Support Forum Articles File Help Startup DB Tips Service DB Hijack This! Analyzer

 

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

  • "Y" - Normally leave to run at start-up
  • "N" - Not required - typically infrequently used tasks that can be started manually if necessary
  • "U" - User's choice - depends whether a user deems it necessary
  • "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
  • "?" - Unknown



Startup Name Process Name Details
Y!AVG Anti-Spywareavgas.exe"System Tray access to and notifications for AVG Anti-Spyware 7.5. This has now been superseded by AVG Anti-Virus which includes Anti-Spyware"
ME""MS Java Applets for Windows NTXjavaapplets.exe
NT"Ms Java for Windows 98 ME & XP"X
NT"Ms Java for Windows 98 XP & ME"X
XP & ME"MS Java for Windows NTXxpjavams.exe
?00DSKSVR00desksaver.exe saskda"Part of Advanced Desktop Shield
U00DSKSVR01desksaver.exe tray"System Tray access to Advanced Desktop Shield
X0_AVD32xzboot.exe"Added by the AGENT-IWI TROJAN!"
U12Ghosts SaveLayout12autosl.exe"12Ghosts SaveLayout - ""Always (always!) keep the layout of your desktop icons"""
X9xHtProtectAVprotect9x.exe"Added by the NETSKY.M WORM!"
NAAATraySaverTraySaver.exe"System Tray management utility from Mike Lin which allows you to hide
XAAMSFree702Avengine.com"Added by the DELF.LJ TROJAN!"
XAll Sea screen saverTaskTray.exe"Free screensaver
XAlphaAVAlphaAV.exe"Alpha Antivirus rogue security software - not recommended
Xansjava[path to worm]"Added by the RANDON-AN WORM!"
Xantispyieav.exe"IE AntiVirus rogue security software - not recommended
YAntiVir XPAVwin.exe"AntiVir® PersonalEdition Classic - antivirus"
XAntivirusav.exe"Added by the SINKIN TROJAN! Resets IE start page to realphx.com"
XAntivirusavm.exe"Antivirus Master rogue security software - not recommended
XAntivirusvav.exe"Vista Antivirus 2008 rogue security software - not recommended
XAntivirusaav.exe"Advanced Antivirus rogue security software - not recommended
XANTIVIRUSAVS.exe"Antivirus Sentry rogue security software - not recommended
XANTIVIRUSmicroAV.exe"Micro Antivirus 2009 rogue security software - not recommended
XANTIVIRUSUltraAV.exe"Ultra Antivirus 2009 rogue security software - not recommended
XAntivirussav.exe"System Antivirus 2008 rogue security software - not recommended
XAntivirusuav.exe"Ultimate Antivirus 2008 rogue security software - not recommended
XAntiviruswav.exe"Windows Antivirus 2008 rogue security software - not recommended
XAntivirus 2009av2009.exe"AntiVirus'09 rogue security software - not recommended
XAntivirus PC 2009avpc2009.exe"Antivirus PC 2009 rogue security software - not recommended
XAntivirus Updatesavupdchk.exe"Added by the AGOBOT-IP WORM!"
Yaolavp.exe"AOL's Active Virus Shield (by Kaspersky) - found in an AOLActive Virus Shield sub-directory"
?AOLSAVAOLAgent.exe"AOL ISP related. What does it do and is it required?"
XApplication Layer Servicesavrsvc.exe"Added by the IRCBOT.BJM BACKDOOR!"
YashAvastashAvast.exe"Part of Avast antivirus"
?ASUS Camera ScreenSaverASScrProlog.exe"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
?ASUS Screen Saver ProtectorASScrPro.exe"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
UATI Technologies Inc. HydraVision Desktop ManagerHydraDM.exe"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is the HYDRAVISION Desktop Manager - which ""customizes the behaviour of windows and dialog boxes
UATI Technologies Inc. HydraVision ViewportHydraMD.exe"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is HYDRAVISION MultiDesk - which ""creates
XAUTOPROTECTUnavapq32.exeAdded by an unidentified WORM or TROJAN!
Xauto__antiav__keyantiav_exe.exe"Added by the BAGLEDI-AA TROJAN!"
XAVUPDATE-28062004.exe[25 blank spaces].vbs"Added by the MIDFIN WORM!"
XAVAntivir.exe"Antivir rogue security software - not recommended
Xavexpressav.exe"Express Antivirus 2009 rogue security software - not recommended
XAV AntiSpywareava.exe"AV AntiSpyware rogue security software - not recommended
XAV CareAvCare.exe"AvCare rogue security software - not recommended
XAV Clientpatch31345.exe"Added by the MYDOOM.AD WORM!"
XAV Industrypatch31345.exe"Added by the MYDOOM.AD WORM!"
XAV UpDateUpdate.exe"Added by the FUROOT-A TROJAN!"
XAV7antivirus7.exe"Antivirus7 rogue security software - not recommended
NAvaFindAvaFind.exe"AvaFind file search utility"
Xavagent3974chnb8895.exe"AntiVirus ransomware security software - not recommended
XAVantivirusAvconsol.exe"Added by the MSNVB-D WORM!"
Xavasttroyan.exe"Added by the SMALL.CZ TROJAN!"
YAvast!ashServ.exe"Main part of avast! Antivirus - including the resident protection
Yavast!ashDisp.exe"System Tray access to and notifications for avast! Antivirus - giving left-click access to the On-Access Scanner
Yavast! AntivirusashDisp.exe"System Tray access to and notifications for avast! Antivirus - giving left-click access to the On-Access Scanner
Yavast! Web ScannerAshwebsv.exe"Web scanning part of avast! Antivirus. Starts via a registry ""Run"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
YAvast32Astart32.exe"Part of Avast! anti-virus software"
Xavcavmon.exeAdded by an unidentified TROJAN!
UAvconsoleEXEAvconsol.exeFrom McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Used to schedule regular scans. If you don't have scans scheduled you don't need it
XAvengineAvengine.com"Added by the DELF.LJ TROJAN!"
XAveoAttuneatmdlusr.exe"Aveo Attune automated helpdesk software - adware/spyware"
UAVFX EngineStartFX.exe"Advanced Video FX - supported by a number of Creative Web Cameras. ""Have more fun by adding a wide range of special effects and backgrounds to your video chat with Advanced Video FX"""
XAvGsvchost323.exe"Added by the RBOT-ZA WORM!"
YAVG Anti-Spywareavgas.exe"System Tray access to and notifications for AVG Anti-Spyware 7.5. This has now been superseded by AVG Anti-Virus which includes Anti-Spyware"
YAVG Anti-Virus systemavgcc.exe"System Tray access to and notifications for the 7.* series of anti-virus products from AVG Technologies. If this entry is disabled
YAVG Anti-Virus Systemavgemc.exe"E-mail scanner for the 7.* series of anti-virus products from AVG Technologies. This process scans incoming and outgoing E-mails for viruses and other malware. From version 7.1 onwards this entry only appears in 9x/Me as a startup entry
YAVG Anti-Virus Systemavgw.exe"This entry is included with the 7.* series of anti-virus products from AVG Technologies. Once installed (or on first run for a different user) it runs the configuration sequence to set up the product and doesn't run on subsequent restarts"
XAvg Antivirusicpldrvx.exe"Added by the BANKER.BYU TROJAN!"
XAVG AntiVirus Scanneravgscnx.exe"Added by the SILLYFDC.BBE WORM! Note - this is not a legitimate AVG entry"
XAVG AntiVirus Updateravgwusv.exe"Added by the SILLYFDC.BAX WORM! Note - this is not a legitimare AVG entry"
XAVG Grisoft Updaterupdater.exe"Added by the AGOBOT-OT WORM!"
