OD

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	*JanisRuckenbrodII	janis.com	"Added by the POPS WORM!"
U	4oD	KHost.exe	"Verisign Kontiki Delivery Management System - Windows-based client software that enables secure delivery of content to users' desktops"
X	852EBF20-A95D-4F1F-B9C2-B2CD24350F3E	sysodkcs.exe	"Added by the FAKEALERT-AH TROJAN!"
N	Acer Product Registration	ACE1.exe	Acer Product Registration - remove when registration is completed
X	ActiveScript32	nod.exe	"Added by the SOHANA-AJ WORM!"
X	adodemaster	adodemaster.exe	"Downloader of Korean origin
U	Agere SoftModem Messaging Applet	AGRSMMSG.exe	Installed with the drivers for internal software modems based upon Lucent/Agere Systems chipsets - required if you use the SoftModem Assistant to configure the modem
U	AModemLockDown	ModemLockDown.exe	"ModemLockDown - allows you to supervise internet access by disabling the modem
N	Anapod Manager	anamgr.exe	"Anapod Explorer from Red Chair Software ""is the most advanced Windows iPod® software available
X	Anti-Virus Product Sync	[unprintable character][3 characters]log.exe	"Added by the KEDEBE.D WORM!"
U	Any To-Do List	anytodo.exe	"Any To-Do List ""the ultimate software solution to keep yourself organized and reminded"""
U	ATIModeChange	Ati2mdxx.exe	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. After testing it's exact function isn't known at this time and it doesn't appear to be running even with the startup entry enabled - hence the ""U"" recommendation"
N	AudioDeck	ADeck.exe	ADeck.exe is a system tray application for VIA's sound cards which offers quick access to a number of sound card related items
X	Audiodrv	audiodrv.exe	"Added by the CRYPTER-C TROJAN!"
U	AudioDrvEmulator	DLLML.exe AudDrvEm.dll	"Related to Creative DLL Module Loader for the Sound Blaster X-Fi (and maybe others). This program is non-essential process to the running of the system
X	AutoDiscovery/AutoPurge (ADAP) Service	wmiadapi.exe	"Added by the RBOT.FLT WORM!"
X	auxAudioDevice	aux32.exe	"Added by the AIZU WORM!"
Y	azmodem	azexe.exe	"Aztech Labs modem driver"
U	BHODemon 2.0	BHODemon.exe	"BHODemon ""protects you from unknown Browser Helper Objects (BHOs)
X	Bron-Spizaetus-5118REPM	komodo-6321422.exe	"Added by the BRONTOK-R WORM!"
U	BTModemProtection	BTModemProtection.exe	"BT Privacy Online modem protection software
X	Cable Modem Adapter	WindowsSec.exe	"Added by the WOOTBOT.A WORM!"
U	Caddais BackupOnDemand	BODMon.exe	"Caddais BackupOnDemand - "runs in the background and monitors your important files for changes. Within seconds of changing
N	Ccdecode	"rundll32.exe streamci	StreamingDeviceSetup"
X	Ciodiag	DECCONF.EXE	"Added by the STRAT.EL TROJAN!"
X	Cn911	ODBCJET.exe	"Added by the BIFROSE-PR TROJAN!"
X	CodeClean	CCIntro.exe	"CodeClean rogue security software - not recommended"
U	Codename Dashboard	dashboard.exe	"Codename: Dashboard - "an application that resides at the side of your screen. Built on the Microsoft .NET Framework
U	com.codeode.cactusspamfilter	cactusspamfilter.exe	"Cactus Spam - free easy-to-use spam blocker"
U	com.codeode.privacymantra	privacymantra.exe	"""Privacy Mantra keeps your computer clean from online and offline tracks"""
U	Comodo Firewall	CPF.exe	"Comodo Firewall"
Y	COMODO Firewall Pro	cfp.exe	"Comodo Firewall Pro"
U	Comodo Launch Pad Tray	CLPTray.exe	"System Tray access to LaunchPad as bundled with Comodo's freebie offerings such as Comodo Anti-Virus. Some allege that LaunchPad is impossible-to-uninstall adware
Y	COMODO Memory Firewall	cmf.exe	"""Comodo Memory Firewall is a buffer overflow detection and prevention tool which provides the ultimate defence against one of the most serious and common attack types on the Internet - the buffer overflow attack"""
U	Companion Module	companion.exe	"The AOL Companion is a small window that appears when you connect to the service using verison 8.0 and early builds of version 9.0. ""Use the Companion to quickly get to your favourite features
N	Compaq Computer Corp SCCenter Module	SCCENTER.EXE	For Compaq PC's. Part of Backweb
X	Compd Service Drivrs	codq.exe	"Added by a variant of the SDBOT WORM!"
