NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

• "Y" - Normally leave to run at start-up
• "N" - Not required - typically infrequently used tasks that can be started manually if necessary
• "U" - User's choice - depends whether a user deems it necessary
• "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
• "?" - Unknown

Fatal error: Maximum execution time of 30 seconds exceeded in /home/iamnotag/domains/iamnotageek.com/public_html/startup/search.php on line 252

	Startup Name	Process Name	Details
X		ne.exe	"Added by the IRCBOT-ZL TROJAN! Note - has a blank entry under the Startup Item/Name field"
	Note the filename has a ""0"" rather than an upper case ""o"""
Y	!1_pgaccount	pgaccount.exe	"DiamondCS ProcessGuard security software - stops malicious worms and trojans from being executed silently in the background
Y	!AVG Anti-Spyware	avgas.exe	"System Tray access to and notifications for AVG Anti-Spyware 7.5. This has now been superseded by AVG Anti-Virus which includes Anti-Spyware"
N	!NoLoad	winrecon.exe	"WinRecon keystroke logger/monitoring program - remove unless you installed it yourself!"
Consume	"Consumer Input Rewarded with MyPoints	U	"ConsumerInputRewardedwithMyPoints
Consume	"Consumer Input Rewarded with MyPoints	U	"ConsumerInputRewardedwithMyPoints
Inc."	"Machine Works	X	aecces.exe
Inc."	"Microsoft NetMeeting Associates	X	NetMeeting.exe
ME"	"MS Java Applets for Windows NT	X	javaapplets.exe
NT	"Ms Java for Windows 98	ME & XP"	X
NT	"Ms Java for Windows 98	XP & ME"	X
XP & ME	"MS Java for Windows NT	X	xpjavams.exe
Version	"NVIDIA Compatible Windows Vista Display driver	U	"RUNDLL32.EXE NvCpl.dll
Version	"NVIDIA Compatible Windows7 Display driver	U	"RUNDLL32.EXE NvCpl.dll
Version	"NVIDIA Driver Helper Service	U	"RUNDLL32.EXE nvsvc.dll
Version	"NVIDIA nView Control Panel	N	nwiz.exe
X	"Vaganza-XPloit-[User Name]"""	[user name].exe	"Added by the GAVGENT.A WORM!"
Y	#NAME?	ZkRunOnceR.exe	Internet Security Suite used by ISPs to protect customers against many attacks
U	$EnterNet	Enternet.exe	"Connection manager for the EnterNet ISP. You can also use RASPPOE"
X	$sys$crash	$sys$sonyTimer.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$momomomochin	$sys$sonyTimer.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$momomomochin	$sys$sos$sys$.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$momomomochin	$sys$WeLoveMcCOL.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$umaiyo	$sys$sonyTimer.exe	"Added by the WELOMOCH TROJAN!"
X	$WindowsRegKey%update	IEXPLORE.EXE	"Added by the RBOT-EZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
N	%FP%1776 Internet fts.exe	fts.exe	1776 Internet US ISP software ISP software front-end
U	%FP%1776 Internet FWPortal.exe	FWPortal.exe	1776 Internet US ISP dial-up software
N	%FP%Friendly fts.exe	fts.exe	Friendly ISP software front-end
X	%Windir%winnl.exe	winnl.exe	"Added by the KIDKITI TROJAN!"
X	%Windir%winnm.exe	winnm.exe	"Added by the KIDKITI TROJAN!"
Y	'Ashampoo AntiSpyWare 2 Guard'	AntiSpyWare2Guard.exe	"Part of Ashampoo® AntiSpyWare 2 from Ashampoo GmbH & Co. KG. This part is the realtime monitor that looks for changes on the users system such as BHO
X	(*)API Machine	winSOCKS.exe	"Homepage hijacker
X	(*)Run	win32API.exe	"Homepage hijacker
X	(Default)	Shania.vbs	"Added by the SHANIA BACKDOOR! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	NOTEPAD.exe	"Added by the RUSTY WORM! Note - not to be confused with the valid Windows ""NOTEPAD"" text editor! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	[random filename].exe	"Added by the BLACKMAL WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	twunk_32.exe	"Added by the BLACKMAL.C WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	winhelp.exe	"Added by the BLACKMAL.C WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	winbas12.exe	"Adware
X	(default)	winlog.exe	"Added by the RBOT-CVY WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(default)	"rundll32.exe [path to DLL file]	Do98Work"
X	(Default)	winligom.exe	"Added by the RBOT-GAI WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKCU\Run
X	(Default)	msnupdate.exe	"Added by the RBOT-GWT BACKDOOR! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run & HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(L4r1$$4) (4nt1) (V1ruz)	SP00Lsv32.pif	"Added by the ASSIRAL.B WORM!"
X	*Bandook	msdll.exe	"Added by an unidentified TROJAN - see here"
X	*Intelli Mouse Pro Version 2.0B*	ncsjapi32.exe	"Added by the BUZUS-O WORM!"
X	*JanisRuckenbrodII	janis.com	"Added by the POPS WORM!"
X	*MS Setup	[random filename]	"Virtumondo adware
X	*MSConfig32	aecache.exe	"Detected by F-Secure as the OBFUSCATED.GP TROJAN!"
X	*Security Center	secctr.exe	"Added by the SDBOT.BRO WORM!"
N	*WerKernelReporting	WerFault.exe	"Part of Windows Error Reporting technology (WER) for Vista. WER captures software crash and hang data from end-users who agree to report it - see here"
X	*windows update	wrauclt.exe	"Added by the RBOT-QU WORM!"
X	*windows update	wuanclt.exe	"Added by the RBOT-PG WORM!"
X	*windows update	wuaucrlt.exe	"Added by the SPYBOT.HUR WORM!"
X	*windows update	wuraclt.exe	"Added by the RBOT-PO WORM!"
X	*windows update	wurauclt.exe	"Added by the RBOT-SY WORM!"
X	*windows update	wsctl.exe	"Added by the SPYBOT.PR WORM!"
X	*windows update	wkmst.exe	"Added by the SDBOT.AVD WORM!"
X	*windows update	wscxt.exe	"Added by the RBOT.AOS WORM!"
X	*windows update	waurclt.exe	"Added by a variant of the RBOT WORM!"
X	*windows update	wuaruclt.exe	"Added by the RBOT-TF WORM!"
X	*Windows [filename] Checker	[filename]	"Added by the KEDEBE-B WORM!"
X	*WindowsAudio	systemupd.exe	"Added by the AGENT-TH WORM!"
X	*WinLogon	[trojan path] ren time:[random number]	"Added by the VUNDO TROJAN!"
X	*winstats	winstats.exe	"Added by the GARGAFX TROJAN!"
X	*wuauclt.exe	w****.exe [* = random char]	"Added by a variant of the RBOT-UG WORM! Note - * in the filename represents a random char; variants spotted: wxmct.exe
X	-=+(L4r1$$4)+=-(4nt1)-=+(V1ru$)=-+	ISASS.exe	"Added by the ASSIRAL.B WORM!"
?	.NET config	sysmon32.exe	"??"
X	.NET.	msnmgnr.exe	"Added by the DELF.AYF WORM!"
X	.norton	rchost.exe	"Added by the BOXED-H TROJAN!"
X	.nvsvc	smss.exe	"Added by the IRCBOT-FP TROJAN! Note - this is not the legitimate smss.exe process which should not normally figure in Msconfig/Startup!"
X	.nvsvcb	smssb.exe	"Added by the BOXED.CG TROJAN!"
X	.Prog	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	.protected	N/A	"Smitfraud variant"
X	.TEXTCONV	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	.TEXTCONV	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
N	/l:eng	N/A	"Related to the Dell OEM version of the Sound Blaster Audigy 2 sound card. If this item is listed and checked in startup
N	/s	N/A	"Related to the Dell OEM version of the Sound Blaster Audigy 2 sound card. If this item is listed and checked in startup
X	007-Anti-Spyware.exe	007-Anti-Spyware.exe	"007 Anti-Spyware rogue security software - not recommended"
U	00ERSRRRNKY	eraser.exe	"Part of Evidence Exterminator
?	00notify33	NetBrowser.exe	"Part of Best Network Security
?	00saskda	newlock.exe saskda	"Part of Access Manager
Y	00TCrdMain	TCrdMain.exe	Related to the flash card slot on a Toshiba laptop. Ending this process will disable access to the flash cards
U	0190 Warner	WARN0190.EXE	"Anti-dialer program (Germany)"
U	0900 Warner	WARN0900.EXE	"Anti-dialer program (Germany)"
X	0utlook Express	*****.exe [* = random char]	"Added by the RBOT-CC WORM! Note the first letter is actually the digit ""0"" and not a capital ""o"""
N	1&1 EasyLogin	EasyLogin.exe	"1&1 EasyLogin - quick access to webhost 1&1's Control Panel
X	1-sukarno	sukarno.exe	"Added by the BRONTOK-CR WORM!"
X	1234klsjdc uiar924c af	sxgnsvuxct.exe	"Added by the FAKEALERT-AM TROJAN!"
X	123Monitor	SpywareFreeMonitor.exe	"1-2-3 Spyware Free rogue spyware remover - not recommended
U	12Ghosts JustAWindow	12window.exe	"12Ghosts JustAWindow - ""Cover annoying ads
U	12Ghosts Synchronize	12sync.exe	"12Ghosts Synchronize - ""Sync PC clock with an atomic clock over the Internet"""
U	1455 Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX1455 multifunction printer
?	17779Proj2002	N/A	"??"
X	180adsolution	180adsolution.exe	"180solutions adware"
X	180ClientStubInstall	stubinstaller****.exe [* = digit]	"180Solutions adware related"
X	180ClientStubInstall	[path to trojan]	"180Solutions adware related"
X	180ClientStubInstall	******.tmp [* = random digit/char]	"180Solutions adware related"
X	196_150_ni	196_150_ni.exe	"WinFixer web installer - ""foistware""
X	197_150_ni_3	197_150_ni_3.exe	"WinFixer web installer - ""foistware""
X	197_150_ni_7	197_150_ni_7.exe	"WinFixer web installer - ""foistware""
U	1A:MacVisionTrayMonitor	TrayMonitor.exe	"Part of MacVision by Jeff Bargmann - an discontinued program that makes your PC's desktop look and feel incredibly like that of a Macintosh OS8 computer. Handler that puts the icons that are in your system tray into the MacVision taskbar
Y	1A:Stardock TrayMonitor	TrayServer.exe	For monitoring tray icons - if disabled icons will not be displayed in ObjectBar or DesktopX
?	1CmailS	NETMAIL.EXE	"??"
X	1on1	1on1.exe	Adult content dialler
U	1Srv32	SpyAgent4.exe	"SpyTech SpyAgent monitoring software. "Spy software that allows you to monitor EVERYTHING users do on your PC.""
U	1Win32Cfg	SpyBuddy.exe	"SpyBuddy from ExploreAnywhere
U	1Win32Cfg	Keyloggerpro.exe	"Keyloggerpro keystroke logger/monitoring program - remove unless you installed it yourself!"
X	1WinCfg32	WebMailSpy.exe	"WebMailSpy spyware"
X	2020Downloader	mssvr.exe	"2020Search Toolbar"
U	2335dn Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Dell 2335 multifunction laser printer
U	24Online Client	CyberoamClient.exe	"Related to Cyberroam from Elitecore Technologies Ltd"
X	252	winmgr.exe	"Added by the LEGMIR-AT TROJAN!"
X	2Search	main.exe	"2Search adware"
X	2thousandbuck	[path to file]	"Added by the RANKY.L TROJAN!"
U	2wSysTray	2portalmon.exe	"2Wire Homeportal user interface"
U	3170 Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung CLX3170 multifunction laser printer
X	32-bit Thunking service	thunk32.exe	"Added by the DERDERO.A WORM!"
X	32.exe	nvscv32.exe	"Added by the AGENT-LOL TROJAN!"
X	360antiarp	[path to trojan]	"Added by the PASTA.AIB TROJAN!"
Y	36X Raid Configurer	JMRaidSetup.exe	"JMB36x series RAID configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers"
Y	3c1807pd	3cmlink.exe 3cpipe-3c1807pd	"3Com WinModem driver. See here for more WinModem information"
Y	3capplnk	3capplnk.exe	US Robotics Modem driver
N	3cdminic	3CDMINIC.EXE	3Com DMI (DynamicAccess Desktop Management Interface) Agent associated with 3Com network cards
Y	3CM Link	3cmcnkw.exe	Required for a US Robotics WinModem as it provides the link to Windows - won't work without it
Y	3Cmlink	3CmlinkW.exe	"For a US Robotics WinModem. Provides the link to Windows as the CPU does the processing on WinModems - won't work without it. See here for more WinModem information"
?	3Com Launcher	Launcher.exe	"Related to networking products from 3Com Corporation. What does it do and is it required?"
N	3ComDMIAgent	3CDMINIC.EXE	3Com DMI (DynamicAccess Desktop Management Interface) Agent associated with 3Com network cards
Y	3cpipe-USRpdA	USRmlnkA.exe	Modem driver files from US Robotics
U	3Deep Control Panel	3DeepCTL.EXE	"3Deep® from E-Color corrects lighting
N	3dfx Task Manager	3dfxMan.exe	System Tray application for 3dfx Voodoo 3/4/5 functions. Available via Start -> Programs
Y	3dfx Tools	3dfxCmn.dll	Updates the registry with information that can't be held for Voodoo 3/4/5 series graphics cards. Important for owners of these cards
?	3Dlabs Taskbar Display Manager	3DLman.exe	"3DLabs graphics driver related. System Tray access to display settings?"
U	3DLabsHelperDemon	3dldemon.exe	"Directly from the programs author ""It is a tiny program that is installed by the Permedia2/3 and probably other Oxygen-series cards. Normally it sits in the background doing nothing at all (sleeping on a semaphore)
X	3d_sound	3d_sound.exe	"Added by the RIADOS-A TROJAN!"
X	3P_UDEC_IA	IAInstall.exe	"Installer for the Internet Antivirus and Internet Antivirus Pro rogue security software - not recommended
X	4.68474E+12	netdll32.exe	"Added by the SDBOT-DEV WORM!"
X	49U5T1N4	49U5T1N4.exe	"Added by the KORRON.B WORM!"
X	4wd!!!	Natal!.pif	"Added by the OPASERV.AI WORM!"
U	4x26 Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX4x26 multifunction laser printers
U	4x28 Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX4x28 multifunction laser printers
X	55278	grepclient1.exe	"Added by the LINEAGE-S TROJAN!"
X	5p4m	[path to trojan]	"Added by the LITEBOT-C TROJAN!"
X	6.54388E+16	rkgnd.exe	"ANG AntiVirus 09 rogue security software - not recommended
U	6200 Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung CLX6200 multifunction laser printer
X	7.61125E+16	angpd.exe	"ANG AntiVirus 09 rogue security software - not recommended
U	802.11b+g USB Wireless LAN Utility	ZDWlan.exe	802.11b+g USB Wireless LAN Utility
U	802.11g Wireless Adatper	Monitor.exe	"Related to wireless card (802.11) adapter/standard. System Tray icon that provides a shortcut to ""Wireless Connection Status"" and allows to turn WL on and off. Supplier unknown. Adapter is miss-spelled"
X	98D0CE0C16B1	"rundll32.exe D0CE0C16B1	D0CE0C16B1"
X	9m	winlog0n.exe	"Added by the LEGMIR-AQK TROJAN!"
X	9UmxQPSiTJMbA	NVUKZ.exe	"Added by the AGENT-LMN TROJAN!"
X	;Rundll	[filename]	"Added by the PWSLEGMIR.E TROJAN!"
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Lock (and maybe others) -.html" title="Access Lock (and maybe others) -">Access Lock (and maybe others) -
	Access Lock (and maybe others) -.html" title="Access Lock (and maybe others) -">Access Lock (and maybe others) -
X	?ekio Startups	?nksvc32.exe	"Added by the AGOBOT-OV WORM where ? is a random character"
X	@	RUNDLL.EXE	"Added by the SPYBOT-DN WORM! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	@	regedit -s win.dll	"Added by the SEEKER.K TROJAN! Note that regedit is the the legitimate Windows Registry Editor and shouldn't be deleted. The ""win.dll"" file is located in %Windir%"
X	@	wincms.exe	"Added by the RBOT.CBR WORM!"
X	@	winsys32.exe	"Added by the DELF.CP BACKDOOR! Note that the entry under the Startup Item/Name field my be blank"
N	@loha	reminder.exe	"Registration reminder for
Y	@OnlineArmor GUI	oaui.exe	"System Tray access to and main user interface for the Online Armor range of security tools from Tall Emu Pty Ltd. The free version incorporates a firewall
X	A New Windows Updater	w32NTupdt.exe	"Added by the MYTOB.BM WORM!"
N	A Note	A Note.exe	"""A Note is a program that lets you create post-it like notes on your Microsoft Windows desktop"""
U	A Verizon App	VERIZO~1.EXE	"Part of Verizon Online Support Manager"
Y	a-squared Anti-Dialer	a2adguard.exe	"System Tray access to and Background Guard feature of Emsisoft Anti-Dialer from Emsi Software GmbH - which provides ""provides a complete defense against Dialers"""
Y	a-winpoet-service	winpppoverethernet.exe	"WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion
U	A1000 Settings Utility	cpqa1000.exe	"Compaq A1000 Print Fax All-in-One copy scan printer software. Required in the Startup in order to scan
X	A70F6A1D-0195-42a2-934C-D8AC0F7C08EB	"rundll32.exe E6F1873B.DLL	D9EBC318C"
?	AAACLEAN	AAACLEAN.INF	"??"
U	aaLDISCN32	LDISCN32.EXE	"LANDesk® Management Suite software component"
U	aaLDTaskCompletion	amclient.EXE	"LANDesk® Management Suite software component"
X	AAMSFree702	Avengine.com	"Added by the DELF.LJ TROJAN!"
X	aaprotect	[path to trojan]	"Added by the BANCBAN-MJ TROJAN!"
?	aauclient	ACNUpdater.exe	"Appears to be related to software from Accenture.com"
N	ABBYY Community Agent	CAGENT.EXE	Installed with the Optical Character Recognition (OCR) software that comes bundled with a Compaq A3000 all-in-one printer/scanner. Its function appears to be to link you to the internet in an attempt to buy the 5.0 version of the software
X	Abrada WIN32	abrada.exe	"Added by the DERMON-G TROJAN!"
Y	ABRegmon	ABregmon.exe	"Part of the ArcaVir antivirus suite from Polish company Arcabit. What does this part do?"
U	Absolute StartUp monitor	ASMon.exe	"Absolute Startup - startup monitor from F-Group Software"
U	AbsoluteShield Internet Eraser	cseraser.exe	"AbsoluteShield Internet Eraser - ""protects your privacy by cleaning up all the tracks of your Internet and computer activities"""
X	Ac97Sound	snddrv.exe	"Added by the VB.AXG TROJAN!"
U	AcBtnMgr_X63	AcBtnMgr_X63.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X63 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	AcBtnMgr_X63.exe	AcBtnMgr_X63.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X63 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	AcBtnMgr_X73	AcBtnMgr_X73.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X73 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	AcBtnMgr_X83	AcBtnMgr_X83.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X83 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	AcBtnMgr_X84-X85	AcBtnMgr_X84-X85.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X84-X85 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
X	ACCDEFRAGINFO	[path to worm]	"Added by the DARBY-O WORM!"
U	Access Connections	ACTray.exe	"System Tray access to the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
X	Access Control App	winsto.exe	"Added by the AGENT.DGO TROJAN!"
N	Access IBM Message Center	ibmmessages.exe	"""The Access IBM Message Center displays messages to inform you about helpful software that may be pre-installed on your PC. The Message Center can also provide messages about new updates available from the IBM Support Center to keep your computer current"""
N	Access Ramp Monitor	armon32.exe	"Monitors your progress on the internet; hang-ups
X	Access WebControl	[path to file]	"Added by the PPDOOR-M TROJAN!"
U	AccessManager	AccessMgr.exe	"Part of SmartPipes SecureSite software. ""SecureSite enables rapid turnup and enhanced administration of VPNs. It automates and simplifies tasks for VPN design and policy management
N	AccessRamp Monitor01	ARMon32a.exe	"From a visitor ""Just wanted to provide you with some info on Access Ramp software installed with Verizon DSL accounts in those areas that use the Winpoet PPPoE software. The Access Ramp TSRs are installed as part of IP Insight software (can't remember the software maker). You can decline to install IP Insight during Winpoet setup
N	AccessRampLAN01	ARUpld32.exe	"Version of the AccessRamp Monitor01 entry for LAN connections - a history uploader. The key in turning it off is a file named ARUCfg32.exe. This file (ARUCfg32.exe) does not show up in the startup process. If you have this file
N	ACDaemon	ACDaemon.exe	"Used to serve notice of product information and updates when running ArcSoft products such as TotalMedia
N	AceGain LiveUpdate	LiveUpdate.exe	"""AceGain LiveUpdate can help to automate and optimize product updates. AceGain LiveUpdate will automatically detect new patch updates
U	Acer Assist Launcher	launcher.exe	"Acer Assist - program that provides information about new updates or notices from Acer"
U	Acer eAP Launch Tool	EAPLAU~1.EXE	"Empowering Technology Launcher
?	Acer Empowering Technology Monitor	SysMonitor.exe	"Part of Acer Empowering Technology. What does it do and is it required?"
U	Acer ePower Management	Acer ePower Management.exe	"Part of Acer Empowering Technology. ""Acer ePower Management is a straightforward interface that allows users to select from pre-configured power usage profiles
U	Acer ePower Management	ePowerTray.exe	"Acer® PowerSmart Manager power management utility included on some models in the Aspire range of notebooks. Also appears as the Packard Bell PowerSave power management utility included on some of their notebook models - as Packard Bell is now owned by Acer"
U	Acer ePower Management	ePowerTrayLauncher.exe	Launcher for the Acer® PowerSmart Manager power management utility included on some models in the Aspire range of notebooks
U	Acer ePresentation HPD	ePresentation.exe	"Part of Acer Empowering Technology. Allows you to manage both internal and external displays"
Y	Acer Launch Tool	Alaunch	"Part of Acer eRecovery - ""a powerful utility that does away with the need for recovery disks provided by the manufacturer
N	Acer Product Registration	ACE1.exe	Acer Product Registration - remove when registration is completed
N	Acer Tour Reminder	Reminder.exe	Popup reminder to take the tour of your new Acer laptop
U	AcerNotebookManager	almxptray.exe	System Tray access on some Acer Notebooks to give faster access to system settings
X	Aceu	[random filename]	"PurityScan adware"
Y	acEventServ	acevtsrv.exe	"ActivCard Gold from ActivIdentity
U	AClntUsr	AClntUsr.exe	"Altiris AClient Service Windows Tray Icon"
N	Acme.PCHButton	pchbutton.exe	Used by HP Instant Support
Y	ACMON	ACMON.exe	"ASUS Splendid ""is a breathtaking innovation that brings the video viewing experience on PC to the next level. Built into the driver of ASUS graphics cards
U	ACMonitor_X63	ACMonitor_X63.exe	"Button monitor for the Lexmark X63 all-in-one multifunction printer/copier/scanner. Works in conjunction with the ""Lexmark Scan & Copy Control Program"" button manager whose filename is ""AcBtnMgr_X63.exe"""
U	ACMonitor_X63.exe	ACMonitor_X63.exe	"Button monitor for the Lexmark X63 all-in-one multifunction printer/copier/scanner. Works in conjunction with the ""Lexmark Scan & Copy Control Program"" button manager whose filename is ""AcBtnMgr_X63.exe"""
U	ACMonitor_X73	ACMonitor_X73.exe	"Button monitor for the Lexmark X73 all-in-one multifunction printer/copier/scanner. Works in conjunction with the ""Lexmark Scan & Copy Control Program"" button manager whose filename is ""AcBtnMgr_X73.exe"""
U	ACMonitor_X83	ACMonitor_X83.exe	"Button monitor for the Lexmark X83 all-in-one multifunction printer/copier/scanner. Works in conjunction with the ""Lexmark Scan & Copy Control Program"" button manager whose filename is ""AcBtnMgr_X83.exe"""
U	ACMonitor_X84-X85	ACMonitor_X84-X85.exe	"Button monitor for the Lexmark X84-X85 all-in-one multifunction printer/copier/scanner. Works in conjunction with the ""Lexmark Scan & Copy Control Program"" button manager whose filename is ""AcBtnMgr_X84-X85.exe"""
X	acocash	fastdown.exe	Adult content dialler
X	acocash	FASTFOWN.EXE	Adult content dialler
X	Aconti	aconti.exe	Adult content dialler
X	Acrobat	acrmon32.exe	"Added by the SMALL-ECT TROJAN!"
U	Acrobat Assistant	AcroTray.exe	"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
U	Acrobat Assistant 7.0	Acrotray.exe	"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
U	Acrobat Assistant 8.0	Acrotray.exe	"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
N	Acrobat Speed Launch	acrobat_sl.exe	"Speeds up the time it takes to load Adobe's Acrobat PDF creation and management tool. From version 7.0 onwards"
U	Acronis Popup Blocker	"RunDll32.exe [path] Blocker.dll	Run"
U	Acronis Scheduler Helper	schedhlp.exe	"Part of Acronis True Image backup software. Co-operates with the ""schedul2.exe"" service to perform backup/restore tasks correctly. Required if you want to use True Image to do some real backup/restore tasks - not if you only want to explore/mount images"
U	Acronis Scheduler2 Service	schedhlp.exe	"Part of Acronis True Image - backup software. Co-operates with the ""schedul2.exe"" service to perform backup/restore tasks correctly. Required if you want to use True Image to do some real backup/restore tasks - not if you only want to explore/mount images"
U	Acronis True Image	TimounterMonitor.exe	"Part of Acronis True Image backup software. Monitor for the backup archive explorer for moving and viewing files within an archive"
N	Acronis True Image Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
N	Acronis TrueImage Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
N	Acronis*True*Image Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
U	AcronisTimounterMonitor	TimounterMonitor.exe	"Part of Acronis True Image backup software. Monitor for the backup archive explorer for moving and viewing files within an archive"
N	AcronisTrueImage Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
N	Action Manager 32	am32.exe	Associated with a Plustech scanner. Small utility that runs in the background for doing fax/copy/etc. Available via Start -> Programs
?	ActionAgent	actionagent.exe	"""A COM server that runs on the client as part of the Dell OpenManage Client Instrumentation 6.x package; provides a simple method for a remote administrator to perform actions on the instrumented client"". Is it required?"
N	Activation	Activation.exe	Part of Microsoft Money
X	Active Bit Station	abs.exe	"Added by the MYTOB.BZ WORM!"
U	Active Desktop Calendar	ADC.EXE	"XemiComputers Active Desktop Calendar"
U	Active Email Monitor	aem25.exe	"Active Email Monitor checks multiple accounts for email
U	ActiveMenu	ActiveMenu.exe	Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
X	ActiveScan Antivirus	ActiveScan.exe	"Added by the RBOT-FKQ WORM!"
X	ActiveScript32	nod.exe	"Added by the SOHANA-AJ WORM!"
X	ActiveSync	wcescom32.exe	"Added by the MANCSYN-E TROJAN!"
N	ActiveWords	AWMonitor.exe	"ActiveWords from ActiveWord Systems
X	ActiveX File Registration Service	filereg.exe	"Added by the RBOT-DVD WORM!"
U	Actual Window Manager	ActualWindowManagerCenter.exe	"Actual Window Manager from Actual Tools - ""an innovative desktop organization application which introduces unconventional window controls and also automatic general window operations making your work more productive
U	Actual Window Minimizer	ActualWindowMinimizerCenter.exe	"Actual Window Minimizer - ""allows minimizing any window to task tray notification area or to the edge of the screen"""
U	ACWLIcon	ACWLIcon.exe	"Part of the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
U	Ad Muncher	AdMunch.exe	"Ad Muncher removes adverts
?	Ad Online Guide	adonlineguide.exe	"??"
X	Ad-Eliminator	ad-eliminator.exe	"Ad-Eliminator rogue spyware remover - not recommended
U	Ad-Muncher	ADMUNCH.EXE	"Ad Muncher removes adverts
U	AD2KClient	AD2KClient.exe	"Executable for Active Disk from Iomega - allows software applications to be run directly from an Iomega Zip® disk. Required if you wish the applications to launch on insertion of a disk"
X	AdAware	wini.exe	"Added by the RBOT-XN WORM!"
U	AdBin	AdBin.exe	"AdBin - ""Free and easy solution to managing your Window's hosts file. A fun way to block ads"""
X	Add**.exe [* = random char]	Add**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Add**32.exe [* = random char]	Add**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	AddClass	[Installation_Path]	"Added by the STARTPAGE.F hijacker"
X	AddClass	[path to trojan]	"Added by the SECDL-A TROJAN!"
X	Additional Guard	WI[random characters].exe	"Additional Guard rogue security software - not recommended
X	ADDITIONAL Services	pkgadd.exe	"Added by a variant of the IRCBOT TROJAN!"
X	AddrPlus3	[path] stup.exe [path] Adplus.dll Rundll32	"TCent adware"
Y	adi CleanUp	CleanUp.exe	"Utility that only runs once after installing the drivers for Analog Devices SoundMax integrated soundcards to clean-up the files no longer required once the installation is complete. Other programs/drivers may use the same filename for the same purpose. In this case
Y	adi DSndUp	DSndUp.exe	"Utility that only runs once after installing the drivers for Analog Devices SoundMax integrated soundcards. It's exact purpose is unknown at the present time but from the filename it's probably used to configure the default or generic speaker arrangement for the system it's used on"
X	AdKiller	AD Defender.exe	"Part of the Advanced Spyware Remover rogue spyware remover - not recommended
X	adlhidp	psncc32.exe	"Added by the SLAPER.AI TROJAN!"
X	Admanager Controller	AdManCtl.exe	"Adware
X	Administrator	svchost.scr	"Added by the NOVACAL TROJAN!"
X	Administrator	winlogon.exe	"Added by the RUBBLE-C WORM! Note - this is not the legitimate winlogon.exe process
X	Administrator di Dago	Dago.exe	"Added by the PUNYA-B WORM!"
X	AdminSoft	sysfile.vbs	"Added by the STARGRUB-A WORM!"
X	Adobe	sysconfig.exe	Added by an unidentified WORM or TROJAN!
X	Adobe Acrobat Distiller Application	acrotray.exe	"Added by the RANDEX.DFJ WORM!"
X	Adobe Acrobat Reader CFG	[random filename]	"Added by a variant of the RBOT WORM!"
N	Adobe Acrobat Speed Launcher	acrobat_sl.exe	"Speeds up the time it takes to load Adobe's Acrobat PDF creation and management tool. From version 7.0 onwards"
N	Adobe Photo Downloader	apdproxy.exe	"Part of Adobe's Photoshop Album or Photoshop Elements packages - starts each time you connect an external image device to your PC (see here)"
N	Adobe Reader Speed Launch	Reader_sl.exe	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
N	Adobe Reader Speed Launch	READER~1.EXE	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
N	Adobe Reader Speed Launcher	Reader_sl.exe	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
U	Adobe Reader Synchronizer	AdobeCollabSync.exe	"Adobe Synchronizer - installed along with Adobe Reader 8.x. ""Synchronizer is a small application that runs in the background
U	Adobe Version Cue CS2	VersionCueCS2Tray.exe	"File manager that's part of Adobe Creative Suite 2 - ""find files fast
X	AdobeFonts	fonts.hta	Browser hijacker - redirecting to Hugesearch.net
X	AdobeManager	rundtl.exe	"Added by the INJECT.IB TROJAN!"
X	AdobeReader	msni.exe	"Added by the RBOT.DAO TROJAN!"
X	AdobeReaderPro	msnxpsp.exe	"Added by the RBOT-ASK or RBOT-AUS WORMS!"
X	AdobeReaderPro	ntkernell32.exe	"Added by the RBOT-ATY WORM!"
X	AdobeReaderPro	msnserve.exe	"Added by the SDBOT-AKH WORM!"
X	AdobeReaderPro	winslog.exe	"Added by a variant of the RBOT WORM!"
X	AdobeReaderPro	winini.exe	"Added by a variant of the RBOT WORM!"
X	AdobeReaderPro	msnservex.exe	"Added by the RBOT.AKM BACKDOOR!"
X	AdobeReaderPro	msnsrcdv.exe	"Added by the INJECT-H WORM!"
X	AdobeReaderProfessional	msx64.exe	"Added by the RBOT-GAT WORM!"
X	AdobeReaderPros	sysmsn.exe	"Added by the RBOT-BGH WORM!"
N	AdobeVersionCue	VersionCueTray.exe	"""An exclusive feature of the Adobe® Creative Suite
X	Adope File Manager	lsasv.exe	Added by an unidentified WORM or TROJAN!
X	ADriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	AdRotator.Application	[path to csrss.exe]	"Added by the SMALL-AQ TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	AdRotator.Application	services.exe	"FakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in an ""Inetsrv"" subfolder"
U	AdsCleaner	AdsCleaner.exe	"""AdsCleaner is a powerful ad blocking software designed to stop ads (block banners ad
U	AdsGone	Adsgone.exe	"AdsGone - pop-up stopper"
N	ADSL Diagnostic Tools	mapiicon.exe	System tray access to ADSL modem diagnostic tools. Available via Start -> Programs
Y	AdslTaskBar	"rundll32.exe stmctrl.dll	TaskBar"
X	AdslTaskBars	taskmng.exe	"Added by the RBOT-AXZ WORM!"
?	ADSL_A2	A2Installed	"Associated with an Integrated Telecom Express (ITeX) ADSL driver installation. What does it do and is it required?"
U	adsnwe	adsnwe.exe	"EmailSpyMonitor E-mail surveillance software. Uninstall this software unless you put it there yourself"
U	adsnwk	adsnwk.exe	"Keylogger Spy Monitor keystroke logger/monitoring program - remove unless you installed it yourself!"
U	adsnws	adsnws.exe	"ScreenSpyMonitor surveillance software. Uninstall this software unless you put it there yourself"
U	adsnwy	adsnwy.exe	"Yahoo! Messenger Spy Monitor - ""spyware program that records Yahoo! Instant Messenger information on the computer and saves it to a log file"". Uninstall this software unless you put it there yourself"
U	aDSProcMngr	aDSProcMngr.exe	"Part of PC Tools Disk Suite from PC Tools - which ""is an all-in-one hard-disk management utility that integrates disk optimization
U	ADUserMon	ADUserMon.exe	"Part of Active Disk from Iomega - allows software applications to be run directly from an Iomega Zip® disk. Required if you wish the applications to launch on insertion of a disk"
X	Advanced DHTML Enable	exo32.exe	"Added by the RANCK-FI TROJAN!"
X	Advanced DHTML Enable	[path to trojan]	"Added by the AGENT.GLQ TROJAN!"
X	Advanced Internet Protocol	cerf.exe	"Added by a variant of the SPYBOT WORM!"
X	Advanced Protection System	advpsys.exe	"Added by a variant of the RBOT WORM!"
X	Advanced Spyware Remover	Asr.exe	"Advanced Spyware Remover rogue spyware remover - not recommended
X	Advanced Spyware Remover Pro	Asr.exe	"Advanced Spyware Remover rogue spyware remover - not recommended
U	Advanced SystemCare 3	AWC.exe	"Advanced SystemCare from IObit - ""helps protect
X	Advanced Tool Checks	advchks.exe	"Added by a variant of the RBOT WORM!"
N	Advanced Tools Check	ADVCHK.EXE	Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget
U	Advanced Uninstaller PRO Installation Monitor	monitor.exe	"Innovative Solutions Advanced Uninstaller PRO - ""easy-to-use suite for uninstalling applications and keeping your computer fast
X	AdvancedCleaner Free	UADC.exe	"AdvancedCleaner rogue security software - not recommended
X	advanceddefender	advanceddefender.exe	"Advanced Defender rogue security software - not recommended
X	AdvancedPrivacyGuard	apg.exe	"AdvancedPrivacyGuard rogue privacy program - not recommended
X	AdvancedPrivacySuite	APS.exe	"AdvancedPrivacySuite rogue privacy program - not recommended
X	AdVantage	AdVantage.exe	"MediaAdVantage adware"
X	AdVantage Setup	AdVantageSetup.exe	"MeMedia.Advantage adware - optionally installed with older versions of the DAEMON Tools Lite CD emulation tool (if you don't uncheck the ""DAEMON Tools sponsor ad module"" option during install) and possibly others"
X	advap32	[path to trojan]	"Added by the MUTANT.AT TROJAN!"
U	Advertising Killer	Akiller.exe	"Advertising Killer - popup stopper"
X	advmon32	advmon32.exe	"Added by a variant of the CRYPTER.C TROJAN!"
U	Adware Agent	adware agent.exe	"Adware Agent popup blocker"
X	Adware Punisher	AdwarePunisher.exe	"Adware Punisher rogue spyware remover - not recommended
X	Adware Punisher Monitor	AdwarePunisher_monitor.exe	"Adware Punisher rogue spyware remover - not recommended
X	AdwareProMFC	AntiTrojan Pro.exe	AntiTrojan Pro rogue security software - not recommended. Variant of Ad-Ware Pro
X	Adware_ProNET	Adware_Pro.exe	"Adware Pro rogue security software - not recommended
U	AEFltrs Application	AESTFltr.exe	"Part of the XP installation of the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
N	AELaunch	AELaunch.exe	"Audio Applications Launcher for the Philips Acoustic Edge soundcard"
X	AERVICESN	AERVICESN.exe	"Added by the RANDON-AO WORM!"
N	AeXAgentLogon	AeXAgentActivate.exe	"Altiris Agent transmits information about your machine for the purpose of asset management and deployment"
U	AFAFilter	windefault.exe	"AFAFilter - internet filter software"
N	AGEIA PhysX SysTray	TrayIcon.exe	"System Tray access to display properties for AGEIA PhysX graphics cards. Unless you change your desktop resolution
N	Agent	Agent.exe	"Cyberlink's Power VCR II 3.0 is a TV tuner recording utility. If you want to schedule recordings you'll need this
X	Agent	alsys.exe	"Added by the DREF-V VIRUS!"
X	agent	ppl.exe	"Added by the DREF-U VIRUS!"
X	Agent Browser	[random filename]	Added by the PPdoor.M-bdr backdoor TROJAN!
X	Agent Explorer	[random filename]	Unidentified adware
X	agent.exe	agent.exe	"Part of rogue security tools
?	Agente	Remupd.exe	"Part of an older version of Panda Antivirus. Is this an update reminder (guess because of the name)
X	agentsvr	agentsvr.exe	"Detected by Kaspersky as Monker.A adware. Note - do not confuse with the Microsoft Agent Server application of the same name as described here - the legitimate file will always be located in the Windows\Msagent folder"
U	Agere SoftModem Messaging Applet	AGRSMMSG.exe	Installed with the drivers for internal software modems based upon Lucent/Agere Systems chipsets - required if you use the SoftModem Assistant to configure the modem
U	AgfaCLnk	AgfaCLnk.exe	For Agfa digital cameras connected via USB. Enables Windows to access the contents of the memory stick (while the stick's still on the camera) via a virtual drive
Y	AHNSD	AhnSD.exe	"AhnLab V3 antivirus updater - leave enabled unless you manually update on a regular basis"
?	AHNUE	AHNUE.exe	"??"
N	AHQInit	ahqinit.exe	Part of AudioHQ for the Soundblaster Live!. Appears as though it makes the AudioHW toolbar drop down from the top of the desktop and isn't required
X	AHU	ANACON.EXE	"Added by the NACO.A WORM!"
U	Ai Nap	AiNap.exe	"Included with some ASUS motherboards (such as the Maximus Extreme & Striker II Extreme)
?	AidemHotKey	DVMAIN.EXE	"Keyboard related"
X	AIM Instant Message Cookies	[random filename]	"Added by the RBOT-AFV WORM!"
X	Aim Plugin	aimplugin.exe	"Added by the GUAP-F WORM!"
X	AIM reminder	AIM reminder.exe	"Added by the BUDDY.E TROJAN!"
N	Aim6	AOLLaunch.exe	"AOL Instant Messenger - start it when you want to use it"
N	AimingClick	AimingClick.exe	"AimingClick from AimingTech. Web searching tool. Available via Start -> Programs"
U	AimMonitor	AimMonitor.exe	"AIM Monitor Sniffer surveillance software for the AIM instant messenger. Uninstall this software unless you put it there yourself"
N	AIMWDInstall	AIMWDInstall.exe	"Version of the WildTangent on-line games installer that came with versions of AOL Instant Messenger. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case"
Y	AirNCFG	AirNCFG.exe	"Driver and configuration utility for a number of wireless routers and adapters from D-Link"
U	AirPort Base Station Agent	APAgent.exe	"Airport Base Station Agent utility for Apple's AirPort wi-fi basestations. ""Wireless solution for home
X	AKEYNAME	WinServ.exe	"Added by the EVILBOT.C TROJAN!"
U	Alarm Manager	Alarmapp.exe	Palm alarm event reminder that coordinates what is on your Palm with settings on your desktop
Y	Alaunch	Alaunch	"Part of Acer eRecovery - ""a powerful utility that does away with the need for recovery disks provided by the manufacturer
?	AlcFDMonitor	ALCFDRTM.EXE	"RealTek related - Real-Time SPDIF-in Monitor for nVidia chipset - is it required in startup?"
N	Alcohol Soft Development Team	axcmd.exe	"Part of Alcohol 120% - ""a powerful Windows CD and DVD burning software that makes it easy to create backups of DVDs and CDs. In addition
N	Alcohol.exe Autorun	Alcohol.exe	"Alcohol 120% - ""a powerful Windows CD and DVD burning software that makes it easy to create backups of DVDs and CDs. In addition
N	AlcoholAutomount	axcmd.exe	"Part of Alcohol 120% - ""a powerful Windows CD and DVD burning software that makes it easy to create backups of DVDs and CDs. In addition
U	AlcxMonitor	Alcxmntr.exe	"Installed with hardware drivers for a Realtek AC97 audio device. It's believed that Realtek uses this file in order to gather data about the customer. Some users report problems with their on-board sound if this is disabled - hence the ""U"" recommendation"
X	AlevirOld	[worm filename]	"Added by the OPASERV WORM!"
X	AlfaCleaner	AlfaCleaner.exe	"AlphaCleaner is now a stealth install using exploits on unpatched systems. Seen alongside RazeSpyware"
N	Alias SketchBook Snapshot	ALIASS~2.EXE	Screen-capture utility for Alias Sketchbook
N	AlienAutopsy	Test_BS.exe	"Alienware computer technical support software"
Y	ALiSndMgr	ALiSndMg.exe	ALi AC97 Sound driver
?	AliUSBfix	GREENMK.exe	"May be realted to a USB 2.0 PCI card - the IOgear GIC220OU?"
U	All Aboard Status	stswin.exe	"All Aboard! Internet Connection Sharing status icon"
X	All Sea screen saver	TaskTray.exe	"Free screensaver
X	All Sea web link	FWLink.exe	"Free screensaver
X	Allopassw	[path to trojan]	"Added by the RANKY.CU TROJAN!"
U	AllSeeingEye	ase.exe	"All-Seeing_Eye security software - ""monitors everything that takes place on your computer
U	allSnap	allSnap.exe	"""allSnap is a small system tray app that makes all top level windows automatically align like they do in programs such as Winamp or Photoshop"""
U	ALLTEL DSL Check-up Center	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	Alogrithm Link Queue	alq.exe	"Added by a variant of the SDBOT WORM!"
X	AlphaAnt	alpha.exe	"Alpha Antivirus rogue security software - not recommended
Y	Alps Electric USB Server	Monserv.exe	"Alps Electric USB Server - required according to this article"
U	AlpsPoint	Apoint.exe	Touchpad software for laptop PC's. For instance it is found on the Panasonic and Sony Vaio machines and allows part of the touchpad to be used for document or Web-page scrolling. Required for proper functioning of the pointing software but not required for the laptop to work
X	Altnet	points manager.exe	"Altnet TopSearch adware"
X	AltnetPointsManager	points manager.exe	"Altnet TopSearch adware"
X	AltPayments	AltPayments.exe	"WeirdOnTheWeb adware"
U	ALUAlert	ALUNotify.exe	Notification reminder for Symantec's LiveUpdate. Leave enabled unless you manually run LiveUpdate on a regular basis
N	Aluria Security Center	SecurityCenter.exe	"Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU
N	Aluria's Spyware Eliminator	ASE.exe	"Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU
U	AlwaysOnTopMaker	AlwaysOnTopMaker.exe	"Always On Top Maker - utilty to enable an application to always be displayed ""on top"" of others on the desktop"
X	AmazingTens	AmazingTens.exe	Premium rate adult content dialler
U	AMD PowerNow!	GemBack.exe	"
N	America Online	aoltray.exe	"Adds the AOL icon in the System Tray (*.* denotes version if present) for versions of AOL up to and including 9.0. Start AOL via the desktop or quick launch shortcuts or via Start → All Programs"
N	America Online *.* Tray Icon	aoltray.exe	"Adds the AOL icon in the System Tray (*.* denotes version if present) for versions of AOL up to and including 9.0. Start AOL via the desktop or quick launch shortcuts or via Start → All Programs"
N	AME_CSA	"rundll32 amecsa.cpl	RUN_DLL"
U	AmIcoSinglun	AmIcoSinglun.exe	"Single LUN Icon Utility - System Tray access/notification for card readers using controllers from Alcor Micro which incorporate Single LUN
U	AModemLockDown	ModemLockDown.exe	"ModemLockDown - allows you to supervise internet access by disabling the modem
Y	Amon	AMON.EXE	"Monitoring part of Eset's NOD32 virus-scanner"
Y	Amonitor	amon.exe	"Tiny Personal Firewall"
U	AMO_Taskplaner.exe	AMO_Taskplaner.exe	"Part of Ashampoo® Magical Optimizer from Ashampoo GmbH & Co. KG - which removes stagnant and unnecessary hard drive files
U	AMO_TA~1	AMO_Taskplaner.exe	"Part of Ashampoo® Magical Optimizer from Ashampoo GmbH & Co. KG - which removes stagnant and unnecessary hard drive files
U	AMP WinOFF	winoff.exe	"WinOFF is "" a utility designed to shut down Windows computers automatically
N	AMSN	amsn.exe	"aMSN Messenger is a multiplatform MSN messenger clone"
X	amsn	amsn.exe	"Added by the BANKER-BNZ TROJAN!"
N	Anapod Manager	anamgr.exe	"Anapod Explorer from Red Chair Software ""is the most advanced Windows iPod® software available
X	anbv32	nabv32.exe	"Added by the TITOG.C WORM!"
X	Andware Defence	Zsoft32.exe	"Added by the GAOBOT.OO WORM!"
X	angeleyes	msdll.exe	"Added by the VB.PI TROJAN!"
X	animalss	animalss.exe	"Added by the AGOBOT-VE WORM!"
Y	ANIWZCS2Service	WZCSLDR2.exe	"ALPHA Networks wireless driver"
?	ANIWZCSService	WZCSLDR.exe	D-Link wireless PCI adapter related. In some cases reported to cause excessive CPU activity
?	AnnotateCheck	AnnCheck.exe	"Genius Wizard Pen Tablet driver related. Is it required?"
N	Announcements	Annclist.exe	MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it
N	Anntext	Anntext.exe	Caere Pagekeeper text annotation server
U	AnonymityGateway	Anonymity Gateway.exe	"Anonymity Gateway - privacy protection tool that conceals IP address preventing your surfing habits and your internet activity form being tracked by websites or Internet Service Providers"
U	Anonymizer Total Net Shield	AnonTns.exe	"Anonymizer Total Net Shield - ID protection and privacy software"
Y	ANONYMIZER_SPYWAREKILLER	SpyWareKiller.exe	"Anonymizer Spyware Killer
Y	ANONYMIZER_SPYWAREKILLER	AnonAntiSpyware.exe	"Anonymizer Anti-Spyware - now discontinued"
U	Another Internet Explorer Popup Killer	aiepk2.exe	"Another IE Popup Killer - pop-up stopper"
X	ansjava	[path to worm]	"Added by the RANDON-AN WORM!"
X	Anskya	PYSKY.NET.exe	"Added by the DLOADER-MW TROJAN!"
X	Answer Problem	dSAFsqs.exe	"Added by the SDBOT-SC WORM!"
U	AnswerTool	AnswerTool.exe	"AnswerTool - save your E-mail replies in AnswerTool
X	Anti	Isass.exe	"Added by the BROPIA.K WORM!"
X	Anti Spam Service	spamsvc.exe	"Added by the MYTOB-BK WORM!"
N	Anti-Blaxx Manager	Anti-Blaxx.exe	"Anti-Blaxx - bypass blacklistings from different copy protections bypassing methods like virtual CD or DVD drives"
U	Anti-keylogger check	antikey.exe	"Anti-keylogger - protects against keylogger programs monitoring your keystrokes"
U	Anti-Trojan-Watch	ATWatch.exe	Anti-Trojan Watch - trojan detector
X	Anti-Virus	vpms.exe	"Added by a variant of the SLAPER TROJAN!"