YAVG IDSAVGIDSUI.exe"System Tray access to and notifications for AVG Identity Protection - identity theft prevention which is available as a stand-alone product or included with AVG Internet Security. ""Always-on identity theft prevention for Windows from one of the world's most trusted security companies. Shop and ensure safe surfing of the web
UAVG Internet Securityavgtray.exe"System Tray access to and notifications for the range of internet security products from AVG Technologies - including Internet Security
YAVG7_AMSVRAVGAMSVR.EXE"This is the AVG7 Alert Manager for the 7.* series of anti-virus products from AVG Technologies. It is essential for both scheduled activities (such as automatic updates and scans) and for displaying alerts and reports via the Control Center (avgcc.exe). Appears in 9x/Me as a startup entry and as a service in 2K and higher"
YAVG7_CCavgcc.exe"System Tray access to and notifications for the 7.* series of anti-virus products from AVG Technologies. If this entry is disabled
YAVG7_EMCavgemc.exe"E-mail scanner for the 7.* series of anti-virus products from AVG Technologies. This process scans incoming and outgoing E-mails for viruses and other malware. From version 7.1 onwards this entry only appears in 9x/Me as a startup entry
YAVG7_Runavgw.exe"This entry is included with the 7.* series of anti-virus products from AVG Technologies. Once installed (or on first run for a different user) it runs the configuration sequence to set up the product and doesn't run on subsequent restarts"
UAVG8_TRAYavgtray.exe"System Tray access to and notifications for the 8.* series of internet security products from AVG Technologies - including Internet Security
UAVG9_TRAYavgtray.exe"System Tray access to and notifications for the 9.* series of internet security products from AVG Technologies - including Internet Security
Yavgamsvr.exeAvgamsvr.exe"This is the AVG7 Alert Manager for the 7.* series of anti-virus products from AVG Technologies. It is essential for both scheduled activities (such as automatic updates and scans) and for displaying alerts and reports via the Control Center (avgcc.exe). Appears in 9x/Me as a startup entry and as a service in 2K and higher"
Yavgasavgas.exe"System Tray access to and notifications for AVG Anti-Spyware 7.5. This has now been superseded by AVG Anti-Virus which includes Anti-Spyware"
Yavgccavgcc.exe"System Tray access to and notifications for the 7.* series of anti-virus products from AVG Technologies. If this entry is disabled
Yavgcc32avgcc32.exe"System Tray access to and notifications for the 6.* (and maybe earlier) series of anti-virus products from AVG Technologies. Also enables scheduled tests
YAVGCtrlAVGCtrl.exe"Part of AntiVir® PersonalEdition Classic antivirus"
Yavgemcavgemc.exe"E-mail scanner for the 7.* series of anti-virus products from AVG Technologies. This process scans incoming and outgoing E-mails for viruses and other malware. From version 7.1 onwards this entry only appears in 9x/Me as a startup entry
YavgfwsrvAVGFWSRV.EXE"Integrated firewall for the 7.* series of anti-virus products from AVG Technologies. Protects the users computer from outside attacks
YAVGIDSAVGIDSUI.exe"System Tray access to and notifications for AVG Identity Protection - identity theft prevention which is available as a stand-alone product or included with AVG Internet Security. ""Always-on identity theft prevention for Windows from one of the world's most trusted security companies. Shop and ensure safe surfing of the web
YAVGIDSUIAVGIDSUI.exe"System Tray access to and notifications for AVG Identity Protection - identity theft prevention which is available as a stand-alone product or included with AVG Internet Security. ""Always-on identity theft prevention for Windows from one of the world's most trusted security companies. Shop and ensure safe surfing of the web
Yavgmsvr.exeavgmsvr.exe"AVG Anti-Virus 7.0 related"
YAVGntAVGnt.exe"AntiVir® PersonalEdition Classic antivirus. System Tray icon and control program"
YAvgserv9.exeAvgserv9.exe"Background monitoring and scanning for the 6.* (and maybe earlier) series of anti-virus products from AVG Technologies when running on 9x/Me. Loaded from the ""RunServices"" registry key"
Uavgtrayavgtray.exe"System Tray access to and notifications for the range of internet security products from AVG Technologies - including Internet Security
YAVGuardAVGuard.exe"AntiVir® PersonalEdition Classic antivirus. Background task which scans files transparently"
Xavguard3876000b09274b.exe"AntiVirus ransomware security software - not recommended
YAVG_CCavgcc32.exe"System Tray access to and notifications for the 6.* (and maybe earlier) series of anti-virus products from AVG Technologies. Also enables scheduled tests
YAVG_EMCAVGEMC.exe"AVG Anti-Virus 7.0 Email Cleaner. Scans incoming and outgoing email for viruses"
YAVG_RegCleanerAVGREGCL.exe"Boot time registry cleaner for the 7.* series of anti-virus products from AVG Technologies - for checking the registry for virus additions and other security problems"
Xavidrvdrvsc.exe"Detected by Kaspersky as the AGENT.PH TROJAN!"
XAvimgtAvimgt.exe"Added by the GEMA TROJAN!"
XAvimgt32Avimgt32.exe"Added by the GEMA TROJAN!"
YavinitAVINIT9X.EXE"Command Antivirus related"
XAvira Anti-Virus Pro 2008explorear.exeAdded by an unidentified WORM or TROJAN!
XAvirTrAvirTr.exe"AntivirusTrigger rogue security software - not recommended
YAVK Mail CheckerAVKPop.exe"eXtendia AVK AntiVirus email checker"
YAVKBarAVKBar.exe"GData AntiVirusKit Anti-virus"
YAVKTrayAVKTray.exe"System Tray access to the antivirus part of G Data range of internet security products"
YAvMaiSrvAvmaisrv.exe"Part of Avast! anti-virus software - E-mail scanner"
XAVManagercsrss.exe"Added by the AUTORUN-DV WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
?AvMenuAVMenu.exe"Part of the ArcaVir antivirus suite from Polish company Arcabit. What does this part do and is it required?"
YAVMWlanClientwlangui.exeRelated to broadband products from avm.de
Xavnortformatsys.exe"Added by the SERFLOG.A WORM!"
Xavnortmsmbw.exe"Added by the SERFLOG.A WORM!"
Xavnortserbw.exe"Added by the SERFLOG.A WORM!"
Yavpavp.exe"Kaspersky anti-virus and AOL's Active Virus Shield (by Kaspersky) - found in either a Kaspersky or AOL sub-directory"
XAVP[path to trojan]"Added by the MUTBO-A TROJAN!"
Xavpavp.exe"Detected by Kaspersky as the ALPHABET.B TROJAN!"
Xavpwin*.tmp.exe [* is a number]Added by a variant of the ALPHABET TROJAN!
Xavpxar6000v7.exe"Detected by Kaspersky as the ALPHABET.B TROJAN!"
XAVP-SEavp-32.exe"Added by the AGOBOT.FS WORM!"
Xavpaavpo.exe"Added by the LEGMIR-ARK TROJAN!"
Yavpccavpcc.exe"Kaspersky Labs anti-virus"
XavplAntivirus.exe"AntiVirus Plasma rogue security software - not recommended
XAvpMAvpM.exe"Added by the STARTPAGE-ID TROJAN! Note - this is not the popular Kaspersky antivirus and this file is located in %Windir%\pchealth\UploadLB\Config"
Xavpmsavpms.exe"Added by the ONLINEGAMES.CPV TROJAN!"
XAvpravpr.exe"Added by the MYDOOM.AF WORM!"
XAVPSrvAVPSrv.exe"Added by the ONLINE-GEN TROJAN!"
Xavptask[path to trojan]"Added by the NOFERE-G TROJAN!"
Xavptaskexpl0rer.exe"Added by the AGENT.JJO TROJAN!"
XAvptaskrund1132.exe"Added by the AGENT.PKZ TROJAN!"
XAvpWxWErcx.exe"Detected by Kaspersky as a variant of the AGENT.A TROJAN!"
XAvril Lavigne - Muse[random filename]"Added by the AVRIL-A WORM!"
Xavrlabsavrlabs.exe"VirusResponse Lab 2009 rogue security software - not recommended"
Xavscanavscan.exe"Added by the SILLYFDC.BCR WORM! The file is in the users %Temp% directory"
XAVScanwinav.exeUnidentfied rogue security software
XAvScanavscan.exe"Antivirus System PRO and Spyware Protect 2009 rogue security software. The file is located in %ProgramFiles%\<rogue name>"
XavscanUsbconeted.exe"Added by the PROVIS-A TROJAN!"
YAVSCHED32AVSched32.exe"AntiVir® PersonalEdition Classic - antivirus"
YAVSchedScanSCHSC9X.EXE"Command Antivirus related"
XAVSchedulerAVSCHSVC.EXE"Part of the WinAntiVirus Pro 2005 rogue security software when installed in Win98/Me - not recommended
XAVSeguropgs.exe"AVSeguro
XAvSerdsm.exe"Added by the SERFLOG.B WORM!"
XAvSermsmpatch.exe"Added by the SERFLOG.B WORM!"
XAvSersvosm.exe"Added by the SERFLOG.B WORM!"
XAvSersysup.exe"Added by the SERFLOG.B WORM!"
Xavserve.exeavserve.exe"Added by the SASSER WORM!"
Xavserve2.exeavserve2.exe"Added by the SASSER.B or SASSER.C WORMS!"
