NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

• "Y" - Normally leave to run at start-up
• "N" - Not required - typically infrequently used tasks that can be started manually if necessary
• "U" - User's choice - depends whether a user deems it necessary
• "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
• "?" - Unknown

Fatal error: Maximum execution time of 30 seconds exceeded in /home/iamnotag/domains/iamnotageek.com/public_html/startup/search.php on line 252

	Startup Name	Process Name	Details
X		dllvirtual.exe	"Added by the DADOBRA-IW TROJAN! Note - has a blank entry under the Startup Item/Name field"
X		dllvirtual.dll	"Added by the DADOBRA-IW TROJAN! Note - has a blank entry under the Startup Item/Name field"
X		dllvirtual.js	"Added by the DADOBRA-IW TROJAN! Note - has a blank entry under the Startup Item/Name field"
X		iexpl0re.exe	"Added by the RBOT-SD WORM! Note - has a blank entry under the Startup Item/Name field"
X		regedit.exe /s appboost.reg	"Added by the APPIX.D WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run and HKCU\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank. The Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file ""appboost.reg"" is located in %Windir%"
	Note the filename has a ""0"" rather than an upper case ""o"""
Y	!1_ProcessGuard_Startup	procguard.exe	"DiamondCS ProcessGuard security software - stops malicious worms and trojans from being executed silently in the background
Y	!AVG Anti-Spyware	avgas.exe	"System Tray access to and notifications for AVG Anti-Spyware 7.5. This has now been superseded by AVG Anti-Virus which includes Anti-Spyware"
N	!NoLoad	winrecon.exe	"WinRecon keystroke logger/monitoring program - remove unless you installed it yourself!"
Consume	"Consumer Input Rewarded with MyPoints	U	"ConsumerInputRewardedwithMyPoints
Consume	"Consumer Input Rewarded with MyPoints	U	"ConsumerInputRewardedwithMyPoints
Inc."	"Machine Works	X	aecces.exe
Inc."	"Microsoft Associates	X	iexplorer.exe
Inc."	"Microsoft NetMeeting Associates	X	NetMeeting.exe
Inc."	"Miramar Systems	U	atmsg.exe
ME"	"MS Java Applets for Windows NT	X	javaapplets.exe
NT	"Ms Java for Windows 98	ME & XP"	X
NT	"Ms Java for Windows 98	XP & ME"	X
XP & ME	"MS Java for Windows NT	X	xpjavams.exe
Version	"NVIDIA Compatible Windows Vista Display driver	U	"RUNDLL32.EXE NvCpl.dll
Version	"NVIDIA Compatible Windows7 Display driver	U	"RUNDLL32.EXE NvCpl.dll
Version	"NVIDIA Driver Helper Service	U	"RUNDLL32.EXE nvsvc.dll
Version	"NVIDIA nView Control Panel	N	nwiz.exe
please	"This is a virus	X	bigbadvirus.exe
X	"Vaganza-XPloit-[User Name]"""	[user name].exe	"Added by the GAVGENT.A WORM!"
"	"[Ephemeral 2.4] by TreeHugger	X	[path to worm]
"	"[Ephemeral 2.5] by TreeHugger	X	[path to worm]
"	"[Ephemeral 2.x] by TreeHugger	X	[path to worm]
Y	#NAME?	ZkRunOnceR.exe	Internet Security Suite used by ISPs to protect customers against many attacks
U	$EnterNet	Enternet.exe	"Connection manager for the EnterNet ISP. You can also use RASPPOE"
X	$sys$crash	$sys$sonyTimer.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$crash	$sys$sos$sys$.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$crash	$sys$WeLoveMcCOL.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$drv	$sys$drv.exe	"Added by the RYKNOS TROJAN! Attempts to utilize the Sony Rootkit A.K.A. SecurityRisk.First4DRM security risk to hide itself on the compromised computer"
X	$sys$momomomochin	$sys$sonyTimer.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$umaiyo	$sys$sonyTimer.exe	"Added by the WELOMOCH TROJAN!"
X	$WindowsRegKey%update	IEXPLORE.EXE	"Added by the RBOT-EZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
?	%cmpmixtitle%	%cmpmixstr%	"Possibly related to C-Media Mixer Control panel?"
U	%FP%012-L2TP FWPortal.exe	FWPortal.exe	012.Net.il Israeli ISP dial-up software
N	%FP%1776 Internet fts.exe	fts.exe	1776 Internet US ISP software ISP software front-end
U	%FP%1776 Internet FWPortal.exe	FWPortal.exe	1776 Internet US ISP dial-up software
N	%FP%AIRTEL fts.exe	fts.exe	"Bharti Airtel Broadband - Indian ISP software front-end"
N	%FP%Barak013 fts.exe	fts.exe	Barak013 Israeli ISP software front-end
U	%FP%Barak013 FWPortal.exe	FWPortal.exe	Barak013 Israeli ISP dial-up software
N	%FP%Friendly fts.exe	fts.exe	Friendly ISP software front-end
X	%Windir%winnl.exe	winnl.exe	"Added by the KIDKITI TROJAN!"
X	%Windir%winnm.exe	winnm.exe	"Added by the KIDKITI TROJAN!"
X	'AdwarePro'	'AdwarePro'.exe	"AdWarePro rogue security software - not recommended"
Y	'Ashampoo AntiSpyWare 2 Guard'	AntiSpyWare2Guard.exe	"Part of Ashampoo® AntiSpyWare 2 from Ashampoo GmbH & Co. KG. This part is the realtime monitor that looks for changes on the users system such as BHO
X	(*)Run	win32API.exe	"Homepage hijacker
X	(Default)	media_driver.exe	"Added by the TUPEG VIRUS! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	[random filename].exe	"Added by the BLACKMAL WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	spolsvr2.exe	"Added by the EVILSOCK.10 TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	Systrsy.exe	"Added by the CDTRAY TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(default)	"rundll32.exe [path to DLL file]	Do98Work"
X	(Default)	KEYBOARD.exe	"Added by the AUTORUN.BUK WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	msarti.com	"Added by the SILLYFDC.CJ WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\..\Policies\Explorer\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	xtreme.exe	"Added by the DROPR-CZ TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKLMRun in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(L4r1$$4) (4nt1) (V1ruz)	SP00Lsv32.pif	"Added by the ASSIRAL.B WORM!"
X	*Intelli Mouse Pro Version 2.0B*	ncsjapi32.exe	"Added by the BUZUS-O WORM!"
X	*JanisRuckenbrodII	janis.com	"Added by the POPS WORM!"
X	*Microsoft Update	ctxma.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	cxma.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wstcl.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wucxt.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wuytc.exe	"Added by the STMU TROJAN!"
X	*MS Setup	[random filename]	"Virtumondo adware
Y	*Restore	rstrui.exe	Part of Windows System Restore and added as a RunOnce registry entry. Leave alone
X	*Security Center	secctr.exe	"Added by the SDBOT.BRO WORM!"
Y	*StateMgr	statemgr.exe	Windows ME default for System Restore. Do NOT disable!
N	*WerKernelReporting	WerFault.exe	"Part of Windows Error Reporting technology (WER) for Vista. WER captures software crash and hang data from end-users who agree to report it - see here"
X	*windows update	wrauclt.exe	"Added by the RBOT-QU WORM!"
X	*windows update	wuaucrlt.exe	"Added by the SPYBOT.HUR WORM!"
X	*windows update	wuraclt.exe	"Added by the RBOT-PO WORM!"
X	*windows update	wurauclt.exe	"Added by the RBOT-SY WORM!"
X	*windows update	waurclt.exe	"Added by a variant of the RBOT WORM!"
X	*windows update	wuaruclt.exe	"Added by the RBOT-TF WORM!"
X	*Windows [filename] Checker	[filename]	"Added by the KEDEBE-B WORM!"
X	*WinLogon	[trojan path] ren time:[random number]	"Added by the VUNDO TROJAN!"
X	*wuauclt.exe	w****.exe [* = random char]	"Added by a variant of the RBOT-UG WORM! Note - * in the filename represents a random char; variants spotted: wxmct.exe
X	-=+(L4r1$$4)+=-(4nt1)-=+(V1ru$)=-+	ISASS.exe	"Added by the ASSIRAL.B WORM!"
X	.mscdr	lassa.exe	"Added by the WEBUS.C TROJAN!"
X	.mscdr	lsvchost.exe	"Added by the WEBUS.D TROJAN!"
X	.mscdsr	lsvchost.exe	"Added by the BDOOR-CR BACKDOOR!"
X	.mssecure	mssecure.exe	"Added by the DDOS_BOXED.X TROJAN!"
X	.NET.	msnmgnr.exe	"Added by the DELF.AYF WORM!"
X	.norton	rchost.exe	"Added by the BOXED-H TROJAN!"
X	.Prog	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
X	.Prog	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	.protected	N/A	"Smitfraud variant"
X	.svchost	CSRSS.EXE	"Added by the WEBUS.F TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	.TEXTCONV	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	.WMAudio	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	007-Anti-Spyware.exe	007-Anti-Spyware.exe	"007 Anti-Spyware rogue security software - not recommended"
?	00DSKSVR00	desksaver.exe saskda	"Part of Advanced Desktop Shield
U	00DSKSVR01	desksaver.exe tray	"System Tray access to Advanced Desktop Shield
U	00ERSRRRNKY	eraser.exe	"Part of Evidence Exterminator
?	00notify33	NetBrowser.exe	"Part of Best Network Security
Y	00PCTFW	FirewallGUI.exe	"System Tray access to PC Tools Firewall Plus from PC Tools - which ""is a powerful personal firewall for Windows that protects your computer from intruders and controls the network traffic in and out of your PC"""
Y	00TCrdMain	TCrdMain.exe	Related to the flash card slot on a Toshiba laptop. Ending this process will disable access to the flash cards
U	0190 Warner	WARN0190.EXE	"Anti-dialer program (Germany)"
U	0900 Warner	WARN0900.EXE	"Anti-dialer program (Germany)"
X	0utlook Express	*****.exe [* = random char]	"Added by the RBOT-CC WORM! Note the first letter is actually the digit ""0"" and not a capital ""o"""
X	1	lsass.scr	"Added by the BANCOS.V TROJAN!"
X	1	svchost.scr	"Added by the BANCOS.X TROJAN!"
X	1	mrcmgr.exe	"Added by the BANKER.RQK TROJAN!"
X	1	KHATRA.exe	"Added by the AUTOIT-BP WORM!"
X	1-sukarno	sukarno.exe	"Added by the BRONTOK-CR WORM!"
X	10Base-T	explore.exe	"Added by the AGOBOT-IJ WORM!"
X	1111swapmgr.exe	1111swapmgr.exe	"Added by the BDOOR-IC BACKDOOR!"
X	1234klsjdc uiar924c af	sxgnsvuxct.exe	"Added by the FAKEALERT-AM TROJAN!"
X	1234klsjdc uiar924c af	sysvtypkbjx.exe	"Added by the FAKEALERT-AM TROJAN!"
X	123Monitor	SpywareFreeMonitor.exe	"1-2-3 Spyware Free rogue spyware remover - not recommended
U	12Ghosts Popup-Killer	12popup.exe	"12Ghosts Popup-Killer"
U	12Ghosts SetColor	12color.exe	"12Ghosts SetColor - ""Change your desktop icon text colors
U	12Ghosts Synchronize	12sync.exe	"12Ghosts Synchronize - ""Sync PC clock with an atomic clock over the Internet"""
U	12Ghosts Tower	12tower.exe	"12Ghosts Tower - ""Quickly access and manage all Ghosts (included in all packages)"""
U	12Ghosts TrayProtect	12srvc.exe	"12Ghosts TrayProtect - ""Hide tray icons
?	17779Proj2002	N/A	"??"
X	180ClientStubInstall	stubinstaller****.exe [* = digit]	"180Solutions adware related"
X	180ClientStubInstall	[path to trojan]	"180Solutions adware related"
X	180ClientStubInstall	******.tmp [* = random digit/char]	"180Solutions adware related"
N	1:00	hpdrv.exe	HP utility for monitoring when and how many recoveries have been done
U	1A:MacVisionTrayMonitor	TrayMonitor.exe	"Part of MacVision by Jeff Bargmann - an discontinued program that makes your PC's desktop look and feel incredibly like that of a Macintosh OS8 computer. Handler that puts the icons that are in your system tray into the MacVision taskbar
Y	1A:Stardock MCP	mcpserver.exe	"Master Control Program for Stardock apps
Y	1A:Stardock TrayMonitor	TrayServer.exe	For monitoring tray icons - if disabled icons will not be displayed in ObjectBar or DesktopX
U	1Srv32	SpyAgent4.exe	"SpyTech SpyAgent monitoring software. "Spy software that allows you to monitor EVERYTHING users do on your PC.""
U	1Win32Cfg	Keyloggerpro.exe	"Keyloggerpro keystroke logger/monitoring program - remove unless you installed it yourself!"
X	2-suharto	suharto.exe	"Added by the BRONTOK-CR WORM!"
X	2020Downloader	mssvr.exe	"2020Search Toolbar"
U	24Online Client	CyberoamClient.exe	"Related to Cyberroam from Elitecore Technologies Ltd"
X	252	winmgr.exe	"Added by the LEGMIR-AT TROJAN!"
X	27	slsorve.exe	"Added by the SLSORVE-A TROJAN!"
X	27	csrss32.exe	"Added by the SLSORVE-D TROJAN!"
X	2k6 updatz	crss3.exe	"Added by the RBOT-CPD WORM!"
X	2Search	main.exe	"2Search adware"
U	2wSysTray	2portalmon.exe	"2Wire Homeportal user interface"
X	32-bit Thunking service	thunk32.exe	"Added by the DERDERO.A WORM!"
X	360antiarp	[path to trojan]	"Added by the PASTA.AIB TROJAN!"
Y	36X Raid Configurer	JMRaidSetup.exe	"JMB36x series RAID configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers"
?	3Com Launcher	Launcher.exe	"Related to networking products from 3Com Corporation. What does it do and is it required?"
Y	3cpipe-USRpdA	USRmlnkA.exe	Modem driver files from US Robotics
X	3D Text	3D Text.scr	"Added by the JERMY.A WORM!"
U	3Deep Control Panel	3DeepCTL.EXE	"3Deep® from E-Color corrects lighting
N	3dfx Task Manager	3dfxMan.exe	System Tray application for 3dfx Voodoo 3/4/5 functions. Available via Start -> Programs
?	3Dlabs Taskbar Display Manager	3DLman.exe	"3DLabs graphics driver related. System Tray access to display settings?"
U	3DLabsHelperDemon	3dldemon.exe	"Directly from the programs author ""It is a tiny program that is installed by the Permedia2/3 and probably other Oxygen-series cards. Normally it sits in the background doing nothing at all (sleeping on a semaphore)
Y	3ware 3DM	3dm.exe	Monitors status of the disk array on 3ware IDE RAID controllers
X	4-gusdur	gusdur.exe	"Added by the BRONTOK-CR WORM!"
X	456655	explorer.exe	"Added by the BIFROSE-DE TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	5-1-61-96	members-area.exe	Adult content dialler
X	55278	grepclient1.exe	"Added by the LINEAGE-S TROJAN!"
X	5p4m	[path to trojan]	"Added by the LITEBOT-C TROJAN!"
X	6.54388E+16	rkgnd.exe	"ANG AntiVirus 09 rogue security software - not recommended
U	802.11b+g USB Wireless LAN Utility	ZDWlan.exe	802.11b+g USB Wireless LAN Utility
U	802.11g MIMO Wireless Utility	RaUI.exe	"Wireless configuration utility for Railink 802.11g MIMO based products"
U	802.11g Wireless Adatper	Monitor.exe	"Related to wireless card (802.11) adapter/standard. System Tray icon that provides a shortcut to ""Wireless Connection Status"" and allows to turn WL on and off. Supplier unknown. Adapter is miss-spelled"
X	98D0CE0C16B1	"rundll32.exe D0CE0C16B1	D0CE0C16B1"
Y	9xadiras	9xadiras.exe	"Allied Telesyn AT series router/modem related - apparently required"
X	9xHtProtect	AVprotect9x.exe	"Added by the NETSKY.M WORM!"
X	;Rundll	[filename]	"Added by the PWSLEGMIR.E TROJAN!"
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Lock (and maybe others) -.html" title="Access Lock (and maybe others) -">Access Lock (and maybe others) -
	Access Lock (and maybe others) -.html" title="Access Lock (and maybe others) -">Access Lock (and maybe others) -
X	?ekio Startups	?nksvc32.exe	"Added by the AGOBOT-OV WORM where ? is a random character"
X	@	RUNDLL.EXE	"Added by the SPYBOT-DN WORM! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	@	regedit -s win.dll	"Added by the SEEKER.K TROJAN! Note that regedit is the the legitimate Windows Registry Editor and shouldn't be deleted. The ""win.dll"" file is located in %Windir%"
X	@	iexpl0res.exe	"Added by the RBOT.AEX WORM!"
N	@Hoc Toolbar	AtHoc.exe	"One-click activated browsing toolbar used by various web-sites. See here for more info"
N	@loha	reminder.exe	"Registration reminder for
Y	@OnlineArmor GUI	oaui.exe	"System Tray access to and main user interface for the Online Armor range of security tools from Tall Emu Pty Ltd. The free version incorporates a firewall
X	@tour_ww	@tour_ww[1].exe	Adult content dialler
X	a	MsSvrdll.vbs	"Added by the MUTAFROG!INF WORM!"
X	A New Windows Updater	w32NTupdt.exe	"Added by the MYTOB.BM WORM!"
U	A Verizon App	VERIZO~1.EXE	"Part of Verizon Online Support Manager"
Y	a-squared	a2guard.exe	"System Tray access to and Anti-Malware Guard feature of Emsisoft Anti-Malware from Emsi Software GmbH - which provides ""comprehensive PC protection against viruses
Y	a-squared	a2adguard.exe	"System Tray access to and Background Guard feature of Emsisoft Anti-Dialer from Emsi Software GmbH - which provides ""provides a complete defense against Dialers"""
Y	a-squared Anti-Dialer	a2adguard.exe	"System Tray access to and Background Guard feature of Emsisoft Anti-Dialer from Emsi Software GmbH - which provides ""provides a complete defense against Dialers"""
Y	a-winpoet-service	winpppoverethernet.exe	"WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion
Y	a2adguard	a2adguard.exe	"System Tray access to and Background Guard feature of Emsisoft Anti-Dialer from Emsi Software GmbH - which provides ""provides a complete defense against Dialers"""
?	a2dservice	a2dservice.exe	"Related to the Air2Data Wireless HISA (High-Speed Internet Access) service. What does it do and is it required?"
Y	a2guard	a2guard.exe	"System Tray access to and Anti-Malware Guard feature of Emsisoft Anti-Malware from Emsi Software GmbH - which provides ""comprehensive PC protection against viruses
U	A4Proxy	A4Proxy.exe	"Anonymity 4 Proxy - local proxy server that makes you anonymous when visiting web sites"
X	A5118r	_default32142.pif	"Added by the BRONTOK-AK WORM and variants!"
X	A5118r	j6321422.exe	"Added by the BRONTOK-AK WORM and variants!"
X	A70F6A1D-0195-42a2-934C-D8AC0F7C08EB	"rundll32.exe E6F1873B.DLL	D9EBC318C"
?	AAAKeyboard	??	"??"
N	AAATraySaver	TraySaver.exe	"System Tray management utility from Mike Lin which allows you to hide
X	Aaep	opar.exe	"PurityScan/Clickspring adware"
X	AAMSFree702	Avengine.com	"Added by the DELF.LJ TROJAN!"
X	AAMSFree702	sys.exe	Added by the BACKDOOR-CPC TROJAN!
X	Aapp	adprot.exe	"AdBlaster adware"
X	aaprotect	[path to trojan]	"Added by the BANCBAN-MJ TROJAN!"
?	aauclient	ACNUpdater.exe	"Appears to be related to software from Accenture.com"
U	AAW	Ad-Aware.exe	"Ad-Aware SE Personal from Lavasoft - popular spyware/adware removal tool. Now superseded by Ad-Aware 2008 Free"
U	AAWTray	AAWTray.exe	"System Tray access to Ad-aware from Lavasoft - popular spyware/adware removal tool"
?	ab EazyScheduler	ezsched.exe	"??"
U	ABC	keylogger.exe	Keystroke logger/monitoring program - remove unless you installed it yourself!
U	ABIT uGuru	uGuru.exe	"ABIT µGuru - on motherboards incorporating the µGuru processor this provides quick access to ""hardware monitoring
X	Abrada WIN32	abrada.exe	"Added by the DERMON-G TROJAN!"
Y	ABRegmon	ABregmon.exe	"Part of the ArcaVir antivirus suite from Polish company Arcabit. What does this part do?"
U	Absolute Shield	dseraser.exe	"Absolute Shield Evidence Eliminator - internet history eraser"
U	Absolute StartUp monitor	ASMon.exe	"Absolute Startup - startup monitor from F-Group Software"
U	AbsoluteShield Internet Eraser	cseraser.exe	"AbsoluteShield Internet Eraser - ""protects your privacy by cleaning up all the tracks of your Internet and computer activities"""
X	ABsr	absr.exe	"Added by the AUTOUPDER TROJAN!"
X	absr	mwsvm.exe	"SeekSeek search hijacker related - see here"
X	abtu	mp3serch.exe	"Loads the executable for Lop.com - final version"
X	abtu	lopsearch.exe	"Loads the executable for Lop.com - beta version"
U	Abyssus	razerhid.exe	"Razer Abyssus gaming mouse driver - required if you use the additional features and programmed keys/macros"
U	AbyssWebServer	abyssws.exe	"Abyss web server"
X	Ac97Sound	snddrv.exe	"Added by the VB.AXG TROJAN!"
U	AcBtnMgr_X63	AcBtnMgr_X63.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X63 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	AcBtnMgr_X63.exe	AcBtnMgr_X63.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X63 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	AcBtnMgr_X73	AcBtnMgr_X73.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X73 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	AcBtnMgr_X83	AcBtnMgr_X83.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X83 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	AcBtnMgr_X84-X85	AcBtnMgr_X84-X85.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X84-X85 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
X	ACCDEFRAGINFO	[path to worm]	"Added by the DARBY-O WORM!"
U	Accelerate	accelerate.exe	Webroot Accelerate - allows you to optimize Windows network registry settings in order to boost surfing speeds. Leave this enabled if you find it improves your connection
Y	AccelerometerSt	AccelerometerSt.exe	HP 3D DriveGuard uses a digital accelerometer protects your disk drive by parking and halting I/O requests if you drop your PC or if you move your PC with the display lid closed
Y	AccelerometerSysTrayApplet	AccelerometerSt.exe	HP 3D DriveGuard uses a digital accelerometer protects your disk drive by parking and halting I/O requests if you drop your PC or if you move your PC with the display lid closed
U	Access Connections	ACTray.exe	"System Tray access to the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
X	Access Control App	winsto.exe	"Added by the AGENT.DGO TROJAN!"
N	Access IBM Message Center	ibmmessages.exe	"""The Access IBM Message Center displays messages to inform you about helpful software that may be pre-installed on your PC. The Message Center can also provide messages about new updates available from the IBM Support Center to keep your computer current"""
N	Access Ramp Monitor	armon32.exe	"Monitors your progress on the internet; hang-ups
X	Access WebControl	[path to file]	"Added by the PPDOOR-M TROJAN!"
U	AccessManager	AccessMgr.exe	"Part of SmartPipes SecureSite software. ""SecureSite enables rapid turnup and enhanced administration of VPNs. It automates and simplifies tasks for VPN design and policy management
X	AccessMedia P2P Loader	amp2pl.exe	"My AccessMedia toolbar related
U	AccessoriesPlus	clockplus.exe	"Clock Plus
N	AccessRamp Monitor01	ARMon32a.exe	"From a visitor ""Just wanted to provide you with some info on Access Ramp software installed with Verizon DSL accounts in those areas that use the Winpoet PPPoE software. The Access Ramp TSRs are installed as part of IP Insight software (can't remember the software maker). You can decline to install IP Insight during Winpoet setup
N	AccessRampLAN01	ARUpld32.exe	"Version of the AccessRamp Monitor01 entry for LAN connections - a history uploader. The key in turning it off is a file named ARUCfg32.exe. This file (ARUCfg32.exe) does not show up in the startup process. If you have this file
Y	accrdsub	accrdsub.exe	"ActivIdentity ActivClient - security software from ActivIdentity Corporation which ""enables organizations to secure workstations with smart cards and smart USB tokens while enforcing strong authentication for desktop access and network login"""
U	AcctMgr	AcctMgr.exe	"Norton™ Password Manager - part of Norton SystemWorks 2004 - stores passwords and other personal information
N	AccuWeather.com® Desktop	AccuWeatherDesktop.exe	"Desktop weather from AccuWeather"
N	AccuWeatherDesktopAlerts	AccuWeatherDesktopAlerts.exe	"Weather alerts for AccuWeather.com Desktop which ""provides you with the most accurate
N	ACDSee	ACDSee8Pro.exe	"ACDSee 8 photo software. Organize
U	Acer Assist Launcher	launcher.exe	"Acer Assist - program that provides information about new updates or notices from Acer"
U	Acer eAP Launch Tool	EAPLAU~1.EXE	"Empowering Technology Launcher
?	Acer Empowering Technology Monitor	SysMonitor.exe	"Part of Acer Empowering Technology. What does it do and is it required?"
U	Acer ePower Management	Acer ePower Management.exe	"Part of Acer Empowering Technology. ""Acer ePower Management is a straightforward interface that allows users to select from pre-configured power usage profiles
U	Acer ePower Management	ePowerTray.exe	"Acer® PowerSmart Manager power management utility included on some models in the Aspire range of notebooks. Also appears as the Packard Bell PowerSave power management utility included on some of their notebook models - as Packard Bell is now owned by Acer"
U	Acer ePower Management	ePowerTrayLauncher.exe	Launcher for the Acer® PowerSmart Manager power management utility included on some models in the Aspire range of notebooks
U	Acer ePresentation HPD	ePresentation.exe	"Part of Acer Empowering Technology. Allows you to manage both internal and external displays"
Y	Acer Launch Tool	Alaunch	"Part of Acer eRecovery - ""a powerful utility that does away with the need for recovery disks provided by the manufacturer
N	Acer Product Registration	ACE1.exe	Acer Product Registration - remove when registration is completed
N	Acer Tour Reminder	Reminder.exe	Popup reminder to take the tour of your new Acer laptop
U	AcerGoto	AcerGoto.exe	"Acer Computer ""Goto Drive"" Cold Swap Driver - a swappable second disk drive provides convenient backup of large files
U	AcerNotebookManager	almxptray.exe	System Tray access on some Acer Notebooks to give faster access to system settings
U	AcerPowerkey	Powerkey.exe	PowerKey utility for Acer TravelMate notebook PCs. Allows the user to quickly switch between different power schemes by pressing Fn+F3
X	Aceu	[random filename]	"PurityScan adware"
Y	acEventServ	acevtsrv.exe	"ActivCard Gold from ActivIdentity
U	AClntUsr	AClntUsr.exe	"Altiris AClient Service Windows Tray Icon"
U	ACMonitor_X63	ACMonitor_X63.exe	"Button monitor for the Lexmark X63 all-in-one multifunction printer/copier/scanner. Works in conjunction with the ""Lexmark Scan & Copy Control Program"" button manager whose filename is ""AcBtnMgr_X63.exe"""
U	ACMonitor_X63.exe	ACMonitor_X63.exe	"Button monitor for the Lexmark X63 all-in-one multifunction printer/copier/scanner. Works in conjunction with the ""Lexmark Scan & Copy Control Program"" button manager whose filename is ""AcBtnMgr_X63.exe"""
U	ACMonitor_X73	ACMonitor_X73.exe	"Button monitor for the Lexmark X73 all-in-one multifunction printer/copier/scanner. Works in conjunction with the ""Lexmark Scan & Copy Control Program"" button manager whose filename is ""AcBtnMgr_X73.exe"""
U	ACMonitor_X83	ACMonitor_X83.exe	"Button monitor for the Lexmark X83 all-in-one multifunction printer/copier/scanner. Works in conjunction with the ""Lexmark Scan & Copy Control Program"" button manager whose filename is ""AcBtnMgr_X83.exe"""
U	ACMonitor_X84-X85	ACMonitor_X84-X85.exe	"Button monitor for the Lexmark X84-X85 all-in-one multifunction printer/copier/scanner. Works in conjunction with the ""Lexmark Scan & Copy Control Program"" button manager whose filename is ""AcBtnMgr_X84-X85.exe"""
N	acpart	agpart11.exe	Program for finding trucks on-line
X	Acrobat	acrmon32.exe	"Added by the SMALL-ECT TROJAN!"
U	Acrobat Assistant	AcroTray.exe	"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
U	Acrobat Assistant 7.0	Acrotray.exe	"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
U	Acrobat Assistant 8.0	Acrotray.exe	"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
X	Acrobat Read	acroup32.exe	"Added by the VANBOT-BQ TROJAN!"
N	Acrobat Speed Launch	acrobat_sl.exe	"Speeds up the time it takes to load Adobe's Acrobat PDF creation and management tool. From version 7.0 onwards"
U	ACROMOUSE	ACROMAPP.exe	"Related to ACROMOUSE Laser mouse control"
U	Acronis Popup Blocker	"RunDll32.exe [path] Blocker.dll	Run"
U	Acronis Scheduler Helper	schedhlp.exe	"Part of Acronis True Image backup software. Co-operates with the ""schedul2.exe"" service to perform backup/restore tasks correctly. Required if you want to use True Image to do some real backup/restore tasks - not if you only want to explore/mount images"
U	Acronis Scheduler2 Service	schedhlp.exe	"Part of Acronis True Image - backup software. Co-operates with the ""schedul2.exe"" service to perform backup/restore tasks correctly. Required if you want to use True Image to do some real backup/restore tasks - not if you only want to explore/mount images"
U	Acronis True Image	TimounterMonitor.exe	"Part of Acronis True Image backup software. Monitor for the backup archive explorer for moving and viewing files within an archive"
N	Acronis True Image Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
N	Acronis TrueImage Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
N	Acronis*True*Image Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
U	AcronisTimounterMonitor	TimounterMonitor.exe	"Part of Acronis True Image backup software. Monitor for the backup archive explorer for moving and viewing files within an archive"
N	AcronisTrueImage Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
X	Acroread	AcroRD32.exe	"Added by the DLOADR-BDK TROJAN! Note - this is not the popular Adobe Reader"
X	Acroread	GoogleUpdate.exe	"Added by the AGENT-JGI TROJAN! Note - this is not the valid Google program which is normally located in %AppData%\Google\Update. This version resides in %Temp%"
U	Act! Preloader	Act8.exe	"Sage Software's ACT! ""enables individuals and small business customers to instantly access key contact and customer information
N	Action Manager 32	am32.exe	Associated with a Plustech scanner. Small utility that runs in the background for doing fax/copy/etc. Available via Start -> Programs
U	Activboard	MMKeybd.exe	"Packard Bell ActiveBoard keyboard - multimedia keyboard manager. Required if you use the additional keys and want to see the status of the Num Lock
U	ACTIVBOARD	ABoard.exe	"Packard Bell ActiveBoard keyboard - multimedia keyboard manager. Required if you use the additional keys and want to see the status of the Num Lock
U	Active Desktop Calendar	ADC.EXE	"XemiComputers Active Desktop Calendar"
U	Active Email Monitor	aem25.exe	"Active Email Monitor checks multiple accounts for email
X	Active Security	asecurity.exe	"Active Security rogue security software - not recommended
X	ActiveDesktop	systray32.exe	"Added by the DABOOM WORM!"
X	ActiveScan Antivirus	ActiveScan.exe	"Added by the RBOT-FKQ WORM!"
X	ActiveScript32	nod.exe	"Added by the SOHANA-AJ WORM!"
N	ActiveWords	AWMonitor.exe	"ActiveWords from ActiveWord Systems
X	ActiveX File Registration Service	filereg.exe	"Added by the RBOT-DVD WORM!"
X	ActiveX Streamer	msgfix.exe	"Added by the SDBOT.NQ WORM!"
N	ActivSurf	backweb*****.exe	Packard Bell ActivSurf - automatically detects an internet connection and downloads any available updates
U	ActMaker	ActMak25.exe	"""ActMaker mouse and keyboard toolkit can record the daily operation of your computer and reduce your workload. You don't need to do any coding
U	ActMaker	ActMaker25.exe	"ActMaker mouse and keyboard toolkit can record the daily operation of your computer and reduce your workload"
U	ACTray	ACTray.exe	"System Tray access to the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
U	Actual Window Manager	ActualWindowManagerCenter.exe	"Actual Window Manager from Actual Tools - ""an innovative desktop organization application which introduces unconventional window controls and also automatic general window operations making your work more productive
U	Actual Window Minimizer	ActualWindowMinimizerCenter.exe	"Actual Window Minimizer - ""allows minimizing any window to task tray notification area or to the edge of the screen"""
U	Ad Arrest	adarrest.exe	"Ad Arrest IE popup killer from GameFools"
U	Ad Blocker	blocker.exe	"Ad Blocker - blocks popups
U	Ad Blocker Pro	Ad Blocker Pro.exe	Ad Away popup and banner remover
U	Ad Muncher	AdMunch.exe	"Ad Muncher removes adverts
U	Ad-Aware	Ad-Aware.exe	"Ad-Aware from Lavasoft - popular spyware/adware removal tool"
X	Ad-Aware	Ad-Aware.exe	"Added by the RBOT-ADJ WORM! Note - this is not the popular Ad-Aware spware/adware removal tool and is located in %System%"
X	Ad-Eliminator	ad-eliminator.exe	"Ad-Eliminator rogue spyware remover - not recommended
U	Ad-Muncher	ADMUNCH.EXE	"Ad Muncher removes adverts
U	Ad-Protect	ad-protect.exe	"Ad-Protect spyware and spam monitoring tool"
N	Adaptec DirectCD	Directcd.exe	DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later
N	AdaptecDirectCD	Directcd.exe	DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later
X	AdAware	wini.exe	"Added by the RBOT-XN WORM!"
U	Adaware Bootup	Ad-aware.exe	"Ad-Aware from Lavasoft - popular spyware/adware removal tool"
X	Adaware lptt01	adaware.exe	"RapidBlaster variant (in a ""Adaware"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Lavasoft Adaware"
X	Adaware ml097e	adaware.exe	"RapidBlaster variant (in a ""Adaware"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Lavasoft Adaware"
X	Add**.exe [* = random char]	Add**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Add**32.exe [* = random char]	Add**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	AddClass	[path to trojan]	"Added by the SECDL-A TROJAN!"
X	AdDestroyer	AdDestroyer.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
X	Additional Guard	WI[random characters].exe	"Additional Guard rogue security software - not recommended
X	ADDITIONAL Services	pkgadd.exe	"Added by a variant of the IRCBOT TROJAN!"
?	addproxy	addproxy.exe	Related to Adobe Photoshop
X	AddrPlus3	[path] stup.exe [path] Adplus.dll Rundll32	"TCent adware"
X	aDir	adirss.exe	"Added by the SPAMSRV-E TROJAN!"
Y	Adiras	Adiras.exe	ADSL USB modem related
X	adirka	adirka.exe	"Added by the TIBS-QT TROJAN!"
X	AdKiller	AD Defender.exe	"Part of the Advanced Spyware Remover rogue spyware remover - not recommended
X	ADM Library Loader	admlib32.exe	"Added by a variant of the SDBOT TROJAN!"
X	Admanager Controller	AdManCtl.exe	"Adware
X	Admilli Service	AdmilliServ.exe	Windupdates adware variant
X	Administrator	svchost.scr	"Added by the NOVACAL TROJAN!"
X	Administrator	winlogon.exe	"Added by the RUBBLE-C WORM! Note - this is not the legitimate winlogon.exe process
X	Administrator di Dago	Dago.exe	"Added by the PUNYA-B WORM!"
?	ADMTray.exe	admtray.exe	"Part of Acer Empowering Technology. What does it do and is it required?"
N	Adobe Acrobat	READER~1.EXE	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
N	Adobe Acrobat	Reader_sl.exe	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
X	Adobe Acrobat Distiller Application	acrotray.exe	"Added by the RANDEX.DFJ WORM!"
X	Adobe Acrobat Reader CFG	[random filename]	"Added by a variant of the RBOT WORM!"
N	Adobe Acrobat Speed Launcher	acrobat_sl.exe	"Speeds up the time it takes to load Adobe's Acrobat PDF creation and management tool. From version 7.0 onwards"
N	Adobe ARM	AdobeARM.exe	"Adobe Reader Manager (ARM) - update/download manager added with Adobe Reader from version 9.2. Taken from the Adobe user forums - ""AdobeARM.exe is a part of new Adobe AcrobatReader updater. If you manage updates yourself
X	Adobe Filter Platform	afilterplatform.exe	"Added by the RBOT-OP WORM!"
X	Adobe Flash Player	AdobeFP.exe	"Added by the AUTORUN-BBP WORM!"
U	Adobe Gamma Loader	Adobe Gamma Loader.exe	"Adjusts monitor colours across all programs
U	Adobe Gamma Loader.exe	Adobe Gamma Loader.exe	"Adjusts monitor colours across all programs
N	Adobe Photo Downloader	apdproxy.exe	"Part of Adobe's Photoshop Album or Photoshop Elements packages - starts each time you connect an external image device to your PC (see here)"
N	Adobe Reader Speed Launch	Reader_sl.exe	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
N	Adobe Reader Speed Launch	READER~1.EXE	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
N	Adobe Reader Speed Launcher	Reader_sl.exe	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
U	Adobe Reader Synchronizer	AdobeCollabSync.exe	"Adobe Synchronizer - installed along with Adobe Reader 8.x. ""Synchronizer is a small application that runs in the background
X	Adobe Reader32	Acrord32.exe	"Added by the RBOT-BLC WORM! Note - this is not the popular Adobe Reader"
U	Adobe Version Cue CS2	VersionCueCS2Tray.exe	"File manager that's part of Adobe Creative Suite 2 - ""find files fast
N	AdobeARM	AdobeARM.exe	"Adobe Reader Manager (ARM) - update/download manager added with Adobe Reader from version 9.2. Taken from the Adobe user forums - ""AdobeARM.exe is a part of new Adobe AcrobatReader updater. If you manage updates yourself
X	AdobeManager	rundtl.exe	"Added by the INJECT.IB TROJAN!"
X	adobemgr	adobemgr.exe	"Added by the ADCLICKER TROJAN!"
X	AdobeReader	msni.exe	"Added by the RBOT.DAO TROJAN!"
X	AdobeReaderPro	msnxpsp.exe	"Added by the RBOT-ASK or RBOT-AUS WORMS!"
X	AdobeReaderPro	ntkernell32.exe	"Added by the RBOT-ATY WORM!"
X	AdobeReaderPro	msnserve.exe	"Added by the SDBOT-AKH WORM!"
X	AdobeReaderPro	updt.exe	"Added by the IRCBOT-VQ WORM!"
X	AdobeReaderPro	rruxdkf.exe	"Added by the RBOT.ADF BACKDOOR!"
X	AdobeReaderPro	svxhost.exe	"Added by a variant of the RBOT WORM - see here"
X	AdobeReaderPro	winslog.exe	"Added by a variant of the RBOT WORM!"
X	AdobeReaderPro	lxlfsprrj.exe	"Added by the RBOT.BDZ BACKDOOR!"
X	AdobeReaderPro	cbdzfrsl.exe	"Added by the RBOT.AZQ BACKDOOR!"
X	AdobeReaderPro	subset.exe	"Added by the RBOT.OCU WORM!"
X	AdobeReaderPro	winini.exe	"Added by a variant of the RBOT WORM!"
X	AdobeReaderPro	rvdjlefr.exe	"Added by the RBOT-CQZ WORM!"
X	AdobeReaderPro	spoolss.exe	"Added by the SDBOT-AKZ WORM!"
X	AdobeReaderPro	lssas.exe	"Added by the RBOT-CLB WORM!"
X	AdobeReaderPro	msnservex.exe	"Added by the RBOT.AKM BACKDOOR!"
X	AdobeReaderPro	msnsrcdv.exe	"Added by the INJECT-H WORM!"
X	AdobeReaderPro	chkdisk.exe	"Added by the RBOT-BDV WORM!"
X	AdobeReaderPro	service.exe	"Added by the RBOT-BCA WORM!"
X	AdobeReaderProfessional	msx64.exe	"Added by the RBOT-GAT WORM!"
X	AdobeReaderPros	sysmsn.exe	"Added by the RBOT-BGH WORM!"
N	AdobeUpdater	AdobeUpdater.exe	Automatic updater for Adobe software - run manually
N	AdobeVersionCue	VersionCueTray.exe	"""An exclusive feature of the Adobe® Creative Suite
?	Adobe_ID0EYTHM	VERSIO~2.EXE	"Part of an Adobe product. What does it do and is it required?"
X	Adobe_Reader	acrotray.exe	"Added by the AGENT-LNS TROJAN! Note that the legitimate Adobe file (if installed) would normally be found in %ProgramFiles%\Adobe%\%ProgramName% (where %ProgramName% is Acrobat 9.0\Acrobat or Acrobat 7.0\Distillr for example) whereas this one is located in %ProgramFiles%\Adobe"
X	Adobe_RLX	ccwap.exe	"Added by the BCKDR-RCL TROJAN!"
X	adodemaster	adodemaster.exe	"Downloader of Korean origin
X	Adope File Manager	lsasv.exe	Added by an unidentified WORM or TROJAN!
X	adprot	adprot.exe	"AdBlaster adware"
N	ADQuickAccess	Adtray.exe	After Dark for Windows. Screen saver creation program produced before screen savers became integrated into Win95
X	ADriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	AdRoarUpdate	ARUpdate.exe	"AdRoar adware updater"
X	AdRotator.Application	[path to csrss.exe]	"Added by the SMALL-AQ TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	AdRotator.Application	services.exe	"FakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in an ""Inetsrv"" subfolder"
X	ADS Adware Remover	ADS Adware Remover.exe	"ADS Adware Remover
X	AdsAlert	AdsAlert.exe	"AdsAlert rogue security software - not recommended"
X	AdsBlocker	stopAds.exe	"AdsBlocker - detected by NOD32 as DIALER.DW!"
U	AdsCleaner	AdsCleaner.exe	"""AdsCleaner is a powerful ad blocking software designed to stop ads (block banners ad
U	ADService	ADService.exe	"Part of Active Disk from Iomega - allows software applications to be run directly from an Iomega Zip® disk. Required if you wish the applications to launch on insertion of a disk. Appears as a service in XP/Vista and under the ""RunServices"" registry key in Win98/ME"
?	ADSLSYSTEMTRAY	SystemtrayV100B.exe	"Apparently Annex A ADSL modem related. What does it do and is it required?"
Y	AdslTaskBar	"rundll32.exe stmctrl.dll	TaskBar"
X	AdslTaskBars	taskmng.exe	"Added by the RBOT-AXZ WORM!"
Y	ADSMTray	ADSMTray.exe	ASUS Data Security Manager provides password protected data encryption on ASUS notebooks
U	aDSProcMngr	aDSProcMngr.exe	"Part of PC Tools Disk Suite from PC Tools - which ""is an all-in-one hard-disk management utility that integrates disk optimization
X	adstartup	automove.exe	"Adlogix adware variant"
X	Adstartup	Adstartup.exe	"Adlogix adware"
X	AdStatus Service	AdStatServ.exe	"WindUpdates AdStatus Service adware"
U	AdSubtract	adsub.exe	"AdSubtract blocks ads
X	Adtools Service	AdTools.exe	"Windupdates Adware"
X	AdUpdater	sysupudt.exe	Unidentified adware downloader/updater
U	ADUserMon	ADUserMon.exe	"Part of Active Disk from Iomega - allows software applications to be run directly from an Iomega Zip® disk. Required if you wish the applications to launch on insertion of a disk"
X	Advanced DHTML Enable	[path to trojan]	"Added by the AGENT.GLQ TROJAN!"
X	Advanced Internet Protocol	cerf.exe	"Added by a variant of the SPYBOT WORM!"
X	Advanced Protection System	advpsys.exe	"Added by a variant of the RBOT WORM!"
X	Advanced Spyware Remover	Asr.exe	"Advanced Spyware Remover rogue spyware remover - not recommended
X	Advanced Spyware Remover Pro	Asr.exe	"Advanced Spyware Remover rogue spyware remover - not recommended
U	Advanced SystemCare 3	AWC.exe	"Advanced SystemCare from IObit - ""helps protect
U	Advanced Uninstaller PRO Installation Monitor	monitor.exe	"Innovative Solutions Advanced Uninstaller PRO - ""easy-to-use suite for uninstalling applications and keeping your computer fast
X	AdvancedCleaner Free	UADC.exe	"AdvancedCleaner rogue security software - not recommended
X	advanceddefender	advanceddefender.exe	"Advanced Defender rogue security software - not recommended
X	AdvancedPrivacyGuard	apg.exe	"AdvancedPrivacyGuard rogue privacy program - not recommended
X	AdvancedPrivacySuite	APS.exe	"AdvancedPrivacySuite rogue privacy program - not recommended
X	advap32	[path to trojan]	"Added by the MUTANT.AT TROJAN!"
U	Advertising Killer	Akiller.exe	"Advertising Killer - popup stopper"
U	Adware Agent	adware agent.exe	"Adware Agent popup blocker"
X	Adware Punisher	AdwarePunisher.exe	"Adware Punisher rogue spyware remover - not recommended
X	Adware Punisher Monitor	AdwarePunisher_monitor.exe	"Adware Punisher rogue spyware remover - not recommended
X	Adware Spy	AdwareSpy.exe	"AdwareSpy rogue adware remover - not recommended
U	AdwareAlert	AdwareAlert.Exe	"Adware program
X	AdwareDelete	adwaredelete.exe	"AdwareDelete rogue adware remover - not recommended
X	AdwareKiller_schedules	schedules.exe	"EAdwareKiller rogue spyware remover - not recommended
X	AdwareKiller_tray	tray.exe	"EAdwareKiller rogue spyware remover - not recommended
X	AdwareProMFC	Ad-Ware Pro.exe	"Ad-Ware Pro rogue security software - not recommended"
X	AdwareProMFC	AntiTrojan Pro.exe	AntiTrojan Pro rogue security software - not recommended. Variant of Ad-Ware Pro
X	AdwareProtector	AdwareProtector.exe	"Part of rogue security tools
X	AdwareRemover2007	AdwareRemover2007.exe	"AdwareRemover2007 rogue security software - not recommended
X	AdwareSpy	AdwareSpy4.exe	"AdwareSpy rogue adware remover - not recommended
X	Adware_ProNET	Adware_Pro.exe	"Adware Pro rogue security software - not recommended
X	Adwarz Spy Remover	ADWARZ.EXE	"Added by the SPYBOT-EV WORM!"
U	AEFltrs Application	AESTFltr.exe	"Part of the XP installation of the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
X	AERVICESN	AERVICESN.exe	"Added by the RANDON-AO WORM!"
U	AESTFltr	AESTFltr.exe	"Part of the XP installation of the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
?	AeXSWDUsr	AeXSWDUsr.exe	"Altiris Express NS Client Manager software. Is it required?"
U	AEZBProc	aptezbp.exe	"IBM Aptiva keyboard customizer - enables certain special buttons on keyboard for CD operation
U	AFAFilter	windefault.exe	"AFAFilter - internet filter software"
N	AGEIA PhysX SysTray	TrayIcon.exe	"System Tray access to display properties for AGEIA PhysX graphics cards. Unless you change your desktop resolution
X	Agent Browser	[random filename]	Added by the PPdoor.M-bdr backdoor TROJAN!
X	Agent Explorer	[random filename]	Unidentified adware
?	Agente	Remupd.exe	"Part of an older version of Panda Antivirus. Is this an update reminder (guess because of the name)
X	agentsvr	agentsvr.exe	"Detected by Kaspersky as Monker.A adware. Note - do not confuse with the Microsoft Agent Server application of the same name as described here - the legitimate file will always be located in the Windows\Msagent folder"
U	Agere SoftModem Messaging Applet	AGRSMMSG.exe	Installed with the drivers for internal software modems based upon Lucent/Agere Systems chipsets - required if you use the SoftModem Assistant to configure the modem
U	AGRSMMSG	AGRSMMSG.exe	Installed with the drivers for internal software modems based upon Lucent/Agere Systems chipsets - required if you use the SoftModem Assistant to configure the modem
U	ahfprog	ahfp.exe	"Advanced Hide Folders - ""is powerful security program that allows you to hide any number of files or folders. It is very useful to keep your personal data from others"". Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows 2K/XP"
X	AhorreMemoria	SysRep.exe	"AhorreMemoria rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
X	AHU	[path to worm]	"Added by the ANACON-B WORM!"
