NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

• "Y" - Normally leave to run at start-up
• "N" - Not required - typically infrequently used tasks that can be started manually if necessary
• "U" - User's choice - depends whether a user deems it necessary
• "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
• "?" - Unknown

Fatal error: Maximum execution time of 30 seconds exceeded in /home/iamnotag/domains/iamnotageek.com/public_html/startup/search.php on line 252

	Startup Name	Process Name	Details
X		pathex.exe	"Added by the MKMOOSE-A WORM! Note - has a blank entry under the Startup Item/Name field"
	Note the filename has a ""0"" rather than an upper case ""o"""
Inc."	"Microsoft Associates	X	iexplorer.exe
Inc."	"Microsoft NetMeeting Associates	X	NetMeeting.exe
Version	"NVIDIA Compatible Windows Vista Display driver	U	"RUNDLL32.EXE NvCpl.dll
Version	"NVIDIA Compatible Windows7 Display driver	U	"RUNDLL32.EXE NvCpl.dll
X	$WindowsRegKey%update	IEXPLORE.EXE	"Added by the RBOT-EZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	%Temp%	%Temp%delwdef2008.bat	"WinDefender 2008 rogue privacy program - not recommended
X	(default)	"rundll32.exe [path to DLL file]	Do98Work"
X	(Default)	QQUpdate.exe	"Added by the QUADRULE.A WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	msnupdate.exe	"Added by the RBOT-GWT BACKDOOR! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run & HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	*Microsoft Update	ctxma.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	cxma.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wstcl.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wucxt.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wuytc.exe	"Added by the STMU TROJAN!"
Y	*StateMgr	statemgr.exe	Windows ME default for System Restore. Do NOT disable!
X	*windows update	wrauclt.exe	"Added by the RBOT-QU WORM!"
X	*windows update	wuanclt.exe	"Added by the RBOT-PG WORM!"
X	*windows update	wuaucrlt.exe	"Added by the SPYBOT.HUR WORM!"
X	*windows update	wuraclt.exe	"Added by the RBOT-PO WORM!"
X	*windows update	wurauclt.exe	"Added by the RBOT-SY WORM!"
X	*windows update	wsctl.exe	"Added by the SPYBOT.PR WORM!"
X	*windows update	wkmst.exe	"Added by the SDBOT.AVD WORM!"
X	*windows update	wscxt.exe	"Added by the RBOT.AOS WORM!"
X	*windows update	waurclt.exe	"Added by a variant of the RBOT WORM!"
X	*windows update	wuaruclt.exe	"Added by the RBOT-TF WORM!"
X	*WinLogon	[trojan path] ren time:[random number]	"Added by the VUNDO TROJAN!"
X	*winstats	winstats.exe	"Added by the GARGAFX TROJAN!"
X	.msfupdate	msveup.exe	"Added by the ALLOCUP.A WORM!"
X	1	KHATRA.exe	"Added by the AUTOIT-BP WORM!"
X	180ClientStubInstall	[path to trojan]	"180Solutions adware related"
X	2k6 updatz	crss3.exe	"Added by the RBOT-CPD WORM!"
X	2thousandbuck	[path to file]	"Added by the RANKY.L TROJAN!"
X	3.8853E+11	AutomaticUpdates.exe	"Added by the SDBOT-DEN WORM!"
X	360antiarp	[path to trojan]	"Added by the PASTA.AIB TROJAN!"
X	4wd!!!	Natal!.pif	"Added by the OPASERV.AI WORM!"
X	5-megawati	megawati.exe	"Added by the BRONTOK-CR WORM!"
X	5p4m	[path to trojan]	"Added by the LITEBOT-C TROJAN!"
U	802.11g Wireless Adatper	Monitor.exe	"Related to wireless card (802.11) adapter/standard. System Tray icon that provides a shortcut to ""Wireless Connection Status"" and allows to turn WL on and off. Supplier unknown. Adapter is miss-spelled"
N	@Hoc Toolbar	AtHoc.exe	"One-click activated browsing toolbar used by various web-sites. See here for more info"
X	A New Windows Updater	w32NTupdt.exe	"Added by the MYTOB.BM WORM!"
X	a9z1eizA1e	atulabov.exe	"Added by the AGENT-GWD TROJAN!"
X	aa bbcc dde effgghh jj	update.exe	"Added by a variant of the IRCBOT BACKDOOR!"
N	AAATraySaver	TraySaver.exe	"System Tray management utility from Mike Lin which allows you to hide
X	aaprotect	[path to trojan]	"Added by the BANCBAN-MJ TROJAN!"
?	aauclient	ACNUpdater.exe	"Appears to be related to software from Accenture.com"
X	ACCDEFRAGINFO	[path to worm]	"Added by the DARBY-O WORM!"
U	Accelerate	accelerate.exe	Webroot Accelerate - allows you to optimize Windows network registry settings in order to boost surfing speeds. Leave this enabled if you find it improves your connection
X	Access WebControl	[path to file]	"Added by the PPDOOR-M TROJAN!"
N	AccuWeather.comŽ Desktop	AccuWeatherDesktop.exe	"Desktop weather from AccuWeather"
N	AccuWeatherDesktopAlerts	AccuWeatherDesktopAlerts.exe	"Weather alerts for AccuWeather.com Desktop which ""provides you with the most accurate
N	AceGain LiveUpdate	LiveUpdate.exe	"""AceGain LiveUpdate can help to automate and optimize product updates. AceGain LiveUpdate will automatically detect new patch updates
U	Acer ePresentation HPD	ePresentation.exe	"Part of Acer Empowering Technology. Allows you to manage both internal and external displays"
N	Acer Product Registration	ACE1.exe	Acer Product Registration - remove when registration is completed
X	Acrobat	acrmon32.exe	"Added by the SMALL-ECT TROJAN!"
U	Acrobat Assistant	AcroTray.exe	"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
U	Acrobat Assistant 7.0	Acrotray.exe	"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
U	Acrobat Assistant 8.0	Acrotray.exe	"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
X	Acrobat Read	acroup32.exe	"Added by the VANBOT-BQ TROJAN!"
N	Acrobat Speed Launch	acrobat_sl.exe	"Speeds up the time it takes to load Adobe's Acrobat PDF creation and management tool. From version 7.0 onwards"
U	Acronis Popup Blocker	"RunDll32.exe [path] Blocker.dll	Run"
X	Acroread	GoogleUpdate.exe	"Added by the AGENT-JGI TROJAN! Note - this is not the valid Google program which is normally located in %AppData%\Google\Update. This version resides in %Temp%"
N	Activation	Activation.exe	Part of Microsoft Money
X	Active Bit Station	abs.exe	"Added by the MYTOB.BZ WORM!"
X	ActiveX File Registration Service	filereg.exe	"Added by the RBOT-DVD WORM!"
X	ActiveXUpdate	svcss.exe	"Added by a variant of the DEDLER.C TROJAN!"
X	Ad-Eliminator	ad-eliminator.exe	"Ad-Eliminator rogue spyware remover - not recommended
U	Ad-watch	Ad-watch.exe	"Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system"
X	AddClass	[Installation_Path]	"Added by the STARTPAGE.F hijacker"
X	AddClass	[path to trojan]	"Added by the SECDL-A TROJAN!"
X	AddrPlus3	[path] stup.exe [path] Adplus.dll Rundll32	"TCent adware"
X	Administrator	svchost.scr	"Added by the NOVACAL TROJAN!"
X	Administrator	winlogon.exe	"Added by the RUBBLE-C WORM! Note - this is not the legitimate winlogon.exe process
X	Administrator di Dago	Dago.exe	"Added by the PUNYA-B WORM!"
X	Adobe	sysbat32.exe	"Added by the LOWZONES.T TROJAN!"
N	Adobe Acrobat	READER~1.EXE	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
N	Adobe Acrobat	Reader_sl.exe	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
X	Adobe Acrobat Distiller Application	acrotray.exe	"Added by the RANDEX.DFJ WORM!"
X	Adobe Acrobat Reader CFG	[random filename]	"Added by a variant of the RBOT WORM!"
N	Adobe Acrobat Speed Launcher	acrobat_sl.exe	"Speeds up the time it takes to load Adobe's Acrobat PDF creation and management tool. From version 7.0 onwards"
X	Adobe Filter Platform	afilterplatform.exe	"Added by the RBOT-OP WORM!"
N	AdobeUpdater	AdobeUpdater.exe	Automatic updater for Adobe software - run manually
X	AdRoarUpdate	ARUpdate.exe	"AdRoar adware updater"
X	AdRotator.Application	[path to csrss.exe]	"Added by the SMALL-AQ TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	AdRotator.Application	services.exe	"FakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in an ""Inetsrv"" subfolder"
X	AdStatus Service	AdStatServ.exe	"WindUpdates AdStatus Service adware"
X	Adult_Chat	Adult_Chat.exe	Adult content dialler
X	Adult_Chat1	Adult_Chat1.exe	Adult content dialler
X	AdUpdater	sysupudt.exe	Unidentified adware downloader/updater
X	Advanced DHTML Enable	[path to trojan]	"Added by the AGENT.GLQ TROJAN!"
U	Advanced Uninstaller PRO Installation Monitor	monitor.exe	"Innovative Solutions Advanced Uninstaller PRO - ""easy-to-use suite for uninstalling applications and keeping your computer fast
X	advap32	[path to trojan]	"Added by the MUTANT.AT TROJAN!"
U	AEFltrs Application	AESTFltr.exe	"Part of the XP installation of the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
N	AeXAgentLogon	AeXAgentActivate.exe	"Altiris Agent transmits information about your machine for the purpose of asset management and deployment"
N	AGSatellite	AGSatellite.exe	Program from AudioGalaxy that lets you download some MP3s from their server. Available via Start -> Programs
X	AHU	[path to worm]	"Added by the ANACON-B WORM!"
Y	Aiptek Graphics Tablet (USB)	atwtusb.exe	USB interface for Aiptek Graphics Tablet (USB)
?	Air2Data	a2dservice.exe	"Related to the Air2Data Wireless HISA (High-Speed Internet Access) service. What does it do and is it required?"
U	AirPort Base Station Agent	APAgent.exe	"Airport Base Station Agent utility for Apple's AirPort wi-fi basestations. ""Wireless solution for home
?	AlarmWatcher	AlarmWatcher.exe	"Associated with SynTPEnh and SynTPLpr which are from Synaptics for touchpads on laptops. What does it do and is it required?"
X	AlexaToolbar	alt.exe	Identified by Ewido Security Suite (Ewido is now part of AVG Technologies) as the DELF.EB TROJAN!
?	ALFY Accellerator	AlfyAC~1.exe	"??"
U	All Aboard Status	stswin.exe	"All Aboard! Internet Connection Sharing status icon"
X	Allopassw	[path to trojan]	"Added by the RANKY.CU TROJAN!"
U	ALLTEL DSL Check-up Center	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	ALTER DATA	[path] repcale.exe [path] beird.exe	"Added by the IRCFLOOD.CD TROJAN! Both files are located in %System%\ccdew"
N	Aluria's Spyware Eliminator	ASE.exe	"Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU
X	amsgupdate	ams.exe	Added by a variant of the MAILBOT TROJAN!
?	AnnotateCheck	AnnCheck.exe	"Genius Wizard Pen Tablet driver related. Is it required?"
U	AnonymityGateway	Anonymity Gateway.exe	"Anonymity Gateway - privacy protection tool that conceals IP address preventing your surfing habits and your internet activity form being tracked by websites or Internet Service Providers"
X	ansjava	[path to worm]	"Added by the RANDON-AN WORM!"
U	Anti-Trojan-Watch	ATWatch.exe	Anti-Trojan Watch - trojan detector
X	Anti-Virus Update Scheduler	[path to trojan]	"Added by the SPAMMIT-A TROJAN!"
X	Anti-Virus Update Scheduler	winsp3.exe	"Malware - detected by Kaspersky as the AGENT.FP TROJAN!"
X	Anti-Virus Update Scheduler V1.39.12R	[path to trojan]	"Added by the HEPLANE or STAPREW.B TROJANS! - different filenames have been spotted; examples: msvc.exe
U	antidialer.co.uk	Dialer_Watcher.exe	"Dialer_Watcher is an application that allows you to detect dialers on your computer"
X	antike	wingate32.exe	"Added by a variant of the RBOT WORM! See here"
X	Antivirus Installer	[path to trojan]	"Added by the BADGENT-A TROJAN!"
X	AntiVirus Update	updates.exe	"Added by the RBOT-JF WORM!"
X	AntiVirus Update	antivirus.exe	"Added by the RBOT-IF WORM!"
X	Antivirus Updates	avupdchk.exe	"Added by the AGOBOT-IP WORM!"
X	anything	ATITAX.exe	"Added by the FORBOT-DP WORM!"
U	AnyTime	Atw.exe	"AnyTime Organizer Deluxe from Individual Software Inc - ""all the tools you need to organize your calendar
U	AnyTime Organizer	AtDem.exe	"AnyTime Organizer Deluxe from Individual Software Inc - ""all the tools you need to organize your calendar
U	AnyTime Organizer	Atw.exe	"AnyTime Organizer Deluxe from Individual Software Inc - ""all the tools you need to organize your calendar
U	AOL Broadband Check-Up	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	Aol Configuration Loader	aimsng.exe	"Added by the SDBOT-XE WORM!"
X	aolupdater.exe	aolupdater.exe	"Added by a variant of the IRCBOT TROJAN!"
Y	APC UPS Status	Display.exe	"APC PowerChute® Personal Edition status icon"
X	App.EXEName	[path to worm]	"Added by the BODIRU WORM!"
X	AppletINIT	INITIATE.EXE	"Added by the AGOBOT.XV TROJAN!"
Y	Application	mdmsetsp.exe	"Aztech Labs modem driver"
X	Application	csrss.exe	"Added by the BEAGLE.EG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Application Adapter	abvsvc.exe	"Added by the CHECKOUT WORM!"
U	Application Explorer	Naldesk.exe	"Novell Zenworks Application Explorer Executable. ""For almost all users the Novell ZENworks agent (either Application Launcher or Application Explorer) will be run via the user's login script on each successful login. ZENworks is used to periodically deliver software updates and is also used to install the remote management components."""
U	Application Explorer	NalView.exe	"Application Explorer - file manager type access to Novell Application Launcher for installing and updating network residing applications"
X	Application Explorer	appexplr.exe	"Added by the AGENT-NMO TROJAN!"
X	Application In System	Snxmsh.exe	"Added by the AGENT-LNV TROJAN!"
N	Application Launcher	Application Launcher.exe	"System Tray access to the Sony Ericsson PC Suite and HTC Sync mobile phone management utilities. Run manually via the Start Menu (or optional desktop shortcut) before connecting the phone"
X	Application Layer Browser	abgsvc.exe	"Added by the ULPM.FX TROJAN!"
X	Application Layer Gateway Service	algs.exe	"Added by the LINKBOT.M WORM!"
X	Application Layer Scheduler	agtsvc.exe	"Added by the IRCBOT.BJJ BACKDOOR!"
X	Application Layer Services	avrsvc.exe	"Added by the IRCBOT.BJM BACKDOOR!"
X	Application Manager	acnsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Application Manager	apnsvc.exe	"Added by the SMALLTRO.FN TROJAN!"
X	ApplicationProtocolRun	smsbvl32.exe	"Added by the IRCBOT-CX TROJAN!"
X	Aqujyjax	[path to file]	"Added by the RANCK-CQ TROJAN!"
X	ARCHIVE CONTROL	fixupdattr.exe	"Added by the MYTOB.GU WORM!"
X	Arman	[path to worm]	"Added by the IRCBOT-TG WORM!"
N	ashampoo UnInstaller Watcher	UIWatcher.exe	"Part of the Ashampoo® UnInstaller series from Ashampoo GmbH & Co. KG - including UnInstaller Platinum 2
U	ASK	rundll32.exe [path] ASK.dll rdl	"Stealth Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	ASP.NET State Service	csrss.exe	"Added by the DLOADER-QI TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	ASP.NET State Service	crsass.exe	"Added by the BANLOAD-M TROJAN!"
X	ASP.NET State Service	servicos..exe	"Added by the DADOBRA-I TROJAN!"
X	asrupdate.exe	asrupdate.exe	"Added by the VB.ATZ TROJAN!"
N	ASUS Live Update	ALU.exe	ASUS Live Update utility for their motherboards
U	asustweakenable	ATweak.exe	ASUS TweakEnable - restores manually changed settings for ASUS based video cards such as overclocking. Only required if you use non-standard settings
U	AT&T Self Support Tool	matcli.exe	"AT&T Resolution Assistant. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	AT-Watch	ATWatch.exe	Anti-Trojan Watch - trojan detector
X	atapidrv	atapidrv.exe	"Added by the AGOBOT-SL WORM!"
U	atchk	atchk.exe	"AMT Status Message from Intel. Users can manage this
X	atf.exe	pgs.exe	"Part of the PCSecureSystem rogue security software - not recommended. A member of the AVSystemCare family"
X	atf_reinstall	atf.exe	"Part of the AVSystemCare rogue security software - not recommended. See here"
U	Athan	Athan.exe	"Athan - an application that calculates and reminds the five daily Islamic prayer times for anywhere in the world"
U	ATI 2D Component	Ati2mdxx.exe	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. After testing it's exact function isn't known at this time and it doesn't appear to be running even with the startup entry enabled - hence the ""U"" recommendation"
X	ATI Active Graphics Card Monitor	atievx.exe	"Added by the IRCBOT-TL WORM!"
X	ATI AS Filter	msnse.exe	"Added by the RBOT-CCY WORM! Note - modifies the HOSTS file by appending numerous lines
N	ATI CATALYST System Tray	CLI.exe SystemTray	"System Tray access to ATI's Catalyst™ Control Center. Note that this has ""SystemTray"" appended to CLI.exe in the ""Command"" column of MSCONFIG. Not required to run the control center - which is available via a right-click on the desktop"
X	Ati Control Panel	atiphexx.EXE	"Added by the RBOT-BR WORM!"
X	ATI Cpanel	atiphexx.exe	"Added by the AGOBOT-NV WORM!"
U	ATI Desktop Component	ATIPTAXX.EXE	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. Provides System Tray access to display settings (including desktop resolution
N	ATI DeviceDetect	ATIDtct.EXE	Utility meant for future use of the ATI TV WONDER USB 2.0 video driver and can be disabled
X	ATI Display	ATIDisplay.exe	"Added by the BDOOR-AFH BACKDOOR!"
X	ATI Display Driver	atixd.exe	"Added by the RBOT-FOV WORM!"
X	Ati Display Settings	atividx.exe	"Added by the RBOT-GAS WORM!"
N	ATI GART Set-up Utility	Atigart.exe	"Program that checks the motherboard chipset and determines which GART driver bundle to install on ATI video cards. If you have one
U	ATI Launchpad	launchpd.exe	"Convenient way to start all your Multimedia Center applications (DVD
X	ATI Rage3d Pro	AtiRage4dPro.exe	"Added by the AGOBOT-OG WORM!"
Y	ATI Remote Control	ATIRW.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
Y	ATI Remote Control	ATIX10.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
N	ATI Scheduler	Atisched.exe	Component that remains resident in memory and automatically launches the ATI VIDEO PLAYER at a user selected time and date. Delete the shortcut in the Start -> Programs -> Startup folder as well. Functions could re-enable the program to load at start-up and re-introduce the shortcut. Try it and see
N	ATI Task Application	Atitkad.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display
N	ATI Task Application (Atikey)	Atitask.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display
U	ATI Technologies Inc. HydraVision Desktop Manager	HydraDM.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is the HYDRAVISION Desktop Manager - which ""customizes the behaviour of windows and dialog boxes
U	ATI Technologies Inc. HydraVision Viewport	HydraMD.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is HYDRAVISION MultiDesk - which ""creates
X	ATI Technology Startup	techstart.exe	"Added by the RBOT-AEU WORM!"
X	ATI Video Driver Control	atigfx.exe	"Added by the RBOT-FWL WORM!"
X	ATI Video Driver Control	btorrent.exe	"Added by a variant of the IRCBOT TROJAN!"
X	ATI Video Driver Controls	[path to worm]	"Added by the SDBOT-DDS WORM!"
X	ATI VIDEO REGKEY	ati2vid.exe	"Added by the SDBOT.UR WORM!"
?	Ati2cwxx	Ati2cwxx.exe	"For some ATI video cards. Probably used to access features and may not be required - for example the ATI Radeon works fine without it"
X	Ati2evxx	Ati2evxx.com	Added by the BACKDOOR-CPC TROJAN!
X	ati2f104	ati2f104.exe	"Added by the DLOADR-BBW TROJAN!"
U	Ati2mdxx	Ati2mdxx.exe	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. After testing it's exact function isn't known at this time and it doesn't appear to be running even with the startup entry enabled - hence the ""U"" recommendation"
N	ATICCC	cli.exe runtime	"ATI's Catalyst™ CONTROL CENTER. Required if you want to change graphics settings on a regular basis but you must have internet access and Microsoft's .NET framework installed. Note that this has ""runtime"" appended to cli.exe in the ""Command"" column of MSCONFIG. Recommend that start the program manually via Start → Programs → ATI Catalyst Control Center → Advanced → Restart Runtime as it can cause problems when starting Windows"
N	ATICCC	CLIStart.exe	Puts the ATI Catalyst™ Control Center Icon/Shortcut on the System Tray - available via Start → Programs
X	AtiCpanel	atiphexx.exe	"Added by the AGOBOT.IL WORM!"
X	aticpaxx.exe	aticpaxx.exe	"Added by the RBOT-XP WORM!"
U	AtiCwd	AtiCwd.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
U	AtiCwd	AtiCwd32.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
U	AtiCwd	Ati2cwad.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
U	AtiCwd32	AtiCwd.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
U	AtiCwd32	AtiCwd32.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
U	AtiCwd32	Ati2cwad.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
X	AtiDisplayDrv	atidrvxx.exe	"Added by the RBOT-VZ WORM!"
X	atidriver	reaIplayer.exe	"Added by the WARPIGS-E WORM! Note the uppercase ""I"" in the filename
N	AtiGart	Atigart.exe	"Program that checks the motherboard chipset and determines which GART driver bundle to install on ATI video cards. If you have one
N	AtiKey	AtiKey32.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display
N	AtiKey	atiptkad.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Control Panel → Display
N	Atikey	Atitask.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display
U	ATIMACE	MACE.exe	ATI Technologies Control Centre - installed alongside ATI graphics hardware and provides additional configuration options for these devices in the Managed Access to Catalyst™ Environment (MACE) component
U	ATIModeChange	Ati2mdxx.exe	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. After testing it's exact function isn't known at this time and it doesn't appear to be running even with the startup entry enabled - hence the ""U"" recommendation"
X	AtiPanel	atip.exe	"Added by the TACTSLAY.U TROJAN!"
X	atipatxx	atipatxx.exe	"Added by the SMALL-ED TROJAN!"
N	ATIPOLAB	ati2evxx.exe	"Hotkey handler for ATI desktop and mobile graphics chipsets. Users report that most of the hotkeys aren't well documented
U	ATIPOLAB	ati2evae.exe	ATI Polling Program - part of the ATI graphics driver e.g. on some Fujitsu-Siemens Notebooks
N	ATIPOLL	ati2evxx.exe	"Hotkey handler for ATI desktop and mobile graphics chipsets. Users report that most of the hotkeys aren't well documented
U	AtiPTA	Ati2ptxx.exe	"Control panel for the ATI series of video cards allowing access to such features as display resolution
U	ATIPTA	ATIPTAXX.EXE	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. Provides System Tray access to display settings (including desktop resolution
U	AtiPTA	Atiptaab.exe	"Control panel for the ATI series of video cards allowing access to such features as display resolution
U	AtiPTAAA	Ati2ptxx.exe	"Control panel for the ATI series of video cards allowing access to such features as display resolution
U	AtiPTAAA	ATIPTAXX.EXE	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. Provides System Tray access to display settings (including desktop resolution
U	atiptaxx	Ati2ptxx.exe	"Control panel for the ATI series of video cards allowing access to such features as display resolution
U	ATIPTAXX	ATIPTAXX.EXE	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. Provides System Tray access to display settings (including desktop resolution
X	atiptext	atiptext.exe	"Added by the COSIAM-A TROJAN!"
U	AtiQiPcl	AtiQiPcl.exe	Used for hardware DVD decoding on ATI video cards supporting this feature. Not required unless you regularly play DVD's
Y	ATIRmtWndr	ATIX10.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
U	ATISmart	ati2s9ag.exe	"ATI's ""SMARTGART""
U	AtiSound	csrss.exe	"WinSpy surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""ComRoot"" subfolder"
X	atisrc2	windfind.exe	"Added by the WINDFIND-A TROJAN!"
X	ATITech	Active.exe	"Added by the ROAMER-A TROJAN!"
U	atitray	atitray.exe	ATI Tray Tools - allows quick access to ATI graphics card settings
U	AtiTrayTools	atitray.exe	ATI Tray Tools - allows quick access to ATI graphics card settings
X	atiupdate	ATIUPDATE5.EXE	"Added by the DEBESKI.A TROJAN!"
X	atiupdate	msshed32.exe	Added by the DELF.EP downloader TROJAN!
X	ATIUpdater	atiupdxx.exe	"Added by the RBOT-ABX WORM!"
X	Atiupdpl	atiupdpl.exe	"Added by the SMALL.AOS TROJAN!"
X	ativopen	ativopen.exe	Premium rate adult content dialler
Y	ATIX10	atix10.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
U	ATKMEDIA	DMEDIA.EXE	"Driver for the media buttons on the front of some Asus laptops
U	ATKOSD2	ATKOSD2.exe	"On-screen display utility bundled with laptops from ASUS. If this utility is not installed then you will not be able to properly use other AsusTek utilities such as Splendid and Power Gear"
X	Atl**.exe [* = random char]	Atl**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Atl**32.exe [* = random char]	Atl**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	ATM Control	adpn.exe	"Added by the MMS.A WORM!"
N	ATnotes	atnotes.exe	Loads the ATnotes program for virtual sticky notes for your desktop. Available via Start -> Programs
U	Atomic Time Synchronizer	TimeSync.exe	"TimeSync - lets you synchronize your computer's clock with any internet atomic clock"
X	Atomic-x27	Atomic-x27.exe	"Added by the KATOMIK-A WORM!"
X	Atomic-x27C	AtomicpartC.exe	"Added by the KATOMIK-A WORM!"
U	Atomic.exe	Atomic.exe	"Atomic Clock Sync - synchronizes your computer's time with the NIST time server"
N	Atomica	atomica.exe	"Atomica runs from the System Tray and allows the user to find out more about a word or phrase on any screen by pointing at it with the mouse and clicking button one while holding down the Alt key"
U	AtomicTime	ATOMICTIME.EXE	"AtomicTime - utility that synchronizes your PC clock to an atomic clock"
U	AtomSync	atomsync.exe	"AtomSync - ""this NTP client synchronizes your PC clock with an internet atomic time server or with a time server on your LAN"""
U	Atrack	atrack.exe	"New feature of Norton Internet Security (NIS) and Norton Personal Firewall (NPF) 3.0 is the Alert Tracker
U	Atray	Atray.exe	"Active Tray is a utility which lets you configure the system tray. You can also create your own tray icons"
U	ATSpooler	AppsTraka.exe	"DeskTopScout keystroke logger/monitoring program - remove unless you installed it yourself!"
U	ATTBroadbandUpdate	SAUpdate.exe	"Big Brother from Quest Software. System and network monitor"
U	ATTRedUpdate	AutoUpdate.exe	Additional item added to start-ups after AT&T took over the now bankrupt Excite@home high-speed internet service. Included for automatically downloading and installing updates. Leave it unless you plan to regularly run it to check for updates
X	AttuneClientEngine	attune_ce.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	AttuneContentUpdater	attune_cu.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	AttuneDiscovery	attune_di.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	Attunel	Attunel.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	AttuneSystray	attune_st.exe	"Aveo Attune automated helpdesk software - adware/spyware"
N	aTuner	atuner.exe	"aTuner - tweak tool for GeForce based graphics cards"
Y	atwtusb	atwtusb.exe	USB interface for Aiptek Graphics Tablet (USB)
X	AtxBrw	Iexplor.exe	"""Pop Marketing"" adware"
X	Aucompat	Aucompat.exe	"Added by the GEMA TROJAN!"
N	AudioCommander Application	AudioCommander.exe	"System Tray access to the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
U	AudioDrvEmulator	DLLML.exe AudDrvEm.dll	"Related to Creative DLL Module Loader for the Sound Blaster X-Fi (and maybe others). This program is non-essential process to the running of the system
Y	Authentic-ID Toolbar	"rundll32.exe [path] ToolbarATL.dll	LoadTrayIcon"
U	Auto EPSON PictureMate Deluxe on X	E_FATI9TA.EXE	"Epson Status Monitor 3 for the PictureMate Deluxe compact photo printer - for monitoring printer status
U	Auto EPSON Stylus C87 Series on X	E_FATIABL.EXE	"Epson Status Monitor 3 for the Stylus C87 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3500 Series on X	E_FATI9 BL.EXE	"Epson Status Monitor 3 for the Stylus CX3500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3600 Series on X	E_FATI9BE.EXE	"Epson Status Monitor 3 for the Stylus CX3600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3700 Series on X	E_FATIACP.EXE	"Epson Status Monitor 3 for the Stylus CX3700 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3800 Series on X	E_FATIACA.EXE	"Epson Status Monitor 3 for the Stylus CX3800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4200 Series on X	E_FATIAEA.EXE	"Epson Status Monitor 3 for the Stylus CX4200 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4500 Series on X	E_FATI9AP.EXE	"Epson Status Monitor 3 for the Stylus CX4500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4600 Series on X	E_FATI9AA.EXE	"Epson Status Monitor 3 for the Stylus CX4600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4800 Series on X	E_FATIADA.EXE	"Epson Status Monitor 3 for the Stylus CX4800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX5000 Series on X	E_FATIBVA.EXE	"Epson Status Monitor 3 for the Stylus CX5000 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX5500 Series on X	E_FATICAP.EXE	"Epson Status Monitor 3 for the Stylus CX5500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6000 Series on X	E_FATIBIA.EXE	"Epson Status Monitor 3 for the Stylus CX6000 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6600 Series on X	E_FATI9EE.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6600 Series on X	E_FATI9EA.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX7400 Series on X	E_FATICDA.EXE	"Epson Status Monitor 3 for the Stylus CX7400 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX7800 Series on X	E_FATIAFA.EXE	"Epson Status Monitor 3 for the Stylus CX7800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX9400Fax Series on X	E_FATICFA.EXE	"Epson Status Monitor 3 for the Stylus CX9400Fax Series printer - for monitoring printer status
U	Auto EPSON Stylus D78 Series on X	E_FATIBGE.EXE	"Epson Status Monitor 3 for the Stylus D78 Series printer - for monitoring printer status
U	Auto EPSON Stylus D88 Series on X	E_FATIABE.EXE	"Epson Status Monitor 3 for the Stylus D88 Series printer - for monitoring printer status
U	Auto EPSON Stylus DX3800 Series on X	E_FATIACE.EXE	"Epson Status Monitor 3 for the Stylus DX3800 Series printer - for monitoring printer status
U	Auto EPSON Stylus DX4800 Series on X	E_FATIADE.EXE	"Epson Status Monitor 3 for the Stylus DX4800 Series printer - for monitoring printer status
U	Auto EPSON Stylus DX6000 Series on X	E_FATIBIE.EXE	"Epson Status Monitor 3 for the Stylus DX6000 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo 1400 Series on X	E_FATIBUA.EXE	"Epson Status Monitor 3 for the Stylus Photo 1400 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R1800 on X	E_FATI9LA.EXE	"Epson Status Monitor 3 for the Stylus Photo R1800 printer - for monitoring printer status
U	Auto EPSON Stylus Photo R220 Series on X	E_FATIAIE.EXE	"Epson Status Monitor 3 for the Stylus Photo R220 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R2400 on X	E_FATI9SA.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	Auto EPSON Stylus Photo R2400 on X	E_FATI9SE.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	Auto EPSON Stylus Photo R260 Series on X	E_FATIBNA.EXE	"Epson Status Monitor 3 for the Stylus Photo R260 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R280 Series on X	E_FATICKA.EXE	"Epson Status Monitor 3 for the Stylus Photo R280 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R320 Series on X	E_FATI9FA.EXE	"Epson Status Monitor 3 for the Stylus Photo R320 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R340 Series on X	E_FATIAJE.EXE	"Epson Status Monitor 3 for the Stylus Photo R340 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R800 on X	E_FATI9YE.EXE	"Epson Status Monitor 3 for the Stylus Photo R800 printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX420 Series on X	E_FATI9CE.EXE	"Epson Status Monitor 3 for the Stylus Photo RX420 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX680 Series on X	E_FATICJA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX680 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX700 Series on X	E_FATI9IA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX700 Series printer - for monitoring printer status
X	Auto Updat	WindowsSys32.exe	"Added by a variant of the FORBOT WORM!"
X	Auto updat	crcss.exe	"Added by the SDBOT.AAG WORM!"
X	Auto updat	SysDebug.exe	"Added by the FORBOT-BA WORM!"
X	Auto Update	AUP.exe	Added by an unididentified WORM or TROJAN!
X	Auto Update	dma.exe	"Added by the RBOT-AVO WORM!"
X	Auto Update	svchost.exe	"Added by the DUMARDI-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Auto Updater	asclt.exe	"Added by the SLINBOT.CJ BACKDOOR!"
X	Auto Updates	svchost.exe	"Added by the CHEUKO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Auto WinUpdate	taskmrg.exe	"Added by the RBOT-AFA WORM!"
X	AutoAdministrator	SERVICES.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Root%\Application Data\WINDOWS"
N	AutoCAD Startup Accelerator	acstart16.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
N	AutoCAD Startup Accelerator	acstart17.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
X	autoload	windowsupdate.exe	"Added by the POLYCRYP.DY TROJAN!"
X	AutoLoaderEnvoloAutoUpdater	auto_update_loader.exe	"Envolo/AproposMedia adware updater"
N	AutoMate Task Service	automate.exe	"Task scheduler for Unisyn Automate 4 task automation/macro running software. Available via a desktop shortcut or Start → Programs"
U	AutoMate5	Am5HkWnd.exe	"""Automate is the Leading Software for Automation of front and back-office business processes.It provides all the tools necessary to completely automate business processes
U	AutoMate6	AMEM.exe	"AutoMate 6 for automating repetitive tasks"
X	Automated Windows Updates	wauclt.exe	"Added by the GAOBOT.AJD WORM!"
X	Automatic Defrag Manager	defrag.exe	"Added by the RBOT-AKE WORM!"
X	Automatic Media Update	CACHE.RVD	Added by an unidentified WORM/TROJAN!
X	Automatic Media Update	HPLNT32.RVD	Added by an unidentified WORM/TROJAN!
X	Automatic Microsoft Windows Updater	suchost.exe	"Added by the RBOT-EQ WORM!"
X	Automatic Updates	algs.exe	"Added by the IRCBOT-AAM TROJAN!"
X	Automatic Windows Updater	Update.exe	"Added by the GAOBOT.AO WORM!"
N	Automatically launches the United Devices Agent when you start your computer	UD.EXE	The United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home but for medical research. Available via Start > Programs
X	Autopdate	Autopdate.exe	"Added by the RBOT-AGL WORM!"
X	autorundemo	[path to trojan]	"Added by the AGENT-FPX TROJAN!"
N	AutoSpell 5	ASWATC32.EXE	"AutoSpell - spell checker"
X	autoupdate	"rundll32 DATADX.DLL	SHStart"
X	autoupdate	"rundll32 SUPDATE.DLL	SHStart"
X	AutoUpdate	smss.exe	"Added by WINSPY.88! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\debug64"
X	Autoupdate Service	kaka.exe	"Added by the SYMPE-B TROJAN!"
X	Autoupdate Service	[path to trojan]	"Added by the AGENT-CB TROJAN!"
X	AutoUpdate32	services.exe	"Added by WINSPY.88! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\debug64"
X	AutoUpdater	aupdate.exe	"Tinybar variant"
X	AutoUpdater	AutoUpdate.exe	"PeopleonPage foistware"
X	autoupdatev2	[path to file]	"Added by the DROPPER-BM TROJAN!"
X	autoupdatev2	autoupdatev2.exe	"Detected by Kaspersky as the AGENT.FQ TROJAN!"
X	AV	UPDATE-28062004.exe[25 blank spaces].vbs	"Added by the MIDFIN WORM!"
X	AV Client	patch31345.exe	"Added by the MYDOOM.AD WORM!"
X	AV Industry	patch31345.exe	"Added by the MYDOOM.AD WORM!"
X	AV UpDate	Update.exe	"Added by the FUROOT-A TROJAN!"
X	AveoAttune	atmdlusr.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	AVG AntiVirus Updater	avgwusv.exe	"Added by the SILLYFDC.BAX WORM! Note - this is not a legitimare AVG entry"
X	AVG Grisoft Updater	updater.exe	"Added by the AGOBOT-OT WORM!"
X	avnort	formatsys.exe	"Added by the SERFLOG.A WORM!"
X	AVP	[path to trojan]	"Added by the MUTBO-A TROJAN!"
X	avptask	[path to trojan]	"Added by the NOFERE-G TROJAN!"
X	AvSer	msmpatch.exe	"Added by the SERFLOG.B WORM!"
U	AVStation premium	AVStation agent.exe	"Related to Samsung AV Station - instant playback of music
X	AVupdate32 Update	AVupdate32.exe	"Added by the RBOT.CNI TROJAN!"
Y	avx communicator	xcommsur.exe	"Anti-virus part of BitDefender virus scanner/firewall"
U	Awatch	Awatch.exe	"Diagnosis tool that monitors DSL connections
U	AWMON	Ad-Watch.exe	"Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system"
X	b3dUpdate	Zupdate.exe	"Associated with B3d Projector foistware - see here"
N	Babylon Translator	Babylon.exe	"""Babylon-Pro is a powerful information tool that instantly provides relevant information
X	Back Updates	Uninstall.log.vbs	"Added by the YPSAN.D WORM!"
X	Background Intelligent Transfer Service	[path] rundll32.exe	"Added by the VB-ZD TROJAN! Note - this is not the legitimate rundll32.exe process
X	backup	[path to worm]	"Added by the AGOBOT-H WORM!"
X	BADDATE	BADDATE.EXE	"Added by an unidentified VIRUS
X	Band-Aid	[path to file]	"Added by the RANKY.O TROJAN!"
U	Banpopup by Pratik	Banpopup.exe	Banpopup - popup killer
?	Bart Station	station.sbrt	"Related to PeoplePC ISP. May be a dialler for dial-up accounts?"
U	Bart Station	PPCOLink.exe	Dialer for PeoplePC ISP
X	Bat	secure2.bat	"Added by the ZCREW.C TROJAN!"
N	Batchreg1	N/A	"Part of the Windows System Recovery process. Added to the registry via Msbatch.inf. The existence of this key or process after the last reboot during installation indicates an unsuccessful installation
U	BatInfEx	"rundll32.exe [path] BatInfEx.dll	BMMAutonomicMonitor"
U	BatLogEx	"rundll32.exe [path] BatLogEx.DLL	StartBattLog"
X	BatSrv	batserv2.exe	"Detected by Kaspersky as the LOCKSY.M WORM!"
U	Battery Scope	batmgr.exe	Monitors battery levels on a notebook/laptop PC
U	BatteryBar	batterybar.exe	"BatteryBar - displays battery usage
Y	batterymiser	batterymiser.exe	"Battery Miser power management utility for LG Notebooks"
Y	BatteryMiser 5	BatteryMiser5.exe	"Battery Miser 5 power management utility for LG Notebooks"
X	BatzBack	BatzBack.scr	"Added by the BACKZAT WORM!"
U	Bayswap2	TbUpdate.exe	Hot-swappable drive management on Compaq Notebooks which allows you to swap drives without closing down Windows. Only required if you frequently swap bay devices
U	BeatNik Internet Clock	BeatNik.exe	"BeatNik Internet Clock is a Windows clock add-on that supports 'skins'. It can also synchronize your computer's clock with an atomic clock"
X	Beegees Update	beegees.exe	"Added by the SDBOT-ADK WORM!"
U	BelNotify	"rundll32.exe [path] NPBelv32.dll	RunDll32_BelNotify"
X	BeSys	[path to file]	"BeSys adware"
X	bfxtray	[path to trojan]	"Added by the AGENT-GEB TROJAN!"
X	Bharatayuda	GNB.exe	"Added by the BHARAT.A WORM!"
X	BIE	"Rundll32.exe [path] BDSrHook.dll	Rundll32"
?	BigDogPath	VM_STI.EXE	"Bundled with some software for digital cameras that use a USB connection - what does it do and is it required?"
X	BillGatesLoh.exe	BillGatesLoh.exe	"Added by the AGENT-FZO TROJAN!"
Y	BitDefender Communicator	xcommsvr.exe	"BitDefender antivirus"
N	BJ Printer Status Monitor	Cjstsr.exe	Canon BJ printer status monitor
N	BJ Status Monitor 5xx	CJSTRxx.EXE	Canon printer status monitor - where "xx" is different depending upon the version. Not required as you can check the printer status via My Computer -> Printers
N	BlackBerryAutoUpdate	RIMAutoUpdate.exe	"Automatic updates for BlackBerry smartphones
X	blah service	winupdate.exe	"Added by the GAOBOT.BIA WORM!"
X	Blank AntiViri	AUT0EXEC.BAT StartUp	"Added by the BRONTOK-CJ WORM!"
X	BLMessagingIntegration	blengine.exe	"BuddyLinks adware"
X	BlockWatcher	BlockWatcher.exe	"BlockWatcher rogue security software - not recommended
U	BLOG	"rundll32.exe [path] BatLogEx.DLL	StartBattLog"
X	Blue Service	[path to trojan]	"Added by the BANCOS-BCW TROJAN!"
U	BluetoothAuthenticationAgent	"rundll32.exe irprops.cpl
U	BluetoothAuthenticationAgent	"rundll32.exe bthprops.cpl
U	blueyonder Instant Support Tool	matcli.exe	"Blueyonder Instant Support Tool. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	BMail Installation	FTP_back.exe	"Part of iMesh - a file sharing system. Reported by Norton AntiVirus as a trojan. Once deleted does not prevent file sharing working. Older versions of iMesh re-instate this but the newer versions do not"
U	BMMGAG	"RunDll32 [path] pwrmonit.dll	StartPwrMonitor"
U	BMMMONWND	"rundll32.exe [path] BatInfEx.dll	BMMAutonomicMonitor"
N	BMupdate	BMupdate.exe	"Related to the BookmarkCentral entry. Typically added after downloading drivers for Visioneer scanners for example
X	Boarddata	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are often located in %System%"
X	boat32	boat32.exe	"Added by a variant of the RBOT WORM!"
X	BootsCfg	wscript.exe [path] Date.POP.vbs	"Added by the KUULLIO WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbs	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbe	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
U	BootStatus	BOOTST~1.EXE	"Visual Basic program that pops up a small window on startup telling you how many times the machine has been booted that day. Once you exit it
X	boot_reg	[path to file]	"Added by the BANCBAN-CA TROJAN!"
X	Bouncer RunStartup	LiveUpdate.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
X	Bridge	"rundll32.exe [path] Bridge.dll	Load"
U	broadband medic	matcli.exe	"NTL's Broadband Medic. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	Bron-Spizaetus	[path to file]	"Added by the BRONTOK-F WORM!"
X	Bron-Spizaetus	RakyatKelaparan.exe	"Added by the BRONTOK-J or BRONTOK-L WORMS!"
X	BrowserUpdateSched	[random filename]	"ZenoSearch adware"
X	brwdiag	[path to worm]	"Added by the STRATIO-BN WORM!"
X	BT	[path to trojan]	"Added by the LITEBOT-B TROJAN!"
U	BT Broadband Basic Help	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	BT Broadband Desktop Help	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	BT Broadband Help	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	Bug Eliminator	Bug_Elim.exe	"Bug Eliminator - ""performs a complete health check on your computer safely
U	bugwatcher service	bugwatcher.exe	"
U	BullGuard Update	avxlive.exe	"Part of Bullguard antivirus. Leave enabled unless you manually update virus definitions"
X	Bwddwss	[path to trojan]	"Added by the RANKY.BD TROJAN!"
?	BZUtilizationCollector	BZUtilizationCollector.exe	"Part of BlazentAgent from Blazent who provide ""outsourcing governance automation for IT Outsourcing (ITO) relationships"". What does it do and is it required?"
X	C7	[path to worm]	"Added by the MEDIAKILL.A WORM!"
X	CacheLoader	[path to trojan]	"Added by the DLOADER-NZ TROJAN!"
U	CafeStation	CafeStation.exe	"""CafeSuite is the solution for your internet cafe. Our software provides you with ameans to control the workstations
X	calc	"rundll32.exe [path] ntuser.dll	_IWMPEvents@0"
U	CallCenter Main Application	V3calmcp.exe	"""V3 Inc. CallCenter is a free 32-bit
?	CameraApplicationLauncher	CameraApplicationLaunchpadLauncher.exe	"Supports the integrated webcam on IBM/Lenovo Thinkpad notebooks. What does it do and is it required?"
