TS

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
Consume	"Consumer Input Rewarded with MyPoints	U	"ConsumerInputRewardedwithMyPoints
Consume	"Consumer Input Rewarded with MyPoints	U	"ConsumerInputRewardedwithMyPoints
ME"	"MS Java Applets for Windows NT	X	javaapplets.exe
N	%FP%012-L2TP fts.exe	fts.exe	012.Net.il Israeli ISP software front-end
N	%FP%1776 Internet fts.exe	fts.exe	1776 Internet US ISP software ISP software front-end
N	%FP%AIRTEL fts.exe	fts.exe	"Bharti Airtel Broadband - Indian ISP software front-end"
N	%FP%Barak013 fts.exe	fts.exe	Barak013 Israeli ISP software front-end
N	%FP%Friendly fts.exe	fts.exe	Friendly ISP software front-end
X	*winstats	winstats.exe	"Added by the GARGAFX TROJAN!"
U	12Ghosts Backup	12backup.exe	"12Ghosts Backup - ""Automatic Backups
U	12Ghosts Clip	12clip.exe	"12Ghosts Clip - ""Screen shots made easy"""
U	12Ghosts JustAWindow	12window.exe	"12Ghosts JustAWindow - ""Cover annoying ads
U	12Ghosts Popup-Killer	12popup.exe	"12Ghosts Popup-Killer"
U	12Ghosts SaveLayout	12autosl.exe	"12Ghosts SaveLayout - ""Always (always!) keep the layout of your desktop icons"""
U	12Ghosts SetColor	12color.exe	"12Ghosts SetColor - ""Change your desktop icon text colors
U	12Ghosts ShowTime	12showtime.exe	"12Ghosts Showtime - ""Enhance the clock in your tray with font formatting
U	12Ghosts Synchronize	12sync.exe	"12Ghosts Synchronize - ""Sync PC clock with an atomic clock over the Internet"""
U	12Ghosts Tower	12tower.exe	"12Ghosts Tower - ""Quickly access and manage all Ghosts (included in all packages)"""
U	12Ghosts TrayProtect	12srvc.exe	"12Ghosts TrayProtect - ""Hide tray icons
U	12Ghosts Wash	12wash.exe	"12Ghosts Wash - ""Protect your privacy
X	180ClientStubInstall	stubinstaller***.exe [ = digit]	"180Solutions adware related"
X	180ClientStubInstall	[path to trojan]	"180Solutions adware related"
X	180ClientStubInstall	*****.tmp [ = random digit/char]	"180Solutions adware related"
N	AccuWeatherDesktopAlerts	AccuWeatherDesktopAlerts.exe	"Weather alerts for AccuWeather.com Desktop which ""provides you with the most accurate
Y	acEventServ	acevtsrv.exe	"ActivCard Gold from ActivIdentity
X	AdobeFonts	fonts.hta	Browser hijacker - redirecting to Hugesearch.net
X	AdStatus Service	AdStatServ.exe	"WindUpdates AdStatus Service adware"
X	agentsvr	agentsvr.exe	"Detected by Kaspersky as Monker.A adware. Note - do not confuse with the Microsoft Agent Server application of the same name as described here - the legitimate file will always be located in the Windows\Msagent folder"
N	Album Fast Start	ABMTSR.EXE	"Scanner software
U	All Aboard Status	stswin.exe	"All Aboard! Internet Connection Sharing status icon"
X	Altnet	points manager.exe	"Altnet TopSearch adware"
X	AltnetPointsManager	points manager.exe	"Altnet TopSearch adware"
X	AltPayments	AltPayments.exe	"WeirdOnTheWeb adware"
N	Announcements	Annclist.exe	MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it
X	AOL Services Hosts	aolserviceshosts.exe	Added by an unidentified WORM or TROJAN!
U	AOL TopSpeedMonitor	aoltsmon.exe	"AOL's TopSpeed ""web-acceleration technology speeds up your web-browsing experience by storing and reusing elements of web pages that you visit
Y	Application	mdmsetsp.exe	"Aztech Labs modem driver"
X	Application Layer Scheduler	agtsvc.exe	"Added by the IRCBOT.BJJ BACKDOOR!"
X	assistse	ASSISTSE.EXE	"CnsMin (Chinese Keywords) hijacker related"
U	ATSpooler	AppsTraka.exe	"DeskTopScout keystroke logger/monitoring program - remove unless you installed it yourself!"
U	Auslogics BoostSpeed	boostspeed.exe	"System Tray access to Auslogics BoostSpeed system optimization utility - which allows you to ""Start programs faster. Speed up computer start time. Increase Internet speed
U	Auslogics BoostSpeed 4	boostspeed.exe	"System Tray access to Auslogics BoostSpeed 4 system optimization utility - which ""Start programs faster. Speed up computer start time. Increase Internet speed
X	avnort	formatsys.exe	"Added by the SERFLOG.A WORM!"
X	BatSrv	batserv2.exe	"Detected by Kaspersky as the LOCKSY.M WORM!"
N	BBC Alerts	BBC_Alerts.exe	"BBC Alerts - ""You can now have all the latest news and sports headlines delivered straight to your desktop with the new BBC Alerts service"""
U	BBC News alerts	skinkers.exe	"BBC News Desktop Alerts service - see here. Desktop alert and breaking news e-mail services let you find out about all the latest news as it happens"
X	BestsellerAntivirus	pgs.exe	"BestsellerAntivirus rogue security software - not recommended
U	BestSync 2008	BestSyncApp.exe	"System Tray access to BestSync® 2008 from Risefly Software - ""a professional utility for synchronizing files between your local folders and Network Drives
N	BJ Printer Status Monitor	Cjstsr.exe	Canon BJ printer status monitor
U	BoostSpeed	boostspeed.exe	"System Tray access to Auslogics BoostSpeed 4 system optimization utility - which ""Start programs faster. Speed up computer start time. Increase Internet speed
X	Boot Server	bootserver.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Boot Service	bootservice.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Boot Service	bootsv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
?	Boots Insert Detect	InsDetect.exe	"Part of Boots Picture Suite. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
X	BootsCfg	wscript.exe [path] Date.POP.vbs	"Added by the KUULLIO WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbs	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbe	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe Install.log.vbs	"Added by the YPSAN.E WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""Install.log.vbs"" file is located in %System%"
X	bootsec	NAVSSE.exe	"Added by the FORBOT-CY WORM!"
Y	BootSkin Startup Jobs	BootSkin.exe	"Stardock BootSkin is a program that allows users to change their Windows 2000 and Windows XP boot screens"
U	BootStatus	BOOTST~1.EXE	"Visual Basic program that pops up a small window on startup telling you how many times the machine has been booted that day. Once you exit it
?	BTSETBOOTKEY	BTSetBootKey.exe	"Related to a USB Bluetooth adaptor. What does it do and is it required?"
U	BtStart	btstart.exe	"Broadcom (formerly WIDCOMM) Bluetooth Connectivity Software"
N	BudgetSip	BudgetSip.exe	"BudgetSip - internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X	caidiysetup	diynetsetupuni.exe	"DIYNet adware"
X	catsrv	catsrv.exe	"Added by the PAPLOK TROJAN!"
N	CDANTSRV	CDANTSRV.exe	"C-Dilla License Management software. Used for any program that uses C-dilla Protection
Y	CertStoreInit	CertStoreInit	"Aladdin eToken authentication and password management"
U	ChatStat	ChatStat.exe	"ChatStat from ChatStat Technologies
X	chostsv	chostsv.exe	"Added by the BANPAES.C TROJAN!"
U	Client Access Taskbar	cwbuitsk.exe	"IBM iSeries Client Access taskbar
?	Clotusorgreg0	prtStart.exe [path] Orgprt.exe	"IBM Lotus SmartSuite related. In a LotusOrgReg folder. Unclear what exactly it does?"
X	cmds	vtsqn.dll	"Added by a variant of the VUNDO TROJAN!"
U	CognizanceTS	"rundll32.exe [path] AsTsVcc.dll	RegisterModule"
X	COM+ Event System	DRWTSN16.EXE	"Added by the LOVGATE.AB WORM!"
X	COM+ EventSystem Services	ECSERVER.EXE	"Added by a variant of the SDBOT WORM!"
X	ComcastSUPPORT	tgkill.exe	Comcast (the cable folks who are replacing @home in some parts of the USA) have struck a deal with Tioga to provide an "enhanced" support and self-repairing tool. This is "beta" at present and was made available to download by mistake at present. Remove via Start -> Settings -> Add/Remove Programs
X	Compaq Service Drivers	ntsys32.exe	"Added by the RBOT.CIW WORM!"
X	ConfidentSurf	GDC.exe	"ConfidentSurf rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	Configuration	ntsys32.exe	"Added by the SDBOT-LN WORM!"
X	Configuration Loader	botss.exe	"Added by the SDBOT-XS WORM!"
N	CONNECTAuto Update	CONNECTScheduler.exe	"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
N	CONNECTScheduler	CONNECTScheduler.exe	"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
X	ContentService	winservn.exe	"PurityScan adware - see here"
N	Corel Colleagues & Contacts Reminders	cffrem.exe	"Corel Colleagues & Contracts - all-in-one organizer for scheduling meetings
X	cpntmgc	winmgts.exe	"Added by the WINTRIM-B TROJAN!"