U	Ai Gear Help	GearHelp.exe	"Included with some ASUS motherboards (such as the Maximus Extreme & Striker II Extreme)
U	Ai Quicker Help	AsRc.exe	"ASUS DH Remote media portal launcher for their Digital Home range of motherboards that are designed for users to control the computer at a distance away
X	AIM Instant Message Cookies	[random filename]	"Added by the RBOT-AFV WORM!"
N	AIM Logger	AIMLogger.exe	"AIM Logger - saves AIM (AOL Instant Messenger) conversations to log files. Can be started when you are using AIM"
X	Aim Quick Start	Aim.exe	"Added by the FORBOT-BB WORM! Note - this is not the popular AOL Instant Messenger utility"
X	AIM reminder	AIM reminder.exe	"Added by the BUDDY.E TROJAN!"
X	AIM95 Startup	aim95.exe	"Added by the AGOBOT.AEE WORM!"
U	AimMonitor	AimMonitor.exe	"AIM Monitor Sniffer surveillance software for the AIM instant messenger. Uninstall this software unless you put it there yourself"
U	AIMPro	aimpro.exe	"AIM Pro - secure instant messaging
N	AIMster	??	Peer to Peer (P2P) file sharing client that runs over the AOL Instant Messenger network. Available via Start -> Programs
Y	Aiptek Graphics Tablet (USB)	atwtusb.exe	USB interface for Aiptek Graphics Tablet (USB)
?	Air2Data	a2dservice.exe	"Related to the Air2Data Wireless HISA (High-Speed Internet Access) service. What does it do and is it required?"
X	aircity	aircity.exe	"Related to ""Prutect"" malware from e2Give"
Y	AirGCFG	AirGCFG.exe	"Driver and configuration utility for a number of wireless routers and adapters from D-Link"
Y	AirNCFG	AirNCFG.exe	"Driver and configuration utility for a number of wireless routers and adapters from D-Link"
Y	AirPlusCFG	AirPlusCFG.exe	"Driver and configuration utility for a number of wireless routers and adapters from D-Link"
U	AirPort Base Station Agent	APAgent.exe	"Airport Base Station Agent utility for Apple's AirPort wi-fi basestations. ""Wireless solution for home
X	AKEYNAME	WinServ.exe	"Added by the EVILBOT.C TROJAN!"
U	AKiller	akiller.exe	"Advertising Killer - popup stopper"
U	Alarm Manager	Alarmapp.exe	Palm alarm event reminder that coordinates what is on your Palm with settings on your desktop
?	AlarmWatcher	AlarmWatcher.exe	"Associated with SynTPEnh and SynTPLpr which are from Synaptics for touchpads on laptops. What does it do and is it required?"
N	Album Fast Start	ABMTSR.EXE	"Scanner software
?	AlcFDMonitor	ALCFDRTM.EXE	"RealTek related - Real-Time SPDIF-in Monitor for nVidia chipset - is it required in startup?"
?	ALCFDRTM16	ALCFDRTM16.com	"RealTek related - Real-Time SPDIF-in Monitor for nVidia chipset - is it required in startup?"
U	Alcmtr	ALCMTR.EXE	"Realtek Azalia Audio - Event Monitor
X	Alcmtr	Malware Doctor.exe	"MalwareDoc rogue security software - not recommended
N	Alcohol.exe Autorun	Alcohol.exe	"Alcohol 120% - ""a powerful Windows CD and DVD burning software that makes it easy to create backups of DVDs and CDs. In addition
?	Alcom PCL Capture	FMW_PCAP.EXE	"??"
X	alcomrg.exe	alcomrg.exe	"Added by the SDBOT-DNT WORM!"
U	AlcWzrd	ALCWZRD.EXE	"RealTek AlcWzrd Application
U	AlcxMonitor	Alcxmntr.exe	"Installed with hardware drivers for a Realtek AC97 audio device. It's believed that Realtek uses this file in order to gather data about the customer. Some users report problems with their on-board sound if this is disabled - hence the ""U"" recommendation"
X	aldefr ere service	tay0x.exe	"Added by the RBOT-XS WORM!"
X	alerter	alerter.exe	"MAHA.F spyware"
X	Alevir	Alevir.exe	"Added by the OPASERV-A WORM!"
X	AlevirOld	[worm filename]	"Added by the OPASERV WORM!"
X	AlexaToolbar	alt.exe	Identified by Ewido Security Suite (Ewido is now part of AVG Technologies) as the DELF.EB TROJAN!
X	AlfaCleaner	AlfaCleaner.exe	"AlphaCleaner is now a stealth install using exploits on unpatched systems. Seen alongside RazeSpyware"
?	ALFY Accellerator	AlfyAC~1.exe	"??"
X	ALG.EXE	iexplorer .exe	"Added by the DEMOTRY-B WORM!"
Y	ALiSndMgr	ALiSndMg.exe	ALi AC97 Sound driver
?	AliUSBfix	GREENMK.exe	"May be realted to a USB 2.0 PCI card - the IOgear GIC220OU?"
X	alkasr	?????.exe	"Added by the BALKART TROJAN!"
U	All Aboard Status	stswin.exe	"All Aboard! Internet Connection Sharing status icon"
X	All Sea screen saver	TaskTray.exe	"Free screensaver
N	AllerCalc	AllerCalc.exe	"AllerCalc is an expression calculator which allows you to directly enter an expression to be evaluated. Can be started manually"
X	Allopassw	[path to trojan]	"Added by the RANKY.CU TROJAN!"
U	ALLTEL DSL Check-up Center	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	AllToTray	ALLTOTRAY.EXE	"AlltoTray from DNTSoft - minimize any program to your System Tray"
X	ALM	csrss32.exe	"Added by the ANACON-D VIRUS!"
X	Alogrithm Link Queue	alq.exe	"Added by a variant of the SDBOT WORM!"
U	Alogserv	Alogserv.exe	"From McAfee VirusScan for logging scanning activities. In some cases
Y	Alps Electric USB Server	Monserv.exe	"Alps Electric USB Server - required according to this article"
U	ALServ	ALServ.exe	Utility that enables a user to control the volume and surround sound and select Pro Logic/Stereo on 2 satellite speakers and subwoofer of old Altec Lansing speaker systems. The right-side speaker has 4 controls on top providing same functionality
X	alt CTRL Shift	et3rd.exe	"Added by the SDBOT-RH BACKDOOR!"
X	ALTER DATA	[path] repcale.exe [path] beird.exe	"Added by the IRCFLOOD.CD TROJAN! Both files are located in %System%\ccdew"
X	Altnet	points manager.exe	"Altnet TopSearch adware"
X	AltnetPointsManager	points manager.exe	"Altnet TopSearch adware"
U	AltoMB_service	AltoMBsrv.exe	"Alto Memory Booster from Alto Software - boost the computers performance via more intelligent and efficient memory management. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
N	ALU Scheduler Service	ALUSchedulerSvc.exe	Symantec LiveUpdate scheduler for programs such as Norton AV or Internet Security
U	ALUAlert	ALUNotify.exe	Notification reminder for Symantec's LiveUpdate. Leave enabled unless you manually run LiveUpdate on a regular basis
N	Aluria Security Center	SecurityCenter.exe	"Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU
U	Aluria's Pop-Up Stopper	eps.exe	Aluria Pop-Stopper
N	Aluria's Spyware Eliminator	ASE.exe	"Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU
U	AlwaysOnTopMaker	AlwaysOnTopMaker.exe	"Always On Top Maker - utilty to enable an application to always be displayed ""on top"" of others on the desktop"
U	AlwaysReady Power Message APP	ARPWRMSG.EXE	"""Away Mode"" feature added with Update Rollup 2 for Windows XP Media Center Edition 2005 that allows the computer to appear off to the user while it continues to perform tasks that do not require user input
U	AMD PowerNow!	GemBack.exe	"
N	America Online	aoltray.exe	"Adds the AOL icon in the System Tray (*.* denotes version if present) for versions of AOL up to and including 9.0. Start AOL via the desktop or quick launch shortcuts or via Start → All Programs"
N	America Online *.* Tray Icon	aoltray.exe	"Adds the AOL icon in the System Tray (*.* denotes version if present) for versions of AOL up to and including 9.0. Start AOL via the desktop or quick launch shortcuts or via Start → All Programs"
N	AME_CSA	"rundll32 amecsa.cpl	RUN_DLL"
X	Amie Release V6.9D	services.exe	"Added by the VB-EAN TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	amircivil	svchost.exe…	"Added by the AMIRECIVEL WORM!"
Y	Amonitor	amon.exe	"Tiny Personal Firewall"
U	AMO_Taskplaner.exe	AMO_Taskplaner.exe	"Part of Ashampoo® Magical Optimizer from Ashampoo GmbH & Co. KG - which removes stagnant and unnecessary hard drive files
U	AMO_TA~1	AMO_Taskplaner.exe	"Part of Ashampoo® Magical Optimizer from Ashampoo GmbH & Co. KG - which removes stagnant and unnecessary hard drive files
N	Anapod Manager	anamgr.exe	"Anapod Explorer from Red Chair Software ""is the most advanced Windows iPod® software available
X	Andware Defence	Zsoft32.exe	"Added by the GAOBOT.OO WORM!"
Y	ANIWZCS2Service	WZCSLDR2.exe	"ALPHA Networks wireless driver"
?	ANIWZCSService	WZCSLDR.exe	D-Link wireless PCI adapter related. In some cases reported to cause excessive CPU activity
U	Anonymizer Total Net Shield	AnonTns.exe	"Anonymizer Total Net Shield - ID protection and privacy software"
Y	ANONYMIZER_SPYWAREKILLER	SpyWareKiller.exe	"Anonymizer Spyware Killer
Y	ANONYMIZER_SPYWAREKILLER	AnonAntiSpyware.exe	"Anonymizer Anti-Spyware - now discontinued"
U	Another Internet Explorer Popup Killer	aiepk2.exe	"Another IE Popup Killer - pop-up stopper"
X	ansjava	[path to worm]	"Added by the RANDON-AN WORM!"
X	Answer Problem	dSAFsqs.exe	"Added by the SDBOT-SC WORM!"
U	AnswerTool	AnswerTool.exe	"AnswerTool - save your E-mail replies in AnswerTool
X	Anti Spam Service	spamsvc.exe	"Added by the MYTOB-BK WORM!"
N	Anti-Blaxx Manager	Anti-Blaxx.exe	"Anti-Blaxx - bypass blacklistings from different copy protections bypassing methods like virtual CD or DVD drives"
U	Anti-keylogger check	antikey.exe	"Anti-keylogger - protects against keylogger programs monitoring your keystrokes"
U	Anti-Trojan-Watch	ATWatch.exe	Anti-Trojan Watch - trojan detector
X	Anti-Virus	vpms.exe	"Added by a variant of the SLAPER TROJAN!"
X	Anti-Virus	[random filename].exe	"Added by the CAPROBAD-A TROJAN!"
X	Anti-Virus Product Sync	[unprintable character][3 characters]log.exe	"Added by the KEDEBE.D WORM!"
X	Anti-Virus Update Scheduler	[path to trojan]	"Added by the SPAMMIT-A TROJAN!"
X	Anti-Virus Update Scheduler	winsp3.exe	"Malware - detected by Kaspersky as the AGENT.FP TROJAN!"
X	Anti-Virus Update Scheduler V1.39.12R	[path to trojan]	"Added by the HEPLANE or STAPREW.B TROJANS! - different filenames have been spotted; examples: msvc.exe
X	AntiCareMain	AntiCare.exe	"AntiCare rogue security software - not recommended"
X	AntiClicker	SVCHST32.EXE	"Added by the CBH TROJAN!"
U	antidialer.co.uk	Dialer_Watcher.exe	"Dialer_Watcher is an application that allows you to detect dialers on your computer"
Y	AntiFreeze	AntiFreeze.exe	"AntiFreeze from Resplendence Software Projects - ""offers a last recourse when you find your computer in a hung state"". If your system has hung and AntiFreeze is running
X	antihost	ahr.exe	"Added by the BANCBAN-QJ TROJAN!"
X	AntiMalware	AntiMalware.exe	"AntiMalware rogue security software - not recommended
X	Antimalware Doctor.exe	Antimalware Doctor.exe	"Antimalware Doctor rogue security software - not recommended
X	AntiMalwareGuard	amg.exe	"AntiMalwareGuard rogue security software - not recommended
X	AntiMalwareSuite	AMS.exe	"AntiMalwareSuite rogue security software - not recommended
X	AntiMalware_ProNET	AntiMalware_Pro.exe	"AntiMalware Pro rogue security software - not recommended
X	AntiSpionagePro	pgs.exe	"AntiSpionagePro
X	antispy	ANTIVIR.exe	"IE AntiVirus rogue security software - not recommended
X	antispy	ANTIVIRUS.exe	"IE AntiVirus rogue security software - not recommended
X	AntiSpyControl	pgs.exe	"AntiSpyControl rogue security software - not recommended
X	AntiSpyGuard	AntiSpyGuard.exe	"AntiSpyGuard rogue security software - not recommended
X	antispysoldier	antispysoldier.exe	"AntiSpyware Soldier rogue spyware remover - not recommended
X	AntispySpider	antispyspider.exe	"AntiSpySpider rogue spyware remover - not recommended
X	AntispyStorm	AntispyStorm.exe	"AntispyStorm rogue security software - not recommended
X	AntiSpyware	AntiSpyware.exe	"AntiSpywareApp rogue spyware remover - not recommended
X	AntiSpyware Pro	AntiSpyware Pro.exe	"AntiSpyware Pro 2009 rogue spyware remover - not recommended
X	Antispyware PRO XP	asproxp.exe	"AntiSpyware Pro XP rogue spyware remover - not recommended
X	Antispyware-2008.exe	Antispyware-2008.exe	"AntiSpyware 2008 rogue security software - not recommended
Y	AntiSpyWare2Guard	AntiSpyWare2Guard.exe	"Part of Ashampoo® AntiSpyWare 2 from Ashampoo GmbH & Co. KG. This part is the realtime monitor that looks for changes on the users system such as BHO
X	AntiSpyware3000.exe	antispyware.exe	"AntiSpyware 3000 rogue spyware remover - not recommended
X	AntiSpywareBot	AntiSpywareBot.exe	"AntiSpywareBot rogue spyware remover - not recommended
X	AntiSpywareControl	pgs.exe	"AntiSpywareControl rogue security software - not recommended
X	AntispywareD	AntispywareD.exe	"AntiSpywareDeluxe rogue security software - not recommended
X	AntiSpywareExpert	ase.exe	"AntiSpywareExpert rogue security software - not recommended
X	AntiSpywareGuard	asg.exe	"AntiSpywareGuard rogue spyware remover - not recommended
X	AntiSpywareMaster	asm.exe	"AntiSpywareMaster rogue security software - not recommended
X	AntiSpywareShield	AntiSpywareShield.exe	"AntiSpywareShield rogue security software - not recommended
X	AntiSpywareSuite	pgs.exe	"AntiSpywareSuite rogue security software - not recommended. A member of the AVSystemCare family"
X	AntiSpywareXP 2009	AntiSpywareXP2009.exe	"AntiSpywareXP 2009 rogue spyware remover - not recommended
X	AntiTroy	AntiTroy.exe	"AntiTroy rogue security software - not recommended
X	AntiTroy.exe	AntiTroy.exe	"AntiTroy rogue security software - not recommended
X	AntiVer2008	pgs.exe	"AntiVer2008
X	AntiVermeans	AntiVermeans.exe	"Variant of the Antivermins rogue security software - not recommended
X	AntiVermins	AntiVermins.exe	"Antivermins rogue security software - not recommended
X	AntiVermins 3.0	AntiVermins 3.0.exe	"Antivermins rogue security software - not recommended
X	AntiVermins 3.3	AntiVermins 3.3.exe	"Antivermins rogue security software - not recommended
X	AntiVerminser	AntiVerminser.exe	"Variant of the Antivermins rogue security software - not recommended
X	AntiVerminsPro	AntiVerminspro.exe	"Antivermins rogue security software - not recommended
X	antiviirus	antiviirus.exe	Added by a variant of the AGENT.KEU TROJAN!
X	Antivir	svchst.exe	"Added by the RAGRUK-A TROJAN!"
X	AntiVir	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	AntiVir	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	AntiVir	smss.exe	"Added by the DWNLDR-GWE TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%"
Y	AntiVir XP	AVwin.exe	"AntiVir® PersonalEdition Classic - antivirus"
X	Antivir64	Antivir64.exe	"Antivir64 rogue spyware remover - not recommended
X	AntiviralGolden	AntiviralGolden.exe	"AntiviralGolden rogue security software - not recommended
X	AntiVirGear 3.7	AntiVirGear 3.7.exe	"AntiVirGear rogue security software - not recommended
X	AntiVirGear 3.8	AntiVirGear 3.8.exe	"AntiVirGear rogue security software - not recommended
X	AntiVirProtect	AntiVirProtect.exe	"AntiVirProtect rogue security software - not recommended
X	Antivirus	av.exe	"Added by the SINKIN TROJAN! Resets IE start page to realphx.com"
X	Antivirus	maja.exe	"Added by the NETSKY.H WORM!"
X	Antivirus	iexpl0res.exe	Added by an unidentified WORM or TROJAN!
X	AntiVirus	kaspery.exe	"Added by a variant of the RBOT WORM!"
X	AntiVirus	AntiVirus.exe	"Added by the BANKER-EHB TROJAN!"
X	Antivirus	Antvrs.exe	"AntiVirus 2008 rogue security software - not recommended
X	Antivirus	avm.exe	"Antivirus Master rogue security software - not recommended
X	Antivirus	vav.exe	"Vista Antivirus 2008 rogue security software - not recommended
X	Antivirus	aav.exe	"Advanced Antivirus rogue security software - not recommended
X	ANTIVIRUS	AVS.exe	"Antivirus Sentry rogue security software - not recommended
X	ANTIVIRUS	microAV.exe	"Micro Antivirus 2009 rogue security software - not recommended
X	Antivirus	MSA.exe	"MS Antivirus rogue security software - not recommended
X	ANTIVIRUS	UltraAV.exe	"Ultra Antivirus 2009 rogue security software - not recommended
X	Antivirus	xpa.exe	"Xpert Antivirus Enterprise rogue security software - not recommended
X	Antivirus	SPP.exe	"Spyware Preventer rogue security software - not recommended
X	Antivirus	sav.exe	"System Antivirus 2008 rogue security software - not recommended
X	Antivirus	uav.exe	"Ultimate Antivirus 2008 rogue security software - not recommended
X	Antivirus	wav.exe	"Windows Antivirus 2008 rogue security software - not recommended
X	Antivirus 2009	av2009.exe	"AntiVirus'09 rogue security software - not recommended
X	Antivirus 2009 plus	Antivirus 2009 plus.exe	"AntiVirus Plus rogue security software - not recommended
X	Antivirus Agent Pro	aap.exe	"Antivirus Agent Pro rogue security software - not recommended
X	Antivirus Installer	[path to trojan]	"Added by the BADGENT-A TROJAN!"
X	Antivirus PC 2009	avpc2009.exe	"Antivirus PC 2009 rogue security software - not recommended
X	Antivirus Pro 2009	AntivirusPro2009.exe	"AntiVirus Plus rogue security software - not recommended
X	Antivirus Pro 2010	AntivirusPro_2010.exe	"Antivirus Pro 2010 rogue security software - not recommended
X	AntiVirus Process	virprot.exe	"Added by a variant of the SDBOT WORM!"
X	Antivirus Protection Services	ccapp2.exe	"Added by the RBOT.EXI WORM!"
X	AntiVirus Update	updates.exe	"Added by the RBOT-JF WORM!"
X	AntiVirus Update	antivirus.exe	"Added by the RBOT-IF WORM!"
X	Antivirus Updates	avupdchk.exe	"Added by the AGOBOT-IP WORM!"
X	Antivirus-2008.exe	Antivirus-2008.exe	"Antivirus 2008 rogue security software - not recommended. Detected by Sophos as the FAKEAV-BK TROJAN!"
X	antivirus-2008pro.exe	antivirus-2008pro.exe	"Antivirus 2008 PRO rogue security software - not recommended. Detected by Sophos as the FAKEAV-AW TROJAN!"
X	Antivirus-Golden	Antivirus-Golden.exe	"Antivirus-Golden rogue security software - not recommended"
X	Antivirus.exe	Antivirus.exe	"Antivirus rogue security software - not recommended
X	Antivirus2008y	antvrs.exe	"AntiVirus 2008 rogue security software - not recommended
X	antivirus32	antivirus.exe	"Added by the SPYBOT.KAI WORM!"
X	AntivirusBEST	Installer.exe	"Installer for the AntivirusBEST rogue security software - not recommended. Removal instructions here"
X	AntivirusBEST	abest.exe	"AntivirusBEST rogue security software - not recommended
X	AntivirusDoc	AntivirusDoc.exe	"AntivirusDoc rogue security software - not recommended
X	AntivirusFiable	pgs.exe	"AntivirusFiable
X	AntivirusForAll	pgs.exe	"AntivirusForAll rogue security software - not recommended
X	AntivirusGold	AntivirusGold.exe	"AntivirusGold rogue security software - not recommended
X	AntivirusGold 5.1	AntivirusGold 5.1.exe	"AntivirusGold rogue security software - not recommended
X	AntiVirusLab2009	AntiVirusLab2009.exe	"Antivirus Lab 2009 rogue security software - not recommended
X	AntivirusOrdi	pgs.exe	"AntivirusOrdi
X	AntivirusPCPakke	pgs.exe	"AntivirusPCPakke
X	AntivirusPCSuite	pgs.exe	"AntivirusPCSuite rogue security software - not recommended
X	Antiviruspertutti	pgs.exe	"Antiviruspertutti rogue security software - not recommended. A member of the AVSystemCare family"
X	AntiVirusPro	AntiVirusPro.exe	"Anti Virus Pro rogue security software - not recommended"
X	AntiVirusProMFC	Antivirus Pro.exe	"AntiVirus Pro rogue security software - not recommended"
?	AntiVirusProtection	qumk.exe	"??"
X	AntivirusProtection	antivirusprotection.exe	"Antivirus Protection rogue security software - not recommended
X	Antivirusscherm	pgs.exe	"Antivirusscherm
X	AntivirusXP.exe	AntivirusXP.exe	"Antivirus XP Pro rogue security software - not recommended
X	AntiVirus_ProNET	AntiVirus_Pro.exe	"AntiVirusPro rogue security software - not recommended
X	antiware	elite***32.exe [*** = random char]	"Added by the DLOADER-HW TROJAN!"
U	AntiWindowsMessenger	AntiMsMsg.exe	"Anti-Windows_Messenger is a small application that prevents Windows Messenger from remaining resident in memory"
X	AntiWorm2008	pgs.exe	"AntiWorm2008 rogue security software - not recommended. A member of the AVSystemCare family"
X	anti_troj	anti_troj.exe	"Malware installed by different rogue security software including SpyKillerPro. Also detected as the LODEAR.D TROJAN!"
U	AnVir	AnVir.exe	"AnVir Task Manager - ""is a tool that controls everything running on computer and provides Windows enhancements that help in every-day work"". Monitors and manages startup programs
U	AnVir Security Suite	AnVir.exe	"AnVir Security Suite - ""is a tool that controls everything running on computer and provides Windows enhancements that help in every-day work"". Monitors and manages startup programs
U	AnVir Task Manager	AnVir.exe	"AnVir Task Manager - ""is a tool that controls everything running on computer and provides Windows enhancements that help in every-day work"". Monitors and manages startup programs
U	AnVir Task Manager Free	AnVir.exe	"AnVir Task Manager Free - ""is a tool that controls everything running on computer and provides Windows enhancements that help in every-day work"". Monitors and manages startup programs
U	AnVir Task Manager Pro	AnVir.exe	"AnVir Task Manager Pro - ""is a tool that controls everything running on computer and provides Windows enhancements that help in every-day work"". Monitors and manages startup programs
X	AnvTrgr	AnvTrgr.exe	"AntivirusTrigger rogue security software - not recommended
?	anycom bluetooth	ftflauncher.exe	"Associated with an Anycom bluetooth wireless card. What does it do and is it required?"
U	AnyDVD	AnyDVDtray.exe	"System Tray access to AnyDVD from SlySoft - which descrambles DVD-Movies automatically in the background and the DVD appears unprotected and region code free. Also removes prohibited operations from the DVD such as skipping adverts"
U	AnyTime Organizer	AtDem.exe	"AnyTime Organizer Deluxe from Individual Software Inc - ""all the tools you need to organize your calendar
U	AnyTime Organizer	Atw.exe	"AnyTime Organizer Deluxe from Individual Software Inc - ""all the tools you need to organize your calendar
N	AO Tray	AOTray.Exe	System Tray application for AOpen soundcards. Can be run manually via Start -> Settings -> Control Panel
U	AOL Broadband Check-Up	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	Aol Configuration Loader	aimsng.exe	"Added by the SDBOT-XE WORM!"
N	AOL Fast Start	AOL.exe	"Fast Start loads the AOL integrated email
X	AOL Instant Messanger	aim.exe	"Added by the SDBOT-YT WORM! Note - this is not the popular AOL Instant Messenger utility"
X	AOL Instant Messengar	aol.exe	"Added by the AGOBOT-FN WORM!"
X	AOL Instant Messenger	AlM.EXE	"Added by unidentified malware. Note - there ia a lower case ""L"" between the A and M in the filename"
X	Aol Instant Messenger	aolmsg.exe	"Added by the KELVIR.AL WORM!"
X	AOL Instant Messenger	aimsgr.exe	"Added by the IRCBOT.N TROJAN!"
X	AOL Instant Messenger 7.213	aim9283.exe	"Added by the SDBOT-ZF WORM!"
X	AOL Instant Messenger dll runtime	MSAOL32dll.exe	"Added by the RBOT-ATA WORM!"
X	Aol Instant Messenger Fix	aolfix.exe	"Added by the SDBOT-ABJ WORM!"
X	AOL Messenger	[random filename]	"Added by an unidentified VIRUS
X	AOL Messenger	aolmsngr.exe	"Added by the SDBOT-JF WORM!"
X	AOL Messenger Optimized	AOLOpt.exe	"Added by the AOLOPT TROJAN!"
N	AOL Service Libraries	AOLSoftware.exe	"Quoted from AOL Beta Team
X	AOL Services Hosts	aolserviceshosts.exe	Added by an unidentified WORM or TROJAN!
U	AOL Spyware Protection	AOLSP Scheduler.exe	AOL's spyware protection program
U	AOL TopSpeedMonitor	aoltsmon.exe	"AOL's TopSpeed ""web-acceleration technology speeds up your web-browsing experience by storing and reusing elements of web pages that you visit
N	AOLDialer	AOLDial.exe	AOL ISP software dialer - can be activated through a desktop shortcut
X	AOLRegKey32	AOREGSVR512.EXE	"Unidentified malware - see here"
N	AOLSoftware	AOLSoftware.exe	"Quoted from AOL Beta Team
X	AOLSPYWAREREMOVER32	AOLSPYWARECLEANER32.EXE	"Added by the SPYBOT-HJ WORM!"
X	AOLStart	AOLStart.exe	"Added by the KRAIMER.12 TROJAN!"
X	aolupdater.exe	aolupdater.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Aornum	aornum.exe	"Installed along with
N	AOTray	AOTray.Exe	System Tray application for AOpen soundcards. Can be run manually via Start -> Settings -> Control Panel
X	aouei	sysrtmvs.exe	"Chivio dialer"
X	APcDefender	APcDefender.exe	"APcDefender rogue security software - not recommended
X	APCProtect.exe	APCProtect.exe	"APCProtect rogue security software - not recommended
X	APcSecure	APcSecure.exe	"APcSecure rogue security software - not recommended
U	APC_SERVICE	mainserv.exe	"APC PowerChute® Personal Edition - ""safe system shutdown software with sophisticated power management functions."" Appears as a service in XP/Vista and under the ""RunServices"" registry key in Win98"
Y	apc_tray	apc_tray.exe	Part of the APC UPS software loaded with the BACK-UPS CS 350 unit. Required to monitor the APC unit in case of power failure
X	Api**.exe [* = random char]	Api**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Api**32.exe [* = random char]	Api**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	APIClass	lexplore_.exe	"Added by the MSNOPT-A TROJAN!"
X	APIMon	msreg.exe	"Added by the DROPPER.Z TROJAN!"
X	apmanager.exe	apmanager.exe	"AP Manager ransomware download manager - not recommended
?	Apmsrv9x	APMSRV9X.EXE	"Intel AnyPoint Wireless II Home Network related. Now discontinued. What does it do and is it required?"
X	App**32.exe [* = random char]	App**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	App.EXEName	[path to worm]	"Added by the BODIRU WORM!"
U	AppExtender	AppExtCB.exe	"Loads the Confimax add-in for popular E-mail programs to confirm E-mails have been sent and received"
N	AppleSyncNotifier	AppleSyncNotifier.exe	"From WinPatrol PLUS by BillP Studios - ""This file installs with iTunes and is used when syncing your iPhone
X	Application	csrss.exe	"Added by the BEAGLE.EG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Application Adapter	abvsvc.exe	"Added by the CHECKOUT WORM!"
U	Application Explorer	Naldesk.exe	"Novell Zenworks Application Explorer Executable. ""For almost all users the Novell ZENworks agent (either Application Launcher or Application Explorer) will be run via the user's login script on each successful login. ZENworks is used to periodically deliver software updates and is also used to install the remote management components."""
U	Application Explorer	NalView.exe	"Application Explorer - file manager type access to Novell Application Launcher for installing and updating network residing applications"
X	Application Explorer	appexplr.exe	"Added by the AGENT-NMO TROJAN!"
N	Application Launcher	Application Launcher.exe	"System Tray access to the Sony Ericsson PC Suite and HTC Sync mobile phone management utilities. Run manually via the Start Menu (or optional desktop shortcut) before connecting the phone"
X	Application Layer Browser	abgsvc.exe	"Added by the ULPM.FX TROJAN!"
X	Application Layer Gateway Service	algs.exe	"Added by the LINKBOT.M WORM!"
X	Application Layer Scheduler	agtsvc.exe	"Added by the IRCBOT.BJJ BACKDOOR!"
X	Application Layer Services	avrsvc.exe	"Added by the IRCBOT.BJM BACKDOOR!"
X	Application Manager	acnsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Application Manager	apnsvc.exe	"Added by the SMALLTRO.FN TROJAN!"
X	ApplicationProtocolRun	smsbvl32.exe	"Added by the IRCBOT-CX TROJAN!"
U	AQ3HelperStartUp	AQ3HEL~1.EXE	"ScreenScenes ""Aquatica Water Worlds"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	ara-key	[random filename]	"Added by the ANTINNY WORM!"
?	ArabLionZ Drive	ArabLionZ.Drive.exe	"ArabLionZ Drive - part of ArabLionZ XP Tools. What does it do and is it required?"
Y	ArcaCheck	ArcaCheck.exe	"Part of the ArcaVir antivirus suite from Polish company Arcabit. What does this part do?"
X	arcaderockstar	arcaderockstar32.exe	"Arcade Rockstar (now Gamevance) - free arcade games and prize tournaments. The program itself is clean
X	Archive	archive.exe	"Adware - detected by Kaspersky as the CENTIM.A TROJAN!"
X	ARCHIVE CONTROL	fixupdattr.exe	"Added by the MYTOB.GU WORM!"
N	ArcSoft Connect	ACDaemon.exe	"Used to serve notice of product information and updates when running ArcSoft products such as TotalMedia
N	ArcSoft Connection Service	ACDaemon.exe	"Used to serve notice of product information and updates when running ArcSoft products such as TotalMedia
N	ARCSolo Recovery	N/A	Backup software by Computer Associates - no longer supported
U	Arctosa	razerhid.exe	"Razer Arctosa gaming keyboard driver - required if you use the additional features and programmed keys/macros"
U	Ardamax Keylogger	akl.exe	"Ardakey keystroke logger/monitoring program - remove unless you installed it yourself!"
N	ares	ares.exe	"""Ares is a free open source file sharing program that enables users to share any digital file including images
N	areslite	AresLite.exe	"""Ares is a free open source file sharing program that enables users to share any digital file including images
U	Argentum Backup	ab.exe	"Argentum Backup - a small backup program that lets you easily back up your documents and folders"
X	argq32	csrss_32.exe	"Added by the RBOT-CPM WORM!"
X	Aritima	aritima.exe	"Added by the ARITIM WORM!"
X	Arman	[path to worm]	"Added by the IRCBOT-TG WORM!"
U	ARMOR2NET	Armor2net.exe	"Related to Armor2net personal firewall (possibly contains or is related to a product known as ArmorWall - which is a known rogue
X	ArmorDefender	ArmorDefender.exe	"ArmorDefender rogue security software - not recommended
U	army logo	readmename.exe	"Torrent101 potentially unwanted torrent client application that installs a Browser Helper Object and displays advertisements"
X	aromis	aromis.exe	"Added by the NUWAR.JQ WORM!"
N	AROReminder	aro.exe	"Advanced Registry Optimizer - ""scan
U	Arovax AntiSpyware	arovaxantispyware.exe	"Part of Arovax AntiSpyware from Arovax
Y	Arovax Shield	ArovaxShield.exe	"Part of Arovax Shield from Arovax
U	arovaxantispyware	arovaxantispyware.exe	"Part of Arovax AntiSpyware from Arovax
Y	ArovaxShield	ArovaxShield.exe	"Part of Arovax Shield from Arovax
U	ARPWRMSG	ARPWRMSG.EXE	"""Away Mode"" feature added with Update Rollup 2 for Windows XP Media Center Edition 2005 that allows the computer to appear off to the user while it continues to perform tasks that do not require user input
U	Artera	arteraui.exe	"Artera Turbo Internet Accelerator - ""surf faster
X	Arucer	"rundll32 Arucer.dll	Arucer"
X	Arucer Dynamic Link Library	"rundll32 Arucer.dll	Arucer"
?	AS00 Gear511	Gear511.exe	"Software for Netgear wireless network cards. Unknown whether it is required for the wireless card to run but does not seem to be a resource hog. Not required for laptop to run if the wireless network card will not be used. Is it at all required?"
N	AS00_Gear511	Gear511.exe	Netgear wireless LAN configuration utility
X	ASC-AntiSpyware	WinCleaner.exe	"WinCleaner 2009 rogue security software - not recommended
X	ASC-AntiSpyware	WinAntivirus.exe	"Win Antivirus Vista/XP rogue security software - not recommended
X	ASDPLUGIN	france.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	100176br.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	Austria.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	netherlands.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	turkey.exe	"AsdPlug premium rate adult content dialer"
X	asdx	xwinrpc32.exe	"Added by the AGOBOT.VO WORM!"
N	ASE Scheduler	ASE Scheduler.exe	"Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU
Y	Ashampoo AntiSpyWare 2	AntiSpyWare2Guard.exe	"Part of Ashampoo® AntiSpyWare 2 from Ashampoo GmbH & Co. KG. This part is the realtime monitor that looks for changes on the users system such as BHO
Y	Ashampoo AntiSpyWare 2 Guard	AntiSpyWare2Guard.exe	"Part of Ashampoo® AntiSpyWare 2 from Ashampoo GmbH & Co. KG. This part is the realtime monitor that looks for changes on the users system such as BHO
Y	Ashampoo AntiVirus Service	GuardGui.exe	"System Tray access to the main user interface for Ashampoo® AntiVirus from Ashampoo GmbH & Co. KG."
U	Ashampoo Core Tuner	ct.exe	"Ashampoo® Core Tuner from Ashampoo GmbH & Co. KG - a utility which helps you to get the most out of a multi-processor (or dual core) computer. ""For instant results you just need to select Auto-Optimize to optimize all the programs you are running or Boost to give more power to a single program"". This entry loads Core Tuner with Windows (required if you use any optimized profiles) and gives System Tray access"
Y	Ashampoo FireWall	FireWall.exe	"Ashampoo® Firewall FREE from Ashampoo GmbH & Co. KG"
Y	Ashampoo FireWall PRO	FireWall.exe	"Ashampoo® Firewall PRO from Ashampoo GmbH & Co. KG"
U	Ashampoo HDD Control Guard	HDDControlGuard.exe	"Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access"
U	Ashampoo Magical Defrag	aDefragCtrl.exe	"System Tray access to the main user interface for Ashampoo® Magical Defrag from Ashampoo GmbH & Co. KG - which ""runs in the background as a service
U	Ashampoo Magical Optimizer Taskplaner	AMO_TA~1.EXE	"Part of Ashampoo® Magical Optimizer from Ashampoo GmbH & Co. KG - which removes stagnant and unnecessary hard drive files
U	Ashampoo Magical Optimizer Taskplaner	AMO_Taskplaner.exe	"Part of Ashampoo® Magical Optimizer from Ashampoo GmbH & Co. KG - which removes stagnant and unnecessary hard drive files
U	Ashampoo PopUpBlocker	PopUpKiller.exe	"Ashampoo popup blocker
N	ashampoo UnInstaller Watcher	UIWatcher.exe	"Part of the Ashampoo® UnInstaller series from Ashampoo GmbH & Co. KG - including UnInstaller Platinum 2
X	ashcap	servirsess.exe	"SpySure spyware"
U	AsioReg	regsvr32.exe ctasio.dll	"ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality"
U	AsioThk32Reg	rregsvr32.exe ctasio.dll	"ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality"
U	ASK	rundll32.exe [path] ASK.dll rdl	"Stealth Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	asl	Aslru.exe	"Added by the BANCOS-CU TROJAN!"
U	ASM	ASMonitor.exe	"Active Security Monitor from AOL - helps you determine how vulnerable your PC is to computer viruses
U	Asmw Soft Popups Burner	popups burner.exe	"Popup blocker
X	ASocksrv	SocksA.exe	"Added by the VB.CBW WORM!"
X	asp-srvc	asp-srvc.exe	"Added by the AGOBOT-KG WORM!"
X	ASP.NET State Service	csrss.exe	"Added by the DLOADER-QI TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	ASP.NET State Service	crsass.exe	"Added by the BANLOAD-M TROJAN!"
X	ASP.NET State Service	servicos..exe	"Added by the DADOBRA-I TROJAN!"
N	asp4tray	asp4tray.exe	System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel
?	AspireService	AspireService.exe	"Found on Acer laptops
Y	AspireTimeMachine	acertmb.exe	"System recovery software supplied with some Acer notebook PCs. Similar to GoBack and the restore program in WinXP
X	asr64_ldm.exe	asr64_ldm.exe	"Added by the Dr. Guard rogue security software - not recommended
X	asrupdate.exe	asrupdate.exe	"Added by the VB.ATZ TROJAN!"
U	ASTART	astart.exe	ASUS TweakEnable - restores manually changed settings for ASUS based video cards such as overclocking. Only required if you use non-standard settings
X	AStart	AStart	"Added by the VB.AH TROJAN!"
N	asTray	Astray.exe	"Voyetra Audio Station - part of Voyetra's Ultimate MP3 & CD Manager. MP3 and digital music jukebox/organizer"
N	Astro	Astro.exe	Checks for updates to Quicken on a system reboot
X	Astrum	Astrum.exe	"Astrum Antivirus Pro rogue security software - not recommended
?	ASUS Camera ScreenSaver	ASScrProlog.exe	"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
N	ASUS Probe	AsusProb.exe	ASUS video card fan/thermal monitor - only required if you overclock your card or live in a hot area
?	ASUS Screen Saver Protector	ASScrPro.exe	"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
U	ASUS SmartDoctor	VGAProbe.exe	ASUS video card fan/thermal monitor
U	ASUS TweakEnable	astart.exe	ASUS TweakEnable - restores manually changed settings for ASUS based video cards such as overclocking. Only required if you use non-standard settings
?	AsusACPIServer	AsAcpiSvr.exe	"Part of the ACPI driver for the Asus Eee PC range. What does it do and is it required?"
U	AsusEPCMonitor	AsEPCMon.exe	"Part of the ACPI driver for the Asus Eee PC range. Manages the Fn function keys and ""on screen display"""
N	ASUSGamerOSD	GamerOSD.exe	"GamerOSD by ASUSTek - for ""real-time overclocking
?	AsusStartupHelp	AsRunHelp.exe	"Unknown ASUS motherboard utility. What does it do and is it required?"
U	AsusTray	AsTray.exe	"Part of the ACPI driver for the Asus Eee PC range. Watches the sensors of the motherboard such as power and temperature"
N	ASUSWebStorage	ASUSWSDashBoard.exe	"System Tray access to ASUS Webstorage online backup and sharing utility which is pre-installed on some ASUS systems or available for free (with 1GB available) for others. Disable unless you want to automatically backup and sync your files every time your system starts"
N	AsusWSDashBoard	ASUSWSDashBoard.exe	"System Tray access to ASUS Webstorage online backup and sharing utility which is pre-installed on some ASUS systems or available for free (with 1GB available) for others. Disable unless you want to automatically backup and sync your files every time your system starts"
U	AT&T Self Support Tool	matcli.exe	"AT&T Resolution Assistant. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	atapidrv	atapidrv.exe	"Added by the AGOBOT-SL WORM!"
X	atf_reinstall	atf.exe	"Part of the AVSystemCare rogue security software - not recommended. See here"
X	ATI Active Graphics Card Monitor	atievx.exe	"Added by the IRCBOT-TL WORM!"
X	ATI AS Filter	msnse.exe	"Added by the RBOT-CCY WORM! Note - modifies the HOSTS file by appending numerous lines
N	ATI CATALYST System Tray	CLI.exe SystemTray	"System Tray access to ATI's Catalyst™ Control Center. Note that this has ""SystemTray"" appended to CLI.exe in the ""Command"" column of MSCONFIG. Not required to run the control center - which is available via a right-click on the desktop"
X	Ati Control Panel	atiphexx.EXE	"Added by the RBOT-BR WORM!"
X	ATI Display Driver	atixd.exe	"Added by the RBOT-FOV WORM!"
N	ATI GART Set-up Utility	Atigart.exe	"Program that checks the motherboard chipset and determines which GART driver bundle to install on ATI video cards. If you have one
X	ATI Rage3d Pro	AtiRage4dPro.exe	"Added by the AGOBOT-OG WORM!"
Y	ATI Remote Control	ATIRW.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
Y	ATI Remote Control	ATIX10.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
N	ATI Scheduler	Atisched.exe	Component that remains resident in memory and automatically launches the ATI VIDEO PLAYER at a user selected time and date. Delete the shortcut in the Start -> Programs -> Startup folder as well. Functions could re-enable the program to load at start-up and re-introduce the shortcut. Try it and see
U	ATI Technologies Inc. HydraVision Desktop Manager	HydraDM.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is the HYDRAVISION Desktop Manager - which ""customizes the behaviour of windows and dialog boxes
U	ATI Technologies Inc. HydraVision Viewport	HydraMD.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is HYDRAVISION MultiDesk - which ""creates
X	ATI Technology Startup	techstart.exe	"Added by the RBOT-AEU WORM!"
X	ATI Video Driver Control	atigfx.exe	"Added by the RBOT-FWL WORM!"
X	ATI Video Driver Control	btorrent.exe	"Added by a variant of the IRCBOT TROJAN!"
X	ATI Video Driver Controls	[path to worm]	"Added by the SDBOT-DDS WORM!"
X	ATI VIDEO REGKEY	ati2vid.exe	"Added by the SDBOT.UR WORM!"
N	ATICCC	cli.exe runtime	"ATI's Catalyst™ CONTROL CENTER. Required if you want to change graphics settings on a regular basis but you must have internet access and Microsoft's .NET framework installed. Note that this has ""runtime"" appended to cli.exe in the ""Command"" column of MSCONFIG. Recommend that start the program manually via Start → Programs → ATI Catalyst Control Center → Advanced → Restart Runtime as it can cause problems when starting Windows"
N	ATICCC	CLIStart.exe	Puts the ATI Catalyst™ Control Center Icon/Shortcut on the System Tray - available via Start → Programs
X	AtiDisplayDrv	atidrvxx.exe	"Added by the RBOT-VZ WORM!"
X	atidriver	reaIplayer.exe	"Added by the WARPIGS-E WORM! Note the uppercase ""I"" in the filename
N	AtiGart	Atigart.exe	"Program that checks the motherboard chipset and determines which GART driver bundle to install on ATI video cards. If you have one
Y	ATIRmtWndr	ATIX10.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
U	ATISmart	ati2s9ag.exe	"ATI's ""SMARTGART""
U	AtiSound	csrss.exe	"WinSpy surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""ComRoot"" subfolder"
X	atisrc2	windfind.exe	"Added by the WINDFIND-A TROJAN!"
U	atitray	atitray.exe	ATI Tray Tools - allows quick access to ATI graphics card settings
U	AtiTrayTools	atitray.exe	ATI Tray Tools - allows quick access to ATI graphics card settings
X	ATIUpdater	atiupdxx.exe	"Added by the RBOT-ABX WORM!"
X	Atl**.exe [* = random char]	Atl**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Atl**32.exe [* = random char]	Atl**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	ATM Control	adpn.exe	"Added by the MMS.A WORM!"
U	Atomic Time Synchronizer	TimeSync.exe	"TimeSync - lets you synchronize your computer's clock with any internet atomic clock"
X	Atomic-x27C	AtomicpartC.exe	"Added by the KATOMIK-A WORM!"
U	Atrack	atrack.exe	"New feature of Norton Internet Security (NIS) and Norton Personal Firewall (NPF) 3.0 is the Alert Tracker
U	Atray	Atray.exe	"Active Tray is a utility which lets you configure the system tray. You can also create your own tray icons"
U	ATSpooler	AppsTraka.exe	"DeskTopScout keystroke logger/monitoring program - remove unless you installed it yourself!"
U	ATTBroadbandUpdate	SAUpdate.exe	"Big Brother from Quest Software. System and network monitor"
U	ATTRedUpdate	AutoUpdate.exe	Additional item added to start-ups after AT&T took over the now bankrupt Excite@home high-speed internet service. Included for automatically downloading and installing updates. Leave it unless you plan to regularly run it to check for updates
X	AttuneContentUpdater	attune_cu.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	AttuneDiscovery	attune_di.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	AttuneSystray	attune_st.exe	"Aveo Attune automated helpdesk software - adware/spyware"
N	aTuner	atuner.exe	"aTuner - tweak tool for GeForce based graphics cards"
X	AtxBrw	Iexplor.exe	"""Pop Marketing"" adware"
X	Audcntr	audcntr.exe	"Added by the GEMA TROJAN!"
?	AudCtrl	"RunDll32 AudCtrl.dll	RCMonitor"
X	Audio Device Manager	winfp.exe	"Added by the IRCBOT-XS WORM!"
X	Audio Device Manager	WinNT.exe	"Added by the IRCBOT.USP BACKDOOR!"
X	Audio Device Manager	WNDXP.exe	"Added by the IRCBOT.AJL BACKDOOR!"
X	Audio Device Manager	sfhgj.exe	"Added by the IRCBOT-ZA BACKDOOR!"
N	AudioCommander	AudioCommander.exe	"System Tray access to the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
N	AudioCommander Application	AudioCommander.exe	"System Tray access to the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
N	AudioCommanderVista	AudioCommander.exe	"System Tray access to the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
X	Audiodrv	audiodrv.exe	"Added by the CRYPTER-C TROJAN!"
U	AudioDrvEmulator	DLLML.exe AudDrvEm.dll	"Related to Creative DLL Module Loader for the Sound Blaster X-Fi (and maybe others). This program is non-essential process to the running of the system
X	AudioMan	Explorer.sm1	"Added by the HUPIGON.IFZ BACKDOOR!"
X	Audoi Device Loader	smssv.exe	"Added by the AGOBOT-ZY WORM!"
X	auloadplx	mplprogsm.exe	"Added by the SLAPER.K TROJAN!"
X	AUNPS2	"RUNDLL32 AUNPS2.DLL	_Run@16"
Y	Aureal A3D Interactive Audio	sa3dsrv.exe	For Aureal based 3D soundcards. A3D sound features won't work with this disabled
Y	Aureal A3D Interactive Audio Init	A3dInit.exe	For Aureal based 3D soundcards. A3D sound features won't work with this disabled
X	Auth Starter Ident	startauth.exe	"Added by the RBOT-WP WORM!"
Y	Authentic-ID Toolbar	wintmr.exe	"System Tray access to Child Control parental control software by Salfield"
Y	Authentic-ID Toolbar	"rundll32.exe [path] ToolbarATL.dll	LoadTrayIcon"
X	Auto CD-ROM Startup	cdaccess.exe	"Added by the SPYBOT.BLA WORM!"
