ERS

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	Intelli Mouse Pro Version 2.0B	ncsjapi32.exe	"Added by the BUZUS-O WORM!"
U	00ERSRRRNKY	eraser.exe	"Part of Evidence Exterminator
X	5-1-61-96	members-area.exe	Adult content dialler
	Access Lock (and maybe others) -.html" title="Access Lock (and maybe others) -">Access Lock (and maybe others) -
	Access Lock (and maybe others) -.html" title="Access Lock (and maybe others) -">Access Lock (and maybe others) -
Y	AccelerometerSt	AccelerometerSt.exe	HP 3D DriveGuard uses a digital accelerometer protects your disk drive by parking and halting I/O requests if you drop your PC or if you move your PC with the display lid closed
Y	AccelerometerSysTrayApplet	AccelerometerSt.exe	HP 3D DriveGuard uses a digital accelerometer protects your disk drive by parking and halting I/O requests if you drop your PC or if you move your PC with the display lid closed
X	Additional Guard	WI[random characters].exe	"Additional Guard rogue security software - not recommended
U	Adobe Version Cue CS2	VersionCueCS2Tray.exe	"File manager that's part of Adobe Creative Suite 2 - ""find files fast
N	AdobeVersionCue	VersionCueTray.exe	"""An exclusive feature of the Adobe® Creative Suite
?	Adobe_ID0EYTHM	VERSIO~2.EXE	"Part of an Adobe product. What does it do and is it required?"
N	ALU Scheduler Service	ALUSchedulerSvc.exe	Symantec LiveUpdate scheduler for programs such as Norton AV or Internet Security
X	Anti-Virus Product Sync	[unprintable character][3 characters]log.exe	"Added by the KEDEBE.D WORM!"
U	AQ3HelperStartUp	AQ3HEL~1.EXE	"ScreenScenes ""Aquatica Water Worlds"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	Auto File System Conversion Utility	scricon.exe	"Added by the SDBOT.EYB WORM!"
U	AXIS Print System DriverScanner	DriverScanner.exe	"Part of AXIS Print System from AXIS Communications - ""adds printer discovery
U	AXIS Print System DriverServer	DriverServer.exe	"Part of AXIS Print System from AXIS Communications - ""adds printer discovery
U	AzMixerSel	AzMixerSel.exe	"Related to Realtek_Azalia Mixer Selector"
U	BBC News alerts	skinkers.exe	"BBC News Desktop Alerts service - see here. Desktop alert and breaking news e-mail services let you find out about all the latest news as it happens"
U	BI1HelperStartUp	BI1HEL~1.EXE	"ScreenScenes ""Beach Islands"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	BO1HelperStartUp	BO1HEL~1.EXE	"ScreenScenes ""Butterfly Oasis"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	BO1HelperStartUp	Bo1helper.exe	"ScreenScenes ""Butterfly Oasis"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	BootsCfg	wscript.exe [path] All Users.vbs	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbe	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	boy lovers of bsd	ilikeboys.exe	"Added by the MYTOB.LY WORM!"
U	Browser Sentinel	BrowserSentinel.exe	"Browser Sentinel - notifies you if a program wants to penetrate into Internet explorer
N	Cashsurfers Cashbar Navigator	Cashbar.Exe	"Cashsurfers CashBar Navigator - ""The CashBar rotates banner advertisements once per minute and provides you with access to up to date special offers and deals"""
X	cdoosoft	herss.exe	"Added by the SILLYFDC.BCT WORM!"
X	CleanUp Antivirus	CU[random characters].exe	"Cleanup Antivirus rogue security software - not recommended
N	Client Access Check Version	cwbckver.exe	"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
X	Compaq Drivers	F1rewalls.exe	"Added by the SDBOT-WD WORM!"
X	Compaq Jes Drivers	winjes.exe	"Added by the SDBOT-XR WORM!"
X	Compaq Service Drivers	systeminfos.exe	"Added by the SDBOT-XC WORM!"
X	Compaq Service Drivers	compq.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	navapqwa.exe	"Added by the SDBOT.BBQ WORM!"
X	Compaq Service Drivers	amsn.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	compqs.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	msnt.exe	"Added by the SDBOT.CQL WORM!"
X	Compaq Service Drivers	NtKernelSystem.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	wincmd.exe	"Added by the RBOT.ATV WORM!"
X	Compaq Service Drivers	wind32.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	winmsn.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	compaq.exe	"Added by the SDBOT-AFU WORM!"
X	Compaq Service Drivers	msnsvc.exe	"Added by the RBOT.BKT WORM!"
X	Compaq Service Drivers	ntsys32.exe	"Added by the RBOT.CIW WORM!"
X	Compaq Service Drivers	winsvc.exe	"Added by the SDBOT-AGD WORM!"
X	Compaq Service Drivers 32	compq32.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Services Drivers	ndt32.exe	"Added by the RBOT.CQZ WORM!"
X	Compaq Sound Drivers For WINDOWS	sounddr.exe	"Added by the SDBOT-XG WORM!"
X	Compaq32 Service Drivers	ms32.exe	"Added by the SDBOT.BWH WORM!"
X	Compaq32 Service Drivers	msconfig32.exe	"Added by the SDBOT-ADC WORM!"
X	Compaq32 Service Drivers	msnt32.exe	"Added by the RBOT.BVF WORM!"
X	Compaqs Service Drivers	compqs.exe	"Added by a variant of the SDBOT WORM!"
N	Corel Colleagues & Contacts Reminders	cffrem.exe	"Corel Colleagues & Contracts - all-in-one organizer for scheduling meetings
N	Corel Family & Friends reminders	CFFREM.EXE	"Corel Family & Friends - all-in-one calender
N	CorelMedia FoldersIndexer8	MFindexer.exe	Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office
N	CorelMedia FoldersIndexer8	MFINDE~1.EXE	Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office
X	Counterstrike Service Agent	czrzns.exe	"Added by the MEDBOT.AR WORM!"
?	Coupon Offers	??	"??"
X	Creative Audio Drivers	creative.exe	"Added by the RBOT-FKR WORM!"
X	Directx Startup Drivers	direct.exe	"Added by the RBOT.UXL WORM!"
N	DiskeeperSystray	DkIcon.exe	"DisKeeper defragmentation software - can be started manually"
X	Display Drivers	cssrs.exe	"Added by the AGOBOT.FX WORM!"
X	DLINK dfe drivers for Windows NT	windfe.exe	"Added by the RANDEX.AK WORM!"
X	dm[3 random letters].exe	dm[3 random letters].exe	"Added by the RUINDEM TROJAN!"
X	Drivers for Internet Explorer	accesweb.exe	"Added by the STARTPAGE.FW TROJAN!"
N	Dulux WeatherShield WeatherDesk	weather.exe	"Dulux WeatherShield WeatherDesk - latest weather information from across Australia"
X	Efata	[random 5 characters].exe	"Added by the FLUKAN-D WORM!"
