NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

• "Y" - Normally leave to run at start-up
• "N" - Not required - typically infrequently used tasks that can be started manually if necessary
• "U" - User's choice - depends whether a user deems it necessary
• "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
• "?" - Unknown

	Startup Name	Process Name	Details
Consume	"Consumer Input Rewarded with MyPoints	U	"ConsumerInputRewardedwithMyPoints
Consume	"Consumer Input Rewarded with MyPoints	U	"ConsumerInputRewardedwithMyPoints
X	(*)API Machine	winSOCKS.exe	"Homepage hijacker
X	*winstats	winstats.exe	"Added by the GARGAFX TROJAN!"
X	1234klsjdc uiar924c af	sxgnsvuxct.exe	"Added by the FAKEALERT-AM TROJAN!"
X	180ClientStubInstall	stubinstaller****.exe [* = digit]	"180Solutions adware related"
X	180ClientStubInstall	[path to trojan]	"180Solutions adware related"
X	180ClientStubInstall	******.tmp [* = random digit/char]	"180Solutions adware related"
X	3P_UDEC_IA	IAInstall.exe	"Installer for the Internet Antivirus and Internet Antivirus Pro rogue security software - not recommended
X	@	winsys32.exe	"Added by the DELF.CP BACKDOOR! Note that the entry under the Startup Item/Name field my be blank"
U	Access Connections	ACTray.exe	"System Tray access to the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
X	Access Control App	winsto.exe	"Added by the AGENT.DGO TROJAN!"
X	AddClass	[Installation_Path]	"Added by the STARTPAGE.F hijacker"
X	AdminSoft	sysfile.vbs	"Added by the STARGRUB-A WORM!"
X	AdobeReaderPro	msnserve.exe	"Added by the SDBOT-AKH WORM!"
X	AdobeReaderPro	winslog.exe	"Added by a variant of the RBOT WORM!"
X	AdobeReaderPro	msnservex.exe	"Added by the RBOT.AKM BACKDOOR!"
X	AdobeReaderPro	msnsrcdv.exe	"Added by the INJECT-H WORM!"
?	ADSL_A2	A2Installed	"Associated with an Integrated Telecom Express (ITeX) ADSL driver installation. What does it do and is it required?"
U	Advanced Uninstaller PRO Installation Monitor	monitor.exe	"Innovative Solutions Advanced Uninstaller PRO - ""easy-to-use suite for uninstalling applications and keeping your computer fast
Y	AHNSD	AhnSD.exe	"AhnLab V3 antivirus updater - leave enabled unless you manually update on a regular basis"
X	AIM Instant Message Cookies	[random filename]	"Added by the RBOT-AFV WORM!"
N	AIMWDInstall	AIMWDInstall.exe	"Version of the WildTangent on-line games installer that came with versions of AOL Instant Messenger. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case"
X	AKEYNAME	WinServ.exe	"Added by the EVILBOT.C TROJAN!"
Y	Alps Electric USB Server	Monserv.exe	"Alps Electric USB Server - required according to this article"
X	AmazingTens	AmazingTens.exe	Premium rate adult content dialler
U	Anonymizer Total Net Shield	AnonTns.exe	"Anonymizer Total Net Shield - ID protection and privacy software"
X	ansjava	[path to worm]	"Added by the RANDON-AN WORM!"
X	Anskya	PYSKY.NET.exe	"Added by the DLOADER-MW TROJAN!"
X	Answer Problem	dSAFsqs.exe	"Added by the SDBOT-SC WORM!"
U	AnswerTool	AnswerTool.exe	"AnswerTool - save your E-mail replies in AnswerTool
X	Anti-Virus Update Scheduler	winsp3.exe	"Malware - detected by Kaspersky as the AGENT.FP TROJAN!"
X	AntiVermeans	AntiVermeans.exe	"Variant of the Antivermins rogue security software - not recommended
X	AntiVermins	AntiVermins.exe	"Antivermins rogue security software - not recommended
X	AntiVermins 3.0	AntiVermins 3.0.exe	"Antivermins rogue security software - not recommended
X	AntiVermins 3.3	AntiVermins 3.3.exe	"Antivermins rogue security software - not recommended
X	AntiVerminser	AntiVerminser.exe	"Variant of the Antivermins rogue security software - not recommended
X	AntiVerminsPro	AntiVerminspro.exe	"Antivermins rogue security software - not recommended
X	Antivirus Installer	[path to trojan]	"Added by the BADGENT-A TROJAN!"
X	AntivirusBEST	Installer.exe	"Installer for the AntivirusBEST rogue security software - not recommended. Removal instructions here"
X	AOL Instant Messanger	aim.exe	"Added by the SDBOT-YT WORM! Note - this is not the popular AOL Instant Messenger utility"
X	AOL Instant Messengar	aol.exe	"Added by the AGOBOT-FN WORM!"
X	AOL Instant Messenger	AlM.EXE	"Added by unidentified malware. Note - there ia a lower case ""L"" between the A and M in the filename"
X	Aol Instant Messenger	aolmsg.exe	"Added by the KELVIR.AL WORM!"
X	AOL Instant Messenger	aimsgr.exe	"Added by the IRCBOT.N TROJAN!"
X	AOL Instant Messenger 7.213	aim9283.exe	"Added by the SDBOT-ZF WORM!"
X	AOL Instant Messenger dll runtime	MSAOL32dll.exe	"Added by the RBOT-ATA WORM!"
X	Aol Instant Messenger Fix	aolfix.exe	"Added by the SDBOT-ABJ WORM!"
U	APC_SERVICE	mainserv.exe	"APC PowerChute® Personal Edition - ""safe system shutdown software with sophisticated power management functions."" Appears as a service in XP/Vista and under the ""RunServices"" registry key in Win98"
X	Application Manager	acnsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Application Manager	apnsvc.exe	"Added by the SMALLTRO.FN TROJAN!"
N	ashampoo Magical UnInstall	MagicalUnInstall.exe	"Ashampoo® Magical UnInstall from Ashampoo GmbH & Co. KG - which monitors each new program installation
N	ashampoo UnInstaller Watcher	UIWatcher.exe	"Part of the Ashampoo® UnInstaller series from Ashampoo GmbH & Co. KG - including UnInstaller Platinum 2
X	asnconsole	msasn.exe	"Added by the RBOT.EVU TROJAN!"
?	ASUS Camera ScreenSaver	ASScrProlog.exe	"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
X	atf_reinstall	atf.exe	"Part of the AVSystemCare rogue security software - not recommended. See here"
X	ATI AS Filter	msnse.exe	"Added by the RBOT-CCY WORM! Note - modifies the HOSTS file by appending numerous lines
X	AVantivirus	Avconsol.exe	"Added by the MSNVB-D WORM!"
U	AvconsoleEXE	Avconsol.exe	From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Used to schedule regular scans. If you don't have scans scheduled you don't need it
X	b3d	BDEsecureinstall.exe	"B3d Projector foistware - periodically trys to access the internet. (1) Uninstall it via Start -> Settings -> Control Panel -> Add/Remove Programs. (2) Remove the BDEsecureinstall.exe if still present in the ""System"" directory. (3) Disable and ideally delete it from the registry. (4) Remove the ""BDE"" directory and all its contents"
N	Babylon Translator	Babylon.exe	"""Babylon-Pro is a powerful information tool that instantly provides relevant information
X	Back Updates	Uninstall.log.vbs	"Added by the YPSAN.D WORM!"
X	Background Intelligent Transfer Service	[path] rundll32.exe	"Added by the VB-ZD TROJAN! Note - this is not the legitimate rundll32.exe process
X	bargains	bargains.exe	"BargainBuddy adware"
X	bargains	bargainbuddy.exe	"BargainBuddy adware"
X	begins	0.exe	"Added by the MYTOB-HE WORM!"
Y	BisonInst0402	BR040286.exe	"Driver for integrated notebook webcams from Bison Electronics Inc - such as the Acer Crystal Eye"
X	blah service	winsysengine.exe	"Added by the RBOT-KI WORM!"
X	BlockDefense	BlockDefense.exe	"BlockDefense rogue security software - not recommended
U	blueyonder Instant Support Tool	matcli.exe	"Blueyonder Instant Support Tool. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	BMail Installation	FTP_back.exe	"Part of iMesh - a file sharing system. Reported by Norton AntiVirus as a trojan. Once deleted does not prevent file sharing working. Older versions of iMesh re-instate this but the newer versions do not"
X	BootCfg	Install.log.vbs	"Added by the YPSAN.D WORM!"
?	Boots Insert Detect	InsDetect.exe	"Part of Boots Picture Suite. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
X	BootsCfg	wscript.exe Install.log.vbs	"Added by the YPSAN.E WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""Install.log.vbs"" file is located in %System%"
X	Bouncer RunStartup	bouncer.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
X	Bouncer RunStartup	LiveUpdate.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
X	BPCv2 re	bpc2 re inst.exe	"BroadcastPC adware variant"
X	Bron-Spizaetus	bronstab.exe	"Added by the RONTOKBRO.C WORM!"
?	btinst	btinst.exe	"Associated with an Anycom bluetooth wireless card. What does it do and is it required?"
X	BullsEye	bargains.exe	"BargainBuddy adware"
X	BullsEye Network	bargains.exe	"BargainBuddy adware"
U	Button Server	bttnserv.exe	"Found on a Compaq PC
X	CABCInstall	CABCInstall.exe	"Ignite Technologies (was CABC) content delivery software"
U	CanonSolutionMenu	CNSLMAIN.exe	"
?	cFosInst_Check	cfosinst.exe	"cFos DSL Modem driver related. What does it do and is it required?"
X	ChansonsMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	CleanSweep Smart Sweep- Internet Sweep	Csinsm32.exe	Automatic logging of installs from Norton CleanSweep - available via Start -> Programs
N	CleanSweep Useage Watch	CSUSEM32.EXE	Quarterdeck/Norton CleanSweep component - tracks how often you use files and alerts you to files that have not been used for a specified period of time
X	cleansweep.exe	cleansweep.exe	"Added by the AGENT-NEU TROJAN!"
Y	CleanUp	mcappins.exe	Used by older versions of McAfee internet security related products to clean up installation files that are no longer required once the product is installed. This entry will normally only appear once the product has been installed before the system is rebooted
X	Cmpnt	mainsv.exe	"Added by the TOMPAI-C TROJAN!"
X	CnsMax	Internat.exe	"Added by the POINTEX TROJAN! Note - the real internat.exe resides in %windir%\system (where %windir% is the Windows directory - C:\Windows or C:\Winnt) whereas this version resides in %windir%"
X	CnsMin	"Rundll32.exe [path] CNSMIN.DLL	Rundll32"
X	COM+ System Applications	lsas.exe	"Added by the AGOBOT.SE WORM!"
N	CommonSDK	RoxWatchTray9.exe	"System Tray access to managing the ""Watched Folders""
X	CommonService	winup.exe	"Added by the DLOADR-BJJ TROJAN!"
Y	Communications_Helper	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	Communications_Helper.exe	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
N	Compaq Connections	COMPAQ~1.EXE	"See here - ""messaging service that automatically sends you support information
N	Compaq Connections	BackWeb-1940576.exe	"See here - ""messaging service that automatically sends you support information
N	Compaq Connections	Compaq Connections.exe	"See here - ""messaging service that automatically sends you support information
X	Compaq Service Drivers	msnsvc.exe	"Added by the RBOT.BKT WORM!"
X	Compaq Service Drivers	winsvc.exe	"Added by the SDBOT-AGD WORM!"
X	ComPlus Applications	twain.exe	"Added by the AGENT.AQO TROJAN!"
X	Config	WinService32.exe	"Added by the CRUTCHA-A TROJAN!"
X	Config Loadr	winsys32.exe	"Added by the AGOBOT-HN WORM!"
X	Configuration File	Winset32.exe	Added by the FLUX.101 TROJAN!
X	Configuration Loader	msnss.exe	"Added by the GAOBOT.AUS WORM!"
X	Configuration Loader	WinSys32ys.exe	"Added by the SDBOT.BCS WORM!"
X	Configuration Loader Service	Winsys32.exe	"Added by the RBOT-YV WORM!"
X	Configuration Servecie	sewins.exe	"Added by the SDBOT-COH WORM!"
X	Configurations Asclt	asclt.exe	"Added by the SDBOT-MX WORM!"
X	Cons	consol32.exe	"Hijacker - redirects to an adult content portal
X	conscorr	conscorr.exe	"VX2.Transponder parasite updater/installer related"
X	Console de Gerenciamento Microsoft	csrss.exe	"Unidentified malware! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Level4"" subfolder"
X	Console de Gerenciamento Microsoft	csrss.exe	"Added by the BANCBAN-ET TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Central de Segurança"" subfolder"
U	Consumer Input	ConsumerInput.exe	"Consumer Input Toolbar. Opt-in market research monitoring you browsing habits - see the FAQ"
X	Content Service	winserv[LETTER].exe	"PurityScan adware"
X	ContentService	winservn.exe	"PurityScan adware - see here"
U	ContentTransferWMDetector.exe	ContentTransferWMDetector.exe	"Part of Sony's Content Transfer Software which ""provides an easy way to transfer music
X	ContinueInstall	bpsinstall.exe	"BrowserAid/BrowserPal foistware"
X	Control handler	ahjinst.exe	"CoolWebSearch parasite variant"
X	Counterstrike Service Agent	czrzns.exe	"Added by the MEDBOT.AR WORM!"
U	cpqns	cpqnpcss.exe	Related to Compaq.Net - not required if you don't use that
X	Create A Monster	createAMonster.exe	"Kudd.com CreateAMonster. Reportedly stealth installed and Look2Me adware related"
X	Crnsava	scrnsave.pif	"Added by the SDBOT-ZV WORM!"
X	crsmons	iomssls.exe	"Added by the BACKDR-AU TROJAN!"
X	ctfmon	WinConst.exe	"Added by the ASSASIN-G TROJAN!"
X	CTFMONSS	CTFMONSS.EXE	"Added by the CWS-F TROJAN!"
X	cybansos	cyban.exe	"Added by the TATERF-V WORM!"
N	Data LifeGuard LifeLine Lite installer	DLGLI.EXE	"Backweb installer - see here"
X	DefensaAntiMalware	pgs.exe	"DefensaAntiMalware
X	Defense Center	defcnt.exe	"Defense Center rogue security software - not recommended
X	DefenseNetSurfage	GDC.exe	"DefenseNetSurfage rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
?	DellTransferAgent	TransferAgent.exe	"Found on Dell computers. What does it do and is it required?"
X	DeluxeCommunications	Dxc.exe	"Deluxe Communications adware - successor to SurfSideKick"
X	Device Management	wnsystem.exe	"Added by the AGOBOT-LH WORM!"
U	Dialgo SDK	PhoneAnswer.exe	"Dialgo Wave Modem ActiveX - ""Telephone Answering Machine for scripting your own professional call center business scripts using a voice modem. Features Caller-ID
U	Dimension	Dimension.exe	"Dimension - a program which lets you customize MSN messenger such as adding animated and coloured nicknames
U	Dimension4	d4.exe	"Dimension 4 - network time synchronization freeware - starts-up
X	Dinst	dinst.exe	"IMIServer/IEPlugin adware"
X	Disk Essensial Tools	detsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
?	Dixons Insert Detect	InsDetect.exe	"Part of Dixons Picture Suite. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
X	Dm Hr	lpns.exe	"Added by the IRCBOT.WORM.61673 WORM!"