X	CPU Windows Status	cpustats.exe	"Added by a variant of the RBOT WORM!"
X	Crc32stats Dependencies	Crc32stats.exe	"Added by the MYTOB.GT WORM!"
?	CreativeTaskScheduler	CTSched.exe	"Creative Task Scheduler. What does it do and is it required?"
X	CS	tsc.exe	"Cyber Security rogue security software - not recommended
X	cscripts	cscripts.exe	"Added by the BDOOR-AAP BACKDOOR!"
X	CT Control Settings	CTSVCCD.EXE	"Added by the RBOT-YS WORM!"
?	CTSched	CTSched.exe	"Creative Task Scheduler. What does it do and is it required?"
N	CTStartup	CTEaxSpl.exe	Splash screen with sound on every boot up. Installed with a Sound Blaster Audigy soundcard
U	CTSVolFE	CTSVolFE.exe	Creative Labs Mixer applet for the Sound Blaster Audigy
U	CTSVolFE.exe	CTSVolFE.exe	Creative Labs Mixer applet for the Sound Blaster Audigy
N	CTSyncU.exe	CTSyncU.exe	"Creative Sync Manager - synchronizes music tracks on your computer with your player"
U	CTsysVol	CTSYSVOL.exe	Creative sound card volume controls
X	DefenseNetSurfage	GDC.exe	"DefenseNetSurfage rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
?	Description of Shortcuts	*.exe	"* seems to be a sequence of alphanumerics that can be different
X	dgtstart	dgtstart.exe	"DigitalNames.g adware"
X	directs.exe	directs.exe	"Added by the BEAGLE.O or BEAGLE.R or BEAGLE.S or BEAGLE.T WORMS!"
X	Disk Essensial Tools	detsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
Y	DLBTCATS	"rundll32 [path] DLBTtime.dll	_RunDLLEntry@16"
Y	DLBUCATS	"rundll32 [path] DLBUtime.dll	_RunDLLEntry@16"
Y	DLBXCATS	"rundll32 [path] DLBXtime.dll	_RunDLLEntry@16"
Y	DLCCCATS	"rundll32 [path] DLCCtime.dll	_RunDLLEntry@16"
Y	DLCDCATS	"rundll32 [path] DLCDtime.dll	_RunDLLEntry@16"
Y	DLCFCATS	"rundll32 [path] DLCFtime.dll	_RunDLLEntry@16"
Y	DLCGCATS	"rundll32 [path] DLCGtime.dll	_RunDLLEntry@16"
Y	DLCICATS	"rundll32 [path] DLCItime.dll	_RunDLLEntry@16"
Y	DLCJCATS	"rundll32 [path] DLCJtime.dll	_RunDLLEntry@16"
Y	DLCQCATS	"rundll32 [path] DLCQtime.dll	_RunDLLEntry@16"
Y	DLCXCATS	"rundll32 [path] DLCXtime.dll	_RunDLLEntry@16"
U	DLink System Tray	dlnetst.exe	"Related to D-Link DGE-530T PCI card for servers and workstations"
X	DRam Monitor 23	tskman3.exe	"Added by a variant of the RBOT WORM!"
X	drmsrv32	stmhosts.exe	"Added by the AGENT.AGWU TROJAN!"
X	DrWatson	drwatson_.exe	"Added by the LOHAV-S TROJAN!"
X	DrWatson	drwatson_32.exe	"Added by the LOHAV-S TROJAN!"
X	DsplObjects	windspl.exe	"Added by the BEAGLE.DN WORM!"
U	DVDBitSet	DVDBitSet.exe	DVD+RW Drive/Disc Compatibility Setting. Installed with HP DVD+RW drives to enhance compatibility with existing readers. You can also set a DVD+RW default drive write mode which is always used
U	EasySync Pro - LtNts4	NtsAgent.exe	"Lotus Notes 4 specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
?	ERTS0749	ERTS0749.exe	"IBM Warranty Notification - presumably it's a reminder to either register or that warranty is about to expire?"
N	evntsvc	evntsc.exe	"Application Scheduler installed along with RealOne Player. Once installed
X	f73cdc8ee94e	btsendto.exe	Associated with mysearchnow.com/searchbar.html
X	fastsmell	fastsmell.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X	FastStart	ntnut32.exe	"Added by the STARTPAGE.L TROJAN!"
X	FastStart	svcnut.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
X	FastStart	svcnut32.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
U	FingerPrintSoftware	fpapp.exe	Supports the fingerprint reader on selected IBM/Lenovo Thinkpad notebooks
X	FontsLoader	ldfnt32.hta	Unidentified malware
N	Forbes	ForbesAlerts.exe	Forbes Business News Alerts - displays business news headlines in a little window on the screen
X	fstsvc	"rundll32.exe fstsvc.dll	start"
U	Fujitsu Hotkey Utility	IndicatorUty.exe	"Fujitsu Hotkey Utility displays icons on the screen when you use hotkeys on a Fujitsu Siemens Lifebook
U	Fujitsu Menu	FjMnuIco.exe	"From the ""Fujitsu Menu"" tray icon you have instant access to the Control Panel
N	Gadwin PrintScreen	PrintScreen.exe	"Gadwin PrintScreen - utility to capture
X	gcasDtServ	gcasDtServ.exe	Added by an unidentified WORM or TROJAN. Note - this is not related to Microsoft Antispyware which has a process bearing the same name which doesn't appear as a startup
X	Generic host proccess for windows	SVCHOSTS.EXE	"Added by the SPYBOT-GQ WORM!"
X	Generic Host Process for Win32 Services	ntspcv.exe	"Added by the SDBOT.S TROJAN!"
X	Generic Host Process for Win32 Services	intspvc.exe	"Added by the DINFOR.D WORM!"
X	Generic Host Process For Win32 Services	mtsc32.exe	"Added by the VB-CPL TROJAN!"
N	Get Smile	getsmile.exe	Puts smilie faces in your E-mail. Run manually when required
U	Getting started with MacDrive	MDGetStarted.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
U	GhostSecuritySuite	gss.exe	"Ghost Security Suite - protect the registry from unauthorized reading and modification and other tools"
N	GhostStartService	GhostStartService.exe	"Required to run the Windows based wizard in Norton Ghost - added from the 2003 version. Will start automatically when you run the wizard"
N	GhostStartTrayApp	GhostStartTrayApp.exe	"System Tray access to Norton Ghost - added from the 2003 version"
Y	GhostSurfDelSatellite	DeleteSatellite.exe	"Part of SpyCatcher spyware remover from Tenebril. Prevents rogue programs from sending personal information to a remote user via the Internet. If you use SpyCatcher with real time scanning
X	GotSmiley	GotSmiley.exe	"GotSmiley - ad supported program that provides the user with smileys for use in emails. Not recommended. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	gwiz	ntsystem.exe	"Added by the NITWIZ.A TROJAN!"
X	hachimitsu-lemon	hachimitsu-lemon.exe	"Added by the HACHILEM TROJAN!"
X	hdlfoe df98ndf	svchots.exe	"Added by a variant of the RBOT WORM!"
N	Holiday Lights	Holiday Lights.exe	"Holiday Lights from Tiger Technologies. Festive desktop enhancement that adds lights. Available via Start -> Programs"
X	Hollaback	slvhosts.exe	"Added by the SDBOT.BMO WORM!"
X	hostserv	hostserv.exe	"Added by the RBOT.BPZ WORM!"
X	hostserv	wiz98.exe	"Added by a variant of the SDBOT WORM!"
U	HostsFileMgr	winHostsEdit.exe	"AdBin from Gilmore Software Development. An easy solution to managing your Window's hosts file"
U	HostsMan	hm.exe	"""HostsMan is a freeware application that lets you manage your Hosts file with ease"". It is mainly intended to block specific domains (mostly advertising servers) by redirecting them to localhost
X	HostSrv	sachostx.exe	"Added by the LOOKSKY.H WORM! Drops multiple files in %System%"
X	HostSrv	sachostx.exe	"Added by the LOOKSKY.A or LOOKSKY.F or LOOKSKY.G WORMS!"
X	HostSrv	sachostx.exe...	"Added by the LOOKSKY.E WORM!"
X	HostSVC syse	HostSVC.exe	"Added by the RBOT-ANZ WORM!"
N	HotSync Manager	hotsync.exe	Installed when connecting a Palm HotSync cradle up to a USB port. The Blue and Red Arrow Icon that enables Palm / Handspring Synchronizing. Available via Start → Programs
X	Hot_Tarts	Hot_Tarts.exe	Adult content dialler
X	Hot_Tarts_**	Hot_Tarts_**.exe	Premium rate adult content dialer (where * is a random char)
X	Hot_Tarts_Au	Hot_Tarts_Au.exe	Premium rate adult content dialler
X	Hot_Tarts_mc	Hot_Tarts_mc.exe	"HotTarts adult content dialer"
N	HP JetSpeed Autostart	AUTOSTART.EXE	Autostart executable for the old multiplayer game HP Jetspeed
U	HPDJ Taskbar Utility	hpztsb01.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb02.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb04.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb05.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb07.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb09.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb06.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb08.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb03.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb10.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb11.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb12.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb13.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
N	HPZTS04	hpzts04.exe	Hewlett Packard printer toolbox shortcut that resides in the system tray
U	hpztsb02	hpztsb02.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	hpztsb04	hpztsb04.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	hpztsb05	hpztsb05.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	hpztsb07	hpztsb07.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	hpztsb09	hpztsb09.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	hpztsbol	hpztsbol.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
X	htssv32.exe	htssv32.exe	"Added by a variant of the SDBOT TROJAN!"
