CS

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	Intelli Mouse Pro Version 2.0B	ncsjapi32.exe	"Added by the BUZUS-O WORM!"
X	.mscsbl	svhost.exe	"Added by the CMQ TROJAN!"
X	.svchost	CSRSS.EXE	"Added by the WEBUS.F TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	.TEXTCONV	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	.WMAudio	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	27	csrss32.exe	"Added by the SLSORVE-D TROJAN!"
X	852EBF20-A95D-4F1F-B9C2-B2CD24350F3E	sysodkcs.exe	"Added by the FAKEALERT-AH TROJAN!"
U	AbsoluteShield Internet Eraser	cseraser.exe	"AbsoluteShield Internet Eraser - ""protects your privacy by cleaning up all the tracks of your Internet and computer activities"""
X	ActiveXUpdate	svcss.exe	"Added by a variant of the DEDLER.C TROJAN!"
U	Adobe Version Cue CS2	VersionCueCS2Tray.exe	"File manager that's part of Adobe Creative Suite 2 - ""find files fast
X	AdRotator.Application	[path to csrss.exe]	"Added by the SMALL-AQ TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
Y	Aiptek Graphics Tablet (USB)	atwtusb.exe	USB interface for Aiptek Graphics Tablet (USB)
X	ALM	csrss32.exe	"Added by the ANACON-D VIRUS!"
N	AME_CSA	"rundll32 amecsa.cpl	RUN_DLL"
Y	ANIWZCS2Service	WZCSLDR2.exe	"ALPHA Networks wireless driver"
?	ANIWZCSService	WZCSLDR.exe	D-Link wireless PCI adapter related. In some cases reported to cause excessive CPU activity
X	AntivirusPCSuite	pgs.exe	"AntivirusPCSuite rogue security software - not recommended
Y	AolAcsDaemon1	Acsd.exe	"AOL Connectivity Service - automatically restores the connection to AOL should you lose it while online. Negates having to go through the procedure of signing back on manually. This version is obsolete and has been replaced by AOLACSD.EXE so update your version of AOL. Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
Y	AolAcsDaemon1	AOLACSD.EXE	"AOL Connectivity Service - automatically restores the connection to AOL should you lose it while online. Negates having to go through the procedure of signing back on manually. Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
X	APcSafe	APcSafe.exe	"APcSafe rogue security software - not recommended
X	APcSecure	APcSecure.exe	"APcSecure rogue security software - not recommended
X	Application	csrss.exe	"Added by the BEAGLE.EG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
N	ArcSoft Connect	ACDaemon.exe	"Used to serve notice of product information and updates when running ArcSoft products such as TotalMedia
N	ArcSoft Connection Service	ACDaemon.exe	"Used to serve notice of product information and updates when running ArcSoft products such as TotalMedia
N	ARCSolo Recovery	N/A	Backup software by Computer Associates - no longer supported
X	argq32	csrss_32.exe	"Added by the RBOT-CPM WORM!"
X	asccacA	asacsqgl.exe	"Added by the MULTIDRP.AA TROJAN!"
X	asdsaxcxz13	dasxcsx13.exe	"Added by the LEGMIR-ARF TROJAN!"
X	ASP.NET State Service	csrss.exe	"Added by the DLOADER-QI TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	ATI Active Graphics Card Monitor	atievx.exe	"Added by the IRCBOT-TL WORM!"
U	AtiSound	csrss.exe	"WinSpy surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""ComRoot"" subfolder"
X	aupd	symcsvc.exe	"Added by the ABWIZ.D TROJAN!"
X	aupd	sysvcs.exe	"Added by the ABWIZ.C TROJAN!"
X	aupd	sywsvcs.exe	"Added by the ORSE-M TROJAN!"
U	Auslogics BoostSpeed	boostspeed.exe	"System Tray access to Auslogics BoostSpeed system optimization utility - which allows you to ""Start programs faster. Speed up computer start time. Increase Internet speed
U	Auslogics BoostSpeed 4	boostspeed.exe	"System Tray access to Auslogics BoostSpeed 4 system optimization utility - which ""Start programs faster. Speed up computer start time. Increase Internet speed
X	Auto updat	crcss.exe	"Added by the SDBOT.AAG WORM!"
N	AutoCAD	acstart17.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
N	AutoCAD Startup Accelerator	acstart16.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
N	AutoCAD Startup Accelerator	acstart17.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
X	AVManager	csrss.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
U	BackupExecScheduler	besch.exe	"Veritas ""Back Up My PC"" software"
N	BacsTray	BacsTray.exe	Broadcom Advanced Control Suite - for modems and set top boxes based upon Broadcom chipsets. Not required unless you have networking problems
X	BagleAV	csrss.exe	"Added by the NETSKY.AB WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
N	bascstray	BascsTray.exe	Broadcom Advanced Control Suite - for modems and set top boxes based upon Broadcom chipsets. Not required unless you have networking problems
U	BCSSync	BCSSync.exe	"Part of SharePoint Server 2010 which is part of the Microsoft Office 2010 suite. ""Business Connectivity Services (BCS) uses a cache to store a copy of the external data required by the BCS solutions deployed on the Office client. A process called BCSSync.EXE runs on the client and provides automatic cache refresh and data synchronization of the entity instances."" For more information - see here"
X	boby	csrs.scr	"Added by the BANCBAN-PC TROJAN!"
X	BuildLabs	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
U	c32cs2	c32cs2.exe	"Cyber Sentinel - internet filtering software"
N	CACStarter	cacstart.exe	Cash A Check - check writing software
U	Calendarscope	cs.exe	"Calendarscope calendar software"
?	CardScan AutoSync	CSyncCfg.exe	"Related to the CardScan business card reader range of products. May be related to synchronization with E-mail software and mobile devices (see here)?"
X	CashToolbar	MSCStat.exe	"Added by the DOWNLOADER-MY TROJAN!"
X	cbvcs	urretnd.exe	"Added by the FRETHOG-C WORM!"
X	ccAppr	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccpApps	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	ccRegVfY	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
Y	ccSetMgr	ccSetMgr.exe	"Part of Norton AntiVirus 2004. What does it do?"
X	ccStart	ccStart.exe	"Added by the AGOBOT-IR WORM!"
X	ccStart	ccInfo.exe	"Added by the AGOBOT-GQ BACKDOOR!"
X	ccSvcHst.exe	ccSvcHst.exe	"Added by the SDBOT-DIW WORM!"
X	ccsvit.exe	ccsvit.exe	"Added by the STARTPA-HP TROJAN!"