X	CTDrive	"rundll32.exe drvmod.dll	startup"
X	CtModule	CtModule.exe	"Added by the CLICKER-EG TROJAN!"
U	Cyber Trio	showmode.exe	"From G-Tek Technologies. Allows you to set the PC in one of three modes
U	DayToday	DAYTODAY.EXE	"DayToday from RoboMagic Software Corp. Displays the date on the taskbar"
?	detect	turbodetect.exe	"??"
X	Diskstart	Code.exe	Adult content dialler
X	Divx	codll.exe	"Added by the GRAVEBOT-A TROJAN!"
X	Divx4 codec	devldr32.exe	"Added by an unidentfied VIRUS! Note - this is not the legitimate Creative Labs devldr32.exe file"
X	DivXCodec	NEWMAIL.exe	"Added by the DELF-RQ BACKDOOR!"
U	Don't Panic	dontpanicdemodp.exe	"30-day trial version of Don't Panic privacy software from Panicware. "Clean up Internet tracks and quickly hide personal documents with this privacy suite.""
N	Drag-to-Disc	DrgToDsc.exe	"System Tray access to Roxio Drag-to-Disc - part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools. ""Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically"". Not required for Roxio to work properly and available via the Start menu"
N	DrgToDsc	DrgToDsc.exe	"System Tray access to Roxio Drag-to-Disc - part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools. ""Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically"". Not required for Roxio to work properly and available via the Start menu"
U	DriveLED	OODLed.exe	"O&O DriveLED - hard disk monitoring and crash prevention"
X	DriverModule	csrnvrt.exe	"Added by the IRCBOT.I TROJAN!"
U	EasySync Pro - 3CmPlm	AutoDet.exe	"3Com Palm PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - PocketPC	AUTODE~1.EXE	"Windows Mobile Pocket PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - PocketPC	AutoDetect.exe	"Windows Mobile Pocket PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
X	EbatesMoeMoneyMaker	wjview ...Code	"Ebates adware"
N	Encoder Agent	WMENCAGT.EXE	"MS Windows Media Encoder
?	Extranet AutoDial	AutoExt.exe	Nortel Networks Contivity Extranet Switching Software
X	eZmmod	mmod.exe	"eZula TopText adware"
X	ezula	eZmmod.exe	"eZula TopText adware"
X	f94mggfhfghodftdf	[path to trojan]	"Added by the SMALL.JHZ TROJAN!"
X	Fdr Command Module	sp2.exe	"Added by the SDBOT.WP WORM!"
X	file laoder configuration	rnd32.exe	"Added by the RBOT.BQJ WORM!"
Y	FirePod	FIREPOD.EXE	"Driver for the PreSonus FP10 (formerly FirePod) Firewire recording system"
X	FLooDNeT	FLooDeR.exe	"Added by the ENDOOL TROJAN!"
X	Framework module library	infocard.exe	"Added by the BUZUS.AYX TROJAN!"
X	froody	timoty.exe	Added by an unidentified malware
X	Fwr Command Module	fwr.exe	"Added by the SDBOT-PP WORM!"
X	Gerenciamento de arquivos do Windows	Winmod32.exe	"Added by the DLOADER-WG TROJAN!"