?	IBM Warranty Notification	ERTS0749.exe	"IBM Warranty Notification - presumably it's a reminder to either register or that warranty is about to expire?"
U	IBMUltraBayHotSwapCPLLoader	IBMBAY2N.EXE	Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops
?	IBMUltraBayHotSwapSound	IBMBAYSN.EXE	"Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops. Is it needed though - does it just play a sound?"
N	ietsr	ietsr.exe	"IEClean by Kevin McAleavy - cookie manager
X	IExploer	svshosts.exe	"Added by the IRCBOT.BT TROJAN!"
X	igfxtras	svchots.exe	"Added by the AUTORUN-AIW WORM!"
X	ine	svchosts.exe	"Added by the RBOT.BNL WORM!"
X	INET	inetsync.exe	"Meplex adware"
X	InetServices	wsock32.exe	"Added by the WOCK32-A TROJAN!"
X	Internet Config	svchosts.exe	"Added by the SDBOT TROJAN!"
X	Internet Firewall Layer	tsqla.exe	"Added by a variant of the SPYBOT WORM!"
X	Internet Server	inetsrv.exe	"Added by the STARTPA-EM TROJAN!"
X	Internet Services	Netsvc.exe	"Added by the MYTOB.MN WORM!"
X	InternetShield	INTERN~1.EXE	"InternetShield rogue security software - not recommended
X	InternetShield	InternetShield.exe	"InternetShield rogue security software - not recommended
U	InternetSpy	InternetSpy.exe	"Internet Spy - freeware keylogger that tracks all visited websites including the date and exact time these sites were visited. The information is stored in a file that may be accessed by the person who knows where it is saved. Remove unless you installed it yourself!"
X	IntSys1	[path to trojan]	"Added by the BANLOA-ASE TROJAN!"
Y	Intuit SyncManager	IntuitSyncManager.exe	"Synchronizes local Intuit Quickbooks data with online data - ""Use the Intuit Sync Manager to find the status of your latest QuickBooks data sync
X	IPv6 STUN Service	netstun.exe	"Added by a variant of the SDBOT WORM!"
N	ISDN Monitor	Linksts.exe	"Tray icon which gets installed when you install the drivers for Asuscom internal ISDN modem cards (or rebadged Asuscom ISDN cards
X	IST Service	istsvc.exe	"ISTBar adware"
Y	ISTray	pctsTray.exe	"System Tray access to both PC Tools Internet Security suite and Spyware Doctor antispyware from PC Tools"
N	ItsDeductiblePopUp	ItsDeductible.exe	"ItsDeductible from Income Dynamics. Calculates your noncash donations quickly and easily. This startup entry checks a registry entry for the next 'PopUp' date and if it is a past or current date displays a program related tip"
X	jutsu	jutsu.exe	"Added by the RBOT-LS WORM!"
X	Kernel Faults	ftphost.exe	"Added by the RBOT.BHU WORM!"
X	Kernel32	svchosts.exe	Added by an unidentified WORM or TROJAN!
N	Kodak Picture Transfer Software	pts.exe	Looks for Kodak camera connection and media insertion. Available via Start -> Programs
U	Laplink PDASync 3.0 - LtNts4	NtsAgnt.exe	"Laplink PDASync for (IBM) Lotus Notes 4 - PDA synchronisation utility"
X	LetsRock	[path to trojan]	"Added by the RANKY.Y BACKDOOR!"
X	LetsSearch	LetsSearch.exe	"BrowserAid/BrowserPal foistware"
N	lhttseng	"rundll32.exe ..lhttseng.inf	RemoveCabinet"
N	Lightscribe	LightScribeControlPanel.exe	"System Tray access to the LightScribe Control Panel for CD/DVD writers based upon HP's LightScribe laser-etching process - which allows you to burn a label straight onto specially coated blank disks. Part of the main LightScribe System Software (LSS)"
N	LightScribe Control Panel	LightScribeControlPanel.exe	"System Tray access to the LightScribe Control Panel for CD/DVD writers based upon HP's LightScribe laser-etching process - which allows you to burn a label straight onto specially coated blank disks. Part of the main LightScribe System Software (LSS)"
N	LightScribeControlPanel	LightScribeControlPanel.exe	"System Tray access to the LightScribe Control Panel for CD/DVD writers based upon HP's LightScribe laser-etching process - which allows you to burn a label straight onto specially coated blank disks. Part of the main LightScribe System Software (LSS)"
N	Linksts	linksts.exe	"Tray icon which gets installed when you install the drivers for Asuscom internal ISDN modem cards (or rebadged Asuscom ISDN cards
X	LoadFonts	LoadFonts.vbs	Homepage hijacker that changes your homepage to an adult content site
X	LoadFonts	Tahoma.vbs	Homepage hijacker that changes your homepage to an adult content site
U	LoadFujitsuQuickTouch	QuickTouch.exe	Maps the keys on a Fujitsu Siemens Lifebook application panel to various programs and functions
N	Logiciel de transfert d'images KODAK	pts.exe	Looks for Kodak camera connection and media insertion. Available via Start -> Programs
X	LotsOfGames	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	LotsOfJokes	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	LSASS Authority	lshosts32.exe	"Added by the SDBOT-UY TROJAN!"
X	LSASS Authority	lsvhosts.exe	"Added by the SDBOT.BCE WORM!"
N	LTSMMSG	LTSMMSG.exe	"Lucent Tech. Soft Modem Messaging application - may be found on Fujitsu Lifebook
X	LTSMSG	Shell32.exe	"Added by the LEMIR.B TROJAN!"
X	ltssvc	"rundll32.exe ltssvc.dll	start"
X	ltwob	formatsys.exe	"Added by the SERFLOG.A WORM!"
Y	LXBSCATS	"rundll32 [path] LXBStime.dll	_RunDLLEntry@16"
Y	LXBTCATS	"rundll32 [path] LXBTtime.dll	_RunDLLEntry@16"
Y	LXBUCATS	"rundll32 [path] LXBUtime.dll	_RunDLLEntry@16"
Y	LXBXCATS	"rundll32 [path] LXBXtime.dll	_RunDLLEntry@16"
Y	LXBYCATS	"rundll32 [path] LXBYtime.dll	_RunDLLEntry@16"
Y	LXCCCATS	"rundll32 [path] LXCCtime.dll	_RunDLLEntry@16"
U	LXCDCATS	"rundll32 [path] LXCDtime.dll	_RunDLLEntry@16"
Y	LXCECATS	"rundll32 [path] LXCEtime.dll	_RunDLLEntry@16"
Y	LXCFCATS	"rundll32 [path] LXCFtime.dll	_RunDLLEntry@16"
Y	LXCGCATS	"rundll32 [path] LXCGtime.dll	_RunDLLEntry@16"
Y	LXCJCATS	"rundll32 [path] LXCJtime.dll	_RunDLLEntry@16"
Y	LXCQCATS	"rundll32 [path] LXCQtime.dll	_RunDLLEntry@16"
Y	LXCRCATS	"rundll32 [path] LXCRtime.dll	_RunDLLEntry@16"
Y	LXCTCATS	"rundll32 [path] LXCTtime.dll	_RunDLLEntry@16"
Y	LXCYCATS	"rundll32 [path] LXCYtime.dll	_RunDLLEntry@16"
Y	LXDBCATS	"rundll32 [path] LXDBtime.dll	_RunDLLEntry@16"
Y	LXDCCATS	"rundll32 [path] LXDCtime.dll	_RunDLLEntry@16"
Y	LXDDCATS	"rundll32 [path] LXDDtime.dll	_RunDLLEntry@16"
Y	LXDICATS	"rundll32 [path] LXDItime.dll	_RunDLLEntry@16"
U	LXDJCATS	"rundll32 [path] LXDJtime.dll	_RunDLLEntry@16"
X	MaxAlerts	max.exe	Bonzi MaxALERT - spyware
Y	McAfee Managed Desktop Agent	MYAGTSVC.EXE	"Part of the now obsolete McAfee Managed VirusScan anti-virus and anti-spyware security tool for small businesses. Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows NT/2K/XP"
Y	MCTskShd	mctskshd.exe	"Part of older versions of McAfee's internet security products such as VirusScan and VirusScan Online and used to schedule tasks such as automatic updates
U	MDGetStarted	MDGetStarted.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
U	MDGetStarted.exe	MDGetStarted.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
X	Media Server	msdts.exe	"Added by a variant of the IRCBOT TROJAN!"
U	Mediafour MacDrive	MDGetStarted.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
X	Messenger	ntsubsys.exe	"Added by the SDBOT.BGE WORM!"
X	Messenger Protocol	netsender.exe	"Added by the SDBOT-ACC WORM!"