Xavserve3.exeavserve3.exe"Added by the SASSER.G WORM!"
UAVStation premiumAVStation agent.exe"Related to Samsung AV Station - instant playback of music
XAVSTRTnavpsrvc.exe"Added by the FORBOT-EF WORM!"
XAVSystemCarepgs.exe"AVSystemCare rogue security software - not recommended. There are number of variants in this family sharing the same filename and user interface - see here"
Xavtapiavtapi.exe"Added by the AGENT.AM TROJAN! Note - example names include ""XviD""
NAvtrayAvtray.exe"Command Antivirus tray icon"
XAVTrayAVTray.exe"Part of the WinAntiVirus Pro 2005 rogue security software when installed in Win98/Me - not recommended
XAVupdate32 UpdateAVupdate32.exe"Added by the RBOT.CNI TROJAN!"
?AVWLPSTAAVWLPSTA.exe"PRISM Status Tray Applet - but what is it for and is it required?"
YAVWUpd32AVWUPD32.EXE"AntiVir® PersonalEdition Classic - updater"
Yavx communicatorxcommsur.exe"Anti-virus part of BitDefender virus scanner/firewall"
YAvxliveavxlive.exe"Bullguard or BitDefender antivirus"
Yavxlniavxinit.exe"Anti-virus part of BitDefender virus scanner/firewall"
?Avxnews??"??"
XBagleAVcsrss.exe"Added by the NETSKY.AB WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
Ybitdefenderliveavxlive.exe"Main program of BitDefender virus scanner/firewall"
XbootsecNAVSSE.exe"Added by the FORBOT-CY WORM!"
NBose Wave/PC Monitorwavepcmonitor.exe"System Tray access for this system (more info on the system here). Available via Start -> Programs"
XBrave-SentryBraveSentry.exe"BraveSentry rogue security software - not recommended
XBraveSentryBraveSentry.exe"BraveSentry rogue security software - not recommended
Xbraviaxbraviax.exe"Added by the FAKEALER.LE TROJAN!"
UBUFFALO Power Save Utility for HDHDManage.exe"Power Save utility for Buffalo backup hard discs"
UBullGuard Updateavxlive.exe"Part of Bullguard antivirus. Leave enabled unless you manually update virus definitions"
YBullGuardInitAVXINIT.EXE"Part of Bullguard antivirus"
YCaAvTrayCAVTray.exe"eTrust™ EZ Antivirus system tray application from Computer Associates"
NCashsurfers Cashbar NavigatorCashbar.Exe"Cashsurfers CashBar Navigator - ""The CashBar rotates banner advertisements once per minute and provides you with access to up to date special offers and deals"""
YCAVRIDCAVRID.exe"eTrust™ EZ Antivirus Real Time Infection Report from Computer Associates"
YCAVSCAVS.exe"Cheyenne (now eTrust) antivirus"
NCmFlywaveNameCmFlywav.exe"Driver for Linksys Wireless-G Music Bridge"
YcnfgCavCMain.exe"Part of Comodo Antivirus"
Xcommandjavaw.exe"Added by the AGOBOT-LG WORM!"
XCompaq Service Driversnavapqwa.exe"Added by the SDBOT.BBQ WORM!"
XContraviroContraviro.exe"Contraviro rogue security software - not recommended
XContraVirusContraVirusPro.exe"ContraVirus rogue security software - not recommended
XContraVirusContraVirus.exe"ContraVirus rogue security software - not recommended
NCorel ReminderNAVBROWSER.EXEIf you don't want to register Corel products and be reminded about it every 2 weeks disable it
NCorel ReminderNAVBrowser.exeRegistration reminder for CorelDRAW 10
Xcpntmgcnavpmc.exe"Added by the SIMCSS TROJAN!"
XCpusaveCpusave.exe"Added by the GEMA TROJAN!"
XCpusave32Cpusave32.exe"Added by the GEMA TROJAN!"
XCrnsavascrnsave.pif"Added by the SDBOT-ZV WORM!"
YCSAV_CheckVirusesvchk.exe"Command Antivirus related"
NCTAVTrayCTAvTray.exeFor Creative Soundblaster Live! series soundcards. Plays the EAX animation on start-up and adds a System Tray icon for it. Available via AudioHQ
XDASDS VSAVdjsdsabdw.exe"Added by the SDBOT-RE WORM!"
NDataViz Inc MessengerDvzIncMsgr.exe"Installed with DataViz ""Documents to Go"" software"
NDataViz MessengerDvzMsgr.exe"DataViz Documents to Go - "allows you to use your Word
Udesksaverdesksaver.exe"Part of Advanced Desktop Shield
UDeskSaverDeskSaver.exe"DeskSaver from Headway Creative - utility that allows you ""to backup and to restore the icons position easily on the Windows desktop"". The Pro version also includes a ""Taskbar Economizer"" which minimizes an open window to the System Tray instead of the taskbar. Located in %ProgramFiles%\Headway Creative\DeskSaver"
UDeskSaver ProDeskSaver.exe"DeskSaver Pro from Headway Creative - utility that allows you ""to backup and to restore the icons position easily on the Windows desktop"". Includes a ""Taskbar Economizer"" which minimizes an open window to the System Tray instead of the taskbar. Located in %ProgramFiles%\Headway Creative\DeskSaver"
Udesksaver.exedesksaver.exe"Part of Advanced Desktop Shield
Xdlcipscldcpavss.exe"Added by the MAILBOT-CB TROJAN!"
YDpcnavdpcnav.exe"DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access"
XDrives swapAV1i.exe"Anti-Virus Number-1 rogue security software - not recommended
XDrWeb AntivirusDRWEBAV.EXEAdded by an unidentified WORM or TROJAN!
?DZKillMeDZSAVEME.EXE"??"
XEasyAVEasyAV.exe"Added by the NETSKY.S or NETSKY.T WORMS!"
UELSAChipGuardelsavect.exe"ChipGuard for ELSA graphics cards - monitoring solution which monitors both the GPU temperature and fan speed
NEnergizer FileSaverEnergizer FileSaver.exe"Energizer FileSaver - UPS back-up utility for Energizer UPS products. From their Tech Support staff this is known to have a memory leak since it's release - with no fix planned! It will grab 2-5 handles per second and crash the average system in less than 3 days - therefore not recommended"
YeScan MonitorAVKWCTL9X.EXE"MicroWorld eScan antivirus"
UeScan Scheduleravkserv.exe"MicroWorld eScan antivirus scheduler"
XEtrafficJavaRun.exe"TopMoxie adware"
XExtra AntivirusExtraAV.exe"Extra Antivirus rogue security software - not recommended
XFast Antivirus 2009FastAV.exe"Fast Antivirus rogue security software - not recommended
UFavoriteSyncFavoriteSync.exe"FavoriteSync keeps the same set of Internet Explorer Favorites on several computers in sync"
XffeqOMEvcvsav.exe"Added by the RANKY.AB TROJAN!"
YFix-it AVmemcheck.exePart of Ontrack's Fix-it Utilities Suite anti-virus. Performs a quick check of memory for signs of any virus. Exits afterward and returns all resources used in one user's experience. Not required but could be left without a drain on resources
NfontnavFontNav.exe"Font Navigator from Bitstream Inc. - a font management utility"
Xfree-save[path to risk]"Freesave security risk that tracks and sends browser information and visited websites on the computer. Uninstall this software unless you put it there yourself"
NGCSGrabClipSave.exe"GrabClipSave screen capture tool"
XGeneral AntivirusGenAvir.exe"General Antivirus rogue security software - not recommended
XGhost AntivirusGhostAV.exe"Ghost Antivirus rogue security software - not recommended
UGravis Appawareloaderdbserver.exe"Looks like it's associated with Gravis game controllers and the Keyset Manager
UGravis Xperience Driver SupportGrxp4exe.exe"Driver for Gravis game controllers such as the Eliminator Aftershock. Must be loaded if you run the supplied application software for the controller to be recognized. Start it manually via a shortcut if not used"
XGustavVED[filename].exe"Added by the OPASERV.H WORM!"
Xhagentavp.exe"Added by the ""Herman Agent"" remote access TROJAN!"
XHomeAVhomeav.exe"Home Personal Antivirus rogue security software - not recommended
?HPAiODevice(hp officejet g series)hpoavn07.exe"HP Printer related
UHPPWRSAVHPPWRSAV.EXE"Power save related for HP Scanners. Many users have complained of system freezes with it running but it stops the light from remaining on all the time. Try www.hp.com
XHtProtectAVprotect.exe"Added by the NETSKY.L WORM!"
