U

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

Fatal error: Maximum execution time of 30 seconds exceeded in /home/iamnotag/domains/iamnotageek.com/public_html/startup/search.php on line 252

	Startup Name	Process Name	Details
X		dllvirtual.exe	"Added by the DADOBRA-IW TROJAN! Note - has a blank entry under the Startup Item/Name field"
X		dllvirtual.dll	"Added by the DADOBRA-IW TROJAN! Note - has a blank entry under the Startup Item/Name field"
X		dllvirtual.js	"Added by the DADOBRA-IW TROJAN! Note - has a blank entry under the Startup Item/Name field"
	Note the filename has a ""0"" rather than an upper case ""o"""
Y	!1_pgaccount	pgaccount.exe	"DiamondCS ProcessGuard security software - stops malicious worms and trojans from being executed silently in the background
Y	!1_ProcessGuard_Startup	procguard.exe	"DiamondCS ProcessGuard security software - stops malicious worms and trojans from being executed silently in the background
Consume	"Consumer Input Rewarded with MyPoints	U	"ConsumerInputRewardedwithMyPoints
Consume	"Consumer Input Rewarded with MyPoints	U	"ConsumerInputRewardedwithMyPoints
Inc."	"Miramar Systems	U	atmsg.exe
Version	"NVIDIA Compatible Windows Vista Display driver	U	"RUNDLL32.EXE NvCpl.dll
Version	"NVIDIA Compatible Windows7 Display driver	U	"RUNDLL32.EXE NvCpl.dll
Version	"NVIDIA Driver Helper Service	U	"RUNDLL32.EXE nvsvc.dll
Mass"	"Telechips	U	patch.exe
please	"This is a virus	X	bigbadvirus.exe
X	"Vaganza-XPloit-[User Name]"""	[user name].exe	"Added by the GAVGENT.A WORM!"
"	"[Ephemeral 2.4] by TreeHugger	X	[path to worm]
"	"[Ephemeral 2.5] by TreeHugger	X	[path to worm]
"	"[Ephemeral 2.x] by TreeHugger	X	[path to worm]
Y	#NAME?	ZkRunOnceR.exe	Internet Security Suite used by ISPs to protect customers against many attacks
X	$sys$umaiyo	$sys$sonyTimer.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$umaiyo	$sys$sos$sys$.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$umaiyo	$sys$WeLoveMcCOL.exe	"Added by the WELOMOCH TROJAN!"
U	$Volumouse$	volumouse.exe	"Volumouse from Nirsoft. ""Provides you a quick and easy way to control the sound volume on your system - simply by rolling the wheel of your wheel mouse"""
X	$WindowsRegKey%update	IEXPLORE.EXE	"Added by the RBOT-EZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
Y	'Ashampoo AntiSpyWare 2 Guard'	AntiSpyWare2Guard.exe	"Part of Ashampoo® AntiSpyWare 2 from Ashampoo GmbH & Co. KG. This part is the realtime monitor that looks for changes on the users system such as BHO
X	(*)Run	win32API.exe	"Homepage hijacker
X	(Default)	media_driver.exe	"Added by the TUPEG VIRUS! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	Shania.vbs	"Added by the SHANIA BACKDOOR! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	NOTEPAD.exe	"Added by the RUSTY WORM! Note - not to be confused with the valid Windows ""NOTEPAD"" text editor! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	[random filename].exe	"Added by the BLACKMAL WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	twunk_32.exe	"Added by the BLACKMAL.C WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	winhelp.exe	"Added by the BLACKMAL.C WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	spolsvr2.exe	"Added by the EVILSOCK.10 TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	winbas12.exe	"Adware
X	(Default)	Systrsy.exe	"Added by the CDTRAY TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	llsass.exe	"Added by the PROXY-GG TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	syspol.exe	"Added by the DREMN-B TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKCU\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(default)	winlog.exe	"Added by the RBOT-CVY WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(default)	"rundll32.exe [path to DLL file]	Do98Work"
X	(Default)	winligom.exe	"Added by the RBOT-GAI WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKCU\Run
X	(Default)	5640.exe	"Added by the DOWNLD-ABF TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKCU\Run
X	(Default)	QQUpdate.exe	"Added by the QUADRULE.A WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	Mcafee.exe	"Added by the AGENT.AY TROJAN! Note - this is not a valid McAfee program and is located in %System%. This malware actually changes the value data of the ""(Default)"" key in HKCU\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	fada.exe	"Added by the VB.HEI TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run
X	(Default)	Default.exe	"Added by the AUTORUN.BUK WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\RunOnce & HKCU\RunOnce in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	KEYBOARD.exe	"Added by the AUTORUN.BUK WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	msarti.com	"Added by the SILLYFDC.CJ WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\..\Policies\Explorer\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	msnupdate.exe	"Added by the RBOT-GWT BACKDOOR! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run & HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	xtreme.exe	"Added by the DROPR-CZ TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKLMRun in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(L4r1$$4) (4nt1) (V1ruz)	SP00Lsv32.pif	"Added by the ASSIRAL.B WORM!"
X	Intelli Mouse Pro Version 2.0B	ncsjapi32.exe	"Added by the BUZUS-O WORM!"
X	*JanisRuckenbrodII	janis.com	"Added by the POPS WORM!"
X	*Microsoft Update	ctxma.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	cxma.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wstcl.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wucxt.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wuytc.exe	"Added by the STMU TROJAN!"
X	*MS Setup	[random filename]	"Virtumondo adware
Y	*Restore	rstrui.exe	Part of Windows System Restore and added as a RunOnce registry entry. Leave alone
X	*Security Center	secctr.exe	"Added by the SDBOT.BRO WORM!"
N	*WerKernelReporting	WerFault.exe	"Part of Windows Error Reporting technology (WER) for Vista. WER captures software crash and hang data from end-users who agree to report it - see here"
X	*windows update	wrauclt.exe	"Added by the RBOT-QU WORM!"
X	*windows update	wuanclt.exe	"Added by the RBOT-PG WORM!"
X	*windows update	wuaucrlt.exe	"Added by the SPYBOT.HUR WORM!"
X	*windows update	wuraclt.exe	"Added by the RBOT-PO WORM!"
X	*windows update	wurauclt.exe	"Added by the RBOT-SY WORM!"
X	*windows update	wsctl.exe	"Added by the SPYBOT.PR WORM!"
X	*windows update	wkmst.exe	"Added by the SDBOT.AVD WORM!"
X	*windows update	wscxt.exe	"Added by the RBOT.AOS WORM!"
X	*windows update	waurclt.exe	"Added by a variant of the RBOT WORM!"
X	*windows update	wuaruclt.exe	"Added by the RBOT-TF WORM!"
X	*WindowsAudio	systemupd.exe	"Added by the AGENT-TH WORM!"
X	*WinLogon	[trojan path] ren time:[random number]	"Added by the VUNDO TROJAN!"
X	*wuauclt.exe	w***.exe [ = random char]	"Added by a variant of the RBOT-UG WORM! Note - * in the filename represents a random char; variants spotted: wxmct.exe
X	-=+(L4r1$$4)+=-(4nt1)-=+(V1ru$)=-+	ISASS.exe	"Added by the ASSIRAL.B WORM!"
X	.msfupdate	msveup.exe	"Added by the ALLOCUP.A WORM!"
X	.mssecure	mssecure.exe	"Added by the DDOS_BOXED.X TROJAN!"
X	.WMAudio	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	.WMAudio	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
Y	00PCTFW	FirewallGUI.exe	"System Tray access to PC Tools Firewall Plus from PC Tools - which ""is a powerful personal firewall for Windows that protects your computer from intruders and controls the network traffic in and out of your PC"""
X	0utlook Express	****.exe [ = random char]	"Added by the RBOT-CC WORM! Note the first letter is actually the digit ""0"" and not a capital ""o"""
X	1-sukarno	sukarno.exe	"Added by the BRONTOK-CR WORM!"
X	1029BB4B-16A9-4E77-AA3D-96930BD68EEC	sysockeu.exe	"Added by the FAKEALERT-AH TROJAN!"
X	1234klsjdc uiar924c af	sxgnsvuxct.exe	"Added by the FAKEALERT-AM TROJAN!"
X	1234klsjdc uiar924c af	sysvtypkbjx.exe	"Added by the FAKEALERT-AM TROJAN!"
U	12Ghosts Backup	12backup.exe	"12Ghosts Backup - ""Automatic Backups
U	12Ghosts JustAWindow	12window.exe	"12Ghosts JustAWindow - ""Cover annoying ads
U	12Ghosts Popup-Killer	12popup.exe	"12Ghosts Popup-Killer"
U	12Ghosts SaveLayout	12autosl.exe	"12Ghosts SaveLayout - ""Always (always!) keep the layout of your desktop icons"""
X	180adsolution	180adsolution.exe	"180solutions adware"
X	180ClientStubInstall	stubinstaller***.exe [ = digit]	"180Solutions adware related"
X	180ClientStubInstall	[path to trojan]	"180Solutions adware related"
X	180ClientStubInstall	*****.tmp [ = random digit/char]	"180Solutions adware related"
X	1u7	1u7.exe	"Added by the MURBAC-A TROJAN!"
U	1Win32Cfg	SpyBuddy.exe	"SpyBuddy from ExploreAnywhere
X	2-suharto	suharto.exe	"Added by the BRONTOK-CR WORM!"
X	2177F056-0AA6-4D6C-A944-13F71F341C29	sysokuaw.exe	"Added by the FAKEALERT-AH TROJAN!"
X	2k6 updatz	crss3.exe	"Added by the RBOT-CPD WORM!"
X	2thousandbuck	[path to file]	"Added by the RANKY.L TROJAN!"
X	3.8853E+11	AutomaticUpdates.exe	"Added by the SDBOT-DEN WORM!"
X	32-bit Thunking service	thunk32.exe	"Added by the DERDERO.A WORM!"
Y	36X Raid Configurer	JMRaidSetup.exe	"JMB36x series RAID configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers"
?	3Com Launcher	Launcher.exe	"Related to networking products from 3Com Corporation. What does it do and is it required?"
Y	3cpipe-USRpdA	USRmlnkA.exe	Modem driver files from US Robotics
Y	3DMouse.EXE	3DMouse.EXE	Dritek System Inc. 3D Mouse driver
X	3d_sound	3d_sound.exe	"Added by the RIADOS-A TROJAN!"
X	3P_UDEC_IA	IAInstall.exe	"Installer for the Internet Antivirus and Internet Antivirus Pro rogue security software - not recommended
X	4-gusdur	gusdur.exe	"Added by the BRONTOK-CR WORM!"
X	49U5T1N4	49U5T1N4.exe	"Added by the KORRON.B WORM!"
X	5whgue21	5whgue21.exe	"ClearSearch adware"
X	6-susilo b	sby.exe	"Added by the BRONTOK-CR WORM!"
U	802.11b+g USB Wireless LAN Utility	ZDWlan.exe	802.11b+g USB Wireless LAN Utility
U	802.11g MIMO Wireless Utility	RaUI.exe	"Wireless configuration utility for Railink 802.11g MIMO based products"
X	98D0CE0C16B1	"rundll32.exe D0CE0C16B1	D0CE0C16B1"
X	9UmxQPSiTJMbA	NVUKZ.exe	"Added by the AGENT-LMN TROJAN!"
X	;Rundll	[filename]	"Added by the PWSLEGMIR.E TROJAN!"
X	?ekio Startups	?nksvc32.exe	"Added by the AGOBOT-OV WORM where ? is a random character"
X	@	RUNDLL.EXE	"Added by the SPYBOT-DN WORM! Note - this is NOT the Win9x/Me system file of the same name as described here"
Y	@OnlineArmor GUI	oaui.exe	"System Tray access to and main user interface for the Online Armor range of security tools from Tall Emu Pty Ltd. The free version incorporates a firewall
X	@tour_ww	@tour_ww[1].exe	Adult content dialler
X	A New Windows Updater	w32NTupdt.exe	"Added by the MYTOB.BM WORM!"
Y	a-squared	a2guard.exe	"System Tray access to and Anti-Malware Guard feature of Emsisoft Anti-Malware from Emsi Software GmbH - which provides ""comprehensive PC protection against viruses
Y	a-squared	a2adguard.exe	"System Tray access to and Background Guard feature of Emsisoft Anti-Dialer from Emsi Software GmbH - which provides ""provides a complete defense against Dialers"""
Y	a-squared Anti-Dialer	a2adguard.exe	"System Tray access to and Background Guard feature of Emsisoft Anti-Dialer from Emsi Software GmbH - which provides ""provides a complete defense against Dialers"""
U	A1000 Settings Utility	cpqa1000.exe	"Compaq A1000 Print Fax All-in-One copy scan printer software. Required in the Startup in order to scan
Y	a2adguard	a2adguard.exe	"System Tray access to and Background Guard feature of Emsisoft Anti-Dialer from Emsi Software GmbH - which provides ""provides a complete defense against Dialers"""
Y	a2guard	a2guard.exe	"System Tray access to and Anti-Malware Guard feature of Emsisoft Anti-Malware from Emsi Software GmbH - which provides ""comprehensive PC protection against viruses
X	A5118r	_default32142.pif	"Added by the BRONTOK-AK WORM and variants!"
X	A70F6A1D-0195-42a2-934C-D8AC0F7C08EB	"rundll32.exe E6F1873B.DLL	D9EBC318C"
X	a9z1eizA1e	atulabov.exe	"Added by the AGENT-GWD TROJAN!"
X	aa bbcc dde effgghh jj	update.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Aaou	amee.exe	"PurityScan adware"
?	aauclient	ACNUpdater.exe	"Appears to be related to software from Accenture.com"
?	ab EazyScheduler	ezsched.exe	"??"
N	ABBYY Community Agent	CAGENT.EXE	Installed with the Optical Character Recognition (OCR) software that comes bundled with a Compaq A3000 all-in-one printer/scanner. Its function appears to be to link you to the internet in an attempt to buy the 5.0 version of the software
U	ABIT uGuru	uGuru.exe	"ABIT µGuru - on motherboards incorporating the µGuru processor this provides quick access to ""hardware monitoring
U	Absolute Shield	dseraser.exe	"Absolute Shield Evidence Eliminator - internet history eraser"
U	Absolute StartUp monitor	ASMon.exe	"Absolute Startup - startup monitor from F-Group Software"
U	AbsoluteShield Internet Eraser	cseraser.exe	"AbsoluteShield Internet Eraser - ""protects your privacy by cleaning up all the tracks of your Internet and computer activities"""
X	abtu	mp3serch.exe	"Loads the executable for Lop.com - final version"
X	abtu	lopsearch.exe	"Loads the executable for Lop.com - beta version"
U	Abyssus	razerhid.exe	"Razer Abyssus gaming mouse driver - required if you use the additional features and programmed keys/macros"
X	Ac97Sound	snddrv.exe	"Added by the VB.AXG TROJAN!"
U	AccessoriesPlus	clockplus.exe	"Clock Plus
N	AccessRampLAN01	ARUpld32.exe	"Version of the AccessRamp Monitor01 entry for LAN connections - a history uploader. The key in turning it off is a file named ARUCfg32.exe. This file (ARUCfg32.exe) does not show up in the startup process. If you have this file
Y	accrdsub	accrdsub.exe	"ActivIdentity ActivClient - security software from ActivIdentity Corporation which ""enables organizations to secure workstations with smart cards and smart USB tokens while enforcing strong authentication for desktop access and network login"""
N	AccuWeather.com� Desktop	AccuWeatherDesktop.exe	"Desktop weather from AccuWeather"
N	AccuWeatherDesktopAlerts	AccuWeatherDesktopAlerts.exe	"Weather alerts for AccuWeather.com Desktop which ""provides you with the most accurate
N	AceGain LiveUpdate	LiveUpdate.exe	"""AceGain LiveUpdate can help to automate and optimize product updates. AceGain LiveUpdate will automatically detect new patch updates
U	Acer Assist Launcher	launcher.exe	"Acer Assist - program that provides information about new updates or notices from Acer"
U	Acer eAP Launch Tool	EAPLAU~1.EXE	"Empowering Technology Launcher
U	Acer ePower Management	ePowerTrayLauncher.exe	Launcher for the Acer® PowerSmart Manager power management utility included on some models in the Aspire range of notebooks
Y	Acer Launch Tool	Alaunch	"Part of Acer eRecovery - ""a powerful utility that does away with the need for recovery disks provided by the manufacturer
N	Acer Product Registration	ACE1.exe	Acer Product Registration - remove when registration is completed
N	Acer Tour Reminder	Reminder.exe	Popup reminder to take the tour of your new Acer laptop
X	Aceu	[random filename]	"PurityScan adware"
U	AClntUsr	AClntUsr.exe	"Altiris AClient Service Windows Tray Icon"
N	Acme.PCHButton	pchbutton.exe	Used by HP Instant Support
U	Acombo3dmouse	Acombo3d.exe	Mouse driver - required if you use non-standard Windows driver features
U	acoustic	acoustic.exe	"Control panel program for Philips Acoustic Edge soundcard. Not required unless changed settings aren't retained"
X	Acrobat Read	acroup32.exe	"Added by the VANBOT-BQ TROJAN!"
N	Acrobat Speed Launch	acrobat_sl.exe	"Speeds up the time it takes to load Adobe's Acrobat PDF creation and management tool. From version 7.0 onwards"
U	ACROMOUSE	ACROMAPP.exe	"Related to ACROMOUSE Laser mouse control"
U	Acronis Popup Blocker	"RunDll32.exe [path] Blocker.dll	Run"
U	Acronis Scheduler Helper	schedhlp.exe	"Part of Acronis True Image backup software. Co-operates with the ""schedul2.exe"" service to perform backup/restore tasks correctly. Required if you want to use True Image to do some real backup/restore tasks - not if you only want to explore/mount images"
U	Acronis Scheduler2 Service	schedhlp.exe	"Part of Acronis True Image - backup software. Co-operates with the ""schedul2.exe"" service to perform backup/restore tasks correctly. Required if you want to use True Image to do some real backup/restore tasks - not if you only want to explore/mount images"
U	Acronis True Image	TimounterMonitor.exe	"Part of Acronis True Image backup software. Monitor for the backup archive explorer for moving and viewing files within an archive"
N	Acronis True Image Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
N	Acronis TrueImage Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
N	AcronisTrueImage Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
U	AcronisTimounterMonitor	TimounterMonitor.exe	"Part of Acronis True Image backup software. Monitor for the backup archive explorer for moving and viewing files within an archive"
N	AcronisTrueImage Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
X	Acroread	GoogleUpdate.exe	"Added by the AGENT-JGI TROJAN! Note - this is not the valid Google program which is normally located in %AppData%\Google\Update. This version resides in %Temp%"
N	Active CPU	acpu.exe	"Active CPU - ""easy to use tool for Windows 95/98/ME/NT/2000 that enables you to watch a graphical representation of your CPU's activity"""
X	Active Security	asecurity.exe	"Active Security rogue security software - not recommended
U	ActiveMenu	ActiveMenu.exe	Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
U	ActivePlus	activeplus.exe	"Interactive Agents Plugin for Messenger Plus! (MSN Messenger add-on)"
X	ActiveScan Antivirus	ActiveScan.exe	"Added by the RBOT-FKQ WORM!"
X	ActiveXUpdate	svcss.exe	"Added by a variant of the DEDLER.C TROJAN!"
N	ActivSurf	backweb*****.exe	Packard Bell ActivSurf - automatically detects an internet connection and downloads any available updates
U	Actual Window Manager	ActualWindowManagerCenter.exe	"Actual Window Manager from Actual Tools - ""an innovative desktop organization application which introduces unconventional window controls and also automatic general window operations making your work more productive
U	Actual Window Minimizer	ActualWindowMinimizerCenter.exe	"Actual Window Minimizer - ""allows minimizing any window to task tray notification area or to the edge of the screen"""
U	ACU	ACU.exe	"Atheros wireless Client Utility"
U	ACU_QSB	ACU.exe	"Atheros wireless Client Utility"
U	Ad Muncher	AdMunch.exe	"Ad Muncher removes adverts
?	Ad Online Guide	adonlineguide.exe	"??"
U	Ad-Muncher	ADMUNCH.EXE	"Ad Muncher removes adverts
U	Adaware Bootup	Ad-aware.exe	"Ad-Aware from Lavasoft - popular spyware/adware removal tool"
X	Additional Guard	WI[random characters].exe	"Additional Guard rogue security software - not recommended
X	AddrPlus3	[path] stup.exe [path] Adplus.dll Rundll32	"TCent adware"
Y	adi CleanUp	CleanUp.exe	"Utility that only runs once after installing the drivers for Analog Devices SoundMax integrated soundcards to clean-up the files no longer required once the installation is complete. Other programs/drivers may use the same filename for the same purpose. In this case
Y	adi DSndUp	DSndUp.exe	"Utility that only runs once after installing the drivers for Analog Devices SoundMax integrated soundcards. It's exact purpose is unknown at the present time but from the filename it's probably used to configure the default or generic speaker arrangement for the system it's used on"
N	Adobe Acrobat Speed Launcher	acrobat_sl.exe	"Speeds up the time it takes to load Adobe's Acrobat PDF creation and management tool. From version 7.0 onwards"
N	Adobe Reader Speed Launch	Reader_sl.exe	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
N	Adobe Reader Speed Launch	READER~1.EXE	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
N	Adobe Reader Speed Launcher	Reader_sl.exe	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
U	Adobe Version Cue CS2	VersionCueCS2Tray.exe	"File manager that's part of Adobe Creative Suite 2 - ""find files fast
X	AdobeManager	rundtl.exe	"Added by the INJECT.IB TROJAN!"
X	AdobeReaderPro	updt.exe	"Added by the IRCBOT-VQ WORM!"
X	AdobeReaderPro	rruxdkf.exe	"Added by the RBOT.ADF BACKDOOR!"
X	AdobeReaderPro	subset.exe	"Added by the RBOT.OCU WORM!"
N	AdobeUpdater	AdobeUpdater.exe	Automatic updater for Adobe software - run manually
N	AdobeVersionCue	VersionCueTray.exe	"""An exclusive feature of the Adobe® Creative Suite
X	AdPopup	dcf5678.exe	"Added by the AGENT-FZ TROJAN!"
N	ADQuickAccess	Adtray.exe	After Dark for Windows. Screen saver creation program produced before screen savers became integrated into Win95
X	AdRoarUpdate	ARUpdate.exe	"AdRoar adware updater"
Y	AdslTaskBar	"rundll32.exe stmctrl.dll	TaskBar"
X	adstartup	automove.exe	"Adlogix adware variant"
X	Adstartup	Adstartup.exe	"Adlogix adware"
X	AdStatus Service	AdStatServ.exe	"WindUpdates AdStatus Service adware"
U	AdSubtract	adsub.exe	"AdSubtract blocks ads
?	ADU	adu.exe	"Related to Cisco Aironet wireless products. What does it do and is it required?"