U	Auto EPSON PictureMate Deluxe on X	E_FATI9TA.EXE	"Epson Status Monitor 3 for the PictureMate Deluxe compact photo printer - for monitoring printer status
U	Auto EPSON Stylus C45 Series on X	E_S4I3T1.EXE	"Epson Status Monitor 3 for the Stylus C45 Series printer - for monitoring printer status
U	Auto EPSON Stylus C48 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C48 Series printer - for monitoring printer status
U	Auto EPSON Stylus C48 Series on X	E_S4I091.EXE	"Epson Status Monitor 3 for the Stylus C48 Series printer - for monitoring printer status
U	Auto EPSON Stylus C60 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C60 Series printer - for monitoring printer status
U	Auto EPSON Stylus C62 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C62 Series printer - for monitoring printer status
U	Auto EPSON Stylus C64 Series on X	E_S4I2C1.EXE	"Epson Status Monitor 3 for the Stylus C64 Series printer - for monitoring printer status
U	Auto EPSON Stylus C82 Series on X	E_S0HIC1.EXE	"Epson Status Monitor 3 for the Stylus C82 Series printer - for monitoring printer status
U	Auto EPSON Stylus C84 Series on X	E_S4I2D1.EXE	"Epson Status Monitor 3 for the Stylus C84 Series printer - for monitoring printer status
U	Auto EPSON Stylus C87 Series on X	E_FATIABL.EXE	"Epson Status Monitor 3 for the Stylus C87 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3500 Series on X	E_FATI9 BL.EXE	"Epson Status Monitor 3 for the Stylus CX3500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3600 Series on X	E_FATI9BE.EXE	"Epson Status Monitor 3 for the Stylus CX3600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3700 Series on X	E_FATIACP.EXE	"Epson Status Monitor 3 for the Stylus CX3700 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3800 Series on X	E_FATIACA.EXE	"Epson Status Monitor 3 for the Stylus CX3800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4200 Series on X	E_FATIAEA.EXE	"Epson Status Monitor 3 for the Stylus CX4200 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4500 Series on X	E_FATI9AP.EXE	"Epson Status Monitor 3 for the Stylus CX4500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4600 Series on X	E_FATI9AA.EXE	"Epson Status Monitor 3 for the Stylus CX4600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4800 Series on X	E_FATIADA.EXE	"Epson Status Monitor 3 for the Stylus CX4800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX5000 Series on X	E_FATIBVA.EXE	"Epson Status Monitor 3 for the Stylus CX5000 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX5500 Series on X	E_FATICAP.EXE	"Epson Status Monitor 3 for the Stylus CX5500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6000 Series on X	E_FATIBIA.EXE	"Epson Status Monitor 3 for the Stylus CX6000 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6600 Series on X	E_FATI9EE.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6600 Series on X	E_FATI9EA.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX7400 Series on X	E_FATICDA.EXE	"Epson Status Monitor 3 for the Stylus CX7400 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX7800 Series on X	E_FATIAFA.EXE	"Epson Status Monitor 3 for the Stylus CX7800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX9400Fax Series on X	E_FATICFA.EXE	"Epson Status Monitor 3 for the Stylus CX9400Fax Series printer - for monitoring printer status
U	Auto EPSON Stylus D78 Series on X	E_FATIBGE.EXE	"Epson Status Monitor 3 for the Stylus D78 Series printer - for monitoring printer status
U	Auto EPSON Stylus D88 Series on X	E_FATIABE.EXE	"Epson Status Monitor 3 for the Stylus D88 Series printer - for monitoring printer status
U	Auto EPSON Stylus DX3800 Series on X	E_FATIACE.EXE	"Epson Status Monitor 3 for the Stylus DX3800 Series printer - for monitoring printer status
U	Auto EPSON Stylus DX4800 Series on X	E_FATIADE.EXE	"Epson Status Monitor 3 for the Stylus DX4800 Series printer - for monitoring printer status
U	Auto EPSON Stylus DX6000 Series on X	E_FATIBIE.EXE	"Epson Status Monitor 3 for the Stylus DX6000 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo 1400 Series on X	E_FATIBUA.EXE	"Epson Status Monitor 3 for the Stylus Photo 1400 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo 820 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo 820 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R1800 on X	E_FATI9LA.EXE	"Epson Status Monitor 3 for the Stylus Photo R1800 printer - for monitoring printer status
U	Auto EPSON Stylus Photo R200 Series on X	E_S4I2H1.EXE	"Epson Status Monitor 3 for the Stylus Photo R200 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R200 Series on X	E_S4I0H2.EXE	"Epson Status Monitor 3 for the Stylus Photo R200 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R220 Series on X	E_FATIAIE.EXE	"Epson Status Monitor 3 for the Stylus Photo R220 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R2400 on X	E_FATI9SA.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	Auto EPSON Stylus Photo R2400 on X	E_FATI9SE.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	Auto EPSON Stylus Photo R260 Series on X	E_FATIBNA.EXE	"Epson Status Monitor 3 for the Stylus Photo R260 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R280 Series on X	E_FATICKA.EXE	"Epson Status Monitor 3 for the Stylus Photo R280 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R300 Series on X	E_S4I2F1.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R300 Series on X	E_S4I0F2.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R320 Series on X	E_FATI9FA.EXE	"Epson Status Monitor 3 for the Stylus Photo R320 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R340 Series on X	E_FATIAJE.EXE	"Epson Status Monitor 3 for the Stylus Photo R340 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R800 on X	E_FATI9YE.EXE	"Epson Status Monitor 3 for the Stylus Photo R800 printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX420 Series on X	E_FATI9CE.EXE	"Epson Status Monitor 3 for the Stylus Photo RX420 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX500 on X	E_S4I2K1.EXE	"Epson Status Monitor 3 for the Stylus Photo RX500 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX600 on X	E_S4I2M1.EXE	"Epson Status Monitor 3 for the Stylus Photo RX600 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX680 Series on X	E_FATICJA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX680 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX700 Series on X	E_FATI9IA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX700 Series printer - for monitoring printer status
U	Auto EPSON Stylus Pro 7600 on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Pro 7600 printer - for monitoring printer status
X	Auto File System Conversion Utility	scricon.exe	"Added by the SDBOT.EYB WORM!"
X	auto repair system	qualityx.exe	"Added by an unidentified WORM or TROJAN - probably a SPYBOT variant"
U	Auto Run Software for Photo Frame	PhotoManager.exe	"Management software for Philips digital PhotoFrame range. Used to edit photos and transfer them directly from a PC via a USB cable. Start manually when you connect the device"
X	Auto Scroll Loader	ASCRLL.EXE	"Added by the SPYBOT-T WORM!"
X	Auto Start	dosin.exe	"Added by the SDBOT-GO BACKDOOR!"
X	Auto Start	sndvol32.exe	"Added by the SLINBOT.AX BACKDOOR!"
X	Auto Start	windos.exe	"Added by the SLINBOT.BO BACKDOOR!"
U	Auto Switch	TASKBAR.exe	Related to 2-port Bitronics AutoSwitch kit from Belkin
N	Auto T Bar	autotbar.exe	If you disable the HP VIEW toolbar in IE and rearrange the toolbars on a reboot they will be back as they were before if this is left enabled
X	Auto updat	crcss.exe	"Added by the SDBOT.AAG WORM!"
X	Auto Updater	asclt.exe	"Added by the SLINBOT.CJ BACKDOOR!"
X	Auto WinUpdate	taskmrg.exe	"Added by the RBOT-AFA WORM!"
X	AutoAdministrator	SERVICES.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Root%\Application Data\WINDOWS"
U	Autobar	autobar.exe	"Connect buttons on the keyboard for internet direct access
N	AutoCAD	acstart17.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
N	AutoCAD Startup Accelerator	acstart16.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
N	AutoCAD Startup Accelerator	acstart17.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
X	autochk	"rundll32.exe autochk.dll	_IWMPEvents@16"
X	autochk	"rundll32.exe protect.dll	_IWMPEvents@16"
X	AutoDiscovery/AutoPurge (ADAP) Service	wmiadapi.exe	"Added by the RBOT.FLT WORM!"
N	AutoEA	Ahqrun.exe	For Creative Soundblaster Live! series soundcards. Specify for any audio application what audio preset to automatically associate with currently active speaker output. Available via AudioHQ
X	Autoloaderaproposclient	Apropos_Client_Loader.exe	"AproposMedia adware"
X	Autoloaderaproposclient	cxtpls_loader.exe	"AproposMedia adware"
X	AutoLoaderEnvoloAutoUpdater	auto_update_loader.exe	"Envolo/AproposMedia adware updater"
N	AutoMate Task Service	automate.exe	"Task scheduler for Unisyn Automate 4 task automation/macro running software. Available via a desktop shortcut or Start → Programs"
X	Automatic Defrag Manager	defrag.exe	"Added by the RBOT-AKE WORM!"
X	Automatic Media Update	CACHE.RVD	Added by an unidentified WORM/TROJAN!
X	Automatic Media Update	HPLNT32.RVD	Added by an unidentified WORM/TROJAN!
X	Automatic Microsoft Windows Updater	suchost.exe	"Added by the RBOT-EQ WORM!"
X	Automatic Windows Updater	Update.exe	"Added by the GAOBOT.AO WORM!"
N	Automatically launches the United Devices Agent when you start your computer	UD.EXE	The United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home but for medical research. Available via Start > Programs
X	autoMe	wscript.exe solution.vbs	"Added by the VBS.SASAN WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""solution.vbs"" file is found in %Windir%"
X	autoMe	wscript.exe samok.vbs	"Added by the SAMOK-A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""samok.vbs"" file is located in %Windir%"
N	AUTOPROP	REGPROP.EXE WMPADDIN.DLL	"Both the files are in the MS Office/Bots/FP_WMP directory. Apparently
X	AutoProtect	AutoProtect.vbs	"Added by the KILLBAT-C WORM!"
X	AUTOPROTECTU	navapq32.exe	Added by an unidentified WORM or TROJAN!
X	autorepair	dexs.exe	"Added by a variant of the SDBOT WORM!"
X	autorn	autorn.exe	"Added by the SILLYFDC.BCY WORM!"
U	Autoroute SMTP	AutoSmtp.exe	"Autoroute SMTP - ""automatic switching between SMTP servers depending on what network you are currently working in."" You need to have two Internet service providers"
X	autorun	autorun.exe	"Added by the AUTOM-B WORM!"
X	autorun	sxs.exe	"Added by the SMALLVBS-A WORM!"
X	autorun	winmain.exe	Added by a variant of the DELF.CNS TROJAN!
X	AutoRun	allrs.exe	"Added by the MUDROP.LJ TROJAN!"
X	autorundemo	[path to trojan]	"Added by the AGENT-FPX TROJAN!"
X	AUTORUN_VAL	AntiSpyCheck 2.1.exe	"AntiSpyCheck rogue spyware remover - not recommended
X	AUTORUN_VAL	asc 2.1.exe	"AntiSpyCheck rogue spyware remover - not recommended
U	AutoSizer	AUTOSIZER.EXE	"AutoSizer - utility that automatically maximizes windows when they're opened"
N	autotbar	autotbar.exe	If you disable the HP VIEW toolbar in IE and rearrange the toolbars on a reboot they will be back as they were before if this is left enabled
X	autoupdate	"rundll32 DATADX.DLL	SHStart"
X	autoupdate	"rundll32 SUPDATE.DLL	SHStart"
X	Autoupdate Service	kaka.exe	"Added by the SYMPE-B TROJAN!"
X	Autoupdate Service	[path to trojan]	"Added by the AGENT-CB TROJAN!"
X	AutoUpdate32	services.exe	"Added by WINSPY.88! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\debug64"
X	AutoUpdater	aupdate.exe	"Tinybar variant"
X	AutoUpdater	AutoUpdate.exe	"PeopleonPage foistware"
X	AutoVirusProtection	ciscv.exe	"Added by a variant of the RBOT WORM!"
X	auto__hloader__key	hloader_exe.exe	"Added by the BAGLE.AB TROJAN!"
N	AUXXTRAY	au30setp.exe	System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel
X	AV	Antivir.exe	"Antivir rogue security software - not recommended
X	av	expressav.exe	"Express Antivirus 2009 rogue security software - not recommended
X	AV AntiSpyware	ava.exe	"AV AntiSpyware rogue security software - not recommended
X	AV Care	AvCare.exe	"AvCare rogue security software - not recommended
X	AV Industry	patch31345.exe	"Added by the MYDOOM.AD WORM!"
X	AV7	antivirus7.exe	"Antivirus7 rogue security software - not recommended
X	AVantivirus	Avconsol.exe	"Added by the MSNVB-D WORM!"
X	avast	troyan.exe	"Added by the SMALL.CZ TROJAN!"
Y	Avast!	ashServ.exe	"Main part of avast! Antivirus - including the resident protection
Y	avast! Antivirus	ashDisp.exe	"System Tray access to and notifications for avast! Antivirus - giving left-click access to the On-Access Scanner
Y	avast! Web Scanner	Ashwebsv.exe	"Web scanning part of avast! Antivirus. Starts via a registry ""Run"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
Y	Avast32	Astart32.exe	"Part of Avast! anti-virus software"
X	AveoAttune	atmdlusr.exe	"Aveo Attune automated helpdesk software - adware/spyware"
U	AVFX Engine	StartFX.exe	"Advanced Video FX - supported by a number of Creative Web Cameras. ""Have more fun by adding a wide range of special effects and backgrounds to your video chat with Advanced Video FX"""
Y	AVG Anti-Spyware	avgas.exe	"System Tray access to and notifications for AVG Anti-Spyware 7.5. This has now been superseded by AVG Anti-Virus which includes Anti-Spyware"
Y	AVG Anti-Virus system	avgcc.exe	"System Tray access to and notifications for the 7.* series of anti-virus products from AVG Technologies. If this entry is disabled
Y	AVG Anti-Virus System	avgemc.exe	"E-mail scanner for the 7.* series of anti-virus products from AVG Technologies. This process scans incoming and outgoing E-mails for viruses and other malware. From version 7.1 onwards this entry only appears in 9x/Me as a startup entry
Y	AVG Anti-Virus System	avgw.exe	"This entry is included with the 7.* series of anti-virus products from AVG Technologies. Once installed (or on first run for a different user) it runs the configuration sequence to set up the product and doesn't run on subsequent restarts"
X	Avg Antivirus	icpldrvx.exe	"Added by the BANKER.BYU TROJAN!"
X	AVG AntiVirus Scanner	avgscnx.exe	"Added by the SILLYFDC.BBE WORM! Note - this is not a legitimate AVG entry"
X	AVG AntiVirus Updater	avgwusv.exe	"Added by the SILLYFDC.BAX WORM! Note - this is not a legitimare AVG entry"
X	AVG Grisoft Updater	updater.exe	"Added by the AGOBOT-OT WORM!"
U	AVG Internet Security	avgtray.exe	"System Tray access to and notifications for the range of internet security products from AVG Technologies - including Internet Security
Y	AVG7_AMSVR	AVGAMSVR.EXE	"This is the AVG7 Alert Manager for the 7.* series of anti-virus products from AVG Technologies. It is essential for both scheduled activities (such as automatic updates and scans) and for displaying alerts and reports via the Control Center (avgcc.exe). Appears in 9x/Me as a startup entry and as a service in 2K and higher"
Y	AVG7_Run	avgw.exe	"This entry is included with the 7.* series of anti-virus products from AVG Technologies. Once installed (or on first run for a different user) it runs the configuration sequence to set up the product and doesn't run on subsequent restarts"
U	AVG8_TRAY	avgtray.exe	"System Tray access to and notifications for the 8.* series of internet security products from AVG Technologies - including Internet Security
U	AVG9_TRAY	avgtray.exe	"System Tray access to and notifications for the 9.* series of internet security products from AVG Technologies - including Internet Security
Y	avgamsvr.exe	Avgamsvr.exe	"This is the AVG7 Alert Manager for the 7.* series of anti-virus products from AVG Technologies. It is essential for both scheduled activities (such as automatic updates and scans) and for displaying alerts and reports via the Control Center (avgcc.exe). Appears in 9x/Me as a startup entry and as a service in 2K and higher"
Y	AVGCtrl	AVGCtrl.exe	"Part of AntiVir® PersonalEdition Classic antivirus"
Y	avgfwsrv	AVGFWSRV.EXE	"Integrated firewall for the 7.* series of anti-virus products from AVG Technologies. Protects the users computer from outside attacks
Y	avgmsvr.exe	avgmsvr.exe	"AVG Anti-Virus 7.0 related"
Y	Avgserv9.exe	Avgserv9.exe	"Background monitoring and scanning for the 6.* (and maybe earlier) series of anti-virus products from AVG Technologies when running on 9x/Me. Loaded from the ""RunServices"" registry key"
U	avgtray	avgtray.exe	"System Tray access to and notifications for the range of internet security products from AVG Technologies - including Internet Security
Y	AVGuard	AVGuard.exe	"AntiVir® PersonalEdition Classic antivirus. Background task which scans files transparently"
X	avguard3876	000b09274b.exe	"AntiVirus ransomware security software - not recommended
Y	AVG_RegCleaner	AVGREGCL.exe	"Boot time registry cleaner for the 7.* series of anti-virus products from AVG Technologies - for checking the registry for virus additions and other security problems"
X	avidrv	drvsc.exe	"Detected by Kaspersky as the AGENT.PH TROJAN!"
X	Avira Anti-Virus Pro 2008	explorear.exe	Added by an unidentified WORM or TROJAN!
X	AvirTr	AvirTr.exe	"AntivirusTrigger rogue security software - not recommended
Y	AVK Mail Checker	AVKPop.exe	"eXtendia AVK AntiVirus email checker"
Y	AVKBar	AVKBar.exe	"GData AntiVirusKit Anti-virus"
Y	AVKTray	AVKTray.exe	"System Tray access to the antivirus part of G Data range of internet security products"
Y	AvMaiSrv	Avmaisrv.exe	"Part of Avast! anti-virus software - E-mail scanner"
X	AVManager	csrss.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
X	avnort	formatsys.exe	"Added by the SERFLOG.A WORM!"
X	avnort	msmbw.exe	"Added by the SERFLOG.A WORM!"
X	avnort	serbw.exe	"Added by the SERFLOG.A WORM!"
X	AVP	[path to trojan]	"Added by the MUTBO-A TROJAN!"
X	avp	win*.tmp.exe [* is a number]	Added by a variant of the ALPHABET TROJAN!
X	avp	xar6000v7.exe	"Detected by Kaspersky as the ALPHABET.B TROJAN!"
X	avpl	Antivirus.exe	"AntiVirus Plasma rogue security software - not recommended
X	Avpr	avpr.exe	"Added by the MYDOOM.AF WORM!"
X	AVPSrv	AVPSrv.exe	"Added by the ONLINE-GEN TROJAN!"
X	avptask	[path to trojan]	"Added by the NOFERE-G TROJAN!"
X	avptask	expl0rer.exe	"Added by the AGENT.JJO TROJAN!"
X	Avptask	rund1132.exe	"Added by the AGENT.PKZ TROJAN!"
X	AvpWx	WErcx.exe	"Detected by Kaspersky as a variant of the AGENT.A TROJAN!"
X	Avril Lavigne - Muse	[random filename]	"Added by the AVRIL-A WORM!"
X	avrlabs	avrlabs.exe	"VirusResponse Lab 2009 rogue security software - not recommended"
X	AVScheduler	AVSCHSVC.EXE	"Part of the WinAntiVirus Pro 2005 rogue security software when installed in Win98/Me - not recommended
X	AVSeguro	pgs.exe	"AVSeguro
X	AvSer	dsm.exe	"Added by the SERFLOG.B WORM!"
X	AvSer	msmpatch.exe	"Added by the SERFLOG.B WORM!"
X	AvSer	svosm.exe	"Added by the SERFLOG.B WORM!"
X	AvSer	sysup.exe	"Added by the SERFLOG.B WORM!"
X	avserve.exe	avserve.exe	"Added by the SASSER WORM!"
X	avserve2.exe	avserve2.exe	"Added by the SASSER.B or SASSER.C WORMS!"
X	avserve3.exe	avserve3.exe	"Added by the SASSER.G WORM!"
U	AVStation premium	AVStation agent.exe	"Related to Samsung AV Station - instant playback of music
X	AVSTRT	navpsrvc.exe	"Added by the FORBOT-EF WORM!"
X	AVSystemCare	pgs.exe	"AVSystemCare rogue security software - not recommended. There are number of variants in this family sharing the same filename and user interface - see here"
N	Avtray	Avtray.exe	"Command Antivirus tray icon"
X	AVTray	AVTray.exe	"Part of the WinAntiVirus Pro 2005 rogue security software when installed in Win98/Me - not recommended
Y	avx communicator	xcommsur.exe	"Anti-virus part of BitDefender virus scanner/firewall"
U	AWMON	Ad-Monitor.exe	"F-Secure Anti-Spyware"
?	AxFilter	"Rundll32 AXFILTER.DLL	Rundll32"
U	AXIS Print System DriverScanner	DriverScanner.exe	"Part of AXIS Print System from AXIS Communications - ""adds printer discovery
U	AXIS Print System DriverServer	DriverServer.exe	"Part of AXIS Print System from AXIS Communications - ""adds printer discovery
U	AXIS Print System TrayIcon	TrayIcon.exe	"System Tray access to AXIS Print System from AXIS Communications - ""adds printer discovery
X	AXPDefender	AXPDefender.exe	"Advanced XP Defender rogue security software - not recommended
X	AXPFixer	AXPFixer.exe	"AdvancedXPFixer rogue security software - not recommended
X	AXVenore	AXVenore.exe	"Added by an unidentified TROJAN - see here"
U	AzMixerSel	AzMixerSel.exe	"Related to Realtek_Azalia Mixer Selector"
X	A_M_P_NET	AntiMalwarePro.exe	"AntiMalware Pro rogue security software - not recommended
Y	a²	a2guard.exe	"System Tray access to and Anti-Malware Guard feature of Emsisoft Anti-Malware from Emsi Software GmbH - which provides ""comprehensive PC protection against viruses
N	B.Reader	remin.exe	"Birthday Reminder 5.0 - as the name implies"
X	b3d	BDEsecureinstall.exe	"B3d Projector foistware - periodically trys to access the internet. (1) Uninstall it via Start -> Settings -> Control Panel -> Add/Remove Programs. (2) Remove the BDEsecureinstall.exe if still present in the ""System"" directory. (3) Disable and ideally delete it from the registry. (4) Remove the ""BDE"" directory and all its contents"
X	babeie	"rundll32 cnbabe.dll	dllstartup"
N	Babylon Translator	Babylon.exe	"""Babylon-Pro is a powerful information tool that instantly provides relevant information
X	Backdoor.NuAgent	agent.exe	"Added by the AGENT-DP TROJAN!"
X	Background Intelligent Transfer Service	[path] rundll32.exe	"Added by the VB-ZD TROJAN! Note - this is not the legitimate rundll32.exe process
U	BackgroundSwitcher	bgswitch.exe	"Originally included with Microsoft's XP PowerToys (but now withdrawn - see here
U	BackgroundSwitcher	BackgroundSwitcher.exe	"John's Background Switcher (or JBS for short) periodically changes the background image on your computer (like every hour or every day) to something interesting"
X	backup	[path to worm]	"Added by the AGOBOT-H WORM!"
U	Backup NOW! Scheduler	Schdlr32.exe	"Scheduled backups for the NTI Backup Now archiving utility. If a backup job has been scheduled
X	Backup One	smbguard.exe	"Added by the SDBOT-MI WORM!"
X	Backup Service	backup.svc	Unidentified adware
X	BackUp Windows 2009	[random].exe	"Added by the AGENT-LUJ TROJAN!"
U	BackupExecScheduler	besch.exe	"Veritas ""Back Up My PC"" software"
N	Backwork	Backwork.exe	"Backwork trojan detector"
N	BacsTray	BacsTray.exe	Broadcom Advanced Control Suite - for modems and set top boxes based upon Broadcom chipsets. Not required unless you have networking problems
X	Badx	HELLRAIDER.EXE	"Added by the MINDCTRL.A BACKDOOR!"
X	BagleAV	csrss.exe	"Added by the NETSKY.AB WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Bakra	IEHost.EXE	"Added by the MULTIDR-AH TROJAN!"
N	Bandwidth Meter Pro	BandwidthMeterPro.exe	"System Tray access to Bandwidth Meter Pro - ""an easy-to-use network software for bandwidth usage monitoring and reporting. It monitors traffic of all network connections on your computer and displays graphical and numerical download and upload speeds in real-time"""
U	Bandwidth Monitor Pro	Bandwidth Monitor Pro.exe	"Bandwidth Monitor Pro - utililty to track your current download/upload limit that may be set by your ISP"
N	BandwidthMeterPro	BandwidthMeterPro.exe	"System Tray access to Bandwidth Meter Pro - ""an easy-to-use network software for bandwidth usage monitoring and reporting. It monitors traffic of all network connections on your computer and displays graphical and numerical download and upload speeds in real-time"""
U	Banpopup by Pratik	Banpopup.exe	Banpopup - popup killer
X	Banyak_Kerjaan	Tukang.exe	"Added by the SILLYFDC.BDM WORM!"
X	Bar Ding lolt	Analiz.exe	"Added by the RBOT-RP WORM!"
X	bargains	bargains.exe	"BargainBuddy adware"
X	bargains	bargainbuddy.exe	"BargainBuddy adware"
X	BaRloNdDiLhep	services.exe	"Added by the AUTORUN.DIB WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~� subfolder"
?	Bart Station	station.sbrt	"Related to PeoplePC ISP. May be a dialler for dial-up accounts?"
U	Bart Station	PPCOLink.exe	Dialer for PeoplePC ISP
X	BarTheme	bartent32.exe	"Added by the AGOBOT-UG WORM!"
N	bascstray	BascsTray.exe	Broadcom Advanced Control Suite - for modems and set top boxes based upon Broadcom chipsets. Not required unless you have networking problems
X	BastioneAntivirus	pgs.exe	"BastioneAntivirus
X	Bat	secure2.bat	"Added by the ZCREW.C TROJAN!"
N	Batchreg1	N/A	"Part of the Windows System Recovery process. Added to the registry via Msbatch.inf. The existence of this key or process after the last reboot during installation indicates an unsuccessful installation
U	BatInfEx	"rundll32.exe [path] BatInfEx.dll	BMMAutonomicMonitor"
U	BatLogEx	"rundll32.exe [path] BatLogEx.DLL	StartBattLog"
X	BatSrv	batserv2.exe	"Detected by Kaspersky as the LOCKSY.M WORM!"
U	Battery Scope	batmgr.exe	Monitors battery levels on a notebook/laptop PC
U	BatteryBar	batterybar.exe	"BatteryBar - displays battery usage
Y	batterymiser	batterymiser.exe	"Battery Miser power management utility for LG Notebooks"
Y	BatteryMiser 5	BatteryMiser5.exe	"Battery Miser 5 power management utility for LG Notebooks"
X	BatzBack	BatzBack.scr	"Added by the BACKZAT WORM!"
U	Bayden SlickRun	sr.exe	"""SlickRun is a floating command line utility for Windows. It gives you almost instant access to any program or website. SlickRun allows you to create command aliases (known as MagicWords)
U	BayMgr	DockApp.exe	Hot-swappable drive management on laptops allowing you to change drives without closing down Windows. Only required if you frequently swap bay devices
N	BBC Alerts	BBC_Alerts.exe	"BBC Alerts - ""You can now have all the latest news and sports headlines delivered straight to your desktop with the new BBC Alerts service"""
U	BBC News alerts	skinkers.exe	"BBC News Desktop Alerts service - see here. Desktop alert and breaking news e-mail services let you find out about all the latest news as it happens"
?	BBDial	BT Broadband.exe	"Part of BT Broandband - is it required?"
N	BBLauncher.exe	BBLauncher.exe	"BounceBack Professional - back-up software"
N	bbSysTray	bbSysTray.exe	"Philips CD-RW related - ""the 'Blue Button' feature gives users the chance to receive convenient online support for their possible device problems or questions"""
U	BCMHal	"rundll32.exe bcmhal9x.dll	bcinit"
?	bcmwltry	bcmwltry.exe	"Broadcom Corporation Wireless Network Tray Applet. Is it required?"
X	Bcvsrv32	bcvsrv32.exe	"Added by the GAOBOT.BQJ WORM!"
X	Bcvsrv32	he3.exe	"Added by the AGOBOT.AKB WORM!"
X	Bcvsrv32	msxml22.exe	"Added by the AGOBOT.AKH WORM!"
X	Bcvsrv32	msc32.exe	"Added by the AGOBOT.AKD WORM!"
X	Bcvsrv32	msbvd32.exe	"Added by the AGOBOT-SR WORM!"
X	Bcvsrv32	system2.exe	"Added by the AGOBOT-PU BACKDOOR!"
X	bdfger	gggasw.exe	"Added by the SDBOT-RT WORM!"
Y	BDOESRV	bdoesrv.exe	"Bitdefender 8 antivirus and firewall"
U	BDRegion	brs.exe	"Part of Cyberlink's PowerDVD version 8 - removes the Blu-ray region on a DVD"
Y	BDWizReg	bdwizreg.exe	"Configuration wizard for BitDefender internet security products. Only runs once the product has been installed. Guides you through the steps necessary to configure the BitDefender modules
U	BearFlix	BearFlix.exe	"BearFlix is optimized for the fast download of video files"
N	BearShare	bearshare.exe	"BearShare file sharing client. Versions known to include spyware - see here"
U	BeatNik Internet Clock	BeatNik.exe	"BeatNik Internet Clock is a Windows clock add-on that supports 'skins'. It can also synchronize your computer's clock with an atomic clock"
X	Beawver	saqevre.exe	"Added by a variant of the RANKY TROJAN!"
X	BedreigingsMonitoor	pgs.exe	"BedreigingsMonitoor rogue security software - not recommended. A member of the AVSystemCare family"
U	BeFaster	befaster3.exe	"BeFaster internet connection optimization tool"
U	beidsystemtray	beidsystemtray.exe	"Related to Belgium Identity Card card reader"
U	Belgacom	sprtcmd.exe /P Belgacom	"Self-help support tool for Belgacom broadband users (provided by SupportSoft
U	Belkin F5D8013 N Wireless Notebook Card Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8013 N Wireless Notebook Card"
U	Belkin F5D8053 N Wireless USB Adapter Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8053 N Wireless USB Adapter"
U	Belkin F5D8073 N Wireless ExpressCard Adapter Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8073 N Wireless ExpressCard Adapter"
N	Belkin PCMCIA WLAN Monitor	monitorbk.exe	Belkin USB Network Adapter Management utility - can be started manually
U	Belkin Wireless G Notebook Card Client Utility	Belkinwcui.exe	Wireless configuration utility for the Belkin F5D701F Wireless G Notebook Card
U	Belkin Wireless USB Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D7050 Wireless G USB Adapter"
U	Belkin Wireless Utility	Belkinwcui.exe	"Wireless configuration utility for some Belkin cards such as the F5D7000 Wireless G Desktop Card"
U	BellSouthAlertManager.exe	BellSouthAlertManager.exe	"Related to BellSouth Alert Manager"
U	BelNotify	"rundll32.exe [path] NPBelv32.dll	RunDll32_BelNotify"
?	BELORVBI	BELORVBI.exe	"??"
X	Benadril Alert Tool	benadrilalert.exe	Plug-in for WeatherBug advising when pollen count in your area is high - prompting you to buy Benadril
X	BeschermingsTool	SysRep.exe	"BeschermingsTool
U	BestCrypt Auto Open	BestCrypt.exe	"BestCrypt from Jetico
X	BestPopUpKiller	BestPopupKiller.exe	"Popup killer by Swanksoft - not recommended
X	BestsellerAntivirus	pgs.exe	"BestsellerAntivirus rogue security software - not recommended
X	bfxtray	[path to trojan]	"Added by the AGENT-GEB TROJAN!"
Y	bg	bullguard.exe	"Bullguard antivirus and firewall. The P2P version is free with KaZaA Media Desktop and Grokster"
U	BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}	NMBgMonitor.exe	"Associated with Nero Scout
X	Bharatayuda	GNB.exe	"Added by the BHARAT.A WORM!"
U	BHR	BHR.exe	"Browser Hijack Retaliator - recovers your browser after it has been hijacked by spyware
U	BI1HelperStartUp	BI1HEL~1.EXE	"ScreenScenes ""Beach Islands"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	BIE	"Rundll32.exe [path] BDSrHook.dll	Rundll32"
X	BigfileSearch	BigfileSearch.exe	"BigfileSearch adware. File located in %Program Files%\BigfileSearch"
X	bigoris	bigoris.exe	"Added by the DORF-AZ TROJAN!"
U	BigPond Toolbar	bpumTray.exe	"Telstra BigPond Toolbar - ""Introducing the free and easy to use BigPond Toolbar that is designed to make your internet experience and managing your Telstra internet account a whole lot easier"""
Y	BigPondWirelessBroadbandCM	BigPond_CM.exe	"Related to BigPond_Wireless_Broadband Service by Telstra"
N	Billminder	Billmind.exe	Can be setup in Quicken to remind user of due payments. Available via Start -> Programs
N	Bing Bar	mswinext.exe	"Bing Bar - the latest incarnation of the MSN Toolbar from version 5.* onwards. This entry loads the toolbar into memory at start-up before you open your internet browser. Not required - it will load with the browser and remains in memory after the browser is closed"
?	Bingo Charm	charms.exe	"Some kind of screen icon kind of like desk flag
U	Bionix Wallpaper 5	Bionix Wallpaper 5.exe	"BioniX Wallpaper Changer - ""the most advanced wallpaper changer/wallpaper manager software in the world"""
U	BioniXWallpaper	Bionix Wallpaper 5beta.exe	"BioniX Wallpaper Changer - ""the most advanced wallpaper changer/wallpaper manager software in the world"""
U	BioniXWallpaper	BioniX Wallper.exe	"BioniX Wallpaper Changer - ""the most advanced wallpaper changer/wallpaper manager software in the world"""
U	BioniXWallpaper	BionixWallpaper5.exe	"BioniX Wallpaper Changer - ""the most advanced wallpaper changer/wallpaper manager software in the world"""
X	BIOS XP Loader	[random filename]	"Added by the RBOT-IC WORM!"
Y	BisonInst0402	BR040286.exe	"Driver for integrated notebook webcams from Bison Electronics Inc - such as the Acer Crystal Eye"
Y	BitDefender 12	bdwizreg.exe	"Configuration wizard for BitDefender internet security products. Only runs once the product has been installed. Guides you through the steps necessary to configure the BitDefender modules
Y	BitDefender 2009	IEShow.exe	"Anti-phishing component of BitDefender internet security products. Anti-phishing prevents sensitive data such as usernames
Y	BitDefender 2009	bdagent.exe	"BitDefender Agent - for BitDefender internet security products. Maintains settings (for all users) and provides alerts and System Tray access to the main program. Note - for the System Tray icon to be displayed the Terminal Services service must be set to either ""Manual"" or ""Automatic"". It can also be licensed by other products such as versions of The Shield Deluxe from PCSecurityShield (see here) - who's reputation is poor"
Y	BitDefender Antiphishing Helper	IEShow.exe	"Anti-phishing component of BitDefender internet security products. Anti-phishing prevents sensitive data such as usernames
X	BitDefender Antivirus	BITDEFENDERX.EXE	"Added by a variant of the SPYBOT WORM!"
Y	BitDefender Communicator	xcommsvr.exe	"BitDefender antivirus"
U	BitDefender for MSN Messenger	msnmon.exe	"Bitdefender anti-virus for MSN Messenger - no longer supported at the BitDefender website"
U	BitDefender for Yahoo! Messenger	yahmon.exe	"Bitdefender anti-virus for Yahoo! Messenger - no longer supported at the BitDefender website"
Y	BitDefender Live! Init	bdinit.exe	"BitDefender antivirus"
Y	BitDefender Scan Server	bdss.exe	"BitDefender antivirus"
Y	BitDefender Virus Shield	vsserv.exe	"BitDefender antivirus"
Y	bitdefenderlive	avxlive.exe	"Main program of BitDefender virus scanner/firewall"
U	BitDefender_P2P_Startup	BitDefender_P2P_Startup.exe	"Bitdefender anti-virus for P2P clients - no longer supported at the BitDefender website"
X	Bittorrent	bittorrent.exe	"Added by the RJUMP-D WORM! Note - do not confuse with the legitimate BitTorrent file-sharing client which is normally located in %ProgramFiles%\BitTorrent. This one is located in %Windir%"
N	BitTorrent	bittorrent.exe	"BitTorrent file sharing client - from BitTorrent
N	BitTorrent DNA	btdna.exe	"""BitTorrent DNA is a FREE content delivery service based on the BitTorrent protocol which brings the power of user-contributed bandwidth to traditional content publishers while leaving publishers in full control of their files"". Now a stand-alone product where the user creates the download
N	bittorrent.exe	bittorrent.exe	"BitTorrent file sharing client - from BitTorrent
N	BitWare Print Monitor	bwprnmon.exe	"FaxServe network fax software"
N	BJ Printer Status Monitor	Cjstsr.exe	Canon BJ printer status monitor
N	BJ Status Monitor 5xx	CJSTRxx.EXE	Canon printer status monitor - where "xx" is different depending upon the version. Not required as you can check the printer status via My Computer -> Printers
U	BJPD HID Control	TVMon.exe	"Related to Canon Photo viewer"
N	BlackBerryAutoUpdate	RIMAutoUpdate.exe	"Automatic updates for BlackBerry smartphones
N	BlackICE PC Protection	blackice.exe	"Loads the user interface for the BlackICE PC Protection (was Defender) firewall. From the parent site - '(the user interface) starts in the ""Startup"" menu and adds itself to the taskbar. The user interface is independent from the rest of the system and only displays the output or reconfigures the system. It does not need to be running for the rest of the system to run.' BlackICE was supported by IBM Internet Security Systems (formerly just ISS) when them acquired the NetworkICE parent but is no longer available. See also LoadBlackD"
X	blah service	winupdate.exe	"Added by the GAOBOT.BIA WORM!"
X	blah service	winsysengine.exe	"Added by the RBOT-KI WORM!"
X	blah service	internet.exe	"Added by a variant of the RBOT WORM!"
X	blah service	smnp.exe	"Added by the RBOT.IZ WORM!"
X	blah service	msnmsgrr.exe	"Added by the RBOT.PZ WORM!"
X	blah service	tazkmgr.exe	"Added by the RBOT.UA WORM!"
X	blah service	FaLeH.exe	"Added by the RBOT-AES WORM!"
X	blah service	microsoft.exe	"Added by a variant of the RBOT WORM!"
X	blah service	evosys.exe	"Added by a variant of the RBOT WORM!"
X	blah service	win32.exe	"Added by the RBOT-AXO WORM!"
X	Blah service	CCAPPS32.EXE	"Added by the RBOT.TV WORM!"
X	blah services	iczw.exe	"Added by the RBOT-GMP WORM!"
X	blahh service	msengine.exe	"Added by a variant of the RBOT WORM!"
X	blahx service	msnjompa.exe	"Added by the SDBOT.AML WORM!"
X	Blank AntiViri	AUT0EXEC.BAT StartUp	"Added by the BRONTOK-CJ WORM!"
N	BlazeChanger	FBZPaper.exe	"Ember graphic file viewer
?	BlazeServoTool	MediaDetector.exe	"Related to BlazeDVD from BlazeVideo - which ""is leading powerful and easy-to-use DVD player software."" What does it do and is it required?"
X	BLMessagingIntegration	blengine.exe	"BuddyLinks adware"
X	BlockChecker	Block-checker.exe	"BlockChecker adware"
X	Blocker System611 Monitoring	PopUpBlocker611.exe	"Added by the RBOT.BLJ WORM!"
X	BlockKeeper	BlockKeeper.exe	"BlockKeeper rogue security software - not recommended
X	BlockProtector.exe	BlockProtector.exe	"BlockProtector rogue security software - not recommended
X	BlockScanner	BlockScanner.exe	"BlockScanner rogue security software - not recommended. A member of the WiniGuard family"
N	BlockTracker	BlockTracker.exe	If present on a HP machine it tracks all the processes and logs them to a blocklog.txt file
X	BlockWatcher	BlockWatcher.exe	"BlockWatcher rogue security software - not recommended
U	BLOG	"rundll32.exe [path] BatLogEx.DLL	StartBattLog"
U	blsloader	blsloader.exe	"BellSouth ISP Internet Tools"
N	Blubster	Blubster.exe	"Related to Blubster Music sharing service"
U	Blue Frog	bluefrog.exe	"Blue Frog by Blue Security Inc. - actively fights spam by posting complaints on the sites advertised by the spam you receive"
X	Blue Service	[path to trojan]	"Added by the BANCOS-BCW TROJAN!"
?	BlueLight_uoltray	exec.exe	"Related to BlueLight Internet. What does it do and is it required?"
?	Bluetooth HCI Monitor	"RunDll32 HCIMNTR.DLL	RunCheckHCIMode"
U	BluetoothAuthenticationAgent	"rundll32.exe irprops.cpl
U	BluetoothAuthenticationAgent	"rundll32.exe bthprops.cpl
U	blueyonder Instant Support Tool	matcli.exe	"Blueyonder Instant Support Tool. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	BMMGAG	"RunDll32 [path] pwrmonit.dll	StartPwrMonitor"
N	BMMLREF	BMMLREF.EXE	"Part of the Battery MaxiMiser and Power Management Features set for some IBM/Lenovo Thinkpad notebooks. The purpose of this entry is unknown at present. It doesn't normally appear to be running if left enabled at startup and it doesn't run if the Battery MaxiMiser Wizard is open - hence the ""N"" status"
N	BMMLREF.EXE	BMMLREF.EXE	"Part of the Battery MaxiMiser and Power Management Features set for some IBM/Lenovo Thinkpad notebooks. The purpose of this entry is unknown at present. It doesn't normally appear to be running if left enabled at startup and it doesn't run if the Battery MaxiMiser Wizard is open - hence the ""N"" status"
U	BMMMONWND	"rundll32.exe [path] BatInfEx.dll	BMMAutonomicMonitor"
X	BMN	strpmon.exe	"Part of CleanPCTool
U	BMO MasterCard Wallet	EWALLET.EXE	"The wallet conveniently stores billing
X	Bnexe	[random filename]	"Added by the KITRO.D (or ARGEN.A) WORM!"
U	BO1HelperStartUp	BO1HEL~1.EXE	"ScreenScenes ""Butterfly Oasis"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	BO1HelperStartUp	Bo1helper.exe	"ScreenScenes ""Butterfly Oasis"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	Boarddata	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are often located in %System%"
X	boby	csrs.scr	"Added by the BANCBAN-PC TROJAN!"
X	boby	netburn.scr	"Added by the BANCBAN-OX TROJAN!"
X	boby.	Isass.scr	"Added by the BANCBAN-OH TROJAN!"
Y	BOCleanautostart	Boclean.exe	"NSClean's BOClean anti-trojan software"
U	BOINC Manager	boincmgr.exe	"BOINC manager - ""controls the use of your computer's disk
U	Boingo Wireless Utility	Icon###XXX#X#.exe	"Starts the Boingo Wireless utility
X	boler.exe	syser.exe	"Added by the RBOT-AYS WORM!"
X	BONZI Task Switcher	Taskswitch.exe	"Added by the SPYBOT.DTR WORM!"
X	BookedSpace	"RunDLL32.EXE bs2.dll	DllRun"
U	Bookmark	bookmark.exe	"System Tray access to Power Favorites by Desksware - which ""is a bookmark manager for Windows that helps you organize and synchronize your bookmarks. It takes bookmarks from Internet Explorer
U	Bookmark.exe	bookmark.exe	"System Tray access to Power Favorites by Desksware - which ""is a bookmark manager for Windows that helps you organize and synchronize your bookmarks. It takes bookmarks from Internet Explorer
N	BookmarkCentral	BMLauncher.exe	"Bookmark Express - "offers a more flexible way to manage Web site bookmarks
N	BookMarkSink	syncit.exe	Bookmark synchronization utility
N	BookMarkSync	syncit.exe	"Sync2IT BookMarkSync - ""real-time automatic synchronization service that allows you to access your bookmarks
N	BookMarkSync2It	sync2it.exe	"Sync2IT BookMarkSync - ""real-time automatic synchronization service that allows you to access your bookmarks
U	Boost XP Service	bxservice.exe	"Boost XP from Systweak - WinXP tweaking utility"
X	Boot Manager	Njgal.exe	"Added by the KILO TROJAN!"
X	Boot Manager	bootmng.exe	"Added by a variant of the SPYBOT WORM!"
X	Boot Server	bootserver.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Boot Service	bootservice.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Boot Service	bootsv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Boot Verify	bootvfy.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	BootClean	smartdrv.exe	"Added by the LURKA-A VIRUS!"
X	BootCTRL	bootctrl.exe	Added by an unidentified WORM or TROJAN!
X	BootLoader	BootLoader.exe.vbs	"Added by the WATERWORKS WORM!"
?	Boots Insert Detect	InsDetect.exe	"Part of Boots Picture Suite. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
X	BootsCfg	wscript.exe [path] Date.POP.vbs	"Added by the KUULLIO WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbs	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbe	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe Install.log.vbs	"Added by the YPSAN.E WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""Install.log.vbs"" file is located in %System%"
Y	BootSkin Startup Jobs	BootSkin.exe	"Stardock BootSkin is a program that allows users to change their Windows 2000 and Windows XP boot screens"
U	BootWarn	BootWarn.exe	"From here: ""Norton AntiVirus Boot Warning. This program is installed as a startup item when you install Norton AntiVirus
X	boot_reg	[path to file]	"Added by the BANCBAN-CA TROJAN!"
X	boot_reg	svchot.exe	"Added by the BANCBAN-BQ TROJAN!"
X	BortMedVirus	pgs.exe	"BortMedVirus rogue security software - not recommended. A member of the AVSystemCare family"
U	borzoi	blg.exe	"Borzoi surveillance software. Uninstall this software unless you put it there yourself"
N	Bose Wave/PC Monitor	wavepcmonitor.exe	"System Tray access for this system (more info on the system here). Available via Start -> Programs"
X	Bot Loader	svchostt.exe	"Added by the GAOBOT.ALV WORM!"
X	Bouncer RunStartup	bouncer.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
X	Bouncer RunStartup	LiveUpdate.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
X	boy lovers of bsd	ilikeboys.exe	"Added by the MYTOB.LY WORM!"
X	BPCv2 re	bpc2 re inst.exe	"BroadcastPC adware variant"
N	BPServer	G6FTPSrv.exe	"BulletProof FTP Server"
U	BQTray.exe	BQTray.exe	"System Tray access to BurnQuick CD burning software. Only required if you use the queueing facility
X	Brasil	Brasil.exe	"Added by the OPASERV.E WORM!"
X	Brasil	BRASIL.PIF	"Added by the OPASERV.E WORM!"
X	BrasilOld	[worm filename]	"Added by the OPASERV.P WORM!"
X	brastk	brastk.exe	"Added by the DORF-BV TROJAN!"
X	Brave-Sentry	BraveSentry.exe	"BraveSentry rogue security software - not recommended
X	BraveSentry	BraveSentry.exe	"BraveSentry rogue security software - not recommended
X	braviax	braviax.exe	"Added by the FAKEALER.LE TROJAN!"
X	Brct	trdb.exe	"Detected by Kaspersky as the PURITYSCAN.Y TROJAN!"
U	Break_Reminder	BREAK REMINDER.exe	"Break Reminder - Remind yourself to take breaks to prevent computer related injuries. See here"
Y	Bredbandsbolaget	servicecenter.exe	"Related to the Brebband Swedish Broadband provider"
X	Breg	bcre.exe	"BroadcastPC adware variant"
X	Breg	bptre.exe	"BroadcastPC adware variant"
X	Breg	breg.exe	"BroadcastPC adware"
X	Bridge	"rundll32.exe [path] Bridge.dll	Load"
Y	Brindys BriTray	BRITRAY.EXE	"Main process for the following applications: GEDEX
U	BrmfRmPA	BrmfRmPA.exe	Brother resource manager - needed for a Brother MFC printer/copiert/scanner and PC to properly communicate
U	broadband medic	matcli.exe	"NTL's Broadband Medic. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	Broadband Wizard	bbwiz.exe	"Starts Broadband Wizard so it runs in the System Tray. This application tests and optimizes your Cable or DSL connection. Available via Start -> Programs"
N	BroadCamRun	broadCam.exe	"BroadCam is an easy to use video streamer designed to broadcast live video using a webcam (or other camera) and microphone"
U	Broadcom Wireless Manager UI	bcmntray.exe	"Related to Broadcom Network Adapters for additional configuration options for these devices. Should not be terminated unless suspected to be causing problems"
N	Broadcom Wireless Manager UI	wltray.exe	System tray access to wireless LAN card configuration options
X	Bron-Spizaetus	CVT.exe	"Added by the RONTOKBRO WORM!"
X	Bron-Spizaetus	norBtok.exe	"Added by the RONTOKBRO.B WORM!"
X	Bron-Spizaetus	[path to file]	"Added by the BRONTOK-F WORM!"
X	Bron-Spizaetus	bronstab.exe	"Added by the RONTOKBRO.C WORM!"
X	Bron-Spizaetus	eksplorasi.exe	"Added by the RONTOKBRO.J WORM!"
X	Bron-Spizaetus	ElnorB.exe	"Added by the RONTOKBRO.D WORM!"
X	Bron-Spizaetus	sempalong.exe	"Added by the BRONTOK-E WORM!"
X	Bron-Spizaetus	RakyatKelaparan.exe	"Added by the BRONTOK-J or BRONTOK-L WORMS!"