UHydraVisionDesktopManagerdesk98.exeATI/Appian HydraVision Desktop Manager software - monitors and regulates window and dialog box placement according to user preferences when using a multi monitor setup
UHydraVisionDesktopManagerHydraDM.exe"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is the HYDRAVISION Desktop Manager - which ""customizes the behaviour of windows and dialog boxes
UHydraVisionViewportviewport.exeATI/Appian HydraVision Desktop Manager software - monitors and regulates window and dialog box placement according to user preferences when using a multi monitor setup
UHydraVisionViewPortHydraMD.exe"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is HYDRAVISION MultiDesk - which ""creates
NIconsaverIconsaver.exe"IconSaver is a desktop icon manager"
Xicrosof Avps32 Controlav32.pif"Added by the RBOT-AVC WORM!"
Xicrosoftf Avpx Controlavpx.exe"Added by the RBOT-AYN WORM!"
XIE Java Updateiejava.exe"Added by the AGENT-HD TROJAN!"
XIExplorer32 Java ScriptingIExplore32b.exe"Added by the RBOT.ABO WORM!"
XIExplorer32c Java ScriptingIExplore32cb.exe"Added by the RBOT.ABN WORM!"
XIExplorer6 Java ScriptingIExplore326.exe"Added by a variant of the SDBOT WORM!"
XIExplorer7 Java ScriptingIExplore327.exe"Added by a variant of the SDBOT WORM!"
XInternet AntivirusIAvir.exe"Internet Antivirus rogue security software - not recommended
Yiolo AntiVirusioloAV.exe"iolo AntiVirus"
XiSafeAViSafeAV.exe"iSafe AntiVirus rogue security software - not recommended
Xjavaremote.cmd"Added by the BANKER-EHG TROJAN!"
Xjavasystem.exe"Added by a variant of the IRCBOT BACKDOOR!"
XJava (VM) v6.9jav.bat"Added by the AGENT-GZK TROJAN!"
XJava appletjavaup.exe"Added by the SDBOT-ACF WORM!"
XJava Applicationvssmf32.exe"Added by the SPIGOT BACKDOOR!"
XJava Auto Updateujm.exe"Added by the SDBOT-ADH WORM!"
XJava Runtime Environmentjbuild.exe"Added by the DELBOT-J WORM!"
XJava Runtime Valuerunjava.exe"Added by the RBOT-DDJ WORM!"
XJava Runtimesiexplore.exe"Added by the KILLAV.B WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This file is located in a %Windir%\Java\Java folder"
XJava SofteJava32.com"Added by the RBOT.ECN WORM!"
XJava updatejavaqs.exe"Added by the SWARLEY.A WORM!"
XJava Updatekeeper.exe"Added by the AGENT-DIS TROJAN!"
XJava Updatesvchost.exe.exe"Added by the AGENT-LBS TROJAN!"
XJava Updatehostwww.exe.exe"Added by the AGENT-MFH TROJAN!"
XJava Virtual Machinejavaw.exe"Added by a variant of the RBOT WORM!"
XJava VM v6.9.2jav.bat"Added by the DWNLDR-HLM TROJAN!"
XJava VM v6.91jav.bat"Added by the DWNLDR-HLL TROJAN!"
NJava(TM) Platform SE 6jusched.exe"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
NJava(TM) Platform SE 6 U*jusched.exe"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now. U* represents the update version
NJava(TM) Platform SE Auto Updater 2 0jusched.exe"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
XJava**.exe [* = random char]Java**.exe [* = random char]"CoolWebSearch/HomeSearch adware - for examples
XJava**32.exe [* = random char]Java**32.exe [* = random char]"CoolWebSearch/HomeSearch adware - for examples
Xjava-pluginjavasctp.exe"Added by the VB.AMX TROJAN!"
XJava32 Configuration Loadermsnmesgr.exe"Added by a variant of the RBOT WORM!"
XJavaCoreJavaCore.exe"Added by the MATCASH TROJAN!"
XJavascriptjscript.exe"Added by the DELBOT-AD WORM!"
XJavaScript Debugging ServiceJsDbgMan.exe"Added by the DERDERO.E WORM!"
XJavaScriptMsxrsMsxrs.exe"Added by the VB.BL WORM!"
XJavaTraytraymgr.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
XJavaUpdate0.07[filename]"Added by the JUPDATE TROJAN!"
XJavaUpdateSchedjusched32.exe"Added by the BCKDR-CKB BACKDOOR!"
XJavaVMjava.exe"Added by the MYDOOM.M WORM and variants! Note - not to be confused with the valid Windows ""java.exe"" which is located in %System% as this is located in %Windir%"
Xjavawsa.exejavawsa.exe"Added by the BANK-Y TROJAN!"
XJufualtjava2.exe"Added by the SDBOT.AOE WORM!"
YKaspersky Anti-HackerKAVPF.exe"Kaspersky Anti-Hacker personal firewall - no longer available"
YKaspersky Anti-Virus MonitorAvpM.exe"Kaspersky Anti-Virus Lite - no longer available"
XKaspersky AntivirusKasperskyAV.exe"Added by a variant of the RBOT WORM!"
XKaspersky Email Securityjavaupd.exe"Added by the SWARLEY.A WORM!"
XKasperskyAvkaspersky.exe"Added by the MIMAIL.T WORM! Note - this has nothing to do with the real Kaspersky anti-virus"
XKasperskyAVEngKasperskyaveng.exe"Added by the NETSKY.V WORM!"
Ykavavp.exe"Kaspersky anti-virus and AOL's Active Virus Shield (by Kaspersky) - found in either a Kaspersky or AOL sub-directory"
Xkavakavo.exe"Added by the LINEAG-GLG TROJAN!"
XKAVFOXwin1ogoin.exe"Added by the GWGHOST-M TROJAN!"
Xkavirkavir.exe"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
XKAVPersonalsvchost.exe"Added by the LINEAGE-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
YKAVPersonal50Kav.exe"Kaspersky Anti-Virus Personal 5.0"
XKAVPersonal90wscntfy.exe"Added by the BANKER-FZ TROJAN!"
YKavPFWKavPFW.exe"KingSoft Personal Firewall"
XKavRunsWindll.exe"Added by the TRYNOMA TROJAN!"
YKavStartKAVStart.exe"KingSoft Personal Firewall"
Ykavsvckavsvc.exe"Kaspersky antivirus"
XKavSvc******.exe reg_run [* = random char]"Added by the QOOLOGIC TROJAN!"
Xkavsvc[random 6 char filename]"Added by the QOOLOGIC TROJAN! Uses random file names (examples: nzkklz.exe
XKAVutil[worm filename]"Added by the WINTOO.B WORM!"
Xkviurskav.exe"Added by the SILLYFDC.BBJ WORM!"
XLavasoft Ad-AwareAd-Aware.exe"Added by the RBOT-SO WORM! Note - this is not the popular Ad-Aware spware/adware removal tool and is located in %System%"
ULavasoft AdwatchAd-watch.exe"Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system"
XLogin Screen Saverlogin.scr"Added by the RBOT-AVN WORM!"
XLsasskavmm.exe"Added by an unidentified WORM or TROJAN! NOTE - do NOT confuse with the legitimate Kaspersky antivirus module as described here. Contrary to this impostor
XM3Development_WhenUSave_InstallerM3Development_WhenUSave_Installer.exe"WhenU.Save adware"
XMacromedia Dreamweaver XMmacdwXM.exe"Added by the AGOBOT-RI WORM!"
XMatrixScreenSavermss.exeUnidentified malware
XMAV_checkmav_startupmon.exe"Part of the WinAntiVirus Pro 2007 rogue security software - not recommended
Xmav_startupmonmav_startupmon.exe"Part of the WinAntiVirus Pro 2007 rogue security software - not recommended
XMcAfeeMcAffeAv.exe"Added by the NETSKY.AL WORM!"
XMcAfee AntivirusMcAfeeAV.exe"Added by a variant of the RBOT WORM!"
XMcAfee Antivirus 32MCAFEEAV32.EXE"Added by the SPYBOT-EH WORM!"
XMcAfee Antivirus ProtectionmcafeeAV.exe"Added by a variant of the RBOT WORM!"