X	AdultX	AdultX.exe	Adult content dialler and hijacker
X	Adult_Chat	Adult_Chat.exe	Adult content dialler
X	Adult_Chat1	Adult_Chat1.exe	Adult content dialler
X	AdUpdater	sysupudt.exe	Unidentified adware downloader/updater
U	ADUserMon	ADUserMon.exe	"Part of Active Disk from Iomega - allows software applications to be run directly from an Iomega Zip® disk. Required if you wish the applications to launch on insertion of a disk"
U	Advanced Uninstaller PRO Installation Monitor	monitor.exe	"Innovative Solutions Advanced Uninstaller PRO - ""easy-to-use suite for uninstalling applications and keeping your computer fast
X	AdvancedCleaner Free	UADC.exe	"AdvancedCleaner rogue security software - not recommended
X	AdvancedPrivacyGuard	apg.exe	"AdvancedPrivacyGuard rogue privacy program - not recommended
X	AdvancedPrivacySuite	APS.exe	"AdvancedPrivacySuite rogue privacy program - not recommended
X	AdVantage Setup	AdVantageSetup.exe	"MeMedia.Advantage adware - optionally installed with older versions of the DAEMON Tools Lite CD emulation tool (if you don't uncheck the ""DAEMON Tools sponsor ad module"" option during install) and possibly others"
X	Adware Punisher	AdwarePunisher.exe	"Adware Punisher rogue spyware remover - not recommended
X	Adware Punisher Monitor	AdwarePunisher_monitor.exe	"Adware Punisher rogue spyware remover - not recommended
X	AdwareKiller_schedules	schedules.exe	"EAdwareKiller rogue spyware remover - not recommended
N	AELaunch	AELaunch.exe	"Audio Applications Launcher for the Philips Acoustic Edge soundcard"
?	AeXSWDUsr	AeXSWDUsr.exe	"Altiris Express NS Client Manager software. Is it required?"
U	AFAFilter	windefault.exe	"AFAFilter - internet filter software"
?	Agente	Remupd.exe	"Part of an older version of Panda Antivirus. Is this an update reminder (guess because of the name)
?	AHNUE	AHNUE.exe	"??"
X	AHU	[path to worm]	"Added by the ANACON-B WORM!"
X	AHU	ANACON.EXE	"Added by the NACO.A WORM!"
X	ahui32.exe	ahui32.exe	"Added by the CERTIF-M TROJAN!"
U	Ai Quicker Help	AsRc.exe	"ASUS DH Remote media portal launcher for their Digital Home range of motherboards that are designed for users to control the computer at a distance away
X	Aica	tuaa.exe	"PurityScan adware"
X	Aida	ttuh.exe	"PurityScan adware"
X	Aida	eetu.exe	"PurityScan adware"
X	Aim Plugin	aimplugin.exe	"Added by the GUAP-F WORM!"
X	Aim Quick Start	Aim.exe	"Added by the FORBOT-BB WORM! Note - this is not the popular AOL Instant Messenger utility"
N	Aim6	AOLLaunch.exe	"AOL Instant Messenger - start it when you want to use it"
X	AIM95 Startup	aim95.exe	"Added by the AGOBOT.AEE WORM!"
Y	Aiptek Graphics Tablet (USB)	atwtusb.exe	USB interface for Aiptek Graphics Tablet (USB)
Y	AirPlusCFG	AirPlusCFG.exe	"Driver and configuration utility for a number of wireless routers and adapters from D-Link"
U	AJC Active Backup	AJCActBk.exe	"AJC Active Backup from AJC Software - ""Instantly backup files you change on your PC and keep multiple versions to undo"""
Y	Alaunch	Alaunch	"Part of Acer eRecovery - ""a powerful utility that does away with the need for recovery disks provided by the manufacturer
N	Album Fast Start	ABMTSR.EXE	"Scanner software
N	Alcohol.exe Autorun	Alcohol.exe	"Alcohol 120% - ""a powerful Windows CD and DVD burning software that makes it easy to create backups of DVDs and CDs. In addition
N	AlcoholAutomount	axcmd.exe	"Part of Alcohol 120% - ""a powerful Windows CD and DVD burning software that makes it easy to create backups of DVDs and CDs. In addition
?	Alcom PCL Capture	FMW_PCAP.EXE	"??"
X	ALGU	ALGU.EXE	"Added by the CWS-I TROJAN!"
X	ALGU.exe	ALGU.exe	"Added by the STARTPAGE.O TROJAN!"
N	AlienAutopsy	Test_BS.exe	"Alienware computer technical support software"
?	AliUSBfix	GREENMK.exe	"May be realted to a USB 2.0 PCI card - the IOgear GIC220OU?"
U	All Aboard Status	stswin.exe	"All Aboard! Internet Connection Sharing status icon"
U	ALLTEL DSL Check-up Center	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	Alogrithm Link Queue	alq.exe	"Added by a variant of the SDBOT WORM!"
Y	Alps Electric USB Server	Monserv.exe	"Alps Electric USB Server - required according to this article"
N	ALU Scheduler Service	ALUSchedulerSvc.exe	Symantec LiveUpdate scheduler for programs such as Norton AV or Internet Security
U	ALUAlert	ALUNotify.exe	Notification reminder for Symantec's LiveUpdate. Leave enabled unless you manually run LiveUpdate on a regular basis
N	Aluria Security Center	SecurityCenter.exe	"Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU
U	Aluria's Pop-Up Stopper	eps.exe	Aluria Pop-Stopper
N	Aluria's Spyware Eliminator	ASE.exe	"Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU
N	AME_CSA	"rundll32 amecsa.cpl	RUN_DLL"
U	AmIcoSinglun	AmIcoSinglun.exe	"Single LUN Icon Utility - System Tray access/notification for card readers using controllers from Alcor Micro which incorporate Single LUN
X	amsgupdate	ams.exe	Added by a variant of the MAILBOT TROJAN!
N	Announcements	Annclist.exe	MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it
U	Another Internet Explorer Popup Killer	aiepk2.exe	"Another IE Popup Killer - pop-up stopper"
X	Anti-Virus	vpms.exe	"Added by a variant of the SLAPER TROJAN!"
X	Anti-Virus	[random filename].exe	"Added by the CAPROBAD-A TROJAN!"
X	Anti-Virus Product Sync	[unprintable character][3 characters]log.exe	"Added by the KEDEBE.D WORM!"
X	Anti-Virus Update Scheduler	[path to trojan]	"Added by the SPAMMIT-A TROJAN!"
X	Anti-Virus Update Scheduler	winsp3.exe	"Malware - detected by Kaspersky as the AGENT.FP TROJAN!"
X	Anti-Virus Update Scheduler V1.39.12R	[path to trojan]	"Added by the HEPLANE or STAPREW.B TROJANS! - different filenames have been spotted; examples: msvc.exe
U	antidialer.co.uk	Dialer_Watcher.exe	"Dialer_Watcher is an application that allows you to detect dialers on your computer"
X	AntiMalwareGuard	amg.exe	"AntiMalwareGuard rogue security software - not recommended
X	AntiMalwareSuite	AMS.exe	"AntiMalwareSuite rogue security software - not recommended
U	AntiPopUp	AntiPopUp.exe	"AntiPopUp for IE - pop-up stopper"
X	antispy	ANTIVIRUS.exe	"IE AntiVirus rogue security software - not recommended
X	AntiSpyGuard	AntiSpyGuard.exe	"AntiSpyGuard rogue security software - not recommended
Y	AntiSpyWare2Guard	AntiSpyWare2Guard.exe	"Part of Ashampoo® AntiSpyWare 2 from Ashampoo GmbH & Co. KG. This part is the realtime monitor that looks for changes on the users system such as BHO
X	AntiSpywareGuard	asg.exe	"AntiSpywareGuard rogue spyware remover - not recommended
X	AntiSpywareSuite	pgs.exe	"AntiSpywareSuite rogue security software - not recommended. A member of the AVSystemCare family"
X	antiviirus	antiviirus.exe	Added by a variant of the AGENT.KEU TROJAN!
X	Antivirus	av.exe	"Added by the SINKIN TROJAN! Resets IE start page to realphx.com"
X	Antivirus	maja.exe	"Added by the NETSKY.H WORM!"
X	Antivirus	iexpl0res.exe	Added by an unidentified WORM or TROJAN!
X	AntiVirus	kaspery.exe	"Added by a variant of the RBOT WORM!"
X	AntiVirus	AntiVirus.exe	"Added by the BANKER-EHB TROJAN!"
X	Antivirus	Antvrs.exe	"AntiVirus 2008 rogue security software - not recommended
X	Antivirus	avm.exe	"Antivirus Master rogue security software - not recommended
X	Antivirus	vav.exe	"Vista Antivirus 2008 rogue security software - not recommended
X	Antivirus	aav.exe	"Advanced Antivirus rogue security software - not recommended
X	ANTIVIRUS	AVS.exe	"Antivirus Sentry rogue security software - not recommended
X	ANTIVIRUS	microAV.exe	"Micro Antivirus 2009 rogue security software - not recommended
X	Antivirus	MSA.exe	"MS Antivirus rogue security software - not recommended
X	ANTIVIRUS	UltraAV.exe	"Ultra Antivirus 2009 rogue security software - not recommended
X	Antivirus	xpa.exe	"Xpert Antivirus Enterprise rogue security software - not recommended
X	Antivirus	SPP.exe	"Spyware Preventer rogue security software - not recommended
X	Antivirus	sav.exe	"System Antivirus 2008 rogue security software - not recommended
X	Antivirus	uav.exe	"Ultimate Antivirus 2008 rogue security software - not recommended
X	Antivirus	wav.exe	"Windows Antivirus 2008 rogue security software - not recommended
X	Antivirus 2009	av2009.exe	"AntiVirus'09 rogue security software - not recommended
X	Antivirus 2009 plus	Antivirus 2009 plus.exe	"AntiVirus Plus rogue security software - not recommended
X	Antivirus Agent Pro	aap.exe	"Antivirus Agent Pro rogue security software - not recommended
X	Antivirus Installer	[path to trojan]	"Added by the BADGENT-A TROJAN!"
X	Antivirus PC 2009	avpc2009.exe	"Antivirus PC 2009 rogue security software - not recommended
X	Antivirus Pro 2009	AntivirusPro2009.exe	"AntiVirus Plus rogue security software - not recommended
X	Antivirus Pro 2010	AntivirusPro_2010.exe	"Antivirus Pro 2010 rogue security software - not recommended
X	AntiVirus Process	virprot.exe	"Added by a variant of the SDBOT WORM!"
X	Antivirus Protection Services	ccapp2.exe	"Added by the RBOT.EXI WORM!"
X	AntiVirus Update	updates.exe	"Added by the RBOT-JF WORM!"
X	AntiVirus Update	antivirus.exe	"Added by the RBOT-IF WORM!"
X	Antivirus Updates	avupdchk.exe	"Added by the AGOBOT-IP WORM!"
X	Antivirus-2008.exe	Antivirus-2008.exe	"Antivirus 2008 rogue security software - not recommended. Detected by Sophos as the FAKEAV-BK TROJAN!"
X	antivirus-2008pro.exe	antivirus-2008pro.exe	"Antivirus 2008 PRO rogue security software - not recommended. Detected by Sophos as the FAKEAV-AW TROJAN!"
X	Antivirus-Golden	Antivirus-Golden.exe	"Antivirus-Golden rogue security software - not recommended"
X	Antivirus.exe	Antivirus.exe	"Antivirus rogue security software - not recommended
X	Antivirus2008y	antvrs.exe	"AntiVirus 2008 rogue security software - not recommended
X	antivirus32	antivirus.exe	"Added by the SPYBOT.KAI WORM!"
X	AntivirusBEST	Installer.exe	"Installer for the AntivirusBEST rogue security software - not recommended. Removal instructions here"
X	AntivirusBEST	abest.exe	"AntivirusBEST rogue security software - not recommended
X	AntivirusDoc	AntivirusDoc.exe	"AntivirusDoc rogue security software - not recommended
X	AntivirusFiable	pgs.exe	"AntivirusFiable
X	AntivirusForAll	pgs.exe	"AntivirusForAll rogue security software - not recommended
X	AntivirusGold	AntivirusGold.exe	"AntivirusGold rogue security software - not recommended
X	AntivirusGold 5.1	AntivirusGold 5.1.exe	"AntivirusGold rogue security software - not recommended
X	AntiVirusLab2009	AntiVirusLab2009.exe	"Antivirus Lab 2009 rogue security software - not recommended
X	AntivirusOrdi	pgs.exe	"AntivirusOrdi
X	AntivirusPCPakke	pgs.exe	"AntivirusPCPakke
X	AntivirusPCSuite	pgs.exe	"AntivirusPCSuite rogue security software - not recommended
X	Antiviruspertutti	pgs.exe	"Antiviruspertutti rogue security software - not recommended. A member of the AVSystemCare family"
X	AntiVirusPro	AntiVirusPro.exe	"Anti Virus Pro rogue security software - not recommended"
X	AntiVirusProMFC	Antivirus Pro.exe	"AntiVirus Pro rogue security software - not recommended"
?	AntiVirusProtection	qumk.exe	"??"
X	AntivirusProtection	antivirusprotection.exe	"Antivirus Protection rogue security software - not recommended
X	Antivirusscherm	pgs.exe	"Antivirusscherm
X	AntivirusXP.exe	AntivirusXP.exe	"Antivirus XP Pro rogue security software - not recommended
X	AntiVirus_ProNET	AntiVirus_Pro.exe	"AntiVirusPro rogue security software - not recommended
X	AntiVituS	Base.exe	"Added by the BAS.A WORM!"
U	AnVir Security Suite	AnVir.exe	"AnVir Security Suite - ""is a tool that controls everything running on computer and provides Windows enhancements that help in every-day work"". Monitors and manages startup programs
?	anycom bluetooth	ftflauncher.exe	"Associated with an Anycom bluetooth wireless card. What does it do and is it required?"
U	AOL Broadband Check-Up	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	Aol Configuration Loader	aimsng.exe	"Added by the SDBOT-XE WORM!"
X	AOL Instant Messenger dll runtime	MSAOL32dll.exe	"Added by the RBOT-ATA WORM!"
U	AOL Spyware Protection	AOLSP Scheduler.exe	AOL's spyware protection program
X	aolupdater.exe	aolupdater.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Aornum	aornum.exe	"Installed along with
X	aouei	sysrtmvs.exe	"Chivio dialer"
Y	APC UPS Status	Display.exe	"APC PowerChute® Personal Edition status icon"
X	APcSecure	APcSecure.exe	"APcSecure rogue security software - not recommended
N	Application Launcher	Application Launcher.exe	"System Tray access to the Sony Ericsson PC Suite and HTC Sync mobile phone management utilities. Run manually via the Start Menu (or optional desktop shortcut) before connecting the phone"
X	Application Layer Scheduler	agtsvc.exe	"Added by the IRCBOT.BJJ BACKDOOR!"
X	ApplicationProtocolRun	smsbvl32.exe	"Added by the IRCBOT-CX TROJAN!"
U	AppPlus	AppPlus.exe	"AppPlus - ""menu bar or tray launcher that docks to your desktop
X	apyginapygin	simenu.exe	"Added by the SDBOT.BTR WORM!"
U	AQ3HelperStartUp	AQ3HEL~1.EXE	"ScreenScenes ""Aquatica Water Worlds"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	aqadcup.exe	aqadcup.exe	"Added by the AGENT.BG WORM!"
Y	Aqua Dock	Aqua Dock.exe	"Aqua Dock - 'free program that allows you to have an ""OS X"" style
X	Aqujyjax	[path to file]	"Added by the RANCK-CQ TROJAN!"
X	Aqujyjax	aqujyjax.exe	"Added by the SDBOT-YC WORM!"
X	ARCHIVE CONTROL	fixupdattr.exe	"Added by the MYTOB.GU WORM!"
U	Argentum Backup	ab.exe	"Argentum Backup - a small backup program that lets you easily back up your documents and folders"
U	Artera	arteraui.exe	"Artera Turbo Internet Accelerator - ""surf faster
X	Arucer	"rundll32 Arucer.dll	Arucer"
X	Arucer Dynamic Link Library	"rundll32 Arucer.dll	Arucer"
X	ASC-AntiSpyware	WinAntivirus.exe	"Win Antivirus Vista/XP rogue security software - not recommended
X	ASDPLUGIN	dsldbaccess.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	canada.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	france.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	fullgames.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	100171be.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	100176br.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	adult1.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	Austria.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	belgium_nm.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	czech.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	dbaccess.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	dslgeaccess.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	Finland.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	geaccess.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	mexico.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	netherlands.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	turkey.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	uk_nm.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	Xadult1.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	temp532.exe	"AsdPlug premium rate adult content dialer"
N	ASE Scheduler	ASE Scheduler.exe	"Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU
Y	Ashampoo AntiSpyWare 2	AntiSpyWare2Guard.exe	"Part of Ashampoo® AntiSpyWare 2 from Ashampoo GmbH & Co. KG. This part is the realtime monitor that looks for changes on the users system such as BHO
Y	Ashampoo AntiSpyWare 2 Guard	AntiSpyWare2Guard.exe	"Part of Ashampoo® AntiSpyWare 2 from Ashampoo GmbH & Co. KG. This part is the realtime monitor that looks for changes on the users system such as BHO
Y	Ashampoo AntiVirus Service	GuardGui.exe	"System Tray access to the main user interface for Ashampoo® AntiVirus from Ashampoo GmbH & Co. KG."
U	Ashampoo Core Tuner	ct.exe	"Ashampoo® Core Tuner from Ashampoo GmbH & Co. KG - a utility which helps you to get the most out of a multi-processor (or dual core) computer. ""For instant results you just need to select Auto-Optimize to optimize all the programs you are running or Boost to give more power to a single program"". This entry loads Core Tuner with Windows (required if you use any optimized profiles) and gives System Tray access"
U	Ashampoo HDD Control Guard	HDDControlGuard.exe	"Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access"
N	ashampoo Magical UnInstall	MagicalUnInstall.exe	"Ashampoo® Magical UnInstall from Ashampoo GmbH & Co. KG - which monitors each new program installation
U	Ashampoo PopUpBlocker	PopUpKiller.exe	"Ashampoo popup blocker
N	ashampoo UnInstaller Watcher	UIWatcher.exe	"Part of the Ashampoo® UnInstaller series from Ashampoo GmbH & Co. KG - including UnInstaller Platinum 2
U	ASK	rundll32.exe [path] ASK.dll rdl	"Stealth Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	asl	Aslru.exe	"Added by the BANCOS-CU TROJAN!"
U	Asmw Soft Popups Burner	popups burner.exe	"Popup blocker
X	asrupdate.exe	asrupdate.exe	"Added by the VB.ATZ TROJAN!"
X	Astrum	Astrum.exe	"Astrum Antivirus Pro rogue security software - not recommended
X	asus	asus.exe	"Added by the RBOT-OC WORM!"
?	ASUS Camera ScreenSaver	ASScrProlog.exe	"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
N	ASUS Live Update	ALU.exe	ASUS Live Update utility for their motherboards
N	ASUS Probe	AsusProb.exe	ASUS video card fan/thermal monitor - only required if you overclock your card or live in a hot area
?	ASUS Screen Saver Protector	ASScrPro.exe	"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
U	ASUS SmartDoctor	VGAProbe.exe	ASUS video card fan/thermal monitor
U	ASUS TweakEnable	astart.exe	ASUS TweakEnable - restores manually changed settings for ASUS based video cards such as overclocking. Only required if you use non-standard settings
?	AsusACPIServer	AsAcpiSvr.exe	"Part of the ACPI driver for the Asus Eee PC range. What does it do and is it required?"
U	AsusEPCMonitor	AsEPCMon.exe	"Part of the ACPI driver for the Asus Eee PC range. Manages the Fn function keys and ""on screen display"""
N	ASUSGamerOSD	GamerOSD.exe	"GamerOSD by ASUSTek - for ""real-time overclocking
N	ASUSKey	V38SHELL.EXE	System tray Icon for quickly changing video modes
?	AsusStartupHelp	AsRunHelp.exe	"Unknown ASUS motherboard utility. What does it do and is it required?"
X	asussvc	asussvc.exe	"Added by the AGENT-FPB TROJAN!"
U	AsusTray	AsTray.exe	"Part of the ACPI driver for the Asus Eee PC range. Watches the sensors of the motherboard such as power and temperature"
U	asustweakenable	ATweak.exe	ASUS TweakEnable - restores manually changed settings for ASUS based video cards such as overclocking. Only required if you use non-standard settings
N	ASUSWebStorage	ASUSWSDashBoard.exe	"System Tray access to ASUS Webstorage online backup and sharing utility which is pre-installed on some ASUS systems or available for free (with 1GB available) for others. Disable unless you want to automatically backup and sync your files every time your system starts"
N	AsusWSDashBoard	ASUSWSDashBoard.exe	"System Tray access to ASUS Webstorage online backup and sharing utility which is pre-installed on some ASUS systems or available for free (with 1GB available) for others. Disable unless you want to automatically backup and sync your files every time your system starts"
U	AT&T Self Support Tool	matcli.exe	"AT&T Resolution Assistant. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	ATI GART Set-up Utility	Atigart.exe	"Program that checks the motherboard chipset and determines which GART driver bundle to install on ATI video cards. If you have one
U	ATI Launchpad	launchpd.exe	"Convenient way to start all your Multimedia Center applications (DVD
N	ATI Scheduler	Atisched.exe	Component that remains resident in memory and automatically launches the ATI VIDEO PLAYER at a user selected time and date. Delete the shortcut in the Start -> Programs -> Startup folder as well. Functions could re-enable the program to load at start-up and re-introduce the shortcut. Try it and see
X	ATI Technology Startup	techstart.exe	"Added by the RBOT-AEU WORM!"
N	ATICCC	cli.exe runtime	"ATI's Catalyst™ CONTROL CENTER. Required if you want to change graphics settings on a regular basis but you must have internet access and Microsoft's .NET framework installed. Note that this has ""runtime"" appended to cli.exe in the ""Command"" column of MSCONFIG. Recommend that start the program manually via Start → Programs → ATI Catalyst Control Center → Advanced → Restart Runtime as it can cause problems when starting Windows"
U	AtiSound	csrss.exe	"WinSpy surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""ComRoot"" subfolder"
X	atiupdate	ATIUPDATE5.EXE	"Added by the DEBESKI.A TROJAN!"