X	GetModule18	GetModule18.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule19	GetModule19.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule20	GetModule20.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule21	GetModule21.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule23	GetModule23.exe	"Internet Speed Monitor adware related"
X	GetModule24	GetModule24.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule25	GetModule25.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule27	GetModule27.exe	"Internet Speed Monitor adware related"
X	GetModule29	GetModule29.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule30	GetModule30.exe	"Internet Speed Monitor adware related"
X	good	badvir.exe	"Added by the SILOV-B WORM!"
U	GroupWise PDA Connect - 3CmPlm	AutoDet.exe	"3Com Palm PC specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
U	GroupWise PDA Connect - PocketPC	AUTODE~1.EXE	"Windows Mobile Pocket PC specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
X	hellodolly	shost.exe	"Added by the YODO WORM!"
N	hpaiodevice	hpodev07.exe	"Direct from HP - "Device Objects Server - detects all device events and handles all ongoing communication on the device. Loads in the Startup group (except when "portable" is chosen during installation)". Related to various HP all-in-one printer/scanner/copier devices. They print and copy fine with those files disabled
?	HPAiODevice(hp officejet g series)	hpoavn07.exe	"HP Printer related
N	HPAiODevice(hp psc 900 series) -1	hpobrt07.exe	"Installed with a Hewlett Packard 900 series colour printer
N	hpodblia	hpodblia.exe	HP OfficeJet Scan Button Monitor on a multi-function printer/copier/scanner. Start your scanning software manually
N	hpoddt01.exe	N/A	"Installed by the ""HP Photo and Imaging Director"" software. If you ask for the imaging software
U	hpoddt01.exe	hpotdd01.exe	"Detection of new imaging
N	hpodlb08	hpodlb08.exe	HP OfficeJet Scan Button Monitor on a multi-function printer/copier/scanner. Start your scanning software manually
X	InfoData	"rundll32.exe ********.dll	realset [* = random char]"
?	InstallNAIProduct	SETUP.EXE	"Could be related to Network Associates Inc who own the McAfee VirusScan product amongst others. This was found in a directory called "VSC". Could it be an installation that failed and "SETUP.EXE" was left to run at startup as an error?"
U	Intel Product Number Utility	IntelProcNumUtility.exe	"Intel Processor Serial Number Control Utility allows you to enable and disable the processor serial number capability of an Intel PIII processor. You can find more information here. System Tray icon providing the user with a visual state indication. You can find more information here"
X	Internet	nteusodp.exe	"Added by the RBOT-GFJ WORM!"
U	InternodeUsage	mum.exe	Australian ISP's free monthly download meter
N	Introducing Media Manager	SPLASHA.EXE	"MS Media Manager tour. Not required"
N	Introduction-Registration	??	"For Compaq PC's. Should only run first time
U	ioloDelayModule	delay.exe	"Part of Iolo System Mechanic. Used to delay the start of an application which loads automatically as Windows loads"
X	Ipod Help	[9 random letters].exe	"Added by a variant of the RBOT WORM!"
X	iPOD USB Driver	IPODUSB.EXE	"Added by a variant of the RBOT WORM!"
X	iPod USB Service	iPODService.exe	"Added by a variant of the RBOT WORM! Do not confuse with the Apple iPod process of the same name. The legitimate iPod file will always be located in the %ProgramFiles%\iPod\bin folder and is implemented as a system service
N	iPodder	iPodder.exe	"iPodder (now known as Juice) - a free utility that ""allows you to select and download audio files from anywhere on the Internet to your desktop"". This entry is present if you choose the option to add it to the startup group during installation"
U	iPodManager	iPodManager.exe	"Apple iPod® management software for the iPod® player - updates
?	iPodWatcher	iPodWatcher.exe	"Associated with Apple's iPod® player. Detects when the iPod® is connected?"
U	iRiver AutoDB	MLService.exe	"Associated with the iRiver Music Manager"
X	ISMModule	ISMModule.exe	"Internet Speed Monitor C adware related - see example here"
X	ISMModule2	ISMModule2.exe	"Internet Speed Monitor C adware related - see example here"
X	ISMModule3	ISMModule3.exe	"Internet Speed Monitor C adware"
X	ISMModule4	ISMModule4.exe	"Internet Speed Monitor A adware related"
X	ISMModule6	ISMModule6.exe	"Internet Speed Monitor C adware related - see example here"
X	ISMModule7	ISMModule7.exe	"Internet Speed Monitor C adware related - see example here"
X	ISMModule8	ISMModule8.exe	"Internet Speed Monitor C adware related"
X	jusodl	severe.exe	"Added by the QQPASS.48436 TROJAN!"