X	Anti-Virus	[random filename].exe	"Added by the CAPROBAD-A TROJAN!"
X	Anti-Virus Product Sync	[unprintable character][3 characters]log.exe	"Added by the KEDEBE.D WORM!"
X	Anti-Virus Update Scheduler	[path to trojan]	"Added by the SPAMMIT-A TROJAN!"
X	Anti-Virus Update Scheduler	winsp3.exe	"Malware - detected by Kaspersky as the AGENT.FP TROJAN!"
X	Anti-Virus Update Scheduler V1.39.12R	[path to trojan]	"Added by the HEPLANE or STAPREW.B TROJANS! - different filenames have been spotted; examples: msvc.exe
X	AntiAdd.exe	AntiAdd.exe	"AntiAdd rogue security software - not recommended
X	AntiAID	AntiAID.exe	"AntiAID rogue security software - not recommended
X	AntiCareMain	AntiCare.exe	"AntiCare rogue security software - not recommended"
X	AntiClicker	SVCHST32.EXE	"Added by the CBH TROJAN!"
U	antidialer.co.uk	Dialer_Watcher.exe	"Dialer_Watcher is an application that allows you to detect dialers on your computer"
Y	AntiFreeze	AntiFreeze.exe	"AntiFreeze from Resplendence Software Projects - ""offers a last recourse when you find your computer in a hung state"". If your system has hung and AntiFreeze is running
X	antihost	ahr.exe	"Added by the BANCBAN-QJ TROJAN!"
X	antike	wingate32.exe	"Added by a variant of the RBOT WORM! See here"
X	AntiKeep	AntiKeep.exe	"AntiKeep rogue security software - not recommended
X	AntiKeep.exe	AntiKeep.exe	"AntiKeep rogue security software - not recommended
X	AntiMalware	AntiMalware.exe	"AntiMalware rogue security software - not recommended
X	Antimalware Doctor.exe	Antimalware Doctor.exe	"Antimalware Doctor rogue security software - not recommended
X	AntiMalwareGuard	amg.exe	"AntiMalwareGuard rogue security software - not recommended
X	AntiMalwareSuite	AMS.exe	"AntiMalwareSuite rogue security software - not recommended
X	AntiMalware_ProNET	AntiMalware_Pro.exe	"AntiMalware Pro rogue security software - not recommended
U	AntiPopUp	AntiPopUp.exe	"AntiPopUp for IE - pop-up stopper"
X	AntiSpionage	pgs.exe	"AntiSpionage
X	AntiSpionagePro	pgs.exe	"AntiSpionagePro
X	antispy	ANTIVIR.exe	"IE AntiVirus rogue security software - not recommended
X	antispy	ANTIVIRUS.exe	"IE AntiVirus rogue security software - not recommended
X	antispy	ieav.exe	"IE AntiVirus rogue security software - not recommended
X	antispy	scan.exe	"IE AntiVirus rogue security software - not recommended
X	AntiSpy2008	AntiSpy2008.exe	"Antispy 2008 rogue spyware remover - not recommended
X	AntiSpyBoss	asb32.exe	"AntiSpyBoss rogue security software - not recommended
X	AntiSpyCheck	AntiSpyCheck.exe	"AntiSpyCheck rogue spyware remover - not recommended
X	AntiSpyCheck 2.1	AntiSpyCheck 2.1.exe	"AntiSpyCheck rogue spyware remover - not recommended
X	AntiSpyCheck 2.1.0	AntiSpyCheck.exe	"AntiSpyCheck rogue spyware remover - not recommended
X	AntiSpyControl	pgs.exe	"AntiSpyControl rogue security software - not recommended
X	AntiSpyGolden	AntiSpyGolden 5.1.exe	"AntiSpyGolden rogue spyware remover - not recommended"
X	AntiSpyGolden 5.1	AntiSpyGolden 5.1.exe	"AntiSpyGolden rogue spyware remover - not recommended"
X	AntiSpyGuard	AntiSpyGuard.exe	"AntiSpyGuard rogue security software - not recommended
X	AntiSpyKit	AntiSpyKit 5.3.exe	"AntiSpyKit rogue spyware remover - not recommended
X	AntiSpyKit 5.2	AntiSpyKit 5.2.exe	"AntiSpyKit rogue spyware remover - not recommended
X	AntiSpyKit 5.3	AntiSpyKit 5.3.exe	"AntiSpyKit rogue spyware remover - not recommended
X	AntiSpyMon	AntiSpyMon.exe	"Antispyware Protector rogue security software - not recommended"
X	antispysoldier	antispysoldier.exe	"AntiSpyware Soldier rogue spyware remover - not recommended
X	AntispySpider	antispyspider.exe	"AntiSpySpider rogue spyware remover - not recommended
X	AntispyStorm	AntispyStorm.exe	"AntispyStorm rogue security software - not recommended
X	AntiSpyware	AntiSpyware.exe	"AntiSpywareApp rogue spyware remover - not recommended
X	AntiSpyware Pro	AntiSpyware Pro.exe	"AntiSpyware Pro 2009 rogue spyware remover - not recommended
X	Antispyware PRO XP	asproxp.exe	"AntiSpyware Pro XP rogue spyware remover - not recommended
X	Antispyware-2008.exe	Antispyware-2008.exe	"AntiSpyware 2008 rogue security software - not recommended
Y	AntiSpyWare2Guard	AntiSpyWare2Guard.exe	"Part of Ashampoo® AntiSpyWare 2 from Ashampoo GmbH & Co. KG. This part is the realtime monitor that looks for changes on the users system such as BHO
X	AntiSpyware3000.exe	antispyware.exe	"AntiSpyware 3000 rogue spyware remover - not recommended
X	AntiSpywareBot	AntiSpywareBot.exe	"AntiSpywareBot rogue spyware remover - not recommended
X	AntiSpywareControl	pgs.exe	"AntiSpywareControl rogue security software - not recommended
X	AntispywareD	AntispywareD.exe	"AntiSpywareDeluxe rogue security software - not recommended
X	AntiSpywareExpert	ase.exe	"AntiSpywareExpert rogue security software - not recommended
X	AntiSpywareGuard	asg.exe	"AntiSpywareGuard rogue spyware remover - not recommended
X	AntiSpywareMaster	asm.exe	"AntiSpywareMaster rogue security software - not recommended
X	AntiSpywareShield	AntiSpywareShield.exe	"AntiSpywareShield rogue security software - not recommended
X	AntiSpywareSuite	pgs.exe	"AntiSpywareSuite rogue security software - not recommended. A member of the AVSystemCare family"
X	AntiSpywareXP 2009	AntiSpywareXP2009.exe	"AntiSpywareXP 2009 rogue spyware remover - not recommended
X	AntiSpyZone	AntiSpyZone.exe	"AntiSpyZone rogue spyware remover - not recommended"
X	AntiSpyZone 4.5	AntiSpyZone 4.5.exe	"AntiSpyZone rogue spyware remover - not recommended"
X	AntiSpyZone 4.6	AntiSpyZone 4.6.exe	"AntiSpyZone rogue spyware remover - not recommended"
X	AntiSpyZone 4.9	AntiSpyZone 4.9.exe	"AntiSpyZone rogue spyware remover - not recommended"
X	AntiSpyZone 5.1	AntiSpyZone 5.1.exe	"AntiSpyZone rogue spyware remover - not recommended"
X	AntiSpyZone 5.4	AntiSpyZone 5.4.exe	"AntiSpyZone rogue spyware remover - not recommended"
X	AntiTroy	AntiTroy.exe	"AntiTroy rogue security software - not recommended
X	AntiTroy.exe	AntiTroy.exe	"AntiTroy rogue security software - not recommended
X	AntiVer2008	pgs.exe	"AntiVer2008
X	AntiVermeans	AntiVermeans.exe	"Variant of the Antivermins rogue security software - not recommended
X	AntiVermins	AntiVermins.exe	"Antivermins rogue security software - not recommended
X	AntiVermins 3.0	AntiVermins 3.0.exe	"Antivermins rogue security software - not recommended
X	AntiVermins 3.3	AntiVermins 3.3.exe	"Antivermins rogue security software - not recommended
X	AntiVerminser	AntiVerminser.exe	"Variant of the Antivermins rogue security software - not recommended
X	AntiVerminsPro	AntiVerminspro.exe	"Antivermins rogue security software - not recommended
X	antiviirus	antiviirus.exe	Added by a variant of the AGENT.KEU TROJAN!
X	Antivir	svchst.exe	"Added by the RAGRUK-A TROJAN!"
X	AntiVir	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	AntiVir	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	AntiVir	smss.exe	"Added by the DWNLDR-GWE TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%"
Y	AntiVir XP	AVwin.exe	"AntiVir® PersonalEdition Classic - antivirus"
X	Antivir64	Antivir64.exe	"Antivir64 rogue spyware remover - not recommended
X	AntiviralGolden	AntiviralGolden.exe	"AntiviralGolden rogue security software - not recommended
X	AntiVirGear 3.7	AntiVirGear 3.7.exe	"AntiVirGear rogue security software - not recommended
X	AntiVirGear 3.8	AntiVirGear 3.8.exe	"AntiVirGear rogue security software - not recommended
X	AntiVirProtect	AntiVirProtect.exe	"AntiVirProtect rogue security software - not recommended
X	Antivirus	av.exe	"Added by the SINKIN TROJAN! Resets IE start page to realphx.com"
X	Antivirus	maja.exe	"Added by the NETSKY.H WORM!"
X	Antivirus	iexpl0res.exe	Added by an unidentified WORM or TROJAN!
X	AntiVirus	kaspery.exe	"Added by a variant of the RBOT WORM!"
X	AntiVirus	AntiVirus.exe	"Added by the BANKER-EHB TROJAN!"
X	Antivirus	Antvrs.exe	"AntiVirus 2008 rogue security software - not recommended
X	Antivirus	avm.exe	"Antivirus Master rogue security software - not recommended
X	Antivirus	vav.exe	"Vista Antivirus 2008 rogue security software - not recommended
X	Antivirus	aav.exe	"Advanced Antivirus rogue security software - not recommended
X	ANTIVIRUS	AVS.exe	"Antivirus Sentry rogue security software - not recommended
X	ANTIVIRUS	microAV.exe	"Micro Antivirus 2009 rogue security software - not recommended
X	Antivirus	MSA.exe	"MS Antivirus rogue security software - not recommended
X	ANTIVIRUS	UltraAV.exe	"Ultra Antivirus 2009 rogue security software - not recommended
X	Antivirus	xpa.exe	"Xpert Antivirus Enterprise rogue security software - not recommended
X	Antivirus	SPP.exe	"Spyware Preventer rogue security software - not recommended
X	Antivirus	sav.exe	"System Antivirus 2008 rogue security software - not recommended
X	Antivirus	uav.exe	"Ultimate Antivirus 2008 rogue security software - not recommended
X	Antivirus	wav.exe	"Windows Antivirus 2008 rogue security software - not recommended
X	Antivirus 2009	av2009.exe	"AntiVirus'09 rogue security software - not recommended
X	Antivirus 2009 plus	Antivirus 2009 plus.exe	"AntiVirus Plus rogue security software - not recommended
X	Antivirus Agent Pro	aap.exe	"Antivirus Agent Pro rogue security software - not recommended
X	Antivirus Installer	[path to trojan]	"Added by the BADGENT-A TROJAN!"
X	Antivirus PC 2009	avpc2009.exe	"Antivirus PC 2009 rogue security software - not recommended
X	Antivirus Pro 2009	AntivirusPro2009.exe	"AntiVirus Plus rogue security software - not recommended
X	Antivirus Pro 2010	AntivirusPro_2010.exe	"Antivirus Pro 2010 rogue security software - not recommended
X	AntiVirus Process	virprot.exe	"Added by a variant of the SDBOT WORM!"
X	Antivirus Protection Services	ccapp2.exe	"Added by the RBOT.EXI WORM!"
X	AntiVirus Update	updates.exe	"Added by the RBOT-JF WORM!"
X	AntiVirus Update	antivirus.exe	"Added by the RBOT-IF WORM!"
X	Antivirus Updates	avupdchk.exe	"Added by the AGOBOT-IP WORM!"
X	Antivirus-2008.exe	Antivirus-2008.exe	"Antivirus 2008 rogue security software - not recommended. Detected by Sophos as the FAKEAV-BK TROJAN!"
X	antivirus-2008pro.exe	antivirus-2008pro.exe	"Antivirus 2008 PRO rogue security software - not recommended. Detected by Sophos as the FAKEAV-AW TROJAN!"
X	Antivirus-Golden	Antivirus-Golden.exe	"Antivirus-Golden rogue security software - not recommended"
X	Antivirus.exe	Antivirus.exe	"Antivirus rogue security software - not recommended
X	Antivirus2008y	antvrs.exe	"AntiVirus 2008 rogue security software - not recommended
X	antivirus32	antivirus.exe	"Added by the SPYBOT.KAI WORM!"
X	AntivirusBEST	Installer.exe	"Installer for the AntivirusBEST rogue security software - not recommended. Removal instructions here"
X	AntivirusBEST	abest.exe	"AntivirusBEST rogue security software - not recommended
X	AntivirusDoc	AntivirusDoc.exe	"AntivirusDoc rogue security software - not recommended
X	AntivirusFiable	pgs.exe	"AntivirusFiable
X	AntivirusForAll	pgs.exe	"AntivirusForAll rogue security software - not recommended
X	AntivirusGold	AntivirusGold.exe	"AntivirusGold rogue security software - not recommended
X	AntivirusGold 5.1	AntivirusGold 5.1.exe	"AntivirusGold rogue security software - not recommended
X	AntiVirusLab2009	AntiVirusLab2009.exe	"Antivirus Lab 2009 rogue security software - not recommended
X	AntivirusOrdi	pgs.exe	"AntivirusOrdi
X	AntivirusPCPakke	pgs.exe	"AntivirusPCPakke
X	AntivirusPCSuite	pgs.exe	"AntivirusPCSuite rogue security software - not recommended
X	Antiviruspertutti	pgs.exe	"Antiviruspertutti rogue security software - not recommended. A member of the AVSystemCare family"
X	AntiVirusPro	AntiVirusPro.exe	"Anti Virus Pro rogue security software - not recommended"
X	AntiVirusProMFC	Antivirus Pro.exe	"AntiVirus Pro rogue security software - not recommended"
?	AntiVirusProtection	qumk.exe	"??"
X	AntivirusProtection	antivirusprotection.exe	"Antivirus Protection rogue security software - not recommended
X	Antivirusscherm	pgs.exe	"Antivirusscherm
X	AntivirusXP.exe	AntivirusXP.exe	"Antivirus XP Pro rogue security software - not recommended
X	AntiVirus_ProNET	AntiVirus_Pro.exe	"AntiVirusPro rogue security software - not recommended
X	AntiVituS	Base.exe	"Added by the BAS.A WORM!"
X	antiware	elite***32.exe [*** = random char]	"Added by the DLOADER-HW TROJAN!"
U	AntiWindowsMessenger	AntiMsMsg.exe	"Anti-Windows_Messenger is a small application that prevents Windows Messenger from remaining resident in memory"
X	AntiWorm2008	pgs.exe	"AntiWorm2008 rogue security software - not recommended. A member of the AVSystemCare family"
X	anti_troj	anti_troj.exe	"Malware installed by different rogue security software including SpyKillerPro. Also detected as the LODEAR.D TROJAN!"
U	AnVir	AnVir.exe	"AnVir Task Manager - ""is a tool that controls everything running on computer and provides Windows enhancements that help in every-day work"". Monitors and manages startup programs
U	AnVir Security Suite	AnVir.exe	"AnVir Security Suite - ""is a tool that controls everything running on computer and provides Windows enhancements that help in every-day work"". Monitors and manages startup programs
U	AnVir Task Manager	AnVir.exe	"AnVir Task Manager - ""is a tool that controls everything running on computer and provides Windows enhancements that help in every-day work"". Monitors and manages startup programs
U	AnVir Task Manager Free	AnVir.exe	"AnVir Task Manager Free - ""is a tool that controls everything running on computer and provides Windows enhancements that help in every-day work"". Monitors and manages startup programs
U	AnVir Task Manager Pro	AnVir.exe	"AnVir Task Manager Pro - ""is a tool that controls everything running on computer and provides Windows enhancements that help in every-day work"". Monitors and manages startup programs
U	anvshell	anvshell.exe	System Tray tool for ASUS video cards. If disabled you lose all the ASUS specific video card options in Control Panel -> Display Properties -> Advanced as well as the System Tray shortcuts toolbar
X	AnvTrgr	AnvTrgr.exe	"AntivirusTrigger rogue security software - not recommended
U	Any To-Do List	anytodo.exe	"Any To-Do List ""the ultimate software solution to keep yourself organized and reminded"""
?	anycom bluetooth	ftflauncher.exe	"Associated with an Anycom bluetooth wireless card. What does it do and is it required?"
U	AnyDVD	AnyDVD.exe	"AnyDVD - descrambles DVD-Movies automatically in the background and the DVD appears unprotected and region code free. Also removes prohibited operations from the DVD such as skipping adverts - hence the ""U"" recommendation"
U	AnyDVD	AnyDVDtray.exe	"System Tray access to AnyDVD from SlySoft - which descrambles DVD-Movies automatically in the background and the DVD appears unprotected and region code free. Also removes prohibited operations from the DVD such as skipping adverts"
X	anything	ATITAX.exe	"Added by the FORBOT-DP WORM!"
U	AnyTime	Atw.exe	"AnyTime Organizer Deluxe from Individual Software Inc - ""all the tools you need to organize your calendar
U	AnyTime Organizer	AtDem.exe	"AnyTime Organizer Deluxe from Individual Software Inc - ""all the tools you need to organize your calendar
U	AnyTime Organizer	Atw.exe	"AnyTime Organizer Deluxe from Individual Software Inc - ""all the tools you need to organize your calendar
X	AOL 9.0 Optimized	AOLClient.exe	"Added by the SPYBOTER.A TROJAN!"
U	AOL Broadband Check-Up	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	AOL Companion	companion.exe	"The AOL Companion is a small window that appears when you connect to the service using verison 8.0 and early builds of version 9.0. ""Use the Companion to quickly get to your favourite features
X	Aol Configuration Loader	aimsng.exe	"Added by the SDBOT-XE WORM!"
X	AOL Instant Messanger	aim.exe	"Added by the SDBOT-YT WORM! Note - this is not the popular AOL Instant Messenger utility"
X	AOL Instant Messengar	aol.exe	"Added by the AGOBOT-FN WORM!"
X	AOL Instant Messenger	AlM.EXE	"Added by unidentified malware. Note - there ia a lower case ""L"" between the A and M in the filename"
X	Aol Instant Messenger	aolmsg.exe	"Added by the KELVIR.AL WORM!"
X	AOL Instant Messenger	aimsgr.exe	"Added by the IRCBOT.N TROJAN!"
X	AOL Instant Messenger 7.213	aim9283.exe	"Added by the SDBOT-ZF WORM!"
X	AOL Instant Messenger dll runtime	MSAOL32dll.exe	"Added by the RBOT-ATA WORM!"
X	Aol Instant Messenger Fix	aolfix.exe	"Added by the SDBOT-ABJ WORM!"
X	AOL Messenger	[random filename]	"Added by an unidentified VIRUS
X	AOL Messenger	aolmsngr.exe	"Added by the SDBOT-JF WORM!"
X	AOL Messenger Optimized	AOLOpt.exe	"Added by the AOLOPT TROJAN!"
U	AOL Spyware Protection	AOLSP Scheduler.exe	AOL's spyware protection program
U	AOL TopSpeedMonitor	aoltsmon.exe	"AOL's TopSpeed ""web-acceleration technology speeds up your web-browsing experience by storing and reusing elements of web pages that you visit
Y	AolAcsDaemon1	Acsd.exe	"AOL Connectivity Service - automatically restores the connection to AOL should you lose it while online. Negates having to go through the procedure of signing back on manually. This version is obsolete and has been replaced by AOLACSD.EXE so update your version of AOL. Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
Y	AolAcsDaemon1	AOLACSD.EXE	"AOL Connectivity Service - automatically restores the connection to AOL should you lose it while online. Negates having to go through the procedure of signing back on manually. Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
?	AOLCC	ACCAgnt.exe	"AOL ISP software related
X	AolCon	config.com	"Added by the TAPLAK WORM!"
?	AOLSAV	AOLAgent.exe	"AOL ISP related. What does it do and is it required?"
X	AOLSPYWAREREMOVER32	AOLSPYWARECLEANER32.EXE	"Added by the SPYBOT-HJ WORM!"
X	Aornum	aornum.exe	"Installed along with
X	APcDefender	APcDefender.exe	"APcDefender rogue security software - not recommended
U	APC_SERVICE	mainserv.exe	"APC PowerChute® Personal Edition - ""safe system shutdown software with sophisticated power management functions."" Appears as a service in XP/Vista and under the ""RunServices"" registry key in Win98"
X	Api**.exe [* = random char]	Api**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Api**32.exe [* = random char]	Api**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	APIMon	apimonx.exe	Added by the TIBSER.A downloader TROJAN!
X	APIMon	winapix.exe	Added by a variant of the TIBSER.A downloader TROJAN!
X	APIMon	msreg.exe	"Added by the DROPPER.Z TROJAN!"
X	apmanager.exe	apmanager.exe	"AP Manager ransomware download manager - not recommended
U	Apoint	Apoint.exe	Touchpad software for laptop PC's. For instance it is found on the Panasonic and Sony Vaio machines and allows part of the touchpad to be used for document or Web-page scrolling. Required for proper functioning of the pointing software but not required for the laptop to work
X	App**32.exe [* = random char]	App**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	App.EXEName	[path to worm]	"Added by the BODIRU WORM!"
U	Appcon	vAppCon.exe	"Vital Application Console - part of POS-partner 2000 point-of-sale software from Vital. This is the taskbar icon and is enabled at startup by the "Auto-start when OS starts" option. Required for a connection to be established"
X	appconn	appconn.exe	"Added by the CARGAO WORM!"
U	AppExtender	AppExtCB.exe	"Loads the Confimax add-in for popular E-mail programs to confirm E-mails have been sent and received"
N	AppleSyncNotifier	AppleSyncNotifier.exe	"From WinPatrol PLUS by BillP Studios - ""This file installs with iTunes and is used when syncing your iPhone
X	AppletINIT	INITIATE.EXE	"Added by the AGOBOT.XV TROJAN!"
Y	Application	mdmsetsp.exe	"Aztech Labs modem driver"
X	Application	csrss.exe	"Added by the BEAGLE.EG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Application Adapter	abvsvc.exe	"Added by the CHECKOUT WORM!"
U	Application Explorer	Naldesk.exe	"Novell Zenworks Application Explorer Executable. ""For almost all users the Novell ZENworks agent (either Application Launcher or Application Explorer) will be run via the user's login script on each successful login. ZENworks is used to periodically deliver software updates and is also used to install the remote management components."""
U	Application Explorer	NalView.exe	"Application Explorer - file manager type access to Novell Application Launcher for installing and updating network residing applications"
X	Application Explorer	appexplr.exe	"Added by the AGENT-NMO TROJAN!"
X	Application In System	Snxmsh.exe	"Added by the AGENT-LNV TROJAN!"
N	Application Launcher	Application Launcher.exe	"System Tray access to the Sony Ericsson PC Suite and HTC Sync mobile phone management utilities. Run manually via the Start Menu (or optional desktop shortcut) before connecting the phone"
X	Application Layer Browser	abgsvc.exe	"Added by the ULPM.FX TROJAN!"
X	Application Layer Gateway Service	algs.exe	"Added by the LINKBOT.M WORM!"
X	Application Layer Scheduler	agtsvc.exe	"Added by the IRCBOT.BJJ BACKDOOR!"
X	Application Layer Services	avrsvc.exe	"Added by the IRCBOT.BJM BACKDOOR!"
X	Application Manager	acnsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Application Manager	apnsvc.exe	"Added by the SMALLTRO.FN TROJAN!"
X	ApplicationProtocolRun	smsbvl32.exe	"Added by the IRCBOT-CX TROJAN!"
Y	Apvxd	APVXDWIN.EXE	"Part of Panda Antivirus and Internet Security. Required to enable permanent virus protection"
Y	Apvxdwin	APVXDWIN.EXE	"Part of Panda Antivirus and Internet Security. Required to enable permanent virus protection"
Y	APVXDWIN	ClShield.exe	"""Panda ClientShield with TruPrevent is designed for companies that want the best protection for their workstations. It protects against viruses and other known and unknown threats including spam
X	apyginapygin	simenu.exe	"Added by the SDBOT.BTR WORM!"
X	ara-key	[random filename]	"Added by the ANTINNY WORM!"
?	ArabLionZ Drive	ArabLionZ.Drive.exe	"ArabLionZ Drive - part of ArabLionZ XP Tools. What does it do and is it required?"
X	ARCHIVE CONTROL	fixupdattr.exe	"Added by the MYTOB.GU WORM!"
N	ArcSoft Connect	ACDaemon.exe	"Used to serve notice of product information and updates when running ArcSoft products such as TotalMedia
N	ArcSoft Connection Service	ACDaemon.exe	"Used to serve notice of product information and updates when running ArcSoft products such as TotalMedia
N	ARCSolo Recovery	N/A	Backup software by Computer Associates - no longer supported
U	Argentum Backup	ab.exe	"Argentum Backup - a small backup program that lets you easily back up your documents and folders"
X	Arman	[path to worm]	"Added by the IRCBOT-TG WORM!"
U	ARMOR2NET	Armor2net.exe	"Related to Armor2net personal firewall (possibly contains or is related to a product known as ArmorWall - which is a known rogue
X	ArmorDefender	ArmorDefender.exe	"ArmorDefender rogue security software - not recommended
U	army logo	readmename.exe	"Torrent101 potentially unwanted torrent client application that installs a Browser Helper Object and displays advertisements"
N	AROReminder	aro.exe	"Advanced Registry Optimizer - ""scan
U	Arovax AntiSpyware	arovaxantispyware.exe	"Part of Arovax AntiSpyware from Arovax
U	arovaxantispyware	arovaxantispyware.exe	"Part of Arovax AntiSpyware from Arovax
X	Arucer	"rundll32 Arucer.dll	Arucer"
X	Arucer Dynamic Link Library	"rundll32 Arucer.dll	Arucer"
U	AS00_WN511B	WN511B.exe	"Netgear RangeMax NEXT wireless adapter configuration utility"
?	AS00_WPN511	WPN511.exe	"NetgearRev MFC Application - software for Netgear wireless network cards - what does it do and is it required in startup?"
X	ASC-AntiSpyware	WinCleaner.exe	"WinCleaner 2009 rogue security software - not recommended
X	ASC-AntiSpyware	WinAntivirus.exe	"Win Antivirus Vista/XP rogue security software - not recommended
X	ASDPLUGIN	dsldbaccess.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	canada.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	france.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	fullgames.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	100171be.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	100176br.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	adult1.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	Austria.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	belgium_nm.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	czech.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	dbaccess.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	dslgeaccess.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	Finland.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	geaccess.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	mexico.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	netherlands.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	turkey.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	uk_nm.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	Xadult1.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	temp532.exe	"AsdPlug premium rate adult content dialer"
X	asdx	xwinrpc32.exe	"Added by the AGOBOT.VO WORM!"
Y	Ashampoo AntiSpyWare 2	AntiSpyWare2Guard.exe	"Part of Ashampoo® AntiSpyWare 2 from Ashampoo GmbH & Co. KG. This part is the realtime monitor that looks for changes on the users system such as BHO
Y	Ashampoo AntiSpyWare 2 Guard	AntiSpyWare2Guard.exe	"Part of Ashampoo® AntiSpyWare 2 from Ashampoo GmbH & Co. KG. This part is the realtime monitor that looks for changes on the users system such as BHO
Y	Ashampoo AntiVirus Service	GuardGui.exe	"System Tray access to the main user interface for Ashampoo® AntiVirus from Ashampoo GmbH & Co. KG."
U	Ashampoo Core Tuner	ct.exe	"Ashampoo® Core Tuner from Ashampoo GmbH & Co. KG - a utility which helps you to get the most out of a multi-processor (or dual core) computer. ""For instant results you just need to select Auto-Optimize to optimize all the programs you are running or Boost to give more power to a single program"". This entry loads Core Tuner with Windows (required if you use any optimized profiles) and gives System Tray access"
U	Ashampoo HDD Control Guard	HDDControlGuard.exe	"Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access"
U	Ashampoo Magical Optimizer Taskplaner	AMO_TA~1.EXE	"Part of Ashampoo® Magical Optimizer from Ashampoo GmbH & Co. KG - which removes stagnant and unnecessary hard drive files
U	Ashampoo Magical Optimizer Taskplaner	AMO_Taskplaner.exe	"Part of Ashampoo® Magical Optimizer from Ashampoo GmbH & Co. KG - which removes stagnant and unnecessary hard drive files
N	ashampoo Magical UnInstall	MagicalUnInstall.exe	"Ashampoo® Magical UnInstall from Ashampoo GmbH & Co. KG - which monitors each new program installation
N	ashampoo UnInstaller Watcher	UIWatcher.exe	"Part of the Ashampoo® UnInstaller series from Ashampoo GmbH & Co. KG - including UnInstaller Platinum 2
U	ASK	rundll32.exe [path] ASK.dll rdl	"Stealth Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
U	ASM	ASMonitor.exe	"Active Security Monitor from AOL - helps you determine how vulnerable your PC is to computer viruses
U	Asmw Soft Popups Burner	popups burner.exe	"Popup blocker
X	asnconsole	msasn.exe	"Added by the RBOT.EVU TROJAN!"
X	ASP.NET State Service	csrss.exe	"Added by the DLOADER-QI TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	ASP.NET State Service	crsass.exe	"Added by the BANLOAD-M TROJAN!"
X	ASP.NET State Service	servicos..exe	"Added by the DADOBRA-I TROJAN!"
Y	AspireTimeMachine	acertmb.exe	"System recovery software supplied with some Acer notebook PCs. Similar to GoBack and the restore program in WinXP
X	Ass and titties	CMD32.EXE	"Added by the SDBOT-GG BACKDOOR!"
?	ASUS Camera ScreenSaver	ASScrProlog.exe	"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
?	ASUS Screen Saver Protector	ASScrPro.exe	"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
U	ASUS TweakEnable	astart.exe	ASUS TweakEnable - restores manually changed settings for ASUS based video cards such as overclocking. Only required if you use non-standard settings
U	AsusEPCMonitor	AsEPCMon.exe	"Part of the ACPI driver for the Asus Eee PC range. Manages the Fn function keys and ""on screen display"""
?	AsusStartupHelp	AsRunHelp.exe	"Unknown ASUS motherboard utility. What does it do and is it required?"
U	asustweakenable	ATweak.exe	ASUS TweakEnable - restores manually changed settings for ASUS based video cards such as overclocking. Only required if you use non-standard settings
X	ASWnk	aswnk.exe	Adult content dialler
X	atf_reinstall	atf.exe	"Part of the AVSystemCare rogue security software - not recommended. See here"
U	Athan	Athan.exe	"Athan - an application that calculates and reminds the five daily Islamic prayer times for anywhere in the world"
U	ATI 2D Component	Ati2mdxx.exe	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. After testing it's exact function isn't known at this time and it doesn't appear to be running even with the startup entry enabled - hence the ""U"" recommendation"
X	ATI Active Graphics Card Monitor	atievx.exe	"Added by the IRCBOT-TL WORM!"
X	ATI AS Filter	msnse.exe	"Added by the RBOT-CCY WORM! Note - modifies the HOSTS file by appending numerous lines
X	Ati Control Panel	atiphexx.EXE	"Added by the RBOT-BR WORM!"
X	ATI Cpanel	atiphexx.exe	"Added by the AGOBOT-NV WORM!"
U	ATI Desktop Component	ATIPTAXX.EXE	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. Provides System Tray access to display settings (including desktop resolution
X	Ati Display Settings	atividx.exe	"Added by the RBOT-GAS WORM!"
U	ATI Launchpad	launchpd.exe	"Convenient way to start all your Multimedia Center applications (DVD
Y	ATI Remote Control	ATIRW.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
Y	ATI Remote Control	ATIX10.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
N	ATI Task Application	Atitkad.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display
N	ATI Task Application (Atikey)	Atitask.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display
U	ATI Technologies Inc. HydraVision Desktop Manager	HydraDM.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is the HYDRAVISION Desktop Manager - which ""customizes the behaviour of windows and dialog boxes
U	ATI Technologies Inc. HydraVision Viewport	HydraMD.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is HYDRAVISION MultiDesk - which ""creates
X	ATI Technology Startup	techstart.exe	"Added by the RBOT-AEU WORM!"
X	ATI Video Driver Control	atigfx.exe	"Added by the RBOT-FWL WORM!"
X	ATI Video Driver Control	btorrent.exe	"Added by a variant of the IRCBOT TROJAN!"
X	ATI Video Driver Controls	[path to worm]	"Added by the SDBOT-DDS WORM!"
N	ATICCC	cli.exe runtime	"ATI's Catalyst™ CONTROL CENTER. Required if you want to change graphics settings on a regular basis but you must have internet access and Microsoft's .NET framework installed. Note that this has ""runtime"" appended to cli.exe in the ""Command"" column of MSCONFIG. Recommend that start the program manually via Start → Programs → ATI Catalyst Control Center → Advanced → Restart Runtime as it can cause problems when starting Windows"
X	AtiCpanel	atiphexx.exe	"Added by the AGOBOT.IL WORM!"
U	ATIModeChange	Ati2mdxx.exe	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. After testing it's exact function isn't known at this time and it doesn't appear to be running even with the startup entry enabled - hence the ""U"" recommendation"
X	AtiPanel	atip.exe	"Added by the TACTSLAY.U TROJAN!"
Y	ATIRmtWndr	ATIX10.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
U	AtiSound	csrss.exe	"WinSpy surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""ComRoot"" subfolder"
X	atisrc2	windfind.exe	"Added by the WINDFIND-A TROJAN!"
X	ativopen	ativopen.exe	Premium rate adult content dialler
X	Atl**.exe [* = random char]	Atl**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Atl**32.exe [* = random char]	Atl**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	ATM Control	adpn.exe	"Added by the MMS.A WORM!"
N	ATnotes	atnotes.exe	Loads the ATnotes program for virtual sticky notes for your desktop. Available via Start -> Programs
U	Atomic Time Synchronizer	TimeSync.exe	"TimeSync - lets you synchronize your computer's clock with any internet atomic clock"
U	AtomSync	atomsync.exe	"AtomSync - ""this NTP client synchronizes your PC clock with an internet atomic time server or with a time server on your LAN"""
U	ATTBroadbandUpdate	SAUpdate.exe	"Big Brother from Quest Software. System and network monitor"
X	AttuneClientEngine	attune_ce.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	AttuneContentUpdater	attune_cu.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	AttuneDiscovery	attune_di.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	Attunel	Attunel.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	AttuneSystray	attune_st.exe	"Aveo Attune automated helpdesk software - adware/spyware"
N	aTuner	atuner.exe	"aTuner - tweak tool for GeForce based graphics cards"
U	AU Agent	AUagent.exe	"Au Agent from Zilab Software. Win2K/NT enhancement tool. Allows you to run applications under any security context without closing the whole logon session to process a new logon"
Y	AUCBPNP	aucbnpn.exe	Adaptec USB CardBus Safe-Eject - driver for the Adaptec USB 2.0 CardBus which provides USB 2.0 ports for laptop users via a PCMCIA card slot
X	Audcntr	audcntr.exe	"Added by the GEMA TROJAN!"
?	AudCtrl	"RunDll32 AudCtrl.dll	RCMonitor"
X	AUDIO	SOUND.exe	"Added by the PLOYB-A TROJAN!"
X	Audio Device Manager	winfp.exe	"Added by the IRCBOT-XS WORM!"
X	Audio Device Manager	WinNT.exe	"Added by the IRCBOT.USP BACKDOOR!"
X	Audio Device Manager	WNDXP.exe	"Added by the IRCBOT.AJL BACKDOOR!"
X	Audio Device Manager	sfhgj.exe	"Added by the IRCBOT-ZA BACKDOOR!"
X	Audiocntl	audiocntl.exe	"Added by a variant of the CRYPTER.C TROJAN!"
N	AudioCommander	AudioCommander.exe	"System Tray access to the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
N	AudioCommander Application	AudioCommander.exe	"System Tray access to the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
N	AudioCommanderVista	AudioCommander.exe	"System Tray access to the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
X	audioinf	audioinf.exe	"Added by a variant of the CRYPTER.C TROJAN!"
X	AudioMan	Explorer.sm1	"Added by the HUPIGON.IFZ BACKDOOR!"
X	audlmne32	dcmsxe.exe	"Added by the MAILBOT-CF TROJAN!"
X	AUNPS2	"RUNDLL32 AUNPS2.DLL	_Run@16"
Y	Aureal A3D Interactive Audio	sa3dsrv.exe	For Aureal based 3D soundcards. A3D sound features won't work with this disabled
Y	Aureal A3D Interactive Audio Init	A3dInit.exe	For Aureal based 3D soundcards. A3D sound features won't work with this disabled
X	Auth Starter Ident	startauth.exe	"Added by the RBOT-WP WORM!"
Y	Authentic-ID Toolbar	wintmr.exe	"System Tray access to Child Control parental control software by Salfield"
Y	Authentic-ID Toolbar	"rundll32.exe [path] ToolbarATL.dll	LoadTrayIcon"
X	auto	win32.exe	"Added by an unidentified TROJAN! See here"
U	Auto EPSON PictureMate Deluxe on X	E_FATI9TA.EXE	"Epson Status Monitor 3 for the PictureMate Deluxe compact photo printer - for monitoring printer status
U	Auto EPSON Stylus C45 Series on X	E_S4I3T1.EXE	"Epson Status Monitor 3 for the Stylus C45 Series printer - for monitoring printer status
U	Auto EPSON Stylus C48 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C48 Series printer - for monitoring printer status
U	Auto EPSON Stylus C48 Series on X	E_S4I091.EXE	"Epson Status Monitor 3 for the Stylus C48 Series printer - for monitoring printer status
U	Auto EPSON Stylus C60 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C60 Series printer - for monitoring printer status
U	Auto EPSON Stylus C62 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C62 Series printer - for monitoring printer status
U	Auto EPSON Stylus C64 Series on X	E_S4I2C1.EXE	"Epson Status Monitor 3 for the Stylus C64 Series printer - for monitoring printer status
U	Auto EPSON Stylus C82 Series on X	E_S0HIC1.EXE	"Epson Status Monitor 3 for the Stylus C82 Series printer - for monitoring printer status
U	Auto EPSON Stylus C84 Series on X	E_S4I2D1.EXE	"Epson Status Monitor 3 for the Stylus C84 Series printer - for monitoring printer status
U	Auto EPSON Stylus C87 Series on X	E_FATIABL.EXE	"Epson Status Monitor 3 for the Stylus C87 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3200 on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus CX3200 printer - for monitoring printer status
U	Auto EPSON Stylus CX3500 Series on X	E_FATI9 BL.EXE	"Epson Status Monitor 3 for the Stylus CX3500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3600 Series on X	E_FATI9BE.EXE	"Epson Status Monitor 3 for the Stylus CX3600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3700 Series on X	E_FATIACP.EXE	"Epson Status Monitor 3 for the Stylus CX3700 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3800 Series on X	E_FATIACA.EXE	"Epson Status Monitor 3 for the Stylus CX3800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4200 Series on X	E_FATIAEA.EXE	"Epson Status Monitor 3 for the Stylus CX4200 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4500 Series on X	E_FATI9AP.EXE	"Epson Status Monitor 3 for the Stylus CX4500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4600 Series on X	E_FATI9AA.EXE	"Epson Status Monitor 3 for the Stylus CX4600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4800 Series on X	E_FATIADA.EXE	"Epson Status Monitor 3 for the Stylus CX4800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX5000 Series on X	E_FATIBVA.EXE	"Epson Status Monitor 3 for the Stylus CX5000 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX5400 on X	E_S4I2G1.EXE	"Epson Status Monitor 3 for the Stylus CX5400 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX5500 Series on X	E_FATICAP.EXE	"Epson Status Monitor 3 for the Stylus CX5500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6000 Series on X	E_FATIBIA.EXE	"Epson Status Monitor 3 for the Stylus CX6000 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6400 on X	E_S4I2L1.EXE	"Epson Status Monitor 3 for the Stylus CX6400 printer - for monitoring printer status
U	Auto EPSON Stylus CX6600 Series on X	E_FATI9EE.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6600 Series on X	E_FATI9EA.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX7400 Series on X	E_FATICDA.EXE	"Epson Status Monitor 3 for the Stylus CX7400 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX7800 Series on X	E_FATIAFA.EXE	"Epson Status Monitor 3 for the Stylus CX7800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX9400Fax Series on X	E_FATICFA.EXE	"Epson Status Monitor 3 for the Stylus CX9400Fax Series printer - for monitoring printer status
U	Auto EPSON Stylus D78 Series on X	E_FATIBGE.EXE	"Epson Status Monitor 3 for the Stylus D78 Series printer - for monitoring printer status
U	Auto EPSON Stylus D88 Series on X	E_FATIABE.EXE	"Epson Status Monitor 3 for the Stylus D88 Series printer - for monitoring printer status
U	Auto EPSON Stylus DX3800 Series on X	E_FATIACE.EXE	"Epson Status Monitor 3 for the Stylus DX3800 Series printer - for monitoring printer status
U	Auto EPSON Stylus DX4800 Series on X	E_FATIADE.EXE	"Epson Status Monitor 3 for the Stylus DX4800 Series printer - for monitoring printer status
U	Auto EPSON Stylus DX6000 Series on X	E_FATIBIE.EXE	"Epson Status Monitor 3 for the Stylus DX6000 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo 1400 Series on X	E_FATIBUA.EXE	"Epson Status Monitor 3 for the Stylus Photo 1400 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo 820 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo 820 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R1800 on X	E_FATI9LA.EXE	"Epson Status Monitor 3 for the Stylus Photo R1800 printer - for monitoring printer status
U	Auto EPSON Stylus Photo R200 Series on X	E_S4I2H1.EXE	"Epson Status Monitor 3 for the Stylus Photo R200 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R200 Series on X	E_S4I0H2.EXE	"Epson Status Monitor 3 for the Stylus Photo R200 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R220 Series on X	E_FATIAIE.EXE	"Epson Status Monitor 3 for the Stylus Photo R220 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R2400 on X	E_FATI9SA.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	Auto EPSON Stylus Photo R2400 on X	E_FATI9SE.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	Auto EPSON Stylus Photo R260 Series on X	E_FATIBNA.EXE	"Epson Status Monitor 3 for the Stylus Photo R260 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R280 Series on X	E_FATICKA.EXE	"Epson Status Monitor 3 for the Stylus Photo R280 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R300 Series on X	E_S4I2F1.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R300 Series on X	E_S4I0F2.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R320 Series on X	E_FATI9FA.EXE	"Epson Status Monitor 3 for the Stylus Photo R320 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R340 Series on X	E_FATIAJE.EXE	"Epson Status Monitor 3 for the Stylus Photo R340 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R800 on X	E_FATI9YE.EXE	"Epson Status Monitor 3 for the Stylus Photo R800 printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX420 Series on X	E_FATI9CE.EXE	"Epson Status Monitor 3 for the Stylus Photo RX420 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX500 on X	E_S4I2K1.EXE	"Epson Status Monitor 3 for the Stylus Photo RX500 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX600 on X	E_S4I2M1.EXE	"Epson Status Monitor 3 for the Stylus Photo RX600 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX680 Series on X	E_FATICJA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX680 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX700 Series on X	E_FATI9IA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX700 Series printer - for monitoring printer status
U	Auto EPSON Stylus Pro 7600 on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Pro 7600 printer - for monitoring printer status
X	Auto File System Conversion Utility	scricon.exe	"Added by the SDBOT.EYB WORM!"
U	Auto Run Software for Photo Frame	PhotoManager.exe	"Management software for Philips digital PhotoFrame range. Used to edit photos and transfer them directly from a PC via a USB cable. Start manually when you connect the device"
X	Auto Start	dosin.exe	"Added by the SDBOT-GO BACKDOOR!"
X	Auto Start	sndvol32.exe	"Added by the SLINBOT.AX BACKDOOR!"
X	Auto Start	windos.exe	"Added by the SLINBOT.BO BACKDOOR!"
X	Auto Updat	WindowsSys32.exe	"Added by a variant of the FORBOT WORM!"
X	Auto WinUpdate	taskmrg.exe	"Added by the RBOT-AFA WORM!"
X	AutoAdministrator	SERVICES.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Root%\Application Data\WINDOWS"
X	autochk	"rundll32.exe autochk.dll	_IWMPEvents@16"
X	autochk	"rundll32.exe protect.dll	_IWMPEvents@16"
N	AutoEA	Ahqrun.exe	For Creative Soundblaster Live! series soundcards. Specify for any audio application what audio preset to automatically associate with currently active speaker output. Available via AudioHQ
X	autoload	cftmon.exe	"Added by the SOCKS-E WORM!"
X	autoload	windowsupdate.exe	"Added by the POLYCRYP.DY TROJAN!"
X	Autoloaderaproposclient	Apropos_Client_Loader.exe	"AproposMedia adware"
X	Autoloaderaproposclient	cxtpls_loader.exe	"AproposMedia adware"
X	AutoLoaderEnvoloAutoUpdater	auto_update_loader.exe	"Envolo/AproposMedia adware updater"
U	AutoMate5	Am5HkWnd.exe	"""Automate is the Leading Software for Automation of front and back-office business processes.It provides all the tools necessary to completely automate business processes
X	Automated Windows Updates	wauclt.exe	"Added by the GAOBOT.AJD WORM!"
X	Automatic Defrag Manager	defrag.exe	"Added by the RBOT-AKE WORM!"
X	Automatic Media Update	HPLNT32.RVD	Added by an unidentified WORM/TROJAN!
X	Automatic Microsoft Windows Updater	suchost.exe	"Added by the RBOT-EQ WORM!"
X	Automatic Windows Updater	Update.exe	"Added by the GAOBOT.AO WORM!"
N	Automatically launches the United Devices Agent when you start your computer	UD.EXE	The United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home but for medical research. Available via Start > Programs
X	autoMe	wscript.exe solution.vbs	"Added by the VBS.SASAN WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""solution.vbs"" file is found in %Windir%"
N	AUTOPROP	REGPROP.EXE WMPADDIN.DLL	"Both the files are in the MS Office/Bots/FP_WMP directory. Apparently
X	AUTOPROTECTU	navapq32.exe	Added by an unidentified WORM or TROJAN!
X	autorn	autorn.exe	"Added by the SILLYFDC.BCY WORM!"
X	autorun	autorun.exe	"Added by the AUTOM-B WORM!"
X	autorun	sxs.exe	"Added by the SMALLVBS-A WORM!"
X	autorun	winmain.exe	Added by a variant of the DELF.CNS TROJAN!
X	AutoRun	allrs.exe	"Added by the MUDROP.LJ TROJAN!"
X	autorundemo	[path to trojan]	"Added by the AGENT-FPX TROJAN!"
X	AUTORUN_VAL	AntiSpyCheck 2.1.exe	"AntiSpyCheck rogue spyware remover - not recommended
X	AUTORUN_VAL	asc 2.1.exe	"AntiSpyCheck rogue spyware remover - not recommended
?	AutoShutdown	pssvc.exe	"Utility to fix vCard Export in MS Outlook 2000 - although why are these together?"
X	autoupdate	"rundll32 DATADX.DLL	SHStart"
X	autoupdate	"rundll32 SUPDATE.DLL	SHStart"
X	Autoupdate Service	[path to trojan]	"Added by the AGENT-CB TROJAN!"
X	AutoVirusProtection	ciscv.exe	"Added by a variant of the RBOT WORM!"
X	auto__antiav__key	antiav_exe.exe	"Added by the BAGLEDI-AA TROJAN!"
X	AV	UPDATE-28062004.exe[25 blank spaces].vbs	"Added by the MIDFIN WORM!"
X	AV	Antivir.exe	"Antivir rogue security software - not recommended
X	AV AntiSpyware	ava.exe	"AV AntiSpyware rogue security software - not recommended
X	AV Client	patch31345.exe	"Added by the MYDOOM.AD WORM!"
X	AV Industry	patch31345.exe	"Added by the MYDOOM.AD WORM!"
X	AV7	antivirus7.exe	"Antivirus7 rogue security software - not recommended
N	AvaFind	AvaFind.exe	"AvaFind file search utility"
X	avagent3974	chnb8895.exe	"AntiVirus ransomware security software - not recommended
X	AVantivirus	Avconsol.exe	"Added by the MSNVB-D WORM!"
X	avast	troyan.exe	"Added by the SMALL.CZ TROJAN!"
