Load

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
N	!NoLoad	winrecon.exe	"WinRecon keystroke logger/monitoring program - remove unless you installed it yourself!"
X	2020Downloader	mssvr.exe	"2020Search Toolbar"
X	@	sysload.exe	"Added by the DELF-EL TROJAN!"
X	AccessMedia P2P Loader	amp2pl.exe	"My AccessMedia toolbar related
U	Act! Preloader	Act8.exe	"Sage Software's ACT! ""enables individuals and small business customers to instantly access key contact and customer information
X	ADM Library Loader	admlib32.exe	"Added by a variant of the SDBOT TROJAN!"
U	Adobe Gamma Loader	Adobe Gamma Loader.exe	"Adjusts monitor colours across all programs
U	Adobe Gamma Loader.exe	Adobe Gamma Loader.exe	"Adjusts monitor colours across all programs
N	Adobe Photo Downloader	apdproxy.exe	"Part of Adobe's Photoshop Album or Photoshop Elements packages - starts each time you connect an external image device to your PC (see here)"
X	Aol Configuration Loader	aimsng.exe	"Added by the SDBOT-XE WORM!"
X	Audoi Device Loader	smssv.exe	"Added by the AGOBOT-ZY WORM!"
X	auloadplx	mplprogsm.exe	"Added by the SLAPER.K TROJAN!"
X	Auto Scroll Loader	ASCRLL.EXE	"Added by the SPYBOT-T WORM!"
X	autoload	cftmon.exe	"Added by the SOCKS-E WORM!"
X	autoload	spooll.exe	"Added by the SILLYFDC WORM!"
X	autoload	windowsupdate.exe	"Added by the POLYCRYP.DY TROJAN!"
X	autoload	spool.exe	"Added by the AGENT-GSG TROJAN!"
X	Autoloaderaproposclient	Apropos_Client_Loader.exe	"AproposMedia adware"
X	Autoloaderaproposclient	cxtpls_loader.exe	"AproposMedia adware"
X	AutoLoaderEnvoloAutoUpdater	auto_update_loader.exe	"Envolo/AproposMedia adware updater"
X	auto__hloader__key	hloader_exe.exe	"Added by the BAGLE.AB TROJAN!"
X	BIOS XP Loader	[random filename]	"Added by the RBOT-IC WORM!"
U	blsloader	blsloader.exe	"BellSouth ISP Internet Tools"
X	BootLoader	BootLoader.exe.vbs	"Added by the WATERWORKS WORM!"
X	Bot Loader	svchostt.exe	"Added by the GAOBOT.ALV WORM!"
N	BrowserWebCheck	loadwc.exe	Checks to make sure that IE is still your default browser
Y	BullguardoptIn	bulldownload.exe	"Part of Bullguard antivirus"
X	CacheLoader	[path to trojan]	"Added by the DLOADER-NZ TROJAN!"
Y	cdloader	cdloader2.exe	"From MagicJack - ""A softphone device that allows you to attach an analog phone into the PC so you can have a traditional-style phone system in your house without any monthly charge"""
U	CDLoader	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
X	CheckScan32	regload16.exe	"Added by the AEBOT.K WORM!"
X	ClickTheButton	cd_load.exe	"Added by the DOWNLOADER-MY TROJAN!"
X	ClrSchLoader	[path to file]	"ClearSearch adware"
X	Config Loadation	iEEexplore.exe	"Added by the SDBOT.H TROJAN!"
X	Config Loadatiorin	I3Explorer.exe	"Added by the SDBOT.H TROJAN!"
X	Config Loader	svchosl.exe	"Added by the GAOBOT.P WORM!"
X	Config Loader	sysldr32.exe	"Added by the GAOBOT WORM!"
X	Config Loader	scvhost.exe	"Added by the GAOBOT.AE or GAOBOT.AO WORMS!"
X	Config Loader	svhost.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Config Loader	svchost2.exe	"Added by the AGOBOT.XE WORM!"
X	Config Loader	[worm filename]	"Added by the AGOBOT-AE WORM!"
X	Config Loader	SYSMGR.EXE	"Added by the AGOBOT.C WORM!"
X	Config Loader	wincrt32.exe	"Added by the AGOBOT-AW WORM!"
X	Config Loader for Microsoft Windows	mwincfg32.exe	"Added by the AGOBOT.BD WORM!"
X	Config Loader2	explores.exe	"Added by the GAOBOT.BT WORM!"
X	Config Loadr	winsys32.exe	"Added by the AGOBOT-HN WORM!"
X	ConfiggLoader	cart322.exe	"Added by the GAOBOT.DJ WORM!"
X	Configuration Loaded	wupdated.exe	"Added by the MOEGA or MOEGA.AG or MOEGA.AP WORMS!"
X	Configuration Loaded	lssas.exe	"Added by a variant of the SDBOT WORM!"
X	Configuration Loaded	iexploree.exe	"Added by the SDBOT-KC WORM!"
X	Configuration Loader	aim95.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	cmd32.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	syscfg32.exe	"Added by the SDBOT.B BACKDOOR!"
X	Configuration Loader	service5.exe	"Added by the GAOBOT.AF WORM!"
X	Configuration Loader	lfass.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	sycfg34.exe	"Added by the GAOBOT.AN WORM!"
X	Configuration Loader	wincrt32.exe	"Added by the GAOBOT.BF WORM!"
X	Configuration Loader	windex.exe	"Added by the GAOBOT.BZ WORM!"
X	Configuration Loader	dosrun32.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Service.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Servicess.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sw32.exe	"Added by the AGOBOT.BQ WORM!"
X	Configuration Loader	System.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Winreg.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sysinfo.exe	"Added by the GAOBOT.FQ WORM!"
X	Configuration Loader	microsoft.exe	"Added by the GAOBOT.JB WORM!"
X	Configuration Loader	confgldr.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	configuration loader	winicfg32.exe	"Added by the GAOBOT.RQ WORM!"
X	Configuration Loader	svhst.exe	"Added by the GAOBOT.YC WORM!"
X	Configuration Loader	msgfix.exe	"Added by the GAOBOT.AUS or SDBOT.J or SDBOT-QG WORMS!"
X	Configuration Loader	msnss.exe	"Added by the GAOBOT.AUS WORM!"