X	Kernel Safe Mode	smss.exe	"Added by the 78CRACK-A TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
N	Kodak Batch Transfer	pezdow1.exe	Part of "Kodak Picture Easy" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC
U	Kodak EasyShare software	EasyShare.exe	Software bundled with Kodak digital cameras to manage the connection between the PC and the Camera. Can be started manually
N	Kodak Picture Easy . Batch Transfer	PezDownload.exe	"Part of ""Kodak Picture Easy"" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC. . represents the version"
N	Kodak Picture Transfer Software	pts.exe	Looks for Kodak camera connection and media insertion. Available via Start -> Programs
N	Kodak Software Updater	backweb*****.exe	"Software updater for Kodak Easyshare digital cameras"
N	KODAK Software Updater	Kodak Software Updater.exe	"Software updater for Kodak Easyshare digital cameras"
Y	KodakCCS	KodakCCS.exe	Kodak DC File System Driver
U	Krnlmod	Krnlmod.exe	Keystroke logger/monitoring program - remove unless you installed it yourself!
U	Laplink PDASync 3.1 - PocketPC	AUTODE~1.EXE	"Laplink PDASync for Windows Mobile Pocket PC - PDA synchronisation utility"
U	LGODDFU	fwupdate.exe	Auto firmware update program for LG Electronics CD-ROM/DVD writer
X	Linksys Modem Drivers	linksys.exe	Added by the IRCBOT.VD WORM!
?	LLMODCL2	"rundll.exe setupx.dll	InstallHinfSection ..LLMODCL2.INF"
N	Logiciel de transfert d'images KODAK	pts.exe	Looks for Kodak camera connection and media insertion. Available via Start -> Programs
N	Logitech . Product Registration	eReg.exe	"Registration reminder from Leader Technologies for Logitech software such as SetPoint for their range of wired and wireless keyboards and pointing devices (mice
Y	LTWinModem1	ltmsg.exe	"Lucent Technologies (now Alcatel-Lucent) WinModem - which uses software rather than hardware
X	main_module	drvmmx32.exe	"Added by the DILA TROJAN!"
U	Media Codec Update Service	update.exe	"Windows Essentials Codec Pack 1.0 is a collection of the most commonly needed video and audio codecs. This program allows keeps these codecs updated"
X	mediacodec.exe	mediacodec.exe	"Added by the VSCODEC PRO TROJAN!"
U	MicroDialler	atdialler1.exe	"Part of the Freeserve Connection Kit - changes the dial-up for Freeserve AnyTime if access problems are encountered"
X	Microsoft Network Neighbourhood	networknbh.exe	"Added by the RBOT.DMN WORM!"
X	Microsoft Nod32 Service	nood32.exe	"Added by the RBOT.EJP WORM!"
X	Microsoft Safe Mode Manager	safemode.exe	"Added by the IRCBOT.HM BACKDOOR!"
X	Microsoft Services	module.exe	"Added by the LAVITS WORM!"
X	Microsoft Sinsup	odjiwjf.exe	"Added by the RBOT-DN WORM!"
X	Microsoft Update Module	rundll24.exe	"Added by the RBOT-PS WORM!"
X	Microsoft UpToDate Driver (32-bits)	[random filename].exe	"Added by the SPYBOT.LXJ WORM!"
X	Microsoft Video Driver	videodrv.exe	"Added by the SDBOT-AGP WORM!"
X	Microsoft Windows Workstation	devcode.exe	"Added by the RBOT-AWL WORM!"
X	Microsoft Winedows WinServ	iPodFix.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft's System Module	Sysmodule.exe	"Added by the BDOOR-FJ BACKDOOR!"