X	DNS	mc-58-12-0000080.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-58-12-0000093.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-110-12-0000079.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-58-12-0000120.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-58-12-0000140.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	[worm filename]	"Added by the BCKDR-CQG BACKDOOR!"
X	DNS Config service	win32.exe	"Added by the RBOT-TL WORM!"
X	Dns Resolver	dnsrslve.exe	"Added by the RBOT-WS WORM!"
X	DNS Service	dnsresolver.exe	"Added by the RBOT-PQ WORM!"
X	DNS Service	dnssvc.exe	"Added by the DELBOT-Z WORM!"
?	DNS2GoClient	dns2goclient.exe	"DNS2Go is a Domain Name System that will make your computer accessible anytime
N	DNS7reminder	Ereg.exe Ereg.ini	"Registration reminder for versions of Nuance (ScanSoft) Dragon NaturallySpeaking"
X	DnsCache	Wscript.exe dns_cache.vbs	"Added by the AUTORUN-AWI WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""dns_cache.vbs"" file is located in %System%"
X	DNSCacheBoost	dnsping.exe	"Added by the DNSBUST-A TROJAN!"
X	dnscleaner	dnscleaner.exe	"CoolWebSearch parasite variant"
X	DNSE	DNSE.exe	"Part of rogue security tools
X	Domain Name Resolve Service	dnsresolver.exe	"Added by the KIMAN.A WORM!"
X	downs	downs.exe	"Added by the BCKDR-MNR TROJAN!"
Y	DPCProxyLoadOnStartup	dpcstart.exe	"DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access"
X	dpnsvr32	dpnsvr32.exe	"Added by the AOLPASS-B TROJAN!"
U	DriveIcons	DriveIcon.exe	"Drive Icons from Realtek - shows a specific icon for each card type for their card reader controllers"
?	DSSSGENS	dssagens.exe	"??"
?	Duane Reade Insert Detect	InsDetect.exe	"Part of Duane Read Picture Suite & Digital Image Pack. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
X	Duwee wong Cerbon	Cirebons.exe	"Added by the BHARAT.A WORM!"
X	Dynamic Dns Binary	dynitora.exe	"Added by the RBOT-WT WORM!"
X	Dynamic Dns Binary	CMD16.EXE	"Added by the RBOT-XM WORM!"
X	Dynamic Dns Binary	winxp34.exe	"Added by a variant of the RBOT WORM!"
X	Dynamic Dns Binary	WinHelpcfn.exe	"Added by a variant of the RBOT WORM!"
U	DynDNS Updater	DynDNS.exe	"Dynamic DNS IP address updater tool
N	DynDNS-Updater Traytool	ddutray.exe	"DynDNS updater tray icon - allows easy configuration of the Dynamic DNSSM service. Can be run manually"
X	DynHttp Dns Binary	dynizari.exe	"Added by a variant of the RBOT WORM!"
U	DynSite	DynSite.exe	"DynSite - dynamic DNS client
?	Eac_rnvdl	ANTIVIRUS_INSTALL.EXE	"??"
U	eanthology_install.exe	eanthology_install.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
?	ENSApServer2_0	APSERVER.EXE	"Intel AnyPoint Wireless II Home Network related. Now discontinued. What does it do and is it required?"
?	ENSMIX32.EXE	ENSMIX32.EXE	"Sound card driver. Is it required?"
U	EnsoniqMixer	starter.exe	"Puts the Ensoniq mixer in system tray. From Ensoniq Technologies ""Our mixer is a critical part of the soundcard as it fixes sound problems and replaces the MS mixer which can no longer be used"". If you find you don't need it - try one of the solutions on this special page. Similar to Creative PCI Audio Configuration Utility"
X	ExFilter	"Rundll32.exe [path] cdnspie.dll	ExecFilter"
X	explorer	Yinstall.exe	"PurityScan/Clickspring adware"
X	exporet	winset.exe	"Added by the QQPASS-I TROJAN!"
U	ExtraDNS	ExtraDNS.exe	"ExtraDNS - DNS configuration tool"
?	f23mxins	f23mxins	"Related to the now discontinued ATI Fire GL3 graphics card. What does it do and is it required?"
X	f2install.exe	f2install.exe	"Added by the IEFEAT-I TROJAN!"
X	Fen Startups	fensvc32.exe	"Added by the RANDEX.CCF WORM!"
X	Flash_Player_Install	ying.exe	"Constructor VC2000 malware"
U	Fortis Secure Layer Config	cseinst.exe	Fortis Bank Home Banking part. Installed during the installation of the software necessary to run the Home Banking. According to Fortis Bank this will not in any way be harmful to the system or relay system information
X	freinst	pgs.exe	"Part of the AVSystemCare rogue security software and other members of this family. See here for more examples"
?	FridaysInHellInstaller	FridaysInHellInstaller.exe	"??"
Y	frxmxins	frxmxins.exe	ATI 3D Studio MAX/VIZ driver
U	FtLnSOP_setup	FtLnSOP.exe	Fujitsu scanner utility
X	Generic Host Process for Win32 Services	winsvc.exe	"Added by the SDBOT-O WORM!"
X	Generic Host Process for Win32 Services	winsvc32.exe	"Added by the SDBOT-P WORM!"
X	genserv path	sdqdqg.exe	"Added by the SDBOT-RF WORM!"
X	german.exe	winsystems.exe	"Added by the BAGLEDl-AE TROJAN!"
X	Go!Zilla Monster Downloads	Go.exe	Download manager for resuming downloads and choosing multiple download locations. Advertising spyware
U	Goldensoft_MndlSvr	MndlSvr.exe	"Goldensoft CD Ghost related - turns a computer into a 200X-speed CD-ROM tower. Working from the hard drive
?	GSISETUP	[path] GsiInst.exe INSTALL [path] V205Res 13	"BT Voyager ADSL modem related - what does it do and is it required?"
X	guarnset	guarnset.exe	"Adlogix adware"
U	Hardware Sensors Monitor	hmonitor.exe	Utility to monitor fan speed and temperatures - similar to Motherboard Monitor. Only required if you're concerned about your system temperature - typically for "overclocked" systems
X	Hbinst	Hbinst.exe	"Hotbar adware"
X	hhtnsn	rnxntup.exe	"Added by a variant of the ORCU.B TROJAN!"
X	Hot Inside	Hottest Story Ever.exe	"Added by the BHARAT.A WORM!"
X	Hotbar	Hbinst.exe	"Hotbar adware"
U	HP Instant Support	matcli.exe	""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	Hrn_qtv	hrnsvc32.exe	"Added by the SDBOT-AET WORM!"
U	HSTrans	hstrans.exe	"Homescan Internet Transporter - part of ACNielson Homescan. Recognizes when the ACNielsen Homescan Scanner is attached to the computer and allows it to transmit scanner information to ACNielsen"
Y	HWinst	N/A	For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out
X	Hyper Start	instantmsgrs.exe	"Added by the RBOT-NH WORM!"
X	I am not Ranky. I am eTunnel!	winsys.exe	Added by an unidentified WORM or TROJAN!
N	Iconsaver	Iconsaver.exe	"IconSaver is a desktop icon manager"
X	IE Menu Extension toolbar	rundll32.exe [path] tbextn.dll DllShowTB	"Topconverting.com/180Search ""IEMenuExtension"" toolbar. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	IE6	winsnt.exe	"Added by the RBOT-GOV WORM!"
X	IEWinserv	winserv.exe	"Added by the BANKER-MY TROJAN!"
X	IExplorerService	WinSock.exe	"Added by the AGENT.KIU TROJAN!"
X	IISADMINS	systems.exe	"Added by the AGOBOT.U WORM!"
U	IJNetworkScanUtility	CNMNSUT.EXE	Network utility available for some Canon scanners and multifunction devices. Allows the device to see computers on a network and those computers running the utility to control scanning via the Control Panel on the scanner - which saves you having to run back and forth between the scanner and your computer
N	Image Transfer	SonyTray.exe	Sony Image Transfer software provides direct image transfer from your digital camera to a PC - can be started manually
U	ImScInst	ImScInst.exe	"Microsoft's Input Method Editor which is used to both display and enable the input of characters from East Asian and Right-to-left (e.g. Arabic) languages in e-mails
U	ImScInst.exe	ImScInst.exe	"Microsoft's Input Method Editor which is used to both display and enable the input of characters from East Asian and Right-to-left (e.g. Arabic) languages in e-mails
X	imwinsrvc	acpmonsrv.exe	"Added by the SLAPER.E TROJAN!"
X	Initial Page	install.exe	EasySearch browser hijack installer
?	insCOA5	insCOA5.exe	"??"
X	Insider	Insider.exe	"Added by the AGENT.KMC TROJAN!"
U	InstaAlert	InstaAlert.exe	"""Kayako InstaAlert allows you to receive realtime alerts whenever a ticket gets updated under the assigned departments. The application displays popups as and when the tickets are created or replied to allowing you to answer your customer requests and issues promptly"""
X	Instafinder	instafinder.exe	"TopSearch.D adware"
X	InstaFinderK	InstaFinderK inst.exe	"InstaFinder adware"
X	Install	Install.exe	"Added by the BANCBAN-HG TROJAN!"
X	Install part II	updates.exe	"Added by the RELFEERWORM!"
?	Install Pending Files	sifxinst.exe	"Uninstall program for Lanovation's Prism Deploy and Prism Pack adminstrators software deployement tools. For specific information see here. Is it required?"
x	install32	install32.exe	"Added by the NUCLEAR.DG BACKDOOR!"
N	InstallAurealDemos	InstallAurealDemos.js	Used to initialize the Aureal A3D demos InstallShield wizard
U	InstallBuddy	Ibtna.exe	"InstallBuddy - automatically translates and installs your desktop documents
X	InstallCleaner	InstallCleaner.exe	"Added by the ANYHOMB.F TROJAN!"
X	Installed shell32.dll	Office.exe...	"Added by the LOVGATE.AO WORM!"
X	Installed shell32.dll	Office.exe	"Added by the LOVGATE.E WORM!"
X	Installer	dial.exe	"Malware - detected by Kaspersky as the AGENT.MM TROJAN!"
?	InstallNAIProduct	SETUP.EXE	"Could be related to Network Associates Inc who own the McAfee VirusScan product amongst others. This was found in a directory called "VSC". Could it be an installation that failed and "SETUP.EXE" was left to run at startup as an error?"
X	InstallProgram	[path to trojan]	"Added by the AGENT-HHU TROJAN!"
X	InstallProvider	newsoftware2007install.exe	"Part of WinAntiVirusPro 2007 and Privacy Protector rogue security software (and possibly others) - not recommended"
X	Installs SP2	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are located in %System%\qpalsp"
X	Installs SP4	[path] repcale.exe [path] p0rd.exe	"Added by the RANDON-AK WORM! Both files are located in %System%\ekrlgc"
U	Installstub	installstub.exe	"Tool for Outlook and Outlook Express from Plaxo for organising and keeping contacts organised and updated and providing online access to your contacts and access from PDA or mobile phone"
X	Instance 001	[path to worm]	"Added by the ALASROU-A WORM!"
X	Instant Access	"rundll32.exe EGDHTML_1023.dll	InstantAccess"
X	Instant Access	"rundll32.exe eg_auth_****.dll	InstantAccess [**** = digits]"
X	Instant Access	"rundll32.exe EGCOMLIB_****.dll	InstantAccess [**** = digits]"
X	Instant Access	"rundll32.exe EGCOMSERVICE_****.dll	InstantAccess [**** = digits]"
X	Instant Access	"rundll32.exe p2esocks_****.dll	InstantAccess [**** = digits]"
X	Instant Access	mwsrvacc.exe	"InstantAccess premium rate adult content dialer"
X	Instant Access	linewsrv.exe	"InstantAccess premium rate adult content dialer variant"
X	Instant Buzz Daemon	IBDaemon.exe	"Instant Buzz adware"
X	Instant Messenger Service	imservice.exe	"Detected by Kaspersky as the HEUR TROJAN!"
X	instant messengers	instantmsgtr.exe	"Added by the AGOBOT-PC BACKDOOR!"
N	Instant Update Center	reminder.exe	"Event reminder for calendar dates
U	Instant Wireless Configuration Utility	WUSB11cfg.exe	"Utility used by the LINKSYS LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
U	Instant Wireless Configuration Utility	WPC11Cfg.exe	"Utility used by the LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
N	InstantAccess	INSTAN~1.EXE	From TextBridge Pro 9.0 OCR scanner software. Available via Start -> Programs
U	InstantDrive	InstantDrive.exe	"Pinnacle Systems (ex VOB) InstantDrive - creates a virtual CD-ROM drive on the computer's hard drive. Part of InstantCD/DVD burning software"
X	InstantPleasure	instantpleasure.exe	Adult content dialler
X	InstantPleasureXXX	instantpleasurexxx.exe	Adult content dialler
N	InstantTray	PCLETray.exe	"Pinnacle InstantCD/DVD disc creation software. Tray icon enabling a pop-up menu that lets you call up any of Instant CD/DVD's tools with one click. Can be started manually"
X	instit	instit.bat	"Added by the OPASERV.H WORM!"
X	instit	INSTIT.BAT	"Added by the OPASERV.K WORM!"
?	InstUtlR.exe	InstUtlR.exe	"??"
X	InSysSecure	InSysSecure.exe	"InSysSecure rogue security software - not recommended
U	Intel File Transfer	xfr.exe	Part of Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicating between the core server and managed clients
?	Intense Registry Service	IntEdReg.exe /CHECK	"Intense Educational Ltd - Language Office Software. Is it required?"
X	internct	WinSocks5.exe	"Added by the GRAYBIRD.F TROJAN!"
X	internet	winsas32.exe	"Added by a variant of the SDBOT WORM!"
X	Internet	wins.exe	"Added by the RBOT.AAYF WORM!"
U	Internet Answering Machine	IAMNET~1.EXE	"From Callwave. It offers a free utility to monitor your incoming phonecalls if you only have a single telephone line for internet access"
U	Internet Answering Machine	IAM.exe	"From Callwave - offers a free utility to monitor your incoming phonecalls if you only have a single telephone line for internet access"
X	Internet Loader1	MSInstall61.exe	"Added by the KWBOT.B WORM!"
N	Intervideo WinScheduler	WinScheduler.exe	"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
N	Intervideo WinScheduler	SchSvr.exe	"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
U	Iomega Disk Icons	IMGICON.EXE	"Displays Iomega icons in Explorer/My Computer
U	Iomega Drive Icons	IMGICON.EXE	"Displays Iomega icons in Explorer/My Computer
N	Iomega Startup Options	IMGSTART.EXE	"Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs"
X	IPC Spool Manager	winspec.exe	"Added by the SDBOT-BLU WORM!"
