IP

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
Mass"	"Telechips	U	patch.exe
U	101Clips	101Clips.exe	"101Clips - ""the simplest of all multi-clipboard programs. Just have it running minimized and it captures everything you cut or copy from other programs. It keeps the last 25"""
U	12Ghosts Clip	12clip.exe	"12Ghosts Clip - ""Screen shots made easy"""
N	12Voip	12Voip.exe	"12Voip - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
Y	3c1807pd	3cmlink.exe 3cpipe-3c1807pd	"3Com WinModem driver. See here for more WinModem information"
Y	3cpipe-USRpdA	USRmlnkA.exe	Modem driver files from US Robotics
X	ActiveScript32	nod.exe	"Added by the SOHANA-AJ WORM!"
Y	Aiptek Graphics Tablet (USB)	atwtusb.exe	USB interface for Aiptek Graphics Tablet (USB)
U	AntiPopUp	AntiPopUp.exe	"AntiPopUp for IE - pop-up stopper"
X	ashDip.exe	ashDip.exe	"Added by the DROPR-CZ TROJAN!"
X	Ati Control Panel	atiphexx.EXE	"Added by the RBOT-BR WORM!"
X	ATI Cpanel	atiphexx.exe	"Added by the AGOBOT-NV WORM!"
U	ATI Desktop Component	ATIPTAXX.EXE	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. Provides System Tray access to display settings (including desktop resolution
X	AtiCpanel	atiphexx.exe	"Added by the AGOBOT.IL WORM!"
X	atidriver	reaIplayer.exe	"Added by the WARPIGS-E WORM! Note the uppercase ""I"" in the filename
N	AtiKey	atiptkad.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Control Panel → Display
X	AtiPanel	atip.exe	"Added by the TACTSLAY.U TROJAN!"
X	atipatxx	atipatxx.exe	"Added by the SMALL-ED TROJAN!"
N	ATIPOLAB	ati2evxx.exe	"Hotkey handler for ATI desktop and mobile graphics chipsets. Users report that most of the hotkeys aren't well documented
U	ATIPOLAB	ati2evae.exe	ATI Polling Program - part of the ATI graphics driver e.g. on some Fujitsu-Siemens Notebooks
N	ATIPOLL	ati2evxx.exe	"Hotkey handler for ATI desktop and mobile graphics chipsets. Users report that most of the hotkeys aren't well documented
U	AtiPTA	Ati2ptxx.exe	"Control panel for the ATI series of video cards allowing access to such features as display resolution
U	ATIPTA	ATIPTAXX.EXE	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. Provides System Tray access to display settings (including desktop resolution
U	AtiPTA	Atiptaab.exe	"Control panel for the ATI series of video cards allowing access to such features as display resolution
U	AtiPTAAA	Ati2ptxx.exe	"Control panel for the ATI series of video cards allowing access to such features as display resolution
U	AtiPTAAA	ATIPTAXX.EXE	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. Provides System Tray access to display settings (including desktop resolution
U	atiptaxx	Ati2ptxx.exe	"Control panel for the ATI series of video cards allowing access to such features as display resolution
U	ATIPTAXX	ATIPTAXX.EXE	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. Provides System Tray access to display settings (including desktop resolution
X	atiptext	atiptext.exe	"Added by the COSIAM-A TROJAN!"
U	AtiQiPcl	AtiQiPcl.exe	Used for hardware DVD decoding on ATI video cards supporting this feature. Not required unless you regularly play DVD's
X	autoMe	wscript.exe solution.vbs	"Added by the VBS.SASAN WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""solution.vbs"" file is found in %Windir%"
X	autoMe	wscript.exe samok.vbs	"Added by the SAMOK-A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""samok.vbs"" file is located in %Windir%"
N	B'sCLiP	BSCLIP.exe	CD recording utility that comes with a lot of CDR/CDRW drives and isn't required
U	Back2zip	Back2zip.exe	"Back2zip is a simple and elegant backup solution which uses the industry's most powerful ZIP and ZIP-64 technologies to constantly monitor your documents and make sure that they are always properly backed up"
N	BCWipeTM	bcwipetm.exe	"BCWipe Task Manager - scheduler for BCWipe so that it runs at convenient times. You can set a time for running the task
?	BIOVCIP	BIOVCIP.exe	"??"
Y	BitDefender Antiphishing Helper	IEShow.exe	"Anti-phishing component of BitDefender internet security products. Anti-phishing prevents sensitive data such as usernames
X	BootsCfg	wscript.exe [path] Date.POP.vbs	"Added by the KUULLIO WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbs	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbe	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe Install.log.vbs	"Added by the YPSAN.E WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""Install.log.vbs"" file is located in %System%"
N	BsCLiP	BSCLIP.exe	CD recording utility that comes with a lot of CDR/CDRW drives and isn't required
N	BudgetSip	BudgetSip.exe	"BudgetSip - internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
U	Canon MultiPASS Status Monitor	monitr32.exe	Cannon Multi-Pass status monitor - your choice
X	CGI Firewall Script	CGIAGENT.EXE	"Added by the BROPIA-U WORM!"
U	CHIPDRIVEPinManager	sokscmpn.exe	"ChipDrive Smartcard software"
U	CHIPDRIVESmartcardManager	SCMgr.exe	"ChipDrive Smartcard software"
U	Cisco Systems VPN Client	ipsecdialer.exe	"Cisco VPN Client - lets local users gain Administrator privileges on the operating system"
X	Client Agent	ipxwping.exe	"Added by the PPDOOR-N TROJAN!"
X	Clip Service Manager	clipmg.exe	"Added by the DELF.DXJ TROJAN!"