X	mmod	mmod.exe	"eZula TopText adware"
N	MOD	muamgr.exe	"Using MicroAngelo On Display
X	Modem	locatesvc.exe	"Added by a variant of the SPYBOT WORM!"
X	Modem Driverz Updates	mdmdrv.exe	"Added by a variant of the SDBOT WORM!"
U	MODEMBTR	MODEMBTR.EXE	"Modem Booster from inKline Global to improve ISP connections"
X	Modeminf	Modeminf.exe	"Added by a variant of the CRYPTER.C TROJAN!"
U	ModemOnHold	MOH.EXE	"NetWaiting/Modem-on-Hold - allows you to place your Internet connection on hold while you take a voice call (if Call Waiting is supported by your phone company). See here for more information"
U	ModemOnHold	netWaiting.exe	"NetWaiting/Modem-on-Hold - allows you to place your Internet connection on hold while you take a voice call (if Call Waiting is supported by your phone company). See here for more information"
N	ModemUtility	mdmsetpe.exe	System Tray configuration icon for Aztech modems
X	Modifiet Amateur HTPB	wuaclt.exe	"Added by the IRCBOT.AYS WORM!"
U	ModPS2	ModPS2Key.exe	"Hotkey drivers for Chicony keyboard. Required if you use the hotkeys"
X	ModularConfig	syscnfg.exe	"Added by an unidentified VIRUS
X	Module Call initialize	"RUNDLL32.EXE reg.dll	ondll_reg"
X	Modulo 00FE0F01 Host Internet	syschost.exe	"Added by the DELF-KW TROJAN!"
U	MoodBook	mb.exe	"MoodBook is a free Windows utility that brings art to your desktop"
X	MSDrive	rundll32.exe drvmod.dll	"Added by a variant of the OP DIALER! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""drvmod.dll"" file is found in %System%"
X	Msn Service	raloded.exe	"Added by the MYTOB-DY WORM!"
X	Multimedia Codecs	mcc.exe	"Added by the DLOADER-MB TROJAN!"
X	Nod23 Service	nod23.exe	"Added by the RBOT-GMK WORM!"
X	Nod29 Service	nodwr.exe	"Added by a variant of the RBOT WORM!"
X	nod32	nodqq.exe	"Added by the AUTORUN-BBV WORM!"
X	NOD32 FiX	regedt32.exe	"NodFix is a is a potentially unwanted application. This application is given an (X) status because we does not and will not support Cracks or Warez. Do not delete the regedt32.exe as it is the legitimate Windows application. NodFix interferes with the default settings of the NOD32 AV application allowing to bypass its free using period as well as changes the default update server to that eval signatures thus allowing to update NOD32 without password. Note - to avoid interfering with the NOD32 application original settings no full cleanup can be provided"
X	Nod32 Free antivirus	nod32krn.exe	"Added by the RBOT-AAO WORM! Note - not the popular free NOD32 antivirus software
X	Nod32 Runtime	sysregi.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Nod32 Service	nod64.exe	"Added by the RBOT.ESJ WORM!"
X	Nod32 Service	alserv32.exe	"Added by the RBOT.DHN WORM!"
X	Nod32 Service	AutoUpdateWin32.exe	"Added by the SDBOT-DJG WORM!"
X	Nod32 Service	nod6.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
U	Nod32CC	nod32cc.exe	"Control Center part of Eset's NOD32 virus-scanner. Leave this enabled if you want to update your virus data files via the click of a button"
Y	NOD32kernel	Nod32krn.exe	"NOD32 antivirus"
Y	nod32kui	nod32kui.exe	"NOD32 antivirus"
Y	NOD32POP3	Pop3scan.exe	"POP3 E-mail part of Eset's NOD32 virus-scanner"
X	Nod3d2 Free antivirus	N0D32KRN.EXE	"Added by the RBOT-ABQ WORM!"
?	NodeMnger	Nodemngr.exe	"Part of the Dell OpenManage Client installation - to allow Dell representatives to remote logon?"
X	NoDNS	NoDNS.exe	"Added by the CLICKER.WI TROJAN!"