U	EFI Hot Folders	hffw.exe	"""EFI Hot Folders improves productivity by simplifying the printing of PostScript and PDF files into a select
X	eMCryT Sh3ars Panagers	[path to worm]	"Added by the RBOT-AWI WORM!"
X	Enterprise Suite	WE[random characters].exe	"Enterprise Suite rogue security software - not recommended
X	Error Safe	ers.exe	"ErrorSafe rogue system error and cleaning utility - not recommended"
X	Error Safe Free	uers.exe	"ErrorSafe rogue system error and cleaning utility - not recommended"
X	ErrorSafe	ers.exe	"ErrorSafe rogue system error and cleaning utility - not recommended"
X	ErrorSafeFree	UERS.exe	"ErrorSafe rogue system error and cleaning utility - not recommended"
X	ERS	ers_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	ERScw	ERScw.exe	"Part of the ErrorSafe rogue system error and cleaning utility - not recommended"
X	ERS_check	ers_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	ERS_Check	uwasers.exe	"Part of the WinAntiSpyware 2006 and WinAntiSpyware 2007 rogue spyware removers - not recommended"
X	Ethernet Drivers	smrrs.exe	"Added by the RBOT-AAK WORM!"
X	Ethernet Drivers	ethernet.exe	"Added by the GAOBOT.CEZ WORM!"
N	Event Planner Reminders	PLNRNote.exe	Part of Sierra/Hallmark Card Studio - System Tray notification of events such as birthdays and anniversaries that you've scheduled with the customizable Event Planner
N	Event Planner Reminders Tray Icon	PLNRnote.exe	Part of Sierra/Hallmark Card Studio - System Tray notification of events such as birthdays and anniversaries that you've scheduled with the customizable Event Planner
?	Execute	delfolders.exe	"??"
U	E_S[numbers]	[path] E_[various].EXE [path] E_S[numbers].tmp	"Temporary entry related to Epson Status Monitor 3 for their range of printer and AIO devices - for monitoring printer status
U	FaxCenterServer	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software. Incorporated into software by Lexmark
U	FaxCenterServer4_in_1	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software. Incorporated into software by Lexmark
X	FBSearch	FastBrowserSearchProtection.exe	"Fast Browser Search/Search Guard Plus parasite - installed with ""Make the Web Better"" applications such as My Web Tattoo
X	FireFox Service Drivers	ssmss.exe	"Added by a variant of the SDBOT WORM!"
X	FireFox Startup Drivers	wuaclt.exe	"Added by the RBOT.BYX WORM!"
U	FolderShare	FolderShare.exe	"""FolderShare allows you to create a private peer-to-peer network that will help you to synchronize files across multiple devices and access or share files with colleagues and friends"""
Y	fspr	FolderShield.exe	"Folder Shield - hide personal files and folders"
X	fukerservice	fukerz.exe	"Added by a variant of the RBOT WORM!"
X	Gate Personal Firewall	Systpl.exe	"Added by the RBOT.ADC WORM"
X	Gestionnaire de disques universel	sysoobe.exe	"Added by the TOADER-A TROJAN!"
X	grinders	grinders.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X	h4te Service Drivers	h4te.exe	"Added by a variant of the RBOT WORM!"
U	HalifaxHowardCluster	skinkers.exe	"""Howard the Weatherman"" desktop client from Halifax by Skinkers - marketing/messaging tool. Leave enabled if you want to receive messages"
X	hdlpscom	[8 random letters].exe	"Added by the RBOT-FUL WORM!"
X	HMI PowerSystem	hmisvc32.exe	"Added by the RANDEX.CZZ WORM!"
X	HML PowerSource	hmlsvc32.exe	"Added by the SDBOT-XL WORM!"
X	HMV PowerSource	hmusvc32.exe	"Added by the SDBOT-YW WORM!"
U	Hot Corners	Hotc.exe	"Hot Corners - ""lets you quickly activate or disable your screen saver by moving the mouse into a given corner of the screen"""
X	hotefix	msnmanegers.exe	"Added by the IRCBRUTE.AS TROJAN!"
X	HP Service Drivers	hdsys.exe	"Added by the SDBOT-ZE WORM!"
X	I/O Controllers	svcnet.exe	"Added by the TIBIK-B TROJAN!"
X	icccomp	[8 random letters].exe	"Added by the ZHELATIN.EQ WORM!"
X	idlesam	[8 random letters].exe	"Added by the ZHELATIN.EQ WORM!"
X	IExplorerService	WinSock.exe	"Added by the AGENT.KIU TROJAN!"
U	igfxpers	igfxpers.exe	"Installed with the graphics drivers for Intel desktop and mobile motherboard chipsets with integrated graphics. It's purpose or function isn't known at present but testing with it disabled would appear to indicate it isn't required - hence the recommended ""U"" status"
X	iisvers	iisvers.exe	Added by an unidentified TROJAN or adware
X	Image Remote Players	sysvn.exe	"Added by a variant of the IRCBOT BACKDOOR!"
U	ImageDrive-{hex numbers}	ImageDrive.exe	"Nero ImageDrive from Ahead - virtual CD/DVD drive software"
X	instant messengers	instantmsgtr.exe	"Added by the AGOBOT-PC BACKDOOR!"
X	Intec Service Drivers	msmsgrs.exe	"Added by the SDBOT-ADN WORM!"
X	Intec Service Drivers	[path to worm]	"Added by the RBOT-GLU WORM!"
X	Intec Service Drivers	wing32.exe	"Added by the RBOT.HAZ WORM!"
X	Intec Service Drivers	msmsgredss.exe	"Added by the SDBOT-AGL WORM!"
X	Intec Services Drivers	msupdate22e.exe	"Added by the RBOT-CGC WORM!"
X	Intel Service Drivers	msconfig16.exe	"Added by the MSCONFIG16 TROJAN!"
U	Intel(R) Common User Interface	igfxpers.exe	"Installed with the graphics drivers for Intel desktop and mobile motherboard chipsets with integrated graphics. It's purpose or function isn't known at present but testing with it disabled would appear to indicate it isn't required - hence the recommended ""U"" status"
X	Intelli Mouse Pro Version 2.0B	ncsjapi32.exe	"Added by the BUZUS-O WORM!"
X	Internet Service	intersvc.exe	"Added by the SPYBOT-DE WORM!"
X	Internet Services	interserv.exe	"Added by the RBOT.BNT WORM!"
X	Inters Configuration Loader	RCL0ADERS.exe	"Added by the SDBOT-KX WORM!"
X	Intersoft Msngr	intersoftmsngr.exe	"Added by the AGOBOT-NW WORM!"
Y	iolo Personal Firewall	ioloFW.exe	"iolo Personal Firewall"
X	Ipod Help	[9 random letters].exe	"Added by a variant of the RBOT WORM!"