X	Clip Servicer	clipsrvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Clip Srv	clipsv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	clipboard.exe	clipboard.exe	Added by an unidentified WORM or TROJAN!
N	Clipbook Service	Clipsrv.exe	"Supports Windows XP ClipBook Viewer
U	clipdiary	clipdiary.exe	"Clipdiary from Softvoile - ""Free Clipboard Manager for keeping the clipboard history"""
N	ClipMate5x	ClipMt5x.exe	"Clip Mate 5.x by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs"
N	Clipmate6	CLIPMT60.EXE	"Clip Mate 6 by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs"
N	ClipMate7	ClipMate.exe	"Clip Mate 7 by Thornsoft - utility that allows you to store more than one item in the clipboard"
N	Clipomatic	Clipomatic.exe	"Mike Lin's Clipomatic is a clipboard cache program - it remembers what was copied to the clipboard even after new data is copied
N	Clipsrv	Clipsrv.exe	"Supports Windows XP ClipBook Viewer
X	ClipSrv	clipserv.exe	"Added by the SDBOT-AAV and SDBOT-AFE WORMS!"
X	ClipSrv	CLIPBRD3D.EXE	"Added by the MOFEI-D WORM!"
X	Clipsvc	clipsv.exe	"Added by the BLACKHOLE.F BACKDOOR!"
N	ClipTrak	ClipTrak.exe	"
N	ClipTrakker	ClipTrakker.exe	"Cliptrakker - clipboard extender"
N	COM-IP	COMIP.EXE	COM-IP Virtual Modem Driver (COM-IP Creates a Fake Serial Port that allows you to use older DOS Based Communications Programs over Telnet. Type atdt host.domain.com instead of atdt 5551212)
X	Configuration Loader10	ip7.exe	"Added by the AGOBOT-ANZ WORM!"
U	CostAware	niIPCApp.exe	"NetInternals CostAware - download quota measuring tool"
X	cscripts	cscripts.exe	"Added by the BDOOR-AAP BACKDOOR!"
X	CTFMON	wscript.exe /E:vbs winjpg.jpg	"Added by the RUNAUTO.F WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""winjpg.jpg"" file is located in %System%"
X	CTFMON	wscript.exe /E:vbs regedit.sys	"Added by the VBSAUTO-A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""regedit.sys"" file is located in %System%"
?	Description of Shortcuts	*.exe	"* seems to be a sequence of alphanumerics that can be different
X	directx	PipeCmd.exe	"Added by the SDBOT.D TROJAN!"
X	dlcipscl	dcpavss.exe	"Added by the MAILBOT-CB TROJAN!"
X	DnsCache	Wscript.exe dns_cache.vbs	"Added by the AUTORUN-AWI WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""dns_cache.vbs"" file is located in %System%"
U	ELSAChipGuard	elsavect.exe	"ChipGuard for ELSA graphics cards - monitoring solution which monitors both the GPU temperature and fan speed
?	Equipmen	Equipmen.exe	"??"
U	eSnips	ClientGW.exe	"eSnips Client Gateway from eSnips"
Y	eTrustCIPE	ezdsmain.exe	eTrust EZ Deskshield from Computer Associates. Protects against malicious email attachments and unauthorized use of email by detecting and blocking unusual behavior
?	Excite Private Messenger Pipe	x8impipe.exe	"??"
X	explorer	wscript.exe [filename]	"Sneaky way to start any VBS script. Many viruses use VBS files. Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
U	FatPipe	DHCP	Software enabling high speed internet browsing (2-4 times faster) and internet connection sharing for up to 5 users
U	Fatpipe Dialer	fpdialer.exe	Dailler for Fatpipe - software enabling high speed internet browsing (2-4 times faster) and internet connection sharing for up to 5 users
X	File System Service	wmiprvsc.exe	"Added by the AGOBOT-HZ TROJAN!"
N	filehippo.com	UpdateChecker.exe	"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
N	FileHippo.com Update Checker	UpdateChecker.exe	"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
X	FileManager32	Wscript.exe ChkMgr32.vbs	"Added by the NOTUP.A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""ChkMgr32.vbs"" file is located in %System%"
X	FileSoft	Wscript.exe UpdataFiles.vbs	"Added by the SST.B WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""UpdataFiles.vbs"" file is located in %Windir%"
?	First Principle Group	fpg.exe	"Related to the E-Players Card from First Principle Group"
N	GCS	GrabClipSave.exe	"GrabClipSave screen capture tool"
X	gremier	wscript.exe gpremier.vbs	"Added by the GPREMIER WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""gpremier.vbs"" file is located in %System%"
X	IExplorer32 Java Scripting	IExplore32b.exe	"Added by the RBOT.ABO WORM!"
X	IExplorer32c Java Scripting	IExplore32cb.exe	"Added by the RBOT.ABN WORM!"
X	IExplorer6 Java Scripting	IExplore326.exe	"Added by a variant of the SDBOT WORM!"
X	IExplorer7 Java Scripting	IExplore327.exe	"Added by a variant of the SDBOT WORM!"
X	ifp	ipf.exe	"Added by the CLAGGER-AG TROJAN!"
X	Iinl	iptl.exe	"PurityScan adware"
N	iIWiper	Systemwiper.exe	"System Wiper from iI Software - allows you to clear the history of your activites from you computer. Run manually on a regular basis"
?	InstallNAIProduct	SETUP.EXE	"Could be related to Network Associates Inc who own the McAfee VirusScan product amongst others. This was found in a directory called "VSC". Could it be an installation that failed and "SETUP.EXE" was left to run at startup as an error?"
