! See here"
X	MSN File Configuration	msnfilecfg.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	MSN Message Background loader	[path to worm]	"Added by the RBOT-AIE WORM!"
X	Msn Messenger Update	msnupdate.exe	"Added by a variant of the RBOT WORM!"
X	Msn Messenger update	msnservice.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Msn Patch	msndp.exe	"Added by the RBOT.AAI WORM!"
X	Msn Patches	msndr.exe	"Added by a variant of the SDBOT WORM!"
X	Msn Plus Updater	msnplus.exe	"Added by the RBOT-MU WORM!"
X	Msn Service	matrixcam.exe	"Added by the MYTOB.JH WORM!"
X	MSN Service Updates	winproc.exe	"Added by the KELVIR-BB WORM!"
X	MSN Update	mscon.exe	"Added by the RBOT-QA WORM!"
X	MSN Update	msn32.exe	"Added by the RBOT.AHN WORM!"
X	MSN Update	DLLCON.EXE	"Added by the RBOT-EA WORM!"
X	MSN Update Cfg	msnupdbt.exe	"Added by an unidentified WORM or TROJAN! See here"
X	MSN Update Client	msnupdater.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	MSN Update Client	msnupdcli.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Msn Update Manager (Sp2)	MSMSGS.EXE	"Added by the AGOBOT-NL WORM! Note - this particular msmsgs.exe file is located in %System% and should not be mistaken for the MSN Messenger file of the same name which is located in %Program Files%\Messenger"
X	Msn Update Service	userx.exe	"Added by the MYTOB.JF WORM!"
X	MSN Update Service	msnupdsv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Msn Update SUPPORT	[random filename]	"Added by the RBOT-BPS WORM!"
X	MSN Updater	msnms.exe	"Added by the FORBOT-CG WORM!"
X	Msn Updater	msnplugins.exe	"Added by the RBOT-HS WORM!"
X	Msn Updater	windatemanager.exe	"Added by the SDBOT.TS WORM!"
X	MSN UPDATERS	virtualmemory.exe	"Added by the RBOT-JK WORM!"
X	MSN Updating	msnupdate.exe	"Added by the QHOST.AEI TROJAN!"
X	msn upddate	mesenger.exe	"Added by the RBOT-AVZ WORM!"
X	MSN6.1 Auto-Updater	v6msn.exe	"Added by the AUTORUN-MM WORM!"
X	Msnarrator	msnarrator.exe	"Added by the NARAT.A TROJAN! - also identified as MPGCOM Toolbar adware"
X	MSNMSGRE	swef.bat	IRC backdoor TROJAN or WORM!
X	MSNMSGRR	swin.bat	IRC backdoor TROJAN or WORM!
X	MSNMSGRS	swe.bat	IRC worm or backdoor trojan!
X	MSNMSGRS	swiss.bat	IRC worm or backdoor trojan!
X	MSNMSGRS1	swed.bat	IRC backdoor TROJAN or WORM!
X	msnmsgy	[path to file]	"Added by the BANKER-EQ TROJAN!"
X	MSNPluginSrvcs	sagate.exe	"Added by the SDBOT.AKJ WORM!"
X	msoft-updater23	mssysstems.exe	"Added by the RBOT-ATU WORM!"
X	msoft-updater23	slssystem.exe	"Added by the RBOT-ASR WORM!"
X	MSOleath32	winss.exe	"Added by the KATHER TROJAN!"
X	msoupdater	msoupdater.exe	"Added by the DLOADER.GBD TROJAN!"
X	Mspatch69	[path to trojan]	"Added by the MPROX TROJAN!"
X	Mspatch89	cnqmax.exe	"Added by the RANDEX.P WORM!"
X	MSPP System Update 64	wiaadmgr.exe	"Detected by Kaspersky as the RANKY.GEN TROJAN!"
X	MSPRO32	[path to worm]	"Added by the IBERIO WORM!"
X	msresear	[path to trojan]	"Added by the WEASYW-B TROJAN!"