X	Micosoft Data Core stuff	svshosts.exe	"Added by the RBOT.FZA WORM!"
X	Microsoft	netsrv.exe	"Added by the RBOT-GOS WORM!"
X	Microsoft	ntsvr.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Digital Cryptors	mdigits.exe	"Added by the SDBOT.LM WORM!"
X	Microsoft Hosts Service	Isass.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Initialization Service	initsvc.exe	"Added by the IRCBOT.AXK BACKDOOR!"
X	Microsoft Initialization Services	initserv.exe	"Added by the IRCBOT-ABO TROJAN!"
X	Microsoft Int Service	MsIntSrv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Internet Explorer	svchosts.exe	"Added by the BANCBAN-U TROJAN!"
X	Microsoft Internet Syncing	inetsync.exe	"Added by the IRCBOT.BLL BACKDOOR!"
X	Microsoft Lmhosting Service	lmhosts.exe	"Added by the RBOT-RC WORM!"
X	Microsoft Macro Protection SubSsy	msacroprots386.exe	"Added by the RBOT-KE WORM!"
X	Microsoft Scanreg	microsoftscanreg.exe	"Added by the FRANRIV.A WORM!"
X	Microsoft Security Pansasagers	dgkztsqgn.exe	"Added by the RBOT-BBJ WORM!"
X	Microsoft Synchronization Manager	netscape.exe	"Added by the RANDEX.AE WORM!"
X	Microsoft Synchronization Manager	svchosts.exe	"Added by the SDBOT-LM WORM!"
X	Microsoft System Checkup	ntsysmgr.exe	"Added by the DONK.S WORM!"
X	Microsoft System Checkup	ntsysman.exe	"Added by the SDBOT-QW WORM!"
X	Microsoft System File	svchots.exe	"Added by the RBOT.BYU WORM!"
X	Microsoft System Security Agent	MSTSA.EXE	"Added by the RBOT.CCM WORM!"
X	Microsoft Update	bnmveqfts.exe	"Added by the BANLOAD.KWQ TROJAN!"
X	Microsoft Update	ntservice.exe	"Added by the AGENT-DIS TROJAN!"
X	Microsoft Update	SetPoints.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Update Machine	ntsystem.exe	"Added by the RBOT.GF WORM!"
X	Microsoft Updaters	tskmgr.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updates	wgcptsud.exe	"Added by the RBOT-GTF WORM!"
X	Microsoft UpToDate Driver (32-bits)	[random filename].exe	"Added by the SPYBOT.LXJ WORM!"
X	Microsoft Video Controls	tskmsgr.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Windows	windets.com	"Added by the FLOOD-EQ TROJAN!"
X	Microsoft Windows Updater	TMNTSrv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Word	BootSector.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsofts Help Services	msnmngr.exe	"Added by the SDBOT-PJ WORM!"
X	Microsofts media	winmplayd.exe	Added by an undidentified WORM or TROJAN!
X	Microsofts media	wingtp.exe	"Added by the RBOT-VO WORM!"
X	Microsofts MediaScope	winmep.exe	"Added by the RBOT-WB WORM!"
X	Microsofts MediaScope	winmedplay.exe	"Added by a variant of the RBOT WORM!"
X	Microsofts Security Manager	**.exe [** = random char]	"Added by the RBOT-WH TROJAN!"
X	Microsofts Service	lcsrv16.exe	"Added by a variant of the RBOT WORM!"
X	Microsofts Updates	lsasss.exe	"Added by the RBOT-AEX WORM!"
X	Microsofts Updatez	cmsssr.exe	"Added by an unidentified VIRUS
X	Microsofts Updatez	exploirez.exe	"Added by a variant of the RBOT WORM!"
X	MicrosoftServiceManager	mstask32.exe	"Added by the YAHA.P WORM!"
X	MicrosoftServiceManager	Wintsk32.exe	"Added by the YAHA.U WORM!"
X	MicrosoftServiceManager	EXPLORERE.EXE	"Added by the YAHA.AB WORM!"
X	MicrosoftServiceManager	msupdat.exe	"Added by the YAHA.AA WORM!"
X	MicrosoftShell	Shellcomm.exe	"Added by the BANCBAN-QG TROJAN!"
X	MicrosoftSourceSafe	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	MicrosoftSourceSafe	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	MicrosoftSys	SPOOLSYS.exe	"Added by the TARNO.N TROJAN!"
X	Microsong	svchosts11.exe	"Added by the SDBOT-EV WORM!"
X	Mircosoft Sockets SP2	mssck.exe	"Added by the MYTOB.ET WORM!"
Y	MMTASK	mmtask.tsk	"A check on the file's properties reveals "Multimedia background task support module". MMTASK is a very simple 16-bit program used by certain multimedia drivers (which are still 16-bit on Win9x) to perform background processing. Some soundcards need this to support MIDI
X	MoreResults	MoreResults.exe	"MoreResults adware"
X	Mozilla Firebird v0.8 Internet Browser	netstats.exe	"Added by the IRCBOT.MC TROJAN!"
N	Mozilla Quick Launch	Netscp6.exe	Netscape 6 and Mozilla browsers
X	mptsgsvc.exe	mptsgsvc.exe	"Hacker Tool - detected by DiamondCS TDS-3 anti-trojan as ""HackTool.Win32.Hidd.j"""
X	MQT Svc	mqtsvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Ms Configuration	microsoftsa32.exe	"Added by the KELVIR.X WORM!"
X	MS Hosts	msthosts.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	MS Java Applets for Windows NT & XP	javaapplet.exe	"Added by the RBOT.BHG WORM!"
X	Ms task manager	tskmgr.exe	"Added by the SDBOT.CCD WORM!"
X	MS taskbar	nts.exe	"Added by the RBOT-AGB WORM!"
X	MS taskmanager	tskmgr.exe	"Added by the RBOT-AKA WORM!"
X	MS Updates	syshosts.exe	"Added by the MYDOOM.Y WORM!"
X	Ms Valud Loader	Svhots.exe	"Added by the AGOBOT-SP WORM!"
X	msappts32	msappts32.exe	"Added by the ELBURRO-A TROJAN!"
X	MSFWAVTSM	FTPDev.exe	"Added by the RBOT-ACF WORM!"
X	Mshosts	Mshosts.exe	"Added by the STARTPAG.CF TROJAN!"
X	MSMNTMTS	MSMNTMTS.EXE	"Added by the BANKER-GZ TROJAN!"
X	MSN	netstats.exe	"Added by the IRCBOT.UXP WORM!"
X	MSPetServ	PET32.EXE	"Added by the IRCBOT-VE WORM!"
X	mstsdsc.exe	mstsdsc.exe	"Added by the CIMUZ-CD TROJAN!"
X	Msupdate	svchosts.exe	"Added by a variant of the TACTSLAY TROJAN!"
Y	MyCIO Agent Service	myagtsvc.exe	"Part of the now obsolete McAfee VirusScan ASaP online anti-virus and anti-spyware security tool for small businesses. Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows NT/2K/XP"
U	mynsw	wntsrv.exe	"Net Screen Watcher surveillance software. Uninstall this software unless you put it there yourself"
X	MyPointsPointAlert	wjview ...MyPointsPointAlertrun.exe	"""With MyPoints you can earn rewards from name-brand merchants. You can even earn vacations and frequent flyer miles"". Dubious privacy policy"
X	MyTotalSearch Email Plugin	mtsoemon.exe	"MyTotalSearchBar adware"
N	NB Common Dialog Enhancements	COMDLGEX.EXE	"Part of McAfee Nuts & Bolts. With Common Dialog Enhancements
X	NC1565	winntsrv -l -p10001 -d -e cmd.exe -L	"Added by the NEWLEY-A WORM!"
X	Ndtstat	Ndtstat.exe	Added by a variant of the BANLOAD family of TROJANS!
X	Nero.ma	*.exe [* = 2 to 3 digits]	"Added by the JONBARR.D WORM!"
U	NeroHomeFirstStart	NMFirstStart.exe	"Associated with Nero Scout
X	NET Bios Stats	ntbstats.exe	"Added by the SDBOT-ZX WORM!"
X	NET protection system	netst.exe	"Added by the RIZO.A TROJAN!"
X	NetManagerService	ntss.exe	"Added by the BESTPICS.A TROJAN!"
U	Netscape	InstallService.exe	Related to Netscape installation
N	Netscape Messenger	NETSCAPE.EXE	"In Netscape 6 (I know for sure with 6.2.1
N	Netscp6	Netscp6.exe	Netscape 6
U	NetScreen-Remote	SafeCfg.exe	"NetScreen Remote VPN client software"
X	NetService	ntsvc.exe	"Added by the QQPASS-DU TROJAN!"
X	netservices	recall.exe	"Added by the WOOTBOT.D WORM!"
X	netservices	svchostn.exe	"Added by the SDBOT.GI WORM!"
X	NETServices	csxrs.exe	"Added by a variant of the SDBOT WORM!"