X	atiupdate	msshed32.exe	Added by the DELF.EP downloader TROJAN!
X	ATIUpdater	atiupdxx.exe	"Added by the RBOT-ABX WORM!"
X	Atiupdpl	atiupdpl.exe	"Added by the SMALL.AOS TROJAN!"
U	ATTBroadbandUpdate	SAUpdate.exe	"Big Brother from Quest Software. System and network monitor"
U	ATTRedUpdate	AutoUpdate.exe	Additional item added to start-ups after AT&T took over the now bankrupt Excite@home high-speed internet service. Included for automatically downloading and installing updates. Leave it unless you plan to regularly run it to check for updates
X	AttuneClientEngine	attune_ce.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	AttuneContentUpdater	attune_cu.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	AttuneDiscovery	attune_di.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	Attunel	Attunel.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	AttuneSystray	attune_st.exe	"Aveo Attune automated helpdesk software - adware/spyware"
N	aTuner	atuner.exe	"aTuner - tweak tool for GeForce based graphics cards"
Y	atwtusb	atwtusb.exe	USB interface for Aiptek Graphics Tablet (USB)
U	au	DealioAu.exe	"Dealio Toolbar is a free shopping comparison toolbar that allows users to search for a wide range of consumer products"
U	AU Agent	AUagent.exe	"Au Agent from Zilab Software. Win2K/NT enhancement tool. Allows you to run applications under any security context without closing the whole logon session to process a new logon"
X	au.exe	au.exe	"Added by the BEAGLE.B WORM!"
Y	AUCBPNP	aucbnpn.exe	Adaptec USB CardBus Safe-Eject - driver for the Adaptec USB 2.0 CardBus which provides USB 2.0 ports for laptop users via a PCMCIA card slot
X	Aucompat	Aucompat.exe	"Added by the GEMA TROJAN!"
X	Audcntr	audcntr.exe	"Added by the GEMA TROJAN!"
?	AudCtrl	"RunDll32 AudCtrl.dll	RCMonitor"
X	audi32	audi32.exe	"Added by the RANCK-FL TROJAN!"
X	AUDIO	SOUND.exe	"Added by the PLOYB-A TROJAN!"
X	Audio Device Manager	winfp.exe	"Added by the IRCBOT-XS WORM!"
X	Audio Device Manager	WinNT.exe	"Added by the IRCBOT.USP BACKDOOR!"
X	Audio Device Manager	WNDXP.exe	"Added by the IRCBOT.AJL BACKDOOR!"
X	Audio Device Manager	sfhgj.exe	"Added by the IRCBOT-ZA BACKDOOR!"
X	audiocfg.exe	audiocfg.exe	Added by the VB.ATE WORM!
X	Audiocntl	audiocntl.exe	"Added by a variant of the CRYPTER.C TROJAN!"
N	AudioCommander	AudioCommander.exe	"System Tray access to the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
N	AudioCommander Application	AudioCommander.exe	"System Tray access to the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
N	AudioCommanderVista	AudioCommander.exe	"System Tray access to the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
N	AudioDeck	ADeck.exe	ADeck.exe is a system tray application for VIA's sound cards which offers quick access to a number of sound card related items
X	Audiodrv	audiodrv.exe	"Added by the CRYPTER-C TROJAN!"
U	AudioDrvEmulator	DLLML.exe AudDrvEm.dll	"Related to Creative DLL Module Loader for the Sound Blaster X-Fi (and maybe others). This program is non-essential process to the running of the system
N	AudioHQ	Ahqtb.exe	For Creative Soundblaster Live! series soundcards. System tray application for SB Live! functions. Available via Start -> Programs
X	AudioHQ	audiohq.exe	"Added by the BANKER-EHK TROJAN!"
N	AudioHQU	AHQTBU.EXE	System Tray application installed with the drivers for Creative Labs SoundBlaster Live! Can be run from Start -> Programs
X	audioinf	audioinf.exe	"Added by a variant of the CRYPTER.C TROJAN!"
X	AudioMan	Explorer.sm1	"Added by the HUPIGON.IFZ BACKDOOR!"
X	audlmne32	dcmsxe.exe	"Added by the MAILBOT-CF TROJAN!"
X	Audoi Device Loader	smssv.exe	"Added by the AGOBOT-ZY WORM!"
X	augmsg	AUGMSG.EXE	"Added by the SPYBOT-CO WORM!"
X	auloadplx	mplprogsm.exe	"Added by the SLAPER.K TROJAN!"
X	AUNPS2	"RUNDLL32 AUNPS2.DLL	_Run@16"
X	aupd	symcsvc.exe	"Added by the ABWIZ.D TROJAN!"
X	aupd	sysvcs.exe	"Added by the ABWIZ.C TROJAN!"
X	aupd	sywsvcs.exe	"Added by the ORSE-M TROJAN!"
Y	Aureal A3D Interactive Audio	sa3dsrv.exe	For Aureal based 3D soundcards. A3D sound features won't work with this disabled
Y	Aureal A3D Interactive Audio Init	A3dInit.exe	For Aureal based 3D soundcards. A3D sound features won't work with this disabled
U	Auslogics BoostSpeed	boostspeed.exe	"System Tray access to Auslogics BoostSpeed system optimization utility - which allows you to ""Start programs faster. Speed up computer start time. Increase Internet speed
U	Auslogics BoostSpeed 4	boostspeed.exe	"System Tray access to Auslogics BoostSpeed 4 system optimization utility - which ""Start programs faster. Speed up computer start time. Increase Internet speed
X	ausvc	ausvc.exe	"Added by the AUTOUPDER TROJAN!"
X	Auth Starter Ident	startauth.exe	"Added by the RBOT-WP WORM!"
Y	Authentic-ID Toolbar	wintmr.exe	"System Tray access to Child Control parental control software by Salfield"
Y	Authentic-ID Toolbar	"rundll32.exe [path] ToolbarATL.dll	LoadTrayIcon"
X	authz	authz.exe	"Added by an unidentified VIRUS
X	auto	win32.exe	"Added by an unidentified TROJAN! See here"
X	auto	auto.exe	"Added by the DOQ.GEN.Y BACKDOOR!"
X	Auto CD-ROM Startup	cdaccess.exe	"Added by the SPYBOT.BLA WORM!"
U	Auto EPSON PictureMate Deluxe on X	E_FATI9TA.EXE	"Epson Status Monitor 3 for the PictureMate Deluxe compact photo printer - for monitoring printer status
U	Auto EPSON Stylus C45 Series on X	E_S4I3T1.EXE	"Epson Status Monitor 3 for the Stylus C45 Series printer - for monitoring printer status
U	Auto EPSON Stylus C48 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C48 Series printer - for monitoring printer status
U	Auto EPSON Stylus C48 Series on X	E_S4I091.EXE	"Epson Status Monitor 3 for the Stylus C48 Series printer - for monitoring printer status
U	Auto EPSON Stylus C60 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C60 Series printer - for monitoring printer status
U	Auto EPSON Stylus C62 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C62 Series printer - for monitoring printer status
U	Auto EPSON Stylus C64 Series on X	E_S4I2C1.EXE	"Epson Status Monitor 3 for the Stylus C64 Series printer - for monitoring printer status
U	Auto EPSON Stylus C82 Series on X	E_S0HIC1.EXE	"Epson Status Monitor 3 for the Stylus C82 Series printer - for monitoring printer status
U	Auto EPSON Stylus C84 Series on X	E_S4I2D1.EXE	"Epson Status Monitor 3 for the Stylus C84 Series printer - for monitoring printer status
U	Auto EPSON Stylus C87 Series on X	E_FATIABL.EXE	"Epson Status Monitor 3 for the Stylus C87 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3200 on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus CX3200 printer - for monitoring printer status
U	Auto EPSON Stylus CX3500 Series on X	E_FATI9 BL.EXE	"Epson Status Monitor 3 for the Stylus CX3500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3600 Series on X	E_FATI9BE.EXE	"Epson Status Monitor 3 for the Stylus CX3600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3700 Series on X	E_FATIACP.EXE	"Epson Status Monitor 3 for the Stylus CX3700 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3800 Series on X	E_FATIACA.EXE	"Epson Status Monitor 3 for the Stylus CX3800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4200 Series on X	E_FATIAEA.EXE	"Epson Status Monitor 3 for the Stylus CX4200 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4500 Series on X	E_FATI9AP.EXE	"Epson Status Monitor 3 for the Stylus CX4500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4600 Series on X	E_FATI9AA.EXE	"Epson Status Monitor 3 for the Stylus CX4600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4800 Series on X	E_FATIADA.EXE	"Epson Status Monitor 3 for the Stylus CX4800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX5000 Series on X	E_FATIBVA.EXE	"Epson Status Monitor 3 for the Stylus CX5000 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX5400 on X	E_S4I2G1.EXE	"Epson Status Monitor 3 for the Stylus CX5400 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX5500 Series on X	E_FATICAP.EXE	"Epson Status Monitor 3 for the Stylus CX5500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6000 Series on X	E_FATIBIA.EXE	"Epson Status Monitor 3 for the Stylus CX6000 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6400 on X	E_S4I2L1.EXE	"Epson Status Monitor 3 for the Stylus CX6400 printer - for monitoring printer status
U	Auto EPSON Stylus CX6600 Series on X	E_FATI9EE.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6600 Series on X	E_FATI9EA.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX7400 Series on X	E_FATICDA.EXE	"Epson Status Monitor 3 for the Stylus CX7400 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX7800 Series on X	E_FATIAFA.EXE	"Epson Status Monitor 3 for the Stylus CX7800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX9400Fax Series on X	E_FATICFA.EXE	"Epson Status Monitor 3 for the Stylus CX9400Fax Series printer - for monitoring printer status
U	Auto EPSON Stylus D78 Series on X	E_FATIBGE.EXE	"Epson Status Monitor 3 for the Stylus D78 Series printer - for monitoring printer status
U	Auto EPSON Stylus D88 Series on X	E_FATIABE.EXE	"Epson Status Monitor 3 for the Stylus D88 Series printer - for monitoring printer status
U	Auto EPSON Stylus DX3800 Series on X	E_FATIACE.EXE	"Epson Status Monitor 3 for the Stylus DX3800 Series printer - for monitoring printer status
U	Auto EPSON Stylus DX4800 Series on X	E_FATIADE.EXE	"Epson Status Monitor 3 for the Stylus DX4800 Series printer - for monitoring printer status
U	Auto EPSON Stylus DX6000 Series on X	E_FATIBIE.EXE	"Epson Status Monitor 3 for the Stylus DX6000 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo 1400 Series on X	E_FATIBUA.EXE	"Epson Status Monitor 3 for the Stylus Photo 1400 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo 820 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo 820 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R1800 on X	E_FATI9LA.EXE	"Epson Status Monitor 3 for the Stylus Photo R1800 printer - for monitoring printer status
U	Auto EPSON Stylus Photo R200 Series on X	E_S4I2H1.EXE	"Epson Status Monitor 3 for the Stylus Photo R200 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R200 Series on X	E_S4I0H2.EXE	"Epson Status Monitor 3 for the Stylus Photo R200 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R220 Series on X	E_FATIAIE.EXE	"Epson Status Monitor 3 for the Stylus Photo R220 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R2400 on X	E_FATI9SA.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	Auto EPSON Stylus Photo R2400 on X	E_FATI9SE.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	Auto EPSON Stylus Photo R260 Series on X	E_FATIBNA.EXE	"Epson Status Monitor 3 for the Stylus Photo R260 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R280 Series on X	E_FATICKA.EXE	"Epson Status Monitor 3 for the Stylus Photo R280 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R300 Series on X	E_S4I2F1.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R300 Series on X	E_S4I0F2.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R320 Series on X	E_FATI9FA.EXE	"Epson Status Monitor 3 for the Stylus Photo R320 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R340 Series on X	E_FATIAJE.EXE	"Epson Status Monitor 3 for the Stylus Photo R340 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R800 on X	E_FATI9YE.EXE	"Epson Status Monitor 3 for the Stylus Photo R800 printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX420 Series on X	E_FATI9CE.EXE	"Epson Status Monitor 3 for the Stylus Photo RX420 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX500 on X	E_S4I2K1.EXE	"Epson Status Monitor 3 for the Stylus Photo RX500 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX600 on X	E_S4I2M1.EXE	"Epson Status Monitor 3 for the Stylus Photo RX600 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX680 Series on X	E_FATICJA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX680 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX700 Series on X	E_FATI9IA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX700 Series printer - for monitoring printer status
U	Auto EPSON Stylus Pro 7600 on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Pro 7600 printer - for monitoring printer status
X	Auto File System Conversion Utility	scricon.exe	"Added by the SDBOT.EYB WORM!"
X	auto repair system	qualityx.exe	"Added by an unidentified WORM or TROJAN - probably a SPYBOT variant"
U	Auto Run Software for Photo Frame	PhotoManager.exe	"Management software for Philips digital PhotoFrame range. Used to edit photos and transfer them directly from a PC via a USB cable. Start manually when you connect the device"
X	Auto Scroll Loader	ASCRLL.EXE	"Added by the SPYBOT-T WORM!"
X	Auto Start	dosin.exe	"Added by the SDBOT-GO BACKDOOR!"
X	Auto Start	sndvol32.exe	"Added by the SLINBOT.AX BACKDOOR!"
X	Auto Start	windos.exe	"Added by the SLINBOT.BO BACKDOOR!"
U	Auto Switch	TASKBAR.exe	Related to 2-port Bitronics AutoSwitch kit from Belkin
N	Auto T Bar	autotbar.exe	If you disable the HP VIEW toolbar in IE and rearrange the toolbars on a reboot they will be back as they were before if this is left enabled
X	Auto Updat	WindowsSys32.exe	"Added by a variant of the FORBOT WORM!"
X	Auto updat	crcss.exe	"Added by the SDBOT.AAG WORM!"
X	Auto updat	SysDebug.exe	"Added by the FORBOT-BA WORM!"
X	Auto Update	AUP.exe	Added by an unididentified WORM or TROJAN!
X	Auto Update	dma.exe	"Added by the RBOT-AVO WORM!"
X	Auto Update	svchost.exe	"Added by the DUMARDI-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Auto Updater	asclt.exe	"Added by the SLINBOT.CJ BACKDOOR!"
X	Auto Updates	svchost.exe	"Added by the CHEUKO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Auto WinUpdate	taskmrg.exe	"Added by the RBOT-AFA WORM!"
X	AutoAdministrator	SERVICES.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Root%\Application Data\WINDOWS"
U	Autobar	autobar.exe	"Connect buttons on the keyboard for internet direct access
N	AutoCAD	acstart17.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
N	AutoCAD Startup Accelerator	acstart16.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
N	AutoCAD Startup Accelerator	acstart17.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
X	autochk	"rundll32.exe autochk.dll	_IWMPEvents@16"
X	autochk	"rundll32.exe protect.dll	_IWMPEvents@16"
U	autoclk	autoclk.exe	"Autoclik is a Windows utility ""that allows you to perform all mouse activity with absolutely no clicking"""
X	AutoDiscovery/AutoPurge (ADAP) Service	wmiadapi.exe	"Added by the RBOT.FLT WORM!"
N	AutoEA	Ahqrun.exe	For Creative Soundblaster Live! series soundcards. Specify for any audio application what audio preset to automatically associate with currently active speaker output. Available via AudioHQ
X	AUTOEXE	AUTOEXE.exe	"Added by the SEMAPI-A WORM!"
X	autoload	cftmon.exe	"Added by the SOCKS-E WORM!"
X	autoload	spooll.exe	"Added by the SILLYFDC WORM!"
X	autoload	windowsupdate.exe	"Added by the POLYCRYP.DY TROJAN!"
X	autoload	spool.exe	"Added by the AGENT-GSG TROJAN!"
X	Autoloaderaproposclient	Apropos_Client_Loader.exe	"AproposMedia adware"
X	Autoloaderaproposclient	cxtpls_loader.exe	"AproposMedia adware"
X	AutoLoaderEnvoloAutoUpdater	auto_update_loader.exe	"Envolo/AproposMedia adware updater"
N	AutoMate Task Service	automate.exe	"Task scheduler for Unisyn Automate 4 task automation/macro running software. Available via a desktop shortcut or Start → Programs"
U	AutoMate5	Am5HkWnd.exe	"""Automate is the Leading Software for Automation of front and back-office business processes.It provides all the tools necessary to completely automate business processes
U	AutoMate6	AMEM.exe	"AutoMate 6 for automating repetitive tasks"
X	Automated Windows Updates	wauclt.exe	"Added by the GAOBOT.AJD WORM!"
X	Automatic Defrag Manager	defrag.exe	"Added by the RBOT-AKE WORM!"
X	Automatic Media Update	CACHE.RVD	Added by an unidentified WORM/TROJAN!
X	Automatic Media Update	HPLNT32.RVD	Added by an unidentified WORM/TROJAN!
X	Automatic Microsoft Windows Updater	suchost.exe	"Added by the RBOT-EQ WORM!"
X	Automatic Updates	algs.exe	"Added by the IRCBOT-AAM TROJAN!"
X	Automatic Windows Updater	Update.exe	"Added by the GAOBOT.AO WORM!"
N	Automatically launches the United Devices Agent when you start your computer	UD.EXE	The United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home but for medical research. Available via Start > Programs
X	autoMe	wscript.exe solution.vbs	"Added by the VBS.SASAN WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""solution.vbs"" file is found in %Windir%"
X	autoMe	wscript.exe samok.vbs	"Added by the SAMOK-A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""samok.vbs"" file is located in %Windir%"
X	Autopdate	Autopdate.exe	"Added by the RBOT-AGL WORM!"
N	AUTOPROP	REGPROP.EXE WMPADDIN.DLL	"Both the files are in the MS Office/Bots/FP_WMP directory. Apparently
X	AutoProtect	AutoProtect.vbs	"Added by the KILLBAT-C WORM!"
X	AUTOPROTECTU	navapq32.exe	Added by an unidentified WORM or TROJAN!
X	autorepair	dexs.exe	"Added by a variant of the SDBOT WORM!"
X	autorn	autorn.exe	"Added by the SILLYFDC.BCY WORM!"
U	Autoroute SMTP	AutoSmtp.exe	"Autoroute SMTP - ""automatic switching between SMTP servers depending on what network you are currently working in."" You need to have two Internet service providers"
X	autorun	autorun.exe	"Added by the AUTOM-B WORM!"
X	autorun	sxs.exe	"Added by the SMALLVBS-A WORM!"
X	autorun	winmain.exe	Added by a variant of the DELF.CNS TROJAN!
X	AutoRun	allrs.exe	"Added by the MUDROP.LJ TROJAN!"
X	autorundemo	[path to trojan]	"Added by the AGENT-FPX TROJAN!"
X	AUTORUN_VAL	AntiSpyCheck 2.1.exe	"AntiSpyCheck rogue spyware remover - not recommended
X	AUTORUN_VAL	asc 2.1.exe	"AntiSpyCheck rogue spyware remover - not recommended
?	AutoShutdown	pssvc.exe	"Utility to fix vCard Export in MS Outlook 2000 - although why are these together?"
U	AutoSizer	AUTOSIZER.EXE	"AutoSizer - utility that automatically maximizes windows when they're opened"
N	AutoSpell	autospel.exe	"AutoSpell - spell checker (version 6.*)"
N	AutoSpell 5	ASWATC32.EXE	"AutoSpell - spell checker"
U	AutoSys	autosys.exe	"Winguardian surveillance software. Uninstall this software unless you put it there yourself"
N	autotbar	autotbar.exe	If you disable the HP VIEW toolbar in IE and rearrange the toolbars on a reboot they will be back as they were before if this is left enabled
N	AutoTKit	AUTOTKIT.EXE	On HP PC's. Unclear what purpose it serves - but there's a known issue with Internet Explorer Toolbar settings not being saved with it enabled
N	autoupd	autoupd.exe	Raxco Software auto update utility
X	autoupd	autoupd.exe	"Added by an unidentified VIRUS
X	autoupdate	"rundll32 DATADX.DLL	SHStart"
X	autoupdate	"rundll32 SUPDATE.DLL	SHStart"
X	AutoUpdate	smss.exe	"Added by WINSPY.88! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\debug64"
X	Autoupdate Service	kaka.exe	"Added by the SYMPE-B TROJAN!"
X	Autoupdate Service	[path to trojan]	"Added by the AGENT-CB TROJAN!"
X	AutoUpdate32	services.exe	"Added by WINSPY.88! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\debug64"
X	AutoUpdater	aupdate.exe	"Tinybar variant"
X	AutoUpdater	AutoUpdate.exe	"PeopleonPage foistware"
X	autoupdatev2	[path to file]	"Added by the DROPPER-BM TROJAN!"
X	autoupdatev2	autoupdatev2.exe	"Detected by Kaspersky as the AGENT.FQ TROJAN!"
X	AutoVirusProtection	ciscv.exe	"Added by a variant of the RBOT WORM!"
X	auto__antiav__key	antiav_exe.exe	"Added by the BAGLEDI-AA TROJAN!"
X	auto__hloader__key	hloader_exe.exe	"Added by the BAGLE.AB TROJAN!"
X	aux.exe	aux.exe	"Added by the ZINS TROJAN!"
X	auxAudioDevice	aux32.exe	"Added by the AIZU WORM!"
N	AUXXTRAY	au30setp.exe	System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel
X	AV	UPDATE-28062004.exe[25 blank spaces].vbs	"Added by the MIDFIN WORM!"
X	AV Industry	patch31345.exe	"Added by the MYDOOM.AD WORM!"
X	AV UpDate	Update.exe	"Added by the FUROOT-A TROJAN!"
X	AV7	antivirus7.exe	"Antivirus7 rogue security software - not recommended
X	AVantivirus	Avconsol.exe	"Added by the MSNVB-D WORM!"
Y	avast! Antivirus	ashDisp.exe	"System Tray access to and notifications for avast! Antivirus - giving left-click access to the On-Access Scanner
X	AveoAttune	atmdlusr.exe	"Aveo Attune automated helpdesk software - adware/spyware"
Y	AVG Anti-Virus system	avgcc.exe	"System Tray access to and notifications for the 7.* series of anti-virus products from AVG Technologies. If this entry is disabled
Y	AVG Anti-Virus System	avgemc.exe	"E-mail scanner for the 7.* series of anti-virus products from AVG Technologies. This process scans incoming and outgoing E-mails for viruses and other malware. From version 7.1 onwards this entry only appears in 9x/Me as a startup entry
Y	AVG Anti-Virus System	avgw.exe	"This entry is included with the 7.* series of anti-virus products from AVG Technologies. Once installed (or on first run for a different user) it runs the configuration sequence to set up the product and doesn't run on subsequent restarts"
X	Avg Antivirus	icpldrvx.exe	"Added by the BANKER.BYU TROJAN!"