X	Bron-Spizaetus-5118REPM	komodo-6321422.exe	"Added by the BRONTOK-R WORM!"
X	Bron-Spizaetus-cfgmktoq	bbm-qotkmgfc.exe	"Added by the BRONTOK-M WORM!"
X	Bron-Spizaetus-cfgmmnru	bbm-urnmmgfc.exe	"Added by the BRONTOK-N WORM!"
X	BRoNToK	BRoNToK.exe	"Added by the BRONTOK-CG WORM!"
X	BrowseProxy	FindService.exe	"Actual Names (AdvSearch) Internet Keywords parasite"
X	browser	msgaol.exe	"Added by the TACTSLAY.C TROJAN!"
X	browser	s_menu.exe	"Added by the TACTSLAY.C TROJAN!"
X	browser	browse.exe	"Added by the TACTSLAY.C TROJAN!"
X	browser	deamon.exe	"Added by the TACTSLAY.C TROJAN!"
X	browser aid	browseraid.exe	"BrowserAid/BrowserPal foistware"
X	Browser Help Svc	BHSV.EXE	"Added by the RBOT-AVQ WORM!"
Y	Browser Hijack Blaster	bhblaster.exe	"Browser Hijack Blaster - protects your system from browser hijackers and spyware that alters your IE settings. Now replaced by SpywareGuard"
U	Browser Launcher	Commandr.exe	Logitech internet keyboard "Commander" software - loads the software for the shortcut keys on the keyboard. Not required unless you want to use the short cut keys
X	Browser Pal	adblck.exe	"BrowserAid/BrowserPal foistware"
U	Browser Sentinel	BrowserSentinel.exe	"Browser Sentinel - notifies you if a program wants to penetrate into Internet explorer
X	BrowserUpdateSched	[random filename]	"ZenoSearch adware"
N	BrowserWebCheck	loadwc.exe	Checks to make sure that IE is still your default browser
X	BrO_AcT	BrO-AcT.exe	"Added by the SILLYFDC-D WORM!"
X	brwdiag	[path to worm]	"Added by the STRATIO-BN WORM!"
X	BS Mediaplayer	bsplyr.exe	"Added by the RBOT-OU WORM!"
N	BS Player	bsplayer.exe	"BSplayer - A video player used to play avi
N	bsplayer	bsplayer.exe	"BSplayer - a video player used to play avi
X	BsRte	MemoteXZZ.exe	"Added by the AUTORUN-AJU WORM!"
X	BSserver	FileKan.exe	"Added by the VB.CBW WORM!"
X	Bsx3	"RunDLL32.EXE bs3.dll	DllRun"
X	BT	[path to trojan]	"Added by the LITEBOT-B TROJAN!"
U	BT Broadband Basic Help	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	BT Broadband Desktop Help	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	BT Broadband Help	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	btbb_wcm_McciTrayApp	McciTrayApp.exe	"System tray access to Motive's Broadband 2.0 configuration and repair utility"
U	BtcMaestro	KMaestro.exe	Multimedia keyboard manager. Required if you use the multimedia keys
U	BTModemProtection	BTModemProtection.exe	"BT Privacy Online modem protection software
X	btmsre.exe	btmsre.exe	"Added by the SDBOT.AM WORM!"
U	BTopenworld	DialBTYahoo.exe	BT Yahoo! internet connection manager
U	BtStart	btstart.exe	"Broadcom (formerly WIDCOMM) Bluetooth Connectivity Software"
U	BTTray	BTTray.exe	"System tray icon which shows the status of a Bluetooth wireless module (either integrated or via an adapter). Most systems with such a module installed can enable/disable the module and the icon changes from blue/white to blue/red when the module is turned off. Also allows access to explore bluetooth places
Y	BTUSRBDG	BtUsrBdg.exe	"Used with a Mitsumi USB Bluetooth adaptor (and maybe others)"
Y	BTUSRBDGF	BtUsrBdg.exe	"Used with a Mitsumi USB Bluetooth adaptor (and maybe others)"
N	Buddyizer	Buddyizer.exe	Part of the AIMster Peer to Peer (P2P) file sharing application that runs over the AOL Instant Messenger network
U	BUFFALO Power Save Utility for HD	HDManage.exe	"Power Save utility for Buffalo backup hard discs"
Y	BufferZone	CLIENTGUI.EXE	"BufferZone from Trustware - ""is the only security software that creates a separate environment allowing you unlimited freedom to enjoy all Internet activities without the fear of external threats"""
N	Bug Eliminator	Bug_Elim.exe	"Bug Eliminator - ""performs a complete health check on your computer safely
X	BugsDestroyer	SysRep.exe	"BugsDestroyer rogue system error and cleaning utility - not recommended
U	bugwatcher service	bugwatcher.exe	"
X	BuildLab	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
X	BuildLabs	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
U	Bulldog Service	upsd.exe	Belkin's Bulldog Plus control software which runs under Windows 95 or later and monitors the UPS (Uninterrupted Power Supply) via a serial or USB link
N	BulletProof FTP Server	bpftpserver.exe	"BulletProof FTP Server"
Y	BullGuard	mgui.exe	"Part of Bullguard antivirus"
Y	BullGuard	BullGuard.exe	"Part of BullGuard antivirus"
U	BullGuard Update	avxlive.exe	"Part of Bullguard antivirus. Leave enabled unless you manually update virus definitions"
Y	BullGuard XComm	XCOMMSVR.EXE	"Part of Bullguard antivirus"
Y	BullGuardInit	AVXINIT.EXE	"Part of Bullguard antivirus"
Y	BullguardoptIn	bulldownload.exe	"Part of Bullguard antivirus"
X	BullsEye	bargains.exe	"BargainBuddy adware"
X	BullsEye Network	bargains.exe	"BargainBuddy adware"
?	BullsEye Tracker	BeTrack.exe	Bullseye - intelligent research assistant
X	buohxqtfswb	gcjydr.exe	"Added by the AGENT-NRC TROJAN!"
X	buritos	buritos.exe	Identified as a variant of the Downloader.FraudLoad.C malware
N	BurnQuick Queue	BQTray.exe	"System Tray access to BurnQuick CD burning software. Only required if you use the queueing facility
U	Button Server	bttnserv.exe	"Found on a Compaq PC
U	BuzMe	RCUI.exe	"Display Client for the BuzMe Internet Call Waiting Service"
X	BVWORSFM	bvworsfm.exe	"Added by the DLUCA-AD TROJAN!"
X	Bwddwss	[path to trojan]	"Added by the RANKY.BD TROJAN!"
N	bwprnmon.exe	bwprnmon.exe	"FaxServe network fax software"
X	bxproxy	bxproxy.exe	"Added by the BXPROXY TROJAN!"
X	bxproxy	[random].dll	"SoftStop rogue security software - not recommended"
X	bxsx5	"RunDLL32.EXE bsx5.dll	DllRun"
X	bxxs5	"RunDLL32.EXE bxxs5.dll	dllrun"
X	Bymer.Scanner	Wininit.exe	"Added by the BYMER WORM!"
X	Bymer.Scanner	Msinit.exe	"Added by the BYMER WORM!"
U	BySoft FreeRAM	FreeRAM.exe	"""Bysoft FreeRAM is a program that frees up ram manually or automatically. It shows current memory status
X	ByteDefender	ByteDefender.exe	"ByteDefender rogue security software - not recommended
?	BZEnvironmentVariableCollector	BZEnvironmentVariableCollector.exe	"Part of BlazentAgent from Blazent who provide ""outsourcing governance automation for IT Outsourcing (ITO) relationships"". What does it do and is it required?"
?	BZUtilizationCollector	BZUtilizationCollector.exe	"Part of BlazentAgent from Blazent who provide ""outsourcing governance automation for IT Outsourcing (ITO) relationships"". What does it do and is it required?"
X	c	c:archiv~1win.com	"Added by the CUYDOC TROJAN!"
U	C-Media Echo Control	EchoCtrl.exe	C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. You may need it if you use the echo control feature of C-Media Mixer
N	C-Media Mixer	Mixer.exe	C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. Provides System Tray access to change audio settings. Available via Start -> Settings -> Control Panel or Start -> Programs
X	C7	[path to worm]	"Added by the MEDIAKILL.A WORM!"
U	C:Program Filesdfjdkjfdkjfldjfdfjdkjfdkjfldjfwinlogin.exe	CritProc.exe	"KeyProwler keystroke logger/monitoring program - remove unless you installed it yourself!"
U	C:Program FilesNetMeterNetMeter.exe	NetMeter.exe	"""Net Meter is a small
X	C:WINDOWSIEXPLOR.EXE	IEXPLOR.EXE	"""Pop Marketing"" adware"
Y	CaAvTray	CAVTray.exe	"eTrust™ EZ Antivirus system tray application from Computer Associates"
X	Cable Modem Adapter	WindowsSec.exe	"Added by the WOOTBOT.A WORM!"
U	CacheBoost	trayicon.exe	"CacheBoost ""optimizes the System Cache-Management of Windows XP/2000/NT and Windows .Net Servers
X	CacheLoader	[path to trojan]	"Added by the DLOADER-NZ TROJAN!"
Y	CacheMgr	CacheMgr.exe	"Sophos Antivirus Remote Update"
U	CacheSentry Pro	CacheSentry Pro.exe	"""CacheSentry Pro is a program that takes over the management of the Internet Explorer (and AOL) web browser cache"""
N	CACStarter	cacstart.exe	Cash A Check - check writing software
N	CahootWebcard	CahootWebcard.exe	"""The Cahoot Webcard is a virtual card that allows you to use your Cahoot credit card online without ever having to expose your real card numbers over the web. It works by generating one-off transaction numbers as a substitute for your real cahoot credit card details"". Run manually when needed"
N	Cal Reminder Shortcut	calrem.exe	Produces a pop-up reminder of events scheduled using the MS Office Calendar
X	calc	"rundll32.exe [path] ntuser.dll	_IWMPEvents@0"
X	calc	"rundll32.exe calc.dll	_IWMPEvents@0"
X	Calc Microsoft Windows	wincalc.exe	Added by an unidentified WORM or TROJAN!
U	Calendar	Calendar.exe	"This entry can be added by PlainSight Desktop Calendar and older versions of Desktop iCalendar from Desksware and the older Calendar 200X - which is no longer supported by or available from the author"
?	Calendar 200X Monitor	calmonitor.exe	"Background task for Calendar 200X by Joel Graffman - which is no longer supported or available from it's author. The exact purpose of this startup entry is unknown at present but it appears to be related to the Calendar 200X Reminder entry - as disabling that entry via the program also disables this one"
N	Calendar 200X Reminder	calendar.exe	"Part of Calendar 200X by Joel Graffman - which is no longer supported or available from it's author. Displays reminders for holidays
?	Calendar Monitor	calmonitor	"Background task for Calendar 200X by Joel Graffman - which is no longer supported or available from it's author. The exact purpose of this startup entry is unknown at present"
U	Calendarscope	cs.exe	"Calendarscope calendar software"
X	Call Function System32	sddriver.exe	"Added by a variant of the SDBOT TROJAN!"
U	CallCenter Main Application	V3calmcp.exe	"""V3 Inc. CallCenter is a free 32-bit
U	CallCenter Printer Interface	V3faxecp.exe	"""V3 Inc. CallCenter is a free 32-bit
N	CallControl	ftctrl32.exe	"FaxTalk Messenger Pro is a Windows TAPI based 32-bit application. When installed
?	calmonitor	calmonitor.exe	"Background task for Calendar 200X by Joel Graffman - which is no longer supported or available from it's author. The exact purpose of this startup entry is unknown at present but it appears to be related to the Calendar 200X Reminder entry - as disabling that entry via the program also disables this one"
?	calmonitor	calmonitor	"Background task for Calendar 200X by Joel Graffman - which is no longer supported or available from it's author. The exact purpose of this startup entry is unknown at present"
U	Camera Assistant Software	traybar.exe	Camera Assistant Software utility for Toshiba laptops - allows you to take pictures with and control the integrated WebCam
U	Camera Detector	CAMDET~*.EXE	"ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically"
U	Camera Detector	Camdetect.exe	"ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically"
U	Camera Detector	DEVDET~*.EXE	"ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically"
?	CameraApplicationLauncher	CameraApplicationLaunchpadLauncher.exe	"Supports the integrated webcam on IBM/Lenovo Thinkpad notebooks. What does it do and is it required?"
U	CameraAssistant	CameraAssistant.exe	"Entry added when you install versions of the Logitech QuickCam webcam software and used to configure and tweak your webcam settings. Includes support for the Quick Assistant - which launches when a video application (such as video conferencing in an instant messaging client) accesses to camera so you can quickly fine tune face tracking and zoom
N	Camio Viewer x	IXApplet.exe	Image viewing program that comes with digital cameras. Shows pictures that are in the camera before downloading them. "x" in the name is the version
?	CamMonitor	hpqcmon.exe	"From HP and related to digital imaging"
Y	CamWizard	CamWizrd.exe	Launches the Logitech Camera Wizard on the first reboot after installing versions of Logitech QuickCam webcam software
U	Canary	canary-std.exe	"Canary keystroke logger/monitoring program - remove unless you installed it yourself!"
U	Canon MultiPASS Status Monitor	monitr32.exe	Cannon Multi-Pass status monitor - your choice
?	Canon PC1200 iC D600 iR1200G Status Window	CAPM1LAK.EXE	"Cannon printer related - is it required in startup?"
N	Canon Printer Monitor BJCxxx	Cjstlst.exe	Trayicon for Canon printer. xxx denotes model. Available via Start -> Programs
U	CanonMyPrinter	BJMyPrt.exe	Printer software for Canon Bubblejet printers
U	capfupgrade	capfupgrade.exe	"CA Personal Firewall - part of the CA Internet Security Suite"
X	Captcha7	rundll captcha.dll	"Added by the TINY.WRE TROJAN!"
X	CaptionMgr32	crssr.exe	"Added by the ZAR.A WORM!"
X	capture	capture.exe	"Added by the THEEF-B TROJAN!"
N	Capture Express 2000	capexp.exe	"Capture Express - screen capture utility"
U	CaptureAssistant	CaptureAssistant.exe	"Capture Assistant ""is a convenient and easy-to-use text and graphics capture tool"". It allows you to capture text
N	CaptureBat	Capture.exe	"!Quick Screen Capture from EtruSoft Inc. - ""allows you to take screenshots from any part of your screen in more than 10 ways
N	Carbonite Backup	CarboniteUI.exe	"""Carbonite's online backup service starts automatically and works quietly and continuously in the background protecting your data"""
N	Card Monitor	REGCNT09.exe	For the USB connection on a Panasonic PV-DV701 Digital Camcorder. Available via Start -> Programs
?	CardScan AutoSync	CSyncCfg.exe	"Related to the CardScan business card reader range of products. May be related to synchronization with E-mail software and mobile devices (see here)?"
X	Care20	Care20.exe	"TopMoxie adware"
U	Care2GTU	Care2GTU.exe	"Care2 Green Thumbs-Up (from the Care2 site). Every online purchase helps environmental causes; tells you how eco-friendly a company really is
U	carpserv	carpserv.exe	"Associated with Zoltrix and Conexant modems - enables the internal modem speaker
X	CARPserver	CARPserver.exe	"Added by the BANKER-AN TROJAN!"
U	CARPservice	carpserv.exe	"Associated with Zoltrix and Conexant modems - enables the internal modem speaker
X	cartao	[path to file]	"Added by the DLOADER-QD TROJAN!"
X	cartao	conflicted.exe	"Added by the DADOBRA-DV TROJAN!"
X	cartao	killing.exe	"Added by the DLOADER-QN TROJAN!"
X	cartao	cartao.exe	"Added by the BANKER-FA TROJAN!"
N	Cashsurfers Cashbar Navigator	Cashbar.Exe	"Cashsurfers CashBar Navigator - ""The CashBar rotates banner advertisements once per minute and provides you with access to up to date special offers and deals"""
X	CashToolbar	MSCStat.exe	"Added by the DOWNLOADER-MY TROJAN!"
X	CashToolbar	svchost.exe	"BrowserAid/CashToolbar adware! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Casino Royale	jamesbond.exe	"Added by the RBOT-FZO WORM!"
X	Cassandra	[10 to 14 random char]THD.EXE	"Added by the KREPPER-AI TROJAN!"
X	Cassandra	cassandra.exe	"SuperSpider hijacker - a CoolWebSearch parasite variant. Also detected as a variant of the KREPPER TROJAN!"
X	Catalyst Control Centre	atixvdm.exe	"Added by the RBOT.DMW TROJAN!"
X	catsrv	catsrv.exe	"Added by the PAPLOK TROJAN!"
Y	CAVRID	CAVRID.exe	"eTrust™ EZ Antivirus Real Time Infection Report from Computer Associates"
U	cbInterface	cbInterface.exe	"System Tray access to Cobian Backup versions 8 thru 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
X	cbvcs	urretnd.exe	"Added by the FRETHOG-C WORM!"
?	CBWUser	CBWDial.exe	"Associated with Bitware that integrates fax
X	Ccao	regedit.exe	"Probably a variant of MediaTickets adware. Note - this is not the valid Windows registry editor which resides in %Windir% and will not figure in Msconfig/Startup! This version resides in a ""mduu"" subfolder
X	ccApp	[random filename]	"Added by the OBSORB TROJAN! Note the random filename compared to the valid Norton AntiVirus"
X	ccApp	gcasServ.exe	"Added by a variant of the RBOT WORM! Do not confuse with the Microsoft AntiSpyware executable of the same name"
X	ccAppr	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccAppr	expIorer.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccAppr	outIook.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccAppr	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccApps	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
X	ccctp	HistoryJMTi.exe	"Added by the GANBATE.A WORM!"
U	CCD Manager	DDS.EXE	"Project Labs Century CD manager for their CD/DVD storage device"
N	Ccdecode	"rundll32.exe streamci	StreamingDeviceSetup"
Y	CCDoctorLogonTesting	ccdoctor.exe	"Checks your system to make sure it's configured properly for running IBM Rational ClearCase
Y	ccenter	CCenter.exe	"RAV AntiVirus"
Y	CcEvtMgr	ccEvtMgr.exe	"Part of Norton AntiVirus 2003. Event manager for scheduling weekly scans and or automatic virus updates. Used to start automatically via ""ccApp"" and was not required as a seperate entry but a recent update changed this"
X	ccEvtMrg.exe	ccEvtMrg.exe	"Added by the RBOT.GZ WORM!"
U	CCleaner	CCleaner.exe	"CCleaner from Piriform Ltd. - ""is a freeware system optimization
X	ccpApps	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
U	ccProxy	CCPROXY.EXE	"Part of Norton Internet Security
X	ccPrxy.exe	ccPrxy.exe	"Added by the SHIPUP-H WORM!"
X	ccreg	explorer.exe	"Added by the ZCREW BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
Y	ccRegVfy	ccRegVfy.exe	"Part of earlier versions of Norton AntiVirus - ""ccRegVfy.exe is responsible for checking the integrity of the NAV registry entries to make sure that the information has not been changed by a malicious threat or a hack"""
X	ccRegVfY	expIorer.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccRegVfY	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccRegVfY	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccRegVfY	outIook.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccrss	msdtc.exe	"Added by the STAP-C WORM!"
Y	ccSetMgr	ccSetMgr.exe	"Part of Norton AntiVirus 2004. What does it do?"
X	ccStart	ccStart.exe	"Added by the AGOBOT-IR WORM!"
X	ccStart	ccInfo.exe	"Added by the AGOBOT-GQ BACKDOOR!"
U	cctray	cctray.exe	"Part of CA Internet Security Suite"
U	ccUpdMgr	ccUpdMgr.exe	"In Loco Parentis remote surveillance software. Uninstall this software unless you put it there yourself!"
U	CCUTRAYICON	CCU_TrayIcon.exe	"Related to Traybar Launcher from Intel Corporation belonging to Intel® Viiv®"
U	ccWasher	aolwasher.exe	"Webroot Cache & Cookie Washer - cleaning browser tracks
Y	CCWinTray	wintmr.exe	"System Tray access to Child Control parental control software by Salfield"
N	CD Storage Master	cdstorager.exe	"CD Storage Master - a program designed to catalog CD information
U	CD-DVD Lock for Win95/98/Me/2k/XP	CDVAgent.exe	"Loads CD-DVD Lock from Ixis Research
N	CDANTSRV	CDANTSRV.exe	"C-Dilla License Management software. Used for any program that uses C-dilla Protection
X	cddrv32	cddrv32.exe	"Added by a variant of the CRYPTER.C TROJAN!"
N	CDInterceptor	cdi.exe	CD indexer for measuring the speed of CD players
Y	cdloader	cdloader2.exe	"From MagicJack - ""A softphone device that allows you to attach an analog phone into the PC so you can have a traditional-style phone system in your house without any monthly charge"""
U	CDLoader	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
X	CdnCtr	cdnup.exe	"CNNIC Update pest"
X	cdoosoft	herss.exe	"Added by the SILLYFDC.BCT WORM!"
X	cdoosoft	olhrwef.exe	"Added by the AUTORUN-AAG WORM!"
X	CDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	CDriver	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
X	Cdrom Controller	cdromcntrl.exe	"Added by the BATTRY-A TROJAN!"
N	CDTray	CDTray.exe	"On HP PCs
U	CeEPOWER	cepmtray.exe	"Toshiba's Power Management Utility - allows the user to setup different profiles for both AC power and Battery Power on laptops. Contols CPU speed
X	Cekirge	[path to worm]	"Added by the KERGEZ.A WORM!"
X	center	[random name]32.exe	"Added by the BOFRA.A WORM!"
X	CentralProcessor	taskimgr.exe	"Added by the BANCOS.J TROJAN!"
X	Cerb	DivXx.exe	"Added by the KEYLOG-LV TROJAN!"
U	CertificateRegistration	SafeSignCertReg.exe	SafeSign Certificate Registration Utility for Microsoft Crypto applications
U	CertReg	certreg.exe	"Related to Gemplus Card Reader"
Y	CertStoreInit	CertStoreInit	"Aladdin eToken authentication and password management"
Y	certtool	certtool.exe	"Part of Client Security Software for IBM\Lenovo notebooks. If you have configured the software via the associated wizard this will need to be running if you want to mount password protected areas of the disk (created with SafeGuard PrivateDisk)
N	CesarFTP FTP Server	server.exe	"CesarFTPd - FTP server"
X	cesmain.dll	"Rundll32.exe [path] cmail.dll	Rundll32"
X	CEventMgr	Cell.exe	"Added by the BIFROSE-AK TROJAN!"
X	CFDStart	WinMuschi.exe	"WINMUSCHI dialler"
N	cfFncEnabler.exe	cfFncEnabler.exe	"Toshiba ""Config Free"" wireless network manager on their range of laptops"
Y	cfgintpr	cfgintpr.exe	"Configuration Interpreter - part of Tiny Personal Firewall V4"
X	cfgmgr51	"RunDLL32.EXE cfgmgr51.dll	DllRun"
X	cfgmgr52	"RunDLL32.EXE cfgmgr52.dll	DllRun"
U	CFi ShellToys Utility Manager	CFiShlMan.exe	"Manager for CFi ShellToys from Cool Focus International Ltd - which ""puts all the tools you need right where you need them - just a click away on your context menu. Right-click one or more files or folders
U	CFSServ.exe	CFSServ.exe	Belongs to Toshiba's configfree utility and searches for Wireless Devices
X	cftmon32	taskmgr*.exe [* = number]	"Added by the SOWSAT.C and SOWSAT.J WORMS!"
X	CGI Firewall Script	CGIAGENT.EXE	"Added by the BROPIA-U WORM!"
U	CGServer	cgserver.exe	"Associated with an Eicon Networks ISDN or ADSL modem. Call Guard Server (CGserver) watches your modem and blocks incoming or outgoing calls. You need cgard.exe (from Startmenu) to configure cgserver with rules and telephone numbers. Good against unwanted dialer programs"
X	Cgtask Services	cgtask.exe	"Added by the LALA.B TROJAN!"
X	ChansonsMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
Y	Charter High-Speed Security Suite	fspex.exe	"Charter High-Speed Security Suite - security software in collaboration with F-Secure"
N	Chcenter	chcenter.exe	"IMSI HiJaak - ""the easiest way to convert
X	Chckup	Netverchk.exe	"Covert Sys Exec malware variant"
U	cheatmonitor	start.exe	"CheatMonitor surveillance software. Uninstall this software unless you put it there yourself"
N	Check for One Touch Update	wiseupdt.exe	Checks for updates for Visioneer OneTouch scanners
N	Check for TWS Updates	WiseUpdt.exe	Interactive Brokers - check for update to their standalone Java-based trading platform
U	Check Messenger	cmesseng.exe	Check Messenger from Qchex.com - program that helps you manage the activity of your Qchex account. Qchex appear to be no longer in buisness
N	CheckCustomWorksUpdate	CheckCWupdate.exe	"Update checker
U	CheckDialer	ChkDial.exe	"Added by the CheckDialer modem connection monitoring tool"
X	CheckFaultKernel	mswdm.exe	"Added by the SMALL-CSK TROJAN!"
X	checkrun	elite***32.exe [* = random char]	"EliteBar adware"
X	checkrun	elitelsj32.exe	"Added by the MULTIDR-ER TROJAN!"
X	CheckScan32	regload16.exe	"Added by the AEBOT.K WORM!"
Y	CheckVCR	IOMagic.exe	"Driver for the I/OMagic Personal Video Recorder (DR-PCTV100)"
X	CheckWinPerf	perfinfo.exe	"Added by a variant of the IRCBOT TROJAN!"
U	CherryKeyMan	KeyMan.exe	"Multimedia keyboard manager for the Cherry keyboard series. Only required if you use any of the special keys"
U	ChicoSys	webtmr.exe	"Child Control parental control software"
U	ChikkaDefault	ChikkaLauncher.exe	"Chikka PC text messanger and IM client"
U	ChineseStar	cstar.exe	Chinese language support software
U	CHIPDRIVEPinManager	sokscmpn.exe	"ChipDrive Smartcard software"
U	CHIPDRIVESmartcardManager	SCMgr.exe	"ChipDrive Smartcard software"
X	CHK Disker	chkdsker.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	chkdrv	iemon.exe	"Detected by Symantec as the ADCLICKER TROJAN!"
X	chope	runlli32.exe	"Added by the QQPASS-U TROJAN!"
N	Christmas Music Player	TTEST6.EXE	"Christmas Music Player brings the music of the Christmas Holiday to your desktop"
?	ChromeMark	keysh.exe	"Related to this. Don't know what keysh.exe does though and if it's required"
?	ChronitelInitTV	CHTVINIT.EXE	"??"
U	chrono	chrono.exe	"Chronograph is a simple utility that synchronizes internal computer clock to the atomic time. Chronograph automatically maintains correct time using atomic clock servers of the National Institute of Standards and Technology (NIST)."" Shows seconds and shows the date without having to hover the mouse. Shows a calendar when hovered over"
X	Ci Servs	SysTuwin.exe	"Added by the AGENT-NIQ TROJAN!"
X	Ci Svr	cisvr.exe	"Added by the IRCBOT.AWN BACKDOOR!"
X	CiaBackdoor	msldr.com	Added by a VIRUS!
N	CIJxP2PSERVER	CIJxP2PS.EXE	"Compaq printer utility which is required in order to make the printer work correctly - "x" depends upon the model
Y	Cingular Communication Manager	CingularCCM.exe	"Cingular Communication Manager - now taken over by AT&T. ""provides a robust set of wireless communication tools for businesses and individuals. With wireless access to email
X	Cinnabd Prompt32	CmdPrompt32.pif	"Added by the ASSIRAL-B WORM!"
X	CirebonPunya	XXrocks.exe	"Added by the BHARAT.A WORM!"
X	Cisco Systems	[path to worm]	"Added by the AUTORUN.UHR WORM!"
U	Cisco Systems VPN Client	ipsecdialer.exe	"Cisco VPN Client - lets local users gain Administrator privileges on the operating system"
N	CISrvr Program	CISRVR.EXE	Related to internet setup on Compaq PC's
Y	ClamWin	ClamTray.exe	"ClamWin antivirus"
X	Classes	run_21.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	srv.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	srv2.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	MSTAR2.EXE	"""Switch"" premium rate adult content dialler variant"
X	Classes	mstart.exe	"""Switch"" premium rate adult content dialler variant"
U	ClauerUpdate	ClUpdate.exe	"Automatic updates for the software supporting the Clau-ACCV and Clauer-idCAT digital certificate USB keys"
X	Clean Mgr	cleanmg.exe	"Added by the IRCBOT.BBO BACKDOOR!"
X	Clean up	service.exe	"Added by the AGENT-FPY TROJAN!"
X	Cleanator	Cleanator.exe	"Cleanator rogue privacy program - not recommended
X	Cleaner2009 Freeware	UCLN.exe	"Cleaner2009 rogue privacy program - not recommended
X	CleanPCTool	SysRep.exe	"CleanPCTool rogue system error and cleaning utility - not recommended
?	CleanRegPath	CleanReg.exe	"Apparently Annex A ADSL modem related. What does it do and is it required?"
U	CleanSweep Smart Sweep- Internet Sweep	Csinsm32.exe	Automatic logging of installs from Norton CleanSweep - available via Start -> Programs
X	CleanUp Antivirus	CU[random characters].exe	"Cleanup Antivirus rogue security software - not recommended
?	CleanupProgram	cleanup.exe	"Sony Vaio related - what does it do and is it required? Located in a C:\Sonysys folder"
X	CleanupTool	SysRep.exe	"CleanupTool rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
X	clean_service	clean_service.cmd	"Added by the REFAZ WORM!"
U	CleverKeys	CK.exe	"CleverKeys - ""is free software that provides instant access to definitions at Dictionary.com
X	CLI Services	clisrv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
N	Click Radio Tuner	clickr~1.exe	"ClickRadio - subscription service playing radio music via the internet"
N	Click Tray Calendar	ClickT~1.EXE	"ClickTray Calendar - shows holidays
N	ClickSight Launcher	cs.exe	"Launcher for the ClickSight® marketing tool from ClickStream Technologies - which ""is a patented data-collection technology that helps independent software vendors understand the current and future usage of their product"""
X	ClickTheButton	csrss.exe	"ClickTheButton adware. Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
N	Client Access Check Version	cwbckver.exe	"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
?	Client Access Express Welcome	cwbwlwiz.exe	"Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
N	Client Access Service	CwbSvStr.Exe	"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
U	Client Access Taskbar	cwbuitsk.exe	"IBM iSeries Client Access taskbar
?	Client agent for ARCserve	W95AGENT.EXE	"Part of Brightstor ARCserve Backup from Computer Associates. What does it do and is it required?"
X	Client for Microsoft Networks	msclient32.exe	"Added by the SDBOT-BXQ WORM!"
N	Client Security Solution	cssauth.exe	"Part of Thinkvantage Client Security Solution for Lenovo ThinkPad notebooks and ThinkCentre desktops. Once configured via the associated setup screens this loads via winlogon.exe (and loads the password manager) and therefore disabling this entry has no effect"
X	Client Server Control Process	[path to trojan]	"Added by the AGENT-HR TROJAN!"
X	Client Server Run Time Proccess	csrsrv.exe	"Added by a variant of the SDBOT WORM!"
X	Client Server Runtime	[path to worm]	"Added by the POEBOT-KR WORM!"
X	Client Server Runtime Process	csrsss.exe	"Added by the SDBOT-LD WORM!"
X	Client Server Runtime Process	csrs.exe	"Added by the LINKBOT.M WORM!"
X	Client Server Runtime Process	smmss.exe	"Backdoor TROJAN! Possible SDBOT-GEN variant"
N	Clik Status Monitor	toolsclickstat.exe	Part of Iomega Tools to let you know whether an Iomega PocketZip (nee Clik) removable drive cartridge is installed
X	Clip Service Manager	clipmg.exe	"Added by the DELF.DXJ TROJAN!"
X	Clip Servicer	clipsrvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Clip Srv	clipsv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	clipboard.exe	clipboard.exe	Added by an unidentified WORM or TROJAN!
N	Clipbook Service	Clipsrv.exe	"Supports Windows XP ClipBook Viewer
U	clipdiary	clipdiary.exe	"Clipdiary from Softvoile - ""Free Clipboard Manager for keeping the clipboard history"""
N	Clipsrv	Clipsrv.exe	"Supports Windows XP ClipBook Viewer
X	ClipSrv	clipserv.exe	"Added by the SDBOT-AAV and SDBOT-AFE WORMS!"
X	ClipSrv	CLIPBRD3D.EXE	"Added by the MOFEI-D WORM!"
N	ClipTrak	ClipTrak.exe	"
N	ClipTrakker	ClipTrakker.exe	"Cliptrakker - clipboard extender"
N	CLISTART	CLIStart.exe	Puts the ATI Catalyst™ Control Center Icon/Shortcut on the System Tray - available via Start → Programs
X	clkhost	[path to trojan]	"Added by the WIXUD-B TROJAN!"
U	CLMFrontPanel	clmpanel.exe	"System tray status/display/configuration utility for a number of modems. Can be disabled by right-clicking on the tray icon. If disabled
?	CLMLServer for HP TouchSmart	CLMLSvc.exe	"Found on the HP Touchsmart range of desktops and notebooks. What does it do and is it required?"
?	clnwall	"rundll.exe setupx.dll	InstallHinfSection ..delwall.inf"
X	clock	[various filenames]	"LiveChat Adware - known file names include: mssetup.exe
X	Clock Manager	amsngr.exe	"Added by the SDBOT-XM TROJAN!"
U	CloneCD	CloneCDTray.exe	"System tray for the now discontinued CloneCD. The only useful option is ""Hide CDR Media"" only available via this tray. Has additional unknown functions in later versions"
U	CloneCDTray	CloneCDTray.exe	"System tray for the now discontinued CloneCD. The only useful option is ""Hide CDR Media"" only available via this tray. Has additional unknown functions in later versions"
?	Clotusorgreg0	prtStart.exe [path] Orgprt.exe	"IBM Lotus SmartSuite related. In a LotusOrgReg folder. Unclear what exactly it does?"
X	Clre	mmdc.exe	"Added by the PURSCAN-AI TROJAN!"
X	ClrSchLoader	[path to file]	"ClearSearch adware"
X	CLSRSS	LSACS.EXE	"Added by the SILLYFDC-X WORM!"
?	CM-SmWizard	SmWizard.exe	"SmartWizard MFC Application - associated with C-Media who produce audio chipsets commonly used for on-board sound on motherboards. What does it do and is it required?"
N	Cmaudio	"Rundll32 cmicnfg.cpl	CMICtrlWnd"
U	CMGrdian	CMGrdian.exe	"McAfee Guardian shortcut menu on the System Tray (looks like a castle) given access to Internet Security
X	cmonitor	startupmon.exe	"SystemDoctor rogue security software - not recommended
X	cmonitor	pasmon.exe	"SystemDoctor rogue security software - not recommended
U	CmPCIaudio	"RunDll32 CMICNFG3.CPL	CMICtrlWnd"
U	CMPDPSRV	CMPDPSRV.EXE	"Printer Driver Plus from ViewAhead Technology (formerly DeviceGuys
X	cmrsf	cmrsf.exe	"Added by the DELF-HU TROJAN!"
X	cmrss	cmrss.exe	"Added by the DELF.DU TROJAN!"
X	cmrss	crmss.exe	"Added by the DLOADER-EK TROJAN!"
X	cmrss	[path to trojan]	"Added by the DLOADER-QQ TROJAN!"
X	cmrst	cmrst.exe	"Added by the BANCOS.S TROJAN!"
X	cmrst	cmrst.scr	"Added by the DLOADER-FP TROJAN!"
X	cms	iserver.exe	"Added by the DLOADER-WK TROJAN!"
X	cmssapp	iexplore_.exe	"Added by the BANCBAN-CQ TROJAN!"
X	cmssapp	iexplore.exe	"Added by the BANCBAN-GF TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	cmssSystemProcess	csmss.exe	"Added by the AGENT-CO TROJAN!"
X	cmssSystemProcess	mcsmss.exe	"Added by the PROXYSER-F TROJAN!"
X	cmssSystemProcess	csms.exe	"Added by the AGENT-Y TROJAN!"
?	CmUCRRun	CmUCReye.exe	"Related to Medion Display Information. What does it do and is it required?"
X	Cn323	cnfrm33.exe	"Added by the MIMAIL.G WORM!"
X	Cnfrm32	cnfrm.exe	"Added by the MIMAIL.D WORM!"
X	CnsMax	Internat.exe	"Added by the POINTEX TROJAN! Note - the real internat.exe resides in %windir%\system (where %windir% is the Windows directory - C:\Windows or C:\Winnt) whereas this version resides in %windir%"
X	CnsMin	"Rundll32.exe [path] CNSMIN.DLL	Rundll32"
N	CnxDslTaskBar	CnxDslTb.exe	Connexant DSL Taskbar as used on Acess Runner and Samsung AHT-E310 ADSL modems
U	Cobian Backup	cbInterface.exe	"System Tray access to Cobian Backup 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup 10 Interface	cbInterface.exe	"System Tray access to Cobian Backup 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup 7 Interface	cobui.exe	"System Tray access to Cobian Backup 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup 8 interface	cbInterface.exe	"System Tray access to Cobian Backup 8 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup 9 interface	cbInterface.exe	"System Tray access to Cobian Backup 9 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup Amanita	cbInterface.exe	"System Tray access to Cobian Backup 9 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup Black Moon	cbInterface.exe	"System Tray access to Cobian Backup 8 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup Interface 6	cobui.exe	"System Tray access to Cobian Backup 6 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
X	CodeClean	CCIntro.exe	"CodeClean rogue security software - not recommended"
U	Codename Dashboard	dashboard.exe	"Codename: Dashboard - "an application that resides at the side of your screen. Built on the Microsoft .NET Framework
X	cof.updit	[random filename]	"Added by a variant of the SDBOT WORM!"
U	CognizanceTS	"rundll32.exe [path] AsTsVcc.dll	RegisterModule"
X	Coldlife -icmp	Systray.exe	"Added by the FLOOD.AV TROJAN! Note - this is not the legitimate systray.exe process"
N	CollaborationHost	p2phost.exe	"Signs a user into the People Near Me feature at login in Windows 7 and Vista. People Near Me enables you to use certain peer-to-peer (P2P) programs on a network - that ""identifies people nearby who are using computers and allows those people to send you invitations for programs such as Windows Meeting Space. They can only invite you to participate in programs that are installed on your computer."" Available via Start → Control Panel"
U	coloreal	coloreal.exe	"Makes colours sharper and brighter
N	Colorific	Hgcctl95.exe	"Colorific® from E-Color - ""delivers accurate gamma and color temperature across your entire system - monitor to printer and digital camera to monitor."" Now superseded by ColorWizzard™"
N	Colorific Control Panel	Hgcctl95.exe	"Colorific® from E-Color - ""delivers accurate gamma and color temperature across your entire system - monitor to printer and digital camera to monitor."" Now superseded by ColorWizzard™"
X	COM Service	mscom32.com	"Added by the BEASTY.H TROJAN!"
X	COM Service	msynvr.com	"Added by the BEASTY.G TROJAN!"
X	COM Service	msjclh.com	"Added by the BEASTY.E TROJAN!"
X	COM Service	msdrce.com	"Added by the BEASTY.I TROJAN!"
X	COM Service	msflyx.com	"Added by the BEASTDO-O TROJAN!"
X	COM Service	mskwda.com	"Added by the AGENT-JIX TROJAN!"
X	COM+ Event System	DRWTSN16.EXE	"Added by the LOVGATE.AB WORM!"
X	COM+ EventSystem Services	ECSERVER.EXE	"Added by a variant of the SDBOT WORM!"
X	Com+ Sys	csrs.exe	"Added by the FORBOT-BT WORM!"
X	COM++ System	exploier.exe	"Added by the LOVGATE.Z WORM!"
U	com.codeode.cactusspamfilter	cactusspamfilter.exe	"Cactus Spam - free easy-to-use spam blocker"
U	com.codeode.privacymantra	privacymantra.exe	"""Privacy Mantra keeps your computer clean from online and offline tracks"""
X	Comcast Network	ribiva.exe	"Added by a variant of the IRC TROJAN!"
X	ComcastSUPPORT	tgkill.exe	Comcast (the cable folks who are replacing @home in some parts of the USA) have struck a deal with Tioga to provide an "enhanced" support and self-repairing tool. This is "beta" at present and was made available to download by mistake at present. Remove via Start -> Settings -> Add/Remove Programs
U	COMDRV32	svdhost.exe	"Orvell Monitoring 2003 surveillance software. Uninstall this software unless you put it there yourself. Note - asks for permission to contact the IP address of http://www.protectcom.com/"
U	Comm Driver	commh32.exe	"G Data ""PC Spion"". PC monitoring and surveilling software
X	Command Prompt32	CmdPrompt32.pif	"Added by the ASSIRAL.B WORM!"
U	Command WorkStation 4	cws 4.exe	"EFI's Command WorkStation makes ""managing demanding workflows easier by centralizing job management. The software automatically identifies the Fiery servers on the network and offers customization options for displaying information"" - for high-end print environments"
N	CommCtr	commctr.exe	"""Net2Phone CommCenter is the latest in Internet voice technology allowing you to place calls easily all over the world right from your PC!"". Available via Start -> Programs"
Y	Common Client	ccRegVfy.exe	"Part of earlier versions of Norton AntiVirus - ""ccRegVfy.exe is responsible for checking the integrity of the NAV registry entries to make sure that the information has not been changed by a malicious threat or a hack"""
N	CommonSDK	RoxWatchTray9.exe	"System Tray access to managing the ""Watched Folders""
X	CommonService	winup.exe	"Added by the DLOADR-BJJ TROJAN!"
Y	Communications_Helper	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	Communications_Helper.exe	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	COMMUNICATOR	Communicator.exe	"Part of Microsoft Office Communicator
U	Comodo Firewall	CPF.exe	"Comodo Firewall"
Y	COMODO Firewall Pro	cfp.exe	"Comodo Firewall Pro"
U	Comodo Launch Pad Tray	CLPTray.exe	"System Tray access to LaunchPad as bundled with Comodo's freebie offerings such as Comodo Anti-Virus. Some allege that LaunchPad is impossible-to-uninstall adware
Y	COMODO Memory Firewall	cmf.exe	"""Comodo Memory Firewall is a buffer overflow detection and prevention tool which provides the ultimate defence against one of the most serious and common attack types on the Internet - the buffer overflow attack"""
X	CompanionWizard	compwiz.exe	"Part of WinAntiVirusPro 2007 rogue security software (and possibly others) - not recommended
U	Compaq Alerter	CPQAlert.exe	"Compaq's Insight Manager Agent - a tool that allows for ""fault
N	Compaq Computer Corp SCCenter Module	SCCENTER.EXE	For Compaq PC's. Part of Backweb
?	Compaq Computer Security	"Rundll32.exe SECURE32.CPL	Service"
X	Compaq Drivers	F1rewalls.exe	"Added by the SDBOT-WD WORM!"
N	Compaq Internet Setup	inetwizard.exe	For Compaq PC's. Runs Compaq internet setup wizard and offers you to signup from ISP list
X	Compaq Jes Drivers	winjes.exe	"Added by the SDBOT-XR WORM!"
U	Compaq Knowledge Center	silent.exe & matcli.exe	""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	Compaq Message Server	COMPAQ-RBA.EXE	"Applies to the CPQBootPerfDB entry as well. These files generate some kind of server or servlet that attempts to connect with Compaq online. They are like Trojans
X	Compaq Print Fax	cpqa1000.exe	"Added by the SDBOT.BCV WORM! Please take note of the difference between the legitimate Compaq Fax Utility Name (A1000 Settings Utility) and the name (Compaq Print Fax) used by this worm"
X	Compaq Service Drivers	systeminfos.exe	"Added by the SDBOT-XC WORM!"
X	Compaq Service Drivers	compq.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	navapqwa.exe	"Added by the SDBOT.BBQ WORM!"
X	Compaq Service Drivers	amsn.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	compqs.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	msnt.exe	"Added by the SDBOT.CQL WORM!"
X	Compaq Service Drivers	NtKernelSystem.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	wincmd.exe	"Added by the RBOT.ATV WORM!"
X	Compaq Service Drivers	wind32.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	winmsn.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	compaq.exe	"Added by the SDBOT-AFU WORM!"
X	Compaq Service Drivers	msnsvc.exe	"Added by the RBOT.BKT WORM!"
X	Compaq Service Drivers	ntsys32.exe	"Added by the RBOT.CIW WORM!"
X	Compaq Service Drivers	winsvc.exe	"Added by the SDBOT-AGD WORM!"
X	Compaq Service Drivers 32	compq32.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivrs	copq.exe	"Added by a variant of the RBOT WORM!"
X	Compaq Services Drivers	ndt32.exe	"Added by the RBOT.CQZ WORM!"
X	Compaq Sound Drivers For WINDOWS	sounddr.exe	"Added by the SDBOT-XG WORM!"
N	Compaq Video CD Watcher	??	For Compaq PC's. MPEG viewer
X	Compaq32 Service Drivers	ms32.exe	"Added by the SDBOT.BWH WORM!"
X	Compaq32 Service Drivers	msconfig32.exe	"Added by the SDBOT-ADC WORM!"
X	Compaq32 Service Drivers	msnt32.exe	"Added by the RBOT.BVF WORM!"
?	CompaqHW Comp Manager	cpqhcm.exe	"Running on a Compaq laptop - any ideas?"
N	CompaqPrinTray	printray.exe	Puts printer icon in the System Tray. When this option is disabled you will no longer be able to access the Control Program or Printer Driver directly from your desktop
X	Compaqs Service Driver	copypad32.exe	"Added by the SDBOT.CSO WORM!"
X	Compaqs Service Drivers	compqs.exe	"Added by a variant of the SDBOT WORM!"
N	CompaqSystray	cpqpscp.exe	Compaq System Tray icon
X	Compatibility Service Process	regsvs.exe	"Added by the GAOBOT.YN WORM!"
X	Compd Service Drivrs	codq.exe	"Added by a variant of the SDBOT WORM!"
X	Compliant	[worm filename]	"Added by the RBOT-LB WORM!"
U	ComproRemote	ComproRemote.exe	"VideoMate TV tuner and capture card - remote control driver"
U	ComproSchedulerDTV	ComproSchedulerDTV.exe	"VideoMate TV tuner and capture card - scheduler"
U	CompuSpy KeyLogger	cswin2008.exe	"CompuSpy surveillance software. Uninstall this software unless you put it there yourself"
X	Computer Defender 2009	cd2009.exe	"Computer Defender 2009 rogue security software - not recommended
X	Computing Technologie Firewall	lsauth.exe	"Added by the SDBOT-WX WORM!"
X	ComStart	Trojan Guarder.exe	"TrojanGuarder rogue security software - not recommended"
X	ComTry Web Searcher	wstray.exe	Comtry MP3 Downloader related - spyware
X	con	[path to trojan]	"Added by the BRAVE-A TROJAN!"
?	Concurre	concurre.exe	"??"
X	ConducteurPrive	GDC.exe	"ConducteurPrive rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	ConfidentSurf	GDC.exe	"ConfidentSurf rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	ConfidentUser	SRP.exe	ConfidentUser rogue system error and cleaning utility - not recommended
X	Config	service.exe	"Added by the ISRAZ.B WORM!"
X	Config	WinService32.exe	"Added by the CRUTCHA-A TROJAN!"
X	Config Loadation	iEEexplore.exe	"Added by the SDBOT.H TROJAN!"
X	Config Loadatiorin	I3Explorer.exe	"Added by the SDBOT.H TROJAN!"
X	Config Loader	svchosl.exe	"Added by the GAOBOT.P WORM!"
X	Config Loader	sysldr32.exe	"Added by the GAOBOT WORM!"
X	Config Loader	scvhost.exe	"Added by the GAOBOT.AE or GAOBOT.AO WORMS!"
X	Config Loader	svhost.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Config Loader	svchost2.exe	"Added by the AGOBOT.XE WORM!"
X	Config Loader	[worm filename]	"Added by the AGOBOT-AE WORM!"
X	Config Loader	SYSMGR.EXE	"Added by the AGOBOT.C WORM!"
X	Config Loader	wincrt32.exe	"Added by the AGOBOT-AW WORM!"
X	Config Loader for Microsoft Windows	mwincfg32.exe	"Added by the AGOBOT.BD WORM!"
X	Config Loader2	explores.exe	"Added by the GAOBOT.BT WORM!"
X	Config Loadr	winsys32.exe	"Added by the AGOBOT-HN WORM!"
X	ConfiggLoader	cart322.exe	"Added by the GAOBOT.DJ WORM!"
N	ConfigServices	Config.exe	Part of initial setup on a Compaq PC
X	Configuration	explorer32.exe	"Added by the SDBOT-ML WORM!"
X	configuration	apphost.exe	"Added by the SDBOT-VP WORM!"
X	Configuration	ntsys32.exe	"Added by the SDBOT-LN WORM!"