U	Canon MultiPASS Status Monitor	monitr32.exe	Cannon Multi-Pass status monitor - your choice
?	Canon PC1200 iC D600 iR1200G Status Window	CAPM1LAK.EXE	"Cannon printer related - is it required in startup?"
N	CaptureBat	Capture.exe	"!Quick Screen Capture from EtruSoft Inc. - ""allows you to take screenshots from any part of your screen in more than 10 ways
X	cartao	[path to file]	"Added by the DLOADER-QD TROJAN!"
N	Cashsurfers Cashbar Navigator	Cashbar.Exe	"Cashsurfers CashBar Navigator - ""The CashBar rotates banner advertisements once per minute and provides you with access to up to date special offers and deals"""
X	CashToolbar	MSCStat.exe	"Added by the DOWNLOADER-MY TROJAN!"
X	Catalyst Control Centre	atixvdm.exe	"Added by the RBOT.DMW TROJAN!"
X	catsrv	catsrv.exe	"Added by the PAPLOK TROJAN!"
U	CBWAttn	CBWAttn.exe	"Required for Bitware to answer incoming faxes
X	ccUpdate	ccUpdate.exe	"Added by the AGOBOT.YS WORM!"
X	Cdcompat	Cdcompat.exe	"Added by the GEMA TROJAN!"
X	Cekirge	[path to worm]	"Added by the KERGEZ.A WORM!"
U	CertificateRegistration	SafeSignCertReg.exe	SafeSign Certificate Registration Utility for Microsoft Crypto applications
X	cesmain.dll	"Rundll32.exe [path] cmail.dll	Rundll32"
X	cftmon	WindowsUpdate.exe	"Added by the AGENT.AQK BACKDOOR!"
X	Chat login	chatlogin.exe	"Added by the ANTINNY.F WORM!"
N	Chatango	Chatango.exe	"Chatango - ""allows people to be connected in real time through their Web browsers. Include your Chatango contact link or button when you create eBay auctions
U	ChatStat	ChatStat.exe	"ChatStat from ChatStat Technologies
X	Cheatle	GigaByte.exe	"Added by the SHODI.B VIRUS!"
U	cheatmonitor	start.exe	"CheatMonitor surveillance software. Uninstall this software unless you put it there yourself"
N	Check for One Touch Update	wiseupdt.exe	Checks for updates for Visioneer OneTouch scanners
N	Check for TWS Updates	WiseUpdt.exe	Interactive Brokers - check for update to their standalone Java-based trading platform
N	CheckCustomWorksUpdate	CheckCWupdate.exe	"Update checker
X	chkdsk	autoexec.bat	"Added by the ANPES WORM!"
Y	Cingular Communication Manager	CingularCCM.exe	"Cingular Communication Manager - now taken over by AT&T. ""provides a robust set of wireless communication tools for businesses and individuals. With wireless access to email
X	Cisco Systems	[path to worm]	"Added by the AUTORUN.UHR WORM!"
U	ClauerUpdate	ClUpdate.exe	"Automatic updates for the software supporting the Clau-ACCV and Clauer-idCAT digital certificate USB keys"
X	Cleanator	Cleanator.exe	"Cleanator rogue privacy program - not recommended
?	CleanRegPath	CleanReg.exe	"Apparently Annex A ADSL modem related. What does it do and is it required?"
N	CleanSweep Useage Watch	CSUSEM32.EXE	Quarterdeck/Norton CleanSweep component - tracks how often you use files and alerts you to files that have not been used for a specified period of time
N	Client Access Help Update	cwbinhlp.exe	"Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
X	Client Agent	[path to file]	"Added by the PPDOOR-J TROJAN!"
X	Client Server Control Process	[path to trojan]	"Added by the AGENT-HR TROJAN!"
X	Client Server Runtime	[path to worm]	"Added by the POEBOT-KR WORM!"
X	Client Update	wup.exe	"Added by the OPANKI.O WORM!"
N	Clik Status Monitor	toolsclickstat.exe	Part of Iomega Tools to let you know whether an Iomega PocketZip (nee Clik) removable drive cartridge is installed
N	ClipMate5x	ClipMt5x.exe	"Clip Mate 5.x by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs"
N	Clipmate6	CLIPMT60.EXE	"Clip Mate 6 by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs"
N	ClipMate7	ClipMate.exe	"Clip Mate 7 by Thornsoft - utility that allows you to store more than one item in the clipboard"
N	Clipomatic	Clipomatic.exe	"Mike Lin's Clipomatic is a clipboard cache program - it remembers what was copied to the clipboard even after new data is copied
X	clkhost	[path to trojan]	"Added by the WIXUD-B TROJAN!"
?	Clotusorgreg0	prtStart.exe [path] Orgprt.exe	"IBM Lotus SmartSuite related. In a LotusOrgReg folder. Unclear what exactly it does?"
X	ClrSchLoader	[path to file]	"ClearSearch adware"
U	ClUpdate	ClUpdate.exe	"Automatic updates for the software supporting the Clau-ACCV and Clauer-idCAT digital certificate USB keys"
X	cmrss	[path to trojan]	"Added by the DLOADER-QQ TROJAN!"
X	CnsMax	Internat.exe	"Added by the POINTEX TROJAN! Note - the real internat.exe resides in %windir%\system (where %windir% is the Windows directory - C:\Windows or C:\Winnt) whereas this version resides in %windir%"
X	CnsMin	"Rundll32.exe [path] CNSMIN.DLL	Rundll32"
U	Cobian Backup 7 Application	CobBU.exe	"Cobian Backup 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	CognizanceTS	"rundll32.exe [path] AsTsVcc.dll	RegisterModule"
N	CollaborationHost	p2phost.exe	"Signs a user into the People Near Me feature at login in Windows 7 and Vista. People Near Me enables you to use certain peer-to-peer (P2P) programs on a network - that ""identifies people nearby who are using computers and allows those people to send you invitations for programs such as Windows Meeting Space. They can only invite you to participate in programs that are installed on your computer."" Available via Start → Control Panel"
X	COM+ System Application	lsas.exe	"Added by the AGOBOT-MO WORM!"
X	COM+ System Applications	lsas.exe	"Added by the AGOBOT.SE WORM!"
U	Command WorkStation 4	cws 4.exe	"EFI's Command WorkStation makes ""managing demanding workflows easier by centralizing job management. The software automatically identifies the Fiery servers on the network and offers customization options for displaying information"" - for high-end print environments"
N	CommonSDK	RoxWatchTray9.exe	"System Tray access to managing the ""Watched Folders""
Y	Communications_Helper	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	Communications_Helper.exe	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	COMMUNICATOR	Communicator.exe	"Part of Microsoft Office Communicator
U	Compaq Knowledge Center	silent.exe & matcli.exe	""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	Compaq Video CD Watcher	??	For Compaq PC's. MPEG viewer
X	Compatibility Service Process	regsvs.exe	"Added by the GAOBOT.YN WORM!"
X	ComPlus Applications	twain.exe	"Added by the AGENT.AQO TROJAN!"
X	con	[path to trojan]	"Added by the BRAVE-A TROJAN!"
X	Config	TaskUpdate.exe	"Added by the MDROP-BRO TROJAN!"
X	Config Loadation	iEEexplore.exe	"Added by the SDBOT.H TROJAN!"
X	Config Loadatiorin	I3Explorer.exe	"Added by the SDBOT.H TROJAN!"
X	Configuration	explorer32.exe	"Added by the SDBOT-ML WORM!"
X	configuration	apphost.exe	"Added by the SDBOT-VP WORM!"
X	Configuration	ntsys32.exe	"Added by the SDBOT-LN WORM!"
X	Configuration	msgfixs.exe	"Added by the SDBOT-NN WORM!"
X	Configuration Default	Wuxat.exe	"Added by the SPYBOT-CA WORM!"
X	Configuration Driver	scghost.exe	"Added by the SDBOT-DLA WORM!"
X	Configuration File	Winset32.exe	Added by the FLUX.101 TROJAN!
X	Configuration Loaded	wupdated.exe	"Added by the MOEGA or MOEGA.AG or MOEGA.AP WORMS!"
X	Configuration Loaded	lssas.exe	"Added by a variant of the SDBOT WORM!"
X	Configuration Loaded	iexploree.exe	"Added by the SDBOT-KC WORM!"
X	Configuration Loader	aim95.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	cmd32.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	syscfg32.exe	"Added by the SDBOT.B BACKDOOR!"
X	Configuration Loader	service5.exe	"Added by the GAOBOT.AF WORM!"
X	Configuration Loader	lfass.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	sycfg34.exe	"Added by the GAOBOT.AN WORM!"
X	Configuration Loader	wincrt32.exe	"Added by the GAOBOT.BF WORM!"
X	Configuration Loader	windex.exe	"Added by the GAOBOT.BZ WORM!"
X	Configuration Loader	dosrun32.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Service.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Servicess.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sw32.exe	"Added by the AGOBOT.BQ WORM!"
X	Configuration Loader	System.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Winreg.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sysinfo.exe	"Added by the GAOBOT.FQ WORM!"
X	Configuration Loader	microsoft.exe	"Added by the GAOBOT.JB WORM!"
X	Configuration Loader	confgldr.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	configuration loader	winicfg32.exe	"Added by the GAOBOT.RQ WORM!"
X	Configuration Loader	svhst.exe	"Added by the GAOBOT.YC WORM!"
X	Configuration Loader	msgfix.exe	"Added by the GAOBOT.AUS or SDBOT.J or SDBOT-QG WORMS!"
X	Configuration Loader	msnss.exe	"Added by the GAOBOT.AUS WORM!"
X	Configuration Loader	IEXPL0RE.EXE	"Added by the SDBOT BACKDOOR! Note the number ""0"" in the filename"
X	Configuration Loader	loadcfg32.exe	"Added by the SDBOT BACKDOOR! Note the number ""0"" in the filename"
X	Configuration Loader	MSTasks.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	systemry.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	ccSort.exe	"Added by the AGOBOT.SR WORM!"
X	Configuration Loader	smss32.exe	"Added by the AGOBOT.MB WORM!"
X	Configuration Loader	wincffg.exe	"Added by the AGOBOT.A3 WORM!"
X	Configuration Loader	seru32.exe	"Added by the SDBOT-VR WORM!"
X	Configuration Loader	botss.exe	"Added by the SDBOT-XS WORM!"
X	Configuration Loader	ldasp.exe	"Added by the AGOBOT.BH WORM!"
X	Configuration Loader	msgcfgsrv.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	smsai.exe	"Added by the SDBOT-YE WORM!"
X	Configuration Loader	svupdate.exe	"Added by the RANDEX.DXP WORM!"
X	Configuration Loader	crcss.exe	"Added by the AGOBOT.ADG WORM!"
X	Configuration Loader	lexplore.exe	"Added by the RBOT-AGX WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	Configuration Loader	scvhost.exe	"Added by the AGOBOT-AAE and SDBOT.AR WORMS!"
X	Configuration Loader	svchost.exe	"Added by the PARADROP-A WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Configuration Loader	svchost2.exe	"Added by the AGOBOT.JR WORM!"
X	Configuration Loader	dezi.exe	"Added by the SDBOT-OB WORM!"
X	Configuration Loader	mouse.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	msg.exe	"Added by the SDBOT.BT WORM!"
X	Configuration Loader	WinHelper.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	extrac.exe	"Added by the SDBOT-AFP WORM!"
X	Configuration Loader	DVD-Player.exe	"Added by a variant of the SDBOT WORM!"
X	Configuration Loader	IEXPLORE.EXE	"Added by the SDBOT-KW WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Configuration Loader	wincore.exe	"Added by the SDBOT.BHE WORM!"
X	Configuration Loader	configldr.exe	"Added by the AGOBOT-PP TROJAN!"
X	Configuration Loader	ahnhst.exe	"Added by the AGOBOT.MX WORM!"
X	Configuration Loader	ntdm.exe	"Added by the AGOBOT.RV WORM!"
X	Configuration Loader	msnmsgr.exe	"Added by the SDBOT-SO WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Configuration Loader	svschost.exe	"Added by the SDBOT-NS WORM!"
X	Configuration Loader	wump.exe	"Added by the AGOBOT-BU BACKDOOR!"
X	Configuration Loader	WinSys32ys.exe	"Added by the SDBOT.BCS WORM!"
X	Configuration Loader	cvcd.exe	"Added by the AGOBOT-DH BACKDOOR!"
X	Configuration Loader	asnclt32.exe	"Added by the AGOBOT-EB BACKDOOR!"
X	Configuration Loader	soundconf.exe	"Added by the AGOBOT-MH WORM!"
X	Configuration Loader	win32exec.exe	"Added by the SDBOT-LA WORM!"
X	Configuration Loader	mservs.exe	"Added by the SDBOT-NM WORM!"
X	Configuration Loader	update.exe	"Added by the SDBOT-OS WORM!"
X	Configuration Loader	FILENAME.EXE	"Added by the AGOBOT-DQ WORM!"
X	Configuration Loader	explore.exe	"Added by the GAOBOT.GW WORM!"
X	Configuration Loader	msgfixy.exe	"Added by the SLINBOT.QW BACKDOOR!"
X	Configuration Loader	winfix.exe	"Added by the SDBOT-MA WORM!"
X	Configuration Loader	scvh0st.exe	"Added by the AGOBOT-AX WORM!"
X	Configuration Loader	msrun.exe	"Added by the AGOBOT-Y WORM!"
X	Configuration Loader 2	confuldr.exe	"Added by the AGOBOT-FC WORM!"
X	Configuration Loader Service	Winsys32.exe	"Added by the RBOT-YV WORM!"
X	Configuration Loader Service	devl32.exe	"Added by the SDBOT-XY WORM!"
X	Configuration Loader10	ip7.exe	"Added by the AGOBOT-ANZ WORM!"
X	Configuration Loading	svchos1.exe	"Added by the GAOBOT.DK WORM!"
X	Configuration Loading	configldr.exe	"Added by the AGOBOT-EC WORM!"
X	Configuration Loading Service	wscel.exe	"Added by the SDBOT-WJ WORM!"
X	Configuration Loadr	iexplore.exee	Added by an unidentified WORM or TROJAN!
X	Configuration Manager	CNFGLD32.EXE	"Added by the SDBOT TROJAN!"
X	Configuration Manager	Cnfgldr.exe	"Added by the SDBOT TROJAN!"
X	Configuration Manager	cfg32.exe	"BookedSpace parasite. Note - the ""cfg32.exe"" file is located in %Windir%"
X	Configuration Servecie	sewins.exe	"Added by the SDBOT-COH WORM!"
X	Configuration Service	suchost.exe	"Added by the TREB TROJAN!"
X	Configuration Services	mswords.exe	"Added by the SDBOT-YM WORM!"
X	Configuration Update	UPDT32V2.EXE	"Added by the SPYBOT-AA BACKDOOR!"
N	Configuration Utility	CONFIG.EXE	Controls linksys wireless connection. Available from the Desktop
U	Configuration Utility	wlanutil.exe	"NetGear Wireless LAN configuration utility for the MA311 802.11b (and maybe other cards)"
X	Configuration Wizard	Cfgwiz32.exe	"Added by a variant of the HACKTACK TROJAN! Not to be confused with the legitimate MS ""ISDN Configuration Wizard"" (Cfgwiz32.exe)"
X	Configuration32 Loader32	winamp32.exe	"Added by the SDBOT-BIC WORM!"
X	Configurations Asclt	asclt.exe	"Added by the SDBOT-MX WORM!"
N	CONNECTAuto Update	CONNECTScheduler.exe	"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
X	Connectivity Tool	[path to trojan]	"Added by the LITEBOT-E TROJAN!"
X	Controladores	[path to trojan]	"Added by the TELEFO-A TROJAN!"
X	ControlPanel	"rundll32 internat.dll	LoadKeyboardProfile"
X	ControlPanel	"host32.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"cmd32.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"[path to executable] internat.dll	LoadKeyboardProfile"
X	ControlPanel	"popcorn.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"svcc.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"private.exe internat.dll	LoadMouseCarpetProfile"
X	ControlPanel	"twink64.exe internat.dll	LoadKeyboardProfile"
U	CookiePatrol	CookiePatrol.exe	"CookiePatrol - cookie interceptor stopping spyware cookies that used to be part of PestPatrol before CA's aquisition"
X	Core Process Aplication	ccapl.exe	"Added by the QHOSTS.G TROJAN!"
X	Core Process Aplication x16	ccapl16.exe	"Added by the SPYBOT.AFT WORM!"
X	Core Process Aplication x32	ccapl32.exe	"Added by the SRAMLER.E TROJAN!"
N	Corel Desktop Application Director	dadx.exe	The Desktop Application Director (DAD) gives you easy access to all Corel applications - x represents ther version number. Available via Start -> Programs
N	Corel Registration	Remind32.exe	If you don't want to register Corel products and be reminded about it every 2 weeks disable it
N	Corel Registration Reminder	Remind32.exe	If you don't want to register Corel products and be reminded about it every 2 weeks disable it
X	Corporate Microsoft Update	uptask.exe	"Added by the RBOT-GVB WORM!"
U	CPATR10	CPATR10.EXE	"Dritek/Compal ATR10 Easy Button driver. Used on certain laptops (e.g. Toshiba
?	CPortPatch	cppatch.exe	"CPortPatch is a utility is required for Dell laptops that are using a docking station. Is it needed though?"
X	cppc	[path to trojan]	"Added by the VB-NV BACKDOOR!"
X	CPU Watcher	"rundll32.exe cpu.dll	load"
X	CPU Windows Status	cpustats.exe	"Added by a variant of the RBOT WORM!"
X	cqlyg	world_cup_.bat	"Added by the WCUP.A WORM!"
X	crash0001	restorecrashwin32.bat	"Added by the AGENT-ZC TROJAN!"
X	CrashDump	[path to trojan]	"Added by the DROPPER.EAT TROJAN!"
X	Crc32stats Dependencies	Crc32stats.exe	"Added by the MYTOB.GT WORM!"
U	Creata Mail	JMSrvr.exe	"Creata_Mail. Smileys
X	Create A Monster	createAMonster.exe	"Kudd.com CreateAMonster. Reportedly stealth installed and Look2Me adware related"
N	CreateCD	Createcd.exe	Adaptec Easy CD Creator system tray application (pre version 5). Available via Start -> Programs
N	CreateCD50	Createcd50.exe	Adaptec Easy CD Creator version 5 system tray application. Available via Start -> Programs
N	CreateCD_Reminder	reminder.exe	Reminder to create system recovery CD/DVDs on a Sony Vaio laptop or desktop
X	Creates stractures for system management	stacture.exe	"Added by the SDBOT-DHS WORM!"
N	Creative AGP Wizard	agpwiz.exe	Part of Creative's BlasterControl
X	Creative Audio Drivers	creative.exe	"Added by the RBOT-FKR WORM!"
N	Creative Detector	CTDetect.exe	"Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player
N	Creative Launcher	CTLauncher.exe	For Creative Soundblaster Live! series soundcards. Adds a quick-launch bar to the top of the display and a System Tray icon. Available via Start -> Programs
U	Creative Live! Cam Manager	CTLCMgr.exe	"Creative Live! Cam Manager"
U	Creative MediaSource Go	CTCMSGo.exe	"Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
U	Creative MediaSource Go	CTCMSGoU.exe	"Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
N	Creative PCI Audio Configuration Utility	starter.exe	"System Tray icon to configure a Creative Soundblaster PCI soundcard. Not required and re-instates itself when un-checked. Try one of the solutions on this special page. Similar to EnsoniqMixer"
N	Creative Software Update	AutoUpdate.exe	Auto-updater for Creative Labs software
N	Creative WebCam Tray	Camtray.exe	Creative WebCam tray control - can be started manually
X	Creative.exe	Creative.exe	"Added by the PROLIN WORM!"
N	CreativeDiscNotifier	CTNOTIFY.EXE	"For Creative Soundblaster Live! series soundcards. Detects when you insert a CD-ROM
U	CreativeMixer	CTMIX32.EXE	"Creative soundcard System Tray access to
?	CreativeTaskScheduler	CTSched.exe	"Creative Task Scheduler. What does it do and is it required?"
X	Critical Update Check	battlenet.exe	"Added by the DELF-LB TROJAN!"
N	CriticalUpdate	Wucrtupd.exe	"MS Windows Critical Update Notification. If you want to keep Windows up-to-date
X	CriticalUpdate	wucrtupd.exe	"Added by the NOALA.B WORM! Note - this file is located in the Windows or Winnt folder
X	CS Update	copy /Y [path] ActivationManager.dll.upd [path] ActivationManager.dll	Added by an unidentified malware
X	csm Win Updates	csm.exe	"Added by the ZOTOB.B WORM!"
X	ctfmon.exe	msupdate32.exe	"Spy Sheriff/SpywareNO malware
X	ctfmoon	microsoftconfigurator.exe	"Added by the DELF-ALS TROJAN!"
X	CTime	[path to trojan]	"Added by the HTTPDOS TROJAN!"
X	CTUpdate	ctupdclt.exe	"Added by the RBOT-ABG WORM!"
X	Ctykd	[path to file]	"SMALL.SN spyware"
U	CWatch	cw.exe	"ChatWatch - chat monitoring tool"
X	cwingllib	atllsimm.exe	"Added by a variant of the SDBOT WORM!"
U	cwupdate	cwupdate.exe	"ContentProtect from ContentWatch - internet filter"
N	Cyber-shot Viewer Media Check Tool	SPUVolumeWatcher.exe	"Part of the Sony Picture Uility software supplied with Sony Cyber-shot digital cameras. Automatically invokes an import process if the camera is connected and has media on it"
X	cyberfree.exe	****.dat [* = random char]	Unidentified adware
U	CyberLat Ram Cleaner	CLRamCleaner.exe	"CyberLat RAM Cleaner - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
U	CyberLat Ram Cleaner	CyberLat Ram Cleaner 1.1.exe	"CyberLat RAM Cleaner - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
U	CyberPatrolNew	cphq.exe	"""CyberPatrol is one of the most powerful and popular client-based
X	CydoorUpdate	CD_Load.exe	"Adware. Check here for information about Cy-Door and here for a program that can remove it"
X	d3dupdate.exe	bbeagle.exe	"Added by the BEAGLE.A WORM!"
X	Daily Weather Forecast	weather.exe	"Added by the DLOADER-IP TROJAN!"
?	DashBarState	dashIE	"??"
X	Data	System.dat.vbs	"Added by the BISCUIT.A WORM!"
X	data	msngs.exe	"Added by the RBOT-ADQ WORM!"
X	Data File	vdehost.exe	"Added by the SDBOT-DOS TROJAN!"
X	Data Layer 2	datalayer.exe	"Added by the RBOT-BNF WORM! Note - do not confuse with the legitimate Nokia file sharing the same filename - this one is located in %System%"
N	Data LifeGuard	BACKWE~1.EXE	Data LifeGuard diagnostic tools for Western Digital's series of hard drives
N	Data LifeGuard LifeLine Lite installer	DLGLI.EXE	"Backweb installer - see here"
X	Data Protection	datprot.exe	"Data Protection rogue security software - not recommended
X	Data Restore Service	prq8.exe	"Added by the KELVIR.AI WORM!"
X	Data789	Regedit.exe ....data789.tmp	Homepage hijacker
X	DATABASE MySql	[path] repcale.exe [path] beird.exe	"Added by the RANDON-AL WORM! Both files are often located in %System%\qsws"
N	DataCaching	FlashKsk.exe	"SmartMedia Card management from the installation of a SanDisk reader for a camera's SmartMedia card and also adds the "Unplug and Eject Hardware" System Tray icon"
X	DataHealer	DataHealer.exe	"DataHealer rogue security software - not recommended
U	DataKeeper	DataKeeper.exe	"PowerQuest DataKeeper (now owned by Symantec) backup software"
Y	DataLayer	DataLayer.exe	"Part of Nokia PC Suite version 5 - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" Required by the Nokia status/connection monitor (NclTray.exe)"
Y	DataLayer	DATALA~1.EXE	"Part of Nokia PC Suite version 5 - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" Required by the Nokia status/connection monitor (NclTray.exe)"
N	DataViz Inc Messenger	DvzIncMsgr.exe	"Installed with DataViz ""Documents to Go"" software"
N	DataViz Messenger	DvzMsgr.exe	"DataViz Documents to Go - "allows you to use your Word
X	Datcheck	datcheck.exe	"Added by the KEYPANIC TROJAN!"
X	Date Manager	datemanager.exe	"Date Manager - calender program. Spyware/adware based provided by The Gator Corporation. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
?	Datechecker	N/A	"Could be related to this?"
X	DateMakerIntl	DateMakerIntl.exe	Premium rate adult content dialler
X	DateMngr	DATEMNGR.EXE	"Added by the SPYBOT-BR BACKDOOR!"
X	DAupdate	DAupdate.exe	NavEnhance adware
X	DCOM Server	[path to trojan]	"Added by the AGENT-CCQ BACKDOOR!"
X	Dcom System Patch	Microsoft.exe	"Added by the RANDEX.MS WORM!"
X	DealHelperUpdate	DHUpdt.exe	"DealHelper adware"
X	Death.exe	Death.exe	"Added by the DELF-ERW TROJAN!"
U	DeathAdder	razerhid.exe	"Razer DeathAdder gaming mouse driver - required if you use the additional features and programmed keys/macros"
X	DefaultConfiguration	defaultconfh.exe	"Added by the AGOBOT-JC WORM!"
X	defender	[path to trojan]	"Added by the VB-BAQ TROJAN!"
U	defwatch	defwatch.exe	Detects out-of-date virus definitions for Norton Anti-Virus Corporate Edition and runs the Defwatch Wizard. Only required if you don't update the virus definitions manually on a regular basis
U	Dell DataSafe Scheduler	DataSafeOnlineScheduler.exe	"Scheduler for Dell DataSafe™ Online which ""helps protect your music
Y	DellAutomatedPCTuneUp	PTAgnt.exe	"PC TuneUp from Dell - ""silently monitors your system
X	DeluxeCommunications	Dxc.exe	"Deluxe Communications adware - successor to SurfSideKick"
U	DepFrez	frzstate.exe	"Deep Freeze from Faronics Coporation. ""Freezes"" the current software configuration so that an a re-boot all changes made refer back to their original settings. Not required for most users - more likely to be used by system administrators
X	DeskMateAutoUpdate	DeskMateAutoUpdate.exe	"DeskMates: Virtual scantily clad girls enhance your desktop. BargainBuddy adware related"
N	Desktop Architect	DATRAY.EXE	"Desktop theme manager available
N	Desktop Weather	THE WEATHER CHANNEL.exe	"Desktop Weather by The Weather Channel - provides current temperature
N	Desktop Weather 3	THE WEATHER CHANNEL.exe	"Desktop Weather 3 by The Weather Channel - provides current temperature
N	Desktop Weather 3	THEWEA~1.EXE	"Desktop Weather 3 by The Weather Channel - provides current temperature
X	DesktopUpdate	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Device Configuration Loader	msdvc32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	DevicePath	Proyecto1.exe	"Added by the GRUEL WORM!"
X	DevicePath	Root.exe	"Added by the GRUEL WORM!"
X	Devicewin	[path to trojan]	"Added by the BANKER-AEV TROJAN!"
X	dfgfdgrergd	[path to trojan]	"Added by the RANKY.CK TROJAN!"
X	DI2	[path to file]	"BroadcastPC adware"
X	DialUp Network Application	Rnaap.exe	"Added by a variant of the SDBOT WORM!"
X	Diesel	Recalculate.exe	"Added by the LAZAR TROJAN!"
Y	Digital Patrol Update 5	update.exe	"Digital Patrol - ""a powerful anti trojan scanner
U	Direct Update	DUControl.exe	"DirectUpdate dynamic DNS updater"
X	DirectX shell driver	[path to trojan]	"Added by the MARKTMAN-B TROJAN!"
U	DiscUpdateManager	DiscUpdMgr.exe	"Disc Update Manager for Digital interactive's DISCover Console. Provider of on-demand video games"
N	DiscUpdateManager	DiscUpdateMgr.exe	"DISCover from Digital Interactive Systems Corporation Inc. ""The company's patented Drop 'n' Play technology provides a simple
X	Disk Defragmentation Loader	pmsvcr.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Disk Keeper	[path to trojan]	"Added by the SMALL-VE TROJAN!"
X	Disk Panel Configuration	dpcsvc.exe	"Added by the IRCBOT.BSQ BACKDOOR!"
X	Diskstart	cat.exe	MS-Connect dialler
X	Dispatcher	dispatcher.exe	"Added by the DLOADR-AS TROJAN!"
X	DivX Updater	DivX.Exe	"Added by the NALDEM TROJAN or MASTAK VIRUS!"
N	DlaTray	Dlatray.exe	"System Tray access to DLA - Drive letter access to HP's and Veritas' version of DirectCD. Does the same thing as DirectCD. From HP - ""This is a needed file as it controles the readability of the Combo drives. Without this file loading the end user will be able to burn CD's but wont be able to read them. The drive itself will be able to read store bought master Cd's without the file but not burnt ones"""
Y	DLBTCATS	"rundll32 [path] DLBTtime.dll	_RunDLLEntry@16"
Y	DLBUCATS	"rundll32 [path] DLBUtime.dll	_RunDLLEntry@16"
Y	DLBXCATS	"rundll32 [path] DLBXtime.dll	_RunDLLEntry@16"
Y	DLCCCATS	"rundll32 [path] DLCCtime.dll	_RunDLLEntry@16"
Y	DLCDCATS	"rundll32 [path] DLCDtime.dll	_RunDLLEntry@16"
Y	DLCFCATS	"rundll32 [path] DLCFtime.dll	_RunDLLEntry@16"
Y	DLCGCATS	"rundll32 [path] DLCGtime.dll	_RunDLLEntry@16"
Y	DLCICATS	"rundll32 [path] DLCItime.dll	_RunDLLEntry@16"
Y	DLCJCATS	"rundll32 [path] DLCJtime.dll	_RunDLLEntry@16"
Y	DLCQCATS	"rundll32 [path] DLCQtime.dll	_RunDLLEntry@16"
Y	DLCXCATS	"rundll32 [path] DLCXtime.dll	_RunDLLEntry@16"
N	DLHelperEXE	WATCH.exe	Download helper distributed with some software that allows the software installation to redirect download locations. Not required once the installation is finished
X	DLL Service Manager	[path to worm]	"Added by the RPCBOT.F TROJAN!"
X	DllExecutable	[path to file]	"Added by the VB-SP WORM!"
X	DLLUPDATE32	dllupdate32.exe	"Added by the AGOBOT.IA WORM!"
X	dm_service	[path to file]	"Added by the MITGLIEDER.P TROJAN!"
Y	DNE Binding Watchdog	"rundll dnes.dll	DnDneCheckBindings"
Y	DNE DUN Watchdog	"rundll dnes.dll	DnDneCheckDUN13"
N	DocuMagix Init	PWATCH.EXE	"PaperMaster is an application for the PC designed to automate the process of organizing
?	Dosbat	??	"??"
N	Download Accelerator Manager Free Edition	dam.exe	"Download Accelerator Manager Free Edition from Tensons Corp"
N	Download Accelerator Plus 5.0	DAP.exe	"Download Accelerator Plus from Speedbit. Download manager for resuming downloads
N	DownloadAccelerator	DAP.EXE	"Download Accelerator Plus from Speedbit. Download manager for resuming downloads
X	Downxz	Downxz.bat	"Added by the MYDOOM.W WORM"
Y	DPASUpdate	DPASAutoUpdate.exe	"Automatic updates for DefenderPro AntiSpy spyware remover - now incorporated Defender Pro 15-in-1 and 5-in-1"
X	DR service	[path to worm]	"Added by the RBOT-CZT WORM!"
X	DRam prosessor	WindowsUpdate.exe	"Added by the RBOT-BBZ WORM!"
X	DRam prosessor	msupdate.exe	"Added by the DELF-FAW TROJAN!"
X	DRam rar proc	winupdaterar.exe	"Added by a variant of the IRCBOT TROJAN!"
X	DRam rare proc	updaterarwin.exe	"Added by the RBOT-GQW WORM!"
X	drin	[path to trojan]	"Added by the SMALL.DPB TROJAN!"
X	DriverPath	system32.exe	"Added by the PRORAT-S TROJAN!"
X	DrWatson	drwatson_.exe	"Added by the LOHAV-S TROJAN!"
X	DrWatson	drwatson_32.exe	"Added by the LOHAV-S TROJAN!"
X	DSAcass	[path to file]	"Added by the RANKY.M TROJAN!"
U	dscactivate	dsca.exe	Dell Support Agent offers additional support and update features for your Dell computer or laptop
X	Dskcompat	Dskcompat.exe	"Added by the GEMA TROJAN!"
X	DSKEY	[path to trojan]	"Added by the STARTER-G TROJAN!"
U	DSLSTATEXE	dslstat.exe	System tray connection status for ADSL modems from Eicon Networks (as used by BT Broadband for example)
X	DsmSer	msmpatch.exe	"Added by the SERFLOG.B WORM!"
X	DSS	[path to trojan]	"Added by the DSSDOOR-C TROJAN!"
U	DT 11Mbps WLAN PC Card Station	DTCARDMonitor.exe	11Mbps PC Card based wireless LAN connection monitor - possibly from Deutsche Telekom
U	DT 11Mbps WLAN USB Station	DTUSBMonitor.exe	11Mbps USB based wireless LAN connection monitor - possibly from Deutsche Telekom
N	Dulux WeatherShield WeatherDesk	weather.exe	"Dulux WeatherShield WeatherDesk - latest weather information from across Australia"
X	Dvdcompat	Dvdcompat.exe	"Added by the GEMA TROJAN!"
N	DW4	Weather.exe	"Desktop Weather 4 by The Weather Channel - provides current temperature
N	DW4	DesktopWeather.exe	"Desktop Weather 4 by The Weather Channel - provides current temperature
N	DW6	DesktopWeather.exe	"Desktop Weather 6 by The Weather Channel - provides current temperature
U	DWHeartbeatMonitor	DWHeartbeatMonitor.exe	DWHeartbeatMonitor.exe is installed alongside the Weather.com instant messaging utility. This is a non-essential process. Disabling or enabling this is down to user preference
X	Dx8compat	Dx8compat.exe	"Added by the GEMA TROJAN!"
N	DXM6Patch_981116	p_981116.exe	"Win32 cabinet self extractor. More info here"
X	Dxupdate.exe	Dxupdate.exe	"Added by the MAFEG WORM!"
U	DynDNS Updater	DynDNS.exe	"Dynamic DNS IP address updater tool
N	DynDNS-Updater Traytool	ddutray.exe	"DynDNS updater tray icon - allows easy configuration of the Dynamic DNSSM service. Can be run manually"
N	E-Color Registration	SonnReg.exe	"Registration for Colorific® and 3Deep® monitor calibration sofware from E-Color. Now superseded by ColorWizzard™ and 3DxWizzard™"
U	e-Surveiller Station	estation.exe	"ESurveiller - surveillance software. Uninstall this software unless you put it there yourself"
U	eanth_critical_update_alert	sys_alert.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
U	eanth_critical_update_alert	EANTHO~1.EXE	"eAcceleration Stop-Sign security software related - previously not recommended (see here). It has now been delisted
U	eanth_system_patcher	sys_alert.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
N	Easy CD Creator	RoxAssist.exe	"Roxio Assistant is designed to correct engine initialization errors in Easy CD & DVD Creator 6. If the engine does not initialize
X	EasyDates	EasyDates.exe	Premium rate adult content dialler
X	EasyDates_gb	EasyDates_gb.exe	"""Edate-A"" premium rate adult content dialler"
X	EasyDates_nl	EasyDates_nl.exe	Adult content dialler
X	EasySearchBar	ESBUpdate.exe	EasySearchBar adware downloader
X	EbatesMoeMoneyMaker	wjview ...Code	"Ebates adware"
X	EbatesMoeMoneyMaker0	EbatesMoeMoneyMaker0.exe	"Ebates adware"
X	ebmmm	ebatesmmmv.exe	"Ebates adware"
U	eDataSecurity Loader	eDSloader.exe	"Part of Acer Empowering Technology. ""Acer eDataSecurity Management is a handy file encryption utility that protects files from being accessed by unauthorized persons
X	educational writer	[random filename]	"Added by the RBOT-LZ WORM!"
X	Efata	[random 5 characters].exe	"Added by the FLUKAN-D WORM!"
U	EFI Job Monitor	"[path] efjm.dll	run"
N	EgisTecLiveUpdate	EgisUpdate.exe	"Software updater for biometric and data encryption products from EgisTec Inc"
U	Eicon NetworksLAN_DAEMON	watch.exe	"Associated with an Eicon Networks ISDN or ADSL modem. Watch protocols your connection with numbers and duration. You need callvu.exe (from Start Menu) to see your connection statistics. You can manually start watch.exe before you go online. Needs diinfo.exe (started by DiTask) to work correctly which can be started manually"
U	Eicon TechnologyLAN_DAEMON	watch.exe	"Associated with an Eicon Networks ISDN or ADSL modem. Watch protocols your connection with numbers and duration. You need callvu.exe (from Start Menu) to see your connection statistics. You can manually start watch.exe before you go online. Needs diinfo.exe (started by DiTask) to work correctly which can be started manually"
X	eixfi	china.bat	"Added by the WCUP.A WORM!"
X	element furth	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are often located in %System%\vert"
U	EMBASSY Trust Suite Secure Update	AutoUpdate.exe	"Updates for Wave Systems Corp. Embassy Trust Suite - ""delivers advanced levels of security to the client PC using the TPM security chip found on most enterprise PCs today"""
X	eMCryT Sh3ars Panagers	[path to worm]	"Added by the RBOT-AWI WORM!"
?	encapsulated command tool	wintr.com	"??"
X	Enumerate Service	wsys.exe	"Added by the MANIFEST TROJAN!"
U	EPSON PictureMate Deluxe	E_FATI9TA.EXE	"Epson Status Monitor 3 for the PictureMate Deluxe compact photo printer - for monitoring printer status
U	EPSON Status Monitor 3	E_[various].EXE	"Epson Status Monitor 3 for their range of printer and AIO devices - for monitoring printer status
N	EPSON Status Monitor 3 Environment Check	e_srcv03.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check	e_srcv02.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check 2	e_srcv03.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check 2	e_srcv02.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
U	EPSON Stylus C120 Series	E_FATICCA.EXE	"Epson Status Monitor 3 for the Stylus C120 Series printer - for monitoring printer status
U	EPSON Stylus C67 Series	E_FATIAAL.EXE	"Epson Status Monitor 3 for the Stylus C67 Series printer - for monitoring printer status
U	EPSON Stylus C87 Series	E_FATIABL.EXE	"Epson Status Monitor 3 for the Stylus C87 Series printer - for monitoring printer status
U	EPSON Stylus CX2900 Series	E_FATIBFP.EXE	"Epson Status Monitor 3 for the Stylus CX2900 Series printer - for monitoring printer status
U	EPSON Stylus CX3500 Series	E_FATI9 BL.EXE	"Epson Status Monitor 3 for the Stylus CX3500 Series printer - for monitoring printer status
U	EPSON Stylus CX3600 Series	E_FATI9BE.EXE	"Epson Status Monitor 3 for the Stylus CX3600 Series printer - for monitoring printer status
U	EPSON Stylus CX3700 Series	E_FATIACP.EXE	"Epson Status Monitor 3 for the Stylus CX3700 Series printer - for monitoring printer status
U	EPSON Stylus CX3800 Series	E_FATIACA.EXE	"Epson Status Monitor 3 for the Stylus CX3800 Series printer - for monitoring printer status
U	EPSON Stylus CX3900 Series	E_FATIBEP.EXE	"Epson Status Monitor 3 for the Stylus CX3900 Series printer - for monitoring printer status
U	EPSON Stylus CX4200 Series	E_FATIAEA.EXE	"Epson Status Monitor 3 for the Stylus CX4200 Series printer - for monitoring printer status
U	EPSON Stylus CX4500 Series	E_FATI9AP.EXE	"Epson Status Monitor 3 for the Stylus CX4500 Series printer - for monitoring printer status
U	EPSON Stylus CX4600 Series	E_FATI9AA.EXE	"Epson Status Monitor 3 for the Stylus CX4600 Series printer - for monitoring printer status
U	EPSON Stylus CX4700 Series	E_FATIADL.EXE	"Epson Status Monitor 3 for the Stylus CX4700 Series printer - for monitoring printer status
U	EPSON Stylus CX4800 Series	E_FATIADA.EXE	"Epson Status Monitor 3 for the Stylus CX4800 Series printer - for monitoring printer status
U	EPSON Stylus CX5000 Series	E_FATIBVA.EXE	"Epson Status Monitor 3 for the Stylus CX5000 Series printer - for monitoring printer status
U	EPSON Stylus CX5500 Series	E_FATICAP.EXE	"Epson Status Monitor 3 for the Stylus CX5500 Series printer - for monitoring printer status
U	EPSON Stylus CX6000 Series	E_FATIBIA.EXE	"Epson Status Monitor 3 for the Stylus CX6000 Series printer - for monitoring printer status
U	EPSON Stylus CX6500 Series	E_FATI9EP.EXE	"Epson Status Monitor 3 for the Stylus CX6500 Series printer - for monitoring printer status
U	EPSON Stylus CX6600 Series	E_FATI9EE.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	EPSON Stylus CX6600 Series	E_FATI9EA.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	EPSON Stylus CX7000F Series	E_FATIBKA.EXE	"Epson Status Monitor 3 for the Stylus CX7000F Series printer - for monitoring printer status
U	EPSON Stylus CX7400 Series	E_FATICDA.EXE	"Epson Status Monitor 3 for the Stylus CX7400 Series printer - for monitoring printer status
U	EPSON Stylus CX7800 Series	E_FATIAFA.EXE	"Epson Status Monitor 3 for the Stylus CX7800 Series printer - for monitoring printer status
U	EPSON Stylus CX8300 Series	E_FATICEP.EXE	"Epson Status Monitor 3 for the Stylus CX8300 Series printer - for monitoring printer status
U	EPSON Stylus CX8400 Series	E_FATICEA.EXE	"Epson Status Monitor 3 for the Stylus CX8400 Series printer - for monitoring printer status
U	EPSON Stylus CX9300F Series	E_FATICFP.EXE	"Epson Status Monitor 3 for the Stylus CX9300F Series printer - for monitoring printer status
U	EPSON Stylus CX9400Fax Series	E_FATICFA.EXE	"Epson Status Monitor 3 for the Stylus CX9400Fax Series printer - for monitoring printer status
U	EPSON Stylus D68 Series	E_FATIAAE.EXE	"Epson Status Monitor 3 for the Stylus D68 Series printer - for monitoring printer status
U	EPSON Stylus D78 Series	E_FATIBGE.EXE	"Epson Status Monitor 3 for the Stylus D78 Series printer - for monitoring printer status
U	EPSON Stylus D88 Series	E_FATIABE.EXE	"Epson Status Monitor 3 for the Stylus D88 Series printer - for monitoring printer status
U	EPSON Stylus DX3800 Series	E_FATIACE.EXE	"Epson Status Monitor 3 for the Stylus DX3800 Series printer - for monitoring printer status
U	EPSON Stylus DX4000 Series	E_FATIBEE.EXE	"Epson Status Monitor 3 for the Stylus DX4000 Series printer - for monitoring printer status
U	EPSON Stylus DX4400 Series	E_FATICAE.EXE	"Epson Status Monitor 3 for the Stylus DX4400 Series printer - for monitoring printer status
U	EPSON Stylus DX4800 Series	E_FATIADE.EXE	"Epson Status Monitor 3 for the Stylus DX4800 Series printer - for monitoring printer status
U	EPSON Stylus DX5000 Series	E_FATIBVE.EXE	"Epson Status Monitor 3 for the Stylus DX5000 Series printer - for monitoring printer status
U	EPSON Stylus DX6000 Series	E_FATIBIE.EXE	"Epson Status Monitor 3 for the Stylus DX6000 Series printer - for monitoring printer status
U	EPSON Stylus DX7000F Series	E_FATIBKE.EXE	"Epson Status Monitor 3 for the Stylus DX7000F Series printer - for monitoring printer status
U	EPSON Stylus DX7400 Series	E_FATICDE.EXE	"Epson Status Monitor 3 for the Stylus DX7400 Series printer - for monitoring printer status
U	EPSON Stylus DX8400 Series	E_FATICEE.EXE	"Epson Status Monitor 3 for the Stylus DX8400 Series printer - for monitoring printer status
U	EPSON Stylus Photo 1400 Series	E_FATIBUA.EXE	"Epson Status Monitor 3 for the Stylus Photo 1400 Series printer - for monitoring printer status
U	EPSON Stylus Photo R1800	E_FATI9LA.EXE	"Epson Status Monitor 3 for the Stylus Photo R1800 printer - for monitoring printer status
U	EPSON Stylus Photo R220 Series	E_FATIAIE.EXE	"Epson Status Monitor 3 for the Stylus Photo R220 Series printer - for monitoring printer status
U	EPSON Stylus Photo R240 Series	E_FATIAHE.EXE	"Epson Status Monitor 3 for the Stylus Photo R240 Series printer - for monitoring printer status
U	EPSON Stylus Photo R2400	E_FATI9SA.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	EPSON Stylus Photo R2400	E_FATI9SE.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	EPSON Stylus Photo R260 Series	E_FATIBNA.EXE	"Epson Status Monitor 3 for the Stylus Photo R260 Series printer - for monitoring printer status
U	EPSON Stylus Photo R280 Series	E_FATICKA.EXE	"Epson Status Monitor 3 for the Stylus Photo R280 Series printer - for monitoring printer status
U	EPSON Stylus Photo R285 Series	E_FATICKE.EXE	"Epson Status Monitor 3 for the Stylus Photo R285 Series printer - for monitoring printer status
U	EPSON Stylus Photo R320 Series	E_FATI9FA.EXE	"Epson Status Monitor 3 for the Stylus Photo R320 Series printer - for monitoring printer status
U	EPSON Stylus Photo R340 Series	E_FATIAJE.EXE	"Epson Status Monitor 3 for the Stylus Photo R340 Series printer - for monitoring printer status
U	EPSON Stylus Photo R380 Series	E_FATIBOA.EXE	"Epson Status Monitor 3 for the Stylus Photo R380 Series printer - for monitoring printer status
U	EPSON Stylus Photo R800	E_FATI9YE.EXE	"Epson Status Monitor 3 for the Stylus Photo R800 printer - for monitoring printer status
U	EPSON Stylus Photo RX420 Series	E_FATI9CE.EXE	"Epson Status Monitor 3 for the Stylus Photo RX420 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX430 Series	E_FATI9CP.EXE	"Epson Status Monitor 3 for the Stylus Photo RX430 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX530 Series	E_FATIAGP.EXE	"Epson Status Monitor 3 for the Stylus Photo RX530 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX640 Series	E_FATIAME.EXE	"Epson Status Monitor 3 for the Stylus Photo RX640 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX680 Series	E_FATICJA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX680 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX700 Series	E_FATI9IA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX700 Series printer - for monitoring printer status
U	EPSON Stylus SX200 Series	E_FATIEFE.EXE	"Epson Status Monitor 3 for the Stylus SX200 Series printer - for monitoring printer status
U	EPSON SX100 Series	E_FATIEDE.EXE	"Epson Status Monitor 3 for the SX100 Series printer - for monitoring printer status
U	EPSON TX100 Series	E_FATIEDP.EXE	"Epson Status Monitor 3 for the TX100 Series printer - for monitoring printer status
U	EPSON WorkForce 30 Series	E_FATIEEA.EXE	"Epson Status Monitor 3 for the WorkForce 30 Series printer - for monitoring printer status
U	EPSON WorkForce 500 Series	E_FATIEQA.EXE	"Epson Status Monitor 3 for the WorkForce 500 Series printer - for monitoring printer status
U	EPSON WorkForce 600 Series	E_FATIEKA.EXE	"Epson Status Monitor 3 for the WorkForce 600 Series printer - for monitoring printer status
Y	eSafe Protect	ESPWatch.exe	"eSafe from Aladdin - internet security for gateway and E-mail servers"
U	eScan Updater	Trayicos.exe	"MicroWorld eScan antivirus updater - allows users to automatically download updates and set the auto time interval for downloads"
X	Especial	Deneca.bat	"Added by the DELUZ VIRUS!"