U	ChineseStar	cstar.exe	Chinese language support software
U	CitiUCS	CitiUCS.exe	"Citibank Virtual Account Numbers - ""With this free service for Citi cardmembers
U	CleanSweep Smart Sweep- Internet Sweep	Csinsm32.exe	Automatic logging of installs from Norton CleanSweep - available via Start -> Programs
N	CleanSweep Useage Watch	CSUSEM32.EXE	Quarterdeck/Norton CleanSweep component - tracks how often you use files and alerts you to files that have not been used for a specified period of time
N	ClickSight Launcher	cs.exe	"Launcher for the ClickSight® marketing tool from ClickStream Technologies - which ""is a patented data-collection technology that helps independent software vendors understand the current and future usage of their product"""
X	ClickTheButton	csrss.exe	"ClickTheButton adware. Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
?	Client agent for ARCserve	W95AGENT.EXE	"Part of Brightstor ARCserve Backup from Computer Associates. What does it do and is it required?"
N	Client Security Solution	cssauth.exe	"Part of Thinkvantage Client Security Solution for Lenovo ThinkPad notebooks and ThinkCentre desktops. Once configured via the associated setup screens this loads via winlogon.exe (and loads the password manager) and therefore disabling this entry has no effect"
X	Client Server Run Time Proccess	csrsrv.exe	"Added by a variant of the SDBOT WORM!"
X	Client Server Runtime Process	csrsss.exe	"Added by the SDBOT-LD WORM!"
X	Client Server Runtime Process	csrs.exe	"Added by the LINKBOT.M WORM!"
X	CLSRSS	LSACS.EXE	"Added by the SILLYFDC-X WORM!"
X	cmdbcs	cmdbcs.exe	"Added by the LINEAG-GKW TROJAN!"
X	cmsound	vcsystem.exe	"Added by the TCXMEDI-D downloader TROJAN!"
X	cmssSystemProcess	csmss.exe	"Added by the AGENT-CO TROJAN!"
X	cmssSystemProcess	mcsmss.exe	"Added by the PROXYSER-F TROJAN!"
X	cmssSystemProcess	csms.exe	"Added by the AGENT-Y TROJAN!"
X	COM+ EventSystem Services	ECSERVER.EXE	"Added by a variant of the SDBOT WORM!"
X	Com+ Sys	csrs.exe	"Added by the FORBOT-BT WORM!"
U	CompuSpy KeyLogger	cswin2008.exe	"CompuSpy surveillance software. Uninstall this software unless you put it there yourself"
X	Configuration Loader	ccSort.exe	"Added by the AGOBOT.SR WORM!"
X	Configuration Loader	crcss.exe	"Added by the AGOBOT.ADG WORM!"
X	Console de Gerenciamento Microsoft	csrss.exe	"Unidentified malware! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Level4"" subfolder"
X	Console de Gerenciamento Microsoft	csrss.exe	"Added by the BANCBAN-ET TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Central de Segurança"" subfolder"
X	ControlServiceMgr	csmsv.exe	"Added by the AGENT-XC TROJAN!"
X	cpntmgc	simcss.exe	"Added by the MAGICON.A TROJAN!"
U	cpqns	cpqnpcss.exe	Related to Compaq.Net - not required if you don't use that
X	cprocsvc	cproc.exe	Added by MSIL.AGENT.C TROJAN!
X	CRCSS	crcss.exe	"Added by the IRCBOT-TH WORM!"
X	CS	tsc.exe	"Cyber Security rogue security software - not recommended
X	CS Update	copy /Y [path] ActivationManager.dll.upd [path] ActivationManager.dll	Added by an unidentified malware
N	csaRem	spqmdmui.exe	Compaq modem country selection
Y	CSAV_CheckViruses	vchk.exe	"Command Antivirus related"
U	csc	csc.exe	Command line compiler for Microsoft C# it gets installed with the .NET SDK
X	cscripts	cscripts.exe	"Added by the BDOOR-AAP BACKDOOR!"
X	CSCRS Value	cscrs.exe	"Added by the RBOT-AAA WORM!"
X	CSCRS Value Check	MsPMSPSd.exe	"Added by a variant of the SDBOT WORM!"
X	Csec	cs.exe	"Cyber Security rogue security software - not recommended
N	csecwiz	csecwiz.exe	"Setup wizard for the Client Security Software for IBM\Lenovo notebooks. This entry only runs once
X	cserv32	cserv32.exe	"Added by the STRATION.EC WORM!"
X	CsimPlayer	CsimPlayer.exe	"Added by the KOOBFACE-AD WORM!"
U	CSINJECT.EXE	CSINJECT.EXE	"Part of Quarterdeck/Norton CleanSweep. ""Csinject must be loaded in order for Smart Sweep to automatically monitor installations and properly track registry changes"""
X	csm Win Updates	csm.exe	"Added by the ZOTOB.B WORM!"
X	CSNetManagerXp	isass.exe	"Added by the HIDER-O TROJAN!"
X	csoftok	softok.exe	"Added by the QQPASS.G TROJAN!"
X	csos	csos.exe	"Added by the SDBOT-DFE WORM!"
X	csrcs	csrcs.exe	"Added by the AGENT-HUA TROJAN!"
X	csrs	csrs.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	csrsc	csrsc.exe	"Added by an unidentified VIRUS
X	CSRSS	CSRSS.EXE	"Search page hijacker
X	Csrss	csrss.exe	"Added by the CHOD WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a random subfolder"
X	csrss	csrss.exe	"Added by the KEYLOG-AQ KEYLOGGER! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	csrss	csrss.exe	"Added by the CHODE-J WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a random subfolder"
X	csrss	msmsgs.exe	"Added by the CHODE-J BACKDOOR! Note - this malware uses MSN Messenger (which is located in %Program Files%\Messenger) in the background to propogate itself"
X	csrss	nwiz.exe	"Added by the CHODE-J WORM!"
U	csrss	csrss.exe	"BeyondKeylog surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Supremtec"
X	Csrss	CSRSS.EXE	"Added by the PUNYA-B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in C:\Documents and Settings\Administrator\Local Settings\Application Data\WINDOWS"
X	csrss	ssms.exe	Added by an unidentified malware
X	Csrss Host	csrhost.exe	"Added by the IRCBOT.BIZ WORM!"
X	CSRSS Loader	csrsss.exe	"Added by the AGOBOT.TX WORM!"
X	csrss.exe	csrss.exe	"Added by the DALBUG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	csrssLevel4	csrss.exe	"Unidentified malware! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Level4"" subfolder"
X	CSRSSU	CSRSSU.exe	"CoolWebSearch parasite variant - hijacking to Slawsearch.com. Also detected as the CWS-E TROJAN!"
X	CSRSSW	CSRSSW.EXE	"Added by the CWS-F TROJAN!"
X	CSRSWIN	[trojan filename]	"Added by the WINSHELL.50 TROJAN!"
X	CSRSX	[trojan filename]	"Added by the WINSHELL.50.B TROJAN!"
X	csrvss	csrvss.exe	"Added by a variant of the SDBOT TROJAN!"