X	IPOT Service Drivers	compaq.exe	"Added by a variant of the FUROOTKIT TROJAN!"
X	ivHost	[6 random letters].exe	"Added by a variant of the SPYBOT WORM! See examples here and here"
U	Job-oversigt	taskmon.exe	"Task Monitor (on Danish language versions of Windows) - checks the disk-access patterns of programs when they are started and stores this information in log files in the Applog folder. Task Monitor also records the number of times you use a program. Task Monitor also records the number of times you use a program. The Disk Defragmenter tool uses this information to optimize your hard disk so that programs that you use frequently are loaded faster. Not required - but can be useful. Note: for Norton Anti-Virus 2002 users
Y	Kaspersky Anti-Hacker	KAVPF.exe	"Kaspersky Anti-Hacker personal firewall - no longer available"
Y	Kaspersky Anti-Virus Monitor	AvpM.exe	"Kaspersky Anti-Virus Lite - no longer available"
X	Kaspersky Antivirus	KasperskyAV.exe	"Added by a variant of the RBOT WORM!"
X	Kaspersky Email Security	javaupd.exe	"Added by the SWARLEY.A WORM!"
X	kaspersky32	kasperskyLabs32.exe	"Added by the RBOT-GOT WORM!"
X	KasperskyAv	kaspersky.exe	"Added by the MIMAIL.T WORM! Note - this has nothing to do with the real Kaspersky anti-virus"
X	KasperskyAVEng	Kasperskyaveng.exe	"Added by the NETSKY.V WORM!"
X	KAVPersonal	svchost.exe	"Added by the LINEAGE-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
Y	KAVPersonal50	Kav.exe	"Kaspersky Anti-Virus Personal 5.0"
X	KAVPersonal90	wscntfy.exe	"Added by the BANKER-FZ TROJAN!"
X	kdmsx	[8 random letters].exe	"Added by the SDBOT.AIJ BACKDOOR!"
X	L0aders	faxneti.exe	"Added by a variant of the SDBOT TROJAN!"
X	Layersecurity Servicemonitor	LSSMON.EXE	"Added by the BANKER.ZAQ TROJAN!"
X	layersldm	hostplsrvc.exe	"Added by a variant of the SDBOT WORM!"
N	LenovoOobeOffers	LenovoOobeOffers.exe	"Displays product upgrades/offers from Lenovo on the first run of a new notebook/desktop. ""Oobe"" refers to the ""Out of box experience"""
X	Life Personal Firewall	FirewallingV10.exe	"Added by the RBOT-BKF WORM!"
X	Linksys Modem Drivers	linksys.exe	Added by the IRCBOT.VD WORM!
X	Live PC Care	LP[random characters].exe	"Live PC Care rogue security software - not recommended
X	Live Windows Messenger Version	msnmessage7.7.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Live Windows Messenger Version	msnmsngrlive.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Loaders	HeIp.exe	"Added by the SDBOT-ADB WORM!"
X	LoadPowerScheme	rundll32.exe powerprof.dll CheckPowerProfile	"Ulubione adult content dialer. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	LOCAL INTERNET WEB DRIVERS FOR WIN32	phqghume.exe	"Added by a variant of the RBOT WORM!"
X	LowVersionSupport	[filename]	"Added by the LASTRAS TROJAN!"
X	LSA Shell (Export Version)	LSASS.exe	"Added by the AHKER.K WORM and variants. Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	LTM2	winvers16.exe	"Added by the SMALL.ND TROJAN!"
X	M S DVD DirectX Dll Drivers	msxdl.exe	"Added by the SDBOT-BJN WORM!"
X	Malware Cleaner	[random numbers].exe	"Malware Cleaner rogue security software - not recommended
X	mceipww	[8 random letters].exe	"Added by the ZHELATIN.EQ WORM!"
X	MDM Rock 4	[8 random letters].exe	"Added by the SDBOT.CHG BACKDOOR!"
X	Members area	*****.exe [ = random digit]	Premium rate adult content dialer
N	MessagerStarter Freeserve	StartMessager.exe	Freeserve Messenger
X	Messenger91	messengersystem.exe	"Added by the RBOT-FPF WORM!"
X	messengerskinner	MessengerSkinner.exe	"Messenger Skinner malware - uses a rootkit to hide executable files"
X	MeTaLRoCk (irc.musirc.com) has sex with printers	metalrock-is-gay.exe	"Added by the RANDEX.Q WORM!"
X	Microsft Corporation Version 2001.12.4414	comrel.exe	"Added by a variant of the SDBOT TROJAN!"
X	Microsft Corporation Version 2002.12.2414	comserv.exe	"Added by a variant of the SLAPER TROJAN!"
X	Microsoft	mixers.exe	"Added by the AGOBOT-AHU WORM!"
X	Microsoft	kasperskyLive32.exe	"Added by the RBOT-GRT WORM!"
X	Microsoft Directx clicks	directxclickers.exe	"Added by the RBOT-GHT WORM!"
X	Microsoft Drivers	WSconf.exe	"Added by a variant of the SDBOT WORM!"
X	MicroSoft Getway mqbol	[12 random letters].exe	"Added by the RBOT.GBA WORM!"
N	Microsoft Greetings Reminders	MHPRMIND.EXE	Microsoft Home Publishing greetings reminder
X	Microsoft Machine Script	iexplorersis.exe	"Added by the RBOT-CMH WORM!"
X	Microsoft media	winmplayers.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft messenger sd	msngersd.exe	Added by an unidentified TROJAN!
X	Microsoft NT Drivers	ntdrv.exe	Added by the SDBOT.AJN TROJAN!
X	Microsoft Personal Firewalls	bakw.exe	"Added by the RBOT-KS WORM!"
X	Microsoft Security Controlers	fxsecues.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Security GManagers	[random filename]	"Added by a variant of the SDBOT WORM!"
X	Microsoft Security Panagers	[random filename]	"Added by the RBOT-AIG WORM!"
X	Microsoft Security Panagers	zzoboony.exe	"Added by the RBOT-AOI WORM!"
X	Microsoft Security Pansasagers	dgkztsqgn.exe	"Added by the RBOT-BBJ WORM!"
X	Microsoft Service Drivers	System.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Service Drivers	VSADNIM.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Device Drivers	wuauclt.exe	"Added by a variant of the SDBOT WORM! Note - this is not the legitimate wuauclt.exe process
X	Microsoft Update Drivers	explorers.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update Loaders 2005	winusers.exe	"Added by the RBOT-AIQ WORM!"
X	Microsoft Update Loaders 2006	winusersystem32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Updaters	tskmgr.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updaters	sysconfigs.exe	"Added by the RBOT-DF TROJAN!"
X	Microsoft Updaters Pros	WINDLL32XP.EXE	Added by the SPYBOTTER.GEN VIRUS!