U	IntelliPoint	point32.exe	"Microsoft IntelliPoint utility (up to version 5.4) - required to support the programmable buttons and additional features on Microsoft's range of mice
U	IntelliPoint	ipoint.exe	"Microsoft IntelliPoint utility (from version 5.5) - required to support the programmable buttons and additional features on Microsoft's range of mice
X	Internet Protocol Configuration Loader	ipcl32.exe	"Added by the SDBOT TROJAN!"
N	InterVoip	InterVoip.exe	"InterVoip - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X	IP	IP.EXE	"Added by the AGOBOT-QO WORM!"
U	IP Changer 2.0	IPChanger.exe	"IP Changer 2.0 from Plustech Inc - network configuration management tool"
X	IP Packet Redirect Service	ipredirect.exe	"Added by the FORBOT.SM WORM!"
X	IP Stack	ipstack.exe	"Added by the AGOBOT.CW WORM!"
X	IP*.exe [ = random char]	IP*.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	IP*32.exe [ = random char]	IP*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
N	iPalm	mon.exe	"Installed with a Panasonic iPalm digital camera. Used to upload photos from the camera. If your camera is not connected (via USB port) you do not need this program loaded"
X	IPC Connection	ipcconn.exe	"Added by the RBOT-AEG WORM!"
X	IPC Spool Manager	wnmgre.exe	"Added by the SDBOT-ZC WORM!"
X	IPC Spool Manager	winspec.exe	"Added by the SDBOT-BLU WORM!"
X	ipcfg.exe	ipcfg.exe	"Adware - detected by McAfee as a variant of the ADCLICKER-BM TROJAN!"
X	IPConfig	svcxnv32.exe	"Added by the HACARMY.E TROJAN!"
X	IPConfig	svcxnw32.exe	"Added by a variant of the HACARMY.E TROJAN!"
X	IPConfig	ipconfigs.exe	"Added by the HACARMY.C BACKDOOR!"
X	IpCtrl	ipcon32.exe	"Added by an unidentified VIRUS
X	IPFW	ipwf.exe	"Added by the DLOADER-YF TROJAN!"
?	IPHSend	IPHSend.exe	"AOL related. What does it do and is it required?"
N	IPInSightLAN 01	IPClient.exe	"IP Insight is a Quality of Service monitor and diagnostic tool that isn't required - see here for more information. Included with services from BellSouth
N	IPInSightMonitor 01	IPMon32.exe	"IP Insight is a Quality of Service monitor and diagnostic tool that isn't required - see here for more information. Included with services from BellSouth
Y	IPinst	N/A	For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out
X	IPLog Security	iplogsec.exe	"Added by the IRCBOT.GP BACKDOOR!"
?	iPlusAgent2	iAgent2.exe	"Related to iriver portable media products. What does it do and is it required?"
X	ipmon.exe	ipmon.exe	"Added by the RECERV or R3C.B TROJANS!"
X	IpNetwork	ipnetwork.exe	Maxifiles adware
X	Ipnuker	Ipnuker.vbs	"Added by the INKER.B WORM!"
N	IPO3	IP Operator 2005.exe	"
X	Ipod Help	[9 random letters].exe	"Added by a variant of the RBOT WORM!"
X	iPOD USB Driver	IPODUSB.EXE	"Added by a variant of the RBOT WORM!"
X	iPod USB Service	iPODService.exe	"Added by a variant of the RBOT WORM! Do not confuse with the Apple iPod process of the same name. The legitimate iPod file will always be located in the %ProgramFiles%\iPod\bin folder and is implemented as a system service
N	iPodder	iPodder.exe	"iPodder (now known as Juice) - a free utility that ""allows you to select and download audio files from anywhere on the Internet to your desktop"". This entry is present if you choose the option to add it to the startup group during installation"
U	iPodManager	iPodManager.exe	"Apple iPod® management software for the iPod® player - updates
?	iPodWatcher	iPodWatcher.exe	"Associated with Apple's iPod® player. Detects when the iPod® is connected?"
U	ipoint	ipoint.exe	"Microsoft IntelliPoint utility (from version 5.5) - required to support the programmable buttons and additional features on Microsoft's range of mice
X	IPOT Service Drivers	compaq.exe	"Added by a variant of the FUROOTKIT TROJAN!"
X	IPOT USB Service DRIVER	hpsebc087.exe	"Added by the SDBOT-WA WORM!"
X	IPOT USB Service DRV32	hpsebc08.exe	"Added by the SDBOT-WH WORM!"
N	IPPDetect	IPP4Detect.exe	"Part of Presto! Mr.Photo - ""an ideal program for creating
X	ipreg	ipreg.exe	"Added by the ZAGABAN-H TROJAN!"
?	iPrint LPT Redirector	nipplpte.exe	"Related to Novell iPrint - ""a printing solution that enables you to send documents to printers located throughout the Net."" Is it required?"
N	iPrint Tray	iprntctl.exe	"Novell® iPrint - based on Novell Distributed Print Services - enables you to send documents to printers located throughout the Net"
U	iProtectYou	ip.exe	"iProtectYou - internet filtering/parental control and network monitoring software"
X	iprun	iPY.exe	"iProtectYou spyware"
X	IPSEC Configuration	wsupdate.exe	"Added by the AGOBOT-IQ WORM!"
X	iPSec7	ipsec7.exe	"Added by the AGENT.AHVR TROJAN!"