U	CSS Server	CSSServer.exe	"ComSpySysSvr surveillance software. Uninstall this software unless you put it there yourself"
N	cssauth	cssauth.exe	"Part of Thinkvantage Client Security Solution for Lenovo ThinkPad notebooks and ThinkCentre desktops. Once configured via the associated setup screens this loads via winlogon.exe (and loads the password manager) and therefore disabling this entry has no effect"
N	cssauthe	cssauthe.exe	"Part of Thinkvantage Client Security Solution for IBM/Lenovo ThinkPad notebooks and ThinkCentre desktops. Once configured via the associated setup screens this loads via winlogon.exe (and loads the password manager) and therefore disabling this entry has no effect"
Y	CSScheduleCheck	SCHWIZEX.EXE	"Part of ConfigSafe - lets you identify changes to the registry
X	cssrs	cssrs.exe	"Added by the BANCBAN-DW TROJAN!"
X	cssrss.exe	cssrss.exe	"Malware installed by different rogue security software including SpyKillerPro"
X	csss	Csss.exe	"Added by the BALICK TROJAN!"
U	CSS_Central	CSS_1631.EXE	"CSS Communication Agent (95 Host) from Command Software Systems (now Authentium). ""CSS Central™ provides administrators with a powerfully proactive tool to effectively manage and maintain the anti-virus strategy from a centralized console"""
X	CSV10P1	CSP001.exe	"ClearSearch adware"
X	CSV10P70	CSv10P070.exe	"ClearSearch adware"
X	CSV7P26	CSV7P26.exe	"ClearSearch adware"
X	CSV7P70	CSV7P070.exe	"ClearSearch adware"
X	CSV7P91	CSV7P91.exe	"ClearSearch adware"
U	csvdea	csvdea.exe	"SpyArsenalLog surveillance software. Uninstall this software unless you put it there yourself"
X	csvhost.exe	csvhost.exe	"Added by the CIMUZ-BD TROJAN!"
X	ctfmen	cssrs.exe	"Added by the STARTP-DC TROJAN!"
X	Current Security Config	csecure.exe	"Added by the RBOT-AMO WORM!"
X	dark	csrs.scr	"Added by the BANCBAN-GT or BANCBAN-GU TROJANS!"
X	dcsm	dcsm.exe	"Part of the PrivacyProtector and DriveCleaner rogue security tools"
X	Device Security	dvcsecure.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Device Security Manager	dvcsecure.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	DIECOX	csrss.exe	"Added by a variant of the ATM.GEN TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Disk Panel Configuration	dpcsvc.exe	"Added by the IRCBOT.BSQ BACKDOOR!"
X	Disk Panel Setup	npcsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Display Drivers	cssrs.exe	"Added by the AGOBOT.FX WORM!"
N	dlbcserv	dlbcserv.exe	Related to Dell Photo Printers and provides additional configuration options for these devices
Y	DPCProxyLoadOnStartup	dpcstart.exe	"DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access"
Y	Dpcstart	dpcstart.exe	"DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access"
X	DriverModule	csrnvrt.exe	"Added by the IRCBOT.I TROJAN!"
X	dsgb	lcsass.exe	"Added by the AGENT.TGZ BACKDOOR!"
?	EDFcsn	discfcsn.exe	"Related to Hewlett-Packard's Discovery Agent. What does it do and is it required?"
?	ENCSurf	surfboard.exe	"??"
U	enginecs2	enginecs2.exe	"Cyber Sentinel - internet filtering software"
X	ethernet adapter	csrmss.exe	"Added by a variant of the RBOT WORM!"
X	Explorer.exe	csrss.exe	"Added by the JUEGO-B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %AppData%\Microsoft"
X	FHStart	shdocsvc.exe	"Added by the WINHOUND TROJAN!"
U	FieldForms Sync	SyncService.exe	"Resco FieldForms. A solution for building of mobile forms that can be viewed or filled in on the run
X	FiendlyType	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	FirewallActivies	csrss.exe	"Added by the BANKER-AQ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""3041"" subfolder"
X	FireWire Services	nvcsv32.exe	"Added by a variant of the SPYBOT WORM!"
N	FoneSyncSystemTray	FoneSyncSystemTray.exe	System Tray icon for Nokia FoneSync utility for the 7160/7190 mobiles. Useful to send data from/to the cell phone and the computer. You can use it to backup data or even to input data through the computer keyboard (which naturally is much more comfortable). Run manually when required
U	Fortis Secure Layer Config	cseinst.exe	Fortis Bank Home Banking part. Installed during the installation of the software necessary to run the Home Banking. According to Fortis Bank this will not in any way be harmful to the system or relay system information
?	GACService	GACService.exe	"Related to a Gemplus product. What does it do and is it required?"
N	GCS	GrabClipSave.exe	"GrabClipSave screen capture tool"
X	Graphics	_default.pif	"Added by the AUTOSKY WORM!"
X	Graphics adapter service	windll.exe	"Added by the ATNAS.A WORM!"
X	GuardPcs.exe	GuardPcs.exe	"GuardPcs rogue security software - not recommended
N	hcsystray	hc_tray.exe	"Kuma Notifier for the Shootout! game from the History Channel. ""It lets you know whenever there's a new episode that's been released or an announcement from the Kuma team. Just click it to get up-to-the-minute game and event information"""
N	HPU	ProvenTactics.exe	"Proven Internet Marketing software"
N	IBM Client Security Software	csecwiz.exe	"Setup wizard for the Client Security Software for IBM\Lenovo notebooks. This entry only runs once
U	ICSDCLT	"rundll32.exe Icsdclt.dll	ICSClient"
N	ICServer	Icserver.exe	Intel Intercast viewer software. Gives access to selected internet pages which are broadcasted by several TV stations
Y	ICSMGR	ICSMGR.EXE	Monitors DNS and DHCP requests for ICS (Internet Connection Sharing). Needed if you're sharing the internet on various computers
X	IECheck	MSDTCs.exe	"Added by the TIRBOT-D WORM!"
X	imcssl	xmliwvug.exe	"Added by the SLAPER.U TROJAN!"
X	imxecs	vbrun70sp4.exe	"Added by the AGOBOT.ALA WORM!"
X	Intel Driver	csrs.exe	"Added by a variant of the SDBOT WORM!"
X	Intelli Mouse Pro Version 2.0B	ncsjapi32.exe	"Added by the BUZUS-O WORM!"
X	IPv6 Helper Driver	csass.exe	"Added by the AGOBOT.TC WORM!"
X	Jnskdfmf9eldfd	csrssc.exe	"Added by the AGENT.EBC TROJAN!"
X	JvcHost	jvcsvc32.exe	"Added by the AGOBOT-AIU WORM!"
X	KernellApps	csrss.exe	"Added by the BANCBAN-AC TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""System"" subfolder"
X	Key Logger	csrss.exe	"Added by the BUCHON.A WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in the root folder (ie
X	KL AntiFunLove	flcss.exe	"Added by the FUNLOVE.4099 VIRUS!"