Y	avast! Antivirus	ashDisp.exe	"System Tray access to and notifications for avast! Antivirus - giving left-click access to the On-Access Scanner
Y	avast! Web Scanner	Ashwebsv.exe	"Web scanning part of avast! Antivirus. Starts via a registry ""Run"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
X	avc	avmon.exe	Added by an unidentified TROJAN!
U	AvconsoleEXE	Avconsol.exe	From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Used to schedule regular scans. If you don't have scans scheduled you don't need it
X	Avengine	Avengine.com	"Added by the DELF.LJ TROJAN!"
X	AveoAttune	atmdlusr.exe	"Aveo Attune automated helpdesk software - adware/spyware"
U	AVFX Engine	StartFX.exe	"Advanced Video FX - supported by a number of Creative Web Cameras. ""Have more fun by adding a wide range of special effects and backgrounds to your video chat with Advanced Video FX"""
Y	AVG Anti-Spyware	avgas.exe	"System Tray access to and notifications for AVG Anti-Spyware 7.5. This has now been superseded by AVG Anti-Virus which includes Anti-Spyware"
Y	AVG Anti-Virus system	avgcc.exe	"System Tray access to and notifications for the 7.* series of anti-virus products from AVG Technologies. If this entry is disabled
Y	AVG Anti-Virus System	avgemc.exe	"E-mail scanner for the 7.* series of anti-virus products from AVG Technologies. This process scans incoming and outgoing E-mails for viruses and other malware. From version 7.1 onwards this entry only appears in 9x/Me as a startup entry
Y	AVG Anti-Virus System	avgw.exe	"This entry is included with the 7.* series of anti-virus products from AVG Technologies. Once installed (or on first run for a different user) it runs the configuration sequence to set up the product and doesn't run on subsequent restarts"
X	Avg Antivirus	icpldrvx.exe	"Added by the BANKER.BYU TROJAN!"
X	AVG AntiVirus Scanner	avgscnx.exe	"Added by the SILLYFDC.BBE WORM! Note - this is not a legitimate AVG entry"
X	AVG AntiVirus Updater	avgwusv.exe	"Added by the SILLYFDC.BAX WORM! Note - this is not a legitimare AVG entry"
U	AVG Internet Security	avgtray.exe	"System Tray access to and notifications for the range of internet security products from AVG Technologies - including Internet Security
Y	AVG7_Run	avgw.exe	"This entry is included with the 7.* series of anti-virus products from AVG Technologies. Once installed (or on first run for a different user) it runs the configuration sequence to set up the product and doesn't run on subsequent restarts"
Y	AVGnt	AVGnt.exe	"AntiVir® PersonalEdition Classic antivirus. System Tray icon and control program"
Y	AVG_RegCleaner	AVGREGCL.exe	"Boot time registry cleaner for the 7.* series of anti-virus products from AVG Technologies - for checking the registry for virus additions and other security problems"
Y	avinit	AVINIT9X.EXE	"Command Antivirus related"
X	Avira Anti-Virus Pro 2008	explorear.exe	Added by an unidentified WORM or TROJAN!
X	AVManager	csrss.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
?	AvMenu	AVMenu.exe	"Part of the ArcaVir antivirus suite from Polish company Arcabit. What does this part do and is it required?"
Y	AVMWlanClient	wlangui.exe	Related to broadband products from avm.de
X	avnort	formatsys.exe	"Added by the SERFLOG.A WORM!"
X	avnort	msmbw.exe	"Added by the SERFLOG.A WORM!"
X	avnort	serbw.exe	"Added by the SERFLOG.A WORM!"
X	AVP	[path to trojan]	"Added by the MUTBO-A TROJAN!"
X	avp	win*.tmp.exe [* is a number]	Added by a variant of the ALPHABET TROJAN!
X	avpl	Antivirus.exe	"AntiVirus Plasma rogue security software - not recommended
X	avptask	[path to trojan]	"Added by the NOFERE-G TROJAN!"
X	Avptask	rund1132.exe	"Added by the AGENT.PKZ TROJAN!"
X	Avril Lavigne - Muse	[random filename]	"Added by the AVRIL-A WORM!"
X	avscan	avscan.exe	"Added by the SILLYFDC.BCR WORM! The file is in the users %Temp% directory"
X	AVScan	winav.exe	Unidentfied rogue security software
X	AvScan	avscan.exe	"Antivirus System PRO and Spyware Protect 2009 rogue security software. The file is located in %ProgramFiles%\<rogue name>"
X	avscan	Usbconeted.exe	"Added by the PROVIS-A TROJAN!"
Y	AVSchedScan	SCHSC9X.EXE	"Command Antivirus related"
U	AVStation premium	AVStation agent.exe	"Related to Samsung AV Station - instant playback of music
X	AVSTRT	navpsrvc.exe	"Added by the FORBOT-EF WORM!"
Y	avx communicator	xcommsur.exe	"Anti-virus part of BitDefender virus scanner/firewall"
Y	avxlni	avxinit.exe	"Anti-virus part of BitDefender virus scanner/firewall"
?	Avxnews	??	"??"
U	AWMON	Ad-Watch.exe	"Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system"
U	AWMON	Ad-Monitor.exe	"F-Secure Anti-Spyware"
?	AxFilter	"Rundll32 AXFILTER.DLL	Rundll32"
U	AXIS Print System DriverScanner	DriverScanner.exe	"Part of AXIS Print System from AXIS Communications - ""adds printer discovery
U	AXIS Print System DriverServer	DriverServer.exe	"Part of AXIS Print System from AXIS Communications - ""adds printer discovery
U	AXIS Print System TrayIcon	TrayIcon.exe	"System Tray access to AXIS Print System from AXIS Communications - ""adds printer discovery
X	AXPDefender	AXPDefender.exe	"Advanced XP Defender rogue security software - not recommended
X	AXVenore	AXVenore.exe	"Added by an unidentified TROJAN - see here"
X	A_M_P_NET	AntiMalwarePro.exe	"AntiMalware Pro rogue security software - not recommended
N	B.Reader	remin.exe	"Birthday Reminder 5.0 - as the name implies"
X	b3d	BDEsecureinstall.exe	"B3d Projector foistware - periodically trys to access the internet. (1) Uninstall it via Start -> Settings -> Control Panel -> Add/Remove Programs. (2) Remove the BDEsecureinstall.exe if still present in the ""System"" directory. (3) Disable and ideally delete it from the registry. (4) Remove the ""BDE"" directory and all its contents"
X	babeie	"rundll32 cnbabe.dll	dllstartup"
N	Babylon Client	Babylon.exe	"Babylon-Pro is a powerful information tool that instantly provides relevant information
N	Babylon Translator	Babylon.exe	"""Babylon-Pro is a powerful information tool that instantly provides relevant information
X	Back Updates	Uninstall.log.vbs	"Added by the YPSAN.D WORM!"
X	Backdoor.NuAgent	agent.exe	"Added by the AGENT-DP TROJAN!"
X	Background Intelligent Transfer Service	[path] rundll32.exe	"Added by the VB-ZD TROJAN! Note - this is not the legitimate rundll32.exe process
U	BackgroundSwitcher	bgswitch.exe	"Originally included with Microsoft's XP PowerToys (but now withdrawn - see here
U	BackgroundSwitcher	BackgroundSwitcher.exe	"John's Background Switcher (or JBS for short) periodically changes the background image on your computer (like every hour or every day) to something interesting"
N	Backpack UDF	bpudfmon.exe	"Backpack UDF packet writing software for Microssolutions' Back Pack external CD-RW drive. Similar to DirectCD. Run manually before insert an appropriately formatted CD-RW disk"
U	Backup NOW! Scheduler	Schdlr32.exe	"Scheduled backups for the NTI Backup Now archiving utility. If a backup job has been scheduled
X	Backup One	smbguard.exe	"Added by the SDBOT-MI WORM!"
X	BackUp Windows 2009	[random].exe	"Added by the AGENT-LUJ TROJAN!"
U	Backup4all OTB Agent	B4AOTB.exe	"""Backup4all is an award-winning data backup software for Windows. This backup utility was designed to protect your valuable data from partial or total loss by automating backup tasks
?	BackupNotify	backupnotify.exe	"HP Digital Imaging related. What does it do and is it required?"
X	bal	SYSMONMS.EXE	"Added by the FAKEALERT TROJAN!"
X	Band-Aid	[path to file]	"Added by the RANKY.O TROJAN!"
U	bandmon	bandmon.exe	"Rokario Bandwidth Monitor"
X	Bandook	ali.exe	"Added by the EXEMAS-B TROJAN!"
N	Bandwidth Meter Pro	BandwidthMeterPro.exe	"System Tray access to Bandwidth Meter Pro - ""an easy-to-use network software for bandwidth usage monitoring and reporting. It monitors traffic of all network connections on your computer and displays graphical and numerical download and upload speeds in real-time"""
U	Bandwidth Monitor Pro	Bandwidth Monitor Pro.exe	"Bandwidth Monitor Pro - utililty to track your current download/upload limit that may be set by your ISP"
N	BandwidthMeterPro	BandwidthMeterPro.exe	"System Tray access to Bandwidth Meter Pro - ""an easy-to-use network software for bandwidth usage monitoring and reporting. It monitors traffic of all network connections on your computer and displays graphical and numerical download and upload speeds in real-time"""
U	Banpopup by Pratik	Banpopup.exe	Banpopup - popup killer
X	bantool	bantool.exe	"Malware installed by different rogue security software including SpyKillerPro"
X	bantool	ie_ban.exe	Detected as the VB.PO TROJAN!
X	Banyak_Kerjaan	Tukang.exe	"Added by the SILLYFDC.BDM WORM!"
X	Bar Ding lolt	Analiz.exe	"Added by the RBOT-RP WORM!"
X	bargains	bargains.exe	"BargainBuddy adware"
X	bargains	bargainbuddy.exe	"BargainBuddy adware"
X	BaRloNdDiLhep	services.exe	"Added by the AUTORUN.DIB WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~� subfolder"
?	Bart Station	station.sbrt	"Related to PeoplePC ISP. May be a dialler for dial-up accounts?"
U	Bart Station	PPCOLink.exe	Dialer for PeoplePC ISP
X	BarTheme	bartent32.exe	"Added by the AGOBOT-UG WORM!"
X	BastioneAntivirus	pgs.exe	"BastioneAntivirus
N	Batchreg1	N/A	"Part of the Windows System Recovery process. Added to the registry via Msbatch.inf. The existence of this key or process after the last reboot during installation indicates an unsuccessful installation
U	BatInfEx	"rundll32.exe [path] BatInfEx.dll	BMMAutonomicMonitor"
U	BatLogEx	"rundll32.exe [path] BatLogEx.DLL	StartBattLog"
X	bawindo	bawindo.exe	"Added by the BEAGLE.AR or BEAGLE.AU WORMS!"
U	Bayden SlickRun	sr.exe	"""SlickRun is a floating command line utility for Windows. It gives you almost instant access to any program or website. SlickRun allows you to create command aliases (known as MagicWords)
U	BBC News alerts	skinkers.exe	"BBC News Desktop Alerts service - see here. Desktop alert and breaking news e-mail services let you find out about all the latest news as it happens"
?	BBDial	BT Broadband.exe	"Part of BT Broandband - is it required?"
N	BBLauncher.exe	BBLauncher.exe	"BounceBack Professional - back-up software"
U	BCMHal	"rundll32.exe bcmhal9x.dll	bcinit"
N	BCNT	bcnt.exe	"AWS Weatherbug related. What does it do?"
U	BCSSync	BCSSync.exe	"Part of SharePoint Server 2010 which is part of the Microsoft Office 2010 suite. ""Business Connectivity Services (BCS) uses a cache to store a copy of the external data required by the BCS solutions deployed on the Office client. A process called BCSSync.EXE runs on the client and provides automatic cache refresh and data synchronization of the entity instances."" For more information - see here"
Y	BDAgent	bdagent.exe	"BitDefender Agent - for BitDefender internet security products. Maintains settings (for all users) and provides alerts and System Tray access to the main program. Note - for the System Tray icon to be displayed the Terminal Services service must be set to either ""Manual"" or ""Automatic"". It can also be licensed by other products such as versions of The Shield Deluxe from PCSecurityShield (see here) - who's reputation is poor"
Y	BDMCon	Bdmcon.exe	"BitDefender antivirus"
Y	BDNewsAgent	bdnagent.exe	"BitDefender antivirus - updater"
U	BDRegion	brs.exe	"Part of Cyberlink's PowerDVD version 8 - removes the Blu-ray region on a DVD"
Y	BDSwitchAgent	bdswitch.exe	"Bitdefender 8 antivirus and firewall"
U	BeatNik Internet Clock	BeatNik.exe	"BeatNik Internet Clock is a Windows clock add-on that supports 'skins'. It can also synchronize your computer's clock with an atomic clock"
X	BedreigingsMonitoor	pgs.exe	"BedreigingsMonitoor rogue security software - not recommended. A member of the AVSystemCare family"
X	begins	0.exe	"Added by the MYTOB-HE WORM!"
U	Belkin F5D8013 N Wireless Notebook Card Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8013 N Wireless Notebook Card"
U	Belkin F5D8053 N Wireless USB Adapter Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8053 N Wireless USB Adapter"
U	Belkin F5D8073 N Wireless ExpressCard Adapter Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8073 N Wireless ExpressCard Adapter"
N	Belkin PCMCIA WLAN Monitor	monitorbk.exe	Belkin USB Network Adapter Management utility - can be started manually
U	Belkin Wireless G Notebook Card Client Utility	Belkinwcui.exe	Wireless configuration utility for the Belkin F5D701F Wireless G Notebook Card
U	Belkin Wireless USB Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D7050 Wireless G USB Adapter"
U	Belkin Wireless Utility	Belkinwcui.exe	"Wireless configuration utility for some Belkin cards such as the F5D7000 Wireless G Desktop Card"
U	BellSouthAlertManager.exe	BellSouthAlertManager.exe	"Related to BellSouth Alert Manager"
U	BelNotify	"rundll32.exe [path] NPBelv32.dll	RunDll32_BelNotify"
X	Benadril Alert Tool	benadrilalert.exe	Plug-in for WeatherBug advising when pollen count in your area is high - prompting you to buy Benadril
X	BeschermingsTool	SysRep.exe	"BeschermingsTool
U	BestCrypt Auto Open	BestCrypt.exe	"BestCrypt from Jetico
X	BestsellerAntivirus	pgs.exe	"BestsellerAntivirus rogue security software - not recommended
U	BestSync 2008	BestSyncApp.exe	"System Tray access to BestSync® 2008 from Risefly Software - ""a professional utility for synchronizing files between your local folders and Network Drives
X	bfxtray	[path to trojan]	"Added by the AGENT-GEB TROJAN!"
U	BGInfo	Bginfo.exe	"BGinfo automatically displays relevant information about a Windows computer on the desktop's background
U	BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}	NMBgMonitor.exe	"Associated with Nero Scout
Y	BGNewsAgent	bgnewsag.exe	"BullGuard antivirus updater"
X	bgoomain.exe	bgoomain.exe	"Baigoo.a malware"
N	bgsmsnd	bgsmsnd.exe	Printer driver to generate PDF files from any program
X	Bharatayuda	GNB.exe	"Added by the BHARAT.A WORM!"
U	BHODemon 2.0	BHODemon.exe	"BHODemon ""protects you from unknown Browser Helper Objects (BHOs)
X	BIE	"Rundll32.exe [path] BDSrHook.dll	Rundll32"
U	BigPond Toolbar	bpumTray.exe	"Telstra BigPond Toolbar - ""Introducing the free and easy to use BigPond Toolbar that is designed to make your internet experience and managing your Telstra internet account a whole lot easier"""
N	BigPondCable	bpcable.exe	Telstra Bigpond Cable login software - can be started manually
Y	BigPondWirelessBroadbandCM	BigPond_CM.exe	"Related to BigPond_Wireless_Broadband Service by Telstra"
X	bikini	bikini.exe	"Added by the LOWZONE-CX TROJAN!"
N	Billminder	Billmind.exe	Can be setup in Quicken to remind user of due payments. Available via Start -> Programs
X	bin32hpu	ppstub.exe	"PrecisionPop adware"
N	Bing Bar	mswinext.exe	"Bing Bar - the latest incarnation of the MSN Toolbar from version 5.* onwards. This entry loads the toolbar into memory at start-up before you open your internet browser. Not required - it will load with the browser and remains in memory after the browser is closed"
X	bingdian	Bingdian.vbs	"Added by the BINGD WORM!"
?	Bingo Charm	charms.exe	"Some kind of screen icon kind of like desk flag
U	Biomenu	menusw.exe	"Related to Sony VAIO - passwords
U	Bionix Wallpaper 5	Bionix Wallpaper 5.exe	"BioniX Wallpaper Changer - ""the most advanced wallpaper changer/wallpaper manager software in the world"""
U	BioniXWallpaper	Bionix Wallpaper 5beta.exe	"BioniX Wallpaper Changer - ""the most advanced wallpaper changer/wallpaper manager software in the world"""
U	BioniXWallpaper	BioniX Wallper.exe	"BioniX Wallpaper Changer - ""the most advanced wallpaper changer/wallpaper manager software in the world"""
U	BioniXWallpaper	BionixWallpaper5.exe	"BioniX Wallpaper Changer - ""the most advanced wallpaper changer/wallpaper manager software in the world"""
X	BIOS XP Loader	[random filename]	"Added by the RBOT-IC WORM!"
?	BisonHK	BisonHK.exe	"Related to a Bison webcam - which is used on notebooks from a number of manufacturers including Acer
Y	BisonInst0402	BR040286.exe	"Driver for integrated notebook webcams from Bison Electronics Inc - such as the Acer Crystal Eye"
Y	BitDefender 12	bdwizreg.exe	"Configuration wizard for BitDefender internet security products. Only runs once the product has been installed. Guides you through the steps necessary to configure the BitDefender modules
Y	BitDefender 2009	IEShow.exe	"Anti-phishing component of BitDefender internet security products. Anti-phishing prevents sensitive data such as usernames
Y	BitDefender 2009	bdagent.exe	"BitDefender Agent - for BitDefender internet security products. Maintains settings (for all users) and provides alerts and System Tray access to the main program. Note - for the System Tray icon to be displayed the Terminal Services service must be set to either ""Manual"" or ""Automatic"". It can also be licensed by other products such as versions of The Shield Deluxe from PCSecurityShield (see here) - who's reputation is poor"
Y	BitDefender Antiphishing Helper	IEShow.exe	"Anti-phishing component of BitDefender internet security products. Anti-phishing prevents sensitive data such as usernames
X	BitDefender Antivirus	BITDEFENDERX.EXE	"Added by a variant of the SPYBOT WORM!"
Y	BitDefender Communicator	xcommsvr.exe	"BitDefender antivirus"
U	BitDefender for MSN Messenger	msnmon.exe	"Bitdefender anti-virus for MSN Messenger - no longer supported at the BitDefender website"
U	BitDefender for Yahoo! Messenger	yahmon.exe	"Bitdefender anti-virus for Yahoo! Messenger - no longer supported at the BitDefender website"
Y	BitDefender Live! Init	bdinit.exe	"BitDefender antivirus"
Y	BitDefender Scan Server	bdss.exe	"BitDefender antivirus"
Y	BitDefender Virus Shield	vsserv.exe	"BitDefender antivirus"
Y	bitdefenderlive	avxlive.exe	"Main program of BitDefender virus scanner/firewall"
U	BitDefender_P2P_Startup	BitDefender_P2P_Startup.exe	"Bitdefender anti-virus for P2P clients - no longer supported at the BitDefender website"
X	Bittorrent	bittorrent.exe	"Added by the RJUMP-D WORM! Note - do not confuse with the legitimate BitTorrent file-sharing client which is normally located in %ProgramFiles%\BitTorrent. This one is located in %Windir%"
N	BitTorrent	bittorrent.exe	"BitTorrent file sharing client - from BitTorrent
N	BitTorrent DNA	btdna.exe	"""BitTorrent DNA is a FREE content delivery service based on the BitTorrent protocol which brings the power of user-contributed bandwidth to traditional content publishers while leaving publishers in full control of their files"". Now a stand-alone product where the user creates the download
N	bittorrent.exe	bittorrent.exe	"BitTorrent file sharing client - from BitTorrent
N	BitWare Print Monitor	bwprnmon.exe	"FaxServe network fax software"
N	BJ Printer Status Monitor	Cjstsr.exe	Canon BJ printer status monitor
N	BJ Status Monitor 5xx	CJSTRxx.EXE	Canon printer status monitor - where "xx" is different depending upon the version. Not required as you can check the printer status via My Computer -> Printers
U	BJLaunchEXE	BJLaunch.exe	"Memory Card Utility for the Canon i470D
U	BJPD HID Control	TVMon.exe	"Related to Canon Photo viewer"
N	BlackICE PC Protection	blackice.exe	"Loads the user interface for the BlackICE PC Protection (was Defender) firewall. From the parent site - '(the user interface) starts in the ""Startup"" menu and adds itself to the taskbar. The user interface is independent from the rest of the system and only displays the output or reconfigures the system. It does not need to be running for the rest of the system to run.' BlackICE was supported by IBM Internet Security Systems (formerly just ISS) when them acquired the NetworkICE parent but is no longer available. See also LoadBlackD"
X	blah service	winupdate.exe	"Added by the GAOBOT.BIA WORM!"
X	blah service	winsysengine.exe	"Added by the RBOT-KI WORM!"
X	blah service	internet.exe	"Added by a variant of the RBOT WORM!"
X	blah service	smnp.exe	"Added by the RBOT.IZ WORM!"
X	blah service	msnmsgrr.exe	"Added by the RBOT.PZ WORM!"
X	blah service	win32.exe	"Added by the RBOT-AXO WORM!"
X	blahh service	msengine.exe	"Added by a variant of the RBOT WORM!"
X	blahx service	msnjompa.exe	"Added by the SDBOT.AML WORM!"
X	Blank AntiViri	AUT0EXEC.BAT StartUp	"Added by the BRONTOK-CJ WORM!"
N	BlazeChanger	FBZPaper.exe	"Ember graphic file viewer
U	blinkx	blinkx.exe	"Blinkx Desktop ""Smart Folders"" software"
N	Blitzz BWI715	WLANmon.exe	Blitzz Technology BWI715 Wireless PC modem connection monitor
X	BLMessagingIntegration	blengine.exe	"BuddyLinks adware"
X	BlockDefense	BlockDefense.exe	"BlockDefense rogue security software - not recommended
X	Blocker System611 Monitoring	PopUpBlocker611.exe	"Added by the RBOT.BLJ WORM!"
X	BlockScanner	BlockScanner.exe	"BlockScanner rogue security software - not recommended. A member of the WiniGuard family"
U	BLOG	"rundll32.exe [path] BatLogEx.DLL	StartBattLog"
X	Blue Service	[path to trojan]	"Added by the BANCOS-BCW TROJAN!"
U	BlueSpace NE	BlueSpaceNE.exe	"""BlueSpace NE is a utility program used to run the Bluetooth function on VAIO computers that support the Bluetooth function or on VAIO computers connected to the Bluetooth USB adapter"". Shortcut available via Start -> Programs"
X	Bluetooth Config	btwindin32.exe	"Added by the SDBOT-DFN WORM!"
U	Bluetooth Connection Assistant	LBTWiz.exe	"Bluetooth connection manager for Logitech based bluetooth wireless products"
?	Bluetooth HCI Monitor	"RunDll32 HCIMNTR.DLL	RunCheckHCIMode"
U	BluetoothAuthenticationAgent	"rundll32.exe irprops.cpl
U	BluetoothAuthenticationAgent	"rundll32.exe bthprops.cpl
U	blueyonder Instant Support Tool	matcli.exe	"Blueyonder Instant Support Tool. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	BMail Installation	FTP_back.exe	"Part of iMesh - a file sharing system. Reported by Norton AntiVirus as a trojan. Once deleted does not prevent file sharing working. Older versions of iMesh re-instate this but the newer versions do not"
X	Bman	BMan1.exe	Abcsearch.com/DealHelper adware variant
U	BMMGAG	"RunDll32 [path] pwrmonit.dll	StartPwrMonitor"
U	BMMMONWND	"rundll32.exe [path] BatInfEx.dll	BMMAutonomicMonitor"
X	BMN	bm.exe	"Part of VirtualPCGuard
X	BMN	strpmon.exe	"Part of CleanPCTool
X	BMN	dcmon.exe	"SystemDoctor rogue security software - not recommended
X	Bmonq	bmonq.exe	"Added by the CLICKER.HZ TROJAN!"
X	Bndt32	Bndt32.exe	"Added by the LACON WORM!"
X	Bnexe	[random filename]	"Added by the KITRO.D (or ARGEN.A) WORM!"
X	boby	netburn.scr	"Added by the BANCBAN-OX TROJAN!"
Y	BOCleanautostart	Boclean.exe	"NSClean's BOClean anti-trojan software"
U	BOINC Manager	boincmgr.exe	"BOINC manager - ""controls the use of your computer's disk
U	Boingo Wireless Utility	Icon###XXX#X#.exe	"Starts the Boingo Wireless utility
X	bolenja	bolenja.exe	"Added by the WANTVI.BF TROJAN!"
X	bolenjx	bolenjx.exe	"Added by the ELDYCOW.O TROJAN!"
X	Bonzi Buddy	??	"Bonzi Buddy adware - see here for removal instructions"
X	BONZI Task Switcher	Taskswitch.exe	"Added by the SPYBOT.DTR WORM!"
X	BookedSpace	"RunDLL32.EXE bs2.dll	DllRun"
N	BookmarkCentral	BMLauncher.exe	"Bookmark Express - "offers a more flexible way to manage Web site bookmarks
N	BookMarkSink	syncit.exe	Bookmark synchronization utility
N	BookMarkSync	syncit.exe	"Sync2IT BookMarkSync - ""real-time automatic synchronization service that allows you to access your bookmarks
N	BookMarkSync2It	sync2it.exe	"Sync2IT BookMarkSync - ""real-time automatic synchronization service that allows you to access your bookmarks
X	Boot Client	bootcli.exe	"Added by the IRCBOT-ACF BACKDOOR!"
X	Boot Config	bootconfig.exe	"Added by the FLOOD-EV TROJAN!"
X	Boot Manager	Njgal.exe	"Added by the KILO TROJAN!"
X	Boot Manager	bootmng.exe	"Added by a variant of the SPYBOT WORM!"
X	BootCfg	Install.log.vbs	"Added by the YPSAN.D WORM!"
X	BootClean	smartdrv.exe	"Added by the LURKA-A VIRUS!"
?	Boots Insert Detect	InsDetect.exe	"Part of Boots Picture Suite. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
X	BootsCfg	wscript.exe Install.log.vbs	"Added by the YPSAN.E WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""Install.log.vbs"" file is located in %System%"
X	bootsec	NAVSSE.exe	"Added by the FORBOT-CY WORM!"
Y	BootSkin Startup Jobs	BootSkin.exe	"Stardock BootSkin is a program that allows users to change their Windows 2000 and Windows XP boot screens"
U	BootWarn	BootWarn.exe	"From here: ""Norton AntiVirus Boot Warning. This program is installed as a startup item when you install Norton AntiVirus
N	Bose Wave/PC Monitor	wavepcmonitor.exe	"System Tray access for this system (more info on the system here). Available via Start -> Programs"
X	BossIdea	winlogin.exe	"Added by the LINEAGE-I TROJAN!"
?	Boston	Boston.exe	"Part of the Boston Acoustics USB speaker systems. What does it do and is it required?"
X	Bouncer RunStartup	bouncer.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
X	Bouncer RunStartup	LiveUpdate.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
X	BPCv2 re	bpc2 re inst.exe	"BroadcastPC adware variant"
X	BrasilOld	[worm filename]	"Added by the OPASERV.P WORM!"
X	Brave-Sentry	BraveSentry.exe	"BraveSentry rogue security software - not recommended
X	BraveSentry	BraveSentry.exe	"BraveSentry rogue security software - not recommended
U	Break_Reminder	BREAK REMINDER.exe	"Break Reminder - Remind yourself to take breaks to prevent computer related injuries. See here"
Y	Bredbandsbolaget	servicecenter.exe	"Related to the Brebband Swedish Broadband provider"
X	Bridge	"rundll32.exe [path] Bridge.dll	Load"
Y	Brindys BriTray	BRITRAY.EXE	"Main process for the following applications: GEDEX
U	broadband medic	matcli.exe	"NTL's Broadband Medic. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	Broadband Wizard	bbwiz.exe	"Starts Broadband Wizard so it runs in the System Tray. This application tests and optimizes your Cable or DSL connection. Available via Start -> Programs"
N	BroadCamRun	broadCam.exe	"BroadCam is an easy to use video streamer designed to broadcast live video using a webcam (or other camera) and microphone"
U	Broadcom Wireless Manager UI	bcmntray.exe	"Related to Broadcom Network Adapters for additional configuration options for these devices. Should not be terminated unless suspected to be causing problems"
N	Broadcom Wireless Manager UI	wltray.exe	System tray access to wireless LAN card configuration options
X	Bron-Spizaetus	CVT.exe	"Added by the RONTOKBRO WORM!"
X	Bron-Spizaetus	norBtok.exe	"Added by the RONTOKBRO.B WORM!"
X	Bron-Spizaetus	[path to file]	"Added by the BRONTOK-F WORM!"
X	Bron-Spizaetus	bronstab.exe	"Added by the RONTOKBRO.C WORM!"
X	Bron-Spizaetus	eksplorasi.exe	"Added by the RONTOKBRO.J WORM!"
X	Bron-Spizaetus	ElnorB.exe	"Added by the RONTOKBRO.D WORM!"
X	Bron-Spizaetus	sempalong.exe	"Added by the BRONTOK-E WORM!"
X	Bron-Spizaetus	RakyatKelaparan.exe	"Added by the BRONTOK-J or BRONTOK-L WORMS!"
X	Bron-Spizaetus-5118REPM	komodo-6321422.exe	"Added by the BRONTOK-R WORM!"
X	Bron-Spizaetus-cfgmktoq	bbm-qotkmgfc.exe	"Added by the BRONTOK-M WORM!"
X	Bron-Spizaetus-cfgmmnru	bbm-urnmmgfc.exe	"Added by the BRONTOK-N WORM!"
X	BRoNToK	BRoNToK.exe	"Added by the BRONTOK-CG WORM!"
X	BrowseProxy	FindService.exe	"Actual Names (AdvSearch) Internet Keywords parasite"
X	browser	s_menu.exe	"Added by the TACTSLAY.C TROJAN!"
X	browser	deamon.exe	"Added by the TACTSLAY.C TROJAN!"
U	Browser Launcher	Commandr.exe	Logitech internet keyboard "Commander" software - loads the software for the shortcut keys on the keyboard. Not required unless you want to use the short cut keys
U	Browser Sentinel	BrowserSentinel.exe	"Browser Sentinel - notifies you if a program wants to penetrate into Internet explorer
X	BrowserUpdateSched	[random filename]	"ZenoSearch adware"
?	BsMnt	BsMnt.exe	"Related to a Bison webcam - which is used on notebooks from a number of manufacturers including Acer
X	BSserver	FileKan.exe	"Added by the VB.CBW WORM!"
X	Bsx3	"RunDLL32.EXE bs3.dll	DllRun"
X	BT	[path to trojan]	"Added by the LITEBOT-B TROJAN!"
U	BT Broadband Basic Help	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	BT Broadband Desktop Help	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	BT Broadband Help	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	BT00003*	hiklmnop27.exe	"Added by the VB-VT TROJAN where * = 2
N	btdna	btdna.exe	"""BitTorrent DNA is a FREE content delivery service based on the BitTorrent protocol which brings the power of user-contributed bandwidth to traditional content publishers while leaving publishers in full control of their files"". Now a stand-alone product where the user creates the download
N	btdna.exe	btdna.exe	"""BitTorrent DNA is a FREE content delivery service based on the BitTorrent protocol which brings the power of user-contributed bandwidth to traditional content publishers while leaving publishers in full control of their files"". Now a stand-alone product where the user creates the download
?	btinst	btinst.exe	"Associated with an Anycom bluetooth wireless card. What does it do and is it required?"
U	BTModemProtection	BTModemProtection.exe	"BT Privacy Online modem protection software
U	BTopenworld	DialBTYahoo.exe	BT Yahoo! internet connection manager
X	BtvC	btvclean.exe	"BroadcastPC adware"
U	BUFFALO Power Save Utility for HD	HDManage.exe	"Power Save utility for Buffalo backup hard discs"
Y	BufferZone	CLIENTGUI.EXE	"BufferZone from Trustware - ""is the only security software that creates a separate environment allowing you unlimited freedom to enjoy all Internet activities without the fear of external threats"""
N	Bug Eliminator	Bug_Elim.exe	"Bug Eliminator - ""performs a complete health check on your computer safely
X	BuildLab	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
Y	BullGuardInit	AVXINIT.EXE	"Part of Bullguard antivirus"
Y	BullguardoptIn	bulldownload.exe	"Part of Bullguard antivirus"
X	BullsEye	bargains.exe	"BargainBuddy adware"
X	BullsEye Network	bargains.exe	"BargainBuddy adware"
X	Bunx	beagle.exe	"Added by the LEBREAT-E WORM!"
N	BurnQuick Queue	BQTray.exe	"System Tray access to BurnQuick CD burning software. Only required if you use the queueing facility
U	Button Server	bttnserv.exe	"Found on a Compaq PC
N	ButtonKey	ButtonKey.exe	"CyberView TWAIN driver for the Pacific Image range of 35mm film scanners. Enables the one touch scanning button and places an icon an the System Tray. Use your scanners software or run it manually by creating a shortcut"
X	Bwddwss	[path to trojan]	"Added by the RANKY.BD TROJAN!"
N	bwprnmon.exe	bwprnmon.exe	"FaxServe network fax software"
X	bxproxy	[random].dll	"SoftStop rogue security software - not recommended"
X	bxsx5	"RunDLL32.EXE bsx5.dll	DllRun"
X	bxxs5	"RunDLL32.EXE bxxs5.dll	dllrun"
X	Bymer.Scanner	Wininit.exe	"Added by the BYMER WORM!"
X	Bymer.Scanner	Msinit.exe	"Added by the BYMER WORM!"
X	ByteDefender	ByteDefender.exe	"ByteDefender rogue security software - not recommended
?	BZEnvironmentVariableCollector	BZEnvironmentVariableCollector.exe	"Part of BlazentAgent from Blazent who provide ""outsourcing governance automation for IT Outsourcing (ITO) relationships"". What does it do and is it required?"
?	BZUtilizationCollector	BZUtilizationCollector.exe	"Part of BlazentAgent from Blazent who provide ""outsourcing governance automation for IT Outsourcing (ITO) relationships"". What does it do and is it required?"
X	c	c:archiv~1win.com	"Added by the CUYDOC TROJAN!"
U	C-Media Echo Control	EchoCtrl.exe	C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. You may need it if you use the echo control feature of C-Media Mixer
U	C:Program Filesdfjdkjfdkjfldjfdfjdkjfdkjfldjfwinlogin.exe	CritProc.exe	"KeyProwler keystroke logger/monitoring program - remove unless you installed it yourself!"
U	C:Program FilesNetMeterNetMeter.exe	NetMeter.exe	"""Net Meter is a small
X	C:WINDOWSasam.exe	asam.exe	"Added by the PEACOMM.E TROJAN!"
X	C:WINDOWSIEXPLOR.EXE	IEXPLOR.EXE	"""Pop Marketing"" adware"
X	C:WINDOWSsystem32SetupCmd.exe	SetupCmd.exe	"Detected by Kaspersky as the AGENT.AAW TROJAN!"
X	C:WINDOWSWinTask.exe	WinTask.exe	"""Pop Marketing"" adware"
U	CA-AMAgent	amagent.exe	"Unicenter Asset Management is a solution for proactively managing IT assets in a business environment. It provides full-featured asset tracking capabilities through automated discovery
X	CABCInstall	CABCInstall.exe	"Ignite Technologies (was CABC) content delivery software"
X	Cable Modem Adapter	WindowsSec.exe	"Added by the WOOTBOT.A WORM!"
U	CacheBoost	trayicon.exe	"CacheBoost ""optimizes the System Cache-Management of Windows XP/2000/NT and Windows .Net Servers
X	CacheLoader	[path to trojan]	"Added by the DLOADER-NZ TROJAN!"
N	Cacheman	Cacheman.exe	"Freeware disk cache tweaker from Outer Technologies. Should only be run once and not loaded at start-up"
U	CacheSentry Pro	CacheSentry Pro.exe	"""CacheSentry Pro is a program that takes over the management of the Internet Explorer (and AOL) web browser cache"""
U	Caddais BackupOnDemand	BODMon.exe	"Caddais BackupOnDemand - "runs in the background and monitors your important files for changes. Within seconds of changing
U	Cadenza	CdzSvc.exe	"Cadenza mNotes for Palm and Pocket PC enables users to access Lotus Notes on their mobile devices"
U	CafeStation	CafeStation.exe	"""CafeSuite is the solution for your internet cafe. Our software provides you with ameans to control the workstations
N	CAgent	CAgent.exe	"Abbyy Fine Reader OCR (Optical Character Recognition) software for scanning and converting documents"
X	cAgOu	[filename].hta	"Added by the KAKWORM WORM!"
X	caidiysetup	diynetsetupuni.exe	"DIYNet adware"
N	Cal Reminder Shortcut	calrem.exe	Produces a pop-up reminder of events scheduled using the MS Office Calendar
X	calc	"rundll32.exe [path] ntuser.dll	_IWMPEvents@0"
X	calc	"rundll32.exe calc.dll	_IWMPEvents@0"
X	Calc Microsoft Windows	wincalc.exe	Added by an unidentified WORM or TROJAN!
U	Calendar	Calendar.exe	"This entry can be added by PlainSight Desktop Calendar and older versions of Desktop iCalendar from Desksware and the older Calendar 200X - which is no longer supported by or available from the author"
?	Calendar 200X Monitor	calmonitor.exe	"Background task for Calendar 200X by Joel Graffman - which is no longer supported or available from it's author. The exact purpose of this startup entry is unknown at present but it appears to be related to the Calendar 200X Reminder entry - as disabling that entry via the program also disables this one"
N	Calendar 200X Reminder	calendar.exe	"Part of Calendar 200X by Joel Graffman - which is no longer supported or available from it's author. Displays reminders for holidays
?	Calendar Monitor	calmonitor	"Background task for Calendar 200X by Joel Graffman - which is no longer supported or available from it's author. The exact purpose of this startup entry is unknown at present"
U	Calendarscope	cs.exe	"Calendarscope calendar software"
X	Call Function System32	sddriver.exe	"Added by a variant of the SDBOT TROJAN!"
Y	CallBumping	cbpopw.exe	"Related to the Gazel 128 PCI ISDN adapter. Required if you use it"
U	CallCenter Main Application	V3calmcp.exe	"""V3 Inc. CallCenter is a free 32-bit
U	CallCenter Printer Interface	V3faxecp.exe	"""V3 Inc. CallCenter is a free 32-bit
N	CallControl	ftctrl32.exe	"FaxTalk Messenger Pro is a Windows TAPI based 32-bit application. When installed
?	calmonitor	calmonitor.exe	"Background task for Calendar 200X by Joel Graffman - which is no longer supported or available from it's author. The exact purpose of this startup entry is unknown at present but it appears to be related to the Calendar 200X Reminder entry - as disabling that entry via the program also disables this one"
?	calmonitor	calmonitor	"Background task for Calendar 200X by Joel Graffman - which is no longer supported or available from it's author. The exact purpose of this startup entry is unknown at present"
U	Cameno	Cameno.exe	"Cameno is a program which brings tabbed windows to MSN Messenger 6.0 and above"
U	Camera Assistant Software	traybar.exe	Camera Assistant Software utility for Toshiba laptops - allows you to take pictures with and control the integrated WebCam
?	CameraApplicationLauncher	CameraApplicationLaunchpadLauncher.exe	"Supports the integrated webcam on IBM/Lenovo Thinkpad notebooks. What does it do and is it required?"
U	CameraAssistant	CameraAssistant.exe	"Entry added when you install versions of the Logitech QuickCam webcam software and used to configure and tweak your webcam settings. Includes support for the Quick Assistant - which launches when a video application (such as video conferencing in an instant messaging client) accesses to camera so you can quickly fine tune face tracking and zoom
?	CamMonitor	hpqcmon.exe	"From HP and related to digital imaging"
N	Canada	Canada.exe	"Known to be a dialler - but is it maliscous or clean?"
U	Canary	canary-std.exe	"Canary keystroke logger/monitoring program - remove unless you installed it yourself!"
X	candy	command32.exe	"Added by the RBOT-LV WORM!"
X	candynet	Taskmsg.exe	"Added by the RBOT-NA WORM!"
U	CANoe	CANoe32.exe	"CANoe from Vector Informatik. Development and test tool for Engine Control Units (ECU) based upon the CAN
U	Canon MultiPASS Status Monitor	monitr32.exe	Cannon Multi-Pass status monitor - your choice
?	Canon PC1200 iC D600 iR1200G Status Window	CAPM1LAK.EXE	"Cannon printer related - is it required in startup?"
N	Canon Printer Monitor BJCxxx	Cjstlst.exe	Trayicon for Canon printer. xxx denotes model. Available via Start -> Programs
U	CanonMyPrinter	BJMyPrt.exe	Printer software for Canon Bubblejet printers
U	CanonSolutionMenu	CNSLMAIN.exe	"
?	CAP3ON	CAP3ONN.EXE	"Canon driver
U	CAPing	CAPing.exe	Citibank Citianywhere software
Y	Capon	Capon.exe	Canon printer driver
Y	Capon	Caponn.exe	Canon printer driver
X	Captcha7	rundll captcha.dll	"Added by the TINY.WRE TROJAN!"
X	CaptionMgr32	crssr.exe	"Added by the ZAR.A WORM!"
U	CaptureAssistant	CaptureAssistant.exe	"Capture Assistant ""is a convenient and easy-to-use text and graphics capture tool"". It allows you to capture text
N	Carbonite Backup	CarboniteUI.exe	"""Carbonite's online backup service starts automatically and works quietly and continuously in the background protecting your data"""
N	Card Monitor	REGCNT09.exe	For the USB connection on a Panasonic PV-DV701 Digital Camcorder. Available via Start -> Programs
?	CardScan AutoSync	CSyncCfg.exe	"Related to the CardScan business card reader range of products. May be related to synchronization with E-mail software and mobile devices (see here)?"
X	cartao	conflicted.exe	"Added by the DADOBRA-DV TROJAN!"
X	cartao	killing.exe	"Added by the DLOADER-QN TROJAN!"
X	CAS Client	casclient.exe	"CasinoClient adware"
U	CasAgnt	CasAgnt.exe	Program by Extended Systems which allows you to sync your Casio PDA with your PC
X	Casdvqwa	bmqnzkg.exe	"Added by the RANDEX.BE WORM!"
N	Cashsurfers Cashbar Navigator	Cashbar.Exe	"Cashsurfers CashBar Navigator - ""The CashBar rotates banner advertisements once per minute and provides you with access to up to date special offers and deals"""
X	Casino Royale	jamesbond.exe	"Added by the RBOT-FZO WORM!"
X	Cassandra	[10 to 14 random char]THD.EXE	"Added by the KREPPER-AI TROJAN!"
X	Cassandra	cassandra.exe	"SuperSpider hijacker - a CoolWebSearch parasite variant. Also detected as a variant of the KREPPER TROJAN!"
X	Catalyst Control Centre	atixvdm.exe	"Added by the RBOT.DMW TROJAN!"
X	CAZNOVAS	CAZNOVAS.exe	"Added by the CAZNO TROJAN!"
U	cbInterface	cbInterface.exe	"System Tray access to Cobian Backup versions 8 thru 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
X	cbvcs	urretnd.exe	"Added by the FRETHOG-C WORM!"
U	CBWAttn	CBWAttn.exe	"Required for Bitware to answer incoming faxes
X	ccagent.exe	ccagent.exe	"Control Center and Control Components rogue security software - not recommended
X	ccApp	[random filename]	"Added by the OBSORB TROJAN! Note the random filename compared to the valid Norton AntiVirus"
X	ccApps	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	ccApps	N/A	"Added by the KANGAROO-A TROJAN!"
U	CCD Manager	DDS.EXE	"Project Labs Century CD manager for their CD/DVD storage device"
N	Ccdecode	"rundll32.exe streamci	StreamingDeviceSetup"
Y	CCDoctorLogonTesting	ccdoctor.exe	"Checks your system to make sure it's configured properly for running IBM Rational ClearCase
Y	ccenter	CCenter.exe	"RAV AntiVirus"
U	CCleaner	CCleaner.exe	"CCleaner from Piriform Ltd. - ""is a freeware system optimization
X	ccStart	ccInfo.exe	"Added by the AGOBOT-GQ BACKDOOR!"
U	CCUTRAYICON	CCU_TrayIcon.exe	"Related to Traybar Launcher from Intel Corporation belonging to Intel® Viiv®"
Y	CCWinTray	wintmr.exe	"System Tray access to Child Control parental control software by Salfield"
U	CD-DVD Lock for Win95/98/Me/2k/XP	CDVAgent.exe	"Loads CD-DVD Lock from Ixis Research
N	CDANTSRV	CDANTSRV.exe	"C-Dilla License Management software. Used for any program that uses C-dilla Protection
N	CDInterceptor	cdi.exe	CD indexer for measuring the speed of CD players
U	CDLoader	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
X	CdnCtr	cdnup.exe	"CNNIC Update pest"
X	CDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	Cdrom Controller	cdromcntrl.exe	"Added by the BATTRY-A TROJAN!"
U	CDVAgent	CDVAgent.exe	"Loads CD-DVD Lock from Ixis Research
X	center	[random name]32.exe	"Added by the BOFRA.A WORM!"
X	CentralProcessor	taskimgr.exe	"Added by the BANCOS.J TROJAN!"
U	CertificateRegistration	SafeSignCertReg.exe	SafeSign Certificate Registration Utility for Microsoft Crypto applications
Y	CertStoreInit	CertStoreInit	"Aladdin eToken authentication and password management"
X	cesmain.dll	"Rundll32.exe [path] cmail.dll	Rundll32"
X	CEventMgr	Cell.exe	"Added by the BIFROSE-AK TROJAN!"
X	CFDStart	WinMuschi.exe	"WINMUSCHI dialler"
N	cfFncEnabler.exe	cfFncEnabler.exe	"Toshiba ""Config Free"" wireless network manager on their range of laptops"
Y	cfgintpr	cfgintpr.exe	"Configuration Interpreter - part of Tiny Personal Firewall V4"
X	cfgmgr51	"RunDLL32.EXE cfgmgr51.dll	DllRun"
X	cfgmgr52	"RunDLL32.EXE cfgmgr52.dll	DllRun"
U	CFi ShellToys Utility Manager	CFiShlMan.exe	"Manager for CFi ShellToys from Cool Focus International Ltd - which ""puts all the tools you need right where you need them - just a click away on your context menu. Right-click one or more files or folders
?	cFosDNT	cFosDNT.exe	"cFos DSL Modem driver related. What does it do and is it required?"
?	cFosInst_Check	cfosinst.exe	"cFos DSL Modem driver related. What does it do and is it required?"
X	cftmon	sfcmonit.exe	Added by a variant of the AGENT.ERG TROJAN!
X	cftmon	WindowsUpdate.exe	"Added by the AGENT.AQK BACKDOOR!"
X	cftmon32	taskmgr*.exe [* = number]	"Added by the SOWSAT.C and SOWSAT.J WORMS!"
X	Cftmon32	afd.exe	"Added by the AUTORUN-AUB WORM! The ""afd.exe"" file is located in %Windir%"
X	Cftmon32	afd.exe	"Added by the SCAR.AYWK TROJAN! The ""afd.exe"" file is located in %AppData%"
X	CGI Firewall Script	CGIAGENT.EXE	"Added by the BROPIA-U WORM!"
X	Cgywin	cgywin32.exe	"Added by the RBOT-AEI WORM!"
X	change-me-now	msgfix1.exe	"Added by the SDBOT.ZD WORM!"
U	ChangeICON	SPMSMON.EXE	Card reader related program. Note - may cause problems with My Computer loading at startup. Disabling through MsConfig seems to solve the problem
?	ChangeLines	chngline.exe	"??"
X	ChansonsMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Chat login	chatlogin.exe	"Added by the ANTINNY.F WORM!"
N	Chatango	Chatango.exe	"Chatango - ""allows people to be connected in real time through their Web browsers. Include your Chatango contact link or button when you create eBay auctions
N	Chcenter	chcenter.exe	"IMSI HiJaak - ""the easiest way to convert
X	Chckup	Netverchk.exe	"Covert Sys Exec malware variant"
U	cheatmonitor	start.exe	"CheatMonitor surveillance software. Uninstall this software unless you put it there yourself"
N	Check for One Touch Update	wiseupdt.exe	Checks for updates for Visioneer OneTouch scanners
U	Check Messenger	cmesseng.exe	Check Messenger from Qchex.com - program that helps you manage the activity of your Qchex account. Qchex appear to be no longer in buisness
X	CheckFaultKernel	mswdm.exe	"Added by the SMALL-CSK TROJAN!"
