FILE

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
	Note the filename has a ""0"" rather than an upper case ""o"""
X	(Default)	[random filename].exe	"Added by the BLACKMAL WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(default)	"rundll32.exe [path to DLL file]	Do98Work"
X	*MS Setup	[random filename]	"Virtumondo adware
X	*Windows [filename] Checker	[filename]	"Added by the KEDEBE-B WORM!"
X	2thousandbuck	[path to file]	"Added by the RANKY.L TROJAN!"
X	;Rundll	[filename]	"Added by the PWSLEGMIR.E TROJAN!"
X	Access WebControl	[path to file]	"Added by the PPDOOR-M TROJAN!"
X	Aceu	[random filename]	"PurityScan adware"
X	ActiveX File Registration Service	filereg.exe	"Added by the RBOT-DVD WORM!"
X	AdminSoft	sysfile.vbs	"Added by the STARGRUB-A WORM!"
X	Adobe Acrobat Reader CFG	[random filename]	"Added by a variant of the RBOT WORM!"
X	Adope File Manager	lsasv.exe	Added by an unidentified WORM or TROJAN!
X	Agent Browser	[random filename]	Added by the PPdoor.M-bdr backdoor TROJAN!
X	Agent Explorer	[random filename]	Unidentified adware
X	AIM Instant Message Cookies	[random filename]	"Added by the RBOT-AFV WORM!"
X	AlevirOld	[worm filename]	"Added by the OPASERV WORM!"
X	Anti-Virus	[random filename].exe	"Added by the CAPROBAD-A TROJAN!"
X	AOL Messenger	[random filename]	"Added by an unidentified VIRUS
X	Aqujyjax	[path to file]	"Added by the RANCK-CQ TROJAN!"
X	ara-key	[random filename]	"Added by the ANTINNY WORM!"
X	Auto File System Conversion Utility	scricon.exe	"Added by the SDBOT.EYB WORM!"
X	autoupdatev2	[path to file]	"Added by the DROPPER-BM TROJAN!"
X	Avril Lavigne - Muse	[random filename]	"Added by the AVRIL-A WORM!"
X	Band-Aid	[path to file]	"Added by the RANKY.O TROJAN!"
X	BeSys	[path to file]	"BeSys adware"
X	BigfileSearch	BigfileSearch.exe	"BigfileSearch adware. File located in %Program Files%\BigfileSearch"
X	BIOS XP Loader	[random filename]	"Added by the RBOT-IC WORM!"
X	Bnexe	[random filename]	"Added by the KITRO.D (or ARGEN.A) WORM!"
X	boot_reg	[path to file]	"Added by the BANCBAN-CA TROJAN!"
X	BrasilOld	[worm filename]	"Added by the OPASERV.P WORM!"
X	Bron-Spizaetus	[path to file]	"Added by the BRONTOK-F WORM!"
X	BrowserUpdateSched	[random filename]	"ZenoSearch adware"
X	BSserver	FileKan.exe	"Added by the VB.CBW WORM!"
U	C:Program Filesdfjdkjfdkjfldjfdfjdkjfdkjfldjfwinlogin.exe	CritProc.exe	"KeyProwler keystroke logger/monitoring program - remove unless you installed it yourself!"
U	C:Program FilesNetMeterNetMeter.exe	NetMeter.exe	"""Net Meter is a small
X	cAgOu	[filename].hta	"Added by the KAKWORM WORM!"
X	cartao	[path to file]	"Added by the DLOADER-QD TROJAN!"
X	ccApp	[random filename]	"Added by the OBSORB TROJAN! Note the random filename compared to the valid Norton AntiVirus"
X	Client Agent	[path to file]	"Added by the PPDOOR-J TROJAN!"
X	clock	[various filenames]	"LiveChat Adware - known file names include: mssetup.exe
X	ClrSchLoader	[path to file]	"ClearSearch adware"
X	cof.updit	[random filename]	"Added by a variant of the SDBOT WORM!"
X	Common Files	twain.exe	"Added by the AGENT.BEA TROJAN!"
X	Compliant	[worm filename]	"Added by the RBOT-LB WORM!"
X	Config Loader	[worm filename]	"Added by the AGOBOT-AE WORM!"
X	Configuration File	Winset32.exe	Added by the FLUX.101 TROJAN!
X	Configuration Loader	FILENAME.EXE	"Added by the AGOBOT-DQ WORM!"
X	Content connector	[random filename].exe	"Added by the DIALER-Y TROJAN! Note - uses a random filename and random folders. Usually the folder containing the file is a Temp folder"
X	crmssrlt	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	CSRSWIN	[trojan filename]	"Added by the WINSHELL.50 TROJAN!"
X	CSRSX	[trojan filename]	"Added by the WINSHELL.50.B TROJAN!"
X	ctfmon32	[random filename].exe	"Added by the RBOT-GSN WORM!"
X	Ctykd	[path to file]	"SMALL.SN spyware"
X	Danton*	[random filename]	"Added by the DANTON TROJAN! where * = random number"
X	Data File	vdehost.exe	"Added by the SDBOT-DOS TROJAN!"
X	ddivmwa	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	DI2	[path to file]	"BroadcastPC adware"
X	Distributed File System	Dfsvc.exe	"Added by the MYFIP.A or MYFIP.K WORMS!"
X	Distributed File System	kernel32dll.exe	"Added by the MYFIP-C or MYFIP.K WORMS!"
X	Distributed File System	blade.exe	"Added by the MYFIP.AC WORM!"
X	Distributed File System	win.exe	"Added by the MYFIP.AB WORM!"
X	Dll Boot Loader on Startup (do not remove this)	[various filenames]	Added by an unidentified TROJAN!
X	dll services	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	dllcvss	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	DllExecutable	[path to file]	"Added by the VB-SP WORM!"
X	dm_service	[path to file]	"Added by the MITGLIEDER.P TROJAN!"
X	DNS	[worm filename]	"Added by the BCKDR-CQG BACKDOOR!"
X	down	[trojan filename]	"Added by the SMALL-QJ TROJAN!"
X	DRam prmaessor	[random filename]	"Added by the RBOT.CSG WORM!"
X	DRam prosesor	[random filename]	"Added by the SPYBOT.EE WORM!"
X	DRam prosessor	[random filename]	"Added by the RBOT.CSG WORM!"
X	DSAcass	[path to file]	"Added by the RANKY.M TROJAN!"
X	educational writer	[random filename]	"Added by the RBOT-LZ WORM!"
X	enBrowser	[name of file]	"WINBO adware"
N	Energizer FileSaver	Energizer FileSaver.exe	"Energizer FileSaver - UPS back-up utility for Energizer UPS products. From their Tech Support staff this is known to have a memory leak since it's release - with no fix planned! It will grab 2-5 handles per second and crash the average system in less than 3 days - therefore not recommended"
U	ES Current Services	[FILE NAME].exe	"123Keylogger surveillance software. Uninstall this software unless you put it there yourself"
X	example	[random filename].exe	"Added by the NUCLEAR BACKDOOR! Note - this trojan file is located in %Windir%\NR"
X	Expatch	[random filename]	"Added by the PWSLMIR-G TROJAN!"
X	expcrt	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	explorer	wscript.exe [filename]	"Sneaky way to start any VBS script. Many viruses use VBS files. Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	ExploreUpdSched	[random filename]	"ZenoSearch adware"
X	FILE	abcdefg.exe	"Added by the KELVIR.DD WORM!"