X	Microsoft Windows Drivers	windrv.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Services	Sersices.exe	"Added by the SDBOT-NO WORM!"
X	Microsoft Windows Sound Drivers	sounddrivers.exe	"Added by the SLENFBOT.ABU WORM!"
X	Microsoft Windows Updata	[5 random letters].exe	"Added by a variant of the RBOT WORM!"
N	Microsoft Works Calendar Reminders	wkcalrem.exe	If you schedule an event at any time in Microsoft Works Calendar and set a reminder then a shortcut will be added to Start → All Programs → Startup so this reminder service loads every time Windows starts
X	Microsoft Xp Systems loaders	win32xpsys.exe	"Added by the SPYBOT.NYT WORM!"
X	MicrosoftDriverService32	drsys32.exe	"Added by the IRCBOT.AKX BACKDOOR!"
X	MicrosoftKs	Drivers.bat	"Added by the SHUTDOWN-F TROJAN!"
X	MicrosoftPersonalFirewall	spoolsrv.exe	"Added by the WOOTBOT.DO BACKDOOR!"
X	MicrosoftROMDriverService	cdrss.exe	"Added by the IRCBOT.BLF BACKDOOR!"
X	Micrsoft DerSystem	uqieelpb.exe	"Added by the RBOT-GRI WORM!"
U	MirrorFolderShell	mrfshl.exe	"MirrorFolder backup software"
N	Mixersel	mixersel.exe	Configuration for Realtek audio devices
U	ML1HelperStartUp	ML1HEL~1.EXE	"ScreenScenes ""Midnight Lake"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	ML1HelperStartUp	ML1Helper.exe	"ScreenScenes ""Midnight Lake"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
N	MMReminderService	MMReminderService.exe	"Mind Manager from Mindjet - ""easy way to organize ideas and information"". Registration reminder"
U	Monitor Apache Servers	ApacheMonitor.exe	Part of the Apache Web Server package. Useful only if you're running such a server on your PC. Available via Start -> Programs
N	Monstersoundtray	Freectrl.exe	Diamond Multimedia sound card control panel
X	Ms Builders	Wupated.exe	"Added by the AGOBOT-SS WORM!"
X	MS DirectX Sound Drivers	msdrvdx.exe	"Added by the RBOT.BCX WORM!"
X	MS DVD DirectX Dll Drivers	mdxdl.exe	"Added by the SDBOT-XI WORM!"
X	MS DVD DirectX Sound Drivers	msdrvdx.exe	"Added by the SDBOT-XJ WORM!"
X	MS Service Drivers	winscv.exe	"Added by the SDBOT-COG WORM!"
X	Ms Sound Drivers	msdrv.exe	"Added by the SDBOT-WR WORM!"
X	MSIE Parsers	MSIE32ab.exe	"Added by the SDBOT.MV WORM!"
X	MSMSGNER	[4-8 random letters].exe	"Added by the FOWLDO-GEN TROJAN!"
X	MSN	msnmesengers.exe	"Added by the RBOT-ME WORM!"
X	MSN 9.0 Plus	[random letters].exe	"Added by the RBOT-ALY WORM!"
X	Msn Messengers	MSNMSGR.EXE	"Added by the RBOT.KX WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	MSN UPDATERS	virtualmemory.exe	"Added by the RBOT-JK WORM!"
X	MsnMessengerSvc	msnmsgr.exe	"Added by a variant of the RBOT WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	MSVersion	INTERNETFEATURES.exe	"Added by the POPMON.A TROJAN! - also known as PopMonster adware"
X	MSVersion	clrschp038.exe	"Added by the POPMON.A TROJAN! - also known as PopMonster adware"
X	MsWindows DRT Drivers	wsdrt32.exe	"Added by the RBOT.ALT WORM!"
X	MsWindows SSL Drivers	mssl32.exe	"Added by the SPYBOT.API WORM!"
U	MW1HelperStartUp	Mw1helper.exe	"ScreenScenes ""Magic Waterfall"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	MW1HelperStartUp	MW1HEL~1.EXE	"ScreenScenes ""Magic Waterfall"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	My Security Engine	MS[random characters].exe	"My Security Engine rogue security software - not recommended
X	My Security Wall	MS[random characters].exe	"My Security Wall rogue security software - not recommended
X	NetManagerService	ntss.exe	"Added by the BESTPICS.A TROJAN!"
N	NetPerSec	NetPerSec.exe	"
N	NetZIPFolders	nzfprop.exe	"
X	NeuerSchild	pgs.exe	"NeuerSchild
X	NI.ERS_9999_N91S3108	[path to file]	"Installer for the ErrorSafe rogue system error and cleaning utility - see here"
X	NI.UERSM_0001_N68M1602	[path to file]	"Installer for the ErrorSafe rogue system error and cleaning utility - see here"
X	Norton Personal Firewall	jah.exe	"Added by a variant of the SDBOT WORM!"
X	Norton Personal Firewall	npfw.exe	"Added by the RBOT-UI WORM!"
X	Norton Personal Firewall	lah.exe	"Added by a variant of the RBOT WORM!"
X	Norton Personal Firewall	npfw32.exe	"Added by the RBOT-UQ WORM!"
Y	Norton Personal Firewall	IntroWiz.exe	Part of Norton Personal Firewall or Norton Internet Security
X	Norton Personal Firewall	winmpts.exe	"Added by the RBOT.ANT WORM!"
X	Nvid	[8 random charachters]	Unidentified adware
X	nVidia Application Drivers	nvidiav32.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	nVidia Display Drivers (x86)	nvsys86.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	nVidia Drivers	nVidiaDrvers.exe	"Added by the SDBOT-AFX WORM! Note - this is not related to any nVidia based motherboard or graphics card"
X	NVidia Drivers	[path to trojan]	"Added by the RANCK-R TROJAN! Note - this is not related to any nVidia based motherboard or graphics card"
X	nVidia System Drivers	nvsys32.exe	"Added by an unidentified WORM or TROJAN! See here"
X	NVIDIA Video drivers	video_32D.exe	"Added by the AGOBOT.KV WORM!"
X	NVIDIA Video drivers	video_32sD.exe	"Added by the RBOT-BB WORM!"
X	Offer Companion	offers.exe	Adware
X	Offers	offers.exe	Adware
X	Open Service Drivers	opiater.exe	"Added by a variant of the RBOT WORM!"
X	OpenGL Drivers	0penGLD.exe	"Added by the YIMP-A WORM!"
X	Optional Web Drivers For WIN32	phqghume.exe	"Added by a variant of the RBOT WORM!"
X	orderShell	order***.exe [ = random char]	"Added by the DLOADR-UN TROJAN!"