N	IPInSightLAN 01	IPClient.exe	"IP Insight is a Quality of Service monitor and diagnostic tool that isn't required - see here for more information. Included with services from BellSouth
N	IPInSightMonitor 01	IPMon32.exe	"IP Insight is a Quality of Service monitor and diagnostic tool that isn't required - see here for more information. Included with services from BellSouth
Y	IPinst	N/A	For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out
X	IpWins	ipwins.exe	"IPWins adware"
X	ist service uninstall	[random filename]	"ISTBar adware related"
X	istinstall zazzer.exe	istinstall zazzer.exe	Unidentified adware downloader/installer
?	Jessops Insert Detect	InsDetect.exe	"Part of Jessops Picture Suite. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
U	JMB36X IDE Setup	JMInsIDE.exe	"JMB36x series IDE (or Parallel ATA) configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers"
U	JMB36X IDE Setup	xInsIDE.exe	"JMB36x series IDE (or Parallel ATA) configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers. This is normally located in %Windir%\RaidTool"
X	Jnskdfmf9eldfd	csrssc.exe	"Added by the AGENT.EBC TROJAN!"
X	KavRuns	Windll.exe	"Added by the TRYNOMA TROJAN!"
X	KernelCheck	winser.exe	"Added by the TSPY_LMIR.SL TROJAN!"
N	Kodak Batch Transfer	pezdow1.exe	Part of "Kodak Picture Easy" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC
N	Kodak Picture Easy *.* Batch Transfer	PezDownload.exe	"Part of ""Kodak Picture Easy"" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC. *.* represents the version"
N	Kodak Picture Transfer Software	pts.exe	Looks for Kodak camera connection and media insertion. Available via Start -> Programs
U	ktchnsnk	ktchnsnk.exe	HP program found with the Office Jet 500/600/700 series which initializes the Office Jet manager each time the computer is booted up or rebooted
U	LanSpeed2	LanSpeed2.exe	Monitors any traffic that is using a LAN adapter (Ethernet or Token ring network card)
Y	LASTinst	N/A	For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out
N	LicCrtl	runservice.exe	"Part of the eLicense Copy Protection scheme employed by some software and games. When this service is not running
X	License Manager	license_manager.exe	"MediaPipe peer-to-peer file swapping program also reported as a hijacker"
X	Live-Help	lmns.exe	"Added by the RBOT-GHE WORM!"
X	loadwin	winset.exe	"Added by the QQPASS-I TROJAN!"
X	loadwin	winsys.exe	"Added by the QQPASS-J TROJAN!"
N	Logiciel de transfert d'images KODAK	pts.exe	Looks for Kodak camera connection and media insertion. Available via Start -> Programs
Y	Logitech	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	LogitechCommunicationsManager	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	LogitechRegisterVideoApplications	InstallHelper.exe	Entry added when you install versions of the Logitech QuickCam webcam software and used to register video applications that can use the webcam on the first reboot after installing the software
U	LogitechVideo[inspector]	InstallHelper.exe	Entry added when you install versions of the Logitech QuickCam webcam software and used to monitor and register video applications that can use the webcam. It isn't normally running but you could disable it and re-enable it before you install supported applications
U	LogMeIn GUI	LogMeInSystray.exe	"RemotelyAnywhere is a remote administration and remote control solution for Windows. It allows access to the host computer via the network (the LAN
X	Logonsara	csrss.exe	"Added by the BRONTOK-BS WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
U	LogonStudio	logonstudio.exe	"WinCustomize LogonStudio - "Allows Windows XP users to edit
Y	Look 'n' Stop	looknstop.exe	"Look 'n' Stop personal firewall"
X	LowVersionSupport	[filename]	"Added by the LASTRAS TROJAN!"
X	lspins	igps.exe	"Detected by Kaspersky as the VB.KC TROJAN!"
X	LTM2	winscan.exe	"Added by the LITMUS-B TROJAN!"
X	LTM2	msns6	"Added by the LITMUS.C TROJAN!"
N	Lwinst Run Profiler	lwtest.exe	Logitech Wingman Profiler for the Logitech joysticks. Available via Start -> Programs
?	lycosInside	Lyc_SysTray.exe	"Lycos eMail related - what does it do and is it required?"
?	M Player Post Installer	postinstallm.exe	"??"
X	M3Development_WhenUSave_Installer	M3Development_WhenUSave_Installer.exe	"WhenU.Save adware"
N	MacLicense	MacLic.exe	"Part of Conversions Plus from DataViz - allowing PC and MAC owners to share disks"
N	MagicalUnInstall	MagicalUnInstall.exe	"Ashampoo® Magical UnInstall from Ashampoo GmbH & Co. KG - which monitors each new program installation
N	MagUninstall	MagicalUnInstall.exe	"Ashampoo® Magical UnInstall from Ashampoo GmbH & Co. KG - which monitors each new program installation
X	MainStart	svcmfte32.exe	"Added by the STINX-A TROJAN!"
X	Malware Defense	mdefense.exe	"Malware Defense rogue security software - not recommended
X	MatrixScreenSaver	mss.exe	Unidentified malware
X	MbarInstall	[random filename]	"Mirar adware"
X	mbssm32	monstu.exe	"Detected by AVG as the AGENT.CNM TROJAN - see here"
X	Mcafee Anti Scan	NortonScn.exe	"Added by a variant of the RBOT WORM!"
Y	McAfee Application Installer	mcappins.exe	Used by older versions of McAfee internet security related products to clean up installation files that are no longer required once the product is installed. This entry will normally only appear once the product has been installed before the system is rebooted
U	McAfee.InstantUpdate.Monitor	RuLaunch.exe	"Instant Updater for McAfee's VirusScan
Y	McAfeeVirusScanService	Avsynmgr.exe	"From McAfee VirusScan version 5.x. Runs VirusScan System Tray (Vsstat.exe)
Y	mcappins	mcappins.exe	Used by older versions of McAfee internet security related products to clean up installation files that are no longer required once the product is installed. This entry will normally only appear once the product has been installed before the system is rebooted
X	MDN	MDNS.exe	"Added by the SPYBOT.JPB WORM!"
X	MDNS	service.exe	"Mirar adware variant"
X	Media Transfer Protocals	msstc.exe	"Added by a variant of the IRCBOT TROJAN!"
U	MediaButtons	MediaButtons.exe	"Supports the eject button on the front on the Dell Studio Hybrid desktop. If disabled
U	Mediafour Mac Volume Notifications	MACVNTFY.EXE	"Part of MacDrive 6 CrossStripe Edition from Mediafour Corporation - ""a perfect way to share files between Mac OS and Windows."" Unlike the standard version of MacDrive 7
X	MediaLoads Installer	dw.exe	"Medialoads adware"
U	MegaPanel	HSTrans.exe	"Homescan Internet Transporter - part of ACNielson Homescan. Recognizes when the ACNielsen Homescan Scanner is attached to the computer and allows it to transmit scanner information to ACNielsen"
U	MemMonster	memmnstr.exe	"MemMonster - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
N	MGA_CD_Install	mgasetup.exe	Matrox Millennium video driver. Not required once drivers installed
X	Mi7sft sdce	MNSQ.exe	"Added by the RBOT.DMU WORM!"
X	Micosoft Data Core	runservice.exe	"Added by the IRCBOT.BK WORM!"
X	Microft Update 32	winssx.exe	"Added by the RBOT-AQS WORM!"
X	Microsoft	WinSecUp.exe	"Added by the RBOT-GPL WORM!"
X	Microsoft	install.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft	winsys32.exe	"Added by the RBOT-GSQ WORM!"
X	Microsoft (R) Windows Network Security Management Service	nsms.exe	"Added by the RANKY.LC TROJAN!"
X	Microsoft Ansti Update	msie.exe	"Added by the RBOT-LE WORM!"
X	Microsoft AOL Instant Messenger	MSAOL32.exe	"Added by the RBOT-AAI WORM!"
X	Microsoft CSRSS Service	nsmscrs.exe	"Added by the RBOT-BPT WORM!"
X	Microsoft Debug Manager Console	mdm32.exe	"Added by the AGOBOT-AQ WORM!"
X	Microsoft Disk Scanner	scansdisk.exe	"Added by the WOOTBOT.DT WORM!"
X	Microsoft DLL Extensions	SystemDll.exe	"Added by the RBOT-ADV WORM!"
X	Microsoft DLL Verifier	wns.exe	"Added by the SPYBOT-LA WORM!"
X	Microsoft DNS Host Resolution	hostres.exe	"Added by the AGOBOT-MK BACKDOOR!"
X	Microsoft DNS Query	msdns.exe	"Added by the AGENT-BS TROJAN!"
X	Microsoft DNSx	mdnex.exe	"Added by the DELBOT-AI WORM!"
X	Microsoft Install Shield Services	rundll64	"Added by the RBOT-FSH WORM!"
X	Microsoft Installshield	nundll32.exe	"Added by the AGOBOT-AHZ WORM!"
X	Microsoft Instant Messenger	msngmsngr32.exe	"Added by the SPYBOTER.GEN TROJAN!"
X	Microsoft Intrenet Explorer	cnsg.pif	"Added by the RBOT-ARO WORM!"
X	Microsoft IT Update	winsyst32.exe	"Added by the RBOT-FC WORM!"
X	Microsoft Java Virtual Machine	winscr32.exe	"Added by a variant of the WOOTBOT WORM!"
X	Microsoft Logins	winlogins.exe	"Added by the SPYBOT.BCZ WORM!"
X	Microsoft Management Console	lssas.exe	"EasySearch adware"
X	Microsoft Management Console	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Microsoft Management Console	lssas1.exe	"Added by the DLOADR-AWD TROJAN!"
X	Microsoft MSN Messenger	msnmnsgr.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft MSN Services	msnsm.exe	"Added by the RBOT.ARV BACKDOOR!"
X	Microsoft msnseru	msnseru.exe	"Added by the RBOT-APB WORM!"
X	Microsoft MsnST	msnst32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Office	msoicons.exe	"Added by the RBOT-ZI WORM! - NOTE - do no confuse with the legitimate Msoicons.exe file described here. The latter wil not be listed among your startups!"
X	Microsoft Opeions	IEXwe.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft SDKP3	mswinsdq.exe	"Added by the RBOT-ARY WORM!"
X	Microsoft Security	winService.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Security Management	winserv.exe	"Added by the RBOT-MJ WORM!"
X	Microsoft Security Monitor Process	mnsmp.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Security Monitor Process	winsys32.exe	"Added by the VIRUT.N VIRUS!"
X	Microsoft Security Monitor Process	winsyss32.exe	"Added by the RBOT.AEU BACKDOOR!"
X	Microsoft Security Pansasagers	dgkztsqgn.exe	"Added by the RBOT-BBJ WORM!"
X	Microsoft Server Applacations	msnmsg.exe	"Added by the AGOBOT.BBM WORM!"
X	Microsoft Server Applacations	wuauct1.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Server Applacations	lsasss.exe	"Added by the RBOT-AQQ WORM!"
X	Microsoft Server Applacations	Q8See.exe	"Added by the SPYBOT.GEN3 TROJAN!"
X	Microsoft Server Applacations	cli.exe	"Added by the RBOT-GAQ WORM!"
X	Microsoft Service	winsvc.exe	"Added by the SPYBOT-DB WORM!"
X	Microsoft Service	winspl.exe	"Spyman spyware"
X	Microsoft Service Information	msnservices.exe	"Added by the RBOT.ID WORM!"
X	Microsoft Service Manager	winsvc.exe	"Added by a variant of the RBOT WORM! See here"
X	Microsoft Sinsup	odjiwjf.exe	"Added by the RBOT-DN WORM!"
X	Microsoft Sound Technology	winsound.exe	"Added by the RBOT-AGG WORM!"
X	Microsoft SpAr Service	winsbsd32.exe	"Added by the RBOT-RN WORM!"
X	Microsoft Standard Executions Library	win32lib.exe	"Added by the RBOT-AUK WORM!"
X	Microsoft standard protector	winsocks5.exe	Added by the SMALL.CF TROJAN!
X	Microsoft Stuff you know	winslogin.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Svchost local services	msnserver.exe	"Added by the RBOT-GPM WORM!"
X	Microsoft System Monitor	monsys.exe	"Added by the IRCBOT-YV TROJAN!"
X	Microsoft System Service	dnservice.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Transfer File Server	mtfs.exe	"Added by the RBOT.AFE WORM!"
X	Microsoft Update	winsys32.exe	"Added by the RBOT.BD WORM!"
X	Microsoft Update	winscv.exe	"Added by the RBOT-BH WORM!"
X	Microsoft Update	winsys.exe	"Added by the RBOT-GV WORM!"
X	Microsoft Update	winsyst.exe	"Added by the RBOT-DL WORM!"
X	Microsoft Update 32	winssx.exe	"Added by the RBOT-ARW WORM!"
X	Microsoft Update Machine	winss.exe	"Added by the RBOT.JU WORM!"
X	Microsoft Update Machine	wins32.exe	"Added by the RBOT.EZ WORM!"
X	Microsoft Update Machine	windns.exe	"Added by the RBOT.EF WORM!"
X	Microsoft Update Machine	MSOICONS.EXE	"Added by the RBOT.AWS WORM! Note - do no confuse with the legitimate Msoicons.exe file described here. The latter should not normally figure in Msconfig/Startup!"
X	Microsoft Update Machine	WINSVC32.EXE	"Added by the RBOT.CU WORM!"
X	Microsoft Updater	winsys32.exe	"Added by the RBOT.RL WORM!"
X	Microsoft Updater	msconsole.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft usnsvc Service	usnsvc.exe	"Added by a variant of the KOBOT-C WORM!"
X	MicroSoft Wind0ws Updater	winsupdater.exe	"Added by a variant of the RBOT WORM!"
X	MicroSoft Window Updater	winsupdater.exe	"Added by the RBOT-ZZ WORM!"
U	Microsoft Windows Media Player Network Sharing Service Configuration Application	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	Microsoft Windows Service	winsys.exe	"Added by the RBOT-ADP WORM!"
X	Microsoft Windows Service Pack	winspkn.exe	"Added by the RBOT-AYD WORM!"
X	Microsoft Windows Socketx32 Services	winsockx32.exe	"Added by the RBOT-FWT WORM!"
X	Microsoft Windows System Service Manager	winsvc.exe	"Added by the SPYBOT.LR WORM!"
X	Microsoft Windows Update	mnswinsx.exe	"Added by the RBOT-AWH WORM!"
X	Microsoft Windows Update XP64	Lcuninst.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows WinSaSS Management	winsass.exe	"Added by the RBOT-APW WORM!"
X	Microsoft Winedows WinServ	iPodFix.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft WINGS32 Protocol	WinSGR32.exe	"Added by the RBOT-APU WORM!"
X	Microsoft Winsock	mswinsck.exe	"Added by the RBOT-ANK WORM!"
X	Microsoft Winsock Service	msusvc.exe	"Added by the RBOT-ANS WORM!"
X	Microsoft Winsock Wrapper	ws2_32s.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Winsock32 System	winsock32.exe	"Added by the SPYBOT.AKKC WORM!"
X	Microsoft WinSound	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft winsupdater	WINSUPDATER.EXE	"Added by the SPYBOTER.FB BACKDOOR!"
X	Microsoft Xp Systems loader	winsystem32xp.exe	"Added by the KELVIR.W WORM!"
X	MicrosoftMessenger	msnserv.exe	"Added by the DARKER.M WORM!"
U	Microsoft® Windows® Operating System	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	Micsorosft Security Center	wcnsfty.exe	"Added by the RBOT-AHU WORM!"
X	Mircosoft DNS Service	svchost.exe	"Added by the IRCBOT-AK TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
?	MM Install	setup.exe	"Possibly Money Manager from Moneysoft?"