X	checkrun	elite***32.exe [* = random char]	"EliteBar adware"
X	checkrun	elitelsj32.exe	"Added by the MULTIDR-ER TROJAN!"
X	CheckScan32	regload16.exe	"Added by the AEBOT.K WORM!"
X	CheckWinPerf	perfinfo.exe	"Added by a variant of the IRCBOT TROJAN!"
U	CherryKeyMan	KeyMan.exe	"Multimedia keyboard manager for the Cherry keyboard series. Only required if you use any of the special keys"
U	ChikkaDefault	ChikkaLauncher.exe	"Chikka PC text messanger and IM client"
U	ChilyClient	ChilyClient.exe	"Chily Employee Activity Monitoring surveillance software. Uninstall this software unless you put it there yourself"
X	china11msn	CHINA11MSN.EXE	"Added by the ENVID.O WORM!"
X	Chinagnq	vasdd.exe	"Added by the SDBOT-SE WORM!"
U	ChineseStar	cstar.exe	Chinese language support software
U	CHIPDRIVEPinManager	sokscmpn.exe	"ChipDrive Smartcard software"
U	CHIPDRIVESmartcardManager	SCMgr.exe	"ChipDrive Smartcard software"
X	CHK NT	chkntf.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
N	CHKADMIN	CHKADMIN.EXE	"Compaq Network Management System. When running
X	chkdrv	iemon.exe	"Detected by Symantec as the ADCLICKER TROJAN!"
X	chope	runlli32.exe	"Added by the QQPASS-U TROJAN!"
?	ChronitelInitTV	CHTVINIT.EXE	"??"
U	chrono	chrono.exe	"Chronograph is a simple utility that synchronizes internal computer clock to the atomic time. Chronograph automatically maintains correct time using atomic clock servers of the National Institute of Standards and Technology (NIST)."" Shows seconds and shows the date without having to hover the mouse. Shows a calendar when hovered over"
X	Ci Servs	SysTuwin.exe	"Added by the AGENT-NIQ TROJAN!"
X	ci1gnt	ci1gnt.exe	"Detected by Kaspersky as the AGENT.DHU TROJAN!"
Y	Cingular Communication Manager	CingularCCM.exe	"Cingular Communication Manager - now taken over by AT&T. ""provides a robust set of wireless communication tools for businesses and individuals. With wireless access to email
X	Cinnabd Prompt32	CmdPrompt32.pif	"Added by the ASSIRAL-B WORM!"
X	Ciodiag	DECCONF.EXE	"Added by the STRAT.EL TROJAN!"
X	CirebonPunya	XXrocks.exe	"Added by the BHARAT.A WORM!"
U	Cisco Systems VPN Client	ipsecdialer.exe	"Cisco VPN Client - lets local users gain Administrator privileges on the operating system"
U	Cisco Systems VPN Client	vpngui.exe	"Sets up IPSec communications for Cisco's VPN Client"
N	CitiVAN	CitiVAN.exe	"Option from Citibank to change a credit card number in a random fashion for each purchase. The number will only be used once and never again"
Y	ClamWin	ClamTray.exe	"ClamWin antivirus"
X	Classes	int1.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	intl.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	run_21.exe	"""Switch"" premium rate adult content dialler variant"
N	Clean Access Agent	CCAAgent.exe	"Cisco Clean Access Agent from Cisco Systems
X	Clean Mgr	cleanmg.exe	"Added by the IRCBOT.BBO BACKDOOR!"
X	Clean up	service.exe	"Added by the AGENT-FPY TROJAN!"
X	Cleanator	Cleanator.exe	"Cleanator rogue privacy program - not recommended
?	CleanEasyImg	cleanall.exe	"??"
X	Cleaner2009 Freeware	UCLN.exe	"Cleaner2009 rogue privacy program - not recommended
X	CleanPCTool	SysRep.exe	"CleanPCTool rogue system error and cleaning utility - not recommended
?	CleanRegPath	CleanReg.exe	"Apparently Annex A ADSL modem related. What does it do and is it required?"
U	CleanSweep Smart Sweep- Internet Sweep	Csinsm32.exe	Automatic logging of installs from Norton CleanSweep - available via Start -> Programs
N	CleanSweep Useage Watch	CSUSEM32.EXE	Quarterdeck/Norton CleanSweep component - tracks how often you use files and alerts you to files that have not been used for a specified period of time
X	cleansweep.exe	cleansweep.exe	"Added by the AGENT-NEU TROJAN!"
U	CleanTemp	CLEANT~1.EXE	"CleanTemp - deletes the contents of the TEMP directory when Windows starts and then closes - using no memory"
U	CleanTemp	CleanTemp.exe	"CleanTemp - deletes the contents of the TEMP directory when Windows starts and then closes - using no memory"
N	Cleanup	ONICTASK.EXE	"Internet Cleanup from Allume Systems (used to be by OnTrack) - cleans up tracks left by browsing the internet"
Y	CleanUp	mcappins.exe	Used by older versions of McAfee internet security related products to clean up installation files that are no longer required once the product is installed. This entry will normally only appear once the product has been installed before the system is rebooted
Y	CleanUp	CleanUp.exe	"Utility that only runs once after installing the drivers for Analog Devices SoundMax integrated soundcards to clean-up the files no longer required once the installation is complete. Other programs/drivers may use the same filename for the same purpose. In this case
X	CleanUp Antivirus	CU[random characters].exe	"Cleanup Antivirus rogue security software - not recommended
?	CleanupProgram	cleanup.exe	"Sony Vaio related - what does it do and is it required? Located in a C:\Sonysys folder"
X	CleanupTool	SysRep.exe	"CleanupTool rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
X	clean_service	clean_service.cmd	"Added by the REFAZ WORM!"
X	clfmon	clfmon.exe	"Added by the TACTSLAY.E TROJAN!"
X	clfmon	nvsvca32.exe	"Added by the TACTSLAY.E TROJAN!"
X	clfmon.exe	clfmon.exe	"Added by the AGENT-BJ TROJAN!"
X	Cli Confg	cliconfig.exe	"Added by a variant of the SPYBOT WORM! See here"
N	Click Radio Tuner	clickr~1.exe	"ClickRadio - subscription service playing radio music via the internet"
N	Click Tray Calendar	ClickT~1.EXE	"ClickTray Calendar - shows holidays
N	ClickSight Launcher	cs.exe	"Launcher for the ClickSight® marketing tool from ClickStream Technologies - which ""is a patented data-collection technology that helps independent software vendors understand the current and future usage of their product"""
X	ClickTheButton	CTB.EXE	"ClickTheButton adware"
X	ClickTheButton	csrss.exe	"ClickTheButton adware. Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	ClickTheButton	cd_load.exe	"Added by the DOWNLOADER-MY TROJAN!"
X	CLICONFG	CLICONFG.EXE	"Added by the OPASERV.T WORM!"
U	Client Access API Daemon	cwbappcd.exe	"IBM iSeries Client Access
N	Client Access Check Version	cwbckver.exe	"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
?	Client Access Express Welcome	cwbwlwiz.exe	"Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
N	Client Access Help Update	cwbinhlp.exe	"Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
N	Client Access Service	CwbSvStr.Exe	"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
U	Client Access Taskbar	cwbuitsk.exe	"IBM iSeries Client Access taskbar
X	Client Agent	ipxwping.exe	"Added by the PPDOOR-N TROJAN!"
X	Client Agent	photes.exe	"Added by the PPDOOR-P TROJAN!"
X	Client Agent	[path to file]	"Added by the PPDOOR-J TROJAN!"
?	Client agent for ARCserve	W95AGENT.EXE	"Part of Brightstor ARCserve Backup from Computer Associates. What does it do and is it required?"
X	Client for Microsoft Networks	msclient32.exe	"Added by the SDBOT-BXQ WORM!"
N	Client Security Solution	cssauth.exe	"Part of Thinkvantage Client Security Solution for Lenovo ThinkPad notebooks and ThinkCentre desktops. Once configured via the associated setup screens this loads via winlogon.exe (and loads the password manager) and therefore disabling this entry has no effect"
X	Client Server Control Process	[path to trojan]	"Added by the AGENT-HR TROJAN!"
X	Client Server Run Time Proccess	csrsrv.exe	"Added by a variant of the SDBOT WORM!"
X	Client Server Runtime	[path to worm]	"Added by the POEBOT-KR WORM!"
X	Client Server Runtime Process	csrsss.exe	"Added by the SDBOT-LD WORM!"
X	Client Server Runtime Process	csrs.exe	"Added by the LINKBOT.M WORM!"
X	Client Server Runtime Process	smmss.exe	"Backdoor TROJAN! Possible SDBOT-GEN variant"
X	Client Update	wup.exe	"Added by the OPANKI.O WORM!"
Y	Cliente DLO	DLOClientu.exe	"Part of the backup suites from VERITAS - Backup Exec and NetBackup. Both have now been replaced by their Symantec equivalents since they acquired VERITAS in 2005"
X	ClientMan1	mscman.exe	"ClientMan parasite variant"
N	Clik Status Monitor	toolsclickstat.exe	Part of Iomega Tools to let you know whether an Iomega PocketZip (nee Clik) removable drive cartridge is installed
X	Clip Service Manager	clipmg.exe	"Added by the DELF.DXJ TROJAN!"
X	clkhost	[path to trojan]	"Added by the WIXUD-B TROJAN!"
U	CLMFrontPanel	clmpanel.exe	"System tray status/display/configuration utility for a number of modems. Can be disabled by right-clicking on the tray icon. If disabled
?	clnwall	"rundll.exe setupx.dll	InstallHinfSection ..delwall.inf"
X	clock	[various filenames]	"LiveChat Adware - known file names include: mssetup.exe
X	Clock Manager	amsngr.exe	"Added by the SDBOT-XM TROJAN!"
X	ClockSync	Sync.exe	"ClockSync - synchronizes your system clock with an internet time server. It's by WhenU
U	CloneCD	CloneCDTray.exe	"System tray for the now discontinued CloneCD. The only useful option is ""Hide CDR Media"" only available via this tray. Has additional unknown functions in later versions"
U	CloneCDElbyCDFL	ElbyCheck.exe	"From Elaborate Bytes who make CloneCD - monitors the installed filters of CD-ROMs/DVD-ROMs. Note - under Win2K removing this from startup causes the CD drive in the computer to not be recognized in the OS and after rechecking it prompts that the driver has been corrupted and asks you to restart the computer to fix it"
U	CloneCDTray	CloneCDTray.exe	"System tray for the now discontinued CloneCD. The only useful option is ""Hide CDR Media"" only available via this tray. Has additional unknown functions in later versions"
X	CLSID	plugin.exe	Adult content dialler
X	CMAPP	cmappclient.exe	"CasClient adware - also detected as the CMAPP TROJAN!"
N	Cmaudio	"Rundll32 cmicnfg.cpl	CMICtrlWnd"
X	cmd32	configs.exe	"Hijacker
X	cmdcon	cmdcon.exe	"Added by the CRYPTER.A TROJAN!"
X	cmds	vtsqn.dll	"Added by a variant of the VUNDO TROJAN!"
N	CmFlywaveName	CmFlywav.exe	"Driver for Linksys Wireless-G Music Bridge"
U	CMGrdian	CMGrdian.exe	"McAfee Guardian shortcut menu on the System Tray (looks like a castle) given access to Internet Security
X	CMMan	CMMan.exe	"Added by the CMAPP TROJAN!"
X	Cmmon32Sys	cmmon32.exe	Added by the SMALL.CL TROJAN!
X	cmonitor	startupmon.exe	"SystemDoctor rogue security software - not recommended
X	cmonitor	pasmon.exe	"SystemDoctor rogue security software - not recommended
U	CmPCIaudio	"RunDll32 CMICNFG3.CPL	CMICtrlWnd"
X	Cmpnt	Devices2.exe	"Added by the TOMPAI-D TROJAN!"
X	Cmpnt	mainsv.exe	"Added by the TOMPAI-C TROJAN!"
X	cmrss	[path to trojan]	"Added by the DLOADER-QQ TROJAN!"
U	CMSETTINGS	ctmn.exe	"Part of NetNanny
X	cmsound	vcpdll.exe	"Added by the TCXMEDI-D downloader TROJAN!"
X	cmsound	vcsystem.exe	"Added by the TCXMEDI-D downloader TROJAN!"
?	CmUCRRun	CmUCReye.exe	"Related to Medion Display Information. What does it do and is it required?"
X	Cn323	cnfrm33.exe	"Added by the MIMAIL.G WORM!"
X	Cn911	ODBCJET.exe	"Added by the BIFROSE-PR TROJAN!"
X	CNBABE	CNBABE.EXE	Appears to be spyware added by KAZAA (and maybe others) that displays pop-up ads whilst you're browsing
N	cnet	kontiki.exe	"Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops"
Y	cnfgCav	CMain.exe	"Part of Comodo Antivirus"
X	Cnfrm32	cnfrm.exe	"Added by the MIMAIL.D WORM!"
X	CnsMax	Internat.exe	"Added by the POINTEX TROJAN! Note - the real internat.exe resides in %windir%\system (where %windir% is the Windows directory - C:\Windows or C:\Winnt) whereas this version resides in %windir%"
X	CnsMin	"Rundll32.exe [path] CNSMIN.DLL	Rundll32"
Y	CnwiDeviceAgent	cnwida.exe	"Part of the Canon imagePROGRAF W8400 printer management software"
Y	CnxAdslL	CnxAdslL.exe	"DLink
N	CnxDslTaskBar	CnxDslTb.exe	Connexant DSL Taskbar as used on Acess Runner and Samsung AHT-E310 ADSL modems
U	Cobian	Cobian.exe	"Cobian Backup versions 8 thru 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup	cbInterface.exe	"System Tray access to Cobian Backup 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup	CobBU.exe	"Cobian Backup 6 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 10	Cobian.exe	"Cobian Backup 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (XP/Vista/7). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 10 Interface	cbInterface.exe	"System Tray access to Cobian Backup 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup 6	CobBU.exe	"Cobian Backup 6 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 7	CobBU.exe	"Cobian Backup 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 7 Application	CobBU.exe	"Cobian Backup 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 7 Interface	cobui.exe	"System Tray access to Cobian Backup 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup 8	Cobian.exe	"Cobian Backup 8 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 8 interface	cbInterface.exe	"System Tray access to Cobian Backup 8 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup 9	Cobian.exe	"Cobian Backup 9 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 9 interface	cbInterface.exe	"System Tray access to Cobian Backup 9 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup Amanita	cbInterface.exe	"System Tray access to Cobian Backup 9 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup Amanita	Cobian.exe	"Cobian Backup 9 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup Black Moon	cbInterface.exe	"System Tray access to Cobian Backup 8 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup Black Moon	Cobian.exe	"Cobian Backup 8 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup Boletus	Cobian.exe	"Cobian Backup 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (XP/Vista/7). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup Interface 6	cobui.exe	"System Tray access to Cobian Backup 6 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
X	CodeClean	CCIntro.exe	"CodeClean rogue security software - not recommended"
U	Codename Dashboard	dashboard.exe	"Codename: Dashboard - "an application that resides at the side of your screen. Built on the Microsoft .NET Framework
X	cof.updit	[random filename]	"Added by a variant of the SDBOT WORM!"
U	CognizanceTS	"rundll32.exe [path] AsTsVcc.dll	RegisterModule"
N	CollaborationHost	p2phost.exe	"Signs a user into the People Near Me feature at login in Windows 7 and Vista. People Near Me enables you to use certain peer-to-peer (P2P) programs on a network - that ""identifies people nearby who are using computers and allows those people to send you invitations for programs such as Windows Meeting Space. They can only invite you to participate in programs that are installed on your computer."" Available via Start → Control Panel"
N	Colorific Control Panel	Hgcctl95.exe	"Colorific® from E-Color - ""delivers accurate gamma and color temperature across your entire system - monitor to printer and digital camera to monitor."" Now superseded by ColorWizzard™"
X	COM Service	msynvr.com	"Added by the BEASTY.G TROJAN!"
X	COM+ Event System	DRWTSN16.EXE	"Added by the LOVGATE.AB WORM!"
X	COM+ EventSystem Services	ECSERVER.EXE	"Added by a variant of the SDBOT WORM!"
X	COM+ System Application	lsas.exe	"Added by the AGOBOT-MO WORM!"
X	COM+ System Applications	lsas.exe	"Added by the AGOBOT.SE WORM!"
U	com.codeode.privacymantra	privacymantra.exe	"""Privacy Mantra keeps your computer clean from online and offline tracks"""
U	ComAgent	ComAgent.exe	"ComAgent - MDaemon's instant messaging client"
X	Comcast Network	ribiva.exe	"Added by a variant of the IRC TROJAN!"
X	Command	system.exe	"Added by the GATECRASH.A or GATECRASH.B TROJANS!"
X	Command	Gotit.exe	"Added by the TITOG WORM!"
X	COMMAND	command.exe	"Added by the QQPASS.E TROJAN!"
X	command	javaw.exe	"Added by the AGOBOT-LG WORM!"
X	Command Prompt32	CmdPrompt32.pif	"Added by the ASSIRAL.B WORM!"
U	Command WorkStation 4	cws 4.exe	"EFI's Command WorkStation makes ""managing demanding workflows easier by centralizing job management. The software automatically identifies the Fiery servers on the network and offers customization options for displaying information"" - for high-end print environments"
X	command32	command32.exe	"Added by the LINEADI-A TROJAN!"
Y	Common Client	ccApp.exe	"Part of earlier versions of Norton AntiVirus - Auto-protect and E-mail check will not function without this"
Y	Common Client	ccRegVfy.exe	"Part of earlier versions of Norton AntiVirus - ""ccRegVfy.exe is responsible for checking the integrity of the NAV registry entries to make sure that the information has not been changed by a malicious threat or a hack"""
X	Common Files	twain.exe	"Added by the AGENT.BEA TROJAN!"
N	CommonSDK	RoxWatchTray9.exe	"System Tray access to managing the ""Watched Folders""
X	CommonService	winup.exe	"Added by the DLOADR-BJJ TROJAN!"
Y	Communications_Helper	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	Communications_Helper.exe	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	COMMUNICATOR	Communicator.exe	"Part of Microsoft Office Communicator
U	Comodo Launch Pad Tray	CLPTray.exe	"System Tray access to LaunchPad as bundled with Comodo's freebie offerings such as Comodo Anti-Virus. Some allege that LaunchPad is impossible-to-uninstall adware
U	Companion Module	companion.exe	"The AOL Companion is a small window that appears when you connect to the service using verison 8.0 and early builds of version 9.0. ""Use the Companion to quickly get to your favourite features
X	CompanionWizard	compwiz.exe	"Part of WinAntiVirusPro 2007 rogue security software (and possibly others) - not recommended
N	Compaq Computer Corp SCCenter Module	SCCENTER.EXE	For Compaq PC's. Part of Backweb
?	Compaq Computer Security	"Rundll32.exe SECURE32.CPL	Service"
N	Compaq Connections	COMPAQ~1.EXE	"See here - ""messaging service that automatically sends you support information
N	Compaq Connections	BackWeb-1940576.exe	"See here - ""messaging service that automatically sends you support information
N	Compaq Connections	Compaq Connections.exe	"See here - ""messaging service that automatically sends you support information
N	Compaq Internet Setup	inetwizard.exe	For Compaq PC's. Runs Compaq internet setup wizard and offers you to signup from ISP list
X	Compaq Jes Drivers	winjes.exe	"Added by the SDBOT-XR WORM!"
U	Compaq Knowledge Center	silent.exe & matcli.exe	""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	Compaq PK Daemon	cpqkl.exe	For Compaq laptops for programming user configurable keys. Not required unless you use them
X	Compaq Print Fax	cpqa1000.exe	"Added by the SDBOT.BCV WORM! Please take note of the difference between the legitimate Compaq Fax Utility Name (A1000 Settings Utility) and the name (Compaq Print Fax) used by this worm"
X	Compaq Service Drivers	systeminfos.exe	"Added by the SDBOT-XC WORM!"
X	Compaq Service Drivers	navapqwa.exe	"Added by the SDBOT.BBQ WORM!"
X	Compaq Service Drivers	amsn.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	msnt.exe	"Added by the SDBOT.CQL WORM!"
X	Compaq Service Drivers	NtKernelSystem.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	wincmd.exe	"Added by the RBOT.ATV WORM!"
X	Compaq Service Drivers	wind32.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	winmsn.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	msnsvc.exe	"Added by the RBOT.BKT WORM!"
X	Compaq Service Drivers	ntsys32.exe	"Added by the RBOT.CIW WORM!"
X	Compaq Service Drivers	winsvc.exe	"Added by the SDBOT-AGD WORM!"
X	Compaq Services Drivers	ndt32.exe	"Added by the RBOT.CQZ WORM!"
X	Compaq Sound Drivers For WINDOWS	sounddr.exe	"Added by the SDBOT-XG WORM!"
X	Compaq32 Service Drivers	msconfig32.exe	"Added by the SDBOT-ADC WORM!"
X	Compaq32 Service Drivers	msnt32.exe	"Added by the RBOT.BVF WORM!"
?	CompaqHW Comp Manager	cpqhcm.exe	"Running on a Compaq laptop - any ideas?"
N	CompaqPrinTray	printray.exe	Puts printer icon in the System Tray. When this option is disabled you will no longer be able to access the Control Program or Printer Driver directly from your desktop
X	Compliant	[worm filename]	"Added by the RBOT-LB WORM!"
X	ComPlus Applications	twain.exe	"Added by the AGENT.AQO TROJAN!"
U	CompuSpy KeyLogger	cswin2008.exe	"CompuSpy surveillance software. Uninstall this software unless you put it there yourself"
X	Computer Defender 2009	cd2009.exe	"Computer Defender 2009 rogue security software - not recommended
X	Computing Technologie Firewall	lsauth.exe	"Added by the SDBOT-WX WORM!"
X	ComStart	Trojan Guarder.exe	"TrojanGuarder rogue security software - not recommended"
X	con	[path to trojan]	"Added by the BRAVE-A TROJAN!"
?	Concurre	concurre.exe	"??"
X	ConducteurPrive	GDC.exe	"ConducteurPrive rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	Confg	bootconfig.exe	"Added by the VB-ERB WORM!"
X	ConfidentSurf	GDC.exe	"ConfidentSurf rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	ConfidentUser	SRP.exe	ConfidentUser rogue system error and cleaning utility - not recommended
X	Config	service.exe	"Added by the ISRAZ.B WORM!"
X	Config	WinService32.exe	"Added by the CRUTCHA-A TROJAN!"
X	Config	winconfig.exe	"Added by the GIP.113.B1 TROJAN!"
X	Config	CONFIG.EXE	"Added by the PSWGIP.B TROJAN!"
X	Config	TaskUpdate.exe	"Added by the MDROP-BRO TROJAN!"
X	Config Loadation	iEEexplore.exe	"Added by the SDBOT.H TROJAN!"
X	Config Loadatiorin	I3Explorer.exe	"Added by the SDBOT.H TROJAN!"
X	Config Loader	svchosl.exe	"Added by the GAOBOT.P WORM!"
X	Config Loader	sysldr32.exe	"Added by the GAOBOT WORM!"
X	Config Loader	scvhost.exe	"Added by the GAOBOT.AE or GAOBOT.AO WORMS!"
X	Config Loader	svhost.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Config Loader	svchost2.exe	"Added by the AGOBOT.XE WORM!"
X	Config Loader	[worm filename]	"Added by the AGOBOT-AE WORM!"
X	Config Loader	SYSMGR.EXE	"Added by the AGOBOT.C WORM!"
X	Config Loader	wincrt32.exe	"Added by the AGOBOT-AW WORM!"
X	Config Loader for Microsoft Windows	mwincfg32.exe	"Added by the AGOBOT.BD WORM!"
X	Config Loader2	explores.exe	"Added by the GAOBOT.BT WORM!"
X	Config Loadr	winsys32.exe	"Added by the AGOBOT-HN WORM!"
X	Config33.exe	Config33.exe	"Added by the SDBOT.T TROJAN!"
X	ConfiggLoader	cart322.exe	"Added by the GAOBOT.DJ WORM!"
U	ConfigSafe	CFGSAFE.EXE	"ConfigSafe - lets you identify changes to the registry
U	ConfigSafe	AUTOCHK.EXE	"ConfigSafe - lets you identify changes to the registry
N	ConfigServices	Config.exe	Part of initial setup on a Compaq PC
X	configsetup	configsetup32.exe	"Added by the AGOBOT-AFP WORM!"
X	Configuration	explorer32.exe	"Added by the SDBOT-ML WORM!"
X	configuration	apphost.exe	"Added by the SDBOT-VP WORM!"
X	Configuration	ntsys32.exe	"Added by the SDBOT-LN WORM!"
X	Configuration	msgfixs.exe	"Added by the SDBOT-NN WORM!"
X	Configuration Default	Wuxat.exe	"Added by the SPYBOT-CA WORM!"
X	Configuration Driver	scghost.exe	"Added by the SDBOT-DLA WORM!"
X	Configuration File	Winset32.exe	Added by the FLUX.101 TROJAN!
X	Configuration Loaded	wupdated.exe	"Added by the MOEGA or MOEGA.AG or MOEGA.AP WORMS!"
X	Configuration Loaded	lssas.exe	"Added by a variant of the SDBOT WORM!"
X	Configuration Loaded	iexploree.exe	"Added by the SDBOT-KC WORM!"
X	Configuration Loader	aim95.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	cmd32.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	syscfg32.exe	"Added by the SDBOT.B BACKDOOR!"
X	Configuration Loader	service5.exe	"Added by the GAOBOT.AF WORM!"
X	Configuration Loader	lfass.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	sycfg34.exe	"Added by the GAOBOT.AN WORM!"
X	Configuration Loader	wincrt32.exe	"Added by the GAOBOT.BF WORM!"
X	Configuration Loader	windex.exe	"Added by the GAOBOT.BZ WORM!"
X	Configuration Loader	dosrun32.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Service.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Servicess.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sw32.exe	"Added by the AGOBOT.BQ WORM!"
X	Configuration Loader	System.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Winreg.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sysinfo.exe	"Added by the GAOBOT.FQ WORM!"
X	Configuration Loader	microsoft.exe	"Added by the GAOBOT.JB WORM!"
X	Configuration Loader	confgldr.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	configuration loader	winicfg32.exe	"Added by the GAOBOT.RQ WORM!"
X	Configuration Loader	svhst.exe	"Added by the GAOBOT.YC WORM!"
X	Configuration Loader	msgfix.exe	"Added by the GAOBOT.AUS or SDBOT.J or SDBOT-QG WORMS!"
X	Configuration Loader	msnss.exe	"Added by the GAOBOT.AUS WORM!"
X	Configuration Loader	IEXPL0RE.EXE	"Added by the SDBOT BACKDOOR! Note the number ""0"" in the filename"
X	Configuration Loader	loadcfg32.exe	"Added by the SDBOT BACKDOOR! Note the number ""0"" in the filename"
X	Configuration Loader	MSTasks.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	systemry.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	ccSort.exe	"Added by the AGOBOT.SR WORM!"
X	Configuration Loader	smss32.exe	"Added by the AGOBOT.MB WORM!"
X	Configuration Loader	wincffg.exe	"Added by the AGOBOT.A3 WORM!"
X	Configuration Loader	seru32.exe	"Added by the SDBOT-VR WORM!"
X	Configuration Loader	botss.exe	"Added by the SDBOT-XS WORM!"
X	Configuration Loader	ldasp.exe	"Added by the AGOBOT.BH WORM!"
X	Configuration Loader	msgcfgsrv.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	smsai.exe	"Added by the SDBOT-YE WORM!"
X	Configuration Loader	svupdate.exe	"Added by the RANDEX.DXP WORM!"
X	Configuration Loader	crcss.exe	"Added by the AGOBOT.ADG WORM!"
X	Configuration Loader	lexplore.exe	"Added by the RBOT-AGX WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	Configuration Loader	scvhost.exe	"Added by the AGOBOT-AAE and SDBOT.AR WORMS!"
X	Configuration Loader	svchost.exe	"Added by the PARADROP-A WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Configuration Loader	svchost2.exe	"Added by the AGOBOT.JR WORM!"
X	Configuration Loader	dezi.exe	"Added by the SDBOT-OB WORM!"
X	Configuration Loader	mouse.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	msg.exe	"Added by the SDBOT.BT WORM!"
X	Configuration Loader	WinHelper.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	extrac.exe	"Added by the SDBOT-AFP WORM!"
X	Configuration Loader	DVD-Player.exe	"Added by a variant of the SDBOT WORM!"
X	Configuration Loader	IEXPLORE.EXE	"Added by the SDBOT-KW WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Configuration Loader	wincore.exe	"Added by the SDBOT.BHE WORM!"
X	Configuration Loader	configldr.exe	"Added by the AGOBOT-PP TROJAN!"
X	Configuration Loader	ahnhst.exe	"Added by the AGOBOT.MX WORM!"
X	Configuration Loader	ntdm.exe	"Added by the AGOBOT.RV WORM!"
X	Configuration Loader	msnmsgr.exe	"Added by the SDBOT-SO WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Configuration Loader	svschost.exe	"Added by the SDBOT-NS WORM!"
X	Configuration Loader	wump.exe	"Added by the AGOBOT-BU BACKDOOR!"
X	Configuration Loader	WinSys32ys.exe	"Added by the SDBOT.BCS WORM!"
X	Configuration Loader	cvcd.exe	"Added by the AGOBOT-DH BACKDOOR!"
X	Configuration Loader	asnclt32.exe	"Added by the AGOBOT-EB BACKDOOR!"
X	Configuration Loader	soundconf.exe	"Added by the AGOBOT-MH WORM!"
X	Configuration Loader	win32exec.exe	"Added by the SDBOT-LA WORM!"
X	Configuration Loader	mservs.exe	"Added by the SDBOT-NM WORM!"
X	Configuration Loader	update.exe	"Added by the SDBOT-OS WORM!"
X	Configuration Loader	FILENAME.EXE	"Added by the AGOBOT-DQ WORM!"
X	Configuration Loader	explore.exe	"Added by the GAOBOT.GW WORM!"
X	Configuration Loader	msgfixy.exe	"Added by the SLINBOT.QW BACKDOOR!"
X	Configuration Loader	winfix.exe	"Added by the SDBOT-MA WORM!"
X	Configuration Loader	scvh0st.exe	"Added by the AGOBOT-AX WORM!"
X	Configuration Loader	msrun.exe	"Added by the AGOBOT-Y WORM!"
X	Configuration Loader 2	confuldr.exe	"Added by the AGOBOT-FC WORM!"
X	Configuration Loader Service	Winsys32.exe	"Added by the RBOT-YV WORM!"
X	Configuration Loader Service	devl32.exe	"Added by the SDBOT-XY WORM!"
X	Configuration Loader10	ip7.exe	"Added by the AGOBOT-ANZ WORM!"
X	Configuration Loading	svchos1.exe	"Added by the GAOBOT.DK WORM!"
X	Configuration Loading	configldr.exe	"Added by the AGOBOT-EC WORM!"
X	Configuration Loading Service	wscel.exe	"Added by the SDBOT-WJ WORM!"
X	Configuration Loadr	iexplore.exee	Added by an unidentified WORM or TROJAN!
X	Configuration Manager	CNFGLD32.EXE	"Added by the SDBOT TROJAN!"
X	Configuration Manager	Cnfgldr.exe	"Added by the SDBOT TROJAN!"
X	Configuration Manager	cfg32.exe	"BookedSpace parasite. Note - the ""cfg32.exe"" file is located in %Windir%"
X	Configuration Servecie	sewins.exe	"Added by the SDBOT-COH WORM!"
X	Configuration Service	suchost.exe	"Added by the TREB TROJAN!"
X	Configuration Services	mswords.exe	"Added by the SDBOT-YM WORM!"
X	Configuration Update	UPDT32V2.EXE	"Added by the SPYBOT-AA BACKDOOR!"
N	Configuration Utility	CONFIG.EXE	Controls linksys wireless connection. Available from the Desktop
U	Configuration Utility	wlanutil.exe	"NetGear Wireless LAN configuration utility for the MA311 802.11b (and maybe other cards)"
X	Configuration Wizard	Cfgwiz32.exe	"Added by a variant of the HACKTACK TROJAN! Not to be confused with the legitimate MS ""ISDN Configuration Wizard"" (Cfgwiz32.exe)"
X	Configuration32 Loader32	winamp32.exe	"Added by the SDBOT-BIC WORM!"
X	Configurations Asclt	asclt.exe	"Added by the SDBOT-MX WORM!"
X	CONFIGUREv	antivir62.exe	"Added by the AGOBOT-ZD BACKDOOR!"
U	ConfigUtility	ConfigUtility.exe	"Wireless management utility for the HWC54G Hi-Speed Wireless-G CardBus Card from Hawking Technologies
X	ConfigVir	services.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
X	ConfLoader	sysconf16.exe	"Added by the SDBOT-FB TROJAN!"
X	conime.exe	conime.exe	"Added by the AVENDOG WORM! Note - this is not the legitimate Console IME process of the same filename which is located in %System%"
N	Conmgr	conmgr.exe	Starts Winfax pro at startup
U	ConMgr.exe	conmgr.exe	Connection Manager as used by Earthlink and others. If you need this to ensure a proper connection but don't want to connect at startup try creating your own shortcut
X	conmswf	conrnbne.exe	"Added by the SDBOT-DEX WORM!"
U	Connect Kasamba	Kasamba.exe	"""Finding the expert help that you need is easy on Kasamba. With more than 30
X	Connect2Party	connect2party.exe	Adult content dialler
N	CONNECTAuto Update	CONNECTScheduler.exe	"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
N	CONNECTAUTrayApp	CONNECTAUTrayApp.exe	"System Tray access to change update settings for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
U	Connection Keeper	ConKeepM.exe	"""Connection Keeper is an invaluable time-saving tool for dial-up users. This free program simulates Internet browsing (at a random interval) to prevent your connection from appearing idle
N	Connection Manager	CManager.exe	SBC Yahoo DSL service connection manager. You can connect from the network connections. Users having problems with this have been advised to uninstall the connection manager via Add/Remove Programs and it won't affect the service
X	Connectivity Tool	[path to trojan]	"Added by the LITEBOT-E TROJAN!"
X	Connector	SYS.EXE	"Nunci premium rate dialer"
X	Connector	sms.EXE	"Added by the ExDial-B premium rate adult content dialer"
N	CONNECTScheduler	CONNECTScheduler.exe	"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
X	Cons	consol32.exe	"Hijacker - redirects to an adult content portal
X	conscorr	conscorr.exe	"VX2.Transponder parasite updater/installer related"
X	Console de Gerenciamento Microsoft	csrss.exe	"Unidentified malware! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Level4"" subfolder"
X	Console de Gerenciamento Microsoft	csrss.exe	"Added by the BANCBAN-ET TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Central de Segurança"" subfolder"
U	Consumer Input	ConsumerInput.exe	"Consumer Input Toolbar. Opt-in market research monitoring you browsing habits - see the FAQ"
?	Contacte	contacte.exe	"Some kind of driver?"
X	Content connector	[random filename].exe	"Added by the DIALER-Y TROJAN! Note - uses a random filename and random folders. Usually the folder containing the file is a Temp folder"
X	Content List Management Subsystem	clmss.exe	"Added by the SPYBOT-EL WORM!"
X	Content Service	winserv[LETTER].exe	"PurityScan adware"
X	ContentDownload	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	ContentEraser	GDC.exe	"ContentEraser rogue privacy tool - not recommended
X	ContentService	winservn.exe	"PurityScan adware - see here"
U	ContentTransferWMDetector.exe	ContentTransferWMDetector.exe	"Part of Sony's Content Transfer Software which ""provides an easy way to transfer music
X	ContinueInstall	bpsinstall.exe	"BrowserAid/BrowserPal foistware"
X	Contraviro	Contraviro.exe	"Contraviro rogue security software - not recommended
X	ContraVirus	ContraVirusPro.exe	"ContraVirus rogue security software - not recommended
X	ContraVirus	ContraVirus.exe	"ContraVirus rogue security software - not recommended
X	Control	"rundll32.exe ctrlpan.dll	Restore ControlPanel"
U	Control Center	Center.exe	"Associated with Hawking Technologies
X	Control handler	***********.exe [* = random char]	"CoolWebSearch parasite variant"
X	Control handler	ahjinst.exe	"CoolWebSearch parasite variant"
X	Control handler	[10 to 14 random char]THD.EXE	"Added by the KREPPER-AI TROJAN!"
N	control panel	smctrlw.exe	System Tray icon for a Silicon Motion LynxEM based PCI Graphics Card
X	Control Panel	System.exe	"Added by the DANI TROJAN!"
X	control panel software service	cprs.exe	"Added by the RBOT-FPI WORM!"
X	Controladores	[path to trojan]	"Added by the TELEFO-A TROJAN!"
Y	ControlCenter	ctlcntr.exe	"Part of Lenovo's (IBM) ThinkVantage Fingerprint Software - used on laptops and keyboards with integrated fingerprint readers"
N	ControlCenter2.0	brctrcen.exe	Brother scanner 'Control Center' application - can be started manually
N	ControlCentreTray	XWCTray.exe	"System Tray access for the Xerox ControlCentre 2.0 software for their range of printers
X	Controlled Resource System Service	crss.exe	"Added by the AGOBOT.GH WORM!"
N	Controller	WFXCTL32.EXE	From Symantec's TalkWorks Pro and WinFax. Appears if you chose to have the program appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs
X	ControlPanel	"rundll32 internat.dll	LoadKeyboardProfile"
X	ControlPanel	"host32.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"cmd32.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"systemctrl.exe internet.dll	LoadNetworkProfile"
X	ControlPanel	"[path to executable] internat.dll	LoadKeyboardProfile"
X	ControlPanel	"popcorn.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"popcorn64.exe rundll.dll	LoadMouseProfile"
X	ControlPanel	"popcorn72.exe rundll.dll	LoadMouseProfile"
X	ControlPanel	"svcc.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"popcorn320.exe rundll.dll	LoadMouseProfile"
X	ControlPanel	"private.exe internat.dll	LoadMouseCarpetProfile"
X	ControlPanel	"twink64.exe internat.dll	LoadKeyboardProfile"
X	ControlServiceMgr	csmsv.exe	"Added by the AGENT-XC TROJAN!"
X	CoolDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	CoolMon	CoolMon.exe	"""CoolMon monitors vital system stats and almost anything else you wish to display on the desktop"""
X	CoolMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	coolwebprogram	clrssn.exe	"CoolWebSearch Smartsearch parasite variant"
N	Copernic Desktop Search	DesktopSearch.exe	"Copernic Desktop Search - ""Easily search your entire hard drive in less than a second to pinpoint the right file
U	Copernic Desktop Search 2	DesktopSearchService.exe	"Copernic Desktop Search - search agent"
U	CopernicPerUserTaskMgr	CopernicPerUserTaskMgr.exe	Automatic tasking feature of Copernic Pro multi-search engine tool
U	Copy handler	Copy Handler.exe	"Copy Handler lets you copy between hard disks
X	Core Process Aplication	ccapl.exe	"Added by the QHOSTS.G TROJAN!"
X	Core Process Aplication x16	ccapl16.exe	"Added by the SPYBOT.AFT WORM!"
X	Core Process Aplication x32	ccapl32.exe	"Added by the SRAMLER.E TROJAN!"
U	CoreCenter	CoreCenter.exe	"MSI Core Center - motherboard utility for monitoring CPU speed
U	CoreCenter	CORECE~1.EXE	"MSI Core Center - motherboard utility for monitoring CPU speed
X	Coreguard Antivirus 2009	Coreguard 2009.exe	"Coreguard Antivirus 2009 rogue security software - not recommended
N	Corel Colleagues & Contacts Reminders	cffrem.exe	"Corel Colleagues & Contracts - all-in-one organizer for scheduling meetings
N	Corel Desktop Application Director	dadx.exe	The Desktop Application Director (DAD) gives you easy access to all Corel applications - x represents ther version number. Available via Start -> Programs
N	Corel Family & Friends reminders	CFFREM.EXE	"Corel Family & Friends - all-in-one calender
N	Corel Photo Downloader	MediaDetect.exe	"Related to Corel Photo Album"
N	Corel Registration	Remind32.exe	If you don't want to register Corel products and be reminded about it every 2 weeks disable it
N	Corel Registration Reminder	Remind32.exe	If you don't want to register Corel products and be reminded about it every 2 weeks disable it
N	Corel Reminder	NAVBROWSER.EXE	If you don't want to register Corel products and be reminded about it every 2 weeks disable it
N	Corel Reminder	NAVBrowser.exe	Registration reminder for CorelDRAW 10
N	CorelCENTRAL 10	I_26dadCC.exe	"CorelCENTRAL 10 - personal information manager (PIM). Supplied as part of Corel WordPerfect Office 2002. Available via Start -> Programs"
N	CorelMedia FoldersIndexer8	MFindexer.exe	Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office
N	CorelMedia FoldersIndexer8	MFINDE~1.EXE	Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office
N	CorrectConnect	CConnect.exe	Broadband ISP diagnostic tool - as used by NTL and Cox Communications. Shortcut available
X	cosine	cosine.exe	"Added by the RBOT-SW WORM!"
U	CostAware	niIPCApp.exe	"NetInternals CostAware - download quota measuring tool"
X	Counterstrike Service Agent	czrzns.exe	"Added by the MEDBOT.AR WORM!"
N	Country Select	pctptt.exe	"Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell
N	CountrySelection	pctptt.exe	"Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell
?	Coupon Offers	??	"??"
X	couponica	couponica.exe	"Adware - see here"
?	CP	CopyProtectionNotifier.exe	"Related to Emuzed Systems and Middleware. Comes included with Windows XP Media Edition"
U	CP32NOT	CP32BTN.EXE	For the programmable "one-touch" buttons on HP laptops (and others?). Safe to disable if you don't use these buttons
U	CP4HPOT	OneTouch.EXE	"Supports the additional multimedia keys on HP/Compaq laptops which give single button press access to standard functions such as Mail
X	cpanel	winlogin32.exe	"Added by the RBOT-FOY WORM!"
X	cpl	deamon.exe	"Added by the TACTSLAY.C TROJAN!"
X	cpl	s_menu.exe	"Added by the TACTSLAY.C TROJAN!"
X	cpntmgc	wincomp.exe	"Added by the WINTRIM.A TROJAN!"
X	cpntmgc	simcss.exe	"Added by the MAGICON.A TROJAN!"
X	cpntmgc	navpmc.exe	"Added by the SIMCSS TROJAN!"
X	cpntmgc	winmgts.exe	"Added by the WINTRIM-B TROJAN!"
X	cppc	[path to trojan]	"Added by the VB-NV BACKDOOR!"
U	CPQInet Runtime Service	CpqInet.exe	"For Compaq PC's. Allows AOL and Compuserve to use the Easy Access buttons for the internet. Is not required if you don't use the ISP providers"
N	CPQINKAGENT	cpqinkag.exe	"That is the Compaq Ink Agent for some inkjet printers
U	cpqns	cpqnpcss.exe	Related to Compaq.Net - not required if you don't use that
X	CPU Manager	cpumgr.exe	"Added by the PANDEM.B WORM!"
U	CPU Power Monitor	CpuPowerMonitor.exe	"Included with some ASUS motherboards (such as the Maximus Extreme & Striker II Extreme). Associated with the ""Energy Saving"" feature of AI Gear - which ""is a utility designed to configure and support all ASUS EPU (Energy Processing Unit) features."" Part of AI Suite"
X	CPU Temp Control	wuitgurd.exe	"Added by the RBOT-AHV WORM!"
X	CPU Watcher	"rundll32.exe cpu.dll	load"
X	CPU Windows Status	cpustats.exe	"Added by a variant of the RBOT WORM!"
N	CPUMon	CPUMon.exe	"""CPUMon continuously displays the updated system statistics in a floating window as well as in system tray area"""
X	CPVHOST Settings	cpvhost.exe	"Added by a variant of the SDBOT TROJAN!"
X	Cr**.exe [* = random char]	Cr**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Cr**32.exe [* = random char]	Cr**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
U	cracked_windows1	cracked_windows1.exe	"Cracked Windows popup killer"
X	crash0001	restorecrashwin32.bat	"Added by the AGENT-ZC TROJAN!"
X	CrashDump	[path to trojan]	"Added by the DROPPER.EAT TROJAN!"
N	CrazyTalk Serve	"rundll32.exe CrazyTalk.dll	DIIServeMediaFile"
U	CRBroadCasting	CRBroadCasting.exe	"CardReader2 from On Track Inovations Ltd. USB Card Reader"
X	Crc32stats Dependencies	Crc32stats.exe	"Added by the MYTOB.GT WORM!"
X	Create A Monster	createAMonster.exe	"Kudd.com CreateAMonster. Reportedly stealth installed and Look2Me adware related"
N	CreateCD_Reminder	reminder.exe	Reminder to create system recovery CD/DVDs on a Sony Vaio laptop or desktop
X	Creates stractures for system management	stacture.exe	"Added by the SDBOT-DHS WORM!"
N	Creative Launcher	CTLauncher.exe	For Creative Soundblaster Live! series soundcards. Adds a quick-launch bar to the top of the display and a System Tray icon. Available via Start -> Programs
U	Creative Live! Cam Manager	CTLCMgr.exe	"Creative Live! Cam Manager"
N	Creative PCI Audio Configuration Utility	starter.exe	"System Tray icon to configure a Creative Soundblaster PCI soundcard. Not required and re-instates itself when un-checked. Try one of the solutions on this special page. Similar to EnsoniqMixer"
N	CreativeDiscNotifier	CTNOTIFY.EXE	"For Creative Soundblaster Live! series soundcards. Detects when you insert a CD-ROM
X	CrisysTec Sentry	Sentry.exe	"CrisysTec Sentry rogue privacy program - not recommended"
X	Critical Update Check	battlenet.exe	"Added by the DELF-LB TROJAN!"
X	crmssrlt	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	Crnsava	scrnsave.pif	"Added by the SDBOT-ZV WORM!"
X	cronos	MARCO!.SCR	"Added by the OPASERV.G WORM!"
X	CrossMenu	CrossMenu	Toshiba CrossMenu Utility - allows the user to create their own menus
U	CrossMenu	CrossMenu.exe	Toshiba CrossMenu Utility - allows the user to create their own menus
X	CRP386 Networking	crp386.exe	"Added by the IRCBOT.N TROJAN!"
X	crsmons	iomssls.exe	"Added by the BACKDR-AU TROJAN!"
X	CRSSXP SysInfo	crssxp.exe	"Added by a variant of the SDBOT TROJAN!"
N	CryptLoad	RouterClient.exe	"CryptLoad download manager"
X	Cryptographic Service	******.exe [* = random char]	"Added by the KORGO.W or KORGO.X or KORGO.AB WORMS!"
?	Crystal 3D Audio Control	CWD3DSND.EXE	"Crystal 3D Audio sound driver. Is it required?"
X	CS Update	copy /Y [path] ActivationManager.dll.upd [path] ActivationManager.dll	Added by an unidentified malware
U	CSINJECT.EXE	CSINJECT.EXE	"Part of Quarterdeck/Norton CleanSweep. ""Csinject must be loaded in order for Smart Sweep to automatically monitor installations and properly track registry changes"""
X	csm Win Updates	csm.exe	"Added by the ZOTOB.B WORM!"
X	CSNetManagerXp	isass.exe	"Added by the HIDER-O TROJAN!"
X	csrss	nwiz.exe	"Added by the CHODE-J WORM!"
X	CSRSWIN	[trojan filename]	"Added by the WINSHELL.50 TROJAN!"
X	CSRSX	[trojan filename]	"Added by the WINSHELL.50.B TROJAN!"
U	CSS_Central	CSS_1631.EXE	"CSS Communication Agent (95 Host) from Command Software Systems (now Authentium). ""CSS Central™ provides administrators with a powerfully proactive tool to effectively manage and maintain the anti-virus strategy from a centralized console"""
X	CT Control Settings	CTSVCCD.EXE	"Added by the RBOT-YS WORM!"
U	CTCMonitor	CTCMonitor.exe	"Click-to-Convert - document-to-HTML or doc-to-PDF converter. Only required if you are going to use the File -> Print method of using Click-to-Convert. If converting directly from MS Office
X	CTDrive	"rundll32.exe drvmod.dll	startup"
X	CTF Device Loader	ctfmond.exe	"Added by the AGOBOT-FO WORM!"
X	ctflog manager	ctflog.exe	"Added by the DONBOMB.A TROJAN!"