X	AVG AntiVirus Scanner	avgscnx.exe	"Added by the SILLYFDC.BBE WORM! Note - this is not a legitimate AVG entry"
X	AVG AntiVirus Updater	avgwusv.exe	"Added by the SILLYFDC.BAX WORM! Note - this is not a legitimare AVG entry"
X	AVG Grisoft Updater	updater.exe	"Added by the AGOBOT-OT WORM!"
Y	AVG IDS	AVGIDSUI.exe	"System Tray access to and notifications for AVG Identity Protection - identity theft prevention which is available as a stand-alone product or included with AVG Internet Security. ""Always-on identity theft prevention for Windows from one of the world's most trusted security companies. Shop and ensure safe surfing of the web
U	AVG Internet Security	avgtray.exe	"System Tray access to and notifications for the range of internet security products from AVG Technologies - including Internet Security
Y	AVG7_Run	avgw.exe	"This entry is included with the 7.* series of anti-virus products from AVG Technologies. Once installed (or on first run for a different user) it runs the configuration sequence to set up the product and doesn't run on subsequent restarts"
Y	AVGIDS	AVGIDSUI.exe	"System Tray access to and notifications for AVG Identity Protection - identity theft prevention which is available as a stand-alone product or included with AVG Internet Security. ""Always-on identity theft prevention for Windows from one of the world's most trusted security companies. Shop and ensure safe surfing of the web
Y	AVGIDSUI	AVGIDSUI.exe	"System Tray access to and notifications for AVG Identity Protection - identity theft prevention which is available as a stand-alone product or included with AVG Internet Security. ""Always-on identity theft prevention for Windows from one of the world's most trusted security companies. Shop and ensure safe surfing of the web
Y	AVGuard	AVGuard.exe	"AntiVir® PersonalEdition Classic antivirus. Background task which scans files transparently"
X	avguard3876	000b09274b.exe	"AntiVirus ransomware security software - not recommended
X	Avira Anti-Virus Pro 2008	explorear.exe	Added by an unidentified WORM or TROJAN!
?	AvMenu	AVMenu.exe	"Part of the ArcaVir antivirus suite from Polish company Arcabit. What does this part do and is it required?"
Y	AVMWlanClient	wlangui.exe	Related to broadband products from avm.de
X	avp	win.tmp.exe [ is a number]	Added by a variant of the ALPHABET TROJAN!
X	avpl	Antivirus.exe	"AntiVirus Plasma rogue security software - not recommended
X	Avptask	rund1132.exe	"Added by the AGENT.PKZ TROJAN!"
X	Avril Lavigne - Muse	[random filename]	"Added by the AVRIL-A WORM!"
X	avscan	Usbconeted.exe	"Added by the PROVIS-A TROJAN!"
X	AVScheduler	AVSCHSVC.EXE	"Part of the WinAntiVirus Pro 2005 rogue security software when installed in Win98/Me - not recommended
X	AVSeguro	pgs.exe	"AVSeguro
X	AvSer	sysup.exe	"Added by the SERFLOG.B WORM!"
U	AVStation premium	AVStation agent.exe	"Related to Samsung AV Station - instant playback of music
X	AVupdate32 Update	AVupdate32.exe	"Added by the RBOT.CNI TROJAN!"
Y	AVWUpd32	AVWUPD32.EXE	"AntiVir® PersonalEdition Classic - updater"
Y	avx communicator	xcommsur.exe	"Anti-virus part of BitDefender virus scanner/firewall"
?	AWUSGSTA	AWUSGSTA.exe	"Reportedly related to a USB Wifi Adapter - is it required at startup?"
?	AxFilter	"Rundll32 AXFILTER.DLL	Rundll32"
Y	a�	a2guard.exe	"System Tray access to and Anti-Malware Guard feature of Emsisoft Anti-Malware from Emsi Software GmbH - which provides ""comprehensive PC protection against viruses
X	b3d	BDEsecureinstall.exe	"B3d Projector foistware - periodically trys to access the internet. (1) Uninstall it via Start -> Settings -> Control Panel -> Add/Remove Programs. (2) Remove the BDEsecureinstall.exe if still present in the ""System"" directory. (3) Disable and ideally delete it from the registry. (4) Remove the ""BDE"" directory and all its contents"
X	b3dUpdate	Zupdate.exe	"Associated with B3d Projector foistware - see here"
X	babeie	"rundll32 cnbabe.dll	dllstartup"
X	Back Updates	Uninstall.log.vbs	"Added by the YPSAN.D WORM!"
X	Backdoor.NuAgent	agent.exe	"Added by the AGENT-DP TROJAN!"
X	Background Intelligent Transfer Service	[path] rundll32.exe	"Added by the VB-ZD TROJAN! Note - this is not the legitimate rundll32.exe process
U	BackgroundSwitcher	bgswitch.exe	"Originally included with Microsoft's XP PowerToys (but now withdrawn - see here
U	BackgroundSwitcher	BackgroundSwitcher.exe	"John's Background Switcher (or JBS for short) periodically changes the background image on your computer (like every hour or every day) to something interesting"
N	Backpack UDF	bpudfmon.exe	"Backpack UDF packet writing software for Microssolutions' Back Pack external CD-RW drive. Similar to DirectCD. Run manually before insert an appropriately formatted CD-RW disk"
X	backup	[path to worm]	"Added by the AGOBOT-H WORM!"
U	Backup NOW! Scheduler	Schdlr32.exe	"Scheduled backups for the NTI Backup Now archiving utility. If a backup job has been scheduled
X	Backup One	smbguard.exe	"Added by the SDBOT-MI WORM!"
X	Backup Service	backup.svc	Unidentified adware
X	BackUp Windows 2009	[random].exe	"Added by the AGENT-LUJ TROJAN!"
U	Backup4all OTB Agent	B4AOTB.exe	"""Backup4all is an award-winning data backup software for Windows. This backup utility was designed to protect your valuable data from partial or total loss by automating backup tasks
U	BackupExecScheduler	besch.exe	"Veritas ""Back Up My PC"" software"
?	BackupNotify	backupnotify.exe	"HP Digital Imaging related. What does it do and is it required?"
U	Banpopup by Pratik	Banpopup.exe	Banpopup - popup killer
X	Banyak_Kerjaan	Tukang.exe	"Added by the SILLYFDC.BDM WORM!"
X	bargains	bargainbuddy.exe	"BargainBuddy adware"
X	BastioneAntivirus	pgs.exe	"BastioneAntivirus
X	Bat	secure2.bat	"Added by the ZCREW.C TROJAN!"
U	BatInfEx	"rundll32.exe [path] BatInfEx.dll	BMMAutonomicMonitor"
U	BatLogEx	"rundll32.exe [path] BatLogEx.DLL	StartBattLog"
U	BAUSB	BAUSB.exe	"Boston Acoustics Audio
U	Bayden SlickRun	sr.exe	"""SlickRun is a floating command line utility for Windows. It gives you almost instant access to any program or website. SlickRun allows you to create command aliases (known as MagicWords)
U	Bayswap2	TbUpdate.exe	Hot-swappable drive management on Compaq Notebooks which allows you to swap drives without closing down Windows. Only required if you frequently swap bay devices
N	BBLauncher.exe	BBLauncher.exe	"BounceBack Professional - back-up software"
U	bbui	bbui.exe	AOL DSL status monitor displaying a red/green icon indicating if you have a connection
U	BCMHal	"rundll32.exe bcmhal9x.dll	bcinit"
X	Beegees Update	beegees.exe	"Added by the SDBOT-ADK WORM!"
U	Belkin F5D8013 N Wireless Notebook Card Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8013 N Wireless Notebook Card"
U	Belkin F5D8053 N Wireless USB Adapter Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8053 N Wireless USB Adapter"
U	Belkin F5D8073 N Wireless ExpressCard Adapter Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8073 N Wireless ExpressCard Adapter"
U	Belkin Wireless G Notebook Card Client Utility	Belkinwcui.exe	Wireless configuration utility for the Belkin F5D701F Wireless G Notebook Card
U	Belkin Wireless USB Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D7050 Wireless G USB Adapter"
U	Belkin Wireless Utility	Belkinwcui.exe	"Wireless configuration utility for some Belkin cards such as the F5D7000 Wireless G Desktop Card"
U	BellSouthAlertManager.exe	BellSouthAlertManager.exe	"Related to BellSouth Alert Manager"
U	BelNotify	"rundll32.exe [path] NPBelv32.dll	RunDll32_BelNotify"
U	BestCrypt Auto Open	BestCrypt.exe	"BestCrypt from Jetico
X	BestPopUpKiller	BestPopupKiller.exe	"Popup killer by Swanksoft - not recommended
X	BestsellerAntivirus	pgs.exe	"BestsellerAntivirus rogue security software - not recommended
Y	bg	bullguard.exe	"Bullguard antivirus and firewall. The P2P version is free with KaZaA Media Desktop and Grokster"
X	Bharatayuda	GNB.exe	"Added by the BHARAT.A WORM!"
U	BI1HelperStartUp	BI1HEL~1.EXE	"ScreenScenes ""Beach Islands"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	BIE	"Rundll32.exe [path] BDSrHook.dll	Rundll32"
U	BigPond Toolbar	bpumTray.exe	"Telstra BigPond Toolbar - ""Introducing the free and easy to use BigPond Toolbar that is designed to make your internet experience and managing your Telstra internet account a whole lot easier"""
X	bin32hpu	ppstub.exe	"PrecisionPop adware"
U	Biomenu	menusw.exe	"Related to Sony VAIO - passwords
X	BitDefender Antivirus	BITDEFENDERX.EXE	"Added by a variant of the SPYBOT WORM!"
Y	BitDefender Communicator	xcommsvr.exe	"BitDefender antivirus"
Y	BitDefender Virus Shield	vsserv.exe	"BitDefender antivirus"
U	BitDefender_P2P_Startup	BitDefender_P2P_Startup.exe	"Bitdefender anti-virus for P2P clients - no longer supported at the BitDefender website"
N	BJ Printer Status Monitor	Cjstsr.exe	Canon BJ printer status monitor
N	BJ Status Monitor 5xx	CJSTRxx.EXE	Canon printer status monitor - where "xx" is different depending upon the version. Not required as you can check the printer status via My Computer -> Printers
U	BJLaunchEXE	BJLaunch.exe	"Memory Card Utility for the Canon i470D
N	BlackBerryAutoUpdate	RIMAutoUpdate.exe	"Automatic updates for BlackBerry smartphones
N	BlackIce Utility	blackice.exe	"Loads the user interface for the BlackICE PC Protection (was Defender) firewall. From the parent site - '(the user interface) starts in the ""Startup"" menu and adds itself to the taskbar. The user interface is independent from the rest of the system and only displays the output or reconfigures the system. It does not need to be running for the rest of the system to run.' BlackICE was supported by IBM Internet Security Systems (formerly just ISS) when them acquired the NetworkICE parent but is no longer available. See also LoadBlackD"
X	blah service	winupdate.exe	"Added by the GAOBOT.BIA WORM!"
X	Blank AntiViri	AUT0EXEC.BAT StartUp	"Added by the BRONTOK-CJ WORM!"
N	bldbubg	bldbubg.exe	Part of Dell Alerts which provides customers with an update on latest updates for his/her system
X	Blocker System611 Monitoring	PopUpBlocker611.exe	"Added by the RBOT.BLJ WORM!"
U	BLOG	"rundll32.exe [path] BatLogEx.DLL	StartBattLog"
N	Blubster	Blubster.exe	"Related to Blubster Music sharing service"
U	Blue Frog	bluefrog.exe	"Blue Frog by Blue Security Inc. - actively fights spam by posting complaints on the sites advertised by the spam you receive"
X	Blue Service	[path to trojan]	"Added by the BANCOS-BCW TROJAN!"
?	BlueLight_uoltray	exec.exe	"Related to BlueLight Internet. What does it do and is it required?"
U	BlueSoleil	BLUESO~1.EXE	"BlueSoleil Bluetooth wireless manager from IVT Corporation"
U	BlueSpace NE	BlueSpaceNE.exe	"""BlueSpace NE is a utility program used to run the Bluetooth function on VAIO computers that support the Bluetooth function or on VAIO computers connected to the Bluetooth USB adapter"". Shortcut available via Start -> Programs"
X	Bluetooth Config	btwindin32.exe	"Added by the SDBOT-DFN WORM!"
U	Bluetooth Connection Assistant	LBTWiz.exe	"Bluetooth connection manager for Logitech based bluetooth wireless products"
?	Bluetooth HCI Monitor	"RunDll32 HCIMNTR.DLL	RunCheckHCIMode"
U	BluetoothAuthenticationAgent	"rundll32.exe irprops.cpl
U	BluetoothAuthenticationAgent	"rundll32.exe bthprops.cpl
U	blueyonder Instant Support Tool	matcli.exe	"Blueyonder Instant Support Tool. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	BMMGAG	"RunDll32 [path] pwrmonit.dll	StartPwrMonitor"
U	BMMMONWND	"rundll32.exe [path] BatInfEx.dll	BMMAutonomicMonitor"
N	BMupdate	BMupdate.exe	"Related to the BookmarkCentral entry. Typically added after downloading drivers for Visioneer scanners for example
U	BO1HelperStartUp	BO1HEL~1.EXE	"ScreenScenes ""Butterfly Oasis"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	BO1HelperStartUp	Bo1helper.exe	"ScreenScenes ""Butterfly Oasis"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	boby	netburn.scr	"Added by the BANCBAN-OX TROJAN!"
Y	BOCleanautostart	Boclean.exe	"NSClean's BOClean anti-trojan software"
U	Boingo Wireless Utility	Icon###XXX#X#.exe	"Starts the Boingo Wireless utility
X	Bonzi Buddy	??	"Bonzi Buddy adware - see here for removal instructions"
X	BookedSpace	"RunDLL32.EXE bs2.dll	DllRun"
N	BookmarkCentral	BMLauncher.exe	"Bookmark Express - "offers a more flexible way to manage Web site bookmarks
X	BootsCfg	wscript.exe [path] All Users.vbs	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbe	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
Y	BootSkin Startup Jobs	BootSkin.exe	"Stardock BootSkin is a program that allows users to change their Windows 2000 and Windows XP boot screens"
U	BootStatus	BOOTST~1.EXE	"Visual Basic program that pops up a small window on startup telling you how many times the machine has been booted that day. Once you exit it
X	BortMedVirus	pgs.exe	"BortMedVirus rogue security software - not recommended. A member of the AVSystemCare family"
X	Bouncer RunStartup	bouncer.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
X	Bouncer RunStartup	LiveUpdate.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
X	Bridge	"rundll32.exe [path] Bridge.dll	Load"
N	BroadCamRun	broadCam.exe	"BroadCam is an easy to use video streamer designed to broadcast live video using a webcam (or other camera) and microphone"
U	Broadcom Wireless Manager UI	bcmntray.exe	"Related to Broadcom Network Adapters for additional configuration options for these devices. Should not be terminated unless suspected to be causing problems"
N	Broadcom Wireless Manager UI	wltray.exe	System tray access to wireless LAN card configuration options
X	Bron-Spizaetus	CVT.exe	"Added by the RONTOKBRO WORM!"
X	Bron-Spizaetus	norBtok.exe	"Added by the RONTOKBRO.B WORM!"
X	Bron-Spizaetus	[path to file]	"Added by the BRONTOK-F WORM!"
X	Bron-Spizaetus	bronstab.exe	"Added by the RONTOKBRO.C WORM!"
X	Bron-Spizaetus	eksplorasi.exe	"Added by the RONTOKBRO.J WORM!"
X	Bron-Spizaetus	ElnorB.exe	"Added by the RONTOKBRO.D WORM!"
X	Bron-Spizaetus	sempalong.exe	"Added by the BRONTOK-E WORM!"
X	Bron-Spizaetus	RakyatKelaparan.exe	"Added by the BRONTOK-J or BRONTOK-L WORMS!"
X	Bron-Spizaetus-5118REPM	komodo-6321422.exe	"Added by the BRONTOK-R WORM!"
X	Bron-Spizaetus-cfgmktoq	bbm-qotkmgfc.exe	"Added by the BRONTOK-M WORM!"
X	Bron-Spizaetus-cfgmmnru	bbm-urnmmgfc.exe	"Added by the BRONTOK-N WORM!"
X	browser	s_menu.exe	"Added by the TACTSLAY.C TROJAN!"
U	Browser Launcher	Commandr.exe	Logitech internet keyboard "Commander" software - loads the software for the shortcut keys on the keyboard. Not required unless you want to use the short cut keys
X	BrowserUpdateSched	[random filename]	"ZenoSearch adware"
X	Bsx3	"RunDLL32.EXE bs3.dll	DllRun"
Y	BTUSRBDG	BtUsrBdg.exe	"Used with a Mitsumi USB Bluetooth adaptor (and maybe others)"
Y	BTUSRBDGF	BtUsrBdg.exe	"Used with a Mitsumi USB Bluetooth adaptor (and maybe others)"
Y	Bubble	Bubble.exe	"Part of Windows SteadyState
N	Buddyizer	Buddyizer.exe	Part of the AIMster Peer to Peer (P2P) file sharing application that runs over the AOL Instant Messenger network
N	BudgetSip	BudgetSip.exe	"BudgetSip - internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
U	BUFFALO Power Save Utility for HD	HDManage.exe	"Power Save utility for Buffalo backup hard discs"
Y	BufferZone	CLIENTGUI.EXE	"BufferZone from Trustware - ""is the only security software that creates a separate environment allowing you unlimited freedom to enjoy all Internet activities without the fear of external threats"""
N	Bug Eliminator	Bug_Elim.exe	"Bug Eliminator - ""performs a complete health check on your computer safely
X	BugsDestroyer	SysRep.exe	"BugsDestroyer rogue system error and cleaning utility - not recommended
U	bugwatcher service	bugwatcher.exe	"
N	BuildBU	bldbubg.exe	Part of Dell Alerts which provides customers with an update on latest updates for his/her system
X	BuildLab	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
X	BuildLab	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	BuildLabs	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	BuildLabs	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	bulk	bulk.exe	"Added by the AGOBOT-ACR WORM!"
U	Bulldog Service	upsd.exe	Belkin's Bulldog Plus control software which runs under Windows 95 or later and monitors the UPS (Uninterrupted Power Supply) via a serial or USB link
N	BulletProof FTP Server	bpftpserver.exe	"BulletProof FTP Server"
Y	BullGuard	mgui.exe	"Part of Bullguard antivirus"
Y	BullGuard	BullGuard.exe	"Part of BullGuard antivirus"
U	BullGuard Update	avxlive.exe	"Part of Bullguard antivirus. Leave enabled unless you manually update virus definitions"
Y	BullGuard XComm	XCOMMSVR.EXE	"Part of Bullguard antivirus"
Y	BullGuardInit	AVXINIT.EXE	"Part of Bullguard antivirus"
Y	BullguardoptIn	bulldownload.exe	"Part of Bullguard antivirus"
X	BullsEye	bargains.exe	"BargainBuddy adware"
X	BullsEye Network	bargains.exe	"BargainBuddy adware"
?	BullsEye Tracker	BeTrack.exe	Bullseye - intelligent research assistant
X	Bunx	beagle.exe	"Added by the LEBREAT-E WORM!"
X	buohxqtfswb	gcjydr.exe	"Added by the AGENT-NRC TROJAN!"
X	buritos	buritos.exe	Identified as a variant of the Downloader.FraudLoad.C malware
N	BurnQuick Queue	BQTray.exe	"System Tray access to BurnQuick CD burning software. Only required if you use the queueing facility
U	Button Server	bttnserv.exe	"Found on a Compaq PC
N	ButtonKey	ButtonKey.exe	"CyberView TWAIN driver for the Pacific Image range of 35mm film scanners. Enables the one touch scanning button and places an icon an the System Tray. Use your scanners software or run it manually by creating a shortcut"
N	Buzme	Bmui.exe	"Buzme by RingCentral
U	BuzMe	RCUI.exe	"Display Client for the BuzMe Internet Call Waiting Service"
U	Buzof.exe	buzof.exe	"Buzof from Basta Computing "enables you to automatically answer
X	bxsx5	"RunDLL32.EXE bsx5.dll	DllRun"
X	bxxs5	"RunDLL32.EXE bxxs5.dll	dllrun"
?	BZUtilizationCollector	BZUtilizationCollector.exe	"Part of BlazentAgent from Blazent who provide ""outsourcing governance automation for IT Outsourcing (ITO) relationships"". What does it do and is it required?"
X	C:WINDOWSsystem32SetupCmd.exe	SetupCmd.exe	"Detected by Kaspersky as the AGENT.AAW TROJAN!"
U	Caddais BackupOnDemand	BODMon.exe	"Caddais BackupOnDemand - "runs in the background and monitors your important files for changes. Within seconds of changing
X	cAgOu	[filename].hta	"Added by the KAKWORM WORM!"
X	caidiysetup	diynetsetupuni.exe	"DIYNet adware"
N	Cal Reminder Shortcut	calrem.exe	Produces a pop-up reminder of events scheduled using the MS Office Calendar
X	calc	"rundll32.exe [path] ntuser.dll	_IWMPEvents@0"
X	calc	"rundll32.exe calc.dll	_IWMPEvents@0"
X	Call Function System32	sddriver.exe	"Added by a variant of the SDBOT TROJAN!"
Y	CallBumping	cbpopw.exe	"Related to the Gazel 128 PCI ISDN adapter. Required if you use it"
?	CameraApplicationLauncher	CameraApplicationLaunchpadLauncher.exe	"Supports the integrated webcam on IBM/Lenovo Thinkpad notebooks. What does it do and is it required?"
U	Canon MultiPASS Status Monitor	monitr32.exe	Cannon Multi-Pass status monitor - your choice
?	Canon PC1200 iC D600 iR1200G Status Window	CAPM1LAK.EXE	"Cannon printer related - is it required in startup?"
U	CanonSolutionMenu	CNSLMAIN.exe	"
U	capfupgrade	capfupgrade.exe	"CA Personal Firewall - part of the CA Internet Security Suite"
X	Captcha7	rundll captcha.dll	"Added by the TINY.WRE TROJAN!"
X	capture	capture.exe	"Added by the THEEF-B TROJAN!"