X	mnklins	mnklins.exe	"VX2.Transponder parasite updater/installer related"
U	MNS	MNS.exe	"Mobile Net Switch enables you to use your computer on more then one network with the click of a button. It allows you to automatically select the correct drive mappings
X	mnsa	mnso.exe	"Added by the LINEAG-AI TROJAN!"
X	mnsvc	mnsvc.exe	"Added by the AUTOUPDER TROJAN!"
X	mnsvcsp	mnsvcsp.exe	"Added by an unidentified VIRUS
U	Mobipocket Reader Notifications	readernotify.exe	"Part of Mobipocket Reader - ""Store all your eBooks
X	MONPluginSrIvcs	n3monap23.exe	"Added by a variant of the RBOT WORM!"
N	Monstersoundtray	Freectrl.exe	Diamond Multimedia sound card control panel
X	mousedrive.exe	instantmsgrs.exe	"Added by the FORBOT-ER WORM!"
N	Movielink Manager Uninstall	msvcmm32.exe	"Auto-update for Movielink - internet movie rental System Tray access"
U	MPEO	Csinsm32.exe	Automatic logging of installs from Norton CleanSweep - available via Start -> Programs
X	MS Domain Name Server Deamon	MSDNSD32.exe	"Added by the RBOT-CMZ WORM!"
X	MS Domain Name System	MSWDNS32.exe	"Added by the RBOT-GKY WORM!"
?	MS management console	mms.exe	"Suspicious as the legitimate ""Microsoft Management Console"" is ""mmc.exe"" and not ""mms.exe"" and doesn't normally run at startup"
X	MS MSN Menssenger 7.0	MSMSN7.exe	"Added by the RBOT-ACA WORM!"
X	MS MSN Menssenger 7.0	MSEXPORT.exe	"Added by a variant of the SDBOT WORM!"
X	MS Service Drivers	winscv.exe	"Added by the SDBOT-COG WORM!"
X	Ms sock for Windows NT	winser.exe	"Added by a variant of the SDBOT WORM!"
X	MS Unix Binary	msmq2inst.exe	"Added by the RBOT-YF WORM!"
X	MS Unix Binary	msnq3insller.exe	"Added by the RBOT.GXH BACKDOOR!"
X	Ms Update WinServices NT/XP	winservnt32.exe	"Added by the VANEBOT-G WORM!"
X	MS WINS Binary	ign32.pif	"Added by the RBOT-ASB WORM!"
X	MS Winsock	msws2_32.exe	"Added by the AKBOT-A TROJAN!"
X	msconfig	wins.exe	"Added by the RBOT.PF WORM!"
X	MSControl31	winnsyst.exe	"Added by the RBOT.CFY WORM!"
X	MSInstall	smvss.exe	"Added by the DEDLER-G TROJAN!"
X	MSN	ctfmoons.exe	"Added by the SPYBOT.HI WORM!"
X	msn	msnsvc.exe	"Added by a variant of the SDBOT WORM!"
X	MSN	msnsgr.exe	Added by an unidentified WORM or TROJAN!
X	MSN	install.exe	"Added by the AGENT-GDO TROJAN!"
X	MSN File Sharing Wizard	msnsharewiz.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Msn Messeng	windns.exe	"Added by a variant of the RBOT WORM!"
X	MSN Messenger Service Startup	msnservice.exe	"Added by a variant of the RBOT WORM! See here"
X	Msn Messenger update	msnservice.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	MSN Security Agent	msnsecure.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	MSN Serv	msmsnserv.exe	"Added by the IRCBOT.AVF BACKDOOR!"
X	Msn Serv	msnserv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	MSN Server	msmsnserver.exe	"Added by the IRCBOT.AUS BACKDOOR!"
X	MSN Service	msnsvc.exe	"Added by the SLENFBOT.EG WORM!"
X	MSN Service!	msnservice.exe	"Added by a variant of the RBOT WORM! See here"
X	MSN Servicer	msnsrv.exe	"Added by a variant of the IRCBOT TROJAN!"
X	MSN Servicer	msnservicer.exe	"Added by the SLENFBOT.PQ WORM!"
X	MSN Services	msnserv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	MSN Services	msnservice.exe	"Added by the IMPARD-A TROJAN!"
X	MSN Settings	msnsettings.exe	"Added by the IRCBOT.AWH BACKDOOR!"
X	MSN Settings Manager	msnsetmg.exe	"Added by an unidentified WORM or TROJAN! See here"
X	MSN Software	msnsoftware.exe	"Added by the IRCBOT.AWD BACKDOOR!"
X	Msn Startup	msnstartup.exe	"Added by the ARBOT.AA WORM!"
X	Msn Updater	msnplugins.exe	"Added by the RBOT-HS WORM!"
X	MSN User Server	msnserver.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	MSN User Server!	msnservices.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	MSN User Service	msnsvc.exe	"Added by the SLENFBOT.NS WORM!"
X	MSN User Service!	msnserv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	MSN User Svc	msnusnsvc.exe	"Added by the IRCBOT.AVV BACKDOOR!"
X	MSNPluginSrIvcs	n3vasap23.exe	"Added by a variant of the RBOT WORM!"
X	MSNPluginSrvcs	p6.exe	"Added by the SDBOT.AKJ or RBOT-VJ WORMS!"
X	MSNPluginSrvcs	sagate.exe	"Added by the SDBOT.AKJ WORM!"
X	MSNS PLUS XP2	msdupd.exe	"Added by the RBOT-BCE WORM!"
X	msnsched2	msnsched2.exe	"Added by the SPYBOT.NNT WORM!"
X	msnscr.exe	msnscr.exe	"Added by the CERTIF-P TROJAN!"
X	MSNService	MSNService.exe	"Added by the CARPET.C WORM!"
X	msnsgs	msnsgs.exe	"Added by the CHEUKO-B TROJAN!"
X	msnshed	msnshed.exe	"Added by the RBOT-YN WORM!"
X	msnsmgr	MsnMsr.exe	"Added by the LOONY-N TROJAN!"
N	msnsyslog	msnappm.exe	"Related to Messenger Applications. When you uninstall the trial version the msnappm keeps saying (You have xx days left) this is adware and it very annoying"
X	MSNSysRestore	pc32.exe	Added by a variant of the MASTAK VIRUS!
X	MSOleath32	winss.exe	"Added by the KATHER TROJAN!"
X	MSPluginSrvc	p3.exe	"Added by the RBOT-WV WORM!"
U	MSPY2002	ImScInst.exe	"Microsoft's Input Method Editor which is used to both display and enable the input of characters from East Asian and Right-to-left (e.g. Arabic) languages in e-mails
X	MSWinSrv	MSWinSrv.exe	"Added by the MTRON TROJAN!"
X	MSWinSrv32	MSWinSrv32.exe	"Added by the MTRON-B TROJAN!"
X	Multimedia extensions	mservice.exe	"EasySearch adware"
X	Multimedia extensions	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Multimedia extensions	mservice1.exe	"Added by the DLOADR-AWD TROJAN!"
U	MyEmoticons	MYEMOTICONS.EXE	"MyEmoticons from Persona Ltd - add icons (emoticons) to your E-mail"
U	mynsw	wntsrv.exe	"Net Screen Watcher surveillance software. Uninstall this software unless you put it there yourself"
X	MyVBApp	install.exe	"Detected as Generic Downloader.s by McAfee
X	Name Server	mswins.exe	"Added by a variant of the SDBOT WORM!"
X	NAV Agent	winsnav.vbs	"Added by the ANPES WORM!"
X	NAV Auto Protect	dnsserv.exe	"Added by a variant of the SDBOT WORM!"
N	NB Windows Patterns	WINDBKGND.EXE	"Part of McAfee Nuts & Bolts. With Background Patterns
X	NBInstall	MBDownloader_876919.exe	"Added by the MIRAR_D TROJAN!"
N	NCS_SS	Csinsm32.exe	Same as CleanSweep Smart Sweep-Internet Sweep
X	NDAv	csnss.exe	"Added by the SERFLOG.C WORM!"
X	NDplDeamon	nstask32.exe	"Added by the RANDEX.E WORM!"
N	NeroNETTrayIcon	NNServiceCtrl.exe	"System tray access to NeroNET - Ahead Software's network-capable extension of their CD/DVD burning program. NeroNET allows a burner to be shared across a network"
X	NetApp	winserv.exe	"Added by the SHADOWTHIEF TROJAN!"
X	Netbeans	netbeans.exe	"Added by the DELBOT-R WORM!"
U	Netscape	InstallService.exe	Related to Netscape installation
U	NetShow Powerpoint Helper	NSPPTHLP.EXE	"If disabled
N	NetStat Live	Nsl.exe	"AnalogX NetStat Live - TCP/IP protocol monitor which can be used to see your exact throughput on both incoming and outgoing data"
X	Network Access	winssh.exe	"Added by a variant of the SDBOT WORM!"
X	Network Connections	internat.exe	"Added by the VB-ZD TROJAN!"
X	Network Security	NSecurity.exe	"Added by the IRCBOT.AAV WORM!"
X	Network Translation System Service	ntss.exe	"Added by the UNPDOOR TROJAN!"
N	nForce Tray Options	sstray.exe	nVidia nForce Taskbar Utility - quick access to the nForce2 "Sound Storm" control panel and related utilitys
X	NI.USYP	SysProtectScannerInstall.exe	"Installer for the SysProtect rogue security software
X	NI.UWA6P_0001_N56M1001	WinAntiVirusPro2006Installer.exe	"Installer for the WinAntiVirus Pro 2006 rogue security software"
X	NI.UWA6P_0001_N69M0303	WinAntiVirusPro2006Installer[1].exe	"Installer for the WinAntiVirus Pro 2006 rogue security software"
X	NI.UWA6P_0001_N73M1004	WinAntiVirusPro2006FreeInstall.exe	"Installer for the WinAntiVirus Pro 2006 rogue security software"
X	NI.UWA6P_0001_N91M1807	WinAntiVirusPro2006FreeInstall[1].exe	"Installer for the WinAntiVirus Pro 2006 rogue security software"
X	NI.UWA7P_0001_N91M0809	WinAntiVirusPro2007FreeInstall.exe	"Installer for the WinAntiVirus Pro 2007 rogue security software - see here"
X	NI.UWAS5LP_0001_0811	UWAS5LP_0001_0811NetInstaller.exe	"Installer for the WinAntiSpyware 2005 rogue spyware remover - not recommended
X	NI.UWAS6_0001_N57M1312	WinAntiSpyware2006FreeInstall.exe	"Installer for the WinAntiSpyware 2006 rogue spyware remover - not recommended
X	NI.UWAS6_0001_N68M2301	UWAS6_0001_N68M2301NetInstaller.exe	"Installer for the WinAntiSpyware 2006 rogue spyware remover - not recommended
X	NI.UWFX5	UWFX5NetInstaller.exe	"WinFixer 2005 web installer - ""foistware""
X	NI.UWFX5	WinFixer2005ScannerInstall.exe	"WinFixer 2005 web installer - ""foistware""
X	NI.UWFX5LP_0001_0614	UWFX5LP_0001_0614NetInstaller.exe	"WinFixer 2005 web installer - ""foistware""
X	NI.UWFX5LP_0001_0715	UWFX5LP_0001_0715NetInstaller.exe	"WinFixer 2005 web installer - ""foistware""
X	NI.UWFX5LP_0001_0802	UWFX5LP_0001_0802NetInstaller.exe	"WinFixer 2005 web installer - ""foistware""
X	NI.UWFX5LP_0001_0803	UWFX5LP_0001_0803NetInstaller.exe	"WinFixer 2005 web installer - ""foistware""
X	NI.UWFX5T	UWFX5TNetInstaller.exe	"Added by the DOWNLDR-BO TROJAN!"
X	NI.UWFX5V_0001_0802	UWFX5V_0001_0802NetInstaller.exe	"WinFixer 2005 web installer - ""foistware""
X	NI.UWFX6_0001_N68M2301	UWFX6_0001_N68M2301NetInstaller.exe	"WinFixer 2006 web installer - ""foistware""
X	Nielsen NetRatings	insight.exe	"NetRatings Premeter spyware"
X	NLS MonBoard	NSBARD.EXE	"Added by the SPYBOT.T TROJAN!"
U	NNSvc	nnsvc.exe	"Net Nanny internet filter. Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
X	NoDNS	NoDNS.exe	"Added by the CLICKER.WI TROJAN!"
Y	Nokia Software Updater	nsu_ui_client.exe	"Utility that only runs once after installing the Nokia Software Updater which is used to update the operating system (or firmware) for selected Nokia mobile devices"
U	NokKernel install	Nok_install.exe	"Installer for the NokNet Workstation Monitor surveillance software. Uninstall this software unless you put it there yourself"
U	Norton Program Scheduler	nsched32.exe	"Installed on a Windows system where the Windows Task Scheduler isn't used as part of the OS (Win95
X	Norton Update	winsvc.exe	"Added by the AGOBOT.ALP WORM!"
X	Norton Updater	winset.exe	"Added by a variant of the SPYBOT WORM!"
X	Nortons AV SYSTEM	scvchost.exe	"Added by a variant of the RBOT WORM!"
X	Nortons AVS Systems	arse.exe	"Added by the RBOT.AWY WORM!"
X	nortonsantivirus	ccEvtMngr.exe	"Added by the HZDOOR-A TROJAN!"
X	NS	ns.exe	"Added by the AGOBOT-HS WORM!"
X	NSCheck	NSCHECK.EXE	"MarketScore parasite - ActiveX control used to download premium-rate dialers"
X	nscntrl	nscntrl.exe	"Added by the DLOAD-DC TROJAN!"
X	nsdcmd services	nsdcmdav.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	nsdcmd vid process	nsdcmdwin.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	nsdlua	nsdlua.exe	All-In-One Telcom - adult content dialler
X	nsdriver	nssys32.exe	"NetShagg adware"
X	nse	nse.exe	"Added by the AGOBOT-ML WORM!"
U	Nsengine	Nsengine.exe	"Scheduling engine of NovaSTOR Backup Service. Only required if scheduling is enabled and wanted - see here"
U	NSHelper	aexnsinstallhelper.exe	Altiris Express Notification Server Install helper - monitors integrity of the installation
U	NSK	NSK.exe	"Ardakey keystroke logger/monitoring program - remove unless you installed it yourself!"
U	NSRKey	NSRTray.exe	"System Tray access to Norton Save & Restore backup utility"
X	nssysconf	[random filename]	"Added by the VIVIA.A TROJAN!"
X	nstat	netstat.exe	Adult content dialler
X	NSupdate	NSupdate.exe	"Added by the Dial/Laet-B premium rate dialer!"
Y	nsu_ui_client	nsu_ui_client.exe	"Utility that only runs once after installing the Nokia Software Updater which is used to update the operating system (or firmware) for selected Nokia mobile devices"
Y	nsu_ui_client.exe	nsu_ui_client.exe	"Utility that only runs once after installing the Nokia Software Updater which is used to update the operating system (or firmware) for selected Nokia mobile devices"
X	Nsv	nsvsvc.exe	"Delfin Promulgate adware"
X	nsvcin	n20050308.exe	"Delfin Media Viewer adware related"
X	Nsvdr	nsvdr.exe	Adult content dialler
U	nsys	nsys.exe	"NetSpy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	nsys32	nsys32.exe	"Added by the AGOBOT-SU WORM!"