X	CTFM0N.exe	CTFM0N.exe	"Added by the STARTPAGE.P TROJAN! Notice the digit ""0"" in both columns rather than the upper case ""o"""
X	ctfmen	cssrs.exe	"Added by the STARTP-DC TROJAN!"
X	ctfmom	ctfnom.exe	"Added by the BCKDR-QTA BACKDOOR!"
U	ctfmon	ctfmon.exe	"Supports multiple languages and alternative method inputs in Windows and MS Office. The language bar is displayed alongside the System Tray if more than one keyboard layout is enabled (for switching input languages) or
X	ctfmon	taskmgr32*.exe [* = number]	"Added by the SOWSAT.B WORM!"
X	ctfmon	cftmon.exe	"Added by the DELIVE-A BACKDOOR! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in %Windir%"
X	ctfmon	mIRC.dll	"Added by the DELBOT-E TROJAN!"
X	ctfmon	WinConst.exe	"Added by the ASSASIN-G TROJAN!"
U	CTFMon	ctfmon.exe	"Family KeyLogger keystroke logger/monitoring program - remove unless you installed it yourself! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in a ""CTF"" sub-folder"
X	ctfmon	msnmsgr.exe	"Added by the BDOOR-JV BACKDOOR! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	CTFMON	wscript.exe /E:vbs winjpg.jpg	"Added by the RUNAUTO.F WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""winjpg.jpg"" file is located in %System%"
X	CTFMON	wscript.exe /E:vbs regedit.sys	"Added by the VBSAUTO-A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""regedit.sys"" file is located in %System%"
X	CTFMON	win.exe	"Added by the VBS.RUNAUTO.G WORM!"
X	Ctfmon	wmisys.exe	"Added by the IRCBOT-ADS WORM!"
X	ctfmon	WinUP.exe	"Added by the BANKER-VV TROJAN!"
X	CTFMON.CPL	CTFM0N.CMD	"Detected by Symantec as the SILLYFDC WORM! See here"
X	Ctfmon.exe	ctfmon32.exe	"CoolWebSearch Ctfmon32 parasite variant"
X	ctfmon.exe	ctfmon.exe	"Added by the RAIDYS TROJAN! Note - this overwrites the legitimate ctfmon.exe process associated with alternate text inputs which is located in %System%"
X	ctfmon.exe	msupdate32.exe	"Spy Sheriff/SpywareNO malware
U	ctfmon.exe	ctfmon.exe	"Supports multiple languages and alternative method inputs in Windows and MS Office. The language bar is displayed alongside the System Tray if more than one keyboard layout is enabled (for switching input languages) or
X	ctfmon.exe	ctfmon.exe eminem.exe	"Added by the BHARAT.A WORM!"
X	CTFMON.EXE	svchost.exe	"Added by the JUEGO-B WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	CTFMON32	CTFMON32.EXE	"CoolWebSearch Ctfmon32 parasite variant - also detected as the CWS-E TROJAN!"
X	ctfmon32	[random filename].exe	"Added by the RBOT-GSN WORM!"
X	ctfmon32	taskmgr32*.exe [* = digit]	"Added by the SOWSAT.C WORM!"
X	ctfmona	ctfmona.exe	"Added by the DLOADR-BME TROJAN!"
X	CTFMONSS	CTFMONSS.EXE	"Added by the CWS-F TROJAN!"
X	ctfmoon	microsoftconfigurator.exe	"Added by the DELF-ALS TROJAN!"
X	ctfmun	ctfmun.exe	"Added by the AGENT.ACEZ TROJAN!"
X	ctfnnon	ctfmon.exe	"Added by the TURKOJAN.IL BACKDOOR! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in %Windir%"
X	ctfnom	rundIl32.exe	"Added by the LEGMIR-AW TROJAN!"
X	ctfnom.exe	SVOHOST.exe	"Added by the DIGIDOR-A TROJAN!"
X	ctfnom.exe	OSRSS.exe	"Added by the DLOADER-UQ TROJAN!"
X	CTime	[path to trojan]	"Added by the HTTPDOS TROJAN!"
X	CTin10	CTin10.exe	"Added by the BANCOS.E TROJAN!"
X	CTMON.EXE	cfmon.exe	"Added by the CLCKR-AN TROJAN!"
U	CTNMRUN	ctnmrun.exe	Detects the Creative NOMAD jukebox/MP3 player at the time it is attached to USB and starts the needed application (Creative PlayCentre 2) that you use to copy MP3 files to and from it. This is required if you want PlayCentre 2 to take control of the NOMAD once connected
N	CTPerformanceUtility	CTPowUti.exe	"Related to Creative PowerSysTrayApp. This program is a non-essential process
X	ctpmon	ctpmon.exe	"Registry Cleaner rogue - not recommended
N	CTRegRun	CTRegRun.exe	For Creative Soundblaster Live! series soundcards. Reminds you to register your card with Creative
N	CTSyncU.exe	CTSyncU.exe	"Creative Sync Manager - synchronizes music tracks on your computer with your player"
X	CU1	VCClient.exe	Associated with the Surf Sidekick adware and should be removed
X	CU2	VCMain.exe	Associated with the Surf Sidekick adware and should be removed
Y	cuagentExe	Cuagent.exe	"Command Antivirus related"
X	CueX44_stil_here	WINLOGON.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate winlogon.exe process
X	Current Security Config	csecure.exe	"Added by the RBOT-AMO WORM!"
X	Current32	msnpla.exe	"Added by the SDBOT-DIS WORM!"
N	CurseClient	CurseClient.exe	"CurseClient add-on manager for World of Warcraft and Warhammer Online games"
N	cursor	Screendragon_VS_Taskbar.exe	"ScreenDragon video player"
U	Curtain	Curtain.exe	"Curtain (from Chaotic Visions) - ""is a Windows utility which gives you the power to hide any window or group of windows to your system tray"""
U	Customizer2000	logon.exe	"Automatic logon feature of Customizer 2000 - ""a special utility which is designed to optimize Win9x/ME performance. The program lets you explore the many hidden settings in Windows
X	Cvfjx	ANACON.EXE	"Added by the NACO.A WORM!"
X	cvhnykzx	keepSafe.exe	"Added by the KILLAV.KAX TROJAN!"
X	cvmonitor.exe	cvmonitor.exe	"Added by the SDBOT.BV WORM!"
Y	CVPND	cvpnd.exe	Sub-system used by Cisco VPN client for making a connection to a remote IPSec server
N	cwbinhlp	cwbinhlp.exe	"Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
X	cwingllib	atllsimm.exe	"Added by a variant of the SDBOT WORM!"
N	CXMon	Hpi_Monitor.exe	Autodetects when a HP camera is attached to the computer and launches the "HP Photoimaging Software". Available via Start -> Programs
X	cybansos	cyban.exe	"Added by the TATERF-V WORM!"
U	Cyber-Defender 2003	uwcdsvr.exe	"
X	cyberfree.exe	****.dat [* = random char]	Unidentified adware
U	CyberLat Ram Cleaner	CLRamCleaner.exe	"CyberLat RAM Cleaner - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
U	CyberLat Ram Cleaner	CyberLat Ram Cleaner 1.1.exe	"CyberLat RAM Cleaner - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
N	Cyberlink PowerCinema 3.0	PCMService.exe	"Part of Cyberlink's PowerCinema - which can be used to watch movies
N	CyberMedia Agent	CMAGENT.EXE	"Part of CyberMedia's Oil Change program. Not normally required. Note - if you have TextBridge
U	CyberPatrolNew	cphq.exe	"""CyberPatrol is one of the most powerful and popular client-based
?	CYNHKey	CYNHKey.exe	"??"
U	CypressLinkMon	CypressLinkMon.exe	"Related to CypressViewer from Siemens that ""allows ACUSON Cypress cardiovascular system PLUS users to store
Y	D-Link Air USB Utility	AirCFG.exe	D-Link Air USB wireless driver and configuration utility
Y	D-Link Air Utility	AirCFG.exe	D-Link Air PCI wireless driver and configuration utility
N	D-Link AirPlus DWL-650+ Utility	WLANMON.exe	D-Link Air Plus Wireless PC modem connection monitor
Y	D-Link AirPlus G	AirGCFG.exe	D-Link Airplus G wireless router driver and configuration utility
Y	D-Link AirPlus G Wireless Utility	AirPlus.exe	"D-Link AirPlus G wireless configuration and monitoring utility"
Y	D-Link AirPlus XtremeG	AirPlusCFG.exe	"D-Link AirPlus Xtreme G wireless access point driver and configuration utility"
Y	D-Link D-Link DWA-125	AirGCFG.exe	"D-Link DWA-125 Wireless 150 USB adapter driver and configuration utility"
Y	D-Link D-Link RangeBooster N DWA-140	AirNCFG.exe	"D-Link DWA-140 RangeBooster N USB adapter driver and configuration utility"
Y	D-Link D-Link Wireless 108G DWA-120	AirPlusCFG.exe	D-Link DWA-120 Wireless 108G USB adapter driver and configuration utility
Y	D-Link D-Link Wireless 108G DWA-520	AirPlusCFG.exe	D-Link DWA-520 Wireless 108G desktop adapter driver and configuration utility
Y	D-Link D-Link Wireless G DWA-110	AirGCFG.exe	D-Link DWA-110 Wireless G USB adapter driver and configuration utility
Y	D-Link D-Link Wireless G DWA-510	AirGCFG.exe	D-Link DWA-510 Wireless G desktop adapter driver and configuration utility
Y	D-Link D-Link Wireless N Dual Band DWA-160	AirNCFG.exe	"D-Link DWA-160 Xtreme N Dual Band USB adapter driver and configuration utility"
Y	D-Link D-Link Wireless N DWA-130	AirNCFG.exe	"D-Link DWA-130 Wireless N USB adapter driver and configuration utility"
Y	D-Link D-Link Xtreme N Dual Band DWA-160	AirNCFG.exe	"D-Link DWA-160 Xtreme N Dual Band USB adapter driver and configuration utility"
Y	D-Link RangeBooster G WDA-2320	AirPlusCFG.exe	"D-Link WDA-2320 RangeBooster G desktop adapter driver and configuration utility"
Y	D-Link RangeBooster G WUA-2340	AirPlusCFG.exe	"D-Link WUA-2340 RangeBooster G USB adapter driver and configuration utility"
Y	D-Link Wireless G WDA-1320	AirGCFG.exe	"D-Link WDA-1320 Wireless G desktop adapter driver and configuration utility"
Y	D-Link Wireless G WUA-1340	AirGCFG.exe	"D-Link WUA-1340 Wireless G USB adapter driver and configuration utility"
X	D3**.exe [* = random char]	D3**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	D3**32.exe [* = random char]	D3**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	dabrun	"rundll32.exe dabapi.dll	Rundll32"
N	DACONFIGEXE	daconfig.exe	3Com NIC Diagnostics. Available via Start -> Programs
N	Daemon	DAEMON32.EXE	Pre-loads game profiles for MS Sidewinder game controllers prior to release 2.0 of the software. Recommend upgrade. Available via Start -> Programs
N	daemon	daemon.exe	"Older version of Daemon Tools Lite from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
X	Daemon	daemon.exe c daemon2.exe	"Added by the SELOTIMA.A WORM!"
N	DAEMON Tools	daemon.exe	"Older version of Daemon Tools Lite from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
N	DAEMON Tools Lite	daemon.exe	"Older version of Daemon Tools Lite from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
N	DAEMON Tools Lite	DTlite.exe	"Daemon Tools Lite from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
N	DAEMON Tools Pro	DTAgent.exe	"System Tray access to DAEMON Tools Pro from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
N	DAEMON Tools Pro Agent	DTProAgent.exe	"System Tray access to an older version of DAEMON Tools Pro from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
N	DAEMON Tools Pro Agent	DTAgent.exe	"System Tray access to DAEMON Tools Pro from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
N	DAEMON Tools-1033	daemon.exe	"Older version of Daemon Tools Lite from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
N	Daily Planner	dayplan.exe	"Daily Planner - discontinued
X	DanBtR270414	DanBtR270414.exe	"Added by the VB-NIB WORM!"
U	Dancer	DncLE.exe	"Part of Microsoft Plus! Digital Media Edition - see here"
X	Danton*	[random filename]	"Added by the DANTON TROJAN! where * = random number"
X	DarKNesS LsasS	LsasS23.exe	Added by an unidentified WORM or TROJAN!
?	DashIE	N/A	"Could be related to "Dash Power Shopping" tool bar in IE?"
X	data	msngs.exe	"Added by the RBOT-ADQ WORM!"
N	Data LifeGuard LifeLine Lite installer	DLGLI.EXE	"Backweb installer - see here"
X	Data Protection	datprot.exe	"Data Protection rogue security software - not recommended
N	DataCaching	FlashKsk.exe	"SmartMedia Card management from the installation of a SanDisk reader for a camera's SmartMedia card and also adds the "Unplug and Eject Hardware" System Tray icon"
N	DataViz Inc Messenger	DvzIncMsgr.exe	"Installed with DataViz ""Documents to Go"" software"
N	DataViz Messenger	DvzMsgr.exe	"DataViz Documents to Go - "allows you to use your Word
X	Date Manager	datemanager.exe	"Date Manager - calender program. Spyware/adware based provided by The Gator Corporation. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
?	Datechecker	N/A	"Could be related to this?"
X	DateMakerIntl	DateMakerIntl.exe	Premium rate adult content dialler
X	DateMngr	DATEMNGR.EXE	"Added by the SPYBOT-BR BACKDOOR!"
U	DAZEL Delivery Agent	DcDaemon.exe	"Control and send documents
U	DC300 Monitor	cmonitor.exe	Monitor for a Acer DC300 digital camera
X	DC6	dc6_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	DC6_check	dc6_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	dc6_check	dcmon.exe	"SystemDoctor rogue security software - not recommended
X	DCE Manager	dcemgr.exe	"Added by the TUMAG TROJAN!"
X	DCOM Server	[path to trojan]	"Added by the AGENT-CCQ BACKDOOR!"
N	DDCActiveMenu	DDCActiveMenu.exe	Digital Distribution Channel - formally part of the WildTangent on-line games delivery service. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
N	DDCM	DDCMan.exe	Digital Distribution Channel - formally part of the WildTangent on-line games delivery service. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
N	DDCMan	DDCMan.exe	Digital Distribution Channel - formally part of the WildTangent on-line games delivery service. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
X	ddivmwa	[random filename]	"Added by a variant of the SLAPER TROJAN!"
U	DDLAgent	DDLAgent.exe	"Loads Hide and Protect any Drives - which ""can be used to restrict read or write access to removable media devices such as CD
X	DDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
?	DDT	N/A	"??"
U	DDWMon	ddwmon.exe	"Direct Disc Writer Event Monitor from TOSHIBA"
X	de32gen	de32gen.exe	"Added by a variant of the CRYPTER.C TROJAN!"
N	DeadAIM	"rundll32.exe DeadAIM.ocm	ExportedCheckODLs"
X	DealHelperDown	download.exe	"DealHelper adware"
X	DebugMonitor	debugmonitor.exe	"Added by the MYDOOM.BG WORM!"
U	DeeEnEs	DeeEnEs.exe	"DeeEnEs - automatically updates a dynamic IP address when it changes"
X	Deewoo	ncntnkwd.exe	Identified as a variant of the AdWare.Win32.ZenoSearch.am malware
U	Default Manager	DefMgr.exe	"Part of MSN Toolbar from version 4.* onwards (renamed ""Bing Bar"" from version 5.* onwards) which includes the Bing search engine. Via Start → All Programs → Microsoft Default Manager you can elect to keep Bing as the default search engine and set it to notify you of any changes to your browsers default settings. Not required if you choose not to use Bing"
X	DefaultConfiguration	defaultconfh.exe	"Added by the AGOBOT-JC WORM!"
X	Default_Page_URL	http://find.naupoint.com	"Naupoint browser hijacker"
X	Default_Search_URL	http://find.naupoint.com	"Naupoint browser hijacker"
X	DefendAPc	DefendAPc.exe	"DefendAPc rogue security software - not recommended
X	defender	defender25.exe	"DollarRevenue adware"
X	defender	dfndref_7.exe	"DollarRevenue adware"
X	defender	[path to trojan]	"Added by the VB-BAQ TROJAN!"
X	DefensaAntiMalware	pgs.exe	"DefensaAntiMalware
X	Defense Center	defcnt.exe	"Defense Center rogue security software - not recommended
X	DefenseNetSurfage	GDC.exe	"DefenseNetSurfage rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	defragm_check	defragment.exe	"CoolWebSearch parasite variant"
U	Delay	delayrun.exe	On HP PCs this program is used to help prevent conflicts or timing issues on fast computers
X	DelayLoad	msprint.exe	"Added by a variant of the Win32.Agent.ryo malware - see here"
U	Delayrun	delayrun.exe	On HP PCs this program is used to help prevent conflicts or timing issues on fast computers
U	Dell AIO Printer A920	dlbkbmgr.exe	System Tray application for the Dell Photo AIO Printer 920 that enables scan or fax functions to run directly from the printer via the buttons
U	Dell AIO Printer A940	dlbabmgr.exe	System Tray application for the Dell Photo AIO Printer 940 that enables scan or fax functions to run directly from the printer via the buttons
U	Dell AIO Printer A960	dlbfbmgr.exe	System Tray application for the Dell Photo AIO Printer 960 that enables scan or fax functions to run directly from the printer via the buttons
N	Dell Alert	DAMon.exe	""Dell Alert" utility
U	Dell DataSafe Scheduler	DataSafeOnlineScheduler.exe	"Scheduler for Dell DataSafe™ Online which ""helps protect your music
U	Dell PanelMgr	SSMMgr.exe	"Monitors ink levels
U	Dell Photo AIO Printer 922	dlbtbmgr.exe	System Tray application for the Dell Photo AIO Printer 922 that enables scan or fax functions to run directly from the printer via the buttons
U	Dell Photo AIO Printer 942	dlbubmgr.exe	System Tray application for the Dell Photo AIO Printer 942 that enables scan or fax functions to run directly from the printer via the buttons
U	Dell Photo AIO Printer 962	dlbxmon.exe	DellPhoto AIO Printer 962 Device Monitor
Y	Dell Webcam Central	WebcamDell.exe	"Dell Webcam Central - webcam management software controlling aspects such as picture control
N	DELL Webcam Manager	DellWMgr.exe	Dell Webcam Manager - Webcam management software provided on Dell PCs
N	Dell Wireless Manager UI	wltray.exe	System tray access to wireless LAN card configuration options
Y	DellAutomatedPCTuneUp	PTAgnt.exe	"PC TuneUp from Dell - ""silently monitors your system
U	DellSupport	DSAgnt.exe	Dell Support Agent offers additional support and update features for your Dell computer or laptop
U	DellSupportCenter	sprtcmd.exe /P DellSupportCenter	"Dell Support Center (provided by SupportSoft
?	DellTransferAgent	TransferAgent.exe	"Found on Dell computers. What does it do and is it required?"
X	delsubmit	"rundll32.exe advpack.dll	DelNodeRunDLL32 submit.exe"
X	DeluxeCommunications	Dxc.exe	"Deluxe Communications adware - successor to SurfSideKick"
?	demon	demon.exe	"Part of the French Wanadoo ADSL extense pack. What does it do and is it required?"
X	Deneca	Virus salvado	"Added by the DELUZ VIRUS!"
X	DescargaBromas	"rundll32.exe MSA64CHK.dll	DllMostrar"
?	Description of Shortcuts	*.exe	"* seems to be a sequence of alphanumerics that can be different
X	Desktop	"rundll32.exe msconfd.dll	Restore ControlPanel"
X	desktop	desktop.ini.vbs	"IE-Title malware"
U	Desktop Calendar	Desktop Calendar.exe	"Desktop Calendar - ""Desktop Calendar is a highly customizable calendar program that turns your desktop into a traditional wall calendar
X	Desktop Defender 2010	Desktop Defender 2010.exe	"Desktop Defender 2010 rogue security software - not recommended
U	Desktop iCalendar	Calendar.exe	"Older version of Desktop iCalendar/Desktop iCalendar Lite by Desksware which include support for Google Calendar and add weather
U	Desktop iCalendar	Desktop iCalendar Lite.exe	"Desktop iCalendar Lite by Desksware - ""is a free desktop calendar for Windows. It allows you to manage your events
U	Desktop iCalendar	Desktop iCalendar.exe	"Desktop iCalendar by Desksware - ""is a handy desktop calendar for Windows. It stays on your desktop and shows the days of the current month. It can sync with your Google Calendar
U	Desktop iCalendar Lite	Desktop iCalendar Lite.exe	"Desktop iCalendar Lite by Desksware - ""is a free desktop calendar for Windows. It allows you to manage your events
U	Desktop iCalendar Lite.exe	Desktop iCalendar Lite.exe	"Desktop iCalendar Lite by Desksware - ""is a free desktop calendar for Windows. It allows you to manage your events
U	Desktop iCalendar.exe	Desktop iCalendar.exe	"Desktop iCalendar by Desksware - ""is a handy desktop calendar for Windows. It stays on your desktop and shows the days of the current month. It can sync with your Google Calendar
N	Desktop Plant	AZARE10S.PLT	"Vritual plant from here - this version is an Azalea
N	Desktop Service Centre	DSC.exe	OptusNet DSL or Dial-Up connection software
N	Desktop Weather	THE WEATHER CHANNEL.exe	"Desktop Weather by The Weather Channel - provides current temperature
N	Desktop Weather 3	THE WEATHER CHANNEL.exe	"Desktop Weather 3 by The Weather Channel - provides current temperature
U	DesktopIconToy	DesktopIconToy.exe	"""Desktop Icon Toy is an easy to use desktop icon enhancement tool
X	DesktopUpdate	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Deus Cleaner	DCleaner.exe	"Deus Cleaner rogue system cleaner utility - not recommended"
?	DevconDefaultDB	READREG	"Appears to be related to older Creative Soundblaster soundcards"
X	Development Environment	devenv.exe	"Added by the DELBOT-AH WORM!"
U	DEventAgent	eventagt.exe	DEvent Agent Module client - part of Dell OpenManage and used for server management. Only required if you use this
X	devenv	smvss.exe	"Added by the DEDLER-G TROJAN!"
X	Device Configuration Loader	msdvc32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Device Hardware	devicehnd.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Device Management	wnsystem.exe	"Added by the AGOBOT-LH WORM!"
X	Device Manager	wfxmgr.exe	"Added by the RBOT.AJU WORM!"
X	Device Security Manager	dvcsecure.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Devicewin	[path to trojan]	"Added by the BANKER-AEV TROJAN!"
X	dfgfdgrergd	[path to trojan]	"Added by the RANKY.CK TROJAN!"
Y	dhcpagnt	dhcpagnt.exe	Intel DSL modem driver - leave enabled or you'll have to re-install the drivers
?	DHNUXB	DHNUXB.exe	"??"
N	diagent	diagent.exe	System Tray access for Creative Diagnostics for the Creative SoundBlaster series soundcards. Available via Start -> Programs
X	Diagnostic	diagnostic.exe	"Added by the ALPHA-C TROJAN!"
X	Diagnostic Agent	diagent.exe	"Added by the AGOBOT-CW WORM!"
X	Dialer	"rundll32.exe MSA32CHK.dll	Reg"
U	Dialer Control	dc.exe	"Dialer-Control. Detects and protects from premium rate adult content diallers"
U	Dialgo SDK	PhoneAnswer.exe	"Dialgo Wave Modem ActiveX - ""Telephone Answering Machine for scripting your own professional call center business scripts using a voice modem. Features Caller-ID
X	DialNet	mxt32.exe	Adult content dialler
N	Dialog Box Assistant	OSDEx.exe	"Dialog Box Assistant from Duality Software. Helps with the standard Open and Save As dialog boxes by showing recently used files and folders"
X	DialUp Network Application	Rnaap.exe	"Added by a variant of the SDBOT WORM!"
U	Diamondback	razerhid.exe	"Razer Diamondback 3G gaming mouse driver - required if you use the additional features and programmed keys/macros"
?	Diamondview	Diamondview.exe	"Manulife Financial Insurance program. Is it required at startup?"
X	DigiD	DigitalSound.exe	Adware downloader
N	DigiGuide	CLIENT.EXE	TV guide and reminder
N	DigiGuide	client01.exe	TV guide and reminder
U	Digisoft AntiDialer	AntiDialer.exe	"Digisoft AntiDialer"
N	Digital Line Detect	DLG.exe	Detects whether your are plugged into a digital telephone line and displays the information graphically. Installed by Dell (and maybe others) and is included with all Connexant V.92 and Broadcom modems
X	Digital Protection	digprot.exe	"Digital Protection rogue security software - not recommended
N	Digital River eBot	downlo~1.exe	"Digital River Systems EBOT for downloading software from their site. In some cases
X	DigitalNames	DigitalNamesStart.exe	"DigitalNames spyware variant"
N	DigitalWizard Monitor	dwMon.exe	"InstallShield's DigitalWizard - free
U	Dimension	Dimension.exe	"Dimension - a program which lets you customize MSN messenger such as adding animated and coloured nicknames
U	Dimension4	d4.exe	"Dimension 4 - network time synchronization freeware - starts-up
X	Dino3	dino3.exe	Related to Jurassic Park III and enables a dinosaur to walk across the screen. Also generates adverts and classified as adware as a result
X	Dinst	dinst.exe	"IMIServer/IEPlugin adware"
X	Direct settings	sdchost.exe	"Added by the DAEMONI-I TROJAN!"
U	Direct Update	DUControl.exe	"DirectUpdate dynamic DNS updater"
X	Direct X Opengl	dxopengl.exe	"Added by a variant of the RBOT-CJ WORM!"
X	Director Video	btnmgern.exe	"Added by the MYTOB-KL WORM!"
X	directx	NTCmd.exe	"Added by the SDBOT.D TROJAN!"
X	DirectX For Microsoft Windows	dtxservice.exe	"Added by the PROGENT TROJAN!"
X	DirectX for Microsoft Windows	Fservice.exe	"Added by the PRORAT TROJAN!"
X	DirectX for Microsoft Windows	Sservice.exe	"Added by the PRORAT TROJAN!"
X	DirectX For Microsoft® Windows	fservice.exe	"Added by the PRORAT-P TROJAN!"
X	DirectX For Microsoft® Windows	fservice.exe	"Added by the PRORAT-L TROJAN!"
X	DirectX shell driver	[path to trojan]	"Added by the MARKTMAN-B TROJAN!"
?	Disable EHCI	nousb20.exe	"??"
X	DisableKeybaord	"Rundll32.exe Keyboard	Disable"
X	DisableMouse	"Rundll32.exe Mouse	Disable"
N	Disc Detector	CtNotify.exe	"For Creative sound cards. Detects when you insert a CD
?	disc detector	qnetquestnotifty.exe	"??"
U	DiscUpdateManager	DiscUpdMgr.exe	"Disc Update Manager for Digital interactive's DISCover Console. Provider of on-demand video games"
N	DiscUpdateManager	DiscUpdateMgr.exe	"DISCover from Digital Interactive Systems Corporation Inc. ""The company's patented Drop 'n' Play technology provides a simple
U	DiscWizardMonitor.exe	DiscWizardMonitor.exe	"Seagate DiscWizard - hard disk utility for Seagate's SATA and PATA (IDE) drives"
U	Disk Cleaner	DiskCleaner.Exe	"Hard disk management part of TuneUp Utilities from TuneUp Distribution GmbH"
X	Disk Defragmentation Loader	pmsvcr.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Disk Essensial Tools	detsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Disk Keeper	[path to trojan]	"Added by the SMALL-VE TROJAN!"
X	Disk Manager	diskver.exe	"Added by the RBOT.AQT WORM!"
X	Disk Master	[trojan name]	"Added by the DISTER TROJAN! - a spam relayer"
X	Disk Panel Configuration	dpcsvc.exe	"Added by the IRCBOT.BSQ BACKDOOR!"
X	Disk Panel Setup	npcsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	DiskCheck	msdarkend.exe	Added by an unidentified WORM or TROJAN!
N	DiskeeperSystray	DkIcon.exe	"DisKeeper defragmentation software - can be started manually"
X	diskinf	diskinf.exe	"Added by the CRYPTER.A TROJAN!"
?	DISKMON.EXE	DISKMON.EXE	"??"
N	Disknag	disknag.exe	Dell program that reminds you to make your backup diskettes
X	Diskstart	Snt.exe	Adult content dialler
U	DiskSuite	aDSProcMngr.exe	"Part of PC Tools Disk Suite from PC Tools - which ""is an all-in-one hard-disk management utility that integrates disk optimization
U	Disk_Monitor	Disk_Monitor.exe	"Multi-media
X	disnisa	disnisa.exe	"Added by the DORF-AE WORM!"
X	dispenter	dispenter.exe	"Added by the AGENT-MKK TROJAN!"
N	Display Settings	hptasks.exe	"Allows for the adjustment of the display for LCD screen
U	DisplayFusion	DisplayFusion.exe	"DisplayFusion from Binary Fortress Software - ""is a fantastic application that can make your dual monitor (or triple monitor or more) life much
N	DisplayTrayIcon	TrayIcon.exe	"System Tray access to display properties for ABIT graphics cards. Unless you change your desktop resolution
X	Dist-FBGeneve	GDC.exe	"NettoyeurDePC French rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
N	Distiller Assistant 3.01	DISTASST.EXE	From Adobe. Creates PDF universal files for Acrobat Reader. Available via Start -> Programs
X	Distributed File System	kernel32dll.exe	"Added by the MYFIP-C or MYFIP.K WORMS!"
X	Distributed File System	win.exe	"Added by the MYFIP.AB WORM!"
X	Distributed Link Tracking	ascvt.exe	"Added by the AGOBOT-GH BACKDOOR!"
U	distributed.net client	DNETC.EXE	"Dsitributed computing projects client from Distributed.net where numerous computers are used to share a projects workload - similar to SETI@Home and Folding@Home. Also prone to being distributed by viruses"
?	Divamon.exe	Divamon.exe	"Associated with an Eicon Networks Diva ISDN or ADSL modem - what does it do and is it required?"
X	divx	divxenc.exe	"Added by the SPBOT.B TROJAN!"
X	DivXCodec	NEWMAIL.exe	"Added by the DELF-RQ BACKDOOR!"
?	Dixons Insert Detect	InsDetect.exe	"Part of Dixons Picture Suite. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
?	DJSNetCN	DJSNetCN.exe	"""Symantec Licensing Detect Internet Connection""
X	dKernel	dKernel.exe	"Added by the DECOY-A WORM!"
Y	DLBTCATS	"rundll32 [path] DLBTtime.dll	_RunDLLEntry@16"
Y	DLBUCATS	"rundll32 [path] DLBUtime.dll	_RunDLLEntry@16"
Y	DLBXCATS	"rundll32 [path] DLBXtime.dll	_RunDLLEntry@16"
Y	DLCCCATS	"rundll32 [path] DLCCtime.dll	_RunDLLEntry@16"
U	dlccmon.exe	dlccmon.exe	Dell Photo AIO Printer 924 device monitor
Y	DLCDCATS	"rundll32 [path] DLCDtime.dll	_RunDLLEntry@16"
U	dlcdmon.exe	dlcdmon.exe	Dell Photo AIO Printer 944 device monitor
Y	DLCFCATS	"rundll32 [path] DLCFtime.dll	_RunDLLEntry@16"
Y	DLCGCATS	"rundll32 [path] DLCGtime.dll	_RunDLLEntry@16"
U	dlcgmon.exe	dlcgmon.exe	Dell Photo AIO Printer 810 device monitor
Y	DLCICATS	"rundll32 [path] DLCItime.dll	_RunDLLEntry@16"
Y	DLCJCATS	"rundll32 [path] DLCJtime.dll	_RunDLLEntry@16"
U	dlcjmon.exe	dlcjmon.exe	Dell Photo AIO Printer 964 device monitor
Y	DLCQCATS	"rundll32 [path] DLCQtime.dll	_RunDLLEntry@16"
U	dlcqmon.exe	dlcqmon.exe	Dell Photo AIO Printer 966 device monitor
Y	DLCXCATS	"rundll32 [path] DLCXtime.dll	_RunDLLEntry@16"
U	dlcxmon.exe	dlcxmon.exe	Dell Photo AIO Printer 926 device monitor
U	dldtamon	dldtamon.exe	Dell AIO Printer V305 device monitor
U	dldtmon	dldtmon.exe	Dell AIO Printer V305 device monitor
U	dldtmon.exe	dldtmon.exe	Dell AIO Printer V305 device monitor
X	DLHelperEXE.exe	N/A	Downloader for Microgaming/Casino software - stealth installed
X	DLINK dfe drivers for Windows NT	windfe.exe	"Added by the RANDEX.AK WORM!"
U	DLink System Tray	dlnetst.exe	"Related to D-Link DGE-530T PCI card for servers and workstations"
X	Dlite	dllmanager.exe	"Added by the WOOTBOT.DN WORM!"
X	Dll Boot Loader on Startup (do not remove this)	[various filenames]	Added by an unidentified TROJAN!
X	Dll Link	svchoist.exe	"Added by the AUTOSKY WORM!"
X	Dll Link	svchost.exe	"Added by the AUTOSKY WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Favourites folder"
X	DLL Manager	dllmngr32.exe	"Added by a variant of the RBOT WORM!"
X	DLL Service Manager	[path to worm]	"Added by the RPCBOT.F TROJAN!"
X	dll services	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	dllcvss	[random filename]	"Added by a variant of the SLAPER TROJAN!"
N	dlmMgr	AdobeDownloadManager.exe	"Adobe Download Manager - ""can prevent you from having to start from the beginning should your download process be interrupted
Y	DLO Agent	DLOClientu.exe	"Part of the backup suites from VERITAS - Backup Exec and NetBackup. Both have now been replaced by their Symantec equivalents since they acquired VERITAS in 2005"
X	Dm Hr	lpns.exe	"Added by the IRCBOT.WORM.61673 WORM!"
X	dm***.exe [* = random char]	dm***.exe [* = random char]	"Wareout - malware masquerading as a spyware and dialer remover"
U	DmwClient	dmwclient.exe	"DMW ""anti-cheating"" software for online gaming"
U	DMXLauncher	DMXLauncher.exe	"Part of Dell's Media Experience
X	dm[3 random letters].exe	dm[3 random letters].exe	"Added by the RUINDEM TROJAN!"
N	DNA	btdna.exe	"""BitTorrent DNA is a FREE content delivery service based on the BitTorrent protocol which brings the power of user-contributed bandwidth to traditional content publishers while leaving publishers in full control of their files"". Now a stand-alone product where the user creates the download
X	dnam	d140113.a.Stub.EXE	"Added by the STUB_A TROJAN!"
N	Dnar	Dnar.exe	"Installed on some Dell workstations and DMI related. Tries to access the internet and is known to not be required - but what does it do?"
Y	DNE Binding Watchdog	"rundll dnes.dll	DnDneCheckBindings"
Y	DNE DUN Watchdog	"rundll dnes.dll	DnDneCheckDUN13"
X	DNHelper32	DNHlp32.exe	Added by an unidentified WORM or TROJAN!
X	DNS	mc-58-12-0000080.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-58-12-0000093.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-110-12-0000079.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-58-12-0000120.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-58-12-0000140.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	[worm filename]	"Added by the BCKDR-CQG BACKDOOR!"
X	DNS Config service	win32.exe	"Added by the RBOT-TL WORM!"
X	Dns Resolver	dnsrslve.exe	"Added by the RBOT-WS WORM!"
X	DNS Service	dnsresolver.exe	"Added by the RBOT-PQ WORM!"
X	DNS Service	dnssvc.exe	"Added by the DELBOT-Z WORM!"
?	DNS2GoClient	dns2goclient.exe	"DNS2Go is a Domain Name System that will make your computer accessible anytime
N	DNS7reminder	Ereg.exe Ereg.ini	"Registration reminder for versions of Nuance (ScanSoft) Dragon NaturallySpeaking"
X	DnsCache	Wscript.exe dns_cache.vbs	"Added by the AUTORUN-AWI WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""dns_cache.vbs"" file is located in %System%"
X	DNSCacheBoost	dnsping.exe	"Added by the DNSBUST-A TROJAN!"
X	dnscleaner	dnscleaner.exe	"CoolWebSearch parasite variant"
X	DNSE	DNSE.exe	"Part of rogue security tools
?	DNXVC	dnxvc.exe	"??"
X	Doctor Antivirus 2008	antvr.exe	"Doctor Antivirus 2008 rogue security software - not recommended
N	DocuMagix Init	PWATCH.EXE	"PaperMaster is an application for the PC designed to automate the process of organizing
U	Document Manager	docmgr.exe	"Wave Systems Corp. Document Manager - ""provides secure storage and management capabilities for file and folder level encryption"""
?	Doing	doing.exe	"??"
X	Domain Name Resolve Service	dnsresolver.exe	"Added by the KIMAN.A WORM!"
U	Don't Panic	dontpanicdemodp.exe	"30-day trial version of Don't Panic privacy software from Panicware. "Clean up Internet tracks and quickly hide personal documents with this privacy suite.""
U	Don't Panic Pop-Up Stopper	dpps2.exe	"Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group"
U	Don't Panic!	DP.EXE	"Don't Panic! privacy software from Panicware. ""Clean up Internet tracks and quickly hide personal documents with this privacy suite"""
X	Dontworry	mysaym.exe	"Added by the SDBOT-RC WORM!"
X	Dos Prompt Loader	cygwin.exe	"Added by the SDBOT-VV WORM!"
N	DoUWantIt	duwi.exe	DoUWantIt - online shopping assistant. Start it manually
X	Dowmingzu	Dowmingzu.dll.vbs	"Added by the SOLOW-E WORM!"
X	down	hlp32.exe	"Added by the DLOADER.BG TROJAN!"
X	down	[trojan filename]	"Added by the SMALL-QJ TROJAN!"
U	Down2Home	Down2Home.exe	"Down2Home - ""monitors your ADSL/Cablemodem/Dialup traffic and provides you with usefull statistics about the amount of data your PC has transferred"""
N	Download Accelerator Manager Free Edition	dam.exe	"Download Accelerator Manager Free Edition from Tensons Corp"
N	Download Accelerator Plus 5.0	DAP.exe	"Download Accelerator Plus from Speedbit. Download manager for resuming downloads
X	Download Plus	DownloadPlus.exe	"DownloadPlus adware"
N	Download Wonder	DownloadWonder.exe	"Download Wonder from Forty Software. Download manager for resuming downloads
N	DownloadAccelerator	DAP.EXE	"Download Accelerator Plus from Speedbit. Download manager for resuming downloads
X	DownloadLegalMusic	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	DownloadMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	DownloadsAndMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	DownloadWare	dw.exe	"DownloadWare adware"
X	DownloadWare Engine	Dwe.exe	"DownloadWare adware"
X	downs	downs.exe	"Added by the BCKDR-MNR TROJAN!"
X	Downxz	Downxz.bat	"Added by the MYDOOM.W WORM"
Y	DpAgent	dpagent.exe	"Part of the DigitalPersona range of fingerprint authentication applications - which are use to replace passwords with fingerprint recognition. Included on some Dell laptop models (such as the Vostro 1720) for example"
N	DPAgnt	DPAgnt.exe	"digitalPersona fingerprint scanner"
Y	DPAS	DPASNT.exe	"DefenderPro AntiSpy spyware remover - now incorporated Defender Pro 15-in-1 and 5-in-1"
Y	Dpcnav	dpcnav.exe	"DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access"
N	DPConfig	DPConfig.exe	"Compuware DevPartner Studio Configuration Utility
Y	DPCProxyLoadOnStartup	dpcstart.exe	"DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access"
X	dpnsvr32	dpnsvr32.exe	"Added by the AOLPASS-B TROJAN!"
X	dpzProtect	n.vbe	"Added by the RUNAUTO.H WORM!"
N	Drag'n'Drop_Autolaunch	Autolaunch.exe	"Iomega HotBurn - CD-RW burning software"
N	DragnDrop_Autolaunch	Autolaunch.exe	"Iomega HotBurn - CD-RW burning software"
X	DRam Monitor 23	tskman3.exe	"Added by a variant of the RBOT WORM!"
X	DRam prmaessor	[random filename]	"Added by the RBOT.CSG WORM!"
X	DRam prosesor	[random filename]	"Added by the SPYBOT.EE WORM!"
X	DRam prosessor	[random filename]	"Added by the RBOT.CSG WORM!"
X	DRam prosessor	WindowsUpdate.exe	"Added by the RBOT-BBZ WORM!"
X	DRam prosessor	winupl.exe	"Added by the RBOT-BCQ WORM!"
X	DRam rar proc	winupdaterar.exe	"Added by a variant of the IRCBOT TROJAN!"
X	DRam rare proc	updaterarwin.exe	"Added by the RBOT-GQW WORM!"
X	DRan posessor	DAP.exe	"Added by a variant of the SDBOT WORM!"
X	DrAntispy	DrAntispy.exe	"DrAntiSpy rogue security software - not recommended"
?	dregfix	ph_finder.exe	"??"
X	drin	[path to trojan]	"Added by the SMALL.DPB TROJAN!"
X	DriveCleaner 2006 Free	UDC2006.exe	"DriveCleaner rogue security software - not recommended
X	DriveCleaner Free	UDC.exe	"DriveCleaner rogue security software - not recommended
X	DriveDefender	GDC.exe	"DriveDefender rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
U	DriveIcons	DriveIcon.exe	"Drive Icons from Realtek - shows a specific icon for each card type for their card reader controllers"
X	DriverConf	dvrconf.exe	"Added by the AGOBOT-IY WORM!"
U	DriverMagicLogon	dmschedule.exe	"Part of DriverMagic - ""the easiest way to locate device drivers"""
X	DriverModule	csrnvrt.exe	"Added by the IRCBOT.I TROJAN!"
X	Drivers for Internet Explorer	accesweb.exe	"Added by the STARTPAGE.FW TROJAN!"
X	DriveSystem	maxpaynowti1.exe	"Added by the TIBS.AZT TROJAN!"
U	drkly16j	"rundll32.exe drkly16j.dll	ServiceCheck"
U	dRMON SmartAgent	SmartAgt.exe	"Part of the network monitoring program group for 3Com NIC cards. See here for more info"
X	DrProtection	DrProtection.exe	"DrProtection rogue security software - not recommended"
U	DrvIcon	DrvIcon.exe	"""Vista Drive Icon changes the drive icons shown in Windows ""My Computer""
?	DrvListnr	DrvListnr.exe	"Analog Devices SoundMAX soundcard related. What does it do and is it required?"
U	drvlsnr	drvlsnr.exe	Compaq/ADI SoundMAX integrated digital audio controller related. May solve a problem if your sound cuts out unexpectedly
U	DrvMon.exe	DrvMon.exe	"Alcor drive monitor software"
X	drvnetw	drvnetw.exe	"Added by the BROGGER-B TROJAN!"
X	drvrmanager	drvrquery32.exe	"Added by the BOOHOO WORM!"
X	drvupd	rundll32 ..drvupd.inf	"Hijacker - drvupd.inf file installs a ""searchforge.com"" hijack"
X	drv_st_key	hidn.exe	"Added by the BEAGLE.FF WORM!"
X	DrWatson	drwatson_.exe	"Added by the LOHAV-S TROJAN!"
X	DrWatson	drwatson_32.exe	"Added by the LOHAV-S TROJAN!"
X	DrWeb Antivirus	DRWEBAV.EXE	Added by an unidentified WORM or TROJAN!
N	DSentry	DSentry.exe	"Anti-spyware from Dell. Seems that after Dell found out certain applications being installed from DVD's would report back information about what customers were watching
X	DSKEY	[path to trojan]	"Added by the STARTER-G TROJAN!"
N	DSL Monitor	spdstrm.exe	Comes with Efficient Networks DSL Modems. Little red/green/yellow flashing icon in system tray
Y	DSLagentexe	DSLagent.exe	"Used in conjunction with USB connected ADSL modems from Eicon Networks (as used by BT for its Broadband internet service for example). Required for a permanent ADSL connection"
Y	dslmon	dslmon.exe	Sagem DSL modem related. Apparently needed to detect the modem
Y	DSndUp	DSndUp.exe	"Utility that only runs once after installing the drivers for Analog Devices SoundMax integrated soundcards. It's exact purpose is unknown at the present time but from the filename it's probably used to configure the default or generic speaker arrangement for the system it's used on"
X	DsplObjects	windspl.exe	"Added by the BEAGLE.DN WORM!"
X	DSS	dssagent.exe	"Registration reminder for Mattel Interactive (Broderbund) applications and games. Spyware as it sends encrypted emails about the system back to the originators of the program. Also a resource hog. See here for more info"
X	DSS	[path to trojan]	"Added by the DSSDOOR-C TROJAN!"
?	DSSSGENS	dssagens.exe	"??"
X	DSystemDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
U	DT 11Mbps WLAN PC Card Station	DTCARDMonitor.exe	11Mbps PC Card based wireless LAN connection monitor - possibly from Deutsche Telekom
U	DT 11Mbps WLAN USB Station	DTUSBMonitor.exe	11Mbps USB based wireless LAN connection monitor - possibly from Deutsche Telekom
N	DTAgent	DTAgent.exe	"System Tray access to DAEMON Tools Pro from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
U	DualCoreCenter	StartUpDualCoreCenter.exe	"Unified control center for overclocking both the graphics card and the CPU
?	Duane Reade Insert Detect	InsDetect.exe	"Part of Duane Read Picture Suite & Digital Image Pack. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
X	DUN_SERVICES3	dun3.exe	"Added by the SOKIRON TROJAN!"
X	Duwee wong Cerbon	Cirebons.exe	"Added by the BHARAT.A WORM!"
U	DVD Device Lock for Win95/98/Me/2k/XP	DDLAgent.exe	"Loads Hide and Protect any Drives - which ""can be used to restrict read or write access to removable media devices such as CD
X	dvd98	windvd98.exe	"Added by the CULT.P WORM!"
?	DVDAgent	DVDAgent.exe	"Found on the HP Touchsmart range of desktops and notebooks. What does it do and is it required?"
N	DVDLauncher	DVDLauncher.exe	"Part of Cyberlink's Power Cinema - allows you to play DVDs upon insertion"
N	DVDSentry	DSentry.exe	"Anti-spyware from Dell. Seems that after Dell found out certain applications being installed from DVD's would report back information about what customers were watching
U	dvHighMem	cfgmng32.exe	"Related to PureSight PC - designed to offer maximum flexibility and choice as families manage their internet use"
Y	DvpInitExe	Dvpinit.exe	"Command Antivirus related"
U	DVSync	dvsync.exe	DVSync is the program that allows you to synchronize your daVinci's PDA's data with your Personal Information Manager on the PC
U	DWHeartbeatMonitor	DWHeartbeatMonitor.exe	DWHeartbeatMonitor.exe is installed alongside the Weather.com instant messaging utility. This is a non-essential process. Disabling or enabling this is down to user preference
N	DwlClient	support.exe	Download manager for Dell support alerts
X	dwqblwppx.exe	[random].exe	"Okcashbackmall adware"
X	dwqblwpvl.exe	[random].exe	"Okcashbackmall adware"
X	dwqblwrsq.exe	[random].exe	"Okcashbackmall adware"
U	DWQueuedReporting	dwtrig20.exe	"Used to launch Microsoft Error Reporting (DW20.exe) - if
X	DW_Start	rwwnw64d.exe	Identified as a variant of the AdWare.Win32.ZenoSearch.am malware
X	Dx	sys*.exe [* = random number]	"Added by the DEXTER.A WORM!"
X	dxdiag diagnose	msidxdia.exe	"Added by a variant of the RBOT WORM!"
X	dxdll32	ntxdll.exe	"Added by the GAOBOT.CPX WORM!"
X	DxLoad	DX3DRndr.exe	"Added by the GIBE.B WORM!"
X	Dynamic DHCP	dydhcp.exe	"Added by the RINBOT.B TROJAN!"
X	Dynamic Dns Binary	dynitora.exe	"Added by the RBOT-WT WORM!"
X	Dynamic Dns Binary	CMD16.EXE	"Added by the RBOT-XM WORM!"
X	Dynamic Dns Binary	winxp34.exe	"Added by a variant of the RBOT WORM!"
X	Dynamic Dns Binary	WinHelpcfn.exe	"Added by a variant of the RBOT WORM!"
X	Dynamic Link Library loader	Loader32.exe	"Added by the KOL TROJAN!"
U	DynDNS Updater	DynDNS.exe	"Dynamic DNS IP address updater tool
N	DynDNS-Updater Traytool	ddutray.exe	"DynDNS updater tray icon - allows easy configuration of the Dynamic DNSSM service. Can be run manually"
X	DynHttp Dns Binary	dynizari.exe	"Added by a variant of the RBOT WORM!"