X	Configuration Loader	IEXPL0RE.EXE	"Added by the SDBOT BACKDOOR! Note the number ""0"" in the filename"
X	Configuration Loader	loadcfg32.exe	"Added by the SDBOT BACKDOOR! Note the number ""0"" in the filename"
X	Configuration Loader	MSTasks.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	systemry.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	ccSort.exe	"Added by the AGOBOT.SR WORM!"
X	Configuration Loader	smss32.exe	"Added by the AGOBOT.MB WORM!"
X	Configuration Loader	wincffg.exe	"Added by the AGOBOT.A3 WORM!"
X	Configuration Loader	seru32.exe	"Added by the SDBOT-VR WORM!"
X	Configuration Loader	botss.exe	"Added by the SDBOT-XS WORM!"
X	Configuration Loader	ldasp.exe	"Added by the AGOBOT.BH WORM!"
X	Configuration Loader	msgcfgsrv.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	smsai.exe	"Added by the SDBOT-YE WORM!"
X	Configuration Loader	svupdate.exe	"Added by the RANDEX.DXP WORM!"
X	Configuration Loader	crcss.exe	"Added by the AGOBOT.ADG WORM!"
X	Configuration Loader	lexplore.exe	"Added by the RBOT-AGX WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	Configuration Loader	scvhost.exe	"Added by the AGOBOT-AAE and SDBOT.AR WORMS!"
X	Configuration Loader	svchost.exe	"Added by the PARADROP-A WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Configuration Loader	svchost2.exe	"Added by the AGOBOT.JR WORM!"
X	Configuration Loader	dezi.exe	"Added by the SDBOT-OB WORM!"
X	Configuration Loader	mouse.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	msg.exe	"Added by the SDBOT.BT WORM!"
X	Configuration Loader	WinHelper.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	extrac.exe	"Added by the SDBOT-AFP WORM!"
X	Configuration Loader	DVD-Player.exe	"Added by a variant of the SDBOT WORM!"
X	Configuration Loader	IEXPLORE.EXE	"Added by the SDBOT-KW WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Configuration Loader	wincore.exe	"Added by the SDBOT.BHE WORM!"
X	Configuration Loader	configldr.exe	"Added by the AGOBOT-PP TROJAN!"
X	Configuration Loader	ahnhst.exe	"Added by the AGOBOT.MX WORM!"
X	Configuration Loader	ntdm.exe	"Added by the AGOBOT.RV WORM!"
X	Configuration Loader	msnmsgr.exe	"Added by the SDBOT-SO WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Configuration Loader	svschost.exe	"Added by the SDBOT-NS WORM!"
X	Configuration Loader	wump.exe	"Added by the AGOBOT-BU BACKDOOR!"
X	Configuration Loader	WinSys32ys.exe	"Added by the SDBOT.BCS WORM!"
X	Configuration Loader	cvcd.exe	"Added by the AGOBOT-DH BACKDOOR!"
X	Configuration Loader	asnclt32.exe	"Added by the AGOBOT-EB BACKDOOR!"
X	Configuration Loader	soundconf.exe	"Added by the AGOBOT-MH WORM!"
X	Configuration Loader	win32exec.exe	"Added by the SDBOT-LA WORM!"
X	Configuration Loader	mservs.exe	"Added by the SDBOT-NM WORM!"
X	Configuration Loader	update.exe	"Added by the SDBOT-OS WORM!"
X	Configuration Loader	FILENAME.EXE	"Added by the AGOBOT-DQ WORM!"
X	Configuration Loader	explore.exe	"Added by the GAOBOT.GW WORM!"
X	Configuration Loader	msgfixy.exe	"Added by the SLINBOT.QW BACKDOOR!"
X	Configuration Loader	winfix.exe	"Added by the SDBOT-MA WORM!"
X	Configuration Loader	scvh0st.exe	"Added by the AGOBOT-AX WORM!"
X	Configuration Loader	msrun.exe	"Added by the AGOBOT-Y WORM!"
X	Configuration Loader 2	confuldr.exe	"Added by the AGOBOT-FC WORM!"
X	Configuration Loader Service	Winsys32.exe	"Added by the RBOT-YV WORM!"
X	Configuration Loader Service	devl32.exe	"Added by the SDBOT-XY WORM!"
X	Configuration Loader10	ip7.exe	"Added by the AGOBOT-ANZ WORM!"
X	Configuration Loading	svchos1.exe	"Added by the GAOBOT.DK WORM!"
X	Configuration Loading	configldr.exe	"Added by the AGOBOT-EC WORM!"
X	Configuration Loading Service	wscel.exe	"Added by the SDBOT-WJ WORM!"
X	Configuration Loadr	iexplore.exee	Added by an unidentified WORM or TROJAN!
X	Configuration32 Loader32	winamp32.exe	"Added by the SDBOT-BIC WORM!"
X	ConfLoader	sysconf16.exe	"Added by the SDBOT-FB TROJAN!"
X	ContentDownload	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	CoolDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
N	Corel Photo Downloader	MediaDetect.exe	"Related to Corel Photo Album"
N	CryptLoad	RouterClient.exe	"CryptLoad download manager"
X	CSRSS Loader	csrsss.exe	"Added by the AGOBOT.TX WORM!"
X	CTF Device Loader	ctfmond.exe	"Added by the AGOBOT-FO WORM!"
X	CyDoor	CD_Load.exe	"Adware. Check here for information about Cy-Door and here for a program that can remove it"
X	CydoorUpdate	CD_Load.exe	"Adware. Check here for information about Cy-Door and here for a program that can remove it"
X	DealHelperDown	download.exe	"DealHelper adware"
X	DelayLoad	msprint.exe	"Added by a variant of the Win32.Agent.ryo malware - see here"
X	Device Configuration Loader	msdvc32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Disk Defragmentation Loader	pmsvcr.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Dll Boot Loader on Startup (do not remove this)	[various filenames]	Added by an unidentified TROJAN!
X	DllLoader	lssas.exe	"Added by the BDOOR-JE BACKDOOR!"
X	Dlload	killer.exe	"Added by the KILLAV-FK TROJAN!"
N	dlmMgr	AdobeDownloadManager.exe	"Adobe Download Manager - ""can prevent you from having to start from the beginning should your download process be interrupted
U	DMHotKey	DMLoader.exe	HotKey access to the Samsung Display Manager on laptops and ultra-mobiles that support it - such as the M55 and Q1
X	dmloader	dmloader.exe	"Added by a variant of the RBOT WORM!"
X	Dos Prompt Loader	cygwin.exe	"Added by the SDBOT-VV WORM!"