Y	KodakCCS	KodakCCS.exe	Kodak DC File System Driver
X	Krnlcheck	csrss.exe	"Added by the BOTNACHALA TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Logon	CSRSS.EXE	"Added by the BRONTOK-BH WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X	LogonAdministrator	CSRSS.EXE	"Added by the KORRON.B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X	Logonrepclient1	CSRSS.EXE	"Added by the BRONTOK-BT WORM and variants! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X	Logonsara	csrss.exe	"Added by the BRONTOK-BS WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X	ManageProtocolCtrl	csmsv.exe	"Added by the LOOKSKY.B TROJAN!"
X	Mcafee VirusScan Manager	mvcsvm.exe	"Added by the SILLYFDC.BBV TROJAN!"
X	Mcaffee	mcsheild.exe	"Added by the RBOT-FDP WORM!"
Y	McShld9x	mcshld9x.exe	"Window 9x/Me on-access scanner for older McAfee's internet security products such as VirusScan and VirusScan Online which scans files in real-time for malware as you access
X	Mcsoft	gfeqzvq.exe	"Added by the SDBOT-NV WORM!"
X	Media Software UPdater	sscs.exe	"Added by the RBOT-ABE WORM!"
U	medicsp2	sprtcmd.exe /P medicsp2	"Self-help support tool for an unidentified high-speed internet provider (provided by SupportSoft
X	Micrcsoft Certificate Services	cflmon.exe	"Added by the RBOT-FWV WORM!"
X	Microsoft	wcsntfy.exe	"Added by the AGOBOT-AHT WORM!"
X	Microsoft	rtvcscan.exe	"Added by the RBOT-GGU WORM!"
X	Microsoft (R) Windows Vista/NT Runtime Compatibility Service	nrcs.exe	"Added by the RANKY.X TROJAN!"
X	Microsoft Client/Server Runtime Server Subsystem	csrs.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Client/Server Runtime Server Subsystem	csrssa.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft CSRSS Service	nsmscrs.exe	"Added by the RBOT-BPT WORM!"
X	Microsoft CSRSS32 Protocol	csrss32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft CSRSS386 Protocol	csrss386.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Data Machine	csdata32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Device Manager	svcswin.exe	"Added by the IRCBOT-YH TROJAN!"
X	Microsoft DLL Verifier	csrssv.exe	"Added by the RBOT-ATK WORM!"
X	Microsoft Keyboard Enhance 2.0.	iasrecst.exe	"Added by the BCKDR-QIL BACKDOOR!"
X	Microsoft Keyboard Enhance V2.0	iasrecst.exe	"Detected by F-Prot as the DOWNLOADER2.AILI TROJAN!"
U	Microsoft Office 2010	BCSSync.exe	"Part of SharePoint Server 2010 which is part of the Microsoft Office 2010 suite. ""Business Connectivity Services (BCS) uses a cache to store a copy of the external data required by the BCS solutions deployed on the Office client. A process called BCSSync.EXE runs on the client and provides automatic cache refresh and data synchronization of the entity instances."" For more information - see here"
X	Microsoft Registry	csrse.exe	"Added by the RBOT-PC WORM!"
X	Microsoft Security Center	wcsntfy.exe	"Added by the SDBOT.BYD WORM!"
X	Microsoft Security System	mssecsys.exe	"Added by the IRCBOT-WJ TROJAN!"
X	Microsoft service	cssrs.exe	"Added by the STARTP-DC TROJAN!"
X	Microsoft Update Service	csrss32.exe	"Added by the AGOBOT-HC WORM!"
X	Microsoft Update Services	wcsnfty.exe	"Added by the RBOT-AGK WORM!"
X	Microsoft Windows CSRSS	csrss.exe	"Added by the KALEL-A WORM! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Microsoft Windows Secure	windocs.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Secure	windocs.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update	svcshost.exe	"Added by the FORBOT-CF WORM!"
X	Microsoft Windows Update	servcs.exe	"Added by the SDBOT.AL BACKDOOR!"
X	Microsoft Windows Update Client	csrss.exe	"Added by the KEBEDE-G WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Systems32"
X	Microsoft Word Profissional	csrss.exe	"Added by the BANCBAN-DB TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""s1613"" subfolder"
X	Microsoft Word Profissional	csrss.exe	"Added by the BANKER-DJ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""protect"" subfolder"
X	Microsoft Word Profissional	csrss.exe	"Added by the BANKER-DP TROJAN! ! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""JavaVM"" subfolder"
X	Microsofts Service	lcsrv16.exe	"Added by a variant of the RBOT WORM!"
X	MicrosoftSourceSafe	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	Micsoft-Published-Software	explrer.exe	"Added by the RBOT-GFL WORM!"
X	Micsorosft Security Center	wcnsfty.exe	"Added by the RBOT-AHU WORM!"
X	mnsvcsp	mnsvcsp.exe	"Added by an unidentified VIRUS
X	MONPluginSrIvcs	n3monap23.exe	"Added by a variant of the RBOT WORM!"
U	MPEO	Csinsm32.exe	Automatic logging of installs from Norton CleanSweep - available via Start -> Programs
X	MS Windows Process Class	MSPRCSS32.exe	"Added by the RBOT-YQ WORM!"
X	msbcs	msbcs.exe	"Added by the DADOBRA-G TROJAN!"
X	Mscsgs	MSCSGS.EXE	"Added by the ZEZER WORM!"
X	Mscsgs32	MSCSGS32.EXE	"Added by the ZEZER WORM!"
X	mscsvc.exe	mscsvc.exe	"Added by the BANCOS.T TROJAN!"
X	msiexecs	msiexecs.exe	"Added by the SILLYFDC.BBB WORM!"
X	msiexecs.exe	msiexecs.exe	"Added by a variant of the SDBOT WORM!"
X	MSN ang	cssrss.exe	"Added by the FORBOT-CE WORM!"
X	MSN CST Manager	mancstmgr.exe	"Added by an unidentified WORM or TROJAN! See here"
X	MSNPluginSrIvcs	n3vasap23.exe	"Added by a variant of the RBOT WORM!"
X	MSNPluginSrvcs	p6.exe	"Added by the SDBOT.AKJ or RBOT-VJ WORMS!"
X	MSNPluginSrvcs	sagate.exe	"Added by the SDBOT.AKJ WORM!"
X	MSSVC	svcsys.exe	"Added by the FATOOS-C TROJAN!"
X	MSSYSTEM	svcsys.exe	"Added by the FATOOS-C TROJAN!"
X	Msupdate	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	MsvcService	msvcs.exe	"Added by the RBOT-RK WORM!"
X	Multimedia Codecs	mcc.exe	"Added by the DLOADER-MB TROJAN!"
X	mvsyswina	acsysiom.exe	"Added by a variant of the SDBOT WORM!"
X	MyPcSecure	MyPcSecure.exe	"MyPcSecure rogue security software - not recommended
X	mysvcig38	recsl.exe	"Added by a variant of the RBOT-FOU WORM!"