U	DynSite	DynSite.exe	"DynSite - dynamic DNS client
U	Dynu Basic Client	dynubas.exe	"Dynu online dynamic IP update client. Useful when using a dial up modem"
U	E-color	IconMgr.Exe	Sets the colour of your monitor when running games that recognise E-Color so that you get 'what the game designer intended' when you see the game. Also allows monitor callibration through a program called 3-Deep. If you play a lot of games it can be useful. Can be disabled from starting up from within the program
N	E-Color Registration	SonnReg.exe	"Registration for Colorific® and 3Deep® monitor calibration sofware from E-Color. Now superseded by ColorWizzard™ and 3DxWizzard™"
X	E-nrgyPlus	E-nrgyPlus.exe	"Energyplus - tracks internet activity including websites visited and queries made at popular search engines. This information along with some system information is sent to a remote site"
U	e-Surveiller Station	estation.exe	"ESurveiller - surveillance software. Uninstall this software unless you put it there yourself"
N	E6TaskPanel	TaskPanl.exe	"Earthlink Task Panel - part of Earthlink TotalAccess 2003 internet access software. Quick access to internet
U	eabconfg.cpl	EabServr.exe	Easy Access Buttons control panel on Compaq laptops. Only required if you use the extra keys
X	Eac Download	download.exe	"Webcelerator from eAcceleration speeds your Web browsing by both remembering where you have been and anticipating where you will go. Only needed if you find it improves web browsing. Now no longer available and supported and when available was classed as spyware - see here"
U	EACLEAN	eaclean.exe	"For Compaq PC's. Easy Access button support for the keyboard"
X	Eac_Cnry	canary.exe	"Added by the CANARY TROJAN!"
?	Eac_rnvdl	ANTIVIRUS_INSTALL.EXE	"??"
U	EanthologyApp	EANTHO~1.EXE	"eAcceleration Stop-Sign security software related. Previously not recommended
U	EanthologyApp	eanthology.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
U	eanthology_install.exe	eanthology_install.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
U	eanth_critical_update_alert	sys_alert.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
U	eanth_critical_update_alert	EANTHO~1.EXE	"eAcceleration Stop-Sign security software related - previously not recommended (see here). It has now been delisted
U	eanth_system_patcher	sys_alert.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
Y	Earthlink Protection Control Center	elnk_pcc.exe	"EarthLink Protection Control Center - ""powerful
N	EarthLink ToolBar 5.0	etoolbar.exe	"EarthLink Toolbar is a tool to help you get to all of the resources of the internet. EarthLink 5.0 Setup adds a few basic buttons to the Toolbar
N	Easy Start Button	esb.exe	Provides functionality on certain laptops that have additional keys. Not required unless you use the extra keys
U	Easy-PrintToolBox	BJPSMAIN.EXE	A utility to launch the applications that are bundled with a Canon bubblejet printer
X	EasyDates_nl	EasyDates_nl.exe	Adult content dialler
U	EasyLinkAdvisor	LinksysAgent.exe	"Linksys EasyLink Advisor - ""the free application that provides and easy way to setup
N	EasyNetwork	McENUI.exe	"McAfee's EasyNetwork user interface - ""enables secure file sharing
X	EasySpywareCleaner	EasySpywareCleaner.exe	"EasySpywareCleaner rogue spyware remover - not recommended
U	EasySync Pro	XCPCMenu.exe	"""IBM® Lotus® EasySync® Pro is a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - 3CmPlm	AutoDet.exe	"3Com Palm PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - LtNts4	NtsAgent.exe	"Lotus Notes 4 specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - PocketPC	AUTODE~1.EXE	"Windows Mobile Pocket PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - PocketPC	AutoDetect.exe	"Windows Mobile Pocket PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasyTuneIII	EasyTune.exe	Tuning (overclocking) utility for Gigabyte motherboards. Shortcut available
U	EasyTuneIV	ET4Tray.exe	Tuning (overclocking) utility for Gigabyte motherboards. Shortcut available
U	EasyTuneV	GUI.exe	Tuning (overclocking) utility for Gigabyte motherboards. Shortcut available
X	EbatesMoeMoneyMaker	wjview ...Code	"Ebates adware"
X	EbatesMoeMoneyMaker0	EbatesMoeMoneyMaker0.exe	"Ebates adware"
U	eBayToolbar	eBayTBDaemon.exe	"eBay toolabar related - also contains eBay account Guard which monitors for fraudulent eBay sites"
N	eBot	DownloadWizard.exe	"eBot from Digital River - ""helps ensure your computer always has the latest technology
U	ECenter	gtb.exe	Dell E-Center/Google Toolbar related
N	ECenter	EULALauncher.exe	End User License Agreement (EULA) launcher - related to Dell E-Center/Google Toolbar
?	EDFcsn	discfcsn.exe	"Related to Hewlett-Packard's Discovery Agent. What does it do and is it required?"
U	eDonkey2000	edonkey2000.exe	"File sharing network - not recommended as the free version of this application should be avoided as it installs
X	educational writer	[random filename]	"Added by the RBOT-LZ WORM!"
X	Edzy AntiVirus	dppsfa.exe	"Added by a variant of the RBOT WORM!"
U	Eee Docking	Eee Docking.exe	"Intuitive shortcuts for easy access to digital content
N	EEventManager	EEventManager.exe	"Part of the Epson Creativity Suite supplied with their multi-function printer/scanners
X	Efata	[random 5 characters].exe	"Added by the FLUKAN-D WORM!"
U	eFax Live Menu 3.3	J2GDllCmd.exe	"DLL Command Utility for version 3.3 of eFax Messenger from j2 Global Communications
N	eFax Tray Menu	HotTray.exe	"eFax Messenger Tray Menu system tray icon for eFax Messenger Plus. Available via Start -> Programs. Disabling instructions available here"
U	eFax Tray Menu	J2GTray.exe	"System Tray access to eFax Messenger from j2 Global Communications
U	eFax Tray Menu 3.3	J2GTray.exe	"System Tray access to version 3.3 of eFax Messenger from j2 Global Communications
U	eFax Tray Menu 3.5	J2GTray.exe	"System Tray access to version 3.5 of eFax Messenger from j2 Global Communications
U	eFax Tray Menu 4.0	J2GTray.exe	"System Tray access to version 4.0 of eFax Messenger from j2 Global Communications
N	eFax.com Tray Menu	HotTray.exe	"eFax Messenger Tray Menu system tray icon for eFax Messenger Plus. Available via Start -> Programs. Disabling instructions available here"
U	EFI Job Monitor	"[path] efjm.dll	run"
X	egikugu	napolecy.exe	"Added by the SDBOT.AOE WORM!"
U	Eicon NetworksLAN_DAEMON	watch.exe	"Associated with an Eicon Networks ISDN or ADSL modem. Watch protocols your connection with numbers and duration. You need callvu.exe (from Start Menu) to see your connection statistics. You can manually start watch.exe before you go online. Needs diinfo.exe (started by DiTask) to work correctly which can be started manually"
U	Eicon TechnologyLAN_DAEMON	watch.exe	"Associated with an Eicon Networks ISDN or ADSL modem. Watch protocols your connection with numbers and duration. You need callvu.exe (from Start Menu) to see your connection statistics. You can manually start watch.exe before you go online. Needs diinfo.exe (started by DiTask) to work correctly which can be started manually"
X	eixfi	china.bat	"Added by the WCUP.A WORM!"
U	ELBERTRicoh_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Ricoh MFP Type 104 multifunction printer
U	ELBERT_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX-5x30 Series multifunction printers
U	Electron Microscope	EMIII.exe	"Electron Microscope or EM - is a program used to track Stanford's distributed computing program client called Folding at Home
X	Element	Element.txt	"Added by the ELEM TROJAN!"
X	element furth	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are often located in %System%\vert"
N	elm	Elmenv.exe	"ViaTech eLicense for securing
X	ELNKProxy	smproxy.exe	"Surfmonkey adware"
U	ELSA WINman Suite	Winmsuit.exe	"Allows you to totally customize your ELSA graphics card settings
U	ELSBLaunch	ELSBLaunch.exe	"EarthLink SpamBlocker"
U	eMachines eBoard	Eboard.exe	eMachines multimedia keyboard manager. Required if you use the extra keys
Y	Email Protection	emlproxy.exe	"AntiVirus Quick Heal - E-mail protection"
Y	EmailScan	mcvsescn.exe	Related to McAfee AntiVirus suite - used to automatically scan incoming e-mails
X	eMCryT Sh3ars Panagers	[path to worm]	"Added by the RBOT-AWI WORM!"
X	eMessenger	emsn.exe	"Added by the RBOT.AHO BACKDOOR!"
X	empin	e121307.exe	"Delfin Media Viewer adware related"
X	empin	e121307.Stub.exe	"Delfin Media Viewer adware related"
?	Empowering Technology Launcher	eAPLauncher.exe	"Part of Acer Empowering Technology. What does it do and is it required?"
?	EmpoweringTechnology	Framework.Launcher.exe	"Part of Acer Empowering Technology. What does it do and is it required?"
Y	Emsisoft Anti-Malware	a2guard.exe	"System Tray access to and Anti-Malware Guard feature of Emsisoft Anti-Malware from Emsi Software GmbH - which provides ""comprehensive PC protection against viruses
N	eMusicClient Systray	eMusicClient.exe	"eMusic MP3 download software"
N	EN4060C Taskbar	en4060ct.exe	Comes with Efficient Networks DSL Modems. Little red/green/yellow flashing icon in system tray
X	enBrowser	[name of file]	"WINBO adware"
?	encapsulated command tool	wintr.com	"??"
N	Encarta Dictionary Quickshelf	QSHLFED.EXE	"Provides quick access to Encarta's Dictionary features?"
N	ENCMONITOR	monitor.exe	The Encompass Monitor. This program is the Connect Direct Program. It is more trouble than it is worth and few use it
N	Encoder Agent	WMENCAGT.EXE	"MS Windows Media Encoder
U	Encompass_ENCMONTR	ENCMONTR.EXE	Optional simple browser from Yahoo (Encompass)
?	ENCSurf	surfboard.exe	"??"
N	Energizer FileSaver	Energizer FileSaver.exe	"Energizer FileSaver - UPS back-up utility for Energizer UPS products. From their Tech Support staff this is known to have a memory leak since it's release - with no fix planned! It will grab 2-5 handles per second and crash the average system in less than 3 days - therefore not recommended"
X	EnergyPlugIn	EnergyPlugin.exe	"EnergyPlugin adware variant"
U	enginecs2	enginecs2.exe	"Cyber Sentinel - internet filtering software"
Y	EngUtil	EngUtil.exe	"Part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools - corrects any modification made to the Roxio Engine
X	Enh Win Updt	enhupdt.exe	"Adware - detected by Kaspersky as the ONECLICKNETSEARCH.H TROJAN!"
X	enhance32	enhance32.exe	"Added by the CRYPTER.A TROJAN!"
N	EnigmaPopupStop	EnigmaPopupStop.exe	"Part of Enigma SpyHunter - not recommended
?	ENSApServer2_0	APSERVER.EXE	"Intel AnyPoint Wireless II Home Network related. Now discontinued. What does it do and is it required?"
?	ENSMIX32.EXE	ENSMIX32.EXE	"Sound card driver. Is it required?"
U	EnsoniqMixer	starter.exe	"Puts the Ensoniq mixer in system tray. From Ensoniq Technologies ""Our mixer is a critical part of the soundcard as it fixes sound problems and replaces the MS mixer which can no longer be used"". If you find you don't need it - try one of the solutions on this special page. Similar to Creative PCI Audio Configuration Utility"
U	Entbloess 2	Entbloess2.exe	"Related to Window-Switcher (now Reflex Vision) - it allows you to see previews of all your open applications via a single keystroke in a manner similar to Apple's Exposé
U	Enterprise Harmony	rsMenu.exe	"Enterprise Harmony 99 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000"
U	Enterprise Harmony '99	rsMenu.exe	"Enterprise Harmony 99 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000"
X	Enterprise Suite	WE[random characters].exe	"Enterprise Suite rogue security software - not recommended
U	Enterra Icon Keeper	IcnKeepr.exe	"Icon Keeper - ""tool to save and restore icon positions on the desktop"""
X	EntraOcio	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Enumerate Service	wsys.exe	"Added by the MANIFEST TROJAN!"
Y	EnvyHFCPL	EnMixCPL.exe	"VIA Envy24 PCI Audio Controller driver"
U	eonemng	eOneMng.exe	"eOne Manager
U	EPGServiceTool	EPGClient.exe	"Electronic Programme Guide (EPG) for the WinTV range of TV Tuners from Hauppauge"
U	ePowerManagement	ePM.exe	"Part of Acer Empowering Technology. ""Acer ePower Management is a straightforward interface that allows users to select from pre-configured power usage profiles
N	ePrint 3.0 Service	EPRINT3.EXE	"LEADTOOLS ePrint file conversion software - ""convert any file to and from over 150 document and image formats including searchable PDF
N	ePrint 4.0 Service	EPRINT4.EXE	"A component of the ""LEADTOOLS ePrint File Conversion Software - Convert ANY file to and from over 150 document and image formats including searchable PDF
X	Epsilon Squared	vmmreg32.exe	"Added by the AGENT.MVC TROJAN!"
N	EPSON Background Monitor	STMS.EXE	Supposed to keep an Epson printer ready for quick printing. Users report little difference whether it is on or not
U	EPSON CardMonitor	EPSON CardMonitor1.0.exe	Monitors the PCMCIA memory card slot on EPSON cameras and printers and launches PhotoStarter or PhotoPrint
U	EPSON PictureMate Deluxe	E_FATI9TA.EXE	"Epson Status Monitor 3 for the PictureMate Deluxe compact photo printer - for monitoring printer status
U	EPSON Status Monitor 3	E_[various].EXE	"Epson Status Monitor 3 for their range of printer and AIO devices - for monitoring printer status
N	EPSON Status Monitor 3 Environment Check	e_srcv03.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check	e_srcv02.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check 2	e_srcv03.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check 2	e_srcv02.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
U	EPSON Stylus C120 Series	E_FATICCA.EXE	"Epson Status Monitor 3 for the Stylus C120 Series printer - for monitoring printer status
U	EPSON Stylus C40 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C40 Series printer - for monitoring printer status
U	EPSON Stylus C41 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C41 Series printer - for monitoring printer status
U	EPSON Stylus C42 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C42 Series printer - for monitoring printer status
U	EPSON Stylus C43 Series	E_S08IC1.EXE	"Epson Status Monitor 3 for the Stylus C43 Series printer - for monitoring printer status
U	EPSON Stylus C43 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C43 Series printer - for monitoring printer status
U	EPSON Stylus C44 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C44 Series printer - for monitoring printer status
U	EPSON Stylus C45 Series	E_S4I3T1.EXE	"Epson Status Monitor 3 for the Stylus C45 Series printer - for monitoring printer status
U	EPSON Stylus C46 Series	E_S4I0T1.EXE	"Epson Status Monitor 3 for the Stylus C46 Series printer - for monitoring printer status
U	EPSON Stylus C48 Series	E_S4I091.EXE	"Epson Status Monitor 3 for the Stylus C48 Series printer - for monitoring printer status
U	EPSON Stylus C60 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C60 Series printer - for monitoring printer status
U	EPSON Stylus C61 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C61 Series printer - for monitoring printer status
U	Epson Stylus C62 Series	E-S0BIC1.EXE	"Epson Status Monitor 3 for the Stylus C62 Series printer - for monitoring printer status
U	EPSON Stylus C62 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C62 Series printer - for monitoring printer status
U	EPSON Stylus C63 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C63 Series printer - for monitoring printer status
U	EPSON Stylus C64 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C64 Series printer - for monitoring printer status
U	EPSON Stylus C64 Series	E_S4I2C1.EXE	"Epson Status Monitor 3 for the Stylus C64 Series printer - for monitoring printer status
U	EPSON Stylus C66 Series	E_S4I0S2.EXE	"Epson Status Monitor 3 for the Stylus C66 Series printer - for monitoring printer status
U	EPSON Stylus C67 Series	E_FATIAAL.EXE	"Epson Status Monitor 3 for the Stylus C67 Series printer - for monitoring printer status
U	Epson Stylus C82 Series	E_S0HIC1.EXE	"Epson Status Monitor 3 for the Stylus C82 Series printer - for monitoring printer status
U	EPSON Stylus C82 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C82 Series printer - for monitoring printer status
U	EPSON Stylus C84 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C84 Series printer - for monitoring printer status
U	EPSON Stylus C84 Series	E_S4I2D1.EXE	"Epson Status Monitor 3 for the Stylus C84 Series printer - for monitoring printer status
U	EPSON Stylus C87 Series	E_FATIABL.EXE	"Epson Status Monitor 3 for the Stylus C87 Series printer - for monitoring printer status
U	EPSON Stylus CX2900 Series	E_FATIBFP.EXE	"Epson Status Monitor 3 for the Stylus CX2900 Series printer - for monitoring printer status
U	EPSON Stylus CX3100	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus CX3100 printer - for monitoring printer status
U	EPSON Stylus CX3200	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus CX3200 printer - for monitoring printer status
U	EPSON Stylus CX3500 Series	E_FATI9 BL.EXE	"Epson Status Monitor 3 for the Stylus CX3500 Series printer - for monitoring printer status
U	EPSON Stylus CX3600 Series	E_FATI9BE.EXE	"Epson Status Monitor 3 for the Stylus CX3600 Series printer - for monitoring printer status
U	EPSON Stylus CX3700 Series	E_FATIACP.EXE	"Epson Status Monitor 3 for the Stylus CX3700 Series printer - for monitoring printer status
U	EPSON Stylus CX3800 Series	E_FATIACA.EXE	"Epson Status Monitor 3 for the Stylus CX3800 Series printer - for monitoring printer status
U	EPSON Stylus CX3900 Series	E_FATIBEP.EXE	"Epson Status Monitor 3 for the Stylus CX3900 Series printer - for monitoring printer status
U	EPSON Stylus CX4200 Series	E_FATIAEA.EXE	"Epson Status Monitor 3 for the Stylus CX4200 Series printer - for monitoring printer status
U	EPSON Stylus CX4500 Series	E_FATI9AP.EXE	"Epson Status Monitor 3 for the Stylus CX4500 Series printer - for monitoring printer status
U	EPSON Stylus CX4600 Series	E_FATI9AA.EXE	"Epson Status Monitor 3 for the Stylus CX4600 Series printer - for monitoring printer status
U	EPSON Stylus CX4700 Series	E_FATIADL.EXE	"Epson Status Monitor 3 for the Stylus CX4700 Series printer - for monitoring printer status
U	EPSON Stylus CX4800 Series	E_FATIADA.EXE	"Epson Status Monitor 3 for the Stylus CX4800 Series printer - for monitoring printer status
U	EPSON Stylus CX5000 Series	E_FATIBVA.EXE	"Epson Status Monitor 3 for the Stylus CX5000 Series printer - for monitoring printer status
U	EPSON Stylus CX5400	E_S4I2G1.EXE	"Epson Status Monitor 3 for the Stylus CX5400 printer - for monitoring printer status
U	EPSON Stylus CX5500 Series	E_FATICAP.EXE	"Epson Status Monitor 3 for the Stylus CX5500 Series printer - for monitoring printer status
U	EPSON Stylus CX6000 Series	E_FATIBIA.EXE	"Epson Status Monitor 3 for the Stylus CX6000 Series printer - for monitoring printer status
U	EPSON Stylus CX6500 Series	E_FATI9EP.EXE	"Epson Status Monitor 3 for the Stylus CX6500 Series printer - for monitoring printer status
U	EPSON Stylus CX6600 Series	E_FATI9EE.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	EPSON Stylus CX6600 Series	E_FATI9EA.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	EPSON Stylus CX7000F Series	E_FATIBKA.EXE	"Epson Status Monitor 3 for the Stylus CX7000F Series printer - for monitoring printer status
U	EPSON Stylus CX7400 Series	E_FATICDA.EXE	"Epson Status Monitor 3 for the Stylus CX7400 Series printer - for monitoring printer status
U	EPSON Stylus CX7800 Series	E_FATIAFA.EXE	"Epson Status Monitor 3 for the Stylus CX7800 Series printer - for monitoring printer status
U	EPSON Stylus CX8300 Series	E_FATICEP.EXE	"Epson Status Monitor 3 for the Stylus CX8300 Series printer - for monitoring printer status
U	EPSON Stylus CX8400 Series	E_FATICEA.EXE	"Epson Status Monitor 3 for the Stylus CX8400 Series printer - for monitoring printer status
U	EPSON Stylus CX9300F Series	E_FATICFP.EXE	"Epson Status Monitor 3 for the Stylus CX9300F Series printer - for monitoring printer status
U	EPSON Stylus CX9400Fax Series	E_FATICFA.EXE	"Epson Status Monitor 3 for the Stylus CX9400Fax Series printer - for monitoring printer status
U	EPSON Stylus D68 Series	E_FATIAAE.EXE	"Epson Status Monitor 3 for the Stylus D68 Series printer - for monitoring printer status
U	EPSON Stylus D78 Series	E_FATIBGE.EXE	"Epson Status Monitor 3 for the Stylus D78 Series printer - for monitoring printer status
U	EPSON Stylus D88 Series	E_FATIABE.EXE	"Epson Status Monitor 3 for the Stylus D88 Series printer - for monitoring printer status
U	EPSON Stylus DX3800 Series	E_FATIACE.EXE	"Epson Status Monitor 3 for the Stylus DX3800 Series printer - for monitoring printer status
U	EPSON Stylus DX4000 Series	E_FATIBEE.EXE	"Epson Status Monitor 3 for the Stylus DX4000 Series printer - for monitoring printer status
U	EPSON Stylus DX4400 Series	E_FATICAE.EXE	"Epson Status Monitor 3 for the Stylus DX4400 Series printer - for monitoring printer status
U	EPSON Stylus DX4800 Series	E_FATIADE.EXE	"Epson Status Monitor 3 for the Stylus DX4800 Series printer - for monitoring printer status
U	EPSON Stylus DX5000 Series	E_FATIBVE.EXE	"Epson Status Monitor 3 for the Stylus DX5000 Series printer - for monitoring printer status
U	EPSON Stylus DX6000 Series	E_FATIBIE.EXE	"Epson Status Monitor 3 for the Stylus DX6000 Series printer - for monitoring printer status
U	EPSON Stylus DX7000F Series	E_FATIBKE.EXE	"Epson Status Monitor 3 for the Stylus DX7000F Series printer - for monitoring printer status
U	EPSON Stylus DX7400 Series	E_FATICDE.EXE	"Epson Status Monitor 3 for the Stylus DX7400 Series printer - for monitoring printer status
U	EPSON Stylus DX8400 Series	E_FATICEE.EXE	"Epson Status Monitor 3 for the Stylus DX8400 Series printer - for monitoring printer status
U	EPSON Stylus Photo 1400 Series	E_FATIBUA.EXE	"Epson Status Monitor 3 for the Stylus Photo 1400 Series printer - for monitoring printer status
U	EPSON Stylus Photo 2200	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo 2200 printer - for monitoring printer status
U	EPSON Stylus Photo 825	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo 825 printer - for monitoring printer status
U	EPSON Stylus Photo 925	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo 925 printer - for monitoring printer status
U	EPSON Stylus Photo R1800	E_FATI9LA.EXE	"Epson Status Monitor 3 for the Stylus Photo R1800 printer - for monitoring printer status
U	EPSON Stylus Photo R200 Series	E_S4I0H2.EXE	"Epson Status Monitor 3 for the Stylus Photo R200 Series printer - for monitoring printer status
U	EPSON Stylus Photo R220 Series	E_S6I2I1.EXE	"Epson Status Monitor 3 for the Stylus Photo R220 Series printer - for monitoring printer status
U	EPSON Stylus Photo R220 Series	E_FATIAIE.EXE	"Epson Status Monitor 3 for the Stylus Photo R220 Series printer - for monitoring printer status
U	EPSON Stylus Photo R240 Series	E_FATIAHE.EXE	"Epson Status Monitor 3 for the Stylus Photo R240 Series printer - for monitoring printer status
U	EPSON Stylus Photo R2400	E_FATI9SA.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	EPSON Stylus Photo R2400	E_FATI9SE.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	EPSON Stylus Photo R260 Series	E_FATIBNA.EXE	"Epson Status Monitor 3 for the Stylus Photo R260 Series printer - for monitoring printer status
U	EPSON Stylus Photo R280 Series	E_FATICKA.EXE	"Epson Status Monitor 3 for the Stylus Photo R280 Series printer - for monitoring printer status
U	EPSON Stylus Photo R285 Series	E_FATICKE.EXE	"Epson Status Monitor 3 for the Stylus Photo R285 Series printer - for monitoring printer status
U	EPSON Stylus Photo R300 Series	E_S4I2F1.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	EPSON Stylus Photo R300 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	EPSON Stylus Photo R300 Series	E_S4I0F2.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	EPSON Stylus Photo R320 Series	E_FATI9FA.EXE	"Epson Status Monitor 3 for the Stylus Photo R320 Series printer - for monitoring printer status
U	EPSON Stylus Photo R340 Series	E_FATIAJE.EXE	"Epson Status Monitor 3 for the Stylus Photo R340 Series printer - for monitoring printer status
U	EPSON Stylus Photo R380 Series	E_FATIBOA.EXE	"Epson Status Monitor 3 for the Stylus Photo R380 Series printer - for monitoring printer status
U	EPSON Stylus Photo R800	E_FATI9YE.EXE	"Epson Status Monitor 3 for the Stylus Photo R800 printer - for monitoring printer status
U	EPSON Stylus Photo RX420 Series	E_FATI9CE.EXE	"Epson Status Monitor 3 for the Stylus Photo RX420 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX430 Series	E_FATI9CP.EXE	"Epson Status Monitor 3 for the Stylus Photo RX430 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX500	E_S4I2K1.EXE	"Epson Status Monitor 3 for the Stylus Photo RX500 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX530 Series	E_FATIAGP.EXE	"Epson Status Monitor 3 for the Stylus Photo RX530 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX600	E_S4I2M1.EXE	"Epson Status Monitor 3 for the Stylus Photo RX600 printer - for monitoring printer status
U	EPSON Stylus Photo RX640 Series	E_FATIAME.EXE	"Epson Status Monitor 3 for the Stylus Photo RX640 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX680 Series	E_FATICJA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX680 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX700 Series	E_FATI9IA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX700 Series printer - for monitoring printer status
U	EPSON Stylus Pro 4000	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Pro 4000 printer - for monitoring printer status
U	EPSON Stylus Pro 7600	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Pro 7600 printer - for monitoring printer status
U	EPSON Stylus SX200 Series	E_FATIEFE.EXE	"Epson Status Monitor 3 for the Stylus SX200 Series printer - for monitoring printer status
U	EPSON SX100 Series	E_FATIEDE.EXE	"Epson Status Monitor 3 for the SX100 Series printer - for monitoring printer status
U	EPSON TX100 Series	E_FATIEDP.EXE	"Epson Status Monitor 3 for the TX100 Series printer - for monitoring printer status
U	EPSON WorkForce 30 Series	E_FATIEEA.EXE	"Epson Status Monitor 3 for the WorkForce 30 Series printer - for monitoring printer status
U	EPSON WorkForce 500 Series	E_FATIEQA.EXE	"Epson Status Monitor 3 for the WorkForce 500 Series printer - for monitoring printer status
U	EPSON WorkForce 600 Series	E_FATIEKA.EXE	"Epson Status Monitor 3 for the WorkForce 600 Series printer - for monitoring printer status
U	EpsonPhotoStarter	EPSON_PhotoStarter.exe	Only needed if you want to make full use of the capabilities of an Epson printer that included this
X	Eptr	nopdb.exe	Added by an unidentified WORM or TROJAN!
?	Equipmen	Equipmen.exe	"??"
U	eRecoveryService	Monitor.exe	"Part of Acer Empowering Technology. ""Acer eRecovery Management is a powerful utility that does away with the need for recovery disks provided by the manufacturer
U	eRecoveryService	eRAgent.exe	"Part of Acer Empowering Technology. ""Acer eRecovery Management is a powerful utility that does away with the need for recovery disks provided by the manufacturer
X	erfgddfk	wind2ll2.exe	"Added by the BEAGLE.CQ WORM!"
X	erghgjhgdr	windlhhl.exe	"Added by the BEAGLE.BG WORM!"
X	erghgjhjgdr	windlhhl.exe	"Added by the BEAGLE.BG or BEAGLE.BH or BEAGLE.BI or BEAGLE.BJ WORMS!"
X	ErrClean	SysRep.exe	"ErrClean rogue system error and cleaning utility - not recommended. There are number of variants in this family sharing the same filename and user interface - see here"
N	Error Nuker	ErrorNuker.exe	"ErrorNuker registry cleaner - only required if you want the application to run a scan at startup. The program can be launched manually if required"
X	errorhandler	errorhandler.exe	"ErrorHandler adware"
X	ErrorProtector Free	ertmain.exe	"ErrorProtector rogue system error and cleaning utility - not recommended"
X	ERS	ers_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	ERS_check	ers_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	erthegdr	windll2.exe	"Added by the BEAGLE.CG WORM!"
X	erthgdr	windll.exe	"Added by the BEAGLE.AO or BEAGLE.AQ WORMS!"
U	ERUNT AutoBackup	AUTOBACK.EXE	"ERUNT backup utility - when added to the user's startup folder automatically backs up the registry each time the system boots
U	ES Current Services	[FILE NAME].exe	"123Keylogger surveillance software. Uninstall this software unless you put it there yourself"
Y	eScan Monitor	AVKWCTL9X.EXE	"MicroWorld eScan antivirus"
U	eScan Scheduler	avkserv.exe	"MicroWorld eScan antivirus scheduler"
U	eScan Updater	Trayicos.exe	"MicroWorld eScan antivirus updater - allows users to automatically download updates and set the auto time interval for downloads"
U	eSnips	ClientGW.exe	"eSnips Client Gateway from eSnips"
X	Especial	Deneca.bat	"Added by the DELUZ VIRUS!"
N	ESPN BottomLine	bline.exe	"ESPN BottomLine. ""You can dock the BottomLine to the top or bottom of your screen or drag it around on your desktop
?	ESS Daemon	Essd.exe	"Related to an ESS based soundacard. Is it required?"
?	ESSNDSYS	ESSNDSYS.EXE	"Related to an ESS based soundacard. Is it required?"
U	EssSpkPhone	essspk.exe	"ESS Technologies Call waiting
?	eSupInit	eSupCmd.exe	"Related to SupportSoft (aka Support.com) ""Real-Time Service Management software"". What does it do and is it required?"
X	etbrun	elit***32.exe [* = random char]	"EliteBar adware"
U	eTCertManger	eTCrtMng.exe	"eToken Certificate Manager from Aladdin Knowledge Systems
N	Ethernet	tcaudiag.exe	3Com NIC Installation/Diagnostic MFC application. Diagnostics may be run from the Start -> Programs
X	ethernet	airftp.exe	"Added by a variant of the SDBOT WORM!"
X	ethernet	msnger.exe	"Added by a variant of the SDBOT WORM!"
X	ethernet	msftp.exe	"Added by the SDBOT.BXJ WORM!"
X	ethernet adapter	csrmss.exe	"Added by a variant of the RBOT WORM!"
X	Ethernet Driver	cmsrrs.exe	"Added by a variant of the RBOT WORM!"
X	Ethernet Drivers	smrrs.exe	"Added by the RBOT-AAK WORM!"
X	Ethernet Drivers	ethernet.exe	"Added by the GAOBOT.CEZ WORM!"
X	Ethernet Linking	ethernet.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Etraffic	JavaRun.exe	"TopMoxie adware"
U	eTrust PestPatrol Active Protection	PPActiveDetection.exe	"PestPatrol real-time protection feature. ""Stops spyware before it infects your system"""
X	eTrust Realtime Monitor	realmon.exe	"Added by the LAZAR.B TROJAN!"
Y	eTrustCIPE	ezdsmain.exe	eTrust EZ Deskshield from Computer Associates. Protects against malicious email attachments and unauthorized use of email by detecting and blocking unusual behavior
X	eTunnel	winfw.exe	Added by an unidentified TROJAN!
?	Event Log	eventlog.exe	"??"
N	Event Planner Reminders	PLNRNote.exe	Part of Sierra/Hallmark Card Studio - System Tray notification of events such as birthdays and anniversaries that you've scheduled with the customizable Event Planner
N	Event Planner Reminders Tray Icon	PLNRnote.exe	Part of Sierra/Hallmark Card Studio - System Tray notification of events such as birthdays and anniversaries that you've scheduled with the customizable Event Planner
N	Event Reminder	pmremind.exe	"Event reminder for calendar dates
X	EventApplicationCmd	smschk.exe	"Added by the IRCBOT-AO TROJAN!"
U	EVENTLISTENER	EvLstnr.exe	Used with a Nikon digital camera to recognize when the camera is plugged in
N	eventmgr	eventmgr.exe	Used with a Microtek scanner. Manages the scanner's button events. Available via Start -> Programs
X	eventwvr	eventwvr.exe	"Added by the COSIAM_G TROJAN!"
U	EVGAPrecision	EVGAPrecision.exe	"EVGA Precision overclocking utility - ""allows you to fine tune your EVGA graphics card for the maximum performance possible
U	Evidence Cleaner	ecleaner.exe	"Evidence Cleaner cleans up tracks left by your PC and Internet activities"
N	Evidence Eliminator	ee.exe	"Evidence Eliminator - cover the tracks of your browsing habits and E-mails if you think you need to. Run manually on a regular basis"
N	evntsvc	evntsc.exe	"Application Scheduler installed along with RealOne Player. Once installed
U	Evoluent Mouse Manager	EvoMouExec.exe	"Mouse manager for Evoluent VertcialMouse"
U	EvtMgr6	Setpoint.exe	"Logitech SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice
Y	ewido anti-spyware	ewido.exe	"System Tray access to and notifications for Ewido Anti-Spyware 4.0. Ewido is now part of AVG Technologies so this has been superseded by AVG Anti-Virus which includes Anti-Spyware"
X	Ewth	tasn.exe	"PurityScan adware"
X	example	[random filename].exe	"Added by the NUCLEAR BACKDOOR! Note - this trojan file is located in %Windir%\NR"
N	Excite Platform	Exlaunch.exe	Loads an Icon in the startup tray that allows you to receive service update notices for Excite@Home if you desire (note that since Excite@Home appears to be winding down this becomes irrelevant). May also allow you to kill the Excite Toolbar that automatically loads in Internet Explorer
?	Excite Private Messenger Pipe	x8impipe.exe	"??"
N	ExciteAssistantEXE	ASSISTANT.EXE	"With Excite Assistant
X	ExeName32	Warm.scr	"Added by the SCOLD WORM!"
X	ExFilter	"Rundll32.exe [path] cdnspie.dll	ExecFilter"
U	Exif Launcher	Exiflaquickdcr.exe	USB mass storage driver used by some digital cameras such as the Fuji Finepix. Only required if you use it regularly
U	Exif Launcher	QuickDCF.exe	USB mass storage driver used by some digital cameras such as the Fuji Finepix. Only required if you use it regularly
?	exmon	hpimoniter.exe	"Some kind of hp digital camera maybe or a photo smart connection probe?"
X	Exn	exn.exe	"Added by the IRCBOT.RJ WORM!"
X	Expatch	[random filename]	"Added by the PWSLMIR-G TROJAN!"
X	expcrt	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	ExpertAntivirus	ExpertAntivirus.exe	"ExpertAntivirus rogue security software - not recommended
X	explore manager	explore.exe	"Added by the DONBOMB.A TROJAN!"
X	explorer	wscript.exe [filename]	"Sneaky way to start any VBS script. Many viruses use VBS files. Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	Explorer	config_.com	"Added by the FLOPPY-D WORM!"
X	explorer	[path to trojan]	"Added by the AGENT-EU TROJAN!"
X	explorer	Yinstall.exe	"PurityScan/Clickspring adware"
X	Explorer	Windows Explorer.exe	"Added by the SILLYFDC-I WORM!"
X	explorer	main.vbe	"Added by the SHUSH-A WORM!"
X	Explorer 2238	[path to trojan]	"Added by the AGENT-CPI TROJAN!"
X	Explorer5	config_.com	"Added by the VB.CBG WORM!"
X	ExplorerRun	conime.exe	"Added by the DLDR-G TROJAN! Note - this is not the legitimate Console IME process of the same filename which is located in %System%. This one is located in %Temp%"
X	ExploreUpdSched	[random filename]	"ZenoSearch adware"
X	exporet	winset.exe	"Added by the QQPASS-I TROJAN!"
N	Extender Resource Monitor	RMSysTry.exe	"Related to Windows Media Center from Microsoft"
X	External Dependencies	External.exe	"Added by the MYTOB.EC WORM!"
X	Extra Antivirus	ExtraAV.exe	"Extra Antivirus rogue security software - not recommended
U	ExtraDNS	ExtraDNS.exe	"ExtraDNS - DNS configuration tool"
N	ExtraFilmHemmaAgent	Agent.exe	"ExtraFilm Photo Assistant"
?	Extranet AutoDial	AutoExt.exe	Nortel Networks Contivity Extranet Switching Software
?	ExxtremeHelperDemon	exxdemon.exe	"Creative Exxtreme graphics card related?"
N	Eye Tide Launcher	oneeyetideone.exe	Nascar wallpaper
X	EYORE	Notepad.scr	"Added by the GIMLET-A WORM!"
U	EZ-DUB Finder	EZ-DUB.exe	"Support software for the Lite-On EZ-DUB external DVD writer from Lite-On IT Corporation"
N	ezagent	ezagent.exe	"EzVCR recording software for the ASUS TV FM card. Available via Start -> Programs"
N	EzButton	EzButton.EXE	EZbutton is a quick launcher for the Media player app that comes with certain laptops
U	EZEJMNAP	EzEjMnAp.Exe	"EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
?	EZNORUN	EZNORUN.EXE	"Easy Internet related?"
N	EzPrint	ezprint.exe	"Lexmark Fast Pics - helps users of their printers to enhance
Y	ezPS_Px	ezSP_PxEngine.exe	"Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings"
Y	ezShieldProtector for Px	ezSP_PxEngine.exe	"Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings"
U	EzTune	dthtml.exe	"EzTune from Gateway. Rebranded version of Display Tune from Portrait Displays
X	eZulaMain	eZulaMain.exe	"eZula TopText adware"
X	eZuluMain	eZuluMain.exe	Comes with "KaZaA" installation. Advertising Spyware. Not required but KaZaA won't work
U	E_S23	E_SICN03.exe	"Epson printer status monitor - for checking ink levels
U	E_S[numbers]	[path] E_[various].EXE [path] E_S[numbers].tmp	"Temporary entry related to Epson Status Monitor 3 for their range of printer and AIO devices - for monitoring printer status
X	f	ftkclean.exe	"FlashEnhancer adware"
U	F-PROT Antivirus Tray application	FProtTray.exe	"System Tray access to F-PROT Antivirus"
X	F-Secure Gatekeeper	[malware name].exe	"Added by the NUWAR.AXQ WORM!"
U	F-Secure Management Agent	FSMA32.EXE	"F-Secure antivirus - F-Secure Policy Manager provides tools for administering F-Secure software products"
Y	F-Secure Manager	FSM32.EXE	"F-Secure antivirus - carry out scheduled virus scans automatically"
Y	F-Secure TNB	TNBUtil.exe	"F-Secure antivirus"
?	f23mxins	f23mxins	"Related to the now discontinued ATI Fire GL3 graphics card. What does it do and is it required?"
X	f2install.exe	f2install.exe	"Added by the IEFEAT-I TROJAN!"
U	F5D7050v3	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D7050 Wireless G USB Adapter"
U	F5D8001	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8001 N1 Wireless Desktop Card"
U	F5D8011	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8011 N1 Wireless Notebook Card"
U	F5D8055v1	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8055 Wireless N+ USB Adapter"
U	F5D8071	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8071 N1 Wireless ExpressCard"
U	F5D9010	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D9010 Wireless G+ MIMO USB Network Adapter"
U	F5D9050	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D9050 Wireless G+ MIMO USB Network Adapter"
X	f73cdc8ee94e	btsendto.exe	Associated with mysearchnow.com/searchbar.html
X	f94mggfhfghodftdf	[path to trojan]	"Added by the SMALL.JHZ TROJAN!"
X	Fantasia injector	wincfg.exe	"Added by the AGOBOT.US WORM!"
?	fapmon	fapmon.exe	"Fair Access Policy monitor for DirecPC/DirecWay internet access"
X	Fast Antivirus 2009	FastAV.exe	"Fast Antivirus rogue security software - not recommended
X	Fast Home	svcnvt.exe	"Detected by Kaspersky as the DELF.KS TROJAN! This file may be found in the System folder on 9x machines
X	Fast Search	svcnv.exe	"Homepage
X	Fast start	Ntut.exe	"Adware - deteced by Kaspersky as the FAVADD.I TROJAN!"
X	Fast start	svcnt.exe	"Adware - detected by Kaspersky as a variant of the FAVADD TROJAN!"
X	FastDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	FastStart	ntnut32.exe	"Added by the STARTPAGE.L TROJAN!"
X	FastStart	svcnut.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
X	FastStart	svcnut32.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
X	FASTTRACKNETVISION	NETVISION.exe	"DialCar-Z premium rate dialer"
U	FastTVSync	FastTVSync.exe	"Part of InterVideo (now Corel) DVD Copy - ""fast DVD copying and file conversion software. In just three steps
U	FavoriteSync	FavoriteSync.exe	"FavoriteSync keeps the same set of Internet Explorer Favorites on several computers in sync"
U	FaxCenterServer	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software. Incorporated into software by Lexmark
U	FaxCenterServer4_in_1	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software. Incorporated into software by Lexmark
N	FaxTalk CallControl 6.0	FTClCtrl.EXE	This allows the software to handle incoming and outgoing communications without requiring the FaxTalk Communicator application to be loaded into memory. Can be started manually
X	FBSearch	FastBrowserSearchProtection.exe	"Fast Browser Search/Search Guard Plus parasite - installed with ""Make the Web Better"" applications such as My Web Tattoo
X	fc	runfc.exe	"Added by the CAMPURF WORM!"
X	FCEngine	FCEngine.exe	"CASClient adware"
X	FCMan	FCMan.exe	"FCHelp adware"
X	Fdaemon security	fsecur.exe	"Added by the SDBOT.KXO WORM!"
X	Fdr Command Module	sp2.exe	"Added by the SDBOT.WP WORM!"
X	FDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
U	FEELitDeviceManager	feelitdm.exe	Associated with Immersion TouchSense devices (Logitech Wingman Force Feedback Mouse and possibly other peripherals)
X	Fen Startups	fensvc32.exe	"Added by the RANDEX.CCF WORM!"
X	Fenio Startups	fnesvc32.exe	"Added by the AGOBOT-OS BACKDOOR!"
X	FestPlattenCleaner	SysRep.exe	"FestPlattenCleaner
X	FestplattenReiniger	GDC.exe	"FestplattenReiniger
U	FG1_00	frntgate.exe	"FrontGate MX - e-mail spam blocker"
?	fgl23DoubleScreenHooks	f23happ.exe	"Related to the now discontinued ATI Fire GL3 graphics card. What does it do and is it required?"
U	FieldForms Sync	SyncService.exe	"Resco FieldForms. A solution for building of mobile forms that can be viewed or filled in on the run
X	FiendlyType	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
?	file indexing service	msfindfile.exe	"New version of MS FindFast and still a resource hog?"
X	file laoder configuration	rnd32.exe	"Added by the RBOT.BQJ WORM!"
X	File Mapping Services	hp-1003.exe	"Added by the RBOT.FAN WORM!"
X	File Protection Monitor	filemon.exe	"Added by a variant of the RBOT WORM!"
X	File-Sharing Wizard	shwizard.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	FileFreedom_Plugin	wtm.exe	"FileFreedom peer-to-peer sharing program"
X	FileManager32	Wscript.exe ChkMgr32.vbs	"Added by the NOTUP.A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""ChkMgr32.vbs"" file is located in %System%"
X	filen	filen.exe	"Added by the VBNAM-A WORM!"
X	filename	filename.exe	"Added by the VB.FSY TROJAN!"
X	filename process	kerneldll.exe	"Added by the AGOBOT-PO WORM!"
X	filename process	explore.exe	"Added by the AGOBOT-QN WORM!"
X	filename process	Rundil16.exe	"Added by the GAOBOT.ZX WORM!"
X	Find	find.exe	"Added by the OPANKI WORM!"
N	Find Fast	Findfast.exe	From older versions of MS Office - searches disk drives for Office file types and creates an index to make opening them easier. When indexing is in progress it can use lots of CPU time and memory - especially on slower/older machines
Y	Find Virus Launch Program	fvlaunch.exe	"Part of Dr. Solomon's Antivirus"
X	findfast	findfast.exe	"Added by the DLOADER.PFR TROJAN! Note - the is not the legitimate file of the same name installed with older versions of MS Office"
X	findfast.exe	findfast.exe	Identified as the RUNDIS.A TROJAN! Note - the is not the legitimate file of the same name installed with older versions of MS Office
X	FindHack	[path to worm]	"Added by the KELVIR-BA WORM!"
U	FinePrint Dispatcher v4	fpdisp4a.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 4.x of the software. ""FinePrint saves ink
U	FinePrint Dispatcher v4	fpdisp4.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 4.x of the software. ""FinePrint saves ink
U	FinePrint Dispatcher v5	fpdisp5a.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 5.x of the software. ""FinePrint saves ink
N	FineReader7NewsReaderPro	AbbyyNewsReader.exe	"ABBYY FineReader OCR software - version 7"
U	FingerPrintSoftware	fpapp.exe	Supports the fingerprint reader on selected IBM/Lenovo Thinkpad notebooks
X	Fire Wall services	[random filename]	"Added by the IRCBOT-QY WORM!"
X	Fire Wall services	wnlmzsfhobi.exe	"Added by the IRCBOT-QY WORM!"
X	Fire Well service	[random].exe	"Added by the RBOT-FJU WORM!"
?	FireBox Control Panel	FireBox.exe	"Control panel for the Presonus FireBox firewire based music recording system. Is it required?"
X	Firefox Plugin Manager	firefoxpgm.exe	Added by the MSNPHOTO.E WORM!
X	FiresWallservices	[random].exe	"Added by the RBOT-FJT WORM!"
X	Firevall Administrating	rndll.exe	"Added by the PUSHBOT-B WORM!"
X	Firewall	wmlaunch .exe	"Added by the ELIPTER.A or ELIPTER.B WORMS! Note the space at the beginning of the filename"
X	Firewall	wmlaunch .exe	"Added by the ELIPTER.D WORM!"
X	Firewall	ctfmon.exe	"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in %Windir%"
X	firewall 2008	logoneui.exe	"Added by the SILLYFDC WORM!"
X	Firewall Administrating	infocard.exe	"Added by the AUTORUN-AYV WORM! Note - this is not the valid InfoCard Service which is part of the .NET Framework from Microsoft and uses the same filename"
X	Firewall auto setup	winlogon.exe	"Added by the AGENT-EDB TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
X	Firewall auto setup	[path to trojan]	"Added by the AGENT-GLY TROJAN!"
X	Firewall config	ReadMe.exe	"Added by the SILLYFDC.BBT WORM!"
X	Firewall Controls	sys32.exe	"Added by the SDBOT-DGI WORM!"
X	Firewall Sp2 system	sys32Conf.exe	"Added by the RBOT-ABT WORM!"
X	Firewall Update System1	WinedowsUpdater1.exe	"Added by the RBOT-ARU WORM!"
X	Firewall Updater	msnupdateit.exe	"Added by the RBOT-AAQ WORM!"
X	firewall_anti	firewall_anti.exe	"Added by the NETDENY-B TROJAN!"
X	FireWire Service	nvscv32.exe	"Added by a variant of the SDBOT WORM!"
X	FireWire Services	nvcsv32.exe	"Added by a variant of the SPYBOT WORM!"
X	First Home Page	http://find.naupoint.com	"Naupoint browser hijacker"
?	First Principle Group	fpg.exe	"Related to the E-Players Card from First Principle Group"
X	FIX	WinFIX1.0.vbs	"Added by the GORMLEZ-A WORM!"
X	Fixnice	vcvw.exe	"Added by the SDBOT TROJAN!"
U	FjMenu	FjMenu.exe	"From the ""Fujitsu Menu"" tray icon you have instant access to the Control Panel
U	FJTWAIN Setup	FjtwSetup.exe	Fujitsu scanner utility
N	FJUPDNV_Chitose	fjdvrupd.exe	Driver update for a Fujitsu Siemens Lifebook laptop
X	FKS v2.0	msngr.exe	Added by an unidentified WORM or TROJAN!
N	fkSysMon	fksysmon.exe	"fkWrae SysMon - system monitor - ""displays the current memory consumption
X	Flash Driver	[path to trojan]	"Added by the AGENT.CWVT TROJAN!"
X	Flash Media	[path to trojan]	"Added by the IRCBOT.AUR TROJAN!"
X	Flash Media	zrpk��'�'%''msn'�%'fix''.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Flash Media	skxs��'�'%''msn'�%'fix''.exe	"Added by the AGENT.ZOY TROJAN!"