U	eTrust PestPatrol Active Protection	PPActiveDetection.exe	"PestPatrol real-time protection feature. ""Stops spyware before it infects your system"""
X	EventApplicationCmd	smschk.exe	"Added by the IRCBOT-AO TROJAN!"
N	Evidence Eliminator	ee.exe	"Evidence Eliminator - cover the tracks of your browsing habits and E-mails if you think you need to. Run manually on a regular basis"
X	ewupdater	ewupdater.exe	"EasyWebSearch adware updater"
N	Excite Platform	Exlaunch.exe	Loads an Icon in the startup tray that allows you to receive service update notices for Excite@Home if you desire (note that since Excite@Home appears to be winding down this becomes irrelevant). May also allow you to kill the Excite Toolbar that automatically loads in Internet Explorer
?	Excite Private Messenger Pipe	x8impipe.exe	"??"
X	ExFilter	"Rundll32.exe [path] cdnspie.dll	ExecFilter"
X	Expatch	[random filename]	"Added by the PWSLMIR-G TROJAN!"
X	Explorer	[path to worm]	"Added by the AUTEX WORM!"
X	explorer	[path to trojan]	"Added by the AGENT-EU TROJAN!"
X	Explorer	TXP1atform.exe	"Added by the FUJACKS.CA VIRUS!"
X	Explorer 2238	[path to trojan]	"Added by the AGENT-CPI TROJAN!"
X	Explorer Updater	IEXPLORE.exe	"Added by the SDBOT-WO WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
U	E_S[numbers]	[path] E_[various].EXE [path] E_S[numbers].tmp	"Temporary entry related to Epson Status Monitor 3 for their range of printer and AIO devices - for monitoring printer status
U	F-PROT Antivirus Tray application	FProtTray.exe	"System Tray access to F-PROT Antivirus"
X	F-Secure Gatekeeper	[malware name].exe	"Added by the NUWAR.AXQ WORM!"
X	f94mggfhfghodftdf	[path to trojan]	"Added by the SMALL.JHZ TROJAN!"
U	Fabrik Ultimate Backup Status	fabrikhomestat.exe	"Status monitor for Fabrik Ultimate Backup from Fabrik Inc. ""No matter what happens to the drive on your desk - a spilled drink
N	FastTrack Accelerator	SPEED UP.EXE	"FastTrack Accelerator - ""speedup"" utility for programs that use the FastTrack network such as KaZaA Media Desktop
X	faT	faT.exe	"Added by the BANKER-DFP TROJAN!"
X	fat.exe	fat.exe	"Part of the WinAntiVirus Pro 2006 and WinAntiVirus Pro 2007 rogue security programs - not recommended
X	Fat32 Microsoft	fat32.exe	"Added by the RBOT-EL WORM!"
U	FatPipe	DHCP	Software enabling high speed internet browsing (2-4 times faster) and internet connection sharing for up to 5 users
U	Fatpipe Dialer	fpdialer.exe	Dailler for Fatpipe - software enabling high speed internet browsing (2-4 times faster) and internet connection sharing for up to 5 users
U	fatrecov	fatrecov.exe	SCKeyLog.j keystroke logger/monitoring program - remove unless you installed it yourself!
X	fddddHOME	dxxatp.exe	"Added by the RANKY.AA TROJAN!"
X	FestPlattenCleaner	SysRep.exe	"FestPlattenCleaner
X	FestplattenReiniger	GDC.exe	"FestplattenReiniger
X	ff	[path to worm]	"Added by the RBOT-XL WORM!"
U	FG1_00	frntgate.exe	"FrontGate MX - e-mail spam blocker"
X	file laoder configuration	rnd32.exe	"Added by the RBOT.BQJ WORM!"
N	filehippo.com	UpdateChecker.exe	"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
N	FileHippo.com Update Checker	UpdateChecker.exe	"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
X	FileSoft	Wscript.exe UpdataFiles.vbs	"Added by the SST.B WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""UpdataFiles.vbs"" file is located in %Windir%"
U	FilterGate	filtergate.exe	"Filtergate internet filtering software - filters sounds
X	FindHack	[path to worm]	"Added by the KELVIR-BA WORM!"
U	FinePrint Dispatcher v4	fpdisp4a.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 4.x of the software. ""FinePrint saves ink
U	FinePrint Dispatcher v4	fpdisp4.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 4.x of the software. ""FinePrint saves ink
U	FinePrint Dispatcher v5	fpdisp5a.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 5.x of the software. ""FinePrint saves ink
X	FireExplore Update	FireExplore.exe	"Added by a variant of the RBOT WORM!"
X	Firevall Administrating	rndll.exe	"Added by the PUSHBOT-B WORM!"
X	Firewall	SP2 UPDATE.exe	"Added by the ELITPER.E WORM!"
X	Firewall	Firewall.bat	"Added by the YPSAN.G WORM!"
X	Firewall Administrating	infocard.exe	"Added by the AUTORUN-AYV WORM! Note - this is not the valid InfoCard Service which is part of the .NET Framework from Microsoft and uses the same filename"
X	Firewall auto setup	[path to trojan]	"Added by the AGENT-GLY TROJAN!"
X	Firewall Update System1	WinedowsUpdater1.exe	"Added by the RBOT-ARU WORM!"
X	Firewall Updater	msnupdateit.exe	"Added by the RBOT-AAQ WORM!"
X	fjdslssdfd	mat2.exe	"Added by the SLAPEW.C TROJAN!"
X	Flash Driver	[path to trojan]	"Added by the AGENT.CWVT TROJAN!"
X	Flash Media	[path to trojan]	"Added by the IRCBOT.AUR TROJAN!"
X	Flash Player2	[path to worm]	"Added by the IRCBOT.PD WORM!"
N	FlashPath Monitor	SDSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
N	FlashPath Monitor	FLSHSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
N	FlashPath Status	SDSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
N	FlashPath Status	FLSHSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
X	Floppy Master	[path to trojan]	"Added by the ZONIT-F TROJAN!"
X	FlyswatDesktop	flydesk.exe	Advertising spyware
X	FolderRaper	[path to worm]	"Added by the VB.GOZ WORM!"
N	FotoStation Easy AutoLaunch	FotoStation Easy AutoLaunch.exe	Installed with a Nikon digital camera. Used to collect photos uploaded from camera program NkVwMon.exe. If your camera is not connected (via USB port) you do not need this program loaded either
X	free-save	[path to risk]	"Freesave security risk that tracks and sends browser information and visited websites on the computer. Uninstall this software unless you put it there yourself"
X	FreeAttention	eqsefeqe.exe	Added by an unidentified WORM or TROJAN!
X	fsdsft	[path to backdoor]	"Added by the RANKY.S BACKDOOR!"
U	Fujitsu Hotkey Utility	IndicatorUty.exe	"Fujitsu Hotkey Utility displays icons on the screen when you use hotkeys on a Fujitsu Siemens Lifebook
X	game	patcher.scr	"Added by the PSW-ED TROJAN!"
X	Games Acceleration	svshost.exe	"EasySearch adware"
X	Games Acceleration	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Games Acceleration	svshost1.exe	"Added by the DLOADR-AWD TROJAN!"
X	Games toolbar	rundll32.exe [path] tbGame.dll DllShowTB	"Topconverting.com/180Search ""Games Toolbar"" adware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
U	GARO Status Monitor	cnwism.exe	Print monitor for certain Canon printers
X	Gate Personal Firewall	Systpl.exe	"Added by the RBOT.ADC WORM"
N	Gateway Extended Warranty	GWCares.exe	Gateway Extended Warranty reminder
X	Gator	gator.exe	"Gator eWallet adware. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	Gator eWallet	gator.exe	"Gator eWallet adware. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	GDAX	[path to backdoor]	"Added by the RANKY.K TROJAN!"
X	genserv path	sdqdqg.exe	"Added by the SDBOT-RF WORM!"
Y	GhostSurfDelSatellite	DeleteSatellite.exe	"Part of SpyCatcher spyware remover from Tenebril. Prevents rogue programs from sending personal information to a remote user via the Internet. If you use SpyCatcher with real time scanning
X	GigaByte	Cheatle.exe	"Added by the SHODI.B VIRUS!"
U	Giganews Accelerator	GiganewsAccelerator.exe	"Giganews Accelerator from Giganews
Y	Gilat SOM Enumerator	dllhost.exe	For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system
Y	GilatFTC	ftc.exe	For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system
X	gimmygames	[path to trojan]	"Added by the DLOADR-LN TROJAN!"
U	Google IME Autoupdater	GooglePinyinDaemon.exe	"Google Pinyin Input Method Editor (IME) - allows a user to input Chinese characters by entering the pinyin of a Chinese character (with or without tone
N	Google Update	GoogleUpdate.exe	"Update manager for the range of tools available from Google - such as the Chrome web browser and Picasa photo manager. Located in %AppData%\Google\Update"
X	Google Update	GoogleUpdate.exe	"Added by the BUZUS.DBFM TROJAN! Note - this is not the valid Google program which is normally located in %AppData%\Google\Update. This version resides in %System%"
N	Google Updater	GOOGLE~1.EXE	"Downloads and installs updates for Google applications (Google Earth
N	Google Updater	GoogleUpdater.exe	"Downloads and installs updates for Google applications (Google Earth
X	GoogleUpdater3	GoogleMapper.exe	"Added by the ROUTROBOT WORM!"
X	gotnewupdate000.exe	gotnewupdate000.exe	"Added by the FAKEAV-BGA TROJAN!"
X	GP Updater	gpupdater.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
?	gramdate	2Stop.exe	"??"
X	Graphic Update	openglx.exe	"Added by the IRCBOT.AMU WORM!"
X	GreasyPalmUpdate	GreasyPalmUpdate.exe	"SearchFast adware"
X	GreatDefender	GreatDefender.exe	"GreatDefender rogue security software - not recommended
X	GreatDefender.exe	GreatDefender.exe	"GreatDefender rogue security software - not recommended
X	GreatDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Gremlin	intrenat.exe	"Added by the DOOMJUICE WORM!"
?	GSISETUP	[path] GsiInst.exe INSTALL [path] V205Res 13	"BT Voyager ADSL modem related - what does it do and is it required?"
X	gssomatic	gssomatic.exe	"Searchcentrix hijacker"
N	Gtwatch	gtwatch.exe	Associated with a Mustec scanner and not required
Y	GuardGui Application	GuardGui.exe	"System Tray access to the main user interface for Ashampoo® AntiVirus from Ashampoo GmbH & Co. KG."
X	HanUpdate	hanz.exe	"Added by the RBOT-GLJ WORM!"
X	HataDuzelticisi	SysRep.exe	"HataDuzelticisi
X	HATAPE	[path to trojan]	"Added by the BANKER-QF TROJAN!"
X	helper.dll	rundll32.exe [path] helper.dll	"CnsMin (Chinese Keywords) hijacker related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
U	Hibernation	hib32.exe	"Reduces the power consumption when the laptop isn't being used to preserve battery power. Similar programs on other laptops reduce the processor clock rate
X	hid_start	gzmrotate.dll	"AdRotator/IconAds adware"
Y	HighPoint ATA RAID Management Software	raidman.exe	"HighPoint RAID management - hard disk striping/mirroring utility for increased performance and reliability. See here for more information on RAID"
X	himem.exe	[path to worm]	"Added by the STRATION-FW WORM!"
X	HKLMRun	windowsupdate.exe	"Added by the FORBOT-BJ WORM (where HKLM\Run represents HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run)!"
X	HLL Data Parameter	hllcxpa.exe	"Added by the RBOT.AFG WORM!"
N	Home Theater SchSvr	SchSvr.exe	"WinScheduler is installed with Home Theater Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
X	Hotfix Updat	svdhost32.exe	"Added by the GAOBOT.ZW WORM!"
X	HotKeysCmds	[path to worm]	"Added by the PAHATIA-A WORM!"
U	HP Instant Support	matcli.exe	""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	HP Presentation Ready	PresRdy.exe	HP Omnibook related: "Press a dedicated button above the keyboard and the system will instantly load your presentation software and change the screen resolution to match your display device"
U	HP ScanPatch	HPScanFix.exe	"Program that starts up and automatically fixes earlier versions of the Scanjet 5100c software. If a Scanjet 5100C scanner is not going to be used
N	HP software update	HPWuSchd2.exe	HP software updates. If a shortcut doesn't exist create your own and run it manually
N	HP software update	HPWuSchd.exe	"HP software updates. If a shortcut doesn't exist
N	HP Status	hpstatus.exe	HP Printer Status and Alerts
?	HP Status Server	hpboid.exe	"Copied during installation of HP Inkjet Printer Drivers in Win2K/XP. What does it do and is it required?"
X	HP Update Assistant	HPAware.exe	Added by the MRO TROJAN!
N	HP Updates	??	"On HP PCs
N	HP_dla	dlatray.exe	"On HP PCs
U	HTpatch	htpatch.exe	HTpatch.exe is part of the SiS AGP patch - BUT unless your processor (and motherboard) supports HyperThreading (HT) and this feature is enabled it will actually SLOW your graphics card by around 6%
U	HughesNet Tools	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	hxadsec	[path to trojan]	"Added by the ADCLICK-AP TROJAN!"
X	ibin	[path to trojan]	"Added by the PERDA-C TROJAN!"
U	IBM ThinkPad EasyEject Support Application	EzEjMnAp.Exe	"EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
U	IBM TrackPoint Accessibility Features	tp4ex.exe	"Supports accessibility features for the TrackPoint stick and associated buttons on IBM/Lenovo ThinkPad notebooks. If features such as ""Click Sound""
?	IBM Warranty Notification	ERTS0749.exe	"IBM Warranty Notification - presumably it's a reminder to either register or that warranty is about to expire?"
X	icifati	yujixit.exe	"Added by the SDBOT.ZZH WORM!"
N	Icon Animation	HDE.EXE	Part of McAfee Nuts & Bolts. Provides entertaining animation of your desktop icons
Y	iconcache	icon.bat	"Related to the Vista Customization Pack"
X	ICQ Center	[path to worm]	"Added by the RANDIN WORM!"
X	ICQ Chat Service	icqjdhs.exe	"Added by a variant of the RBOT WORM!"
X	IcqBeta	webcamupdate.exe	Added by an unidentified TROJAN!
X	ICQMsn	[path to trojan]	"Added by the RANCK-AH TROJAN! The most common example is ""cbfks.exe"" located in %System%"
X	icrosoft Windows DLL Services Configuration	poker3.exe	"Added by the SDBOT-AER WORM!"
X	IDTemplates	IDTemplate.exe	"Added by the BRONTOK-H WORM!"
X	IE Java Update	iejava.exe	"Added by the AGENT-HD TROJAN!"
X	IE Menu Extension toolbar	rundll32.exe [path] tbextn.dll DllShowTB	"Topconverting.com/180Search ""IEMenuExtension"" toolbar. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	IEAgent update check	iewatch.exe	"Added by the BOMKA TROJAN!"
X	IEexplorer AUpdate	IEexplore32.exe	"Added by the RBOT-GRE WORM!"
X	IEFeatures	IEFeatures.exe	"Added by the POPMON.A TROJAN! - also known as PopMonster adware"
X	IEFeatures	Internetfeatures.exe	"Added by the POPMON.A TROJAN! - also known as PopMonster adware"
X	ieupdate	MCP****.exe [**** = random char]	"Added by the ASOXY TROJAN!"
X	ieupdate	mcpdll32.exe	Adware downloader trojan
X	ieupdate	[random filename]	"Added by the AGENT-C BACKDOOR!"
X	ieupdates	ieupdates.exe	"Added by a number of TROJANS such as DWNLDR-HGI and AGENT-HGA and the Antivirus 2009 rogue security software - see here"
X	IEXPLORE.EXE	[path to trojan]	"Added by the BANCOS-CJ TROJAN!"
X	igamatu	ekor.exe	"Added by the SDBOT.AQ TROJAN!"
X	igamatu	atecaca.exe	"Added by the IRCBOT.R WORM!"
U	IKL	rundll32.exe [path] IKL.dll	"IKL surveillance software. Uninstall this software unless you put it there yourself"
X	Image	"rundll32 [path] [trojan filename]	Install"
X	ImagePath	taskbarmngr.exe	"Added by the SDBOT-XB WORM!"
U	Imatio	imation.exe	"Imation Disk Manager - enables you to create a password protected area on your Imation USB flash drive"
X	imchat	imchat.exe	"Added by a variant of the IRCBOT TROJAN!"
N	Imesh Auto Update	??	"Update check for the Imesh file sharing system. Turn the update off under ""options"""
X	imgit	[path to file]	"Added by the BANKER-EM TROJAN!"
X	IMJPMIG6.1	HelpCat.exe	"Added by the BESVERIT WORM!"
X	imonitor	[path to trojan]	"Added by the IMONI-A TROJAN!"
X	Indexindicator	Indexindicator.exe	"Added by the LAZAR TROJAN!"
U	IndicatorUty	IndicatorUty.exe	"Fujitsu Hotkey Utility displays icons on the screen when you use hotkeys on a Fujitsu Siemens Lifebook
X	Inet DataBase	Inetdbs.exe	"Added by the QEDS WORM!"
X	INFO DATA	apc.exe	"Added by the RANDON.B WORM!"
X	InfoData	"rundll32.exe ********.dll	realset [* = random char]"
X	Information Update	iu.exe	"Detected by Kaspersky as the CENTIM.CH TROJAN!"
X	Init	[path to trojan]	"Added by the DROPPER.EAT TROJAN!"
N	InkWatch	InkWatch.exe	Associated with Canon (and maybe other) printers. Tells you when the ink's running low and asks if you want to buy another cartridge on-line
X	Install part II	updates.exe	"Added by the RELFEERWORM!"
X	InstallProgram	[path to trojan]	"Added by the AGENT-HHU TROJAN!"
X	Installs SP2	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are located in %System%\qpalsp"
X	Installs SP4	[path] repcale.exe [path] p0rd.exe	"Added by the RANDON-AK WORM! Both files are located in %System%\ekrlgc"
X	Instance 001	[path to worm]	"Added by the ALASROU-A WORM!"
N	Instant Update Center	reminder.exe	"Event reminder for calendar dates
U	Instant Wireless Configuration Utility	WUSB11cfg.exe	"Utility used by the LINKSYS LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
U	Instant Wireless Configuration Utility	WPC11Cfg.exe	"Utility used by the LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
X	instit	instit.bat	"Added by the OPASERV.H WORM!"
X	instit	INSTIT.BAT	"Added by the OPASERV.K WORM!"
X	Intec Service Drivers	[path to worm]	"Added by the RBOT-GLU WORM!"
X	Intec Services Drivers	msupdate22e.exe	"Added by the RBOT-CGC WORM!"
X	InterceptedSystem	[path to worm]	"Added by the ANACON-B WORM!"
X	internat	internat.exe	"Added by the LYDRA-F TROJAN! Note - the real internat.exe resides in %windir%\system (where %windir% is the Windows directory - C:\Windows or C:\Winnt) whereas this version resides in %windir%"
X	Internat	systray.exe	"Added by the ALADINZ.P TROJAN! Note - this is not the legitimate systray.exe process. If you right-click on the real systray.exe the ""Properties"" reveal it to be a Microsoft file"
X	Internat	msgsrv32.exe	"Added by the NYRUBOT-A BACKDOOR! Note - this is not the legitimate msgsvr32.exe process on a Win9x/Me system which should not appear in MSConfig/startup!"
X	Internat	[trojan filename]	"Added by the CMJSPY-Y TROJAN!"
X	Internat Conf	bootconf.exe	"Homepage hijacker
N	internat.exe	internat.exe	"Microsoft language selection icon in system tray
X	Internat.exe	internat.exe	"Added by the NETSNAKE TROJAN! Note - the real internat.exe resides in %windir%system (Win98/Me) or %windir%System32 (WinNT/2K/XP) (where %windir% is the Windows directory - C:\Windows or C:\Winnt) and has a ""?"" icon wheras this version resides in %windir% and has a ZIP icon"
X	Internet Application Driver	expIorer.exe	"Added by the IRCBOT-WK TROJAN!"
X	Internet Connection Wizard	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
U	Internet Download Accelerator	ida.exe	"Internet Download Accelerator download manager"
X	Internet Explorer Auto-Update	updt32v5.exe	"Added by the SPYBOT-AB BACKDOOR!"
X	Internet Explorer Configuration	IEXPLORE.EXE	"Added by the SDBOT-UL WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Internet Explorer Updater	lexbac.exe	"Added by the DOWNLOAD TROJAN!"
X	Internet Explorer Updater	iexplorer.exe	"Added by the REUR.B WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Internet Mail and News	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Internet Protocol Configuration Loader	ipcl32.exe	"Added by the SDBOT TROJAN!"
X	InternetGetConnectedState	winupdate.exe	"Added by the SDBOT-JN WORM!"
X	InternetGetConnectedStateEx	winupdate.exe	"Added by the SDBOT-JN WORM!"
X	Inters Configuration Loader	RCL0ADERS.exe	"Added by the SDBOT-KX WORM!"
X	Intrenat	Intrenat.exe	"Added by the LEMIR.E TROJAN!"
N	Introduction-Registration	??	"For Compaq PC's. Should only run first time
X	IntSys1	[path to trojan]	"Added by the BANLOA-ASE TROJAN!"
U	Iomega Automatic Backup	ibackup.exe	"Iomega Automatic Backup - automatic backups for use with Iomega portable HDD"
U	Iomega Automatic Backup 1.0.1	ibackup.exe	"Iomega Automatic Backup - automatic backups for use with Iomega portable HDD"
N	Iomega Watch	IOWATCH.EXE	Used by Iomega drives. Available via Start -> Programs
N	IPO3	IP Operator 2005.exe	"
?	iPodWatcher	iPodWatcher.exe	"Associated with Apple's iPod® player. Detects when the iPod® is connected?"
X	IPSEC Configuration	wsupdate.exe	"Added by the AGOBOT-IQ WORM!"
X	IPTable Configuration	Winipcfgs.exe	"Added by a variant of the RBOT WORM!"
N	iRiver Updater	Updater.exe	"Updates for the iRiver Music Manager - used with their digital music players"
X	Irwftp	[path to trojan]	"Added by the BANCOS-AP TROJAN!"
U	isDeleteMe	isDel.bat	Used by Norton Internet Security to remove certain files and directories on reboot when uninstalling their product
U	ISDNwatch	IWatch.exe	"FRITZ!X ISDNWatch - ""dialing filter for more security and control on the ISDN PC. The PC is doubly protected against dialer programs and premium-service numbers: ISDNWatch allows the user to block calls to and from both individual numbers and whole number blocks"""
N	ISSI EZUpdate Service	issimsvc.exe	Part of IBM Global Services - used internally by IBM for automatic updating of software and Microsoft patching
X	ixproxy	[path to trojan]	"Added by the XORPIX-A TROJAN!"
X	Java (VM) v6.9	jav.bat	"Added by the AGENT-GZK TROJAN!"
X	Java Application	vssmf32.exe	"Added by the SPIGOT BACKDOOR!"
X	Java Auto Update	ujm.exe	"Added by the SDBOT-ADH WORM!"
X	Java update	javaqs.exe	"Added by the SWARLEY.A WORM!"
X	Java Update	keeper.exe	"Added by the AGENT-DIS TROJAN!"
X	Java Update	svchost.exe.exe	"Added by the AGENT-LBS TROJAN!"
X	Java Update	hostwww.exe.exe	"Added by the AGENT-MFH TROJAN!"
X	Java VM v6.9.2	jav.bat	"Added by the DWNLDR-HLM TROJAN!"
X	Java VM v6.91	jav.bat	"Added by the DWNLDR-HLL TROJAN!"
N	Java(TM) Platform SE 6	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
N	Java(TM) Platform SE 6 U*	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now. U* represents the update version
N	Java(TM) Platform SE Auto Updater 2 0	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
X	Java32 Configuration Loader	msnmesgr.exe	"Added by a variant of the RBOT WORM!"
X	JavaTray	traymgr.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	JavaUpdate0.07	[filename]	"Added by the JUPDATE TROJAN!"
X	JavaUpdateSched	jusched32.exe	"Added by the BCKDR-CKB BACKDOOR!"
Y	JetAdmin Discovery Indicator	HPJETDSC.EXE	"HP JetAdmin software for HP JetDirect Print Servers. HPJETDSC.EXE is the file necessary for the JetAdmin Discovery Indicator (paper airplane in the taskbar). It gets launched automatically through the registry
X	jijbl	ezlwy.bat	"Added by the REDDW WORM!"
X	jon315	[path to trojan]	"Added by the MAILBOT-BI TROJAN!"
X	jpgdiag	[path to worm]	"Added by the STRATION-AN WORM!"
X	jusched	[path to trojan]	"Added by the BANKER-BWR TROJAN!"
X	KAT	KAT.vbs	"Added by the SOAD-D WORM!"
U	KatMouse	KatMouse.exe	"KatMouse - utility to enhance the functionality of mice with a scroll wheel
N	KAZAA	[path] kpp.exe [path] kazaalite.kpp	"System Tray access to later versions of the Kazaa Lite P2P file sharing utility - namely the K++ and Resurrection variants. Kazaa Lite is the unauthorized modification of the original Kazaa Media Desktop - with the malware removed"
X	Kazaa Download Accelerator Updater (required)	regsvr32 kdp****.dll [* = random char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
U	KClient	kstatus.exe	KClient Kerberos client software for Win32 systems. It provides the libraries and utilities needed to use Kerberos-based PC applications developed by Computing Services such as KWeb and NiftyTelnet
U	KE9801	DriBat32.exe	KE9801 multimedia keyboard driver - required if you use the multimedia keys
X	Kernel	Update.exe	"Added by the DELF-FN TROJAN!"
X	kernel system daemon	ACTIVAT0R.exe	"Added by the RANDEX.AW WORM!"
X	KernelRuntime	[path to worm]	"Added by the MYTOB-JO WORM!"
X	keyboard	[path to trojan]	"Added by the DLOADR-AOZ TROJAN!"
?	Keyboard Status	KeyStat.exe	"Multimedia keyboard manager for Medion desktop and notebook PCs? Located in %ProgramFiles%\Medion\KeyStat"
U	KeyPatrol	KeyPatrol.exe	"KeyPatrol - key logger detector using both behavioral and pattern-matching algorithms that used to be part of PestPatrol before CA's aquisition"
X	kfienq	masbl.bat	"Added by the KIFER TROJAN!"
X	KHATARNAK Loader	KHATARNAK.exe	"Added by the AUTORUN.ACO WORM!"
X	Kiamat Sudah Dekat_16_04	ISASS.exe	"Added by the PAHATIA.B WORM!"
X	klop	[path to file]	"Added by the AGENT-WQ TROJAN!"
N	Kodak Batch Transfer	pezdow1.exe	Part of "Kodak Picture Easy" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC
N	Kodak Picture Easy *.* Batch Transfer	PezDownload.exe	"Part of ""Kodak Picture Easy"" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC. *.* represents the version"
N	Kodak Software Updater	backweb*****.exe	"Software updater for Kodak Easyshare digital cameras"
N	KODAK Software Updater	Kodak Software Updater.exe	"Software updater for Kodak Easyshare digital cameras"
U	Komunikator	tlen.exe	"Tlen - a Polish language instant messaging client"
X	ksrlnhm	zxatgso.exe	"Added by the DLOADER-LI TROJAN!"
X	lameshit	[path to trojan]	"Added by the LOWZONE-H TROJAN!"
X	LanGuard	[path to trojan]	"Added by the DLOADER-VO TROJAN!"
?	LanzarL2007	[path] setup.exe	"??"
?	Lasb	ewat.exe	"??"
X	LAsIAf32	RePEAtLD.exe	"Added by the REPEATLD WORM!"
?	Later	later.exe	"??"
N	Launch Application	LaunchApplication.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
N	Launch YahooPOPs! at Windows startup	YAHOOPOPS.EXE	"YahooPOPs - enables free POP3/SMTP access to Yahoo! Mail through a service on localhost that emulates the web interface. Available via Start -> Programs"
N	LaunchApplication	LaunchApplication.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
U	Lavasoft Adwatch	Ad-watch.exe	"Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system"
X	LetsRock	[path to trojan]	"Added by the RANKY.Y BACKDOOR!"
X	Letum	[path to worm]	"Added by the LETUM.A WORM!"
N	LG Intelligent Update	autoupdate.exe	"Automatic update utility for LG Notebooks"
U	LGODDFU	fwupdate.exe	Auto firmware update program for LG Electronics CD-ROM/DVD writer
X	Life FireWall Update1	FireWall-Update1.exe	"Added by the RBOT-ARS WORM!"
U	LifeChat	LifeChat.exe	"Support software for Microsoft's ""LifeChat"" headsets - which are optimized for use with Windows Live Messenger"
X	Litebot	[path to trojan]	"Added by the LITEBOT-A TROJAN!"
X	Live update monitor	srvany32.exe	"Added by the AGOBOT.AFM WORM!"
X	live update monitor	umxlu32.exe	"Added by the AGOBOT.ADK WORM!"
U	LiveUpdate	LiveUpdate.exe	"Web-update utility as used by various types of software - see here"
X	LiveUpdate	[Windows username]05.exe	"Added by the LINEAGE TROJAN!"
X	LiveUpdate	smss.exe	"Added by the VB.BAU BACKDOOR! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\isas"
N	LiveUpdate	Copyer.exe	"Samsung PC Studio is a Windows-based PC program package that you can use easily to manage personal data and multimedia files by connecting a Samsung Electronics Mobile phone (GSM/GPRS/UMTS) to your PC. You can launch the update manually - see the instructions
X	LiveUpdate32	services.exe	"Added by the VB.BAU BACKDOOR! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\isas"
X	Livre	Dibane.bat	"Added by the BANEDI VIRUS!"
X	lk3h1	[path to file]	"Added by the MOSUCK-G TROJAN!"
N	LM Status	LMSTATUS.EXE	Xerox WorkCenter XE - language monitor status application
N	LMSTATUS	LMSTATUS.EXE	Xerox WorkCenter XE - language monitor status application
X	lnternet Update	lExplore.exe	"Added by the RBOT-GRH WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	load	[path to worm]	"Added by the KELVIR.AI WORM!"
X	load	Internat.exe	"Added by the WOWCRAFT TROJAN!"
X	load	KHATRA.exe	"Added by the ORBINA-A WORM!"
U	load=	asistat.exe	Status monitor for an NEC SuperScript printer
X	load=	msater.exe	"Added by the RETSAM TROJAN!"
?	Load=	wtfeat.exe	"Associated with the Wintab Digitizer"
X	loaddr	[path to trojan]	"Added by the AGENT-DIY TROJAN!"
X	LoadOrderVerification	[random filename]	"Added by the TRON.A TROJAN!"
?	LoadWatcher	Test.exe	"Reportedly part of a webcam surveillance program that's supposed to test SMTP dialling in the event of an alert? Is this correct?"
X	LoadWatcher	watcher.exe	"Watcher spyware"
X	Local Service	Intenat.exe	"Added by the NUCLEAR-J TROJAN!"
X	Locator Service	[filename]	"Added by the AGOBOT-KY TROJAN!"
X	login	[path to trojan]	"Added by the HOTWORD-A TROJAN!"
X	Login Service	[path to file]	"Added by the MIGMAF TROJAN!"
Y	Logitech	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
N	Logitech . Product Registration	eReg.exe	"Registration reminder from Leader Technologies for Logitech software such as SetPoint for their range of wired and wireless keyboards and pointing devices (mice
Y	LogitechCommunicationsManager	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	LogitechRegisterVideoApplications	InstallHelper.exe	Entry added when you install versions of the Logitech QuickCam webcam software and used to register video applications that can use the webcam on the first reboot after installing the software
N	LogitechSoftwareUpdate	ManifestEngine.exe	"Automatic updater for versions of Logitech QuickCam webcam software. Check for updates via the System Tray icon - see the LogitechVideoTray entry"
X	Logo	[path to trojan]	"Added by the DLOADER-RH TROJAN!"
X	LogonAdministrator	imoet.exe	"Added by the RAHIWI.A WORM!"
X	LogonAdministrator	CSRSS.EXE	"Added by the KORRON.B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
U	LogWatch	logwat95.exe	Licensing patch for products installed on NT by Computer Associates such as eTrust. Detects and updates old versions of lic98.dll. Not required if you already have a newer version or the patch has been applied
N	LowRateVoip	LowRateVoip.exe	"LowRateVoip - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X	lsass	start.bat	"Added by the ZCREW TROJAN!"
X	lsass	[path to lsass.exe]	"Added by the ALADINZ.F TROJAN! Note - this is not the legitimate lasss.exe process which should NOT appear in Msconfig/Startup!"
X	LsasS	Sygate.exe	"Added by the SDBOT.BCA WORM!"
X	lsass2k Update	lsass2k.exe	"Added by a variant of the RBOT WORM!"
Y	lsburnwatcher	lsburnwatcher.exe	"HP software which helps one create labels after a music CD is burned using LightScribe discs. If you want to use LightScribe labeling
Y	LSBWatcher	lsburnwatcher.exe	"HP software which helps one create labels after a music CD is burned using LightScribe discs. If you want to use LightScribe labeling
X	LTM2	winupdate.exe	"Added by the LITMUS.203 TROJAN!"
X	ltwob	formatsys.exe	"Added by the SERFLOG.A WORM!"
Y	LXBSCATS	"rundll32 [path] LXBStime.dll	_RunDLLEntry@16"
Y	LXBTCATS	"rundll32 [path] LXBTtime.dll	_RunDLLEntry@16"
Y	LXBUCATS	"rundll32 [path] LXBUtime.dll	_RunDLLEntry@16"
Y	LXBXCATS	"rundll32 [path] LXBXtime.dll	_RunDLLEntry@16"
Y	LXBYCATS	"rundll32 [path] LXBYtime.dll	_RunDLLEntry@16"
Y	LXCCCATS	"rundll32 [path] LXCCtime.dll	_RunDLLEntry@16"
U	LXCDCATS	"rundll32 [path] LXCDtime.dll	_RunDLLEntry@16"
Y	LXCECATS	"rundll32 [path] LXCEtime.dll	_RunDLLEntry@16"
Y	LXCFCATS	"rundll32 [path] LXCFtime.dll	_RunDLLEntry@16"
Y	LXCGCATS	"rundll32 [path] LXCGtime.dll	_RunDLLEntry@16"
Y	LXCJCATS	"rundll32 [path] LXCJtime.dll	_RunDLLEntry@16"
Y	LXCQCATS	"rundll32 [path] LXCQtime.dll	_RunDLLEntry@16"
Y	LXCRCATS	"rundll32 [path] LXCRtime.dll	_RunDLLEntry@16"
Y	LXCTCATS	"rundll32 [path] LXCTtime.dll	_RunDLLEntry@16"
Y	LXCYCATS	"rundll32 [path] LXCYtime.dll	_RunDLLEntry@16"
Y	LXDBCATS	"rundll32 [path] LXDBtime.dll	_RunDLLEntry@16"
Y	LXDCCATS	"rundll32 [path] LXDCtime.dll	_RunDLLEntry@16"
Y	LXDDCATS	"rundll32 [path] LXDDtime.dll	_RunDLLEntry@16"
Y	LXDICATS	"rundll32 [path] LXDItime.dll	_RunDLLEntry@16"
U	LXDJCATS	"rundll32 [path] LXDJtime.dll	_RunDLLEntry@16"
X	LzioMediaUpdater	LzioMediaUpdater.exe	"LZIO.com adware downloader"
X	M1cr0s0ft Upd4t4zS	update32.exe	"Added by the RBOT-MI WORM!"
U	MacDrive application	MacDrive.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
?	MacDrive7.0.4TimeOutPatch	TimeOutPatch.EXE	"Part of MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
X	Macfee Security Patch	Mpfsheild.exe	"Added by the RBOT-NP WORM!"
X	Machine Update Soft	wusas.exe	Added by an unidfentified WORM!
X	Macromedia Critical Updater	rarww.exe	"Added by a variant of the RBOT WORM!"
X	Macromedia Flash Update	scvhost.exe	"Added by a variant of the RBOT WORM!"
N	Macrovision Update Service	issch.exe	"InstallShield is used by a number of software producers to install their programs and manage software updates. This entry runs scheduled searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis"
N	Macrovision Update Service	ISUSPM.exe	"InstallShield is used by a number of software producers to install their programs and manage software updates. This entry searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis"
U	MagicFormation	MagicFormation.exe	"MagicFormation from Tokyo Downstairs - a docking program that allows you to group icons in a ring anywhere on the desktop using mouse gestures to access things like My Documents
U	MagicFormation.exe	MagicFormation.exe	"MagicFormation from Tokyo Downstairs - a docking program that allows you to group icons in a ring anywhere on the desktop using mouse gestures to access things like My Documents
X	MailBlocker	[path to trojan]	"Added by the AGENT-LRJ TROJAN!"
Y	MailScan Dispatcher	Launch.exe	"MicroWorld MailScan Dispatcher splits each e-mail message into various components such as the header
X	Malware Catcher 2009	MCatcher.exe	"Malware Catcher 2009 rogue security software - not recommended
X	Mascro soft SDK updates2	SDKrepair2.exe	"Added by the SDBOT.BXM WORM!"
X	Master Card Updaate 32	Mastercard32.exe	"Added by a variant of the RBOT WORM!"
U	Matador	mlfbuddy.exe	"MailFrontier - anti-spam application"
U	Matador	mantispm.exe	"MailFrontier Desktop (Matador) email spam blocker software"
U	Matrix Screen Locker	matrix.exe	"Matrix Screen Locker is a system tray application that allows for quick and secure PC lock when you wish. The screen does a ""matrix style"" scrolling characters effect when the lock is running"
X	MatrixScreen	[filename]	"Added by the MATRIXSCREEN TROJAN!"
X	MatrixScreenSaver	mss.exe	Unidentified malware
N	Matrox Color Control	hgcctl95.exe	For Matrox video cards. Quick access to changing colors
N	Matrox Control Center	mgactrl.exe	For Matrox video cards. Quick access to settings
N	Matrox Diagnostic	mgadiag.exe	For Matrox video cards. Quick access to diagnostics
N	Matrox Powerdesk	PDesk.exe	"""Matrox PowerDesk software provides extra multi-display desktop management controls"""
N	Matrox PowerDesk 8	matrox.powerdesk.exe	"""Matrox PowerDesk software provides extra multi-display desktop management controls"""
N	Matrox PowerDesk SE	Matrox.PowerDesk SE.exe	"Matrox PowerDesk SE - multi-display desktop management controls"
N	Matrox QuickDesk	mgaqdesk.exe	For Matrox video cards. Quick access to tweak your card to your liking
X	Mcafee Antivirus Monitoring System326	VSStatmn326.exe	"Added by a variant of the SDBOT WORM!"
X	Mcafee Antivirus Monitoring System32mn	VSStatmn32.exe	"Added by a variant of the RBOT WORM!"
Y	McAfee Application Installer	mcappins.exe	Used by older versions of McAfee internet security related products to clean up installation files that are no longer required once the product is installed. This entry will normally only appear once the product has been installed before the system is rebooted
U	McAfee Backup	McAfeeDataBackup.exe	"McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
U	McAfee Backup and Restore	McAfeeDataBackup.exe	"McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
U	McAfee Data Backup	LogOnHook.exe	"Part of McAfee Data Backup (now Online Backup) - which ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection. The exact purpose of this entry is unknown at present but it unloads after startup"
U	McAfee Data Backup	McAfeeDataBackup.exe	"McAfee Data Backup (now Online Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
U	McAfee Online Backup	MOBKstat.exe	"System Tray access to McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
U	McAfee Online Backup Status	MOBKstat.exe	"System Tray access to McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
Y	McAfee SecurityCenter	McUpdate.exe	Automatic virus definition and software updates/upgrades for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online
U	McAfee.InstantUpdate.Monitor	RuLaunch.exe	"Instant Updater for McAfee's VirusScan
U	McAfeeDataBackup	McAfeeDataBackup.exe	"McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
Y	McAfeeUpdaterUI	UpdaterUI.exe	McAfee common updater user interface
Y	McAfeeUpdaterUI	UdaterUI.exe	Updater user interface for McAfee's VirusScan Enterprise corporate anti-virus and anti-spyware security tool
X	Mcrosoftr Update	Mcrosoftr.exe	"Added by a variant of the RBOT WORM!"
Y	McUpdate	McUpdate.exe	Automatic virus definition and software updates/upgrades for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online
Y	MCUpdateExe	McUpdate.exe	Automatic virus definition and software updates/upgrades for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online
X	MCX Update	wisp.exe	"Added by the RBOT-AQH WORM!"
X	mdetect	[path to trojan]	"Added by the SPABOT TROJAN!"
U	Media Codec Update Service	update.exe	"Windows Essentials Codec Pack 1.0 is a collection of the most commonly needed video and audio codecs. This program allows keeps these codecs updated"
X	Media Gateway	MediaGateway.exe	"WindUpdates MediaPass adware"
X	Media Player Update	xpsp1mfh.exe	"Added by a variant of the RBOT WORM!"
X	Media Software UPdater	sscs.exe	"Added by the RBOT-ABE WORM!"
X	MEDIA32	[path to trojan]	"Added by the PURSCAN-Z TROJAN!"
N	MediaFace Integration	Sethook.exe	"Fellowes Neato® cd label design software. ""Launch NEATO's MediaFACE II label making software directly from the productname toolbar"""
U	Mediafour Mac Volume Notifications	MACVNTFY.EXE	"Part of MacDrive 6 CrossStripe Edition from Mediafour Corporation - ""a perfect way to share files between Mac OS and Windows."" Unlike the standard version of MacDrive 7
U	Mediafour XPlay Tray Notification Icon	Xptryicn.exe	"Mediafour Xplay - allows you to use an Apple iPod digital music player with a PC running Windows. If not used regularily start manually before connecting the iPod"
U	Mediafour XPlay Tray Notification Icon	Xptryicn.exe	"Xplay 2 from Mediafour Corporation - ""expands what you can do with any iPod
X	MediaPath	Proyecto1.exe	"Added by the GRUEL WORM!"