X	MSSGisg	[path to file]	"Added by the RANKY.N TROJAN!"
X	mssonfig	winupdate.exe	"Added by a variant of the SDBOT WORM!"
X	mssvc	[path to trojan]	"Added by the PSK TROJAN!"
X	MSUpdate	wupd.exe	"Added by the ALADINZ.M TROJAN!"
X	MSUpdate	svchosthlp.exe	"Added by the BLASTER.T WORM!"
X	msupdate	msupdate.exe	"Added by the RBOT-MZ WORM!"
X	MSUpdate	criticalUpdate.exe	"Affilred adware"
X	msupdate	update.exe	"Added by a variant of the SDBOT WORM!"
X	Msupdate	expIorer.exe	"Added by the TACTSLAY.A TROJAN!"
X	Msupdate	outIook.exe	"Added by the TACTSLAY.A TROJAN!"
X	Msupdate	svchosts.exe	"Added by a variant of the TACTSLAY TROJAN!"
X	Msupdate	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	Msupdate	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	MSupdate.exe	N/A	"CoolWebSearch parasite variant - resets home page to an adult content site"
X	MSUpdateDevKit	axfd.exe	"Added by the SDBOT-ZD WORM!"
X	msupdater	msupdater.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X	MsUpdater System	udpsys32.exe	"Added by the RBOT.AAA WORM!"
X	MSupdater.exe	N/A	"CoolWebSearch parasite variant. Installs the Winshow.dll browser plugin"
X	msupdater25	lsasser.exe	"Added by the RBOT-ATS WORM!"
X	msupdates	msupdt.exe	"Added by the RBOT-JO WORM!"
X	MSVersion	INTERNETFEATURES.exe	"Added by the POPMON.A TROJAN! - also known as PopMonster adware"
X	msvupdater	msvupdater.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X	MsWindows SysDate	sysmsvc.exe	"Added by the SPYBOT.FCD WORM!"
X	MSWindowsUpdate	Systern.exe	"Added by the RBOT-AFD WORM!"
X	MSWindowsUpdate	mswinup.exe	"Added by a variant of the SDBOT WORM!"
X	MSWinupdate	winupdate.exe	"Added by the DLOADR-AAW TROJAN!"
X	MSWTL32	MSATL32.exe	"Added by an unidentified WORM or TROJAN! See here"
X	MSWUpdate	[path to worm]	"Added by the SILLYFD-V WORM! The most common filename is lsass.exe but it not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	MSxmlHpr	"RUNDLL32.EXE [path] msxm192z.dll	w"
X	MS_Update Check	wdfmgr.exe	"Added by the AGOBOT-TB WORM!"
X	MS_update_0704_KB74073.exe	MS_update_0704_KB74073.exe	"Added by a variant of the UPDATEKB TROJAN!"
X	Multimedia extensions	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	mxb2	[path to worm]	"Added by the IXBOT-G WORM!"
X	MyFastAccess	myfastupdate.exe	My-Fast-Access toolbar updater
U	myNetWatchman	nwclient.exe	"Sends your firewall alerts to a website
U	MytekSystrayExePath	MyTekSystray.exe	"MyTek system tray - web site providing computer tech support in Australia"
X	MyWebSearch Plugin	"rundll32 [path] M3PLUGIN.DLL	UPF"
X	napv.exe	wupdate.exe	"Added by the AGOBOT-JX BACKDOOR!"
X	Narrator	******.exe [* = random char]	"Added by the QOOLOGIC TROJAN!"
U	Narrator	Narrator.exe	Associated with the Narrator accessibility feature on Windows XP. It is used to convert text to speech
X	Natal	Natal.scr	"Added by the OPASERV.AE WORM!"
X	NAV Auto Update	[random filename]	"Added by the SPYBOT-E WORM!"
X	NAV Auto Update	iamsad.exe	"Added by the SPYBOT-CE BACKDOOR!"
X	NAV Auto Update	Sadness.exe	"Added by the SPYBOT-E WORM!"