?	FLASH32	#NAME?	"??"
U	FlashEnc	FlashEnc.exe	"Supplied with EasyDisk USB pen devices. The utility manages the encryption and compressed folders options. It will create these folders if running on the USB key without permission
X	Flashget Download Manager	Flashget.exe	"Added by the RBOT-AGZ WORM!"
N	FlashPath Monitor	SDSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
N	FlashPath Monitor	FLSHSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
X	Flash_Player_Install	ying.exe	"Constructor VC2000 malware"
X	FlenCPY	flencpy.exe	"FlashEnhancer adware"
U	FlingRun	fling.exe	"Fling - free FTP software from NCH Software"
U	FLMMEDIONMOUSE	mouse32a.exe	Mouse utility for a Medion branded Fellowes mouse
X	FlnCPY	flncpy.exe	"FlashEnhancer adware"
X	FLooDNeT	FLooDeR.exe	"Added by the ENDOOL TROJAN!"
X	Floppy Master	[path to trojan]	"Added by the ZONIT-F TROJAN!"
X	flpycntl	flpycntl.exe	"Added by the CRYPTER.C TROJAN!"
Y	FltProcess	msinet.exe	"Part of Cyber Patrol internet filtering software to restrict access to certain types of material on the internet. It can be disabled but do not ask how it's done"
X	fmnwebassist	fmnwebassist.exe	Adware popup generator
X	fnmwebassist	fnmwebassist.exe	"WinPL adware"
X	foffice	nm.exe	"Added by the DELF-CB TROJAN!"
U	FolderClone v*.*.*	folderclone.exe	"Folderclone backup and synchronization software"
N	Folding@home	WINFAH.EXE	"Folding@Home is a distributed computing project which studies protein folding
N	FoneSyncSystemTray	FoneSyncSystemTray.exe	System Tray icon for Nokia FoneSync utility for the 7160/7190 mobiles. Useful to send data from/to the cell phone and the computer. You can use it to backup data or even to input data through the computer keyboard (which naturally is much more comfortable). Run manually when required
X	Font	boot.exe	"Added by the AGENT-LZW TROJAN!"
X	Font Viewer	fontviewer.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	FontFix	fontfix.exe	"Added by an unidentified VIRUS
N	fontnav	FontNav.exe	"Font Navigator from Bitstream Inc. - a font management utility"
X	FontsLoader	ldfnt32.hta	Unidentified malware
X	FONTVIEW	FONTVIEW.EXE	"Added by the OPASERV.T WORM!"
X	foobin lptt01	adaware.exe	"RapidBlaster variant (in a ""foo1"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	foobin ml097e	adaware.exe	"RapidBlaster variant (in a ""foo1"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
Y	FoolProof	fpwinldr.exe	"FoolProof Security PC security software from SmartStuff"
X	ForceShow	"rundll32.exe QaBar.dll	ForceShowBar"
N	Forget Me Not	AGRemind.exe	"Calendar reminder part of Broderbund's American Greetings® CreataCard®"
U	forteManager	dthtml.exe	"forteManager from LG. Rebranded version of Display Tune from Portrait Displays
Y	FortiClient	FortiClient.exe	"Fortinet security systems are the new generation of real time network protection systems"
U	Fortis Secure Layer Config	cseinst.exe	Fortis Bank Home Banking part. Installed during the installation of the software necessary to run the Home Banking. According to Fortis Bank this will not in any way be harmful to the system or relay system information
N	FotoStation Easy AutoLaunch	FotoStation Easy AutoLaunch.exe	Installed with a Nikon digital camera. Used to collect photos uploaded from camera program NkVwMon.exe. If your camera is not connected (via USB port) you do not need this program loaded either
X	foxdh	foxdhend.exe	"Added by the MENGHUAN TROJAN!"
N	Fpx	mnmsrvc.exe	Remote Desktop Sharing service part of Microsoft's Netmeeting allowing users to share items on their screens across remote locations
X	Framework module library	infocard.exe	"Added by the BUZUS.AYX TROJAN!"
X	Framework Windows	frmwrk32.exe	"Added by the FAKEAV-KS TROJAN!"
X	France	svchost.exe	"Added by the MIMAIL.L WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
N	Free Download Manager	fdm.exe	"""Free Download Manager"" - see here"
?	Free Downloads Monitor	fdcmon.exe	"??"
X	FreeAttention	eqsefeqe.exe	Added by an unidentified WORM or TROJAN!
N	Freebie Notes	FreebieNotes.exe	"Freebie Notes by Power Soft - create electronic notes (stickers)"
U	FreeMemVn2	FreeMem.exe	"FreeMem - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
X	FreeMP3download	"rundll32.exe MSA64CHK.dll	DllMostrar"
N	FreePDF Assistant	fpassist.exe	"Part of FreePDF (was FreePDF XP) - a utility used to create Adobe compatible PDF files from virtually any Windows application. This executable needs to be running when you want to send a printer output to a PDF file via the FreePDF virtual printer"
N	FreePDF_Assistant	fpassist.exe	"Part of FreePDF (was FreePDF XP) - a utility used to create Adobe compatible PDF files from virtually any Windows application. This executable needs to be running when you want to send a printer output to a PDF file via the FreePDF virtual printer"
X	freinst	pgs.exe	"Part of the AVSystemCare rogue security software and other members of this family. See here for more examples"
?	FridaysInHellInstaller	FridaysInHellInstaller.exe	"??"
X	FriendlyType	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	FriendlyTypeName	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
X	FriendlyTypeName	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
N	FriendlyWebQuick-Launch	SELFCERT.EXE	selfcert.exe is a stand alone program for creating your own digital certificates for macros - the .exe is installed as an extra basically by clicking on MS Office in add/remove programs and selecting remove - also I would do away with the FriendlyWebQuickLaunchBar as well
?	FRITZ!DSL Startcenter	StCenter.exe	"FRITZ! ISP software ""StartCenter"" User interface that allows you to manage
N	Fromine WinPopup	winpopup.exe	Instant Messenger program
X	frun	derc32xz.exe	Added by an unidentified TROJAN!
Y	frxmxins	frxmxins.exe	ATI 3D Studio MAX/VIZ driver
X	FS Agent	fagent.exe	"Added by the VOLVER-B TROJAN!"
X	FSH	svcnva.exe	Identified by Ewido Security Suite (Ewido is now part of AVG Technologies) as the DELF.KA TROJAN!
X	fstsvc	"rundll32.exe fstsvc.dll	start"
X	ftk	ftkclean.exe	"FlashEnhancer adware"
U	FtLnSOP_setup	FtLnSOP.exe	Fujitsu scanner utility
X	FTP FOR WINDOWS	ftpwin32.exe	"Added by a variant of the RBOT WORM!"
N	FTPManager	FTPDM.exe	"""Robust FTP is a Windows-based file transfer client application that transfers files between a user's local PC and another
U	ftutil2	"rundll32.exe ftutil2.dll	SetWriteCacheMode"
U	Fujitsu Hotkey Utility	IndicatorUty.exe	"Fujitsu Hotkey Utility displays icons on the screen when you use hotkeys on a Fujitsu Siemens Lifebook
U	Fujitsu Menu	FjMnuIco.exe	"From the ""Fujitsu Menu"" tray icon you have instant access to the Control Panel
X	Fun	Fun.exe	"Added by the COIDUNG-A WORM!"
N	FusionHdtvTray	FusionHdtvTray.exe	"FusionTrayAgent - main executable for DVICO FusionHDTV software. It adds an icon to system tray that allows you to easily access Fusion HDTV software"
U	FusionRC	FusionRC.exe	"Remote control manager for DVICO FusionHDTV"
U	FusionRemote	FusionRc.exe	"Remote control manager for DVICO FusionHDTV"
N	FusionTrayAgent	FusionHdtvTray.exe	"FusionTrayAgent - main executable for DVICO FusionHDTV software. It adds an icon to system tray that allows you to easily access Fusion HDTV software"
Y	FveNotify	fveNotify.exe	"Windows Vista - BitLocker Drive Encryption Notification Utility. Available with Enterprise and Ultimate versions of Vista
X	FW Manager	fwcheck.exe	"Added by the DELBOT-H WORM!"
X	FWDMON.EXE	fwdmon.exe	"Added by the PROXY-S TROJAN!"
Y	fwenc.exe	fwenc.exe	"Check Point SecuRemote VPN client - ""dynamic and fixed IP addressing for all ISP services - dial-up
X	Fwr Command Module	fwr.exe	"Added by the SDBOT-PP WORM!"
X	G00123	[worm filename]	"Added by the BUGBROS WORM!"
X	G4G	[random filename]	Detected as Trojan-Downloader.Win32.VB.fki
U	G6FTP Server Tray Monitor	G6FTPTray.exe	"System Tray monitoring tool for Gene6 FTP Server - ""an advanced FTP server software for Windows developed specifically for security and high performance requirements"""
X	gabougool	nounina.exe	"Added by the AGENT-JVX TROJAN!"
N	Gadwin PrintScreen	PrintScreen.exe	"Gadwin PrintScreen - utility to capture
X	gah95on6	gah95on6.exe	"ShopAtHome/SAHagent adware"
U	Gainward	TBPanel.exe	Configuration utility for Gainward graphics cards. Not required unless you use non-default settings. Available via Start -> Settings -> Control Panel
X	Games Acceleration	svshost.exe	"EasySearch adware"
X	Games Acceleration	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Games Acceleration	svshost1.exe	"Added by the DLOADR-AWD TROJAN!"
X	Games toolbar	rundll32.exe [path] tbGame.dll DllShowTB	"Topconverting.com/180Search ""Games Toolbar"" adware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
N	GameSpot	kontiki.exe	"Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops"
X	gangsta	gangsta.exe	"Added by the RIMA.A BACKDOOR!"
U	GARO Status Monitor	cnwism.exe	Print monitor for certain Canon printers
X	Gate Personal Firewall	Systpl.exe	"Added by the RBOT.ADC WORM"
N	Gateway Extended Warranty	GWCares.exe	Gateway Extended Warranty reminder
U	GazelDisplay	gsyno.exe	"BT Digital Access USB - Gazel ISDN installation System Tray icon"
Y	GBMHome7Agent	GBMAgent.exe	"Genie Backup Manager Home 7 - backup software"
Y	GBMLite7Agent	GBMAgent.exe	"Genie Backup Manager Lite 7 - backup software"
Y	GBMPro7Agent	GBMAgent.exe	"Genie Backup Manager Pro 7 - backup software"
Y	GBSpaceMan	SpaceMan.exe	"GreenBorder - secure your browsing activities on the internet"
?	GCC Reminder	gccrem.exe	"Associated with AcraMax Greeting Card Creator. Is it a registration reminder?"
X	Gddlib	"rundll32.exe gddlib.dll	start"
X	gdien32	gdien32.exe	"Added by the SINGU-P TROJAN!"
N	Gearbox	confsvr.exe	"NTL's Gearbox software for configuring internet connections with their NTLWorld software - does a similar job to the Internet Connection Wizard which can be used instead using the dial-up details available here"
X	Gekio Startups	gnksvc32.exe	"Added by the AGOBOT.AFJ WORM!"
X	gencroot	gencroot.exe	"Added by the SDBOT-AED WORM!"
U	Gene USB Monitor	USBMonit.exe	Monitors USB ports for insertion of Sandisk USB flashdrives
X	General Antivirus	GenAvir.exe	"General Antivirus rogue security software - not recommended
X	general lptt01	general.exe	"RapidBlaster variant (in a ""General"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	general ml097e	general.exe	"RapidBlaster variant (in a ""General"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Generic host proccess for windows	SVCHOSTS.EXE	"Added by the SPYBOT-GQ WORM!"
X	Generic Host Process	SCHOST.EXE	"Added by the RBOT-NC WORM!"
X	Generic Host Process	svchost.exe	"Added by the DLOADER-NX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Generic Host Process	camacttiv.exe	"Detected by AVG as the CIADOOR.13 TROJAN!"
X	Generic Host Process	lsassw.exe	"Added by the AGOBOT-N WORM!"
X	Generic Host Process for Win Services	mscvs.exe	"Added by a variant of the SDBOT WORM!"
X	Generic Host Process for Win32 Service	svlhost.exe	"Added by the WOOTBOT.EX WORM!"
X	Generic Host Process for Win32 Service	rpchost.exe	"Added by the IRCBOT.DCN WORM!"
X	Generic Host Process for Win32 Services	ntspcv.exe	"Added by the SDBOT.S TROJAN!"
X	Generic Host Process for Win32 Services	intspvc.exe	"Added by the DINFOR.D WORM!"
X	Generic Host Process for Win32 Services	winsvc.exe	"Added by the SDBOT-O WORM!"
X	Generic Host Process for Win32 Services	bazzi.exe	"Added by the AHKER.E WORM!"
X	Generic Host Process for Win32 Services	winsvc32.exe	"Added by the SDBOT-P WORM!"
X	Generic Host Process for Win32 Services	lspsvc.exe	"Added by the MUMU.C WORM!"
X	Generic Host Process for Win32 Services	SPSVC.EXE	"Added by the SDBOT.DA WORM!"
X	Generic Host Process for Win32 Services	svchost32.exe	"Added by the AGOBOT.ALH WORM!"
X	Generic Host Process for Win32 Services	svñhîst.exe	"Added by the DLOADER.AK TROJAN!"
X	Generic Host Process for Win32 Services	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Generic Host Process For Win32 Services	mtsc32.exe	"Added by the VB-CPL TROJAN!"
X	Generic Host Process for WinXP Services	mshelp.exe	"Added by the AGENT-GQP TROJAN!"
X	Generic Host Process2 System Backup	scvhost2.exe	"Added by the RBOT-BAH WORM!"
X	Generic Host Process326a System Backup	scvhost326a.exe	"Added by a variant of the SDBOT WORM!"
X	Generic Host Service	lshost.exe	"Added by the RBOT.LU WORM!"
X	Generic Service Process	regsvc32.exe	"Added by the GAOBOT.UJ or GAOBOT.UL WORMS!"
X	Generic Service Process	serv1ces.exe	"Added by the AGOBOT-JK WORM!"
X	Generic Service Process	nvsvc.exe	"Added by the AGOBOT.BY WORM! Note - this is not the valid NVIDIA Driver Helper Service and is located in %System%"
X	Generic Service Process	srvhost.exe	"Added by the AGOBOT-FX WORM!"
X	Generic Service Process	regsvr32.exe	"Added by the AGOBOT-AGD WORM!"
X	Generic Service Process	SRCHOST.EXE	"Added by the AGOBOT-DG WORM!"
X	Generic Services Process	regsvc32.exe	"Added by the GAOBOT.SY WORM!"
X	GenericHostXP	WinLoaderXP.exe	"Added by the BDOOR-ACX BACKDOOR!"
Y	Genie USB Monitor	USBmonitor.exe	Port monitor for an external USB hard drive. Required to enable access to the drive
X	Genius Mose Driver	svghost.exe	"Added by a variant of the SPYBOT WORM! See here"
X	genserv path	sdqdqg.exe	"Added by the SDBOT-RF WORM!"
X	Geography TX 1.0 NT	CompuSpeed.vbs	"Added by the NEWLEY-A WORM!"
X	Gerenciamento de arquivos do Windows	Winmod32.exe	"Added by the DLOADER-WG TROJAN!"
X	german.exe	winsystems.exe	"Added by the BAGLEDl-AE TROJAN!"
X	german.exe	wintems.exe	"Added by the BAGLE-AS TROJAN!"
X	Gestionnaire de disques universel	sysoobe.exe	"Added by the TOADER-A TROJAN!"
X	Get-Torrent Service	wakeservice.exe	Get-Torrent bittorrent client - Installs LOP adware
Y	Getca	InfoMyCa.exe	"Monitor for a Belkin USB Wireless adapter"
X	GetitAll	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	GetMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	GetRight - Tray Icon	getright.exe	"Entry added with older versions of the GetRight download manager from Headlight Software
X	GetTheMusic	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	Getting started with MacDrive	MDGetStarted.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
X	getwin	winB_.exe	"Added by the BANKER-HS TROJAN!"
X	gfxtray	"rundll32 ctccw32.dll	findwnd"
X	Ghost Antivirus	GhostAV.exe	"Ghost Antivirus rogue security software - not recommended
X	Ghost Relay	[random filename]	"Added by the DNSCHANG.EK TROJAN!"
U	Giganews Accelerator	GiganewsAccelerator.exe	"Giganews Accelerator from Giganews
Y	Gilat SOM Enumerator	dllhost.exe	For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system
X	gimmygames	[path to trojan]	"Added by the DLOADR-LN TROJAN!"
X	GinaDll	ntgina.dll	"Added by the ANIG.A WORM!"
?	GisdnLog	gisdnlog.exe	"BT Digital Access USB"
X	GLF Network Lan Monitor	NPFMNTOR.exe	"Added by the RBOT-AGY WORM!"
X	Global Startup	WinDash.EXE	"Detected by Kaspersky as the VB.Q WORM!"
X	GlobalSCAPE	[random filename]	"Added by the RBOT-AYM WORM!"
?	gluon	gluon.exe	"In a gluon/bin sub-directory"
U	Gnetmous	gnetmous.exe	"Genius mouse driver - required if you use non-standard Windows driver features"
U	GNETMOUSE	gnetmouse.exe	"Genius mouse driver - required if you use non-standard Windows driver features"
X	GNP Generic Host Process	svchost.exe	"Added by the ZAPCHAS-F BACKDOOR! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
?	gnub	gnub.exe	"??"
X	Go And Start	svdll32.exe	"Added by the RBOT.AI BACKDOOR!"
X	Go!Zilla Monster Downloads	Go.exe	Download manager for resuming downloads and choosing multiple download locations. Advertising spyware
U	GoBack	GBMenu.exe	"Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
U	GoBack Polling Service	GBPoll.exe	"Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
U	GoBack Tray Icon	GBTray.exe	"Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
X	GoldenAntiSpy	pgs.exe	"GoldenAntiSpy rogue security software - not recommended. A member of the AVSystemCare family"
U	Goldensoft_MndlSvr	MndlSvr.exe	"Goldensoft CD Ghost related - turns a computer into a 200X-speed CD-ROM tower. Working from the hard drive
X	Google Earth	[random filename]	"Added by the RBOT-AXK TROJAN!"
U	Google IME Autoupdater	GooglePinyinDaemon.exe	"Google Pinyin Input Method Editor (IME) - allows a user to input Chinese characters by entering the pinyin of a Chinese character (with or without tone
X	google Intrenet Explorer	google.pif	"Added by the RBOT-ARA WORM!"
N	GoogleDCClient	GoogleDCC.exe	"Google Compute Client - only present if you installed the Google Toolbar with ""Google Compute"" client active. Does complex calculations in the background when idle. If you want to turn it off go to your browser
U	GoogleToolbarNotifier	GoogleToolbarNotifier.exe	"Part of Google Toolbar (from version 4 onwards) for IE. ""Google Toolbar Notifier allows you to set Google as your default search engine and prevents your search settings from being changed without your consent. An icon in your system tray blinks if the Notifier identifies an attempt to change your default search engine. You can click the icon to get more details and allow the change"". There was a bug in earlier versions where disabling the option resulted in the entry still running at startup but this has now been resolved"
X	gotnewupdate000.exe	gotnewupdate000.exe	"Added by the FAKEAV-BGA TROJAN!"
U	GoTrusted	GoTrusted Secure Tunnel.exe	"""GoTrusted is the fast
X	govurarope	"Rundll32.exe retasevo.dll	s"
X	GPLv3	[random name].dll	"Vundo adware"
X	gpmce	window.exe	"Added by the VB.CK WORM!"
X	Graphic Loader	ntvdm32.exe	"Added by a variant of the RBOT WORM!"
X	Graphic Update	openglx.exe	"Added by the IRCBOT.AMU WORM!"
X	Graphics adapter service	windll.exe	"Added by the ATNAS.A WORM!"
U	Gravis Xperience Driver Support	Grxp4exe.exe	"Driver for Gravis game controllers such as the Eliminator Aftershock. Must be loaded if you run the supplied application software for the controller to be recognized. Start it manually via a shortcut if not used"
X	GreatDefender	GreatDefender.exe	"GreatDefender rogue security software - not recommended
X	GreatDefender.exe	GreatDefender.exe	"GreatDefender rogue security software - not recommended
X	GreatDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
N	Greetings Workshop	GWREMIND.EXE	You really want to be reminded about somebody's birthday at the expense of resources?
X	Gremlin	intrenat.exe	"Added by the DOOMJUICE WORM!"
X	grgtgvgb.exe	[random].exe	"Added by the AGENT-EBF TROJAN!"
X	grinders	grinders.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
U	GrooveMonitor	GrooveMonitor.exe	"Part of MS Office Groove - a stand-alone product or included with the Enterprise/Ultimate versions of MS Office 2007. ""A collaboration software program that helps teams work together dynamically and effectively
U	GrooveMonitor Utility	GrooveMonitor.exe	"Part of MS Office Groove - a stand-alone product or included with the Enterprise/Ultimate versions of MS Office 2007. ""A collaboration software program that helps teams work together dynamically and effectively
U	GroupWise PDA Connect - 3CmPlm	AutoDet.exe	"3Com Palm PC specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
U	GroupWise PDA Connect - GrpWse	Agnt.exe	"GroupWise PDA Connect PDA synchronisation utility - from Novell"
U	GroupWise PDA Connect - PocketPC	AUTODE~1.EXE	"Windows Mobile Pocket PC specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
U	GroupWise PDA Connect - ScheduleSync	SCHEDU~1.EXE	"ScheduleSync specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
N	GrpConv	grpconv.exe	"Microsoft Windows Program Group Converter - used by installers (ONLY in the RunOnce keys) - provides the translation of groups and group items to folders and links. Also see this MS Knowledge Base article"
N	Gsiconexe	Gsicon.exe	"ADSL modem monitor from Eicon Networks (as used by BT for its Broadband internet service for example). Can safely be disabled without affecting the connection - all this does is give an indication of connectivity and access to the diagnostic facilities"
?	GsiFinal	"rundll32 gspndll.dll	postInstall final"
?	GSISETUP	[path] GsiInst.exe INSTALL [path] V205Res 13	"BT Voyager ADSL modem related - what does it do and is it required?"
N	GSOrganizer	GSOrganizer.exe	"GoldenSection Organizer (now WinOrganizer - personal information manager)"
X	GuardCenter	GuardCenter.exe	"GuardCenter rogue security software - not recommended"
Y	GuardGui Application	GuardGui.exe	"System Tray access to the main user interface for Ashampoo® AntiVirus from Ashampoo GmbH & Co. KG."
U	Guardian	CMGrdian.exe	"McAfee Guardian shortcut menu on the System Tray (looks like a castle) given access to Internet Security
U	Guardian PC Security Tools	Pfft.exe	"Boomerang Software's Guardian PC Security Tools - now rebranded as the eXtendia Security Suite"
X	guarnset	guarnset.exe	"Adlogix adware"
U	GuruNet	GuruNet.exe	"GuruNet lets you click on any word on your screen to get the relevant information you want"
X	GustavVED	[filename].exe	"Added by the OPASERV.H WORM!"
X	gvagfxj	rundll32 ...gvagfxj.dll	"Unidentified adware
Y	gw port controller	PORTCT95.EXE	"From a visitor - "I must keep it active in start up or my Lexmark printer and RCA Cam program cannot discover a working port to work". From the file properties
N	GWInkMonitor	GWInkMonitor.exe	"Gateway ink monitor - makes an annoying popup that says your printer may be running out of ink
X	gwiz	ntsystem.exe	"Added by the NITWIZ.A TROJAN!"
U	H/PC Connection Agent	WCESCOMM.EXE	"Connection manager for Microsoft ActiveSync - mobile device synchronization software for Windows XP (and earlier)
X	hachimitsu-lemon	hachimitsu-lemon.exe	"Added by the HACHILEM TROJAN!"
X	hagent	avp.exe	"Added by the ""Herman Agent"" remote access TROJAN!"
U	HalifaxHowardCluster	skinkers.exe	"""Howard the Weatherman"" desktop client from Halifax by Skinkers - marketing/messaging tool. Leave enabled if you want to receive messages"
U	HaMFrontPanel	hampanel.exe	"Displays a panel simulating modem lights for the Intel HaM internal modem. The lights are useful as a reminder to disconnect from the net if you are likely to forget
U	Handy Backup 3.9	hbagent.exe	"Handy Backup - automatic backup of your critical data to virtually any type of storage media including CD-RW devices and remote FTP servers"
X	HanUpdate	hanz.exe	"Added by the RBOT-GLJ WORM!"
N	Hard Disk Sentinel	HDSentinel.exe	"Hard Disk Sentinel - a multi-OS hard disk drive monitoring application. Its goal is to find
X	Hard drive Controller	hdcontroller.exe	"Added by the KIMAN.B WORM!"
X	Hardware Monitor Service	mshms.exe	"Added by the WOLLF-A TROJAN!"
U	Hardware Sensors Monitor	hmonitor.exe	Utility to monitor fan speed and temperatures - similar to Motherboard Monitor. Only required if you're concerned about your system temperature - typically for "overclocked" systems
X	Hardware Shell Detection	WinHSD.exe	"Added by a variant of the RBOT WORM!"
U	Harmony 98 - CasioOrg	CasAgnt.exe	"Enterprise Harmony 98 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000"
X	HATAPE	[path to trojan]	"Added by the BANKER-QF TROJAN!"
U	HawkEye IV Control Panel	HAWK_32.EXE	"Control Panel application for the old Number Nine graphics cards to change resolution
U	Hawking HWU54G Utility	HWU54G.exe	"Wireless management utility for the HWU54G Mini Wireless-G USB Adapter from Hawking Technologies
U	Hawking Wireless Utility	HWU8DD.exe	"Wireless management utility for the HWU8DD Hi-Gain™ USB Wireless-G Dish Adapter from Hawking Technologies
X	Hbinst	Hbinst.exe	"Hotbar adware"
N	HC Reminder	hc.exe	"For Compaq PC's. Help Compiler
X	hcen	hcen.exe	"Added by the SMALL.LR TROJAN!"
U	hcenter	tgcmd.exe	"Part of software from SupportSoft (aka Support.com) provided to manufacturers and ISPs that allows them to offer on-line support - to update drivers
U	hcenter	hcenter.exe	"Bellsouth help center. Part of software from SupportSoft (aka Support.com) provided to manufacturers and ISPs that allows them to offer on-line support - to update drivers
X	hclean32.exe	hclean32.exe	"Wareout - malware masquerading as a spyware and dialer remover"
U	Hcontrol	hcontrol.exe	Hotkeys on an ASUS Notebook. Only required if you use the additional keys
U	HControlUser	HControlUser.exe	Hotkeys on an ASUS Notebook. Only required if you use the additional keys
N	HD Audio Control Panel	RtHDVCpl.exe	"Realtek HD Audio Manager
X	HDAudio Driver 1.0	[random filename].exe	"Added by the TEADOOR-D TROJAN!"
X	HDAudio Driver 2.0	[random filename].exe	"Added by the TEADOOR-E TROJAN!"
U	HDDControlGuard	HDDControlGuard.exe	"Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access"
U	HDDControlGuard.exe	HDDControlGuard.exe	"Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access"
X	hdlfoe df98ndf	svchots.exe	"Added by a variant of the RBOT WORM!"
X	hdlpscom	[8 random letters].exe	"Added by the RBOT-FUL WORM!"
X	he3bbcff	"rundll32.exe he3bbcff.dll	EnableRunDLL32"
X	he3e3fc4	"rundll32.exe he3e3fc4.dll	EnableRunDLL32"
X	Hekio Startups	Hnksvc32.exe	"Added by the AGOBOT-QE WORM!"
X	HelloInt	hello3.exe	"Added by the CASAL.A TROJAN!"
X	helloworld	nb32ext2.exe	"Added by the MYDOOM.BV WORM!"
X	helloworld	nb32ext3.exe	"Added by the MYTOB.JT WORM!"
X	helloworld3	nb32ext4.exe	"Added by the RITDOOR.A WORM!"
X	Help	Wizardnil.exe	"Added by the BANCOS-BCZ TROJAN!"
X	Help Temp Files	netreg.exe	"Added by the FORBOT-EM WORM!"
U	HelpCenter	sprtcmd.exe /P HelpCenter	"Self-help support tool for BellSouth's FastAccess® DSL (now owned by AT&T) broadband service (provided by SupportSoft
U	HelpCenter4.1	sprtcmd.exe /P HelpCenter4.1	"Self-help support tool for BellSouth's FastAccess® DSL (now owned by AT&T) broadband service (provided by SupportSoft
X	HELPER	greece_nm.exe	"AsdPlug premium rate adult content dialer variant"
X	HELPER	Netherlands.exe	"AsdPlug premium rate adult content dialer variant"
X	HELPER	new_zealand.exe	"AsdPlug premium rate adult content dialer variant"
X	HELPER	sweden.exe	"AsdPlug premium rate adult content dialer variant"
X	HELPER	canada.exe	"AsdPlug premium rate adult content dialer variant"
X	HELPER	france.exe	"AsdPlug premium rate adult content dialer variant"
X	helper.dll	rundll32.exe [path] helper.dll	"CnsMin (Chinese Keywords) hijacker related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	helpmanager	spoler.exe	"Added by the RANDEX.J WORM!"
X	hen	[filename].exe	"Added by the TARNO.G TROJAN!"
X	hErcUnes	softhost.exe	"Added by the GARROCH WORM!"
U	Hermes Messenger	DGDRHE~1.EXE	"A LAN messenger alternative to WinPopUp - Digital Dreams Software"
X	Hewlett Packard Manager	hpmanager.exe	"Added by the MYTOB.KE WORM! Note - this is not a valid Hewlett-Packard program"
N	Hewlett Packard Recorder	Remind32.exe	HP multifunction registration
X	hfdtubvnx	keepSafe.exe	"Added by the KILLAV.KAX TROJAN!"
X	Hhjg5jfd93dftdf	winlogan.exe	"Added by the ERTFOR.A TROJAN!"
X	hhtnsn	rnxntup.exe	"Added by a variant of the ORCU.B TROJAN!"
?	HiberMonitor	HCount.exe	"??"
U	Hibernation	hib32.exe	"Reduces the power consumption when the laptop isn't being used to preserve battery power. Similar programs on other laptops reduce the processor clock rate
U	Hide and Protect any Drives for Win95/98/Me/2k/XP	HPDAgent.exe	"Loads Hide and Protect any Drives - which allows you to ""Protect Hard drive
X	hiden	hiden.exe	"Added by the AGENT-IW TROJAN!"
X	HideRun.exe	Hiderun.exe and svhost.exe and pro.gif	"Added by the BOOHOO WORM!"
X	HideStyle	Ante Browse Trust.exe	"IE toolbar taking you to Lop.com. If the exe is running
U	Hidetools Spy Monitor	wmispe.exe	"HideTools Spy Monitor surveillance software. Uninstall this software unless you put it there yourself"
X	Hidup_Susah	Pembantu.exe	"Added by the SILLYFDC.BDM WORM!"
U	High Definition Audio Property Page Shortcut	CHDAudPropShortcut.exe	"Realtek audio card related. Probably adds the odd feature to one of the ""Sounds"" Control Panel applet tabs - doesn't appear to be required"
N	High Definition Audio Property Page Shortcut	HDAShCut.exe	High definition audio page shortcut for Realtek audio devices - not required
U	High Definition Audio Property Page Shortcut	CHDAudPropShortcut.exe	"Realtek audio card related. Probably adds the odd feature to one of the ""Sounds"" Control Panel applet tabs - doesn't appear to be required"
Y	HighPoint ATA RAID Management Software	raidman.exe	"HighPoint RAID management - hard disk striping/mirroring utility for increased performance and reliability. See here for more information on RAID"
X	Highspeeddownloader	SetupClickHere.EXE	"Homepage hijacker
U	HijackThis startup scan	HijackThis.exe	"""HijackThis is a free utility which quickly scans your Windows computer to find settings that may have been changed by spyware
U	Hitman Pro SurfRight Helper	srhelper.exe	"Hitman Pro - a utility to start a number of Security Protection software. They can be started individualy"
X	HKEYok	runlli32.exe	"Added by the QQPASS-U TROJAN!"
X	HKLMRun	windowsupdate.exe	"Added by the FORBOT-BJ WORM (where HKLM\Run represents HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run)!"
X	HKLM\Run	svhost.exe	"Added by the FORBOT-AO BACKDOOR (where HKLM\\Run represents HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run)!"
X	HLcleanup	hlsetup2.exe	"LinkReplacer/FFinder adware"
U	Hmonitor	Hmonitor.exe	Hardware sensor monitoring program. Only required if you overclock your system and want to check on the status
X	hohohhaha	ournik.com	"Added by the IRCFLOOD.AL BACKDOOR!"
X	Home Antivirus 2010	HomeAntivirus2010.exe	"Home Antivirus 2010 rogue security software - not recommended
X	HomeAntivirus 2009	HomeAntivirus2009.exe	"HomeAntivirus 2009 rogue security software - not recommended
?	HomeCentre WakeUp	LGWAKEUP.EXE	"Associated with the no longer supported Xerox HomeCentre printer/scanner"
X	Homeland Network	HomelandNetwork.exe	Homeland Network Notifier - pops ads
X	homepage.monitor.exe	isamonitor.exe	"Added by the ZLOB.MEDIA-CODEC TROJAN! This purports to be a Windows Media Player upgrade (with names such as ""iCodecPack""
U	HondaHelper	HondaHelper.exe	"Part of Honda Music Link which allows you to use your Honda's audio system's controls to play and search for music on your iPod® in you car"
?	Honor	honor.exe	"??"
U	HornetMonitor	MntrHrnt.exe	"Hornet Monitor - monitoring system that detects and responds to unauthorized access attempts and sources of channel interference on any local DSSS network"
Y	HorngTech4D	bally4d.exe	HorngTech 4D mouse driver
X	Host	N/A	"Added by the POPDIS or STARTPAGE.F TROJANS!"
X	Host Process for Windows Tasks	taskhost.exe	"Added by the BREDO-AI WORM! Note - this is not the valid Windows 7 process which has the same filename and the file description is also ""Host Process for Windows Tasks"". It is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	HostManager	AOLHostManager.exe	"Manages a component essential to the operation of most current AOL software. If you remove it from startup it will load when IE is launched
N	HostManager	AOLSoftware.exe	"Quoted from AOL Beta Team
X	Hostname Manager Server	host32srv.exe	"Added by a variant of the RBOT WORM!"
X	Hostren.exe	Hostren.exe	"Added by PWS.BANKER.F
U	HostsFileMgr	winHostsEdit.exe	"AdBin from Gilmore Software Development. An easy solution to managing your Window's hosts file"
U	HostsMan	hm.exe	"""HostsMan is a freeware application that lets you manage your Hosts file with ease"". It is mainly intended to block specific domains (mostly advertising servers) by redirecting them to localhost
U	Hot Corners	Hotc.exe	"Hot Corners - ""lets you quickly activate or disable your screen saver by moving the mouse into a given corner of the screen"""
X	HOT FIX	filename.exe	"Added by the SDBOT-DKM WORM!"
X	HOT FIX	QOching.exe	"Added by the WOOTBOT.VH WORM!"
X	HOT FIX	windsys2.exe	"Added by the AGOBOT.AOI BACKDOOR!"
X	Hot Inside	Hottest Story Ever.exe	"Added by the BHARAT.A WORM!"
U	Hot Key Kbd 2690 Daemon	SK2690DM.EXE	Multi-function keyboard driver. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
U	Hot Key Kbd 9910 Daemon	SK9910DM.exe	Multi-function keyboard driver. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
X	HotAction_hr	hotaction_hr.exe	"Added by the SITEICON-B DIALER! An uninstall option can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as ""HotAction_hr"""
X	Hotbar	Hbinst.exe	"Hotbar adware"
X	Hotbar	HbOEAddOn.exe	"Hotbar adware"
X	HotbarOE	OEAddOn.exe	"Hotbar adware"
X	hotefix	msnmanegers.exe	"Added by the IRCBRUTE.AS TROJAN!"
X	hotfix	msnnmaneger.exe	"Added by the WOOTBOT.AF WORM!"
U	HOTFOON2	hotfoon4.exe	"Related to Hotfoon - a developer and provider of Internet Telephony technology based on LTP (Lightweight Telephony Protocol)"
N	HotSync Manager	hotsync.exe	Installed when connecting a Palm HotSync cradle up to a USB port. The Blue and Red Arrow Icon that enables Palm / Handspring Synchronizing. Available via Start → Programs
X	HP	mon.exe	"Added by the SILLYFDC WORM!"
U	HP AutoIndexer	hppautoindexer.exe	"Installed by HP multi-function printer driver software
X	hp center	BACKWEB-*****.exe	"See here - ""messaging service that automatically sends you support information
N	hp center UI	ShadowBar.exe	"User Interface for HP Center - see here"
N	HP Component Manager	hpcmpmgr.exe	"Checks the internet for updated drivers/utilities for your HP product - update manually. Disabling will remove the error ""Windows can't shutdown the computer because hpcmpmgr.exe can't be ended"""
U	HP Digital Imaging Monitor	hpqtra08.exe	"System Tray access to HP Director. Required if you prefer to use the all-in-one buttons to manually scan documents or transfer photos froma camera
U	HP Display Settings	hpdisply.exe	"Sets default display settings. Unchecking this item has been reported to cure a ""Problem sending command to keyboard"" error message"
U	HP Gaming Keyboard	razerhid.exe	HP VoodooDNA Gaming Keyboard (powered by Razer) driver - required if you use the additional features and programmed keys/macros
N	HP Image Zone Fast Start	hpqthb08.exe	"Improves the startup time of HP Image Zone. If you disable it
N	HP Info Express	??	"On HP PCs
U	HP Instant Support	matcli.exe	""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	HP Internet Center	SURFBRD.EXE	Loads the HP Internet center surfboard on startup. HP Internet Center allows you to customize the multimedia keys on the fly without having to go the Control Panel --> Keyboards to change them
?	HP Network Registry Agent	hpnra.exe	"??"
X	HP Photo Manager	HPPhotoManager.exe	"Added by the SDBOT.AXU WORM!"
N	HP Precision Scan	hpmdlbwx.exe	HP multifunction scanner software. Available from HP Office Jet R Toolbox so not required
N	HP Presentation Ready	PresRdy.exe	HP Omnibook related: "Press a dedicated button above the keyboard and the system will instantly load your presentation software and change the screen resolution to match your display device"
U	hp psc 2000 Series	hpobnz08.exe	System Tray icon indicating when the printer is ready. Can be started manually with HP Director but takes time to start
U	HP RecordNow	??	"From HP ""Software for the CD writer. Do not prevent from starting unless the CD writer is never going to be used."""
U	HP ScanPatch	HPScanFix.exe	"Program that starts up and automatically fixes earlier versions of the Scanjet 5100c software. If a Scanjet 5100C scanner is not going to be used
N	HP ScanPicture	hpsplmwa.exe	HP multifunction scanner software. Available from HP Office Jet R Toolbox so not required
U	HP SchedIndexer	hppschedindexer.exe	"Installed by HP multi-function printer driver software
?	hp Silent Service	HpSrvUI.exe	"HP related"
N	HP Simple Trax	Hpcron.exe	Supplied with HP CD-RW drives - stores information about CD contents on your hard drive. Available via Start -> Programs or Desktop Icon
U	HP TV Now	HpTvNow.exe	Application supplied with HP notebooks. It activates the S-Video port and is said to improve the quality of the output signal (resolution/timeouts)
X	HP Update Assistant	HPAware.exe	Added by the MRO TROJAN!
?	HP Visualize Init	HpVisIni.exe	"HP Visualize software related. What does it do and is it required?"
N	HP-Aio Flight	Remind32.exe	HP multifunction registration
?	HPAiODevice(hp officejet g series)	hpoavn07.exe	"HP Printer related
N	HPAIO_PrintFolderMgr	hpoopm07.exe	"Directly from HP: "This process has one purpose - detects if the device moves to a different port
U	HPDAgent	HPDAgent.exe	"Loads Hide and Protect any Drives - which allows you to ""Protect Hard drive
U	HPGamesActiveMenu	ActiveMenu.exe	Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
N	hpgs2wnd	hpgs2wnd.exe	"Share-to-Web - HP-created software and Internet-based application that enables easy uploading and sharing of photos via affiliated photo-sharing Web sites. Available via Start → Programs"
U	Hpha1mon	Hpha1mon.exe	"Supports the memory card reader on some HP Photosmart and AIO (all-in-one) printers - displaying a System Tray icon for the drive and allowing you to transfer files directly via the SAVE button. This verison is applicable for version 2.0 to 2.3 drivers - see here. Known to cause 100% CPU load in some cases. Only needed if you use this feature"
U	Hpha2mon	Hpha2mon.exe	"Supports the memory card reader on some HP Photosmart and AIO (all-in-one) printers - displaying a System Tray icon for the drive and allowing you to transfer files directly via the SAVE button. This verison is applicable for version 3.1 to 3.2 drivers - see here. Known to cause 100% CPU load in some cases. Only needed if you use this feature"
U	Hpha3mon	Hpha3mon.exe	"Supports the memory card reader on some HP Photosmart and AIO (all-in-one) printers - displaying a System Tray icon for the drive and allowing you to transfer files directly via the SAVE button. This verison is applicable for version 3.3.138 to 3.4.13 drivers - see here. Known to cause 100% CPU load in some cases. Only needed if you use this feature"
U	HPHmon03	hphmon03.exe	Supports the memory card reader on some HP Photosmart and AIO (all-in-one) printers - displaying a System Tray icon for the drive and allowing you to transfer files directly via the SAVE button. Known to cause 100% CPU load in some cases. Only needed if you use this feature
U	HPHmon04	hphmon04.exe	"Supports the memory card reader on some HP Photosmart and AIO (all-in-one) printers - displaying a System Tray icon for the drive and allowing you to transfer files directly via the SAVE button. This verison is applicable for version 4.0 to 4.2 drivers - see here. Known to cause 100% CPU load in some cases. Only needed if you use this feature"
U	hphmon05	hphmon05.exe	"Supports the memory card reader on some HP Photosmart and AIO (all-in-one) printers - displaying a System Tray icon for the drive and allowing you to transfer files directly via the SAVE button. This verison is applicable for version 5.0 to 5.3 drivers - see here. Known to cause 100% CPU load in some cases. Only needed if you use this feature"
U	HPHmon06	hphmon06.exe	"Supports the memory card reader on some HP Photosmart and AIO (all-in-one) printers - displaying a System Tray icon for the drive and allowing you to transfer files directly via the SAVE button. This verison is applicable for version 6.0 drivers - see here. Known to cause 100% CPU load in some cases. Only needed if you use this feature"
U	HPLaptopGamesActiveMenu	ActiveMenu.exe	Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
Y	HPLJ Config	SetConfig.exe	Connects system to networked HP printer.
U	HPLogiFinder	hp_finder.exe	HP LogiFinder helps detect and allows the use of the centre button for the Logitech mouse. Can be disabled if not used
X	HPNT	hpdll.exe	"Malware downloader - detected by Kaspersky as the VB.KU TROJAN!"
N	hpoddt01.exe	N/A	"Installed by the ""HP Photo and Imaging Director"" software. If you ask for the imaging software
X	HpPrinter	hpserver.exe	"Added by the CMJSPY-W TROJAN!"
?	hpqcmon	hpqcmon.exe	"From HP and related to digital imaging"
?	hpqSRMon	hpqSRMon.exe	"Related to HP Digital Imaging products. What does it do and is it required?"
U	HPSCANMonitor	hpsjvxd.exe	HP scanning software that enables you to scan images from your scanner. Needed if you're using the scanner
?	hpScannerFirstBoot	scannerfb.exe	"HP scanner related"
X	hpsysconf1	[random filename]	"Added by a variant of the VIVIA.A TROJAN!"
N	HPU	ProvenTactics.exe	"Proven Internet Marketing software"
U	hpWirelessAssistant	HP Wireless Assistant.exe	The HP Wireless Assistant is a user application that provides a way to control the enablement of individual wireless devices (such as Bluetooth or WLAN devices) and that shows the state of the radios for these wireless devices
U	hpWirelessAssistant	HPWAMain.exe	Wireless application bundled with HP computers that allows you to control different settings on the computer's wireless devices such as Bluetooth and WLAN
X	HP_runner	front.exe	"Added by the SILLYFDC WORM!"
X	Hrn_qtv	hrnsvc32.exe	"Added by the SDBOT-AET WORM!"
U	HSON	HSON.exe	Toshiba HotStart button support for instant-on entertainment on their laptops
U	HSTrans	hstrans.exe	"Homescan Internet Transporter - part of ACNielson Homescan. Recognizes when the ACNielsen Homescan Scanner is attached to the computer and allows it to transmit scanner information to ACNielsen"
?	HsuGuiControl	HsuGuiControl.exe	"Part of the Starband Internet satellite client. What does it do and is it required?"
U	Hti	npdor.exe	"Appears in startup if you have chosen to participate in on survey by NPD Online Research. Required for the survey to work correctly. Otherwise not required"
X	HTTP Tunneling Server	mstunnel.exe	"Added by the RBOT.EDL WORM!"
X	http://www.lienvandekelder.be	LienVandeKelder.exe	"Added by the MYTOB-AZ WORM!"
X	http://www.lienvandekelder.be	Lien Van de Kelder.exe	"Added by the MYTOB-AP WORM and variants!"
X	http://www.lienvandekelder.be	Lien Vande Kelder.exe	"Added by the MYTOB-AQ WORM!"
X	http://www.lienvandekelder.be	Lien vd Kelder.exe	"Added by the MYTOB-M WORM!"
X	http://www.lienvandekelder.be	Lien.exe	"Added by the MYTOB-CZ WORM!"
X	http://www.lienvandekelder.be	Lientjeuh.exe	"Added by the MYTOB-P WORM!"
X	http://www.lienvandekelder.be	LienVdK.exe	"Added by the MYTOB-U WORM!"
X	http://www.lienvandekelder.be	Van de Kelder Lien.exe	"Added by the MYTOB-BF WORM!"
X	http://www.lienvandekelder.be	We Love Lien Van de Kelder.exe	"Added by the MYTOB-CV WORM!"
X	http://www.lienvandekelder.com	Lien Van de Kelder.exe	"Added by the MYTOB-EQ WORM!"
X	http://www.lienvandekelder.com/	LienVandeKelder.exe	"Added by the MYTOB-EO WORM!"
X	httpd	c_pan.exe	Added by a variant of the DELF-A TROJAN!
X	httpd	deamon.exe	"Added by the TACTSLAY.C TROJAN!"
X	httpd	s_menu.exe	"Added by the TACTSLAY.C TROJAN!"
X	httpd	deamon.exe	"Added by the TACTSLAY.C TROJAN!"
U	HughesNet Tools	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	Hvewsveqmg	ANACON.EXE	"Added by the NACO.A WORM!"
X	HWINFO*	HWINFO*	"Added by the PUROL WORM! where * is a random character"
Y	HWinst	N/A	For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out
X	hxadsec	[path to trojan]	"Added by the ADCLICK-AP TROJAN!"
U	HydarVisionDesktopManager	desk95.exe	"ATI's HydraVision desktop management software
U	HydraVisionDesktopManager	desk98.exe	ATI/Appian HydraVision Desktop Manager software - monitors and regulates window and dialog box placement according to user preferences when using a multi monitor setup
U	HydraVisionDesktopManager	HydraDM.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is the HYDRAVISION Desktop Manager - which ""customizes the behaviour of windows and dialog boxes
U	HydraVisionViewport	viewport.exe	ATI/Appian HydraVision Desktop Manager software - monitors and regulates window and dialog box placement according to user preferences when using a multi monitor setup
U	HydraVisionViewPort	HydraMD.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is HYDRAVISION MultiDesk - which ""creates
X	Hyper Start	instantmsgrs.exe	"Added by the RBOT-NH WORM!"
X	I am not Ranky. I am eTunnel!	msyervice.exe	Added by an unidentified WORM or TROJAN!
X	I am not Ranky. I am eTunnel!	winsys.exe	Added by an unidentified WORM or TROJAN!
X	I am not Ranky. I am eTunnel!	disney.exe	Added by an unidentified WORM or TROJAN!
X	I just want to say I love Milko and I need a drink	svchost.exe	"Added by the CHIKO WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\Administrator\Local Settings\Application Data"
X	I/O Controllers	svcnet.exe	"Added by the TIBIK-B TROJAN!"
U	i8kfangui	i8kfangui.exe	Graphical interface for fan speed control
U	IAAnotif	Iaanotif.exe	"Part of Intel® Matrix Storage Manager (formally known as Intel® Application Accelerator and Intel® Application Accelerator RAID Edition). Used in conjunction with the event monitor service (IAANTMON - Iaantmon.exe) to display event notifications (such as RAID volume status changes
X	Iamnacho On Irc.MusIrc.com Is a Homosexual!	XBox64.exe	"Added by the RANDEX.Y WORM!"