X	NAV Auto Updates	csrssp.exe	"Added by a variant of the SDBOT WORM!"
Y	NCSW Server	NcsW.exe	"LockLink access control management software. LockLink 7.0 lets users seamlessly manage both offline and online access control solutions available from IR Security & Safety"
N	NCS_SS	Csinsm32.exe	Same as CleanSweep Smart Sweep-Internet Sweep
X	NDAv	csnss.exe	"Added by the SERFLOG.C WORM!"
X	NETServices	csxrs.exe	"Added by a variant of the SDBOT WORM!"
X	NetWork	csrs.exe	"Added by the AGOBOT.JJ WORM!"
X	Network Security	secsvc.exe	"Added by the RBOT-ALX WORM!"
X	Network Services	netsvacs.exe	"Added by the GAOBOT.AIS WORM!"
X	New Csnm Manager	csmn.exe	"Added by the SDBOT.BZS WORM!"
N	Nokia PC Sync	PCSync2.exe	"System Tray access to Nokia PC Sync - which ""allows you to synchronise contacts
N	Nokia.PCSync	PCSync2.exe	"System Tray access to Nokia PC Sync - which ""allows you to synchronise contacts
N	NokiaPCSuiteTray	LaunchApplication.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
N	NokiaPCSyncTray	PCSync.exe	"System Tray access to Nokia PC Sync - which ""allows you to synchronise contacts
X	Norman Worl System Ability	nwcss32.exe	"Added by the DELF.IO TROJAN!"
X	Norton Protect Activies	csrss.exe	"Added by the BANKER-CZ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""D5133"" subfolder"
X	Norton Start	ccStart.exe	"Added by the SDBOT-OX WORM!"
X	Norton System	csrs.scr	"Added by the BANLOA-AFM TROJAN!"
X	NT Windows System Manager Loader	csrlss.exe	"Added by the AGOBOT.OX WORM!"
X	NTDLM	csrss.exe	"Added by the HALE TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Qossrv"" subfolder"
Y	NuTCSetupEnviron	ncoeenv.exe	"Used by the MKS Toolkit for Enterprise Developers product. NuTCracker is a Unix runtime environment for Windows
X	NvGraphicsInterface	[path to trojan]	"Added by the BCKDR-QKI BACKDOOR!"
X	Nvidia Control Panel	ncsvc32.exe	"Added by an unidentified VIRUS
X	nvsv32.exe	cstr.exe	"Added by a variant of the SDBOT WORM!"
X	Nxvst	cssrs.exe	"Added by the GAOBOT.CD WORM!"
X	OfficeAgent	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	OfficeGuardUI	svcss.exe	"Added by the DEDLER-C TROJAN!"
U	PC Dynamics SdwMon32	sdwmon32.exe	"SafeHouse ""Personal Privacy"" protects and hides your private and personal photos
X	PC Scout	pcscout.exe	"PC Scout rogue security software - not recommended
N	PC SpeedScan Pro	PCSpeedScan.exe	"Ascentive PC SpeedScan Pro registry optimizer - not recommended
N	PC Suite	PCSuite.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
N	PC Suite Tray	PCSuite.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
N	PC Sync	PCSync2.exe	"System Tray access to Nokia PC Sync - which ""allows you to synchronise contacts
X	PCprot	crcss.exe	Added by an unidentified WORM!
U	PCRecSA	PCRecSA.exe	"Part of the IBM/XPoint Rapid Restore backup utility. If you choose
X	PcSecureNet	PcSecureNet.exe	"PcSecureNet rogue security software - not recommended
X	PCSecureSystem	pgs.exe	"PCSecureSystem rogue security software - not recommended. A member of the AVSystemCare family"
X	pcServer	server.exe	"Ssppyy spyware"
X	PCShield	regsvr32 sfg_***.dll [ = random char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	PcsProtector	PcsProtector.exe	"PcsProtector rogue security software - not recommended
X	PcsSecure	PcsSecure.exe	"PcsSecure rogue security software - not recommended
N	PCStart	Pcm25.exe	"Runs as part of PCMonitor which is a program for monitoring your activity on your system. It makes screen dumps and key logging. It can hang-up your system because the screen dump page gets VERY big"
N	PCSuite	PCSuite.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
N	PCSuiteTrayApplication	TrayApplication.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
N	PCSuiteTrayApplication	LaunchApplication.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
N	PCSuiteTrayApplication	TRAYAP~1.EXE	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
N	PCSuiteTrayApplication	LAUNCH~1.EXE	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
X	Pcsv	pcsvc.exe	"Delfin Media Viewer or ""Promulgate"" adware"
N	PCSync	PCSync.exe	"System Tray access to Nokia PC Sync - which ""allows you to synchronise contacts
X	PcSync	PcSync.exe	"Added by the RBOT-XJ WORM! Note - do not confuse with the Nokia application described here"
N	PcSync	PcSync2.exe	"System Tray access to Nokia PC Sync - which ""allows you to synchronise contacts
N	PCSync.exe	PCSync.exe	"System Tray access to Nokia PC Sync - which ""allows you to synchronise contacts
N	PCSync2	PCSync2.exe	"System Tray access to Nokia PC Sync - which ""allows you to synchronise contacts
X	Perfomance Monitor	davcsync.exe	"Added by the LAMUD-A WORM!"
X	picsvr	picsvr.exe	"Delfin Promulgate adware"
?	PMCS	PMC.Service.Main.exe	"Related to MediaCenterService from Pinnacle Systems. What does it do and is it required?"
U	PowerDOCSAPIHost	papihost.exe	"Hummingbird PowerDOCS - ""delivers powerful enterprise document management functionality via a tightly integrated Microsoft WinNT/98/2K environment"""
X	Prog	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	ProtectPcs.exe	ProtectPcs.exe	"ProtectPcs rogue security software - not recommended
X	ProtocolEventTsk	csrwjd.exe	"Added by the STINX-N TROJAN!"
N	QD FastAndSafe	QDCSFS.exe	Automatically runs Fast & Safe clean-up from Norton/Quarterdeck Cleansweep. Deletes safe to remove files such as Temporary Internet Files (cache). Recommended you run it manually
X	Rapdata	ravsecs.exe	"Added by the QQPASS-V TROJAN!"
U	Rapid Restore	rrpcsb.exe	"XPoint ""Rapid Restore PC"" - ""a Managed Recovery solution that enables IT Administrators to protect the corporate image
U	RCScheduleCheck	RCSCHED.EXE	"Scheduler for VCOM's Recovery Commander - which ""can restore your non-booting system back to normal. It only takes a few minutes to get your system back up and running"""
X	Rcsh	weaa.exe	"PurityScan adware"
X	RCSync	RCSync.exe	"PrizeSurfer related. ""PrizeSurfer is the free software that automatically enters you to win cash and prizes just for surfing the web and shopping online!"" Stealth installed malware"
U	RCSystem	DLLML.exe RCSystem	"Related to Creative DLL Module Loader for the Sound Blaster X-Fi (and maybe others). This program is non-essential process to the running of the system
X	RCSystemTray	MaxRCSystemTray.exe	"Max Registry Cleaner rogue registry cleaner - not recommended
X	Real Statics Agent	ccreal.exe	"Added by a variant of the RBOT WORM!"