XMcAfee Online virus Scanneravp.exe"Added by the RBOT-GCV WORM! Not to be confused with Kaspersky anti-virus and AOL's Active Virus Shield (by Kaspersky) - found in either a Kaspersky or AOL sub-directory"
YMcAfeeVirusScanServiceAvsynmgr.exe"From McAfee VirusScan version 5.x. Runs VirusScan System Tray (Vsstat.exe)
XMegaVirusKitpgs.exe"MegaVirusKit rogue security software - not recommended. A member of the AVSystemCare family"
Ymgavctrlmgavrtcl.exePart of older versions of McAfee's internet security products such as VirusScan and VirusScan Online
Ymgavrtclexemgavrtcl.exePart of older versions of McAfee's internet security products such as VirusScan and VirusScan Online
Ymgavrtclexemgavrte.exePart of older versions of McAfee's internet security products such as VirusScan and VirusScan Online
XMicrosoft Anti Virus Controllermsavc.exe"Added by a variant of the IRCBOT BACKDOOR! See here"
XMicrosoft Anti Virus Controllermsavc32.exe"Added by the SDBOT.EPW BACKDOOR!"
XMicrosoft DLL Verifierwinavguard.exeAdded by the SDBOT.AAD WORM!
XMicrosoft Gina V EncryptionMSGINAV.EXE"Added by an unidentified VIRUS
XMicrosoft Java Virtual MachineMsConfiG.exe"Added by the FORBOT-DV WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting"
XMicrosoft Java Virtual Machinemsjvm.exe"Added by a variant of the SDBOT WORM!"
XMicrosoft Java Virtual Machinejavavm.exe"Added by a variant of the RBOT WORM!"
XMicrosoft Java Virtual Machinemsjavarxp.exe"Added by the FORBOT-DL WORM!"
XMicrosoft Java Virtual Machinewinscr32.exe"Added by a variant of the WOOTBOT WORM!"
XMicrosoft Java Windows Update[filename]"Added by the RBOT-DZ WORM!"
XMicrosoft JavaVMmsjarun.exe"Added by the RBOT-JW WORM!"
XMicrosoft Machinewinjava.exe"Added by a variant of the AGOBOT/GAOBOT WORM!"
XMicrosoft PC Health Remote Assistance File Open & Save controlssfrcdlg32.exe"Added by the RBOT-AVY WORM!"
XMicrosoft Security Centersavservices.exe"Added by the RBOT-ANU WORM!"
XMicrosoft Service Disk Cycledisksave.exe"Added by a variant of the IRCBOT TROJAN!"
XMicrosoft Synchronization Managerjava.exe"Added by a variant of the SDBOT WORM!"
XMicrosoft System Saver[path to worm]"Added by the RBOT.BSK WORM!"
XMicrosoft Updatenavmgrd.exe"Added by the SDBOT.DP TROJAN!"
XMicrosoft UpdateNAV.exe"Added by the RBOT-IV WORM!"
XMicrosoft Updatingnavguard.exe"Added by the RBOT.HW WORM!"
XMicrosoft Word ProfissionalJava Plug In close.exe"Added by the BANKER-EL TROJAN!"
XMicrosoftCorpjavaw.exe"Added by the BUZUS.BULO TROJAN!"
XMicrosoftNAPCjavaw.exe"Added by the BUZUS.BULO TROJAN!"
UMilShieldSlaveShieldWorker.exe"Mil Shield from Mil Incorporated. It protects your privacy by removing all tracks from your online or offline computer activities"
NMiniMavisMiniMavis.exeMavis Beacon typing tutor
XMonitor calibrationAV1i.exe"Anti-Virus-1 rogue security software - not recommended
XMS Java Applets for Windows NT & XPjavaapplet.exe"Added by the RBOT.BHG WORM!"
XMs Java for Windows NTMS32.exe"Added by the VANEBOT-H WORM!"
XMs Java for Windows NTmsi32java.exe"Added by the VANEBOT-I WORM!"
XMs Java for Windows NTmsjava.exe"Added by the VANEBOT-E WORM!"
XMs Java for Windows NTmsi32info.exe"Added by the RBOT.AFX WORM!"
XMS Java for Windows XP & NTjavanet.exe"Added by the VANEBOT-A WORM!"
XMS Java Service Wrapper Windows NT & XPwrapper.exe"Added by the VANEBOT-D WORM!"
XMs Java Update For Windows NT/XPmsijavaupdt32.exe"Added by the RANDEX.AF WORM!"
XMS Java virtual machinejavavm.exe"Added by the RBOT.ABG WORM!"
XMS Screen Saverscrsave.scr"Added by the RBOT-AGT WORM!"
XMS UniXnavupdate64.exe"Added by the RBOT.CRZ BACKDOOR!"
Xmsavsc.exemsavsc.exe"Added by the AGENT.ANQ TROJAN!"
XMSFWAVTSMFTPDev.exe"Added by the RBOT-ACF WORM!"
XMSInfoAVBgle.exe"Added by the NETSKY.O WORM!"
Xmsjava servicexpcd.exe"Added by the SDBOT.VM WORM!"
XMSMcAfeeeAvsynmgr32e.exe"Added by the FRAMAR TROJAN!"
XMSMcAfeehAvsynmgr32h.exe"Added by the FRANGO TROJAN!"
XMSMcAfeeSAvsynmgr32S.exe"Added by the VOLAC or VOLAC.DR TROJANS!"
XMSNavWHMSWkwrH.exe"Added by the ANAV-A WORM!"
XMSOfficeCfgnavchk.exePremium rate adult content dialer
Xmsvcavmsvcav.exe"Added by the AGENT-ACR TROJAN!"
Xmswavemswave.exe"Added by the CRYPTER.A TROJAN!"
XMswavedllmswavedll.exe"Added by the CRYPTER-C TROJAN!"
Umwavscanmwavscan.com"MicroWorld Anti Virus Toolkit is a free anti-virus scanner that runs on-demand. You can choose to scan your entire system
XMyAVavpguard.exe"Added by the NETSKY.J WORM!"
XNano Antivirusnanoav.exe"Nano Antivirus rogue security software - not recommended
XNAVRuxDLL32.exe"Added by the MAPSON.D WORM!"
YNAV Agentnavapw32.exeNorton Anti-Virus's background scanning process
XnAv AGENTN/A"Added by the RIOSYS MACRO! Note the lower-case ""n"" and ""v"" in the name as this is not the valid Norton AntiVirus entry of the same name - indeed it closes Norton AV processes"
XNAV Agentsystems.exe"Added by the TARNO.C TROJAN! Note - this is not the valid Norton Antivirus entry of the same name"
XNAV Agentwinsnav.vbs"Added by the ANPES WORM!"
XNAV Agentwmilib32.exe"Added by the VB-XU TROJAN!"
XNAV Auto Protnavprot1.exe"Added by the RBOT.ZAC WORM!"
XNAV Auto Protectmsfwe1.exe"Added by a variant of the RBOT WORM!"
XNAV Auto Protectnavprotect.exe"Added by the RBOT.BKW WORM! Note - this is not a valid Norton AntiVirus product from Symantec"
XNAV Auto Protectdnsserv.exe"Added by a variant of the SDBOT WORM!"
XNAV Auto Protectmcafee32.exe"Added by a variant of the SPYBOT WORM!"
XNAV Auto Update[random filename]"Added by the SPYBOT-E WORM!"
XNAV Auto Updateiamsad.exe"Added by the SPYBOT-CE BACKDOOR!"
XNAV Auto UpdateSadness.exe"Added by the SPYBOT-E WORM!"
XNAV Auto Updatescsrssp.exe"Added by a variant of the SDBOT WORM!"
XNAV Auto Updatesnavwindows.exe"Added by a variant of the SDBOT WORM!"
XNAV Auto Updatesslserves.exe"Added by the RBOT.COI BACKDOOR!"
XNAV Auto Updatesnavupdaterx.exe"Added by a variant of the RBOT WORM!"
NNAV CfgWizcfgwiz.exe"Introduced with Norton Anti-Virus 2002
NNAV Configuration Wizardcfgwiz.exe"Introduced with Norton Anti-Virus 2002
UNAV DefAlertDefAlert.exeNorton Anti-Virus Definitions Alert. Warns you if virus definitions are out of date. Leave enabled unless you manually update virus definitions on a regular basis
XNAV Live Update[path to worm]"Added by the DEBORMS.C WORM! Note - this is not a valid Norton Anti-Virus (NAV) function from Symantec"
XNAV Scan ServiceNAVSCAN32.EXE"Added by the SDBOT.VG WORM!"
XNavAgent32lasvr32.exe"Added by the FEMOT.D WORM!"
XNavAgent32SCardSvr32.Exe"Added by the MOFEI.B WORM!"