?	file indexing service	msfindfile.exe	"New version of MS FindFast and still a resource hog?"
X	file laoder configuration	rnd32.exe	"Added by the RBOT.BQJ WORM!"
X	File Mapping Services	hp-1003.exe	"Added by the RBOT.FAN WORM!"
X	File Protection Monitor	filemon.exe	"Added by a variant of the RBOT WORM!"
X	File System	taskmqrs.exe	"Added by a variant of the TOXBOT/CODBOT WORM!"
X	File System	taskmqr.exe	"Added by the RBOT.BWQ WORM!"
X	File System Service	wmiprvsc.exe	"Added by the AGOBOT-HZ TROJAN!"
X	File-Sharing Wizard	shwizard.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	File0_0	MD1.exe	"Added by the DLOADER-OR TROJAN!"
X	File1	Dia Claro.htm	"Added by the DLOADER-OR TROJAN!"
X	FileFreedom_Plugin	wtm.exe	"FileFreedom peer-to-peer sharing program"
N	filehippo.com	UpdateChecker.exe	"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
N	FileHippo.com Update Checker	UpdateChecker.exe	"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
X	FileManager32	Wscript.exe ChkMgr32.vbs	"Added by the NOTUP.A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""ChkMgr32.vbs"" file is located in %System%"
X	filen	filen.exe	"Added by the VBNAM-A WORM!"
X	filename	filename.exe	"Added by the VB.FSY TROJAN!"
X	filename process	kerneldll.exe	"Added by the AGOBOT-PO WORM!"
X	filename process	explore.exe	"Added by the AGOBOT-QN WORM!"
X	filename process	Rundil16.exe	"Added by the GAOBOT.ZX WORM!"
X	Files Driver	sdphost.exe	"Added by the SDBOT-DKZ WORM!"
X	Files Driver	sfdhost.exe	"Added by the AGOBOT-AJC BACKDOOR!"
X	FileSoft	Wscript.exe UpdataFiles.vbs	"Added by the SST.B WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""UpdataFiles.vbs"" file is located in %Windir%"
X	Fire Wall services	[random filename]	"Added by the IRCBOT-QY WORM!"
X	G00123	[worm filename]	"Added by the BUGBROS WORM!"
X	G4G	[random filename]	Detected as Trojan-Downloader.Win32.VB.fki
X	Ghost Relay	[random filename]	"Added by the DNSCHANG.EK TROJAN!"
X	GlobalSCAPE	[random filename]	"Added by the RBOT-AYM WORM!"
X	Google Earth	[random filename]	"Added by the RBOT-AXK TROJAN!"
X	GustavVED	[filename].exe	"Added by the OPASERV.H WORM!"
X	Hardware Profile	hxdef.exe	"Added by the LOVGATE.AB WORM!"
X	Hardware Profile	hxdef.exe...	"Added by the LOVGATE.Z WORM!"
X	HDAudio Driver 1.0	[random filename].exe	"Added by the TEADOOR-D TROJAN!"
X	HDAudio Driver 2.0	[random filename].exe	"Added by the TEADOOR-E TROJAN!"
X	Help Temp Files	netreg.exe	"Added by the FORBOT-EM WORM!"
X	Help Temp Files	emp32.exe	"Added by the FORBOT-EC WORM!"
X	hen	[filename].exe	"Added by the TARNO.G TROJAN!"
U	HostsFileMgr	winHostsEdit.exe	"AdBin from Gilmore Software Development. An easy solution to managing your Window's hosts file"
X	HOT FIX	filename.exe	"Added by the SDBOT-DKM WORM!"
X	hpsysconf1	[random filename]	"Added by a variant of the VIVIA.A TROJAN!"
X	Hyper Files	phfhost.exe	"Added by the AGENT-JQO TROJAN!"
X	idmlssp	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	ieupdate	[random filename]	"Added by the AGENT-C BACKDOOR!"
X	ifperx	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	Image	"rundll32 [path] [trojan filename]	Install"
X	imgit	[path to file]	"Added by the BANKER-EM TROJAN!"
?	Install Pending Files	sifxinst.exe	"Uninstall program for Lanovation's Prism Deploy and Prism Pack adminstrators software deployement tools. For specific information see here. Is it required?"
U	Intel File Transfer	xfr.exe	Part of Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicating between the core server and managed clients
X	Internal	[trojan filename]	"Added by the SMOTHER and TRANSLAT TROJANS!"
X	Internal Memory File	sysintmemory.exe	"Added by the RBOT-GKT WORM!"
X	Internat	[trojan filename]	"Added by the CMJSPY-Y TROJAN!"
X	internet	[trojan filename].exe	"Added by the MIFENG-D TROJAN!"
X	Intranet Explorer	[random filename]	"Added by the POEBOT.DK BACKDOOR!"
X	ist service uninstall	[random filename]	"ISTBar adware related"
X	JavaUpdate0.07	[filename]	"Added by the JUPDATE TROJAN!"
X	jcidls	[random filename]	"Added by a variant of the SLAPER TROJAN!"
U	jv16 PT TempFileTool	TempTool.exe	"jv16 PowerTools File Cleaner - ""allows you to find obsolete and left-over temporary files"""
X	JVM0.12	[random filename]	"Added by the TEADOOR-A TROJAN!"
X	JVM0.14	[random filename]	"Added by the TEADOOR-B TROJAN!"
X	jysyqm	[random filename]	"ZenoSearch adware"
X	Kadoc	[random filename].exe	"Added by the STAPREW TROJAN!"
X	kavsvc	[random 6 char filename]	"Added by the QOOLOGIC TROJAN! Uses random file names (examples: nzkklz.exe
X	KAVutil	[worm filename]	"Added by the WINTOO.B WORM!"
X	kern64dll	[random filename]	"Added by the TARNO.J TROJAN!"
X	klop	[path to file]	"Added by the AGENT-WQ TROJAN!"
X	lar	[trojan filename]	"Added by the ROXY.C TROJAN!"
X	lk3h1	[path to file]	"Added by the MOSUCK-G TROJAN!"
X	load	Systemfile.dll.vbs	"Added by an unidentified WORM or TROJAN! See here"
X	LoadOrderVerification	[random filename]	"Added by the TRON.A TROJAN!"
X	LoadPowerProfile	ASDAPI.EXE	"Added by the CABRO TROJAN! Not to be confused with the valid LoadPowerProfile entry where the command is Rundll32.exe powrprof.dll"
U	LoadPowerProfile	Rundll32.exe powrprof.dll	"Power management specifics such as monitor shut-off
X	LoadPowerProfile	Rundll.exe powerprof.dll	"Added by the LOXOSCAM TROJAN! Note - do not confuse with the valid LoadPowerProfile entry! Notice that the infected version uses ""Rundll.exe"" whereas the uninfected version uses ""Rundll32.exe"""
X	LoadPowerProfile	rundl.exe	"Added by the TOFAZZOL TROJAN! Not to be confused with the valid LoadPowerProfile entry where the command is Rundll32.exe powrprof.dll"
X	LoadPowerProfile	Rundll32.exe	"Added by the MIROOT WORM! Note - do not confuse with the valid LoadPowerProfile entry which has ""powrprof.dll"" appended to the command/data line"
X	LoadPowerScheme	rundll32.exe powerprof.dll CheckPowerProfile	"Ulubione adult content dialer. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	LoadWindowsFile	Kernel32.exe	"Added by the DELF.B TROJAN!"