X	Configuration	msgfixs.exe	"Added by the SDBOT-NN WORM!"
X	Configuration Default	Wuxat.exe	"Added by the SPYBOT-CA WORM!"
X	Configuration Driver	scghost.exe	"Added by the SDBOT-DLA WORM!"
X	Configuration File	Winset32.exe	Added by the FLUX.101 TROJAN!
X	Configuration Loaded	wupdated.exe	"Added by the MOEGA or MOEGA.AG or MOEGA.AP WORMS!"
X	Configuration Loaded	lssas.exe	"Added by a variant of the SDBOT WORM!"
X	Configuration Loaded	iexploree.exe	"Added by the SDBOT-KC WORM!"
X	Configuration Loader	aim95.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	cmd32.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	syscfg32.exe	"Added by the SDBOT.B BACKDOOR!"
X	Configuration Loader	service5.exe	"Added by the GAOBOT.AF WORM!"
X	Configuration Loader	lfass.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	sycfg34.exe	"Added by the GAOBOT.AN WORM!"
X	Configuration Loader	wincrt32.exe	"Added by the GAOBOT.BF WORM!"
X	Configuration Loader	windex.exe	"Added by the GAOBOT.BZ WORM!"
X	Configuration Loader	dosrun32.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Service.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Servicess.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sw32.exe	"Added by the AGOBOT.BQ WORM!"
X	Configuration Loader	System.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Winreg.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sysinfo.exe	"Added by the GAOBOT.FQ WORM!"
X	Configuration Loader	microsoft.exe	"Added by the GAOBOT.JB WORM!"
X	Configuration Loader	confgldr.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	configuration loader	winicfg32.exe	"Added by the GAOBOT.RQ WORM!"
X	Configuration Loader	svhst.exe	"Added by the GAOBOT.YC WORM!"
X	Configuration Loader	msgfix.exe	"Added by the GAOBOT.AUS or SDBOT.J or SDBOT-QG WORMS!"
X	Configuration Loader	msnss.exe	"Added by the GAOBOT.AUS WORM!"
X	Configuration Loader	IEXPL0RE.EXE	"Added by the SDBOT BACKDOOR! Note the number ""0"" in the filename"
X	Configuration Loader	loadcfg32.exe	"Added by the SDBOT BACKDOOR! Note the number ""0"" in the filename"
X	Configuration Loader	MSTasks.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	systemry.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	ccSort.exe	"Added by the AGOBOT.SR WORM!"
X	Configuration Loader	smss32.exe	"Added by the AGOBOT.MB WORM!"
X	Configuration Loader	wincffg.exe	"Added by the AGOBOT.A3 WORM!"
X	Configuration Loader	seru32.exe	"Added by the SDBOT-VR WORM!"
X	Configuration Loader	botss.exe	"Added by the SDBOT-XS WORM!"
X	Configuration Loader	ldasp.exe	"Added by the AGOBOT.BH WORM!"
X	Configuration Loader	msgcfgsrv.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	smsai.exe	"Added by the SDBOT-YE WORM!"
X	Configuration Loader	svupdate.exe	"Added by the RANDEX.DXP WORM!"
X	Configuration Loader	crcss.exe	"Added by the AGOBOT.ADG WORM!"
X	Configuration Loader	lexplore.exe	"Added by the RBOT-AGX WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	Configuration Loader	scvhost.exe	"Added by the AGOBOT-AAE and SDBOT.AR WORMS!"
X	Configuration Loader	svchost.exe	"Added by the PARADROP-A WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Configuration Loader	svchost2.exe	"Added by the AGOBOT.JR WORM!"
X	Configuration Loader	dezi.exe	"Added by the SDBOT-OB WORM!"
X	Configuration Loader	mouse.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	msg.exe	"Added by the SDBOT.BT WORM!"
X	Configuration Loader	WinHelper.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	extrac.exe	"Added by the SDBOT-AFP WORM!"
X	Configuration Loader	DVD-Player.exe	"Added by a variant of the SDBOT WORM!"
X	Configuration Loader	IEXPLORE.EXE	"Added by the SDBOT-KW WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Configuration Loader	wincore.exe	"Added by the SDBOT.BHE WORM!"
X	Configuration Loader	configldr.exe	"Added by the AGOBOT-PP TROJAN!"
X	Configuration Loader	ahnhst.exe	"Added by the AGOBOT.MX WORM!"
X	Configuration Loader	ntdm.exe	"Added by the AGOBOT.RV WORM!"
X	Configuration Loader	msnmsgr.exe	"Added by the SDBOT-SO WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Configuration Loader	svschost.exe	"Added by the SDBOT-NS WORM!"
X	Configuration Loader	wump.exe	"Added by the AGOBOT-BU BACKDOOR!"
X	Configuration Loader	WinSys32ys.exe	"Added by the SDBOT.BCS WORM!"
X	Configuration Loader	cvcd.exe	"Added by the AGOBOT-DH BACKDOOR!"
X	Configuration Loader	asnclt32.exe	"Added by the AGOBOT-EB BACKDOOR!"
X	Configuration Loader	soundconf.exe	"Added by the AGOBOT-MH WORM!"
X	Configuration Loader	win32exec.exe	"Added by the SDBOT-LA WORM!"
X	Configuration Loader	mservs.exe	"Added by the SDBOT-NM WORM!"
X	Configuration Loader	update.exe	"Added by the SDBOT-OS WORM!"
X	Configuration Loader	FILENAME.EXE	"Added by the AGOBOT-DQ WORM!"
X	Configuration Loader	explore.exe	"Added by the GAOBOT.GW WORM!"
X	Configuration Loader	msgfixy.exe	"Added by the SLINBOT.QW BACKDOOR!"
X	Configuration Loader	winfix.exe	"Added by the SDBOT-MA WORM!"
X	Configuration Loader	scvh0st.exe	"Added by the AGOBOT-AX WORM!"
X	Configuration Loader	msrun.exe	"Added by the AGOBOT-Y WORM!"
X	Configuration Loader 2	confuldr.exe	"Added by the AGOBOT-FC WORM!"
X	Configuration Loader Service	Winsys32.exe	"Added by the RBOT-YV WORM!"
X	Configuration Loader Service	devl32.exe	"Added by the SDBOT-XY WORM!"
X	Configuration Loader10	ip7.exe	"Added by the AGOBOT-ANZ WORM!"
X	Configuration Loading	svchos1.exe	"Added by the GAOBOT.DK WORM!"
X	Configuration Loading	configldr.exe	"Added by the AGOBOT-EC WORM!"
X	Configuration Loading Service	wscel.exe	"Added by the SDBOT-WJ WORM!"
X	Configuration Loadr	iexplore.exee	Added by an unidentified WORM or TROJAN!
X	Configuration Manager	CNFGLD32.EXE	"Added by the SDBOT TROJAN!"
X	Configuration Manager	Cnfgldr.exe	"Added by the SDBOT TROJAN!"
X	Configuration Manager	cfg32.exe	"BookedSpace parasite. Note - the ""cfg32.exe"" file is located in %Windir%"
X	Configuration Servecie	sewins.exe	"Added by the SDBOT-COH WORM!"
X	Configuration Service	suchost.exe	"Added by the TREB TROJAN!"
X	Configuration Services	mswords.exe	"Added by the SDBOT-YM WORM!"
X	Configuration Update	UPDT32V2.EXE	"Added by the SPYBOT-AA BACKDOOR!"
N	Configuration Utility	CONFIG.EXE	Controls linksys wireless connection. Available from the Desktop
U	Configuration Utility	wlanutil.exe	"NetGear Wireless LAN configuration utility for the MA311 802.11b (and maybe other cards)"
X	Configuration Wizard	Cfgwiz32.exe	"Added by a variant of the HACKTACK TROJAN! Not to be confused with the legitimate MS ""ISDN Configuration Wizard"" (Cfgwiz32.exe)"
X	Configuration32 Loader32	winamp32.exe	"Added by the SDBOT-BIC WORM!"
X	Configurations Asclt	asclt.exe	"Added by the SDBOT-MX WORM!"
X	CONFIGUREv	antivir62.exe	"Added by the AGOBOT-ZD BACKDOOR!"
X	ConfigVir	services.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
X	ConfLoader	sysconf16.exe	"Added by the SDBOT-FB TROJAN!"
N	Conmgr	conmgr.exe	Starts Winfax pro at startup
U	ConMgr.exe	conmgr.exe	Connection Manager as used by Earthlink and others. If you need this to ensure a proper connection but don't want to connect at startup try creating your own shortcut
X	conmswf	conrnbne.exe	"Added by the SDBOT-DEX WORM!"
X	Connect2Party	connect2party.exe	Adult content dialler
N	CONNECTAuto Update	CONNECTScheduler.exe	"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
N	CONNECTAUTrayApp	CONNECTAUTrayApp.exe	"System Tray access to change update settings for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
U	Connection Keeper	ConKeepM.exe	"""Connection Keeper is an invaluable time-saving tool for dial-up users. This free program simulates Internet browsing (at a random interval) to prevent your connection from appearing idle
N	Connection Manager	CManager.exe	SBC Yahoo DSL service connection manager. You can connect from the network connections. Users having problems with this have been advised to uninstall the connection manager via Add/Remove Programs and it won't affect the service
X	Connectivity Tool	[path to trojan]	"Added by the LITEBOT-E TROJAN!"
X	Connector	SYS.EXE	"Nunci premium rate dialer"
X	Connector	sms.EXE	"Added by the ExDial-B premium rate adult content dialer"
N	CONNECTScheduler	CONNECTScheduler.exe	"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
X	conscorr	conscorr.exe	"VX2.Transponder parasite updater/installer related"
X	Console de Gerenciamento Microsoft	csrss.exe	"Unidentified malware! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Level4"" subfolder"
X	Console de Gerenciamento Microsoft	csrss.exe	"Added by the BANCBAN-ET TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Central de Segurança"" subfolder"
U	Consumer Input	ConsumerInput.exe	"Consumer Input Toolbar. Opt-in market research monitoring you browsing habits - see the FAQ"
X	Content connector	[random filename].exe	"Added by the DIALER-Y TROJAN! Note - uses a random filename and random folders. Usually the folder containing the file is a Temp folder"
X	Content Service	winserv[LETTER].exe	"PurityScan adware"
X	ContentDownload	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	ContentEraser	GDC.exe	"ContentEraser rogue privacy tool - not recommended
X	ContentService	winservn.exe	"PurityScan adware - see here"
U	ContentTransferWMDetector.exe	ContentTransferWMDetector.exe	"Part of Sony's Content Transfer Software which ""provides an easy way to transfer music
X	Contraviro	Contraviro.exe	"Contraviro rogue security software - not recommended
X	ContraVirus	ContraVirusPro.exe	"ContraVirus rogue security software - not recommended
X	ContraVirus	ContraVirus.exe	"ContraVirus rogue security software - not recommended
X	Control	"rundll32.exe ctrlpan.dll	Restore ControlPanel"
U	Control Center	Center.exe	"Associated with Hawking Technologies
X	Control handler	***********.exe [* = random char]	"CoolWebSearch parasite variant"
X	Control handler	ahjinst.exe	"CoolWebSearch parasite variant"
X	Control handler	[10 to 14 random char]THD.EXE	"Added by the KREPPER-AI TROJAN!"
N	control panel	smctrlw.exe	System Tray icon for a Silicon Motion LynxEM based PCI Graphics Card
X	Control Panel	System.exe	"Added by the DANI TROJAN!"
X	control panel software service	cprs.exe	"Added by the RBOT-FPI WORM!"
X	Controladores	[path to trojan]	"Added by the TELEFO-A TROJAN!"
Y	ControlCenter	ctlcntr.exe	"Part of Lenovo's (IBM) ThinkVantage Fingerprint Software - used on laptops and keyboards with integrated fingerprint readers"
N	ControlCenter2.0	brctrcen.exe	Brother scanner 'Control Center' application - can be started manually
N	ControlCentreTray	XWCTray.exe	"System Tray access for the Xerox ControlCentre 2.0 software for their range of printers
X	Controlled Resource System Service	crss.exe	"Added by the AGOBOT.GH WORM!"
N	Controller	WFXCTL32.EXE	From Symantec's TalkWorks Pro and WinFax. Appears if you chose to have the program appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs
X	ControlPanel	"rundll32 internat.dll	LoadKeyboardProfile"
X	ControlPanel	"host32.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"cmd32.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"systemctrl.exe internet.dll	LoadNetworkProfile"
X	ControlPanel	"[path to executable] internat.dll	LoadKeyboardProfile"
X	ControlPanel	"popcorn.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"popcorn64.exe rundll.dll	LoadMouseProfile"
X	ControlPanel	"popcorn72.exe rundll.dll	LoadMouseProfile"
X	ControlPanel	"svcc.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"popcorn320.exe rundll.dll	LoadMouseProfile"
X	ControlPanel	"private.exe internat.dll	LoadMouseCarpetProfile"
X	ControlPanel	"twink64.exe internat.dll	LoadKeyboardProfile"
X	ControlServiceMgr	csmsv.exe	"Added by the AGENT-XC TROJAN!"
U	Cookie Pal	CPBRWTCH.EXE	"Kookaburra Software's Cookie Pal cookie manager. Allows you to decide which internet sites can add ""cookies"" related to their sites for the next time you return"
U	CookieJar	Cookiejar.exe	"Cookie Jar cookie manager from Jason's Toolbox. Allows you to decide which internet sites can add ""cookies"" related to their sites for the next time you return. No longer being actively supported"
U	CookiePatrol	CookiePatrol.exe	"CookiePatrol - cookie interceptor stopping spyware cookies that used to be part of PestPatrol before CA's aquisition"
X	CoolDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	CoolMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
N	Coolwallpaper	cwm_tray.exe	"Cool Wallpaper software allows you to manage high quality photos as desktop wallpaper and screen savers"
X	coolwebprogram	clrssn.exe	"CoolWebSearch Smartsearch parasite variant"
N	Copernic Desktop Search	DesktopSearch.exe	"Copernic Desktop Search - ""Easily search your entire hard drive in less than a second to pinpoint the right file
U	Copernic Desktop Search 2	DesktopSearchService.exe	"Copernic Desktop Search - search agent"
U	CopernicPerUserTaskMgr	CopernicPerUserTaskMgr.exe	Automatic tasking feature of Copernic Pro multi-search engine tool
U	Copperhead	razerhid.exe	"Razer Copperhead gaming mouse driver - required if you use the additional features and programmed keys/macros"
U	Copy handler	Copy Handler.exe	"Copy Handler lets you copy between hard disks
N	Copyright	mwcpyrt.exe	Displays copyright information on IBM ThinkPads
X	Core Process Aplication	ccapl.exe	"Added by the QHOSTS.G TROJAN!"
X	Core Process Aplication x16	ccapl16.exe	"Added by the SPYBOT.AFT WORM!"
X	Core Process Aplication x32	ccapl32.exe	"Added by the SRAMLER.E TROJAN!"
X	Core System Hardware	syscorehd.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
U	CoreCenter	CoreCenter.exe	"MSI Core Center - motherboard utility for monitoring CPU speed
U	CoreCenter	CORECE~1.EXE	"MSI Core Center - motherboard utility for monitoring CPU speed
X	Coreguard Antivirus 2009	Coreguard 2009.exe	"Coreguard Antivirus 2009 rogue security software - not recommended
N	Corel Colleagues & Contacts Reminders	cffrem.exe	"Corel Colleagues & Contracts - all-in-one organizer for scheduling meetings
N	Corel Desktop Application Director	dadx.exe	The Desktop Application Director (DAD) gives you easy access to all Corel applications - x represents ther version number. Available via Start -> Programs
N	Corel Family & Friends reminders	CFFREM.EXE	"Corel Family & Friends - all-in-one calender
N	Corel Photo Downloader	MediaDetect.exe	"Related to Corel Photo Album"
N	Corel Registration	Remind32.exe	If you don't want to register Corel products and be reminded about it every 2 weeks disable it
N	Corel Registration Reminder	Remind32.exe	If you don't want to register Corel products and be reminded about it every 2 weeks disable it
N	Corel Reminder	NAVBROWSER.EXE	If you don't want to register Corel products and be reminded about it every 2 weeks disable it
N	Corel Reminder	NAVBrowser.exe	Registration reminder for CorelDRAW 10
N	CorelCENTRAL 10	I_26dadCC.exe	"CorelCENTRAL 10 - personal information manager (PIM). Supplied as part of Corel WordPerfect Office 2002. Available via Start -> Programs"
X	CorelDraw Toolbox	CorelDraw.exe	"Added by the SDBOT-VZ WORM!"
N	CorelMedia FoldersIndexer8	MFindexer.exe	Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office
N	CorelMedia FoldersIndexer8	MFINDE~1.EXE	Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office
X	CoreSrv	coresrv.exe	"Some IRC trojans/worms use this - see here for more information"
?	CORESYS	coresys.exe	"??"
X	Corporate Microsoft Update	uptask.exe	"Added by the RBOT-GVB WORM!"
N	CorrectConnect	CConnect.exe	Broadband ISP diagnostic tool - as used by NTL and Cox Communications. Shortcut available
U	CostAware	niIPCApp.exe	"NetInternals CostAware - download quota measuring tool"
X	Counterstrike Service Agent	czrzns.exe	"Added by the MEDBOT.AR WORM!"
N	Country Select	pctptt.exe	"Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell
N	CountrySelection	pctptt.exe	"Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell
?	Coupon Offers	??	"??"
?	CP	CopyProtectionNotifier.exe	"Related to Emuzed Systems and Middleware. Comes included with Windows XP Media Edition"
?	CPA9P2PSERVER	CPA9P2PS.exe	"Found on a Compaq Presario but what is it?"
U	CPATR10	CPATR10.EXE	"Dritek/Compal ATR10 Easy Button driver. Used on certain laptops (e.g. Toshiba
U	CPBrWtch	CPBrWtch.exe	"Kookaburra Software's Cookie Pal cookie manager. Allows you to decide which internet sites can add ""cookies"" related to their sites for the next time you return"
X	cpl	browse.exe	"Added by the TACTSLAY.C TROJAN!"
?	CPortPatch	cppatch.exe	"CPortPatch is a utility is required for Dell laptops that are using a docking station. Is it needed though?"
X	cppc	[path to trojan]	"Added by the VB-NV BACKDOOR!"
U	CPQAlert	CPQAlert.exe	"Compaq's Insight Manager Agent - a tool that allows for ""fault
N	CPQBootPerfDB	CPQBootPerfDB.EXE	See the entry for Compaq Message Server
U	CPQEASYACC	StartEAK.exe	"Easy Access Button Support for Compaq PCs. Allows the use of programmable keys on multimedia keyboards. Required if you use the additional keys"
U	CPQEASYACC	STARTDRV.exe	For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
U	CPQInet Runtime Service	CpqInet.exe	"For Compaq PC's. Allows AOL and Compuserve to use the Easy Access buttons for the internet. Is not required if you don't use the ISP providers"
X	cpr	cpr	Adroar.com adware downloader
X	cprocsvc	cproc.exe	Added by MSIL.AGENT.C TROJAN!
X	CPU Manager	cpumgr.exe	"Added by the PANDEM.B WORM!"
U	CPU Power Monitor	CpuPowerMonitor.exe	"Included with some ASUS motherboards (such as the Maximus Extreme & Striker II Extreme). Associated with the ""Energy Saving"" feature of AI Gear - which ""is a utility designed to configure and support all ASUS EPU (Energy Processing Unit) features."" Part of AI Suite"
X	CPU Temp Control	wuitgurd.exe	"Added by the RBOT-AHV WORM!"
X	CPU Watcher	"rundll32.exe cpu.dll	load"
X	cqlyg	world_cup_.bat	"Added by the WCUP.A WORM!"
?	CQSCP2PSERVER	CQSCP2PS.EXE	"""Compaq printer utility which is required in the startup menu in order to make the printer work correctly"". Is it actually required?"
X	Cr**.exe [* = random char]	Cr**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Cr**32.exe [* = random char]	Cr**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
U	cracked_windows1	cracked_windows1.exe	"Cracked Windows popup killer"
X	crash0001	restorecrashwin32.bat	"Added by the AGENT-ZC TROJAN!"
X	CrashDump	[path to trojan]	"Added by the DROPPER.EAT TROJAN!"
N	CrazyTalk Serve	"rundll32.exe CrazyTalk.dll	DIIServeMediaFile"
U	CRBroadCasting	CRBroadCasting.exe	"CardReader2 from On Track Inovations Ltd. USB Card Reader"
X	CRC Value Verifier	crsss32.exe	"Added by a variant of the RBOT WORM!"
X	CRC Value Verifier	Crsss64.exe	"Added by the RBOT-NY WORM!"
X	CRC Value Verifier	svchost32.exe	"Added by the RBOT-OA WORM!"
X	CRC Value Verifier	crsss.exe	"Added by the SPYBOT.UK WORM!"
X	Crc32stats Dependencies	Crc32stats.exe	"Added by the MYTOB.GT WORM!"
X	CRCSS	crcss.exe	"Added by the IRCBOT-TH WORM!"
U	Creata Mail	JMSrvr.exe	"Creata_Mail. Smileys
X	Create A Monster	createAMonster.exe	"Kudd.com CreateAMonster. Reportedly stealth installed and Look2Me adware related"
N	CreateCD	Createcd.exe	Adaptec Easy CD Creator system tray application (pre version 5). Available via Start -> Programs
N	CreateCD50	Createcd50.exe	Adaptec Easy CD Creator version 5 system tray application. Available via Start -> Programs
N	CreateCD_Reminder	reminder.exe	Reminder to create system recovery CD/DVDs on a Sony Vaio laptop or desktop
X	Creates stractures for system management	stacture.exe	"Added by the SDBOT-DHS WORM!"
N	Creative AGP Wizard	agpwiz.exe	Part of Creative's BlasterControl
X	Creative Audio Drivers	creative.exe	"Added by the RBOT-FKR WORM!"
N	Creative Detector	CTDetect.exe	"Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player
N	Creative Launcher	CTLauncher.exe	For Creative Soundblaster Live! series soundcards. Adds a quick-launch bar to the top of the display and a System Tray icon. Available via Start -> Programs
U	Creative Live! Cam Manager	CTLCMgr.exe	"Creative Live! Cam Manager"
U	Creative MediaSource Go	CTCMSGo.exe	"Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
U	Creative MediaSource Go	CTCMSGoU.exe	"Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
N	Creative PCI Audio Configuration Utility	starter.exe	"System Tray icon to configure a Creative Soundblaster PCI soundcard. Not required and re-instates itself when un-checked. Try one of the solutions on this special page. Similar to EnsoniqMixer"
N	Creative Software Update	AutoUpdate.exe	Auto-updater for Creative Labs software
N	Creative WebCam Tray	Camtray.exe	Creative WebCam tray control - can be started manually
X	Creative.exe	Creative.exe	"Added by the PROLIN WORM!"
N	CreativeDiscNotifier	CTNOTIFY.EXE	"For Creative Soundblaster Live! series soundcards. Detects when you insert a CD-ROM
U	CreativeMixer	CTMIX32.EXE	"Creative soundcard System Tray access to
?	CreativeTaskScheduler	CTSched.exe	"Creative Task Scheduler. What does it do and is it required?"
X	CrisysTec Sentry	Sentry.exe	"CrisysTec Sentry rogue privacy program - not recommended"
X	Critical Error Safe32	GetWaylayer32.exe	Added by the RBOT.IAL WORM!
X	Critical Update Check	battlenet.exe	"Added by the DELF-LB TROJAN!"
N	CriticalUpdate	Wucrtupd.exe	"MS Windows Critical Update Notification. If you want to keep Windows up-to-date
X	CriticalUpdate	wucrtupd.exe	"Added by the NOALA.B WORM! Note - this file is located in the Windows or Winnt folder
X	crmssrlt	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	Crnsava	scrnsave.pif	"Added by the SDBOT-ZV WORM!"
X	cronos	MARCO!.SCR	"Added by the OPASERV.G WORM!"
X	CrossMenu	CrossMenu	Toshiba CrossMenu Utility - allows the user to create their own menus
U	CrossMenu	CrossMenu.exe	Toshiba CrossMenu Utility - allows the user to create their own menus
X	CRP386 Networking	crp386.exe	"Added by the IRCBOT.N TROJAN!"
X	crs	crs.exe	"Added by the AGOBOT-TJ WORM!"
X	crsmons	iomssls.exe	"Added by the BACKDR-AU TROJAN!"
X	CRSS	CRSS.exe	"Added by the AGOBOT-RM WORM!"
X	CRSS	lssas.exe	Added by an unidentified WORM or TROJAN!
X	crsss	crsss.exe	"Added by the AUTORUN.FM WORM!"
X	CRSSXP SysInfo	crssxp.exe	"Added by a variant of the SDBOT TROJAN!"
X	Crusty	dmcpl.exe	"Added by the RUSTY WORM!"
X	cryptdlg	cryptdlg.exe	Added by an unidentified TROJAN!
N	CryptLoad	RouterClient.exe	"CryptLoad download manager"
U	cryptoexpert	cexpert.exe	"CryptoExpert from SecureAction Research. Advanced on the fly encryption system"
X	Cryptographic Service	******.exe [* = random char]	"Added by the KORGO.W or KORGO.X or KORGO.AB WORMS!"
?	Crystal 3D Audio Control	CWD3DSND.EXE	"Crystal 3D Audio sound driver. Is it required?"
X	CS Update	copy /Y [path] ActivationManager.dll.upd [path] ActivationManager.dll	Added by an unidentified malware
N	csaRem	spqmdmui.exe	Compaq modem country selection
Y	CSAV_CheckViruses	vchk.exe	"Command Antivirus related"
X	cscripts	cscripts.exe	"Added by the BDOOR-AAP BACKDOOR!"
X	CSCRS Value	cscrs.exe	"Added by the RBOT-AAA WORM!"
X	CSCRS Value Check	MsPMSPSd.exe	"Added by a variant of the SDBOT WORM!"
X	cserv32	cserv32.exe	"Added by the STRATION.EC WORM!"
X	CsimPlayer	CsimPlayer.exe	"Added by the KOOBFACE-AD WORM!"
X	CSNetManagerXp	isass.exe	"Added by the HIDER-O TROJAN!"
X	csrcs	csrcs.exe	"Added by the AGENT-HUA TROJAN!"
X	csrs	csrs.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	csrsc	csrsc.exe	"Added by an unidentified VIRUS
X	CSRSS	CSRSS.EXE	"Search page hijacker
X	Csrss	csrss.exe	"Added by the CHOD WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a random subfolder"
X	csrss	csrss.exe	"Added by the KEYLOG-AQ KEYLOGGER! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	csrss	csrss.exe	"Added by the CHODE-J WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a random subfolder"
X	csrss	msmsgs.exe	"Added by the CHODE-J BACKDOOR! Note - this malware uses MSN Messenger (which is located in %Program Files%\Messenger) in the background to propogate itself"
X	csrss	nwiz.exe	"Added by the CHODE-J WORM!"
U	csrss	csrss.exe	"BeyondKeylog surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Supremtec"
X	Csrss	CSRSS.EXE	"Added by the PUNYA-B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in C:\Documents and Settings\Administrator\Local Settings\Application Data\WINDOWS"
X	csrss	ssms.exe	Added by an unidentified malware
X	Csrss Host	csrhost.exe	"Added by the IRCBOT.BIZ WORM!"
X	CSRSS Loader	csrsss.exe	"Added by the AGOBOT.TX WORM!"
X	csrss.exe	csrss.exe	"Added by the DALBUG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	csrssLevel4	csrss.exe	"Unidentified malware! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Level4"" subfolder"
X	CSRSSU	CSRSSU.exe	"CoolWebSearch parasite variant - hijacking to Slawsearch.com. Also detected as the CWS-E TROJAN!"
X	CSRSSW	CSRSSW.EXE	"Added by the CWS-F TROJAN!"
X	CSRSWIN	[trojan filename]	"Added by the WINSHELL.50 TROJAN!"
X	CSRSX	[trojan filename]	"Added by the WINSHELL.50.B TROJAN!"
X	csrvss	csrvss.exe	"Added by a variant of the SDBOT TROJAN!"
U	CSS Server	CSSServer.exe	"ComSpySysSvr surveillance software. Uninstall this software unless you put it there yourself"
X	cssrs	cssrs.exe	"Added by the BANCBAN-DW TROJAN!"
X	cssrss.exe	cssrss.exe	"Malware installed by different rogue security software including SpyKillerPro"
U	CSS_Central	CSS_1631.EXE	"CSS Communication Agent (95 Host) from Command Software Systems (now Authentium). ""CSS Central™ provides administrators with a powerfully proactive tool to effectively manage and maintain the anti-virus strategy from a centralized console"""
X	CT Control Settings	CTSVCCD.EXE	"Added by the RBOT-YS WORM!"
U	CTAPR2	CTAPR2.exe	"Console Launcher for the Creative Sound Blaster X-Fi series"
N	CTAVTray	CTAvTray.exe	For Creative Soundblaster Live! series soundcards. Plays the EAX animation on start-up and adds a System Tray icon for it. Available via AudioHQ
U	CTCMonitor	CTCMonitor.exe	"Click-to-Convert - document-to-HTML or doc-to-PDF converter. Only required if you are going to use the File -> Print method of using Click-to-Convert. If converting directly from MS Office
X	CTDrive	"rundll32.exe drvmod.dll	startup"
X	CTF Device Loader	ctfmond.exe	"Added by the AGOBOT-FO WORM!"
X	ctflog manager	ctflog.exe	"Added by the DONBOMB.A TROJAN!"
X	ctfmen	cssrs.exe	"Added by the STARTP-DC TROJAN!"
X	ctfmon	taskmgr32*.exe [* = number]	"Added by the SOWSAT.B WORM!"
X	ctfmon	mIRC.dll	"Added by the DELBOT-E TROJAN!"
X	ctfmon	msnmsgr.exe	"Added by the BDOOR-JV BACKDOOR! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	CTFMON	wscript.exe /E:vbs winjpg.jpg	"Added by the RUNAUTO.F WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""winjpg.jpg"" file is located in %System%"
X	CTFMON	wscript.exe /E:vbs regedit.sys	"Added by the VBSAUTO-A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""regedit.sys"" file is located in %System%"
X	ctfmon32	[random filename].exe	"Added by the RBOT-GSN WORM!"
X	ctfmon32	taskmgr32*.exe [* = digit]	"Added by the SOWSAT.C WORM!"
X	ctfmoon	microsoftconfigurator.exe	"Added by the DELF-ALS TROJAN!"
X	ctfnom	rundIl32.exe	"Added by the LEGMIR-AW TROJAN!"
X	ctfnom.exe	OSRSS.exe	"Added by the DLOADER-UQ TROJAN!"
U	CTHELPER	CTHELPER.EXE	"CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers
X	CTHelper	cthelper.exe	"Added by the RBOT-XB WORM! Note - do not confuse with the Creative application of the same name described here"
X	CTHELPER	svhost.exe	"Added by the SDBOT-RZ WORM!"
X	CTime	[path to trojan]	"Added by the HTTPDOS TROJAN!"
U	CTNMRUN	ctnmrun.exe	Detects the Creative NOMAD jukebox/MP3 player at the time it is attached to USB and starts the needed application (Creative PlayCentre 2) that you use to copy MP3 files to and from it. This is required if you want PlayCentre 2 to take control of the NOMAD once connected
?	CTPDPSRV	CTPDPSRV.EXE	"Compaq A3000 printer driver (in the %System%\spool\DRIVERS\W32\X86 folder). Is it required?"
N	CTPerformanceUtility	CTPowUti.exe	"Related to Creative PowerSysTrayApp. This program is a non-essential process
N	CTRegRun	CTRegRun.exe	For Creative Soundblaster Live! series soundcards. Reminds you to register your card with Creative
U	CtrlVol	CtrlVol.exe	"Volume control key on Acer
N	CTStartup	CTEaxSpl.exe	Splash screen with sound on every boot up. Installed with a Sound Blaster Audigy soundcard
?	cttdpsrv	cttdpsrv.exe	"??"
N	CTXFIREG	CTxfiReg.exe	Creative Labs sound card driver related. It appears that it isn't required and maybe registration related
X	CueX44_stil_here	WINLOGON.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate winlogon.exe process
X	Current Security Config	csecure.exe	"Added by the RBOT-AMO WORM!"
X	Current32	msnpla.exe	"Added by the SDBOT-DIS WORM!"
N	CurseClient	CurseClient.exe	"CurseClient add-on manager for World of Warcraft and Warhammer Online games"
N	cursor	Screendragon_VS_Taskbar.exe	"ScreenDragon video player"
U	CursorGizmo	CursorGizmo.exe	"Cursor Gizmo - cursor management utility"
N	CursorXP	CursorXP.exe	"CursorXP from Stardock - tool for creating mouse cursors"
U	Curtain	Curtain.exe	"Curtain (from Chaotic Visions) - ""is a Windows utility which gives you the power to hide any window or group of windows to your system tray"""
U	Customizer2000	logon.exe	"Automatic logon feature of Customizer 2000 - ""a special utility which is designed to optimize Win9x/ME performance. The program lets you explore the many hidden settings in Windows
X	cvmonitor.exe	cvmonitor.exe	"Added by the SDBOT.BV WORM!"
X	cvmsyslpd	sdservss.exe	"Added by the MAILBOT-BY TROJAN!"
N	cwbckver	cwbckver.exe	"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
N	cwbsvstr	cwbsvstr.exe	"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
U	cwcptray	cwcptray.exe	"Related to ContentWatch Parental Control internet filter"
X	cwriter	ucookw.exe	"Part of the ErrClean rogue system error and cleaning utility and other members of this family. See here for more examples"
X	cwriter	cwriter.exe	"Part of PcRaiser
X	cximddl	ldfrmmd.exe	"Added by the BUZUS.CQMU TROJAN!"
N	CXMon	Hpi_Monitor.exe	Autodetects when a HP camera is attached to the computer and launches the "HP Photoimaging Software". Available via Start -> Programs
N	Cyber	cyberchk.exe	"Part of Belkins ""Multimedia Cleaning Kit"" and is automatically installed when you run their optical disk drive cleaning utility - to remind you to clean your drive after ""x"" amount of time has passed"
U	Cyber Trio	showmode.exe	"From G-Tek Technologies. Allows you to set the PC in one of three modes
U	Cyber-Defender 2003	uwcdsvr.exe	"
N	Cyber-shot Viewer Media Check Tool	SPUVolumeWatcher.exe	"Part of the Sony Picture Uility software supplied with Sony Cyber-shot digital cameras. Automatically invokes an import process if the camera is connected and has media on it"
N	Cyber-shot Viewer Media Check Tool	SPUVOL~1.EXE	"Part of the Sony Picture Utility software supplied with Sony Cyber-shot digital cameras. Automatically invokes an import process if the camera is connected and has media on it"
X	cyberfree.exe	****.dat [* = random char]	Unidentified adware
U	Cyberhawk	CHTray.exe	"Cyberhawk from Novatix. Protects against viruses
U	CyberLat Ram Cleaner	CLRamCleaner.exe	"CyberLat RAM Cleaner - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
U	CyberLat Ram Cleaner	CyberLat Ram Cleaner 1.1.exe	"CyberLat RAM Cleaner - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
N	Cyberlink PowerCinema 3.0	PCMService.exe	"Part of Cyberlink's PowerCinema - which can be used to watch movies
N	CyberMedia Agent	CMAGENT.EXE	"Part of CyberMedia's Oil Change program. Not normally required. Note - if you have TextBridge
U	CyberPatrolNew	cphq.exe	"""CyberPatrol is one of the most powerful and popular client-based
X	CyberWolf	CyberWolf.exe	"Added by the KICKIN.A (or CYDOG.C) WORM!"
X	CyDoor	CD_Load.exe	"Adware. Check here for information about Cy-Door and here for a program that can remove it"
X	CydoorUpdate	CD_Load.exe	"Adware. Check here for information about Cy-Door and here for a program that can remove it"
N	CyphTray	CyphTray.exe	"Cypherus - encryption software"
U	CypressLinkMon	CypressLinkMon.exe	"Related to CypressViewer from Siemens that ""allows ACUSON Cypress cardiovascular system PLUS users to store
Y	D-Link Air USB Utility	AirCFG.exe	D-Link Air USB wireless driver and configuration utility
Y	D-Link Air Utility	AirCFG.exe	D-Link Air PCI wireless driver and configuration utility
N	D-Link AirPlus DWL-650+ Utility	WLANMON.exe	D-Link Air Plus Wireless PC modem connection monitor
Y	D-Link AirPlus G	AirGCFG.exe	D-Link Airplus G wireless router driver and configuration utility
Y	D-Link AirPlus G Wireless Utility	AirPlus.exe	"D-Link AirPlus G wireless configuration and monitoring utility"
Y	D-Link AirPlus XtremeG	AirPlusCFG.exe	"D-Link AirPlus Xtreme G wireless access point driver and configuration utility"
Y	D-Link D-Link DWA-125	AirGCFG.exe	"D-Link DWA-125 Wireless 150 USB adapter driver and configuration utility"
Y	D-Link D-Link RangeBooster N DWA-140	AirNCFG.exe	"D-Link DWA-140 RangeBooster N USB adapter driver and configuration utility"
Y	D-Link D-Link Wireless 108G DWA-120	AirPlusCFG.exe	D-Link DWA-120 Wireless 108G USB adapter driver and configuration utility
Y	D-Link D-Link Wireless 108G DWA-520	AirPlusCFG.exe	D-Link DWA-520 Wireless 108G desktop adapter driver and configuration utility
Y	D-Link D-Link Wireless G DWA-110	AirGCFG.exe	D-Link DWA-110 Wireless G USB adapter driver and configuration utility
Y	D-Link D-Link Wireless G DWA-510	AirGCFG.exe	D-Link DWA-510 Wireless G desktop adapter driver and configuration utility
Y	D-Link D-Link Wireless N Dual Band DWA-160	AirNCFG.exe	"D-Link DWA-160 Xtreme N Dual Band USB adapter driver and configuration utility"
Y	D-Link D-Link Wireless N DWA-130	AirNCFG.exe	"D-Link DWA-130 Wireless N USB adapter driver and configuration utility"
Y	D-Link D-Link Xtreme N Dual Band DWA-160	AirNCFG.exe	"D-Link DWA-160 Xtreme N Dual Band USB adapter driver and configuration utility"
Y	D-Link RangeBooster G WDA-2320	AirPlusCFG.exe	"D-Link WDA-2320 RangeBooster G desktop adapter driver and configuration utility"
Y	D-Link RangeBooster G WUA-2340	AirPlusCFG.exe	"D-Link WUA-2340 RangeBooster G USB adapter driver and configuration utility"
Y	D-Link Wireless G WDA-1320	AirGCFG.exe	"D-Link WDA-1320 Wireless G desktop adapter driver and configuration utility"
Y	D-Link Wireless G WUA-1340	AirGCFG.exe	"D-Link WUA-1340 Wireless G USB adapter driver and configuration utility"
X	D3**.exe [* = random char]	D3**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	D3**32.exe [* = random char]	D3**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	dabrun	"rundll32.exe dabapi.dll	Rundll32"
N	DAEMON Tools Pro	DTAgent.exe	"System Tray access to DAEMON Tools Pro from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
N	DAEMON Tools Pro Agent	DTProAgent.exe	"System Tray access to an older version of DAEMON Tools Pro from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
N	DAEMON Tools Pro Agent	DTAgent.exe	"System Tray access to DAEMON Tools Pro from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
N	Daily Planner	dayplan.exe	"Daily Planner - discontinued
X	Daily Weather Forecast	weather.exe	"Added by the DLOADER-IP TROJAN!"
X	DamedWare Services	dwdrce.exe	"Added by the RBOT-AOJ WORM!"
X	DanBtR270414	DanBtR270414.exe	"Added by the VB-NIB WORM!"
U	Dancer	DncLE.exe	"Part of Microsoft Plus! Digital Media Edition - see here"
X	Danton*	[random filename]	"Added by the DANTON TROJAN! where * = random number"
X	dark	imgst.scr	"Added by the BANCOS.U TROJAN!"
X	dark	imgrt.scr	"Added by the BANCBAN-FH TROJAN!"
X	dark	csrs.scr	"Added by the BANCBAN-GT or BANCBAN-GU TROJANS!"
X	DarkDevil.Grasiele.BR	Grasiele.VBS	"Added by the LEMBRA WORM!"
X	DarKNesS LsasS	LsasS23.exe	Added by an unidentified WORM or TROJAN!
?	DashBarState	dashIE	"??"
X	Data Layer 2	datalayer.exe	"Added by the RBOT-BNF WORM! Note - do not confuse with the legitimate Nokia file sharing the same filename - this one is located in %System%"
N	Data LifeGuard	BACKWE~1.EXE	Data LifeGuard diagnostic tools for Western Digital's series of hard drives
N	Data LifeGuard LifeLine Lite installer	DLGLI.EXE	"Backweb installer - see here"
X	Data Protection	datprot.exe	"Data Protection rogue security software - not recommended
X	Data Restore Service	prq8.exe	"Added by the KELVIR.AI WORM!"
X	Data789	Regedit.exe ....data789.tmp	Homepage hijacker
X	DATABASE MySql	[path] repcale.exe [path] beird.exe	"Added by the RANDON-AL WORM! Both files are often located in %System%\qsws"
X	DataHealer	DataHealer.exe	"DataHealer rogue security software - not recommended
U	DataKeeper	DataKeeper.exe	"PowerQuest DataKeeper (now owned by Symantec) backup software"
Y	DataLayer	DataLayer.exe	"Part of Nokia PC Suite version 5 - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" Required by the Nokia status/connection monitor (NclTray.exe)"
Y	DataLayer	DATALA~1.EXE	"Part of Nokia PC Suite version 5 - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" Required by the Nokia status/connection monitor (NclTray.exe)"
N	DataViz Inc Messenger	DvzIncMsgr.exe	"Installed with DataViz ""Documents to Go"" software"
N	DataViz Messenger	DvzMsgr.exe	"DataViz Documents to Go - "allows you to use your Word
X	Date Manager	datemanager.exe	"Date Manager - calender program. Spyware/adware based provided by The Gator Corporation. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
?	Datechecker	N/A	"Could be related to this?"
X	DateMakerIntl	DateMakerIntl.exe	Premium rate adult content dialler
X	DateMngr	DATEMNGR.EXE	"Added by the SPYBOT-BR BACKDOOR!"
U	DAZEL Delivery Agent	DcDaemon.exe	"Control and send documents
X	dbar_starter	starter.exe	"Deskbar adware - adds a search bar to your Windows taskbar which performs searches on www.w-w-w-dot-com.com"
N	dbserv	dbserv.exe	Database Server for Norton Ghost on Win2k Pro. Ghost works fine when it is disabled
U	DC300 Monitor	cmonitor.exe	Monitor for a Acer DC300 digital camera
X	DC6	dc6_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	DC6_check	dc6_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	DCE Manager	dcemgr.exe	"Added by the TUMAG TROJAN!"
X	DCOM Server	[path to trojan]	"Added by the AGENT-CCQ BACKDOOR!"
X	Dcom System Patch	Microsoft.exe	"Added by the RANDEX.MS WORM!"
X	ddeproc	ddeproc.exe	"Webcelerator from eAcceleration speeds your Web browsing by both remembering where you have been and anticipating where you will go. Only needed if you find it improves web browsing. Now no longer available and supported and when available was classed as spyware - see here"
U	ddhelper	W815DM.EXE	"Enuff Parental Control Software by Akrontech"
X	DDialler	DDialler.exe	Adult content dialler
X	ddivmwa	[random filename]	"Added by a variant of the SLAPER TROJAN!"
U	ddoctorv2	sprtcmd.exe /P ddoctorv2	"Comcast Desktop Doctor (provided by SupportSoft
X	DDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	DDriver	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
N	DeadAIM	"rundll32.exe DeadAIM.ocm	ExportedCheckODLs"
X	DealHelperBrwsr	dhbrwsr.exe	"DealHelper adware"
X	DealHelperDown	download.exe	"DealHelper adware"
X	DealHelperUpdate	DHUpdt.exe	"DealHelper adware"
U	DeathAdder	razerhid.exe	"Razer DeathAdder gaming mouse driver - required if you use the additional features and programmed keys/macros"
X	Debugger	dbg32.exe	"Added by the MYTOB-FW WORM!"
X	Debugger	explorer32dbg.exe	"Added by the CWS-M TROJAN!"
X	Debugger	iexplore_dbg.exe	"Added by the CWS-M TROJAN!"
X	debugger	help.pif	"Added by the DELF-DRA WORM!"
X	DebugMonitor	debugmonitor.exe	"Added by the MYDOOM.BG WORM!"
X	deejay	forboo.exe	"Added by the FORBOT-AY WORM!"
X	Default	explore.vbs	"Added by the ALLEM WORM!"
U	Default Manager	DefMgr.exe	"Part of MSN Toolbar from version 4.* onwards (renamed ""Bing Bar"" from version 5.* onwards) which includes the Bing search engine. Via Start → All Programs → Microsoft Default Manager you can elect to keep Bing as the default search engine and set it to notify you of any changes to your browsers default settings. Not required if you choose not to use Bing"
X	Default System Research	vhchost.exe	"Added by the TARNO.I TROJAN!"
X	Default web browser	IexpIore.exe	"Added by the OBLIVION.B TROJAN! Note - do not confuse "IexpIore.exe" with "iexplore.exe" (Internet Explorer)
X	DefaultConfiguration	defaultconfh.exe	"Added by the AGOBOT-JC WORM!"
X	Default_Page_URL	http://find.naupoint.com	"Naupoint browser hijacker"
X	Default_Search_URL	http://find.naupoint.com	"Naupoint browser hijacker"
X	defender	defender25.exe	"DollarRevenue adware"
X	defender	dfndref_7.exe	"DollarRevenue adware"
X	defender	[path to trojan]	"Added by the VB-BAQ TROJAN!"
X	DefensaAntiMalware	pgs.exe	"DefensaAntiMalware
X	Defense Center	defcnt.exe	"Defense Center rogue security software - not recommended
X	DefenseNetSurfage	GDC.exe	"DefenseNetSurfage rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
?	defergui	defergui.exe	"Related to IBM Standard Software Installer. What does it do and is it required?"
U	DefMgr	DefMgr.exe	"Part of MSN Toolbar from version 4.* onwards (renamed ""Bing Bar"" from version 5.* onwards) which includes the Bing search engine. Via Start → All Programs → Microsoft Default Manager you can elect to keep Bing as the default search engine and set it to notify you of any changes to your browsers default settings. Not required if you choose not to use Bing"
X	defragm_check	defragment.exe	"CoolWebSearch parasite variant"
X	defragsys	svchost.exe	"Added by the BIFROSE-TH TROJAN! Note - this is not the legitimate svchost.exe process which should normally figure in Msconfig/Startup!"
U	DefragTaskBar	defragTaskBar.exe	"System Tray access to Ashampoo® Magical Defrag 2 from Ashampoo GmbH & Co. KG - which ""works is similar to a screensaver. Whenever the computer is idle the program cuts in automatically and starts cleaning up your hard disk"""
U	defragTaskBar.exe	defragTaskBar.exe	"System Tray access to Ashampoo® Magical Defrag 2 from Ashampoo GmbH & Co. KG - which ""works is similar to a screensaver. Whenever the computer is idle the program cuts in automatically and starts cleaning up your hard disk"""
U	Delay	delayrun.exe	On HP PCs this program is used to help prevent conflicts or timing issues on fast computers
X	DelayLoad	msprint.exe	"Added by a variant of the Win32.Agent.ryo malware - see here"
U	Delayrun	delayrun.exe	On HP PCs this program is used to help prevent conflicts or timing issues on fast computers
N	DelayShred	ShrCL.EXE	McAfee Shredder - not required at startup. You can run it manually via McAfee Security Center
?	delcab	deltreew.exe C:cabs	"??"
X	Delete Me	worm.exe	"Added by the DOOMHUNTER WORM!"