Xnavappnavapp.exe"NavExcel adware variant"
Ynavapw32navapw32.exeNorton Anti-Virus's background scanning process
XNAVChecknavchk.exePremium rate adult content dialer
XNAVCheckshman.exePremium rate adult content dialer
XNavegateiiexplorer.exe"Added by the BANCBAN-OP TROJAN!"
XNavegatewisterd.exe"Added by the BANKER-BOS TROJAN!"
UNaverPCGreenNPCGreenUpgrader.exe"Related to Naver_Anti-virus Realtime Monitor From NHNCorp"
UNaviscopenaviscope.exe"Naviscope is a multipurpose browser enhancement that can speed up Web searches
XNaviSearchnls.exe"NaviSearch
NNavLoadNAVBrowser.exeRegistration reminder for CorelDRAW 10
Xnavman_20sysnav32.exe"Hijacker
?NAVMD25UpdtNv28.exeAdded by Symantec for updating the MicroDefs for their AV products - is it required?
XNAVMon32NAVMon32.exE"Added by the WINKO.AO WORM!"
XNAVNet***.tmp [* = random digit]Unidentified adware
Xnavp.exenavp.exe"Added by the AGOBOT-OE WORM!"
XNavPassNavPass.exeFree system for gaining access to and downloading from adult content web-sites
XNavScan[filename]"Added by the OBSORB TROJAN!"
XNAVSCAN32.EXENAVSCAN32.exe"Added by the SDBOT-DO WORM!"
XNAVSCANNER32NAVSCANNER32.EXE"Added by the RBOT.QC WORM!"
XNAVtaskNAVtask.exe"Added by the REMBOT-A BACKDOOR!"
XNAVUpd"rundll32.exe navupd.dll Startup"
XNAVWatchNAVWatcher.exe"VX2.Transponder parasite updater/installer related"
XNAV_UpdateNAV_Update.exeUnidentified WORM or TROJAN!
XNDAvcsnss.exe"Added by the SERFLOG.C WORM!"
XNDAvsvhost.exe"Added by the SERFLOG.C WORM!"
XNeroFileCheckmsjavam32.exe"Added by the AGOBOT.AKM WORM!"
XNeroUpdate Checkmsjava.exe"Added by the AGOBOT.AMH WORM!"
XNeroUpdater6.8winjava.exe"Added by the AGOBOT.AMK WORM!"
XNewmanplayavi.exe"Added by the LINEAGE-AT TROJAN!"
XNI.UAVIFR_0001_N105M2404[path to file]"Installer for the VirusGarde French rogue security software - see here"
XNorton Antiviral Scannernavscnr.exe"Added by the DELBOT-K WORM!"
XNorton Antivirusnortonav.exe"Added by the RBOT-AYE TROJAN! Note - this is not the real Norton AV!"
XNorton Antivirus 2004SYMANTECAV2.EXE"Added by the SPYBOT-DY WORM! Note - this is not the real Norton AV!"
XNorton Antivirus AVFVProtect.exe"Added by the NETSKY.P WORM! Note - this is not the popular AV software!"
XNorton AntiVirus SysNAVsys32.exe"Added by a variant of the WOOTBOT WORM!"
XNorton Antivirus Updaternortonav.exe"Added by the DELBOT-T WORM! Note - this is not the real Norton AV!"
XNorton Auto Protectnava.exeAdded by an unidentified WORM or TROJAN!
YNorton Auto-Protectnavapw32.exeNorton Anti-Virus's background scanning process
?Norton AV PreloadPremend.exe"Norton Antivirus related. What does it do and is it required"
XNorton AV Protection StartupAti2xxx.exe"Added by a variant of the RBOT WORM!"
XNorton Live UpdaterCavapsvc.exe"Added by the GAOBOT.AO WORM!"
XNorton Live UpdaterAvapsvc.exe"Added by the AGOBOT-BG BACKDOOR!"
NNorton Navigator Loadernnloader.exe"An older Norton utility for file management under Windows 95. More information here"
XNorton Service Processnavapvc.exe"Added by a variant of the AGOBOT/GAOBOT WORM!"
XNorton Service Processnavapsvc.exe"Added by the AGOBOT-GV WORM! Note - this is not the valid Norton Anti-Virus service which has the same file and is located in %ProgramFiles%\Norton AntiVirus. This one is located in %System%"
XNorton SpySweeper AutoUpdatenavsw.exe"Added by the FORBOT-AS WORM!"
XNorton Updaternavupdtr.exe"Added by the SDBOT.AXV WORM!"
XNortonAVnorton_antivirus.exe"Added by the NETJOE TROJAN! Note - this is not the legitimate Symantec AV program"
XnortonavCCUPD32.EXEAdded by an unidentified WORM or TROJAN!
XNortons AV SYSTEMscvchost.exe"Added by a variant of the RBOT WORM!"
XNortons AVS Systemsarse.exe"Added by the RBOT.AWY WORM!"
Xnsdcmd servicesnsdcmdav.exe"Added by a variant of the AGOBOT/GAOBOT WORM!"
XNvCplDmnNAVSVC.EXE"Added by an unidentified VIRUS
XNvCplScankav32.exe"Added by the FORBOT-EW WORM!"
XnVidia Application Driversnvidiav32.exe"Added by a variant of the IRCBOT BACKDOOR!"
XPaladin Antiviruspav.exe"Paladin Antivirus rogue security software - not recommended
YPanda Cleanerpavdr.exe"Panda internet security software related. Possibly the ActiveScan on-line scanner?"
UPanda Schedulerpavsched.exe"Scheduler for older versions of Panda Antivirus. Required if you have scans scheduled on a regular basis"
XPandaAVEnginePandaAVEngine.exe"Added by the NETSKY.R WORM!"
UPandaSchedulerpavsched.exe"Scheduler for older versions of Panda Antivirus. Required if you have scans scheduled on a regular basis"
XPAVpav.exe"Personal Antivirus rogue security software - not recommended. Located in %ProgramFiles%\PAV"
XPAV.EXE%Number%"Added by the KITRO.D (or ARGEN.A) WORM! %Number% can be any number"
YPAV.EXEPAV.EXE"PER Antivirus"
YPAVFIRESPavFires.exe"Firewall included with older versions of Panda Antivirus and Internet Security"
YPAVFNSVRPavFnSvr.exe"Part of Panda Antivirus and Internet Security"
YPavkre9xpavkre9x.exe"Part of the 2005 & 2006 versions of Panda Antivirus and Internet Security"
YPavProcPavPrS9x.exe"Part of Panda Antivirus and Internet Security"
YPavProtPavProt.exe"Part of the 2004 & 2005 versions of Panda Antivirus and Internet Security"
YPavprot9Pavprot9.exe"Part of the 2005 versions of Panda Antivirus and Internet Security"
YPC Tools AntiVirus ClientPCTAV.exe"System Tray access to PC Tools AntiVirus from PC Tools - which ""provides world-leading protection against viruses
YPCTAVPCTAV.exe"System Tray access to PC Tools AntiVirus from PC Tools - which ""provides world-leading protection against viruses
YPCTAVAppPCTAV.exe"System Tray access to PC Tools AntiVirus from PC Tools - which ""provides world-leading protection against viruses
NpdfSaver3pdfSaver3.exe"PDF-XChange - create Adobe compatible PDF files from virtually any Windows software such as MS Word
YPER Email Protectionpavmail.exe"PER Antivirus"
XPerfomance Monitordavcsync.exe"Added by the LAMUD-A WORM!"
XPersonal AntivirusPerAvir.exe"Personal Antivirus rogue security software - not recommended
XPersonalAVpav.exe"PersonalAV rogue security software - not recommended. Detected as the FAKEAV.FT TROJAN by Trend. Located in %ProgramFiles%\PersonalAV"
XPlayboyplayavi.exe"Added by the GAMANLOCK TROJAN!"
XPoliceAVxppolice.exe"XP Police Antivirus rogue security software - not recommended
XPopularScreensaversWallpaper"rundll32 [path] F3SCRCTR.DLLLES"
XPostdavatchnvdas.exe"Added by the RANDEX.T WORM!"
XProtocol Settingskav.exe"Added by a variant of the RBOT WORM!"
UPwrsavePwrsave.exeToshiba Power Saver utilities. Required on a laptop if you run of a battery and want to conserve power
XQQKAVscvhsot.exe"Added by the QQROB.ARQ WORM!"
XQTSvcnavchk.exePremium rate adult content dialler
XRA ServerSlave.exeAdded by the RA TROJAN!
XRapdataravsecs.exe"Added by the QQPASS-V TROJAN!"
XRapdatybsravseteyns.exe"Added by the PWS-ACP TROJAN!"