X	LoadWindowsFile	winreg.exe	"Added by the HUPIGON.A BACKDOOR!"
X	Locator Service	[filename]	"Added by the AGOBOT-KY TROJAN!"
X	Login Service	[path to file]	"Added by the MIGMAF TROJAN!"
X	LowRiskFileTypes	sysguard.exe	"Added by the FAKEAV-UY TROJAN!"
X	LowVersionSupport	[filename]	"Added by the LASTRAS TROJAN!"
N	Lwinst Run Profiler	lwtest.exe	Logitech Wingman Profiler for the Logitech joysticks. Available via Start -> Programs
X	Managment Service	[random filename]	Added by the RBOT.BIS TROJAN!
X	Mantis	[filename]	"Added by the MANTIBE VIRUS!"
X	MatrixScreen	[filename]	"Added by the MATRIXSCREEN TROJAN!"
X	mb2np	[random filename]	Added by the IRCBOT.TJ WORM!
X	MbarInstall	[random filename]	"Mirar adware"
X	Media Services	[filename].exe	"Added by the AGENT-BA BACKDOOR!"
X	messnger	[worm filename]	"Added by the DELODER WORM!"
X	Mickey Mouse Cereal	[random filename].exe	"Added by the RANKY.Q TROJAN!"
X	MicroLoad	[random filename]	"Added by the DARBY WORM!"
X	MICROSFT ANTIVIRUS UPDATE SUPPORT	[random 10-letter filename].EXE	"Added by the RBOT-AQA WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	[random filename]	"Added by the RBOT-ASM or RBOT-AUW WORMS!"
X	Microsft Upgraed	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	Microsft Windows Adapter 5.1.3013	[random filename]	"Added by the SMALL.HIT TROJAN!"
X	Microsoft (C) HTML Application host	[random filename]	"Added by the RBOT-YB WORM!"
X	Microsoft ADservice	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Anti-Spy	[random filename]	"Added by a variant of the SDBOT WORM!"
X	Microsoft Config File	config.exe	Added by the KILLFILES.GR TROJAN! This is malware that will attempt to delete all system dlls!
X	Microsoft Core Support	[random filename]	"Added by a variant of the RBOT TROJAN!"
X	Microsoft Corporation	[random filename]	"Added by various VIRUSES
X	Microsoft Diagnostic	[random filename]	"Added by the ACEBOT TROJAN!"
X	Microsoft DirktorWin	[random filename]	"Added by the SPYBOT.GEN3 TROJAN!"
X	Microsoft DLL Verifier	file.exe	"Added by the RBOT-AED WORM!"
X	Microsoft DLL Verifier	chkfile.exe	"Added by the RBOT-AOC WORM!"
X	Microsoft File Demand Manager	wmgrdf.exe	"Added by a variant of the RBOT WORM!"
X	MicroSoft Getway Dire	[random filename]	"Added by the IRCBRUTE.AM WORM!"
X	Microsoft IIS	[filename]	"Added by the FRANCETTE-S WORM!"
X	Microsoft Internet Acceleration Utility	[path to file]	"Added by the AGENT-CX TROJAN!"
X	Microsoft IT Update	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Java Windows Update	[filename]	"Added by the RBOT-DZ WORM!"
X	Microsoft Locals 332	[random filename]	"Added by the RBOT-KU WORM!"
X	Microsoft LV	[path to file]	"Added by the BDOOR-BDL BACKDOOR!"
X	Microsoft PC Health Remote Assistance File Open & Save controls	sfrcdlg32.exe	"Added by the RBOT-AVY WORM!"
X	Microsoft PCHealth32	[path to file]	"Added by the NICE-A TROJAN!"
X	Microsoft Profile Manager	profile.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Redirect	[path to file]	"Added by the BANKER-FW TROJAN!"
X	Microsoft Security GManagers	[random filename]	"Added by a variant of the SDBOT WORM!"
X	Microsoft Security Monitor Process	[random filename]	"Added by variants of the RBOT WORM! See here"
X	Microsoft Security Panager	[filename]	"Added by the RBOT-ANL WORM!"
X	Microsoft Security Panagers	[random filename]	"Added by the RBOT-AIG WORM!"
X	Microsoft System Backup	[random filename]	"Added by the RBOT-AGM WORM!"
X	Microsoft System File	svchots.exe	"Added by the RBOT.BYU WORM!"
X	Microsoft Telecoms Center	xpfilesys.exe	Added by the RBOT.BCJ TROJAN!
X	Microsoft Transfer File Server	mtfs.exe	"Added by the RBOT.AFE WORM!"
X	Microsoft Tray	[random filename]	"Added by the DELF.BZ TROJAN!"
X	Microsoft Update 32	[path to file]	"Added by the RBOT-AJJ WORM!"
X	Microsoft Update Loader	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Updates	[worm filename]	"Added by the AGOBOT-AIZ WORM!"
X	Microsoft Updote	[random filename]	"Added by the RBOT-ARC WORM!"
X	Microsoft UpToDate Driver (32-bits)	[random filename].exe	"Added by the SPYBOT.LXJ WORM!"
X	Microsoft Windows	[path to file]	"Added by the BDOOR-LI BACKDOOR!"
X	Microsoft Windows Adapter 5.1.3214	[worm filename].exe	"Added by the STRAT.GEN-3 WORM!"
X	Microsoft Windows Files Loader	cgy32win.exe	"Added by the RBOT-AXR WORM!"
X	Microsoft Windows Update x86	[various filenames]	"Added by a variant of the RBOT WORM! Filenames seen include (but are not limited to firefox.exe
X	Microsoft WinSound	[random filename]	"Added by a variant of the RBOT WORM!"
X	MicrosoftWindows	[various filenames]	"MagicSearch - a CoolWebSearch parasite variant"
X	Microsot NT Support	[random filename].exe	"Added by the RBOT-CTI WORM!"
X	minimo	[path to file]	"Added by the MOSUCK-X TROJAN!"
X	Mioft Wiws Seice ent	[worm filename].exe	"Added by the RBOT-GIJ WORM!"
X	mmsddlx	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	MonAppli	[random filename]	"Added by the DELF.IF TROJAN! The most common filenames are isys32.exe & msnmsg.exe"
X	Monitor Test	[random filename]	"Added by the SDBOT-NC WORM!"
X	MoussaEvil	[path to file]	"Added by the MUSANUB-A WORM!"
X	MP3files	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MS Task Manager 32	[trojan filename] .exe	"Added by the RANKY.NF TROJAN!"
X	MS-HTML	[random filename]	"Added by the LATINUS.15 TROJAN!"
X	MsgApi	[path to file]	"Added by the DEDLER-D TROJAN! The most common filenames seen are ""csmss.exe"" and ""csmrs.exe""
X	Msgsvc32	[worm filename]	"Added by the NAUTICAL-A WORM!"
X	MSKCES32	[random filename]	"Added by the CLONER TROJAN!"
X	MSN File & Folder Sharing App	msnfileshare.exe	"Added by an unidentified WORM or TROJAN! See here"
X	MSN File Configuration	msnfilecfg.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	MSN File Sharing	msnusr.exe	"Added by the SLENFBOT.AM WORM!"