X	NAV Auto Updates	csrssp.exe	"Added by a variant of the SDBOT WORM!"
X	NAV Auto Updates	navwindows.exe	"Added by a variant of the SDBOT WORM!"
X	NAV Auto Updates	slserves.exe	"Added by the RBOT.COI BACKDOOR!"
X	NAV Auto Updates	navupdaterx.exe	"Added by a variant of the RBOT WORM!"
N	NAV Configuration Wizard	cfgwiz.exe	"Introduced with Norton Anti-Virus 2002
X	NAV Live Update	[path to worm]	"Added by the DEBORMS.C WORM! Note - this is not a valid Norton Anti-Virus (NAV) function from Symantec"
X	Navegate	iiexplorer.exe	"Added by the BANCBAN-OP TROJAN!"
X	Navegate	wisterd.exe	"Added by the BANKER-BOS TROJAN!"
X	NAVWatch	NAVWatcher.exe	"VX2.Transponder parasite updater/installer related"
X	NAV_Update	NAV_Update.exe	Unidentified WORM or TROJAN!
N	NB Windows Patterns	WINDBKGND.EXE	"Part of McAfee Nuts & Bolts. With Background Patterns
X	NBT System alias	[path] repcale.exe [path] beird.exe	"Added by a variant of the RANDON.AN WORM!"
X	Ndpldaemon	[path to trojan]	"Added by the RPCSDBOT-A TROJAN!"
X	Ndtstat	Ndtstat.exe	Added by a variant of the BANLOAD family of TROJANS!
X	Negative	spain.exe	"Added by the BANKER-EXJ TROJAN!"
X	Nero Updater.6.12	wmp9.exe	"Added by the AGOBOT-AAG WORM!"
X	NeroUpdate Check	msjava.exe	"Added by the AGOBOT.AMH WORM!"
X	NeroUpdater6.8	winjava.exe	"Added by the AGOBOT.AMK WORM!"
U	Net Accelerator	NetAccelerator.exe	"Rizal NetAccelerator - ""Optimizing Dial-Up
X	NET Bios Stats	ntbstats.exe	"Added by the SDBOT-ZX WORM!"
U	NetAccelerator	NetAccel.exe	"NetAccelerator is a "software utility that optimizes your internet access up to 1200% faster!. NetAccelerator speeds all modems allowing you to download faster
U	NetAssistant	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
?	netfxupdate	netfxupdate.exe	"Would appear to be a valid Microsoft .NET file (see here) but other sources suggest it could be a trojan"
?	NetFxUpdate_v1.0.3705	netfxupdate.exe	"Would appear to be a valid Microsoft .NET file (see here) but other sources suggest it could be a trojan"
X	nethost.exe	[path to file]	"Added by the PERDA-J TROJAN!"
U	NetManageImport	nmcpdata.exe	"NetManage business software related"
U	NetPatrol	winclient.exe	"NetPatrol network monitoring software"
N	NetStat Live	Nsl.exe	"AnalogX NetStat Live - TCP/IP protocol monitor which can be used to see your exact throughput on both incoming and outgoing data"
X	Nettordinateur	GDC.exe	"Nettordinateur rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	netupdate32	netupdate32.exe	"Added by the RBOT-GQZ WORM!"
X	NetWatch32	netwatch.exe	"Added by the MIMAIL.C WORM!"
X	Network Administration	NAS.exe	"Added by the ANTILAM.20.Q TROJAN!"
X	Network Administration Service	rsvc32.exe	"Added by the RBOT.ABH WORM!"
U	Network Associates Error Reporting Service	TBMon.exe	Network Associates Error Reporting Tool - tool traps errors and requests submission to NAI for the purpose of betatesting new software
X	Network Connections	internat.exe	"Added by the VB-ZD TROJAN!"
X	Network Host Controller	[path to trojan]	"Added by the WHISPER TROJAN!"
X	Network Security Guard	[path to trojan]	"Added by the COLEM-A TROJAN!"
X	Network Translation System Service	ntss.exe	"Added by the UNPDOOR TROJAN!"