?	Packard Bell EverSafe Tray Control	TrayControl.exe	"Packard Bell EverSafe software. What does it do
X	PC Live Guard	PC[random characters].exe	"PC Live Guard rogue security software - not recommended
Y	PersFw	PersFw.exe	"Kerio or Tiny Personal Firewall"
U	Persistence	igfxpers.exe	"Installed with the graphics drivers for Intel desktop and mobile motherboard chipsets with integrated graphics. It's purpose or function isn't known at present but testing with it disabled would appear to indicate it isn't required - hence the recommended ""U"" status"
X	Personal Anti Malware	PAM.exe	"Unregistered version of Personal Anti Malware rogue security software - not recommended
X	Personal Anti Malware Center	AMC.exe	"Registered version of Personal Anti Malware rogue security software - not recommended
X	Personal Antivirus	PerAvir.exe	"Personal Antivirus rogue security software - not recommended
X	Personal Computer	scvhost.exe	"Added by the RBOT-AJE WORM!"
X	Personal Defender 2009	pdefendr.exe	"Personal Defender 2009 rogue security software - not recommended
X	Personal Firewall V9	Firewall-UpdateV9.exe	"Added by the RBOT-BJR WORM!"
X	Personal Firwall	ptmedsrv.exe	"Added by the SDBOT.XY WORM!"
X	Personal Security Center Monitor	isc_ui.exe	"Added by the FAKEALERT TROJAN!"
X	PersonalAntiSpy Free	pas.exe	"PersonalAntiSpy rogue spyware remover - not recommended
X	PersonalAV	pav.exe	"PersonalAV rogue security software - not recommended. Detected as the FAKEAV.FT TROJAN by Trend. Located in %ProgramFiles%\PersonalAV"
X	personalguard	personalguard.exe	"Personal Guard 2009 rogue security software - not recommended
X	personalprotector	personalprotector.exe	"Personal Protector rogue security software - not recommended
X	PersonalSec	psecurity.exe	"Personal Security rogue security software - not recommended
X	PersonSecurity	psecurity.exe	"Personal Security rogue security software - not recommended
X	PersSecurity	personalsecurity.exe	"Personal Security rogue security software - not recommended
X	PersSecurity	psecurity.exe	"Personal Security rogue security software - not recommended
U	PhoneFree version 6.2	PHONEF??.EXE	"An Internet telephony application. Complicated registration and ad banners tailored to your profile - see here"
U	PMT	personalmoneytree.exe	"According to the web site Personal Money Tree is an automatic cash rebate program. Note: Not recommended"
X	PopularScreensaversWallpaper	"rundll32 [path] F3SCRCTR.DLL	LES"
X	Popup and Advertisement Killers	adkillers.exe	"Added by the RBOT-DDH WORM!"
X	popuppers	newpop63.exe	"Medload adware"
X	popuppers64	a64sddd.exe	"Popuppers adware
X	popuppers65	[path to file]	"Medload adware"
X	Power Scan	powerscan.exe	"Foistware by Integrated Search Technologies - the people behind ISTBar adware"
U	PowerPanel Personal Edition User Interaction	pppeuser.exe	"CyberPower PowerPanel Personal Edition UPS Monitoring & Control Software - ""is included with CyberPower's products. This exclusive software allows control and monitoring of your UPS to provide protection for your computer system
?	PowerS	PowerS.exe	"ProlinkTest for either their AGP graphics card or TV/FM capture card. Is it required?"
?	PowerSet	Regedit.exe /s ...PowerSet_8100_CU.REG	"Appears to be Toshiba power management related"
N	PowerStrip	powerstrip.exe	"PowerStrip is a Video Mode Editor to allow special Refresh Rates and Tweaking of Video Settings"
N	PowerStrip	PSTRIP.EXE	"PowerStrip is a Video Mode Editor to allow special Refresh Rates and Tweaking of Video Settings"
X	PrinterSpool	[path] RESTORE.EXE [path] SPOOL.EXE	"Added by the ALADINZ.K TROJAN!"
X	Program Access Service	[10 random letters].exe	"Added by the RBOT.GJJ WORM!"
X	proses	[5 random letters].exe	"Added by a variant of the RBOT WORM!"
X	RegistryMonitor1	igfxpers.exe	"Added by the DELF-EZZ TROJAN! Note - this is not the legitimate Intel graphics driver which has the same filename"
X	Required Service Drivers	micront.exe	"Added by the RBOT-ABD WORM!"
X	reszrv	[8 random letters].exe	"Added by a variant of the SDBOT WORM! See here"
U	RetrieverScheduler	retrieverscheduler.exe	"80-20 Retriever from 80-20 - ""80-20 Retriever is a powerful personal search tool that encompasses email folders
U	RivaTunerStartupDaemon	RivaTuner.exe	"Part of RivaTuner - a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This entry is for XP and applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
U	RivaTunerStartupDaemon	RivaTunerWrapper.exe	"Part of RivaTuner - a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This entry is for Vista and loads the main application (RivaTuner.exe) to apply overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
X	RPC Drivers	rpcall.exe	"Added by the SDBOT.FLY WORM!"
X	SearchNavVersion	searchnavversion.exe	SearchNav adware - IEFeatures/Popnav variant
U	SecureOnlineAccountNumbers	SOAN.exe	"Related to Secure Online Account Numbers by Discover(R) Card from Orbiscom Ltd. Secure and innovative payment solutions"
X	Security Antivirus	SA[random characters].exe	"Security Antivirus rogue security software - not recommended
X	Security Guard	SG[random characters].exe	"Security Guard rogue security software - not recommended
X	Security Master AV	SM[random characters].exe	"Security Master AV rogue security software - not recommended
X	Service Drivers	msnpg.exe	"Added by the RBOT.BMD WORM!"
X	Service Drivers	PC.EXE	"Added by the SDBOT-WK WORM!"
X	Service Drivers	Compt.exe	"Added by the RBOT-ZJ WORM!"
X	Service Drivers	abl.exe	"Added by the SDBOT-YX WORM!"
X	Service Drivers	MSNMEssenger.exe	"Added by a variant of the RBOT WORM!"
X	Services Managers	svcmanager.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	SGPUpdater	sgpUpdaters.exe	"Fast Browser Search/Search Guard Plus parasite - installed with ""Make the Web Better"" applications such as My Web Tattoo
X	SichererSchutz	pgs.exe	"SichererSchutz
U	skinkers	skinkers.exe	"Selection of desktop messaging/marketing tools with celebrity tie-ins including MTV's ""Desktop Ozzy"" and Arsenal's ""Desktop Wenger"" - see here. Leave enabled if you want to receive messages"
X	Smart Virus Eliminator	SM[random characters].exe	"Smart Virus Eliminator rogue security software - not recommended
X	SMSERIALWORKERSTART	shellexcon.exe	"Added by the FAKEALERT-AH TROJAN! Installed with the SpyBurner spyware remover - which is not recommended
X	SMSERIALWORKERSTARTER	winstrse.exe	"Added by the RENOS.IC TROJAN! Installed with the SpyBurner spyware remover - which is not recommended
X	SoundMax Audio Drivers	SndMAX.exe	"Added by a variant of the SDBOT WORM!"