X	nodriver	AUEKXRZ.EXE	"Added by a variant of the SPYBOT WORM!"
X	nodriver	SVCHOST.EXE	"Added by the SPYBOT-Z BACKDOOR! Note - this is not the legitimate svchost.exe process which should normally figure in Msconfig/Startup!"
X	ntsmod	ntsmod.exe	"Adware downloader/installer
X	OD	SYSCNTR.EXE	HotVideo dialler
X	od-matrxx	od-matrxx.exe	Adult dialler - xx can be any number
X	od-stndxx	od-stndxx.exe	Adult dialler - xx can be any number
X	od-teenxx	od-teenxx.exe	Adult dialler - xx can be any number
U	ODBC BackUp	fdxxl.exe	"G Data ""PC Spion"". PC monitoring and surveilling software
X	oddworldz.exe	oddworldz.exe	"Added by the MULTIDR-EG TROJAN!"
N	Odebit Multimedia V2	Odebit.exe	"Odébit Multimedia - free French multimedia player giving access to the best of television
N	Odebit Multimedia V3	Odebit.exe	"Odébit Multimedia - free French multimedia player giving access to the best of television
N	Odebit Multimedia V3 - Services	Odebit.exe	"Odébit Multimedia - free French multimedia player giving access to the best of television
X	odnex	odbns.exe	"Added by the AGENT-MPM TROJAN!"
X	odnexy	odbnsy.exe	"Added by the VESLORUKI.DWJ TROJAN!"
N	Odometer	Odometer.EXE	Mouse odometer - tracks how far your pointer/arrow has traveled on the screen. Shortcut available
U	ODSPConfig	ODSPConfig.exe	"DsktopSurveil surveillance software. Uninstall this software if you did not install it yourself"
U	OODefragTray	oodtray.exe	"System Tray access to O&O Defrag disk defragmentation software"
Y	PCBG	PCBODYGUARD.EXE	"PC Bodyguard from Calluna - protects system files and settings from being deleted
Y	PCBODYGUARD	PCBODYGUARD.EXE	"PC Bodyguard from Calluna - protects system files and settings from being deleted
X	PcEXPLODE	specialfile.exe	"Added by the RBOT.RH WORM!"
?	PCIMODEM	pcimodem.exe	"Associated with Lucent based Aztech MDP7800-U PCI modems. Is it required?"
X	Pex Sound Driver	Today's Results.vbs	"Added by the TRODE-A WORM!"
X	pex Sound driver 2	Today's Results.vbs	"Added by the TRODE-A WORM!"
N	PitFrame Module	Reminder.exe	"Registration reminder for the PC Pitstop Optimize 2.0 system optimizatoon utility by CA. Located in %ProgramFiles%\PCPitstop\Optimize2"
X	pnvifj	jusodl.exe	"Added by the QQPASS.48436 TROJAN!"
?	Prodigy DSL	EnterNetDUN.Exe	"Prodigy EnterNet DUN PPPoE Client - is it required?"
N	ProdikeysAutorun	Prodload.exe	"Creative Prodikeys software - 'an interactive music entertainment device which not only functions as a full-featured
N	ProDsl	ProDsl.exe	Intel Pro/DSL 2100 modem connection manager. Available via Start -> Programs
U	Program Neighborhood Agent	pnagent.exe	"Citrix Program Neighborhood Agent"
X	Public Microsoft ODBC	ODBC32.exe [ = random char]	"Added by the MASLAN.D WORM!"
X	PVModule	pvmodule.exe	"Adperform.com/Adoptim.com adware - located in %ProgramFiles%\PrintView and detected by Avira AntiVir antivirus as the AGENT.ALB TROJAN! NOTE - the 'real' PrintView installs in C:\CBR folder"
X	QdrModule10	QdrModule10.exe	"Internet Speed Monitor adware"
X	QdrModule11	QdrModule11.exe	"Internet Speed Monitor adware related - see example here"
X	QdrModule12	QdrModule12.exe	"Internet Speed Monitor adware related - see example here"
X	QdrModule13	QdrModule13.exe	"Internet Speed Monitor adware related - see example here"
X	QdrModule15	QdrModule15.exe	"Internet Speed Monitor I adware"
X	QdrModule16	QdrModule16.exe	"Internet Speed Monitor adware related - see example here"
X	QdrModule17	QdrModule17.exe	"Internet Speed Monitor I adware"
X	QdrModule9	QdrModule9.exe	"Internet Speed Monitor H adware"
X	Quicktime Pro 3.0	winuodps.exe	"Added by the GAOBOT.BH WORM!"