U	DeleteHistoryFree	dhf.exe	"Delete History Free - ""Privacy protection software for deleting Internet surfing and other computer activity tracks from your PC"""
U	Dell AIO Printer A920	dlbkbmgr.exe	System Tray application for the Dell Photo AIO Printer 920 that enables scan or fax functions to run directly from the printer via the buttons
U	Dell AIO Printer A940	dlbabmgr.exe	System Tray application for the Dell Photo AIO Printer 940 that enables scan or fax functions to run directly from the printer via the buttons
U	Dell AIO Printer A960	dlbfbmgr.exe	System Tray application for the Dell Photo AIO Printer 960 that enables scan or fax functions to run directly from the printer via the buttons
N	Dell Alert	DAMon.exe	""Dell Alert" utility
U	Dell DataSafe Scheduler	DataSafeOnlineScheduler.exe	"Scheduler for Dell DataSafe™ Online which ""helps protect your music
U	Dell PanelMgr	SSMMgr.exe	"Monitors ink levels
U	Dell Photo AIO Printer 922	dlbtbmgr.exe	System Tray application for the Dell Photo AIO Printer 922 that enables scan or fax functions to run directly from the printer via the buttons
U	Dell Photo AIO Printer 942	dlbubmgr.exe	System Tray application for the Dell Photo AIO Printer 942 that enables scan or fax functions to run directly from the printer via the buttons
U	Dell Photo AIO Printer 962	dlbxmon.exe	DellPhoto AIO Printer 962 Device Monitor
Y	Dell Webcam Central	WebcamDell.exe	"Dell Webcam Central - webcam management software controlling aspects such as picture control
N	DELL Webcam Manager	DellWMgr.exe	Dell Webcam Manager - Webcam management software provided on Dell PCs
N	Dell Wireless Manager UI	wltray.exe	System tray access to wireless LAN card configuration options
U	DellSupport	DSAgnt.exe	Dell Support Agent offers additional support and update features for your Dell computer or laptop
U	DellSupportCenter	sprtcmd.exe /P DellSupportCenter	"Dell Support Center (provided by SupportSoft
?	DellTransferAgent	TransferAgent.exe	"Found on Dell computers. What does it do and is it required?"
?	delstart	delstart.exe	"Reportedly part of BT ISP software - what does it do and is it required in startup?"
X	delsubmit	"rundll32.exe advpack.dll	DelNodeRunDLL32 submit.exe"
U	DeltaIITaskbarApp	DeltaIITray.exe	"System Tray access to the Delta Control Panel for the M-Audio Delta series of PCI audio cards"
N	DeltTray	deltray.exe	"System Tray access to the control panel for the M-Audio Delta 44 PCI Analog Recording Interface. Available via a desktop shortcut
X	DELXP Protocol	delxp.exe	"Added by a variant of the SDBOT WORM!"
X	Deneca	Virus salvado	"Added by the DELUZ VIRUS!"
U	DepFrez	frzstate.exe	"Deep Freeze from Faronics Coporation. ""Freezes"" the current software configuration so that an a re-boot all changes made refer back to their original settings. Not required for most users - more likely to be used by system administrators
X	deryheruxc	keepSafe.exe	"Added by the KILLAV.KAX TROJAN!"
X	DescargaBromas	"rundll32.exe MSA64CHK.dll	DllMostrar"
?	Description of Shortcuts	*.exe	"* seems to be a sequence of alphanumerics that can be different
X	Desire	desires.exe	Adult content dialler
?	desk-top-service	desk-top-service.exe	"??"
X	DeskAd Service	DeskAdServ.exe	"DeskAd.Service adware"
N	DeskColor	DESKCOLOR.EXE	Provides transparent icon text backgrounds and coloured icon text
U	desksaver	desksaver.exe	"Part of Advanced Desktop Shield
U	DeskSaver	DeskSaver.exe	"DeskSaver from Headway Creative - utility that allows you ""to backup and to restore the icons position easily on the Windows desktop"". The Pro version also includes a ""Taskbar Economizer"" which minimizes an open window to the System Tray instead of the taskbar. Located in %ProgramFiles%\Headway Creative\DeskSaver"
U	DeskSaver Pro	DeskSaver.exe	"DeskSaver Pro from Headway Creative - utility that allows you ""to backup and to restore the icons position easily on the Windows desktop"". Includes a ""Taskbar Economizer"" which minimizes an open window to the System Tray instead of the taskbar. Located in %ProgramFiles%\Headway Creative\DeskSaver"
U	desksaver.exe	desksaver.exe	"Part of Advanced Desktop Shield
X	Desktop	"rundll32.exe msconfd.dll	Restore ControlPanel"
N	Desktop Architect	DATRAY.EXE	"Desktop theme manager available
Y	Desktop Armor	DesktopArmor.exe	"Desktop Armor from Headlight Software - ""watches dozens and dozens of important settings on your computer and warns you if any program has changed them"" including those made by malware"
U	Desktop Calendar	Desktop Calendar.exe	"Desktop Calendar - ""Desktop Calendar is a highly customizable calendar program that turns your desktop into a traditional wall calendar
X	Desktop Defender 2010	Desktop Defender 2010.exe	"Desktop Defender 2010 rogue security software - not recommended
U	Desktop iCalendar	Calendar.exe	"Older version of Desktop iCalendar/Desktop iCalendar Lite by Desksware which include support for Google Calendar and add weather
U	Desktop iCalendar	Desktop iCalendar Lite.exe	"Desktop iCalendar Lite by Desksware - ""is a free desktop calendar for Windows. It allows you to manage your events
U	Desktop iCalendar	Desktop iCalendar.exe	"Desktop iCalendar by Desksware - ""is a handy desktop calendar for Windows. It stays on your desktop and shows the days of the current month. It can sync with your Google Calendar
U	Desktop iCalendar Lite	Desktop iCalendar Lite.exe	"Desktop iCalendar Lite by Desksware - ""is a free desktop calendar for Windows. It allows you to manage your events
U	Desktop iCalendar Lite.exe	Desktop iCalendar Lite.exe	"Desktop iCalendar Lite by Desksware - ""is a free desktop calendar for Windows. It allows you to manage your events
U	Desktop iCalendar.exe	Desktop iCalendar.exe	"Desktop iCalendar by Desksware - ""is a handy desktop calendar for Windows. It stays on your desktop and shows the days of the current month. It can sync with your Google Calendar
U	Desktop Maestro	deskmech.exe	"Part of Desktop Maestro from PC Tools - which ""combines the features of our award winning products
U	Desktop Maestro Vista Tray	RMTray.exe	"Part of Desktop Maestro from PC Tools - which ""combines the features of our award winning products
N	Desktop Plant	AZARE10S.PLT	"Vritual plant from here - this version is an Azalea
X	Desktop Search	desktop.exe	"iSearch adware"
X	Desktop Security 2010	Desktop Security 2010.exe	"Desktop Security 2010 rogue security software - not recommended
N	Desktop Service Centre	DSC.exe	OptusNet DSL or Dial-Up connection software
N	Desktop Weather	THE WEATHER CHANNEL.exe	"Desktop Weather by The Weather Channel - provides current temperature
N	Desktop Weather 3	THE WEATHER CHANNEL.exe	"Desktop Weather 3 by The Weather Channel - provides current temperature
N	Desktop Weather 3	THEWEA~1.EXE	"Desktop Weather 3 by The Weather Channel - provides current temperature
Y	DesktopArmor	DesktopArmor.exe	"Desktop Armor from Headlight Software - ""watches dozens and dozens of important settings on your computer and warns you if any program has changed them"" including those made by malware"
U	DesktopMaestro	deskmech.exe	"Part of Desktop Maestro from PC Tools - which ""combines the features of our award winning products
U	DesktopMaestro	RMTray.exe	"Part of Desktop Maestro from PC Tools - which ""combines the features of our award winning products
N	desktopmgr	desktopmgr.exe	"Synchronisation manager for the cradles for the Research In Motion range of wireless handhelds
X	DesktopUpdate	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	destroyb11	destroyb11.exe	"Added by the DELF-KO TROJAN!"
?	detect	turbodetect.exe	"??"
N	Detector	detector.exe	"USB port detector for LG scanners. Sits in the System Tray
U	DetectorApp	DetectorApp.exe	"Related to Roxio MyDVD (was Sonic) DVD authoring software"
X	Deus Cleaner	DCleaner.exe	"Deus Cleaner rogue system cleaner utility - not recommended"
?	DevconDefaultDB	READREG	"Appears to be related to older Creative Soundblaster soundcards"
X	Development Environment	devenv.exe	"Added by the DELBOT-AH WORM!"
X	Device Configuration Loader	msdvc32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
U	Device Detector	DevDetect.exe	"ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically"
N	Device Detector 2	DevDtct2.exe	"Installed by various Olympus products
X	Device Hardware	devicehnd.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Device Manager	wfxmgr.exe	"Added by the RBOT.AJU WORM!"
X	Device Security	dvcsecure.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Device Security Driver	devicesec.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Device Security Manager	dvcsecure.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
U	DeviceDiscovery	hpotdd01.exe	"Detection of new imaging
X	DevicePath	Proyecto1.exe	"Added by the GRUEL WORM!"
X	DevicePath	Root.exe	"Added by the GRUEL WORM!"
U	Devices	olesvr.exe	"Salfeld Child Control - parental control software"
X	Devicewin	[path to trojan]	"Added by the BANKER-AEV TROJAN!"
U	devldr16	devldr16.exe	Associated with some Creative Labs sound cards. Provides audio support for DOS applications. Not needed if you don't have those. Required if you use "Sound Play Control" and "Sound Recorder". To disable: (1) Disable via MSCONFIG (2) Start → Settings → Control Panel → System → Device Manager then disable "Creative SB16 Emulation" under Creative Miscellaneous Devices
U	devldr16.exe	devldr16.exe	"Associated with some Creative Labs sound cards. Provides audio support for DOS applications. Not needed if you don't have those. Required if you use ""Sound Play Control"" and ""Sound Recorder"". To disable: (1) Disable via MSCONFIG (2) Start -> Settings -> Control Panel -> System -> Device Manager then disable ""Creative SB16 Emulation"" under Creative Miscellaneous Devices"
X	dfgfdgrergd	[path to trojan]	"Added by the RANKY.CK TROJAN!"
X	dgtstart	dgtstart.exe	"DigitalNames.g adware"
U	dguard	dguard.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
X	DHCP Server	regsvr.exe	"Added by the RBOT-PR WORM!"
X	DHCP32	services.exe	"Added by the WINSPY.AG TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\display"
X	Dialer	"rundll32.exe MSA32CHK.dll	Reg"
U	Dialer Control	dc.exe	"Dialer-Control. Detects and protects from premium rate adult content diallers"
U	Dialer Detect	dd.exe	"DialerDetect detects stealth installed premium rate diallers
U	Dialgo SDK	PhoneAnswer.exe	"Dialgo Wave Modem ActiveX - ""Telephone Answering Machine for scripting your own professional call center business scripts using a voice modem. Features Caller-ID
N	Dialog Helper	PDDLGHLP.EXE	"Dialog Helper from PowerDesk Pro by Ontrack. Helps with the standard Open and Save As dialog boxes by showing recently used files and folders. Available via Start -> Programs"
X	DialUp Network Application	Rnaap.exe	"Added by a variant of the SDBOT WORM!"
X	Diam prlaer	oqedrhg.exe	"Added by the SDBOT-DEU WORM!"
U	Diamondback	razerhid.exe	"Razer Diamondback 3G gaming mouse driver - required if you use the additional features and programmed keys/macros"
X	DIECOX	csrss.exe	"Added by a variant of the ATM.GEN TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Diesel	Recalculate.exe	"Added by the LAZAR TROJAN!"
U	Digisoft AntiDialer	AntiDialer.exe	"Digisoft AntiDialer"
U	DigiSrv	DigiSrv.exe	"Related to camera software from DigitalDreams"
N	Digital Dashboard	devgulp.exe	For Compaq PC's. Loads Digital Dashboard options
Y	Digital Patrol Update 5	update.exe	"Digital Patrol - ""a powerful anti trojan scanner
X	Digital Protection	digprot.exe	"Digital Protection rogue security software - not recommended
N	Digital River eBot	downlo~1.exe	"Digital River Systems EBOT for downloading software from their site. In some cases
X	DigitalNames	DigitalNamesStart.exe	"DigitalNames spyware variant"
N	DigitalWizard	ISWizard.exe	"InstallShield's DigitalWizard - free
N	DigitalWizard Monitor	dwMon.exe	"InstallShield's DigitalWizard - free
U	DIGServices	DIGServices	Created by Disney but licensed to ESPN for watching videos
N	DIGServices	DIGServices.exe	Created by Disney but licensed to ESPN for watching videos
N	DIGStream	digstream.exe	"DIGStream Cache Manager - part of ESPN Motion and Disney Motion that periodically check for new videos and indication they're available in the System Tray. Starting ESPN Motion/Disney Motion starts digstream automatically"
X	Dir1	caKe	"Added by the CAKE WORM!"
X	Direct settings	sdchost.exe	"Added by the DAEMONI-I TROJAN!"
U	Direct Update	DUControl.exe	"DirectUpdate dynamic DNS updater"
X	Direct X Direct3D	dxd3d.exe	"Added by a variant of the SDBOT WORM!"
X	Direct X Opengl	dxopengl.exe	"Added by a variant of the RBOT-CJ WORM!"
X	direct3d.exe	direct3d.exe	"Added by the CERTIF-F TROJAN!"
N	DirectCD	DirectCD.exe	DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later
X	Director Video	btnmgern.exe	"Added by the MYTOB-KL WORM!"
Y	Directory Opus Desktop Dblclk	dopusrt.exe	"Directory Opus - an advanced file manager. ""Directory Opus goes beyond the simple file manager metaphor
X	directs.exe	directs.exe	"Added by the BEAGLE.O or BEAGLE.R or BEAGLE.S or BEAGLE.T WORMS!"
U	DIRECTVDSL	Directvdsl.exe	Starts DirectTV DSL modem at boot up. Can also be started manually
X	DirectX	ddhelp32.exe	"Added by the BIONET.318 TROJAN! Note - not the DirectX helper which is ddhelp.exe"
X	directx	Directx.exe	"Added by the SDBOT.D TROJAN!"
X	directx	Sqlexploit.exe	"Added by the SDBOT.D TROJAN!"
X	DirectX	DirectX.exe	"Added by the BLAXE or LOGPOLE WORMS!"
X	directx	NTCmd.exe	"Added by the SDBOT.D TROJAN!"
X	directx	PipeCmd.exe	"Added by the SDBOT.D TROJAN!"
X	DirectX 32	directx32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	DirectX Driver	stdhost.exe	"Added by the SDBOT.GVJ BACKDOOR!"
X	DirectX For Microsoft Windows	dtxservice.exe	"Added by the PROGENT TROJAN!"
X	DirectX for Microsoft Windows	Fservice.exe	"Added by the PRORAT TROJAN!"
X	DirectX for Microsoft Windows	Sservice.exe	"Added by the PRORAT TROJAN!"
X	DirectX For Microsoft® Windows	fservice.exe	"Added by the PRORAT-P TROJAN!"
X	DirectX For Microsoft® Windows	fservice.exe	"Added by the PRORAT-L TROJAN!"
X	DirectX shell driver	[path to trojan]	"Added by the MARKTMAN-B TROJAN!"
X	Directx Startup Drivers	direct.exe	"Added by the RBOT.UXL WORM!"
X	DirectX Video Driver	dxterm5.exe	"Added by the WILAB-A TROJAN!"
X	DirectX64	DirectXset.exe	"Added by the BROWNEY.A WORM!"
X	DirectX9	direct3d.exe	"Added by the AGENT.EAK TROJAN!"
X	DirectX9	svchost32.exe	"Added by the RBOT.AQG WORM!"
X	DirectX9 Diag	dx9diag.exe	"Added by the RBOT-ALT WORM!"
X	DirecX	DirecX.exe	"Added by the AGOBOT-HU BACKDOOR!"
U	Dirkey	Dirkey.exe	"Dirkey - small utility that allows you to bookmark up to 9 folders by using the Ctrl+Alt+1..9 shortcut keys in an Open/Save File dialog or in Windows Explorer. After this the Ctrl+1..9 shortcut keys can be used in the same or another window to go to any of the 9 bookmarked folders"
X	DirLocker	dirlock.exe	"Added by the AUTORUN-AMS WORM!"
X	DisableKeybaord	"Rundll32.exe Keyboard	Disable"
X	DisableMouse	"Rundll32.exe Mouse	Disable"
N	Disc Detector	CtNotify.exe	"For Creative sound cards. Detects when you insert a CD
?	disc detector	qnetquestnotifty.exe	"??"
?	DISCover	DISCover.exe	"Related to DISCover Drop from Digital Interactive Systems Corporation. What does it do and is it required?"
N	DiscoverDeskshop	Deskshop.exe	"Discover Deskshop - single use ""virtual"" credit card"
U	DiscUpdateManager	DiscUpdMgr.exe	"Disc Update Manager for Digital interactive's DISCover Console. Provider of on-demand video games"
N	DiscUpdateManager	DiscUpdateMgr.exe	"DISCover from Digital Interactive Systems Corporation Inc. ""The company's patented Drop 'n' Play technology provides a simple
U	DiscWizardMonitor.exe	DiscWizardMonitor.exe	"Seagate DiscWizard - hard disk utility for Seagate's SATA and PATA (IDE) drives"
U	Disk Cleaner	DiskCleaner.Exe	"Hard disk management part of TuneUp Utilities from TuneUp Distribution GmbH"
X	Disk Defragmentation Loader	pmsvcr.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Disk Keeper	[path to trojan]	"Added by the SMALL-VE TROJAN!"
X	Disk Keeper	SECURITY.EXE	"Daosearch adware"
X	Disk Manager	diskver.exe	"Added by the RBOT.AQT WORM!"
X	Disk Master	[trojan name]	"Added by the DISTER TROJAN! - a spam relayer"
X	Disk Panel Configuration	dpcsvc.exe	"Added by the IRCBOT.BSQ BACKDOOR!"
X	DiskCheck	msdarkend.exe	Added by an unidentified WORM or TROJAN!
N	DiskeeperSystray	DkIcon.exe	"DisKeeper defragmentation software - can be started manually"
X	DiskRetter	SysRep.exe	"DiskRetter
X	Diskstart	Code.exe	Adult content dialler
X	Diskstart	cat.exe	MS-Connect dialler
X	Diskstart	hit.exe	Adult content dialler
X	Diskstart	Snt.exe	Adult content dialler
U	DiskSuite	aDSProcMngr.exe	"Part of PC Tools Disk Suite from PC Tools - which ""is an all-in-one hard-disk management utility that integrates disk optimization
U	Disk_Monitor	Disk_Monitor.exe	"Multi-media
X	Dispatcher	dispatcher.exe	"Added by the DLOADR-AS TROJAN!"
X	dispenter	dispenter.exe	"Added by the AGENT-MKK TROJAN!"
X	Display Drivers	cssrs.exe	"Added by the AGOBOT.FX WORM!"
N	DisplayTrayIcon	TrayIcon.exe	"System Tray access to display properties for ABIT graphics cards. Unless you change your desktop resolution
N	Distiller Assistant 3.01	DISTASST.EXE	From Adobe. Creates PDF universal files for Acrobat Reader. Available via Start -> Programs
X	Distributed File System	Dfsvc.exe	"Added by the MYFIP.A or MYFIP.K WORMS!"
X	Distributed File System	kernel32dll.exe	"Added by the MYFIP-C or MYFIP.K WORMS!"
X	Distributed File System	blade.exe	"Added by the MYFIP.AC WORM!"
X	Distributed File System	win.exe	"Added by the MYFIP.AB WORM!"
X	Distributed Link Tracking	ascvt.exe	"Added by the AGOBOT-GH BACKDOOR!"
U	distributed.net client	DNETC.EXE	"Dsitributed computing projects client from Distributed.net where numerous computers are used to share a projects workload - similar to SETI@Home and Folding@Home. Also prone to being distributed by viruses"
X	DivX MediaPlayer 7.0	Dr.DivX.exe	"Added by the ALADINZ.G TROJAN!"
X	DivX Player	DivXPlayer.exe	"Added by a variant of the RBOT WORM!"
X	DivX Updater	DivX.Exe	"Added by the NALDEM TROJAN or MASTAK VIRUS!"
X	DIVX Video Player	DIVXPloyer.exe	Added by an unidentified WORM or TROJAN!
X	Divx4 codec	devldr32.exe	"Added by an unidentfied VIRUS! Note - this is not the legitimate Creative Labs devldr32.exe file"
?	Dixons Insert Detect	InsDetect.exe	"Part of Dixons Picture Suite. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
N	DJRegFix	regedit /s c:hpdjregfix.reg	"DJRegFix showed up first in WinME as a ""clever"" way to ensure that all Hewlett-Packard DeskJet printers actually worked with WinME - since most were having major problems. This ""utility"" adds the functionality and compatibility HP forgot to add in its WinME drivers"
X	djtopr1150.exe	djtopr1150.exe	"WebRebates adware"
X	dKernel	dKernel.exe	"Added by the DECOY-A WORM!"
Y	DkService	DkService.exe	"From Executive Software's Diskeeper defragmenting utility - a replacement for Windows Disk Defragmenter. It's recommended to leave this enabled
X	Dkware lptt01	dkware.exe	"RapidBlaster variant (in a ""DonkeySoft"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Dkware ml097e	dkware.exe	"RapidBlaster variant (in a ""DonkeySoft"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
Y	dla	tfswctrl.exe	"Drive letter access to a UDF packet writer for CD-RW - from HP
Y	DLA	DLACTRLW.EXE	"Drive letter access to a UDF packet writer for CD-RW - from HP
Y	DLACTRLW	DLACTRLW.EXE	"Drive letter access to a UDF packet writer for CD-RW - from HP
Y	DLACTRLW.EXE	DLACTRLW.EXE	"Drive letter access to a UDF packet writer for CD-RW - from HP
N	DlaTray	Dlatray.exe	"System Tray access to DLA - Drive letter access to HP's and Veritas' version of DirectCD. Does the same thing as DirectCD. From HP - ""This is a needed file as it controles the readability of the Combo drives. Without this file loading the end user will be able to burn CD's but wont be able to read them. The drive itself will be able to read store bought master Cd's without the file but not burnt ones"""
N	dlbcserv	dlbcserv.exe	Related to Dell Photo Printers and provides additional configuration options for these devices
Y	DLBTCATS	"rundll32 [path] DLBTtime.dll	_RunDLLEntry@16"
Y	DLBUCATS	"rundll32 [path] DLBUtime.dll	_RunDLLEntry@16"
Y	DLBXCATS	"rundll32 [path] DLBXtime.dll	_RunDLLEntry@16"
Y	DLCCCATS	"rundll32 [path] DLCCtime.dll	_RunDLLEntry@16"
Y	DLCDCATS	"rundll32 [path] DLCDtime.dll	_RunDLLEntry@16"
Y	DLCFCATS	"rundll32 [path] DLCFtime.dll	_RunDLLEntry@16"
Y	DLCGCATS	"rundll32 [path] DLCGtime.dll	_RunDLLEntry@16"
Y	DLCICATS	"rundll32 [path] DLCItime.dll	_RunDLLEntry@16"
Y	DLCJCATS	"rundll32 [path] DLCJtime.dll	_RunDLLEntry@16"
Y	DLCQCATS	"rundll32 [path] DLCQtime.dll	_RunDLLEntry@16"
Y	DLCXCATS	"rundll32 [path] DLCXtime.dll	_RunDLLEntry@16"
X	dlder	dlder.exe	"Dlder spyware. Also creates a fake ""explorer.exe"" file and can be installed via versions of Grokster
X	DlDir1	caKe	"Added by the CAKE WORM!"
?	DLForcerExe	DLForcerEXE.exe	"??"
N	DLHelperEXE	WATCH.exe	Download helper distributed with some software that allows the software installation to redirect download locations. Not required once the installation is finished
X	DLHelperEXE.exe	N/A	Downloader for Microgaming/Casino software - stealth installed
X	DLINK dfe drivers for Windows NT	windfe.exe	"Added by the RANDEX.AK WORM!"
U	DLink System Tray	dlnetst.exe	"Related to D-Link DGE-530T PCI card for servers and workstations"
X	Dlite	dllmanager.exe	"Added by the WOOTBOT.DN WORM!"
X	Dll Boot Loader on Startup (do not remove this)	[various filenames]	Added by an unidentified TROJAN!
X	DLL Manager	dllmngr32.exe	"Added by a variant of the RBOT WORM!"
X	DLL Service Manager	[path to worm]	"Added by the RPCBOT.F TROJAN!"
X	dll services	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	DllCacherv2	dllcachev2.exe	"Added by the LATEDA TROJAN!"
X	dllcvss	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	DllLoader	lssas.exe	"Added by the BDOOR-JE BACKDOOR!"
X	Dlload	killer.exe	"Added by the KILLAV-FK TROJAN!"
X	dllreg	dllreg.exe	"Added by the CRYPTER.A TROJAN!"
X	DLLService32	dllsvc32.exe	"Added by the AGOBOT.VX WORM!"
N	dlmMgr	AdobeDownloadManager.exe	"Adobe Download Manager - ""can prevent you from having to start from the beginning should your download process be interrupted
X	Dm Hr	lpns.exe	"Added by the IRCBOT.WORM.61673 WORM!"
X	DM mgr	dm_mgr.exe	"Added by the JITTAR TROJAN!"
X	dm***.exe [* = random char]	dm***.exe [* = random char]	"Wareout - malware masquerading as a spyware and dialer remover"
N	DMAScheduler	DMAScheduler.exe	"Related to DigitalMedia Plus Archiver. This program is non-essential process to the running of the program
U	DMHotKey	DMLoader.exe	HotKey access to the Samsung Display Manager on laptops and ultra-mobiles that support it - such as the M55 and Q1
N	DMILDR	dmildr.exe	"Part of Dell OpenManage Client Instrumentation - software that allows remote management application programs to access information about
X	dmloader	dmloader.exe	"Added by a variant of the RBOT WORM!"
U	DMXLauncher	DMXLauncher.exe	"Part of Dell's Media Experience
X	dm[3 random letters].exe	dm[3 random letters].exe	"Added by the RUINDEM TROJAN!"
X	DM_server	dmserver.exe	"Comet Cursor adware"
X	dm_service	[path to file]	"Added by the MITGLIEDER.P TROJAN!"
N	Dnar	Dnar.exe	"Installed on some Dell workstations and DMI related. Tries to access the internet and is known to not be required - but what does it do?"
Y	DNE Binding Watchdog	"rundll dnes.dll	DnDneCheckBindings"
Y	DNE DUN Watchdog	"rundll dnes.dll	DnDneCheckDUN13"
X	DNHelper32	DNHlp32.exe	Added by an unidentified WORM or TROJAN!
X	DNS	[worm filename]	"Added by the BCKDR-CQG BACKDOOR!"
X	DNS Config service	win32.exe	"Added by the RBOT-TL WORM!"
X	Dns Resolver	dnsrslve.exe	"Added by the RBOT-WS WORM!"
X	DNS Service	dnsresolver.exe	"Added by the RBOT-PQ WORM!"
X	DNS Service	dnssvc.exe	"Added by the DELBOT-Z WORM!"
N	DNS7reminder	Ereg.exe Ereg.ini	"Registration reminder for versions of Nuance (ScanSoft) Dragon NaturallySpeaking"
X	DnsCache	Wscript.exe dns_cache.vbs	"Added by the AUTORUN-AWI WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""dns_cache.vbs"" file is located in %System%"
X	dnscleaner	dnscleaner.exe	"CoolWebSearch parasite variant"
X	DocTor	Doctor.exe	"Added by the DOTOR.A WORM!"
X	Doctor Antivirus 2008	antvr.exe	"Doctor Antivirus 2008 rogue security software - not recommended
U	Document Manager	docmgr.exe	"Wave Systems Corp. Document Manager - ""provides secure storage and management capabilities for file and folder level encryption"""
X	DOGStart	GSDOGST.EXE	"Added by an unidentified VIRUS
X	DokterFix	SysRep.exe	"DokterFix
X	Domain Name Resolve Service	dnsresolver.exe	"Added by the KIMAN.A WORM!"
X	DomPlayer Service	wakeservice.exe	"DomPlayer adware"
U	Don't Panic Pop-Up Stopper	dpps2.exe	"Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group"
X	Dontworry	mysaym.exe	"Added by the SDBOT-RC WORM!"
N	DoroServer	DoroServer.exe	"Doro PDF Writer from The SZ Development. All what you need for creating pdf files"
X	Dos Prompt Loader	cygwin.exe	"Added by the SDBOT-VV WORM!"
X	down	[trojan filename]	"Added by the SMALL-QJ TROJAN!"
N	Download Accelerator Manager Free Edition	dam.exe	"Download Accelerator Manager Free Edition from Tensons Corp"
N	Download Accelerator Plus 5.0	DAP.exe	"Download Accelerator Plus from Speedbit. Download manager for resuming downloads
N	Download Wonder	DownloadWonder.exe	"Download Wonder from Forty Software. Download manager for resuming downloads
N	DownloadAccelerator	DAP.EXE	"Download Accelerator Plus from Speedbit. Download manager for resuming downloads
X	DownloadLegalMusic	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	DownloadMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	DownloadsAndMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	DownloadWare	dw.exe	"DownloadWare adware"
X	DownloadWare Engine	Dwe.exe	"DownloadWare adware"
X	dpcproxy	dpcproxy.exe	"Added by the GOLDENP-A TROJAN!"
Y	DPCProxyLoadOnStartup	dpcstart.exe	"DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access"
Y	Dpcstart	dpcstart.exe	"DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access"
X	dpnsvr32	dpnsvr32.exe	"Added by the AOLPASS-B TROJAN!"
N	dptracker	dptracker.exe	"CamTrack webcam software that enhances the way people video chat"
U	DpUtil	TEDTray.exe	"Main executable for TOSHIBA DualPoint Utility Main Module. It is a system tray icon program that provides configuration options for dual pointing device"
X	dpzProtect	n.vbe	"Added by the RUNAUTO.H WORM!"
X	DR service	[path to worm]	"Added by the RBOT-CZT WORM!"
X	Dr. Guard	drguard.exe	"Dr. Guard rogue security software - not recommended
N	Drag'n'Drop_Autolaunch	Autolaunch.exe	"Iomega HotBurn - CD-RW burning software"
N	Drag-to-Disc	DrgToDsc.exe	"System Tray access to Roxio Drag-to-Disc - part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools. ""Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically"". Not required for Roxio to work properly and available via the Start menu"
?	DragDrop	DragDrop.exe	"??"
N	DragnDrop_Autolaunch	Autolaunch.exe	"Iomega HotBurn - CD-RW burning software"
X	DRam Monitor 23	tskman3.exe	"Added by a variant of the RBOT WORM!"
X	DRam prmaessor	[random filename]	"Added by the RBOT.CSG WORM!"
X	DRam prosesor	[random filename]	"Added by the SPYBOT.EE WORM!"
X	DRam prosessor	[random filename]	"Added by the RBOT.CSG WORM!"
X	DRam prosessor	plscd.exe	"Added by the RBOT.CYA WORM!"
X	DRam prosessor	HWAPI.exe	"Added by a variant of the RBOT WORM! Note - this is not the McAfee HackerWatch process which has the same filename"
X	DRam prosessor	WindowsUpdate.exe	"Added by the RBOT-BBZ WORM!"
X	DRam prosessor	msupdate.exe	"Added by the DELF-FAW TROJAN!"
X	DRam prosessor	winupl.exe	"Added by the RBOT-BCQ WORM!"
X	DRam rar proc	winupdaterar.exe	"Added by a variant of the IRCBOT TROJAN!"
X	DRam rare proc	updaterarwin.exe	"Added by the RBOT-GQW WORM!"
X	DRan posessor	DAP.exe	"Added by a variant of the SDBOT WORM!"
X	DrAntispy	DrAntispy.exe	"DrAntiSpy rogue security software - not recommended"
X	DrCache	MSTDC.EXE	"Added by the BDOOR-JM BACKDOOR!"
X	dreams	server.exe	"Added by a variant of the SDBOT WORM!"
X	DrefIW	SysDrefIWv2.exe	"Added by the DREF-C WORM!"
X	DrefIW	SysDref.exe	"Added by the DREF-D WORM!"
?	dregfix	ph_finder.exe	"??"
N	DrgToDsc	DrgToDsc.exe	"System Tray access to Roxio Drag-to-Disc - part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools. ""Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically"". Not required for Roxio to work properly and available via the Start menu"
?	dried.exe	dried.exe	"??"
X	drin	[path to trojan]	"Added by the SMALL.DPB TROJAN!"
X	DriveCleaner 2006 Free	UDC2006.exe	"DriveCleaner rogue security software - not recommended
X	DriveCleaner Free	UDC.exe	"DriveCleaner rogue security software - not recommended
X	DriveDefender	GDC.exe	"DriveDefender rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
U	DriveIcons	DriveIcon.exe	"Drive Icons from Realtek - shows a specific icon for each card type for their card reader controllers"
U	DriveLED	OODLed.exe	"O&O DriveLED - hard disk monitoring and crash prevention"
X	Driver	gbot.exe	"Added by the JUNTADOR.K TROJAN!"
X	Driver32	Scam32.exe	"Added by the SIRCAM WORM!"
X	DriverCheck	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	DriverConf	dvrconf.exe	"Added by the AGOBOT-IY WORM!"
X	DriverDB	svcmdx32.exe	"Added by the BERPI TROJAN!"
X	DriverLoad	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
U	DriverMagicLogon	dmschedule.exe	"Part of DriverMagic - ""the easiest way to locate device drivers"""
N	DriverMax	devices.exe	"DriverMax from Innovative Solutions - ""a new tool that allows you to download the latest driver updates for your computer. No more searching for rare drivers on discs or on the web or inserting one installation CD after the other"""
X	DriverModule	csrnvrt.exe	"Added by the IRCBOT.I TROJAN!"
X	DriverPath	system32.exe	"Added by the PRORAT-S TROJAN!"
X	Drivers for Internet Explorer	accesweb.exe	"Added by the STARTPAGE.FW TROJAN!"
X	Drives swap	AV1i.exe	"Anti-Virus Number-1 rogue security software - not recommended
N	DriveSelect	driveselect.exe	"DVD X Copy XPress by 321 Studios. Creates a pop-up at Windows startup that asks for the DVD drive to be selected. Available via Start -> Programs"
X	DriveSystem	maxpaynowti1.exe	"Added by the TIBS.AZT TROJAN!"
U	drkly16j	"rundll32.exe drkly16j.dll	ServiceCheck"
X	DRM Upgrade	drmupgd.exe	"Added by the IRCBOT.AWU BACKDOOR!"
U	dRMON SmartAgent	SmartAgt.exe	"Part of the network monitoring program group for 3Com NIC cards. See here for more info"
X	drmsrv32	stmhosts.exe	"Added by the AGENT.AGWU TROJAN!"
X	drmu	W95Mm.exe	Homepage hijacker installing a toolbar: http://tdko.com/. Lop.com in disguise
X	Drmupgds	Drmupgds.exe	"Maxfiles adware"
X	drocher	d.exe	Adult content dialler
X	DropSpam Lifestyle	dslifestyle.exe	"Dropspam adware"
X	DrProtection	DrProtection.exe	"DrProtection rogue security software - not recommended"
X	drvddll.exe	drvddll.exe	"Added by the BEAGLE.AP WORM!"
X	Drvddll_exe	drvddll.exe	"Added by the BEAGLE.X WORM!"
U	DrvIcon	DrvIcon.exe	"""Vista Drive Icon changes the drive icons shown in Windows ""My Computer""
?	DrvListnr	DrvListnr.exe	"Analog Devices SoundMAX soundcard related. What does it do and is it required?"
U	drvlsnr	drvlsnr.exe	Compaq/ADI SoundMAX integrated digital audio controller related. May solve a problem if your sound cuts out unexpectedly
U	DrvMon.exe	DrvMon.exe	"Alcor drive monitor software"
X	drvnetw	drvnetw.exe	"Added by the BROGGER-B TROJAN!"
X	drvr32h	drvr32h.exe	"Added by an unidentified VIRUS
X	drvrmanager	drvrquery32.exe	"Added by the BOOHOO WORM!"
X	DrvStart	HPMedia.exe	"Added by the BANCBAN-QE TROJAN!"
X	drvsys.exe	drvsys.exe	"Added by the BEAGLE.W WORM!"
X	drvsyskit	hidr.exe	"Added by the BAGLE.HR WORM!"
X	drvsyskit	hldrrr.exe	"Added by the BAGLE.QU TROJAN!"
X	drvupd	rundll32 ..drvupd.inf	"Hijacker - drvupd.inf file installs a ""searchforge.com"" hijack"
X	drv_st_key	hidn.exe	"Added by the BEAGLE.FF WORM!"
X	DrWatson	drwatson_.exe	"Added by the LOHAV-S TROJAN!"
X	DrWatson	drwatson_32.exe	"Added by the LOHAV-S TROJAN!"
X	DrWeb Antivirus	DRWEBAV.EXE	Added by an unidentified WORM or TROJAN!
Y	Drwebscheduler	Drwebscd.exe	"DrWeb antivirus related - scheduler that allows you to manage an automatic launch of applications
X	DR_S	DR_S.exe	"IstBar adware"
N	DSentry	DSentry.exe	"Anti-spyware from Dell. Seems that after Dell found out certain applications being installed from DVD's would report back information about what customers were watching
X	DSKEY	[path to trojan]	"Added by the STARTER-G TROJAN!"
N	DSL Monitor	spdstrm.exe	Comes with Efficient Networks DSL Modems. Little red/green/yellow flashing icon in system tray
X	DsmSer	dsm.exe	"Added by the SERFLOG.B WORM!"
X	DsmSer	msmpatch.exe	"Added by the SERFLOG.B WORM!"
X	DsmSer	svosm.exe	"Added by the SERFLOG.B WORM!"
X	DsmSer	sysup.exe	"Added by the SERFLOG.B WORM!"
X	DSS	[path to trojan]	"Added by the DSSDOOR-C TROJAN!"
X	DSService	dmrss.exe	"Added by the AGOBOT-XX WORM!"
X	DSystemDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
U	DT 11Mbps WLAN PC Card Station	DTCARDMonitor.exe	11Mbps PC Card based wireless LAN connection monitor - possibly from Deutsche Telekom
U	DT 11Mbps WLAN USB Station	DTUSBMonitor.exe	11Mbps USB based wireless LAN connection monitor - possibly from Deutsche Telekom
N	DU Meter	DUMETER.EXE	"Hagel Technologies internet bandwidth monitor"
U	DualCoreCenter	StartUpDualCoreCenter.exe	"Unified control center for overclocking both the graphics card and the CPU
?	Duane Reade Insert Detect	InsDetect.exe	"Part of Duane Read Picture Suite & Digital Image Pack. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
N	Dulux WeatherShield WeatherDesk	weather.exe	"Dulux WeatherShield WeatherDesk - latest weather information from across Australia"
X	Dumeter Services	dumeter.exe	"Added by the SDBOT-AEQ WORM!"
X	dumprep	spoolc.exe	"Detected by Kaspersky as a variant of the AGENT.CXF TROJAN!"
X	dumprep	dump-k.exe	"Added by the BUZUS-U WORM!"
X	dumprep	dump.exe	"Added by the CODOX-A WORM!"
N	dumprep 0 -k	dumprep 0 -k	"Used in connection with memory dumps - you can disable these by - right clicking on My Computer
N	dumprep 0 -u	dumprep 0 -u	"Used in connection with memory dumps - you can disable these by - right clicking on My Computer
X	DUN_SERVICES3	dun3.exe	"Added by the SOKIRON TROJAN!"
X	Duwee wong Cerbon	Cirebons.exe	"Added by the BHARAT.A WORM!"
U	DVD Device Lock for Win95/98/Me/2k/XP	DDLAgent.exe	"Loads Hide and Protect any Drives - which ""can be used to restrict read or write access to removable media devices such as CD
X	DVD Upgrade	dvdupgd.exe	"Added by a variant of the IRCBOT BACKDOOR!"
N	dvd43	DVD43_Tray.exe	"DVD43 is ""a small tool that integrates into Windows and overrides CSS copy-protection found on DVD movies"""
N	DVDLauncher	DVDLauncher.exe	"Part of Cyberlink's Power Cinema - allows you to play DVDs upon insertion"
N	DVDSentry	DSentry.exe	"Anti-spyware from Dell. Seems that after Dell found out certain applications being installed from DVD's would report back information about what customers were watching
N	DVDTray	DVDTray.exe	HP CD/DVD Tray icon installed with the DVD writer software. Periodically checks for new drive firmware
N	DVDUpgrade	DVDUpgrd.exe	"Microsoft program to upgrade your DVD decoder program - see Q306331. Available via Start -> Programs"
Y	dvprpt	Dvprpt.exe	"Command Antivirus related"
X	dvraudio	dvraudio.exe	"Added by a variant of the CRYPTER.C TROJAN!"
X	dvsfss	fbsfsdrs.exe	"Added by the SDBOT-QA WORM!"
N	DW4	Weather.exe	"Desktop Weather 4 by The Weather Channel - provides current temperature
N	DW4	DesktopWeather.exe	"Desktop Weather 4 by The Weather Channel - provides current temperature
N	DW6	DesktopWeather.exe	"Desktop Weather 6 by The Weather Channel - provides current temperature
U	DWHeartbeatMonitor	DWHeartbeatMonitor.exe	DWHeartbeatMonitor.exe is installed alongside the Weather.com instant messaging utility. This is a non-essential process. Disabling or enabling this is down to user preference
N	DwlClient	support.exe	Download manager for Dell support alerts
X	dwqblwppx.exe	[random].exe	"Okcashbackmall adware"
X	dwqblwpvl.exe	[random].exe	"Okcashbackmall adware"
X	dwqblwrsq.exe	[random].exe	"Okcashbackmall adware"
U	DWQueuedReporting	dwtrig20.exe	"Used to launch Microsoft Error Reporting (DW20.exe) - if
N	dwStart	FireWall.exe	"The Shield firewall from pcsecurityshield.com. Not recommended by some (see here) and there are better free alternatives out there such as Zone Alarm. Located in %ProgramFiles%\PCSecurityShield\The Shield Firewall"
U	dwtrig20	dwtrig20.exe	"Used to launch Microsoft Error Reporting (DW20.exe) - if
X	DW_Start	rwwnw64d.exe	Identified as a variant of the AdWare.Win32.ZenoSearch.am malware
X	Dx	sys*.exe [* = random number]	"Added by the DEXTER.A WORM!"
N	DXDllRegExe	dxdllreg.exe	"Created when you select ""Yes"" to check the ""WHQL Digital signatures"" in the DirectX9 files at the first time you open it"
X	DxLoad	DX3DRndr.exe	"Added by the GIBE.B WORM!"
X	dxmsrv	dxmsrv.exe	Added by an unidentified WORM or TROJAN!
X	DyFuCA Active Alert	actalert.exe	"Adult content dialler - see here"
X	Dynamic Dns Binary	dynitora.exe	"Added by the RBOT-WT WORM!"
X	Dynamic Dns Binary	CMD16.EXE	"Added by the RBOT-XM WORM!"
X	Dynamic Dns Binary	winxp34.exe	"Added by a variant of the RBOT WORM!"
X	Dynamic Dns Binary	WinHelpcfn.exe	"Added by a variant of the RBOT WORM!"
X	Dynamic Link Library loader	Loader32.exe	"Added by the KOL TROJAN!"
U	DynDNS Updater	DynDNS.exe	"Dynamic DNS IP address updater tool
N	DynDNS-Updater Traytool	ddutray.exe	"DynDNS updater tray icon - allows easy configuration of the Dynamic DNSSM service. Can be run manually"
X	DynHttp Dns Binary	dynizari.exe	"Added by a variant of the RBOT WORM!"
X	E-Card	ecard.exe	"Added by the YODI WORM!"
U	E-color	IconMgr.Exe	Sets the colour of your monitor when running games that recognise E-Color so that you get 'what the game designer intended' when you see the game. Also allows monitor callibration through a program called 3-Deep. If you play a lot of games it can be useful. Can be disabled from starting up from within the program
N	E-Color Registration	SonnReg.exe	"Registration for Colorific® and 3Deep® monitor calibration sofware from E-Color. Now superseded by ColorWizzard™ and 3DxWizzard™"
X	E-nrgyPlus	E-nrgyPlus.exe	"Energyplus - tracks internet activity including websites visited and queries made at popular search engines. This information along with some system information is sent to a remote site"
U	e-Surveiller Station	estation.exe	"ESurveiller - surveillance software. Uninstall this software unless you put it there yourself"
U	E06DXLRD_7604703	EDICT.EXE	"Related to Microsoft Encarta dictionary functions"
N	EA Core	Core.exe	"Electronic Arts EA Link software - ""gives you a secure yet simple way to download EA PC games and patches
U	eabconfg.cpl	EabServr.exe	Easy Access Buttons control panel on Compaq laptops. Only required if you use the extra keys
X	Eac_Cnry	canary.exe	"Added by the CANARY TROJAN!"
?	Eac_rnvdl	ANTIVIRUS_INSTALL.EXE	"??"
Y	EAFRCliStart	EAFRCliStart.exe	"Related to Encryption Anywhere hard disk encryption products from GuardianEdge"
U	eanth_critical_update_alert	sys_alert.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
U	eanth_critical_update_alert	EANTHO~1.EXE	"eAcceleration Stop-Sign security software related - previously not recommended (see here). It has now been delisted
U	eanth_system_patcher	sys_alert.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
N	EAPCISETUP	wizard.exe	Part of the Creative Sounblaster PIC Installation Wizard. Probably left as a result of a failed installation
Y	Earthlink Protection Control Center	elnk_pcc.exe	"EarthLink Protection Control Center - ""powerful
N	EarthLink ToolBar 5.0	etoolbar.exe	"EarthLink Toolbar is a tool to help you get to all of the resources of the internet. EarthLink 5.0 Setup adds a few basic buttons to the Toolbar
N	Easy CD Creator	RoxAssist.exe	"Roxio Assistant is designed to correct engine initialization errors in Easy CD & DVD Creator 6. If the engine does not initialize
N	Easy Start Button	esb.exe	Provides functionality on certain laptops that have additional keys. Not required unless you use the extra keys
U	Easy-PrintToolBox	BJPSMAIN.EXE	A utility to launch the applications that are bundled with a Canon bubblejet printer
U	EasyKeyboardLogger	EasyKeyboardLogger.exe	"EasyKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself!"
U	EasyLinkAdvisor	LinksysAgent.exe	"Linksys EasyLink Advisor - ""the free application that provides and easy way to setup
N	EasyNetwork	McENUI.exe	"McAfee's EasyNetwork user interface - ""enables secure file sharing
X	EasySearchBar	ESBUpdate.exe	EasySearchBar adware downloader
X	easyServ	Server.exe	"Added by the EASYSERV TROJAN!"
X	EasySpywareCleaner	EasySpywareCleaner.exe	"EasySpywareCleaner rogue spyware remover - not recommended
U	EasySync Pro	XCPCMenu.exe	"""IBM® Lotus® EasySync® Pro is a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - 3CmPlm	AutoDet.exe	"3Com Palm PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - LtNts4	NtsAgent.exe	"Lotus Notes 4 specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - PocketPC	AUTODE~1.EXE	"Windows Mobile Pocket PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - PocketPC	AutoDetect.exe	"Windows Mobile Pocket PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasyTuneIV	ET4Tray.exe	Tuning (overclocking) utility for Gigabyte motherboards. Shortcut available
X	EbatesMoeMoneyMaker	wjview ...Code	"Ebates adware"
X	EbatesMoeMoneyMaker0	EbatesMoeMoneyMaker0.exe	"Ebates adware"
X	eBay Toolbar	EBAYTBAR.EXE	"eBay Toolbar - reportes as spyware as it "phones home""
U	eBayToolbar	eBayTBDaemon.exe	"eBay toolabar related - also contains eBay account Guard which monitors for fraudulent eBay sites"
U	eBoard	Eboard.exe	eMachines multimedia keyboard manager. Required if you use the extra keys
N	eBot	DownloadWizard.exe	"eBot from Digital River - ""helps ensure your computer always has the latest technology
U	ECenter	gtb.exe	Dell E-Center/Google Toolbar related
N	ECenter	EULALauncher.exe	End User License Agreement (EULA) launcher - related to Dell E-Center/Google Toolbar
X	ecko	claro.exe	"Added by the DLOADR-AQJ TROJAN!"
U	eDataSecurity Loader	eDSloader.exe	"Part of Acer Empowering Technology. ""Acer eDataSecurity Management is a handy file encryption utility that protects files from being accessed by unauthorized persons
N	edexter	edexter.exe	"eDexter supplements internet filtering by substituting local images for filtered images in order to prevent browser stalls and other annoyances. Can be activated manually when starting the browser"
N	EDLoader	DTLoader.exe	Effective Desktop from MiniStars Software - desktop management software no longer being supported
U	EDRestore	??	"Set Point from Easy Desk Software - ""small utility that automatically sets System Restore points for WinME/XP"""
X	educational writer	[random filename]	"Added by the RBOT-LZ WORM!"
U	Edwizard	Edwizard.exe	"SafeGuard Easy - ""provides total company-wide protection for sensitive information on laptops and workstations. Boot protection
X	Edzy AntiVirus	dppsfa.exe	"Added by a variant of the RBOT WORM!"
X	Eech	hoor.exe	"PurityScan adware"
N	EEventManager	EEventManager.exe	"Part of the Epson Creativity Suite supplied with their multi-function printer/scanners
X	Efata	[random 5 characters].exe	"Added by the FLUKAN-D WORM!"