N	RecShe	RecSche.exe	Recording scheduler for WatchTV Capture Card (TV Tuner card)
U	RegClean Expert Scheduler	RCScheduler.exe	"""Registry Clean Expert scans the Windows registry and finds incorrect or obsolete information in the registry. By fixing these obsolete information in Windows registry
X	RegDone Ex	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
?	Register SeqChk	regsvr32.exe ..csseqchk.dll	"??"
X	Registry	wscript.exe ShakiraPics.jpg.vbs	"Added by the VBSWG.AQ WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""ShakiraPics.jpg.vbs"" file is located in %Windir%"
X	RegWrite	csrss.exe	"Added by the SOKACAPS TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Media"
X	Remndr	CsRemnd.exe	CasinoOnline foistware
X	RPCser32g	services.exe	"Added by the RITDOOR-C WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	RPCser32g1	services.exe	"Added by the PREX.D WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	RPCser32g3	services.exe	"Added by the PREXOT.D BACKDOOR! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	RPCser32g4	services.exe	"Added by the PREXOT.E BACKDOOR! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	RPCserr32g	winlogon.exe	"Added by the RITDOOR-B WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	RPCserv32	services.exe	"Added by the MYDOOM.AL WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	RPCserv32g	services.exe	"Added by the BOBAX.AA WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	RPCserv32g	CSRSS.EXE	"Added by the BOBAX.AD WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	RPCserv32g	MSDEFR.EXE	"Added by the BOBAX.AD WORM!"
X	RPCserv32g	NB32EXT2.EXE	"Added by the BOBAX.AD WORM!"
X	RPCserv32g	WINLOGON.EXE	"Added by the BOBAX.AD WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
Y	RPCSS.exe	rpcss.exe	"Remote Procedure Call. Required by windows for programs to communicate with each other on networks/different machines. Originally for NT only but now installed with Win98/98se. Under Win98/98se
X	rundll32	csrss.exe	"Added by the GUTTA TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Runner	csrss.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Runtime Process	Csrss.exe	"Added by the CIADOOR-J BACKDOOR! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Runtime Server Subsystem	csrss.exe	"Added by the IRCBOT-XV WORM!"
X	Salestart	dcsm.exe	"Part of the PrivacyProtector and DriveCleaner rogue security tools"
Y	SBCSTray	SBCSTray.exe	"System Tray access to CounterSpy antispyware software"
X	Scheduler	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
Y	Scsi	Scsi.exe	SCSI Miniport driver
X	scssrr.exe	Services.exe	"Added by the VB-EMX TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	SDAv	csnss.exe	"Added by the SERFLOG.C WORM!"
X	SDR6V_Check	udcsdr.exe	"Part of the DriveCleaner rogue security software - not recommended
X	SDR6_Check	udcsdr.exe	"Part of the DriveCleaner rogue security software - not recommended
X	secserv.exe	secserv.exe	"Detected by Panda as an EasySearch adware variant. Note - EasySearch modifies the Internet Explorer settings and may download programs onto the infected computer"
X	secsvc32	secsvcnt.exe	"Added by the GLOBAL PATROL TROJAN!"
U	Secsys	Secsys.exe	"UltraSoft Key Interceptor surveillance software - uninstall this unless you put it there yourself!"
U	SecurePCSolutionsBootCheck	BootCheck.exe	"1 Click Fixer PLUS from Secure PC Solutions ""takes the guesswork out of locating and solving problems in the Windows registry"""
X	Security Mechanic	lsascs.exe	"Security Mechanic rogue security software - not recommended
X	Security Server DB	secserver.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Security Service	secsvc.exe	"Added by the RBOT-GGF WORM!"
X	Security Service DB	secservice.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Select server	slcsvr.exe	"Added by the DLOADER-WD TROJAN!"
N	SEPCSuite	SEPCSuite.exe	"System Tray access to Sony Ericsson PC Suite which ""connects your phone to your computer and expands the capabilities of your phone"". Run manually via the Start Menu (or optional desktop shortcut) before connecting the phone"
X	SernellApp.pcx	csrss.exe	"Added by the BANCBAN-BJ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""D5133"" subfolder"
X	Service Controller	Csrrs.exe	"Added by the GAOBOT.AO WORM!"
X	Service Monitor	csnss.exe	"Added by the RBOT.EEH WORM!"
X	Services	csrss.exe	"Added by a variant of the RANKY.U TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Services	csrss32.exe	"Added by the ANACON-D VIRUS!"
X	Services Managements	servcs.exe	"Added by the RBOT-GUC WORM!"
X	ServicesActive	cssrs.exe	"Added by the AGOBOT-GB BACKDOOR!"
X	servics	servics.exe	"Added by the SINGU-J TROJAN!"
X	Shockwave	csrss.exe	"Added by the SNDOG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	SiS Mpc Service	mpcsvc.exe	"Added by the CIADOOR-CJ TROJAN!"
U	Smart Connect Setup	SCSetup.exe	Appears on a Sony Vaio. Smart Connect Version 2.1 enables data transfer between Vaios via i.LINK cable. Smart Connect supports File and Printer Sharing for MS networks. You can copy files from your Vaio to another Vaio or print using a printer connected to a remote Vaio
X	smcserv	winsrv.exe	"Added by the AGOBOT-OU WORM!"
Y	SmcService	smc.exe	Sygate Firewall
Y	SmcServices	smc.exe	Sygate Firewall
Y	SmcServices	spfsmc.exe	Sygate Firewall
X	smcss	smcss.exe	"Added by the SCLOG-AJ TROJAN!"
?	Smcsta.exe	Smcsta.exe	"SMC Networks wireless PCI card driver. Is it required?"
X	SmcSVR	SmcSVR.exe	"Added by the LEGMIR.JU TROJAN!"
X	smile	wcs.exe	"Added by the ZLOB.MEDIA-CODEC TROJAN! This purports to be a Windows Media Player upgrade (with names such as ""iCodecPack""
U	SmpcSys	SmpSys.exe	"""Set Up My PC"" utility supplied with some Packard Bell computers"
X	smss.exe	csrss.exe	"Added by the DALBUG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Social Security Agency	rpcxsocsa.exe	"Added by a variant of the RBOT WORM!"