XRaptelnetravspeger.exe"Added by the QQPASS-AA TROJAN!"
XRapteltravspegtl.exe"Added by the QQPASS-AB TROJAN!"
YRAV8Trayravtray8.exe"RAV anti-virus related"
XRavAvRavMonE.exe"Added by the RJUMPF-F WORM!"
XRavAvAdobeR.exe"Added by the RJUMP.D WORM!"
XRAVEN_VLZS.EXERAVEN_VLZS.EXE"DownloadReceiver parasite - no longer in existence"
YRavMonRavMon.exe"RAV AntiVirus"
Xravshellexpl0rer.exe"Added by the DLOADER.MAR TROJAN!"
XRavshellexplore3.exe"Added by the PAKES.HZ TROJAN!"
XRavshellIEXPLORER.EXE"Added by the AGENT.URZ TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
XRavshellrund1132.exe"Added by the AGENT.OKZ TROJAN!"
XRavshellsvch0st.exe"Added by the NSPM.PU TROJAN! Notice the digit ""0"" in the filename rather than the lower case ""O"""
Xravshell1explore.exe"Added by the DLOADER.MJF TROJAN!"
Xravshelliexpl0re.exe"Added by the NOFERE-A TROJAN! Note the number ""0"" in the filename"
YRavStubravstub.exe"Rising antivirus"
Xravtaskrund1132.exe"Added by the DLOADER.IYT TROJAN!"
Xravtasksvch0st.exe"Added by the LINEAG-AIN TROJAN!"
YRavTaskRavTask.exe"Rising antivirus"
Xravtaskiexpl0re.exe"Added by the AGENT.AIR BACKDOOR! Note the number ""0"" in the filename"
XRavTimeMstray.exe"Added by the WUKILL.A WORM!"
YRavTimerRavTimer.exe"RAV AntiVirus"
XRavTimerexplores.exe"Added by the HOMEY-A TROJAN!"
XRavTimeXP[worm filename]"Added by the WULLIK.B WORM!"
XRavTimeXPVirus"Added by the CAGER.A WORM!"
XRavTimXP[worm filename]"Added by the WULLIK.B WORM!"
XRavUptetsagetlke.exe"Added by the QQPASS-AK TROJAN!"
XRavUptktagetlktz.exe"Added by the QQPASS-AJ TROJAN!"
XRavUptperavsesur.exe"Added by the QQPASS-T TROJAN!"
?rav_temp.exerav_temp.exe"??"
XRBOT v2 with NetAPI exploit traded with billgates I gave my mother Greetz - OG - Bluehell Irc Serverglossary.exe"Added by the VANEBOT-J WORM!"
XRealAV.exeRealAV.exe"Real Antivirus rogue security suite - not recommended
NRegShaveregshave.exe"Part of the USB driver for your Fuji digital cameras - used when uninstalling the USB drivers
XRemote Access SlaveSynchost.exe"Added by the RIPJAC TROJAN!"
Xrun=RAVMOND.exe"Added by the LOVGATE-F WORM!"
Xs9201av2008xp.exe"Antivirus 2008 XP rogue security software - not recommended
XSafePcAvSafePcAv.exe"SafePcAv rogue security software - not recommended
XSaggwwggCVAvwwd.exe"Added by the LIOTEN.HT WORM!"
XSalestartmav_startupmon.exe"Part of the WinAntiVirus Pro 2007 rogue security software - not recommended
YSAVAgentSAVAgent.exe"Part of Sophos anti-virus software. Required for centrally administered Sophos updates to work correctly
XSavasddwqffasd.exe"Added by the SDBOT-SI WORM!"
XSaveSave.exe"WhenU.Save adware"
XSavelssas.exe"Added by an unidentified TROJAN! See here"
XSaveArmorSaveArmor.exe"SaveArmor rogue security software - not recommended
XSaveDateSaveStartDate.ExeUnidentified adware
XSaveDefenderSaveDefender.exe"SaveDefender rogue security software - not recommended
XSaveDefenseSaveDefense.exe"SaveDefense rogue security software - not recommended
XSaveKeepSaveKeep.exe"SaveKeep rogue security software - not recommended
XSaveKeeperSaveKeeper.exe"SaveKeeper rogue security software - not recommended
XSavenowSaveNow.exe"WhenU.Save adware"
XSaveSoldierSaveSoldier.exe"SaveSoldier rogue security software - not recommended
XSavsvc"rundll32.exe savsvc.dllstart"
NScanSoft PaperPort 7 Registration ReminderNAVBrowser.EXE"Registration reminder for PaperPort 7 from Scansoft (now Nuance)"
XSchedulerMgrnavchk.exePremium rate adult content dialer
XScreen Saverscrnsaver.scr"Added by the RBOT-AGP WORM!"
NScreen Saver ControlFSScrCtl.exeInstalls as part of the Hubble Space Telescope screen saver (and possibly others). Lets you control your installed screensavers from a System Tray icon
XScreenSaverPlus"rundll32.exe MSA64CHK.dllDllMostrar"
XSDAvcsnss.exe"Added by the SERFLOG.C WORM!"
XSDAvsvhost.exe"Added by the SERFLOG.C WORM!"
Xsearchnavsearchnav.exeSearchNav adware - IEFeatures/Popnav variant
XSearchNavVersionsearchnavversion.exeSearchNav adware - IEFeatures/Popnav variant
XSecure AntiVirus Proav.exe"Secure AntiVirus Pro rogue security software - not recommended
XSecurePcAvSecurePcAv.exe"SecurePcAv rogue security software - not recommended
XSecurity Master AVSM[random characters].exe"Security Master AV rogue security software - not recommended
XService Monitorjavams32.exe"Added by the DELF-NK TROJAN!"
XService Monitorjavams64.exe"Added by the SDBOT-AFO WORM!"
XService Registry NT Savejdbgmgrnt.exe"Added by the BANCOS-CG TROJAN!"
XService Registry NT Savetaskmgrnt.exe"Added by the BANCOS-BY TROJAN!"
XService Registry NT Saveregeditnt.exe"Added by the BANCOS-BM TROJAN!"
XShockwavecsrss.exe"Added by the SNDOG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
NShockwave InitSWINIT.EXEPart of Macromedia Shockwave. Controls the Shockwave Remote Control Panel. The Remote Control can be activated manually from the Start Menu by locating and selecting Shockwave and then Shockwave Remote under Programs
XShockwave SupportFlashPlayer.exe"Added by the DELF-DRA WORM!"
USiteAdvisorSiteAv.exe"Refer to the SiteAdv.exe entry. This entry only appears to originate from version 2.0.0.75 (Build 4295) of SiteAdvisor and the registry entry incorrectly points to the invalid filename ""SiteAv.exe"" - when it should be ""SiteAdv.exe"""
USiteAvSiteAv.exe"Refer to the SiteAdv.exe entry. This entry only appears to originate from version 2.0.0.75 (Build 4295) of SiteAdvisor and the registry entry incorrectly points to the invalid filename ""SiteAv.exe"" - when it should be ""SiteAdv.exe"""
Xskynetave.exeskynetave.exe"Added by the SASSER.D WORM!"
XSndsaverSndsaver.exe"Added by the GEMA TROJAN!"
XSpecial Firewall Serviceavguard.exe"Added by the NETSKY.G WORM! Note - do not confuse with AntiVir® antivirus which uses the same filename. This one is located in %Windir%"
XSun Java Console for Windows NT & XPjconsole.exe"Added by the VANEBOT-C WORM!"
XSun Java Updaterstacsv.exe"Added by the BUZUS.DBFM TROJAN!"
XSun Java Updater v5javajre.exe"Added by the AUTORUN-XI WORM!"
XSun Java Updater v7.4javawx.exe"Added by the ACKANTTA.B WORM!"
XSunjavajavasmart.exe"Added by the AGENT.AHV TROJAN!"
XSunJava Updater v7javale.exe"Added by the ACKANTTA.B WORM!"
XSunJavaSchedccEvtMngr.exe"Added by the SDBOT-YP WORM!"
XSunJavaSched Updateravamx.exe"Added by the RBOT-ABJ WORM!"
XSunJavaUpdatesmvss.exe"Added by the DEDLER-G TROJAN!"
XSunJavaUpdaterjavaw.exe"Added by the MYTOB.QR WORM!"
XSunJavaUpdaterv13javaupdater.exe"Added by the ROUTROBOT WORM!"
NSunJavaUpdateSchedjusched.exe"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
XSunJavaUpdateSchedscvhost.exe"Added by the SDBOT-AVX WORM!"