U	ipsecdialer	IPSECD~1.EXE	"Cisco VPN Client - lets local users gain Administrator privileges on the operating system"
U	ipsecdialer	ipsecdialer.exe	"Cisco VPN Client - lets local users gain Administrator privileges on the operating system"
Y	IPSecMon	IPSecMon.exe	"Microsoft L2TP/IPSec VPN Client for Win98/Me/NT. Secure technology for making remote access virtual private network (VPN) connections across public networks such as the Internet"
X	IPTable Configuration	Winipcfgs.exe	"Added by a variant of the RBOT WORM!"
N	iptray	iptray.exe	"System Tray access to Intel Desktop Utilities - ""provides you with the means to monitor system temperatures
X	IPv6 Helper Driver	csass.exe	"Added by the AGOBOT.TC WORM!"
X	IPv6 STUN Service	netstun.exe	"Added by a variant of the SDBOT WORM!"
N	IPW	IPW.exe	"Internet Phone Wizard from Actiontec - Voice over IP (VoIP) that allows you to ""make and receive free Internet calls on your regular phone"" whilst ""at the same time
N	ipw	usbipw.exe	"Related to Internet Phone Wizard from Actiontec - Voice over IP (VoIP) that allows you to ""make and receive free Internet calls on your regular phone"" whilst ""at the same time
X	ipwf	ipwf.exe	"Added by the SCHOEBERL TROJAN!"
X	IpWins	ipwins.exe	"IPWins adware"
X	ipxwshel	ipxwshel.exe	"Added by the WAREZOV.DG WORM!"
X	ipyjy	woniz.exe	"Added by the SDBOT.BQD WORM!"
Y	ISP.COM High Speed	slipgui.exe	"User interface for Slipstream - internet acceleration through compression/decompression techniques
X	Javascript	jscript.exe	"Added by the DELBOT-AD WORM!"
X	JavaScript Debugging Service	JsDbgMan.exe	"Added by the DERDERO.E WORM!"
X	JavaScriptMsxrs	Msxrs.exe	"Added by the VB.BL WORM!"
N	JustVoip	JustVoip.exe	"JustVoip - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X	Kernel_check	wmiprvse.exe	"Added by the SONEBOT-B WORM! Note - this is not the legitimate wmiprvse.exe process which is always located in the %System%\wbem folder and should not normally figure in Msconfig/Startup!"
X	Load-Guard	Wscript.exe LGuarg.exe.vbs	"Added by the YENO.B and YENO.C WORMS! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""LGuarg.exe.vbs"" file is located in %Windir%"
X	Loaders	HeIp.exe	"Added by the SDBOT-ADB WORM!"
X	LoadingAgent	ZipLoader32.exe	"Added by the OBLIVION TROJAN! This executable is one of the most common but there are more"
X	LoadSIPS	"rundll32.exe SIPSPI32.dll	SIPSPI32"
X	Logitech Desktop	IPCONN.EXE	"Added by the SDBOT-WE WORM!"
N	Lotus Organizer EasyClip	easyclip.exe	""The Easy Clip icon automates the collection of information from sources such as e-mail to create an Organizer address
N	LowRateVoip	LowRateVoip.exe	"LowRateVoip - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X	machine-debugger	WMIPRVSW.exe	"Added by the AGOBOT.WW WORM!"
X	Malware-Wipe	Malware-Wipe.exe	"MalwareWipe rogue security software variant - not recommended
X	Malware-Wiped	Malware-Wiped.exe	"MalwareWipe rogue security software variant - not recommended
X	MalwaresWipeds	MalwareWipeds.exe	"MalwareWipe rogue security software variant - not recommended
X	MalwareWipe	MalwareWipe.exe	"MalwareWipe rogue security software - not recommended
X	MalwareWiped	MalwareWiped.exe	"MalwareWipe rogue security software variant - not recommended
X	MalwareWiped 5.5	MalwareWiped 5.5.exe	"MalwareWipe rogue security software variant - not recommended
X	MalwareWiped 5.6	MalwareWiped 5.6.exe	"MalwareWipe rogue security software variant - not recommended
X	MalwareWiped 5.7	MalwareWiped 5.7.exe	"MalwareWipe rogue security software variant - not recommended
X	MalwareWiped 5.8	MalwareWiped 5.8.exe	"MalwareWipe rogue security software variant - not recommended
X	MalwareWiped 6.1	MalwareWiped 6.1.exe	"MalwareWipe rogue security software variant - not recommended
X	MalwareWiped 6.2	MalwareWiped 6.2.exe	"MalwareWipe rogue security software variant - not recommended
X	MalwareWiped 6.3	MalwareWiped 6.3.exe	"MalwareWipe rogue security software variant - not recommended
X	MalwareWiped 6.4	MalwareWiped 6.4.exe	"MalwareWipe rogue security software variant - not recommended
X	MalwareWiped 6.9	MalwareWiped 6.9.exe	"MalwareWipe rogue security software variant - not recommended
X	MalwareWipeds	MalwareWipeds.exe	"MalwareWipe rogue security software variant - not recommended
X	MalwareWipePro	MalwareWipePro.exe	"MalwareWipe rogue security software variant - not recommended
X	MalwareWiper	MalwareWiper.exe	"MalwareWipe rogue security software variant - not recommended
X	MCAFEEIPS	setup.exe	"Added by the WHITEWELL TROJAN!"
X	mceipww	[8 random letters].exe	"Added by the ZHELATIN.EQ WORM!"
X	MediaPipe P2P Loader	mpp2pl.exe	"MediaPipe peer-to-peer file swapping program also reported as a hijacker"
U	MemoryZipperPlus	memzip.exe	"Memory Zipper Plus - ""optimizes the memory management of your system and boost-up its performance amazingly!"""
X	Microsoft (R) Windows TCP/IP Socket Driver	[path to trojan]	"Added by the PROXY-DD TROJAN!"