U	NetShow Powerpoint Helper	NSPPTHLP.EXE	"If disabled
X	NetStart	svchost.exe	"Added by the MKAR-A VIRUS! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""NETSTART"" subfolder"
N	NetStat Live	Nsl.exe	"AnalogX NetStat Live - TCP/IP protocol monitor which can be used to see your exact throughput on both incoming and outgoing data"
X	NetSurfageAssure	GDC.exe	"NetSurfageAssure French rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	netsv32	netsv32.exe	"Added by the SDBOT-PX WORM!"
X	netsv32	sv.exe	"Added by the DELF.CCD TROJAN!"
X	Network Service Manager	netsvc.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Network Services	netsvacs.exe	"Added by the GAOBOT.AIS WORM!"
X	Network Translation System Service	ntss.exe	"Added by the UNPDOOR TROJAN!"
X	Networks Controler	Netsis.exe	"Added by the RBOT-NG WORM!"
X	NI.USYP	SysProtectScannerInstall.exe	"Installer for the SysProtect rogue security software
U	NMFirstStart	NMFirstStart.exe	"Associated with Nero Scout
?	nMTaskBarService	nMtsk.exe	"Taskbar control for ISDN NetMod modem. What does it do and is it required?"
N	Nokia FastStart	NokiaMusic.exe	"Part of the Nokia Music music manager. ""With Nokia Music
X	Norton Personal Firewall	winmpts.exe	"Added by the RBOT.ANT WORM!"
X	nstat	netstat.exe	Adult content dialler
X	NT Services	ntsvc.exe	"Added by the AGOBOT.VJ WORM!"
X	Nt System Protocol	ntsystem.exe	"Added by the RBOT.DSB TROJAN!"
X	NTSet32	services.exe	"Added by the WINSPY-C TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\dll32"
X	NTSF Microsoft System	fylez.exe	"Added by a variant of the RBOT WORM!"
X	NTSF MICROSOFT SYSTEM	wntsf.exe	"Added by the RBOT.ATC WORM!"
X	NTSF MICROSOFT SYSTEM	fufffy.exe	"Added by the RBOT-AEL WORM!"
X	NTSF MICROSOFT SYSTEM	ntssf.exe	"Added by a variant of the RBOT WORM!"
X	NTSF MICROSOFT SYSTEM	scvhost.exe	"Added by a variant of the RBOT WORM!"
X	NTSF MICROSOFT SYSTEM	winsis32.exe	"Added by a variant of the RBOT WORM!"
X	NTSF MICROSOFT SYSTEM	marya.exe	"Added by the RBOT-AXY WORM!"
X	NTSF MICROSOFT SYSTEM	sysman.exe	"Added by the RBOT.EDP WORM!"
X	ntsmod	ntsmod.exe	"Adware downloader/installer
X	NTsocket	NoeWinnt.exe	"Added by the ATAKA-E TROJAN!"
X	NTSpool	NTSpool.exe	"Added by the AGENT-GPY TROJAN!"
X	NTsrv.exe	NTsrv.exe	"Added by a variant of the SERVU-O TROJAN!"
X	Ntsysv	ntsysv.exe	"Added by the MIFENG-E TROJAN!"
X	Numerical Xterm Agents	2x32.exe	"Added by the RBOT-FWY WORM!"
X	NvCplScan	netstat32.exe	"Added by the SDBOT.BRL WORM!"
X	Oesi	srts.exe	"PurityScan adware"
N	OM2_Monitor	FirstStart.exe	"Olympus Master 2 - digital camera management tools"
N	OM_Monitor	FirstStart.exe	"Olympus Master 1 - digital camera management tools"
X	Optimum Online	Netsurf.exe	OptimumOnline ISP software related spyware - displays advertising popups and collects information about user activity
U	PartSeal	PartSeal.exe	System backup for Sony Vaio PCs. Adds a recovery mechanism for users over and above any System Restore features - allowing users to revert a drive back to the state it was when bought form the factory by hitting F10. The user obviously loses any data stored if not backed-up elsewhere
N	PC Pitstop Optimize Reminder	Reminder.exe	"Registration reminder for the PC Pitstop Optimize 2.0 system optimizatoon utility by CA. Located in %ProgramFiles%\PCPitstop\Optimize2"
U	PC Pitstop Optimize Scheduler	PCPOptimize.exe	"Scheduler for the Optimize system optimization utility from PC Pitstop"
N	PCPitstop Registration Reminder	Reminder.exe	"Registration reminder for the Exterminate antimalware package from PC Pitstop"
U	PCPitStopEraser	PCPitStopErase.exe	"""PC PitStop Erase is both a free privacy scanner and paid tracks cleaner"""
U	pctspk	pctspk.exe	Used for modems based upon PC-TEL chipsets. Normally used for some Voice and Speakerphone functions and also for some Power management options. If you remove it you may not be able to use any of those functions
Y	pctsTray	pctsTray.exe	"System Tray access to both PC Tools Internet Security suite and Spyware Doctor antispyware from PC Tools"
Y	pctsTray.exe	pctsTray.exe	"System Tray access to both PC Tools Internet Security suite and Spyware Doctor antispyware from PC Tools"
U	PDUiP6000DTskbr	PDUiP6000DTskbr.exe	"Memory Card Utility for the Canon PIXMA iP6000D photo printer - which allows ""your computer to access the memory card reader feature of your printer"""
U	PerfectSuite	dthtml.exe	"PerfectSuite™ from ViewSonic. Rebranded version of Display Tune from Portrait Displays
X	pestsweeper	pestsweeper.exe	"PestSweeper rogue security software - not recommended
X	Pex Sound Driver	Today's Results.vbs	"Added by the TRODE-A WORM!"
X	pex Sound driver 2	Today's Results.vbs	"Added by the TRODE-A WORM!"
U	PHIME2002A	TINTSETP.EXE	"Microsoft's Input Method Editor for Asian languages which is used to both display and enable the input of characters in e-mails
U	PHIME2002ASync	TINTSETP.EXE	"Microsoft's Input Method Editor for Asian languages which is used to both display and enable the input of characters in e-mails
N	PivotSoftware	wpctrl.exe	"PivotPro from Portrait Studios - allows a screen to be rotated to match rotated LCD screens
N	PMTSHOOT	pmtshoot.exe	MS tool for troubleshooting power management problems
X	pnpsvc_lock	startsvs.exe	Browser hijacker
X	Points Manager	points manager.exe	"Altnet TopSearch adware"
X	PostSetupCheck	Rundll32.exe atgban.dll	"TrafficSol adware variant. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""atgban.dll"" file is found in %System%"
X	postSetupCheck	Rundll32.exe gzmrt.dll	"TrafficSol adware variant. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""gzmrt.dll"" file is found in %System%"
X	PostSetupCheck	Rundll32.exe cpmsky.dll	"TrafficSol adware variant. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""cpmsky.dll"" file is found in %System%"
X	postsos	post.exe	"Added by the TATERF-Z WORM!"
X	printer	SpyAssaultScanner.exe	"SpyAssault spyware remover - not recommended
N	PrintScreen	UNWISE.EXE	"Gadwin PrintScreen - utility to capture
N	Printscreen 95	PRT95MIN.EXE	"Printscreen 95 - utility to capture
U	PrintSpooler	lass.exe	"Win-Spy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	PrintSpoolSv	System.exe	"Added by the BDOOR-S BACKDOOR!"
X	ProtectSoldier	ProtectSoldier.exe	"ProtectSoldier rogue security software - not recommended
X	ProtocolEventTsk	csrwjd.exe	"Added by the STINX-N TROJAN!"
X	prutsct	prutsct.exe	"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
N	Ptsnoop	Ptsnoop.exe	"These descriptions I've come across - all valid as far as I can see :- (1) Program installed with some modems that monitors the COM ports for the modem driver. Not required from what I've read - may need a registry edit to get rid of it (2) Backdoor trojan virus that copies itself as PTSNOOP.EXE -see here for more info(3) Apparently the people who put it out claim it's a driver for a Voice modems (don't know who they are though - Ed) Note: If using AOL and you disable this you may lose your connection or lock up (4) Can also be an older Logitech scanner program. Remove from the Win.ini tab under Load='path'PTSNOOP and the System.ini tab under drivers='path'ptrtkr.drb. Can cause parallel port conflicts big time dragging system resources way down when a conflict exists (5) Allows audio monitoring of modem phone dialling tones and can be useful if you have connection problems (6) Karen Kenworthy's Snooper - ""logs the start and stop time of all programs run under Windows"""
X	PTSShell	PTSShell.exe	"Added by the WINKO.AO WORM!"
U	PWSActivePrint_5	ActivePrintSystem.exe	"ActivePrint from Pocket Watch LLC - ""Windows Mobile users are given the invaluable capability of printing from their mobile devices to any Windows 2000/XP/2003/Vista compatible printer without the necessity of wireless hardware"""
N	QTSTUB.EXE	Qtstub.exe	Part of an old version of the Quick Tax application. It enables Quick Tax Calendar Popup to show tax calendar reminders
X	QTSvc	msocfg.exe	Premium rate adult content dialler
X	QTSvc	navchk.exe	Premium rate adult content dialler
X	QTSvc	shman.exe	Premium rate adult content dialler
X	QTSvc	ssvr.exe	Premium rate adult content dialler
X	RavUptets	agetlke.exe	"Added by the QQPASS-AK TROJAN!"