U	eFax 4.1	J2GTray.exe	"System Tray access to version 4.1 of eFax Messenger from j2 Global Communications
U	eFax 4.2	J2GTray.exe	"System Tray access to version 4.2 of eFax Messenger from j2 Global Communications
U	eFax 4.3	J2GTray.exe	"System Tray access to version 4.3 of eFax Messenger from j2 Global Communications
U	eFax 4.4	J2GTray.exe	"System Tray access to version 4.4 of eFax Messenger from j2 Global Communications
N	eFax Tray Menu	HotTray.exe	"eFax Messenger Tray Menu system tray icon for eFax Messenger Plus. Available via Start -> Programs. Disabling instructions available here"
U	eFax Tray Menu	J2GTray.exe	"System Tray access to eFax Messenger from j2 Global Communications
U	eFax Tray Menu 3.3	J2GTray.exe	"System Tray access to version 3.3 of eFax Messenger from j2 Global Communications
U	eFax Tray Menu 3.5	J2GTray.exe	"System Tray access to version 3.5 of eFax Messenger from j2 Global Communications
U	eFax Tray Menu 4.0	J2GTray.exe	"System Tray access to version 4.0 of eFax Messenger from j2 Global Communications
N	eFax.com Tray Menu	HotTray.exe	"eFax Messenger Tray Menu system tray icon for eFax Messenger Plus. Available via Start -> Programs. Disabling instructions available here"
U	EFI Hot Folders	hffw.exe	"""EFI Hot Folders improves productivity by simplifying the printing of PostScript and PDF files into a select
U	EFI Job Monitor	"[path] efjm.dll	run"
U	ehTray	ehtray.exe	"Media Center Tray Applet - part of Windows Media Center on XP MCE
U	ehTray.exe	ehTray.exe	"Media Center Tray Applet - part of Windows Media Center on XP MCE
U	Eicon NetworksLAN_DAEMON	watch.exe	"Associated with an Eicon Networks ISDN or ADSL modem. Watch protocols your connection with numbers and duration. You need callvu.exe (from Start Menu) to see your connection statistics. You can manually start watch.exe before you go online. Needs diinfo.exe (started by DiTask) to work correctly which can be started manually"
X	eKerberos	eKerberos.exe	"eKerberos rogue security software - not recommended"
U	ELBERTRicoh_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Ricoh MFP Type 104 multifunction printer
U	ELBERT_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX-5x30 Series multifunction printers
U	Electron Microscope	EMIII.exe	"Electron Microscope or EM - is a program used to track Stanford's distributed computing program client called Folding at Home
X	element furth	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are often located in %System%\vert"
U	eLert	eLert.exe	"eLert Emergency Notification System by Kennected Software - ""is an internet based public notification system designed to get emergency and non-emergency information out to the public quickly
X	EliteProtector	EliteProtector.exe	"EliteProtector rogue spyware remover - not recommended
?	ElkCtrl	ElkCtrl.exe	Entry added when you install versions of the Logitech QuickCam webcam software. It's exact purpose is unknown at the present time
X	ELNKProxy	smproxy.exe	"Surfmonkey adware"
Y	ElsaCapiCtl	Rcapi.exe	"Assumed to stand for Remote Common Application Programming Interface (RCAPI)
U	ELSAChipGuard	elsavect.exe	"ChipGuard for ELSA graphics cards - monitoring solution which monitors both the GPU temperature and fan speed
U	eMachines eBoard	Eboard.exe	eMachines multimedia keyboard manager. Required if you use the extra keys
Y	Email Protection	emlproxy.exe	"AntiVirus Quick Heal - E-mail protection"
U	EMBASSY Trust Suite Secure Update	AutoUpdate.exe	"Updates for Wave Systems Corp. Embassy Trust Suite - ""delivers advanced levels of security to the client PC using the TPM security chip found on most enterprise PCs today"""
X	eMCryT Sh3ars Panagers	[path to worm]	"Added by the RBOT-AWI WORM!"
X	eMessenger	emsn.exe	"Added by the RBOT.AHO BACKDOOR!"
U	EMMeter	EMMeter.exe	"""Express Meter lets you track and manage software usage so you can avoid purchasing and supporting applications that aren't being used
X	emoc0re	emo.exe	"Added by the AGOBOT-AGE WORM!"
?	Empowering Technology Launcher	eAPLauncher.exe	"Part of Acer Empowering Technology. What does it do and is it required?"
?	EmpoweringTechnology	Framework.Launcher.exe	"Part of Acer Empowering Technology. What does it do and is it required?"
X	emre1	emre1.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
Y	Emsisoft Anti-Malware	a2guard.exe	"System Tray access to and Anti-Malware Guard feature of Emsisoft Anti-Malware from Emsi Software GmbH - which provides ""comprehensive PC protection against viruses
N	eMuleAutoStart	emule.exe	"eMule - ""one of the biggest and most reliable peer-to-peer file sharing clients around the world. Thanks to it's open source policy many developers are able to contribute to the project
N	eMusicClient Systray	eMusicClient.exe	"eMusic MP3 download software"
N	EN4060C Taskbar	en4060ct.exe	Comes with Efficient Networks DSL Modems. Little red/green/yellow flashing icon in system tray
X	enBrowser	[name of file]	"WINBO adware"
?	encapsulated command tool	wintr.com	"??"
N	Encarta Dictionary Quickshelf	QSHLFED.EXE	"Provides quick access to Encarta's Dictionary features?"
N	ENCMONITOR	monitor.exe	The Encompass Monitor. This program is the Connect Direct Program. It is more trouble than it is worth and few use it
N	Encoder Agent	WMENCAGT.EXE	"MS Windows Media Encoder
U	Encompass_ENCMONTR	ENCMONTR.EXE	Optional simple browser from Yahoo (Encompass)
?	ENCSurf	surfboard.exe	"??"
N	Energizer FileSaver	Energizer FileSaver.exe	"Energizer FileSaver - UPS back-up utility for Energizer UPS products. From their Tech Support staff this is known to have a memory leak since it's release - with no fix planned! It will grab 2-5 handles per second and crash the average system in less than 3 days - therefore not recommended"
X	EnergyPlugIn	EnergyPlugin.exe	"EnergyPlugin adware variant"
?	ENSApServer2_0	APSERVER.EXE	"Intel AnyPoint Wireless II Home Network related. Now discontinued. What does it do and is it required?"
U	EnsoniqMixer	starter.exe	"Puts the Ensoniq mixer in system tray. From Ensoniq Technologies ""Our mixer is a critical part of the soundcard as it fixes sound problems and replaces the MS mixer which can no longer be used"". If you find you don't need it - try one of the solutions on this special page. Similar to Creative PCI Audio Configuration Utility"
U	Enterprise Harmony	rsMenu.exe	"Enterprise Harmony 99 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000"
U	Enterprise Harmony '99	rsMenu.exe	"Enterprise Harmony 99 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000"
X	Enterprise Suite	WE[random characters].exe	"Enterprise Suite rogue security software - not recommended
U	Enterra Icon Keeper	IcnKeepr.exe	"Icon Keeper - ""tool to save and restore icon positions on the desktop"""
X	EntraOcio	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Enumerate Service	wsys.exe	"Added by the MANIFEST TROJAN!"
U	EPGServiceTool	EPGClient.exe	"Electronic Programme Guide (EPG) for the WinTV range of TV Tuners from Hauppauge"
U	EPGServiceTool	EPGCLI~1.EXE	"Electronic Programme Guide (EPG) for the WinTV range of TV Tuners from Hauppauge"
U	ePowerManagement	ePM.exe	"Part of Acer Empowering Technology. ""Acer ePower Management is a straightforward interface that allows users to select from pre-configured power usage profiles
U	ePower_DMC	ePower_DMC.exe	"Part of Acer Empowering Technology. ""Acer ePower Management is a straightforward interface that allows users to select from pre-configured power usage profiles
N	ePrint 3.0 Service	EPRINT3.EXE	"LEADTOOLS ePrint file conversion software - ""convert any file to and from over 150 document and image formats including searchable PDF
N	ePrint 4.0 Service	EPRINT4.EXE	"A component of the ""LEADTOOLS ePrint File Conversion Software - Convert ANY file to and from over 150 document and image formats including searchable PDF
U	ePrompter	ePrompter.exe	"ePrompter - E-mail notification software"
N	EPS	e_srcv02.exe	"According to the Epson info: ""Use this utility to automatically check for errors and also check the level of ink remaining."" This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check"
N	EPS	e_srcv03.exe	"According to the Epson info: ""Use this utility to automatically check for errors and also check the level of ink remaining."" This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check"
X	Epsilon Squared	vmmreg32.exe	"Added by the AGENT.MVC TROJAN!"
N	EPSON Background Monitor	STMS.EXE	Supposed to keep an Epson printer ready for quick printing. Users report little difference whether it is on or not
U	EPSON CardMonitor	EPSON CardMonitor1.0.exe	Monitors the PCMCIA memory card slot on EPSON cameras and printers and launches PhotoStarter or PhotoPrint
U	EPSON PictureMate Deluxe	E_FATI9TA.EXE	"Epson Status Monitor 3 for the PictureMate Deluxe compact photo printer - for monitoring printer status
U	EPSON Status Monitor 3	E_[various].EXE	"Epson Status Monitor 3 for their range of printer and AIO devices - for monitoring printer status
N	EPSON Status Monitor 3 Environment Check	e_srcv03.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check	e_srcv02.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check 2	e_srcv03.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check 2	e_srcv02.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
U	EPSON Stylus C120 Series	E_FATICCA.EXE	"Epson Status Monitor 3 for the Stylus C120 Series printer - for monitoring printer status
U	EPSON Stylus C40 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C40 Series printer - for monitoring printer status
U	EPSON Stylus C41 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C41 Series printer - for monitoring printer status
U	EPSON Stylus C42 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C42 Series printer - for monitoring printer status
U	EPSON Stylus C43 Series	E_S08IC1.EXE	"Epson Status Monitor 3 for the Stylus C43 Series printer - for monitoring printer status
U	EPSON Stylus C43 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C43 Series printer - for monitoring printer status
U	EPSON Stylus C44 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C44 Series printer - for monitoring printer status
U	EPSON Stylus C45 Series	E_S4I3T1.EXE	"Epson Status Monitor 3 for the Stylus C45 Series printer - for monitoring printer status
U	EPSON Stylus C46 Series	E_S4I0T1.EXE	"Epson Status Monitor 3 for the Stylus C46 Series printer - for monitoring printer status
U	EPSON Stylus C48 Series	E_S4I091.EXE	"Epson Status Monitor 3 for the Stylus C48 Series printer - for monitoring printer status
U	EPSON Stylus C60 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C60 Series printer - for monitoring printer status
U	EPSON Stylus C61 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C61 Series printer - for monitoring printer status
U	Epson Stylus C62 Series	E-S0BIC1.EXE	"Epson Status Monitor 3 for the Stylus C62 Series printer - for monitoring printer status
U	EPSON Stylus C62 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C62 Series printer - for monitoring printer status
U	EPSON Stylus C63 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C63 Series printer - for monitoring printer status
U	EPSON Stylus C64 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C64 Series printer - for monitoring printer status
U	EPSON Stylus C64 Series	E_S4I2C1.EXE	"Epson Status Monitor 3 for the Stylus C64 Series printer - for monitoring printer status
U	EPSON Stylus C66 Series	E_S4I0S2.EXE	"Epson Status Monitor 3 for the Stylus C66 Series printer - for monitoring printer status
U	EPSON Stylus C67 Series	E_FATIAAL.EXE	"Epson Status Monitor 3 for the Stylus C67 Series printer - for monitoring printer status
U	Epson Stylus C82 Series	E_S0HIC1.EXE	"Epson Status Monitor 3 for the Stylus C82 Series printer - for monitoring printer status
U	EPSON Stylus C82 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C82 Series printer - for monitoring printer status
U	EPSON Stylus C84 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C84 Series printer - for monitoring printer status
U	EPSON Stylus C84 Series	E_S4I2D1.EXE	"Epson Status Monitor 3 for the Stylus C84 Series printer - for monitoring printer status
U	EPSON Stylus C87 Series	E_FATIABL.EXE	"Epson Status Monitor 3 for the Stylus C87 Series printer - for monitoring printer status
U	EPSON Stylus CX2900 Series	E_FATIBFP.EXE	"Epson Status Monitor 3 for the Stylus CX2900 Series printer - for monitoring printer status
U	EPSON Stylus CX3500 Series	E_FATI9 BL.EXE	"Epson Status Monitor 3 for the Stylus CX3500 Series printer - for monitoring printer status
U	EPSON Stylus CX3600 Series	E_FATI9BE.EXE	"Epson Status Monitor 3 for the Stylus CX3600 Series printer - for monitoring printer status
U	EPSON Stylus CX3700 Series	E_FATIACP.EXE	"Epson Status Monitor 3 for the Stylus CX3700 Series printer - for monitoring printer status
U	EPSON Stylus CX3800 Series	E_FATIACA.EXE	"Epson Status Monitor 3 for the Stylus CX3800 Series printer - for monitoring printer status
U	EPSON Stylus CX3900 Series	E_FATIBEP.EXE	"Epson Status Monitor 3 for the Stylus CX3900 Series printer - for monitoring printer status
U	EPSON Stylus CX4200 Series	E_FATIAEA.EXE	"Epson Status Monitor 3 for the Stylus CX4200 Series printer - for monitoring printer status
U	EPSON Stylus CX4500 Series	E_FATI9AP.EXE	"Epson Status Monitor 3 for the Stylus CX4500 Series printer - for monitoring printer status
U	EPSON Stylus CX4600 Series	E_FATI9AA.EXE	"Epson Status Monitor 3 for the Stylus CX4600 Series printer - for monitoring printer status
U	EPSON Stylus CX4700 Series	E_FATIADL.EXE	"Epson Status Monitor 3 for the Stylus CX4700 Series printer - for monitoring printer status
U	EPSON Stylus CX4800 Series	E_FATIADA.EXE	"Epson Status Monitor 3 for the Stylus CX4800 Series printer - for monitoring printer status
U	EPSON Stylus CX5000 Series	E_FATIBVA.EXE	"Epson Status Monitor 3 for the Stylus CX5000 Series printer - for monitoring printer status
U	EPSON Stylus CX5500 Series	E_FATICAP.EXE	"Epson Status Monitor 3 for the Stylus CX5500 Series printer - for monitoring printer status
U	EPSON Stylus CX6000 Series	E_FATIBIA.EXE	"Epson Status Monitor 3 for the Stylus CX6000 Series printer - for monitoring printer status
U	EPSON Stylus CX6500 Series	E_FATI9EP.EXE	"Epson Status Monitor 3 for the Stylus CX6500 Series printer - for monitoring printer status
U	EPSON Stylus CX6600 Series	E_FATI9EE.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	EPSON Stylus CX6600 Series	E_FATI9EA.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	EPSON Stylus CX7000F Series	E_FATIBKA.EXE	"Epson Status Monitor 3 for the Stylus CX7000F Series printer - for monitoring printer status
U	EPSON Stylus CX7400 Series	E_FATICDA.EXE	"Epson Status Monitor 3 for the Stylus CX7400 Series printer - for monitoring printer status
U	EPSON Stylus CX7800 Series	E_FATIAFA.EXE	"Epson Status Monitor 3 for the Stylus CX7800 Series printer - for monitoring printer status
U	EPSON Stylus CX8300 Series	E_FATICEP.EXE	"Epson Status Monitor 3 for the Stylus CX8300 Series printer - for monitoring printer status
U	EPSON Stylus CX8400 Series	E_FATICEA.EXE	"Epson Status Monitor 3 for the Stylus CX8400 Series printer - for monitoring printer status
U	EPSON Stylus CX9300F Series	E_FATICFP.EXE	"Epson Status Monitor 3 for the Stylus CX9300F Series printer - for monitoring printer status
U	EPSON Stylus CX9400Fax Series	E_FATICFA.EXE	"Epson Status Monitor 3 for the Stylus CX9400Fax Series printer - for monitoring printer status
U	EPSON Stylus D68 Series	E_FATIAAE.EXE	"Epson Status Monitor 3 for the Stylus D68 Series printer - for monitoring printer status
U	EPSON Stylus D78 Series	E_FATIBGE.EXE	"Epson Status Monitor 3 for the Stylus D78 Series printer - for monitoring printer status
U	EPSON Stylus D88 Series	E_FATIABE.EXE	"Epson Status Monitor 3 for the Stylus D88 Series printer - for monitoring printer status
U	EPSON Stylus DX3800 Series	E_FATIACE.EXE	"Epson Status Monitor 3 for the Stylus DX3800 Series printer - for monitoring printer status
U	EPSON Stylus DX4000 Series	E_FATIBEE.EXE	"Epson Status Monitor 3 for the Stylus DX4000 Series printer - for monitoring printer status
U	EPSON Stylus DX4400 Series	E_FATICAE.EXE	"Epson Status Monitor 3 for the Stylus DX4400 Series printer - for monitoring printer status
U	EPSON Stylus DX4800 Series	E_FATIADE.EXE	"Epson Status Monitor 3 for the Stylus DX4800 Series printer - for monitoring printer status
U	EPSON Stylus DX5000 Series	E_FATIBVE.EXE	"Epson Status Monitor 3 for the Stylus DX5000 Series printer - for monitoring printer status
U	EPSON Stylus DX6000 Series	E_FATIBIE.EXE	"Epson Status Monitor 3 for the Stylus DX6000 Series printer - for monitoring printer status
U	EPSON Stylus DX7000F Series	E_FATIBKE.EXE	"Epson Status Monitor 3 for the Stylus DX7000F Series printer - for monitoring printer status
U	EPSON Stylus DX7400 Series	E_FATICDE.EXE	"Epson Status Monitor 3 for the Stylus DX7400 Series printer - for monitoring printer status
U	EPSON Stylus DX8400 Series	E_FATICEE.EXE	"Epson Status Monitor 3 for the Stylus DX8400 Series printer - for monitoring printer status
U	EPSON Stylus Photo 1400 Series	E_FATIBUA.EXE	"Epson Status Monitor 3 for the Stylus Photo 1400 Series printer - for monitoring printer status
U	EPSON Stylus Photo R1800	E_FATI9LA.EXE	"Epson Status Monitor 3 for the Stylus Photo R1800 printer - for monitoring printer status
U	EPSON Stylus Photo R200 Series	E_S4I0H2.EXE	"Epson Status Monitor 3 for the Stylus Photo R200 Series printer - for monitoring printer status
U	EPSON Stylus Photo R220 Series	E_S6I2I1.EXE	"Epson Status Monitor 3 for the Stylus Photo R220 Series printer - for monitoring printer status
U	EPSON Stylus Photo R220 Series	E_FATIAIE.EXE	"Epson Status Monitor 3 for the Stylus Photo R220 Series printer - for monitoring printer status
U	EPSON Stylus Photo R240 Series	E_FATIAHE.EXE	"Epson Status Monitor 3 for the Stylus Photo R240 Series printer - for monitoring printer status
U	EPSON Stylus Photo R2400	E_FATI9SA.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	EPSON Stylus Photo R2400	E_FATI9SE.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	EPSON Stylus Photo R260 Series	E_FATIBNA.EXE	"Epson Status Monitor 3 for the Stylus Photo R260 Series printer - for monitoring printer status
U	EPSON Stylus Photo R280 Series	E_FATICKA.EXE	"Epson Status Monitor 3 for the Stylus Photo R280 Series printer - for monitoring printer status
U	EPSON Stylus Photo R285 Series	E_FATICKE.EXE	"Epson Status Monitor 3 for the Stylus Photo R285 Series printer - for monitoring printer status
U	EPSON Stylus Photo R300 Series	E_S4I2F1.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	EPSON Stylus Photo R300 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	EPSON Stylus Photo R300 Series	E_S4I0F2.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	EPSON Stylus Photo R320 Series	E_FATI9FA.EXE	"Epson Status Monitor 3 for the Stylus Photo R320 Series printer - for monitoring printer status
U	EPSON Stylus Photo R340 Series	E_FATIAJE.EXE	"Epson Status Monitor 3 for the Stylus Photo R340 Series printer - for monitoring printer status
U	EPSON Stylus Photo R380 Series	E_FATIBOA.EXE	"Epson Status Monitor 3 for the Stylus Photo R380 Series printer - for monitoring printer status
U	EPSON Stylus Photo R800	E_FATI9YE.EXE	"Epson Status Monitor 3 for the Stylus Photo R800 printer - for monitoring printer status
U	EPSON Stylus Photo RX420 Series	E_FATI9CE.EXE	"Epson Status Monitor 3 for the Stylus Photo RX420 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX430 Series	E_FATI9CP.EXE	"Epson Status Monitor 3 for the Stylus Photo RX430 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX500	E_S4I2K1.EXE	"Epson Status Monitor 3 for the Stylus Photo RX500 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX530 Series	E_FATIAGP.EXE	"Epson Status Monitor 3 for the Stylus Photo RX530 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX600	E_S4I2M1.EXE	"Epson Status Monitor 3 for the Stylus Photo RX600 printer - for monitoring printer status
U	EPSON Stylus Photo RX640 Series	E_FATIAME.EXE	"Epson Status Monitor 3 for the Stylus Photo RX640 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX680 Series	E_FATICJA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX680 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX700 Series	E_FATI9IA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX700 Series printer - for monitoring printer status
U	EPSON Stylus Pro 4000	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Pro 4000 printer - for monitoring printer status
U	EPSON Stylus Pro 7600	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Pro 7600 printer - for monitoring printer status
U	EPSON Stylus SX200 Series	E_FATIEFE.EXE	"Epson Status Monitor 3 for the Stylus SX200 Series printer - for monitoring printer status
U	EPSON SX100 Series	E_FATIEDE.EXE	"Epson Status Monitor 3 for the SX100 Series printer - for monitoring printer status
U	EPSON TX100 Series	E_FATIEDP.EXE	"Epson Status Monitor 3 for the TX100 Series printer - for monitoring printer status
U	EPSON WorkForce 30 Series	E_FATIEEA.EXE	"Epson Status Monitor 3 for the WorkForce 30 Series printer - for monitoring printer status
U	EPSON WorkForce 500 Series	E_FATIEQA.EXE	"Epson Status Monitor 3 for the WorkForce 500 Series printer - for monitoring printer status
U	EPSON WorkForce 600 Series	E_FATIEKA.EXE	"Epson Status Monitor 3 for the WorkForce 600 Series printer - for monitoring printer status
U	EpsonPhotoStarter	EPSON_PhotoStarter.exe	Only needed if you want to make full use of the capabilities of an Epson printer that included this
X	Eptr	nopdb.exe	Added by an unidentified WORM or TROJAN!
X	EQArticle	EQArticle.exe	"EQArticle adware"
X	eraseplg	eraseplg.exe	"Added by the GENOME.AQUV TROJAN!"
U	Eraser	eraser.exe	"Eraser - ""an advanced security tool for Windows which allows you to completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns"". This entry starts the Scheduler with Windows and provides a System Tray icon for on-demand access. Located in %ProgramFiles%\Eraser"
U	eraser	eraser.exe	"Part of Evidence Exterminator
U	eraser.exe	eraser.exe	"Part of Evidence Exterminator
Y	eRecoveryService	check.exe	"Now part of Acer Empowering Technology. ""Acer eRecovery Management is a powerful utility that does away with the need for recovery disks provided by the manufacturer
U	eRecoveryService	Monitor.exe	"Part of Acer Empowering Technology. ""Acer eRecovery Management is a powerful utility that does away with the need for recovery disks provided by the manufacturer
U	eRecoveryService	eRAgent.exe	"Part of Acer Empowering Technology. ""Acer eRecovery Management is a powerful utility that does away with the need for recovery disks provided by the manufacturer
N	Ereg	reg32.exe	"EReg is a software registration tool incorporated on products such as those by Broderbund
X	erfgddfk	wind2ll2.exe	"Added by the BEAGLE.CQ WORM!"
X	erghgjhgdr	windlhhl.exe	"Added by the BEAGLE.BG WORM!"
X	erghgjhjgdr	windlhhl.exe	"Added by the BEAGLE.BG or BEAGLE.BH or BEAGLE.BI or BEAGLE.BJ WORMS!"
?	erm	erm.exe	"??"
X	Eroca	Eroca.exe	"Insider.i adware"
X	eros.exe	eros.exe	Adult content dailler
X	ErrClean	SysRep.exe	"ErrClean rogue system error and cleaning utility - not recommended. There are number of variants in this family sharing the same filename and user interface - see here"
X	ErreurChasseur	SysRep.exe	"ErreurChasseur
N	Error Nuker	ErrorNuker.exe	"ErrorNuker registry cleaner - only required if you want the application to run a scan at startup. The program can be launched manually if required"
X	Error Safe	ers.exe	"ErrorSafe rogue system error and cleaning utility - not recommended"
X	Error Safe Free	uers.exe	"ErrorSafe rogue system error and cleaning utility - not recommended"
X	ErrorFix	ErrorFix.exe	"ErorrFix rogue system error and cleaning utility - not recommended
X	ErrorGuard	ErrorGuard.exe	"ErrorGuard rogue spyware remover - not recommended
X	errorhandler	errorhandler.exe	"ErrorHandler adware"
X	ErrorProtector Free	ertmain.exe	"ErrorProtector rogue system error and cleaning utility - not recommended"
X	ErrorRepairTool	ErrorRepairTool.exe	"ErrorRepairTool rogue system error and cleaning utility - not recommended"
X	ErrorSafe	ers.exe	"ErrorSafe rogue system error and cleaning utility - not recommended"
X	ErrorSafeFree	UERS.exe	"ErrorSafe rogue system error and cleaning utility - not recommended"
X	ErrorWiz	ErrorWiz.exe	"ErrorWiz rogue system error and cleaning utility - not recommended
X	ERS	ers_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	ERScw	ERScw.exe	"Part of the ErrorSafe rogue system error and cleaning utility - not recommended"
X	ERS_check	ers_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	ERS_Check	uwasers.exe	"Part of the WinAntiSpyware 2006 and WinAntiSpyware 2007 rogue spyware removers - not recommended"
X	erthegdr	windll2.exe	"Added by the BEAGLE.CG WORM!"
X	erthgdr	windll.exe	"Added by the BEAGLE.AO or BEAGLE.AQ WORMS!"
X	erthgdr	svc.exe	"Added by the BEAGLE.BN or BEAGLE.BP WORM!"
X	erthgdr2	svc23.exe	"Added by the BAGLE.CG WORM!"
?	ERTS0749	ERTS0749.exe	"IBM Warranty Notification - presumably it's a reminder to either register or that warranty is about to expire?"
X	ertyuop	rttrwq.exe	"Added by the AUTORUN-APA WORM!"
U	ERUNT AutoBackup	AUTOBACK.EXE	"ERUNT backup utility - when added to the user's startup folder automatically backs up the registry each time the system boots
X	erwghjjrjt	ucbcg.exe	"Added by the SMALL.CUL TROJAN!"
U	ES Current Services	[FILE NAME].exe	"123Keylogger surveillance software. Uninstall this software unless you put it there yourself"
Y	eSafe Protect	ESPWatch.exe	"eSafe from Aladdin - internet security for gateway and E-mail servers"
Y	eScan Monitor	AVKWCTL9X.EXE	"MicroWorld eScan antivirus"
U	eScan Scheduler	avkserv.exe	"MicroWorld eScan antivirus scheduler"
U	eScan Updater	Trayicos.exe	"MicroWorld eScan antivirus updater - allows users to automatically download updates and set the auto time interval for downloads"
X	EScorcher	escorcher.exe	"Part of eScorcher anti-virus software - responsible for performing virus checks and deletions. Used to collect information about the user and therefore treated as spyware - now the web-site is dead"
X	Esph	ortu.exe	"PurityScan adware"
X	ETB Tester	etbtest.exe	"Added by the RBOT-ABR WORM!"
X	etbrun	elit***32.exe [* = random char]	"EliteBar adware"
U	eTCertManger	eTCrtMng.exe	"eToken Certificate Manager from Aladdin Knowledge Systems
U	ETDWare	ETDCtrl.exe	Elantech smart-pad touchpad driver for the Asus Eee PC range
X	eth0 driver	exec.exe	"Added by the SPYBOT-Z WORM!"
N	Ethernet	tcaudiag.exe	3Com NIC Installation/Diagnostic MFC application. Diagnostics may be run from the Start -> Programs
X	ethernet	airftp.exe	"Added by a variant of the SDBOT WORM!"
X	ethernet	msnger.exe	"Added by a variant of the SDBOT WORM!"
X	ethernet	msftp.exe	"Added by the SDBOT.BXJ WORM!"
X	ethernet adapter	csrmss.exe	"Added by a variant of the RBOT WORM!"
X	Ethernet Driver	cmsrrs.exe	"Added by a variant of the RBOT WORM!"
X	Ethernet Drivers	smrrs.exe	"Added by the RBOT-AAK WORM!"
X	Ethernet Drivers	ethernet.exe	"Added by the GAOBOT.CEZ WORM!"
X	Ethernet Linking	ethernet.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Etraffic	JavaRun.exe	"TopMoxie adware"
Y	eTrust EZ Firewall	efpeadm.exe	"eTrust EZ Firewall"
U	eTrust PestPatrol Active Protection	PPActiveDetection.exe	"PestPatrol real-time protection feature. ""Stops spyware before it infects your system"""
X	eTrust Realtime Monitor	realmon.exe	"Added by the LAZAR.B TROJAN!"
Y	eTrustCIPE	ezdsmain.exe	eTrust EZ Deskshield from Computer Associates. Protects against malicious email attachments and unauthorized use of email by detecting and blocking unusual behavior
U	Eudora	Eudora.exe	"Eudora from Qualcomm allows you to receive and send Internet e-mails"
X	EUP Service	eupsvc.exe	"Added by the DELBOT-Q WORM!"
U	EuroGlot	EuroGlot.exe	"Euroglot - ""multilanguage translating system
N	Event Planner Reminders	PLNRNote.exe	Part of Sierra/Hallmark Card Studio - System Tray notification of events such as birthdays and anniversaries that you've scheduled with the customizable Event Planner
N	Event Planner Reminders Tray Icon	PLNRnote.exe	Part of Sierra/Hallmark Card Studio - System Tray notification of events such as birthdays and anniversaries that you've scheduled with the customizable Event Planner
N	Event Reminder	pmremind.exe	"Event reminder for calendar dates
U	EVENTLISTENER	EvLstnr.exe	Used with a Nikon digital camera to recognize when the camera is plugged in
N	eventmgr	eventmgr.exe	Used with a Microtek scanner. Manages the scanner's button events. Available via Start -> Programs
X	eventwvr	eventwvr.exe	"Added by the COSIAM_G TROJAN!"
?	EverioService	EverioService.exe	"Related to the Cyberlink software supplied with JVC's Everio camcorders. What does it do and is it required?"
U	EVGAPrecision	EVGAPrecision.exe	"EVGA Precision overclocking utility - ""allows you to fine tune your EVGA graphics card for the maximum performance possible
U	Evidence Cleaner	ecleaner.exe	"Evidence Cleaner cleans up tracks left by your PC and Internet activities"
N	Evidence Eliminator	ee.exe	"Evidence Eliminator - cover the tracks of your browsing habits and E-mails if you think you need to. Run manually on a regular basis"
U	Evoluent Mouse Manager	EvoMouExec.exe	"Mouse manager for Evoluent VertcialMouse"
U	EvtMgr6	Setpoint.exe	"Logitech SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice
U	EW Message Server	msg32.exe	Conexant (older versions are Brooktree) Wavestream Message Server - associated with Conexant based audio devices
N	eWare Startup	iWareStart.exe	"eWare iWare task bar. Not required"
Y	ewido anti-spyware	ewido.exe	"System Tray access to and notifications for Ewido Anti-Spyware 4.0. Ewido is now part of AVG Technologies so this has been superseded by AVG Anti-Virus which includes Anti-Spyware"
X	ewrgetuj	geurge.exe	"Added by the AUTOINF-AK WORM!"
X	ewupdater	ewupdater.exe	"EasyWebSearch adware updater"
X	example	[random filename].exe	"Added by the NUCLEAR BACKDOOR! Note - this trojan file is located in %Windir%\NR"
N	Excite Platform	Exlaunch.exe	Loads an Icon in the startup tray that allows you to receive service update notices for Excite@Home if you desire (note that since Excite@Home appears to be winding down this becomes irrelevant). May also allow you to kill the Excite Toolbar that automatically loads in Internet Explorer
?	Excite Private Messenger Pipe	x8impipe.exe	"??"
X	ExecUser	ExecUser.exe	"Added by a variant of the RBOT WORM!"
?	Execute	delfolders.exe	"??"
X	ExeName32	Warm.scr	"Added by the SCOLD WORM!"
X	ExFilter	"Rundll32.exe [path] cdnspie.dll	ExecFilter"
U	Exif Launcher	Exiflaquickdcr.exe	USB mass storage driver used by some digital cameras such as the Fuji Finepix. Only required if you use it regularly
U	Exif Launcher	QuickDCF.exe	USB mass storage driver used by some digital cameras such as the Fuji Finepix. Only required if you use it regularly
U	ExitKiller	Ekiller.exe	"Exit Killer - automatically closes pop-up windows in your browser"
?	exmon	hpimoniter.exe	"Some kind of hp digital camera maybe or a photo smart connection probe?"
X	exp1orer.exe	exp1orer.exe	"Added by the DLOAD-FG TROJAN! Notice the digit ""1"" used in both the startup entry and filename
X	Expatch	[random filename]	"Added by the PWSLMIR-G TROJAN!"
X	expcrt	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	ExpertAntivirus	ExpertAntivirus.exe	"ExpertAntivirus rogue security software - not recommended
X	EXPL0RE.EXE	EXPL0RE.EXE	"Added by the POPNO-A TROJAN! Note that the filename is spelled using the digit ""0"" instead of the uppercase letter ""o"""
X	Expl0rer soft	expl0rer.pif	"Added by the RBOT-AQR WORM!"
X	expler	Updadv.exe	"Added by the QQPASS-N TROJAN!"
X	explord.exe	explord.exe	"Added by the DLOADR-AYW TROJAN!"
X	explore	explore.exe	"Added by any number of VIRUSES
X	Explore	Explorer.exe	"Added by the IRC.FLOOD.G BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Explore	explore.exe	Adult content dialler
X	Explore	PLORE.EXE	"Added by the FORBOT-P WORM!"
X	explore manager	explore.exe	"Added by the DONBOMB.A TROJAN!"
X	explore.exe	Explore.exe	"Added by the GRAYBIRD.G TROJAN!"
X	exploreff.exe	exploreff.exe	"Added by the FINFANSE TROJAN!"
X	explorep.exe	explorep.exe	"Added by the LINEAG-I TROJAN!"
U	explorer	explorer.exe	"Starts Windows Explorer. Unless this has been manually added to startups or added by another program it could be a virus such as PE_BISTRO or DVLDR or MYDOOM.C. Note that it is also not the explorer.exe task/service you'll see when via CTRL+ALT+DEL"
X	explorer	wscript.exe [filename]	"Sneaky way to start any VBS script. Many viruses use VBS files. Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	Explorer	shellexpl.exe	"Added by the SHELDOR TROJAN!"
X	explorer	expl32.exe	"Added by the RATSOU TROJAN!"
X	Explorer	[path to worm]	"Added by the AUTEX WORM!"
X	Explorer	shellexp.exe	"Added by the AGENT-ZY TROJAN!"
X	EXPLORER	EXPL0RER.EXE	"Added by the BEASTDO-Y TROJAN! Note the ""0"" in the filename rather than upper case ""o"""
X	EXPLORER	sys.exe	"Added by the SILLYFDC-A TROJAN!"
X	Explorer	config_.com	"Added by the FLOPPY-D WORM!"
X	Explorer	drv.exe	"Added by the SMALL-FD TROJAN!"
X	explorer	[path to trojan]	"Added by the AGENT-EU TROJAN!"
X	explorer	explorer.exe	"Added by the KEYLOG-AK TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%\service"
X	EXPLORER	EXPLORER.exe	"Added by the NETHIEF-P TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%\ShellExt"
X	explorer	explorer.exe	"Added by the BLOCKEY-A TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%\config"
X	explorer	Yinstall.exe	"PurityScan/Clickspring adware"
X	Explorer	Windows Explorer.exe	"Added by the SILLYFDC-I WORM!"
X	Explorer	explorar.vbs	"Added by the DESKTO-A WORM!"
X	Explorer	TXP1atform.exe	"Added by the FUJACKS.CA VIRUS!"
X	explorer	system.exe	"Added by the AGENT-FI TROJAN!"
X	Explorer	msrstart.exe	"Added by the SOPICLICK TROJAN!"
X	explorer	main.vbe	"Added by the SHUSH-A WORM!"
X	Explorer 2238	[path to trojan]	"Added by the AGENT-CPI TROJAN!"
X	Explorer Loader	explr32.exe	"Added by the AGOBOT.N WORM!"
X	Explorer Loader	explorerl.exe	"Added by the SDBOT-ADI WORM!"
X	Explorer lptt01	explorer.exe	"RapidBlaster variant (in a ""explorer"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here.Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually!"
X	EXPLORER MICROSOFT SYSTEM	explore.exe	"Added by a variant of the RBOT WORM!"
X	Explorer ml097e	explorer.exe	"RapidBlaster variant (in a ""explorer"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here.Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually!"
X	Explorer soft	explorer.pif	"Added by the RBOT-APK WORM!"
X	Explorer soft	explorer.com	"Added by the RBOT-ARM WORM!"
X	Explorer Updater	IEXPLORE.exe	"Added by the SDBOT-WO WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	explorer.exe	explorer.exe	"Added by the AGENT-EW or PWS-CY TROJANS! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	explorer.exe	explorer.exe	"Added by the DELF-ACL TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the Program Files folder"
X	Explorer.exe	csrss.exe	"Added by the JUEGO-B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %AppData%\Microsoft"
X	Explorer32	Expl32.exe	"Added by the HACKTACK.B TROJAN!"
X	Explorer32	explorer6s4.exe	Added by the Downloader.Win32.Small.biq TROJAN!
X	Explorer32	efsdfgxg.exe	"Added by the CLICKER-Y TROJAN!"
X	Explorer5	config_.com	"Added by the VB.CBG WORM!"
X	Explorer6.1.EXE	Explorer.exe	Added by the MYDOOM.B WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually!
X	explorerf.exe	explorerf.exe	"Added by the AGENT-GDZ TROJAN!"
X	ExplorerRun	conime.exe	"Added by the DLDR-G TROJAN! Note - this is not the legitimate Console IME process of the same filename which is located in %System%. This one is located in %Temp%"
X	ExplorerTask	explorer.exe	"Added by the ZCREW-B BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the ""Fonts"" sub-folder"
X	ExploreUpdSched	[random filename]	"ZenoSearch adware"
X	exporet	winset.exe	"Added by the QQPASS-I TROJAN!"
U	Express ClickYes	ClickYes.exe	"""Express ClickYes is a handy tool that runs in the system tray automatically clicks the Yes button for the Outlook Security security prompt
N	Extender Resource Monitor	RMSysTry.exe	"Related to Windows Media Center from Microsoft"
X	External Dependencies	External.exe	"Added by the MYTOB.EC WORM!"
X	Extra Antivirus	ExtraAV.exe	"Extra Antivirus rogue security software - not recommended
U	ExtraDNS	ExtraDNS.exe	"ExtraDNS - DNS configuration tool"
N	ExtraFilmHemmaAgent	Agent.exe	"ExtraFilm Photo Assistant"
?	Extranet AutoDial	AutoExt.exe	Nortel Networks Contivity Extranet Switching Software
?	ExxtremeHelperDemon	exxdemon.exe	"Creative Exxtreme graphics card related?"
N	Eye Tide Launcher	oneeyetideone.exe	Nascar wallpaper
X	EYORE	Notepad.scr	"Added by the GIMLET-A WORM!"
Y	EZ Firewall	ca.exe	"eTrust EZ Armor Internet Security"
U	EZ-DUB Finder	EZ-DUB.exe	"Support software for the Lite-On EZ-DUB external DVD writer from Lite-On IT Corporation"
N	EZEJTRAY	EZEJTRAY.EXE	"System Tray access to the EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
N	ezHelper	ezHelper.exe	"Part of the ezPeer+ ezHelper music sharing program."
?	EZNORUN	EZNORUN.EXE	"Easy Internet related?"
N	EzPrint	ezprint.exe	"Lexmark Fast Pics - helps users of their printers to enhance
Y	ezShieldProtector for Px	ezSP_Px.exe	"Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings"
Y	ezShieldProtector for Px	ezSP_PxEngine.exe	"Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings"
U	EZSMART App	ezsmart.exe	EZ-S.M.A.R.T. hard drive monitoring software from StorageSoft - appears to be no longer supported
U	E_S[numbers]	[path] E_[various].EXE [path] E_S[numbers].tmp	"Temporary entry related to Epson Status Monitor 3 for their range of printer and AIO devices - for monitoring printer status
U	F-PROT Antivirus Tray application	FProtTray.exe	"System Tray access to F-PROT Antivirus"
X	F-Secure 2005	svchost.exe	"Added by the BIFROSE-CH TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
Y	F-Secure 2006	fspex.exe	"F-Secure Anti-Virus automatic updater"
X	F-Secure Gatekeeper	[malware name].exe	"Added by the NUWAR.AXQ WORM!"
U	F-Secure Management Agent	FSMA32.EXE	"F-Secure antivirus - F-Secure Policy Manager provides tools for administering F-Secure software products"
Y	F-Secure Manager	FSM32.EXE	"F-Secure antivirus - carry out scheduled virus scans automatically"
Y	F-Secure Startup Wizard	FSSW.EXE	"F-Secure antivirus"
Y	F-Secure TNB	TNBUtil.exe	"F-Secure antivirus"
U	f1Tray.exe	F1TRAY.EXE	"System Tray icon for FusionOne's MightyPhone software. ""MightyPhone is a concept for wirelessly synchronizing the data on your mobile phone with your web-based or PC based organizer"""
X	f94mggfhfghodftdf	[path to trojan]	"Added by the SMALL.JHZ TROJAN!"
U	Fabrik Ultimate Backup Status	fabrikhomestat.exe	"Status monitor for Fabrik Ultimate Backup from Fabrik Inc. ""No matter what happens to the drive on your desk - a spilled drink
U	FamilyKeyLogger	cisvc.exe	"Family Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Located in %ProgramFiles%\FamilyKeyLogger"
X	Fantasia injector	wincfg.exe	"Added by the AGOBOT.US WORM!"
X	farkrish	farkrish.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X	farmmext	farmmext.exe	"VX2.Transponder parasite updater/installer related"
X	Fast Antivirus 2009	FastAV.exe	"Fast Antivirus rogue security software - not recommended
N	FAST Defrag	FAST2.EXE	"FastDefrag defragmenting software"
X	Fast Search	svcnv.exe	"Homepage
X	Fast start	Ntut.exe	"Adware - deteced by Kaspersky as the FAVADD.I TROJAN!"
X	Fast start	svcnt.exe	"Adware - detected by Kaspersky as a variant of the FAVADD TROJAN!"
X	FastDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	FastStart	ntnut32.exe	"Added by the STARTPAGE.L TROJAN!"
X	FastStart	svcnut.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
X	FastStart	svcnut32.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
N	FastTrack Accelerator	SPEED UP.EXE	"FastTrack Accelerator - ""speedup"" utility for programs that use the FastTrack network such as KaZaA Media Desktop
X	FASTTRACKNETVISION	NETVISION.exe	"DialCar-Z premium rate dialer"
N	FastUser	fast.exe	Installs as part of Windows XP PowerToys as an option for very-fast user switching (allowing a keystoke to switch users instead of using the login screen). It is only used for the hot-key switch and yet it hogs 1.5 megs of memory in two separate processes (one run by the user & one by the system). Optional install in PowerToys
N	FastUsr	fast.exe	Installs as part of Windows XP PowerToys as an option for very-fast user switching (allowing a keystoke to switch users instead of using the login screen). It is only used for the hot-key switch and yet it hogs 1.5 megs of memory in two separate processes (one run by the user & one by the system). Optional install in PowerToys
X	Fat32 Microsoft	fat32.exe	"Added by the RBOT-EL WORM!"
U	Fatpipe Dialer	fpdialer.exe	Dailler for Fatpipe - software enabling high speed internet browsing (2-4 times faster) and internet connection sharing for up to 5 users
U	fatrecov	fatrecov.exe	SCKeyLog.j keystroke logger/monitoring program - remove unless you installed it yourself!
U	FavoriteSync	FavoriteSync.exe	"FavoriteSync keeps the same set of Internet Explorer Favorites on several computers in sync"
U	FaxCenterServer	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software. Incorporated into software by Lexmark
U	FaxCenterServer4_in_1	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software. Incorporated into software by Lexmark
U	FaxCtrl.exe	ASMediaProxyServer.exe	"Part of Avaya's Contact Center Express - ""a multi-channel
N	FaxTalk CallControl 6.0	FTClCtrl.EXE	This allows the software to handle incoming and outgoing communications without requiring the FaxTalk Communicator application to be loaded into memory. Can be started manually
U	FBDirect	FBDirect.exe	"Software that monitors the status of a Visioneer OneTouch scanner button and allows you to scan
X	FBSearch	FastBrowserSearchProtection.exe	"Fast Browser Search/Search Guard Plus parasite - installed with ""Make the Web Better"" applications such as My Web Tattoo
X	FBSearch	SearchGuardPlus.exe	"Fast Browser Search/Search Guard Plus parasite - installed with ""Make the Web Better"" applications such as My Web Tattoo
X	fc	runfc.exe	"Added by the CAMPURF WORM!"
X	Fdaemon security	fsecur.exe	"Added by the SDBOT.KXO WORM!"
X	Fdr Command Module	sp2.exe	"Added by the SDBOT.WP WORM!"
X	FDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
U	feedreader.exe	feedreader.exe	"""Feedreader is a freeware Windows application that reads and displays Internet newsfeeds aka ATOM and RSS feeds based on XML"""
X	feelalright	mirc.exe	"Added by the IRCFLOOD-M WORM!"
U	FEELitDeviceManager	feelitdm.exe	Associated with Immersion TouchSense devices (Logitech Wingman Force Feedback Mouse and possibly other peripherals)
U	Fellowes Proxy	R3proxy.exe	Installed with Fellowes EasyPoint mouse software. Not necessary for normal functioning of Fellowes mice but it is necessary to use the extended features of all Fellowes mice
X	Fen Startups	fensvc32.exe	"Added by the RANDEX.CCF WORM!"
X	Fenio Startups	fnesvc32.exe	"Added by the AGOBOT-OS BACKDOOR!"
U	FerrariWallPaper	FerrariWP.exe	Calendar that replaces the default desktop background image. It comes with every Acer Ferrari 3000 laptop. Also downloadable for members of www.ferrari.com
X	FestPlattenCleaner	SysRep.exe	"FestPlattenCleaner
X	FestplattenReiniger	GDC.exe	"FestplattenReiniger
X	ff	[path to worm]	"Added by the RBOT-XL WORM!"
X	ffis	ffisearch.exe	"iSearch adware"
Y	ffprsrv	ffprsrv.exe	"File and Folder Privacy - is a ""system security utility you can use to password-protect or hide your files and folders with a click of mouse. The program will always prompt to enter your access password when protection is enabled and a user is trying to access a protected file or folder"". If this entry is disabled
Y	ffprsrv.exe	ffprsrv.exe	"File and Folder Privacy - is a ""system security utility you can use to password-protect or hide your files and folders with a click of mouse. The program will always prompt to enter your access password when protection is enabled and a user is trying to access a protected file or folder"". If this entry is disabled
Y	ffpsrv	ffpsrv.exe	"File & Folder Protector - ""great easy-to-use password-protected security utility lets you password-protect certain files and folders
Y	ffpsrv.exe	ffpsrv.exe	"File & Folder Protector - ""great easy-to-use password-protected security utility lets you password-protect certain files and folders
U	FG1_00	frntgate.exe	"FrontGate MX - e-mail spam blocker"
?	fgl23DoubleScreenHooks	f23happ.exe	"Related to the now discontinued ATI Fire GL3 graphics card. What does it do and is it required?"
X	FHStart	shdocsvc.exe	"Added by the WINHOUND TROJAN!"
X	Fhzepgyi	HELLRAIDER.EXE	"Added by the MINDCTRL.A BACKDOOR!"
U	FieldForms Sync	SyncService.exe	"Resco FieldForms. A solution for building of mobile forms that can be viewed or filled in on the run
X	FiendlyType	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
?	file indexing service	msfindfile.exe	"New version of MS FindFast and still a resource hog?"
X	file laoder configuration	rnd32.exe	"Added by the RBOT.BQJ WORM!"
X	File Mapping Services	hp-1003.exe	"Added by the RBOT.FAN WORM!"
X	File Protection Monitor	filemon.exe	"Added by a variant of the RBOT WORM!"
X	File System	taskmqrs.exe	"Added by a variant of the TOXBOT/CODBOT WORM!"
X	File System	taskmqr.exe	"Added by the RBOT.BWQ WORM!"
X	File System Service	wmiprvsc.exe	"Added by the AGOBOT-HZ TROJAN!"