X	Microsoft (R) Windows TCP/IP Socket Layer	services.exe	"Added by the RBOT.ARM WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\winsock"
U	Microsoft IntelliPoint	ipoint.exe	"Microsoft IntelliPoint utility (from version 5.5) - required to support the programmable buttons and additional features on Microsoft's range of mice
U	Microsoft IntelliPoint	point32.exe	"Microsoft IntelliPoint utility (up to version 5.4) - required to support the programmable buttons and additional features on Microsoft's range of mice
X	Microsoft IPC	system.exe	"Added by the NULLBOT TROJAN!"
X	Microsoft IPC	svshost.exe	"Added by an unidentified VIRUS
X	Microsoft Machine Script	iexplorersis.exe	"Added by the RBOT-CMH WORM!"
X	Microsoft TCP/IP Connection Monitor	svchost32.exe	"Added by the RBOT.KS WORM!"
X	Microsoft Update Clinic	svsipconfig.exe	"Added by the RBOT.BR WORM!"
X	Microsoft Update Process	wmipcvse.exe	"Added by the AGOBOT-JF TROJAN!"
X	Microsoft Update Service	wmiprvre.exe	"Added by the AGOBOT-NN WORM!"
X	Microsoft Winedows WinServ	iPodFix.exe	"Added by a variant of the RBOT WORM!"
N	Miniphone	glophone.exe	"VoiceGlo Glophone - ""an affordable and convenient way to call friends and family throughout the world using a dial-up or broadband Internet connection on your computer"" using the VoIP (Voice over Internet Protocol). No longer available"
X	miniport	usb2chk.exe	"Added by the LAZAR-A TROJAN!"
X	MiniPortRt	miniport_mp.exe	"Malware - see here"
X	MistikotitaTuIpologisti	GDC.exe	"MistikotitaTuIpologisti Greek rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
U	Mobipocket Reader Notifications	readernotify.exe	"Part of Mobipocket Reader - ""Store all your eBooks
U	Mobipocket Web Companion	webcomp.exe	"Related to Mobipocket eBook Reader"
X	MS Auto-IPSec Protection	MSASP32.exe	"Added by the RBOT-AER WORM!"
X	My Web Search Community Tools	m3IMPipe.exe	"MyWebSearch parasite"
X	NAMEDPIPE SYSTEM	namedpipe.exe	"Added by the MYTOB-FH TROJAN!"
X	netzip	svzip.exe	"Added by the DELF.ZWL TROJAN!"
X	Netzip Smart Downloader	npnzdad.exe	Advertising spyware
N	NetZIPFolders	nzfprop.exe	"
U	No-IP DUC	DUC20.exe	"Part of http://www.no-ip.com provided service. Keeps No-IP's dynamic nameserver (DNS) updated if and when your computer's (network's) dynamic IP-address changes so that you can run servers on computers with dynamic IP. Shortcut available"
N	Nuance OmniPage 17-reminder	Ereg.exe Ereg.ini	"Registration reminder for Ominpage version 17 from Nuance"
X	NvClipRsv	svchost.exe	"Added by the DUMARU-K WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	NvClipRsv	swchost.exe	"Added by the DUMARU-AK WORM!"
N	OmniPage	Opware32.exe	"Part of OmniPage from Nuance (was Scansoft) - ""the fastest
U	OmniPass	scureapp.exe	"OmniPass from Softex Inc. - secure password management software"
N	OneNote 2007 Screen Clipper and Launcher	ONENOTEM.EXE	"System Tray access to MS Office OneNote 2007 - an electronic notebook that allows you to create free-form notes
X	p2snetis	comippwa.exe	"Added by the SPAMTOO-AL TROJAN!"
U	PDUiP6000DMon	PDUiP6000DMon.exe	"Memory Card Utility for the Canon PIXMA iP6000D photo printer - which allows ""your computer to access the memory card reader feature of your printer"""
U	PDUiP6000DTskbr	PDUiP6000DTskbr.exe	"Memory Card Utility for the Canon PIXMA iP6000D photo printer - which allows ""your computer to access the memory card reader feature of your printer"""
U	PDUiP6210DMon	PDUiP6210DMon.exe	"Memory Card Utility for the Canon PIXMA iP6210D photo printer - which allows ""your computer to access the memory card reader feature of your printer"""
U	PDUiP6220DMon	PDUiP6220DMon.exe	"Memory Card Utility for the Canon PIXMA iP6220D photo printer - which allows ""your computer to access the memory card reader feature of your printer"""
U	PDUiP6600DMon	PDUiP6600DMon.exe	"Memory Card Utility for the Canon PIXMA iP6600D photo printer - which allows ""your computer to access the memory card reader feature of your printer"""
U	PDUiP6700DMon	PDUiP6700DMon.exe	"Memory Card Utility for the Canon PIXMA iP6600D photo printer - which allows ""your computer to access the memory card reader feature of your printer"""
U	Petit Larousse 2001	HIPL2000Popup.exe	Popup dictionary tool
U	Philips Intelligent Agent	Philips Intelligent Agent.exe	"Philips Intelligent Agent searches automatically the correct update for your recordable drive in only three simple steps"
U	Philips PhotoFrame Manager	PFM30.exe	"Management software for the Philips 8FF3WMI/27 digital PhotoFrame. Used to configure the device
N	PhilipsDM	DeviceManager.exe	Device manager for Philips portable media players such as the GoGear
?	PhilipsLime	LimeAlive.exe	"Associated with some Philips portable media players such as the GoGear. What does it do and is it required?"