X	SpecialOffers	SpecialOffers.exe [ = digit]	"SpecialOffers adware"
X	SpecialOffers	SpecialOffers.exe	"SpecialOffers adware"
X	SpoolerSubSystemProcess	SpooI32.exe	"Added by the EHKS.21 keylogger! Note - the ""I"" between ""o"" and ""3"" is a capital ""i"" not a lower case ""L"""
X	Streams Drivers	[trojan filename]	"Added by the RESTARTER.E TROJAN!"
U	Super X Desktop Version 3.4	SXDesk.exe	"Super X Desktop - virtual desktop manager"
X	superslut	msslut32.exe	"Added by the SLUTER-A WORM!"
U	SuperSpamKiller Pro	Ssk.exe	"SuperSpamKiller Pro email spam blocker"
X	support-reverse-smileys	[trojan filename]	"Added by the LITEBOT TROJAN!"
X	SwiftCleaner	SwiftCleanerScanner.exe	"SwiftCleaner rogue cleaning utility - not recommended
X	Sygaete Personal Firewall	SyGate.exe	"Added by the RBOT-GLX WORM!"
X	Sygate Personal 3	svrv.exe	"Added by the RBOT-XD WORM!"
X	Sygate Personal Block	Studio.exe	"Added by the RBOT-TW WORM!"
X	Sygate Personal Firewall	Win32x.exe	"Added by the RBOT-KZ WORM!"
X	Sygate Personal Firewall	system32.exe	"Added by the RBOT.VI WORM!"
X	Sygate Personal Firewall	sysgut.exe	"Added by the SDBOT.WM WORM!"
X	Sygate Personal Firewall	Sygate.exe	"Added by the RBOT-PN WORM!"
X	Sygate Personal Firewall	Mcafeeupdate.exe	"Added by the RBOT.YN WORM!"
X	Sygate Personal Firewall	Sygate32.exe	"Added by the RBOT.ATW WORM!"
X	Sygate Personal Firewall	MSNSRV32.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personal Firewall	service.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personal Firewall	t1ktik.exe	"Added by the RBOT-VP WORM!"
X	Sygate Personal Firewall	host32.exe	"Added by the RBOT.ALD WORM!"
X	Sygate Personal Firewall	sexy.exe	"Added by the RBOT-XY WORM!"
X	Sygate Personal Firewall	sys.exe	"Added by the RBOT-ZC WORM!"
X	Sygate Personal Firewall	syserror.exe	"Added by the RBOT.UC WORM!"
X	Sygate Personal Firewall	hostserv.exe	"Added by the RBOT.BKO WORM!"
X	Sygate Personal Firewall	msnmsgrs.exe	"Added by the RBOT.XN WORM!"
X	Sygate Personal Firewall	Sygat.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personal Firewall	wins.exe	"Added by the RBOT.AOB WORM!"
X	Sygate Personal Firewall	winxpstat.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personal Firewall	Syga.exe	"Added by the RBOT-AQD WORM!"
X	Sygate Personal Firewall	svchots.exe	"Added by the RBOT.ABT WORM!"
X	Sygate Personal Firewall	win31243.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Sygate Personal Firewall Start	services32.exe	"Added by the RBOT-MB WORM!"
X	Sygate Personal Firewall Start	servic.exe	"Added by the RBOT-RY WORM!"
X	Sygate Personal Port	crss.exe	"Added by the RBOT-PX WORM!"
X	Sygate Personal Port Blocker	volume.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personal Port Blocker	winupdate.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personals Firewalls	ccsrn.exe	"Added by a variant of the RBOT WORM!"
X	Sygates Personal Firewall	sygs.exe	"Added by the RBOT.XB WORM!"
X	Synchronization Manager	rservers.exe	"Added by the FORBOT-FM WORM!"
X	SysDefenders	SysDefenders.exe	"SysDefenders rogue security software - not recommended
X	Sysgate Personal Firewall	syst3ms.exe	"Added by a variant of the IRCBOT TROJAN!"
X	sysPersonalFirewall	msnmssgr.exe	"Added by a variant of the RBOT WORM!"
X	sysPersonalFirewall	system.exe	"Added by the WOOTBOT.FH WORM!"
X	sysPersonalFirewall	tskm0nitor.exe	"Added by the SDBOT.APC WORM!"
X	System Defender	WS[random characters].exe	"System Defender rogue security software - not recommended
X	System Device Version	systemdv.exe	"Added by a variant of the RBOT WORM!"
X	System Drivers	wingmt.exe	"Added by the SDBOT-MG WORM!"
X	System Drivers	cpsq32.exe	"Added by the SDBOT.AXH WORM!"
X	System Drivers	sysdrv32.exe	"Added by the AGOBOT-ZX WORM!"
X	System File Drivers	nvsysvc32.exe	"Added by the AGOBOT.WJ WORM!"
X	System Security Updaters	vsmons.exe	"Added by the RBOT-OW WORM!"
X	SystemB	MessengerStopper.exe	"MessStopper adware"
X	syswin.txt	[3 random letters].exe	"Added by a variant of the SPYBOT WORM! See here"
X	Taesk managers	tase.pif	"Added by the RBOT-AYK TROJAN!"
U	tgcmdprovidersbc	tgcmd.exe	"Part of software from SupportSoft (aka Support.com) provided to manufacturers and ISPs that allows them to offer on-line support - to update drivers
Y	Tiny Personal Firewall	persfw.exe	"Tiny Personal Firewall"
X	Trojan Guarder Gold Version	Trojan Guarder.exe	"TrojanGuarder rogue security software - not recommended"
X	ttool	[random numbers].exe	"Added by the BCKDR-QII BACKDOOR! The filename seen most often is ""9129837.exe"""
X	UERScw	UERScw.exe	"Part of the ErrorSafe rogue system error and cleaning utility - not recommended"
X	Universal Plug & Play devices	WinUPPD.exe	Added by an unidentified WORM/TROJAN!
X	Universal USB Service	svchost32.exe	"Added by the KELVIR.R WORM!"
X	USB Drivers1	msupdate.exe	"Added by a variant of the RBOT WORM!"
X	user	users.exe	"Added by the AUTORUN-AMK WORM!"
X	User Services	usersvc.exe	"Added by the REVCUSS.A TROJAN!"
X	UserSystem	[filename]	"CoolWebSearch Smartsearch parasite variant. Also detected as the SEARCH-A TROJAN!"
U	versato	versato.exe	"""Hot"" button (such as volume and browser control) management and a CD player as supplied with QTronix (as possibly Micro Innovations) keyboards"
X	verse	verse.exe	"Added by the STAP-C WORM!"