N	NSystemMonitor	Symmon.exe	Norton Uninstall Deluxe - monitors programs being installed and logs them for removing later. Available via Start -> Programs for manual logging
X	NTSF MICROSOFT SYSTEM	winsis32.exe	"Added by a variant of the RBOT WORM!"
X	ntupdate	dnsvc.exe	"Added by the SDBOT-TC WORM!"
U	NUAgentInstallPath	NU_Install.exe	"Installer associated with Chily Employee Activity Monitoring surveillance software. Uninstall this software unless you put it there yourself"
X	odnex	odbns.exe	"Added by the AGENT-MPM TROJAN!"
X	odnexy	odbnsy.exe	"Added by the VESLORUKI.DWJ TROJAN!"
Y	OneCareUI	winssnotify.exe	"System Tray access to and notifications from Windows Live OneCare - now superseded by Microsoft Security Essentials. ""OneCare helps keep your PC safe and secure while making your life easier. From virus scanning and file backups
X	OnSrvr	OnSrvr.exe	OnWebMedia adware
X	Open Site	opnste.exe	"OpenSite adware"
X	Open Site	opensite.exe	"OpenSite adware"
U	OpenDNS Update	OpenDNS Updater.exe	"Updater for OpenDNS which ""is a free service that works for networks of all sizes
N	Operations Typhoon Rising Registration	NOVG.EXE	"Joint Operations registration reminder"
U	OSSelectorReinstall	oss_reinstall.exe	"Related to Acronis Disk Director Suite"
X	OutLooks	InSane.exe	"Added by the SWOOP TROJAN!"
X	overinstall	pgs.exe	"Part of VirtualPCGuard
U	Panasonic Communications Utility	Mfpscdl.exe	"Port manager for Panasonic Panafax fax_machines"
Y	PAVFNSVR	PavFnSvr.exe	"Part of Panda Antivirus and Internet Security"
U	PCMagInstaback2	InstaBack.exe	"
X	PersonSecurity	psecurity.exe	"Personal Security rogue security software - not recommended
X	PingTimeout Institution	pingchek.exe	"Added by the SDBOT-VY WORM!"
X	PingTimeout Institution	internal.exe	"Added by the SDBOT.BMH WORM!"
U	PlainSight Desktop Calendar	Calendar.exe	"PlainSight Desktop Calendar by Desksware - ""It can display Microsoft® Outlook® data
X	Pmedia	winsrvc.exe	"Internet marketing sofware from Permissioned Media Inc as used in E-Card FriendGreetings foistware - see here. Treated by Trend as the FRIENDGRT.B WORM!"
U	PNSetup	PNSetup.exe	"PopNot - pop-up killer"
X	Pofatch	nstrue.exe	"Added by the RANDEX.Z WORM!"
X	PopularScreensaversWallpaper	"rundll32 [path] F3SCRCTR.DLL	LES"
U	PP2000 Instaupdate	PPInupdt.exe	Protector Plus anti-virus software - instant update program for virus data updates. Not required if you regularly update virus data manually
X	PreInstall Windows	[path] repcale.exe [path] beird.exe	"Added by a variant of the RANDON.AN WORM! Both files are located in %System%\detr"
Y	PrevxOne	PXConsole.exe	"Prevx intrusion prevention software"
X	Print Scheduler	usnsvc.exe	"Added by a variant of the KOBOT-C WORM!"
X	PrnShare	Wscript.exe prn_share.vbs	"Added by the AUTORUN-AWI WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""prn_share.vbs"" file is located in %System%"
U	PrnSys Executable	PrnSys.exe	"Print screen utility bundled with some HP printer software - not required
X	Protections	ProtEX32.exe	"Ultimate SecuritySuite rogue malware remover - not recommended
N	PSIWin2.3 Connection Server	Psconsv.exe	Allows connectivity between a PC and a Psion device. Access can be gained from the Desktop or Start -> Programs
U	Purge with Current Options	PURGEIE.EXE	"PurgeIE from Assistance & Resources for Computing
U	PVUnInst1	PVUnInst1.exe	"Privacy View - privacy software that ensures that all your private computer files
U	PyroTrans	pyrobatchftp.exe	"""PyroBatchFTP lets you transfer files to/from FTP/SFTP servers in an automatic and unattended way through a simple to learn batch/script language"""
Y	QCDriverInstaller	Lqdsw.exe	"Launches the camera driver setup wizard on the first reboot after installing Logitech's ClickSmart
?	Queensla	Queensla.exe	"??"
N	QuickenSEMessage	Qsemsg.exe	Quicken option
X	QuickInstallPack	QuickInstallPack.exe	"Installed and used by rogue security products such as Cleaner2009
X	QuickInstallPack	CLN_2009FreeInstall.exe	"Installed and used by rogue security products such as Cleaner2009
U	QWS3270 Sessions	sessions.exe	QWS3270 Secure terminal emulation software
X	Random Interface Network Manager	rinsv.exe	"Added by the DELBOT-L WORM!"
X	Rapdatybs	ravseteyns.exe	"Added by the PWS-ACP TROJAN!"
Y	Raptor Mobile	vpnservices.exe	"Symantec VPN Client used to connect to corporate networks. If unchecked
X	Real-Tens	Real-Tens.exe	"DownloadWare adware"
X	Reg Service	winsy.exe	"Added by a variant of the SPYBOT WORM!"
X	Reg Service	winslogon.exe	"Added by the AGOBOT-SC WORM!"
X	Regkey for autostart	winservice.exe	"Added by the RBOT-NU WORM!"
X	Regptmens	REGPTMENS.EXE	"Added by the BANCOS-ED TROJAN!"
X	relinson	cmdno.exe	"Added by the DROPPER-PS TROJAN!"
N	reminder-ScanSoft Product Registration	remind32.exe	Registration reminder for ScanSoft products such as PaperPort
X	Remote Procedure Call	winsysrpc.exe	"Added by the SDBOT-PS WORM!"
?	RjLyraInstaller	setup.exe	"??"
X	RPCInstall	[path to trojan]	"Added by the AGENT-DQM TROJAN!"
X	RpcxWindows Extensions	rpcxwinex.exe	"Added by the RBOT.ACP WORM!"
X	rtkernsw	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	run	winsys32.exe	"Added by the DELF.CP BACKDOOR!"
X	runs	run.exe	"Added by the RBOT-BWF WORM!"
X	RunSearvices	tread.exe	IESearchToolbar parasite. Identified by Ewido Security Suite (Ewido is now part of AVG Technologies) as the DELF.LF TROJAN!
X	RunServices	runsvc32.exe	"Added by the AGOBOT.QJ WORM!"
X	runservices	services.exe	"Identified as a variant of the SMALL.QO TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	runsql	runsql.exe	"Added by the DELF.ZWK TROJAN!"
X	runSubvalues	[path to file]	"Added by the DLOADER-QY TROJAN!"
X	runsvc	runsvc.exe	"Added by the SMALL-CF TROJAN!"
U	RunSysd32	RunSysd32.exe	DesktopShield2000 by Stéphane Groleau. Locks the desktop at bootup so that users cannot bypass the Windows screensaver password. Only essential if using the program and is an optional setting. It can be disabled from within
N	SafeInstall.exe	SAFEIN~1.EXE	Monitors a download and ensures an newer version of a file isn't replaced by an older one
X	SANS Service	sansv.exe	"Added by the VANEBOT-AH WORM!"
U	SansaDispatch	SansaDispatch.exe	"Sansa Updater - ""The Sansa Updater is an application that checks for the latest firmware updates then downloads and installs the firmware to your Sansa device"""
X	SaveDefense	SaveDefense.exe	"SaveDefense rogue security software - not recommended
X	SBI	install_sbd_**.exe	"Installer for a number of rogue security products and error fixing tools - where ** represents a 2 letter language code
Y	Scanner File Utility	NsCatCom.exe	"Kycocera Mita network copier/printer/scanner process to dump scanned documents onto a workstation"
X	ScanRegistry	nsrvnt.exe	"Added by the NERTE TROJAN! Not to be confused with the real ScanRegistry - which is a vital Windows file. This version has the executable as nsrvnt.exe not scanregw.exe"
N	ScanSoft OmniPage SE 4.0-reminder	Ereg.exe ereg.ini	"Registration reminder for Ominpage SE version 4 from Scansoft (now Nuance)"
N	ScanSoft PaperPort 7 Registration Reminder	NAVBrowser.EXE	"Registration reminder for PaperPort 7 from Scansoft (now Nuance)"
N	ScanSoft PDF Professional 4-reminder	Ereg.exe Ereg.ini	"Registration reminder for PDF Converter Professional version 4 from Scansoft (now Nuance)"
X	ScanSpyware	Scanner.exe	"ScanSpyware rogue security software - not recommended
X	ScanSpyware v3.2	Scanner.exe	"ScanSpyware rogue security software - not recommended
X	ScanSpyware v3.5	Scanner.exe	"ScanSpyware rogue security software - not recommended
U	ScanSys32	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
X	Screen Saver	scrnsaver.scr	"Added by the RBOT-AGP WORM!"
X	ScreenSaverPlus	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	SDAv	csnss.exe	"Added by the SERFLOG.C WORM!"
X	SdScans**	stup_tmp.#32	"Added by the SDSCAN.A TROJAN - where ** are random upper case letters"
X	secure socket layer	wins32a.exe	"Added by an IRCBOT TROJAN!"
U	SecurePCSolutionsBootCheck	BootCheck.exe	"1 Click Fixer PLUS from Secure PC Solutions ""takes the guesswork out of locating and solving problems in the Windows registry"""
X	SemanticInsight	SemanticInsight.exe	"RXToolbar adware. Software that displays pop-up/pop-under advertisements when the primary user interface is not visible"
U	Sensiva	Sensiva.exe	"Symbol Commander makes the use of your PC
X	Server Runtime Error	unsec.exe	"Added by the SDBOT-DFA WORM!"
X	Service Client	winsvcli.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Service Monitor	msnserve.exe	"Added by the SPYBOT.YQW WORM!"
X	Service Monitor	csnss.exe	"Added by the RBOT.EEH WORM!"
X	Service Process	winset.exe	"Added by a variant of the SPYBOT WORM!"
X	Services	windns.exe	"Added by a variant of the RBOT WORM!"
X	Services Start2	odcwinst.exe	"Added by the PYSKE-D WORM!"
U	SfWinStartInfo	sfWinStartupInfo.exe	SFIRM32 Online Banking software
U	sginst	sginst.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
X	shccde	winssled.exe	"Added by the BUZUS.CQMU TROJAN!"
X	Shell	Explorer.exe winsys32.exe	"Added by the DELF.CP BACKDOOR! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The ""winsys32.exe"" file is located in %Windir%"
X	Shell Extension	spollsv.exe	"Added by the LOVGATE.Z WORM!"
X	SiS Dns	dnssvc.exe	"Added by the DLOADER-UE TROJAN!"
X	sis32	winsos.exe	"Added by the QQPASS.IA WORM!"
X	SmansaApp	winlogon.exe	"Added by the ROMARIO-A WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	smcserv	winsrv.exe	"Added by the AGOBOT-OU WORM!"
N	Smileycons	smileycons.exe	"Smileycons - free smileys
X	SMSERIALWORKERSTARTER	winstrse.exe	"Added by the RENOS.IC TROJAN! Installed with the SpyBurner spyware remover - which is not recommended
X	SNInstall	[various filenames]	"Spy Sheriff/SpywareNO malware
N	Snsicon	Snsicon.exe	Launches a screensaver program from Second Nature
X	SNSS.EXE	SNSS.EXE	"Nunci premium rate dialer"
Y	SOFTinst	N/A	For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out
X	Sound System	WinSound1.exe	"Added by an unidentified VIRUS
X	Spam Blocker for Outlook Express	SBInst.exe	"Hotbar adware"
U	Spyware Nuker Installer	SpywareNukerInstaller.exe	"Spyware remover by TrekBlue. Previously not recommended but the latest version was delisted here"
X	SpywareGuard	deinst_qfe001.exe	"Added by a variant of the Win32.Small TROJAN! - Do NOT confuse with the legitimate SpywareGuard application"
X	SQInstaller	SQInstaller.exe	"Xupiter SQWire toolbar related. Use Spybot S&D
X	sqservices	wins32.exe	"Added by the PROGENT-B TROJAN!"
U	SRUUninstall	msiexec.exe	Symantec Network Driver Update - part of LiveUpdate
X	Srv32 spool service	runsrv32.exe	"Topantispyware.com malware - detected by Kaspersky as the SPYRE.B TROJAN!"
X	ssate.exe	winsys.exe	"Added by the BEAGLE.K WORM!"
X	ssgrate.exe	winsystems.exe	"Added by the BAGLEDL-J TROJAN!"
X	SSK Service	winssk32.exe	"Added by the SOBIG.E WORM!"
X	Startup	WinlogonStartup	Unidentified malware
Y	Startup Scan	Sensor.EXE	"AntiVirus Quick Heal - scheduling agent"
X	stcinstaller	id53.exe	"Added by the SCTHOUGHT.L TROJAN!"
U	StopSignSsTsMon	"sstsmon.dll	VerifyStatus"
U	StopSignStatus	stopsinfo.dll	"eAcceleration Stop-Sign security software related. Previously not recommended
X	STV	winscrne.exe	"Added by a variant of the SDBOT WORM!"
X	Sun Java Console for Windows NT & XP	jconsole.exe	"Added by the VANEBOT-C WORM!"
Y	SunProtectionServer	SunProtectionServer.exe	"CounterSpy antispyware software"
Y	SunServer	SunServer.exe	"CounterSpy antispyware software"
U	SurfinGuard Pro	winsfcm.exe	"SurfinGuard Pro from Finjan - internet protection software
X	svwin32	unninst32.exe	"Added by the AGOBOT-NF WORM!"
X	Sygate Personal Firewall	MSNSRV32.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personal Firewall	wins.exe	"Added by the RBOT.AOB WORM!"
X	Symantec Antivirus professional	dyndns.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	f0dns.exe	"Added by the FORBOT-GT WORM!"
X	Symantec Antivirus professional	flushdns.exe	"Added by a variant of the FORBOT WORM!"
X	syncman	winsync.exe	"Added by the MANCSYN-A TROJAN!"
?	SynSetup	SynTP.tmp RunOnce.exe	"Probably associated Synaptics touchpads on laptops as for the SynTPEnh and SynTPLpr entries but what does it do and is it required?"
X	Sysnet	snuninst.exe	Unidentified adware
U	SysSense	SysSense.exe	"""SysSense is your personal desktop Google AdSense monitor. It keeps your current Google AdSense information in the Windows system tray"". Google AdSense account required"
X	System Applications Profile	sap.exe	"Added by the RBOT-QF WORM!"
X	System Document Application	wins.exe	"Added by the SDBOT.AUB WORM!"
X	System Document Application	winsvc32.exe	"Added by the SDBOT-VA WORM!"
X	System Failure Statistic	cnstat.exe	"Added by the RBOT-LF WORM!"
X	System Manager	winsrv32.exe	Added by an unidentified WORM or TROJAN!
X	System Manager Updates	winsvc.exe	"Added by the AGOBOT.AEM WORM!"
X	System Security Updaters	vsmons.exe	"Added by the RBOT-OW WORM!"
X	System Update2	winspool.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Updates	winsci.exe	"Added by a variant of the RBOT WORM!"
X	System Updates Manager	winserv32.exe	"Added by the AGOBOT-AGA WORM!"