X	MSN File Sharing Wizard	msnsharewiz.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	MSN File Sharing!	msnuser.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Msn Update SUPPORT	[random filename]	"Added by the RBOT-BPS WORM!"
X	msnmsgy	[path to file]	"Added by the BANKER-EQ TROJAN!"
X	MSPQFile	MSA***.TMP [ = random char]	Homepage hijacker
X	MSSGisg	[path to file]	"Added by the RANKY.N TROJAN!"
X	mswspl	[random filename]	"Added by the SMALL.IQ TROJAN!"
X	Myapp	[filename]	"Added by the FATEE.B WORM!"
X	NAV Auto Update	[random filename]	"Added by the SPYBOT-E WORM!"
X	NavScan	[filename]	"Added by the OBSORB TROJAN!"
X	NeroFileCheck	msjavam32.exe	"Added by the AGOBOT.AKM WORM!"
X	nethost.exe	[path to file]	"Added by the PERDA-J TROJAN!"
X	NETVISIONAdulti	[random filename]	"Trafficadvance dialer"
X	NI.ERS_9999_N91S3108	[path to file]	"Installer for the ErrorSafe rogue system error and cleaning utility - see here"
X	NI.GA6PU_0001_N108E1308	[path to file]	"Installer for the VirusSchlacht German rogue security software - see here"
X	NI.GA6PU_0001_N120C2910	[path to file]	"Installer for the VirusSchlacht German rogue security software - see here"
X	NI.GA6P_0001_N105E2704	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N108E1606	[path to file]	"Installer for the BestsellerAntivirus rogue security software - see here"
X	NI.GA6P_0001_N111C1707	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N115C0110	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N115E0110	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N122C0611	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N122C2210	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N122C2802	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_0001_N122E0611	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.GA6P_2001_N108E1606	[path to file]	"Installer for the BestsellerAntivirus rogue security software - see here"
X	NI.GDCDE_0001_N122C1912	[path to file]	"Installer for the FestplattenReiniger German rogue privacy tool - see here"
X	NI.GDC_0001_N111C1909	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.GDC_0001_N122C1912	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.GES_0001_N122C2610	[path to file]	"Installer for the ErrClean rogue system error and cleaning utility - see here"
X	NI.UAVIFR_0001_N105M2404	[path to file]	"Installer for the VirusGarde French rogue security software - see here"
X	NI.UERSM_0001_N68M1602	[path to file]	"Installer for the ErrorSafe rogue system error and cleaning utility - see here"
X	NI.UGA6P	[path to file]	"Installer for the BestsellerAntivirus rogue security software - see here"
X	NI.UGA6PH_0001_N122M2910	[path to file]	"Installer for the AntiVirusAskeladd rogue security software - see here"
X	NI.UGA6PK_0001_N122M1302	[path to file]	"Installer for the VirusForsvar Danish rogue security software - see here"
X	NI.UGA6PL_0001_N108M2808	[path to file]	"Installer for the VirusSchlacht Swedish rogue security software - see here"
X	NI.UGA6PL_0001_N120M1302	[path to file]	"Installer for the VirusSchlacht Swedish rogue security software - see here"
X	NI.UGA6PM_0001_N108M2108	[path to file]	"Installer for the AntivirusScherm Dutch rogue security software - see here"
X	NI.UGA6PM_0001_N122M1202	[path to file]	"Installer for the AntivirusScherm Dutch rogue security software - see here"
X	NI.UGA6PM_0001_N122M3010	[path to file]	"Installer for the AntivirusScherm Dutch rogue security software - see here"
X	NI.UGA6PT_0001_N108M2208	[path to file]	"Installer for the VirusDifesa Italian rogue security software - see here"
X	NI.UGA6PT_0001_N122M1202	[path to file]	"Installer for the VirusDifesa Italian rogue security software - see here"
X	NI.UGA6PT_0001_N122M2910	[path to file]	"Installer for the VirusDifesa Italian rogue security software - see here"
X	NI.UGA6PU_0001_N108M1308	[path to file]	"Installer for the VirusSchlacht German rogue security software - see here"
X	NI.UGA6PU_0001_N120M1202	[path to file]	"Installer for the VirusSchlacht German rogue security software - see here"
X	NI.UGA6PU_0001_N120M2910	[path to file]	"Installer for the VirusSchlacht German rogue security software - see here"
X	NI.UGA6PV_0001_N108M0207	[path to file]	"Installer for the VirusGarde French rogue security software - see here"
X	NI.UGA6PV_0001_N122M1202	[path to file]	"Installer for the VirusGarde French rogue security software - see here"
X	NI.UGA6PV_0001_N122M2910	[path to file]	"Installer for the VirusGarde French rogue security software - see here"
X	NI.UGA6P_0001_N105M2704	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_0001_N111M1707	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_0001_N115M0110	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_0001_N119M1510	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_0001_N120M1710	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_0001_N122M0611	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_0001_N122M2210	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_0001_N122M2802	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_0007_N125M2002	[path to file]	"Installer for the BestsellerAntivirus rogue security software - see here"
X	NI.UGA6P_1001_N122M0402	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_1002_N122M1402	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_4001_N122M2111	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_4444_N122M2811	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_5001_N122M1902	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGA6P_5555_N122M0312	[path to file]	"Installer for the AVSystemCare rogue security software - see here"
X	NI.UGDC1_0001_N119M0911	[path to file]	"Installer for the FilterProgram rogue privacy tool - see here"
X	NI.UGDCCZ_0001_N122M0307	[path to file]	"Installer for the SuspenzorPC Czech rogue privacy tool - see here"
X	NI.UGDCCZ_0001_N122M0511	[path to file]	"Installer for the SuspenzorPC Czech rogue privacy tool - see here"
X	NI.UGDCCZ_0001_N122M1712	[path to file]	"Installer for the SuspenzorPC Czech rogue privacy tool - see here"
X	NI.UGDCDE_0001_N111M3007	[path to file]	"Installer for the FestplattenReiniger German rogue privacy tool - see here"
X	NI.UGDCDE_0001_N122M1912	[path to file]	"Installer for the FestplattenReiniger German rogue privacy tool - see here"
X	NI.UGDCGR_0001_N122M0307	[path to file]	"Installer for the FestplattenReiniger Greek rogue privacy tool - see here"
X	NI.UGDCGR_0001_N122M1812	[path to file]	"Installer for the FestplattenReiniger Greek rogue privacy tool - see here"
X	NI.UGDCNL_0001_N111M3007	[path to file]	"Installer for the NoCompromaat Dutch rogue privacy tool - see here"
X	NI.UGDCNL_0001_N122M1912	[path to file]	"Installer for the NoCompromaat Dutch rogue privacy tool - see here"
X	NI.UGDCNL_0001_N122M3011	[path to file]	"Installer for the NoCompromaat Dutch rogue privacy tool - see here"