X	Version	Version.exe	"JRAUN adware variant"
X	Version	manage.exe	"JRAUN adware variant"
X	version	[random].exe	"DealHelper adware"
X	VidiaDrivers	[path to trojan]	"Added by the RANKY.U TROJAN!"
X	VIEW POINT DRIVERS	phqghum.exe	"Added by the RBOT.BRX WORM!"
X	VIEW POINT DRIVERS FOR WIN32	phqghu.exe	"Added by a variant of the RBOT WORM!"
X	Virus-Bursters	virus-bursters.exe	"VirusBursters rogue security software - not recommended
X	VirusBursters	virusbursters.exe	"VirusBursters rogue security software - not recommended
X	Volcano Security Suite	VS[random characters].exe	"Volcano Security Suite rogue security software - not recommended
U	VPCUserServices	VMUSrvc.exe	"Part of ""DOS Virtual Machine Additions"" for Microsoft Virtual PC
N	vTunerStartUp	vTuner.exe	"vTuner - "an easy way to find and listen to radio and TV broadcasts over the Internet""
U	WallpaperSS	WallpaperSS.exe	"Wallpaper Slideshow LT from gPhotoShow.com - ""a great utility for displaying your favorite photos as your desktop wallpaper"""
N	Weatherscope	Weatherscope.exe	"WeatherScope - ""displays your current local temperature in the system tray of your computer (near the clock) whenever you are online!"" Not recommended as it bundles GAIN adware. You can get the adware free version for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	WeatherStudio Desktop	WeatherStudio Desktop.exe	"WeatherStudio adware"
X	WEB DRIVERS FOR WIN32	phqgh.exe	"Added by a variant of the RBOT WORM!"
X	wersds	doriot.exe	"Added by the JECT.C TROJAN!"
X	wersds.exe	doriot.exe	"Added by the BAGLEDI-A TROJAN!"
N	WhitephonePersonal	WhitePhonePersonal.exe	"WhitePhone Personal from Voice Commerce Group - ""provides free PC to PC calls globally and access to low cost calls to phones worldwide."" Free internet telephony utility using the VoIP (Voice over Internet Protocol). No longer appears to be available"
X	Win Drivers SSL	hpws.exe	"Added by the IRCBOT.67098 WORM!"
X	Win Drivers SSL	TASKMAN4.exe	"Added by a variant of the RBOT WORM!"
X	Win Drivers SSL32	hpwsnnsbc.exe	"Added by the SPYBOT.MAR WORM!"
X	Win32 Drivers	winlogons.exe	"Added by the FORBOT-FG WORM!"
X	Win32 Firewall Drivers	winfirewall.exe	"Added by the WOOTBOT.GX WORM!"
X	Windows Acer Service	acersv.exe	"Added by the IRCBOT.YFQ BACKDOOR!"
X	Windows Additional Guard	WI[random characters].exe	"Windows Additional Guard rogue security software - not recommended
X	Windows Domain Name Drivers	windns.exe	"Added by the FORBOT-EP WORM!"
X	Windows Drivers	ssms.exe	"Added by the RBOT-AT WORM!"
X	Windows drivers update	windowsupdate.exe	"Added by the RBOT-ACE WORM!"
X	Windows Enterprise Suite	WE[random characters].exe	"Windows Enterprise Suite rogue security software - not recommended
X	Windows Graphics Loaders	wingraphics.exe	"Added by the SPYBOT.JG WORM!"
X	Windows haz Layer	[5 random letters].exe	"Added by a variant of the RBOT WORM!"
X	Windows HP Drivers	hpdmws.exe	"Added by the SDBOT.AQU WORM!"
X	Windows IPv6 Drivers	wipv6.exe	"Added by the SDBOT-VJ WORM!"
X	Windows Memory Drivers	memretain.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows messenger	messengers.exe	"Added by the MYTOB.EI WORM!"
X	Windows Messenger Service	kaspersky.exe	"Added by the MYTOB.HY WORM!"
X	Windows Micro Drivers	wupdates32.exe	"Added by the RBOT-AEH WORM!"
X	Windows Microsoft Services	[8 random letters].exe	"Added by the KOLAB.AW WORM!"
X	Windows ms Drivers	msnup32.exe	"Added by the SDBOT-AAL WORM!"
X	Windows MSX drivers	winmsx.exe	"Added by the RBOT-AYG TROJAN!"
X	Windows NTFS Volume Manage	[6 random letters].exe	"Added by the RBOT.EDL BACKDOOR!"
X	Windows PC Defender	WP[random characters].exe	"Windows PC Defender rogue security software - not recommended
X	Windows Portable Device Drivers	MSKSVRVS.EXE	"Added by a TROJAN - see here"
X	Windows Protection Suite	WI[random characters].exe	"Windows Protection Suite rogue security software - not recommended
X	Windows Registers	winservicess.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Registry Manager	tasksmanagers.exe	"Added by the MYTOB.ER WORM!"
X	Windows Reverse Preperation	winrvp.exe	"Added by the SLENFBOT.CB WORM!"
X	Windows Reversed Virus Protection	winrsvp.exe	"Added by the SLENFBOT.HX WORM!"
X	Windows Secure talal32	[7 random letters].exe	"Added by the RBOT.HTP TROJAN!"
X	Windows Security Suite	WI[random characters].exe	"Windows Security Suite rogue security software - not recommended
X	Windows Servcesc	[9 random letters].exe	"Added by a variant of the SDBOT WORM! See here"
X	Windows Server Drivers	syssrv.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Service Ag3nt	[6 random letters].exe	"Added by the SDBOT.EZX TROJAN!"
X	Windows Service Agent	[3 random letters].exe	"Added by the AGENT.AMEB TROJAN - see examples here and here"
X	Windows Service Agnts	[8 random letters].exe	"Added by the SDBOT.BCQ WORM!"
X	Windows Service oi worms	[6 random letters].exe	"Added by the SYSTEMHI.OS TROJAN!"
X	Windows Services	NetworkDrivers.exe	"Added by the SDBOT-YO WORM!"
X	Windows Services Aganters	[10 random letters].exe	"Added by the RBOT.CUN WORM!"
X	Windows Services alges2	[8 random letters].exe	"Added by a variant of the RBOT WORM!"
X	Windows Services Tower	svctowers.exe	"Added by the IRCBOT.AGJ BACKDOOR!"
X	Windows Serviece Agents	[8 random letters].exe	"Added by the AGENT.BHR TROJAN!"
X	Windows SP2 Version Load	wuauclt32.exe	"Added by the GAOBOT.CX WORM!"
X	Windows SpoolPrint Service	spoolersrv.exe	"Added by the SDBOT-ZT WORM!"
X	Windows sq Drivers	winmsn32.exe	"Added by the RBOT-ADI WORM!"
X	Windows SSL Secondary Drivers	SSL32Dr.exe	"Added by the SDBOT.ASQ WORM!"