X	File-Sharing Wizard	shwizard.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	File1	Dia Claro.htm	"Added by the DLOADER-OR TROJAN!"
X	FileFreedom_Plugin	wtm.exe	"FileFreedom peer-to-peer sharing program"
N	filehippo.com	UpdateChecker.exe	"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
N	FileHippo.com Update Checker	UpdateChecker.exe	"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
X	FileManager32	Wscript.exe ChkMgr32.vbs	"Added by the NOTUP.A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""ChkMgr32.vbs"" file is located in %System%"
X	filename process	kerneldll.exe	"Added by the AGOBOT-PO WORM!"
X	filename process	explore.exe	"Added by the AGOBOT-QN WORM!"
X	filename process	Rundil16.exe	"Added by the GAOBOT.ZX WORM!"
X	Files Driver	sdphost.exe	"Added by the SDBOT-DKZ WORM!"
X	Files Driver	sfdhost.exe	"Added by the AGOBOT-AJC BACKDOOR!"
X	FileSoft	Wscript.exe UpdataFiles.vbs	"Added by the SST.B WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""UpdataFiles.vbs"" file is located in %Windir%"
U	FilmLoop	FilmLoopService.exe	"Related to FilmLoop - a photocasting network. Share your pictures with your family and friends"
U	FilterGate	filtergate.exe	"Filtergate internet filtering software - filters sounds
U	Filterguard	Filtrgrd.exe	"An icon located in the lower left of the screen and looks like a lifesaver. This icon is a ""short-cut"" to access the basic features of SOS-Guardian
X	FilterProgram	GDC.exe	"FilterProgram rogue privacy tool - not recommended
Y	Find Virus Launch Program	fvlaunch.exe	"Part of Dr. Solomon's Antivirus"
X	FindHack	[path to worm]	"Added by the KELVIR-BA WORM!"
U	FinePrint Dispatcher v4	fpdisp4a.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 4.x of the software. ""FinePrint saves ink
U	FinePrint Dispatcher v4	fpdisp4.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 4.x of the software. ""FinePrint saves ink
U	FinePrint Dispatcher v5	fpdisp5a.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 5.x of the software. ""FinePrint saves ink
N	FineReader7NewsReaderPro	AbbyyNewsReader.exe	"ABBYY FineReader OCR software - version 7"
U	FingerPrintSoftware	fpapp.exe	Supports the fingerprint reader on selected IBM/Lenovo Thinkpad notebooks
X	Fire Wall services	[random filename]	"Added by the IRCBOT-QY WORM!"
X	Fire Wall services	wnlmzsfhobi.exe	"Added by the IRCBOT-QY WORM!"
X	Fire Well service	[random].exe	"Added by the RBOT-FJU WORM!"
?	FireBox Control Panel	FireBox.exe	"Control panel for the Presonus FireBox firewire based music recording system. Is it required?"
X	FireExplore Update	FireExplore.exe	"Added by a variant of the RBOT WORM!"
X	FireFox	firefox.exe	"Added by the RBOT-ATP WORM! Note - this is not the popular FireFox web browser and is located in %System%"
X	Firefox Plugin Manager	firefoxpgm.exe	Added by the MSNPHOTO.E WORM!
U	Firefox Preloader	FirefoxPreloader.exe	"Firefox Preloader - ""a utility that is designed to load parts of Mozilla Firefox into memory before it is used to improve the its startup time"". Even on fast machines Firefox can take a while to load"
X	FireFox Service Drivers	ssmss.exe	"Added by a variant of the SDBOT WORM!"
X	FireFox Startup Drivers	wuaclt.exe	"Added by the RBOT.BYX WORM!"
X	firefox.exe	firefox.exe	"Added by the BANKER-EBO TROJAN! Note - this is not the popular FireFox web browser and is located in %System%"
Y	FirePod	FIREPOD.EXE	"Driver for the PreSonus FP10 (formerly FirePod) Firewire recording system"
X	FiresWallservices	[random].exe	"Added by the RBOT-FJT WORM!"
X	Firevall Administrating	rndll.exe	"Added by the PUSHBOT-B WORM!"
X	firewal	firewal.exe	"Added by the BANCBAN-QY TROJAN!"
X	Firewall	wmlaunch .exe	"Added by the ELIPTER.A or ELIPTER.B WORMS! Note the space at the beginning of the filename"
X	Firewall	wmlaunch .exe	"Added by the ELIPTER.D WORM!"
X	Firewall	SP2 UPDATE.exe	"Added by the ELITPER.E WORM!"
X	Firewall	Firewall.bat	"Added by the YPSAN.G WORM!"
X	firewall	fw_304.exe	"Added by the BDOOR-JQ BACKDOOR!"
X	Firewall	ctfmon.exe	"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in %Windir%"
X	firewall	spoolsv.exe	"Added by the DIZAN.F VIRUS!"
X	firewall	firewall.exe	"Added by the SURO-A TROJAN!"
X	firewall 2008	logoneui.exe	"Added by the SILLYFDC WORM!"
X	Firewall Administrating	infocard.exe	"Added by the AUTORUN-AYV WORM! Note - this is not the valid InfoCard Service which is part of the .NET Framework from Microsoft and uses the same filename"
X	Firewall auto setup	winlogon.exe	"Added by the AGENT-EDB TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
X	Firewall auto setup	[path to trojan]	"Added by the AGENT-GLY TROJAN!"
X	Firewall config	ReadMe.exe	"Added by the SILLYFDC.BBT WORM!"
X	Firewall Controls	sys32.exe	"Added by the SDBOT-DGI WORM!"
X	Firewall Policy	MidiDef32.exe	"Added by the PIEBOT-A TROJAN!"
X	Firewall Sp2 system	sys32Conf.exe	"Added by the RBOT-ABT WORM!"
X	Firewall Update System1	WinedowsUpdater1.exe	"Added by the RBOT-ARU WORM!"
X	Firewall Updater	msnupdateit.exe	"Added by the RBOT-AAQ WORM!"
X	Firewall.exe	Firewall.exe	"Added by the AGENT.AGL BACKDOOR! Located in %System%"
Y	FireWall.exe	FireWall.exe	"Ashampoo® Firewall PRO and Ashampoo® Firewall FREE from Ashampoo GmbH & Co. KG. Located in an Ashampoo related sub-directory of %ProgramFiles%"
X	FirewallActivies	csrss.exe	"Added by the BANKER-AQ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""3041"" subfolder"
Y	FirewallGUI	FirewallGUI.exe	"System Tray access to PC Tools Firewall Plus from PC Tools - which ""is a powerful personal firewall for Windows that protects your computer from intruders and controls the network traffic in and out of your PC"""
U	FirewallStartup	Firewallstartup.exe	"Innovative Startup Firewall - ""designed to protect your computer from programs that install themselves in the StartUp area of your Windows without asking for your approval. Innovative StartUp Firewall will help you keep your computer clean
X	FirewallSvr	FirewallSvr.exe	"Added by the NETSKY.X or NETSKY.Y WORMS!"
X	firewall_anti	firewall_anti.exe	"Added by the NETDENY-B TROJAN!"
X	FireWire Driver	samx.exe	"Added by the SDBOT.AE WORM!"
X	FireWire Service	nvscv32.exe	"Added by a variant of the SDBOT WORM!"
X	FireWire Services	nvcsv32.exe	"Added by a variant of the SPYBOT WORM!"
X	First Home Page	http://find.naupoint.com	"Naupoint browser hijacker"
?	First Principle Group	fpg.exe	"Related to the E-Players Card from First Principle Group"
N	FJUPDNV_Chitose	fjdvrupd.exe	Driver update for a Fujitsu Siemens Lifebook laptop
X	FKS v2.0	msngr.exe	Added by an unidentified WORM or TROJAN!
X	Flash Driver	[path to trojan]	"Added by the AGENT.CWVT TROJAN!"
X	Flash Media	[path to trojan]	"Added by the IRCBOT.AUR TROJAN!"
X	Flash Media	services.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
X	Flash Media	zrpk��'�'%''msn'�%'fix''.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Flash Player2	[path to worm]	"Added by the IRCBOT.PD WORM!"
X	Flashget Download Manager	Flashget.exe	"Added by the RBOT-AGZ WORM!"
X	FlashGuard	FlashGuard.exe	"Added by the AUTOIT.AL WORM!"
N	FlashPath Monitor	SDSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
N	FlashPath Monitor	FLSHSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
X	Flash_Player_Install	ying.exe	"Constructor VC2000 malware"
U	FlingRun	fling.exe	"Fling - free FTP software from NCH Software"
U	FLMBROWSERMOUSE	mouse32A.exe	Mouse utility for a Trust brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
U	FLMTRUSTKB	KbdAp32A.exe	Keyboard utility for a Trust brand keyboard. If you disable this entry you will not be able to use any of the keyboard hotkeys or other non-standard functions on the keyboard
U	FLMTRUSTMOUSE	mouse32a.exe	Mouse utility for a Trust brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
X	FLooDNeT	FLooDeR.exe	"Added by the ENDOOL TROJAN!"
X	Floppy Master	[path to trojan]	"Added by the ZONIT-F TROJAN!"
Y	FltProcess	msinet.exe	"Part of Cyber Patrol internet filtering software to restrict access to certain types of material on the internet. It can be disabled but do not ask how it's done"
U	FmctrlTray	Fmctrl.EXE	Genius SM-Live Control Panel. Enhances audio output through Genius sound cards (makes a big difference and worth the 3MB Ram used)
U	FMStart	Fmstart.exe	"GFI FAXmaker - native fax connector for Microsoft Exchange Server or for networks
X	Folder Service	wssdtu.exe	"Added by the MANIFEST TROJAN!"
U	Folder View	folderview.exe	"Folder View enhances the Windows file Explorer by making all folders you need available in a single click"
U	FolderClone v*.*.*	folderclone.exe	"Folderclone backup and synchronization software"
X	FolderRaper	[path to worm]	"Added by the VB.GOZ WORM!"
U	FolderShare	FolderShare.exe	"""FolderShare allows you to create a private peer-to-peer network that will help you to synchronize files across multiple devices and access or share files with colleagues and friends"""
N	FoneSyncSystemTray	FoneSyncSystemTray.exe	System Tray icon for Nokia FoneSync utility for the 7160/7190 mobiles. Useful to send data from/to the cell phone and the computer. You can use it to backup data or even to input data through the computer keyboard (which naturally is much more comfortable). Run manually when required
X	Font Viewer	fontviewer.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	FontsLoader	ldfnt32.hta	Unidentified malware
U	FooBar 1.0	FooBar.exe	"FooBar - ""combines fifteen high-quality productivity tools in a single toolbar that floats on your desktop or runs in the Windows task bar"""
X	foobin lptt01	adaware.exe	"RapidBlaster variant (in a ""foo1"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	foobin ml097e	adaware.exe	"RapidBlaster variant (in a ""foo1"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
Y	FoolProof	fpwinldr.exe	"FoolProof Security PC security software from SmartStuff"
Y	FoolProofSweep	??	"Part of FoolProof Security PC security software from SmartStuff"
N	Forbes	ForbesAlerts.exe	Forbes Business News Alerts - displays business news headlines in a little window on the screen
X	ForceShow	"rundll32.exe QaBar.dll	ForceShowBar"
N	Forget Me Not	AGRemind.exe	"Calendar reminder part of Broderbund's American Greetings® CreataCard®"
U	forteManager	dthtml.exe	"forteManager from LG. Rebranded version of Display Tune from Portrait Displays
Y	FortiClient	FortiClient.exe	"Fortinet security systems are the new generation of real time network protection systems"
U	Fortis Secure Layer Config	cseinst.exe	Fortis Bank Home Banking part. Installed during the installation of the software necessary to run the Home Banking. According to Fortis Bank this will not in any way be harmful to the system or relay system information
U	FourthDay	FourthDay.exe	"The Fourth Day - ""astronomical clock and almanac for your system tray"""
X	foxrxjh	foxrxjh.exe	"Added by the GWGHOST-T TROJAN!"
X	foxwudy9912	service.exe	"Added by the BANCOS-BT TROJAN!"
Y	FP Loader	loadfp.exe	"FoolProof Security - PC security software from SmartStuff"
N	Fpx	mnmsrvc.exe	Remote Desktop Sharing service part of Microsoft's Netmeeting allowing users to share items on their screens across remote locations
X	fqor	stub_113_4_0_4_0.exe	"TargetSaver adware"
X	FrameWork 2.5	FrameWork.exe	"Added by the RBOT-FMW WORM! Note - can terminate AV related processes"
X	Framework module library	infocard.exe	"Added by the BUZUS.AYX TROJAN!"
X	Framework Windows	frmwrk32.exe	"Added by the FAKEAV-KS TROJAN!"
X	France	svchost.exe	"Added by the MIMAIL.L WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
N	Fraps	FRAPS.EXE	"Fraps® by Beepa Pty Ltd - is ""a universal Windows application that can be used with games using DirectX or OpenGL graphic technology"". It can show how many Frames Per Second (FPS) you are getting
N	Free Download Manager	fdm.exe	"""Free Download Manager"" - see here"
?	Free Downloads Monitor	fdcmon.exe	"??"
N	Free DVD Direct	FreeDVDDirect.exe	"Free DVD Direct - provides a program to access a peer-to-peer (P2P) file-sharing network (see here)"
U	Free Key Logger	freekeylogger.exe	"Free Key Logger keystroke logger/monitoring program - remove unless you installed it yourself!"
U	Free Ram Optimizer	fro.exe	"Free Ram Optimizer monitors your memory
X	free-save	[path to risk]	"Freesave security risk that tracks and sends browser information and visited websites on the computer. Uninstall this software unless you put it there yourself"
X	FreeAttention	eqsefeqe.exe	Added by an unidentified WORM or TROJAN!
N	Freebie Notes	FreebieNotes.exe	"Freebie Notes by Power Soft - create electronic notes (stickers)"
N	FreeCall	FreeCall.exe	"FreeCall - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
Y	Freedom	Freedom.exe	"Freedom Internet Security & Privacy - anti-virus
U	FreeMem Pro	FMEMPRO.EXE	"FreeMem Pro - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
U	FreeMemVn2	FreeMem.exe	"FreeMem - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
X	FreeMP3download	"rundll32.exe MSA64CHK.dll	DllMostrar"
N	FreePDF Assistant	fpassist.exe	"Part of FreePDF (was FreePDF XP) - a utility used to create Adobe compatible PDF files from virtually any Windows application. This executable needs to be running when you want to send a printer output to a PDF file via the FreePDF virtual printer"
N	FreePDF_Assistant	fpassist.exe	"Part of FreePDF (was FreePDF XP) - a utility used to create Adobe compatible PDF files from virtually any Windows application. This executable needs to be running when you want to send a printer output to a PDF file via the FreePDF virtual printer"
U	FreeRAM XP	FreeRAM XP Pro *.exe	"FreeRAM XP Pro - memory optimizer where * represents the version. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
U	FreeRAM XP	FreeRAM XP Pro.exe	"FreeRAM XP Pro - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
X	freestyle	lockx.exe	"Added by the RBOT-ATH WORM!"
U	freesurfer	fs20.exe	"EMS Free Surfer mk II - pop-up stopper"
X	freexstyle	lockbar.exe	"Added by the LOXBOT.D WORM!"
X	freexstyle	lockbr.exe	"Added by the LOXBOT.C WORM!"
X	freinst	pgs.exe	"Part of the AVSystemCare rogue security software and other members of this family. See here for more examples"
U	Fresh Desktop	freshdesktop.exe	"Fresh Desktop is a utility that lets you manage vast collections of wallpapers for your desktop with ease. When run on bootup it changes the desktop wallpaper at startup or at specified intervals"
N	freshclam	freshclam.exe	"Auto update agent of the open source Clamwin virus scanner"
?	frguk	shdrkmck.exe	"??"
?	FridaysInHellInstaller	FridaysInHellInstaller.exe	"??"
X	FriendlyType	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	FriendlyTypeName	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
X	FriendlyTypeName	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
N	FriendlyWebQuick-Launch	SELFCERT.EXE	selfcert.exe is a stand alone program for creating your own digital certificates for macros - the .exe is installed as an extra basically by clicking on MS Office in add/remove programs and selecting remove - also I would do away with the FriendlyWebQuickLaunchBar as well
U	FRISK FP-Scheduler	F-Sched.exe	"Scheduler for F-Prot anitvirus software. Leave enabled unless you scan manually on a regular basis"
?	FRITZ!DSL Startcenter	StCenter.exe	"FRITZ! ISP software ""StartCenter"" User interface that allows you to manage
U	FRITZ!webProtect	FwebProt.exe	Firewall included in FRITZ! ISP DSL software
N	Fromine WinPopup	winpopup.exe	Instant Messenger program
X	froody	timoty.exe	Added by an unidentified malware
X	Frsk	frsk.exe	Unidentified adware downloader trojan
X	frun	derc32xz.exe	Added by an unidentified TROJAN!
Y	FRW_EXE	FRW.EXE	"ConSeal Signal9 firewall - now McAfee Personal firewall"
Y	frxmxins	frxmxins.exe	ATI 3D Studio MAX/VIZ driver
?	FSDPSRV	FSDPSRV.exe	"??"
X	fsdsft	[path to backdoor]	"Added by the RANKY.S BACKDOOR!"
Y	fspr	FolderShield.exe	"Folder Shield - hide personal files and folders"
N	FSScrCtl	FSScrCtl.exe	Screen saver control applet used by the "Stardust Screen Saver Toolkit" and "SolidWorks Screen Saver"
U	fsserv	fserv.exe	"Farsighter Server - monitors a remote computer invisibly by streaming video to a viewer on your computer. You will know exactly what is happening on the remote computer as you see it in real-time"
X	fstsvc	"rundll32.exe fstsvc.dll	start"
U	FSWebServer	fsws.exe	"Easy File Sharing Web Server is a Windows program that allows you to host a secure peer-to-peer and web-based file sharing system without any additional software or services"
X	FTP FOR WINDOWS	ftpwin32.exe	"Added by a variant of the RBOT WORM!"
X	FTPGraber	FTPGraber.exe	"Added by the DLOADER-DT TROJAN!"
N	FTPManager	FTPDM.exe	"""Robust FTP is a Windows-based file transfer client application that transfers files between a user's local PC and another
?	FtpServer.exe	FtpServer.exe	"Part of the Sharpdesk from Sharp Electronics. ""A desktop-based
U	ftutil2	"rundll32.exe ftutil2.dll	SetWriteCacheMode"
X	FU	FUvirus.exe	"Added by the VB-EJC TROJAN!"
X	Fucker	fucker.vbs	"Added by the CATCHER-A WORM!"
U	Fujitsu Hotkey Utility	IndicatorUty.exe	"Fujitsu Hotkey Utility displays icons on the screen when you use hotkeys on a Fujitsu Siemens Lifebook
X	fukerservice	fukerz.exe	"Added by a variant of the RBOT WORM!"
X	FUKLBAR	bar.exe	"PurityScan adware"
N	FullAudio	WMPImporter.exe	Used to import settings from Windows Media Player into Music Now software (from www.musicnow.com - which is no longer available) and possibly others
N	FusionHdtvTray	FusionHdtvTray.exe	"FusionTrayAgent - main executable for DVICO FusionHDTV software. It adds an icon to system tray that allows you to easily access Fusion HDTV software"
U	FusionRC	FusionRC.exe	"Remote control manager for DVICO FusionHDTV"
U	FusionRemote	FusionRc.exe	"Remote control manager for DVICO FusionHDTV"
N	FusionTrayAgent	FusionHdtvTray.exe	"FusionTrayAgent - main executable for DVICO FusionHDTV software. It adds an icon to system tray that allows you to easily access Fusion HDTV software"
X	FW Manager	fwcheck.exe	"Added by the DELBOT-H WORM!"
X	Fwr Command Module	fwr.exe	"Added by the SDBOT-PP WORM!"
N	fwrastrc	fwrastrc.exe	Dial-up software for Friendly Technologies/1NationOnLine free ISP
U	fwservice	fwservice	"eAcceleration Stop-Sign security software related. Previously not recommended
X	FX	ieloader.exe	Added by the SMALL.RR TROJAN!
X	Fxoekm	miyhart.exe	"Added by the SDBOT-CZQ WORM!"
U	fxredir	fxredir.exe	Canon MultiPASS fax redirector
X	f~a	ra32.exe	"Added by the CAY TROJAN!"
X	G00123	[worm filename]	"Added by the BUGBROS WORM!"
X	G4G	[random filename]	Detected as Trojan-Downloader.Win32.VB.fki
U	G6FTP Server Tray Monitor	G6FTPTray.exe	"System Tray monitoring tool for Gene6 FTP Server - ""an advanced FTP server software for Windows developed specifically for security and high performance requirements"""
?	GACService	GACService.exe	"Related to a Gemplus product. What does it do and is it required?"
N	Gadwin PrintScreen	PrintScreen.exe	"Gadwin PrintScreen - utility to capture
U	Gainward	TBPanel.exe	Configuration utility for Gainward graphics cards. Not required unless you use non-default settings. Available via Start -> Settings -> Control Panel
X	game	patcher.scr	"Added by the PSW-ED TROJAN!"
N	Game Device	JOYUPDRV.EXE	Genius game controller profile activator
N	GameDrive	GDTask.exe	"GameDrive from FarStone - virtual CD/DVD drive emulator that allows you to run your PC games without the disc. Available via Start → Programs"
X	Games Acceleration	svshost.exe	"EasySearch adware"
X	Games Acceleration	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Games Acceleration	svshost1.exe	"Added by the DLOADR-AWD TROJAN!"
X	Games toolbar	rundll32.exe [path] tbGame.dll DllShowTB	"Topconverting.com/180Search ""Games Toolbar"" adware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
N	GameTracker	GTLite.exe	"GameTracker - ""Keep track of and launch all your games from one application with the Game Tracker Client. Instantly announce on your profile and to your friends what game and on which server you are playing!"""
U	GARO Status Monitor	cnwism.exe	Print monitor for certain Canon printers
X	gaSrv	gaSrv.exe	"Detected by Panda as the DOWNLOADER.ALQ TROJAN! Adware downloader"
X	gaSrve	gaSrve.exe	"Detected by Panda as the DOWNLOADER.ALQ TROJAN! Adware downloader"
X	Gate Personal Firewall	Systpl.exe	"Added by the RBOT.ADC WORM"
N	Gateway Extended Warranty	GWCares.exe	Gateway Extended Warranty reminder
X	Gator	gator.exe	"Gator eWallet adware. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	Gator eWallet	gator.exe	"Gator eWallet adware. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
Y	GBMPro7Agent	GBMAgent.exe	"Genie Backup Manager Pro 7 - backup software"
U	GBTray	GBTray.exe	"System Tray icon access to Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
X	gcasDtServ	gcasDtServ.exe	Added by an unidentified WORM or TROJAN. Note - this is not related to Microsoft Antispyware which has a process bearing the same name which doesn't appear as a startup
Y	gcasServ	gcasServ.exe	"Giant Antipsyware - now superseded by Microsoft's Windows Defender"
X	gcasServ	realsched.exe	"Added by a variant of the TACTSLAY.A TROJAN! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name"
?	GCC Reminder	gccrem.exe	"Associated with AcraMax Greeting Card Creator. Is it a registration reminder?"
N	GCS	GrabClipSave.exe	"GrabClipSave screen capture tool"
X	GDAX	[path to backdoor]	"Added by the RANKY.K TROJAN!"
X	Gddlib	"rundll32.exe gddlib.dll	start"
Y	GDFirewallTray	GDFirewallTray.exe	"System Tray access to the firewall part of G Data range of internet security products"
U	GDMgr.exe	gdmgr.exe	"GuardMon is a commercial surveillance software program designed to monitor all forms of user activity on a computer"
N	GDrive	GDriver.exe	Found on IBM systems. All it does is set the CDROM drive letter to G:. Set your drive letter manually via Start -> Settings -> Control Panel -> System -> Device Manager
N	Gearbox	confsvr.exe	"NTL's Gearbox software for configuring internet connections with their NTLWorld software - does a similar job to the Internet Connection Wizard which can be used instead using the dial-up details available here"
N	GEARsec	gearsec.exe	Installed by Apple Quicktime package - iPod®/iTunes® CDRW support. Can be disabled if you only require Quicktime player
X	Gekio Startups	gnksvc32.exe	"Added by the AGOBOT.AFJ WORM!"
N	GemStRmW	GemStRmW.exe	"For a GemPlus smart card reader. If it doesn't start automatically when you insert the smart card
X	gencroot	gencroot.exe	"Added by the SDBOT-AED WORM!"
U	Gene USB Monitor	USBMonit.exe	Monitors USB ports for insertion of Sandisk USB flashdrives
X	General Antivirus	GenAvir.exe	"General Antivirus rogue security software - not recommended
X	general lptt01	general.exe	"RapidBlaster variant (in a ""General"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	general ml097e	general.exe	"RapidBlaster variant (in a ""General"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Generic host proccess for windows	SVCHOSTS.EXE	"Added by the SPYBOT-GQ WORM!"
X	Generic Host Process	SCHOST.EXE	"Added by the RBOT-NC WORM!"
X	Generic Host Process	svchost.exe	"Added by the DLOADER-NX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Generic Host Process	camacttiv.exe	"Detected by AVG as the CIADOOR.13 TROJAN!"
X	Generic Host Process	lsassw.exe	"Added by the AGOBOT-N WORM!"
X	Generic Host Process for Win Services	mscvs.exe	"Added by a variant of the SDBOT WORM!"
X	Generic Host Process for Win32 Service	svlhost.exe	"Added by the WOOTBOT.EX WORM!"
X	Generic Host Process for Win32 Service	rpchost.exe	"Added by the IRCBOT.DCN WORM!"
X	Generic Host Process for Win32 Services	ntspcv.exe	"Added by the SDBOT.S TROJAN!"
X	Generic Host Process for Win32 Services	intspvc.exe	"Added by the DINFOR.D WORM!"
X	Generic Host Process for Win32 Services	winsvc.exe	"Added by the SDBOT-O WORM!"
X	Generic Host Process for Win32 Services	bazzi.exe	"Added by the AHKER.E WORM!"
X	Generic Host Process for Win32 Services	winsvc32.exe	"Added by the SDBOT-P WORM!"
X	Generic Host Process for Win32 Services	lspsvc.exe	"Added by the MUMU.C WORM!"
X	Generic Host Process for Win32 Services	SPSVC.EXE	"Added by the SDBOT.DA WORM!"
X	Generic Host Process for Win32 Services	svchost32.exe	"Added by the AGOBOT.ALH WORM!"
X	Generic Host Process for Win32 Services	svñhîst.exe	"Added by the DLOADER.AK TROJAN!"
X	Generic Host Process for Win32 Services	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Generic Host Process For Win32 Services	mtsc32.exe	"Added by the VB-CPL TROJAN!"
X	Generic Host Process for WinXP Services	mshelp.exe	"Added by the AGENT-GQP TROJAN!"
X	Generic Host Process2 System Backup	scvhost2.exe	"Added by the RBOT-BAH WORM!"
X	Generic Host Process326a System Backup	scvhost326a.exe	"Added by a variant of the SDBOT WORM!"
X	Generic Host Service	lshost.exe	"Added by the RBOT.LU WORM!"
X	Generic Service Process	regsvc32.exe	"Added by the GAOBOT.UJ or GAOBOT.UL WORMS!"
X	Generic Service Process	serv1ces.exe	"Added by the AGOBOT-JK WORM!"
X	Generic Service Process	nvsvc.exe	"Added by the AGOBOT.BY WORM! Note - this is not the valid NVIDIA Driver Helper Service and is located in %System%"
X	Generic Service Process	srvhost.exe	"Added by the AGOBOT-FX WORM!"
X	Generic Service Process	regsvr32.exe	"Added by the AGOBOT-AGD WORM!"
X	Generic Service Process	SRCHOST.EXE	"Added by the AGOBOT-DG WORM!"
X	Generic Services Process	regsvc32.exe	"Added by the GAOBOT.SY WORM!"
X	GenericHostXP	WinLoaderXP.exe	"Added by the BDOOR-ACX BACKDOOR!"
Y	Genie USB Monitor	USBmonitor.exe	Port monitor for an external USB hard drive. Required to enable access to the drive
X	Genius Mose Driver	svghost.exe	"Added by a variant of the SPYBOT WORM! See here"
X	genserv path	sdqdqg.exe	"Added by the SDBOT-RF WORM!"
X	Geography TX 1.0 NT	CompuSpeed.vbs	"Added by the NEWLEY-A WORM!"
X	Gerenciamento de arquivos do Windows	Winmod32.exe	"Added by the DLOADER-WG TROJAN!"
X	german.exe	winsystems.exe	"Added by the BAGLEDl-AE TROJAN!"
X	german.exe	wintems.exe	"Added by the BAGLE-AS TROJAN!"
X	Gestionnaire de disques universel	sysoobe.exe	"Added by the TOADER-A TROJAN!"
X	Get-Torrent Service	wakeservice.exe	Get-Torrent bittorrent client - Installs LOP adware
X	GetitAll	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	GetMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	GetRight	GetRight.exe	"GetRight from Headlight Software - shareware download manager for resuming downloads and choosing multiple download locations. The Pro version adds uploading and other features. Earlier 4.x versions included ads
U	GetRight - Tray Icon	getright.exe	"Entry added with older versions of the GetRight download manager from Headlight Software
X	GetTheMusic	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	Getting started with MacDrive	MDGetStarted.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
X	gfxtray	"rundll32 ctccw32.dll	findwnd"
X	Ghost Antivirus	GhostAV.exe	"Ghost Antivirus rogue security software - not recommended
X	Ghost Relay	[random filename]	"Added by the DNSCHANG.EK TROJAN!"
U	GhostSecuritySuite	gss.exe	"Ghost Security Suite - protect the registry from unauthorized reading and modification and other tools"
N	GhostStartService	GhostStartService.exe	"Required to run the Windows based wizard in Norton Ghost - added from the 2003 version. Will start automatically when you run the wizard"
N	GhostStartTrayApp	GhostStartTrayApp.exe	"System Tray access to Norton Ghost - added from the 2003 version"
Y	GhostSurfDelSatellite	DeleteSatellite.exe	"Part of SpyCatcher spyware remover from Tenebril. Prevents rogue programs from sending personal information to a remote user via the Internet. If you use SpyCatcher with real time scanning
U	Giganews Accelerator	GiganewsAccelerator.exe	"Giganews Accelerator from Giganews
Y	Gilat SOM Enumerator	dllhost.exe	For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system
X	gimmygames	[path to trojan]	"Added by the DLOADR-LN TROJAN!"
X	GLF Network Lan Monitor	NPFMNTOR.exe	"Added by the RBOT-AGY WORM!"
X	Global Startup	WinDash.EXE	"Detected by Kaspersky as the VB.Q WORM!"
X	GlobalFlagACER	ACER.exe	"Added by the VB.BL WORM!"
X	GlobalSCAPE	[random filename]	"Added by the RBOT-AYM WORM!"
X	GNP Generic Host Process	svchost.exe	"Added by the ZAPCHAS-F BACKDOOR! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	go	cvir.exe	"Added by the SILOV-A WORM!"
X	Go And Start	svdll32.exe	"Added by the RBOT.AI BACKDOOR!"
X	Go!Zilla Monster Downloads	Go.exe	Download manager for resuming downloads and choosing multiple download locations. Advertising spyware
U	GoBack	GBTray.exe	"System Tray icon access to Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
U	GoBack Polling Service	GBPoll.exe	"Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
U	GoBack Tray Icon	GBTray.exe	"Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
X	goidr	goidr.exe	"Goidr adware"
U	Goldensoft_MndlSvr	MndlSvr.exe	"Goldensoft CD Ghost related - turns a computer into a 200X-speed CD-ROM tower. Working from the hard drive
X	Golum	services.exe	"Added by the GOLUM.A TROJAN! Note - this is not the legitimate services.exe process
X	golumm	services.exe	"Added by the DLOADER-ET TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""golumm"" subfolder"
X	good	badvir.exe	"Added by the SILOV-B WORM!"
U	Google Desktop Search	GoogleDesktop.exe	"Google Desktop - ""a desktop search application that provides full text search over your email
X	Google Earth	[random filename]	"Added by the RBOT-AXK TROJAN!"
N	Google Earth Viewer	GOOGLEMAPS.EXE	"Google Earth ""combines satellite imagery
U	Google IME Autoupdater	GooglePinyinDaemon.exe	"Google Pinyin Input Method Editor (IME) - allows a user to input Chinese characters by entering the pinyin of a Chinese character (with or without tone
X	google Intrenet Explorer	google.pif	"Added by the RBOT-ARA WORM!"
U	Google Quick Search Box	GoogleQuickSearchBox.exe	"Part of Google Toolbar (from version 6 onwards) for IE. The Quick Search Box sits between the ""Start"" button and Quick Launch toolbar and ""lets you easily search both your computer and the Web from a slick-looking search box that comes up only when you need it"""
X	Google service	Googlesetup.exe	"Added by the IRCBOT-RJ WORM!"
X	Google Service FR	GO0GLEFREE.EXE	"Added by a variant of the SPYBOT WORM!"
X	google toolbar	ggtb32.exe	"Added by the AGOBOT-RR WORM!"
N	Google Updater	GOOGLE~1.EXE	"Downloads and installs updates for Google applications (Google Earth
N	Google Updater	GoogleUpdater.exe	"Downloads and installs updates for Google applications (Google Earth
U	GoogleQuickSearchBox	GoogleQuickSearchBox.exe	"Part of Google Toolbar (from version 6 onwards) for IE. The Quick Search Box sits between the ""Start"" button and Quick Launch toolbar and ""lets you easily search both your computer and the Web from a slick-looking search box that comes up only when you need it"""
U	GoogleToolbarNotifier	GoogleToolbarNotifier.exe	"Part of Google Toolbar (from version 4 onwards) for IE. ""Google Toolbar Notifier allows you to set Google as your default search engine and prevents your search settings from being changed without your consent. An icon in your system tray blinks if the Notifier identifies an attempt to change your default search engine. You can click the icon to get more details and allow the change"". There was a bug in earlier versions where disabling the option resulted in the entry still running at startup but this has now been resolved"
X	GoogleUpdater3	GoogleMapper.exe	"Added by the ROUTROBOT WORM!"
U	GoTrusted	GoTrusted Secure Tunnel.exe	"""GoTrusted is the fast
X	gouday.exe	readme.exe	"Added by the BEAGLE.C WORM!"
X	govurarope	"Rundll32.exe retasevo.dll	s"
X	GP Updater	gpupdater.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	GPLv3	[random name].dll	"Vundo adware"
X	gqgqqger	gqgeqegl.exe	"Added by the SDBOT-CLJ WORM!"
N	GRA	gra.exe	"Looks at system resources at startup and warns you if they have dropped. Contains links to the Disk Clean Up
?	gramdate	2Stop.exe	"??"
X	Graphic Driver	smss32.exe	"Added by a variant of the RBOT WORM!"
X	Graphic Loader	ntvdm32.exe	"Added by a variant of the RBOT WORM!"
X	Graphic Update	openglx.exe	"Added by the IRCBOT.AMU WORM!"
X	Graphics	_default.pif	"Added by the AUTOSKY WORM!"
X	Graphics adapter service	windll.exe	"Added by the ATNAS.A WORM!"
U	Gravis Appawareloader	dbserver.exe	"Looks like it's associated with Gravis game controllers and the Keyset Manager
U	Gravis Xperience Driver Support	Grxp4exe.exe	"Driver for Gravis game controllers such as the Eliminator Aftershock. Must be loaded if you run the supplied application software for the controller to be recognized. Start it manually via a shortcut if not used"
?	GrdSys32	GrdSys32.exe	"X-Stream ISP software. Offers free Net access funded by on-screen ads. Is it required or can you create your own dial-up networking connection to use on demand?"
X	GreasyPalmUpdate	GreasyPalmUpdate.exe	"SearchFast adware"
X	GreatDefender	GreatDefender.exe	"GreatDefender rogue security software - not recommended
X	GreatDefender.exe	GreatDefender.exe	"GreatDefender rogue security software - not recommended
X	GreatDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
N	Greetings Workshop	GWREMIND.EXE	You really want to be reminded about somebody's birthday at the expense of resources?
X	gremier	wscript.exe gpremier.vbs	"Added by the GPREMIER WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""gpremier.vbs"" file is located in %System%"
X	Gremlin	intrenat.exe	"Added by the DOOMJUICE WORM!"
X	grgtgvgb.exe	[random].exe	"Added by the AGENT-EBF TROJAN!"
X	grinders	grinders.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
N	Grokster	Grokster.exe	"Grokster Peer-To-Peer File Sharing program"
Y	Groove Virtual Office	Groove.exe	"""Groove Virtual Office uses a peer-to-peer networking model to connect users in Groove Workspaces. In these workspaces geographically dispersed coworkers can do almost everything they could do in the same office. They can hold online meetings
U	GrooveMonitor	GrooveMonitor.exe	"Part of MS Office Groove - a stand-alone product or included with the Enterprise/Ultimate versions of MS Office 2007. ""A collaboration software program that helps teams work together dynamically and effectively
U	GrooveMonitor Utility	GrooveMonitor.exe	"Part of MS Office Groove - a stand-alone product or included with the Enterprise/Ultimate versions of MS Office 2007. ""A collaboration software program that helps teams work together dynamically and effectively
U	GroupWise PDA Connect - 3CmPlm	AutoDet.exe	"3Com Palm PC specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
U	GroupWise PDA Connect - GrpWse	Agnt.exe	"GroupWise PDA Connect PDA synchronisation utility - from Novell"
U	GroupWise PDA Connect - PocketPC	AUTODE~1.EXE	"Windows Mobile Pocket PC specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
U	GroupWise PDA Connect - ScheduleSync	SCHEDU~1.EXE	"ScheduleSync specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
N	GrpConv	grpconv.exe	"Microsoft Windows Program Group Converter - used by installers (ONLY in the RunOnce keys) - provides the translation of groups and group items to folders and links. Also see this MS Knowledge Base article"
?	GsiFinal	"rundll32 gspndll.dll	postInstall final"
?	GSISETUP	[path] GsiInst.exe INSTALL [path] V205Res 13	"BT Voyager ADSL modem related - what does it do and is it required?"
N	GSOrganizer	GSOrganizer.exe	"GoldenSection Organizer (now WinOrganizer - personal information manager)"
Y	gStart	gStart.exe	gStart GPS software from Garmin
X	GStartup	GMT.exe	"Gator spyware component - see here. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	GT15J4R49V	cpuserv.exe	Identified as a variant of the Trojan.Win32.Radi.gu malware
U	GTVRec	GTVRec.exe	"Part of Got All Media - control your TV tuner and other utilities from your PC"
X	gtydf	ggrrgg.exe	"Added by the DLOADR-AZK TROJAN!"
U	Guard	Guard.exe	"Related to Phoenix Technologies Core Managed Environment (cME) Integration and Certification program"
X	Guard Pro	VH339.exe	"Guard Pro rogue security software - not recommended
X	GuardCenter	GuardCenter.exe	"GuardCenter rogue security software - not recommended"
Y	GuardGui Application	GuardGui.exe	"System Tray access to the main user interface for Ashampoo® AntiVirus from Ashampoo GmbH & Co. KG."
U	Guardian	CMGrdian.exe	"McAfee Guardian shortcut menu on the System Tray (looks like a castle) given access to Internet Security
U	Guardian PC Security Tools	Pfft.exe	"Boomerang Software's Guardian PC Security Tools - now rebranded as the eXtendia Security Suite"
X	GuardPcs.exe	GuardPcs.exe	"GuardPcs rogue security software - not recommended
X	GuardWWW	GuardWWW.exe	"GuardWWW rogue security software - not recommended
X	guarnset	guarnset.exe	"Adlogix adware"
X	GURL	gurl.exe	"GURLWatcher spyware"
U	GuruNet	GuruNet.exe	"GuruNet lets you click on any word on your screen to get the relevant information you want"
X	gvagfxj	rundll32 ...gvagfxj.dll	"Unidentified adware
Y	gw port controller	PORTCT95.EXE	"From a visitor - "I must keep it active in start up or my Lexmark printer and RCA Cam program cannot discover a working port to work". From the file properties
N	GWInkMonitor	GWInkMonitor.exe	"Gateway ink monitor - makes an annoying popup that says your printer may be running out of ink
X	gwiz	arpl.exe	"Detected by F-Prot as W32/Downloader-Sml-based"
X	G_Server.exe	G_Server.exe	"Added by the FEUTEL-C TROJAN!"
X	G_Server1.2.exe	G_Server1.2.exe	"Added by the GRAYBIRD-Z TROJAN!"
X	h4te Service Drivers	h4te.exe	"Added by a variant of the RBOT WORM!"
U	Habu	razerhid.exe	"Microsoft Habu (by Razer) gaming mouse driver - required if you use the additional features and programmed keys/macros"
U	HalifaxHowardCluster	skinkers.exe	"""Howard the Weatherman"" desktop client from Halifax by Skinkers - marketing/messaging tool. Leave enabled if you want to receive messages"
U	HaMFrontPanel	hampanel.exe	"Displays a panel simulating modem lights for the Intel HaM internal modem. The lights are useful as a reminder to disconnect from the net if you are likely to forget
N	Hard Disk Sentinel	HDSentinel.exe	"Hard Disk Sentinel - a multi-OS hard disk drive monitoring application. Its goal is to find
X	Hard drive Controller	hdcontroller.exe	"Added by the KIMAN.B WORM!"
X	HardDriveGuard	SysRep.exe	"HardDriveGuard rogue system error and cleaning utility - not recommended
U	Hardware Doctor	Hwdoctor.exe	"Winbond Hardware Doctor - as included on some motherboard using Winbond's hardware monitoring chips. Displays fan speeds
X	Hardware Monitor Service	mshms.exe	"Added by the WOLLF-A TROJAN!"
X	Hardware Profile	hxdef.exe	"Added by the LOVGATE.AB WORM!"
X	Hardware Profile	hxdef.exe...	"Added by the LOVGATE.Z WORM!"
U	Hardware Sensors Monitor	hmonitor.exe	Utility to monitor fan speed and temperatures - similar to Motherboard Monitor. Only required if you're concerned about your system temperature - typically for "overclocked" systems
X	Hardware Shell Detection	WinHSD.exe	"Added by a variant of the RBOT WORM!"
U	Hare	hare.exe	"Hare - improve and optimize performance of desktop/laptop PCs"
U	Harmony 98 - CasioOrg	CasAgnt.exe	"Enterprise Harmony 98 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000"
X	HataDuzelticisi	SysRep.exe	"HataDuzelticisi
X	HATAPE	[path to trojan]	"Added by the BANKER-QF TROJAN!"
U	HawkEye IV Control Panel	HAWK_32.EXE	"Control Panel application for the old Number Nine graphics cards to change resolution
U	Hawking Wireless Utility	HWU8DD.exe	"Wireless management utility for the HWU8DD Hi-Gain™ USB Wireless-G Dish Adapter from Hawking Technologies
N	HC Reminder	hc.exe	"For Compaq PC's. Help Compiler
U	hcenter	tgcmd.exe	"Part of software from SupportSoft (aka Support.com) provided to manufacturers and ISPs that allows them to offer on-line support - to update drivers
U	hcenter	hcenter.exe	"Bellsouth help center. Part of software from SupportSoft (aka Support.com) provided to manufacturers and ISPs that allows them to offer on-line support - to update drivers
U	Hcontrol	hcontrol.exe	Hotkeys on an ASUS Notebook. Only required if you use the additional keys
U	HControlUser	HControlUser.exe	Hotkeys on an ASUS Notebook. Only required if you use the additional keys
N	hcsystray	hc_tray.exe	"Kuma Notifier for the Shootout! game from the History Channel. ""It lets you know whenever there's a new episode that's been released or an announcement from the Kuma team. Just click it to get up-to-the-minute game and event information"""
N	HD Audio Control Panel	RtHDVCpl.exe	"Realtek HD Audio Manager
X	HDAudio Driver 1.0	[random filename].exe	"Added by the TEADOOR-D TROJAN!"
X	HDAudio Driver 2.0	[random filename].exe	"Added by the TEADOOR-E TROJAN!"
U	HDDControlGuard	HDDControlGuard.exe	"Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access"
U	HDDControlGuard.exe	HDDControlGuard.exe	"Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access"
X	hdlpscom	[8 random letters].exe	"Added by the RBOT-FUL WORM!"
X	HDriveSweeper	HDriveSweeper.exe	"HDriveSweeper rogue privacy program - not recommended
N	HDtray	HDtray.exe	Philips Edge Series Control Panel Tray Utility - system tray icon for a Philips Edge series soundcards. Available via Start -> Settings -> Control Panel
X	he3bbcff	"rundll32.exe he3bbcff.dll	EnableRunDLL32"
X	he3e3fc4	"rundll32.exe he3e3fc4.dll	EnableRunDLL32"
X	Hekio Startups	Hnksvc32.exe	"Added by the AGOBOT-QE WORM!"
X	hellfire	svchost.exe	"Added by the LEOX.D TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	helloserv	helloserv.exe	"Added by the ZHELATI.BHA WORM!"
X	helloworld	nb32ext2.exe	"Added by the MYDOOM.BV WORM!"
X	helloworld	nb32ext3.exe	"Added by the MYTOB.JT WORM!"
X	helloworld3	nb32ext4.exe	"Added by the RITDOOR.A WORM!"
X	help	help.scr	"Added by the BANCOS-BBU TROJAN!"
X	Help	Wizardnil.exe	"Added by the BANCOS-BCZ TROJAN!"
X	Help Temp Files	netreg.exe	"Added by the FORBOT-EM WORM!"
U	HelpCenter	sprtcmd.exe /P HelpCenter	"Self-help support tool for BellSouth's FastAccess® DSL (now owned by AT&T) broadband service (provided by SupportSoft
U	HelpCenter4.1	sprtcmd.exe /P HelpCenter4.1	"Self-help support tool for BellSouth's FastAccess® DSL (now owned by AT&T) broadband service (provided by SupportSoft
X	Helper	eschlp.exe	"Added by the BLASTER.T WORM!"
X	HELPER	greece_nm.exe	"AsdPlug premium rate adult content dialer variant"
X	HELPER	Netherlands.exe	"AsdPlug premium rate adult content dialer variant"
X	HELPER	new_zealand.exe	"AsdPlug premium rate adult content dialer variant"
X	HELPER	sweden.exe	"AsdPlug premium rate adult content dialer variant"
X	HELPER	canada.exe	"AsdPlug premium rate adult content dialer variant"
X	HELPER	france.exe	"AsdPlug premium rate adult content dialer variant"
X	HELPER	temp532.exe	"AsdPlug premium rate adult content dialer variant"
X	helper.dll	rundll32.exe [path] helper.dll	"CnsMin (Chinese Keywords) hijacker related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	helpmanager	spoler.exe	"Added by the RANDEX.J WORM!"
Y	HEProtect	HSockPE.exe	"Part of the AntiSpam function of the HAURI ViRobot Desktop internet security suite"
?	HerculesCamService	CamService.exe	"Related to the Hercules Dualpix HD Webcam. What does it do and is it required?"
X	hErcUnes	softhost.exe	"Added by the GARROCH WORM!"
X	herjek	herjek.exe	"Added by the NUWAR.APJ WORM!"
U	Hermes Messenger	DGDRHE~1.EXE	"A LAN messenger alternative to WinPopUp - Digital Dreams Software"
X	Hewlett Packard Manager	hpmanager.exe	"Added by the MYTOB.KE WORM! Note - this is not a valid Hewlett-Packard program"
N	Hewlett Packard Recorder	Remind32.exe	HP multifunction registration
X	HF Security	hfsecure.exe	"Added by the AGOBOT-TI WORM!"
Y	hffsrv	hffsrv.exe	"Hide Files & Folders - ""great easy-to-use password-protected security utility working at Windows kernel level you can use to password-protect certain files and folders
Y	hffsrv.exe	hffsrv.exe	"Hide Files & Folders - ""great easy-to-use password-protected security utility working at Windows kernel level you can use to password-protect certain files and folders
N	HGTXPEI	FirstReboot.exe	Herucles Audio tool for the Hercules Game Theater XP soundcard. Available via Start -> Settings -> Control Panel
X	hhtnsn	rnxntup.exe	"Added by a variant of the ORCU.B TROJAN!"
?	HiberMonitor	HCount.exe	"??"
U	Hibernation	hib32.exe	"Reduces the power consumption when the laptop isn't being used to preserve battery power. Similar programs on other laptops reduce the processor clock rate
U	Hide and Protect any Drives for Win95/98/Me/2k/XP	HPDAgent.exe	"Loads Hide and Protect any Drives - which allows you to ""Protect Hard drive
X	HideRun.exe	Hiderun.exe and svhost.exe and pro.gif	"Added by the BOOHOO WORM!"
X	HideStyle	Ante Browse Trust.exe	"IE toolbar taking you to Lop.com. If the exe is running
U	Hidetools Spy Monitor	wmispe.exe	"HideTools Spy Monitor surveillance software. Uninstall this software unless you put it there yourself"