X	some	wcs.exe	"Added by the ZLOB.MEDIA-CODEC TROJAN! This purports to be a Windows Media Player upgrade (with names such as ""iCodecPack""
N	Sony Ericsson PC Suite	Application Launcher.exe	"System Tray access to Sony Ericsson PC Suite which ""connects your phone to your computer and expands the capabilities of your phone"". Run manually via the Start Menu (or optional desktop shortcut) before connecting the phone"
N	Sony Ericsson PC Suite	SEPCSuite.exe	"System Tray access to Sony Ericsson PC Suite which ""connects your phone to your computer and expands the capabilities of your phone"". Run manually via the Start Menu (or optional desktop shortcut) before connecting the phone"
U	Speedtouch USB Diagnostics	Dragdiag.exe	For an external Alcatel ADSL high-speed modem. A diagnostic tool and can be run from the Start menu when required. The only reason it might be useful on startup is if you like seeing an 'at-a-glance' status indicator on the taskbar (the icon is a different colour depending on the status of the device/line)
X	spoolsvr32	csmss.exe	"Added by the AGENT-AU TROJAN!"
X	spoolsvr32	csmss32.exe	"Added by a variant of the AGENT-AU TROJAN!"
X	Spy Protector	srcss.exe	"SpyProtector rogue security suite - not recommended
X	Spy Protector	lsascs.exe	"Spy Protector rogue security software - not recommended
X	SpyBlocs	SpyBlocs.exe	"SpyBlocs spyware remover - not recommended
X	SpyBlocs3.0	SpyBlocs3.0.exe	"SpyBlocs spyware remover - not recommended
N	StacSysTray	StacSysTray.exe	System Tray control panel for SigmaTel C-Major on-board audio - as used on some Dell and Packard Bell PCs
X	Start CurePCSolution	CurePCSolution.exe	"CurePCSolution spyware remover - not recommended
X	State Service	csrss.exe	"Added by the DADOBRA-CP TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Statistics	statslist.exe	"Added by the OPANKI-S WORM!"
X	Sun Java Updater	stacsv.exe	"Added by the BUZUS.DBFM TROJAN!"
X	svchost	svcst.exe	"Added by the AGENT-LIL WORM!"
X	svcshare	winampXP.exe	"Added by the FUJACKS-J VIRUS!"
X	svcshare	spoclsv.exe	"Added by the FUJACKS-A VIRUS!"
X	svcshare	CTMONTv.exe	"Added by the FUJACKS-AJ WORM!"
X	svcshare	nvscv32.exe	"Added by the FUJACKS-Z WORM!"
X	SvcSys	[path to file]	"Added by the BANCOS.Z TROJAN!"
X	Svcsys Registry Manager	svcsysreg.exe	"Detected by Kaspersky as the AGENT.CV TROJAN!"
X	svcsys32	svcsys32.exe	"Added by the AGOBOT-LL WORM!"
X	Sygate Personals Firewalls	ccsrn.exe	"Added by a variant of the RBOT WORM!"
Y	Symantec Core LC	symlcsvc.exe	"Part of Norton AntiVirus 2004. What does it do?"
X	Symlcs	[path to file]	"Added by the YASPY-A TROJAN!"
U	Synaptics Pointing Device Driver	SynTPEnh.exe	"Synaptics TouchPad Enhancements - included with drivers for Synaptics based TouchPads
X	SysSearch	Regedit.exe -s pcsearch.reg	"Added by the STARTPAGE-FN TROJAN! Note that regedit.exe is a legitimate Microsoft file and shouldn't be deleted. The ""pcsearch.reg"" file is located in %Windir%"
X	System	csrss.exe	"Added by the LDPINCH.E TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System CSRSS Patch	scrtkfg.exe	"Added by the RBOT-ADA WORM!"
X	System Diagnostics	sysdiag32.exe	"Added by the SDBOT.GEN TROJAN!"
X	System Event Manager	secsvc.exe	"Added by the RBOT.BMY WORM!"
X	System Log Event	csrss32.exe	"Added by the AGOBOT-JI WORM!"
X	System Messaging Queue	SMCSS.EXE	"Added by a variant of the RBOT WORM!"
X	System Process	csrss.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System Process	CSRSR.exe	"Added by the AGOBOT-SQ WORM!"
X	System Protector	lsascs.exe	"System Protector rogue security software - not recommended
X	System Services	svcsenes.exe	"Added by a variant of the RBOT WORM!"
X	System Services	svcsenes32a.exe	"Added by the RBOT-AFG WORM!"
X	System Startup Manager	smcss.exe	"Added by the RBOT.AMD WORM!"
X	System time updator	CSysTime.exe	"Added by the RANDEX.S WORM!"
X	System Update Service	csrss32.exe	"Added by the AGOBOT-HI WORM!"
X	System132	Csrtss.exe	"Added by the LANFILT-I TROJAN!"
X	System32	csrss.exe	"Added by the SILLYFDC WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	System32-Driver	csrs32.exe	"Added by the SDBOT-CP BACKDOOR!"
X	SystemDriver	csrss.exe	"Added by the ASCETIC.B TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\addins\explorer"
X	SYSTEMSars32	csrss.exe	"Added by the AHLEM.A WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	SysW8	csta.exe	"Clean Space internet evidence eliminator"
X	TaskMrg	csrss.exe	"Added by the LDPINCH-W TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	THCS	svchost.exe	"AllMonitor surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup. This one is located in a ""drivers\imon"" subfolder"
X	TINTIMG	cssrs.exe	"Added by the PASTA.KRI TROJAN!"
U	TotRecSched	TotRecSched.exe	"Scheduler for Total Recorder - allows automatic recording of a show at a given time for later playback or you can use the scheduler as an alarm"
U	U.S.Robotics WLAN Adapter Configuration Utility	USRWLAN.exe	"U.S.Robotics LAN Adapter - wireless LAN (WLAN) configuration utility"
X	Uate	oocs.exe	"PurityScan adware"
N	ucstartup	ucstartup.exe	"IBM Update Connector - old auto updater feature for IBM machines that connects to IBM to see if there are any new drivers
N	ucstartup.exe	ucstartup.exe	"IBM Update Connector - old auto updater feature for IBM machines that connects to IBM to see if there are any new drivers
N	UC_SMB	ucstart.exe	Part of IBM Update connector on IBM PCs for updating drivers on a new installation. Once you manually run the IBM Update connector program (shortcut) this entry is removed
N	UC_Start	ucstartup.exe	"IBM Update Connector - old auto updater feature for IBM machines that connects to IBM to see if there are any new drivers
X	UltimateServices	ultsvcs.exe	"Added by the AGENT-LGT TROJAN!"
X	Update	csrss.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Update	csrss.exe	"Added by the MEHEERWAR TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""winupdate"" subfolder"
X	UpDaTer	csrss.exe	"Added by the AUTORUN.DIB WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ï¿½ subfolder"
X	Updater Service Process	csrss32.exe	"Added by the AGOBOT-GP BACKDOOR!"
X	UPNPService	WinSVCservice.exe	"Added by the AGOBOT.UN WORM!"
X	UsrManagementConf	umcss.exe	"Added by the IRCBOT-W TROJAN!"