X	NI.UGDCPL_0001_N108M0207	[path to file]	"Installer for the OczyszczaczKomputerza Polish rogue privacy tool - see here"
X	NI.UGDCPL_0001_N122M2012	[path to file]	"Installer for the OczyszczaczKomputerza Polish rogue privacy tool - see here"
X	NI.UGDCRU_0001_N111M0208	[path to file]	"Installer for the SanitarDiska Romanian rogue privacy tool - see here"
X	NI.UGDCRU_0001_N122M2012	[path to file]	"Installer for the SanitarDiska Romanian rogue privacy tool - see here"
X	NI.UGDCTH_0001_N122M1712	[path to file]	"Installer for the PC Drive Tool rogue privacy tool - see here"
X	NI.UGDCTR_0001_N108M0407	[path to file]	"Installer for the PC Drive Tool rogue privacy tool - see here"
X	NI.UGDC_0001_N108M0407	[path to file]	"Installer for the PC Drive Tool rogue privacy tool - see here"
X	NI.UGDC_0001_N111M1909	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.UGDC_0001_N122M0502	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.UGDC_0001_N122M1912	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.UGDC_0001_N122M2603	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.UGDC_0001_N122M2610	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.UGDC_0001_N122M2802	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.UGDC_0001_N122M2811	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.UGDC_0002_N108M1007	[path to file]	"Installer for the PC Drive Tool rogue privacy tool - see here"
X	NI.UGDC_0003_N108M2407	[path to file]	"Installer for the PCPrivacyTool rogue privacy tool - see here"
X	NI.UGESF_0001_N122M0201	[path to file]	"Installer for the HataDuzelticisi Turkish rogue system error and cleaning utility - see here"
X	NI.UGESL_0001_N105M0405	[path to file]	"Installer for the SystemOrdnare Swedish rogue system error and cleaning utility - see here"
X	NI.UGESL_0001_N122M0303	[path to file]	"Installer for the SystemOrdnare Swedish rogue system error and cleaning utility - see here"
X	NI.UGESL_0001_N122M2911	[path to file]	"Installer for the SystemOrdnare Swedish rogue system error and cleaning utility - see here"
X	NI.UGESM_0001_N122M0303	[path to file]	"Installer for the DokterFix Dutch rogue system error and cleaning utility - see here"
X	NI.UGESV_0001_N108M2006	[path to file]	"Installer for the SysDepannage French rogue system error and cleaning utility - see here"
X	NI.UGESV_0001_N122M0303	[path to file]	"Installer for the SysDepannage French rogue system error and cleaning utility - see here"
X	NI.UGESV_0001_N122M2811	[path to file]	"Installer for the SysDepannage French rogue system error and cleaning utility - see here"
X	NI.UGESV_0001_N122M3010	[path to file]	"Installer for the SysDepannage French rogue system error and cleaning utility - see here"
X	NI.UGES_0001_N122M0502	[path to file]	"Installer for the ErrClean rogue system error and cleaning utility - see here"
X	NI.UGES_0001_N122M2111	[path to file]	"Installer for the ErrClean rogue system error and cleaning utility - see here"
X	NI.UGES_0001_N122M2602	[path to file]	"Installer for the ErrClean rogue system error and cleaning utility - see here"
X	NI.UGES_0001_N122M2603	[path to file]	"Installer for the ErrClean rogue system error and cleaning utility - see here"
X	NI.UGES_0001_N122M2610	[path to file]	"Installer for the ErrClean rogue system error and cleaning utility - see here"
X	NI.UGES_0002_N108M1607	[path to file]	"Installer for the ErrClean rogue system error and cleaning utility - see here"
X	NiroFile Updated	NiroFile.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Norton Antivirus 7.0a	[path to file]	"Added by the PERDA-B or RANCK-CT TROJANS!"
X	NotePad	[worm filename]	"Added by the SILLYFDC-G WORM!"
X	nssysconf	[random filename]	"Added by the VIVIA.A TROJAN!"
X	NT Virtual Machine	[path to file]	"Added by the SCAERBOT-A WORM!"
X	Ntech.patchs	[trojan filename]	"Added by the LEMIR.G TROJAN!"
X	NTFSS Microsoft System	filees.exe	"Added by the RBOT.GAB WORM!"
X	NTFSS MICROSOFT SYSTEM	filess.exe	"Added by the RBOT.AXZ WORM!"
X	NvCpl	[random filename]	"Added by the AGOBOT-APJ WORM!"
X	nvviddrv32	[random filename]	"Added by the RBOT-HT BACKDOOR!"
X	Office Monitor Word Exel R	[trojan filename]	"Added by the IRCBOT-VX TROJAN!"
U	OfflineFileSync	OfflineFileSyn.exe	"Offline synchronization part of ZANTAZ EAS (Enterprise Archive Solution) - which ""is a secure
X	OLE	[filename]	"Added by the STAWIN or TARNO.D TROJANS!"
X	OPQFile	regedit.exe /s ...rad03FA6.tmp	Unsavoury program that resets your homepage every time you restart - uncheck in MSCONFIG and delete it via a registry edit
X	passcxd	[random filename]	"Added by a variant of the SLAPER TROJAN!"
U	PCDrProfiler	RunProfiler.exe	Part of PC Doctor software installed for some machines. Disabling or enabling it is down to your preference
X	PcEXPLODE	specialfile.exe	"Added by the RBOT.RH WORM!"
X	PGStub.exe	[various filenames]	Unidentified adware
X	Plasdll service	[random filename]	"Added by a variant of the SDBOT WORM!"
X	PNP FIX	[worm filename]	"Added by the RBOT-AKQ WORM!"
X	popuppers65	[path to file]	"Medload adware"
X	PostBootReminder	[random filename]	Added by and unidentified WORM or TROJAN!
X	PowerPrifile	"rundl132 kenel.dll	PowerProfileEnable"
X	PowerProfile	mfcp30.exe	"Added by the RINDAS-A TROJAN!"
U	PPSVC	[path to file]	"PC Police surveillance software that logs keystrokes
X	Printer	[path to file]	"Added by the LOWTAPER TROJAN!"
X	PrivateNet	[various filenames]	Premium rate adult content dialler
X	pro	[path to file]	"Added by the SPYWAD-F TROJAN!"
X	Proc992	[path to file]	"Added by the IXBOT-C WORM!"
X	Profile	Profile.vbs	"Added by the WHITEHO VIRUS or TRAPPY WORM!"
N	Profiler	Profiler.exe	"Enables the "Profiler" to be launched from a System Tray icon for Saitek's game controllers. Available via Start -> Programs"
X	profiler	liteout.exe	"Added by the ZAPCHAS-G WORM!"
X	profiler	prof.exe	"Added by the ZAPCHAS-G WORM!"
N	Profiler	ProfilerU.exe	"Enables the ""Profiler"" to be launched from a System Tray icon for Saitek's game controllers. Available via Start -> Programs"
N	ProfilerU	ProfilerU.exe	"Saitek SST (Saitek Smart Technolgy) Profile Launcher - allows System Tray access to the ""Profiler"" and ""Control Panel"" for Saitek's game controllers. Start manually via Start -> Programs -> Saitek SD6 Programming Software -> Profiler"
X	Program File	Progmon.exe	"Added by the PEEPER TROJAN!"
X	prompt drive	[random filename]	"Added by the SDBOT.AMF WORM!"
X	putil	[filename]	"Added by the LDPINCH TROJAN!"
X	qbotd	[random filename]	"Added by the BOTTEN TROJAN!"
X	Quick Time file manager	quicktimeprom.exe	"Added by the SDBOT TROJAN!"
X	Quicktime Task	[random filename]	"Trafficadvance dialer"
X	Random Unique ID	[worm filename]	"Added by the XROVE-A WORM!"
X	RavTimeXP	[worm filename]	"Added by the WULLIK.B WORM!"
X	RavTimXP	[worm filename]	"Added by the WULLIK.B WORM!"