N	Download Accelerator Manager Free Edition	dam.exe	"Download Accelerator Manager Free Edition from Tensons Corp"
N	Download Accelerator Plus 5.0	DAP.exe	"Download Accelerator Plus from Speedbit. Download manager for resuming downloads
X	Download Plus	DownloadPlus.exe	"DownloadPlus adware"
N	Download Wonder	DownloadWonder.exe	"Download Wonder from Forty Software. Download manager for resuming downloads
N	DownloadAccelerator	DAP.EXE	"Download Accelerator Plus from Speedbit. Download manager for resuming downloads
X	DownloadLegalMusic	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	DownloadMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	DownloadsAndMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	DownloadWare	dw.exe	"DownloadWare adware"
X	DownloadWare Engine	Dwe.exe	"DownloadWare adware"
Y	DPCProxyLoadOnStartup	dpcstart.exe	"DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access"
X	DriverLoad	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	DxLoad	DX3DRndr.exe	"Added by the GIBE.B WORM!"
X	Dynamic Link Library loader	Loader32.exe	"Added by the KOL TROJAN!"
X	Eac Download	download.exe	"Webcelerator from eAcceleration speeds your Web browsing by both remembering where you have been and anticipating where you will go. Only needed if you find it improves web browsing. Now no longer available and supported and when available was classed as spyware - see here"
N	eBot	DownloadWizard.exe	"eBot from Digital River - ""helps ensure your computer always has the latest technology
U	eDataSecurity Loader	eDSloader.exe	"Part of Acer Empowering Technology. ""Acer eDataSecurity Management is a handy file encryption utility that protects files from being accessed by unauthorized persons
N	EDLoader	DTLoader.exe	Effective Desktop from MiniStars Software - desktop management software no longer being supported
X	Explorer Loader	explr32.exe	"Added by the AGOBOT.N WORM!"
X	Explorer Loader	explorerl.exe	"Added by the SDBOT-ADI WORM!"
X	FastDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	Firefox Preloader	FirefoxPreloader.exe	"Firefox Preloader - ""a utility that is designed to load parts of Mozilla Firefox into memory before it is used to improve the its startup time"". Even on fast machines Firefox can take a while to load"
X	Flashget Download Manager	Flashget.exe	"Added by the RBOT-AGZ WORM!"
X	FontsLoader	ldfnt32.hta	Unidentified malware
Y	FP Loader	loadfp.exe	"FoolProof Security - PC security software from SmartStuff"
N	Free Download Manager	fdm.exe	"""Free Download Manager"" - see here"
?	Free Downloads Monitor	fdcmon.exe	"??"
X	FreeMP3download	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	FX	ieloader.exe	Added by the SMALL.RR TROJAN!
X	GenericHostXP	WinLoaderXP.exe	"Added by the BDOOR-ACX BACKDOOR!"
X	Go!Zilla Monster Downloads	Go.exe	Download manager for resuming downloads and choosing multiple download locations. Advertising spyware
X	Graphic Loader	ntvdm32.exe	"Added by a variant of the RBOT WORM!"
U	Gravis Appawareloader	dbserver.exe	"Looks like it's associated with Gravis game controllers and the Keyset Manager
X	GreatDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Highspeeddownloader	SetupClickHere.EXE	"Homepage hijacker
U	IBMUltraBayHotSwapCPLLoader	IBMBAY2N.EXE	Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops
X	iConfigLoader	DIIhost.exe	"Added by the GAOBOT.AO WORM!"
X	IDE Loader	IDElibr32.exe	"Added by the XILON TROJAN! Related to the game ""Diablo II"""
X	IELoader32	iexplore32.exe	"Added by the SPEX or SPEX.B WORMS!"
X	IMAPI	load.exe	"Added by the DOWNDEL-A TROJAN!"
U	Internet Download Accelerator	ida.exe	"Internet Download Accelerator download manager"
X	Internet download manager service	idman.exe	"Added by the RBOT-BMS WORM!"
X	Internet Loader1	MSInstall61.exe	"Added by the KWBOT.B WORM!"
X	Internet Protocol Configuration Loader	ipcl32.exe	"Added by the SDBOT TROJAN!"
X	Inters Configuration Loader	RCL0ADERS.exe	"Added by the SDBOT-KX WORM!"
X	Iomega_loader	Iomega_loader.exe	"Added by the ANTINNY.F WORM!"
X	Java32 Configuration Loader	msnmesgr.exe	"Added by a variant of the RBOT WORM!"
X	Kazaa Download Accelerator Updater (required)	regsvr32 kdp***.dll [ = random char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	Kernel Loader	ntkrnl.exe	"Added by the CERVIVEC.A WORM!"
Y	Keyboard Preload Check	Preload.exe	Millenium Multi-Function Keyboard driver
X	KHATARNAK Loader	KHATARNAK.exe	"Added by the AUTORUN.ACO WORM!"
U	KK Loader	loadkk.exe	"KeyKey XP Professional from KeyKey.com. "Monitor Instant Messages
N	Kodak Picture Easy . Batch Transfer	PezDownload.exe	"Part of ""Kodak Picture Easy"" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC. . represents the version"
X	KTAX Auto Loader	ktax.exe	"Added by the SDBOT-MZ WORM!"
U	Lightning Download	Lightning.exe	"Lightning Download from Headlight Software - shareware download manager for resuming downloads. Start it manually unless you want to intercept download links from your browser"
?	live rdr	loadloud.exe	"??"
X	load	mdm.exe	"Added by the BINGHE TROJAN! Note - this is not the legitimate Machine Debug Manager (mdm.exe) process which is located in %ProgramFiles%\Common Files\Microsoft Shared\VS7Debug (98/Me/XP/Vista) or C:\WINDOWS\SYSTEM (Me only)"
X	load	msgsr32.exe	"Added by the SDBOT-QR WORM!"
X	load	[path to worm]	"Added by the KELVIR.AI WORM!"
X	Load	MyGame.exe	"Added by the LAMEYEAR-A WORM!"
X	load	_Kerne1.exe	"Added by the LINEAGE-AN TROJAN!"
X	load	Internat.exe	"Added by the WOWCRAFT TROJAN!"
X	load	rundll32.exe	"Added by the WOWCRAFT TROJAN!"
X	load	svhost32.exe	"Added by the WOWCRAFT TROJAN!"
X	load	svchsot.exe	"Added by the GWGHOST-O TROJAN!"