X	Realplayer Codec Support	realsched.exe	"Added by the AGOBOT-AAD WORM! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name"
X	Recycler DO NOT MODIFY	recyclecl.exe	"Added by the RBOT.DDA WORM!"
N	reminder-ScanSoft Product Registration	remind32.exe	Registration reminder for ScanSoft products such as PaperPort
N	RoxioDragToDisc	DrgToDsc.exe	"System Tray access to Roxio Drag-to-Disc - part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools. ""Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically"". Not required for Roxio to work properly and available via the Start menu"
X	RunWindowsUpdate	uptodate.exe	"BrowserAid/BrowserPal foistware"
X	SDK Codre Function22	sdkimddprovment2.exe	"Added by the SDBOT-YJ WORM!"
X	Services Start2	odcwinst.exe	"Added by the PYSKE-D WORM!"
?	SetCacheMode	"rundll32.exe ptipbmf.dll	SetWriteCacheMode"
?	ShowIcon_Justrams_USB Product Driver v2.12r012	shwicon.exe	"Related to Just Rams USB product driver. Is it required?"
U	smodul	smodule.exe	"UserMonitor from Neuber. Teachers can broadcast screen to other screens
Y	SoDA Startup	SodaStartup.exe	"Used by the IBM Rational SoDA project management tool. Unsure of it's actual purpose but it's recommended you leave it enabled if you use the software"
U	SoftK56 Modem Driver	carpserv.exe	"Associated with Zoltrix and Conexant modems - enables the internal modem speaker
U	spyprodetector	spydetector.exe	Spyware Process Detector spyware remover
U	StormCodec_Helper	StormSet.exe	"Storm Codec is a codec pack for Windows"
X	sysmod	sysmod.exe	"Added by the SPYBOT-DU WORM!"
X	System Document Application	nmod.exe	"Added by the SDBOT-ABB WORM!"
X	System Service	coderxt.exe	"Added by the RBOT-ALD WORM!"
X	System Setup	rpcxcmod.exe	Added by an unidentified WORM or TROJAN!
X	TaskManager Load Module	TSKMNGR32.EXE	"Added by the SPYBOT.I WORM!"
X	tgbcde	module32.exe	"Added by the REIGN.R TROJAN!"
X	Tiny AV	fooding.exe	"Added by the NETSKY.I WORM!"
Y	TPSODDCtl	TPSODDCtl.exe	Power saving software on Toshiba laptops
N	Transcode360	Transcode360Tray.exe	"Designed for WinXP Media Center Edition 2005 and the Xbox 360
?	Ulead AutoDetector	Monitor.exe	"Related to Ulead Systems Inc. programs. What does it do and is it required?"
?	Ulead AutoDetector v2	monitor.exe	"Related to Ulead Systems Inc.. What does it do and is it required?"
U	UpromiseRemindU	wjview ...Code	"Part of the Upromise saving scheme but associated with Ebates MoneyMaker adware so the choice is yours"
X	UpToDate	uptodate.exe	"BrowserAid/BrowserPal foistware"
U	V.92 Modem On Hold	Ltmoh.exe	Modem On Hold utility - manages incoming/outgoing voice calls on a single phone line while being connected to the internet
X	VFW Encoder/Decoder Settings	RUNDLL32.exe MSSIGN30.DLL ondll_reg	"Added by the LOVGATE-W WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	VideoDriver	[filename]	"Added by the GSPOT20.A TROJAN!"
X	VideoDriver	videodrv.exe	"Added by the MIMAIL.A WORM!"