X	NetworkAssociates Inc	internet.exe	"Added by the LOVGATE.AB WORM!"
X	Networks Configurator	NetConfs.exe	"Added by the RBOT-OX WORM!"
X	New.net Startup	"rundll32 [path] NEWDOT~1.DLL	ClientStartup"
X	New.net Startup	"rundll32 [path] NEWDOT~1.DLL	NewDotNetStartup"
X	New.net Startup	"rundll32 [path] NEWDOT~2.DLL	ClientStartup"
X	New.net Startup	"rundll32 [path] NEWDOT~2.DLL	NewDotNetStartup"
X	newname	[path to trojan]	"Added by the DRSMARTL-S TROJAN!"
X	NI.ERS_9999_N91S3108	[path to file]	"Installer for the ErrorSafe rogue system error and cleaning utility - see here"
X	NI.GA6PU_0001_N108E1308	[path to file]	"Installer for the VirusSchlacht German rogue security software - see here"
X	NI.GA6PU_0001_N120C2910	[path to file]	"Installer for the VirusSchlacht German rogue security software - see here"
X	NI.GA6P_0001_N105E2704	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N108E1606	[path to file]	"Installer for the BestsellerAntivirus rogue security software - see here"
X	NI.GA6P_0001_N111C1707	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N115C0110	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N115E0110	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N122C0611	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N122C2210	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N122C2802	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N122E0611	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_2001_N108E1606	[path to file]	"Installer for the BestsellerAntivirus rogue security software - see here"
X	NI.GDCDE_0001_N122C1912	[path to file]	"Installer for the FestplattenReiniger German rogue privacy tool - see here"
X	NI.GDC_0001_N111C1909	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.GDC_0001_N122C1912	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.GES_0001_N122C2610	[path to file]	"Installer for the ErrClean rogue system error and cleaning utility - see here"
X	NI.UAVIFR_0001_N105M2404	[path to file]	"Installer for the VirusGarde French rogue security software - see here"
X	NI.UERSM_0001_N68M1602	[path to file]	"Installer for the ErrorSafe rogue system error and cleaning utility - see here"
X	NI.UGA6P	[path to file]	"Installer for the BestsellerAntivirus rogue security software - see here"
X	NI.UGA6PH_0001_N122M2910	[path to file]	"Installer for the AntiVirusAskeladd rogue security software - see here"
X	NI.UGA6PK_0001_N122M1302	[path to file]	"Installer for the VirusForsvar Danish rogue security software - see here"
X	NI.UGA6PL_0001_N108M2808	[path to file]	"Installer for the VirusSchlacht Swedish rogue security software - see here"
X	NI.UGA6PL_0001_N120M1302	[path to file]	"Installer for the VirusSchlacht Swedish rogue security software - see here"
X	NI.UGA6PM_0001_N108M2108	[path to file]	"Installer for the AntivirusScherm Dutch rogue security software - see here"
X	NI.UGA6PM_0001_N122M1202	[path to file]	"Installer for the AntivirusScherm Dutch rogue security software - see here"
X	NI.UGA6PM_0001_N122M3010	[path to file]	"Installer for the AntivirusScherm Dutch rogue security software - see here"
X	NI.UGA6PT_0001_N108M2208	[path to file]	"Installer for the VirusDifesa Italian rogue security software - see here"
X	NI.UGA6PT_0001_N122M1202	[path to file]	"Installer for the VirusDifesa Italian rogue security software - see here"
X	NI.UGA6PT_0001_N122M2910	[path to file]	"Installer for the VirusDifesa Italian rogue security software - see here"
X	NI.UGA6PU_0001_N108M1308	[path to file]	"Installer for the VirusSchlacht German rogue security software - see here"
X	NI.UGA6PU_0001_N120M1202	[path to file]	"Installer for the VirusSchlacht German rogue security software - see here"
X	NI.UGA6PU_0001_N120M2910	[path to file]	"Installer for the VirusSchlacht German rogue secu