XSunJavaUpdateSchedjavamx.exe"Added by the SDBOT-WI WORM!"
XSunJavaUpdateSched10jushed.exe"Added by the ACKANTTA.F WORM!"
XSunJavaUpdateSched132jschd.exe"Added by the AUTORUN-AQY WORM!"
XSunJavaUpdateSched16jvshed.exe"Added by the ACKANTTA.G WORM!"
XSunJavaUpdatSchedspoolsv.exe"Added by the BANCBAN-NP TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %ProgramFiles%\MSN Messenger"
NSwap Nutjavaw.exe"javaw.exe can be loaded by other programs at startup but in this instance it's SwapNut
XSwf32AVupdate.exe"Added by the MERKUR.E WORM!"
XSymantec Security Routine Addonnavpaw.exe"Added by the AGOBOT-ES BACKDOOR!"
XSymantec Security Routine Addon for Microsoft Windowsnavpxaw32.exe"Added by the AGOBOT-GJ TROJAN!"
XSymAVSymAV.exe"Added by the NETSKY.U WORM!"
XSysAntivirus 2009sysav.exe"SysAntivirus 2009 rogue security software - not recommended
Xsysavwinav.exe"WinPC Antivirus rogue security software - not recommended
XSystem Information ManagerNavcpe.exe"Added by the SDBOT-QB WORM!"
XSystemServicenavchk.exePremium rate adult content dialler
Xtavatavo.exe"Added by the CRPYT.DE TROJAN!"
XTiny AVfooding.exe"Added by the NETSKY.I WORM!"
?TlcRavp.exe"??"
XtopmoxieJavaRun.exe"TopMoxie adware"
XTRE AntiVirustreav.exe"TRE AntiVirus rogue security software - not recommended
YTrend Micro AntiVirus 2007tavui.exe"Part of Trend Micro AntiVirus 2007"
XTrend Micro AVtrendav.exe"Added by the AGOBOT-OH WORM! Note - this is not a valid Trend Micro antivirus entry"
YTrendMicro AntivirusAveagent.exeVirus scanner
XUltimate System GuardMainFAVProj.exe"Ultimate System Guard rogue security software - not recommended
XUpdate.exeravseuper.exe"Added by the QQPASS-P TROJAN!"
Xupdatelavasoftupdatelavasoft.exe"CoolWebSearch parasite variant - redirecting to lalasearch.com"
XUsB drivermsjavx86.exe"Added by the AGOBOT-PQ WORM!"
XVideo ProcessAvg123.exe"Added by the AGOBOT-MS WORM!"
XVideo ProcessNavapsvcc.exe"Added by the SPYBOT-CW WORM!"
XVirusCheckIIAVIRCHK.EXE"Added by the DASMIN TROJAN!"
UVoiceCenterAndreaVC.exe"Related to Andrea's Superbeam microphone utility"
UVZRemoteCommanderAvRmtCtr.exeRelated to Sony's VAIO Zone Remote Commander
YWaveFramerWaveFramer.exe"Part of SafeSpace (from Artificial Dynamics) which ""protects computers from Internet malware infection without the need for signature updates or regular maintenance"""
NWaveTop LauncherWaveTop.exe"WaveTop - ""Get push content from TV without an Internet connection"" - now possibly a defunct system in the US included as an optional part of WebTV in Win98"
NWaveTop Receiver 1N/A"WaveTop - ""Get push content from TV without an Internet connection"" - now possibly a defunct system in the US included as an optional part of WebTV in Win98"
NWaveTop Receiver 2N/A"WaveTop - ""Get push content from TV without an Internet connection"" - now possibly a defunct system in the US included as an optional part of WebTV in Win98"
NWaveTop Upload ManagerN/A"WaveTop - ""Get push content from TV without an Internet connection"" - now possibly a defunct system in the US included as an optional part of WebTV in Win98"
YWavXMgrWavXDocMgr.exe"Part of Wave Systems Corp. Embassy Trust Suite. ""Document Manager uses the hardware security provided by the TPM to provide strong protection for data. Files encrypted by Document Manager cannot be located or viewed by others"""
XWebdav.exewebdav.exeIRC DDoS bot which gives the hacker full control over your system
Uwebsaverlivewebsaverlive.exe"WebSaver Live! is a companion program to Websaver that retrieves information from the Internet on a schedule and displays it on your screen when your computer is idle"
XWebSavingsfromEbatesWebSavingsfromEbatesrun.exe"Web Savings From Ebates Software
XWebSavingsFromEbates0WebSavingsFromEbates0.exe"Web Savings From Ebates Software
Uwebscanstopsignav.exe"eAcceleration Stop-Sign security software related. Previously not recommended
XWhenUSaveSave.exe"WhenU.Save adware"
XWin Antispyware Centerav.exe"Win Antispyware Center rogue security software - not recommended
XWin32 Usb DriverAvpG.exe"Added by the FORBOT-BX WORM!"
XWIn32S Java DLLkavsvx.exe"Added by the AGOBOT-RZ WORM!"
XWinAntivirusAVSVC.EXE"Part of the WinAntiVirus Pro 2005 rogue security software when installed in Win98/Me - not recommended
XWinAntiVirus Pro 2007WinAv.exe"WinAntiVirus Pro 2007 rogue security software - not recommended
XWinAntiVirusPro2006WinAV.exe"WinAntiVirus Pro 2006 rogue security software - not recommended
XWinAvXWinAvX.exe"Added by the VIRANTIX TROJAN!"
XWinAvXWinAvXX.exe"Malware installed by different rogue security software including SpyKillerPro. Also detected as the SPYWAD-AR TROJAN!"
XWindows Anti Virus Control Centeravrscan.exe"Added by a variant of the IRCBOT BACKDOOR!"
XWindows Anti Virus Control Centerwinavscan.exe"Added by a variant of the IRCBOT BACKDOOR!"
XWindows Console MonitorgcasAV32.exe"Added by the KEDEBE-A WORM!"
XWindows Java UpdateweatherBug32.exe"Added by a variant of the RBOT WORM!"
XWindows JavaScript DaemonWinjsd.exe"Added by the WOOTBOT.AF WORM!"
XWindows Print SpoolerNavAgent32.exe"Added by an unidentified VIRUS
XWindows Recavery Adwarelsass.exe"Added by an unidentified TROJAN - see here. Note - this is not the legitimate lsass.exe process
XWindows ScreensaverService.exe"Added by the KELVIR.P WORM!"
XWINDOWS SCREENSAVERssaver.scr"Added by the SDBOT-YZ WORM!"
XWindows Service Ajavjava128.exe"Added by the RBOT.BNG WORM!"
XWindows Servicesavsrv32.exe"Added by a variant of the IRCBOT BACKDOOR!"
XWindows svchostavserv.exe"Added by the PUSHBOT.FM WORM!"
XWindows Updateavkir.exe"Added by the RBOT-GJP WORM!"
XWindows Update Dravendraven.exe"Added by a variant of the SDBOT WORM!"
XWinFavoritesWinFavorites.exe1Loudmarketing.com adware downloader
XWinjava xmldirx9.exe"Added by the HAXDOOR ROOTKIT!"
XWinSecureAvpgs.exe"WinSecureAv rogue security software - not recommended
XWlan Driveravscan.exe"Added by the WOOTBOT.DH WORM!"
?XeroxEndeavorBackgroundTaskxGKOHbgnd.exe"Associated with a Xerox multifunction and/or scanner. What does it do and is it required?"
Xynavmrcd.exeynavmrcd.exe"Added by the DLOADR-AVC TROJAN!"
UYou've Got Pictures Screensaverygpsstra.exeAOL You've Got Pictures Screensaver
XZonavirus0"Added by the KITRO.D (or ARGEN.A) WORM!"
X[12 random characters]avifile5.exe"IeDriver adware variant"
X[32 random numbers]av2009.exe"AntiVirus 2009 rogue security software - not recommended
X[32 random numbers]av360.exe"Antivirus 360 rogue security software - not recommended
X[32 random numbers]AVS.exe"Antivirus Sentry rogue security software - not recommended
X[random][random]sftav.exe"Antivirus Soft rogue security software - not recommended
X[various names]avpmondll.exe"Wareout - malware masquerading as a spyware and dialer remover"
X[various names]clamav.exe"Wareout - malware masquerading as a spyware and dialer remover"
X[various names]SYSTRAV.exe"Wareout - malware masquerading as a spyware and dialer remover"
X{2C70168B-97CE-4f31-B85D-1FEC5002721D}sysavxjgdu.exe"Added by the FAKEALERT-AM TROJAN!"


DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.