X	MediaPath	Root.exe	"Added by the GRUEL WORM!"
X	MediaPlayeS	MediaPlayer_update.exe	"Added by the STARTER-K TROJAN!"
X	Memory Allocation Host	cihost.exe	"Detected by Avast as a variant of the IRCBOT-CHZ WORM!"
X	Memory Allocation Server	ciserv.exe	Added by an unidentified malware
X	Memory Allocation Services	cisrv.exe	"Added by the IRCBOT.FC BACKDOOR!"
X	Memory relocation service	reloc32.exe	"Added by the RELFEERWORM!"
N	Memory Stick Monitor	MSTAT.exe	"Used with the Sony floppy disk adapter for memory sticks
U	Memory Stick Monitor	MSstat.exe	Sony/SmartDisk memorystick-floppydisk-adapter software - allows you to read memorysticks in a normal floppydrive
X	Memory Watcher	MemoryWatcher.exe	"MemoryWatcher spyware"
X	Messenger Gateway	msmgs.exe	"Added by the AGENT-IGK TROJAN!"
X	Messenger Service Updater	svshost.exe	"Added by the MYTOB.GC WORM!"
X	Micosoft Data Core	runservice.exe	"Added by the IRCBOT.BK WORM!"
X	Micosoft Data Core stuff	svshosts.exe	"Added by the RBOT.FZA WORM!"
X	Micr Update	soundblaster.exe	"Added by the SDBOT.NP WORM!"
X	Micr Update System	upwin.exe	"Added by the SDBOT.YS WORM!"
X	Micrcoft Updat	spoolsae.exe	"Added by the RBOT-AIB WORM!"
X	Micrcoft Updat	spoolsaex.exe	"Added by the RBOT-AJM WORM!"
X	Micrcoft Updat	Internet.exe	"Added by the RBOT-ANA WORM!"
X	Micrcsoft Certificate Services	cflmon.exe	"Added by the RBOT-FWV WORM!"
X	Micro Office	[path to trojan]	"Added by the BANCBAN-QC TROJAN!"
X	Micro Update	dailin.exe	"Added by the RBOT-ER WORM!"
N	microAttuneDownload	atmdlusr.exe	"Application Launcher
U	MicroDialler	atdialler1.exe	"Part of the Freeserve Connection Kit - changes the dial-up for Freeserve AnyTime if access problems are encountered"
X	Microfot Update	winldx32.exe	"Added by a variant of the RBOT WORM!"
X	Microft Update 32	winssx.exe	"Added by the RBOT-AQS WORM!"
X	Micromedia Flash Update	wdfmrg.exe	"Added by a variant of the SDBOT WORM!"
X	Micromedia Flash Update	xptxt.exe	"Added by the RBOT-GAB WORM!"
X	Microoft Timing	pupdate.exe	"Added by a variant of the RBOT WORM!"
X	MICROSFT ANTIVIRUS UPDATE SUPPORT	[random 10-letter filename].EXE	"Added by the RBOT-AQA WORM!"
X	MICROSFT ANTIVIRUS UPDATE SUPPORT	MSGUPDATED.EXE	"Added by the RBOT-APZ WORM!"
X	Microsft Corporation Version 2001.12.4414	comrel.exe	"Added by a variant of the SDBOT TROJAN!"
X	Microsft Corporation Version 2002.12.2414	comserv.exe	"Added by a variant of the SLAPER TROJAN!"
X	MICROSFT MX UPDATE SUPPORT	taskmngrs.exe	"Added by the RBOT-AUZ WORM!"
X	MICROSFT MX UPDATE SUPPORT	winmx32.EXE	"Added by the IRCBOT-FD WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	[random filename]	"Added by the RBOT-ASM or RBOT-AUW WORMS!"
X	MICROSFT RAMA UPDATE SUPPORT	MSN32.EXE	"Added by the RBOT-AWJ WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	mtakthmyn.EXE	"Added by the RBOT-AUJ WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	MSGUPDAT32.EXE	"Added by the RBOT-BBB WORM!"
X	microsft windows updates	mwupdate32.exe	"Added by a variant of the TOXBOT/CODBOT WORM!"
X	Microsof Value	nmatt.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft	MSUPDATE.exe	Added by an unidentified WORM or TROJAN!
X	Microsoft	updater.exe	"Added by the RBOT-GHP WORM!"
X	Microsoft	internetdat.exe	"Added by the RBOT.ETY BACKDOOR!"
X	Microsoft	MicrosoftCorporation.exe	"Added by the KILLFILES.AED TROJAN!"
X	Microsoft (C) HTML Application host	[random filename]	"Added by the RBOT-YB WORM!"
X	Microsoft (R) Windows Configuration Backup Service	svchost.exe	"Added by the RANKY.X TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in either a ""config""
X	Microsoft (R) Windows Network Latency Controller	1.tmp	"Added by a generic password stealer TROJAN - see here"
X	Microsoft (R) Windows Network Latency Controller	nlc.exe	"Added by a generic password stealer TROJAN - see here"
X	Microsoft (R) Windows Network Latency Controller	sp2vc.exe	"Added by a generic password stealer TROJAN - see here"
X	Microsoft (R) Windows Protected Content Restoration Service	services.exe	"Added by the AGENT.AGV BACKDOOR! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\etc"
X	Microsoft (R) Windows TCP/IP Socket Driver	[path to trojan]	"Added by the PROXY-DD TROJAN!"
X	Microsoft (R) Windows Update Service	wuauclt.exe	"Added by a variant of the SDBOT WORM! Note - this is not the legitimate wuauclt.exe process
X	Microsoft (R) Windows Vista/NT Runtime Compatibility Service	nrcs.exe	"Added by the RANKY.X TROJAN!"
X	Microsoft .NET Confingurator	msnconf.exe	"Added by an unidentified VIRUS
X	Microsoft 16Bit Update	wuapdate16.exe	"Added by the RBOT.CZ WORM!"
X	Microsoft 64 Bit Runtime Updater	wupdt64.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft ActiveX Debugger NT	[path to trojan]	"Added by the BANCOS-DO TROJAN!"
X	Microsoft Ansti Update	msie.exe	"Added by the RBOT-LE WORM!"
X	Microsoft Application Center	mappc.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Application Manager	msapl32.exe	"Added by the BROPIA-AE TROJAN!"
X	Microsoft AUT Update	MSlti32.exe	"Added by the RBOT-X WORM!"
X	Microsoft AUT Update	MSlti16.exe	"Added by the RBOT.EB WORM!"
X	Microsoft auto update	winupdate.exe	"Added by the BMBOT TROJAN!"
X	Microsoft Auto Update	WINHLP16.EXE	"Added by the RBOT.GY WORM!"
X	Microsoft auto update	wuauclt.exe	"Added by the CULT-B TROJAN! Note - this is not the legitimate wuauclt.exe process
X	Microsoft Automatic Update Serivce	msautou.exe	"Added by the RBOT-AOB WORM!"
X	Microsoft Automatic Updater	Explorer.exe	"Added by the RBOT-SG WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft AutoUpdater	svhost.exe	"Added by the RBOT.QG WORM!"
X	Microsoft Calculator	calc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Configoration Service	msconfigs.exe	"Added by the RBOT-ETT WORM!"
X	Microsoft Configuration	msconfig32.exe	"Added by the SDBOT.MQ WORM!"
X	Microsoft Configuration 35	microsot1.exe	"Added by an unidentified TROJAN!"
X	Microsoft Configuration Wizard	taskmrg.exe	"Added by the SDBOT-MX TROJAN!"
X	Microsoft Corp SQL Certificates	sqlcer.exe	"Added by the ZYBOT-C WORM!"
X	Microsoft Corp SSL Certificates	windowz.exe	"Added by the RBOT-GCZ WORM!"
X	Microsoft Corp TLS Certificates	msauth.exe	"Added by the RBOT-GAC WORM!"
X	Microsoft Corp Updates	wupdates.exe	"Added by the RBOT-AUU WORM!"
X	Microsoft Corporaticn SQL Handler	sqlhandler.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Corporation	[random filename]	"Added by various VIRUSES
X	Microsoft Corporation	jview.exe	"Added by the RBOT-AOD WORM!"
X	Microsoft Corporation Svchost Service	mssvc.exe	"Added by a variant of the SDBOT WORM! See here"
X	Microsoft Corporation Svchost Service	mswsc.exe	Added by the AGENT.MAB TROJAN!
X	Microsoft Corporation SYM monitor	mssym.exe	"Added by the RBOT-GDB WORM!"
X	Microsoft CPU Over Heat Manager	CPU.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Data Helper	cihost.exe	"Malware
X	Microsoft Data Machine	csdata32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Database Handler	mssql32.exe	"Added by the RANDEX.AX WORM!"
X	Microsoft Datalog Application	msdata.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Directx	directxat.exe	"Added by the SDBOT-BXF WORM! Note - disables autostart for the SharedAccess service and deactivates the Microsoft Internet Connection Firewall (ICF)"
X	Microsoft DirectX	wupdate.exe	"Added by the RBOT-L WORM!"
X	Microsoft DLL Authentification	dllsecure.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft driver update	Mshome.exe	Added by the SDBOT.BL WORM!
X	Microsoft explorer Update	internal.exe	Added by an unidentified WORM or TROJAN!
X	Microsoft Features	ms32cfg.exe	"Added by the RBOT.HO WORM!"
X	Microsoft Features	msie.exe	"Added by a variant of the RBOT WORM!"
Y	MICROSOFT FIREWALL CLIENT	ISATRAY.EXE	"MS Internet Security and Acceleration Server - see here"
X	Microsoft Generic Update Manager	wupdate.exe	"Added by the RBOT-AWC TROJAN!"
X	Microsoft Incroporate	mfs.exe	"Added by the RBOT-ANF WORM!"
X	Microsoft Information	securenet.exe	"Added by the SDBOT.AJM WORM!"
X	Microsoft Information Check	microsoft.exe	"Added by the IRCBOT.AUH TROJAN!"
X	Microsoft Initialization Service	initsvc.exe	"Added by the IRCBOT.AXK BACKDOOR!"
X	Microsoft Initialization Services	initserv.exe	"Added by the IRCBOT-ABO TROJAN!"
X	Microsoft Internel Corporat	netvhost.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Internel Corporat	smbvhost.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Internet Acceleration Utility	iau.exe	"EasySearch adware"
X	Microsoft Internet Acceleration Utility	[path to file]	"Added by the AGENT-CX TROJAN!"
X	Microsoft Internet Acceleration Utility	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Microsoft Internet Explorer	[path to trojan]	"Added by the BANCBAN-AS TROJAN!"
X	Microsoft Internet Explorer Update	ieupdate.exe	"Added by the SHEUR.MH TROJAN!"
X	Microsoft Internet Firewall Update	updater.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft IT Update	win64.exe	"Added by the RBOT.GA WORM!"
X	Microsoft IT Update	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft IT Update	IEserv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft IT Update	msupdate.exe	"Added by the RBOT-FE WORM!"
X	Microsoft IT Update	winn43.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft IT Update	svchsst.exe	"Added by the RBOT-DH WORM!"
X	Microsoft IT Update	win43.exe	"Added by the RBOT-SA WORM!"
X	Microsoft IT Update	windows.exe	"Added by the RBOT-JM WORM!"
X	Microsoft IT Update	winsyst32.exe	"Added by the RBOT-FC WORM!"
X	Microsoft IT Update	Rhost32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Java Windows Update	[filename]	"Added by the RBOT-DZ WORM!"
U	Microsoft Location Finder	LocationFinder.exe	"Microsoft Location Finder ""is a client-side application that turns a regular WiFi enabled laptop
X	Microsoft LV	[path to file]	"Added by the BDOOR-BDL BACKDOOR!"
X	Microsoft Machine	updata.exe	"Added by the RBOT-DJ WORM!"
X	Microsoft MachineUpdatese	tempes.exe	"Added by the RBOT.EWN BACKDOOR!"
X	Microsoft Management Console	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Microsoft MSUPDATE	SpoolSvc.exe	"Added by the SXTB-A TROJAN!"
X	Microsoft NT Update	winexec32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Office Start	winupdates.exe	"Added by the GAOBOT.BC WORM!"
X	Microsoft Patch Update	bootini.exe	"Added by the RBOT-FMN WORM!"
X	Microsoft PCHealth32	[path to file]	"Added by the NICE-A TROJAN!"
X	Microsoft PSTCP32 Data	pstcp32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Redirect	[path to file]	"Added by the BANKER-FW TROJAN!"
X	Microsoft Security Hot Fix Update	mshotfix.exe	"Affilred adware"
X	Microsoft Security Monitor Process	windowsupdate.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Security Update	security32.exe	"Added by the DELF-JJ TROJAN!"
X	Microsoft Server Applacations	msnmsg.exe	"Added by the AGOBOT.BBM WORM!"
X	Microsoft Server Applacations	wuauct1.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Server Applacations	lsasss.exe	"Added by the RBOT-AQQ WORM!"
X	Microsoft Server Applacations	Q8See.exe	"Added by the SPYBOT.GEN3 TROJAN!"
X	Microsoft Server Applacations	cli.exe	"Added by the RBOT-GAQ WORM!"
X	Microsoft Server Application	Sound.exe	"Added by the RBOT-NE WORM!"
X	Microsoft Service Information	msnservices.exe	"Added by the RBOT.ID WORM!"
X	Microsoft Software Update	nmon.exe	"Added by the RBOT.HZ WORM!"
X	Microsoft standard protector	[path to trojan]	"Added by the STOX-C TROJAN!"
X	Microsoft Synchronization Manager	asgard.exe	"Added by the SDBOT-AEA WORM!"
X	Microsoft Synchronization Manager	bot.exe	"Added by the SDBOT.IH WORM!"
X	Microsoft Synchronization Manager	netscape.exe	"Added by the RANDEX.AE WORM!"
X	Microsoft Synchronization Manager	slhost.exe	"Added by the SDBOT.YH WORM!"
X	Microsoft Synchronization Manager	svhost.exe	"Added by the SDBOT-PY WORM!"
X	Microsoft Synchronization Manager	WinLoginnn.exe	"Added by the SPYBOT.FO WORM!"
X	Microsoft Synchronization Manager	winupdate.exe	"Added by the SDBOT.ER WORM!"
X	Microsoft Synchronization Manager	xXx.exe	"Added by the SDBOT-KZ WORM!"
X	Microsoft Synchronization Manager	___synmgr.exe	"Added by the MASLAN.A or MASLAN.C WORMS!"
X	Microsoft Synchronization Manager	al.exe	"Added by the OPTXPRO.132 TROJAN!"
X	Microsoft Synchronization Manager	win.exe	"Added by the SDBOT.AK WORM!"
X	Microsoft Synchronization Manager	java.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Synchronization Manager	svchosts.exe	"Added by the SDBOT-LM WORM!"
X	Microsoft Synchronization Manager	winlogon32.exe	"Added by the SDBOT.AEU WORM!"
X	Microsoft Synchronization Manager	svxhost.exe	"Added by the SDBOT-ZU WORM!"
X	Microsoft Synchronization Manager	wincfg32.exe	"Added by the SDBOT.DO WORM!"
X	Microsoft Synchronization Manager	screen.exe	"Added by the SDBOT-ACO WORM!"
X	Microsoft Synchronization Manager	devldr32.exe	"Added by a variant of the RBOT WORM! Note - do not confuse with the legitimate Creative Labs devldr32.exe file"
X	Microsoft Synchronization Manager	explorer.exe	"Added by the SDBOT-AEA WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft Synchronization Manager	firewire.exe	"Added by the SDBOT-AFC WORM!"
X	Microsoft Synchronization Manager	wmedia.exe	"Added by the SDBOT.BFC WORM!"
X	Microsoft Synchronization Manager	win932.exe	"Added by the SDBOT.AH WORM!"
X	Microsoft Synchronization Manager	mircup.exe	"Added by the SDBOT.BQD WORM!"
U	Microsoft Synchronization Manager	mobsync.exe	"Microsoft Synchronization Manager for 2K/XP - used to update network copies of materials that were edited offline
X	Microsoft Synchronization Manager	alien.exe	"Added by the SDBOT-MV BACKDOOR!"
X	Microsoft Synchronization Manager	microsoft.exe	"Added by the SDBOT-OM WORM!"
X	Microsoft Synchronization Manager 2	svhostc.exe	"Added by the SLINBOT.ST WORM!"
X	Microsoft System Administration	system.exe	"Added by a variant of the IRCBOT BACKDOOR!"
N	Microsoft System Configuration Utility	msconfig.exe	Entry that appears when you uncheck an item in the MSConfig Startup group and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode. Located in %System% (98/Me/Vista) or %Windir%\PCHealth\HelpCtr\Binaries (XP)
X	Microsoft System DLL Services Configuration	windir32.exe	"Added by the SDBOT-ACY TROJAN!"
X	Microsoft System Restore Configuration	CBRSS.EXE	"Added by a variant of the SPYBOT WORM!"
X	Microsoft System Saver	[path to worm]	"Added by the RBOT.BSK WORM!"
X	Microsoft System Update	sysupdate.exe	"Added by the SDBOT.DG WORM!"
X	Microsoft System32 Update	cmsrg.exe	"Added by the RBOT-GN WORM!"
X	Microsoft Taskmanager Updater	keyboard.exe	"Added by the RBOT-ALU WORM!"
X	Microsoft UMA Update	MSuma32.exe	"Added by the RBOT.FS WORM!"
X	Microsoft Updat3	mswkst32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	Microsoft.exe	"Added by the GAOBOT.AFJ WORM!"
X	Microsoft Update	mssmgrd.exe	"Added by the SDBOT.JT WORM!"
X	Microsoft Update	mvsc.exe	"Added by the SPYBOT.DAZ WORM!"
X	Microsoft Update	ascdl.exe	"Added by the GAOBOT.SY WORM!"
X	Microsoft Update	Isac.exe	"Added by the RBOT-AU WORM!"
X	Microsoft Update	automgr32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	mediap.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	Microsoftx.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	msconfg.exe	"Added by the RBOT.H WORM!"
X	Microsoft Update	Mslti32.exe	"Added by the RBOT-LX WORM!"
X	Microsoft Update	muamgrd.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update	navmgrd.exe	"Added by the SDBOT.DP TROJAN!"
X	Microsoft Update	Smss32.exe	"Added by the RBOT-CB WORM!"
X	Microsoft Update	sys32cfg.exe	"Added by the RBOT.DR WORM!"
X	Microsoft Update	VPC32.EXE	"Added by the AGOBOT.XM WORM!"
X	Microsoft Update	winsys32.exe	"Added by the RBOT.BD WORM!"
X	Microsoft Update	wuamgrd.exe	"Added by the RBOT-LK WORM!"
X	Microsoft Update	wuammgr32.exe	"Added by the RBOT-AW WORM!"
X	Microsoft Update	wudmate.exe	"Added by the RBOT.AP WORM!"
X	Microsoft Update	msawindows.exe	"Added by the GAOBOT.AFJ WORM!"
X	Microsoft Update	msiwin84.exe	"Added by the GAOBOT.AFJ WORM!"
X	Microsoft Update	wuamgrd32.exe	"Added by the RBOT.ZB WORM!"
X	Microsoft Update	NAV.exe	"Added by the RBOT-IV WORM!"
X	Microsoft Update	systemi32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update	xpupdate.exe	"Added by the RBOT-QE WORM!"
X	Microsoft Update	webm.exe	"Added by the SDBOT.WK WORM!"
X	Microsoft Update	wuagrd.exe	"Added by the RBOT-FK WORM!"
X	Microsoft Update	aaupdt.exe	"Added by the RBOT-RQ WORM!"
X	Microsoft Update	lsac.exe	"Added by the GAOBOT.XW WORM!"
X	Microsoft Update	Mupdate.exe	"Added by the RBOT-AG WORM!"
X	Microsoft Update	prowind32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update	snlogsvc.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	svhost.exe	"Added by the RBOT-PI WORM!"
X	Microsoft Update	wauguard.exe	"Added by the RBOT.AEE WORM!"
X	Microsoft Update	winscv.exe	"Added by the RBOT-BH WORM!"
X	Microsoft Update	winsys.exe	"Added by the RBOT-GV WORM!"
X	Microsoft Update	wserv32.exe	"Added by the RBOT.AF WORM!"
X	Microsoft Update	wtm32.exe	"Added by the RBOT-AQ WORM!"
X	Microsoft Update	wumgrd.exe	"Added by the SDBOT-KY WORM!"
X	Microsoft Update	wuampd.exe	"Added by the RBOT-UT WORM!"
X	Microsoft Update	msupdate32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update	Botnet.exe	"Added by the RBOT.AFL WORM!"
X	Microsoft Update	sghost.exe	"Added by the SDBOT.AKV WORM!"
X	Microsoft Update	update_w.exe	"Added by the RBOT-EW WORM!"
X	Microsoft Update	windows24.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	wingrd32.exe	"Added by the RBOT-DW WORM!"
X	Microsoft Update	wssvr.exe	"Added by the RBOT-OD WORM!"
X	Microsoft Update	wuamagr32.exe	"Added by the SPYBOT.CG WORM!"
X	Microsoft Update	WinUpdate32.exe	"Added by the RBOT-TI WORM!"
X	Microsoft Update	wkfix.exe	"Added by the RBOT-ABZ WORM!"
X	Microsoft Update	Kkk.exe	"Added by the RBOT-AHL WORM!"
X	Microsoft Update	mcupdate.exe	"Added by the RBOT.XT WORM! Note - this file is located in %System% and should not be confused with the McAfee antivirus executable as described here"
X	Microsoft Update	Micr0s0ft.exe	"Added by the AGOBOT.AAR WORM!"
X	Microsoft Update	Msnmsngr.exe	"Added by the RBOT.BQS WORM!"
X	Microsoft Update	msupdate32.exe	"Added by the SPYBOT.LZ WORM!"
X	Microsoft Update	scvhost.exe	"Added by the RBOT-AEM WORM!"
X	Microsoft Update	svghost.exe	"Added by the RBOT.BUJ WORM!"
X	Microsoft Update	sys.exe	"Added by the RBOT-AJ WORM!"
X	Microsoft Update	up2dat5.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	winamp.exe	"Added by a variant of the RBOT WORM! Note - this is NOT the popular Winamp media player"
X	Microsoft Update	win-mang.exe	"Added by the RBOT-AFK WORM!"
X	Microsoft Update	winupdater.exe	"Added by the RBOT.BIN WORM!"
X	Microsoft Update	wuamk0032.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	wuamk032.exe	"Added by the RBOT-AHD WORM!"
X	Microsoft Update	wuamk0p32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	wuamkop.exe	"Added by the RBOT-AFI WORM!"
X	Microsoft Update	wuamkop32.exe	"Added by the RBOT.BGU WORM!"
X	Microsoft Update	wuampkd.exe	"Added by the SDBOT.BBX WORM!"
X	Microsoft Update	svzhost.exe	"Added by the RBOT.OX WORM!"
X	Microsoft Update	win32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	wininit.exe	"Added by the RBOT-AKR WORM!"
X	Microsoft Update	wuamgrd3.exe	"Added by the RBOT-AMC WORM!"
X	Microsoft Update	Wudates.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	ms.exe	"Added by the SDBOT.CC WORM!"
X	Microsoft Update	wuagmsd.exe	"Added by the RBOT-AX WORM!"
X	Microsoft Update	cmss.exe	"Added by the RBOT-ATQ WORM!"
X	Microsoft Update	wuamgrb.exe	"Added by the RBOT-AZE WORM!"
X	Microsoft Update	WINDOC.EXE	"Added by the SDBOT.PF WORM!"
X	Microsoft Update	phqghumea.exe	"Added by the SDBOT.AFO WORM!"
X	Microsoft Update	system32.exe	"Added by the RBOT.IS WORM!"
X	Microsoft Update	bling.exe	"Added by the RBOT-AVK WORM!"
X	Microsoft Update	Sygate.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	update.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	WinDrv32.exe	"Added by the RBOT.EGW WORM!"
X	Microsoft Update	devmks32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft update	winupdate.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	msupdate.exe	"Added by the BOROBOT-I TROJAN!"
X	Microsoft Update	mixer.exe	"Added by the RBOT-AIR WORM!"
X	Microsoft Update	taskmgr32.exe	"Added by the RBOT-CV WORM!"
X	Microsoft Update	drive.exe	"Added by the BIFROSE-PN WORM!"
X	Microsoft Update	wangard.exe	"Added by the RBOT-LH WORM!"
X	MICROSOFT UPDATE	WUAGTRD.EXE	"Added by the RBOT-CJ WORM!"
X	Microsoft Update	spool.exe	"Added by the AGENT-GJC TROJAN!"
X	Microsoft Update	bnmveqfts.exe	"Added by the BANLOAD.KWQ TROJAN!"
X	Microsoft Update	dqbxhupdt	"Added by a variant of the SDBOT WORM! See here"
X	Microsoft Update	enule.exe	"Added by the IRCBOT.DU BACKDOOR!"
X	Microsoft Update	explorer.exe	"Added by the RBOT.AEU BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft Update	imchemaoa.exe	"Added by the BANLOAD.KWQ TROJAN!"
X	Microsoft Update	livemessenger.com	"Added by the ADLOAD-LN TROJAN!"
X	Microsoft Update	msnmsgl.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Update	nnwyaupdt	"Added by the RBOT.RHK BACKDOOR!"
X	Microsoft Update	ntservice.exe	"Added by the AGENT-DIS TROJAN!"
X	Microsoft Update	rundll32.dll	"Added by the CIADOOR.GN BACKDOOR!"
X	Microsoft Update	wuamgrdx.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Update	wutr.exe	"Added by the SPYBOT.AAR WORM!"
X	Microsoft Update	SetPoints.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Update	system.exe	"Added by a variant of the RBOT WORM! See here"
X	Microsoft Update	service.exe	"Added by a variant of the RBOT WORM! See here"
X	Microsoft Update	msgn.exe	"Added by the RBOT.RQ BACKDOOR!"
X	Microsoft Update	wuamgrd16.exe	"Added by the RBOT-BQ WORM!"
X	Microsoft Update	windows32.exe	"Added by the RBOT-BHQ WORM!"
X	Microsoft Update	winsyst.exe	"Added by the RBOT-DL WORM!"
X	Microsoft Update 23	NtKernelSystem.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 23	spoolvs.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	explore32.exe	"Added by the SPYBOT.CYM WORM!"
X	Microsoft Update 32	MSupdate32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update 32	wininit.exe	"Added by the RBOT-ANY WORM!"
X	Microsoft Update 32	wininit32.exe	"Added by the RBOT-AKJ WORM!"
X	Microsoft Update 32	[path to file]	"Added by the RBOT-AJJ WORM!"
X	Microsoft Update 32	mscnfg.exe	"Added by the RBOT-ALM WORM!"
X	Microsoft Update 32	servic.exe	"Added by the RBOT-AXN WORM!"
X	Microsoft Update 32	winitXP32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	mssetup32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	wiit.exe	"Added by the RBOT-AMS WORM!"
X	Microsoft Update 32	explorer.exe	"Added by the RBOT-ARF WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft Update 32	network.exe	"Added by the RBOT-ARZ WORM!"
X	Microsoft Update 32	om4r.exe	"Added by the RBOT-AQP WORM!"
X	Microsoft Update 32	winin.exe	"Added by the RBOT-ARR WORM!"
X	Microsoft Update 32	wuinit.exe	"Added by the AGOBOT-UE WORM!"
X	Microsoft Update 32	neta.exe	"Added by the RBOT-AMI WORM!"
X	Microsoft Update 32	spoolvs.exe	"Added by the RBOT-BBQ WORM!"
X	Microsoft Update 32	rundll32.exe	"Added by the RBOT.AIE BACKDOOR! Note that this BACKDOOR modifies the file rundll32.exe
X	Microsoft Update 32	taskMangr.exe	"Added by the RBOT.AIE BACKDOOR!"
X	Microsoft Update 32	winssx.exe	"Added by the RBOT-ARW WORM!"
X	Microsoft Update 33	init.exe	"Added by the RBOT-ATT WORM!"
X	Microsoft Update 64 BIT	wininit32.exe	"Added by the RBOT-AHE WORM!"
X	Microsoft Update 64 BIT	winman32.exe	"Added by the RBOT-AKI WORM!"
X	Microsoft Update 64 BIT	schvost.exe	"Added by the RBOT.CAU WORM!"
X	Microsoft Update 64 BIT	winl32xe.exe	"Added by the RBOT-AQO WORM!"
X	Microsoft Update Clinic	svsipconfig.exe	"Added by the RBOT.BR WORM!"
X	MICROSOFT UPDATE CONFIGURATION	WIN32SNC.EXE	"Added by the RBOT-AI WORM!"
X	Microsoft Update Control	Ms64.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Debugger	wincfg32.exe	"Added by the SPYBOT.ZC WORM!"
X	Microsoft Update Device	flolo.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Update Device Drivers	wuauclt.exe	"Added by a variant of the SDBOT WORM! Note - this is not the legitimate wuauclt.exe process
X	Microsoft Update DLL	rxxhost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Drivers	explorers.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update Emulator	kern-mxe.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Emulator	wuaddsff.exe	"Added by the RBOT-GX WORM!"
X	Microsoft Update Event	svnhost.exe	"Added by the AGOBOT-GW BACKDOOR!"
X	Microsoft Update Loader	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Loaders 2005	winusers.exe	"Added by the RBOT-AIQ WORM!"
X	Microsoft Update Loaders 2006	winusersystem32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update Machine	expl0rer.exe	"Added by the SDBOT.OK WORM!"
X	Microsoft Update Machine	rxhost.exe	"Added by the RBOT.FC WORM!"
X	Microsoft Update Machine	servicz.exe	"Added by the RBOT-HU WORM!"
X	Microsoft Update Machine	SP2.exe	"Added by the SPYBOT.FP WORM!"
X	Microsoft Update Machine	winini.exe	"Added by the RBOT-KV WORM!"
X	Microsoft Update Machine	xvshost.exe	"Added by the RBOT.QP WORM!"
X	Microsoft Update Machine	memstat.exe	"Added by the RBOT-OM WORM!"
X	Microsoft Update Machine	ntce.exe	"Added by the RBOT-FA WORM!"
X	Microsoft Update Machine	system03.exe	"Added by the RBOT-NM WORM!"
X	Microsoft Update Machine	wuawx.exe	"Added by the RBOT-CE WORM!"
X	Microsoft Update Machine	zonealarm.exe	"Added by the RBOT-BZ WORM! Note - this is not the valid Zone Labs firewall program!"
X	Microsoft Update Machine	systemll.exe	"Added by the RBOT-JT WORM!"
X	Microsoft Update Machine	winupdt.exe	"Added by the RBOT-FP WORM!"
X	Microsoft Update Machine	svshost.exe	"Added by the RBOT.AK WORM!"
X	Microsoft Update Machine	wuamgd.exe	"Added by the SDBOT.HQ WORM!"
X	Microsoft Update Machine	wupdt32x.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update Machine	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	linux.exe	"Added by the RBOT-IM WORM!"
X	Microsoft Update Machine	lmrss.exe	"Added by the RBOT-DY WORM!"
X	Microsoft Update Machine	windowsu.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	wininigo.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	winmgr.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	Winmsixp32.exe	"Added by the RBOT.DN WORM!"
X	Microsoft Update Machine	Winregs32.exe	"Added by the RBOT.DN WORM!"
X	Microsoft Update Machine	winxpini.exe	"Added by the RBOT-OB WORM!"
X	Microsoft Update Machine	wuamgrd.exe	"Added by the RBOT-HE WORM!"
X	Microsoft Update Machine	wuagrd.exe	"Added by the RBOT-GF WORM!"
X	Microsoft Update Machine	LANWAKE.EXE	"Added by the RBOT-QZ WORM!"
X	Microsoft Update Machine	scvhost.exe	"Added by the RBOT-GS WORM!"
X	Microsoft Update Machine	winhost.exe	"Added by the RBOT-GK WORM!"
X	Microsoft Update Machine	winss.exe	"Added by the RBOT.JU WORM!"
X	Microsoft Update Machine	WUAMGRDXS.EXE	"Added by the RBOT-GL WORM!"
X	Microsoft Update Machine	crss32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	lsasse.exe	"Added by the RBOT-DI WORM!"
X	Microsoft Update Machine	qwerty.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	rxxhost.exe	"Added by the RBOT.EP WORM!"
X	Microsoft Update Machine	servicez.exe	"Added by the SPYBOT.BI WORM!"
X	Microsoft Update Machine	spoolserv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	Systemnt.exe	"Added by the RBOT.DA WORM!"
X	Microsoft Update Machine	systemse.exe	"Added by the RBOT-BD WORM!"
X	Microsoft Update Machine	taskmngrs.exe	"Added by the RBOT-CR WORM!"
X	Microsoft Update Machine	windowsup.exe	"Added by the RBOT-FV WORM!"
X	Microsoft Update Machine	wuamgard.exe	"Added by the SPYBOT.CS WORM!"
X	Microsoft Update Machine	wupdate32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	system.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	TMEMSER.EXE	"Added by the RBOT-NQ WORM!"
X	Microsoft Update Machine	winnie.exe	"Added by the RBOT-ACD WORM!"
X	Microsoft Update Machine	winortho.exe	"Added by the RBOT-NW WORM!"
X	Microsoft Update Machine	wins32.exe	"Added by the RBOT.EZ WORM!"
X	Microsoft Update Machine	serviz.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	TASKMAN4.EXE	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	wftestb.exe	"Added by the RBOT-AFZ WORM!"
X	Microsoft Update Machine	Win32.exe	"Added by the SDBOT.UV WORM!"
X	Microsoft Update Machine	windns.exe	"Added by the RBOT.EF WORM!"
X	Microsoft Update Machine	MSOICONS.EXE	"Added by the RBOT.AWS WORM! Note - do no confuse with the legitimate Msoicons.exe file described here. The latter should not normally figure in Msconfig/Startup!"
X	Microsoft Update Machine	WINSVC32.EXE	"Added by the RBOT.CU WORM!"
X	Microsoft Update Machine	ntsystem.exe	"Added by the RBOT.GF WORM!"
X	Microsoft Update Machine	winupdte.exe	"Added by the RBOT-GKL WORM!"
X	Microsoft Update Machine	jkfrnz.exe	"Added by the RBOT-GOZ WORM!"
X	Microsoft Update Machine	wlimyc.exe	"Added by the RBOT-GQN WORM!"
X	Microsoft Update Machine	xagwxzy.exe	"Added by the RBOT.S WORM!"
X	Microsoft Update Machine	jkydxg.exe	"Added by the RBOT.AEA BACKDOOR!"
X	Microsoft Update Machine	opmmve.exe	"Added by the KOLABC.DES WORM!"
X	Microsoft Update Machine	paxrxo.exe	"Added by the PUSHBOT.A WORM!"
X	Microsoft Update Machine	psmszw.exe	"Added by the KOLABC.CC WORM!"
X	Microsoft Update Machine	syadpo.exe	"Added by the CIADOOR.GN BACKDOOR!"
X	Microsoft Update Machine	systemi.exe	"Added by the BUZUS.JKU TROJAN!"
X	Microsoft Update Machine	thvfyq.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	ubthec.exe	"Added by the AGENT.AWZ TROJAN!"
X	Microsoft Update Machine	winmngr.exe	"Added by the RBOT.GKQ BACKDOOR!"
X	Microsoft Update Machine	gbhglj.exe	"Added by the IRCBOT-ZJ TROJAN!"
X	Microsoft Update Machine	wuamgdr.exe	"Added by the RBOT-IO BACKDOOR!"
X	Microsoft Update Manager	WINRLS.EXE	"Added by the RBOT-AF WORM!"
X	Microsoft Update Manager	svshost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Manager	scvhost.exe	"Added by the AGOBOT.AXJ WORM!"
X	Microsoft Update Manager	scvideo.exe	"Added by the SDBOT-CVP TROJAN!"
X	Microsoft Update Mechene	Updatez.exe	"Added by the RBOT-GI WORM!"
X	Microsoft Update Module	rundll24.exe	"Added by the RBOT-PS WORM!"
X	Microsoft Update Process	wmipcvse.exe	"Added by the AGOBOT-JF TROJAN!"
X	Microsoft Update Security Patch	mssecurityupdatepatch.exe	Added by the AGENT.EF TROJAN!
X	Microsoft Update Server	mssrv.exe	"Added by an unidentified VIRUS
X	Microsoft Update Service	csrss32.exe	"Added by the AGOBOT-HC WORM!"
X	Microsoft Update Service	mswin32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft update service	systemm.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update SERVICE	phqghum.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Service	msupdate.pif	"Added by the RBOT-AQB WORM!"
X	Microsoft Update Service	wmiprvre.exe	"Added by the AGOBOT-NN WORM!"
X	Microsoft Update Services	wcsnfty.exe	"Added by the RBOT-AGK WORM!"
X	Microsoft Update Services	wsnfty.exe	"Added by the RBOT-AFU WORM!"
X	Microsoft Update Time	wuam.exe	"Added by the RBOT-M WORM!"
X	Microsoft Update USB2	wuammgrd32.exe	"Added by the RBOT-ADT WORM!"
X	Microsoft Update v2.6	lxxex.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Win32a	winupdate32a.exe	"Added by the RBOT-LO WORM!"
X	Microsoft Update Win32x	winupdate32x.exe	"Added by the RBOT-AJN WORM!"
X	Microsoft Update32	wuamgrd32.exe	"Added by the RBOT-PU WORM!"
X	Microsoft Updater	winsys32.exe	"Added by the RBOT.RL WORM!"
X	Microsoft Updater	msconsole.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Updater	svhost.exe	"Added by the AGENT.CDF TROJAN!"
X	Microsoft Updater	vbcjlg.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Updater	wuamgrds.exe	"Added by the RBOT.A WORM!"
X	Microsoft Updater	winupdate.exe	"Added by the AGENT-KIR TROJAN!"
X	Microsoft Updater Resources	WinFixd32.exe	"Added by the SPYBOT.CA WORM!"
X	Microsoft Updater v2	[path to worm]	"Added by the AUTORUN-BCI WORM!"
X	Microsoft UPDATER32	lsass.exe	"Added by the RANDEX.AR WORM! Note - this is not the legitimate Lsass.exe system file should normally NOT figure in Msconfig/Startup!"
X	Microsoft UPDATER32	LSASS32.EXE	"Added by the RANDEX.AR WORM!"
X	Microsoft Updaters	tskmgr.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updaters	sysconfigs.exe	"Added by the RBOT-DF TROJAN!"
X	Microsoft Updaters Pros	WINDLL32XP.EXE	Added by the SPYBOTTER.GEN VIRUS!
X	Microsoft Updates	systemc32.exe	"Added by the RBOT-GR WORM!"
X	Microsoft Updates	wkssvr.exe	"Added by the RBOT.R WORM!"
X	Microsoft Updates	wkssvrs.exe	"Added by the RBOT-EB WORM!"
X	Microsoft Updates	wuamgrd.exe	"Added by the RBOT-CO WORM!"
X	Microsoft Updates	wtemp32.exe	"Added by the RBOT-AHQ WORM!"
X	Microsoft Updates	svehost.exe	"Added by the RBOT-GRW WORM!"
X	Microsoft Updates	svshost.exe	"Added by the AGOBOT-AIW WORM!"
X	Microsoft Updates	svdhost.exe	"Added by the RBOT-GVH WORM!"
X	Microsoft Updates	service.exe	"Added by the POISON.HPT BACKDOOR!"
X	Microsoft Updates	[worm filename]	"Added by the AGOBOT-AIZ WORM!"
X	Microsoft Updates	wgcptsud.exe	"Added by the RBOT-GTF WORM!"
X	Microsoft Updates	winit.exe	"Added by the SDBOT-CSB WORM!"
X	Microsoft Updates 2 USB	wgafixer.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updates 5 USB	sp3fixer.exe	"Added by the RBOT-ADS WORM!"
X	Microsoft UpdateS Machine	wgrd.exe	"Added by the RBOT-FI WORM!"
X	Microsoft Updates Resources	WinFixIDs.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updating	navguard.exe	"Added by the RBOT.HW WORM!"
X	Microsoft Updating	syswr.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updating	wuamguards.exe	"Added by the RBOT-BY WORM!"
X	Microsoft Updating Client	websvc.exe	"Added by the RBOT.AQ WORM!"
X	Microsoft Updating Machine	sysc0de.exe	"Added by the RBOT.RB WORM!"
X	Microsoft Updatting	miroupdate.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft upnp Update	msie.exe	"Added by the RBOT-LQ WORM!"
X	Microsoft UpToDate Driver (32-bits)	[random filename].exe	"Added by the SPYBOT.LXJ WORM!"
X	Microsoft Vertupdate	MSvert32.exe	"Added by the MYTOB-CY WORM!"
X	Microsoft Vista Upgrade Validation Service	cfmon.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Visual Application	vpcrtf.exe	"Added by the IRCBOT-XJ TROJAN!"
X	Microsoft web update	webmsn.exe	"Added by the RBOT-EMQ WORM!"
X	Microsoft Win Corp TLS Verification	mswintls.exe	"Added by the RBOT-GCT WORM!"
X	Microsoft Win Update	WinUP.exe	"Added by the RBOT-BPR WORM!"
X	MicroSoft Wind0ws Updater	winsupdater.exe	"Added by a variant of the RBOT WORM!"
X	MicroSoft Window Updater	winsupdater.exe	"Added by the RBOT-ZZ WORM!"
X	Microsoft Windows	atup	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows	[path to file]	"Added by the BDOOR-LI BACKDOOR!"
X	Microsoft Windows 32 Update	win32update.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows Communicator for NT/XP	wincomm.exe	"Added by the RBOT.ATH WORM!"
X	Microsoft Windows DLL Services Configuration	newdll.exe	"Added by the SDBOT-ZR WORM!"
X	Microsoft Windows DLL Services Configuration	newdll2.exe	"Added by the SDBOT-ABD WORM!"
X	Microsoft Windows DLL Services Configuration	poker.exe	"Added by the SDBOT-ZY WORM!"
X	Microsoft Windows DLL Services Configuration	poker3.exe	"Added by the SDBOT-AAH WORM!"
X	Microsoft Windows DLL Services Configuration	proxy.exe	"Added by the SDBOT-ZL WORM!"
X	Microsoft Windows DLL Services Configuration	windir32.exe	"Added by the SDBOT.BHF WORM!"
X	Microsoft Windows DLL Services Configuration	windir32a.exe	"Added by a variant of the SDBOT.BHF WORM!"
X	Microsoft Windows DLL Services Configuration	windll32.exe	"Added by the SDBOT.BHD WORM!"
X	Microsoft Windows DLL Services Configuration	winDSL.exe	"Added by the SDBOT-ZG WORM!"
X	Microsoft Windows DLL Services Configuration	dllmanager32.exe	"Added by the SDBOT-BTU WORM!"
X	Microsoft Windows Express	Microsoft Update	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Windows Game Updater	msgame32.exe	"Added by a variant of the RBOT WORM!"
U	Microsoft Windows Media Player Network Sharing Service Configuration Application	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	Microsoft Windows Secure Update	rpcxwinupdt.exe	Added by an unidentified WORM or TROJAN!
X	Microsoft Windows Updata	scvhost.exe	"Added by the RBOT.CEM BACKDOOR!"
X	Microsoft Windows Updata	windows.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Updata	[5 random letters].exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update	rundlls.exe	"Added by the HABRACK WORM!"
X	Microsoft Windows Update	msoffice2.exe	"Added by the RBOT-GB WORM!"
X	Microsoft Windows Update	spools.exe	"Added by the SDBOT.TD WORM!"
X	Microsoft Windows Update	svchos.exe	"Added by the SDBOT.AC WORM!"
X	Microsoft Windows Update	svcshost.exe	"Added by the FORBOT-CF WORM!"
X	Microsoft Windows Update	svmhost.exe	"Added by the FORBOT-CH WORM!"
X	Microsoft Windows Update	svshost.exe	"Added by the WOOTBOT.CJ WORM!"
X	Microsoft Windows Update	msnmessenger.exe	"Added by the SDBOT.AJ WORM!"
X	Microsoft Windows Update	msnwun.exe	"Added by the SDBOT-RM WORM!"
X	Microsoft Windows Update	scvvhost.exe	"Added by the FORBOT-DH WORM!"
X	Microsoft Windows Update	swwhost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update	MSNMSGR.EXE	"Added by the SDBOT-WM WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Microsoft Windows Update	svzhost.exe	"Added by the FORBOT-EV WORM!"
X	Microsoft Windows Update	sccvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update	scrhost.exe	"Added by the RBOT-AOW WORM!"
X	Microsoft Windows Update	mnswinsx.exe	"Added by the RBOT-AWH WORM!"
X	MICROSOFT Windows update	pdate.exe	"Added by the RBOT.BZT WORM!"
X	Microsoft Windows Update	srshost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update	rhost32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows Update	windowsupdate.exe	"Added by the AGOBOT.ON WORM!"