X	load	explorer.exe	"Added by the LINEAGE-OZ TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	load	Kerne121.exe	"Added by the LINEAGE-ON TROJAN!"
X	load	Kerne1211.exe	"Added by the LINEAGE-DY TROJAN!"
X	load	rundl132.exe	"Added by the LOOKED-CK WORM!"
X	load	ctftpscr32.exe	"Added by the AGENT-FPN TROJAN!"
X	Load	win32.exe	"Added by the RUBBLE-A WORM!"
X	load	QQ.exe	"Added by the QUADRULE.A WORM! Note - this is not the Tencent QQ Asian instant messanger program which is located in %Windir%"
X	load	WinExplorer.exe	"Added by the VB.EIW WORM!"
X	load	Systemfile.dll.vbs	"Added by an unidentified WORM or TROJAN! See here"
X	load	KHATRA.exe	"Added by the ORBINA-A WORM!"
X	Load Service	SvHost.exe	"Added by the PESIN-D WORM!"
U	LOAD WB	LOADWB.EXE	"Part of Stardock's WindowBlinds custom desktop program. "WindowBlinds is the first utility of its kind. It extends Win98/NT/2K/XP to have a fully skinnable user interface. You can change the style of title bars
X	Load-Guard	Wscript.exe LGuarg.exe.vbs	"Added by the YENO.B and YENO.C WORMS! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""LGuarg.exe.vbs"" file is located in %Windir%"
X	LOAD32	Lorena.exe	"Added by the MAPSON.C WORM!"
X	load32	load32.exe	"Added by the NIBU
X	load32	l32x.exe	"Added by the DUMARU.Z or DUMARU.Y or DUMARU.AD WORM!"
X	load32	1111a.exe	"Added by the DUMARU.AH WORM!"
X	load32	swchost.exe	"Added by the TURTA.A WORM!"
X	load32	netda.exe	"Added by the NIBU.E TROJAN!"
X	load32	winldra.exe	"Added by the NIBU.J BACKDOOR or DUMARU-BI TROJAN! Note - also known as Srv.SSA-KeyLogger by Sunbelt Software which has developed a free removal tool for this keylogger"
N	load=	adw30.exe	After Dark for Windows - screen saver program. Popular before screen savers were integrated into Win95
U	load=	asistat.exe	Status monitor for an NEC SuperScript printer
?	load=	cfgsys32.exe	"??"
U	load=	esspk.exe	"Speakerphone capability through a soundcard for an ESS modem"
Y	load=	hotkey.exe	Solo 5300 display driver for Win2K on some Gateway laptops
N	load=	HPWHRC.EXE	Loads the Status Window software for the HP Laserjet printers
?	load=	WPSLOAD.EXE	"Windows printing system that comes with the setup for Canon BJC series on the manufacturer's disk"
N	load=	vi_grm.exe	Monitor drivers for Trio2x/3x based video cards - displays control panel for quick access to display settings
?	load=	WINOSCFG.EXE	"Could it be something to do with configuring Windows on a new PC from an OEM supplier?"
Y	load=	wpshrc.exe	Required to prevent configuration errors on a Compaq LBP-660 and LBP-460 parallel port laser printers (and maybe others)
Y	load=	Bfrecv.exe	Bitware modem driver
X	load=	msater.exe	"Added by the RETSAM TROJAN!"
X	load=	shambl3r.exe	"Added by the REMABL WORM!"
X	load=	Spoolsv.exe	"Added by the CIADOOR.B TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %Windir%"
?	Load=	wtfeat.exe	"Associated with the Wintab Digitizer"
Y	load=	AICLIENT.EXE	"Asset Insight from Tangram - asset managing software. Required if an organisation is running a centrally administered asset management system"
X	load=	hint.exe	"Added by the ATAK WORM!"
X	load=	win32exec.exe	"Added by the BITTER WORM!"
X	load=	a1g.exe	"Added by the ATAK.B WORM!"
X	load=	dapdll.exe	"Added by the ATAK.E WORM!"
X	load=	svhost32.exe	"Added by the LINEAGE-AB TROJAN!"
Y	load=	01comm32.exe	"Related to Elsa CommPro (Communicate Pro) access software for Microlink modems - this software contains answering machine and fax functions
X	load=	inetinfo.exe	"Added by the PROXY-GG TROJAN!"
X	load=	Kerne14.exe	"Added by the LINEAGE-BA TROJAN!"
X	Loadab1	explorer.exe	"Added by the LINEAGE-AJ TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %ProgramFiles%"
Y	LoadBlackD	blackd.exe	"""Intrusion detection system"" of the BlackICE PC Protection (was Defender) firewall which loads independently of the ""user interface"" (BlackICE Utility). BlackICE was supported by IBM Internet Security Systems (formerly just ISS) when them acquired the NetworkICE parent but is no longer available. Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
U	LoadBtnHnd	BtnHnd.exe	Fujitsu Siemens Lifebook laptops have some buttons on the case that can be programmed to execute specified programs (like hotkeys). The buttons can also be used as a combination lock input
X	LoadDBackUp	BcTool.exe	"Added by the GIBE WORM!"
X	loaddll	loaddll.exe	"Winvest spyware"
X	loaddr	[path to trojan]	"Added by the AGENT-DIY TROJAN!"
Y	LoadDvpApi9x	DVPAPI9X.exe	Command AntiVirus for Windows 95/98/Me
X	loader	loader.exe	"Homepage hijacker
X	loader	WMPLAYER.EXE	Unknown baddie - WMPLAYER.EXE is stored in the location and uses the same name as Windows Media Player but that valid Windows program doesn't load at startup
X	loader32	sys***.exe [*** = random digit]	"Added by the DOMCOM TROJAN!"
X	loader32	Loader32.exe	Added by an unidentified TROJAN!
X	Loaders	HeIp.exe	"Added by the SDBOT-ADB WORM!"
X	loadfax	loadfax.exe	"Added by the WINFLUX-C TROJAN!"
X	LoadFonts	LoadFonts.vbs	Homepage hijacker that changes your homepage to an adult content site
X	LoadFonts	Tahoma.vbs	Homepage hijacker that changes your homepage to an adult content site
U	LoadFujitsuQuickTouch	QuickTouch.exe	Maps the keys on a Fujitsu Siemens Lifebook application panel to various programs and functions
X	LoadGolfCourses	LoadGolfCourses.exe	PlayMiniGolf.com foistware - stealth installed!