N	USRobotics 802.11g Wireless Network Utility	USRWLANG.exe	"USRobotics Wireless Network Utility - used to configure security settings for connecting to WEP encrypted Access Point through the USR Wireless adapter. You must uncheck ""Use Windows to configure my wireless settings"" for the program to work properly. Has Site Survey capabilities
N	Usrobotics Online Registration	??	Pop-up reminding customers to register their products online at US Robotics
X	vcmicrec	msccsed.exe	"Added by the MAILBOT-CE TROJAN!"
X	VCS Host	vcshost.exe	"Added by the RBOT-FKT WORM!"
N	VCSPlayer	vcsplay.exe	"Virtual CD drive emulator. Available via Start -> Programs"
X	Verificador do sistema	cssrs.exe	"Added by the MOCON WORM!"
X	Video Process	netsvcs.exe	"Added by the AGOBOT.LH WORM!"
X	Volume Shadow Manager	vbcsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	wcsys	wcsys.exe	"Added by the KEYLOG-AP TROJAN!"
X	WildFlics	WildFlics.exe	"Direct-B premium rate adult content dialler"
U	Winacsr	Winacsr.exe	"AceScreenSpy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	WinCSRSS	MSGRT32.EXE	"Added by the REWINDO-A TROJAN!"
X	WinDLL (csmss.exe)	"rundll32.exe CSMSS.EXE	start"
X	Windows (ICS) Spooler	crtss.exe	"Added by a variant of the RBOT WORM!"
X	Windows 2004	csrss.exe	"Added by the BANKER-DY TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Windows 2004\Tools"
X	Windows Action	csrs.exe	"Added by the SECCMU-A WORM!"
X	Windows Audio Components	nncsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Client Service 32	csrss.exe	"Added by the RBOT-ALB WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a drivers\winsdriver subfolder"
X	Windows Client/Server Runtime Server	csrs.exe	"Added by the RBOT.KD WORM!"
X	Windows Custom Services	CSRCS.EXE	"Added by the SPYBOT-EI WORM!"
X	Windows Event Detection	wecsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Explorer SP2	csrss.exe	"Added by the BANKER-DM TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""JavaBeans"" subfolder"
X	Windows Graphics Loaders	wingraphics.exe	"Added by the SPYBOT.JG WORM!"
X	Windows Image Acquisition (WIASC)	WIAcs.exe	"Added by the RIZO.A TROJAN!"
X	Windows Image Acquisition (WIASSC)	WIAcss.exe	"Added by the RIZO.A TROJAN!"
X	Windows IP Security Service	ipsecs.exe	"Added by the RBOT.BPW WORM!"
X	Windows Messenger Panel	wbcsvc.exe	"Added by the IRCBOT.ADA BACKDOOR!"
X	Windows NT Service Name	svchcst.exe	"Added by the RBOT-NV WORM!"
X	Windows Remote Launcher	wnpmcs.exe	"Added by the IRCBOT.ASX BACKDOOR!"
X	Windows Svshost Service Update 32	svcsshost32.exe	"Added by the FORBOT-GD WORM!"
X	Windows Taskmanager Data	csrrss.exe	"Added by the RBOT-BBH WORM!"
X	Windows UDP Control Center	wksvcsc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Services	wksvcsc.exe	"Added by the ANTIAV-C TROJAN!"
X	Windows Update	csrss.exe	"Added by the BANKER-HM TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Update Service	csrs.exe	"Added by the AGOBOT-NI WORM!"
X	Windows Update services	wins32svcs.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update System Shell	svhostcs32.exe	"Added by the RBOT-AAZ WORM!"
X	Windows Video Component	wvcsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Zero Spooler	nmvcs.exe	"Added by the SLENFBOT.JQ WORM!"
X	WindowsDiskEvt	svcsvh32.exe	"Added by the NANINF.D TROJAN!"
X	WindowsDiskLog	cstsm.exe	"Added by the STINX-C or STINX-D TROJANS!"
X	WindowsExplorer	csrss.exe	"Messenger Blocker rogue security software - not recommended. Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\System"
X	Windowsupdate Service	csrss.exe	"Added by the BABA-B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in the root folder (ie
X	winexecs	winexecs.exe	"Added by the SILLYFDC.BBB WORM!"
X	WinFX	cssrs.exe	"Added by the AGOBOT.FX WORM!"
X	WinFX	cssrs.exe	"Added by the GAOBOT.CD WORM!"
X	Winlogon	scssrr.exe	"Added by the AGENT-LXB TROJAN!"
X	winphonics7536	vbsystem35.exe setups.exe vb.vb	"Added by a variant of the MUTIN-C TROJAN!"
X	winprotection	ccsrss.exe	"Added by the SILLYFDC.BBT WORM!"
X	WINTASKMGR	ccsrs.exe	"Added by the MYTOB.Q WORM!"
X	WinUpdateAdministrator	CSRSS.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in C:\Application Data\WINDOWS"
U	WinUpdateProtection	csrss.exe	"EmployeeWatch is a commercial surveillance software program designed to monitor user activity on a computer. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a subfolder of C:\windowsupdate\ufp"
X	WinXP	csrss.exe	"Added by the BANCOS-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\WinXP\Tools"
X	WinXP-98	CSRSS.exe	"Added by the BANKER-DS TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\WinXP-98\Tools"
X	WMDM PMSP Service	cssrss.exe	"Added by the KNOCKIT-A TROJAN!"
X	WMI Standard Event Consumer - Scripting	scrcs.exe	"Added by a variant of the RBOT-GRD WORM!"
X	WSAConfiguration	csrsvcs.exe	"Added by the AGOBOT.VI WORM!"
X	WSAConfiguration1	csass.exe	"Added by the AGOBOT.WH WORM!"
X	wscsvc.exe	wscsvc.exe	"Added by a password stealing BANKER TROJAN!"
X	wscsvc32.exe	wscsvc32.exe	"Antivirus rogue security software - not recommended
U	WSVCS	SERVICES.EXE	"WSLogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	wupd	symcsvc.exe	"Added by the ABWIZ.C TROJAN!"
X	xcxdsaa7	slcskxsdl7.exe	"Added by the ONLINEG-K TROJAN!"
?	XTCsgloader	XTCsgloader.exe	"Another Xupiter toolbar variant??"
X	xware	cskware.exe	"Malware downloader from xxsware.com
X	Yahoo Messengger	SSVICSSHOST.exe	"Added by the IMAUT.AA WORM!"
X	zcseacrt	[random filename]	"Added by a variant of the SLAPER TROJAN!"
U	ZoneUpdate	csrss.exe	"WinSpy surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""ComRoot"" subfolder"
N	Z_acamucli wizard	csecwiz.exe	"Setup wizard for the Client Security Software for IBM\Lenovo notebooks. This entry only runs once
X	[unknown name]	WINBASICS32.EXE	"Added by the SDBOT-JH WORM!"
X	_SystemDriver	csrss.exe	"Added by the ASCETIC.B TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\addins\explorer"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.