X	rdvs	[worm filename]	"Added by the ULTIMAX.B WORM!"
X	RealP1ayer	[path to file]	"Added by the RPLAY.A TROJAN! Note that the name has a number ""1"" in place of the second lower case ""L"""
X	REEGRUN	[path to file]	"Added by the SECDROP.AI TROJAN"
X	regcheck	[path to file]	"Added by the SERVPAM TROJAN!"
X	REGMSYS	[path to file]	"Added by the LOWZONE-AX TROJAN!"
X	rmalt	[random filename]	"Added by the CLICKER-CS TROJAN! Filenames spotted inlcude Setup.exe
X	RPC Service	[random filename]	"Added by the BDOOR-AAD BACKDOOR!"
X	RSPC Driver	[random filename].exe	"Added by the RBOT-SN WORM!"
X	RSPC Driver D	[random filename]	"Added by a variant of the RBOT WORM!"
X	rtkernsw	[random filename]	"Added by a variant of the SLAPER TROJAN!"
U	Run POPFile in background	perl.exe	"POPFile - E-mail spam blocker"
U	Run POPFile in background	wperl.exe	"POPFile - E-mail spam blocker"
X	runddlfile	runddl.exe	"Added by the DELF.D TROJAN!"
X	Rundll	rundll32.exe [random filename].dll	"Added by the MYTOB.IG WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The random DLL file is found in %System%"
X	RunDLL Kernel File Core	rundll.exe	"Added by a variant of the RBOT WORM! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	Runner	lsass.exe [trojan filename]	"Added by the DROWSY-B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	runSubvalues	[path to file]	"Added by the DLOADER-QY TROJAN!"
X	RunWin	[path to file]	"Added by the BANKER-ES TROJAN!"
X	SaMail	[WORM FILE NAME].vbs	"Added by the VBS.LIDO WORM!"
?	ScanFile	??	"??"
Y	Scanner File Utility	NsCatCom.exe	"Kycocera Mita network copier/printer/scanner process to dump scanned documents onto a workstation"
X	Scanreg	[filename]	"Added by the QQPASS.E TROJAN!"
X	ScrSvrOld	[worm filename]	"Added by the OPASERV WORM!"
X	SearchClick	[trojan filename]	"Added by the AGENT-DWR TROJAN!"
X	SeekmoToolbar	${HOOKOE_FILE}	"180Solutions.Seekmo adware - also see here"
X	seli	[path to file]	"Added by the LOWZONE-AS TROJAN!"
X	Service	[trojan filename]	"Added by the KAITEX.E TROJAN!"
X	Service Cleaner	filen.exe	"Added by the RBOT.BRH WORM!"
X	Service Defender	[random filename]	"Added by a variant of the ZLOB TROJAN! See here"
X	Service Host	[filename].exe	"Added by the TORVEL.B WORM!"
X	Service Monitor	msnfilen.exe	"Added by the RBOT-ALE WORM!"
X	Service Monitor	filen.exe	"Added by a variant of the RBOT WORM!"
X	Service Pack	[various filenames]	"Added by the LERPA-A WORM! Note - the file name will be one of the following common.exe
X	Service Pack 1	[random filename]	"Added by the VXGAME.Z TROJAN! Note - the filename is random - see the link. Typical examples are vexg6ame4.exe
X	Service PAck SFVP	[worm filename].exe	"Added by a variant of the RBOT WORM! The filename is 4 random characters"
X	Services004	[worm filename]	"Added by the BUGBROS WORM!"
X	SfKg6wIP	[random filename]	Identified as a variant of the TrojanDownloader.Matcash malware
X	SfKg6wIPu	[random filename]	Identified as a variant of the TrojanDownloader.Matcash malware
X	ShellCommand	[path to file]	"Added by the REMCON-A TROJAN!"
X	SilentSoftech	[worm filename]	"Added by the SILLYFDC-BL WORM!"
X	SNInstall	[various filenames]	"Spy Sheriff/SpywareNO malware
X	Soft Profile Inc	hxdef.exe...	"Added by the LOVGATE.AO WORM!"
X	Soft Profile Inc	hxdef.exe	"Added by the LOVGATE.E WORM!"
X	SpeedBoss	[worm filename]	"Added by the OPASERV.AD WORM!"
X	spoolsv.exe	[random filename]	"Added by the RBOT-JB WORM!"
Y	SpybotDeleting*****	[cmd or command] /c del [path] [filename]	"Generated by Spybot Search & Destroy if it encounters files that cannot be deleted during runtime because they are locked by other processes. For example
X	Srv32Old	[worm filename].PIF	"Added by the OPASERV.J WORM!"
N	Start Wingman Profiler	lwtest.exe	"Logitech Wingman software required to operate Logitech joysticks and gamepads. Unless you're a hard-core gamer
N	Start Wingman Profiler	LWEMon.exe	Part of Logitech Gaming Software (formerly Wingman Software) for their range of game controllers. Starts the profiler (button configuration) and loads the last used profile at start-up - including System Tray access. Unless you're a hard-core gamer it's best to leave it disabled and load when needed
X	Startup Configuration	[six character filename]	"Added by the RBOT-ARV WORM!"
X	stdlib	[filename]	"Added by the PERDA-E TROJAN!"
X	Streams Drivers	[trojan filename]	"Added by the RESTARTER.E TROJAN!"
X	suicide	tempfile2.bat	"Personal Protector rogue security software - not recommended
X	Supernova	[worm filename]	"Added by the SURNOVA.A (or SUPOVA) WORM!"
X	support-reverse-smileys	[trojan filename]	"Added by the LITEBOT TROJAN!"
X	SvcSys	[path to file]	"Added by the BANCOS.Z TROJAN!"
X	sws.exe	[random filename]	"Haldex type adult content dialler"
X	SYDNEY	[file path]	"Added by the SYNEY WORM!"
X	syelimS-esreveR-troppuS	[filename]	"Added by the LITBOT.C TROJAN!"
X	Symantec Autoscan	[random filename]	"Added by the RBOT-AJO WORM!"
X	Symlcs	[path to file]	"Added by the YASPY-A TROJAN!"
U	SysBkup	[path to file]	"Keyspy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	SysData	[path to file]	"Added by the RANCK-BA TROJAN!"
X	sysdll	[trojan filename]	"Added by the HUGESOT TROJAN!"
X	sysfiler	sysfiler.exe	"Added by the RETSAM TROJAN!"
X	sysin	[path to file]	"Added by the DSRC-A TROJAN!"
X	sysmon12	[various filenames]	"Wareout - malware masquerading as a spyware and dialer remover"
X	sysser	[path to file]	"Added by the RAHACK WORM!"
X	SysStart	[random filename]	"ZenoSearch adware"
X	SYSTEM	SystemFile.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	System Applications Profile	sap.exe	"Added by the RBOT-QF WORM!"
X	System backup	[random filename]	"Added by the ADMINCASH.B TROJAN! Note - multiple different file names have been spotted
X	System CPL manager	[random filename]	"Added by the RBOT-SR WORM!"
X	System File Drivers	nvsysvc32.exe	"Added by the AGOBOT.WJ WORM!"
X	System File Startup	sys32.exe	"Added by the RBOT.OTL WORM!"