X	Windows Stand Sound Drivers	Sounddrv.exe	"Added by the SDBOT-XF WORM!"
X	Windows Storm-Memory Drivers	memorystorm.exe	"Added by the SLENFBOT.CO WORM!"
X	Windows System Defender	WS[random characters].exe	"Windows System Defender rogue security software - not recommended
X	Windows System Drivers	sysretain.exe	"Added by the SLENFBOT.BY WORM!"
X	Windows System Security Monitor	[4 random letters].exe	"Added by the PINKTON.A WORM!"
X	Windows System Suite	WS[random characters].exe	"Windows System Suite rogue security software - not recommended
X	Windows System-Control Drivers	syscontrl.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	windows updaters	winupdats.exe	"Added by the SPYBOT-IS WORM!"
N	Windows Version Check	ver_chk.exe	"Version checker for CyberAudioLibrary - ""a new way to exchange information through the Internet"""
X	Windows Version Service	sysvers.exe	"Added by the SLENFBOT.IF WORM!"
X	Windows Version Service	sysvers32.exe	"Added by the SLENFBOT.HZ WORM!"
X	Windows Video Drivers	videons32.exe	"Added by the GAOBOT.AZT WORM!"
X	Windows Video Drivers	VIDEONS3.EXE	"Added by the AGOBOT-KZ BACKDOOR!"
X	windowsupdate	RPC[RANDOM CHARACTERS].exe	"Added by the IRCBOT.B TROJAN!"
X	Winds Sers Agts	[5 random letters].exe	"Added by a variant of the RBOT WORM!"
X	Winds Sersc Agts	rzrzncrtz.exe	"Added by the RBOT-GTV WORM!"
X	WinNetDDE	[random characters].exe	"Added by the NETDEPIX.B TROJAN!"
X	Winproxy Personal	WINPROXY.EXE	"Added by the SDBOT.BMF WORM!"
X	WinRunners	WinDrivers.exe	"Added by the DULOAD.C WORM!"
X	winversion	winversion.exe	"Browser hijacker
U	XemiComputers Scheduler	Scheduler.exe	"Smooth Program Scheduler from XemiComputers ""will start any program you want at a scheduled time"""
X	xswdmse	[8 random letters].exe	"Added by a variant of the SPYBOT WORM! See here"
X	XTN Service Drivers	winxtn.exe	"Added by the SDBOT-YK WORM!"
X	Xupiter Startup	XupiterStartup.exe	"Xupiter - adware and homepage hijacker. Use Spybot S&D
X	xupiterstartup2003	xupiterstartup2003.exe	"Xupiter - adware and homepage hijacker. Use Spybot S&D
X	Yahoo Messengger	IEXPLORERS.exe	"Added by the AUTOIT.DH TROJAN!"
X	ZtgServerSwitch	server.vbs	ZTGServerswitch is part of Sony's Vaio support agent - designed by Support.com. Not required if the user does not wish to use the Vaio support agent and regarded as spyware
X	[12 random characters]	avifile5.exe	"IeDriver adware variant"
X	[12 random characters]	bootvid4.exe	"IeDriver adware variant"
X	[12 random characters]	browser8.exe	"IeDriver adware variant"
X	[12 random characters]	atitvo32.exe	"IeDriver adware variant"
X	[12 random characters]	autodisc.exe	"IeDriver adware variant"
X	[12 random characters]	cabview1.exe	"IeDriver adware variant"
X	[12 random characters]	advpack1.exe	"IeDriver adware variant"
X	[12 random characters]	batmeter.exe	"IeDriver adware variant"
X	[12 random characters]	bidispl2.exe	"IeDriver adware variant"
X	[12 random characters]	asferror.exe	"IeDriver adware variant"
X	[12 random characters]	catsrvps.exe	"IeDriver adware variant"
X	[12 random characters]	admparse.exe	"IeDriver adware variant"
X	[12 random characters]	audiosrv.exe	"IeDriver adware variant"
X	[12 random characters]	bootvid2.exe	"IeDriver adware variant"
X	[12 random characters]	cmpbk321.exe	"IeDriver adware variant"
X	[12 random characters]	ADPTIF67.exe	"IeDriver adware variant"
X	[12 random characters]	asycfilt.exe	"IeDriver adware variant"
X	[12 random characters]	ati2dvag.exe	"IeDriver adware variant"
X	[12 random characters]	atl91036.exe	"IeDriver adware variant"
X	[12 random characters]	blackbox.exe	"IeDriver adware variant"
X	[12 random characters]	browser5.exe	"IeDriver adware variant"
X	[12 random characters]	bthserv1.exe	"IeDriver adware variant"
X	[12 random characters]	camocx28.exe	"IeDriver adware variant"
X	[12 random characters]	CAMOCX74.exe	"IeDriver adware variant"
X	[12 random characters]	capesnpn.exe	"IeDriver adware variant"
X	[14 random numbers]	mradll.exe	"Green AV rogue security software - not recommended
X	[14 random numbers]	rwg.exe	"Green AV rogue security software - not recommended
X	[3-4 random letters]	nslookup.exe	"PurityScan adware. Not to be confused with the legitimate nslookup.exe which is found in the System32 folder"
X	[3-4 random letters]Srv32	[path to file]	"Added by the BANCSADE-A TROJAN!"
X	[32 random hex numbers]	tsc.exe	"Total Security rogue security software - not recommended
X	[32 random hex numbers]	badware-protector.exe	"Badware Protector rogue security software - not recommended
X	[32 random numbers]	av2009.exe	"AntiVirus 2009 rogue security software - not recommended
X	[32 random numbers]	av360.exe	"Antivirus 360 rogue security software - not recommended
X	[32 random numbers]	AVS.exe	"Antivirus Sentry rogue security software - not recommended
X	[32 random numbers]	xpa.exe	"XP Antivirus rogue security software - not recommended"
X	[32 random numbers]	total.exe	"Total Antivirus rogue security software - not recommended
X	[random characters]	securewinload32x.exe	"Added by the OPTIXP-N TROJAN!"
X	[random characters]	rsbmsc.exe	"Detected by AntiVir antivirus as the BDS/Agent.adt TROJAN!"
X	[random characters]	_default[random].pif	"Added by the BRONTOK-AI WORM and variants!"
X	[random characters]	j[random].exe	"Added by the BRONTOK-AI WORM and variants!"
X	[random characters]	sv[random].exe	"Added by the BRONTOK-AI WORM and variants!"
X	[random characters]	yesbron.com	"Added by the BRONTOK-AI WORM and variants!"
X	[random characters]	systs.exe	"Added by the AGENT-GDC TROJAN!"
X	[random characters]	xvassdf.exe	"Added by the AUTORUN-BAD WORM!"
X	[various names]	UserSp1.exe	"Wareout - malware masquerading as a spyware and dialer remover"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.