X	Microsoft Windows Update	servcs.exe	"Added by the SDBOT.AL BACKDOOR!"
X	Microsoft Windows Update	syssinfos.exe	"Added by the RBOT-FWR WORM!"
X	Microsoft Windows Update Application	wuap.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update Client	csrss.exe	"Added by the KEBEDE-G WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Systems32"
X	Microsoft Windows Update Client	services.exe	"Added by the AUTORUN.DVE WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Windows Update Logon	win-logon.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update Service	wupdmgr32.exe	"Added by the DOS.AUTOCAT TROJAN!"
X	Microsoft Windows Update Service	msnmsg.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Windows Update x86	[various filenames]	"Added by a variant of the RBOT WORM! Filenames seen include (but are not limited to firefox.exe
X	Microsoft Windows Update XP64	********.exe [* = random char]	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update XP64	updatexp64.exe	"Added by the SDBOT-AIM WORM!"
X	Microsoft Windows Update XP64	Lcuninst.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update XP64	mzhxlixm.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updater	winupdgm.exe	"Added by the GAOBOT.BI WORM!"
X	Microsoft Windows Updater	WINIUPDATES.EXE	"Added by the RBOT-KK WORM!"
X	Microsoft Windows Updater	WINUPDATE.EXE	"Added by the RBOT-LI WORM!"
X	Microsoft Windows Updater	TMNTSrv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Updater	win32upd.exe	"Added by the RBOT-EC WORM!"
X	Microsoft Windows Updater	msnupdateit.exe	"Added by the AGOBOT-RL WORM!"
X	Microsoft Windows Updater	windates.exe	"Added by the SDBOT.TE WORM!"
X	Microsoft Windows Updater	spoolvs.exe	"Added by the RBOT.ACQ WORM!"
X	Microsoft Windows Updater	suvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updater	winfix.exe	"Added by the RBOT-CM WORM!"
X	Microsoft Windows updaterD	log32zx.exe	"Added by the MYDOOM.W WORM!"
X	Microsoft Windows Updates	explorer32.exe	"Added by the SDBOT.VQ WORM!"
X	Microsoft Windows Updates	wsap32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updating System	msresource.exe	"Added by the RBOT-EAM WORM!"
X	Microsoft Windows Workstation	devcode.exe	"Added by the RBOT-AWL WORM!"
X	Microsoft Windows XP Configuration Loader	m32svco.exe	"Added by the SDBOT.WORM!.48548 WORM!"
X	Microsoft Winedows Updateing	NinKey.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft winsupdater	WINSUPDATER.EXE	"Added by the SPYBOTER.FB BACKDOOR!"
X	Microsoft WinUpdate	mntcgf032.exe	"Added by the RBOT-PF WORM!"
X	Microsoft WinUpdate	svh0st.exe	"Added by the SPYBOT.DL WORM!"
X	Microsoft WinUpdate	syslx32.exe	"Added by an unidentified VIRUS
X	Microsoft WinUpdate	syswin32.exe	"Added by the RBOT-HO WORM!"
X	Microsoft WinUpdate	spfix.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft WinUpdate	Winamp61.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft WinUpdate	Winupd32.exe	"Added by the RBOT.MQ WORM!"
X	Microsoft WinUpdate	WinNTinit32.exe	"Added by the RBOT.VS WORM!"
X	Microsoft WinUpdate	msupdte.exe	"Added by an unidentified TROJAN! See examples here & here"
X	Microsoft WinUpdates	serm32.exe	"Added by the RBOT.GE WORM!"
N	Microsoft Works Update Detection	wkdetect.exe	Checks for updates to MS Works
X	Microsoft WPCEmail	[path to trojan]	"Added by the SNIFFER-N TROJAN!"
X	Microsoft WWW	[path to trojan]	"Added by the AGENT-DRI TROJAN!"
X	Microsoft Wxdate	Syswu32.exe	"Added by the SPYBOT.HZ WORM!"
X	Microsoft X Update	wuamkoppnp.exe	"Added by the RBOT-ANI WORM!"
X	Microsoft--Updates	sxvhost.exe	"Added by the RBOT-FH WORM!"
X	Microsoft-Update	wngard.exe	"Added by the RBOT-JV WORM!"
X	Microsoft-Updates	svxhost.exe	"Added by the RBOT-CT WORM!"
X	MicrosoftCorp	update.exe	"Added by the AUTORUN-ASG WORM!"
X	MicrosoftCorp	wupdate.exe	"Added by the AGENT-LAY TROJAN!"
X	MicrosoftKs	Drivers.bat	"Added by the SHUTDOWN-F TROJAN!"
X	MicrosoftMultimediaTask	Mmtask.exe	Adware downloader - not the valid MusicMatch Jukebox which shares the same filename
X	MicrosoftNAPC	update.exe	"Added by the AUTORUN-ASG WORM!"
X	MicrosoftNAPC	wupdate.exe	"Added by the AGENT-LAY TROJAN!"
X	Microsofts Updates	lsasss.exe	"Added by the RBOT-AEX WORM!"
X	Microsofts Updatez	cmsssr.exe	"Added by an unidentified VIRUS
X	Microsofts Updatez	exploirez.exe	"Added by a variant of the RBOT WORM!"
X	MicrosoftServiceManager	msupdat.exe	"Added by the YAHA.AA WORM!"
X	MicrosoftUpdate	syshelper.exe	"Added by the WOOTBOT.AC WORM!"
X	MicrosoftUpdate	WinUp32.exe	"Added by an unidentified VIRUS
X	MicrosoftUpdate	MicrosoftUpdate.exe	"Added by the BANKER-EHC TROJAN!"
X	MicrosoftUpdate	windll.exe	"Added by the RBOT-IH WORM!"
X	MicrosoftUpdate	RBuilder.exe	"Added by the DLOADR-BMV TROJAN!"
X	MicrosoftUpdate	svhest.exe	"Added by the RBOT-ES WORM!"
X	MicrosoftUpdate	downnew.exe	"Added by the TANTO-D TROJAN!"
X	MicrosoftUpdates	[path to trojan]	"Added by the DELF-LO TROJAN!"
X	MicrosoftUpdates	syshelped.exe	"Added by the FORBOT-AZ WORM!"
U	MicrosoftŽ WindowsŽ Operating System	Sidebar.exe	"Windows Sidebar is a pane on the side of the Microsoft Windows Vista desktop where you can keep your gadgets organized and always available. In Windows 7 this feature is known as Desktop Gadgets and each gadget can be placed anywhere on the desktop. If the file isn't located in %ProgramFiles%\Windows Sidebar or you're using other versions of Windows it could be part of the Searchcentrix hijacker"
N	MicrosoftŽ WindowsŽ Operating System	"RunDLL32.exe ehuihlp.dll	BootMediaCenter"
N	MicrosoftŽ WindowsŽ Operating System	p2phost.exe	"Signs a user into the People Near Me feature at login in Windows 7 and Vista. People Near Me enables you to use certain peer-to-peer (P2P) programs on a network - that ""identifies people nearby who are using computers and allows those people to send you invitations for programs such as Windows Meeting Space. They can only invite you to participate in programs that are installed on your computer."" Available via Start → Control Panel"
U	MicrosoftŽ WindowsŽ Operating System	ehTray.exe	"Media Center Tray Applet - part of Windows Media Center on XP MCE
N	MicrosoftŽ WindowsŽ Operating System	"rundll32.exe oobefldr.dll	ShowWelcomeCenter"
N	MicrosoftŽ WindowsŽ Operating System	stikynot.exe	"Microsoft Sticky Notes - virtual sticky notes tool from Windows Vista. This implementation of the popular yellow ""Post-It"" tool is part of the Tablet PC features and allows you to enter either handwriting (via a pen or mouse) or record a voice note. AVailable via Start → All Programs"
U	MicrosoftŽ WindowsŽ Operating System	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	Microsotufed Update 32	windinit.exe	"Added by the RBOT-CTJ WORM!"
X	Microszoft Update Mach1nezs	svchst.exe	"Added by the RBOT-ED WORM!"
?	MigrationVendorSetupCaller	"rundll32.exe migrate.dll	CallVendorSetupDlls"
X	minimo	[path to file]	"Added by the MOSUCK-X TROJAN!"
X	Miosf Update	wimsqaad.exe	"Added by the SDBOT.AG TROJAN!"
X	Mirate Sp 2 Information	miratesp2.exe	"Added by the RBOT.QH WORM!"
X	Mircosoft Update	wuampkd.exe	"Added by a variant of the SDBOT WORM!"
X	MistikotitaTuIpologisti	GDC.exe	"MistikotitaTuIpologisti Greek rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	ml34	[path to trojan]	"Added by the MAILBOT-BH TROJAN!"
N	Mobile Connectivity Suite	Application Launcher.exe	"System Tray access to the HTC Sync mobile phone management utility for models including the Hero
U	Mobipocket Reader Notifications	readernotify.exe	"Part of Mobipocket Reader - ""Store all your eBooks
X	Modem	locatesvc.exe	"Added by a variant of the SPYBOT WORM!"
X	Modem Driverz Updates	mdmdrv.exe	"Added by a variant of the SDBOT WORM!"
X	Modifiet Amateur HTPB	wuaclt.exe	"Added by the IRCBOT.AYS WORM!"
N	MoneyStartUp10.0	Activation.exe	Part of MS Money 2002. Available via Start -> Programs
X	Monitor calibration	AV1i.exe	"Anti-Virus-1 rogue security software - not recommended
X	Motherboard Config	Ati2xxx.exe	"Added by the RBOT-AIK WORM!"
X	MouseDrv	[path to worm]	"Added by the ZOLOAD-B WORM!"
X	MouseDrv	update.exe	"Added by the ZOTOB.N WORM!"
X	MoussaEvil	[path to file]	"Added by the MUSANUB-A WORM!"
X	Mozilla Firebird v0.8 Internet Browser	netstats.exe	"Added by the IRCBOT.MC TROJAN!"
U	Mozy Status	mozystat.exe	"Mozy - free backup at a secure
X	Mp3 Loader	Sysdata.EXE	"Added by the AVETTE-A VIRUS!"
X	MPatrolPRO	MPatrolPRO.exe	"MalwarePatrol Pro rogue security software - not recommended
U	MP_STATUS_MONITOR	monitr32.exe	Cannon Multi-Pass status monitor - your choice
X	Ms Builders	Wupated.exe	"Added by the AGOBOT-SS WORM!"
X	MS Configuration	MSFramer.exe	"Added by the RANDEX.OL WORM!"
X	Ms Configuration	microsoftsa32.exe	"Added by the KELVIR.X WORM!"
X	MS Configuration Utility	msconfig32.exe	"Added by the WOOTBOT.DY WORM!"
X	MS DATABASE	MSDATA32.EXE	"Added by a variant of the SDBOT WORM!"
X	MS HTML	mslat.exe	"Added by the LATINUS.SVR TROJAN!"
X	MS HTML Location Class	MSHTML32.exe	"Added by the RBOT-YD WORM!"
X	Ms Java Update For Windows NT/XP	msijavaupdt32.exe	"Added by the RANDEX.AF WORM!"
X	MS Security Update 993	msident.exe	"Added by a variant of the SDBOT WORM!"
X	MS UniX	navupdate64.exe	"Added by the RBOT.CRZ BACKDOOR!"
X	MS Unix Binary	msnupdate.exe	"Added by the RBOT-AAM WORM!"
X	MS Unix Binary	outlookexpressupdate.exe	"Added by the RBOT-YU WORM!"
X	MS Unix Binary	Win32Update.exe	"Added by the RBOT-BAS WORM!"
X	MS Unix Binary	Norton2005Update.exe	"Added by a variant of the RBOT WORM!"
X	MS Unix Binary	trmupdate.exe	"Added by the RBOT-ACC WORM!"
X	MS Update	syshost.exe	"Added by the EVAMAN-F WORM!"
X	Ms Update WinServices NT/XP	winservnt32.exe	"Added by the VANEBOT-G WORM!"
X	MS UPDATER	update.exe	"Added by the RBOT-VC WORM!"
X	MS Updates	mscache.exe	Spyware web downloader
X	MS Updates	syshosts.exe	"Added by the MYDOOM.Y WORM!"
X	MS Updates	aupd.exe	Spyware web downloader
X	MS Updating Utility	msupdater.exe	"Added by the RBOT-XR WORM!"
X	ms window update	******.exe [* = random character]	"Added by a variant of the RBOT WORM!"
X	MS windows Data list process	MSDATLST.exe	Added by an unidentified WORM or TROJAN!
X	MS Windows Security Updater	updater.pif	"Added by the RBOT-AKY WORM!"
X	MS Windows Update	scguard.exe	"Added by the RBOT-YZ WORM!"
X	MS-patch	msconfig32.exe	"Added by the RBOT-AUF WORM!"
X	MS-patch	mspatch32.exe	"Added by the RBOT-AWF TROJAN!"
X	msbsc	[path to trojan]	"Added by the BANKER-DF TROJAN!"
X	msconfig	msconfig.bat	"Added by the PAHATIA.B WORM!"
X	MSConfig Manager	msupdate.exe	"CoolWebSearch parasite variant"
X	msconfig service	MSupdate32.exe	"Added by a variant of the SPYBOT WORM!"
X	msconfigurator	ctfsdk.exe	"Added by the DELF-ALS TROJAN!"
?	MSCRMStartup	Microsoft.Crm.Application.Hoster.exe	"Related to Microsoft Dynamics CRM integrated solutions for Financial
X	MSDatabla	vadasq.exe	"Added by the LIOTEN.IK WORM!"
X	msdir32	msdir32.bat	"Added by the ROOKIE-A TROJAN!"
X	MSDNMess	[path to trojan]	"Added by the RANKY.BA TROJAN!"
X	MsgApi	[path to file]	"Added by the DEDLER-D TROJAN! The most common filenames seen are ""csmss.exe"" and ""csmrs.exe""
X	Msgmgr	[path to worm]	"Added by the BABYBEAR WORM!"
X	MSI Configuration	msiconf.exe	"Added by the AGENT.AKSZ TROJAN!"
?	MSLIB32	mswatch32.exe	"??"
X	msliveupdate	msliveupdate.exe	"Added by the AGOBOT.ALT WORM!"
X	msmsgss	[path to trojan]	"Added by the RANKY.G BACKDOOR!"
X	MSN	netstats.exe	"Added by the IRCBOT.UXP WORM!"
X	MSN Administration For Windows	msnadp32.exe	"Added by the BROPIA.W WORM!"
X	MSN Auto-Updater	msnaupdater.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	MSN Auto-Updater	msnupdates.exe	"Added by the AUTORUN.WORM.GEN WORM!"
X	MSN Communication Manager	msncommgr.exe	"Added by an unidentified WORM or TROJAN! See here"
X	MSN Configuration	msnconfig.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Msn Configuration Loader	msngms.exe	"Added by the KELVIR.T WORM!"
X	MSN Configuration Loader	msmsncfg.exe	"Added by the AGOBOT-KX BACKDOOR!"
X	MSN Database Client	msndbcli.exe	"Added by an unidentified WORM or TROJAN! See here"
X	MSN File Configuration	msnfilecfg.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	MSN Message Background loader	[path to worm]	"Added by the RBOT-AIE WORM!"
X	Msn Messenger Update	msnupdate.exe	"Added by a variant of the RBOT WORM!"
X	Msn Messenger update	msnservice.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Msn Patch	msndp.exe	"Added by the RBOT.AAI WORM!"
X	Msn Patches	msndr.exe	"Added by a variant of the SDBOT WORM!"
X	Msn Plus Updater	msnplus.exe	"Added by the RBOT-MU WORM!"
X	Msn Service	matrixcam.exe	"Added by the MYTOB.JH WORM!"
X	MSN Service Updates	winproc.exe	"Added by the KELVIR-BB WORM!"
X	MSN Update	mscon.exe	"Added by the RBOT-QA WORM!"
X	MSN Update	msn32.exe	"Added by the RBOT.AHN WORM!"
X	MSN Update	DLLCON.EXE	"Added by the RBOT-EA WORM!"
X	MSN Update Cfg	msnupdbt.exe	"Added by an unidentified WORM or TROJAN! See here"
X	MSN Update Client	msnupdater.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	MSN Update Client	msnupdcli.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Msn Update Manager (Sp2)	MSMSGS.EXE	"Added by the AGOBOT-NL WORM! Note - this particular msmsgs.exe file is located in %System% and should not be mistaken for the MSN Messenger file of the same name which is located in %Program Files%\Messenger"
X	Msn Update Service	userx.exe	"Added by the MYTOB.JF WORM!"
X	MSN Update Service	msnupdsv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Msn Update SUPPORT	[random filename]	"Added by the RBOT-BPS WORM!"
X	MSN Updater	msnms.exe	"Added by the FORBOT-CG WORM!"
X	Msn Updater	msnplugins.exe	"Added by the RBOT-HS WORM!"
X	Msn Updater	windatemanager.exe	"Added by the SDBOT.TS WORM!"
X	MSN UPDATERS	virtualmemory.exe	"Added by the RBOT-JK WORM!"
X	MSN Updating	msnupdate.exe	"Added by the QHOST.AEI TROJAN!"
X	msn upddate	mesenger.exe	"Added by the RBOT-AVZ WORM!"
X	MSN6.1 Auto-Updater	v6msn.exe	"Added by the AUTORUN-MM WORM!"
X	Msnarrator	msnarrator.exe	"Added by the NARAT.A TROJAN! - also identified as MPGCOM Toolbar adware"
X	MSNMSGRE	swef.bat	IRC backdoor TROJAN or WORM!
X	MSNMSGRR	swin.bat	IRC backdoor TROJAN or WORM!
X	MSNMSGRS	swe.bat	IRC worm or backdoor trojan!
X	MSNMSGRS	swiss.bat	IRC worm or backdoor trojan!
X	MSNMSGRS1	swed.bat	IRC backdoor TROJAN or WORM!
X	msnmsgy	[path to file]	"Added by the BANKER-EQ TROJAN!"
X	MSNPluginSrvcs	sagate.exe	"Added by the SDBOT.AKJ WORM!"
X	msoft-updater23	mssysstems.exe	"Added by the RBOT-ATU WORM!"
X	msoft-updater23	slssystem.exe	"Added by the RBOT-ASR WORM!"
X	MSOleath32	winss.exe	"Added by the KATHER TROJAN!"
X	msoupdater	msoupdater.exe	"Added by the DLOADER.GBD TROJAN!"
X	Mspatch69	[path to trojan]	"Added by the MPROX TROJAN!"
X	Mspatch89	cnqmax.exe	"Added by the RANDEX.P WORM!"
X	MSPP System Update 64	wiaadmgr.exe	"Detected by Kaspersky as the RANKY.GEN TROJAN!"
X	MSPRO32	[path to worm]	"Added by the IBERIO WORM!"
X	msresear	[path to trojan]	"Added by the WEASYW-B TROJAN!"
X	MSSGisg	[path to file]	"Added by the RANKY.N TROJAN!"
X	mssonfig	winupdate.exe	"Added by a variant of the SDBOT WORM!"
X	mssvc	[path to trojan]	"Added by the PSK TROJAN!"
X	MSUpdate	wupd.exe	"Added by the ALADINZ.M TROJAN!"
X	MSUpdate	svchosthlp.exe	"Added by the BLASTER.T WORM!"
X	msupdate	msupdate.exe	"Added by the RBOT-MZ WORM!"
X	MSUpdate	criticalUpdate.exe	"Affilred adware"
X	msupdate	update.exe	"Added by a variant of the SDBOT WORM!"
X	Msupdate	expIorer.exe	"Added by the TACTSLAY.A TROJAN!"
X	Msupdate	outIook.exe	"Added by the TACTSLAY.A TROJAN!"
X	Msupdate	svchosts.exe	"Added by a variant of the TACTSLAY TROJAN!"
X	Msupdate	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	Msupdate	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	MSupdate.exe	N/A	"CoolWebSearch parasite variant - resets home page to an adult content site"
X	MSUpdateDevKit	axfd.exe	"Added by the SDBOT-ZD WORM!"
X	msupdater	msupdater.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X	MsUpdater System	udpsys32.exe	"Added by the RBOT.AAA WORM!"
X	MSupdater.exe	N/A	"CoolWebSearch parasite variant. Installs the Winshow.dll browser plugin"
X	msupdater25	lsasser.exe	"Added by the RBOT-ATS WORM!"
X	msupdates	msupdt.exe	"Added by the RBOT-JO WORM!"
X	MSVersion	INTERNETFEATURES.exe	"Added by the POPMON.A TROJAN! - also known as PopMonster adware"
X	msvupdater	msvupdater.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X	MsWindows SysDate	sysmsvc.exe	"Added by the SPYBOT.FCD WORM!"
X	MSWindowsUpdate	Systern.exe	"Added by the RBOT-AFD WORM!"
X	MSWindowsUpdate	mswinup.exe	"Added by a variant of the SDBOT WORM!"
X	MSWinupdate	winupdate.exe	"Added by the DLOADR-AAW TROJAN!"
X	MSWTL32	MSATL32.exe	"Added by an unidentified WORM or TROJAN! See here"
X	MSWUpdate	[path to worm]	"Added by the SILLYFD-V WORM! The most common filename is lsass.exe but it not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	MSxmlHpr	"RUNDLL32.EXE [path] msxm192z.dll	w"
X	MS_Update Check	wdfmgr.exe	"Added by the AGOBOT-TB WORM!"
X	MS_update_0704_KB74073.exe	MS_update_0704_KB74073.exe	"Added by a variant of the UPDATEKB TROJAN!"
X	Multimedia extensions	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	mxb2	[path to worm]	"Added by the IXBOT-G WORM!"
X	MyFastAccess	myfastupdate.exe	My-Fast-Access toolbar updater
U	myNetWatchman	nwclient.exe	"Sends your firewall alerts to a website
U	MytekSystrayExePath	MyTekSystray.exe	"MyTek system tray - web site providing computer tech support in Australia"
X	MyWebSearch Plugin	"rundll32 [path] M3PLUGIN.DLL	UPF"
X	napv.exe	wupdate.exe	"Added by the AGOBOT-JX BACKDOOR!"
X	Narrator	******.exe [* = random char]	"Added by the QOOLOGIC TROJAN!"
U	Narrator	Narrator.exe	Associated with the Narrator accessibility feature on Windows XP. It is used to convert text to speech
X	Natal	Natal.scr	"Added by the OPASERV.AE WORM!"
X	NAV Auto Update	[random filename]	"Added by the SPYBOT-E WORM!"
X	NAV Auto Update	iamsad.exe	"Added by the SPYBOT-CE BACKDOOR!"
X	NAV Auto Update	Sadness.exe	"Added by the SPYBOT-E WORM!"
X	NAV Auto Updates	csrssp.exe	"Added by a variant of the SDBOT WORM!"
X	NAV Auto Updates	navwindows.exe	"Added by a variant of the SDBOT WORM!"
X	NAV Auto Updates	slserves.exe	"Added by the RBOT.COI BACKDOOR!"
X	NAV Auto Updates	navupdaterx.exe	"Added by a variant of the RBOT WORM!"
N	NAV Configuration Wizard	cfgwiz.exe	"Introduced with Norton Anti-Virus 2002
X	NAV Live Update	[path to worm]	"Added by the DEBORMS.C WORM! Note - this is not a valid Norton Anti-Virus (NAV) function from Symantec"
X	Navegate	iiexplorer.exe	"Added by the BANCBAN-OP TROJAN!"
X	Navegate	wisterd.exe	"Added by the BANKER-BOS TROJAN!"
X	NAVWatch	NAVWatcher.exe	"VX2.Transponder parasite updater/installer related"
X	NAV_Update	NAV_Update.exe	Unidentified WORM or TROJAN!
N	NB Windows Patterns	WINDBKGND.EXE	"Part of McAfee Nuts & Bolts. With Background Patterns
X	NBT System alias	[path] repcale.exe [path] beird.exe	"Added by a variant of the RANDON.AN WORM!"
X	Ndpldaemon	[path to trojan]	"Added by the RPCSDBOT-A TROJAN!"
X	Ndtstat	Ndtstat.exe	Added by a variant of the BANLOAD family of TROJANS!
X	Negative	spain.exe	"Added by the BANKER-EXJ TROJAN!"
X	Nero Updater.6.12	wmp9.exe	"Added by the AGOBOT-AAG WORM!"
X	NeroUpdate Check	msjava.exe	"Added by the AGOBOT.AMH WORM!"
X	NeroUpdater6.8	winjava.exe	"Added by the AGOBOT.AMK WORM!"
U	Net Accelerator	NetAccelerator.exe	"Rizal NetAccelerator - ""Optimizing Dial-Up
X	NET Bios Stats	ntbstats.exe	"Added by the SDBOT-ZX WORM!"
U	NetAccelerator	NetAccel.exe	"NetAccelerator is a "software utility that optimizes your internet access up to 1200% faster!. NetAccelerator speeds all modems allowing you to download faster
U	NetAssistant	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
?	netfxupdate	netfxupdate.exe	"Would appear to be a valid Microsoft .NET file (see here) but other sources suggest it could be a trojan"
?	NetFxUpdate_v1.0.3705	netfxupdate.exe	"Would appear to be a valid Microsoft .NET file (see here) but other sources suggest it could be a trojan"
X	nethost.exe	[path to file]	"Added by the PERDA-J TROJAN!"
U	NetManageImport	nmcpdata.exe	"NetManage business software related"
U	NetPatrol	winclient.exe	"NetPatrol network monitoring software"
N	NetStat Live	Nsl.exe	"AnalogX NetStat Live - TCP/IP protocol monitor which can be used to see your exact throughput on both incoming and outgoing data"
X	Nettordinateur	GDC.exe	"Nettordinateur rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	netupdate32	netupdate32.exe	"Added by the RBOT-GQZ WORM!"
X	NetWatch32	netwatch.exe	"Added by the MIMAIL.C WORM!"
X	Network Administration	NAS.exe	"Added by the ANTILAM.20.Q TROJAN!"
X	Network Administration Service	rsvc32.exe	"Added by the RBOT.ABH WORM!"
U	Network Associates Error Reporting Service	TBMon.exe	Network Associates Error Reporting Tool - tool traps errors and requests submission to NAI for the purpose of betatesting new software
X	Network Connections	internat.exe	"Added by the VB-ZD TROJAN!"
X	Network Host Controller	[path to trojan]	"Added by the WHISPER TROJAN!"
X	Network Security Guard	[path to trojan]	"Added by the COLEM-A TROJAN!"
X	Network Translation System Service	ntss.exe	"Added by the UNPDOOR TROJAN!"
X	NetworkAssociates Inc	internet.exe	"Added by the LOVGATE.AB WORM!"
X	Networks Configurator	NetConfs.exe	"Added by the RBOT-OX WORM!"
X	New.net Startup	"rundll32 [path] NEWDOT~1.DLL	ClientStartup"
X	New.net Startup	"rundll32 [path] NEWDOT~1.DLL	NewDotNetStartup"
X	New.net Startup	"rundll32 [path] NEWDOT~2.DLL	ClientStartup"
X	New.net Startup	"rundll32 [path] NEWDOT~2.DLL	NewDotNetStartup"
X	newname	[path to trojan]	"Added by the DRSMARTL-S TROJAN!"
X	NI.ERS_9999_N91S3108	[path to file]	"Installer for the ErrorSafe rogue system error and cleaning utility - see here"
X	NI.GA6PU_0001_N108E1308	[path to file]	"Installer for the VirusSchlacht German rogue security software - see here"
X	NI.GA6PU_0001_N120C2910	[path to file]	"Installer for the VirusSchlacht German rogue security software - see here"
X	NI.GA6P_0001_N105E2704	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N108E1606	[path to file]	"Installer for the BestsellerAntivirus rogue security software - see here"
X	NI.GA6P_0001_N111C1707	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N115C0110	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N115E0110	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N122C0611	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N122C2210	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N122C2802	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N122E0611	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_2001_N108E1606	[path to file]	"Installer for the BestsellerAntivirus rogue security software - see here"
X	NI.GDCDE_0001_N122C1912	[path to file]	"Installer for the FestplattenReiniger German rogue privacy tool - see here"
X	NI.GDC_0001_N111C1909	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.GDC_0001_N122C1912	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.GES_0001_N122C2610	[path to file]	"Installer for the ErrClean rogue system error and cleaning utility - see here"
X	NI.UAVIFR_0001_N105M2404	[path to file]	"Installer for the VirusGarde French rogue security software - see here"
X	NI.UERSM_0001_N68M1602	[path to file]	"Installer for the ErrorSafe rogue system error and cleaning utility - see here"
X	NI.UGA6P	[path to file]	"Installer for the BestsellerAntivirus rogue security software - see here"
X	NI.UGA6PH_0001_N122M2910	[path to file]	"Installer for the AntiVirusAskeladd rogue security software - see here"
X	NI.UGA6PK_0001_N122M1302	[path to file]	"Installer for the VirusForsvar Danish rogue security software - see here"
X	NI.UGA6PL_0001_N108M2808	[path to file]	"Installer for the VirusSchlacht Swedish rogue security software - see here"
X	NI.UGA6PL_0001_N120M1302	[path to file]	"Installer for the VirusSchlacht Swedish rogue security software - see here"
X	NI.UGA6PM_0001_N108M2108	[path to file]	"Installer for the AntivirusScherm Dutch rogue security software - see here"
X	NI.UGA6PM_0001_N122M1202	[path to file]	"Installer for the AntivirusScherm Dutch rogue security software - see here"
X	NI.UGA6PM_0001_N122M3010	[path to file]	"Installer for the AntivirusScherm Dutch rogue security software - see here"
X	NI.UGA6PT_0001_N108M2208	[path to file]	"Installer for the VirusDifesa Italian rogue security software - see here"
X	NI.UGA6PT_0001_N122M1202	[path to file]	"Installer for the VirusDifesa Italian rogue security software - see here"
X	NI.UGA6PT_0001_N122M2910	[path to file]	"Installer for the VirusDifesa Italian rogue security software - see here"
X	NI.UGA6PU_0001_N108M1308	[path to file]	"Installer for the VirusSchlacht German rogue security software - see here"
X	NI.UGA6PU_0001_N120M1202	[path to file]	"Installer for the VirusSchlacht German rogue security software - see here"
X	NI.UGA6PU_0001_N120M2910	[path to file]	"Installer for the VirusSchlacht German rogue security software - see here"
X	NI.UGA6PV_0001_N108M0207	[path to file]	"Installer for the VirusGarde French rogue security software - see here"
X	NI.UGA6PV_0001_N122M1202	[path to file]	"Installer for the VirusGarde French rogue security software - see here"
X	NI.UGA6PV_0001_N122M2910	[path to file]	"Installer for the VirusGarde French rogue security software - see here"
X	NI.UGA6P_0001_N105M2704	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_0001_N111M1707	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_0001_N115M0110	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_0001_N119M1510	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_0001_N120M1710	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_0001_N122M0611	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_0001_N122M2210	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_0001_N122M2802	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_0007_N125M2002	[path to file]	"Installer for the BestsellerAntivirus rogue security software - see here"
X	NI.UGA6P_1001_N122M0402	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_1002_N122M1402	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_4001_N122M2111	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_4444_N122M2811	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_5001_N122M1902	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_5555_N122M0312	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGDC1_0001_N119M0911	[path to file]	"Installer for the FilterProgram rogue privacy tool - see here"
X	NI.UGDCCZ_0001_N122M0307	[path to file]	"Installer for the SuspenzorPC Czech rogue privacy tool - see here"
X	NI.UGDCCZ_0001_N122M0511	[path to file]	"Installer for the SuspenzorPC Czech rogue privacy tool - see here"
X	NI.UGDCCZ_0001_N122M1712	[path to file]	"Installer for the SuspenzorPC Czech rogue privacy tool - see here"
X	NI.UGDCDE_0001_N111M3007	[path to file]	"Installer for the FestplattenReiniger German rogue privacy tool - see here"
X	NI.UGDCDE_0001_N122M1912	[path to file]	"Installer for the FestplattenReiniger German rogue privacy tool - see here"
X	NI.UGDCGR_0001_N122M0307	[path to file]	"Installer for the FestplattenReiniger Greek rogue privacy tool - see here"
X	NI.UGDCGR_0001_N122M1812	[path to file]	"Installer for the FestplattenReiniger Greek rogue privacy tool - see here"
X	NI.UGDCNL_0001_N111M3007	[path to file]	"Installer for the NoCompromaat Dutch rogue privacy tool - see here"
X	NI.UGDCNL_0001_N122M1912	[path to file]	"Installer for the NoCompromaat Dutch rogue privacy tool - see here"
X	NI.UGDCNL_0001_N122M3011	[path to file]	"Installer for the NoCompromaat Dutch rogue privacy tool - see here"
X	NI.UGDCPL_0001_N108M0207	[path to file]	"Installer for the OczyszczaczKomputerza Polish rogue privacy tool - see here"
X	NI.UGDCPL_0001_N122M2012	[path to file]	"Installer for the OczyszczaczKomputerza Polish rogue privacy tool - see here"
X	NI.UGDCRU_0001_N111M0208	[path to file]	"Installer for the SanitarDiska Romanian rogue privacy tool - see here"
X	NI.UGDCRU_0001_N122M2012	[path to file]	"Installer for the SanitarDiska Romanian rogue privacy tool - see here"
X	NI.UGDCTH_0001_N122M1712	[path to file]	"Installer for the PC Drive Tool rogue privacy tool - see here"
X	NI.UGDCTR_0001_N108M0407	[path to file]	"Installer for the PC Drive Tool rogue privacy tool - see here"
X	NI.UGDC_0001_N108M0407	[path to file]	"Installer for the PC Drive Tool rogue privacy tool - see here"
X	NI.UGDC_0001_N111M1909	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.UGDC_0001_N122M0502	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.UGDC_0001_N122M1912	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.UGDC_0001_N122M2603	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.UGDC_0001_N122M2610	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.UGDC_0001_N122M2802	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.UGDC_0001_N122M2811	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.UGDC_0002_N108M1007	[path to file]	"Installer for the PC Drive Tool rogue privacy tool - see here"
X	NI.UGDC_0003_N108M2407	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.UGESF_0001_N122M0201	[path to file]	"Installer for the HataDuzelticisi Turkish rogue system error and cleaning utility - see here"
X	NI.UGESL_0001_N105M0405	[path to file]	"Installer for the SystemOrdnare Swedish rogue system error and cleaning utility - see here"
X	NI.UGESL_0001_N122M0303	[path to file]	"Installer for the SystemOrdnare Swedish rogue system error and cleaning utility - see here"
X	NI.UGESL_0001_N122M2911	[path to file]	"Installer for the SystemOrdnare Swedish rogue system error and cleaning utility - see here"
X	NI.UGESM_0001_N122M0303	[path to file]	"Installer for the DokterFix Dutch rogue system error and cleaning utility - see here"
X	NI.UGESV_0001_N108M2006	[path to file]	"Installer for the SysDepannage French rogue system error and cleaning utility - see here"
X	NI.UGESV_0001_N122M0303	[path to file]	"Installer for the SysDepannage French rogue system error and cleaning utility - see here"
X	NI.UGESV_0001_N122M2811	[path to file]	"Installer for the SysDepannage French rogue system error and cleaning utility - see here"
X	NI.UGESV_0001_N122M3010	[path to file]	"Installer for the SysDepannage French rogue system error and cleaning utility - see here"
X	NI.UGES_0001_N122M0502	[path to file]	"Installer for the ErrClean rogue system error and cleaning utility - see here"
X	NI.UGES_0001_N122M2111	[path to file]	"Installer for the ErrClean rogue system error and cleaning utility - see here"
X	NI.UGES_0001_N122M2602	[path to file]	"Installer for the ErrClean rogue system error and cleaning utility - see here"
X	NI.UGES_0001_N122M2603	[path to file]	"Installer for the ErrClean rogue system error and cleaning utility - see here"
X	NI.UGES_0001_N122M2610	[path to file]	"Installer for the ErrClean rogue system error and cleaning utility - see here"
X	NI.UGES_0002_N108M1607	[path to file]	"Installer for the ErrClean rogue system error and cleaning utility - see here"
X	Nielsen NetRatings	insight.exe	"NetRatings Premeter spyware"
X	NIEUW	[path to dialler]	"""Switch-F"" premium rate adult content dialler"
X	NiroFile Updated	NiroFile.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Nocana	[path to worm]	"Added by the ANACON-B WORM!"
X	NoCompromaat	GDC.exe	"NoCompromaat Dutch rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	Nod32 Service	AutoUpdateWin32.exe	"Added by the SDBOT-DJG WORM!"
U	Nokia M Platform	NokiaMServer.exe	"Part of the Nokia Music music manager
Y	Nokia PC Suite	DataLayer.exe	"Part of Nokia PC Suite version 5 - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" Required by the Nokia status/connection monitor (NclTray.exe)"
Y	Nokia Software Updater	nsu_ui_client.exe	"Utility that only runs once after installing the Nokia Software Updater which is used to update the operating system (or firmware) for selected Nokia mobile devices"
N	Nokia Status Monitor	NclTray.exe	"Part of Nokia PC Suite version 5 - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" Monitors ports to see if a phone has been connected and provides System Tray access to the Connection Manager (and other PC Suite components if a phone is connected). Available via the Control Panel as ""Nokia Connection Manager"""
N	Nokia Tray Application	NclTray.exe	"Part of Nokia PC Suite version 5 - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" Monitors ports to see if a phone has been connected and provides System Tray access to the Connection Manager (and other PC Suite components if a phone is connected). Available via the Control Panel as ""Nokia Connection Manager"""
N	NokiaPCSuiteTray	LaunchApplication.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
X	Norton Antivirus 7.0a	[path to file]	"Added by the PERDA-B or RANCK-CT TROJANS!"
X	Norton Antivirus Updater	nortonav.exe	"Added by the DELBOT-T WORM! Note - this is not the real Norton AV!"
X	Norton AV Protection Startup	Ati2xxx.exe	"Added by a variant of the RBOT WORM!"
X	Norton Firewall	[path to trojan]	"Added by the BANKER-ET TROJAN!"
X	Norton Live Update Server	cpsdv.exe	"Added by the AGOBOT.EW TROJAN!"
X	Norton Live Updater	Cavapsvc.exe	"Added by the GAOBOT.AO WORM!"
X	Norton Live Updater	Sochost.exe	"Added by the GAOBOT.AO WORM!"
X	Norton Live Updater	Avapsvc.exe	"Added by the AGOBOT-BG BACKDOOR!"
N	Norton Navigator Loader	nnloader.exe	"An older Norton utility for file management under Windows 95. More information here"
X	Norton SpySweeper AutoUpdate	navsw.exe	"Added by the FORBOT-AS WORM!"
X	Norton Update	ccUpdate.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Norton Update	winsvc.exe	"Added by the AGOBOT.ALP WORM!"
X	Norton Update	cUpdate.exe	"Added by the AGOBOT.APP WORM!"
X	Norton updated	NVSV32.EXE	"Added by the SDBOT.ABH WORM!"
X	Norton Updater	winset.exe	"Added by a variant of the SPYBOT WORM!"
X	Norton Updater	lsa.exe	"Added by a variant of the RBOT WORM!"
X	Norton Updater	NortonUpdate.exe	Added by an unidentified WORM or TROJAN!
X	Norton Updater	ccUpdate.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Norton Updater	navupdtr.exe	"Added by the SDBOT.AXV WORM!"
X	Notification Utility	altpayV2.exe	"AltPay adware"
X	nstat	netstat.exe	Adult content dialler
X	NSupdate	NSupdate.exe	"Added by the Dial/Laet-B premium rate dialer!"
N	NT Kernel Patch	ntkrnlpt.exe	"FaxServe network fax software"
X	NT Virtual Machine	[path to file]	"Added by the SCAERBOT-A WORM!"
X	NTCommLib3	[path to trojan]	"Added by the AGENT-AXB TROJAN!"
X	Ntech.patchs	[trojan filename]	"Added by the LEMIR.G TROJAN!"
N	ntlfreedom	"rundll32 [path] RyDial.dll	QuickStart"
X	NTP Server	[path to trojan]	"Added by the RANKY.F TROJAN!"
X	ntupdate	dnsvc.exe	"Added by the SDBOT-TC WORM!"
X	NTupdater	[path to trojan]	"Added by the DIGARIX-D TROJAN!"
U	NUAgentInstallPath	NU_Install.exe	"Installer associated with Chily Employee Activity Monitoring surveillance software. Uninstall this software unless you put it there yourself"
N	Nuance PDF Create! 5-reminder	Ereg.exe Ereg.ini	"Registration reminder for PDF Create version 5 from Nuance"
U	NuvaTime	NuvaTime.exe	"NuvaTime - reminder for women using NuvaRing"
X	NvCp1Do	[path to trojan]	"Added by the DWNLDR-GWE TROJAN! The most common filename seen is ""smss.exe"" - which is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	NvCplScan	netstat32.exe	"Added by the SDBOT.BRL WORM!"
X	NvGraphicsInterface	[path to trojan]	"Added by the BCKDR-QKI BACKDOOR!"
X	nVidia Application Drivers	nvidiav32.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	NVidia Drivers	[path to trojan]	"Added by the RANCK-R TROJAN! Note - this is not related to any nVidia based motherboard or graphics card"
N	NVIDIA nForce APU1 Utilities	NVATray.exe	"nVidia's nForce Audio Processing Unit (APU)- ""provides 3D positional audio and DirectX 8.0 compatibility
X	nvpatch	napatch.exe	"Added by the SASSER-F WORM!"
?	NVRotateSysTray	nvsysrot.dll	"Related to NVIDIA nView Control Panel. What does it do and is it required?"
X	NvUpdater	nwiz32.exe	"Added by a variant of the RBOT WORM!"
X	nwiz	KHATRA.exe	"Added by the ORBINA-A WORM!"
X	OB Updater	ob.exe	"Added by the AGOBOT-IH WORM!"
X	od-matrxx	od-matrxx.exe	Adult dialler - xx can be any number
X	Office Monitors	GoogleUpdater.exe	"Added by the RBOT-GKZ WORM! Note - this is not the updater for the popular Google tools"
X	Office Monitorse	[path to worm]	"Added by the SDBOT-CZX WORM!"
X	Offices Monitors	[path to worm]	"Added by the RBOT-GKO WORM!"
X	Offices Monitorse	[path to worm]	"Added by the RBOT-GKO WORM!"
X	office_update	[path to trojan]	"Added by the DLOADER-ZB TROJAN!"
X	OLE Automation Server	ole32aut.vbe	"CoolWebSearch parasite variant"
X	OnlineHelpmate	GDC.exe	"OnlineHelpmate rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	Open Service Drivers	opiater.exe	"Added by a variant of the RBOT WORM!"
U	OpenDNS Update	OpenDNS Updater.exe	"Updater for OpenDNS which ""is a free service that works for networks of all sizes
X	OpenMstart	[path to dialler]	"""Switch-E"" premium rate adult content dialer"
U	Openwares LiveUpdate	LiveUpdate.exe	"Web-update utility as used by various types of software - see here"
N	Operations Typhoon Rising Registration	NOVG.EXE	"Joint Operations registration reminder"
N	Operator	??	"Media Pilot operator
U	Operator	xtmop.exe	Fax/Phone answering facility for Extreem Machine - as supplied with the old Diamond SupraExpress modems. No longer supported
X	OpiStat	OpiStat.exe	"NetRatings Premeter spyware"
X	opsql update check	opsql.exe	"Added by the RBOT-ACJ WORM!"
X	Optim[NUMBER]	[path] egdtopt.exe	"Added by the RAMVICRYPE TROJAN!"
U	Optus Cable Data Monitor	datamonitor.exe	"Allows Optus customers to monitor their actual data usage against Optus' ""data allowance limits"""
Y	Orange Connection Kit	atdialler1.exe	"Part of the Orange Connection Kit - changes the dial-up for Orange Any Time if access problems are encountered"
N	OrangeShark	OSharkUpdater.exe	"Orange Shark updater - online games for all ages"
X	OrbitUpdate	update.exe	"Xupiter OrbitExplorer toolbar related. Drive-by foistware. Use Spybot S&D
X	OS Boot Configuration	bootconfig.exe	"Added by the IRCBOT.HJ WORM!"
X	OS Boot Configuration!	bootconf.exe	"CoolWebSearch BootConf adware"
X	OuterinfoUpdate	OuterinfoUpdate.exe	"Clickspring.Outerinfo adware"
X	outpostupdate	outpostupdate.exe	"Added by the COSIAM-C TROJAN!"
N	PAL Evidence Eliminator	Cleaner.exe	"PAL Evidence Eliminator - cover the tracks of your browsing habits and E-mails if you think you need to. Run manually on a regular basis"
N	palmOne Registration	register.exe	"Registration reminder for Palm products"
N	Palo Alto Software Update Manager 8.0	PAS8_UD.exe	"Update manager for small business planning software from Palo Alto Software - such as Business Plan Pro
U	Panasonic Communications Utility	Mfpscdl.exe	"Port manager for Panasonic Panafax fax_machines"
X	Patah Hati	[path to worm]	"Added by the PAHATIA-A WORM!"