N	Capture Express 2000	capexp.exe	"Capture Express - screen capture utility"
U	CaptureAssistant	CaptureAssistant.exe	"Capture Assistant ""is a convenient and easy-to-use text and graphics capture tool"". It allows you to capture text
N	CaptureBat	Capture.exe	"!Quick Screen Capture from EtruSoft Inc. - ""allows you to take screenshots from any part of your screen in more than 10 ways
N	Carbonite Backup	CarboniteUI.exe	"""Carbonite's online backup service starts automatically and works quietly and continuously in the background protecting your data"""
?	CardScan AutoSync	CSyncCfg.exe	"Related to the CardScan business card reader range of products. May be related to synchronization with E-mail software and mobile devices (see here)?"
U	Care2GTU	Care2GTU.exe	"Care2 Green Thumbs-Up (from the Care2 site). Every online purchase helps environmental causes; tells you how eco-friendly a company really is
X	Cas2Stub	cas2stub.exe	"CasinoClient adware"
N	Cashsurfers Cashbar Navigator	Cashbar.Exe	"Cashsurfers CashBar Navigator - ""The CashBar rotates banner advertisements once per minute and provides you with access to up to date special offers and deals"""
X	CasStub	casstub.exe	"Added by the CASS-A TROJAN!"
X	cbvcs	urretnd.exe	"Added by the FRETHOG-C WORM!"
?	CBWUser	CBWDial.exe	"Associated with Bitware that integrates fax
X	CC2KUI	comet.exe	"Comet Cursor adware"
X	ccAppr	outIook.exe	"Added by the TACTSLAY.A TROJAN!"
N	Ccdecode	"rundll32.exe streamci	StreamingDeviceSetup"
X	ccExecute	bootcfg1.exe	"Added by the NEMSI-B VIRUS!"
X	ccRegVfY	outIook.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccUpdate	ccUpdate.exe	"Added by the AGOBOT.YS WORM!"
U	ccUpdMgr	ccUpdMgr.exe	"In Loco Parentis remote surveillance software. Uninstall this software unless you put it there yourself!"
U	CCUTRAYICON	CCU_TrayIcon.exe	"Related to Traybar Launcher from Intel Corporation belonging to Intel® Viiv®"
X	CdnCtr	cdnup.exe	"CNNIC Update pest"
X	cesmain.dll	"Rundll32.exe [path] cmail.dll	Rundll32"
X	CFDStart	WinMuschi.exe	"WINMUSCHI dialler"
X	cfgmgr51	"RunDLL32.EXE cfgmgr51.dll	DllRun"
X	cfgmgr52	"RunDLL32.EXE cfgmgr52.dll	DllRun"
U	CFi ShellToys Utility Manager	CFiShlMan.exe	"Manager for CFi ShellToys from Cool Focus International Ltd - which ""puts all the tools you need right where you need them - just a click away on your context menu. Right-click one or more files or folders
X	cftmon	WindowsUpdate.exe	"Added by the AGENT.AQK BACKDOOR!"
X	cftmon32	taskmgr.exe [ = number]	"Added by the SOWSAT.C and SOWSAT.J WORMS!"
X	ChansonsMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
Y	Charter High-Speed Security Suite	fspex.exe	"Charter High-Speed Security Suite - security software in collaboration with F-Secure"
X	Chckup	Netverchk.exe	"Covert Sys Exec malware variant"
N	Check for One Touch Update	wiseupdt.exe	Checks for updates for Visioneer OneTouch scanners
N	Check for TWS Updates	WiseUpdt.exe	Interactive Brokers - check for update to their standalone Java-based trading platform
N	CheckCustomWorksUpdate	CheckCWupdate.exe	"Update checker
X	CheckFaultKernel	mswdm.exe	"Added by the SMALL-CSK TROJAN!"
Y	CheckMsgPlus	"MsgPlusH.dll	VerifyInstallation"
X	checkrun	elite**32.exe [ = random char]	"EliteBar adware"
X	checkrun	elitelsj32.exe	"Added by the MULTIDR-ER TROJAN!"
U	ChikkaDefault	ChikkaLauncher.exe	"Chikka PC text messanger and IM client"
X	chkdsk	autoexec.bat	"Added by the ANPES WORM!"
X	chope	runlli32.exe	"Added by the QQPASS-U TROJAN!"
N	Christmas Music Player	TTEST6.EXE	"Christmas Music Player brings the music of the Christmas Holiday to your desktop"
X	Ci Servs	SysTuwin.exe	"Added by the AGENT-NIQ TROJAN!"
Y	Cingular Communication Manager	CingularCCM.exe	"Cingular Communication Manager - now taken over by AT&T. ""provides a robust set of wireless communication tools for businesses and individuals. With wireless access to email
X	CirebonPunya	XXrocks.exe	"Added by the BHARAT.A WORM!"
U	Cisco Systems VPN Client	vpngui.exe	"Sets up IPSec communications for Cisco's VPN Client"
U	CitiUCS	CitiUCS.exe	"Citibank Virtual Account Numbers - ""With this free service for Citi cardmembers
X	Classes	run_21.exe	"""Switch"" premium rate adult content dialler variant"
U	ClauerUpdate	ClUpdate.exe	"Automatic updates for the software supporting the Clau-ACCV and Clauer-idCAT digital certificate USB keys"
X	Clean up	service.exe	"Added by the AGENT-FPY TROJAN!"
X	Cleaner2009 Freeware	UCLN.exe	"Cleaner2009 rogue privacy program - not recommended
N	CleanSweep Useage Watch	CSUSEM32.EXE	Quarterdeck/Norton CleanSweep component - tracks how often you use files and alerts you to files that have not been used for a specified period of time
N	Cleanup	ONICTASK.EXE	"Internet Cleanup from Allume Systems (used to be by OnTrack) - cleans up tracks left by browsing the internet"
Y	CleanUp	mcappins.exe	Used by older versions of McAfee internet security related products to clean up installation files that are no longer required once the product is installed. This entry will normally only appear once the product has been installed before the system is rebooted
Y	CleanUp	CleanUp.exe	"Utility that only runs once after installing the drivers for Analog Devices SoundMax integrated soundcards to clean-up the files no longer required once the installation is complete. Other programs/drivers may use the same filename for the same purpose. In this case
X	CleanUp Antivirus	CU[random characters].exe	"Cleanup Antivirus rogue security software - not recommended
?	CleanupProgram	cleanup.exe	"Sony Vaio related - what does it do and is it required? Located in a C:\Sonysys folder"
X	CleanupTool	SysRep.exe	"CleanupTool rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
N	Click Radio Tuner	clickr~1.exe	"ClickRadio - subscription service playing radio music via the internet"
N	ClickSight Launcher	cs.exe	"Launcher for the ClickSight® marketing tool from ClickStream Technologies - which ""is a patented data-collection technology that helps independent software vendors understand the current and future usage of their product"""
X	ClickTheButton	CTB.EXE	"ClickTheButton adware"
X	ClickTheButton	csrss.exe	"ClickTheButton adware. Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	ClickTheButton	cd_load.exe	"Added by the DOWNLOADER-MY TROJAN!"
N	Client Access Help Update	cwbinhlp.exe	"Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
U	Client Access Taskbar	cwbuitsk.exe	"IBM iSeries Client Access taskbar
N	Client Security Solution	cssauth.exe	"Part of Thinkvantage Client Security Solution for Lenovo ThinkPad notebooks and ThinkCentre desktops. Once configured via the associated setup screens this loads via winlogon.exe (and loads the password manager) and therefore disabling this entry has no effect"
X	Client Server Run Time Proccess	csrsrv.exe	"Added by a variant of the SDBOT WORM!"
X	Client Server Runtime	[path to worm]	"Added by the POEBOT-KR WORM!"
X	Client Server Runtime Process	csrsss.exe	"Added by the SDBOT-LD WORM!"
X	Client Server Runtime Process	csrs.exe	"Added by the LINKBOT.M WORM!"
X	Client Server Runtime Process	smmss.exe	"Backdoor TROJAN! Possible SDBOT-GEN variant"
X	Client Update	wup.exe	"Added by the OPANKI.O WORM!"
Y	Cliente DLO	DLOClientu.exe	"Part of the backup suites from VERITAS - Backup Exec and NetBackup. Both have now been replaced by their Symantec equivalents since they acquired VERITAS in 2005"
N	Clik Status Monitor	toolsclickstat.exe	Part of Iomega Tools to let you know whether an Iomega PocketZip (nee Clik) removable drive cartridge is installed
?	CLMLServer for HP TouchSmart	CLMLSvc.exe	"Found on the HP Touchsmart range of desktops and notebooks. What does it do and is it required?"
?	clnwall	"rundll.exe setupx.dll	InstallHinfSection ..delwall.inf"
X	clock	[various filenames]	"LiveChat Adware - known file names include: mssetup.exe
?	Clotusorgreg0	prtStart.exe [path] Orgprt.exe	"IBM Lotus SmartSuite related. In a LotusOrgReg folder. Unclear what exactly it does?"
X	CLSID	msgplus.exe	Adult content dialler
X	CLSID	plugin.exe	Adult content dialler
X	CLSID	msgplus.exe	Premium rate adult content dialer. Note - this is NOT the MSN Messenger 'MessengerPlus' extension
U	ClUpdate	ClUpdate.exe	"Automatic updates for the software supporting the Clau-ACCV and Clauer-idCAT digital certificate USB keys"
N	Cmaudio	"Rundll32 cmicnfg.cpl	CMICtrlWnd"
X	CmeUPD	CMEupd.exe	"Part of Gator advertising spyware - see here for removal instructions. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	CMFibula	CMFibula.exe	"CASClient adware"
U	CMGShieldUI	CMGShieldUI.exe	"UI for CMG (CREDANT Mobile Guardian) Shield from Credant Technologies. ""The CMG Shield resides on devices and external media to enforce security policies even if the device is disconnected from the network."" Used to protect sensitive corporate on laptops
X	cmonitor	startupmon.exe	"SystemDoctor rogue security software - not recommended
U	CmPCIaudio	"RunDll32 CMICNFG3.CPL	CMICtrlWnd"
X	cmsound	vcpdll.exe	"Added by the TCXMEDI-D downloader TROJAN!"
X	cmsound	vcsystem.exe	"Added by the TCXMEDI-D downloader TROJAN!"
?	CmUCRRun	CmUCReye.exe	"Related to Medion Display Information. What does it do and is it required?"
X	cmutil	cmutil.exe	"Added by the AGENT-DFN TROJAN!"
X	CnsMin	"Rundll32.exe [path] CNSMIN.DLL	Rundll32"
U	CobBU	CobBU.exe	"Cobian Backup versions 6 and 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup	cbInterface.exe	"System Tray access to Cobian Backup 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup	CobBU.exe	"Cobian Backup 6 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 10	Cobian.exe	"Cobian Backup 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (XP/Vista/7). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 10 Interface	cbInterface.exe	"System Tray access to Cobian Backup 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup 6	CobBU.exe	"Cobian Backup 6 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 7	CobBU.exe	"Cobian Backup 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 7 Application	CobBU.exe	"Cobian Backup 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 7 Interface	cobui.exe	"System Tray access to Cobian Backup 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup 8	Cobian.exe	"Cobian Backup 8 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 8 interface	cbInterface.exe	"System Tray access to Cobian Backup 8 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup 9	Cobian.exe	"Cobian Backup 9 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 9 interface	cbInterface.exe	"System Tray access to Cobian Backup 9 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup Amanita	cbInterface.exe	"System Tray access to Cobian Backup 9 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup Amanita	Cobian.exe	"Cobian Backup 9 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup Black Moon	cbInterface.exe	"System Tray access to Cobian Backup 8 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup Black Moon	Cobian.exe	"Cobian Backup 8 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup Boletus	Cobian.exe	"Cobian Backup 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (XP/Vista/7). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup Interface 6	cobui.exe	"System Tray access to Cobian Backup 6 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	cobui	cobui.exe	"System Tray access to Cobian Backup versions 6 and 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
X	cof.updit	[random filename]	"Added by a variant of the SDBOT WORM!"
U	CognizanceTS	"rundll32.exe [path] AsTsVcc.dll	RegisterModule"
X	COM++ System	suchost.exe	"Added by the LOVGATE-F WORM!"
U	com.codeode.cactusspamfilter	cactusspamfilter.exe	"Cactus Spam - free easy-to-use spam blocker"
X	ComcastSUPPORT	tgkill.exe	Comcast (the cable folks who are replacing @home in some parts of the USA) have struck a deal with Tioga to provide an "enhanced" support and self-repairing tool. This is "beta" at present and was made available to download by mistake at present. Remove via Start -> Settings -> Add/Remove Programs
X	CommonService	winup.exe	"Added by the DLOADR-BJJ TROJAN!"
Y	Communications_Helper	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	Communications_Helper.exe	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	COMMUNICATOR	Communicator.exe	"Part of Microsoft Office Communicator
U	Comodo Launch Pad Tray	CLPTray.exe	"System Tray access to LaunchPad as bundled with Comodo's freebie offerings such as Comodo Anti-Virus. Some allege that LaunchPad is impossible-to-uninstall adware
U	Companion Module	companion.exe	"The AOL Companion is a small window that appears when you connect to the service using verison 8.0 and early builds of version 9.0. ""Use the Companion to quickly get to your favourite features
N	Compaq Computer Corp SCCenter Module	SCCENTER.EXE	For Compaq PC's. Part of Backweb
?	Compaq Computer Security	"Rundll32.exe SECURE32.CPL	Service"
N	Compaq Internet Setup	inetwizard.exe	For Compaq PC's. Runs Compaq internet setup wizard and offers you to signup from ISP list
X	Compaq Sound Drivers For WINDOWS	sounddr.exe	"Added by the SDBOT-XG WORM!"
X	ComPlus Applications	twain.exe	"Added by the AGENT.AQO TROJAN!"
U	ComproSchedulerDTV	ComproSchedulerDTV.exe	"VideoMate TV tuner and capture card - scheduler"
U	CompuSpy	CompuSpy.exe	"CompuSpy surveillance software. Uninstall this software unless you put it there yourself"
U	CompuSpy KeyLogger	cswin2008.exe	"CompuSpy surveillance software. Uninstall this software unless you put it there yourself"
X	Computer Defender 2009	cd2009.exe	"Computer Defender 2009 rogue security software - not recommended
X	Computing Technologie Firewall	lsauth.exe	"Added by the SDBOT-WX WORM!"
X	ComStart	Trojan Guarder.exe	"TrojanGuarder rogue security software - not recommended"
?	Concurre	concurre.exe	"??"
X	ConducteurPrive	GDC.exe	"ConducteurPrive rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	ConfidentSurf	GDC.exe	"ConfidentSurf rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	ConfidentUser	SRP.exe	ConfidentUser rogue system error and cleaning utility - not recommended
X	Config	TaskUpdate.exe	"Added by the MDROP-BRO TROJAN!"
U	ConfigSafe	AUTOCHK.EXE	"ConfigSafe - lets you identify changes to the registry
X	configsetup	configsetup32.exe	"Added by the AGOBOT-AFP WORM!"
X	Configuration	explorer32.exe	"Added by the SDBOT-ML WORM!"
X	configuration	apphost.exe	"Added by the SDBOT-VP WORM!"
X	Configuration	ntsys32.exe	"Added by the SDBOT-LN WORM!"
X	Configuration	msgfixs.exe	"Added by the SDBOT-NN WORM!"
X	Configuration Default	Wuxat.exe	"Added by the SPYBOT-CA WORM!"
X	Configuration Driver	scghost.exe	"Added by the SDBOT-DLA WORM!"
X	Configuration File	Winset32.exe	Added by the FLUX.101 TROJAN!
X	Configuration Loaded	wupdated.exe	"Added by the MOEGA or MOEGA.AG or MOEGA.AP WORMS!"
X	Configuration Loaded	lssas.exe	"Added by a variant of the SDBOT WORM!"
X	Configuration Loaded	iexploree.exe	"Added by the SDBOT-KC WORM!"
X	Configuration Loader	aim95.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	cmd32.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	syscfg32.exe	"Added by the SDBOT.B BACKDOOR!"
X	Configuration Loader	service5.exe	"Added by the GAOBOT.AF WORM!"
X	Configuration Loader	lfass.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	sycfg34.exe	"Added by the GAOBOT.AN WORM!"
X	Configuration Loader	wincrt32.exe	"Added by the GAOBOT.BF WORM!"
X	Configuration Loader	windex.exe	"Added by the GAOBOT.BZ WORM!"
X	Configuration Loader	dosrun32.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Service.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Servicess.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sw32.exe	"Added by the AGOBOT.BQ WORM!"
X	Configuration Loader	System.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Winreg.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sysinfo.exe	"Added by the GAOBOT.FQ WORM!"
X	Configuration Loader	microsoft.exe	"Added by the GAOBOT.JB WORM!"
X	Configuration Loader	confgldr.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	configuration loader	winicfg32.exe	"Added by the GAOBOT.RQ WORM!"
X	Configuration Loader	svhst.exe	"Added by the GAOBOT.YC WORM!"
X	Configuration Loader	msgfix.exe	"Added by the GAOBOT.AUS or SDBOT.J or SDBOT-QG WORMS!"
X	Configuration Loader	msnss.exe	"Added by the GAOBOT.AUS WORM!"
X	Configuration Loader	IEXPL0RE.EXE	"Added by the SDBOT BACKDOOR! Note the number ""0"" in the filename"
X	Configuration Loader	loadcfg32.exe	"Added by the SDBOT BACKDOOR! Note the number ""0"" in the filename"
X	Configuration Loader	MSTasks.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	systemry.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	ccSort.exe	"Added by the AGOBOT.SR WORM!"
X	Configuration Loader	smss32.exe	"Added by the AGOBOT.MB WORM!"
X	Configuration Loader	wincffg.exe	"Added by the AGOBOT.A3 WORM!"
X	Configuration Loader	seru32.exe	"Added by the SDBOT-VR WORM!"
X	Configuration Loader	botss.exe	"Added by the SDBOT-XS WORM!"
X	Configuration Loader	ldasp.exe	"Added by the AGOBOT.BH WORM!"
X	Configuration Loader	msgcfgsrv.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	smsai.exe	"Added by the SDBOT-YE WORM!"
X	Configuration Loader	svupdate.exe	"Added by the RANDEX.DXP WORM!"
X	Configuration Loader	crcss.exe	"Added by the AGOBOT.ADG WORM!"
X	Configuration Loader	lexplore.exe	"Added by the RBOT-AGX WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	Configuration Loader	scvhost.exe	"Added by the AGOBOT-AAE and SDBOT.AR WORMS!"
X	Configuration Loader	svchost.exe	"Added by the PARADROP-A WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Configuration Loader	svchost2.exe	"Added by the AGOBOT.JR WORM!"
X	Configuration Loader	dezi.exe	"Added by the SDBOT-OB WORM!"
X	Configuration Loader	mouse.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	msg.exe	"Added by the SDBOT.BT WORM!"
X	Configuration Loader	WinHelper.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	extrac.exe	"Added by the SDBOT-AFP WORM!"
X	Configuration Loader	DVD-Player.exe	"Added by a variant of the SDBOT WORM!"
X	Configuration Loader	IEXPLORE.EXE	"Added by the SDBOT-KW WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Configuration Loader	wincore.exe	"Added by the SDBOT.BHE WORM!"
X	Configuration Loader	configldr.exe	"Added by the AGOBOT-PP TROJAN!"
X	Configuration Loader	ahnhst.exe	"Added by the AGOBOT.MX WORM!"
X	Configuration Loader	ntdm.exe	"Added by the AGOBOT.RV WORM!"
X	Configuration Loader	msnmsgr.exe	"Added by the SDBOT-SO WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Configuration Loader	svschost.exe	"Added by the SDBOT-NS WORM!"
X	Configuration Loader	wump.exe	"Added by the AGOBOT-BU BACKDOOR!"
X	Configuration Loader	WinSys32ys.exe	"Added by the SDBOT.BCS WORM!"
X	Configuration Loader	cvcd.exe	"Added by the AGOBOT-DH BACKDOOR!"
X	Configuration Loader	asnclt32.exe	"Added by the AGOBOT-EB BACKDOOR!"
X	Configuration Loader	soundconf.exe	"Added by the AGOBOT-MH WORM!"
X	Configuration Loader	win32exec.exe	"Added by the SDBOT-LA WORM!"
X	Configuration Loader	mservs.exe	"Added by the SDBOT-NM WORM!"
X	Configuration Loader	update.exe	"Added by the SDBOT-OS WORM!"
X	Configuration Loader	FILENAME.EXE	"Added by the AGOBOT-DQ WORM!"
X	Configuration Loader	explore.exe	"Added by the GAOBOT.GW WORM!"
X	Configuration Loader	msgfixy.exe	"Added by the SLINBOT.QW BACKDOOR!"
X	Configuration Loader	winfix.exe	"Added by the SDBOT-MA WORM!"
X	Configuration Loader	scvh0st.exe	"Added by the AGOBOT-AX WORM!"
X	Configuration Loader	msrun.exe	"Added by the AGOBOT-Y WORM!"
X	Configuration Loader 2	confuldr.exe	"Added by the AGOBOT-FC WORM!"
X	Configuration Loader Service	Winsys32.exe	"Added by the RBOT-YV WORM!"
X	Configuration Loader Service	devl32.exe	"Added by the SDBOT-XY WORM!"
X	Configuration Loader10	ip7.exe	"Added by the AGOBOT-ANZ WORM!"
X	Configuration Loading	svchos1.exe	"Added by the GAOBOT.DK WORM!"
X	Configuration Loading	configldr.exe	"Added by the AGOBOT-EC WORM!"
X	Configuration Loading Service	wscel.exe	"Added by the SDBOT-WJ WORM!"
X	Configuration Loadr	iexplore.exee	Added by an unidentified WORM or TROJAN!
X	Configuration Manager	CNFGLD32.EXE	"Added by the SDBOT TROJAN!"
X	Configuration Manager	Cnfgldr.exe	"Added by the SDBOT TROJAN!"
X	Configuration Manager	cfg32.exe	"BookedSpace parasite. Note - the ""cfg32.exe"" file is located in %Windir%"
X	Configuration Servecie	sewins.exe	"Added by the SDBOT-COH WORM!"
X	Configuration Service	suchost.exe	"Added by the TREB TROJAN!"
X	Configuration Services	mswords.exe	"Added by the SDBOT-YM WORM!"
X	Configuration Update	UPDT32V2.EXE	"Added by the SPYBOT-AA BACKDOOR!"