X	Systemboot	msnsngr.exe	"Added by a variant of the RBOT WORM!"
X	systemdll.dll	winsys32.exe	"Added by the DELF.CP BACKDOOR!"
U	SystemService	nsserver.exe	"NiceSpy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	systrans	[path to trojan]	"Added by the STARTPA-GZ TROJAN!"
X	systrasx	CONSOLES.EXE	"Added by the SDBOT-NW WORM!"
U	T3Console	T3Console.exe	"Related to T3 Security Suite - prevents unauthorized or inappropriate access to your PC and data"
X	TClock.exe	tclock_install.exe	"TClock - distributed and installed without user permission by other rogue software or malware. TClock contains no uninstall facility through Windows. As TClock is of dubious origin and usefulness
X	TCP Monitoring	LanNSvc.exe	"Added by the RANDEX.AAS WORM!"
?	Tesco Insert Detect	InsDetect.exe	"Part of Tesco Picture Suite. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
N	Textbridge Instant Access OCR	telepath.exe	"TextBridge from Nuance (was Scansoft). OCR (optical character recognition) software for scanning documents into popular editing applications. Available via Start -> Programs"
?	TheMainStart	N/A	"??"
U	ThinkVantage Access Connections	ACTray.exe	"System Tray access to the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
U	ThinkVantage Access Connections	ACWLIcon.exe	"Part of the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
X	this free	winsyst.exe	"Added by the MADAG.A WORM!"
U	TivoTransfer	TivoTransfer.exe	"Tivo Transfer Service. TiVo Desktop is an easy-to-use application that lets you publish and share digital music
U	TMA distribution	cfinst.exe	Part of Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicating between the core server and managed clients
X	ToolbarInstall	MirarSetup.exe	"Mirar adware"
X	Transaction Tasker	stdhost.exe	"Added by the SDBOT.HNK BACKDOOR!"
N	Transcode360	Transcode360Tray.exe	"Designed for WinXP Media Center Edition 2005 and the Xbox 360
U	Transparent	TransparentW.exe	"Utility to turn desktop icon text backgrounds transparent. The last letter defines the icon text color: D= as desktop
U	Transparent	TransparentD.exe	"Utility to turn desktop icon text backgrounds transparent. The last letter defines the icon text color: D= as desktop
U	Transparent	TransparentB.exe	"Utility to turn desktop icon text backgrounds transparent. The last letter defines the icon text color: D= as desktop
U	TransparentIcons	tranicon.exe	"A Tweak-XP component (only in the registered version)
U	transtask	transtask.exe	"A Tweak-XP component
X	transys	"rundll32.exe transys.dll	start"
X	Trojan	TrojanS_P.exe	"Added by the AGENT-CQ TROJAN!"
U	TrojanScanner	Trjscan.exe	"Trojan Remover from Simply Super Software. Scans for an removes trojan viruses where anti-virus software may have not detected or removed"
X	TrojansFilter	pgs.exe	"TrojansFilter rogue security software - not recommended. A member of the AVSystemCare family"
X	TrojansFiltre	pgs.exe	"TrojansFiltre
U	TrojanShield	Init.exe	"TrojanShield"
U	TrojanShield Protector	Port.exe	"TrojanShield anti-hacker/anti-trojan software"
X	TrojanSimulator	TSServ.exe	"Trojan Simulator security risk which simulates a trojan infection and may be used to verify whether a virus scanner can properly detect the file"
U	TSClientMSIUninstaller	tscuinst.vbs	"Related to Terminal Services Client Remote Desktop Connection Software from Microsoft"
X	Tsk Mng Hlp	wins32.exe	"Added by the AGOBOT-JB WORM!"
?	TSService	NSSERVICE.EXE	"??"
X	tvs_re	tvs_re_inst.exe	"BroadcastPC adware"
U	TVTunerLib	TVTLInstTool.exe	Related to Sony installer tool for Sony TV tuner library
X	uninstal	regsvr32 image.dll	"CoolWebSearch parasite variant. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The ""image.dll"" file is found in %System%"
X	Uninstall****	upd.exe	Adult content based screen saver where **** can be any number
N	UninstallAbility	uability.exe	"UninstallAbility free uninstaller"
X	UninstallHL	PreUninstallHL.exe	"LinkReplacer/FFinder adware"
X	UninstallQL	PreUninstallQL.exe	"LinkReplacer/FFinder adware"
X	Uninstall_TBPS	TBuninst.exe	"WebSearch Toolbar - HuntBar hijacker
X	UnSpyPC	UnSpyPC.exe	"UnSpyPC spyware remover - not recommended
X	Update Install	Schost.exe	"Added by the GAOBOT.AO WORM!"
X	UpdateCheck	winstall.exe	"Added by the SPYBOT-CY WORM!"
X	updateWins	systrey.exe	"Added by the RANDON WORM!"
X	UPNPService	WinSVCservice.exe	"Added by the AGOBOT.UN WORM!"
X	USB 2.0 Driver	Winsys32.exe	"Added by the AGOBOT-QM WORM!"
X	USB 2.0 Driver	winsystem.exe	"Added by the AGOBOT-QS WORM!"
Y	USB SECURITY DEVICE CoInstaller	JupitCo.exe	"ButterflyMedia USB Flash drive related - required for the password security feature to work"
N	USB2Check	PCLECoInst.dll	"Related to Pinnacle Systems Inc. CoInstaller - you can execute the USB2.0 interface check program (Usb2Check.exe file) to check if your system is a USB2.0 enabled system"
X	User Servicer	usnsrvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	User Sharing Manager	usnsharen.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	User Sharing Server	usnsrv.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	User Sharing Services	usnsvc.exe	"Added by a variant of the KOBOT-C WORM!"
X	User Sharing Wizard	usnshare.exe	"Added by the SLENFBOT.DF WORM!"
X	Userfile Sharing Serv	usnsrv.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Userfile Sharing Server	usnserv.exe	"Added by a variant of the IRCBOT TROJAN!"
X	usnsvc.exe	usnsvc.exe	"Added by the SPYBOT.AMD WORM!"
X	Ussi	wnscpit.exe	"PurityScan adware"
Y	UTILsInst	N/A	For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out
?	Verizon Custom Uninstall Tracking	InstallHelper.exe	"Verizon related installation tracker. What does it do and is it required?"
U	VerizonServicepoint.exe	VerizonServicepoint.exe	"Part of Verizon Online Support Manager"
U	Virtual Dimension	VirtualDimension.exe	"Virtual Dimension by Typz - ""a free
U	VirtualDimension.exe	VirtualDimension.exe	"Virtual Dimension by Typz - ""a free
X	VirusResponseLab2009	VirusResponseLab2009.exe	"VirusResponse Lab 2009 rogue security software - not recommended
X	VirusScanner	mnsys.exe	"Added by the SDBOT-AFQ WORM!"
X	VITAL BOOT PROCESS	taskmnsgr.exe	"Added by the Rbot-VY WORM!"
?	VMConsole.exe	VMConsole.exe	"Sony VAIO Media Console - installed on the VAIO Media Integrated Server PCs. What does it do and is it required?"
U	VOBID	InstantDrive.exe	"Pinnacle Systems (ex VOB) InstantDrive - creates a virtual CD-ROM drive on the computer's hard drive. Part of InstantCD/DVD burning software"
U	VoodooBanshee	"rundll32.exe 3DBBps.dll	BansheeLoadSettings"
X	W32PluginsDownloaderXMLHTTPSelfClearing7520	wiper.exe	"Added by the PROXYSER-M TROJAN!"
U	Watson Subscriber for SENS Network Notifications	dwtrig20.exe	"Used to launch Microsoft Error Reporting (DW20.exe) - if
X	WDNS SYSTEM	nibie.exe	"Added by the MYTOB-BY WORM!"
X	WDNS SYSTEM	skybotx.exe	"Added by the MYTOB-BY WORM!"
X	WDNS SYSTEM	wdns33.exe	"Added by the MYTOB-BY WORM!"
X	Web-cameinst	[path to trojan]	"Added by the RANCK-BP TROJAN!"
X	WebInstall	WebInstall.exe	ClipGenie adware downloader
X	WebInstall2	WebInstall.exe	ClipGenie adware downloader
X	Win Drivers SSL32	hpwsnnsbc.exe	"Added by the SPYBOT.MAR WORM!"
X	Win Security	winsecure.exe	"Added by the SLENFBOT.RD WORM!"
X	Win Security 360	WinSecurity360.exe	"Win Security 360 rogue security software - not recommended
X	Win Server	winserv.exe	"Added by the IMISERV.A TROJAN!"
X	Win Server Updt	winserver.exe	"Added by a variant of the IMISERV TROJAN!"
X	Win Sync montr	winsyncupx.exe	"Added by the RBOT.BYJ BACKDOOR!"
X	win32	winsrv32.exe	"Added by the ADUENT TROJAN! Acts as a hi-jacker redirecting to Surferbar.com and adult content sites"
X	win32	WinSetup.exe	"Added by the EVILBOT.B TROJAN!"
X	Win32	msnsrv.exe	"Added by a variant of the SDBOT WORM!"
X	Win32 Console	cmd.exe	"Added by the ABI.C WORM! Note - this is not the legitimate cmd.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Win32 Drivers	winlogons.exe	"Added by the FORBOT-FG WORM!"
X	Win32 exe file	winstr32.exe	"Added by a variant of the SPYBOT WORM!"
X	win32 internet server	winserver.exe	"Added by the DERMON-D TROJAN!"
X	Win32 SSL Driver	winssv.exe	"Added by the FORBOT-BH WORM!"
X	Win32 System Kernel	winservice.exe	"Added by the SDBOT.KIN WORM!"
X	win32 system server	winserver.exe	"Added by the DERMON-A TROJAN!"
X	Win32 USB2	wins32.exe	"Added by a variant of the RBOT WORM!"
X	Win32 USB2 Driver	winsnd32.exe	"Added by a variant of the SDBOT WORM!"
X	win98 DNS	wingrd.exe	"Added by a variant of the RBOT WORM!"
X	WinDLL (windns32.dll)	"rundll32.exe windns32.dll	start"
X	WinDNS	windns32.exe	"Added by the GAOBOT.WX WORM!"
X	Windowfdgfds DLL fgfdg Verifier	winsecure.exe	"Added by a variant of the RBOT WORM!"
X	WindowRegKey update	wins.exe	"Added by the SPYBOT.I WORM!"
X	Windows AdStatus	WinStat.exe	"Added by the BLESHARE!DR VIRUS!"
X	Windows applications server	SysShield.exe	"Added by the unregistered version of Personal Anti Malware rogue security software - not recommended
X	Windows Audio Control	ppnsvc.exe	"Added by the HAM TROJAN!"
X	Windows Config	wins.exe	"Added by the SPYBOT.JR WORM!"
X	Windows Console	wkssvc.exe	"Added by the SDBOT-DJX WORM!"
X	Windows Console Component	wrasvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Console Monitor	[path to worm]	"Added by the KEDEBE WORM!"
X	Windows Console Monitor	gcasAV32.exe	"Added by the KEDEBE-A WORM!"
X	Windows Console Norms	wnbsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Console Source	wnbsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Database	wiinsvc.exe	"Added by the AGOBOT-RU WORM!"
X	Windows DLL Services	winsvc32.exe	"Added by the RBOT-ZF WORM!"
X	Windows DNS	windns.exe	"Added by the SDBOT-XU WORM!"
X	Windows DNS Daemon	windnsd.exe	"Added by the WOOTBOT.AS WORM!"
X	Windows Domain Name Drivers	windns.exe	"Added by the FORBOT-EP WORM!"
X	Windows Essensials	mvnesc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Event Service	winserv.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Extensions for Win32	winprgs32.exe	"Added by the SDBOT.AFA WORM!"
X	Windows File Migration Wizard	HIMENSYST.EXE	"Added by the RBOT-EMO WORM!"
X	Windows Generic Services	winsvc32.exe	"Added by the AGOBOT-ZF BACKDOOR!"
X	Windows Genuine Validate	winservicessss.exe	"Added by the IRCBOT.UUI BACKDOOR!"
X	Windows Icons Manager	wicomgr.exe	"Added by the RBOT-AIF WORM!"
X	Windows Incontext	InSearch.exe	"PacerD_Media/Pacimedia.com/Z-Quest adware installer"
X	Windows Insecure	[path to worm]	"Added by the RBOT-FSM WORM!"
X	Windows installer	winstall.exe	"SpySheriff malware. For more information on registry key changes see SPYWAD-E"
X	Windows Installer	ntdll.exe	Added by an unidentified WORM or TROJAN!
X	Windows Installer 1	msnconfig.exe	"Added by the PURITYSCN.B TROJAN!"
X	Windows Instruction Services	winstruct32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Internet Protocol	deinst_qfe001.exe	Added by a variant of the Win32.Small TROJAN!
Y	Windows Live OneCare	winssnotify.exe	"System Tray access to and notifications from Windows Live OneCare - now superseded by Microsoft Security Essentials. ""OneCare helps keep your PC safe and secure while making your life easier. From virus scanning and file backups
X	Windows Loader	winServices.pif	"Detected by Kaspersky as the CARDSPY.D TROJAN!"
X	Windows Logical Connection	wcnsvc.exe	"Added by the VIRUT.AO VIRUS!"
X	Windows Management Instrumentation	mwd.exe	"Added by the GRAPS WORM!"
X	Windows Management Instrumentation	[path to file]	"Added by the QEDS-A WORM!"
X	Windows Management Instrumentations	winmg.exe	"Added by the GAOBOT.GW WORM!"
X	Windows Manager	winsrv.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
N	Windows Media Powerpoint Helper	NSPPTHLP.EXE	German software (comes with some Toshiba CD writers) that helps convert Powerpoint files to ASF (Streaming Media) files. Available via Start -> Programs
X	Windows Messanger Control Center	winsys.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Messenger	msnsmgs.exe	"Added by the RBOT-ANJ WORM!"
X	Windows Messenger Service	winsmsgr.exe	"Added by the RBOT-VW WORM!"
X	Windows NetStart Service	winsN2S.exe	"Added by the RBOT-ZX WORM!"
X	Windows NetStart Service2	winsN2S.exe	"Added by the RBOT-ABN WORM!"
X	Windows NetStart Service2	winsN2SD.exe	"Added by a variant of the RBOT WORM!"
X	Windows Network Session	nspsvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Networking	winsys32.exe	"Added by the GAOBOT.FL WORM!"
X	Windows NT Login Session Manager	WNSM.EXE	"Added by the RBOT.BIV WORM!"
X	Windows NT Service Name	winshock.exe	"Added by the RBOT-PK WORM!"
X	Windows Printing Driver	WinSpooler.exe	"Added by the ARCHIVARIUS series of WORMS!"
X	Windows Proffesional Security	WinSecure32.exe	"Added by the AGOBOT.VA WORM"
X	Windows Recovery Console	recovery.exe	"Added by the RANSOM.FD WORM!"
X	Windows Registers	winservicess.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Registry Name	winses.exe	"Added by the RBOT-ADB WORM!"
X	Windows Rescue System	winsto.exe	"Added by the SUURCH.CG TROJAN!"
X	Windows Rundll Center	msnsmgr.exe	"Added by the AGENT-LLB TROJAN!"
X	Windows Screensaver	Service.exe	"Added by the KELVIR.P WORM!"