X	Patah Hati	ISASS.exe	"Added by the PAHATIA.A WORM!"
X	Patch	patch.exe	"Added by the NETBUS WORM!"
X	Patches Value	WinGamed.exe	"Added by the SDBOT.BR WORM!"
?	Path	lide.exe	"??"
X	pathname	pathname.exe	"Added by the IRCCONTACT TROJAN!"
?	PathNvidiaTV	patchnvidiaTVout.exe	Related to a Gigabyte Nvidia based video card - typical file location is %ProgramFiles%\Gigabyte\Nvidia
N	PC Suite	LaunchApplication.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
N	PC Suite for Smartphones	Application Launcher.exe	"System Tray access to the Sony Ericsson PC Suite mobile phone management utility for some models
X	PC2X	initial.bat	"Added by the DWNLDR-FZZ TROJAN!"
X	PCHEasySearch	STUpdate.exe	PCH EasySearch bar
N	PCPitstop Registration Reminder	Reminder.exe	"Registration reminder for the Exterminate antimalware package from PC Pitstop"
N	PCSuiteTrayApplication	TrayApplication.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
N	PCSuiteTrayApplication	LaunchApplication.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
N	PCSuiteTrayApplication	TRAYAP~1.EXE	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
N	PCSuiteTrayApplication	LAUNCH~1.EXE	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
U	PCWatch	pcwatch.exe	"PCWatch surveillance software. Uninstall this software if you did not install it yourself"
U	pdfFactory Dispatcher v1	fppdis1a.exe	"FinePrint pdfFactory Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory printer. Version 1.x of the software. ""pdfFactory products offer a unique approach to PDF creation that is simpler
U	pdfFactory Dispatcher v2	fppdis2a.exe	"FinePrint pdfFactory Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory printer. Version 2.x of the software. ""pdfFactory products offer a unique approach to PDF creation that is simpler
U	pdfFactory Pro Dispatcher v1	fppdis1.exe	"FinePrint pdfFactory Pro Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory PRO printer. Version 1.x of the software. ""pdfFactory products offer a unique approach to PDF creation that is simpler
U	pdfFactory Pro Dispatcher v3	fppdis3a.exe	"FinePrint pdfFactory Pro Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory Pro printer. Version 3.x of the software. ""pdfFactory products offer a unique approach to PDF creation that is simpler
U	PDFHook	pdfcreate5hook.exe	"Prevents the ""Trial Version www.Nuance.com"" watermark appearing in PDF documents created by PDF Create version 5 (from Nuance) when the product has been installed but not activated properly. See here for more information"
U	pdfMachine dispatcher	mapisnd.exe	"pdfMachine Windows print driver"
N	PDIBM Application	pdibm.exe	"Part of the IBM customized version of SafeGuard PrivateDisk from Utimaco - which provides secure area of hard disk where files and folders are encrypted. This entry loads the associated IBM wizard to create the initial secure area once the program has been installed and will no longer be loaded (but remains as a startup entry) once it is completed"
X	Personal Firewall V9	Firewall-UpdateV9.exe	"Added by the RBOT-BJR WORM!"
X	Pest-Patrol	Pest-Patrol.exe	"Pest-Patrol rogue security software - not recommended
X	Pest-Patrol 2.1.0	Pest-Patrol.exe	"Pest-Patrol rogue security software - not recommended
U	PestPatrol Control Center	PPControl.exe	"PestPatrol Control Terminal - utility that launched PestPatrol features such as PPMemCheck and CookiePatrol before CA's acquisition"
?	PestPatrolCL	PestPatrolCL.exe	"PestPatrol's command line scanner
X	PHIME2OO2ASyst	[path to trojan]	"Added by the DBDOOR-B TROJAN!"
N	Pickatag	pickatag.exe	"Pick-a-tag - ""freeware utility for random selection of your taglines. This utility randomly picks a tagline out of a list of taglines. It will create a signature file which your mailer can use to place under your messages"""
N	Picture Motion Browser Media Check Tool	SPUVolumeWatcher.exe	"Part of the Sony Picture Uility software supplied with Sony camera/camcorder products. Automatically invokes an import process if the camera/camcorder is connected and has media on it"
N	PluckSvr	PluckUpdater.exe	"Pluck Toolbar updater"
X	Pofatch	nstrue.exe	"Added by the RANDEX.Z WORM!"
X	PopRock	[path to trojan]	"Added by the AGENT-LNU TROJAN!"
X	PopularScreensaversWallpaper	"rundll32 [path] F3SCRCTR.DLL	LES"
X	Popup Blocker Updater	regsvr32 veev****.dll [* = random char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	Popup Defence Updater	regsvr32 pdfupd.dll	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
U	Popup Terminator	GLADManager.exe	"Popup Terminator - pop-up killer"
U	PopupEliminator	Popup Eliminator.exe	"Popup Eliminator - pop-up killer"
X	popuppers65	[path to file]	"Medload adware"
X	PopUpWatch	PopUpWatch.exe	"BPS spyware remover - not recommended
?	POS-Partnerbatchprocessor	BATCH.EXE	"VISA credit card batch processing related to Appcon. Is it needed or can it be started manually via Start -> Programs or a manually created shortcut?"
X	Postdavatch	nvdas.exe	"Added by the RANDEX.T WORM!"
X	Postpatch	nvdes.exe	"Added by the RANDEX.T WORM!"
X	PostSetupCheck	Rundll32.exe atgban.dll	"TrafficSol adware variant. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""atgban.dll"" file is found in %System%"
U	Power_Gear	BatteryLife.exe	Power management for all Asus notebook. Useful but not critical
U	PP2000 Instaupdate	PPInupdt.exe	Protector Plus anti-virus software - instant update program for virus data updates. Not required if you regularly update virus data manually
N	PP3100b	flatbed.exe	"Twain driver for the Visioneer PaperPort 3100b scanner that allows you to scan
N	ppmate	ppmate.exe	"PPMate - free tool for streaming online TV via P2P (peer-to-peer)"
U	PPSVC	[path to file]	"PC Police surveillance software that logs keystrokes
U	PPUpdate	ppupdater.exe	"PPUpdater - updater that used to be part of PestPatrol before CA's acquisition"
?	PreAnnotate	PreAnntt.exe	"Genius Wizard Pen Tablet driver related. Is it required?"
X	PreInstall Windows	[path] repcale.exe [path] beird.exe	"Added by a variant of the RANDON.AN WORM! Both files are located in %System%\detr"
N	Price Patrol	neo.exe	"Price Patrol by Half.com - internet shopping companion for finding the best on-line prices"
X	print sharing	start.bat	"Added by the ZCREW TROJAN!"
X	print sharing	[path] hidden32.exe [path] explorer.exe	"Added by the ZCREW.B BACKDOOR! Note - the legitimate Windows Explorer (explorer.exe) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually!"
X	Printer	[path to file]	"Added by the LOWTAPER TROJAN!"
X	Printer Spool	updater.exe	"Added by a variant of the RBOT WORM!"
?	Printer Update	CFGREG.EXE	"Maybe a registration reminder or automatically updates drivers or application software for a printer?"
X	PrinterSpool	[path] RESTORE.EXE [path] SPOOL.EXE	"Added by the ALADINZ.K TROJAN!"
X	Privacy Watcher	Privacy Watcher.exe	"Privacy Watcher rogue privacy program - not recommended
N	PrivateDisk	pdservice.exe	"Part of SafeGuard PrivateDisk from Utimaco - which ""securely and transparently protects sensitive files on notebooks and desktop computers
X	PrivateNet	[various filenames]	Premium rate adult content dialler
X	pro	[path to file]	"Added by the SPYWAD-F TROJAN!"
U	Pro PCL Status Monitor	PENGSS.EXE	Xerox printer/fax/copier status monitor (PCL = printer control language)
X	Proc992	[path to file]	"Added by the IXBOT-C WORM!"
X	PromoReg	[path to worm]	"Added by the WALEDAC.C WORM!"
X	PromulGate	PgMonitr.exe	"Delfin Promulgate adware variant"
U	Propel Accelerator	PropelAC.exe	"Propel Internet Accelerator"
X	Protection	[path] runtask.exe [path] protection.exe	Added by a variant of the AGENT.3.AU TROJAN!
X	ProtezionefiData	pgs.exe	"ProtezionefiData rogue security software - not recommended. A member of the AVSystemCare family"
X	PrU Async Service	[path to worm]	"Added by the IRCBOT-UG WORM!"
X	prunnet	[path to trojan]	"Added by the AGENT-HVB TROJAN!"
U	Purgative	PURGATIVE100.EXE	AIM (AOL Instant Messenger) Ad Remover Using Active Memory Edits instead of a patch/crack
X	Purgatory	Purga.exe	"Added by the PURGORY-B WORM!"
U	pwrmonit	"RunDll32 [path] pwrmonit.dll	StartPwrMonitor"
U	pyrobatchftp	pyrobatchftp.exe	"""PyroBatchFTP lets you transfer files to/from FTP/SFTP servers in an automatic and unattended way through a simple to learn batch/script language"""
U	pyrobatchftp.exe	pyrobatchftp.exe	"""PyroBatchFTP lets you transfer files to/from FTP/SFTP servers in an automatic and unattended way through a simple to learn batch/script language"""
U	PyroTrans	pyrobatchftp.exe	"""PyroBatchFTP lets you transfer files to/from FTP/SFTP servers in an automatic and unattended way through a simple to learn batch/script language"""
X	qgqqft	[path to Trojan]	"Added by the RANKY.T TROJAN!"
Y	QH Live Update Scheduler	UPSCHD.EXE	"Quick Heal Anti-Virus"
Y	Quick Heal On-Line Protection	Cateye.exe	"Quick Heal - virus scanner"
X	Quick Office	activate.exe	"Added by the RANSOMLOCK.D TROJAN! Note - this infection hooks the keyboard to prevent anything except numbers from being typed and displays a Russian message requesting a valid license key"
U	QuickBooks Database Server Manager	QBServerUtilityMgr.exe	"Part of QuickBooks Pro/Premier from Intuit - ""QuickBooks Database Server Manager is a utility that allows you to configure the QuickBooks Server for multi-user access."" See here for further information"
N	Quickbooks Update Agent	qbupdate.exe	Associated with Intuit's Quickbooks but not required. Possibly to do with the payroll update service but you're prompted to check for updates when appropriate whether this is running or not
N	Quicken Scheduled Updates	bagent.exe	Quicken background downloading module
N	QuickTime Update Completion x	quicktimeupdatehelper.exe	"Different numbers caused by number of launches. So if 3 updates are made separately
X	QuickTimeUpdate	QuickUpdate.exe	"Added by the BIFROSE-CW TROJAN!"
X	Rakyat_Kelaparan	Kuli.exe	"Added by the SILLYFDC.BDM WORM!"
X	Rakyat_Miskin	Buruh.exe	"Added by the SILLYFDC.BDM WORM!"
?	RAMGINAConnWatch	RAMConnWatcher.exe	"Part of Remote Access Manager (RAM) for Nortel Networks - which ""combines an intuitive
X	Rapdata	ravsecs.exe	"Added by the QQPASS-V TROJAN!"
X	Rapdatae	rabseuser.exe	"Added by the QQPASS-S TROJAN!"
X	Rapdatybs	ravseteyns.exe	"Added by the PWS-ACP TROJAN!"
X	rate.exe	i11r54n4.exe	"Added by the BEAGLE-I WORM!"
X	rate.exe	i1ru74n4.exe	"Added by the BEAGLE.E WORM and variants!"
X	rawload	[path to trojan]	"Added by the DARKIRC.QZ TROJAN!"
X	RBOT v2 with NetAPI exploit traded with billgates I gave my mother Greetz - OG - Bluehell Irc Server	glossary.exe	"Added by the VANEBOT-J WORM!"
X	RCAutoLiveUpdate	MaxLURC.exe	"Max Registry Cleaner rogue registry cleaner - not recommended
X	RDPlatinum v5	RDPlatinumv5.exe	"Registry Defender Platinum rogue registry cleaner - not recommended
X	Real player updater	realupd.exe	"Added by the PARLAY TROJAN!"
X	Real Statics Agent	ccreal.exe	"Added by a variant of the RBOT WORM!"
X	RealP1ayer	[path to file]	"Added by the RPLAY.A TROJAN! Note that the name has a number ""1"" in place of the second lower case ""L"""
X	RealPlayer Ath Check	rnathchk.exe	"Added by the MYTOB.AG WORM!"
X	RealPlayer Ath Check	mathchk.exe	"Added by the MYDOOM-AJ WORM!"
X	RealPlayerUpdater	realupd32.exe	"Added by the LOHAV-T TROJAN!"
?	RealTimeUpdate	RealTimeUpdate.exe	"Product description in properties is ""InternetExplorerCommunicationAgent Module"" ?"
X	RealUpdater	realupd.exe	"Added by the PARLAY or MITGLIEDER.I TROJANS!"
X	RebateNation0	RebateNation0.exe	"RebateNation adware"
X	REEGRUN	[path to file]	"Added by the SECDROP.AI TROJAN"
X	Reeg_	[path to trojan]	"Added by the BANCBAN-AW TROJAN!"
X	regcheck	[path to file]	"Added by the SERVPAM TROJAN!"
X	Registration Service	toker.exe	"Added by the SDBOT-BB WORM!"
X	Registration Service	msvdm6.exe	"Added by the SDBOT-HE TROJAN!"
N	Registration-Studio 8	RegTool.exe	"Registration for Pinnacle Studio Version 8 home video software from Pinnacle Systems"
X	RegistryGreat.exe	RegistryGreat.exe	"Registry Great rogue registry cleaner - not recommended"
X	REGMSYS	[path to file]	"Added by the LOWZONE-AX TROJAN!"
X	REGRUN	[path to trojan]	"Added by the LOWZONE-AH TROJAN!"
Y	Regrun2	WatchDog.exe	"Greatis Software's RegRun security suite which amongst other things replaces MSCONFIG. The WatchDog check for registry changes caused by trojan's
U	RegUpdate	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
Y	Regx10EXE	ATIX10.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
N	reminder-ScanSoft Product Registration	remind32.exe	Registration reminder for ScanSoft products such as PaperPort
U	Remote Data Backups	CBSysTray.exe	"System Tray access to Remote Data Backups online system/data backup utility"
U	Remote Data Backups	COBackup.exe	"Remote Data Backups online system/data backup utility"
U	Remote Data Backups TaskBar Icon	CBSysTray.exe	"System Tray access to Remote Data Backups online system/data backup utility"
X	Remote Procedure Call Locator	RUNDLL32.EXE reg678.dll ondll_reg	"Added by the LOVGATE.F WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
Y	Remote Update Monitor	imonitor.exe	"Sophos Antivirus Remote Update utility - provides an easy way for remote workers to keep up to date with their virus protection via a website or network connection provided by their employer"
X	ReparateurDeSysteme	SysRep.exe	"ReparateurDeSysteme
U	Replicator	PTReplicator.exe	"Replicator from Karen's powertools. ""Automatically backup files
X	reseurce	[path to trojan]	"Added by the LINEAGE-AI TROJAN!"
U	Resolution Assistant	matcli.exe	"Dell Resolution Assistant. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
?	Restart Watch	Watch.exe	"Associated with an Eicon Networks Diva ISDN or ADSL modem. What does it do and is it required?"
X	Restore Operation	svchots.exe	"Added by a variant of the RBOT WORM!"
X	Rg2catbd	Rg2catbd.exe	Added by a variant of the BANLOAD family of TROJANS!
X	RichMedia	"rundll32.exe [path] hbcast.dll	WaitWindows"
U	RivaTuner	RivaTuner.exe	"RivaTuner is a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This startup entry is for XP and can appear twice - with registry key names of ""RivaTuner"" and ""RivaTunerStartupDaemon"" respectively. The former minimizes it to the System Tray and is primarily required only if you want to use the ""Launcher"" or monitoring options. The latter applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
U	RivaTuner	RivaTunerWrapper.exe	"RivaTuner is a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This startup entry is for Vista and can appear twice - with registry key names of ""RivaTuner"" and ""RivaTunerStartupDaemon"" respectively. Both load the main application (RivaTuner.exe). The former minimizes it to the System Tray and is primarily required only if you want to use the ""Launcher"" or monitoring options. The latter applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
U	RivaTuner Application	RivaTuner.exe	"RivaTuner is a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This startup entry is for XP and can appear twice - with registry key names of ""RivaTuner"" and ""RivaTunerStartupDaemon"" respectively. The former minimizes it to the System Tray and is primarily required only if you want to use the ""Launcher"" or monitoring options. The latter applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
U	RivaTunerStartupDaemon	RivaTuner.exe	"Part of RivaTuner - a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This entry is for XP and applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
U	RivaTunerStartupDaemon	RivaTunerWrapper.exe	"Part of RivaTuner - a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This entry is for Vista and loads the main application (RivaTuner.exe) to apply overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
U	RivaTunerWrapper Application	RivaTunerWrapper.exe	"RivaTuner is a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This startup entry is for Vista and can appear twice - with registry key names of ""RivaTuner"" and ""RivaTunerStartupDaemon"" respectively. Both load the main application (RivaTuner.exe). The former minimizes it to the System Tray and is primarily required only if you want to use the ""Launcher"" or monitoring options. The latter applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
X	rngmf	[path to trojan]	"Added by the RANKY.C TROJAN!"
N	RoboFormWatcher	RoboFormWatcher.exe	"Roboform from Siber Systems. Automatically completes web forms. Available via Start -> Programs"
X	rollbk	msmpatch.exe	"Added by the SERFLOG.B WORM!"
X	romahere	matrixhere.exe	"SuperSpider hijacker - a CoolWebSearch parasite variant"
X	Root_Machine	[path to trojan]	"Added by the BANCBAN-DI TROJAN!"
Y	Roxio Engine Compatibility Wizard	EngUtil.exe	"Part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools - corrects any modification made to the Roxio Engine
N	RoxWatchTray	RoxWatchTray.exe	"System Tray access to managing the ""Watched Folders""
N	RoxWatchTray	RoxWatchTray10.exe	"System Tray access to managing the ""Watched Folders""
N	RoxWatchTray	RoxWatchTray9.exe	"System Tray access to managing the ""Watched Folders""
N	RoxWatchTray10	RoxWatchTray10.exe	"System Tray access to managing the ""Watched Folders""
N	RoxWatchTray9	RoxWatchTray9.exe	"System Tray access to managing the ""Watched Folders""
X	RPC DCOM Vulnerability Patch	msgfix.exe	"Added by the RBOT.S WORM!"
X	RPC Patcher	[path to worm]	"Added by the BOLGI WORM!"
X	RPCInstall	[path to trojan]	"Added by the AGENT-DQM TROJAN!"
X	RpcLocator	explorer.exe	"Added by the RBOT-GSA WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
U	Run Google Web Accelerator	GoogleWebAccWarden.exe	"Google Web Accelerator"
U	Run Nintendo Wi-Fi USB Connector Registration Tool	NintendoWFCReg.exe	"Related to Wi-Fi USB Connector from Nintendo"
X	Run Services as Application	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	run windows	servic.bat	"Added by the REBOOT-AP TROJAN!"
X	run=	mouse_configurator.win	"Added by the GAGGLE.E WORM!"
X	rundl332	math.exe ...pluged.exe	"Added by the DOOMJUICE WORM!"
X	RunDLL	"rundll32.exe [path] Bridge.dll	Load"
X	RunDll	[path to trojan]	"Added by the DROPPER.EAT TROJAN!"
X	rundll***	die.exe [path] mdll.exe	"Added by the SUMTAX TROJAN! where *** is 134
X	rundll***	die.exe [path] secure.bat	"Added by the SUMTAX TROJAN! where *** is 134
X	rundll***	die.exe [path] secure.exe	"Added by the SUMTAX TROJAN! where *** is 134
X	rundll***	die.exe [path] ttg.exe	"Added by the SUMTAX TROJAN! where *** is 134
X	RunDLL32	winupdate.exe	"Added by an unidentified TROJAN! - possibly a BMBOT variant"
X	rundll32	[path to worm]	"Added by the AUTEX WORM!"
X	rundll64	[path to worm]	"Added by the AUTEX WORM!"
U	RunNarrator	Narrator.exe	Associated with the Narrator accessibility feature on Windows XP. It is used to convert text to speech
X	runner1	updater.exe	Added by the CRYPT.ULPM.GEN TROJAN!
X	RunOnce	[path to trojan]	"Added by the BANCBAN-P TROJAN!"
X	RunOnce	[path to mstask32.exe]	"Added by the DELF-IA TROJAN!"
X	RunOnce2Upd	[path to trojan]	"Added by the MURLO.FI TROJAN!"
X	runSubvalues	[path to file]	"Added by the DLOADER-QY TROJAN!"
X	Runtt1	Internat.exe	"Added by the LINEAGE-R TROJAN!"
X	RunWin	[path to file]	"Added by the BANKER-ES TROJAN!"
X	RunWindowsUpdate	uptodate.exe	"BrowserAid/BrowserPal foistware"
X	rxres32	ati2vid.exe	"Added by the RBOT-FL WORM!"
X	Safe	[path to trojan]	"Added by the BANKER-DT TROJAN!"
X	SafeGuard Popup Blocker Updater	regsvr32 sfgupd.dll	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	SafeGuard Popup Blocker Updater (required)	regsvr32 sfg****.dll [* = ramdom char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	SafeGuard Popup Updater (required)	regsvr32 sfg****.dll [* = random char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	SafeGuard Popup Updater (required)	regsvr32 PDF****.dll [* = random char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	SafeSurfingUpdate	SSUpdate.exe	"MoneyTree parasite - ActiveX control used to download premium-rate dialers"
X	Sagate Security Firewall	sagate.exe	"Added by the GAOBOT.BOW WORM!"
N	SAgent2ExePath	SAgent2.exe	Seiko Epson printer status agent. Disable if printer is not used often
N	SalaatTime	SalaatTime.exe	"""Salaat Time is a FREE multi-function Islamic application that calculates the prescribed five daily Muslim prayer times as well as Qiblah direction for anywhere in the world"""
U	SansaDispatch	SansaDispatch.exe	"Sansa Updater - ""The Sansa Updater is an application that checks for the latest firmware updates then downloads and installs the firmware to your Sansa device"""
U	SaskTel Accelerated Dial-up	sasktelgui.exe	"""Experience faster surfing
U	SATARaid	SATARaid.exe	RAID driver for serial ATA disks on some motherboards such as the DFI Lanparty range. Only loaded if one is using RAID support on SATA drives
X	satmat	satmat.exe	"VX2.Transponder parasite updater/installer related"
U	SAUpdate	SAUpdate.exe	"Big Brother from Quest Software. System and network monitor"
X	SaveDate	SaveStartDate.Exe	Unidentified adware
X	SB Watchdog	SBWatchdog.exe	Spyware utility installed by the manufacturers of some laptops (Sony) used to monitor browsing habits and send them back to whoever installed it - released by SoftBank
U	SBAutoUpdate	sbautoupdate.exe	"SpywareBlaster auto-updater"
U	SBC Self Support Tool	matcli.exe	"matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	ScanDisc	satan.exe	Added by the GREGSTAR TROJAN!
Y	Scanner File Utility	NsCatCom.exe	"Kycocera Mita network copier/printer/scanner process to dump scanned documents onto a workstation"
X	ScanRegistry	update.exe	"Added by the DWNLDR-FZY TROJAN!"
N	ScanSoft PaperPort 7 Registration Reminder	NAVBrowser.EXE	"Registration reminder for PaperPort 7 from Scansoft (now Nuance)"
U	scheduler_proxy Application	scheduler_proxy.exe	"Found on IBM/Lenovo ThinkCentre/ThinkStation desktops and Thinkpad notebooks. Included with versions of ThinkVantage System Update (for software updates)
X	schost	[path to trojan]	"Added by the TJSERV.D TROJAN!"
X	scrbmk	[path to trojan]	"Added by the DLOADER-VP TROJAN!"
?	script	script.bat	"Maybe associated with DOS on a Win9x machine"
U	SDAutoLiveupdate	LiveUpdateSD.exe	"Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here"
X	sdfsdfsdf	sp2update.exe	"Added by a variant of the SPYBOT WORM!"
X	SDKcore Update Components2	SDKC0R3.exe	"Added by the RBOT-ABA WORM!"
X	sdkupdate22	SDK0mCORE.exe	"Added by the FORBOT-DT WORM!"
X	Secure Socket Layer Certification	sslcert.exe	"Added by the VANEBOT-AN WORM!"
X	Security	WindowsSecurityUpdate.exe	"Added by a variant of the SDBOT WORM!"
X	Security Patch	scmss.exe	"Added by the RBOT-ZW WORM!"
X	Security Patch	WinUpdate32.exe	"Added by the SDBOT-BM WORM!"
X	Security Patches	msnkn.exe	"Added by the RBOT.WW WORM!"
X	Security Patches	WinLab32.exe	"Added by the SDBOT-KB WORM!"
X	Security Update Service	wmiprvce.exe	"Added by the AGOBOT.ZW WORM!"
X	Security Update Service Process	svrhost23.exe	"Added by the AGOBOT-GN WORM!"
X	seli	[path to file]	"Added by the LOWZONE-AS TROJAN!"
X	Sepate Security Firewall	sepate.exe	"Added by the RBOT.BLC BACKDOOR!"
X	serpe	formatsys.exe	"Added by the SERFLOG.A WORM!"
Y	Server Application for MFP Server	ServoApp.exe	"Multi Function Printer (MFP) Server Agent for Belkin's Wirless G All-in-One Print Server and ZyXEL's NPS-520"
X	Service Update Client	svcupdcli.exe	"Added by an unidentified WORM or TROJAN! See here"
X	service32.exe	[path to trojan]	"Added by the DLOADR-AYX TROJAN!"
X	ServiceAdministrator	SERVICES.EXE	"Added by the KORRON.B WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X	services	start.bat	"Added by the ZCREW TROJAN!"
X	Services	[path to trojan]	"Added by the METEORSHELL TROJAN!"
X	Services	[path to trojan]	"Added by the RANCK-DB TROJAN!"
X	Services Administrator	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	ServicesAdministrator	SERVICES.EXE	"Added by the PUNYA-B WORM! Note - this is not the legitimate services.exe process
X	setFTPBack	createsw.exe	"Added by the FTP_BMAIL TROJAN!"
X	Setup	[path to trojan]	"Added by the DROPPER.EAT TROJAN!"
X	Setup experation	svchost.exe	"Added by the TOFGER-AW TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	setupdata	rnll32.exe	"Added by the QQPASS-AC TROJAN!"
X	SGPUpdater	sgpUpdaters.exe	"Fast Browser Search/Search Guard Plus parasite - installed with ""Make the Web Better"" applications such as My Web Tattoo
X	shambl3r	cnf.bat	"Added by the REMABL WORM!"
U	Shareaza	bindata.exe	"Shareaza P2P client related"
X	ShareSearcher	[path to trojan]	"Added by the AGENT-FPE TROJAN!"
X	Shell	Explorer.exe winupdate.exe	"Added by the AGENT-FD TROJAN! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The ""winupdate.exe"" file is located in %System%"
X	Shell	Explorer.exe [path] ibm[RANDOM 5 DIGIT NUMBER].exe	"Added by the ANSERIN TROJAN! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files"
X	shell update	shellexec.exe	"Added by the RBOT-ANC WORM!"
X	ShellCommand	[path to file]	"Added by the REMCON-A TROJAN!"
X	Shmgrate.exe	ibot4.exe	"Added by the GASTER TROJAN!"
U	ShowIcon_PNY_PNY Attaché	shwicon.exe	"PNY Attaché USB flash memory stick System Tray icon - shows when the device is plugged in"
?	ShowIcon_SmartDisk Corporation_USB Card Reader v1.14e051	shwicon.exe	"Card reader for memory cards from digital cameras. Is it required? "
Y	ShStatEXE	SHSTAT.EXE	Part of McAfee's VirusScan Enterprise corporate anti-virus and anti-spyware security tool
X	ShutdownWithoutLjiasvt.exe	[path to trojan]	"Added by the BIFROSE.F BACKDOOR!"
N	SigmaTel Audio	setup.exe	"Sigmatel audio driver"
N	SigmaTel StacMon	stacmon.exe	Installed with the drivers for a SigmaTel C-Major Audio card (on a Dell Inspiron 600m PC for example). Appears as though it can be disabled with no ill effects
N	SigmatelSysTrayApp	stsystra.exe	System tray program for the Sigmatel Audio sound card. Often found on Dell computers
N	SigmatelSysTrayApp	sttray.exe	System tray program for the Sigmatel Audio sound card. Often found on Dell computers
U	Sinus 1054 data WLAN Manager	Wifiusb.exe	Wireless management utility for the T-Com Sinus 1054 Data WLAN adapter
U	SiS (R) Compatible Super VGA SiSTray application	sistray.exe	System Tray access to display settings for Silicon Integrated Systems (SiS) based graphics chipsets. Located in %System%
X	SiS 6326 Accelerator	sis6326m.exe	"Added by the MSIC BACKDOOR!"
U	SiS Compatible Super VGA Keyboard Daemon	keyhook.exe	"Hotkey manager for Silicon Integrated Systems (SiS) based graphics chipsets - disable unless you use hotkeys"
X	Sistray32	win.bat	"Added by the JUMPRED.A WORM!"
U	SkinClock	AtomicAlarmClock.exe	"Atomic Alarm Clock - ""Alert yourself about important events with different alarms and replace your computer tray clock using different skins. Computer Alarm clock that will play any MP3 file. It can also run a program
N	SkypeMate	SkypeMate.exe	"SkypeMate acts as a bridge between networks of VoIP and PSTN"
X	SM	iro.bat	"Added by the IROFFER.CT TROJAN!"
X	Smart Virus Eliminator	SM[random characters].exe	"Smart Virus Eliminator rogue security software - not recommended
U	SMax4PNP Application	SMax4PNP.exe	"Analog Devices SoundMax integrated soundcard utility. Brings up the SoundMAX Control Panel when it detects if new audio devices (such as microphones
X	SMS	iro.bat	"Added by the IROFFER.CT TROJAN!"
U	SMS Application Launcher	LAUNCH32.EXE	"Microsoft Systems Management Server - used to manage computers on a network remotely"
X	smss	[path to smss.exe]	"Added by the ALADINZ.F TROJAN! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup!"
X	Sndcompat	Sndcompat.exe	"Added by the GEMA TROJAN!"
?	SO5 Integrator Pass One	sointgr.exe	"StarOffice 5. See here for more details"
?	SO5 Integrator Pass Two	sointgr.exe	"StarOffice 5. See here for more details"
X	softIce Update 32	wininits.exe	"Added by the RBOT-ANB WORM!"
U	SoftickPPP	PPPGate.exe	"Softick PPP is a Microsoft Windows driver that allows to establish PPP session between Palm powered devices and Microsoft Windows desktop computer"
U	SoftwareStation	station.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
X	somatic	somatic.exe	"Searchcentrix hijacker"
X	Somefox	[path to trojan]	"Added by the DWNLDR-HHB TROJAN!"
N	Sony Auto Update Tray Application	CONNECTAUTrayApp.exe	"System Tray access to change update settings for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
N	Sony Ericsson PC Suite	Application Launcher.exe	"System Tray access to Sony Ericsson PC Suite which ""connects your phone to your computer and expands the capabilities of your phone"". Run manually via the Start Menu (or optional desktop shortcut) before connecting the phone"
X	Sound	[path to trojan]	"Added by the DROPPER.EAT TROJAN!"
N	SoundMAX Integrated Digital Audio	Smtray.exe	"System Tray icon for Analog Devices SoundMax integrated soundcards. Sound properties can be accessed through the Start Menu or Control Panel"
X	SoundMnEx32	[path to worm]	"Added by the STRATION-FW WORM!"
N	SourcePath	gwreg.exe	Used to update Gateway registry settings for System Restoration Kit and Web update programs
X	sp	"rundll32 (Path to Trojan DLL)	DllInstall"
U	SP2 Connection Patcher	SP2ConnPatcher.exe	Changes limit of concurrent TCP connections of Windows Service Pack 2
X	SP2 data	[path] repcale.exe [path] apc.exe	"Added by a variant of the RANDON.AN WORM! Both files are often located in %System%\winstat"
X	SP2 Firewall/Internet Updater	crssrs.exe	"Added by the RBOT.BJO WORM!"
X	sp2update	sp2update.exe	"SP2Update adware! Tracks URLs visited and search terms entered into Internet Explorer"
X	sp2update	updatesp2.exe	"Added by the SDBOT.CAS WORM!"
U	spamihilator	spamihilator.exe	"Spamihilator - spam filter"
U	SpamMonitor Application	SpamMonitor.Exe	"System Tray access to Spam Monitor from PC Tools - which ""is an easy-to-use spam filter that detects and isolates unsolicited junk mail sent to your mailbox. Designed for computer users
N	SpeedBitVideoAccelerator	VideoAccelerator.exe	"""SpeedBit Video Accelerator makes videos from YouTube and over 150 sites stream faster and play smoother by reducing buffering problems and video interruptions or hiccups"""
X	Spees2	Speedy.bat	"Added by the OPASERV.AD WORM!"
X	Spool	[path to trojan]	"Added by the RANKY.R TROJAN!"
X	Spool	static.exe	"Added by an unidentified WORM or TROJAN! Located in the Root folder (C:\)
X	SPOOL Configuration	spoolsvc.exe	"Added by the SDBOT-KD WORM!"
X	spoolax	[path to trojan]	"Added by the PERDA-D TROJAN!"
X	Spooler SubSystem Application	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler Subsystem Application	smss.exe	"Added by the IRCBOT-ZO TROJAN! Note - the legitimate smss.exe process should not normally figure in Msconfig/Startup!"
U	Sprint DSL virtual assistant	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	Spruce - Auto Update	Spruce.exe	"Rabio ""Search Enhancer"" adware variant"
Y	Spybot - Search & Destroy	TeaTimer.exe	"Part of the popular Spybot - Search & Destroy spyware removal tool from Safer Networking Limited. ""Resident TeaTimer is a tool of Spybot-S&D which perpetually monitors the processes called/initiated. It immediately detects known malicious processes wanting to start and terminates them giving you some options
Y	SpybotDeleting*****	[cmd or command] /c del [path] [filename]	"Generated by Spybot Search & Destroy if it encounters files that cannot be deleted during runtime because they are locked by other processes. For example
Y	SpybotSD TeaTimer	TeaTimer.exe	"Part of the popular Spybot - Search & Destroy spyware removal tool from Safer Networking Limited. ""Resident TeaTimer is a tool of Spybot-S&D which perpetually monitors the processes called/initiated. It immediately detects known malicious processes wanting to start and terminates them giving you some options
X	SpyDevastator	SpyDevastator.exe	"SpyDevastator rogue security software - not recommended
X	SpyFighterUpdate	AutoUpdate.exe	"SpyFighter spyware remover - not recommended
X	Spyinator	Spyinator.exe	"Spyinator rogue spyware remover - not recommended"
Y	Spyware X-terminator	SpywareX.exe	"Spyware X-terminator antispyware from StompSoft
X	spywareisolator	spywareisolator.exe	"SpywareIsolator rogue spyware remover - not recommended
Y	SpywareTerminator	SpywareTerminatorShield.exe	"Spyware Terminator's real-time protection. Initially not recommended due to false positives but the later versions have since improved - see here"
Y	SpywareTerminatorUpdate	SpywareTerminatorUpdate.exe	"Automatic updates for Spyware Terminator. Initially not recommended due to false positives but the later versions have since improved - see here"
X	SPYWATCH	SpyWatch.exe	"BPS spyware remover - not recommended
X	SpyWatchE	SpyWatchE.exe	"SpyWatchE rogue security software - not recommended
X	SQUpdatesChecker	uc.exe	"Xupiter SQWire toolbar related. Use Spybot S&D
X	sr64	[path to trojan]	"Added by the AGENT.X TROJAN!"
X	SrchfstUpdate	srchupdt.exe	SearchFast adware downloader
?	srePostpone	"rundll32.exe [path] srescan.dll	DoSpecialAction"
X	Srv32 spool service	[path to trojan]	"Added by the DLOADER-LB TROJAN!"
X	ssate.exe	irun4.exe	"Added by the BEAGLE.J WORM!"
X	ssate.exe	winsys.exe	"Added by the BEAGLE.K WORM!"
N	SSBkgdUpdate	SSBkgdupdate.exe	"Automatic updates for ScanSoft (now Nuance) products such as OmniPage and PaperPort. Can be disabled using the main program's options. Note - if you have a Soundblaster Audigy2 ZS soundcard installed on your computer and the volume of your sound system is turned on extremely high disabling this will solve the problem"
X	ssgrate.exe	system.exe	"Added by the MITGLIEDER.C TROJAN!"
X	ssgrate.exe	irun.exe	"Added by the MITGLIEDER.D TROJAN!"
X	ssgrate.exe	irun4.exe	"Added by the MITGLIEDER.F TROJAN!"
X	ssgrate.exe	sysdoor.exe	"Added by the MITGLIEDER.N TROJAN!"
X	ssgrate.exe	winerdir.exe	"Added by the MITGLIEDER.O TROJAN!"
X	ssgrate.exe	winsystems.exe	"Added by the BAGLEDL-J TROJAN!"
X	ssgrate.exe	wintems.exe	"Added by the MITGLIEDER.Q TROJAN!"
X	sstata	dwdas.exe	"Added by the DASDA TROJAN!"
X	sstata	[path to trojan]	"Added by the RANCK-DF TROJAN!"
X	SSUpdate	SSUpdate.exe	"MoneyTree parasite - ActiveX control used to download premium-rate dialers"
X	Start aThe Roll	enotxa2.exe	"Added by the RBOT-PV BACKDOOR!"
X	Start aThx Roll	f0mered.exe	"Added by the RBOT.AAV WORM!"
X	Start Uppings	mssupdate.exe	"Added by a variant of the RBOT WORM!"
X	startemdoit	[path to trojan]	"Added by the DLOADR-AVP TROJAN!"
X	startkey	update.exe	"Added by the BIFROSE-DG TROJAN!"
X	Startup Configuration	[six character filename]	"Added by the RBOT-ARV WORM!"
X	Startup Configuration	wztoid.exe	"Added by the RBOT-ASD WORM!"
X	Startup Update	Cvshost.exe	"Added by the GAOBOT.AO WORM!"
X	StartUpDate	[path to trojan]	"Added by the BIFROSE.F BACKDOOR!"
N	Stat 'n' Perf	StatnPerf.exe	"Stat 'n' Perf monitors your internet connection and displays information about sent and received bytes"
X	StatBar	STATBAR.exe	"StatBar (system status bar) allows you to quickly get an overview of your system's condition (memory
X	State Service	csrss.exe	"Added by the DADOBRA-CP TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	StationPlaylistStudio	SPLStudio.exe	"StationPlaylist Studio - ""simple to use on-air broadcast playback software for the studio and/or DJ"" for small to medium sized radio broadcasters
X	Statistics	statslist.exe	"Added by the OPANKI-S WORM!"
X	statloads	pgjd83sa.exe	"Added by the SDBOT-UM WORM!"
N	Status Monitor	BrMfcWnd.exe	Brother scanner status monitor - can be started manually
U	Status Monitor CLJ1500	HPPOUMUI.exe	"Status monitor for the HP Color LaserJet 1500 printer from Hewlett-Packard - for monitoring printer status
N	Status Monitor XE	ENGSS.EXE	The Xerox Document WorkCentre XE Series Status Monitor displays information about your printer and currently active or waiting print jobs. You can use it to control your printing environment and manage your printing operations. Available via Start -> Programs
?	StatusClient	StatusClient.exe	Part of Hewlett Packard network printer drivers
?	StatusClient 2.6	StatusClient.exe	Part of Hewlett Packard network printer drivers
N	StatusView	StatusView.exe	"Status View intra-office messaging"
X	stealth.stat.exe	stealth.stat.exe	"Added by the THEALS.A WORM!"
U	StopSignStatus	stopsinfo.dll	"eAcceleration Stop-Sign security software related. Previously not recommended
X	stratas	xmconfig.exe	"Added by the RBOT-AHR WORM!"
X	stratas	lockx.exe	"Added by the SDBOT-ADD WORM!"
X	Stratas	ggfig.exe	"Added by the OPANKI.W WORM!"
X	strto	[path to trojan]	"Added by the KILLAV-AP TROJAN!"
X	StubPath	Sservice.exe	"Added by the PRORAT TROJAN!"
X	stup	[path to trojan]	"Added by the AGENT-CIL TROJAN!"
X	stxrmsgms	mstats.exe	"Added by the IRCBOT-AE TROJAN!"
X	suicide	tempfile2.bat	"Personal Protector rogue security software - not recommended
X	Sun Java Updater	stacsv.exe	"Added by the BUZUS.DBFM TROJAN!"
X	Sun Java Updater v5	javajre.exe	"Added by the AUTORUN-XI WORM!"
X	Sun Java Updater v7.4	javawx.exe	"Added by the ACKANTTA.B WORM!"
X	SunJava Updater v7	javale.exe	"Added by the ACKANTTA.B WORM!"
X	SunJavaSched Updater	avamx.exe	"Added by the RBOT-ABJ WORM!"
X	SunJavaUpdate	smvss.exe	"Added by the DEDLER-G TROJAN!"
X	SunJavaUpdater	javaw.exe	"Added by the MYTOB.QR WORM!"
X	SunJavaUpdaterv13	javaupdater.exe	"Added by the ROUTROBOT WORM!"
N	SunJavaUpdateSched	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
X	SunJavaUpdateSched	scvhost.exe	"Added by the SDBOT-AVX WORM!"
X	SunJavaUpdateSched	javamx.exe	"Added by the SDBOT-WI WORM!"
X	SunJavaUpdateSched10	jushed.exe	"Added by the ACKANTTA.F WORM!"
X	SunJavaUpdateSched132	jschd.exe	"Added by the AUTORUN-AQY WORM!"
X	SunJavaUpdateSched16	jvshed.exe	"Added by the ACKANTTA.G WORM!"
X	SunJavaUpdatSched	spoolsv.exe	"Added by the BANCBAN-NP TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %ProgramFiles%\MSN Messenger"
U	SuNotification	suatshut.exe	"ShadowSurfer - ""provides a safe computing environment by creating a virtual twin of your PC. Restore the pre-ShadowMode system state no matter what changes have occurred to your PC"""
N	Supastatus	status.exe	"Supanet ISP software"
X	supdate	supdate.exe	"Added by the MALWARE.D TROJAN!"
X	supdate2.dll	"rundll32.exe supdate2.dll	Run"
X	supdate2.dll	regsvr32.exe /s supdate2.dll	"Added by the ZLOB-VL TROJAN! Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The ""supdate2.dll"" file is found in %System%"
X	SuperBar.Component	[path to services.exe]	"Added by the SMALL-AQ TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %System%\Inetsrv"
U	Support.com Scheduler and Command Dispatcher	tgcmd.exe	"Part of software from SupportSoft (aka Support.com) provided to manufacturers and ISPs that allows them to offer on-line support - to update drivers
X	SurfBuddy	rundll32 [path] sbuddy.dll	"SurfBuddy adware - not to be confused with the legitimate SurfBuddy application by SurfApps!. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	SustemUpdate	explorer.exe	"Added by an unidentified VIRUS
X	svcdata.exe	svcdata.exe	"Added by the SPYBOT.ZIF WORM!"
X	svchosd	[path to trojan]	"Added by the BANCOS-BCX TROJAN!"
X	svchost	[path to trojan]	"Added by the HAZZER TROJAN!"
X	svchost	[path] SETUP.EXE	"Added by the SETCLO WORM!"
X	SVCHOST	updater32.exe	"Added by the RANTS.A WORM!"
X	svchost	[path to explorer.exe]	"Added by the UNREAL-A TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually!"
X	SVCHOST Generic application	svchost.exe	"Added by the DAEMONI-K TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	svchost.exe	[path to executeable]	"Added by the BANKER-MO TROJAN!"
X	SvcManager	[path to trojan]	"Added by the ZALON-A BACKDOOR!"
X	SvcSys	[path to file]	"Added by the BANCOS.Z TROJAN!"
X	svcwinprocess32	[path to worm]	"Added by the UPERING WORM!"
X	svhost updates	Svhost.exe	"Added by a variant of the RBOT WORM!"
X	sVideo2	[path to dialler]	"""Switch-D"" premium rate adult content dialler"
X	Svshost Update Service	svcbind.exe	"Added by the MYTOB.LH WORM!"
X	svshostdriver	msnmessengerupdate.exe	"Added by the SDBOT-BI BACKDOOR!"
X	Swf32	AVupdate.exe	"Added by the MERKUR.E WORM!"
N	Switchboard.com Toolbar	AtHoc.exe	"Toolbar for the on-line version of Yellow Pages in the US - Switchboard.com"
U	SWL	rundll32.exe [path] SWL.dll rdl	"StealthWeblog surveillance software. Uninstall this software unless you put it there yourself! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	SYDNEY	[file path]	"Added by the SYNEY WORM!"
X	Sygaete Personal Firewall	SyGate.exe	"Added by the RBOT-GLX WORM!"
X	Sygate Peral Firewall	Syga.exe	"Added by the RBOT-AQK WORM!"