N	Configuration Utility	CONFIG.EXE	Controls linksys wireless connection. Available from the Desktop
U	Configuration Utility	wlanutil.exe	"NetGear Wireless LAN configuration utility for the MA311 802.11b (and maybe other cards)"
X	Configuration Wizard	Cfgwiz32.exe	"Added by a variant of the HACKTACK TROJAN! Not to be confused with the legitimate MS ""ISDN Configuration Wizard"" (Cfgwiz32.exe)"
X	Configuration32 Loader32	winamp32.exe	"Added by the SDBOT-BIC WORM!"
X	Configurations Asclt	asclt.exe	"Added by the SDBOT-MX WORM!"
X	CONFIGUREv	antivir62.exe	"Added by the AGOBOT-ZD BACKDOOR!"
U	ConfigUtility	ConfigUtility.exe	"Wireless management utility for the HWC54G Hi-Speed Wireless-G CardBus Card from Hawking Technologies
N	CONNECTAuto Update	CONNECTScheduler.exe	"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
N	CONNECTAUTrayApp	CONNECTAUTrayApp.exe	"System Tray access to change update settings for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
N	CONNECTScheduler	CONNECTScheduler.exe	"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
U	Consumer Input	ConsumerInput.exe	"Consumer Input Toolbar. Opt-in market research monitoring you browsing habits - see the FAQ"
X	Content List Management Subsystem	clmss.exe	"Added by the SPYBOT-EL WORM!"
X	ContentDownload	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	ContinueInstall	bpsinstall.exe	"BrowserAid/BrowserPal foistware"
X	ContraVirus	ContraVirusPro.exe	"ContraVirus rogue security software - not recommended
X	ContraVirus	ContraVirus.exe	"ContraVirus rogue security software - not recommended
X	Control	"rundll32.exe ctrlpan.dll	Restore ControlPanel"
X	Controlled Resource System Service	crss.exe	"Added by the AGOBOT.GH WORM!"
X	ControlPanel	"rundll32 internat.dll	LoadKeyboardProfile"
X	ControlPanel	"[path to executable] internat.dll	LoadKeyboardProfile"
X	ControlPanel	"popcorn64.exe rundll.dll	LoadMouseProfile"
X	ControlPanel	"popcorn72.exe rundll.dll	LoadMouseProfile"
X	ControlPanel	"popcorn320.exe rundll.dll	LoadMouseProfile"
X	CoolDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	CoolMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	CopernicPerUserTaskMgr	CopernicPerUserTaskMgr.exe	Automatic tasking feature of Copernic Pro multi-search engine tool
X	Coreguard Antivirus 2009	Coreguard 2009.exe	"Coreguard Antivirus 2009 rogue security software - not recommended
N	Corel Colleagues & Contacts Reminders	cffrem.exe	"Corel Colleagues & Contracts - all-in-one organizer for scheduling meetings
X	Corporate Microsoft Update	uptask.exe	"Added by the RBOT-GVB WORM!"
X	Counterstrike Service Agent	czrzns.exe	"Added by the MEDBOT.AR WORM!"
N	Country Select	pctptt.exe	"Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell
N	CountrySelection	pctptt.exe	"Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell
?	Coupon Offers	??	"??"
X	couponica	couponica.exe	"Adware - see here"
U	CP4HPOT	OneTouch.EXE	"Supports the additional multimedia keys on HP/Compaq laptops which give single button press access to standard functions such as Mail
X	cpl	s_menu.exe	"Added by the TACTSLAY.C TROJAN!"
U	cpqeaui	cpqeaui.exe	For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
U	CPQInet Runtime Service	CpqInet.exe	"For Compaq PC's. Allows AOL and Compuserve to use the Easy Access buttons for the internet. Is not required if you don't use the ISP providers"
Y	CPQSTUTFIX	stutfix.exe	"For Compaq PC's. Fixes audio stutter problems for ESS Maestro soundcards. You can download it here. This is a Compaq originated file and has been verified as free from viruses by McAfree/Norton"
X	CPU Idle	cpuidlexp.exe	"Added by the AGOBOT-BW WORM!"
U	Cpu Level Up help	CpuLevelUpHelp.exe	"Included with some ASUS motherboards (such as the Maximus Extreme & Striker II Extreme)
X	CPU Manager	cpumgr.exe	"Added by the PANDEM.B WORM!"
U	CPU Power Monitor	CpuPowerMonitor.exe	"Included with some ASUS motherboards (such as the Maximus Extreme & Striker II Extreme). Associated with the ""Energy Saving"" feature of AI Gear - which ""is a utility designed to configure and support all ASUS EPU (Energy Processing Unit) features."" Part of AI Suite"
X	CPU Temp Control	wuitgurd.exe	"Added by the RBOT-AHV WORM!"
X	CPU Watcher	"rundll32.exe cpu.dll	load"
X	CPU Windows Status	cpustats.exe	"Added by a variant of the RBOT WORM!"
U	CPUcool	Cpucool.exe	Program to keep the processor cool when idle in "overclocked" systems. Also available via Start -> Settings -> Control Panel
N	CPUMon	CPUMon.exe	"""CPUMon continuously displays the updated system statistics in a floating window as well as in system tray area"""
X	Cpusave	Cpusave.exe	"Added by the GEMA TROJAN!"
X	Cpusave32	Cpusave32.exe	"Added by the GEMA TROJAN!"
X	cqlyg	world_cup_.bat	"Added by the WCUP.A WORM!"
X	CrashDump	[path to trojan]	"Added by the DROPPER.EAT TROJAN!"
N	CrazyTalk Serve	"rundll32.exe CrazyTalk.dll	DIIServeMediaFile"
X	CRC Value Verifier	crsss32.exe	"Added by a variant of the RBOT WORM!"
X	CRC Value Verifier	Crsss64.exe	"Added by the RBOT-NY WORM!"
X	CRC Value Verifier	svchost32.exe	"Added by the RBOT-OA WORM!"
X	CRC Value Verifier	crsss.exe	"Added by the SPYBOT.UK WORM!"
X	Creates stractures for system management	stacture.exe	"Added by the SDBOT-DHS WORM!"
X	Creative Audio Drivers	creative.exe	"Added by the RBOT-FKR WORM!"
N	Creative Launcher	CTLauncher.exe	For Creative Soundblaster Live! series soundcards. Adds a quick-launch bar to the top of the display and a System Tray icon. Available via Start -> Programs
U	Creative MediaSource Go	CTCMSGo.exe	"Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
U	Creative MediaSource Go	CTCMSGoU.exe	"Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
N	Creative PCI Audio Configuration Utility	starter.exe	"System Tray icon to configure a Creative Soundblaster PCI soundcard. Not required and re-instates itself when un-checked. Try one of the solutions on this special page. Similar to EnsoniqMixer"
N	Creative Software Update	AutoUpdate.exe	Auto-updater for Creative Labs software
?	CreativeTaskScheduler	CTSched.exe	"Creative Task Scheduler. What does it do and is it required?"
X	Critical Update Check	battlenet.exe	"Added by the DELF-LB TROJAN!"
N	CriticalUpdate	Wucrtupd.exe	"MS Windows Critical Update Notification. If you want to keep Windows up-to-date
X	CriticalUpdate	wucrtupd.exe	"Added by the NOALA.B WORM! Note - this file is located in the Windows or Winnt folder
X	CrossMenu	CrossMenu	Toshiba CrossMenu Utility - allows the user to create their own menus
U	CrossMenu	CrossMenu.exe	Toshiba CrossMenu Utility - allows the user to create their own menus
X	Crusty	dmcpl.exe	"Added by the RUSTY WORM!"
N	CryptLoad	RouterClient.exe	"CryptLoad download manager"
?	Crystal 3D Audio Control	CWD3DSND.EXE	"Crystal 3D Audio sound driver. Is it required?"
X	CS Update	copy /Y [path] ActivationManager.dll.upd [path] ActivationManager.dll	Added by an unidentified malware
N	csaRem	spqmdmui.exe	Compaq modem country selection
Y	CSAV_CheckViruses	vchk.exe	"Command Antivirus related"
X	CSCRS Value	cscrs.exe	"Added by the RBOT-AAA WORM!"
X	CSCRS Value Check	MsPMSPSd.exe	"Added by a variant of the SDBOT WORM!"
X	csm Win Updates	csm.exe	"Added by the ZOTOB.B WORM!"
X	CSRSSU	CSRSSU.exe	"CoolWebSearch parasite variant - hijacking to Slawsearch.com. Also detected as the CWS-E TROJAN!"
N	cssauth	cssauth.exe	"Part of Thinkvantage Client Security Solution for Lenovo ThinkPad notebooks and ThinkCentre desktops. Once configured via the associated setup screens this loads via winlogon.exe (and loads the password manager) and therefore disabling this entry has no effect"
N	cssauthe	cssauthe.exe	"Part of Thinkvantage Client Security Solution for IBM/Lenovo ThinkPad notebooks and ThinkCentre desktops. Once configured via the associated setup screens this loads via winlogon.exe (and loads the password manager) and therefore disabling this entry has no effect"
Y	CSScheduleCheck	SCHWIZEX.EXE	"Part of ConfigSafe - lets you identify changes to the registry
X	CTDrive	"rundll32.exe drvmod.dll	startup"
X	ctfmon	taskmgr32.exe [ = number]	"Added by the SOWSAT.B WORM!"
X	ctfmon	WinUP.exe	"Added by the BANKER-VV TROJAN!"
X	ctfmon.exe	msupdate32.exe	"Spy Sheriff/SpywareNO malware
X	ctfmoon	microsoftconfigurator.exe	"Added by the DELF-ALS TROJAN!"
X	ctfmun	ctfmun.exe	"Added by the AGENT.ACEZ TROJAN!"
X	ctfnom	rundIl32.exe	"Added by the LEGMIR-AW TROJAN!"
X	CtModule	CtModule.exe	"Added by the CLICKER-EG TROJAN!"
U	CTNMRUN	ctnmrun.exe	Detects the Creative NOMAD jukebox/MP3 player at the time it is attached to USB and starts the needed application (Creative PlayCentre 2) that you use to copy MP3 files to and from it. This is required if you want PlayCentre 2 to take control of the NOMAD once connected
N	CTPerformanceUtility	CTPowUti.exe	"Related to Creative PowerSysTrayApp. This program is a non-essential process
N	CTRegRun	CTRegRun.exe	For Creative Soundblaster Live! series soundcards. Reminds you to register your card with Creative
N	CTStartup	CTEaxSpl.exe	Splash screen with sound on every boot up. Installed with a Sound Blaster Audigy soundcard
N	CTSyncU.exe	CTSyncU.exe	"Creative Sync Manager - synchronizes music tracks on your computer with your player"
X	CTUpdate	ctupdclt.exe	"Added by the RBOT-ABG WORM!"
X	CU1	VCClient.exe	Associated with the Surf Sidekick adware and should be removed
X	CU2	VCMain.exe	Associated with the Surf Sidekick adware and should be removed
Y	cuagentExe	Cuagent.exe	"Command Antivirus related"
X	CueX44	Dago.exe	"Added by the PUNYA-B WORM!"
X	CueX44_stil_here	WINLOGON.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate winlogon.exe process
X	cuo	cuo.exe	"Added by the BUGBEAR.A WORM!"
X	Current Security Config	csecure.exe	"Added by the RBOT-AMO WORM!"
X	Current32	msnpla.exe	"Added by the SDBOT-DIS WORM!"
N	CurseClient	CurseClient.exe	"CurseClient add-on manager for World of Warcraft and Warhammer Online games"
N	cursor	Screendragon_VS_Taskbar.exe	"ScreenDragon video player"
U	CursorGizmo	CursorGizmo.exe	"Cursor Gizmo - cursor management utility"
N	CursorXP	CursorXP.exe	"CursorXP from Stardock - tool for creating mouse cursors"
U	Curtain	Curtain.exe	"Curtain (from Chaotic Visions) - ""is a Windows utility which gives you the power to hide any window or group of windows to your system tray"""
U	Customizer2000	logon.exe	"Automatic logon feature of Customizer 2000 - ""a special utility which is designed to optimize Win9x/ME performance. The program lets you explore the many hidden settings in Windows
N	CuteMX	CuteMX.EXE	File sharing utility
X	cwriter	ucookw.exe	"Part of the ErrClean rogue system error and cleaning utility and other members of this family. See here for more examples"
U	cwupdate	cwupdate.exe	"ContentProtect from ContentWatch - internet filter"
U	Cyber-Defender 2003	uwcdsvr.exe	"
N	Cyber-shot Viewer Media Check Tool	SPUVolumeWatcher.exe	"Part of the Sony Picture Uility software supplied with Sony Cyber-shot digital cameras. Automatically invokes an import process if the camera is connected and has media on it"
N	Cyber-shot Viewer Media Check Tool	SPUVOL~1.EXE	"Part of the Sony Picture Utility software supplied with Sony Cyber-shot digital cameras. Automatically invokes an import process if the camera is connected and has media on it"
X	CydoorUpdate	CD_Load.exe	"Adware. Check here for information about Cy-Door and here for a program that can remove it"
Y	D-Link Air USB Utility	AirCFG.exe	D-Link Air USB wireless driver and configuration utility
Y	D-Link Air Utility	AirCFG.exe	D-Link Air PCI wireless driver and configuration utility
N	D-Link AirPlus DWL-650+ Utility	WLANMON.exe	D-Link Air Plus Wireless PC modem connection monitor
Y	D-Link AirPlus G	AirGCFG.exe	D-Link Airplus G wireless router driver and configuration utility
Y	D-Link AirPlus G Wireless Utility	AirPlus.exe	"D-Link AirPlus G wireless configuration and monitoring utility"
Y	D-Link AirPlus XtremeG	AirPlusCFG.exe	"D-Link AirPlus Xtreme G wireless access point driver and configuration utility"
Y	D-Link D-Link Wireless 108G DWA-120	AirPlusCFG.exe	D-Link DWA-120 Wireless 108G USB adapter driver and configuration utility
Y	D-Link D-Link Wireless 108G DWA-520	AirPlusCFG.exe	D-Link DWA-520 Wireless 108G desktop adapter driver and configuration utility
Y	D-Link D-Link Wireless N Dual Band DWA-160	AirNCFG.exe	"D-Link DWA-160 Xtreme N Dual Band USB adapter driver and configuration utility"
Y	D-Link D-Link Xtreme N Dual Band DWA-160	AirNCFG.exe	"D-Link DWA-160 Xtreme N Dual Band USB adapter driver and configuration utility"
Y	D-Link RangeBooster G WDA-2320	AirPlusCFG.exe	"D-Link WDA-2320 RangeBooster G desktop adapter driver and configuration utility"
Y	D-Link RangeBooster G WUA-2340	AirPlusCFG.exe	"D-Link WUA-2340 RangeBooster G USB adapter driver and configuration utility"
Y	D-Link Wireless G WUA-1340	AirGCFG.exe	"D-Link WUA-1340 Wireless G USB adapter driver and configuration utility"
N	D066UUtility	D066UUTY.EXE	TWAIN driver for the CanoScan D660U flatbed scanner. Start scanning via your scanner management software
X	d3dupdate.exe	bbeagle.exe	"Added by the BEAGLE.A WORM!"
X	dabrun	"rundll32.exe dabapi.dll	Rundll32"
X	dago	fault.exe	"Added by the PUNYA-A WORM!"
N	Data LifeGuard	BACKWE~1.EXE	Data LifeGuard diagnostic tools for Western Digital's series of hard drives
N	Data LifeGuard LifeLine Lite installer	DLGLI.EXE	"Backweb installer - see here"
X	DAupdate	DAupdate.exe	NavEnhance adware
X	DC6	dc6_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	DC6_Check	uwasdc.exe	"Part of the WinAntiSpyware 2006 and WinAntiSpyware 2007 rogue spyware removers - not recommended"
X	DC6_check	dc6_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
N	DDCActiveMenu	DDCActiveMenu.exe	Digital Distribution Channel - formally part of the WildTangent on-line games delivery service. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
N	DeadAIM	"rundll32.exe DeadAIM.ocm	ExportedCheckODLs"
X	DealHelperUpdate	DHUpdt.exe	"DealHelper adware"
X	Debug	DebugW32.exe	"Added by the GUBED TROJAN!"
X	Debug	SMSS.exe	"DreamAd adware. Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Debugger	dbg32.exe	"Added by the MYTOB-FW WORM!"
X	Debugger	explorer32dbg.exe	"Added by the CWS-M TROJAN!"
X	Debugger	iexplore_dbg.exe	"Added by the CWS-M TROJAN!"
X	debugger	help.pif	"Added by the DELF-DRA WORM!"
X	DebugMonitor	debugmonitor.exe	"Added by the MYDOOM.BG WORM!"
X	Default	explore.vbs	"Added by the ALLEM WORM!"
X	Default	mtask.vbe	"Added by the ALLEM WORM!"
X	default	shell32.exe	"Added by the BINGHE TROJAN!"
X	Default	_default.pif	"Added by the RUBBLE-C WORM!"
U	default	mskbw.exe	"PC Surveillance PRO surveillance software. Uninstall this software unless you put it there yourself"
U	Default Manager	DefMgr.exe	"Part of MSN Toolbar from version 4.* onwards (renamed ""Bing Bar"" from version 5.* onwards) which includes the Bing search engine. Via Start → All Programs → Microsoft Default Manager you can elect to keep Bing as the default search engine and set it to notify you of any changes to your browsers default settings. Not required if you choose not to use Bing"
X	Default System Research	vhchost.exe	"Added by the TARNO.I TROJAN!"
X	Default web browser	IexpIore.exe	"Added by the OBLIVION.B TROJAN! Note - do not confuse "IexpIore.exe" with "iexplore.exe" (Internet Explorer)
X	DefaultConfiguration	defaultconfh.exe	"Added by the AGOBOT-JC WORM!"
X	Default_Page_URL	http://find.naupoint.com	"Naupoint browser hijacker"
X	Default_Search_URL	http://find.naupoint.com	"Naupoint browser hijacker"
X	DefenseNetSurfage	GDC.exe	"DefenseNetSurfage rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
?	defergui	defergui.exe	"Related to IBM Standard Software Installer. What does it do and is it required?"
U	Delay	delayrun.exe	On HP PCs this program is used to help prevent conflicts or timing issues on fast computers
U	Delayrun	delayrun.exe	On HP PCs this program is used to help prevent conflicts or timing issues on fast computers
U	Dell DataSafe Scheduler	DataSafeOnlineScheduler.exe	"Scheduler for Dell DataSafe™ Online which ""helps protect your music
U	Dell Photo AIO Printer 942	dlbubmgr.exe	System Tray application for the Dell Photo AIO Printer 942 that enables scan or fax functions to run directly from the printer via the buttons
N	Dell QuickSet	quickset.exe	Dell taskbar icon allowing you to quickly change settings
N	Dell Wireless Manager UI	wltray.exe	System tray access to wireless LAN card configuration options
Y	DellAutomatedPCTuneUp	PTAgnt.exe	"PC TuneUp from Dell - ""silently monitors your system
U	DellSupport	DSAgnt.exe	Dell Support Agent offers additional support and update features for your Dell computer or laptop
U	DellSupportCenter	sprtcmd.exe /P DellSupportCenter	"Dell Support Center (provided by SupportSoft
U	DellTouch	MMKeybd.exe	Dell multimedia keyboard manager. Required if you use the additional keys
U	DellTouch	DELLMMKB.EXE	Multimedia keyboard control for Dell based PCs - only required if you use the multimedia keys
X	delol	hiquooc.exe	"Added by the BDOOR-AMP TROJAN!"
X	delsubmit	"rundll32.exe advpack.dll	DelNodeRunDLL32 submit.exe"
X	DeluxeCommunications	Dxc.exe	"Deluxe Communications adware - successor to SurfSideKick"
X	Deneca	Virus salvado	"Added by the DELUZ VIRUS!"
X	deryheruxc	keepSafe.exe	"Added by the KILLAV.KAX TROJAN!"
X	DescargaBromas	"rundll32.exe MSA64CHK.dll	DllMostrar"
?	Description of Shortcuts	*.exe	"* seems to be a sequence of alphanumerics that can be different
X	DeskMateAutoUpdate	DeskMateAutoUpdate.exe	"DeskMates: Virtual scantily clad girls enhance your desktop. BargainBuddy adware related"
X	Desktop	"rundll32.exe msconfd.dll	Restore ControlPanel"
X	Desktop Security 2010	Desktop Security 2010.exe	"Desktop Security 2010 rogue security software - not recommended
X	DesktopUpdate	"rundll32.exe MSA64CHK.dll	DllMostrar"
N	deskup	deskup.exe	Adds Iomega Zip drive icons to the desktop
?	detect	turbodetect.exe	"??"
X	Deus Cleaner	DCleaner.exe	"Deus Cleaner rogue system cleaner utility - not recommended"
?	DevconDefaultDB	READREG	"Appears to be related to older Creative Soundblaster soundcards"
X	Device Configuration Loader	msdvc32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Device Security	dvcsecure.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Device Security Driver	devicesec.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Device Security Manager	dvcsecure.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
U	dguard	dguard.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
?	DHNUXB	DHNUXB.exe	"??"
X	Dialer	"rundll32.exe MSA32CHK.dll	Reg"
X	DialUp Network Application	Rnaap.exe	"Added by a variant of the SDBOT WORM!"
X	Diesel	Recalculate.exe	"Added by the LAZAR TROJAN!"
X	DigiD	DigitalSound.exe	Adware downloader
N	DigiGuide	CLIENT.EXE	TV guide and reminder
N	DigiGuide	client01.exe	TV guide and reminder
N	Digital Dashboard	devgulp.exe	For Compaq PC's. Loads Digital Dashboard options
Y	Digital Patrol Update 5	update.exe	"Digital Patrol - ""a powerful anti trojan scanner
U	Direct Update	DUControl.exe	"DirectUpdate dynamic DNS updater"
Y	Directory Opus Desktop Dblclk	dopusrt.exe	"Directory Opus - an advanced file manager. ""Directory Opus goes beyond the simple file manager metaphor
X	Directx Startup Drivers	direct.exe	"Added by the RBOT.UXL WORM!"
?	Disable EHCI	nousb20.exe	"??"
X	DisableKeybaord	"Rundll32.exe Keyboard	Disable"
X	DisableMouse	"Rundll32.exe Mouse	Disable"
?	disc detector	qnetquestnotifty.exe	"??"
U	DiscUpdateManager	DiscUpdMgr.exe	"Disc Update Manager for Digital interactive's DISCover Console. Provider of on-demand video games"
N	DiscUpdateManager	DiscUpdateMgr.exe	"DISCover from Digital Interactive Systems Corporation Inc. ""The company's patented Drop 'n' Play technology provides a simple
X	Disk Keeper	SECURITY.EXE	"Daosearch adware"
X	Disk Panel Configuration	dpcsvc.exe	"Added by the IRCBOT.BSQ BACKDOOR!"