X	WINDOWS SCREENSAVER	ssaver.scr	"Added by the SDBOT-YZ WORM!"
X	Windows Secure Connection	winsc.exe	"Added by the SDBOT.BTN WORM!"
X	Windows Secure Update	WinSecUp.exe	"Added by the RBOT-GCD WORM!"
X	Windows Secure Update	WinSecure.exe	"Added by the RBOT-GDO WORM!"
X	Windows Security	winscure.exe	"Added by the RBOT-BAF WORM!"
X	Windows Security Assistant	winsec.exe	"CoolWebSearch parasite variant"
X	Windows Security Manager	winsecurity.exe	"Added by the AGOBOT-KI WORM!"
X	Windows Security Manager	winsecure.exe	"Affilred adware"
X	Windows Security Tool	WinSecure.exe	"Added by the AGENT-GPY TROJAN!"
X	Windows ServeAd	WinServAd.exe	Windupdates adware variant
X	Windows Server	winserv.exe	"Added by the IRCBOT.AVM BACKDOOR!"
X	Windows Server!	winsvr.exe	"Added by the IRCBOT.AYC BACKDOOR!"
X	Windows Servic2	winsy.exe	"Added by the RBOT-AIA WORM!"
X	Windows Service	WINSVC.EXE	"Added by the SPYBOT-DH TROJAN!"
X	Windows Service Agent	win32wins.exe	"Added by the RBOT-LOL WORM!"
X	Windows Service help	winservices.exe	"Added by the DROPPER.TT TROJAN!"
X	Windows Service Supply	winsupply.exe	"Added by the SLENFBOT.CZ WORM!"
X	Windows Service Utitity	winsrvc.exe	"Added by the RBOT-ASI WORM!"
X	Windows Services	winsvc32.exe	"Added by the MYTOB-CB WORM!"
X	Windows Services	winsysdll.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services	winsyssrv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Socket Procedure	WinSock32.exe	"Added by the RBOT-FMX WORM!"
X	Windows Spool	winspool.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Spooler	winsplr.exe	"Added by the SHEUR.ANX TROJAN!"
X	Windows Spools SV	winsv.exe	"Added by the RBOT-AUQ WORM!"
X	Windows Sql Service For Windows 32 Bit	winsql32.exe	"Added by the FORBOT-FC WORM!"
X	Windows SRS Client	winsrs.exe	"Added by the RBOT-BXQ WORM!"
X	Windows SRT Client	winsrt.exe	"Added by the RBOT-BFR WORM!"
X	Windows SSH Client	winssh.exe	"Added by the RBOT-AXC WORM!"
X	Windows SSL File	winssv.exe	"Added by the WOOTBOT.CA WORM!"
X	Windows Startup	winsta~1.exe	"GoHip foistware"
X	Windows Startup	winstartup.exe	"GoHip foistware"
X	Windows Startup	Winsys32.exe	"Added by the RBOT.AAB WORM!"
U	Windows Supervisor	winspvr.exe	"Windows Supervisor surveillance software. Uninstall this software unless you put it there yourself"
X	WINDOWS SVC	winsvc.exe	"Added by the MYTOB-EY WORM!"
X	WINDOWS SYSTEM	wdns33.exe	"Added by the MYTOB-BY WORM!"
X	WINDOWS SYSTEM	winsvc32.exe	"Added by the MYTOB.HH WORM!"
X	Windows System	WINSYS.exe	"Added by the RBOT-AEF WORM!"
X	WINDOWS SYSTEM	winsys33.exe	"Added by the MYTOB.EK WORM!"
X	Windows System	winsys32.exe	"Added by the MYTOB-IS WORM!"
X	WINDOWS SYSTEM	winsvc.exe	"Added by the MYTOB.LM WORM!"
X	WINDOWS SYSTEM	mswins.exe	"Added by the MYTOB.DP WORM!"
X	Windows System 32	winsys_32.exe	"Added by the RBOT-FTR WORM!"
X	Windows System Configuration	WINSYS32.exe	"Added by the SDBOT.AXK WORM!"
X	WINDOWS SYSTEM Dns	windsns.exe	"Added by the MYTOB.EY WORM!"
X	WINDOWS SYSTEM DNSPOOL	hbmail.exe	"Added by the MYTOB.FW WORM!"
X	Windows System Guard	msns.exe	"Added by the DWNLDR-IGD TROJAN!"
X	Windows System Manager	winsystem.exe	"Added by the RBOT-AN WORM!"
X	Windows System Manager	winsysmgr.exe	"Added by the IRCBOT.BJG BACKDOOR!"
X	Windows System Manager Proc	winsmc.exe	"Added by the RBOT.JH WORM!"
X	Windows System Serivce	winserv.exe	"Added by the RBOT.ACA WORM!"
X	windows system service	winsock.exe	"Added by the RBOT-MR WORM!"
X	Windows System32	winsys32.exe	"Added by the SDBOT-AHS WORM!"
X	Windows Sz Host	winshvc.exe	"Added by a variant of the SDBOT WORM!"
X	Windows TaskManager Service	windns32.exe	"Added by the AGOBOT-JP WORM!"
X	Windows Time Service Diagnostic Tool	winscrvs.exe	"Added by the RBOT.FTV BACKDOOR!"
X	Windows UDP Control Center	installer.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows UDP Control Center	msnsmsgrs.exe	"Added by the PUSHBOT.MF WORM!"
X	Windows Update	msnwinsb.exe	"Added by the RBOT-AAH WORM!"
X	windows update	msnsever.exe	"Added by the RBOT-AHN WORM!"
X	Windows Update	msnsupdate.exe	"Added by the RBOT-AXS WORM!"
X	Windows Update	install.exe	"Added by the BANKER-IB TROJAN!"
X	Windows Update	usnsvc.exe	"Added by the KOBOT-C WORM!"
X	Windows Update	msnsa32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Update	winsc.exe	"Added by the BUZUS.RYI TROJAN!"
X	Windows Update 32	winlogons.exe	"Added by the FORBOT-FI WORM!"
X	Windows Update Checker	deinst_qfe001.exe	Added by a variant of the Win32.Small TROJAN!
X	Windows Update Checker	deinst_qfe002.exe	Added by a variant of the Win32.Small TROJAN!
X	Windows Update services	wins32svcs.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update System	mswins.exe	"Added by the IRCBOT.DN WORM!"
X	Windows Updates	w32dns.exe	"Added by the SDBOT-BFW WORM!"
X	Windows Video Drivers	videons32.exe	"Added by the GAOBOT.AZT WORM!"
X	Windows Video Drivers	VIDEONS3.EXE	"Added by the AGOBOT-KZ BACKDOOR!"
X	Windows Vista Transformation	IEXPLORE.exe	"Added by the FORBOT-GV WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows xp	Wins.exe	"Added by the RBOT.VH BACKDOOR!"
X	Windows32 Serivces	winser32.exe	"Added by the SPYBOT.AAF WORM!"
X	WindowsFileSystem	winsfs32.exe	"Added by the RBOT-FMQ WORM!"
X	WindowsFirewallSvc	winsvcup.exe	"Added by a variant of the SDBOT WORM!"
X	WindowsInstaller	[path to file]	"Added by the DEDLER-D TROJAN! The most common filenames seen are ""csmss.exe"" and ""csmrs.exe""
X	WindowsRegKey update	windns.exe	"Added by the RBOT.IE WORM!"
X	WindowsRegKey update	winsys.exe	"Added by the RBOT-JY WORM!"
X	WindowsRegKeys update	winsysi.exe	"Added by the SDBOT.WE WORM!"
U	WindowsTranslator	DWinTrsl.exe	"Delta Translator® English < > Portugese (Brazilian) version - ""an automatic
U	WindowsTranslator_Espanhol	DWinTrsl.exe	"Delta Translator® Spanish < > Portugese (Brazilian) version - ""an automatic
X	WindowsUpdatev4	w32gins.exe	"Added by an unidentified WORM or TROJAN! Located in the Root folder (C:\)
X	WindowsUpdatewinsec	winsec.exe	"Added by a variant of the AGENT-HZ TROJAN!"
X	Windows_Protect	winsystem.exe	"Added by a variant of the RBOT WORM!"
X	Window_Protect	winsi32.exe	"Added by a variant of the RBOT WORM!"
X	windtbs	winsysvc	"Added by the AGOBOT-NH WORM!"
X	winhelp	dns32.exe	"Added by a variant of the RBOT WORM!"
U	winlgn	winsplg.exe	"Related to the Sentry Parental Controls software"
X	winlogins.exe	winlogins.exe	"Added by the OPTIX.H BACKDOOR!"
X	WinMenssage	winmax.exe	"Added by the BANCOS.B TROJAN!"
X	WinMenssage	winmaxy.exe	"Added by the BANCOS TROJAN!"
X	winnsvc	msvc.exe	"Added by the PWS.O TROJAN!"
X	winnt DNS ident	wuamgrd32.exe	"Added by the RBOT-BAU WORM!"
X	winnt DNS ident	iexplorer.exe	"Added by a variant of the RBOT WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	winnt DNS ident	pidchk32.exe	"Added by the RBOT-ACY WORM!"
X	winnt DNS ident	windowxp.exe	"Added by a variant of the RBOT WORM!"
X	winnt DNS ident	Winupd32.exe	"Added by the RBOT.AVU WORM!"
X	winnt DNS ident	winupdate32.exe	"Added by a variant of the RBOT WORM!"
X	winnt DNS ident	wuamgrd33.exe	"Added by a variant of the RBOT WORM!"
X	Winnt DNS ident	windowsp.exe	"Added by the RBOT.BAL WORM!"
X	Winnt DNS ident	msnmsrg.exe	"Added by the RBOT.BVQ WORM!"
X	winroot	winsn.exe	"Added by the QQPASS.IA WORM!"
X	Wins Loader5	Gadu-Gadu.exe	"Added by a variant of the IRCBOT TROJAN! Note - doe not confuse with the Polish language Instant Messaging client also called Gadu-Gadu"
X	Wins Service Driver	winet.exe	"Added by the RBOT-APV WORM!"
X	Wins Update 32	services32.exe	"Added by the FORBOT-FN WORM!"
X	Wins32 Online	cfgpwnz.exe	"Added by the BROPIA.R WORM!"
X	WinScMngr	winsmc.exe	"Added by the SDBOT-BPZ WORM!"
X	WinSec	winsec16.exe	"Added by the AGOBOT.ZF WORM!"
X	winsecure	winsecure.exe	"Browser hijacker
X	WinSecure	[random].exe	"Added by the AGENT-LR TROJAN!"
X	Winsecure Antivirus	Secureantivirus.exe	"Added by a variant of the SPYBOT WORM!"
X	WinSecureAv	pgs.exe	"WinSecureAv rogue security software - not recommended
X	WinSecured32	ssmr.exe	"Added by a variant of the FORBOT WORM!"
X	WinSecurity	uninstall.exe	"Added by the SILLYFDC.BCJ WORM!"
X	Winserv	Winserv.ila	"Added by the NODMIN WORM!"
X	winserver	Server.txt.vbs	"Added by the DELTAD.A WORM!"
X	Winservice	winmain.exe	Adult content related malware
X	winservice	svchost.exe	"Added by the CVK BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""services"" sub-folder"
X	WinService	hosth.exe	"Added by the DWNLDR-FUX TROJAN!"
X	WinService	Ttt.exe	"Added by the MSNVB-D WORM!"
X	WinService	WinServ.exe	"Added by the SKOWOR-O WORM!"
U	WinService32	ssmgr.exe	"007 Spy Software - ""stealthy monitoring program which allows you to secretly track all activities of computer users and automatically deliver logs to you via Email or FTP"""
U	WinService32	svchost.exe	"007 Spy Software - ""stealthy monitoring program which allows you to secretly track all activities of computer users and automatically deliver logs to you via Email or FTP"""
X	WinServices	WinServices.exe	"Added by the YAHA.K or YAHA.M WORMS!"
X	winservices	bootvfy.exe	Added by an unidentified WORM or TROJAN!
X	winservit	cassl.exe	"Added by the RBOT.ASG WORM!"
X	winservn	winservn.exe	"PurityScan adware"
X	winservs	winservs.exe	"PurityScan adware"
X	WinSetBrowse	BasicUpdate.dll.vbs	"Added by the BISCUIT.A WORM!"
X	winsfc	winsfc.exe	"Added by the WISFC VIRUS!"
X	Winshell	remote.exe	"Added by the MYTOB.LJ WORM!"
X	winshell	windll32lib.exe	"Added by the BAGLE-DM WORM!"
?	Winshoe	wuadfdqr.exe	"Probably an unidentified VIRUS! Adds itself to 3 registry ""Run"" keys and prevents Task Manager being displayed. This is not the Winshoe IRC Client as the visitor did not have it installed"
X	winshost.exe	winshost.exe	"Added by the TOOSO WORM and variants!"
X	winshow	[path to trojan]	"Added by the VB-DXP TROJAN!"
X	WinShowUpdate	copy [path] winshow.new [path] winshow.dll	"Winshow parasiate related - from the ""RunOnce"" keys it replaces ""winshow.dll"" with a new version"
X	WinSig	NetXP.exe	"Added by the BANKER-FN TROJAN!"
X	WinSistem	Tunggul.vbs	"Added by the VBS.STEMCLOVER WORM!"
X	Winsk system Loader	winsk.exe	"Added by the AGOBOT-IZ WORM!"
X	winskype	winskype.exe	"Added by the BROGGER-C TROJAN!"
U	WinSL	WinSL.exe	"StarLogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	winsock	svch0st.exe	"Added by the SAGE-A WORM! Note - the filename has the digit 0 rather then the uppercase ""o"""
X	Winsock driver	winnt update.exe	"Added by the SPYBOT-DM TROJAN!"
X	Winsock driver	winnt64.exe	"Added by the SPYBOT-DR WORM!"
X	Winsock Driver	nvscv32.exe	"Added by the AGOBOT-FD WORM!"
X	Winsock Driver	scvhost.exe	"Added by the RBOT.AEU BACKDOOR!"
X	Winsock driver	win.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Winsock driver	tcpmngr.exe	"Added by the SPYBOT-CK WORM!"
X	Winsock driver	winupdate32.exe	"Added by the SPYBOT-JZ TROJAN!"
X	Winsock Startup	Main2.exe	"Added by a variant of the SDBOT WORM!"
X	winsock.client	winsock.exe	"Added by the DIABLO-M TROJAN!"
X	winsock2	netsvr.exe	"Added by the AGOBOT.LY WORM!"
X	Winsock2 dlls	W32DLL.EXE	"Added by the SPYBOT-CS BACKDOOR!"
X	Winsock2 driver	SDJOIJE.EXE	"Added by the SPYBOT.DR TROJAN!"
X	Winsock2 driver	MIRC32.exe	"Added by the SPYBUZZ TROJAN!"
X	Winsock2 driver	kgzgjkpcw.exe	"Added by the SDBOT.T TROJAN!"
X	Winsock2 driver	ZONEALARM.EXE	"Added by the SDBOT.T TROJAN! Note - ZONEALARM.EXE is not the valid Zone Labs firewall program"
X	Winsock2 driver	wincfg.scr	"Added by the SPYBOT-E TROJAN!"
X	Winsock2 driver	winupdate.exe	"Added by the SPYBOT-BX WORM!"