X	Loadhg	rundll32.exe	"Added by the LINEAG-ABX TROJAN!"
X	LoadHTML	"rundll32.exe regsvr32.exe	MShtmpre"
X	LoadingAgent	ZipLoader32.exe	"Added by the OBLIVION TROJAN! This executable is one of the most common but there are more"
X	LoadingAgent	msload32.exe	"Added by the OBLIVION TROJAN! This executable is one of the most common but there are more"
X	LoadManager	msload.exe	"Added by the OPASERV.T WORM!"
X	loadMecq0	explorer.exe	"Added by the MUMUBOY.C TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %ProgramFiles%"
X	loadMecq3	rundll32.exe	"Added by the LEGMIR-AS TROJAN! Note - this is not the legitimate rundll32.exe process
X	loadMect1	explorer.exe	"Added by the LINEAGE-L TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %ProgramFiles%"
X	loadMefs	rundll32.exe	"Added by the LEGMIR-JB TROJAN! Note - this is not the legitimate rundll32.exe process
X	loadMefs	smss32.exe	"Added by the FLOOD-EL TROJAN!"
N	LoadMSvcmm	msvcmm32.exe	"Auto-update for Movielink - internet movie rental System Tray access"
X	LoadOrderVerification	[random filename]	"Added by the TRON.A TROJAN!"
U	Loadout Manager	nost_LM.exe	"Manager for the Belkin Nostromo n50 SpeedPad game controller - see here"
X	LoadPFW	wmimgr.exe	"Added by the QEDS-B WORM!"
X	LoadPowerProfile	ASDAPI.EXE	"Added by the CABRO TROJAN! Not to be confused with the valid LoadPowerProfile entry where the command is Rundll32.exe powrprof.dll"
U	LoadPowerProfile	Rundll32.exe powrprof.dll	"Power management specifics such as monitor shut-off
X	LoadPowerProfile	Rundll.exe powerprof.dll	"Added by the LOXOSCAM TROJAN! Note - do not confuse with the valid LoadPowerProfile entry! Notice that the infected version uses ""Rundll.exe"" whereas the uninfected version uses ""Rundll32.exe"""
X	LoadPowerProfile	rundl.exe	"Added by the TOFAZZOL TROJAN! Not to be confused with the valid LoadPowerProfile entry where the command is Rundll32.exe powrprof.dll"
X	LoadPowerProfile	Rundll32.exe	"Added by the MIROOT WORM! Note - do not confuse with the valid LoadPowerProfile entry which has ""powrprof.dll"" appended to the command/data line"
X	LoadPowerScheme	rundll32.exe powerprof.dll CheckPowerProfile	"Ulubione adult content dialer. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
U	LoadQM	loadqm.exe	"Installed with MSN Explorer and loads the MSN Queue Manager. Required to enable the WU AutoUpdate feature. Note that disabling this can sometimes prevent internet sharing working on Win2K Pro SP2. Reports also suggest that removing it will re-enable internet access - hence the ""users choice"" recommendation. If you have problems leave it
X	loads.exe	loads.exe	"MediaMotor adware"
X	loads.exe	medload.exe	"Medload adware"
X	loads.exe	suploads.exe	"Added by the AGENT-BZ TROJAN!"
X	LoadService	Rest In Peace	"Added by the KANGAROO-A WORM!"
X	LoadService	"Maaf	tempatmu bukan di sin"
X	LoadService	Virus	"Added by the CAGER.A WORM!"
X	LoadSIPS	"rundll32.exe SIPSPI32.dll	SIPSPI32"
?	LoadWatcher	Test.exe	"Reportedly part of a webcam surveillance program that's supposed to test SMTP dialling in the event of an alert? Is this correct?"
X	LoadWatcher	watcher.exe	"Watcher spyware"
X	loadwin	winset.exe	"Added by the QQPASS-I TROJAN!"
X	loadwin	winsys.exe	"Added by the QQPASS-J TROJAN!"
X	LoadWindowsFile	Kernel32.exe	"Added by the DELF.B TROJAN!"
X	LoadWindowsFile	winreg.exe	"Added by the HUPIGON.A BACKDOOR!"
U	Logon Loader	LogonLoader.exe	"Logon Loader - customize boot & login screens"
U	Logon Loader Random	LogonLoader.exe	"Logon Loader - customize boot & login screens"
X	MainDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Major Microsoft Windows Driver Boot loader	bpool.exe	"Added by the MYTOB.AJ WORM!"
X	MCAFFE FLD LOADER	MCAFFEFLD.EXE	"Added by the RBOT-PY WORM!"
X	Media Load	msn32.exe	Added by a unidentified WORM or TROJAN!
X	MediaLoads	dw.exe	"Medialoads adware"
X	MediaLoads Installer	dw.exe	"Medialoads adware"
X	MediaPipe P2P Loader	mpp2pl.exe	"MediaPipe peer-to-peer file swapping program also reported as a hijacker"
X	MEMreaload	MEMreaload.exe	"Added by the LAZAR TROJAN!"
N	microAttuneDownload	atmdlusr.exe	"Application Launcher
X	MicroLoad	[random filename]	"Added by the DARBY WORM!"
X	Microsoft (R) Windows DLL Loader	rundll32.exe	"Added by the RANKY.W TROJAN! Note - this is not the legitimate rundll32.exe process
X	Microsoft Config Loader	msconfig32.exe	"Added by the AGOBOT.XX WORM!"
X	Microsoft Config Loader	msrun32.exe	"Added by the AGOBOT-DY WORM!"
X	Microsoft Config Loader	msconf32.exe	"Added by a variant of the RBOT WORM!"
U	Microsoft CTF Loader	ctfmon.exe	"Supports multiple languages and alternative method inputs in Windows and MS Office. The language bar is displayed alongside the System Tray if more than one keyboard layout is enabled (for switching input languages) or
X	Microsoft Update Loader	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Loaders 2005	winusers.exe	"Added by the RBOT-AIQ WORM!"
X	Microsoft Update Loaders 2006	winusersystem32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Windows Files Loader	cgy32win.exe	"Added by the RBOT-AXR WORM!"
X	Microsoft Windows Loader	wloader.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Windows XP Configuration Loader	m32svco.exe	"Added by the SDBOT.WORM!.48548 WORM!"
X	Microsoft Xp Systems loader	winsystem32xp.exe	"Added by the KELVIR.W WORM!"