X	Disk Panel Setup	npcsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
U	DiskSuite	aDSProcMngr.exe	"Part of PC Tools Disk Suite from PC Tools - which ""is an all-in-one hard-disk management utility that integrates disk optimization
X	Display	backup.exe	"Added by the BRONTOK-CR WORM!"
U	DisplayFusion	DisplayFusion.exe	"DisplayFusion from Binary Fortress Software - ""is a fantastic application that can make your dual monitor (or triple monitor or more) life much
X	Distributed File System	Dfsvc.exe	"Added by the MYFIP.A or MYFIP.K WORMS!"
X	Distributed File System	kernel32dll.exe	"Added by the MYFIP-C or MYFIP.K WORMS!"
X	Distributed File System	blade.exe	"Added by the MYFIP.AC WORM!"
X	Distributed File System	win.exe	"Added by the MYFIP.AB WORM!"
X	Distributed Link Tracking	ascvt.exe	"Added by the AGOBOT-GH BACKDOOR!"
U	distributed.net client	DNETC.EXE	"Dsitributed computing projects client from Distributed.net where numerous computers are used to share a projects workload - similar to SETI@Home and Folding@Home. Also prone to being distributed by viruses"
X	DivX Updater	DivX.Exe	"Added by the NALDEM TROJAN or MASTAK VIRUS!"
Y	DLBTCATS	"rundll32 [path] DLBTtime.dll	_RunDLLEntry@16"
Y	DLBUCATS	"rundll32 [path] DLBUtime.dll	_RunDLLEntry@16"
Y	DLBXCATS	"rundll32 [path] DLBXtime.dll	_RunDLLEntry@16"
Y	DLCCCATS	"rundll32 [path] DLCCtime.dll	_RunDLLEntry@16"
Y	DLCDCATS	"rundll32 [path] DLCDtime.dll	_RunDLLEntry@16"
Y	DLCFCATS	"rundll32 [path] DLCFtime.dll	_RunDLLEntry@16"
Y	DLCGCATS	"rundll32 [path] DLCGtime.dll	_RunDLLEntry@16"
Y	DLCICATS	"rundll32 [path] DLCItime.dll	_RunDLLEntry@16"
Y	DLCJCATS	"rundll32 [path] DLCJtime.dll	_RunDLLEntry@16"
Y	DLCQCATS	"rundll32 [path] DLCQtime.dll	_RunDLLEntry@16"
Y	DLCXCATS	"rundll32 [path] DLCXtime.dll	_RunDLLEntry@16"
X	Dll Boot Loader on Startup (do not remove this)	[various filenames]	Added by an unidentified TROJAN!
X	DllExecutable	[path to file]	"Added by the VB-SP WORM!"
X	DLLUPDATE32	dllupdate32.exe	"Added by the AGOBOT.IA WORM!"
Y	DLO Agent	DLOClientu.exe	"Part of the backup suites from VERITAS - Backup Exec and NetBackup. Both have now been replaced by their Symantec equivalents since they acquired VERITAS in 2005"
X	dluca	dluca.exe	"Added by the DLUCA.C TROJAN!"
X	dluxde	dluxde.exe	All-In-One-Telcom (adult content dialler) variant
X	Dluxjp	Dluxjp.exe	"Added by the DLUCA.D TROJAN!"
N	DMAScheduler	DMAScheduler.exe	"Related to DigitalMedia Plus Archiver. This program is non-essential process to the running of the program
U	DMXLauncher	DMXLauncher.exe	"Part of Dell's Media Experience
X	dnam	d140113.a.Stub.EXE	"Added by the STUB_A TROJAN!"
Y	DNE Binding Watchdog	"rundll dnes.dll	DnDneCheckBindings"
Y	DNE DUN Watchdog	"rundll dnes.dll	DnDneCheckDUN13"
X	Doctor Antivirus 2008	antvr.exe	"Doctor Antivirus 2008 rogue security software - not recommended
N	DocuMagix Init	PWATCH.EXE	"PaperMaster is an application for the PC designed to automate the process of organizing
U	Document Manager	docmgr.exe	"Wave Systems Corp. Document Manager - ""provides secure storage and management capabilities for file and folder level encryption"""
U	Don't Panic Pop-Up Stopper	dpps2.exe	"Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group"
U	Dopus	dopus.exe	"Directory Opus - a file manager from GPSoft"
U	DoubleDesktop	dd.exe	"""DoubleDesktop is a smart and elegant system tray utility that effectively doubles the width of your Windows desktop"""
N	DoUWantIt	duwi.exe	DoUWantIt - online shopping assistant. Start it manually
X	Dowmingzu	Dowmingzu.dll.vbs	"Added by the SOLOW-E WORM!"
N	Download Accelerator Plus 5.0	DAP.exe	"Download Accelerator Plus from Speedbit. Download manager for resuming downloads
X	Download Plus	DownloadPlus.exe	"DownloadPlus adware"
X	DownloadLegalMusic	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	DownloadMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	DownloadsAndMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
Y	DPASUpdate	DPASAutoUpdate.exe	"Automatic updates for DefenderPro AntiSpy spyware remover - now incorporated Defender Pro 15-in-1 and 5-in-1"
Y	DPCProxyLoadOnStartup	dpcstart.exe	"DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access"
U	DpUtil	TEDTray.exe	"Main executable for TOSHIBA DualPoint Utility Main Module. It is a system tray icon program that provides configuration options for dual pointing device"
X	Dr. Guard	drguard.exe	"Dr. Guard rogue security software - not recommended
N	Drag'n'Drop_Autolaunch	Autolaunch.exe	"Iomega HotBurn - CD-RW burning software"
N	DragnDrop_Autolaunch	Autolaunch.exe	"Iomega HotBurn - CD-RW burning software"
X	DRam prosessor	WindowsUpdate.exe	"Added by the RBOT-BBZ WORM!"
X	DRam prosessor	msupdate.exe	"Added by the DELF-FAW TROJAN!"
X	DRam prosessor	winupl.exe	"Added by the RBOT-BCQ WORM!"
X	DRam rar proc	winupdaterar.exe	"Added by a variant of the IRCBOT TROJAN!"
X	DRam rare proc	updaterarwin.exe	"Added by the RBOT-GQW WORM!"
X	DriveCleaner 2006 Free	UDC2006.exe	"DriveCleaner rogue security software - not recommended
X	DriveCleaner Free	UDC.exe	"DriveCleaner rogue security software - not recommended
U	DriverMagicLogon	dmschedule.exe	"Part of DriverMagic - ""the easiest way to locate device drivers"""
X	DriverModule	csrnvrt.exe	"Added by the IRCBOT.I TROJAN!"
U	drkly16j	"rundll32.exe drkly16j.dll	ServiceCheck"
X	DRM Upgrade	drmupgd.exe	"Added by the IRCBOT.AWU BACKDOOR!"
X	drmu	W95Mm.exe	Homepage hijacker installing a toolbar: http://tdko.com/. Lop.com in disguise
X	Drmupgds	Drmupgds.exe	"Maxfiles adware"
X	drvrmanager	drvrquery32.exe	"Added by the BOOHOO WORM!"
X	drvupd	rundll32 ..drvupd.inf	"Hijacker - drvupd.inf file installs a ""searchforge.com"" hijack"
X	DrWeb Antivirus	DRWEBAV.EXE	Added by an unidentified WORM or TROJAN!
Y	Drwebscheduler	Drwebscd.exe	"DrWeb antivirus related - scheduler that allows you to manage an automatic launch of applications
X	DsmSer	sysup.exe	"Added by the SERFLOG.B WORM!"
Y	DSndUp	DSndUp.exe	"Utility that only runs once after installing the drivers for Analog Devices SoundMax integrated soundcards. It's exact purpose is unknown at the present time but from the filename it's probably used to configure the default or generic speaker arrangement for the system it's used on"
U	DT 11Mbps WLAN USB Station	DTUSBMonitor.exe	11Mbps USB based wireless LAN connection monitor - possibly from Deutsche Telekom
N	DU Meter	DUMETER.EXE	"Hagel Technologies internet bandwidth monitor"
U	DualCoreCenter	StartUpDualCoreCenter.exe	"Unified control center for overclocking both the graphics card and the CPU
?	Duane Reade Insert Detect	InsDetect.exe	"Part of Duane Read Picture Suite & Digital Image Pack. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
X	duck	duck.exe	"Added by the AGOBOT-AVG WORM!"
N	Dulux WeatherShield WeatherDesk	weather.exe	"Dulux WeatherShield WeatherDesk - latest weather information from across Australia"
X	Dumeter Services	dumeter.exe	"Added by the SDBOT-AEQ WORM!"
X	Dump	Dump.exe	"Added by the ZIMUSE WORM!"
X	dumprep	spoolc.exe	"Detected by Kaspersky as a variant of the AGENT.CXF TROJAN!"
X	dumprep	dump-k.exe	"Added by the BUZUS-U WORM!"
X	dumprep	dump.exe	"Added by the CODOX-A WORM!"
N	dumprep 0 -k	dumprep 0 -k	"Used in connection with memory dumps - you can disable these by - right clicking on My Computer
N	dumprep 0 -u	dumprep 0 -u	"Used in connection with memory dumps - you can disable these by - right clicking on My Computer
X	DUN_SERVICES3	dun3.exe	"Added by the SOKIRON TROJAN!"
X	Duweculey	yujixit.exe	"Added by the SDBOT.BRP WORM!"
X	Duwee wong Cerbon	Cirebons.exe	"Added by the BHARAT.A WORM!"
X	DVD Upgrade	dvdupgd.exe	"Added by a variant of the IRCBOT BACKDOOR!"
N	DVDLauncher	DVDLauncher.exe	"Part of Cyberlink's Power Cinema - allows you to play DVDs upon insertion"
N	DVDUpgrade	DVDUpgrd.exe	"Microsoft program to upgrade your DVD decoder program - see Q306331. Available via Start -> Programs"
X	dvraudio	dvraudio.exe	"Added by a variant of the CRYPTER.C TROJAN!"
N	DwlClient	support.exe	Download manager for Dell support alerts
U	DWQueuedReporting	dwtrig20.exe	"Used to launch Microsoft Error Reporting (DW20.exe) - if
X	Dx	sys.exe [ = random number]	"Added by the DEXTER.A WORM!"
X	Dxupdate.exe	Dxupdate.exe	"Added by the MAFEG WORM!"
X	DyFuCA	optimize.exe	"Adult content dialler - see here"
X	DyFuCA Active Alert	actalert.exe	"Adult content dialler - see here"
U	DynDNS Updater	DynDNS.exe	"Dynamic DNS IP address updater tool
N	DynDNS-Updater Traytool	ddutray.exe	"DynDNS updater tray icon - allows easy configuration of the Dynamic DNSSM service. Can be run manually"
U	Dynu Basic Client	dynubas.exe	"Dynu online dynamic IP update client. Useful when using a dial up modem"
X	E-nrgyPlus	E-nrgyPlus.exe	"Energyplus - tracks internet activity including websites visited and queries made at popular search engines. This information along with some system information is sent to a remote site"
U	e-Surveiller Station	estation.exe	"ESurveiller - surveillance software. Uninstall this software unless you put it there yourself"
?	Eac_rnvdl	ANTIVIRUS_INSTALL.EXE	"??"
U	eanth_critical_update_alert	sys_alert.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
U	eanth_critical_update_alert	EANTHO~1.EXE	"eAcceleration Stop-Sign security software related - previously not recommended (see here). It has now been delisted
N	Eapcisetup	sbsetup.exe	Rockwell RipTide soundcard application software. Sound works without it
N	EAPCISETUP	wizard.exe	Part of the Creative Sounblaster PIC Installation Wizard. Probably left as a result of a failed installation
N	Easy Start Button	esb.exe	Provides functionality on certain laptops that have additional keys. Not required unless you use the extra keys
N	EasyNetwork	McENUI.exe	"McAfee's EasyNetwork user interface - ""enables secure file sharing
X	EasySearchBar	ESBUpdate.exe	EasySearchBar adware downloader
U	EasySync Pro	XCPCMenu.exe	"""IBM® Lotus® EasySync® Pro is a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - 3CmPlm	AutoDet.exe	"3Com Palm PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - PocketPC	AUTODE~1.EXE	"Windows Mobile Pocket PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - PocketPC	AutoDetect.exe	"Windows Mobile Pocket PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasyTuneIII	EasyTune.exe	Tuning (overclocking) utility for Gigabyte motherboards. Shortcut available
U	EasyTuneIV	ET4Tray.exe	Tuning (overclocking) utility for Gigabyte motherboards. Shortcut available
U	EasyTuneV	GUI.exe	Tuning (overclocking) utility for Gigabyte motherboards. Shortcut available
U	eAudio	eAudio.exe	"Part of Acer Empowering Technology. Acer eAudio Management provides centralized control over notebook audio and specialized audio modes for movies
N	ECenter	EULALauncher.exe	End User License Agreement (EULA) launcher - related to Dell E-Center/Google Toolbar
U	eDataSecurity Loader	eDSloader.exe	"Part of Acer Empowering Technology. ""Acer eDataSecurity Management is a handy file encryption utility that protects files from being accessed by unauthorized persons
X	educational writer	[random filename]	"Added by the RBOT-LZ WORM!"
X	Edzy AntiVirus	dppsfa.exe	"Added by a variant of the RBOT WORM!"
U	eFax Live Menu 3.3	J2GDllCmd.exe	"DLL Command Utility for version 3.3 of eFax Messenger from j2 Global Communications
N	eFax Tray Menu	HotTray.exe	"eFax Messenger Tray Menu system tray icon for eFax Messenger Plus. Available via Start -> Programs. Disabling instructions available here"
U	eFax Tray Menu	J2GTray.exe	"System Tray access to eFax Messenger from j2 Global Communications
U	eFax Tray Menu 3.3	J2GTray.exe	"System Tray access to version 3.3 of eFax Messenger from j2 Global Communications
U	eFax Tray Menu 3.5	J2GTray.exe	"System Tray access to version 3.5 of eFax Messenger from j2 Global Communications
U	eFax Tray Menu 4.0	J2GTray.exe	"System Tray access to version 4.0 of eFax Messenger from j2 Global Communications
N	eFax.com Tray Menu	HotTray.exe	"eFax Messenger Tray Menu system tray icon for eFax Messenger Plus. Available via Start -> Programs. Disabling instructions available here"
X	egikugu	napolecy.exe	"Added by the SDBOT.AOE WORM!"
N	EgisTecLiveUpdate	EgisUpdate.exe	"Software updater for biometric and data encryption products from EgisTec Inc"
Y	egui	egui.exe	"User interface for ESET NOD32 Antivirus and Smart Security"
X	element furth	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are often located in %System%\vert"
U	ELSA WINman Suite	Winmsuit.exe	"Allows you to totally customize your ELSA graphics card settings
U	ELSAChipGuard	elsavect.exe	"ChipGuard for ELSA graphics cards - monitoring solution which monitors both the GPU temperature and fan speed
U	ELSBLaunch	ELSBLaunch.exe	"EarthLink SpamBlocker"
U	EMBASSY Trust Suite Secure Update	AutoUpdate.exe	"Updates for Wave Systems Corp. Embassy Trust Suite - ""delivers advanced levels of security to the client PC using the TPM security chip found on most enterprise PCs today"""
U	Emouse	Emouse.exe	"Genius mouse driver - required if you use non-standard Windows driver features"
X	empin	e121307.Stub.exe	"Delfin Media Viewer adware related"
?	Empowering Technology Launcher	eAPLauncher.exe	"Part of Acer Empowering Technology. What does it do and is it required?"
?	EmpoweringTechnology	Framework.Launcher.exe	"Part of Acer Empowering Technology. What does it do and is it required?"
Y	Emsisoft Anti-Malware	a2guard.exe	"System Tray access to and Anti-Malware Guard feature of Emsisoft Anti-Malware from Emsi Software GmbH - which provides ""comprehensive PC protection against viruses
X	emule	emule.exe	"Added by the RBOT-ALZ WORM! Note - do not confuse with the legitimate eMule peer-to-peer (P2P) file-sharing program which is normally located in %ProgramFiles%\eMule. This one is located in %System%"
N	eMule	emule.exe	"eMule - ""one of the biggest and most reliable peer-to-peer file sharing clients around the world. Thanks to it's open source policy many developers are able to contribute to the project
N	eMuleAutoStart	emule.exe	"eMule - ""one of the biggest and most reliable peer-to-peer file sharing clients around the world. Thanks to it's open source policy many developers are able to contribute to the project
N	eMusicClient Systray	eMusicClient.exe	"eMusic MP3 download software"
?	encapsulated command tool	wintr.com	"??"
N	Encarta Dictionary Quickshelf	QSHLFED.EXE	"Provides quick access to Encarta's Dictionary features?"
?	ENCSurf	surfboard.exe	"??"
X	EnergyPlugIn	EnergyPlugin.exe	"EnergyPlugin adware variant"
Y	EngUtil	EngUtil.exe	"Part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools - corrects any modification made to the Roxio Engine
X	Enh Win Updt	enhupdt.exe	"Adware - detected by Kaspersky as the ONECLICKNETSEARCH.H TROJAN!"
N	EnigmaPopupStop	EnigmaPopupStop.exe	"Part of Enigma SpyHunter - not recommended
U	Enterprise Harmony	rsMenu.exe	"Enterprise Harmony 99 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000"
U	Enterprise Harmony '99	rsMenu.exe	"Enterprise Harmony 99 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000"
X	Enterprise Suite	WE[random characters].exe	"Enterprise Suite rogue security software - not recommended
X	EntraOcio	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Enumerate Service	wsys.exe	"Added by the MANIFEST TROJAN!"
U	EOUApp	EOUWiz.exe	Intel ProSET Wireless related - provides additional configuration options for these devices
U	EOUWiz	EOUWiz.exe	Intel ProSET Wireless related - provides additional configuration options for these devices
U	EPoXUSDM	USDM.EXE	"EPoX Universal Serial Data Monitor - a diagnostics tool that shows Temps
X	Epsilon Squared	vmmreg32.exe	"Added by the AGENT.MVC TROJAN!"