X	Sygate Personal 3	svrv.exe	"Added by the RBOT-XD WORM!"
X	Sygate Personal Block	Studio.exe	"Added by the RBOT-TW WORM!"
X	Sygate Personal Firewall	Win32x.exe	"Added by the RBOT-KZ WORM!"
X	Sygate Personal Firewall	system32.exe	"Added by the RBOT.VI WORM!"
X	Sygate Personal Firewall	sysgut.exe	"Added by the SDBOT.WM WORM!"
X	Sygate Personal Firewall	Sygate.exe	"Added by the RBOT-PN WORM!"
X	Sygate Personal Firewall	Mcafeeupdate.exe	"Added by the RBOT.YN WORM!"
X	Sygate Personal Firewall	Sygate32.exe	"Added by the RBOT.ATW WORM!"
X	Sygate Personal Firewall	MSNSRV32.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personal Firewall	service.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personal Firewall	t1ktik.exe	"Added by the RBOT-VP WORM!"
X	Sygate Personal Firewall	host32.exe	"Added by the RBOT.ALD WORM!"
X	Sygate Personal Firewall	sexy.exe	"Added by the RBOT-XY WORM!"
X	Sygate Personal Firewall	sys.exe	"Added by the RBOT-ZC WORM!"
X	Sygate Personal Firewall	syserror.exe	"Added by the RBOT.UC WORM!"
X	Sygate Personal Firewall	hostserv.exe	"Added by the RBOT.BKO WORM!"
X	Sygate Personal Firewall	msnmsgrs.exe	"Added by the RBOT.XN WORM!"
X	Sygate Personal Firewall	Sygat.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personal Firewall	wins.exe	"Added by the RBOT.AOB WORM!"
X	Sygate Personal Firewall	winxpstat.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personal Firewall	Syga.exe	"Added by the RBOT-AQD WORM!"
X	Sygate Personal Firewall	svchots.exe	"Added by the RBOT.ABT WORM!"
X	Sygate Personal Firewall	win31243.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Sygate Personal Firewall Start	services32.exe	"Added by the RBOT-MB WORM!"
X	Sygate Personal Firewall Start	servic.exe	"Added by the RBOT-RY WORM!"
X	Sygate Personal Port	crss.exe	"Added by the RBOT-PX WORM!"
X	Sygate Personal Port Blocker	volume.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personal Port Blocker	winupdate.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personals Firewalls	ccsrn.exe	"Added by a variant of the RBOT WORM!"
X	Sygates Personal Firewall	sygs.exe	"Added by the RBOT.XB WORM!"
U	SyGateService	sgserv95.exe	"SyGate is a useful little program that lets you share an internet connection over an intranet. Is it needed - it saves a lot of headache to just let SyGate load at startup. Available via Start -> Programs"
X	Symantec Antivirus professional	dfrgfrat.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	autoformat.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Configuration Loader	ccApp32.exe	"Added by the AGOBOT-EE WORM!"
X	SymantecFilterCheck	[path to trojan]	"Added by the BANKER-EIN TROJAN!"
X	Symlcs	[path to file]	"Added by the YASPY-A TROJAN!"
U	SymmTime Application	GeTTime.exe	"SymmTime from Symmetricon - freeware utility that ""synchronizes your PC clock to Coordinated Universal Time (UTC)
U	Sync Data	Hndsync.exe	"Pocket Real Estate - mobile synchronization manager"
X	Sync Server	drwatsoon.exe	"Added by the WATSOON.A TROJAN!"
X	Synchronization Agent	mobsynca.exe	"Added by the RANDEX-E WORM!"
U	Synchronization Manager	mobsync.exe	"Microsoft Synchronization Manager for 2K/XP - used to update network copies of materials that were edited offline
X	Synchronization Manager	rservers.exe	"Added by the FORBOT-FM WORM!"
X	Syntax Script	saskatcw.exe	"Added by the SDBOT-TE WORM!"
X	Sys-Stat	wuapdxe.exe	"Added by the SDBOT.HK WORM!"
X	SysATW	sysatw.exe	"Added by the VANEBOT-AM WORM!"
U	SysBkup	[path to file]	"Keyspy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	Sysctrls	winupdate.exe	Added by an unidentified WORM or TROJAN!
X	sysdat.dll	sysdat.dll.exe	Added by the NISHICA 1.1 TROJAN!
X	SysData	[path to file]	"Added by the RANCK-BA TROJAN!"
X	sysformat	sysformat.exe	"Added by the BAGLE-BK WORM!"
X	Sysgate Personal Firewall	syst3ms.exe	"Added by a variant of the IRCBOT TROJAN!"
X	sysin	[path to file]	"Added by the DSRC-A TROJAN!"
X	sysnate	sysnate.exe	"Added by the MEDIAS TROJAN!"
X	syspath	drv.exe	"Added by the SOBER WORM!"
X	SySPower	[path to trojan]	"Added by the BANCBAN-OC TROJAN!"
X	Syss	ehuupdate.exe	"EHU adware"
X	sysser	[path to file]	"Added by the RAHACK WORM!"
X	System	Atira.exe	"Added by the KOTIRA VIRUS!"
X	System	Updaterun.exe	"Added by the QQHELP-DX TROJAN!"
X	System Applications Profile	sap.exe	"Added by the RBOT-QF WORM!"
X	System Buffer Application	buffer32.exe	"Added by the SDBOT-UD WORM!"
X	system check	updater.exe	Unidentified adware downloader
X	System Configuration	iexplore.exe	"Added by the RANDEX.AD WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	System Configuration	syscfg32.exe	"Added by the MYTOB.EA WORM!"
X	System Configurator32	SYSTEMCFG.EXE	"Added by the AGOBOT-KS WORM!"
X	System CSRSS Patch	scrtkfg.exe	"Added by the RBOT-ADA WORM!"
X	System Database administration	systemDA.exe	"Added by the DERDERO.B WORM!"
X	System Database Administration Support Process	sysdasp.exe	"Added by the DERDERO.C WORM!"
X	System DataBase Root	sysdbroot.exe	"Added by the QHOST-W TROJAN!"
X	System Document Application	nmod.exe	"Added by the SDBOT-ABB WORM!"
X	System Document Application	msdocument.exe	"Added by the RANDEX.COX WORM!"
X	System Document Application	wins.exe	"Added by the SDBOT.AUB WORM!"
X	System Document Application	winsvc32.exe	"Added by the SDBOT-VA WORM!"
X	System Error Notification	senr32.exe	"Added by the POISON-BT TROJAN!"
X	System Failure Statistic	cnstat.exe	"Added by the RBOT-LF WORM!"
U	System Files Updater	System Files Updater.exe	"System Files Updater from Flyakiteosx ""will transform the look of an ordinary Windows XP system to resemble the look of Mac OS X"""
X	System Information Manager	Navcpe.exe	"Added by the SDBOT-QB WORM!"
X	System Information Manager	Msbb.exe	"Added by the SLINBOT.YR BACKDOOR!"
X	System Information Manager	iexplore.exe	"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	System Information Manager	mslog.exe	"Added by the DELF.AKO TROJAN!"
X	System Information Manager	no.exe	"Added by the SPYBOT.NO WORM!"
X	System Information Manager	syspass.exe	"Added by the SDBOT-MO WORM!"
X	System Information Manager	win.exe	"Added by the SDBOT-MU WORM!"
X	System Information Manager	windowsNt.com	"Added by the SDBOT-ND WORM!"
X	System Initialization	msmsgri32.exe	"Added by the RANDEX.D WORM or ROXY or ROXY.B TROJANS!"
X	System Initialization	payload.dat	"Added by the RANDEX.D WORM or ROXY or ROXY.B TROJANS!"
X	System Manager Updates	winsvc.exe	"Added by the AGOBOT.AEM WORM!"
N	System Mechanic Professional Update [Incinerator.dll]	SysMech4.exe /REREG: [path] Incinerator.dll	"Iolo System Mechanic ""Incinerator"" feature securely deletes files and folders from your PC so they can never be recovered again"
X	System Net Database	sysnd.exe	"Added by the RBOT-AAW WORM!"
X	System Process Analization	sysproc.exe	"Added by a variant of the RBOT WORM!"
X	System Process Analization Thread	system.exe	"Added by a variant of the RBOT WORM!"
X	System Restore Data	[path] repcale.exe [path] beird.exe	"Added by the RANDON.AN WORM! Both files are located in %System%\frbyjed"
X	System Security Updaters	vsmons.exe	"Added by the RBOT-OW WORM!"
X	System service78	[path to file]	"Added by the ELITEBAR-T and ELITEBAR-U TROJANS!"
X	System service79	[path to file]	"Added by the ELITEBAR-V TROJAN!"
X	System Stats	SystemStats.exe	"Added by a variant of the WOOTBOT WORM!"
X	System time updator	CSysTime.exe	"Added by the RANDEX.S WORM!"
X	system updata	updata.exe	"Added by the LINEAGE-C TROJAN!"
X	System Update	[filename].exe	"CoolWebSearch parasite variant"
X	System Update	[random filename]	"Added by the KORGO.W or KORGO.X WORMS!"
X	System Update	wupdmgr.exe	"Added by the SOROMO-A TROJAN!"
X	System Update	[random filename]	"Added by the SOROMO-A TROJAN!"
X	System Update	wauluclt.exe	"Added by the SDBOT.EF WORM!"
X	System Update	[path to trojan]	"Added by the AUTOTROJ-D TROJAN!"
X	System Update	mssetupconf.exe	"Added by the RBOT.DLC WORM!"
X	System Update Application	msbuffer.exe	"Added by the SDBOT.AFF WORM!"
X	System Update Service	wmiprvsa.exe	"Added by the AGOBOT-RG TROJAN!"
X	System Update Service	winupd32.exe	"Added by the ADTODA-A TROJAN!"
X	System Update Service	system.pif	"Added by the RBOT-ALL WORM!"
X	System Update Service	update.pif	"Added by the SPYBOT.WOE WORM!"
X	System Update Service	wmiprvsv.exe	"Added by the AGOBOT.YG WORM!"
X	System Update Service	csrss32.exe	"Added by the AGOBOT-HI WORM!"
X	System Update2	explorer.exe	"Added by the AUTOTROJ-C TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	System Update2	services.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	System Update2	svchost.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	System Update2	system.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	taskman.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	taskmon.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate Win98/Me file of the same name which is located in %Windir% as this version is located in %System%. It is not normally found on a WinXP system"
X	System Update2	update.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	webcheck.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	wininet.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	winlogon.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate winlogon.exe process
X	System Update2	winspool.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	wupdmgr.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Updated	svchoes.exe	"Added by the RBOT-ASF WORM!"
X	System Updater Machine	crhwss.exe	"Added by the CIADOOR-DQ TROJAN!"
X	System Updater Machine	system.exe	"Added by the CIADOOR.GN BACKDOOR!"
X	System Updater Process	wmiprvsw.exe	"Added by the AGOBOT-IL WORM!"
X	System Updater Service	wmiprvsw.exe	"Added by the GAOBOT.AFC WORM!"
X	System Updates	winsci.exe	"Added by a variant of the RBOT WORM!"
X	System Updates	szwi.exe	"Added by the RBOT-AXE WORM!"
X	System Updates	unve.exe	"Added by the RBOT-AWG TROJAN!"
X	System Updates	wmkl.exe	"Added by the RBOT-AYJ WORM!"
X	System Updates 4	mssysfix.exe	"Added by the RBOT-ADU WORM!"
X	System Updates Manager	winserv32.exe	"Added by the AGOBOT-AGA WORM!"
X	System Updates Service	updates.pif	"Added by the RBOT-AMA WORM!"
X	System-Stat	systats.exe	"Added by the SDBOT.RA WORM!"
X	SystemAdministration	Wincmp32.exe	"Added by the ASYLUM TROJAN!"
X	SystemBooster2009	sbr_updater.exe	"SystemBooster2009 rogue system suite - not recommended
X	SystemData	MBlocker.exe	"Messenger Blocker rogue security software - not recommended"
X	Systemiom Updater	Systemiom.exe	"Added by the SPYBOT.TY WORM!"
U	SystemKey	rundll32.exe [path] SystemKey.dll rdl	"Stealth Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	SystemMessenger	rundll32.exe [path] SystemMessenger.dll	"Stealth Chat Monitor spyware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	SystemMigration	WinMedia.exe	"Added by the KELVIR.EI WORM!"
X	SystemUpdate	Negdo.exe	"Added by the CULLER-C WORM!"
X	SystemUpdate	Xeyu.exe	"Added by the CULLER-D WORM!"
U	SystemWeb	rundll32.exe [path] SystemWeb.dll rdl	"StealthWeblog surveillance software. Uninstall this software unless you put it there yourself! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	systemyom Updater	systemyom.exe	"Added by a variant of the IRCBOT TROJAN!"
X	SYSTEMZ Patch	SYSZ.exe	"Added by the ALADINZ.P TROJAN!"
X	systrans	[path to trojan]	"Added by the STARTPA-GZ TROJAN!"
X	Systray	KAT.vbs	"Added by the SOAD-D WORM!"
X	Systry	[path to worm]	"Added by the AUTEX WORM!"
X	Systryt	[path to worm]	"Added by the AUTEX WORM!"
X	sysupdate	cmman32.exe	"Added by a variant of the SDBOT WORM!"
X	taengtae	AutoRun.bat	"Added by the GATINA-B WORM!"
N	Tahni Deskmate	Tahni.exe	"Tahni Deskmate - "Interactive cartoon character that lives on your Windows desktop""
X	talk	talk.bat	"Added by the TIOTUA-G WORM!"
X	TANG_INA_MO	AutoRun.bat	"Added by the FILUKIN.A WORM!"
U	Task Catcher	tasktrap.exe	"Real-time monitor for Task Catcher from BillP Studios - which ""allows you to efficiently monitor programs running on your computer without slowing you down or hogging all your memory. Task Catcher will block unwanted programs from running and restart your favorite programs if they are disabled or crash"". If the program isn't registered the monitor will initially load and then close at start-up. If registered it will continue to run and optional System Tray access will also be available"
U	Task Catcher Monitor	tasktrap.exe	"Real-time monitor for Task Catcher from BillP Studios - which ""allows you to efficiently monitor programs running on your computer without slowing you down or hogging all your memory. Task Catcher will block unwanted programs from running and restart your favorite programs if they are disabled or crash"". If the program isn't registered the monitor will initially load and then close at start-up. If registered it will continue to run and optional System Tray access will also be available"
U	Task Catcher Real-Time Detector	tasktrap.exe	"Real-time monitor for Task Catcher from BillP Studios - which ""allows you to efficiently monitor programs running on your computer without slowing you down or hogging all your memory. Task Catcher will block unwanted programs from running and restart your favorite programs if they are disabled or crash"". If the program isn't registered the monitor will initially load and then close at start-up. If registered it will continue to run and optional System Tray access will also be available"
X	Task manager	UPDATEWIN.exe	"Added by the RBOT.BBS WORM!"
X	Taskman	KHATRA.exe	"Added by the AUTORUN-AKR WORM!"
X	Taskman	sysdate.exe	"Added by the SILLYFDC.BCQ WORM!"
X	TaskManager	[path to trojan]	"Added by the LDPINCH-CF TROJAN!"
X	Taskmgo	[path to file]	"Added by the BANCBAN-T TROJAN!"
X	taskmgr	[path to trojan]	"Added by the AGENT-ENV TROJAN!"
X	taskmngr	[path] msnve.exe [path] task.exe	"Added by the FLOOD-EK TROJAN!"
X	TaskMon	[path to trojan]	"Added by the DROPPER.EAT TROJAN!"
X	taskmrg.exe	[path to trojan]	"Added by the BANCBAN-BN TROJAN!"
X	taskmsgs	[path to trojan]	"Added by the BANCOS-BBW TROJAN!"
X	Tasmgr	Taskmgr.bat	"Added by the YPSAN.G WORM!"
X	tat	tatss.exe	"Delfin Promulgate adware variant"
X	Tcp Application Manager	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	TCPXP Update	tcpxp.exe	"Added by the RBOT-UL WORM!"
X	tcupdater	tcupdater.exe	Topconverting.com/180Search adware updater
Y	TeaTimer	TeaTimer.exe	"Part of the popular Spybot - Search & Destroy spyware removal tool from Safer Networking Limited. ""Resident TeaTimer is a tool of Spybot-S&D which perpetually monitors the processes called/initiated. It immediately detects known malicious processes wanting to start and terminates them giving you some options
Y	Telepath	telepath.exe	"Drivers for the WinModem versions of the US Robotics ""Telepath"" series - as supplied to Gateway for instance. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information"
U	TelstraClear Broadband Support	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	TELUS eCare	matcli.exe	"TELUS Resolution Assistant. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	Terminal Update	biosefui.exe	"Added by the PPDOOR-O TROJAN!"
X	Terminate Popup	ZPU.exe	"Free Popup Killer - foistware proven to install the Regsvc32 homepage hijacker. Also see here"
X	Terminate Popup	fpuk.exe	Popup killer - foistware proven to install the Regsvc32 homepage hijacker
N	Tesco.net	"rundll32 [path] RyDial.dll	QuickStart"
X	Testing 123	msdata.dat	"Added by the NITS.A WORM!"
N	Textbridge Instant Access OCR	telepath.exe	"TextBridge from Nuance (was Scansoft). OCR (optical character recognition) software for scanning documents into popular editing applications. Available via Start -> Programs"
U	The Easy Bee's Hive	ATCEgSvr.exe	"The Easy Bee is a software that allows you to record Internet navigation sequences
X	TheMonitor	[path to trojan]	"Added by the DLOADR-LO TROJAN!"
N	ThinkPad Configuration Utility	TP98TRAY.EXE	"System Tray access to the ThinkPad Configuration utility for IBM/Lenovo ThinkPad notebooks. ""The ThinkPad Configuration utility is a control center to configure your ThinkPad hardware. With this utility
U	ThinkPad Presentation Director	NPDTray.exe	System Tray access to Presentation Director for IBM/Lenovo Thinkpad notebooks - which allows you to create and quickly select between various single and mulitple display options. Scheme selection and settings are also available via Fn+F7 key combination on some models
Y	ThreatFire	TFTray.exe	"System Tray access to ThreatFire no-signature anti-malware from PC Tools - which ""features innovative real-time behavioral technology that provides powerful protection against both known and unknown viruses
X	Time Zone Synchronization	wscript zshell.js	"Added by the NETDEX-A TROJAN!"
N	Tiny Watcher Logon Time	Watcher.exe	"Tiny Watcher detects changes to your system. It will not prevent your system from being modified or corrupted. It will only tell you that something suspicious happened. Think of it as an early CAT scan against system tumors. Better to install a tool that will detect and remove bad items"
U	Titlebar Date	Titlebar Date.exe	"Titlebar Date by Titlebar Software - displays the day of the week and date and time in the active window's tile bar. For example
X	tjstartup	[path to file]	"Added by the TJSERV.C TROJAN!"
X	tlc	update911.js	Hijacker installer
U	TLogonPath	tb2logon.exe	"Timbuktu Pro - remote desktop access software"
X	tmax	pupdate.exe	Adware pop-up generator
X	Tok-Cirrhatus	IDTemplate.exe	"Added by the RONTOKBRO.A WORM!"
X	Tok-Cirrhatus	smss.exe	"Added by the BRONTOK-A WORM and variants! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %AppData%"
X	Tok-Cirrhatus	[path to file]	"Added by the BRONTOK-F WORM!"
X	Tok-Cirrhatus-1464	br3951on.exe	"Added by the BRONTOK.AD WORM!"
X	Tok-Cirrhatus-1959	br4941on.exe	"Added by the BRONTOK-J WORM!"
X	Tok-Cirrhatus-1959	[random].exe	"Added by the BRONTOK-CF WORM!"
X	Tok-Cirrhatus-1959sarc	sv711224030r.exe	"Added by the BRONTOK-R WORM!"
X	Tok-Cirrhatus-1959sarc	yesbron.com	"Added by the BRONTOK-R WORM!"
X	Tok-Cirrhatus-2454	br5931on.exe	"Added by the BRONTOK.AD WORM!"
X	Tok-Cirrhatus-2784	br6591on.exe	"Added by the BRONTOK-L WORM!"
X	Tok-Cirrhatus-2784	smss.exe	"Added by the BRONTOK-S WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %AppData%"
X	Tok-Cirrhatus-[4 random digits]	br[4 random digits]on.exe	"Added by the BRONTOK-M WORM!"
?	TomcatStartup	hpbpsttp.exe	"Apache Tomcat web server
?	TomcatStartup 2.5	hpbpsttp.exe	"Apache Tomcat web server
X	topat	zlip.exe	"Added by the FLOOD-IG TROJAN!"
X	Torjan Program	[path to trojan]	"Added by the LEGMIR-BO TROJAN!"
U	Toshiba Key State	KEYSTATE.EXE	"Displays an icon in the System Tray indicating the state of the CAPS LOCK key. Can be handy on (e.g.
N	Toshiba Registration	ToshibaRegistration.exe	Toshiba Registration - available via Start -> Programs
N	Toshiba TEMPO	Toshiba.Tempo.UI.TrayApplication.exe	"TEMPO is a software service developed by Toshiba. It will advise you on how to fine-tune the performance of your notebook and keep you informed of the latest Toshiba software and driver updates as soon as they are released. It does this by delivering various types of alerts into a special TEMPO inbox area on your notebook PC"
U	TOSHIBA Volume Indicator	VolControl.exe	On-screen volume indicator for Toshiba notebooks
U	TosRotation	TRot.exe	TOSHIBA Rotation Utility - allows users to rotate a notebook's screen image 180 degrees in order to share information on the screen with others seated across a table or desk
N	tourpath	regedit /s [path] tour.reg	"Edits registry values to keep the Win 2000 ""tour"" in Task Scheduler"
X	tpcupdater	updatetc.exe	"Antivirus XP 2008 rogue security software - not recommended"
X	trackerx90.th.gs	anti_data_exe_by_trackerx90.exe	"Added by the BCKDR-QIT BACKDOOR!"
U	TrackPoint Accessibility Features	tp4ex.exe	"Supports accessibility features for the TrackPoint stick and associated buttons on IBM/Lenovo ThinkPad notebooks. If features such as ""Click Sound""
N	Tray Date	Tray Date.exe	"Tray Date by Titlebar Software - displays a simple icon in the System Tray (that can't be configured) which shows the current date. The originator's website is no longer available but you can still download it here. Whilst it only uses around 10MB of memory
N	Tray Temperature	Weatherbug.exe	"Weatherbug provides current outdoor temperature in the System Tray
U	traydate.exe	TRAYDATE.EXE	TrayDate - displays the date as well as the time in the System Tray
X	Trickler	[path to file]	"GAIN adware. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	TrojanSimulator	TSServ.exe	"Trojan Simulator security risk which simulates a trojan infection and may be used to verify whether a virus scanner can properly detect the file"
X	ttaa	tata.exe	"Added by the LINEAGE-T TROJAN!"
?	Tukati	TukatiRedistributor.exe	"Tukati Digital Content Distribution. Is it required?"
X	TurboNet	[path to trojan]	"Added by the RENOS-EA TROJAN!"
?	Tvwatch	tvwatch.exe	"Associated with the TV-oOut option on Asus AGP or Intel graphics cards. Is it required?"
X	type	bat.exe	"Added by the ANSKYA-A WORM!"
N	TypingSatellite	KBOOST.exe	"Typing Master 2002 background utility that collects typing errors and builds up customised typing lessons for your needs. Available via Start -> Programs"
U	U.S.Robotics WLAN Adapter Configuration Utility	USRWLAN.exe	"U.S.Robotics LAN Adapter - wireless LAN (WLAN) configuration utility"
X	Uate	oocs.exe	"PurityScan adware"
U	UCmore XP - The Search Accelerator	"rundll32.exe UCMTSAIE.dll	DllShowTB"
N	UIWatcher	UIWatcher.exe	"Part of the Ashampoo® UnInstaller series from Ashampoo GmbH & Co. KG - including UnInstaller Platinum 2
X	Ultimate Cleaner	UltimateCleaner.exe	"Ultimate Cleaner rogue security software - not recommended
X	Ultimate Defender	UltimateDefender.exe	"Ultimate Defender rogue security software - not recommended
X	Ultimate Fixer	UltimateFixer.exe	"UltimateFixer rogue system error and cleaning utility - not recommended"
X	Ultimate System Guard	MainFAVProj.exe	"Ultimate System Guard rogue security software - not recommended
X	UltimateBuddy	UltimateBuddy.exe	"UltimateBuddy - installs malware
X	UltimateServices	ultsvcs.exe	"Added by the AGENT-LGT TROJAN!"
N	UltimateZip Quick Start	uzqkst.exe	"UltimateZip - file compression utility"
X	UpData	wupdata.exe	"Added by the IRCBOT-AA TROJAN!"
X	Update	[original file path]	"Added by the LYNDEGG WORM!"
X	Update	CDUpdater.exe	"""Carpe Diem"" adult premium rate dialler related"
X	Update	Sysupd.exe	Added by the SLACKBOT VIRUS!
X	Update	Zupdate.exe	"Associated with B3d Projector foistware - see here"
X	Update	mshtm.exe	Browser hijacker - redirecting to buldog-search.com
X	Update	UPDATE-28062004.exe[25 blank spaces].vbs	"Added by the MIDFIN WORM!"
X	update	winis.exe	"Added by the RBOT-VD WORM!"
X	update	r00t.exe	"Added by the RBOT-ACO WORM!"
X	UPDATE	WinUpdater5.0.vbs	"Added by the GORMLEZ-A WORM!"
X	UpDate	RAuth.exe	"Added by the DLOADER-UL TROJAN!"
X	Update	csrss.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Update	csrss.exe	"Added by the MEHEERWAR TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""winupdate"" subfolder"
X	Update	lsass.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Update	svchost.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Update	Update.exe	"QuickButton adware"
X	Update	hanz.exe	"Added by a variant of the RBOT-GLJ WORM!"
X	Update	WinUpdate.exe	"Added by the SDBOT-CV BACKDOOR!"
X	Update Checker	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	Update Checker	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	update driver	SNDVOL32.EXE	"Added by the SPYBOT-CU BACKDOOR!"
X	Update Explorer	iexploreupd.exe	"Added by a variant of the RBOT WORM!"
X	Update for Windows	[various filenames]	"Added by the LERPA-A WORM! Note - the file name will be one of the following common.exe
?	Update for Works	MSWkstz.exe	"Maybe related to later versions of MS Works?"
N	Update Grokster	WiseUpdt.exe	"Automatically updates the Grokster file sharing software. Beware of adware and spyware when using this type of program
X	Update Install	Schost.exe	"Added by the GAOBOT.AO WORM!"
?	Update local	SetCPQLC.exe	"Running on a Compaq desktop. Any ideas?"
N	Update Manager	UpdateManager.exe	"Searches for updates for the Rogers Yahoo! Browser - can be run manually"
X	update mon sys	updaterar.exe	"Added by a variant of the RBOT WORM!"
X	update run dos	logon.exe	"Added by a variant of the SDBOT WORM!"
X	Update Run MSword	LOGON.EXE	"Added by the RBOT.TY WORM!"
Y	Update Service	Update.exe	"Loaded by Handybits programs such as EasyCrypto. Re-instates itself every time the program is run so best to leave it enabled. Prevent it dialling out via a firewall"
X	update service	svxhost.exe	"Added by the RBOT-MG WORM!"
X	Update Service	winu32.exe	"Added by the RBOT-MG WORM!"
X	update service	winx.exe	"Added by a variant of the RBOT WORM!"
?	Update TUT	WiseUpdt.exe	"??"
X	Update ver 1.0	Swap.exe	"Added by the SWAP-C WORM!"
X	Update Windows	EXPLORE.EXE	"Added by a variant of the SDBOT WORM!"
X	Update Windows	EXPLORE.EXE	"Added by a variant of the SDBOT WORM!"
X	Update.exe	ravseuper.exe	"Added by the QQPASS-P TROJAN!"
X	Update32	configs.exe	"Hijacker
X	UpdateCheck	winstall.exe	"Added by the SPYBOT-CY WORM!"
N	UpdateChecker	UpdateChecker.exe	"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
X	UpdateComponent	CNF UPD.EXE	Added by the SPYBOT.GEN VIRUS!
?	UpdateFW	fwdload.exe	"Appears to be firmware update software for a Network Associates ATMbook OC-3 SMF Interface Module?"
?	UPDATEHOOK	Rundll32.exe	"??"
X	updatelavasoft	updatelavasoft.exe	"CoolWebSearch parasite variant - redirecting to lalasearch.com"
U	UpdateManager	sgtray.exe	"StorageGuard from Veritas (this version by Sonic). Free utility that integrates with Backup MyPC (formerly Backup Exec Desktop)
X	UpdateManager	updmanager.exe	"Added by the ANYHOMB.F TROJAN!"
X	UpdateMedia	UpdateMedia.exe	"MediaUpdate foistware"
X	UpdateMgr	updmgr.exe	"SouthBeachTel premium rate adult content dialer"
N	updateMgr	AdobeUpdateManager.exe	Automatic updates for the Adobe Reader file viewer
N	updatemgr.exe	updatemgr.exe	"Once a month
X	UPDATEMSN	svhost.exe	Added by an unidentified WORM or TROJAN!
X	updater	wupdater.exe	"KeenVal adware"
?	updater	updater.exe	"??"
X	Updater	adservernow.exe	"AdServerNow adware"
X	updater	wisvc.exe	"Added by the ORSE-A TROJAN!"
X	UpDaTer	csrss.exe	"Added by the AUTORUN.DIB WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~� subfolder"
X	Updater Service Process	svhost32.exe	"Added by the AGOBOT.TY WORM!"
X	Updater Service Process	csrss32.exe	"Added by the AGOBOT-GP BACKDOOR!"
X	updater32	winload32.exe	"Added by the CULT.M WORM!"
X	updatereal	realupdate.exe	Chinese originated adware
X	UpdaterUI	UpdaterUI.exe	"Added by the AGENT-TM TROJAN!"
X	Updates	msupdate.exe	"CoolWebSearch parasite variant"
N	Updates from HP	backweb*****.exe	"See here - ""messaging service that automatically sends you support information
N	Updates from HP	Updates from HP.exe	Automatically detects an internet connection and downloads any available updates
X	updatesched	[random filename]	"ZenoSearch adware"
X	UpdateService	wservice.exe	"Added by the DREF-K WORM!"
X	Updatestats	Updatestats.exe	"Statblaster adware"
X	UpdateStats	UpdateStats.exe	"SeekSeek search hijacker related - see here"
N	updatev01	updatev01.exe	Ultra-networks.com software updater/downloader
X	updatewin	update.exe	"Added by a variant of the SDBOT WORM!"
X	UpdateWin	[random filename]	"Added by the IRCBOT.AZW BACKDOOR!"
X	updateWins	systrey.exe	"Added by the RANDON WORM!"
?	Updatewiz	updatewiz.exe	"??"
X	UpdateXpSp	MS045-XP2.exe	"Added by the IRCBOT.NY TROJAN!"
X	updatexwin	winxrpc.exe	"Added by the AGOBOT-KJ WORM!"
N	UPDATE~1	updatemgr.exe	"Once a month
X	upddateit	winit.exe	"Added by the RBOT-MS WORM!"
X	UPNP	[path to trojan]	"Added by the DROPPER.EAT TROJAN!"
U	Upromise Update	UpromiseUa.exe	"Updater for the Upromise college savings program"
X	UpToDate	uptodate.exe	"BrowserAid/BrowserPal foistware"
X	uptolate	nucle.exe	Added by a variant of the BIFROSE TROJAN!
X	USB 2.0 Driver	updateXPSPC.exe	"Added by the AGOBOT-RJ WORM!"
X	USB 2.0 Driver	updateXP.exe	"Added by the AGOBOT-QP WORM!"
X	USB 2.0 Driver	UpdateXPSP.exe	"Added by the AGOBOT-QD WORM!"
X	USB 2.1 Driver	winupdate1.exe	"Added by a variant of the RBOT WORM!"
X	USB Driver4	UpdateXP*.exe [* = random digit]	"Added by a variant of the SDBOT WORM!"
X	USB Drivers1	msupdate.exe	"Added by a variant of the RBOT WORM!"
?	USB Hub Keyboard Patch	SKBPATCH.EXE	USB HUB Update
X	USB MS Update	USBS.exe	"Added by a variant of the RBOT WORM!"
X	USB Updates	mservices.exe	"Added by a variant of the SDBOT WORM!"
X	USB Updates	msfirewalls.exe	"Added by a variant of the RBOT WORM!"
X	USB Updates 2	wugfixx.exe	"Added by a variant of the RBOT WORM!"
X	USBConfigration2	wmmndir.exe	"Added by the AGOBOT-SV WORM!"
X	UsbD	[path to trojan]	"Added by the CIDRA-F TROJAN!"
X	USBHWINFO	[path to trojan]	"Added by the LOWZONE-I TROJAN!"
X	usbn	[path to trojan]	"Added by the HOGIL-C TROJAN!"
X	user logon	[path to worm]	"Added by the PAHATIA-A WORM!"
N	Usrobotics Online Registration	??	Pop-up reminding customers to register their products online at US Robotics
X	UtilisateurSur	SysRep.exe	"UtilisateurSur
U	VAIO Update 2	VAIOUpdt.exe	Related to Sony Vaio Update service
X	ValidData	[path to trojan]	"Added by the RANKY.H TROJAN!"
X	VBS_AUTO_UPDATE	0548656X.vbs	"Added by the GORMLEZ-A WORM!"
X	VC5MediaPlayer	[path to file]	"Added by the DEDLER-D TROJAN! The most common filenames seen are ""csmss.exe"" and ""csmrs.exe""
X	VCatch	Vcatch.exe	"CommonSearch Vcatch - ""antivirus"" software which actually bundles spy/adware itself!"
X	VCatch Premium	VCatchpre.exe	"VCatch antivirus. Considered spyware itself - see here"
?	VCDWATCH	VCDWATCH.EXE	"Confirmed as Voyetra CD Watcher as it was found in a Compaq/Voyetra/AS2 directory but what does it do?"
X	Vdat Update	lalaa.exe	"Added by a variant of the RBOT WORM!"
U	Venturi Configurator	ventcfg.exe	"Venturi Wireless mobile broadband configuration utility"
U	VERBATIM STORE 'N' G	verbatim store 'n' go.exe	"Loads the driver for the Verbatim Store'n'Go PRO USB Flash Drive - reportedly required only on systems running Windows 98 and Millennium"
X	Veritas Patch	veritas.exe	"Added by the RBOT-XT WORM!"
U	Verizon Online Support Center	matcli.exe	""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	versato	versato.exe	"""Hot"" button (such as volume and browser control) management and a CD player as supplied with QTronix (as possibly Micro Innovations) keyboards"
X	VGATune	VGATune.exe	"Added by the RBOT-AWM WORM!"
X	Vidcompat	Vidcompat.exe	"Added by the GEMA TROJAN!"
X	VidiaDrivers	[path to trojan]	"Added by the RANKY.U TROJAN!"
X	vietato.exe	vietato.exe	Adult content dialler
U	ViewpointPhotosDeviceConnect	FotomatDeviceConnect.exe	"Related to Viewpoint which is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything ""bad"". This will change from what we know in 2006 according to this article. You can remove it via Start -> Settings -> Control Panel -> Add/Remove Programs list..."
U	Virtuele Katja	VKatja.exe	"Virtuele Katja - have an attractive moviestar parade on your Desktop and help you search the Dutch ""Gouden Gids"" business directory too..."
X	Virus Melt	[path to executable]	"Virus Melt rogue security software - not recommended
X	Virus Removal Tool	[path to trojan]	"Added by the TOMETA-B TROJAN!"
X	virusbye	virusbyeUpdater.exe	"VirusBye rogue security software - not recommended"
X	VirusHeat 3.9	VirusHeat 3.9.exe	"VirusHeat rogue security software - not recommended
X	VirusHeat 4.3	VirusHeat 4.3.exe	"VirusHeat rogue security software - not recommended
X	VirusHeat 4.4	VirusHeat 4.4.exe	"VirusHeat rogue security software - not recommended
X	VirusIsolator	VirusIsolator	"VirusIsolator rogue security software - not recommended
X	VirusIsolator.exe	VirusIsolator.exe	"VirusIsolator rogue security software - not recommended
?	VirusScanMSC	VsStat.exe	"Part of McAfee VirusScan. System Tray application as with previous versions (were also VsStat.exe)
X	VMware User Process	KHATRA.exe	"Added by the AUTOIT.K TROJAN!"
U	VMware Workstation	vmware-tray.exe	"System Tray access to virtual machines (VMs) currently in a ""powered on"" state in VMware Workstation - which ""makes it simple to create and run multiple virtual machines on your desktop or laptop computer"". Can be helpful if VMs are configured to run ""headless"" at Windows startup
N	VMware Workstation	hqtray.exe	"VMware Host Network Access Status Tray Application - part of both VMware Player (from version 2.0) and Workstation (until version 6.5) - which allow you to ""run multiple operating systems simultaneously on a single PC."" It's function is uknown at present and it displays no tray icon as the name suggests. Can be disabled without affecting the operation of either product"
X	VnCplUpdate	msdm.exe	"Masssend - spam relayer. Listens on a port for the spammers to feed it a list of addresses and what to send out. More information in
X	Volume Shadow Configuration	vbmsvc.exe	"Added by the SLENFBOT.DH WORM!"
N	VoyetraTray	vtray.exe	This provides an abbreviated Control Group for the Turtle Beach Montego II sound functions/associated with AudioStation 3 and 32
Y	VsStatEXE	VSSTAT.EXE	From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Communicates between VSSTAT.EXE and the VShield System Scan module. Can be started automatically or available via Start -> Programs
X	vXCXssdss	[path to trojan]	"Added by the RANCK-BO TROJAN!"
X	VxD Driver Initialization	ntsvxd.exe	"Added by the SDBOT-LW WORM!"
X	W32data	eworo.exe	"Added by a variant of the RBOT WORM!"
N	Watch	watch.exe	Found to be used by a Trust USB scanner for auto starting the scanning software when the lid is lifted
U	Watch	1200UBWATCH.EXE	Button press monitor for the Mustek 1200 UB Scanner
N	Watch Dog Program	watchdog.exe	For Compaq PC's. Associated with Compaq's internet services. Not required if you don't use services provided by them and may not be required even if you do
N	Watchdog	Watchdog.exe	"Definitely part of the Mustek scanner drivers and software (for 600 III EP Plus and maybe others)
?	WatchDog	watchdog.exe	"Part of Motorola ""Mobile Phone Tools"" v3 - in a ""Mobiile Phone Tools"" sub-directory of Program Files"
?	WatchDog	DVDCheck.exe	"Related to an Intervideo program. What does it do and is it required in startup?"
U	WatcherHelper	WaHelper.exe	"Sierra Wireless Watcher™ - wireless configuration utility"
N	WatchWAN	WatchWAN.exe	"WatchWAN keeps an accurate account of the data that is flowing between your computer and the Internet at any given moment. This readout is presented in both numerical and graphical format
U	Watson Subscriber for SENS Network Notifications	dwtrig20.exe	"Used to launch Microsoft Error Reporting (DW20.exe) - if
U	WDDMStatus	WDDMStatus.exe	"WD Drive Manager - part of Western Digital's WD SmartWare management software for selected external drives in the My Book and My Passport range. Allows the user see the drive status
N	WEATHER	WEATHER.EXE	"Weatherbug provides current outdoor temperature in the System Tray
U	Weather Pulse	weatherpulse.exe	"Weather Pulse from Tropic Designs. ""Display popular Satellite images and video from around the globe
N	WeatherCast	Weather.exe	Weather reporting in the System Tray. Available via Start -> Programs. Installed via Radlight
N	WeatherEye	WeatherEye.exe	"WeatherEye - desktop weather from TheWeatherNetwork"
X	WeatherOnTray	WeatherOnTray.exe	"Hotbar adware"
X	WeatherOnTray	SbWeatherOnTray.exe	"Hotbar adware"
N	Weatherscope	Weatherscope.exe	"WeatherScope - ""displays your current local temperature in the system tray of your computer (near the clock) whenever you are online!"" Not recommended as it bundles GAIN adware. You can get the adware free version for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	WeatherStudio Desktop	WeatherStudio Desktop.exe	"WeatherStudio adware"
N	WeatherWatcher	ww.exe	"WeatherWatcher - weather reporting in the System Tray"
X	Web-cameinst	[path to trojan]	"Added by the RANCK-BP TROJAN!"
?	Webcam Go Sti Service Application	wbcgosvc.exe	"Control software for the portable Creative Webcam Go digital camera/PC web cam. What does it do and is it required?"
X	Webcelerator	webcel.exe	"Webcelerator from eAcceleration speeds your Web browsing by both remembering where you have been and anticipating where you will go. Only needed if you find it improves web browsing. Now no longer available and supported and when available was classed as spyware - see here"
X	WebRebates0	WebRebates0.exe	"WebRebates adware"
X	WebSavingsfromEbates	WebSavingsfromEbatesrun.exe	"Web Savings From Ebates Software
X	WebSavingsFromEbates0	WebSavingsFromEbates0.exe	"Web Savings From Ebates Software
X	Website Administrator Info	webadmin.exe	"Added by the FORBOT-FY WORM!"
X	WebSpecials	rundll32 [path] webspec.dll	"WebSpecials spyware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	WebSUpdater	wupda.exe	"Added by the STARTPAGE.C TROJAN!"
?	WEPstat	Wepstat.exe	"Cisco Aironet 340 Series PC Card driver. If it can be started manually it shouldn't be required if you don't use the PC card facility regularily - hence the status could be ""U"". Can anybody confirm this?"
X	what ever	decom.exe	"Added by the RBOT-SC WORM!"
X	What Frenz	FriendEQUALsuX.exe	"Added by the BHARAT.A WORM!"
U	WhatPulse	WHATPU~1.EXE	"WhatPulse keeps track of your keystrokes
U	WhatPulse	WhatPulse.exe	"WhatPulse collects statistics on how much you type on your computer and sends this information to a server. It is not a keylogger which monitors your keystrokes and what you type - it only counts the number of keystrokes"
X	WheelsMouse	[path to trojan]	"Added by the SOCKSPR-D TROJAN!"
X	Wifi Configuration	wificonfig.exe	"Added by the IRCBOT.AWB BACKDOOR!"
X	Wifi Configuration!	wificonfigs.exe	"Added by the IRCBOT.AWB BACKDOOR!"
U	WildTangent Web Driver updater	wcmdmgrl.exe	"Web Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case"
?	win name	stat.exe	"??"
X	Win Patch	ntldr.exe	"Added by the SDBOT-GS WORM!"
X	Win Process Updates	winupdates.exe	"Added by a variant of the SDBOT WORM!"
X	Win Secure Update	[random filename]	"Added by the RBOT-AGI WORM!"
X	win update	wupda32.exe	"Added by the SDBOT.J WORM!"
X	win update	wapdate.exe	"Added by a variant of the RBOT WORM!"
X	Win Update	SysUpdate.exe	"Added by the AGOBOT-TN WORM!"
X	Win Update	oleupdate.exe	"Added by the AGENT-UY TROJAN!"
X	Win Update	msnmger.exe	"Added by the RBOT-GDP WORM!"
X	win update	wupdate.exe	"Added by the RBOT-P BACKDOOR!"
X	Win Updater	WINUPDATER.EXE	"Added by the RBOT.IP WORM!"
X	Win Updator Services	ctfnom.exe	"Added by a variant of the WOOTBOT WORM!"
X	Win Validation Application	DBExecCom.exe	"Added by the VBSILLY-A WORM!"
X	Win32 Configuration	videosd32.exe	"Added by the SDBOT.TT WORM!"
X	Win32 Configuration	dllhelp.exe	"Added by the SDBOT.UL WORM!"
X	Win32 Configuration	mplayer.exe	"Added by the FORBOT-BZ WORM!"
X	Win32 Information Service	crsrs.exe	"Added by the RINBOT.Y WORM!"
X	Win32 Kernel Update	win32update.exe	"Added by the PROXY-BS TROJAN!"
X	Win32 Ms Auto Updater	AutomsUPD.exe	"Added by a variant of the RBOT WORM!"
X	win32 security updates downloader	tskmngr.exe	"Added by a variant of the SDBOT WORM! See here"
X	Win32 Test	bleatest.exe	"Added by a variant of the RBOT WORM!"
X	Win32 Update	svchosts.exe	"Added by a variant of the SDBOT WORM!"
X	Win32 Update	dl32.exe	Added by an unidentified WORM or TROJAN!
X	win32 update service	svchostt.exe	"Added by a variant of the SDBOT WORM!"
X	Win32 USB2 Driver	winupdate.exe	"Added by the AGOBOT.YE WORM!"
X	Win32 USB2 Driver	updatemgr.exe	"Added by a variant of the FORBOT WORM!"
X	Win32.Trojan.Downloader	netstat2.exe	"Added by the PAINTER TROJAN!"
X	win32update	win32update.exe	"Added by the GENOME.AQUV TROJAN!"
X	Win32Updater	KERNAL32.EXE	"Added by the SPYBOT-OK WORM!"