X	Microsoft Xp Systems loaders	win32xpsys.exe	"Added by the SPYBOT.NYT WORM!"
X	Microsoftvirus	sysoverload.exe	"Added by the FORBOT-AL WORM!"
X	mload	lxmstart.exe	"Added by an unidentified VIRUS
X	Mp3 Loader	Sysdata.EXE	"Added by the AVETTE-A VIRUS!"
X	MP3download	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3freeDownload	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3freeDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MS Autoloader 32	MSAuto32.exe	"Added by the SPYBOT.BD WORM!"
X	MS Config Loader	svchos1.exe	"Added by the AGOBOT.R WORM!"
X	MS Config Loader	MSWin32bck.exe	"Added by the GAOBOT.AA WORM!"
X	MS Config Loader	svcrhost.exe	"Added by a variant of the RBOT WORM!"
X	MS Config Service	Msloader32.exe	"Added by the RBOT-KJ WORM!"
X	Ms Valud Loader	Svhots.exe	"Added by the AGOBOT-SP WORM!"
X	Msn Configuration Loader	msngms.exe	"Added by the KELVIR.T WORM!"
X	MSN Configuration Loader	msmsncfg.exe	"Added by the AGOBOT-KX BACKDOOR!"
X	MSN Message Background loader	[path to worm]	"Added by the RBOT-AIE WORM!"
X	MSN Messenger Inbox Loader	msninbox.exe	"Added by the SLENFBOT.YG WORM!"
X	MSN Registry loader	msmnwin.exe	"Added by the KELVIR.FK WORM!"
X	msnload32.exe	msnload32.exe	"Added by the BANCOS.M TROJAN!"
X	msReg32 Loader	msreg32.exe	"Added by the AGOBOT.IU WORM!"
X	msvccc66	dload.exe	"Added by a variant of the RBOT WORM!"
X	msvload32	msvload32.exe	"Added by the RBOT-ACI WORM!"
X	mswspl	vnmispoisn downloader.exe	SearchBarCash adware variant
U	MXO Auto Loader	MXOaldr.exe	Maxtor includes a driver to bypass the Windows certified drivers check just when it detects an external drive. MXOaldr.exe is installed with the new driver and if disabled the button on a Maxtor OneTouch External Store no longer functions
N	NavLoad	NAVBrowser.exe	Registration reminder for CorelDRAW 10
X	NBInstall	MBDownloader_876919.exe	"Added by the MIRAR_D TROJAN!"
X	NeroLoader	NeroLoader.exe	"Added by the BANCBAN-EJ TROJAN!"
X	Netzip Smart Downloader	npnzdad.exe	Advertising spyware
X	NewDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	NiceDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
?	Norton AV Preload	Premend.exe	"Norton Antivirus related. What does it do and is it required"
N	Norton Navigator Loader	nnloader.exe	"An older Norton utility for file management under Windows 95. More information here"
X	notepad	"rundll32.exe ntload.dll	_IWMPEvents@0"
X	NT Windows System Manager Loader	csrlss.exe	"Added by the AGOBOT.OX WORM!"
X	NTmessageSystem	loadnewmessage.exe	"Added by the HIDAGENT-B WORM!"
X	nviload32	nviload32.exe	"Added by the SDBOT-VT WORM!"
X	Oeloader	Oeloader.exe	"Xupiter OrbitExplorer toolbar related. Drive-by foistware. Use Spybot S&D
X	OleLoader	ole32.exe	Added by the DELF.BR TROJAN!
X	OS Boot Load	bootload.exe	"Added by a variant of the IRCBOT TROJAN!"
U	Password Door Loader	PDMonitor.exe	"Password Door - password protection software"
N	Photo Loader supervisory	Plauto.exe	"Casio's Photo Loader software. Hook up your camera to the USB port
?	PLoader	umsd.exe	"USB Mass Storage Disk related tray icon. Is it required?"
U	Praize Messenger	itLoad.exe	"Praize IM Christian chat instant messenger"
Y	Preload	Preload.exe	Millenium Multi-Function Keyboard driver
N	preload	RUNXMLPL.exe	Software found on Acer computers from Wistron. Information suggests it maps keyboard buttons to operating system functions
?	PreloadApp	hphprld.exe	"HP PhotoSmart printers related. What does it do and is it required?"
N	ProdikeysAutorun	Prodload.exe	"Creative Prodikeys software - 'an interactive music entertainment device which not only functions as a full-featured
X	psaload32	psaload32.exe	"Added by the RBOT-ADL WORM!"
U	Qoeloader	Qoeloader.exe	"Qurb 2.0 anti-spam tool for Outlook/Outlook Express. Required when supporting OE but not for Outlook. Shortcut available via Start -> Programs"
X	rawload	[path to trojan]	"Added by the DARKIRC.QZ TROJAN!"
N	RealDownload	RealPlay.exe	Download manager. Available via Start -> Programs
X	RealDownload Express	npnzdad.exe	Advertising spyware
X	Registry Loader	regloadr.exe	"Added by the GAOBOT.AO WORM!"
X	Registry Loader	winhlpp32.exe	"Added by the GAOBOT.AO WORM!"
X	reg_key	loader_name.exe	"Added by the BEAGLE.Y or BEAGLE.Z or BEAGLE.AA WORMS!"
X	reload	reload.vbs	"Added by the LOVELETTER.AS VIRUS!"
X	Reload	reload.exe	"Added by the LAZAR TROJAN!"
X	RUNLOAD	l0ad.exe	"PurityScan/Clickspring adware"
?	RUSBHOLoader	"rundll32.exe RUSBHOLoader.dll	AutoRegister"
X	scvhost loader	ixplore.exe	"Added by the SDBOT-CY TROJAN!"
X	searchbar	vnmispoisn downloader.exe	SearchBarCash adware variant
X	Services DLL Loader	srvdll.exe	"Added by the SLENFBOT.ZS WORM!"
X	ServicesLoad	lsass.exe	"Added by the DEARIS-A TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	sload	sload.exe	"Win SynchroAd adware
X	sload	sload32.exe	"Added by the SDBOT-OY WORM!"
N	SMSI Loader	SMLoader.exe	"Smith Micro HotFax - fax software"
X	SMSSS Loader	smsss.exe	"Added by the AGOBOT.MQ WORM!"
X	Sound Loader	sndloader.exe	"Added by the AGOBOT-BV WORM!"
X	Spool Loader	spool.exe	"Added by a variant of the RBOT WORM!"