N	RealJukeboxSystray	tsystray.exe	System Tray icon for RealJukebox
X	Regedit	regedits.exe	"Added by the BANCBAN-QV TROJAN!"
U	RegHelp	svchosts.exe	"SpyGraphica spy software - ""Stealth monitoring of ALL PC or Network Activity with DVD-like playback. EVERY keystroke can be e-mailed in a detailed activity report every 15 minutes...anywhere in the world."""
X	Remote Terminal Task	rtsbsvc.exe	"Added by the IRCBOT.AUZ BACKDOOR!"
X	Restore Operation	svchots.exe	"Added by a variant of the RBOT WORM!"
U	RNBOStart	sentstrt.exe	Program used to initialise the VxD virtual driver for Sentinel drivers associated with Rainbow H/W keys that plug-in to the parallel port. These are usually supplied with workplace design tools and restrict the use of the software only to the machine to which the H/W key is connected. Required if you have such tools
X	RSync	netsync.exe	"SafeSurfing adware"
?	RTStartMute	N/A	"??"
X	Run Services as Application	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	runner1	retadpu[random digits].exe	"Added by the SMALL.CTV TROJAN!"
X	runner1	tsitra.exe	"Added by the AGENT.ABFQ TROJAN!"
X	RVC6Player	tskdbg.exe	"Added by the ZAPCHAS-M TROJAN!"
U	SAGENTSERVICE	Sagent.exe	"TinySpyAgent commercial keystroke logger. Uninstall this software if you did not install it yourself"
Y	ScriptSentry	Scriptsentry.exe	"Script Sentry from Jason's Toolbox. Blocks malicious scripts and allows safe scripts to run. Only required if you want it to check the file associations it guards at startup. It will function regardlessly"
X	sdchosts32	vbdd.exe	Added by the RANKY.AG TROJAN!
X	SDKcore Update Components2	SDKC0R3.exe	"Added by the RBOT-ABA WORM!"
U	SecretSmileys	ss.exe	"""Secret Smileys is an add-on for AIM that provides users access to 1000's of new Smileys that can be viewed by anyone using a current version of AIM. Secret Smileys also adds other features such as logging of IM conversations
X	Security Accounts Manager SM	samsm.exe	"Added by the SPYBOT.JE WORM!"
X	serpe	formatsys.exe	"Added by the SERFLOG.A WORM!"
X	Service Host	svchosts.exe	"PornCleanser spyware"
X	services	Svchosts.exe	"Added by the SDBOT-N TROJAN!"
X	Services Administrator	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Management Clients	servc.exe	"Added by the RIZO.A TROJAN!"
X	Services Managements	servcs.exe	"Added by the RBOT-GUC WORM!"
X	SicherheitsTool	SysRep.exe	"SicherheitsTool
U	SightSpeed	SightSpeed.exe	"SightSpeed Video Chat - ""lets you connect with all your friends and family easily. Make video calls
N	SigmatelSysTrayApp	stsystra.exe	System tray program for the Sigmatel Audio sound card. Often found on Dell computers
X	SilentSoftech	[worm filename]	"Added by the SILLYFDC-BL WORM!"
X	SilentSoftech	SilentSo.exe	"Added by the AUTORUN-ANU WORM!"
N	Simcast	SimcastAlerts.exe	"Simcast is a free service that allows you to subscribe to information on a large variety of topics. Alerts will appear on your desktop when a channel that you have subscribed to has something to say"
X	SmartSecurity	SmartSecurity.exe	"Smart Security rogue security software - not recommended
U	SmartSync Pro	SmartSync.exe	"Related to CompanionLink Software Inc. Synchronization solutions for ACT!
X	softIce Update 32	wininits.exe	"Added by the RBOT-ANB WORM!"
X	SoftSafeness	SoftSafeness.exe	"SoftSafeness rogue security software - not recommended
X	SoftSoldier	SoftSoldier.exe	"SoftSoldier rogue security software - not recommended
X	SoftStronghold	SoftStronghold.exe	"SoftStronghold rogue security software - not recommended
U	SoftStuff Wallpaper Changer	softstrt.exe	"AzureBay wallpaper changer"
X	sounofts	sounofts.exe	"Added by the AGOBOT-ND WORM!"
X	sountskmanager	sountaskmgr	Added by an unidentified WORM or TROJAN!
N	Speed racer	CTSRReg.exe	Software for a Creative sound card
X	Spooler SubSystem Application	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	spoolsv	scvhosts.exe	"Added by the SMALL-AW TROJAN!"
U	Sprint SmartView	SprintSV.exe	"Sprint SmartView wireless connectivity manager which supports cards from multiple manufacturers including Intel
U	Spybot-S&D	SpybotSD.exe	"Main program part of the popular Spybot - Search & Destroy spyware removal tool from Safer Networking Limited. A number of other options are available if this runs at start up (enabled under Mode → Advanced : Settings → Settings → Automation → System Start) - including autocheck
U	SpybotSD	SpybotSD.exe	"Main program part of the popular Spybot - Search & Destroy spyware removal tool from Safer Networking Limited. A number of other options are available if this runs at start up (enabled under Mode → Advanced : Settings → Settings → Automation → System Start) - including autocheck
Y	SpybotSD TeaTimer	TeaTimer.exe	"Part of the popular Spybot - Search & Destroy spyware removal tool from Safer Networking Limited. ""Resident TeaTimer is a tool of Spybot-S&D which perpetually monitors the processes called/initiated. It immediately detects known malicious processes wanting to start and terminates them giving you some options
U	SpybotSnD	SpybotSD.exe	"Main program part of the popular Spybot - Search & Destroy spyware removal tool from Safer Networking Limited. A number of other options are available if this runs at start up (enabled under Mode → Advanced : Settings → Settings → Automation → System Start) - including autocheck
X	SpywareSoftStop	SpywareSoftStop.exe	"SoftStop rogue security software - not recommended"
Y	SR Agent	AGENTSVC.EXE	"Related to Secure Resolutions - desktop virus protection"
?	sr1exe	updtSup3.exe	"Found on a Dell computer in Documents and Settings\All Users\Application Data\DellAlert2"
X	Start It Upping	svchosets.exe	"Added by a variant of the RBOT WORM!"
X	Start Upping	windupdts.exe	"Added by a variant of the RBOT WORM!"
X	Start Uppings	svcchosts.exe	"Added by the SDBOT.VY WORM!"
X	startkey	CKOTS.exe	"Added by the BIFROSE-HM TROJAN!"
U	StartSecurDoc	SDPin.exe	"SecurDoc from WinMagic Inc - ""Provides full disk encryption to protect sensitive information stored on laptops
U	StartStop	STARTSTOP.EXE	"StartStop from TFI Technology - startup manager"
U	StartSurfing	STARTS.exe	"Start Surfing allows you to protect your privacy while surfing and searching the Internet by acting as a "filter" between you and the website you are visiting. Startsurfing acts as your shield from Pop Up Windows
U	StationPlaylistStudio	SPLStudio.exe	"StationPlaylist Studio - ""simple to use on-air broadcast playback software for the studio and/or DJ"" for small to medium sized radio broadcasters
X	Statistics	statslist.exe	"Added by the OPANKI-S WORM!"
U	StopSignSsTsMon	"sstsmon.dll	VerifyStatus"
U	STOPzilla Service	SZNTSVC.EXE	"StopZilla! - pop-up killer"
X	Sts	iwnujdss2.exe	"Added by the SDBOT-YI WORM!"
X	stxrmsgms	mstats.exe	"Added by the IRCBOT-AE TROJAN!"
U	Sunasdtserv	Sunasdtserv.exe	"CounterSpy by Sunbelt Software - adware/spyware protection"
X	SunJavaUpdatSched	spoolsv.exe	"Added by the BANCBAN-NP TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %ProgramFiles%\MSN Messenger"
U	SuNotification	suatshut.exe	"ShadowSurfer - ""provides a safe computing environment by creating a virtual twin of your PC. Restore the pre-ShadowMode system state no matter what changes have occurred to your PC"""
X	SVCH0TS	sp00lvs.exe	"Added by the LINEAGE-AZ TROJAN!"
X	Svchost	svchots.exe	"Added by the RBOT.ADK WORM!"
X	svchosts	svchosts.exe	"Added by the BANCBAN-DC or BANKER-ED TROJANS!"
X	Svchosts	SCVHOST.EXE	"Added by the AGOBOT-RQ BACKDOOR!"
X	svchosts.exe	svchosts.exe	"Added by the AGOBOT-JN WORM!"
X	svchosts.scr	svchosts.scr	"Added by the BANCBAN-DQ TROJAN and variants!"
X	Svhost Service Server	svhostser.exe	"Added by a variant of the RBOT WORM! See here"
X	Sygate Personal Firewall	hostserv.exe	"Added by the RBOT.BKO WORM!"
X	Sygate Personal Firewall	svchots.exe	"Added by the RBOT.ABT WORM!"
X	Sync Server	drwatsoon.exe	"Added by the WATSOON.A TROJAN!"
X	sys	Fonts.exe	"Added by the AUTORUN.BUK WORM!"
X	sysPersonalFirewall	tskm0nitor.exe	"Added by the SDBOT.APC WORM!"