U	PhilipsRemote	PhilipsRemote.exe	"Remote control support for MusicMatch Jukebox on Philips audio players such as the AZ2555 Sound Machine - see
U	PicoZip	PicoZipTray.exe	"System tray access to PicoZip - ""an easy to use Zip and UnZip utility that runs on all 32-bit Windows platforms such as Windows 95
X	PIPE SYSTEM	pipe.exe	"Added by the MYTOB-FF WORM!"
N	PowerStrip	powerstrip.exe	"PowerStrip is a Video Mode Editor to allow special Refresh Rates and Tweaking of Video Settings"
N	PowerStrip	PSTRIP.EXE	"PowerStrip is a Video Mode Editor to allow special Refresh Rates and Tweaking of Video Settings"
X	Printer	dipset.exe	"Added by a variant of the FBSR TROJAN!"
X	PrnShare	Wscript.exe prn_share.vbs	"Added by the AUTORUN-AWI WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""prn_share.vbs"" file is located in %System%"
?	Ptipbmf	"rundll32.exe ptipbmf.dll	SetWriteCacheMode"
U	PtiuPbmd	"Rundll32.exe ptipbm.dll	SetWriteBack"
N	Q152404	wsript.exe Q152404.VBS	Appears to run Scandisk at bootup on NEC PCs
X	Quickzip	Ls.exe	MsConnect browser hijacker and dialler
X	QuickZip	lu.exe	MsConnect browser hijacker and dialler
X	Real Internet Player	Reaiplay.exe	"Added by a variant of the SPYBOT WORM!"
N	Reclip	reclip.exe	"Reclip Popup Clipboard manager"
X	Reg Service	ipcfg.exe	"Added by the AGOBOT-SO WORM!"
X	Registry	wscript.exe ShakiraPics.jpg.vbs	"Added by the VBSWG.AQ WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""ShakiraPics.jpg.vbs"" file is located in %Windir%"
?	roketpipe	rpclient.exe	"??"
X	Run MSupdt32	wscript MSupdt32.vbs	"Added by the CASER WORM!"
?	run=	wallflip.exe	"Desktop wallpaper changer?"
U	Rundll32	"Rundll32.exe ptipbm.dll	SetWriteBack"
?	rundll32	"rundll32.exe ptipbmf.dll	SetWriteCacheMode"
X	S3 Internal Chip	s3serv.exe	"Added by the AGOBOT-DD WORM!"
X	S3 Internal Chip	s3chip3.exe	"Added by the AGOBOT-FW WORM!"
X	SafeStrip	SafeStrip.exe	"SafeStrip rogue security software - not recommended
X	SafeStripReminder	SafeStripReminder.exe	"SafeStrip rogue security software - not recommended
U	SafetyNet	ipcTray.exe	"Safety.Net from Netveda - ""offers Internet security
U	SafetyNet_Notifier	ipcLn.exe	"Safety.Net from Netveda - ""offers Internet security
N	ScanSoft OmniPage SE 4.0-reminder	Ereg.exe ereg.ini	"Registration reminder for Ominpage SE version 4 from Scansoft (now Nuance)"
X	scApp	wmiprvse.exe	"Added by the SILLYFDC-AW WORM!"
?	script	script.bat	"Maybe associated with DOS on a Win9x machine"
Y	ScriptBlocking	SBServ.exe	"Update to Norton AntiVirus 2001. Detects certain types of script-based viruses without the need for specific virus definitions - such as JavaScript and VBScript. This will help protect you from these viruses even before virus definitions are available. Note - some users complain of problems once the update is installed - refer here for more information"
Y	ScriptSentry	Scriptsentry.exe	"Script Sentry from Jason's Toolbox. Blocks malicious scripts and allows safe scripts to run. Only required if you want it to check the file associations it guards at startup. It will function regardlessly"
X	Security Update Service	wmiprvce.exe	"Added by the AGOBOT.ZW WORM!"
?	SetCacheMode	"rundll32.exe ptipbmf.dll	SetWriteCacheMode"
X	SfKg6wIP	[random filename]	Identified as a variant of the TrojanDownloader.Matcash malware
X	SfKg6wIPu	[random filename]	Identified as a variant of the TrojanDownloader.Matcash malware
N	SipDiscount	SipDiscount.exe	"SipDiscount - internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
U	SIPPS	SIPPS.exe	Web.de Internet phone utility
Y	slipcore	slipcore.exe	"Core module for Slipstream - internet acceleration through compression/decompression techniques
Y	slipgui	slipgui.exe	"User interface for Slipstream - internet acceleration through compression/decompression techniques
Y	SlipStream	slipcore.exe	"Core module for Slipstream - internet acceleration through compression/decompression techniques
N	Smith Micro try	smiptray.exe	Smith Micro shared files. Comes with D-Link web cam
U	Snippet	SnippingTool.exe	"The Snipping Tool (part of the Experience Pack for Tablet PC) allows you to easily ""cut out"" anything on screen and share it with other people. The whole screen becomes an ""inkable"" surface that you can add comments to and mark up however you like. You can then save that annotated image to use later
X	Software	cipsn.exe	"Added by the FORBOT-DM WORM!"
N	SparVoip	SparVoip.exe	"SparVoip - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X	SPINX	Wscript.exe OXNEY.B.VBS	"Added by the YENO.B and YENO.C WORMS! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""OXNEY.B.VBS"" file is located in %System%"
X	spysnipe	spysnipe.exe	"SpySnipe rogue security software - not recommended"
X	SpyViperDemo	SpyViperDemo	"SpyViper rogue spyware remover - not recommended
X	Syntax Script	systacq.exe	"Added by the SDBOT.AI WORM!"