X	Winsock2 driver	SPOLSV.EXE	"Added by the SPYBOT-CM WORM!"
X	Winsock2 driver	[random filename]	"Added by members of the SPYBOT family of WORMS! Note - the random filename is located in %System%"
X	Winsock2 driver	sysreq.exe	"Added by the SPYBOT-CC WORM!"
X	Winsock2 driver	WUAUMQR.EXE	"Added by the SPYBOT-DP WORM!"
X	Winsock2 driver	wincfg.exe	"Added by the SPYBOT.CO WORM!"
X	Winsock2 driver	svchorsst.exe	"Added by the SPYBOT-EE WORM!"
X	Winsock2 driver	SYSTEM32.EXE	"Added by the SPYBOT-EG WORM!"
X	Winsock2 driver	dllcfg32.exe	"Added by the SPYBOT.AG WORM!"
X	Winsock2 driver	CFTMON.EXE	"Added by a variant of the IRCBOT BACKDOOR!"
X	Winsock2 driver	ntsys32.exe	"Added by the SPYBOT-DD WORM!"
X	Winsock2 driver	WINNT32.EXE	"Added by the SPYBOT-CN WORM!"
X	Winsock2 driver	PAC.EXE	"Added by the SPYBOT-ET WORM!"
X	Winsock2 driver	winsock2.exe	"Added by the SPYBOT-CT BACKDOOR!"
X	Winsock2 driver	mmtask5.exe	"Added by the SPYBOT-CD WORM!"
X	Winsock2 driver	WWEUMQR.EXE	"Added by the SPYBOT-BY WORM!"
X	Winsock2 driver	IEXPLORE .EXE	"Added by the SPYBOT-AU WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process as there is a space before the "".exe"""
X	Winsock2 driver	WINSOUND.EXE	"Added by the SPYBOT-H WORM!"
X	Winsock2 Loader	WICONF.EXE	"Added by the SDBOT-LA WORM!"
X	Winsock2 wqr1s	WUAUMQR1.EXE	"Added by the SPYBOT.KD WORM!"
X	Winsock2.dll	WINLODR.SCR	"Added by an unidentified VIRUS
X	Winsock32 driver	TESTING.EXE	"Added by the SPYBOT-B WORM!"
X	Winsock32 driver	system32.exe	"Added by the IRCBOT-VT TROJAN!"
X	Winsock32driver	win32server.scr	"Added by the HACARMY TROJAN!"
X	Winsock32driver	sp2XPupdate.exe	"Added by the HACKARMY.S TROJAN!"
X	Winsock32driver	win32server.exe	"Added by the BACKDOOR-AZV TROJAN!"
X	Winsock32driver	ZoneAlarmPr0.exe	"Added by the HACKARMY-B TROJAN!"
X	Winsock32driver	ZoneLockup.exe	"Added by the HACARMY.D TROJAN!"
X	Winsock32driver	win32server.exe	"Added by the HACARMY.F TROJAN!"
X	Winsock32driver	winXPupdate.exe	"Added by the HACKARMY.9728 TROJAN!"
X	Winsock32driver	svchhost.exe	"Added by the HACKARMY.I TROJAN!"
X	Winsock6 MIC driver	ieservicesupd.exe	"Added by the SPYBOT.AFZ WORM!"
X	winsockdriver	tskmg.exe	"Added by the SDBOT.GEN TROJAN or WARPIGS.C WORM!"
X	winsockdriver	winsock2.2.exe	"Added by a variant of the SPYBOT WORM!"
X	winsockdriver	iexplor.exe	"Added by the BLATIC.A WORM!"
X	winsockdriver	winsock3.exe	"Added by the SPYBOT-DO WORM!"
X	winsockdriver	bot.exe	"Added by the WARPIGS-D WORM!"
X	winsockdriver	winsock4.1.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	winsockdriver	winsock2.exe	"Added by the SPYBOT-AC WORM!"
X	WinSocketComponent	nthost.exe	"Added by an unidentified VIRUS
X	Winsocks2 driver	mznmgr.exe	"Added by a variant of the SDBOT WORM!"
U	WINSOS VERIFY	WINSOS.EXE	"WinSOS - ""deletes spyware
X	WinSP	[path] REGEDIT.EXE -s [path] sysreg.reg	"Added by the STARTPA-ME TROJAN!"
X	WINSP00L	WINSP00L.EXE	"Added by the AGENT.XAB TROJAN! Notice the digit ""0"" in both columns rather than the upper case ""o"""
X	winspd32dll	winspd32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	WinSPF	windrv32.exe	"Added by the MYDOOM.T WORM!"
X	WinSPF	winspf32.exe	"Added by the MYDOOM.S WORM!"
X	Winspl	winsplx.exe	"Added by a variant of the TROLL-A TROJAN!"
X	winsplog	wsmmlog.exe	"Added by the MAILBOT-CA TROJAN!"
X	Winspool	spoolsvr.exe	"Added by a variant of the SDBOT WORM!"
X	WinSpyControl	pgs.exe	"WinSpyControl rogue security software - not recommended. A member of the AVSystemCare family"
X	WinSpyDemo	WinSpyDemo.exe	"WinSpy rogue spyware remover - not recommended"
X	WinSpyKiller	WinSpyKiller.exe	"WinSpyKiller rogue spyware remover - not recommended
X	WinSpywareProtect	WinSpywareProtect.exe	"WinSpywareProtect rogue security software - not recommended
X	WinSpywareProtect (ver. 5.1)	WinSpywareProtect.exe	"WinSpywareProtect rogue security software - not recommended
X	WinSrv	kn0x.exe	"Added by the HOBBIT.F WORM!"
X	WinSrv	SHIZZLE.EXE	"Added by the HOBBIT.C WORM!"
X	Winsrv	winsrv.exe	"Added by the OPASERV.T WORM!"
X	winsrv	winsrv.exe	"Added by the NETSNAK-B TROJAN!"
X	winsrv3	services.exe	"Added by the NAFBOT-A TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
Y	winssnotify	winssnotify.exe	"System Tray access to and notifications from Windows Live OneCare - now superseded by Microsoft Security Essentials. ""OneCare helps keep your PC safe and secure while making your life easier. From virus scanning and file backups
X	WinsSystem	syssmss.exe	"Added by the DELF.IG TROJAN!"
X	WinStabilizer	WinStabilizer.exe	"Added by the AGOBOT-SW WORM!"
X	WinStar	IEXPL0RE.exe	"Added by the WOSRIST A TROJAN!"
X	WinStart	services.exe	"Added by the SOBER.O WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Connection Wizard\Status and note the space at the beginning of the ""Startup Item"" field"
X	WinStart	WinStart.exe	"From IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words
X	WinStart	Wscript.exe WinStart.vbs	"Added by the CIAN.C WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""WinStart.vbs"" file is located in %System%"
X	WinStart	winstart32.exe	"Added by the PUROL WORM!"
X	WinStart	WinStart.pif	"Added by the CONE.E WORM!"
X	winstart	winstart.exe	"Added by the SCKEYLO-AB TROJAN!"
X	WinStart001	WinStart001.exe	"From IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words
X	WinStart001.EXE	WinStart001.exe	"From IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words
X	winstats	winstats.exe	"Added by the GARGAFX TROJAN!"
X	Winsta~1	winsta~1.exe	"GoHip foistware"
X	WinSth16	WinSth16.exe	"Added by the CAKE WORM!"
X	winstro	RUN32DLL.exe	"Added by the FTP_ANA TROJAN!"
X	winsupdater	winsupdater.exe	"Added by the ALCRA-F WORM!"
X	winsupdatesysmngr64	winsys64mnger.exe	"Added by the RBOT-BAG WORM!"
X	WinSvc16.exe	WinSvc16.exe	"Added by the SDBOT.FQ TROJAN!"
X	winsvc32	winsvc32.exe	"Added by the IRCBOT-AEG WORM!"
X	winsvc32.exe	winsvc32.exe	"Added by the GREPAGE TROJAN!"
X	Winsvr	msupd******.exe [*= random digit]	Added by the INJECT.163 TROJAN!
X	Winsvr	[random filename].exe	"Added by the ADCLICK-DK TROJAN!"
X	Winsvr manager	DDEsvr.exe	"Added by the TIRBOT-C WORM!"
X	winsy32.exe	winsy32.exe	"CoolWebSearch parasite variant"
X	winsync	******.exe reg_run [* = random char]	"Added by a variant of the QOOLOGIC TROJAN!"
U	Winsys	Winsys.exe	"Win-Spy keyboard logger/monitoring software - remove unless you installed it yourself"
X	WINSYS	[path to trojan]	"Added by the GOLDPLAY TROJAN!"
X	winsys	syschost.exe	Added by an unidentified TROJAN!
X	WinSys	winmgmt.com	"Added by the VB.EIW WORM!"
X	WinSys	system.exe	"Added by the DAPROSY WORM!"
X	WinSys32	Winsys32.exe	"Added by the CIGIVIP TROJAN or RECKUS WORM!"
X	winsys32 Driver	winsys32.exe	"Added by the LOONY-O TROJAN!"
U	WinSysAppMon	WinSysRM.exe	"Home & Family Content Filter related. See here"
X	winsysban	[path to trojan]	"Added by the CLICKER-CD TROJAN!"
U	WinSysCheck	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
X	winsyslog lptt01	winsyslog.exe	"RapidBlaster variant (in a ""Winsyslog"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	WinSysM	371662M.exe	"Added by the WINKO.AO WORM!"
X	WinSysModule	[path to trojan]	"Added by the AGENT-DIQ TROJAN!"
X	WinSysStartUpWKbLw	TaskSystemDll.Exe	"Added by the BACKZAT.G WORM!"
X	WinSyst32	winsyst32.exe	"Added by the MORB WORM!"
X	WinSystem	winsystem.exe	"Added by the WHITEBAIT WORM!"
U	WinSystem	WinSystems.exe	"CMKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	Winsystem	Freevideo5.EXE	"Added by the AGENT.FZS WORM!"
X	winsystem.sys	smss.exe	"Added by the SOBER.K WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\msagent\win32 and note the space at the beginning of the ""Startup Item"" field"
X	WinSystems	winsystems16.exe	"Added by the SDBOT-CZT WORM!"
X	winsystems25	winsystems.exe	"Added by the RBOT-CNZ WORM!"
X	winsysupd	[path to trojan]	"Added by the STARTPA-NI TROJAN!"
X	WinSysW	371662L.exe	"Added by the WINKO.AO WORM!"
X	WINTASK	yahooicons.exe	"Added by the MYTOB-HM WORM!"
X	Winupdatee	winsvcc.exe	"Added by the AGENT.AN TROJAN!"
X	WinXP Processor Generator v1.2	intspnsr32.exe	"Added by the SDBOT.LP WORM!"
X	win_supp00.exe	Win Const.exe	"Added by the ASSASIN-H TROJAN!"
X	Wireless Conections	WireConnect.exe	"Added by the SDBOT-VF WORM!"
X	Wireless Connections	WIRECONNECT.EXE	"Added by the SDBOT-VM WORM!"
N	Wireless Console	wcourier.exe	"ASUS Wireless Console - installed alongside ASUS wireless components and provides additional configuration options for these devices"
N	Wireless Console 2	wcourier.exe	"ASUS Wireless Console - installed alongside ASUS wireless components and provides additional configuration options for these devices"
N	Wireless Console 3	wcourier.exe	"ASUS Wireless Console - installed alongside ASUS wireless components and provides additional configuration options for these devices"
N	WLAN Status Tray Applet	WLANSTA.EXE	System Tray icon for checking the status of a Wireless LAN
N	WLANSTA.EXE	WLANSTA.EXE	System Tray icon for checking the status of a Wireless LAN
X	WLWin	WINSYS.EXE	"Added by the NAVER.A WORM!"
X	WMI Standard Event Consumer - Scripting	scrcons32.exe	"Added by the RBOT-GRD WORM!"
X	WMI Standard Event Consumer - Scripting	scrcs.exe	"Added by a variant of the RBOT-GRD WORM!"
U	WMPNSCFG	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	WN Services	wnsvc.exe	"Added by the KBBOT-A TROJAN!"
X	WNSA	wnsts**.exe [* = random char]	"PurityScan adware"
X	WNSC	wnsin**.exe [* = random char]	"PurityScan adware"
X	Wnsck2 driver	wlogf.exe	"Added by the SPYBOT-AF WORM!"
X	WNSI	wnscp**.exe [* = random char]	"PurityScan adware"
X	WNSI	rwsa.exe	"PurityScan adware"
X	WNSO	WNSO.exe	"Baidu.SoBar adware"
X	WNST	wnsapi**.exe [* = random char]	"PurityScan adware"
X	wntlgns	wntlgns.exe	"CoolWebSearch parasite variant"
X	wormexe	winstart.exe	"Added by the EARLYBIRD WORM!"
X	WPSVC Services	wpnsc.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	WXcmeinst	[path to file]	"Added by the RANCK-CD TROJAN!"
X	xInsIDE	xInsIDE.exe	"Added by the ADLOAD.BH TROJAN! Note - this should not be confused with the valid IDE configuration utility from JMicron Technology which is normally located in %Windir%\RaidTool and uses the same filename. This one is located in %ProgramFiles%\xInsIDE"
U	xInsIDE	xInsIDE.exe	"JMB36x series IDE (or Parallel ATA) configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers. This is normally located in %Windir%\RaidTool"
?	xkstartup	"RunDll32 InstZ82.dll	SetUsbPrinterPort"
X	XMLmedia 10.0	wmsdkns.exe	"Added by the FAKEALERT TROJAN!"
X	XNSearchAssistant	SrchAsst.exe	iWon Search Assistant - spyware
X	xpsp2install	xpsp2Update.exe	"Added by the AGENT-DPK BACKDOOR!"
X	xpstat	winlogins.exe	"Added by the RBOT-AAR WORM!"
U	XtreamLok License Manager	xl.exe	"License manager for xLok (XtreamLok) - prevents software being reverse engineered"
X	x~{{dybel	x~{{dy8%nsn	"Added by the AGOBOT.DQ WORM!"
X	Yahoo Instant Messengar	YahooMsgr.exe	"Added by the SDBOT.GEN TROJAN!"
U	You've Got Pictures Screensaver	ygpsstra.exe	AOL You've Got Pictures Screensaver
U	ZipDisk Icons	IMGICON.EXE	"Displays Iomega icons in Explorer/My Computer
X	ZNN	znnsvc.exe	"Added by the SDBOT-DAA WORM!"
X	Zolero Translator	ZoleroTranslator.exe	"Zolero Translator - added by Clickspring
X	Zonesoft Cleaner	rnsys.exe	"Added by a variant of the SDBOT WORM!"
?	zzzCamlnSuitelll	setup.exe 46***	"??"
X	[3-4 random letters]	nslookup.exe	"PurityScan adware. Not to be confused with the legitimate nslookup.exe which is found in the System32 folder"
X	[random name]	w?nspool.exe	"PurityScan adware"
X	[trojan filename]	Install.exe	"Added by the BANCBAN-FS TROJAN!"
X	[various names]	ActionScr.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	install2.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	NsCplTray.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	NSYSCPLSTR.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	openstre.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	scanSYS.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	_WinStart	services.exe	"Added by the SOBER.O WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Connection Wizard\Status"
X	_winsystem.sys	smss.exe	"Added by the SOBER.K WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\msagent\win32"