?	IaNvSrv	IaNvSrv.exe	"Related to the option ROM part of the Intel® Matrix Storage Manager. Located in %ProgramFiles%\Intel\Intel Matrix Storage Manager\OROM\aNvSrv. What does it do and is it required?"
X	ibin	[path to trojan]	"Added by the PERDA-C TROJAN!"
Y	IBM Client Security	certtool.exe	"Part of Client Security Software for IBM\Lenovo notebooks. If you have configured the software via the associated wizard this will need to be running if you want to mount password protected areas of the disk (created with SafeGuard PrivateDisk)
N	IBM Client Security Software	csecwiz.exe	"Setup wizard for the Client Security Software for IBM\Lenovo notebooks. This entry only runs once
Y	IBM Password Manager	pwmgr.exe	"Part of Client Security Software for IBM\Lenovo notebooks - IBM® Client Security Password Manager ""enables you to manage your sensitive and easy-to-forget login information
N	IBM RecordNow!	RecordNow.exe	"IBM customized version of the RecordNow! CD-writing utility from Sonic Solutions"
U	IBM ThinkPad EasyEject Support Application	EzEjMnAp.Exe	"EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
N	IBM ThinkPad EasyEject Tray Utility	EZEJTRAY.EXE	"System Tray access to the EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
N	IBM ThinkPad Tray Utility	TP98TRAY.EXE	"System Tray access to the ThinkPad Configuration utility for IBM/Lenovo ThinkPad notebooks. ""The ThinkPad Configuration utility is a control center to configure your ThinkPad hardware. With this utility
U	IBM ThinkPad Utility	NPDTray.exe	System Tray access to Presentation Director for IBM/Lenovo Thinkpad notebooks - which allows you to create and quickly select between various single and mulitple display options. Scheme selection and settings are also available via Fn+F7 key combination on some models
U	IBM TrackPoint Accessibility Features	tp4ex.exe	"Supports accessibility features for the TrackPoint stick and associated buttons on IBM/Lenovo ThinkPad notebooks. If features such as ""Click Sound""
?	IBM Warranty Notification	ERTS0749.exe	"IBM Warranty Notification - presumably it's a reminder to either register or that warranty is about to expire?"
?	Ibmmon.exe	Ibmmon.exe	"??"
U	IBMUltraBayHotSwapCPLLoader	IBMBAY2N.EXE	Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops
?	IBMUltraBayHotSwapSound	IBMBAYSN.EXE	"Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops. Is it needed though - does it just play a sound?"
U	IBWin Background process	IBackground.exe	"IBackup for Windows"
U	IBWin Monitor	IBMonitor.exe	"IBackup for Windows"
U	iCalendar	Calendar.exe	"Older version of Desktop iCalendar/Desktop iCalendar Lite by Desksware which include support for Google Calendar and add weather
X	icccomp	[8 random letters].exe	"Added by the ZHELATIN.EQ WORM!"
X	ICcontrol	iccontrol.exe	"ICcontrol premium rate adult content dialer"
X	icdd7ee6	"rundll32.exe icdd7ee6.dll	EnableRunDLL32"
X	icddefff	"rundll32.exe icddefff.dll	EnableRunDLL32"
N	ICH Synth	eusexe.exe	"Sound related and can be disabled without affecting performance although advanced sound features may be sacrificed. May be related to Compaq PC's with "SoundMAX integrated Digital Audio" (Analog Devices Inc.) devices"
U	iClean	iClean.exe	"IEClean - ""advanced
X	ICManagement	msic32.exe	"Added by the MSIC BACKDOOR!"
N	iCn	NAG.EXE	"iChoose - shopping browser enhancement that alerts you to cheaper deals for goods you want to buy
N	Icon Animation	HDE.EXE	Part of McAfee Nuts & Bolts. Provides entertaining animation of your desktop icons
N	Icon Hearit 95	hearit95.exe	Audio desktop customization utility from Moon Valley Software. Resource hog
N	Icon Hearit 98	hearit98.exe	Audio desktop customization utility from Moon Valley Software. Resource hog
X	Icon lptt01	icon.exe	"RapidBlaster variant (in a ""Icon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Icon ml097e	icon.exe	"RapidBlaster variant (in a ""Icon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
Y	iconcache	icon.bat	"Related to the Vista Customization Pack"
Y	ICONCLNT	iconclnt.exe	"APC PowerChute® Personal Edition tray icon"
U	ICONDESK	ICONDESK.EXE	Small utility which will allow you the option of hiding or showing your desktop icons
N	Iconfig.exe	Iconfig.exe	Icon for LS-120 "Superdisk"
X	iConfigLoader	DIIhost.exe	"Added by the GAOBOT.AO WORM!"
N	Iconoid	Iconoid.exe	"Iconoid is a desktop icon manager"
N	Iconsaver	Iconsaver.exe	"IconSaver is a desktop icon manager"
X	ICQ	ICQNET.vbs	"Added by the GORMLEZ-A WORM!"
X	ICQ Agent	icq6.exe	"Added by the AGENT-FZJ TROJAN!"
X	ICQ Center	[path to worm]	"Added by the RANDIN WORM!"
X	ICQ Hacking Pro	ICQpro.exe	"Added by a variant of the NETSPY TROJAN!"
X	icq lite	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	ICQ Lite Messenger	ICQLITE.EXE	"Added by an unidentified VIRUS
X	ICQ Messenger 2002	ICQ2002.exe	"Added by the SDBOT-ABL WORM!"
X	ICQ Net	winlogon.exe	"Added by variants of the NETSKY WORMS! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
U	ICQMonitor	ICQMonitor.exe	"ICQ Monitor Sniffer surveillance software for the ICQ instant messenger. Uninstall this software unless you put it there yourself"
X	ICQMsn	[path to trojan]	"Added by the RANCK-AH TROJAN! The most common example is ""cbfks.exe"" located in %System%"
X	ICQNet	winlogon.exe	"Added by the NETSKY-C WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	icrosof Avps32 Control	av32.pif	"Added by the RBOT-AVC WORM!"
X	icrosoft Visual InterDevc	zvslmqb.exe	"Added by the RBOT-AYP WORM!"
X	icrosoft Windows DLL Services Configuration	poker3.exe	"Added by the SDBOT-AER WORM!"
X	icrosoftf Avpx Control	avpx.exe	"Added by the RBOT-AYN WORM!"
U	ICSDCLT	"rundll32.exe Icsdclt.dll	ICSClient"
N	ID Commander	IDCom.exe	Caller ID utility for identifying incoming telephone numbers
X	idecntl	idecntl.exe	"Added by a variant of the CRYPTER.C TROJAN!"
X	idlesam	[8 random letters].exe	"Added by the ZHELATIN.EQ WORM!"
N	IDMan	IDMan.exe	"Internet Download Manager - download files faster
X	idmlssp	[random filename]	"Added by a variant of the SLAPER TROJAN!"
N	IDW Logging Tool	idwlog.exe	Added with WinXP SP1. Usually only found in internal builds only to indicate the current build being used. Can cause slow network logon problems
X	IE configure	explorer.exe	"Added by the LINEAGE-C TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually!"
X	IE Menu Extension toolbar	rundll32.exe [path] tbextn.dll DllShowTB	"Topconverting.com/180Search ""IEMenuExtension"" toolbar. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
U	IE New Window Maximizer	iemaximizer.exe	"IE New Window Maximizer - automatically maximize new Internet Explorer and Outlook Express windows"
X	IE Runtime	wini.exe	"Added by the PICRATE.B WORM!"
X	IE Runtimes	winis.exe	"Added by the RBOT-ADZ TROJAN!"
X	IE**.exe [* = random char]	IE**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	IE**32.exe [* = random char]	IE**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	IE-Security	iescan.exe	"IE-Security rogue spyware remover - not recommended
X	IE-Security	wdscan.exe	"IE-Security rogue spyware remover - not recommended
X	IE6	porn.pif	"Added by the RBOT-ATF WORM!"
X	IE6	winsnt.exe	"Added by the RBOT-GOV WORM!"
X	IEAgent update check	iewatch.exe	"Added by the BOMKA TROJAN!"
U	IECleanAux	Ieboot6.exe	"IEClean by Kevin McAleavy - cookie manager
X	IEengine	IEeng.exe	"STARTPAG.AI hijacker"
X	IEFeatures	Internetfeatures.exe	"Added by the POPMON.A TROJAN! - also known as PopMonster adware"
X	Iehelper	syslaunch.exe	Outwar adware downloader
X	iel2cde8	"rundll32.exe iel2cde8.dll	EnableRunDLL32"
X	ielcaabe	"rundll32.exe ielcaabe.dll	EnableRunDLL32"
X	ieupdate	MCP****.exe [**** = random char]	"Added by the ASOXY TROJAN!"
X	ieupdate	[random filename]	"Added by the AGENT-C BACKDOOR!"
X	IEWinserv	winserv.exe	"Added by the BANKER-MY TROJAN!"
X	iExplore Ini	ie4uini.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	IEXPLORE.EXE	[path to trojan]	"Added by the BANCOS-CJ TROJAN!"
X	IExplorer32 Java Scripting	IExplore32b.exe	"Added by the RBOT.ABO WORM!"
X	IExplorer32c Java Scripting	IExplore32cb.exe	"Added by the RBOT.ABN WORM!"
X	IExplorer6 Java Scripting	IExplore326.exe	"Added by a variant of the SDBOT WORM!"
X	IExplorer7 Java Scripting	IExplore327.exe	"Added by a variant of the SDBOT WORM!"
X	IExplorerService	WinSock.exe	"Added by the AGENT.KIU TROJAN!"
X	ifperx	[random filename]	"Added by a variant of the SLAPER TROJAN!"
N	igndlm.exe	DLM.exe	"IGN Download Manager has become a requirement for downloading files through FilePlanet.com. It is based on Internet Explorer and it installs through an ActiveX-plugin
X	Iinl	iptl.exe	"PurityScan adware"
X	IISADMINS	systems.exe	"Added by the AGOBOT.U WORM!"
U	IJNetworkScanUtility	CNMNSUT.EXE	Network utility available for some Canon scanners and multifunction devices. Allows the device to see computers on a network and those computers running the utility to control scanning via the Control Panel on the scanner - which saves you having to run back and forth between the scanner and your computer
U	iKeyWorks	IKEYMAIN.EXE	"A4Tech wireless keyboard driver and utility"
U	IKL	rundll32.exe [path] IKL.dll	"IKL surveillance software. Uninstall this software unless you put it there yourself"
?	ILO_Office_Manager	IntEdReg.exe /OFFMAN	"Intense Educational Ltd - Language Office Software. Is it required?"
N	iM Start Center	iM_Tray.exe	Installed with the Sound Blaster Audigy range of soundcards. A radio tuner installed if the user chooses during installation. Available via Start -> Programs -> iM Networks -> iM Radio Tuner
X	Image	"rundll32 [path] [trojan filename]	Install"
X	Image Remote Players	sysvn.exe	"Added by a variant of the IRCBOT BACKDOOR!"
N	Image Transfer	SonyTray.exe	Sony Image Transfer software provides direct image transfer from your digital camera to a PC - can be started manually
U	ImageDrive-{hex numbers}	ImageDrive.exe	"Nero ImageDrive from Ahead - virtual CD/DVD drive software"
X	ImagePath	taskbarmngr.exe	"Added by the SDBOT-XB WORM!"
U	ImageTune	dthtml.exe	"ImageTune from Hyundai ImageQuest. Rebranded version of Display Tune from Portrait Displays
N	iMarkup Client	iUtil.exe	"Enables the iMarkup Client web page annotation utility to run in the background and be available in systray. Shortcut available via Start -> Programs"
U	Imatio	imation.exe	"Imation Disk Manager - enables you to create a password protected area on your Imation USB flash drive"
X	IME	conime.exe	"Added by the DLDR-G TROJAN! Note - this is not the legitimate Console IME process of the same filename which is located in %System%. This one is located in %Windir%"
U	ImgIcon	ImgIcon.exe	"Displays Iomega icons in Explorer/My Computer
X	ImMsn	timed.exe	"Added by the WEBDOR.AK TROJAN!"
U	Imonitor	Plguni.exe	"Part of McAfee's QuickClean - which removes internet clutter and unwanted programs. This entry monitor changes made to the registry so that they can be undone later using QuickClean - such as removing programs. QuickClean is now integrated into their Total Protection
X	imonitor	[path to trojan]	"Added by the IMONI-A TROJAN!"
U	IMONTRAY	imontray.exe	"System tray monitoring of fans
U	ImScInst	ImScInst.exe	"Microsoft's Input Method Editor which is used to both display and enable the input of characters from East Asian and Right-to-left (e.g. Arabic) languages in e-mails
U	ImScInst.exe	ImScInst.exe	"Microsoft's Input Method Editor which is used to both display and enable the input of characters from East Asian and Right-to-left (e.g. Arabic) languages in e-mails
U	IMVU	IMVUClient.exe	"IMVU chat client that allows you to create ""your own avatars who chat in animated 3D scenes"""
X	imwinsrvc	acpmonsrv.exe	"Added by the SLAPER.E TROJAN!"
X	imxecs	vbrun70sp4.exe	"Added by the AGOBOT.ALA WORM!"
X	im_autorn	im_1.exe	"Added by the IMAV.A WORM!"
X	im_autorn	im_2.exe	"Added by the BAGLEDL-BO TROJAN!"
Y	InCD	incd.exe	"Ahead InCD packet writing software - similar to DirectCD. For Nero 5.0 or 5.5 (InCD3)
N	IncMail	IncMail.exe	"""IncrediMail is an advanced
X	incognito	incognito.exe	"Added by an unidentified WORM or TROJAN! See here"
N	InControl Desktop Manager	DMHKEY.EXE	For Diamond Multimedia video cards. Allows System Tray access to desktop utilities such as screen resolution. Available via Start -> Programs
X	Incredible Keylogger	AdvKeylog.exe	"IncredibleKeylogger spyware"
N	Incredimail	incredimail.exe	""IncrediMail is an advanced
N	Incredimail	IncMail.exe	"""IncrediMail is an advanced
X	Index Service	dllhost32.exe	"Added by the AGOBOT.CH WORM!"
U	Index Washer	WashIdx.exe	"Window Washer from Webroot Software. Useful utility that deletes safe to remove files
?	Indexer	Indexer.exe	"Part of the Sharpdesk from Sharp Electronics. ""A desktop-based
X	Indexindicator	Indexindicator.exe	"Added by the LAZAR TROJAN!"
N	IndexSearch	IndexSearch.exe	"Part of Nuance (ScanSoft) PaperPort - ""scan
U	IndexTray	IndexTray.exe	"Part of
U	IndicatorUty	IndicatorUty.exe	"Fujitsu Hotkey Utility displays icons on the screen when you use hotkeys on a Fujitsu Siemens Lifebook
U	IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}	NMIndexStoreSvr.exe	"Indexing service that catalogs all the media on your computer so that the files are available to all of the programs in the Nero suite of applications"
X	ine	svchosts.exe	"Added by the RBOT.BNL WORM!"
X	INET	inetsync.exe	"Meplex adware"
X	Inet DataBase	Inetdbs.exe	"Added by the QEDS WORM!"
X	Inet Delivery	inetdl.exe	"Inet Delivery adware"
X	Inet Delivery	inetdl_2.exe	"Inet Delivery adware"
X	Inetapi	Netapi.exe	"Added by the NETDEVIL.14 TROJAN!"
X	InetChk	ms[random value].exe	"Added by the AGENT-IRL TROJAN!"
U	inetcntrl	inetcntrl.exe	Bsafe Online - internet filter
?	InetConf	inetconf.exe	"??"
U	Inetd	INETD32.EXE	"Windows Inet Daemon from Hummingbird Communications. ""Hummingbird Inetd has the advanced ability to conserve PC resources by listening for connection requests and launching server daemons"". Provides PCs with the full functionality of a UNIX workstation"
U	inetinfo.exe	inetinfo.exe	"Executable used by MS Internet Information Server (IIS). If it's running
X	inetinfomon manager	inetinfomon.exe	"Added by the DONBOMB.A TROJAN!"
X	inetmgr	inetmgr.exe	"Actual Names (AdvSearch) Internet Keywords parasite"
X	InetMSN	msnet.exe	"Added by a variant of the SDBOT TROJAN!"
X	InetServices	wsock32.exe	"Added by the WOCK32-A TROJAN!"
X	infamous.exe	wmplayer.exe	Added by unknown malware. WMPLAYER.EXE is stored in the location and uses the same name as Windows Media Player but that valid Windows program doesn't load at startup
X	InfeStop	InfeStopRemover.exe	"InfeStop rogue spyware remover - not recommended
X	info	smss.exe	"Added by the VB.EIW WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %System%\inetsrv"
X	INFO DATA	apc.exe	"Added by the RANDON.B WORM!"
U	Info Select	is.exe	"Info Select from Micro Logic - personal information manager"
X	Info32x	Info32x.exe	"Added by the GEMA TROJAN!"
X	InfoData	"rundll32.exe ********.dll	realset [* = random char]"
U	InfoPenMSN	InfoPenIM.exe	"InfoPenMSN is a MSN Messenger plugin that allows you to send data written/drawn by hand"
?	Infoplay.exe	Infoplay.exe	"Written by New Media Properties
X	Information Update	iu.exe	"Detected by Kaspersky as the CENTIM.CH TROJAN!"
U	Infra-red Monitor	IRMON.EXE	System Tray access to infra-red devices. Not required unless you use infra-red devices
X	infus	infus.exe	Adult content dialler
U	Infuzer	Infuzer.exe	"Infuzer - ""is a service that copies dates from the web or an email straight to your electronic calendar"". Beware of the following adware trait - ""Infuzer provides web site owners with a unique opportunity to communicate with their visitors in a way that is useful and relevant to them
X	infwin	infwin.exe	"VX2.Transponder parasite updater/installer related"
X	Init	[path to trojan]	"Added by the DROPPER.EAT TROJAN!"
X	Init32	Init32.exe	"Added by the WINEX.A TROJAN!"
X	Initial Page	install.exe	EasySearch browser hijack installer
Y	Initialize8x8	8x8_init.exe	Tool that initializes a Pinnacle PCTV card - maybe in capture or in showing overlay
X	inixs	minix32.exe	"Added by the AGENT.CKQX TROJAN!"
X	injob	injobs.exe	"Added by the BINJO TROJAN!"
N	Ink Monitor	InkMonitor.exe	Associated with Epson (and maybe other) printers. Tells you when the ink's running low and asks if you want to buy another cartridge on-line
N	InkWatch	InkWatch.exe	Associated with Canon (and maybe other) printers. Tells you when the ink's running low and asks if you want to buy another cartridge on-line
X	Inom	snmoo.exe	"Added by the RBOT-DPM WORM!"
Y	InoRPC	InoRpc.exe	"Associated with eTrust Antivirus/InoculateIT"
Y	InoRT	InoRT9x.exe	"Associated with the Realtime Monitor of eTrust Antivirus/InoculateIT version 6 virus scanners from Computer Associates. For NT/2K/XP users you may need a patch if seeing high CPU useage"
U	InoTask	InoTask.exe	"Scheduled scans and signature updates for eTrust Antivirus/InoculateIT version 6 virus scanners from Computer Associates. Leave enabled unless you manually update signatures or perform routine scans. If enabled it can result in high CPU useage when performing updates"
X	iNotice	iservice.exe	Added by a variant of an MSN worm that tries to lure people to an infected site by using nude pictures and videos
?	insCOA5	insCOA5.exe	"??"
X	Insider	Insider.exe	"Added by the AGENT.KMC TROJAN!"
U	InstaAlert	InstaAlert.exe	"""Kayako InstaAlert allows you to receive realtime alerts whenever a ticket gets updated under the assigned departments. The application displays popups as and when the tickets are created or replied to allowing you to answer your customer requests and issues promptly"""
X	Instafinder	instafinder.exe	"TopSearch.D adware"
X	InstaFinderK	InstaFinderK inst.exe	"InstaFinder adware"
X	Install	Install.exe	"Added by the BANCBAN-HG TROJAN!"
X	Install part II	updates.exe	"Added by the RELFEERWORM!"
?	Install Pending Files	sifxinst.exe	"Uninstall program for Lanovation's Prism Deploy and Prism Pack adminstrators software deployement tools. For specific information see here. Is it required?"
x	install32	install32.exe	"Added by the NUCLEAR.DG BACKDOOR!"
N	InstallAurealDemos	InstallAurealDemos.js	Used to initialize the Aureal A3D demos InstallShield wizard
U	InstallBuddy	Ibtna.exe	"InstallBuddy - automatically translates and installs your desktop documents
X	InstallCleaner	InstallCleaner.exe	"Added by the ANYHOMB.F TROJAN!"
X	Installed shell32.dll	Office.exe...	"Added by the LOVGATE.AO WORM!"
X	Installed shell32.dll	Office.exe	"Added by the LOVGATE.E WORM!"
X	Installer	dial.exe	"Malware - detected by Kaspersky as the AGENT.MM TROJAN!"
?	InstallNAIProduct	SETUP.EXE	"Could be related to Network Associates Inc who own the McAfee VirusScan product amongst others. This was found in a directory called "VSC". Could it be an installation that failed and "SETUP.EXE" was left to run at startup as an error?"
X	InstallProgram	[path to trojan]	"Added by the AGENT-HHU TROJAN!"
X	InstallProvider	newsoftware2007install.exe	"Part of WinAntiVirusPro 2007 and Privacy Protector rogue security software (and possibly others) - not recommended"
X	Installs SP2	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are located in %System%\qpalsp"
X	Installs SP4	[path] repcale.exe [path] p0rd.exe	"Added by the RANDON-AK WORM! Both files are located in %System%\ekrlgc"
U	Installstub	installstub.exe	"Tool for Outlook and Outlook Express from Plaxo for organising and keeping contacts organised and updated and providing online access to your contacts and access from PDA or mobile phone"
X	Instance 001	[path to worm]	"Added by the ALASROU-A WORM!"
X	Instant Access	"rundll32.exe EGDHTML_1023.dll	InstantAccess"
X	Instant Access	"rundll32.exe eg_auth_****.dll	InstantAccess [**** = digits]"
X	Instant Access	"rundll32.exe EGCOMLIB_****.dll	InstantAccess [**** = digits]"
X	Instant Access	"rundll32.exe EGCOMSERVICE_****.dll	InstantAccess [**** = digits]"
X	Instant Access	"rundll32.exe p2esocks_****.dll	InstantAccess [**** = digits]"
X	Instant Access	mwsrvacc.exe	"InstantAccess premium rate adult content dialer"
X	Instant Access	linewsrv.exe	"InstantAccess premium rate adult content dialer variant"
X	Instant Buzz Daemon	IBDaemon.exe	"Instant Buzz adware"
X	Instant Messenger Service	imservice.exe	"Detected by Kaspersky as the HEUR TROJAN!"
X	instant messengers	instantmsgtr.exe	"Added by the AGOBOT-PC BACKDOOR!"
N	Instant Update Center	reminder.exe	"Event reminder for calendar dates
U	Instant Wireless Configuration Utility	WUSB11cfg.exe	"Utility used by the LINKSYS LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
U	Instant Wireless Configuration Utility	WPC11Cfg.exe	"Utility used by the LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
N	InstantAccess	INSTAN~1.EXE	From TextBridge Pro 9.0 OCR scanner software. Available via Start -> Programs
U	InstantDrive	InstantDrive.exe	"Pinnacle Systems (ex VOB) InstantDrive - creates a virtual CD-ROM drive on the computer's hard drive. Part of InstantCD/DVD burning software"
X	InstantPleasure	instantpleasure.exe	Adult content dialler
X	InstantPleasureXXX	instantpleasurexxx.exe	Adult content dialler
N	InstantTray	PCLETray.exe	"Pinnacle InstantCD/DVD disc creation software. Tray icon enabling a pop-up menu that lets you call up any of Instant CD/DVD's tools with one click. Can be started manually"
X	instit	instit.bat	"Added by the OPASERV.H WORM!"
X	instit	INSTIT.BAT	"Added by the OPASERV.K WORM!"
?	InstUtlR.exe	InstUtlR.exe	"??"
X	InSysSecure	InSysSecure.exe	"InSysSecure rogue security software - not recommended
X	intdctrr	idctup20.exe	"SafeSurfing adware variant"
X	Intec Service Drivers	msmsgrs.exe	"Added by the SDBOT-ADN WORM!"
X	Intec Service Drivers	[path to worm]	"Added by the RBOT-GLU WORM!"
X	Intec Service Drivers	wing32.exe	"Added by the RBOT.HAZ WORM!"
X	Intec Service Drivers	msmsgredss.exe	"Added by the SDBOT-AGL WORM!"
X	Intec Services Driverrs	winrvc.exe	"Added by a variant of the SDBOT WORM!"
X	Intec Services Drivers	msupdate22e.exe	"Added by the RBOT-CGC WORM!"
U	IntegardTray	IntegardTray.exe	"System Tray access to Integardparental control software from Race River Corp"
U	Intel Active Monitor	imontray.exe	"System tray monitoring of fans
X	Intel Audio Studio V2.0	fmideploy.exe	Detected by VBA32 as the BIFROSE.ADR TROJAN!
X	Intel Driver	csrs.exe	"Added by a variant of the SDBOT WORM!"
U	Intel File Transfer	xfr.exe	Part of Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicating between the core server and managed clients
X	Intel Management Services v32	mstime32.exe	"Added by the AUTORUN-AYG WORM!"
U	Intel PDS	pds.exe	Intel Ping Discovery Service (PDS). Part of Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicating between the core server and managed clients. Will start the dial-up if installed and enabled
X	Intel Physical Routine 1.2A	stnetlib.exe	"Added by the BACKDR-AS BACKDOOR!"
U	Intel Product Number Utility	IntelProcNumUtility.exe	"Intel Processor Serial Number Control Utility allows you to enable and disable the processor serial number capability of an Intel PIII processor. You can find more information here. System Tray icon providing the user with a visual state indication. You can find more information here"
N	Intel PROSet Tray Icon	promon.exe	System Tray icon for Intel PRO series ethernet adapters giving access to the diagnostic features
X	Intel Service Drivers	msconfig16.exe	"Added by the MSCONFIG16 TROJAN!"
X	Intel system tool	hookdump.exe	"Added by the SPYRE-H TROJAN!"
X	Intel system tool	winnook.exe	"Added by the SPYRE-C TROJAN!"
X	Intel system tool	svehost.exe	"Added by the AGENT-EBT TROJAN!"
X	Intel system works	iis.exe	"Added by the RBOT.QGA WORM!"
U	Intel(R) Common User Interface	igfxtray.exe	"System Tray access to display settings for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
U	Intel(R) Common User Interface	hkcmd.exe	"Hot Key handler for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
U	Intel(R) Common User Interface	igfxpers.exe	"Installed with the graphics drivers for Intel desktop and mobile motherboard chipsets with integrated graphics. It's purpose or function isn't known at present but testing with it disabled would appear to indicate it isn't required - hence the recommended ""U"" status"
X	intel32.exe	intel32.exe	"Added by the SmitFraud alias SPYJACK-B TROJAN!"
U	IntelAPMClient	amclient.exe	"LANDesk® Management Suite software component"
N	IntelAudioStudio	IntelAudioStudio.exe	"""Intel Audio Studio combines Intel® High Definition audio hardware features with Sonic Focus* Audio Refinement and Dolby* technologies to provide you with a comprehensive tool that puts you in control of your audio experience"". Audio utility supplied with some Intel motherboards"
X	InteliSys	smss.exe	"Advertisingvision adware. Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	intell32.exe	intell32.exe	"Added by the SmitFraud alias Desktophijack.C TROJAN!"
X	intell321.exe	intell321.exe	"Added by the SPYJACK-B TROJAN!"
X	Intelli Mouse Pro Version 2.0B	ncsjapi32.exe	"Added by the BUZUS-O WORM!"
X	Intelliflag_be.exe	Intelliflag_be.exe	"Intelliflag spyware"
U	IntelliPoint	point32.exe	"Microsoft IntelliPoint utility (up to version 5.4) - required to support the programmable buttons and additional features on Microsoft's range of mice
U	IntelliPoint	ipoint.exe	"Microsoft IntelliPoint utility (from version 5.5) - required to support the programmable buttons and additional features on Microsoft's range of mice
U	Intellitype	type32.exe	"Microsoft IntelliType Pro utility (up to version 5.4) - required to support the multimedia keys
U	IntelMEM	IntelMEM.exe	"Related to connection events on an Intel chipset based modem. It can alert you if the telephone line is being used when you're trying to get online (when you're using dial-up). It can also alert you if your modem line is disconnected. Furthermore
X	Intelprc	Aas3lovu.exe	"Added by the SILLYFDC-CG WORM!"
U	IntelProcNumUtility	cpunumber.exe	"Intel Processor Serial Number Control Utility allows you to enable and disable the processor serial number capability of an Intel PIII processor. You can find more information here. System Tray icon providing the user with a visual state indication. You can find more information here"
Y	IntelWireless	ifrmewrk.exe	Associated with the Intel PRO/Set Wireless software
U	IntelZeroConfig	ZCfgSvc.exe	"Zero Config MFC Application
?	Intense Registry Service	IntEdReg.exe /CHECK	"Intense Educational Ltd - Language Office Software. Is it required?"
X	InterceptedSystem	[path to worm]	"Added by the ANACON-B WORM!"
Y	InterCheck Monitor	Icmon.exe	"Part of Sophos ant-virus sofware"
Y	InterCheckMonitor	ICMON.EXE	"Part of Sophos anti-virus sofware"
X	Interdll	Interdll.exe	"Added by the DELF family of TROJANS!"
X	Internal	[trojan filename]	"Added by the SMOTHER and TRANSLAT TROJANS!"
X	Internal	regedit.exe /s c[month number]	"Added by the FORTNIGHT.D TROJAN! Note that the Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file ""c[month number]"" is located in %Windir%
X	Internal Memory File	sysintmemory.exe	"Added by the RBOT-GKT WORM!"
X	InternalSystray	Kazza.exe	"Added by the OPTIXPRO.12.C BACKDOOR! Note - unlike the valid KaZaA executable
X	internat	internat.exe	"Added by the LYDRA-F TROJAN! Note - the real internat.exe resides in %windir%\system (where %windir% is the Windows directory - C:\Windows or C:\Winnt) whereas this version resides in %windir%"
X	Internat	systray.exe	"Added by the ALADINZ.P TROJAN! Note - this is not the legitimate systray.exe process. If you right-click on the real systray.exe the ""Properties"" reveal it to be a Microsoft file"
X	Internat	msgsrv32.exe	"Added by the NYRUBOT-A BACKDOOR! Note - this is not the legitimate msgsvr32.exe process on a Win9x/Me system which should not appear in MSConfig/startup!"
X	Internat	[trojan filename]	"Added by the CMJSPY-Y TROJAN!"
X	Internat Conf	bootconf.exe	"Homepage hijacker
N	internat.exe	internat.exe	"Microsoft language selection icon in system tray
X	Internat.exe	internat.exe	"Added by the NETSNAKE TROJAN! Note - the real internat.exe resides in %windir%system (Win98/Me) or %windir%System32 (WinNT/2K/XP) (where %windir% is the Windows directory - C:\Windows or C:\Winnt) and has a ""?"" icon wheras this version resides in %windir% and has a ZIP icon"
X	internct	WinSocks5.exe	"Added by the GRAYBIRD.F TROJAN!"
X	internet	smss.exe	"Added by the MIFENG-K TROJAN! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup!"
X	Internet	Internet.exe	"Added by the PWS-CS TROJAN!"
X	Internet	recruit.exe	"Added by the RBOT-AJG WORM!"
X	internet	[trojan filename].exe	"Added by the MIFENG-D TROJAN!"
X	Internet	winlogom.exe	"Added by a variant of the SDBOT WORM!"
X	Internet	nteusodp.exe	"Added by the RBOT-GFJ WORM!"
X	internet	winsas32.exe	"Added by a variant of the SDBOT WORM!"
X	internet	lsass.exe	"Added by the DSPY-A TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	Internet	alm7tas.exe	"Added by a variant of the RBOT WORM!"
X	Internet	wins.exe	"Added by the RBOT.AAYF WORM!"
U	Internet Answering Machine	IAMNET~1.EXE	"From Callwave. It offers a free utility to monitor your incoming phonecalls if you only have a single telephone line for internet access"
U	Internet Answering Machine	IAM.exe	"From Callwave - offers a free utility to monitor your incoming phonecalls if you only have a single telephone line for internet access"
X	Internet Antivirus	IAvir.exe	"Internet Antivirus rogue security software - not recommended
X	Internet Antivirus Pro	IAPro.exe	"Internet Antivirus Pro rogue security software - not recommended
X	Internet Application Driver	expIorer.exe	"Added by the IRCBOT-WK TROJAN!"
U	Internet Call Director	ICD.EXE	"TELUS Internet Call Director (ICD) provides Internet users with real-time call notification while connected to the Internet"
U	Internet Call Manager	ICM.EXE	"Starts Internet Call Manager dialog box and/or taskbar icons at bootup. This is a subscription program from internetcallmanager.com that monitors a dialup phone line for incoming calls and handles voicemail"
X	Internet Config	svchosts.exe	"Added by the SDBOT TROJAN!"
X	Internet Connection Wizard	stisvsq.exe	"EasySearch adware"
X	Internet Connection Wizard	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Internet Connection Wizard	stisvsq1.exe	"Added by the DLOADR-AWD TROJAN!"
X	Internet Content Publisher	ICP.EXE	"Added by the RBOT-UD WORM!"
U	Internet Disk Cleaner	CLEARH~1.EXE	"""Internet Disk Cleaner from Elongsoft ""protects your privacy by cleaning up all Internet tracks and past computer activities"""
U	Internet Download Accelerator	ida.exe	"Internet Download Accelerator download manager"
X	Internet download manager service	idman.exe	"Added by the RBOT-BMS WORM!"
X	Internet Exploere Services	urlmon32.dll.exe	"Added by the EVIAN.C WORM!"
X	Internet Explore Microsoft	lEXPLORE.EXE	"Added by the RBOT-AOF WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	Internet Explorer	iexplorer.exe	"Added by the LORSIS WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Internet Explorer	IEXPLORE.EXE	"Added by the RBOT-EY WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Internet Explorer	IExplorer.exe	"Added by the NETHIEF-O BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Internet Explorer	http.exe	"Added as part of a new potential CWS infection
X	Internet Explorer	iexpiore.exe	"Added by the RBOT-AZC WORM!"
X	Internet Explorer	IEPLORE32.EXE	"Added by the AGOBOT-CU WORM!"
X	Internet Explorer	twain.exe	"Added by the AGENT.BEA TROJAN!"
X	Internet Explorer Agent	iexplorer.exe	"Added by the AGENT-BH TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Internet Explorer Auto-Update	updt32v5.exe	"Added by the SPYBOT-AB BACKDOOR!"
X	Internet Explorer Configuration	IEXPLORE.EXE	"Added by the SDBOT-UL WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Internet Explorer Security	iexplore.pif	"Added by the RBOT-ALQ WORM!"
X	Internet Explorer Sys32	isys32.exe	"Added by the IRCBOT-ADA WORM!"
X	Internet Explorer Updater	lexbac.exe	"Added by the DOWNLOAD TROJAN!"
X	Internet Explorer Updater	iexplorer.exe	"Added by the REUR.B WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Internet Explorer6	IEexplore.exe	"Added by the RBOT.AGC WORM. Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Internet Explorer6.0	IEXPLORE.EXE	"Added by the RBOT.ENZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Internet Firewall Layer	tsqla.exe	"Added by a variant of the SPYBOT WORM!"
U	Internet History Eraser	HERASER.exe	"Internet History Eraser - deletes your browsing tracks"
X	Internet Loader1	MSInstall61.exe	"Added by the KWBOT.B WORM!"
X	Internet Mail and News	msqdevl.exe	"EasySearch adware"
X	Internet Mail and News	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Internet Mail and News	msqdevl1.exe	"Added by the DLOADR-AWD TROJAN!"
X	Internet Optimizer	optimize.exe	"Internet Optimizer parasite - detected by Sophos as the DLUCA-G TROJAN and variants"
X	Internet Protocol Configuration Loader	ipcl32.exe	"Added by the SDBOT TROJAN!"
X	Internet Security 2010	IS2010.exe	"Internet Security 2010 rogue security software - not recommended
X	Internet Security Service	msq32.exe	"Added by the RBOT-GFP WORM!"
X	Internet Security Service	msq23.exe	"Added by the RBOT-GQL WORM!"
X	Internet Security Service	msql23.exe	"Added by the RBOT-GML WORM!"
X	Internet Security Service	mysqlwin32.exe	"Added by the RBOT.UX TROJAN!"
X	Internet Security Service	expllorer.exe	"Added by the REFROSO.AFF TROJAN!"
X	Internet Send	More log.exe	Unidentfied adware
X	Internet Server	inetsrv.exe	"Added by the STARTPA-EM TROJAN!"
X	Internet Service	intersvc.exe	"Added by the SPYBOT-DE WORM!"
X	internet service	syscfg32.exe	"Added by the RBOT-QS WORM!"
X	internet service	ssvhost.exe	"Added by a variant of the RBOT WORM!"
X	internet service	svho0st98.exe	"Added by the RBOT.EAT WORM!"
X	Internet Services	systemdev.exe	"Added by the SDBOT-PW WORM!"
X	Internet Services	internet.exe	"Added by the MYTOB.BT WORM!"
X	Internet Services	interserv.exe	"Added by the RBOT.BNT WORM!"
X	Internet Services	Netsvc.exe	"Added by the MYTOB.MN WORM!"
X	INTERNET SERVISES	winz32.exe	"Added by the KWBOT.Z WORM!"
Y	Internet Sharing Server	iss_srvr.exe	"Intel AnyPoint internet sharing software. Now discontinued"
X	Internet Suspention	story.exe	"Added by the WOOTBOT.HV WORM!"
N	Internet Sweeper	Sweeper.exe	"Internet Sweeper - removes unnecessart left over files after browsing the internet"
U	Internet Timer	ITIMER.exe	"Shareware dial-up connection call cost calculator from Ratsoft"
X	Internet Washer Pro	iw.exe	"Internet Washer manages temporary browser files
X	Internet.exe	Internet.exe	"Added by the MAGICCALL VIRUS!"
X	internet.exe	yinyin3345.vbs	"Added by the YINI MACRO!"
X	Internet2 Optimizer	wkfix.exe	"Added by a variant of the RBOT WORM!"
N	InternetCalls	InternetCalls.exe	"InternetCalls - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X	InternetExplorer2	windows.exe	"Added by the SDBOT-CZP WORM!"
X	InternetExplorer32	iexplore32.exe	"Added by the RBOT-GRA WORM!"
X	InternetGetConnectedState	winupdate.exe	"Added by the SDBOT-JN WORM!"
X	InternetGetConnectedStateEx	winupdate.exe	"Added by the SDBOT-JN WORM!"
X	InternetShield	INTERN~1.EXE	"InternetShield rogue security software - not recommended
X	InternetShield	InternetShield.exe	"InternetShield rogue security software - not recommended
U	InternetSpy	InternetSpy.exe	"Internet Spy - freeware keylogger that tracks all visited websites including the date and exact time these sites were visited. The information is stored in a file that may be accessed by the person who knows where it is saved. Remove unless you installed it yourself!"
X	InternetWasherPro	iw.exe	"Internet Washer manages temporary browser files
X	Internet_Explorer	microsoft.exe	"Added by the BANKER-EUQ TROJAN!"
X	Internet_Explorer.exe	Internet_Explorer.exe	"Added by the BANKER-END TROJAN!"
X	INTERNET_SERVISES	winz32.exe	"Added by the SDBOT.Q TROJAN!"
U	InternodeUsage	mum.exe	Australian ISP's free monthly download meter
X	Internt	Internt.exe	"Added by the PEEPER or CARUFAX.A TROJANS!"
X	Inters Configuration Loader	RCL0ADERS.exe	"Added by the SDBOT-KX WORM!"
X	Intersoft Msngr	intersoftmsngr.exe	"Added by the AGOBOT-NW WORM!"
N	InterTrust Quick Start	it_cpq~1.exe	"InterTrust offers something known as Digital Rights Management to control legal software download and other E-commerce related business"
X	InterU	WINDRV.EXE	"Added by the IRCINTER.A TROJAN!"
N	Intervideo Win Cinema Manager	WinCinemaMgr.exe	"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	Intervideo Win Cinema Manager	WINCIN~1.EXE	"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	Intervideo WinCinema Manager	WinCinemaMgr.exe	"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	Intervideo WinCinema Manager	WINCIN~1.EXE	"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	Intervideo WinScheduler	WinScheduler.exe	"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
N	Intervideo WinScheduler	SchSvr.exe	"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
N	InterVoip	InterVoip.exe	"InterVoip - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
U	InterWARN	interwarn.exe	"InterWARN by Storm Alert Inc. Provides customized
X	Intespention	IEXPLORE.exe	"Added by the FORBOT-FL WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Intmgr	Intmgr.exe	"Added by the GEMA TROJAN!"
X	intranet	SYS32CFG.EXE	"Added by the SPYBOT-DW WORM!"
X	Intranet	intranet.exe	"Added by the CHIMOZ.AC TROJAN!"
X	Intranet	schost.exe	"Added by the RBOT.SV BACKDOOR!"
X	Intranet Explorer	[random filename]	"Added by the POEBOT.DK BACKDOOR!"
X	Intrenat	Intrenat.exe	"Added by the LEMIR.E TROJAN!"
N	Introducing Media Manager	SPLASHA.EXE	"MS Media Manager tour. Not required"
N	Introduction-Registration	??	"For Compaq PC's. Should only run first time
X	IntruderAlert	ia99.exe	"Intruder Alert '99 from Bonzi - spyware"
X	IntSys1	[path to trojan]	"Added by the BANLOA-ASE TROJAN!"
Y	Intuit SyncManager	IntuitSyncManager.exe	"Synchronizes local Intuit Quickbooks data with online data - ""Use the Intuit Sync Manager to find the status of your latest QuickBooks data sync
U	Inventory Scan	LDISCN32.EXE	"LANDesk® Management Suite software component"
N	iobi	iobiClient.exe	"iobi Home - a mail/voice service by Verizon"
Y	iolo AntiVirus	ioloAV.exe	"iolo AntiVirus"
Y	iolo Personal Firewall	ioloFW.exe	"iolo Personal Firewall"
U	Iolo Task Agent	Task_Agent.exe	"Iolo System Mechanic Task Agent. Scheduled maintenance"
U	Iomega Disk Icons	IMGICON.EXE	"Displays Iomega icons in Explorer/My Computer
U	Iomega Drive Icons	IMGICON.EXE	"Displays Iomega icons in Explorer/My Computer
U	Iomega ImIconXP	imiconxp.exe	"Iomega REV System Software - allows your Iomega REV drive to interact with the operating system via the Iomega REV UDF file system
?	Iomega QuickSync	Quicksync.exe	"??"
N	Iomega Startup Options	IMGSTART.EXE	"Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs"
N	IomegaWare	COMMANDER.EXE	"Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs"
U	Iomon98.exe	Iomon98.exe	PC-Cillin 98 real time virus check. Can cause floppy disk accesses to hang
U	IP Changer 2.0	IPChanger.exe	"IP Changer 2.0 from Plustech Inc - network configuration management tool"
X	IP**.exe [* = random char]	IP**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	IP**32.exe [* = random char]	IP**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
N	iPalm	mon.exe	"Installed with a Panasonic iPalm digital camera. Used to upload photos from the camera. If your camera is not connected (via USB port) you do not need this program loaded"
X	IPC Connection	ipcconn.exe	"Added by the RBOT-AEG WORM!"
X	IPC Spool Manager	wnmgre.exe	"Added by the SDBOT-ZC WORM!"
X	IPC Spool Manager	winspec.exe	"Added by the SDBOT-BLU WORM!"
X	IPConfig	svcxnv32.exe	"Added by the HACARMY.E TROJAN!"
X	IPConfig	svcxnw32.exe	"Added by a variant of the HACARMY.E TROJAN!"
X	IPConfig	ipconfigs.exe	"Added by the HACARMY.C BACKDOOR!"
X	IpCtrl	ipcon32.exe	"Added by an unidentified VIRUS
?	IPHSend	IPHSend.exe	"AOL related. What does it do and is it required?"
N	IPInSightLAN 01	IPClient.exe	"IP Insight is a Quality of Service monitor and diagnostic tool that isn't required - see here for more information. Included with services from BellSouth
N	IPInSightMonitor 01	IPMon32.exe	"IP Insight is a Quality of Service monitor and diagnostic tool that isn't required - see here for more information. Included with services from BellSouth
Y	IPinst	N/A	For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out
?	iPlusAgent2	iAgent2.exe	"Related to iriver portable media products. What does it do and is it required?"
X	ipmon.exe	ipmon.exe	"Added by the RECERV or R3C.B TROJANS!"
X	IpNetwork	ipnetwork.exe	Maxifiles adware
X	Ipnuker	Ipnuker.vbs	"Added by the INKER.B WORM!"
X	Ipod Help	[9 random letters].exe	"Added by a variant of the RBOT WORM!"
U	iPodManager	iPodManager.exe	"Apple iPod® management software for the iPod® player - updates
U	ipoint	ipoint.exe	"Microsoft IntelliPoint utility (from version 5.5) - required to support the programmable buttons and additional features on Microsoft's range of mice
?	iPrint LPT Redirector	nipplpte.exe	"Related to Novell iPrint - ""a printing solution that enables you to send documents to printers located throughout the Net."" Is it required?"
N	iPrint Tray	iprntctl.exe	"Novell® iPrint - based on Novell Distributed Print Services - enables you to send documents to printers located throughout the Net"
X	iprun	iPY.exe	"iProtectYou spyware"
X	IPSEC Configuration	wsupdate.exe	"Added by the AGOBOT-IQ WORM!"
Y	IPSecMon	IPSecMon.exe	"Microsoft L2TP/IPSec VPN Client for Win98/Me/NT. Secure technology for making remote access virtual private network (VPN) connections across public networks such as the Internet"
X	IPTable Configuration	Winipcfgs.exe	"Added by a variant of the RBOT WORM!"
X	IPv6 STUN Service	netstun.exe	"Added by a variant of the SDBOT WORM!"
X	IpWins	ipwins.exe	"IPWins adware"
X	ipyjy	woniz.exe	"Added by the SDBOT.BQD WORM!"
X	iqmanager.exe	iqmanager.exe	"IQ-Manager ransomware copyright scanner - not recommended
X	irassync	irasyncd.exe	"IRASSync adware"
X	irc session	sessionmgr.exe	"Added by the SDBOT-ACE WORM!"
N	iRis Active Monitor	winmon32.exe	"Iris Antivirus - discontinued
N	iRiS AntiVirus Active Monitor	WIMMUN32.exe	"Iris Antivirus - discontinued
U	IRIS_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung CLX-3160 Series multifunction laser printer
U	IRIS_XRX_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Xerox Phaser 6110MFP multifunction laser printer
U	IrMon	IRMON.EXE	System Tray access to infra-red devices. Not required unless you use infra-red devices
?	IRPMonitor	itcnmon.exe	"??"
X	irssyncd	irssyncd.exe	"SafeSurfing adware variant"
X	Irwftp	[path to trojan]	"Added by the BANCOS-AP TROJAN!"
X	irwftp	ftpmon.exe	"Added by the BANCBAN-BO TROJAN!"
X	isamini.exe	isamonitor.exe	"Added by the ZLOB.MEDIA-CODEC TROJAN! This purports to be a Windows Media Player upgrade (with names such as ""iCodecPack""
X	isamonitor.exe	isamonitor.exe	"Added by the ZLOB.MEDIA-CODEC TROJAN! This purports to be a Windows Media Player upgrade (with names such as ""iCodecPack""
X	IsassRenascimento	Issas.exe	"Added by the BANKER.GAX TROJAN!"
N	ISDN Monitor	Linksts.exe	"Tray icon which gets installed when you install the drivers for Asuscom internal ISDN modem cards (or rebadged Asuscom ISDN cards
U	ISDNwatch	IWatch.exe	"FRITZ!X ISDNWatch - ""dialing filter for more security and control on the ISDN PC. The PC is doubly protected against dialer programs and premium-service numbers: ISDNWatch allows the user to block calls to and from both individual numbers and whole number blocks"""
X	iSecurity applet	"rundll32.exe iSecurity.cpl	SecurityMonitor"
X	ISPSERVICE	wintmp.exe	"Added by the IRCBOT.GP BACKDOOR!"
U	iSpyNOW	ispynow.exe	"iSpyNOW - remote monitoring and surveillance software"
N	IsReminder	ISPopup.exe	"Related to GuardWare iShield - this is the registration reminder for the trial version
X	ISS	inet.exe	"Meplex adware"
X	issEnc32Svr	issEnc32.exe	"Added by a variant of the RBOT WORM!"