X	Spool LoadKIt	spoolv.exe	"Added by a variant of the RBOT WORM!"
X	start uploading	smsss.exe	"Added by a variant of the SDBOT WORM!"
X	start uploading	crsss.exe	"Added by the RBOT-SZ WORM!"
X	StartReplySystem	loadnewmessage.exe	"Added by the HIDAGENT-B WORM!"
X	StartupOption	loadsysdisk.exe	"Added by the HIDAGENT-B WORM!"
X	statloads	pgjd83sa.exe	"Added by the SDBOT-UM WORM!"
X	stcloader	stcloader.exe	"SecondThought adware"
N	Streamload Downloader	SlDB.exe	"Downloader for MediaMax (was Streamload) - ""gives you a private and secure place to upload
N	Streamload Uploader	StreamMgr.exe	"Uploader for MediaMax (was Streamload) - ""gives you a private and secure place to upload
X	Svhost Loader	svshost.exe	"Added by the AGOBOT.G WORM!"
X	sviload32	sviload32.exe	"Added by the RBOT-AAS WORM!"
X	svnloader	svnload32.exe	"Added by the RBOT-ACU WORM!"
X	Svost Loader	svost.exe	"Added by the SDBOT.G BACKDOOR!"
Y	Sweep95	ICLOAD95.EXE	"Part of Sophos ant-virus sofware"
X	Symantec Configuration Loader	ccApp32.exe	"Added by the AGOBOT-EE WORM!"
X	System Boot Check	sysload3.exe	"Added by the FUBALCA WORM!"
X	System Boot Loader	sysboot32.exe	"Added by the SDBOT.PG WORM!"
X	System Config	sysloadcnf.exe	"Added by a variant of the SDBOT WORM! See here"
X	System Download Manager	SysMgr.exe	"Added by the RBOT.CIG WORM!"
X	System Initialization	payload.dat	"Added by the RANDEX.D WORM or ROXY or ROXY.B TROJANS!"
X	System Loader	systems.exe	"Added by the AGOGBOT-FI WORM!"
X	System Loader	syscfg.exe	"Added by the AGOBOT-BS BACKDOOR!"
X	System Loaderap	syst19b.exe	"Added by the AGOBOT-AT BACKDOOR!"
X	SystemDriverLoad	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	SystemLoad32	sysload32.exe	"Added by the MIMAIL.E WORM!"
X	SystemLoader	sysldr32.exe	"Added by the DOWNLDR-NS TROJAN!"
X	SystemTasks	loaded.exe	Adult content dialler
X	Task Loader	{rdprM@Y_VO^	"Added by the AGOBOT.CB WORM!"
X	TaskManager Load Module	TSKMNGR32.EXE	"Added by the SPYBOT.I WORM!"
X	The Service Pack Loader	spxp.exe	"Added by the RBOT-BYM WORM!"
U	TPP Auto Loader	Tppaldr.exe	"Installed with DataStor's (and some other manufacturers) USB 2.0 based external DVD
N	Turbine Download Manager Tray Icon	TurbineDownloadManagerIcon.exe	"Turbine Download Manager (TDM) - download manager associated with the game ""The Lord of the Rings Online™"""
?	UpdateFW	fwdload.exe	"Appears to be firmware update software for a Network Associates ATMbook OC-3 SMF Interface Module?"
X	updater32	winload32.exe	"Added by the CULT.M WORM!"
N	UVS10 Preload	uvPL.exe	Part of older versions of the Ulead (now Corel) VideoStudio video editing and DVD authoring software. Unless you use VideoStudio daily and find this speeds up the time it takes to open files associated with the program you shouldn't need this
N	UVS11 Preload	uvPL.exe	Part of older versions of the Ulead (now Corel) VideoStudio video editing and DVD authoring software. Unless you use VideoStudio daily and find this speeds up the time it takes to open files associated with the program you shouldn't need this
N	UVS12 Preload	uvPL.exe	Part of older versions of the Ulead (now Corel) VideoStudio video editing and DVD authoring software. Unless you use VideoStudio daily and find this speeds up the time it takes to open files associated with the program you shouldn't need this
X	Vital Load Process	Spoolsvr.exe	"Added by the RBOT.AIF WORM!"
X	vnmispoisn downloader	vnmispoisn downloader.exe	SearchBarCash adware variant
X	W32Load	[random filename].scr	"Added by the CASPID WORM!"
X	W32PluginsDownloaderXMLHTTPSelfClearing7520	wiper.exe	"Added by the PROXYSER-M TROJAN!"
N	WaveTop Upload Manager	N/A	"WaveTop - ""Get push content from TV without an Internet connection"" - now possibly a defunct system in the US included as an optional part of WebTV in Win98"
X	Wifi Loader	wifiload.exe	"Added by the IRCBOT.XEL BACKDOOR!"
X	Wifi Loader!	wifiloader.exe	"Added by the IRCBOT.XES BACKDOOR!"
X	Win TaskLoader	msgmr.exe	"Added by the MYTOB.L WORM!"
X	Win32 Device Loader	Win32ldr.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Win32 Rundll Loader	Rundll32.exe	"Added by the SDBOT.A TROJAN! Note - this is not to be confused with the legitimate rundll32.exe file!"
X	win32 security updates downloader	tskmngr.exe	"Added by a variant of the SDBOT WORM! See here"
X	Win32.Trojan.Downloader	netstat2.exe	"Added by the PAINTER TROJAN!"
X	win32servv	load.exe	"iSearch adware"
X	Win64 Compatibility Check	load win64.drv	"CoolWebSearch parasite variant"
X	Window Loader	Dos32.exe	"Added by the GAOBOT.AO WORM!"
U	WindowBlinds	wbload.exe	"WindowBlinds from Stardock. Skin application to change the appearence on Windows desktops. Available as an individual download or as part of Object Desktop. Required to restore settings if you use it. Available via right-click on the Desktop -> Properties -> Skins"
U	WindowFX	wfxload.exe	"Stardock WindowFX - ""Allows you to add an unprecedented number of special effects to windows"""
X	Windows Autostart Loader	notepad32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Config Loader	Wincfg32.exe	"Added by the SILVERFTP TROJAN!"
X	Windows Configuration Loader	asclt.exe	"Added by the SDBOT-OA WORM!"
X	Windows Configuration Loader	msgfix.exe	"Added by the SDBOT-NP WORM!"