U	System Files Updater	System Files Updater.exe	"System Files Updater from Flyakiteosx ""will transform the look of an ordinary Windows XP system to resemble the look of Mac OS X"""
X	System Profile	Regsrv.exe	"Added by a variant of the OPTIX TROJAN!"
X	System service78	[path to file]	"Added by the ELITEBAR-T and ELITEBAR-U TROJANS!"
X	System service79	[path to file]	"Added by the ELITEBAR-V TROJAN!"
X	System Services	[random file name]	"Added by a variant of the RBOT WORM!"
X	System Update	[filename].exe	"CoolWebSearch parasite variant"
X	System Update	[random filename]	"Added by the KORGO.W or KORGO.X WORMS!"
X	System Update	[random filename]	"Added by the SOROMO-A TROJAN!"
X	System32	[worm filename]	"Added by the NAUTICAL-A WORM!"
X	SystemBoot	Mshta.exe ...filename.hta	Adult content dialler
X	SystemEmergency	[various filenames]	"CoolWebSearch Smartsearch parasite variant"
X	SystemFile	SystemFile.exe	"Added by the DULLDOOR-A TROJAN!"
X	SystemManager	[random filename]	"Added by the SETTEC ROOTKIT!"
X	SystemProcEvent	[trojan filename]	"Added by the IRCBOT.I TROJAN! Filenames used are csrwnd.exe
X	SystemTasks	filez.exe	Adult content dialler
X	Systray	[filename.exe]	"Winfavorites adware"
X	Taskmgo	[path to file]	"Added by the BANCBAN-T TROJAN!"
X	TaskReg	[random filename]	"Added by the CBLAD WORM!"
X	TA_Start	[random filename]	"Zeno Think-Adz adware"
X	Telnet24	[random filename]	"Added by the RBOT-ARD WORM!"
X	Think-Adz	[random filename]	"Zeno Think-Adz adware"
X	tjstartup	[path to file]	"Added by the TJSERV.C TROJAN!"
X	Tok-Cirrhatus	[path to file]	"Added by the BRONTOK-F WORM!"
X	Trickler	[path to file]	"GAIN adware. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	TSystem	[trojan filename]	"Added by the NSYS-A TROJAN!"
X	Unix File Support	init3.exe	"Added by the RBOT-ZN WORM!"
X	Update	[original file path]	"Added by the LYNDEGG WORM!"
X	Update for Windows	[various filenames]	"Added by the LERPA-A WORM! Note - the file name will be one of the following common.exe
X	updatesched	[random filename]	"ZenoSearch adware"
X	UpdateWin	[random filename]	"Added by the IRCBOT.AZW BACKDOOR!"
X	UpdSys	[random filename]	Added by the BJ TROJAN!
X	upme	[filename]	"Added by the MUGLY.F WORM!"
X	User32	[filename]	"Added by the NETTRASH TROJAN!"
X	Userfile Sharing Serv	usnsrv.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Userfile Sharing Server	usnserv.exe	"Added by a variant of the IRCBOT TROJAN!"
X	UserSystem	[filename]	"CoolWebSearch Smartsearch parasite variant. Also detected as the SEARCH-A TROJAN!"
X	ValueS0ft	[random filename]	"Added by a variant of the SPYBOT WORM! See here"
X	ValueX	[random filename]	"Added by the IRCBOT.EE TROJAN!"
X	vbcdtm	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	VBS.Ipnuker@mm	[worm filename].vbs	"Added by the NUKIP WORM!"
X	VC5MediaPlayer	[path to file]	"Added by the DEDLER-D TROJAN! The most common filenames seen are ""csmss.exe"" and ""csmrs.exe""
X	Video Process	[random filename]	"Added by the RBOT-LM WORM!"
X	VideoDriver	[filename]	"Added by the GSPOT20.A TROJAN!"
X	Visual Element FX5	[various filenames]	"ClearStream Accelerator adware"
X	Voltage Manager	[random filename]	"Added by the DREFFORT WORM!"
X	vxcxcvfck	[random filename]	"Added by the RANCK-AZ TROJAN! The most common example is ""sbsvsd.exe"" located in %System%"
X	w02db700.dll	[random filename]	"ZenoSearch adware"
X	W32Load	[random filename].scr	"Added by the CASPID WORM!"
U	WashAndGo - Cleanup of old Backupfiles	checker.exe	"WashAndGo - temp file cleaner"
X	Web Service	[random filename].exe	"Added by the ADMINCASH TROJAN!"
X	WebRun	[random filename]	"Added by the ADWARELOADER TROJAN!"
X	wescmv	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	WiFix service	[random filename]	"Added by a variant of the SDBOT WORM!"
X	Win exe file managr	crss.exe	"Added by the RBOT.CCI WORM!"
X	Win I5oahder	[worm filename]	"Added by the AGOBOT-DS WORM!"
X	Win Prosess0r	[random filename]	"Added by the RBOT-BIT WORM!"
X	WIN prosessor16	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	Win Secure Update	[random filename]	"Added by the RBOT-AGI WORM!"
X	Win2Drv	[worm filename]	"Added by the WINTOO WORM!"
X	Win32 Critical File	Win32.exe	"Added by the RBOT-GUB WORM!"
X	Win32 exe file	winstr32.exe	"Added by a variant of the SPYBOT WORM!"
X	Win32 Service	[trojan filename]	"Added by the AGENT-GBO TROJAN!"
X	Win32system	[random filename]	"Added by the DDV.B WORM!"
X	WIN95DEFVIEW	[path to file]	"Added by the DEDLER-D TROJAN! The most common filenames seen are ""csmss.exe"" and ""csmrs.exe""
X	winabc	"rundll32.exe [Temp][ORIGFILENAME].DLL	InstallLaunchEv"
X	Wind Logd File	servicelogd.exe	"Added by a variant of the RBOT WORM!"
X	Windos Seres Agnts	[worm filename].exe	"Added by the RBOT-GUN WORM!"
X	Window service	[random filename]	"Added by the RBOT-ACH WORM!"
X	Windows ASN Service	[random filename]	"Added by the AGOBOT-TC WORM!"
X	Windows Compliant	[random filename]	"Added by the RBOT-IR WORM!"
X	Windows ExpIorer	[random filename]	"Added by the RBOT-AKO WORM!"
X	Windows Explorer	[filename].exe	"Added by the SDBOT TROJAN!"
X	Windows File Migration Wizard	HIMENSYST.EXE	"Added by the RBOT-EMO WORM!"
X	Windows File Protection	winprotect.exe	"Added by the AGOBOT.JB WORM!"
X	Windows File System Frame	ntframe.exe	Added by an unidentified WORM or TROJAN!
X	Windows File Verification Service	wfvs.exe	Added by the RANKY.AC TROJAN!
X	Windows File XP Manager	wfdmgr.exe	"Added by the SDBOT.XD TROJAN!"
X	Windows FileSharing Service	mcwsvc.exe	"Added by the IRCBOT.AJF BACKDOOR!"
X	Windows Help File	winhelper32.exe	"Added by the SDBOT-QK TROJAN!"
X	Windows HTML file reader	Sysconf32.exe	"Added by the NOOMY.A WORM!"
X	Windows LoL Layer	[random filename].exe	"Added by the RBOT-GMD WORM!"
X	Windows Management Instrumentation	[path to file]	"Added by the QEDS-A WORM!"
X	Windows Media Player	[random filename]	"Added by a variant of the RBOT WORM!"