X	System Manager	User Documents.exe	"Added by the VB.GF VIRUS!"
X	System Presets	[temp name].exe	"Added by the HOSTINF-A WORM!"
X	System Reboot	rebootsys.exe	"Added by the RBOT-WU WORM!"
X	System Stats	SystemStats.exe	"Added by a variant of the WOOTBOT WORM!"
X	System-Stat	systats.exe	"Added by the SDBOT.RA WORM!"
X	System132	Csrtss.exe	"Added by the LANFILT-I TROJAN!"
X	SystemNetwork	NETSERV.EXE	Added by the NETCONTROL VIRUS!
X	systwtray	twitty.exe [ = random digits]	"Added by the KOOBFACE.C WORM!"
X	sys_up1	svchostsys.exe	"Added by the MULTIDR-FL TROJAN!"
U	T-Com WLAN Manager	TS154USB.exe	Wireless management utility for the T-Com Sinus 154 Data II WLAN adapter
X	Tablet Task	tabletsk32.exe	"Added by the RBOT-AJB WORM!"
X	Tapisys	tss.exe	Added by the SMALL TROJAN!
X	Task Debugger	tskdbg.exe	"Added by the AGOBOT-KK WORM!"
X	Task Help	wualcts.exe	"Added by a variant of the RBOT WORM!"
X	Task Manager	tskmngr.exe	"Added by the RBOT-GOU WORM!"
X	TaskManager Load Module	TSKMNGR32.EXE	"Added by the SPYBOT.I WORM!"
X	Taskmgr	tskmgr32.exe	Homepage hi-jacker
X	tat	tatss.exe	"Delfin Promulgate adware variant"
X	Tcp Application Manager	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Terminal Services	mstscc.exe	"Added by the SDBOT-CZW WORM!"
X	Text Tray Service	tstray.exe	"Added by the SILLYFDC.BCC WORM!"
U	Tgsetsite	tgfix.exe	"See also TgAddServer. This part ensures the software is installed correctly (similar to an installation wizard) as reported by Cox Regarded as spyware by some as it has the ability to retrieve user information. Whether it does so depends upon the provider. One Toshiba user reports problems with hibernate on his laptop if disabled - hence the ""U"" recommendation"
U	ThrustTSR	TMTMTSR.exe	"Thrustmaster Thrustmapper - ""t-mapper - icon sits on your taskbar and automatically detects when the joystick is plugged in and configures it accordingly"""
X	TimeSink Add Client	TSADBOT.EXE	Advertising spyware
U	TINTSETP	TINTSETP.EXE	"Microsoft's Input Method Editor for Asian languages which is used to both display and enable the input of characters in e-mails
N	TkBell.Exe	evntsvc.exe	"Application Scheduler installed along with RealOne Player. Once installed
N	TkBellExe	evntsvc.exe	"Application Scheduler installed along with RealOne Player. Once installed
U	tlntsvr	tlntsvr.exe	"Microsoft program associated with Telnet"
X	Tmntsrv32	Tmntsrv32.exe	"Added by the STARTPAGE.O TROJAN!"
U	TMTMTSR	TMTMTSR.exe	"Thrustmaster Thrustmapper - ""t-mapper - icon sits on your taskbar and automatically detects when the joystick is plugged in and configures it accordingly"""
X	Tok-Cirrhatus-[4 random digits]	br[4 random digits]on.exe	"Added by the BRONTOK-M WORM!"
?	TomcatStartup	hpbpsttp.exe	"Apache Tomcat web server
?	TomcatStartup 2.5	hpbpsttp.exe	"Apache Tomcat web server
U	TrackpointSrv	daemon.exe	"Supports the ""pointer stick"" in lieu of a mouse on an IBM ThinkPad laptop. Necessary for the ""scroll"" button to work"
U	TrackpointSrv	tp4serv.exe	Supports the "pointer stick" in lieu of a mouse on an IBM ThinkPad laptop. Necessary for the "scroll" button to work
U	TrackPointSrv	tp4mon.exe	"Supports the ""pointer stick"" in lieu of a mouse on an IBM ThinkPad laptop. Necessary for the ""scroll"" button to work"
X	TrojanSimulator	TSServ.exe	"Trojan Simulator security risk which simulates a trojan infection and may be used to verify whether a virus scanner can properly detect the file"
X	TrueFonts	fonts.hta	Browser hijacker - redirecting to Hugesearch.net
N	TrueSync Launcher	tstool.exe	"Starfish TrueSync - for synchronization between Windows platforms and popular devices
X	TrustSoldier	TrustSoldier.exe	"TrustSoldier rogue security software - not recommended
X	TrustyHound-TS	TrustyHound-TS.exe	"TrustyHound spyware"
X	TS	tsc.exe	"Total Security rogue security software - not recommended
X	tsa	tsm.exe	"TargetSaver adware"
X	Tsa2	tsm2.exe	"TargetSaver adware"
X	TsAdbot	TSADBOT.EXE	TimeSink Add Client - advertising spyware
?	TSBxLogon	TMESBS2.EXE	"Found on a Toshiba laptop. May be related to TMESBS?"
U	TSClientMSIUninstaller	tscuinst.vbs	"Related to Terminal Services Client Remote Desktop Connection Software from Microsoft"
X	tserv	tserv.exe	"Added by the STRATION.AD WORM!"
U	TSE_PLUtil	PLBkMon.exe	"Prolific USB Flash Disk Log On Application"
X	Tsk Mng Hlp	wins32.exe	"Added by the AGOBOT-JB WORM!"
X	tskdbg	tskdbg.exe	"Added by the FLOOD.E TROJAN!"
X	Tsklist	tsklist32.exe	"Detected by Kaspersky as the BANCOS.SP TROJAN!"
U	TSkrMain	TSkrMain.exe	"TOSHIBA Accelerometer Utilities - hardware utilities that work with the motion sensors built into their Tablet PCs. Detect the way you are holding it at any given moment
X	Tsl	tsl.exe	"Uploader-R adware"
X	Tsl2	tsl2.exe	"TargetSaver adware"
?	TSMAgent	TSMAgent.exe	"Found on the HP Touchsmart range of desktops and notebooks. What does it do and is it required?"
N	TSMsger	TSMsger.exe	"Epson scannner software - required for ""one-touch"" operation. Can be launched manually"
N	tsnp2std	tsnp2std.exe	Digital camera related
Y	tsnpstd3	tsnpstd3.exe	"Related to Sonix Inc. Camera Monitor MFC Application"
?	TSPower	spower.drv	"Found on a Toshiba laptop. Related to power management?"
X	tsrv	t2serv.exe	"Added by the WAREZOV.AT WORM!"
X	tsrv	tsrv.exe	"Added by the WAREZOV.W WORM!"
?	TSService	NSSERVICE.EXE	"??"
X	tsvcin	n20050308.exe	"Delfin Media Viewer adware related"
X	tsx	regedlt.exe	"Added by the SDBOT-KA BACKDOOR! Note the lower case ""L"" in place of the lower case ""I"" in the command"
?	tsyssmon	tsyssmon.exe	"Found in a Toshiba\sysstability directory"
X	TSystem	[trojan filename]	"Added by the NSYS-A TROJAN!"
X	TTS Sync	testtts.exe	"Added by the SDBOT.BVA WORM!"
U	Tweak UI 1.33 deutsch	"RUNDLL32.EXE TWEAKUI.CPL	TweakMeUp"
U	UCmore XP - The Search Accelerator	"rundll32.exe UCMTSAIE.dll	DllShowTB"
X	UltimateServices	ultsvcs.exe	"Added by the AGENT-LGT TROJAN!"
U	UniPrint	SetDfltSettings.exe	"Drivers for Uniprint
X	Updatestats	Updatestats.exe	"Statblaster adware"
X	UpdateStats	UpdateStats.exe	"SeekSeek search hijacker related - see here"
Y	UrtSvcExe	Urt95Svc.exe	"""Cisco Secure URT is a virtual LAN (VLAN) assignment service that enhances LAN security by actively identifying and authenticating users and then associating them only to their specific network services and resources"""
U	VAIO Recovery	PartSeal.exe	System backup for Sony Vaio PCs. Adds a recovery mechanism for users over and above any System Restore features - allowing users to revert a drive back to the state it was when bought form the factory by hitting F10. The user obviously loses any data stored if not backed-up elsewhere
X	valuename	svchosts.exe	"Added by a variant of the SDBOT WORM!"
X	Vhosts Protection	vhosts.exe	Added by an unidentified WORM or TROJAN!
X	Video Card Driver (do not remove)	tsasi.exe	"Added by the SPYBOT-EF WORM!"
X	Video Process	netsvcs.exe	"Added by the AGOBOT.LH WORM!"
X	Video Process	ntsystm.exe	"Added by the GAOBOT.ZX WORM!"
X	virtual-machine	svchosts.exe	"Added by the RBOT-US WORM!"
Y	VrBootScan	VRBScan.exe	"Boot scan feature of the HAURI ViRobot series of internet security products. HAURI's ViRobot engine is included in those used by VirusTotal
X	vschost	vschosts.exe	"Added by the VIPSY-A TROJAN!"
X	VxD Driver Initialization	ntsvxd.exe	"Added by the SDBOT-LW WORM!"