X	Windows DDE Loader	windde32.exe	"Added by the SDBOT-UZ WORM!"
X	Windows DLL Loader	RUNDLL16.EXE	"Added by the DOMWIS TROJAN!"
X	Windows DLL Loader	defragfat32z.exe	"Added by the LINKBOT.A WORM!"
X	Windows DLL Loader	rundll32.exe	"Added by the WHIPSER-B WORM! Note - this is not the legitimate rundll32.exe process"
X	Windows DLL Loader	defragfat32pi.exe	"Added by the RBOT-QQ WORM!"
X	Windows DLL Loader	defragfat39.exe	"Added by the POEBOT-C WORM!"
X	Windows DLL Loader	defragfatz.exe	"Added by the LINKBOT.H WORM!"
X	Windows DLL Loader	defragfat32.exe	"Added by the SDBOT-SS WORM!"
X	Windows DLL Loader	defragfat32abc.exe	"Added by the RBOT-RG WORM!"
X	Windows DLL Loader	wdevice.exe	"Added by a variant of the SDBOT WORM!"
X	Windows DLL Loader	SYSCFG16.EXE	"Added by the DOMWIS-N WORM!"
X	Windows DLL Loader	WINCFG32.EXE	"Added by the AGOBOT-TE WORM!"
X	Windows DLL Loader	defragfatx.exe	"Added by the POEBOT-F WORM!"
X	Windows Download Manager	windlmngr.exe	Added by an unidentified TROJAN!
X	Windows Dynamic Loading Header	winDLL32.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Graphics Loaders	wingraphics.exe	"Added by the SPYBOT.JG WORM!"
?	Windows Load	windows.com	"??"
X	Windows Loader	wstart32.exe	"Added by the GAOBOT.CA WORM!"
X	Windows Loader	winServices.pif	"Detected by Kaspersky as the CARDSPY.D TROJAN!"
X	Windows Loader	SysUpdate.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Loader Service	civsc.exe	"Added by a variant of the RBOT WORM!"
X	windows Loadxm	Win_.exe	"Added by the FODDER-A TROJAN!"
X	Windows Media Loader	wmloader.exe	"Added by a variant of the GAOBOT WORM!"
X	Windows Registry Express Loader	regexpress.exe	"Added by the FORBOT-CJ WORM!"
X	Windows Secure Update	load.exe	"Added by the FORBOT-GU WORM!"
X	Windows Service Loader	Window.exe	"Added by the RBOT-XO WORM!"
X	Windows Shell Library Loader	load shell.dll	"CoolWebSearch parasite variant"
X	Windows SP2 Version Load	wuauclt32.exe	"Added by the GAOBOT.CX WORM!"
X	Windows Subsys	winload.exe	"Added by the NETSPREE.C WORM!"
X	WINDOWS SYSTEM FILE	winload.exe	"Added by the MYTOB.DK WORM!"
X	Windows System Manager Loader	smsls.exe	"Added by the AGOBOT.TF WORM!"
X	WINDOWS SYSTEM MEMORY LOADER	memloader.exe	"Added by the MYTOB-IN WORM!"
X	Windows Update	Winload.exe	"Added by the DEDMIR-A WORM!"
X	Windows update loader	xpupdate.exe	"Malware installed by different rogue security software including SpyKillerPro. Also detected as the BRAVE-A TROJAN!"
X	Windows32 Configuration Loader	msrf32.exe	"Added by the SDBOT-ABX WORM!"
X	WindowsFZ	zloader3.exe	"Variant of the SmitFraud alias FAKEALE-C TROJAN!"
X	Windws Configuration Loader	LEXPLORE.exe	"Added by the SODABOT WORM!"
U	Winfast2KLoadDefault	"rundll32.exe wf2kcpl.dll	DllLoadDefaultSettings"
U	WinLoad	Winload.exe	"PCTattletale is a surveillance software program that monitors user activity
X	winload	winload.exe	"Added by the AGENT-GNY TROJAN! Note - the file is located in %ProgramFiles%\Internet Explorer"
X	WinLoader	[random filename]	"Added by variants of the SUBSEVEN TROJAN!"
X	winnload	winnload.COM	"Added by the DOWNLD-ABG TROJAN!"
X	Wins Loader5	Gadu-Gadu.exe	"Added by a variant of the IRCBOT TROJAN! Note - doe not confuse with the Polish language Instant Messaging client also called Gadu-Gadu"
X	Winsk system Loader	winsk.exe	"Added by the AGOBOT-IZ WORM!"
X	Winsock2 Loader	WICONF.EXE	"Added by the SDBOT-LA WORM!"
N	Wintime Wtxpload	Wxpload.exe Wintime	"Part of the software to support a Dexxa USB graphics tablet. From a visitor - "This gets started anyway when you plug in the USB connector for the graphics tablet
X	WinUpdate Loader	msnnm.exe	"Added by the REVCUSS.C TROJAN!"
U	WinXPLoad	"Rundll32 LoadDll	LoadExe WinXPLoad.exe"
X	xload	[path to trojan]	"Added by the VB-AGP TROJAN!"
X	xload32	netdd.exe	"Added by the NETSPY TROJAN!"
X	xloadnet	xloadnet.exe	Added by the VB.NCK TROJAN!
X	XP Loader	loaderxp.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
?	XTCsgloader	XTCsgloader.exe	"Another Xupiter toolbar variant??"
X	XupiterCfgLoader	XTCfgLoader.exe	"Xupiter - adware and homepage hijacker. Use Spybot S&D
X	XupiterCfgLoader	BWCfgLoader.exe	"Xupiter - adware and homepage hijacker. Use Spybot S&D
X	XupiterToolbarLoader	XupiterToolbarLoader.exe	"Xupiter - adware and homepage hijacker. Use Spybot S&D
X	Zip Driver Loader	ZipLoader32.exe	"Added by the OBLIVION TROJAN! This executable is one of the most common but there are more"
X	Zip Driver Loader	msload32.exe	"Added by the OBLIVION TROJAN! This executable is one of the most common but there are more"
X	[random characters]	securewinload32x.exe	"Added by the OPTIXP-N TROJAN!"
X	[random name]	CXTPLS_LOADER.EXE	"AproposMedia adware"
X	[Randomly chosen existing folder name]	_loader.exe	"Added by the ANTINNY-L WORM!"
X	[various names]	runload32.exe	"Wareout - malware masquerading as a spyware and dialer remover"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.