X	Syntax Script	saskatcw.exe	"Added by the SDBOT-TE WORM!"
X	System	winipck.exe	"Added by the RBOT-TK WORM!"
X	System IP	systemip.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	System Update Service	wmiprvsa.exe	"Added by the AGOBOT-RG TROJAN!"
X	System Update Service	wmiprvsv.exe	"Added by the AGOBOT.YG WORM!"
X	System Updater Process	wmiprvsw.exe	"Added by the AGOBOT-IL WORM!"
X	System Updater Service	wmiprvsw.exe	"Added by the GAOBOT.AFC WORM!"
U	TabletTip	tabtip.exe	This is the Tablet PC Input Panel for Windows XP Tablet PC Edition. This utility allows you to use a pen (in conjunction with a touchscreen or tablet) to enter text into a document or input field (such as a URL in a browser) using either handwriting or the on-screen keyboard. This utility is also included with Windows 7 and Vista but only appears to run at startup if using the XP Tablet PC version. This cannot be confirmed at present
X	TCPIP Protocol	mstcpip.exe	"Added by the SDBOT-LR WORM!"
X	tcpipmon	tcpipmon.exe	"Added by the CLICKER-EF TROJAN!"
X	tcpippui	tcpippui.exe	"Added by the RBOT-APS WORM!"
X	tcpippui32	tcpippui32.exe	"Added by the RBOT-ART WORM!"
X	tcpipsvc.exe	tcpipsvc.exe	"Added by the AGOBOT-PG WORM!"
X	Time Zone Synchronization	wscript zshell.js	"Added by the NETDEX-A TROJAN!"
X	tipguard.exe	tipguard.exe	"Privacy Commander rogue privacy program - not recommended
N	Tips	mousetips.exe	Suggests tips on using your mouse
X	topat	zlip.exe	"Added by the FLOOD-IG TROJAN!"
N	UltimateZip Quick Start	uzqkst.exe	"UltimateZip - file compression utility"
U	UniPrint	SetDfltSettings.exe	"Drivers for Uniprint
?	USBToolTip	USBTip.exe	"Related to Pinnacle Systems Inc. What does it do and is it required?"
X	VBS.Ipnuker@mm	[worm filename].vbs	"Added by the NUKIP WORM!"
X	vipantispyware	vipantispyware.exe	"VipAntiSpyware rogue spyware remover - not recommended"
U	VisualTaskTips	VisualTaskTips.exe	"""Visual Task Tips is a lightweight shell enhancement utility. It provides thumbnail preview image for each task in the Windows Taskbar"""
U	VisualTooltip	VisualToolTip.exe	"Related to VisualTooltip. Shows a thumbnail of a window by placing the mouse cursor over a button on the taskbar"
U	voip phone	voip phone.exe	"Related to Acer Bluetooth VoIP phone - as optionally supplied with some of their notebooks such as the TravelMate 8200"
N	VoipBuster	VoipBuster.exe	"VoipBuster - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
N	VoipBusterPro	VoipBusterPro.exe	"VoipBusterPro - internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
N	VoipCheap	VoipCheap.exe	"VoipCheap - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
N	VoipCheapCom	VoipCheapCom.exe	"VoipCheapCom - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
N	VoipDiscount	VoipDiscount.exe	"VoipDiscount - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
N	VoipHit	VoipHit.exe	"VoipHit - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
N	VoipRaider	VoipRaider.exe	"VoipRaider - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
N	VoipStunt	VoipStunt.exe	"VoipStunt - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
N	Voipwise	Voipwise.exe	"Voipwise - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
N	VoipZoom	VoipZoom.exe	"VoipZoom - internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
Y	VPNClient	ipigclient.exe	"iOpus Private Internet Gateway (iPIG) client. 'Using powerful 256-bit AES encryption technology
X	W32PluginsDownloaderXMLHTTPSelfClearing7520	wiper.exe	"Added by the PROXYSER-M TROJAN!"
X	w7zip	w7zip.exe	"Added by the BANCBAN-QB TROJAN!"
U	wait4IP	wait4IP.exe	"Packard Bell net2Plug allows you to network PCs anywhere in your house"
U	wfips	iphider.exe	"ICQ (messaging/chat program) anti-bomb software. ""WFIPS is anti-bomb software for safeguarding ICQ Bomb before the bombing. 'ICQ Defoolder' is a tool for removing ICQ bomb after being exposed."" For more information about ICQ bombs see here"
X	WIN3S2SNDS	winiprtx.exe	"Added by the AGENT.DN TROJAN - known to BOClean as ""CWS/INDEX""
X	Windows driver update	Ipconfig32.exe	"Added by the SDBOT-JV WORM!"
X	Windows Firewall	ipservice32.exe	"Added by a variant of the RBOT WORM!"
U	Windows IP Security	ipsec.exe	"Related to the VPN IPSec utility - used to create Security Policy (SP) entries and Security Association (SA) entries in the kernel"
X	Windows IP Security Service	ipsecs.exe	"Added by the RBOT.BPW WORM!"
X	Windows IPv6 Drivers	wipv6.exe	"Added by the SDBOT-VJ WORM!"
X	Windows JavaScript Daemon	Winjsd.exe	"Added by the WOOTBOT.AF WORM!"
X	Windows Relay Service	ipcbind.exe	"Added by the DELFINJECT.F TROJAN!"
X	Windows Secure Fix	iPodFixer.exe	"Added by the WOOTBOT.BM BACKDOOR!"
X	Windows Server IP Verification Service	wsivs.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Windows Service Agent	WinTcpip.exe	"Added by the SPYBOT.AP WORM!"