X	Win64 Compatibility Check	load win64.drv	"CoolWebSearch parasite variant"
X	WIN95DEFVIEW	[path to file]	"Added by the DEDLER-D TROJAN! The most common filenames seen are ""csmss.exe"" and ""csmrs.exe""
X	Winamp Update	yhn.exe	"Added by the SDBOT-ACR WORM!"
X	wincrt.exe	[path to worm]	"Added by the STRATIO-HA WORM!"
X	WIND0WS	mella.bat	"Added by the ALLEM WORM!"
X	WinData	services.exe	"Added by the SOBER-AD WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\PoolData and note the space at the beginning of the ""Startup Item"" field"
N	WinDates	windates.exe	"WinDates is a calendar
X	WinDLL (wingatey32.exe)	"rundll32.exe wingatey32.exe	start"
X	Windosupdate manager	runwin32.exe	"Added by the SDBOT.NNS BACKDOOR!"
X	Window upadate	pe2.exe	"Added by a variant of the RBOT WORM!"
X	window2	ieupdate.exe	"Added by the FORBOT-BM WORM!"
X	Windowfdgfds DasdLL Verifier	winupdatr.exe	"Added by the AGOBOT.HZ WORM!"
X	Windowfdgfds DasdLL Verifiew	[path to worm]	"Added by the RBOT-GGX WORM!"
X	WindowRegKey update	wins.exe	"Added by the SPYBOT.I WORM!"
X	windows	[path to trojan]	"Added by the AIMWIN TROJAN!"
X	Windows 32 Update	Windows-Update.exe	"Added by a variant of the RBOT WORM!"
U	Windows Accelerators	setup.exe	"KeySpy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	Windows Account Alternation	wauclt.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Activate System	syssv.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows AdStatus	WinStat.exe	"Added by the BLESHARE!DR VIRUS!"
X	Windows Application Layer	walg32.exe	"Added by the AGOBOT.ATN WORM!"
X	Windows Application Layer Gateway	walg32.exe	"Added by the AGOBOT-AAZ WORM!"
X	Windows applications server	SysShield.exe	"Added by the unregistered version of Personal Anti Malware rogue security software - not recommended
X	windows auto update	msblast.exe	"Added by the BLASTER.B WORM!"
X	windows auto update	penis32.exe	"Added by the BLASTER (or MSBLAST.A) WORM!"
X	Windows Auto Update	winupdater.exe	"Added by the SDBOT.TF WORM!"
X	Windows auto update	bazzi.exe	"Added by the AHKER.E WORM!"
X	Windows auto update	LSASS.exe	"Added by the AHKER.G WORM! Note - this is not the legitimate lsass.exe process
X	Windows Auto Updater	WINDOWSUPDATE.EXE	"Added by the SDBOT.PB WORM! Note the space at the beginning of the filename"
X	Windows Automatic Update	wuamgrder.exe	"Added by a variant of the RBOT WORM!"
X	Windows Automatic Updater	windrg.exe	"Added by a variant of the RBOT WORM!"
X	Windows Automatic Updates	dvldr.exe	"Added by the RBOT.MF WORM!"
X	Windows Automatical Updater	dcz.exe	"Added by the RBOT.CXS WORM!"
X	Windows AutomaticUpdater	runddls.exe	"Added by a variant of the RBOT WORM!"
X	windows automation	mslaugh.exe	"Added by the BLASTER.E WORM!"
X	Windows Automation	msdspr.exe	"Added by the SOLAME.A WORM!"
X	Windows Backup Configuration	IEXPLORER.exe	"Added by the GAOBOT.AZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Windows Communicator	wincomm.exe	"Added by the AGOBOT-BH WORM!"
X	Windows Communicator for NT/XP	osndyrn.exe	"Added by the SDBOT-CPK WORM! Note - can terminate AV related processes"
X	Windows Configuration	wsys32.exe	"Added by the GAOBOT.FB WORM!"
X	Windows Configuration	wincfg32.exe	"Added by the MYTOB.ED WORM!"
X	Windows Configuration	WINHUB.EXE	"Added by the SPYBOT-CG WORM!"
X	Windows Configuration Loader	asclt.exe	"Added by the SDBOT-OA WORM!"
X	Windows Configuration Loader	msgfix.exe	"Added by the SDBOT-NP WORM!"
X	Windows Configuration System	IExplore.exe	"Added by the RBOT-DDG WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows Configuration Utility	winxupdate.exe	"Added by the AGOBOT.LW WORM!"
X	Windows Configurator	winconf.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Console Monitor	[path to worm]	"Added by the KEDEBE WORM!"
X	Windows Core Kernel Update	win32bootcfg.exe	"Added by the RANCK-EL TROJAN!"
X	Windows Data Server	autodisc.exe	"Added by the SPYBOT-CB WORM!"
X	Windows Data Server	[random name].exe	"Added by the SPYBOT-DS WORM!"
X	Windows Database	WinDat.exe	Added by an unidentified WORM or TROJAN!
X	Windows Database	wiinsvc.exe	"Added by the AGOBOT-RU WORM!"
X	Windows Debugging Tools	updatecfg.exe	"Added by the RBOT-AXU WORM!"
X	Windows Default Configuration	svchost.exe	"Added by the DLOADER-U TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Windows Defender Updater	wdu*.exe	"Added by a variant of the FakeAlert TROJAN! This infection displays fake Windows Defender alerts which link to spyware-kicker.com"
X	Windows DLL Loader	defragfat32z.exe	"Added by the LINKBOT.A WORM!"
X	Windows DLL Loader	defragfat32pi.exe	"Added by the RBOT-QQ WORM!"
X	Windows DLL Loader	defragfat39.exe	"Added by the POEBOT-C WORM!"
X	Windows DLL Loader	defragfatz.exe	"Added by the LINKBOT.H WORM!"
X	Windows DLL Loader	defragfat32.exe	"Added by the SDBOT-SS WORM!"
X	Windows DLL Loader	defragfat32abc.exe	"Added by the RBOT-RG WORM!"
X	Windows DLL Loader	defragfatx.exe	"Added by the POEBOT-F WORM!"
X	Windows Drive Compatibility	System32Driver32.exe	"Added by the SUPOVA.Z WORM!"
X	Windows Driver Foundation	MTVSCMXT.EXE	"Added by a variant of the RBOT WORM!"
X	Windows driver update	dmsvc32.exe	"Added by the SDBOT-GP BACKDOOR!"
X	Windows driver update	Ipconfig32.exe	"Added by the SDBOT-JV WORM!"
X	Windows drivers update	windowsupdate.exe	"Added by the RBOT-ACE WORM!"
X	Windows Explorer Update Build 1142	EXPLORER32.EXE	"Added by the KaZaA based KWBOT or KWBOT.Y WORMS!"
X	Windows FAT 32	WINFAT32B.exe	"Added by the SPYBOT-AGT WORM!"
X	Windows File Migration Wizard	HIMENSYST.EXE	"Added by the RBOT-EMO WORM!"
X	Windows File Verification Service	wfvs.exe	Added by the RANKY.AC TROJAN!
X	Windows Firewall Updater	updatees.exe	"Added by the RBOT-GBX WORM!"
X	Windows Firewall Updater	cronos.exe	"Added by the RBOT-GBY WORM!"
X	Windows Firewall Updater	ctfcom.exe	"Added by the RBOT-GCB WORM!"
X	Windows Firewall Updater	windowsupdate.exe	"Added by the SPYBOT.AVEO WORM!"
X	Windows Fix	integator.exe	"Added by the SDBOT.ZAB WORM!"
X	Windows FormatAd	WinForm.exe	Windupdates adware variant
X	Windows Genuine Validate	winservicessss.exe	"Added by the IRCBOT.UUI BACKDOOR!"
X	Windows Insecure	[path to worm]	"Added by the RBOT-FSM WORM!"
X	Windows Java Update	weatherBug32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Loader	SysUpdate.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Locator	wsass.exe	"Added by the IRCBOT.N TROJAN!"
X	Windows Logon Application	WinIogon.exe	"Added by the LINKBOT.M WORM!"
X	Windows Logon Application	logon.exe	"Added by the POEBOT-J WORM!"
X	Windows Logon Application	services.exe	"Added by the CIADOOR-L TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Logon Application	win32help.exe	"Added by the DELBOT-X WORM!"
X	Windows Logon Application	winlogon.exe	"Added by the POEBOT-KW WORM! Note - this is not the legitimate winlogon.exe process
X	Windows Logon Application	winamp.exe	"Added by the POEBOT-LR WORM! Note - this is NOT the popular Winamp media player which resides in a ""Winamp"" subdirectory of the Program Files directory"
X	Windows Logon Applicationedc	winlogon.exe	"Added by the DWNLDR-HGR TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%"
X	Windows Logon Applicatonedc	winlogon.exe	"Added by the VB-EBV TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%"
X	Windows Management Instrumentation	mwd.exe	"Added by the GRAPS WORM!"
X	Windows Management Instrumentation	[path to file]	"Added by the QEDS-A WORM!"
X	Windows Management Instrumentations	winmg.exe	"Added by the GAOBOT.GW WORM!"
X	Windows Manager Update Inc	tgb.exe	"Added by the SDBOT-ACM WORM!"
X	Windows Media Player	mpupdata.exe	"Added by the SDBOT.BBG WORM!"
X	Windows Media Player Update	[random filename]	"Added by the RBOT-ET WORM!"
X	Windows media service	Sygate32.exe	"Added by the RBOT.ADE WORM!"
X	Windows Media Updater	crease.exe	"Added by the RBOT-ATI WORM!"
X	Windows Micro Drivers	wupdates32.exe	"Added by the RBOT-AEH WORM!"
X	Windows Microsoft Update	wintask32.exe	"Added by a variant of the SDBOT WORM!"
X	Windows MS Update 32	fhm.exe	"Added by the IRCBOT.GEN WORM!"
X	Windows MS Update 32	sucker.exe	"Added by the FORBOT-GJ WORM!"
X	Windows MS Update 32	jebote.exe	"Added by the FORBOT-GK WORM!"
X	Windows MSN Updates	wnd32.exe	"Added by the IRCBOT-ABA TROJAN!"
X	Windows NNT	[path to trojan]	"Added by the RANKY.E TROJAN!"
X	Windows NT Logon Application	winlogon.scr	"Added by the RBOT-ALP WORM!"
X	Windows NT Update Manager	WINL0G0N.exe	"Added by the AGOBOT-NU WORM! Note that those are zeroes in the filename and not capital ""o"""
X	Windows OLE Automation Server	ole32aut.vbe	"CoolWebSearch parasite variant"
X	Windows Online Updater	dllman.exe	"Added by the RBOT-TE WORM!"
X	Windows Population Logger	winpo32.exe	"Added by the AGENT.YKR WORM!"
X	Windows Process	win_update.exe	"Added by the LASTWORD WORM!"
X	Windows Registry Scan	timeupdate.exe	"Added by the SPYBOT.JE WORM!"
X	Windows Reverse Preperation	winrvp.exe	"Added by the SLENFBOT.CB WORM!"
X	Windows Secure Update	winupser.exe	"Added by the RBOT-GCG WORM!"
X	Windows Secure Update	WinSecUp.exe	"Added by the RBOT-GCD WORM!"
X	Windows Secure Update	load.exe	"Added by the FORBOT-GU WORM!"
X	Windows Secure Update	WinSecure.exe	"Added by the RBOT-GDO WORM!"
X	Windows Security Center Notification App	wscnfty.exe	"Added by a variant of the RBOT WORM!"
X	Windows Security Center Notification Appls	sxe.exe	"Added by the RBOT-GKX WORM!"
X	Windows Security Center Notification Applse	sxes.exe	"Added by the RBOT-GLR WORM!"
X	Windows Security Center Notification Applse	os.exe	"Added by a variant of the RBOT-GLR WORM!"
X	Windows Security Center Notification Applsee	sysecurex.exe	"Added by a variant of the RBOT-GKX WORM!"
X	Windows Security Update	security32.exe	"Affilred adware"
X	Windows Security Update	ndsass.exe	"Added by the RBOT.ESM BACKDOOR!"
X	Windows Serv Patch	Mcaffe2005.exe	"Added by a variant of the RBOT WORM!"
X	Windows Server Client Verification Service	wscvs.exe	"Added by the AGENT.AWC TROJAN!"
X	Windows Server Information	servinfo.exe	"Added by the FORBOT-EN WORM!"
X	Windows Server IP Verification Service	wsivs.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Windows Server Peer Verification Service	wspvs.exe	"Added by a variant of the RANKY TROJAN!"
X	Windows Service	private-zone.exe	Added by an unidentified WORM or TROJAN!
X	Windows Service Host Process	[path to file]	"Added by the EZIO-A WORM!"
X	Windows Service Pack Auto Update	winworks.exe	"Adware downloader - detected by eScan antivirus as the AGENT.BT TROJAN!"
X	Windows Service Pack Auto Update	figgaz.exe	"Detected by Kaspersky as the AGENT.BT TROJAN!"
X	Windows Service Pack Auto Update	ballin.exe	Added by an unidentified WORM or TROJAN!
X	Windows Service Pack Auto Update	del-me.exe	"Adware
X	Windows Service Update	livecal.exe	"Added by the SDBOT-DEY WORM!"
X	Windows Service Update	crsss.exe	"Added by the SDBOT.CWX WORM!"
X	Windows Service Update	mswsgs.exe	"Added by the RBOT.FQB WORM!"
X	Windows Services	wupdate.exe	"Added by the GAOBOT.ZT WORM!"
X	Windows Services Certification	svccert.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services Ink Platform Tablet Input Subsystem	wsiptis.exe	"Added by the RBOT.APC WORM!"
X	Windows Services Update	svch0st.exe	"Added by a variant of the RBOT WORM! Note - the filename has the digit 0 rather then the uppercase ""o"""
X	Windows Sound Emulator	snd32_win.exe	"Added by the ATNAS.A WORM!"
X	Windows SP2 Update	Sp2update.exe	"Added by the WOOTBOT.BS WORM!"
Y	Windows SteadyState - Bubble Messages	Bubble.exe	"Part of Windows SteadyState
Y	Windows SteadyState - Session Timer Notify (UI)	SCTUINotify.exe	"Part of Windows SteadyState
X	Windows Svshost Service Update 32	svcsshost32.exe	"Added by the FORBOT-GD WORM!"
X	WINDOWS SYSTEM	xpupdate.exe	"Added by the ZOTOB-G WORM!"
X	WINDOWS SYSTEM	wupdate.exe	"Added by the MYTOB-HT WORM!"
X	Windows System 32-Bat Service	win32bat.exe	"Added by the MYTOB.FI WORM!"
X	Windows System Configuration	SYSCFG16.EXE	"Added by the WISDOOR-K TROJAN!"
X	Windows System Configuration	Passcfg16.exe	"Added by the DOMWIS-E TROJAN!"
X	Windows System Configuration	Winfrw.exe	"Added by the SOLUFINA TROJAN or the DOMWIS-J WORM!"
X	Windows System Configuration	wincfg.exe	"Added by the AGOBOT.OP WORM!"
X	Windows System Configuration	WINCFG32.EXE	"Added by the AGOBOT-TE WORM!"
X	Windows System Configuration	WinNeth.exe	"Added by the RETHE-A WORM!"
X	Windows System Configuration	nether.exe	"Added by the OPANKI-AB WORM!"
X	Windows System Configuration	WINSYS32.exe	"Added by the SDBOT.AXK WORM!"
X	Windows System Gateway	SPOOLER.EXE	"Added by a variant of the RBOT WORM!"
X	Windows System Restore Configuration	Sblhost.exe	"Added by a variant of the SPYBOT WORM!"
X	WINDOWS SYSTEM UPDATE	xDcc.exe	"Added by the MYOTB-EH WORM!"
X	Windows System Update Tools	upds.exe	"Added by the VANBOT.CX BACKDOOR!"
X	Windows Task Manager Emulator	kennewr.exe	"Added by the SPYBOT-FA WORM!"
X	Windows Taskbar Manager	internat.exe	"Added by the PROTORIDE-H WORM!"
X	Windows Taskbar Manager	[path to file]	"Added by the PROTORIDE.B WORM!"
X	Windows Taskmanager Data	csrrss.exe	"Added by the RBOT-BBH WORM!"
X	Windows Temperate Services	wintmp.exe	"Added by the SLENFBOT.ZW WORM!"
X	Windows TM	pdpatbcyj.exe	"Added by the RBOT.FEF WORM!"
X	Windows Upate	rundll.exe	"Added by the HAKO TROJAN! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	Windows Update	[filename]	"Added by the NORIO TROJAN! Acts as a hi-jacker redirecting to adult content sites"
X	Windows Update	iexplorere.exe	"Added by the GAOBOT.AP WORM!"
X	windows update	uddater.exe	"Added by the LEOX TROJAN!"
X	Windows Update	wudate.exe	"Added by the AGOBOT.ML WORM!"
X	Windows Update	wupdate.exe	"Wengs adware"
X	windows update	sychost.exe	"Added by the LEOX.B WORM!"
X	Windows Update	Wuamgrd.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Update	inetinf.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Windows Update	WindowsUpdate.exe	"Added by the BAYROB-A TROJAN!"
X	Windows Update	host32.exe	"Added by the RBOT-GU WORM!"
X	windows update	wuraclt.exe	"Added by the RBOT-PO WORM!"
X	windows update	Wuanclt.exe	"Added by the RBOT.XZ WORM!"
X	Windows Update	svchosts.exe	"Added by the FRUCTA TROJAN!"
X	Windows Update	ebay.exe	"Added by the GAOBOT.BUU WORM!"
X	Windows Update	windows.exe	"Added by the RBOT-RB WORM!"
X	windows update	wuaurlt.exe	"Added by the RBOT.ADG WORM!"
X	Windows Update	Update.exe	"Added by the DELF-FN TROJAN!"
X	Windows Update	winmguard.exe	"Added by the RBOT-EM WORM!"
X	Windows Update	wuampd.exe	"Added by the RBOT.UM WORM!"
X	windows update	wuarclt.exe	"Added by the RBOT-OF WORM!"
X	Windows Update	winupdate.exe	"Added by the SDBOT-WS WORM!"
X	Windows Update	msnwinsb.exe	"Added by the RBOT-AAH WORM!"
X	Windows Update	scvhost.exe	"Added by the SDBOT-XT WORM!"
X	windows update	Microsoft.exe	"Added by the LMIR.A TROJAN!"
X	Windows Update	mplupdate.exe	"Added by the MOEGA WORM!"
X	windows update	msnsever.exe	"Added by the RBOT-AHN WORM!"
X	Windows Update	taskmr.exe	"Added by the MYTOB-GZ WORM!"
X	Windows Update	update32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update	wininfo.exe	"Added by the MYTOB.GA WORM!"
X	Windows Update	winlogin.exe	"Added by the BANKER-DV TROJAN!"
X	Windows Update	msnupdates.exe	"Added by the RBOT-ALK WORM! Note - this file has nothing to do with Windows updates or MSN"
X	Windows Update	qtask.exe	"Added by the RBOT-AKU WORM! Note - do not confuse with the Quicken file of the same name as described here"
X	windows update	real.exe	"Added by the LEGMIR-AU WORM!"
X	Windows Update	windowsx.exe	"Added by the BANCD-A TROJAN!"
X	Windows update	wudupdate.exe	"ISTBar adware related"
X	Windows Update	wupdmgr.exe	"Added by the BANCBAN-FC TROJAN and variants!"
X	Windows Update	csrss.exe	"Added by the BANKER-HM TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Update	msnsupdate.exe	"Added by the RBOT-AXS WORM!"
X	Windows Update	XPLoogNT.exe	"Added by the BANCD-B TROJAN!"
X	Windows Update	install.exe	"Added by the BANKER-IB TROJAN!"
X	Windows Update	msi.exe	"Added by the BANKER-XB TROJAN!"
X	Windows Update	Sqltob.exe	"Added by the DASHER.A WORM!"
X	windows update	logonuit.exe	"Added by the LEGMIR-AO TROJAN!"
X	Windows Update	avkir.exe	"Added by the RBOT-GJP WORM!"
X	Windows Update	easypwnt.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update	MSDEVS30.exe	Added by the SPYBOT.AHC WORM!
X	Windows Update	SecretStub.exe	"Added by the SRAMLER.C WORM!"
X	Windows Update	Winload.exe	"Added by the DEDMIR-A WORM!"
X	Windows Update	taskngr.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Update	usnsvc.exe	"Added by the KOBOT-C WORM!"
X	Windows Update	win32update.exe	"Added by the SDBOT.FTK WORM!"
X	Windows Update	livesrvs.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update	McAfee.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not a valid McAfee program"
X	Windows Update	McAfee3.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Windows Update	msconfig32.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows Update	msnsa32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Update	scrigz.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Update	winsc.exe	"Added by the BUZUS.RYI TROJAN!"
X	Windows Update	wuauclt32.exe	"Added by the SDBOT.DHY WORM!"
X	Windows Update	dllhostup.exe	"Added by the BANCBAN-NB TROJAN!"
X	Windows Update	explored.exe	"Added by the GAOBOT.MF WORM!"
X	Windows Update	smsscr.exe	"Added by the BANKER-DK TROJAN!"
X	Windows Update	sysdrv.exe	"Added by the AGENT-IYE TROJAN!"
X	Windows Update	winupupdate1.exe	"Added by the RBOT-UV WORM!"
X	Windows Update	klass.exe	"Added by the BIFROSE-ZH TROJAN!"
X	Windows Update	winlogonEvt.exe	"Added by the VB-DXM TROJAN!"
X	Windows update	explore.exe	"Added by the GAOBOT.AL WORM!"
X	Windows Update	fdos.exe	"Added by the RBOT-COG WORM!"
X	Windows Update	leak32x.exe	"Added by the AGENT.ALY BACKDOOR!"
X	Windows update	msb32.exe	"Added by the GAOBOT.CG WORM!"
X	Windows update	svdhost.exe	"Added by the GAOBOT.CG WORM!"
X	Windows Update	tskmngr.exe	"Added by the AGENT.ALY BACKDOOR!"
X	Windows Update	windb32.exe	"Added by the AGENT.ALY BACKDOOR!"
X	Windows update 2005	[random filename]	"Added by the RBOT.ARP WORM!"
X	Windows Update 32	winlogons.exe	"Added by the FORBOT-FI WORM!"
X	Windows Update 32	rempss.exe	"Added by the FORBOT-FW WORM!"
X	Windows Update 32	slsys.exe	"Added by the FORBOT-FT WORM!"
X	Windows update 32bit	winupd32.exe	"Added by the SDBOT.BE WORM!"
X	Windows Update 63	shupd64.exe	"Added by the FORBOT-GA WORM!"
X	Windows Update 64	nbupd64.exe	"Added by a variant of the FORBOT WORM!"
X	Windows Update 64	WinV.exe	"Added by the FORBOT-FP WORM!"
X	Windows Update Auto Update	wuaumgr.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Update Automatic Updates	[path to backdoor]	"Added by the VBBOT.AM BACKDOOR!"
X	Windows Update Automation	winuptdate.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update AutoUpdate Client	waucult.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update AutoUpdate Client	wuauclt.exe	"Added by the LAZAR.B TROJAN! Note - this is not the legitimate wuauclt.exe process
X	Windows Update AutoUpdate Client Product	wuauct.exe	"Added by the AGOBOT.ACL WORM!"
X	Windows Update Center	svthx.exe	"Added by the STUBBOT.A WORM!"
X	Windows Update Center	W32RSA.exe	Added by an unidentified WORM or TROJAN!
X	Windows Update Check	syslodr.exe	"Added by the SMALL.LU TROJAN!"
X	Windows Update Checker	[random filename]	Adware downloader trojan
X	Windows Update Checker	msupdte32.exe	"Added by the SDBOT-AEF WORM!"
X	Windows Update Checker	deinst_qfe001.exe	Added by a variant of the Win32.Small TROJAN!
X	Windows Update Checker	deinst_qfe002.exe	Added by a variant of the Win32.Small TROJAN!
X	Windows Update Client	wuclient.exe	"Added by the SMALL-RN TROJAN!"
X	Windows Update Client Service	windrvl32.exe	"Added by the AGOBOT-MM TROJAN!"
X	Windows update config	svhost.exe	"Added by the SDBOT-PF WORM!"
X	windows update configurator	svghost.exe	"Added by a variant of the SPYBOT WORM!"
X	windows update configurator	explore.exe	"Added by the SDBOT.RY BACKDOOR!"
X	Windows Update Controller	mwoffice.exe	"Added by the BATTRY-A TROJAN!"
X	Windows Update Draven	draven.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update Drive	updrvs.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update Files	dnetc.exe	"Added by an unidentified VIRUS
X	Windows Update Firewall System	ctfmoom.exe	"Added by the RBOT-GAN WORM!"
X	Windows Update Firewall System	winmsfw.exe	"Added by the RBOT-EEO WORM!"
X	Windows Update Firewall System	ctfmom.exe	"Added by the SPYBOT.ANDM WORM!"
X	Windows Update GUI Executable x32x	wupdategux32.exe	"Added by the RBOT.CXY WORM!"
X	Windows Update Host	winupsvc.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update IPv6 Layer	WIN32IPV6.EXE	"Added by the RBOT.DUD WORM!"
X	Windows update loader	xpupdate.exe	"Malware installed by different rogue security software including SpyKillerPro. Also detected as the BRAVE-A TROJAN!"
X	Windows Update Manager	wupdmngr.exe	"Added by the RANDEX.BTB WORM!"
X	Windows Update Manager	Winlog0n.exe	"Added by the AGENT-BO TROJAN!"
X	Windows Update Manager	wupdate.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update Manager	bootwiz.exe	Added by the MYBOT WORM!
X	Windows Update Manager	WindowsUpdateManager.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Update Manager for NT	wupdmgr32.exe	"Added by the SDBOT.AH WORM!"
X	windows update microsoft	updatem.exe	"Added by the RBOT-CHE WORM!"
X	Windows Update Monitoring Service	winupdt.exe	"Added by the RBOT-PL WORM!"
X	Windows Update Process	wmiprvsc.exe	"Added by the SDBOT-CB WORM!"
X	Windows Update Service	csrs.exe	"Added by the AGOBOT-NI WORM!"
X	Windows Update Service	smcg.exe	"Added by the SDBOT.QY WORM!"
X	Windows Update Service	SP00ISS.exe	"Added by the SDBOT-ZH WORM!"
X	Windows Update Service	update32.pif	"Added by the RBOT-ALC WORM!"
X	Windows Update Service	trest.exe	Identified by BitDefender as a variant of the PEED TROJAN!
X	Windows Update Service	wmiprvse32.exe	"Added by the AGOBOT.NI WORM!"
X	Windows Update Service	regscv.exe	"Added by the AGOBOT-AM BACKDOOR!"
X	Windows Update Service	msupdate32.exe	"Added by the DLOADR-CRJ TROJAN!"
X	Windows Update Service 2004/2005	systemupdate.exe	"Added by the RBOT-JE WORM!"
X	Windows Update services	wins32svcs.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update Services	winupdate32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update Software	system.exe	"TOFGER.BX spyware"
X	Windows Update SP3	Windat.EXE	"Added by the RBOT-GTS WORM!"
X	Windows Update Svc	rundll32.exe xpupdate.dll	"ContraVirus rogue security software - not recommended
X	Windows Update System	mswins.exe	"Added by the IRCBOT.DN WORM!"
X	Windows Update System Shell	svhostcs32.exe	"Added by the RBOT-AAZ WORM!"
X	Windows Update V6	[random filename]	"Added by the RBOT-KT WORM!"
X	Windows Update.exe	N/A	Homepage hijacker
X	Windows Updated	spoolsae.exe	"Added by the RBOT-APM WORM!"
X	Windows Updated	updatr.exe	"Added by the RBOT-AYB WORM!"
X	Windows Updater	wupdmgr32.exe	"Added by a variant of the DOS.AUTOCAT TROJAN!"
X	Windows Updater	iexplorerrs.exe	"Added by the RBOT-TN WORM!"
X	Windows Updater	svigost.exe	"Added by the RBOT-VS WORM!"
X	Windows Updater	wupdate.exe	"Added by the WOOTBOT.AJ WORM!"
X	Windows Updater	sdsys.exe	"Added by the FORBOT-JG WORM!"
X	Windows Updater Online	winupdatexx.exe	"Added by a variant of the RBOT WORM!"
X	Windows Updater Servc	xpuupdate.exe	"ContraVirus rogue security software - not recommended
X	Windows Updater Service Manager	winupdatr.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Updater Services	msnupdate.exe	"Added by a variant of the RBOT WORM!"
X	windows updaters	winupdats.exe	"Added by the SPYBOT-IS WORM!"
X	Windows Updates	lsassx.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Updates	winupd32.exe	"Added by the MYTOB.CE WORM!"
X	Windows Updates	w32dns.exe	"Added by the SDBOT-BFW WORM!"
X	Windows Updates Agent	winupdate.exe	"Added by the SPYBOT.HW WORM!"
X	Windows Updating Service	updating.pif	"Added by the RBOT-ALW WORM!"
X	Windows Upgrate Utility	winulty.exe	"Added by the AUTORUN-ASR WORM!"
X	Windows USB Monitor	servupdate.exe	"Added by the IRCBRUTE.AQ TROJAN!"
X	Windows Virtual Manager	vmnat.exe	"Added by the SILLYFDC.BCB WORM!"
X	Windows Vista Corparation Agent Services	winxp_sp3.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Vista Transformation	IEXPLORE.exe	"Added by the FORBOT-GV WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows Workstation	mpci.exe	"Added by a variant of the RBOT WORM!"
X	Windows Workstation	msup32a.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Workstation Service	explore.exe	Added by unknown malware
X	Windows Workstation Service	wkssvc.exe	"Added by the IRCBOT-AAI WORM!"
X	Windows Workstation Service (32-bits)	wkssvc32.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Workstation Service [5.1-2600]	windrm.exe	"Added by the RBOT-CNY WORM!"
X	Windows Workstation Start Service	mslanmgr.exe	"Added by a variant of the RBOT WORM!"
X	Windows XP Automatic Update	wXPupdate.exe	"Added by the RBOT-AFC WORM!"
X	Windows-Xdate	wuamclt32.exe	"Added by the SPYBOT.AMUV WORM!"
X	Windows32 Configuration Loader	msrf32.exe	"Added by the SDBOT-ABX WORM!"
X	Windows32 Net Database	msnd32.exe	"Added by the RBOT-AAL WORM!"
X	WindowsACEbar	acebarupdate.exe	"BarACE adware"
X	WindowsCriticalUpdate	windows_critical_update.exe	"Added by the ASTEF or RESPAN WORMS!"
X	WINDOWSflashbrg	sqldata1.exe	"Added by a variant of the AGENT-IC TROJAN!"
X	WindowsFY	[path to trojan]	"Added by the FAKEALE-E TROJAN!"
X	WindowsFZ	[path to file]	"Added by the DESKTOPHIJACK VIRUS! Also see DESKTOPHIJACK.B TROJAN!"
X	WindowsInstaller	[path to file]	"Added by the DEDLER-D TROJAN! The most common filenames seen are ""csmss.exe"" and ""csmrs.exe""
X	Windows�Updates	Update.exe	"Added by the RBOT.TRA BACKDOOR!"
X	WindowsKeyUpdate	master.exe	"Added by the JOSAM WORM!"
X	WindowsReg% update	[random filename].exe	"Added by the RBOT-HH WORM!"
X	WindowsRegistration	[random filename]	"Added by the RBOT-NO WORM!"
X	WindowsRegKey Autoupdate	[random filename]	"Added by a variant of the RBOT WORM!"
X	WindowsRegKey update	winupdate.exe	"Added by the RBOT-QJ WORM!"
X	WindowsRegKey update	windns.exe	"Added by the RBOT.IE WORM!"
X	WindowsRegKey update	winupdatexx.exe	"Added by the RBOT.LW WORM!"
X	WindowsRegKey update	[random filename]	"Added by the RBOT.QT WORM!"
X	WindowsRegKey update	svchoosts.exe	"Added by the RBOT.ADB WORM!"
X	WindowsRegKey update	svchostc.exe	"Added by the RBOT.IF WORM!"
X	WindowsRegKey update	wdnupdate.exe	"Added by the SDBOT.QX WORM!"
X	WindowsRegKey update	Windowsup.exe	"Added by the SDBOT.PU WORM!"
X	WindowsRegKey update	WINUPDATES.EXE	"Added by the RBOT-MM WORM!"
X	WindowsRegKey update	rkbuouoxfl.exe	"Added by the RBOT-OO WORM!"
X	WindowsRegKey update	winsys.exe	"Added by the RBOT-JY WORM!"
X	WindowsRegKey update	winupdat32.exe	"Added by the RBOT-AGW WORM!"
X	WindowsRegKey update XP	windexv1.exe	"Added by the RBOT-ABM WORM!"
X	WindowsRegKey%$ update	msi332.exe	"Added by the RBOT-IX WORM!"
X	WindowsRegKey%update	ethernet32m.exe	"Added by the RBOT-EN WORM!"
X	WindowsRegKeys update	winsysi.exe	"Added by the SDBOT.WE WORM!"
X	WindowsSetup	[path to trojan]	"Added by the EZBOT TROJAN!"
X	WindowsSystem32	[path to worm]	"Added by the SDBOT-DFG WORM!"
U	WindowsTranslator	DWinTrsl.exe	"Delta Translator® English < > Portugese (Brazilian) version - ""an automatic
U	WindowsTranslator_Espanhol	DWinTrsl.exe	"Delta Translator® Spanish < > Portugese (Brazilian) version - ""an automatic
X	WindowsUpdate	windows_update.exe	"Added by the LOFNI WORM!"
X	WindowsUpdate	svchost.exe	"Added by the ASTEF or RESPAN WORMS or AGENT-V TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	windowsupdate	RPC[RANDOM CHARACTERS].exe	"Added by the IRCBOT.B TROJAN!"
X	WindowsUpdate	USRINIT.EXE	"Added by the MADDIS.B WORM!"
X	windowsupdate	winupdate.exe	"Added by the WARPI WORM!"
X	WindowsUpdate	svchost.exe	"Added by the BDOOR-IK BACKDOOR! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	WindowsUpdate	winnnint.exe	Added by an unidentified WORM or TROJAN!
X	WindowsUpdate	[path to file]	"Added by the DUPA-B TROJAN!"
X	WindowsUpdate	svchostw.exe	"Added by the COBFINN_B TROJAN!"
X	WindowsUpdate	Nzil.exe	"Added by the CULLER-C WORM!"
X	WindowsUpdate	Strad.exe	"Added by the CULLER-D WORM!"
X	Windowsupdate	Windowsupdate.exe	"Added by the BANKER.ARK TROJAN!"
X	Windowsupdate	wupdmgr98.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	WinDOwsUPdate	smss.exe	"Added by the AUTORUN.DIB WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~� subfolder"
X	windowsupdate	autoupdate.exe	"Added by the IRCBOT-P BACKDOOR!"
X	WindowsUpdate	svdhost.exe	"Added by the AGOBOT-BP WORM!"
X	WindowsUpdate	twain.exe	"Added by the AGENT.BEA TROJAN!"
X	WindowsUpdate renew	iexplore.exe	"Added by the AGENT.QG TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	WindowsUpdate Service	wuautlc.exe	"Added by the RBOT-NR WORM!"
X	Windowsupdate Service	csrss.exe	"Added by the BABA-B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in the root folder (ie
X	WindowsUpdatecrss	crss.exe	"Added by a variant of the AGENT-HZ TROJAN!"
X	WindowsUpdateDirect	dupadirect.exe	"Added by the DUPA-C TROJAN!"
X	WindowsUpdatelsasss	lsasss.exe	"Added by a variant of the AGENT-HZ TROJAN!"
X	WindowsUpdatem1	[path to file]	"Added by the AGENT-AAJ TROJAN!"
X	WindowsUpdatem2	svchost.exe	"Added by an unidentified WORM or TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	WindowsUpdateManager	wupdmng.exe	"Added by the IRCBOT.OE BACKDOOR!"
X	WindowsUpdateNT	svwhost.exe	"Added by the SHELLOT-B TROJAN!"
X	WindowsUpdateR	regserv.exe	"Added by the COBFINN_B TROJAN!"
X	WindowsUpdatesvchostss	svchostss.exe	"Added by the AGENT-HZ TROJAN!"
X	WindowsUpdatev4	w32gins.exe	"Added by an unidentified WORM or TROJAN! Located in the Root folder (C:\)
X	WindowsUpdatewinsec	winsec.exe	"Added by a variant of the AGENT-HZ TROJAN!"
X	WindowsXP Update	windowsxpupdate.exe	"Added by the RBOT-PB WORM!"
X	Windows_Updates	svthost.exe	"Added by a variant of the SPYBOT WORM!"
X	Windowz Update V2.0	Explorer.exe	"Added by the YODO WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Windowz Update V2.0	updater.exe	"Added by the YODO-C WORM!"
X	Windoxs Update Center	W32RfSA.exe	"Added by a variant of the SDBOT WORM!"
X	WinDriver Configuration	windrvconf.exe	"Added by the AGOBOT-LX TROJAN!"
U	Windstream Broadband Check-up Center	matcli.exe	"Part of the Windstream Broadband service from AllTel. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	WindUpdates	[path to trojan]	"Added by the AGENT.BF TROJAN!"
X	WindUpdates	WinUpdt.exe	Windupdates adware variant
U	WINDVDpatch	CTHELPER.EXE	"CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers
X	Windws Configuration Loader	LEXPLORE.exe	"Added by the SODABOT WORM!"
U	WinGate Engine Monitor	wgengmon.exe	"WinGate Internet Client Dialup Monitor - component of WinGate proxy server software. Displays the status of the WinGate engine
X	WinGate initialize	WinGate.exe	"Added by the LOVGATE.F WORM!"
X	WinKernel	[path to virus]	"Added by the PLEA VIRUS!"
X	winldr	[path to file]	"Added by the VIDLO-P TROJAN!"
X	WinLibUpdate	libupdate.exe	"Added by the BIONET series of TROJANS such as BIONET.31 or BIONET.310"
X	WinLibUpdate32	libupdate32.exe	Added by the BIONET.405 TROJAN!
X	winlocatorupdate	updatewinlocator.exe	Locator adult content toolbar related
X	winlogon32_	[path to file]	"Added by the RULAND.A WORM!"
X	WinLsass	[path to trojan]	"Added by the SCANE WORM!"
U	winmatrix.exe	WinMatrixXP.exe	"WinMatrix XP - wallpaper replacement that shows different matrix effects (including flowing matrix codes from 'The Matrix' movie) on your desktop"
X	WinMedia	[path to trojan]	"Added by the ZEROBE-A TROJAN!"
X	winmngr.exe	[path to trojan]	"Added by the AGENT-ZB TROJAN!"
?	Winnov Status	WvStatus.Exe	"Winnov Video Capture Card related. What does it do and is it required?"
X	winnt DNS ident	winupdate32.exe	"Added by a variant of the RBOT WORM!"
X	winNT updatc	wupgrd.exe	"Added by a variant of the RBOT WORM!"
X	WinPatch Protection	winpatch.exe	Added by an unidentified WORM or TROJAN!
U	WinPatrol	winpatrol.exe	"WinPatrol - ""Manage Startup programs
Y	WinPatrol Explorer	WinPatrolEx.exe	"Part of WinPatrol"
U	WinPatrol Monitor	winpatrol.exe	"WinPatrol - ""Manage Startup programs
X	Winprocer32 Update	winprocer32.exe	"Added by the RBOT.GW WORM!"
X	winprocessor Update	winprocessor.exe	"Added by the RBOT.IO WORM!"
X	WinReanimator	WinReanimator.exe	"WinReanimator rogue security software - not recommended
X	winreg_32	[path to trojan]	"Added by the BANKER-DB TROJAN!"
X	Winres32vis	[path to worm]	"Added by the THRAX.A WORM!"
X	Wins Update 32	services32.exe	"Added by the FORBOT-FN WORM!"
X	WinSetBrowse	BasicUpdate.dll.vbs	"Added by the BISCUIT.A WORM!"
X	winshow	[path to trojan]	"Added by the VB-DXP TROJAN!"
X	WinShowUpdate	copy [path] winshow.new [path] winshow.dll	"Winshow parasiate related - from the ""RunOnce"" keys it replaces ""winshow.dll"" with a new version"
X	Winsock driver	winnt update.exe	"Added by the SPYBOT-DM TROJAN!"
X	Winsock driver	winupdate32.exe	"Added by the SPYBOT-JZ TROJAN!"
X	Winsock2 driver	winupdate.exe	"Added by the SPYBOT-BX WORM!"
X	Winsock32driver	sp2XPupdate.exe	"Added by the HACKARMY.S TROJAN!"
X	Winsock32driver	winXPupdate.exe	"Added by the HACKARMY.9728 TROJAN!"
X	WinSP	[path] REGEDIT.EXE -s [path] sysreg.reg	"Added by the STARTPA-ME TROJAN!"
X	winstats	winstats.exe	"Added by the GARGAFX TROJAN!"
X	winsupdater	winsupdater.exe	"Added by the ALCRA-F WORM!"
X	winsupdatesysmngr64	winsys64mnger.exe	"Added by the RBOT-BAG WORM!"
X	WINSYS	[path to trojan]	"Added by the GOLDPLAY TROJAN!"
X	winsysban	[path to trojan]	"Added by the CLICKER-CD TROJAN!"
X	WinSysModule	[path to trojan]	"Added by the AGENT-DIQ TROJAN!"
X	winsysupd	[path to trojan]	"Added by the STARTPA-NI TROJAN!"
X	WINTASK DLL32	updatewin	"Added by the MYTOB.NI WORM!"
X	WintelUpdate	[path to trojan]	"Added by the SMALL-EKW TROJAN!"
X	WinTimer	msupdate.cmd	"Hijacker - detected by Kaspersky as the STARTPAGE.TJ TROJAN!"
X	winupated.exe	winupated.exe	"Added by a variant of the SDBOT WORM!"
X	winupdat	winupdat.exe	"Added by the CANBOT.A WORM!"
X	WinUpdate	RBSKQQBO.EXE	"Added by the VBSWG2B.A WORM!"
X	WinUpdate	wmbem.exe	"Added by the REVCUSS.B TROJAN!"
X	WinUpdate	updsys.exe	"Added by a variant of the RBOT WORM!"
X	winupdate	winupdate.exe	"Added by the ALCAN.B WORM!"
X	WinUpdate	svhost.exe	"Added by a variant of the SDBOT WORM!"
X	WinUpdate	svchots.exe	"Added by the SMALL.GXJ TROJAN!"
X	winupdate	jusched.exe	"Added by the DWNLDR-FUX TROJAN! Note that this is not the legitimate Sun Microsystems file (of the same name) which is usually located in %Program Files%\Java\version number\bin. This one is located in %Windir%"
X	Winupdate	lsas.exe	"Added by the COSPET.JR TROJAN!"
X	Winupdate Engine	wupeng.exe	"MalwareCrush rogue security software - not recommended
X	WinUpdate Loader	msnnm.exe	"Added by the REVCUSS.C TROJAN!"
X	Winupdate Service	winxp.exe	"Added by the SPYBOT.IR WORM!"
X	winupdate.exe	winupdate.exe	"Added by the RADO TROJAN!"
X	winupdate.reg	winupdate.exe	"Added by the SPYBOT.EAS WORM!"
X	winupdate2846	vbsystem35.exe msvbrun.exe	"Added by a variant of the MUTIN-C TROJAN!"
X	winupdate86.exe	winupdate86.exe	"Added by the FAKEAV-AHQ TROJAN!"
X	WinUpdateAdministrator	CSRSS.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in C:\Application Data\WINDOWS"
X	WinUpdateB	breatle.exe	"Added by the BRATLE.AWORM!"
X	winupdateconn	[path to file]	"Added by the COMBRA-A WORM!"
X	winupdateconn_	Explorer.EXE	"Added by the COMBRA-B WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Winupdatee	winsvcc.exe	"Added by the AGENT.AN TROJAN!"
X	winupdatefiv_	[path to file]	"Added by the COMBRA.C WORM!"
U	WinUpdateProtection	csrss.exe	"EmployeeWatch is a commercial surveillance software program designed to monitor user activity on a computer. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a subfolder of C:\windowsupdate\ufp"
X	WinUpdater	update.exe	"Added by the STARTPAGE.C TROJAN!"
X	winupdates	winupdates.exe	"Added by the ALCRA-B WORM!"
X	winupdate_	[path to file]	"Added by the COMDOR.A WORM!"
X	WinUpdating	WinUpdating.exe	"Added by the AGENT-GSC TROJAN!"
X	WinUpgrader	[path to trojan]	"Added by the AGENT-DZ TROJAN!"
X	WinxDiagUpdate	WinxDiagUpdate	"Added by the RBOT.BWQ BACKDOOR!"
X	WinXP fix	[path to file]	"Added by the RANKY.P TROJAN!"
X	WinXP Processor Generator v1.2	intspnsr32.exe	"Added by the SDBOT.LP WORM!"
X	Winxp update	Cappp.exe	"Added by the RBOT.DKO WORM!"