X	WAPI	wts*.exe [ = random char]	"PurityScan adware"
U	Watson Subscriber for SENS Network Notifications	dwtrig20.exe	"Used to launch Microsoft Error Reporting (DW20.exe) - if
X	waults	waults.exe	"Added by the BIFROSE.L BACKDOOR!"
X	WCPC	wintsvcc.exe	"PurityScan adware"
X	WCPI	wintsvit.exe	"PurityScan adware"
X	WCPT	wintsvtr.exe	"PurityScan adware"
U	Webshots	Webshots Tray.exe	"Webshots - software that displays photos as your screensaver and wallpaper
U	Webshots	websho~1.exe	"Webshots - software that displays photos as your screensaver and wallpaper
U	Webshots	Launcher.exe	"Webshots - software that displays photos as your screensaver and wallpaper
U	Webshots	WebshotsTray.exe	"Webshots - software that displays photos as your screensaver and wallpaper
N	WetSock	wetsock.exe	"RoboMagic Wetsock - weather reporting in the System Tray"
X	Win32 Driver	svchosts.exe	"Added by the FORBOT-FD WORM!"
X	win32 security updates downloader	tskmngr.exe	"Added by a variant of the SDBOT WORM! See here"
X	Win32 Svchosts Driver	svchosts.exe	"Added by the FORBOT-FO WORM!"
X	Win32 Update	svchosts.exe	"Added by a variant of the SDBOT WORM!"
X	Win32.Trojan.Downloader	netstat2.exe	"Added by the PAINTER TROJAN!"
X	Windeows NetStart Service2	tesakrmger.exe	"Added by the RBOT-AMY WORM!"
X	windll	windotnetsrv.exe	"Added by the AUTORUN-ANO WORM!"
X	Windos Seres Agnts	[worm filename].exe	"Added by the RBOT-GUN WORM!"
X	Windows (ICS) Spooler	crtss.exe	"Added by a variant of the RBOT WORM!"
X	Windows .Net Manager	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows API Control Task	apitsk32.exe	"Added by the MYTOB.HI WORM!"
X	Windows Audio Components	nncsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Event Section	sntsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Host	hosts.exe	"Added by the KELVIR.U WORM!"
X	Windows Host Device	hostsvc.exe	"Added by the ZOOTY-A WORM!"
X	Windows Host Service	scvhosts.exe	"Added by the SPYBOT.NLI WORM!"
X	Windows Host Service	svchosts32.exe	"Added by the KELVIR.AW WORM!"
X	Windows Host32 Starter	hostserv.exe	"Added by the SDBOT-WU WORM!"
X	Windows Hosts	hosts.exe	"Added by the KELVIR-O TROJAN!"
X	Windows Hosts	winhosts.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Local Services	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Manager	winmants.exe	"Added by the MANTAS WORM!"
X	Windows Nets	WinNET.exe	"Added by the RBOT-MO WORM!"
X	Windows NetStart Service	winsN2S.exe	"Added by the RBOT-ZX WORM!"
X	Windows NetStart Service2	winsN2S.exe	"Added by the RBOT-ABN WORM!"
X	Windows NetStart Service2	winsN2SD.exe	"Added by a variant of the RBOT WORM!"
X	Windows Netsystem Layer	Netsystem.exe	"Added by the RBOT.BEI WORM!"
X	Windows Portable Devices	MSKSVRTSS.EXE	"Added by the SPYBOT.APEO WORM!"
?	Windows Print Spooler	SCVHOSTS.EXE	"Suspicious due to the similarity to the valid ""svchost.exe"" file"
X	Windows Printing Driver	gpedits.exe	"Added by the DCKEYG.A WORM!"
X	Windows Registery Center	svhchosts.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Service Agnts	[8 random letters].exe	"Added by the SDBOT.BCQ WORM!"
X	Windows Service Manager	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	initsvc.exe	"Added by the RBOT-BWT WORM!"
X	Windows Services	svchosts.exe	"Added by the AGOBOT-KL TROJAN!"
X	Windows Services Hosts	svhosts.exe	"Added by the SDBOT-YH TROJAN!"
X	Windows Serviece Agents	[8 random letters].exe	"Added by the AGENT.BHR TROJAN!"
X	Windows SpooltPrint Service	spooltsrv.exe	"Added by the SDBOT-AYE WORM!"
X	Windows Startup 32 Bits	sysrun32.exe	Added by a variant of the DARKSUN TROJAN!
X	WINDOWS SYSTEM	winNTsys32.exe	"Added by the MYTOB-DM WORM!"
X	Windows Task Service (32-bits)	tasksys.exe	"Added by the DREFIR.D WORM!"
X	Windows Taskmanager	tskmngr.exe	"Added by the IRCBOT.DHR BACKDOOR!"
X	Windows Taskmanager	wdtsvc.exe	"Added by the PUSHBOT.AU WORM!"
X	Windows Update	svchosts.exe	"Added by the FRUCTA TROJAN!"
X	Windows Update	SecretStub.exe	"Added by the SRAMLER.C WORM!"
X	Windows Update	tskmngr.exe	"Added by the AGENT.ALY BACKDOOR!"
X	windows updaters	winupdats.exe	"Added by the SPYBOT-IS WORM!"
X	Windows USB 2.0 Driver	usbtskmgr.exe	"Added by the RBOT-BKG WORM!"
X	Windows Web Services	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Workstation Service (32-bits)	wkssvc32.exe	"Added by a variant of the SDBOT WORM!"
X	WindowsDiskLog	cstsm.exe	"Added by the STINX-C or STINX-D TROJANS!"
X	WindowsRegKey update	svchoosts.exe	"Added by the RBOT.ADB WORM!"
X	WindowsSystem32	svchosts.exe	"Added by the AGENT-EDA TROJAN!"
X	WindowsUpdatesvchostss	svchostss.exe	"Added by the AGENT-HZ TROJAN!"
X	Winds Sers Agts	[5 random letters].exe	"Added by a variant of the RBOT WORM!"
X	Winds Sersc Agts	rzrzncrtz.exe	"Added by the RBOT-GTV WORM!"
Y	WinFaxAppPortStarter	wfxsnt40.exe	WinFax 10.0 and maybe earlier versions. Used to initiate the WinFax port to enable printing to the WinFax printer (send a fax) from any application.
X	winsock2	netsvr.exe	"Added by the AGOBOT.LY WORM!"
X	Winsock2 driver	ntsys32.exe	"Added by the SPYBOT-DD WORM!"
X	winsockdriver	tskmg.exe	"Added by the SDBOT.GEN TROJAN or WARPIGS.C WORM!"
X	winstats	winstats.exe	"Added by the GARGAFX TROJAN!"
X	WinTasks DLL Library (32-bits)	winkll.exe	"Added by the RBOT-AJZ WORM!"
X	wintsk32dll	wintsk32dll.exe	"Added by the RBOT-AAJ WORM!"
X	WinUpdate	svchots.exe	"Added by the SMALL.GXJ TROJAN!"
X	WinXP Processor Generator v1.2	intspnsr32.exe	"Added by the SDBOT.LP WORM!"
X	WinXPService	Tskdbg.exe	"Added by the MDROP-BPQ TROJAN!"
X	WNSA	wnsts*.exe [ = random char]	"PurityScan adware"
X	word pair	bopotsvr.exe	"Added by the SHED-A TROJAN!"
X	WTSC	wapisvcc.exe	"PurityScan adware"
X	WTSI	wapisvit.exe	"PurityScan adware"
X	WTSS	wapi*.exe [ = random char]	"PurityScan adware"
X	WTST	wapisvtr.exe	"PurityScan adware"
U	X10 Device Network Service	x10nets.exe	Belongs to X10 video streaming device(s)
Y	XoftSpy	XoftSpy.exe	"XoftSpy antispyware software by Pareto Logic"
U	XTNDConnect PC - LtNts4	NtsAgnt.exe	"(IBM) Lotus Notes 4 specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
X	XTServiceUpdate	XTServiceUpdate.exe	hahame.net adware downloader
X	Yahoo Messengger	scvhosts.exe	"Added by the SOHANNA-AH WORM!"
X	Yahoo Messengger	scvshosts.exe	"Added by the TRAX-A WORM!"
U	Yahoo! Widgets	YahooWidgets.exe	"Yahoo! Widgets lets you run little files called Widgets that can do pretty much whatever you want them to"
X	[12 random characters]	catsrvps.exe	"IeDriver adware variant"
X	[32 random hex numbers]	tsc.exe	"Total Security rogue security software - not recommended
X	[default]	DrWatson32.exe	"Added by the DREMN TROJAN!"
X	[random characters]	systs.exe	"Added by the AGENT-GDC TROJAN!"
X	[random]	[random]tssd.exe	"Antivirus Suite and AntiSpyware Soft rogue security software - not recommended
X	[various filenames]	qtsks.exe	Added by the WEBDOR.Y TROJAN
X	[various names]	svchostss.exe	"Added by a variant of the RBOT WORM!"
X	[various names]	ms-its.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	panel_its.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	utsgmon.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	WhatsNewBot.exe	"Wareout - malware masquerading as a spyware and dialer remover"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.