X	Windows Media Player Update	[random filename]	"Added by the RBOT-ET WORM!"
X	Windows Media SP.2.37	[random filename]	"Added by the LEMIR.C TROJAN!"
X	Windows Messenger Fileshare	wivsvc.exe	"Added by the SILLYIM WORM!"
X	Windows Microsoft Service	[random filename]	"Added by the AGENT-HCD TROJAN!"
X	Windows Print Monitor Daemon	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	Windows Registry Name	[random filename]	"Added by the RBOT-AEB WORM!"
X	Windows Secure Layer	[random filename]	"Added by the RBOT.DRF WORM!"
X	Windows Security Service	[random file name]	"Added by the RBOT-ALV WORM!"
X	Windows Servce Agent	[random filename]	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Service Agent	[random filename].exe	"Added by the IRCBOT-XE TROJAN!"
X	Windows Service alge	[random filename]	"Added by the RBOT.GJO TROJAN!"
X	Windows Service Host Process	[path to file]	"Added by the EZIO-A WORM!"
X	Windows Services	filename.exe	"Added by the SDBOT.FSK BACKDOOR!"
X	Windows SSL File	winssv.exe	"Added by the WOOTBOT.CA WORM!"
X	Windows Standard Securty	[random 3-letter filename]	"Added by the RBOT-ALF WORM!"
X	Windows System File	cmxp.exe	"Added by the SPYBOT.KHO WORM!"
X	WINDOWS SYSTEM FILE	winload.exe	"Added by the MYTOB.DK WORM!"
X	Windows System Service	[worm filename]	"Added by the RBOT.XG WORM!"
X	Windows Taskbar Manager	[path to file]	"Added by the PROTORIDE.B WORM!"
X	Windows Update	[filename]	"Added by the NORIO TROJAN! Acts as a hi-jacker redirecting to adult content sites"
X	Windows update 2005	[random filename]	"Added by the RBOT.ARP WORM!"
X	Windows Update Checker	[random filename]	Adware downloader trojan
X	Windows Update Files	dnetc.exe	"Added by an unidentified VIRUS
X	Windows Update V6	[random filename]	"Added by the RBOT-KT WORM!"
X	WindowsFileSystem	winsfs32.exe	"Added by the RBOT-FMQ WORM!"
X	WindowsFileSystem	cidaemon32.exe	"Added by the RBOT-FSP WORM!"
X	WindowsFZ	[path to file]	"Added by the DESKTOPHIJACK VIRUS! Also see DESKTOPHIJACK.B TROJAN!"
X	WindowsInstaller	[path to file]	"Added by the DEDLER-D TROJAN! The most common filenames seen are ""csmss.exe"" and ""csmrs.exe""
X	WindowsReg% update	[random filename].exe	"Added by the RBOT-HH WORM!"
X	WindowsRegistration	[random filename]	"Added by the RBOT-NO WORM!"
X	WindowsRegKey Autoupdate	[random filename]	"Added by a variant of the RBOT WORM!"
X	WindowsRegKey update	[random filename]	"Added by the RBOT.QT WORM!"
X	WindowsUpdate	[path to file]	"Added by the DUPA-B TROJAN!"
X	WindowsUpdatem1	[path to file]	"Added by the AGENT-AAJ TROJAN!"
X	Windowz	[original worm filename].vbs	"Added by the NUKIP WORM!"
X	WinFixer service	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	wingo	[various filenames]	"Added by the BAGLE-AU WORM!"
X	winldr	[path to file]	"Added by the VIDLO-P TROJAN!"
X	WinLoader	[random filename]	"Added by variants of the SUBSEVEN TROJAN!"
X	winlogin.exe	logfile.exe	Added by the AGENT.AH TROJAN!
X	winlogon32_	[path to file]	"Added by the RULAND.A WORM!"
X	WinProfile	Command.exe	"Added by the BUDDY.E TROJAN!"
X	WinProfile	sndcfg16.exe	"Added by the SNDC.A WORM!"
X	winprofile	iexpiore.exe	Added by a variant of the MONCHER WORM!
X	WinProfile	iexpIore.exe	"Added by the CHUM-C TROJAN!"
X	Winsock2 driver	[random filename]	"Added by members of the SPYBOT family of WORMS! Note - the random filename is located in %System%"
X	Winsvr	[random filename].exe	"Added by the ADCLICK-DK TROJAN!"
X	WINTASK	taskfile.exe	"Added by the MYTOB.EF WORM!"
X	winupdateconn	[path to file]	"Added by the COMBRA-A WORM!"
X	winupdatefiv_	[path to file]	"Added by the COMBRA.C WORM!"
X	winupdate_	[path to file]	"Added by the COMDOR.A WORM!"
X	WinUPPD.exe	[random filename]	Added by an unidentified WORM/TROJAN!
X	WinXP fix	[path to file]	"Added by the RANKY.P TROJAN!"
X	Winz Firewall	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	Winzip	[various filenames]	"Added by the LERPA-A WORM! Note - the file name will be one of the following common.exe
X	Win_BooT	[path to file]	"Added by the BANKER-GI TROJAN!"
X	worknote1	[filename].exe	"Added by the MEETOT WORM!"
X	wpxmls	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	Wupdate driver	[various filenames]	"Added by a variant of the SPYBOT WORM!"
X	WXcmeinst	[path to file]	"Added by the RANCK-CD TROJAN!"
U	X1FileMonitor.exe	X1FileMonitor.exe	"Part of X1's Enterprise Desktop Search Resource Center. An enterprise desktop search engine"
U	XFilesDialog	XFilesDialog.EXE	"""XFilesDialog is designed to improve all the (more or less standard) Windows file dialogs (Open / Load / Save)"""
X	xp_system	[filename]	"Added by the BOOKMARKER.J TROJAN! The file is located in %Windir%\inet20004"
X	Yahoo Messengger	winfiles.exe	"Added by the AUTORUN-BCY WORM!"
X	YahooStock	[path to file]	"Adtomi adware"
X	ZaCker	[filename].PIF	"Added by the HOLAR.A WORM!"
X	ZagrebLand	[trojan filename]	"Added by the RENOS-EH TROJAN!"
X	zcseacrt	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	Zeno	[random filename]	"ZenoSearch adware"
X	zonealarm	[random filename]	"Added by an unidentified VIRUS
X	ZStart	[various filenames]	"VX2.Transponder parasite updater/installer related"
X	Z_Start	[random filename]	"ZenoSearch adware"
X	[12 random characters]	avifile5.exe	"IeDriver adware variant"
X	[3-4 random letters]Srv32	[path to file]	"Added by the BANCSADE-A TROJAN!"
X	[executed file name]	App.exe	"Added by the WAXPOW WORM!"
X	[executed file name]	Regsrv32.com	"Added by the SOUTHGHOST WORM!"
X	[filename]	svchost.scr	"Added by the BANKER-CC TROJAN!"
X	[original filename]	svchost.scr	"Added by the BANCBAN-CX TROJAN!"
X	[original filename]	xphost.scr	"Added by the BANCBAN-HM TROJAN!"
X	[random filename]	slk8x2peu.exe	"QuickLinks adware"
X	[trojan filename]	Install.exe	"Added by the BANCBAN-FS TROJAN!"
X	[various filenames]	qtsks.exe	Added by the WEBDOR.Y TROJAN
X	_Hazafibb	[path to file]	"Added by the ZAFI.B WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.