X	Windows Services Ink Platform Tablet Input Subsystem	wsiptis.exe	"Added by the RBOT.APC WORM!"
X	Windows Sound Verifier	WinIp32.exe	"Added by the RBOT-FMO WORM!"
X	Windows TCP/IP	wintcp.exe	"Added by the AGOBOT-ZH WORM!"
X	Windows Update IPv6 Layer	WIN32IPV6.EXE	"Added by the RBOT.DUD WORM!"
X	Windows Update Process	wmiprvsc.exe	"Added by the SDBOT-CB WORM!"
X	Windows Update Service	wmiprvse32.exe	"Added by the AGOBOT.NI WORM!"
X	Windows-TCP-IP	rfkampig.exe	"Added by the GIPMA TROJAN!"
X	WindowsIPRelay	winipsvc.exe	"Added by the IRCBOT-AAA WORM!"
U	WinFlip	WinFlip.exe	"WinFlip from Tokyo Downstairs - a 'Flip-3D' task switcher alternative to the standard Alt+Tab on Windows XP that adds the equivalent 'Aero' feature from Windows 7 and Vista. You can either click on the tray icon
U	WinFlip.exe	WinFlip.exe	"WinFlip from Tokyo Downstairs - a 'Flip-3D' task switcher alternative to the standard Alt+Tab on Windows XP that adds the equivalent 'Aero' feature from Windows 7 and Vista. You can either click on the tray icon
X	Winhlp32	Wscript.exe Msexec32.vbs	"Added by the GANT.B WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""Msexec32.vbs"" file is found in %System%"
X	winipsec	winipsec.exe	Unidentified malware
X	WINLOGON	wscript.exe WINLOGON.vbs	"Added by the YSPAN.F WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""WINLOGON.vbs"" file is found in %System%"
X	winmgmt	wmiprvse.exe	"Added by the AGENT-GHP TROJAN!"
X	winpipe	winpipe.exe	Browser hijacker redirecting to wow-access.com
X	WinStart	Wscript.exe WinStart.vbs	"Added by the CIAN.C WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""WinStart.vbs"" file is located in %System%"
X	winzip	[path to trojan]	"Added by the BANCOS.G or BANCOS.K TROJANS! Note - this is not part of the popular WinZip file compression utility"
X	Winzip	[various filenames]	"Added by the LERPA-A WORM! Note - the file name will be one of the following common.exe
X	winzip	winzip.exe	"Added by the RBOT.BDA WORM! Note - this is not part of the popular WinZip file compression utility"
X	winzip	ir_ftp.exe	"Added by the BANCBAN-S TROJAN!"
X	Winzip Application	winzip81.exe	"Added by the RBOT-BKZ WORM!"
X	Winzip Compression Utility	Winzip32.exe	"Added by the SDBOT-UI BACKDOOR!"
N	WinZip Quick Pick	WZQKPICK.EXE	"Added with WinZip version 8.1. "The new WinZip Quick Pick taskbar tray icon gives you instant access to WinZip and your Zip files. Just left click the icon to open WinZip
X	WinZip Update	WinZip.exe	"Added by a variant of the RBOT WORM! Note - this is not part of the popular WinZip file compression utility"
X	winzip32	winzip32.exe	"Added by the BANCBAN-OE TROJAN! Note - this is not part of the popular WinZip file compression utility"
X	WIP Config GUI	Winipcfgs.exe	"Added by the RBOT-CN WORM!"
X	WMI Standard Event Consumer - Scripting	scrcons32.exe	"Added by the RBOT-GRD WORM!"
X	WMI Standard Event Consumer - Scripting	scrcs.exe	"Added by a variant of the RBOT-GRD WORM!"
X	wmiprevse	wmiprevse.exe	"Added by the BANKER-EPN TROJAN!"
X	wmiprv	wmiprv.exe	"Added by the RBOT-WM WORM!"
X	wscript.exe	vabian.vbs	"Added by the VABI VIRUS!"
X	wupipenimi	"Rundll32.exe jinorije.dll	s"
X	wupipenimi	"Rundll32.exe luyenofe.dll	s"
X	wupipenimi	"Rundll32.exe poyimimu.dll	s"
X	wupipenimi	"Rundll32.exe siremase.dll	s"
X	wupipenimi	"Rundll32.exe tamuyiko.dll	s"
?	XeroxScanUtility	xrxzipui.exe	"Associated with a Xerox multifunction and/or scanner. What does it do and is it required?"
U	XSC SIP Client	X-Lite.exe	"""CounterPath's X-Lite 3.0 is the market's leading free SIP based softphone available for download"". For VOIP and broadband users"
N	Yankee Clipper III	YankClip.exe	"Yankee Clipper III - 'A super powerful Windows clipboard extender/memory - now in its third generation. Handles Pictures
X	Zip Driver Loader	ZipLoader32.exe	"Added by the OBLIVION TROJAN! This executable is one of the most common but there are more"
X	Zip Driver Loader	msload32.exe	"Added by the OBLIVION TROJAN! This executable is one of the most common but there are more"
U	ZipDisk Icons	IMGICON.EXE	"Displays Iomega icons in Explorer/My Computer
N	ZipGenius Clean	zg.exe	"ZipGenius file compression utility"
X	ziphelp	ziphelp.exe	"CoolWebSearch parasite variant"
N	ZipMagic	zm32.exe	"Zip utility by Ontrack. Preloading ZipMagic allows you to access files within a zip archive without unzipping them first"
X	[various names]	cnftips.exe	"Wareout - malware masquerading as a spyware and dialer remover"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.