X	VideoDriver	gspotbot.exe	"Added by the SPIGOT.C TROJAN!"
X	VideoDriverHook	vmdriver.exe	"Added by the BCKDR-PSS BACKDOOR!"
U	VoodooBanshee	"rundll32.exe 3DBBps.dll	BansheeLoadSettings"
X	Win32 Services	odbc32.exe	"Added by the SPYBOT-EK WORM!"
X	Win32BaseServiceMOD	Wintask.exe	"Added by the NAVIDAD WORM!"
X	WIN3S2SNDS	winabsmod.exe	"Added by the AGENT.DN TROJAN - known to BOClean as ""CWS/INDEX""
X	Windows 128 Module	win128.exe	"Added by the FORBOT-ES WORM!"
X	Windows CODE Fix Msy Startups	msyh32.exe	"Added by the AGOBOT.AKK WORM!"
X	Windows Data Server	autodisc.exe	"Added by the SPYBOT-CB WORM!"
X	Windows mod Verifier	Windows-mod.exe	"Added by the RBOT.DSU WORM!"
X	Windows modez Verifier	w1nz0zz0.exe	"Added by a variant of the SDBOT WORM!"
X	Windows modez Verifier	Window2.exe	"Added by a variant of the RBOT WORM!"
X	Windows modez Verifier	WindowsLogon.exe	"Added by a variant of the SDBOT WORM!"
X	Windows modez Verifier	Wwuamguard.exe	"Added by the RBOT.EZJ WORM!"
X	Windows modez Verifier	winlogom.exe	"Added by a variant of the RBOT WORM!"
X	Windows modez Verifier	Windows-.exe	"Added by the RBOT-DIO WORM!"
X	Windows modez Verifier	taskmngr.exe	"Added by a variant of the RBOT WORM!"
X	Windows modez Verifier	winl0g0z.exe	"Added by the RBOT-FNB WORM!"
X	Windows modez Verifier	wuamguard.exe	"Added by the RBOT.EZJ BACKDOOR!"
X	Windows Secure Fix	iPodFixer.exe	"Added by the WOOTBOT.BM BACKDOOR!"
X	Windows Security Module	module.exe	"Added by a variant of the RBOT WORM!"
X	Windows Service Agent	nod32.exe	"Added by the RBOT.BNG BACKDOOR!"
X	Windows Update AutoUpdate Client Product	wuauct.exe	"Added by the AGOBOT.ACL WORM!"
X	Windows Update Check	syslodr.exe	"Added by the SMALL.LU TROJAN!"
X	Windows USB Printer	unqgod.exe	"Added by the RBOT.BKC BACKDOOR!"
X	Windows User Mode Driver Manager	wdfmrg.exe	"Added by the SDBOT-ZN WORM!"
X	WindowsXP Module	DirectX3D.exe	"Malware
Y	winmodem	wmexe.exe	"Software for software based modems. Required if you have one of these. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information"
X	Winsock2.dll	WINLODR.SCR	"Added by an unidentified VIRUS
X	WinSysModule	[path to trojan]	"Added by the AGENT-DIQ TROJAN!"
X	Woods Inc	wcmd.exe	"Added by the KILLFIL-O TROJAN!"
X	WOOZ	autodisc.exe	"Added by the AGENT-CPS TROJAN!"
N	WXProcMgr Module	WXprocMgr.exe	"TVTonic from Wavexpress - ""enjoy 3 full-screen
Y	XircWinModem4	ltcm000c.exe	"WinModem drivers. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information"
U	XTNDConnect PC - 3CmPlm	Autodet.exe	"3Com Palm PC specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
U	XTNDConnect PC - PocketPC	AutoDetect.exe	"Windows Mobile Pocket PC specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
N	Zinio DLM	ZinioDeliveryManager.exe	"Related to Zinio used to read magazines in digital rather than paper format"
X	[12 random characters]	autodisc.exe	"IeDriver adware variant"
X	{BAAA759D-56F0-428c-B8DA-827EA3B08C2C}	sysawechod.exe	"Added by the FAKEALERT-AH TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.