N	EPSON Background Monitor	STMS.EXE	Supposed to keep an Epson printer ready for quick printing. Users report little difference whether it is on or not
U	EPSON PictureMate Deluxe	E_FATI9TA.EXE	"Epson Status Monitor 3 for the PictureMate Deluxe compact photo printer - for monitoring printer status
U	EPSON Status Monitor 3	E_[various].EXE	"Epson Status Monitor 3 for their range of printer and AIO devices - for monitoring printer status
N	EPSON Status Monitor 3 Environment Check	e_srcv03.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check	e_srcv02.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check 2	e_srcv03.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check 2	e_srcv02.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
U	EPSON Stylus C120 Series	E_FATICCA.EXE	"Epson Status Monitor 3 for the Stylus C120 Series printer - for monitoring printer status
U	EPSON Stylus C40 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C40 Series printer - for monitoring printer status
U	EPSON Stylus C41 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C41 Series printer - for monitoring printer status
U	EPSON Stylus C42 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C42 Series printer - for monitoring printer status
U	EPSON Stylus C43 Series	E_S08IC1.EXE	"Epson Status Monitor 3 for the Stylus C43 Series printer - for monitoring printer status
U	EPSON Stylus C43 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C43 Series printer - for monitoring printer status
U	EPSON Stylus C44 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C44 Series printer - for monitoring printer status
U	EPSON Stylus C45 Series	E_S4I3T1.EXE	"Epson Status Monitor 3 for the Stylus C45 Series printer - for monitoring printer status
U	EPSON Stylus C46 Series	E_S4I0T1.EXE	"Epson Status Monitor 3 for the Stylus C46 Series printer - for monitoring printer status
U	EPSON Stylus C48 Series	E_S4I091.EXE	"Epson Status Monitor 3 for the Stylus C48 Series printer - for monitoring printer status
U	EPSON Stylus C60 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C60 Series printer - for monitoring printer status
U	EPSON Stylus C61 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C61 Series printer - for monitoring printer status
U	Epson Stylus C62 Series	E-S0BIC1.EXE	"Epson Status Monitor 3 for the Stylus C62 Series printer - for monitoring printer status
U	EPSON Stylus C62 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C62 Series printer - for monitoring printer status
U	EPSON Stylus C63 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C63 Series printer - for monitoring printer status
U	EPSON Stylus C64 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C64 Series printer - for monitoring printer status
U	EPSON Stylus C64 Series	E_S4I2C1.EXE	"Epson Status Monitor 3 for the Stylus C64 Series printer - for monitoring printer status
U	EPSON Stylus C66 Series	E_S4I0S2.EXE	"Epson Status Monitor 3 for the Stylus C66 Series printer - for monitoring printer status
U	EPSON Stylus C67 Series	E_FATIAAL.EXE	"Epson Status Monitor 3 for the Stylus C67 Series printer - for monitoring printer status
U	Epson Stylus C82 Series	E_S0HIC1.EXE	"Epson Status Monitor 3 for the Stylus C82 Series printer - for monitoring printer status
U	EPSON Stylus C82 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C82 Series printer - for monitoring printer status
U	EPSON Stylus C84 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C84 Series printer - for monitoring printer status
U	EPSON Stylus C84 Series	E_S4I2D1.EXE	"Epson Status Monitor 3 for the Stylus C84 Series printer - for monitoring printer status
U	EPSON Stylus C87 Series	E_FATIABL.EXE	"Epson Status Monitor 3 for the Stylus C87 Series printer - for monitoring printer status
U	EPSON Stylus CX2900 Series	E_FATIBFP.EXE	"Epson Status Monitor 3 for the Stylus CX2900 Series printer - for monitoring printer status
U	EPSON Stylus CX3100	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus CX3100 printer - for monitoring printer status
U	EPSON Stylus CX3200	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus CX3200 printer - for monitoring printer status
U	EPSON Stylus CX3500 Series	E_FATI9 BL.EXE	"Epson Status Monitor 3 for the Stylus CX3500 Series printer - for monitoring printer status
U	EPSON Stylus CX3600 Series	E_FATI9BE.EXE	"Epson Status Monitor 3 for the Stylus CX3600 Series printer - for monitoring printer status
U	EPSON Stylus CX3700 Series	E_FATIACP.EXE	"Epson Status Monitor 3 for the Stylus CX3700 Series printer - for monitoring printer status
U	EPSON Stylus CX3800 Series	E_FATIACA.EXE	"Epson Status Monitor 3 for the Stylus CX3800 Series printer - for monitoring printer status
U	EPSON Stylus CX3900 Series	E_FATIBEP.EXE	"Epson Status Monitor 3 for the Stylus CX3900 Series printer - for monitoring printer status
U	EPSON Stylus CX4200 Series	E_FATIAEA.EXE	"Epson Status Monitor 3 for the Stylus CX4200 Series printer - for monitoring printer status
U	EPSON Stylus CX4500 Series	E_FATI9AP.EXE	"Epson Status Monitor 3 for the Stylus CX4500 Series printer - for monitoring printer status
U	EPSON Stylus CX4600 Series	E_FATI9AA.EXE	"Epson Status Monitor 3 for the Stylus CX4600 Series printer - for monitoring printer status
U	EPSON Stylus CX4700 Series	E_FATIADL.EXE	"Epson Status Monitor 3 for the Stylus CX4700 Series printer - for monitoring printer status
U	EPSON Stylus CX4800 Series	E_FATIADA.EXE	"Epson Status Monitor 3 for the Stylus CX4800 Series printer - for monitoring printer status
U	EPSON Stylus CX5000 Series	E_FATIBVA.EXE	"Epson Status Monitor 3 for the Stylus CX5000 Series printer - for monitoring printer status
U	EPSON Stylus CX5400	E_S4I2G1.EXE	"Epson Status Monitor 3 for the Stylus CX5400 printer - for monitoring printer status
U	EPSON Stylus CX5500 Series	E_FATICAP.EXE	"Epson Status Monitor 3 for the Stylus CX5500 Series printer - for monitoring printer status
U	EPSON Stylus CX6000 Series	E_FATIBIA.EXE	"Epson Status Monitor 3 for the Stylus CX6000 Series printer - for monitoring printer status
U	EPSON Stylus CX6500 Series	E_FATI9EP.EXE	"Epson Status Monitor 3 for the Stylus CX6500 Series printer - for monitoring printer status
U	EPSON Stylus CX6600 Series	E_FATI9EE.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	EPSON Stylus CX6600 Series	E_FATI9EA.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	EPSON Stylus CX7000F Series	E_FATIBKA.EXE	"Epson Status Monitor 3 for the Stylus CX7000F Series printer - for monitoring printer status
U	EPSON Stylus CX7400 Series	E_FATICDA.EXE	"Epson Status Monitor 3 for the Stylus CX7400 Series printer - for monitoring printer status
U	EPSON Stylus CX7800 Series	E_FATIAFA.EXE	"Epson Status Monitor 3 for the Stylus CX7800 Series printer - for monitoring printer status
U	EPSON Stylus CX8300 Series	E_FATICEP.EXE	"Epson Status Monitor 3 for the Stylus CX8300 Series printer - for monitoring printer status
U	EPSON Stylus CX8400 Series	E_FATICEA.EXE	"Epson Status Monitor 3 for the Stylus CX8400 Series printer - for monitoring printer status
U	EPSON Stylus CX9300F Series	E_FATICFP.EXE	"Epson Status Monitor 3 for the Stylus CX9300F Series printer - for monitoring printer status
U	EPSON Stylus CX9400Fax Series	E_FATICFA.EXE	"Epson Status Monitor 3 for the Stylus CX9400Fax Series printer - for monitoring printer status
U	EPSON Stylus D68 Series	E_FATIAAE.EXE	"Epson Status Monitor 3 for the Stylus D68 Series printer - for monitoring printer status
U	EPSON Stylus D78 Series	E_FATIBGE.EXE	"Epson Status Monitor 3 for the Stylus D78 Series printer - for monitoring printer status
U	EPSON Stylus D88 Series	E_FATIABE.EXE	"Epson Status Monitor 3 for the Stylus D88 Series printer - for monitoring printer status
U	EPSON Stylus DX3800 Series	E_FATIACE.EXE	"Epson Status Monitor 3 for the Stylus DX3800 Series printer - for monitoring printer status
U	EPSON Stylus DX4000 Series	E_FATIBEE.EXE	"Epson Status Monitor 3 for the Stylus DX4000 Series printer - for monitoring printer status
U	EPSON Stylus DX4400 Series	E_FATICAE.EXE	"Epson Status Monitor 3 for the Stylus DX4400 Series printer - for monitoring printer status
U	EPSON Stylus DX4800 Series	E_FATIADE.EXE	"Epson Status Monitor 3 for the Stylus DX4800 Series printer - for monitoring printer status
U	EPSON Stylus DX5000 Series	E_FATIBVE.EXE	"Epson Status Monitor 3 for the Stylus DX5000 Series printer - for monitoring printer status
U	EPSON Stylus DX6000 Series	E_FATIBIE.EXE	"Epson Status Monitor 3 for the Stylus DX6000 Series printer - for monitoring printer status
U	EPSON Stylus DX7000F Series	E_FATIBKE.EXE	"Epson Status Monitor 3 for the Stylus DX7000F Series printer - for monitoring printer status
U	EPSON Stylus DX7400 Series	E_FATICDE.EXE	"Epson Status Monitor 3 for the Stylus DX7400 Series printer - for monitoring printer status
U	EPSON Stylus DX8400 Series	E_FATICEE.EXE	"Epson Status Monitor 3 for the Stylus DX8400 Series printer - for monitoring printer status
U	EPSON Stylus Photo 1400 Series	E_FATIBUA.EXE	"Epson Status Monitor 3 for the Stylus Photo 1400 Series printer - for monitoring printer status
U	EPSON Stylus Photo 2200	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo 2200 printer - for monitoring printer status
U	EPSON Stylus Photo 825	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo 825 printer - for monitoring printer status
U	EPSON Stylus Photo 925	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo 925 printer - for monitoring printer status
U	EPSON Stylus Photo R1800	E_FATI9LA.EXE	"Epson Status Monitor 3 for the Stylus Photo R1800 printer - for monitoring printer status
U	EPSON Stylus Photo R200 Series	E_S4I0H2.EXE	"Epson Status Monitor 3 for the Stylus Photo R200 Series printer - for monitoring printer status
U	EPSON Stylus Photo R220 Series	E_S6I2I1.EXE	"Epson Status Monitor 3 for the Stylus Photo R220 Series printer - for monitoring printer status
U	EPSON Stylus Photo R220 Series	E_FATIAIE.EXE	"Epson Status Monitor 3 for the Stylus Photo R220 Series printer - for monitoring printer status
U	EPSON Stylus Photo R240 Series	E_FATIAHE.EXE	"Epson Status Monitor 3 for the Stylus Photo R240 Series printer - for monitoring printer status
U	EPSON Stylus Photo R2400	E_FATI9SA.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	EPSON Stylus Photo R2400	E_FATI9SE.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	EPSON Stylus Photo R260 Series	E_FATIBNA.EXE	"Epson Status Monitor 3 for the Stylus Photo R260 Series printer - for monitoring printer status
U	EPSON Stylus Photo R280 Series	E_FATICKA.EXE	"Epson Status Monitor 3 for the Stylus Photo R280 Series printer - for monitoring printer status
U	EPSON Stylus Photo R285 Series	E_FATICKE.EXE	"Epson Status Monitor 3 for the Stylus Photo R285 Series printer - for monitoring printer status
U	EPSON Stylus Photo R300 Series	E_S4I2F1.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	EPSON Stylus Photo R300 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	EPSON Stylus Photo R300 Series	E_S4I0F2.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	EPSON Stylus Photo R320 Series	E_FATI9FA.EXE	"Epson Status Monitor 3 for the Stylus Photo R320 Series printer - for monitoring printer status
U	EPSON Stylus Photo R340 Series	E_FATIAJE.EXE	"Epson Status Monitor 3 for the Stylus Photo R340 Series printer - for monitoring printer status
U	EPSON Stylus Photo R380 Series	E_FATIBOA.EXE	"Epson Status Monitor 3 for the Stylus Photo R380 Series printer - for monitoring printer status
U	EPSON Stylus Photo R800	E_FATI9YE.EXE	"Epson Status Monitor 3 for the Stylus Photo R800 printer - for monitoring printer status
U	EPSON Stylus Photo RX420 Series	E_FATI9CE.EXE	"Epson Status Monitor 3 for the Stylus Photo RX420 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX430 Series	E_FATI9CP.EXE	"Epson Status Monitor 3 for the Stylus Photo RX430 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX500	E_S4I2K1.EXE	"Epson Status Monitor 3 for the Stylus Photo RX500 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX530 Series	E_FATIAGP.EXE	"Epson Status Monitor 3 for the Stylus Photo RX530 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX600	E_S4I2M1.EXE	"Epson Status Monitor 3 for the Stylus Photo RX600 printer - for monitoring printer status
U	EPSON Stylus Photo RX640 Series	E_FATIAME.EXE	"Epson Status Monitor 3 for the Stylus Photo RX640 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX680 Series	E_FATICJA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX680 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX700 Series	E_FATI9IA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX700 Series printer - for monitoring printer status
U	EPSON Stylus Pro 4000	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Pro 4000 printer - for monitoring printer status
U	EPSON Stylus Pro 7600	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Pro 7600 printer - for monitoring printer status
U	EPSON Stylus SX200 Series	E_FATIEFE.EXE	"Epson Status Monitor 3 for the Stylus SX200 Series printer - for monitoring printer status
?	Equipmen	Equipmen.exe	"??"
X	ErreurChasseur	SysRep.exe	"ErreurChasseur
N	Error Nuker	ErrorNuker.exe	"ErrorNuker registry cleaner - only required if you want the application to run a scan at startup. The program can be launched manually if required"
X	Error Safe Free	uers.exe	"ErrorSafe rogue system error and cleaning utility - not recommended"
X	ErrorGuard	ErrorGuard.exe	"ErrorGuard rogue spyware remover - not recommended
X	ErrorSafeFree	UERS.exe	"ErrorSafe rogue system error and cleaning utility - not recommended"
X	ERS	ers_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	ERS_check	ers_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	ERS_Check	uwasers.exe	"Part of the WinAntiSpyware 2006 and WinAntiSpyware 2007 rogue spyware removers - not recommended"
X	ertyuop	rttrwq.exe	"Added by the AUTORUN-APA WORM!"
U	ERUNT AutoBackup	AUTOBACK.EXE	"ERUNT backup utility - when added to the user's startup folder automatically backs up the registry each time the system boots
X	erwghjjrjt	ucbcg.exe	"Added by the SMALL.CUL TROJAN!"
U	ES Current Services	[FILE NAME].exe	"123Keylogger surveillance software. Uninstall this software unless you put it there yourself"
U	eScan Scheduler	avkserv.exe	"MicroWorld eScan antivirus scheduler"
U	eScan Updater	Trayicos.exe	"MicroWorld eScan antivirus updater - allows users to automatically download updates and set the auto time interval for downloads"
X	Esph	ortu.exe	"PurityScan adware"
?	eSupInit	eSupCmd.exe	"Related to SupportSoft (aka Support.com) ""Real-Time Service Management software"". What does it do and is it required?"
X	Esutityde	osutityde.exe	"Added by the SDBOT.BQD WORM!"
X	etbrun	elit**32.exe [ = random char]	"EliteBar adware"
N	Ethernet	tcaudiag.exe	3Com NIC Installation/Diagnostic MFC application. Diagnostics may be run from the Start -> Programs
X	Etraffic	JavaRun.exe	"TopMoxie adware"
Y	eTrust EZ Firewall	efpeadm.exe	"eTrust EZ Firewall"
U	eTrust PestPatrol Active Protection	PPActiveDetection.exe	"PestPatrol real-time protection feature. ""Stops spyware before it infects your system"""
X	eTrust Realtime Monitor	realmon.exe	"Added by the LAZAR.B TROJAN!"
Y	eTrustCIPE	ezdsmain.exe	eTrust EZ Deskshield from Computer Associates. Protects against malicious email attachments and unauthorized use of email by detecting and blocking unusual behavior
X	eTunnel	winfw.exe	Added by an unidentified TROJAN!
U	Eudora	Eudora.exe	"Eudora from Qualcomm allows you to receive and send Internet e-mails"
X	EUP Service	eupsvc.exe	"Added by the DELBOT-Q WORM!"
U	EuroGlot	EuroGlot.exe	"Euroglot - ""multilanguage translating system
U	Evoluent Mouse Manager	EvoMouExec.exe	"Mouse manager for Evoluent VertcialMouse"
N	eWare Startup	iWareStart.exe	"eWare iWare task bar. Not required"
X	ewrgetuj	geurge.exe	"Added by the AUTOINF-AK WORM!"
X	ewupdater	ewupdater.exe	"EasyWebSearch adware updater"
N	Excite Platform	Exlaunch.exe	Loads an Icon in the startup tray that allows you to receive service update notices for Excite@Home if you desire (note that since Excite@Home appears to be winding down this becomes irrelevant). May also allow you to kill the Excite Toolbar that automatically loads in Internet Explorer
X	ExecUser	ExecUser.exe	"Added by a variant of the RBOT WORM!"
?	Execute	delfolders.exe	"??"
X	ExFilter	"Rundll32.exe [path] cdnspie.dll	ExecFilter"
U	Exif Launcher	Exiflaquickdcr.exe	USB mass storage driver used by some digital cameras such as the Fuji Finepix. Only required if you use it regularly
U	Exif Launcher	QuickDCF.exe	USB mass storage driver used by some digital cameras such as the Fuji Finepix. Only required if you use it regularly
X	ExpertAntivirus	ExpertAntivirus.exe	"ExpertAntivirus rogue security software - not recommended
X	expler	Updadv.exe	"Added by the QQPASS-N TROJAN!"
X	Explkw	expup.exe	Keywords hijacker
X	Explorer Updater	IEXPLORE.exe	"Added by the SDBOT-WO WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	ExplorerRun	conime.exe	"Added by the DLDR-G TROJAN! Note - this is not the legitimate Console IME process of the same filename which is located in %System%. This one is located in %Temp%"
X	ExploreUpdSched	[random filename]	"ZenoSearch adware"
N	Extender Resource Monitor	RMSysTry.exe	"Related to Windows Media Center from Microsoft"
X	Extra Antivirus	ExtraAV.exe	"Extra Antivirus rogue security software - not recommended
?	Extranet AutoDial	AutoExt.exe	Nortel Networks Contivity Extranet Switching Software
N	Eye Tide Launcher	oneeyetideone.exe	Nascar wallpaper
U	EZ-DUB Finder	EZ-DUB.exe	"Support software for the Lite-On EZ-DUB external DVD writer from Lite-On IT Corporation"
N	EzButton	EzButton.EXE	EZbutton is a quick launcher for the Media player app that comes with certain laptops
?	EZNORUN	EZNORUN.EXE	"Easy Internet related?"
U	EzTune	dthtml.exe	"EzTune from Gateway. Rebranded version of Display Tune from Portrait Displays
X	ezula	eZmmod.exe	"eZula TopText adware"
X	eZulaMain	eZulaMain.exe	"eZula TopText adware"
X	eZuluMain	eZuluMain.exe	Comes with "KaZaA" installation. Advertising Spyware. Not required but KaZaA won't work
U	E_S[numbers]	[path] E_[various].EXE [path] E_S[numbers].tmp	"Temporary entry related to Epson Status Monitor 3 for their range of printer and AIO devices - for monitoring printer status
U	F-PROT Antivirus Tray application	FProtTray.exe	"System Tray access to F-PROT Antivirus"
X	F-Secure 2005	svchost.exe	"Added by the BIFROSE-CH TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
Y	F-Secure 2006	fspex.exe	"F-Secure Anti-Virus automatic updater"
X	F-Secure Gatekeeper	[malware name].exe	"Added by the NUWAR.AXQ WORM!"
U	F-Secure Management Agent	FSMA32.EXE	"F-Secure antivirus - F-Secure Policy Manager provides tools for administering F-Secure software products"
Y	F-Secure Manager	FSM32.EXE	"F-Secure antivirus - carry out scheduled virus scans automatically"
Y	F-Secure Startup Wizard	FSSW.EXE	"F-Secure antivirus"
Y	F-Secure TNB	TNBUtil.exe	"F-Secure antivirus"
U	F5D7050v3	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D7050 Wireless G USB Adapter"
U	F5D8001	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8001 N1 Wireless Desktop Card"
U	F5D8011	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8011 N1 Wireless Notebook Card"
U	F5D8055v1	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8055 Wireless N+ USB Adapter"
U	F5D8071	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8071 N1 Wireless ExpressCard"
U	F5D9010	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D9010 Wireless G+ MIMO USB Network Adapter"
U	F5D9050	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D9050 Wireless G+ MIMO USB Network Adapter"
U	Fabrik Ultimate Backup Status	fabrikhomestat.exe	"Status monitor for Fabrik Ultimate Backup from Fabrik Inc. ""No matter what happens to the drive on your desk - a spilled drink
X	Fast Antivirus 2009	FastAV.exe	"Fast Antivirus rogue security software - not recommended
X	Fast start	Ntut.exe	"Adware - deteced by Kaspersky as the FAVADD.I TROJAN!"
X	FastDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	FastStart	ntnut32.exe	"Added by the STARTPAGE.L TROJAN!"
X	FastStart	svcnut.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
X	FastStart	svcnut32.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
N	FastTrack Accelerator	SPEED UP.EXE	"FastTrack Accelerator - ""speedup"" utility for programs that use the FastTrack network such as KaZaA Media Desktop
N	FastUser	fast.exe	Installs as part of Windows XP PowerToys as an option for very-fast user switching (allowing a keystoke to switch users instead of using the login screen). It is only used for the hot-key switch and yet it hogs 1.5 megs of memory in two separate processes (one run by the user & one by the system). Optional install in PowerToys
N	FastUsr	fast.exe	Installs as part of Windows XP PowerToys as an option for very-fast user switching (allowing a keystoke to switch users instead of using the login screen). It is only used for the hot-key switch and yet it hogs 1.5 megs of memory in two separate processes (one run by the user & one by the system). Optional install in PowerToys
X	FBSearch	SearchGuardPlus.exe	"Fast Browser Search/Search Guard Plus parasite - installed with ""Make the Web Better"" applications such as My Web Tattoo
X	fc	runfc.exe	"Added by the CAMPURF WORM!"
X	Fdaemon security	fsecur.exe	"Added by the SDBOT.KXO WORM!"
X	Fdr Command Module	sp2.exe	"Added by the SDBOT.WP WORM!"
X	Fen Startups	fensvc32.exe	"Added by the RANDEX.CCF WORM!"
X	Fenio Startups	fnesvc32.exe	"Added by the AGOBOT-OS BACKDOOR!"
?	fgl23DoubleScreenHooks	f23happ.exe	"Related to the now discontinued ATI Fire GL3 graphics card. What does it do and is it required?"
X	file laoder configuration	rnd32.exe	"Added by the RBOT.BQJ WORM!"
X	FileFreedom_Plugin	wtm.exe	"FileFreedom peer-to-peer sharing program"
N	filehippo.com	UpdateChecker.exe	"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
N	FileHippo.com Update Checker	UpdateChecker.exe	"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
X	filename process	Rundil16.exe	"Added by the GAOBOT.ZX WORM!"
X	FileSoft	Wscript.exe UpdataFiles.vbs	"Added by the SST.B WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""UpdataFiles.vbs"" file is located in %Windir%"
U	Filterguard	Filtrgrd.exe	"An icon located in the lower left of the screen and looks like a lifesaver. This icon is a ""short-cut"" to access the basic features of SOS-Guardian
Y	Find Virus Launch Program	fvlaunch.exe	"Part of Dr. Solomon's Antivirus"
X	FireExplore Update	FireExplore.exe	"Added by a variant of the RBOT WORM!"
X	Firefox Plugin Manager	firefoxpgm.exe	Added by the MSNPHOTO.E WORM!
X	FireFox Startup Drivers	wuaclt.exe	"Added by the RBOT.BYX WORM!"
X	Firewall	wmlaunch .exe	"Added by the ELIPTER.A or ELIPTER.B WORMS! Note the space at the beginning of the filename"
X	Firewall	wmlaunch .exe	"Added by the ELIPTER.D WORM!"
X	Firewall	SP2 UPDATE.exe	"Added by the ELITPER.E WORM!"
X	firewall 2008	logoneui.exe	"Added by the SILLYFDC WORM!"
X	Firewall auto setup	winlogon.exe	"Added by the AGENT-EDB TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
X	Firewall auto setup	[path to trojan]	"Added by the AGENT-GLY TROJAN!"
X	Firewall Update System1	WinedowsUpdater1.exe	"Added by the RBOT-ARU WORM!"
X	Firewall Updater	msnupdateit.exe	"Added by the RBOT-AAQ WORM!"
Y	FirewallGUI	FirewallGUI.exe	"System Tray access to PC Tools Firewall Plus from PC Tools - which ""is a powerful personal firewall for Windows that protects your computer from intruders and controls the network traffic in and out of your PC"""
U	FirewallStartup	Firewallstartup.exe	"Innovative Startup Firewall - ""designed to protect your computer from programs that install themselves in the StartUp area of your Windows without asking for your approval. Innovative StartUp Firewall will help you keep your computer clean
X	First Home Page	http://find.naupoint.com	"Naupoint browser hijacker"
?	First Principle Group	fpg.exe	"Related to the E-Players Card from First Principle Group"
U	FjMenu	FjMenu.exe	"From the ""Fujitsu Menu"" tray icon you have instant access to the Control Panel
U	FJTWAIN Setup	FjtwSetup.exe	Fujitsu scanner utility
N	FJUPDNV_Chitose	fjdvrupd.exe	Driver update for a Fujitsu Siemens Lifebook laptop
X	FlashGuard	FlashGuard.exe	"Added by the AUTOIT.AL WORM!"
U	FlashMute	FlashMute.exe	"""FlashMute is a tool which allows you to mute/unmute Flash Movies loaded in a browser exclusively
N	FlashPath Status	SDSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
N	FlashPath Status	FLSHSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
U	FlingRun	fling.exe	"Fling - free FTP software from NCH Software"
U	FLMBROWSERMOUSE	mouse32A.exe	Mouse utility for a Trust brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
U	FLMLABTECMOUSE	mouse32A.exe	Mouse utility for a Labtec brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
U	FLMMEDIONMOUSE	mouse32a.exe	Mouse utility for a Medion branded Fellowes mouse
U	FLMOFFICE4DMOUSE	moffice.exe	Mouse utility for a Labtec brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
U	FLMOFFICE4DMOUSE	mouse32a.exe	Mouse utility for a Micro Innovations brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
U	FLMTRUSTKB	KbdAp32A.exe	Keyboard utility for a Trust brand keyboard. If you disable this entry you will not be able to use any of the keyboard hotkeys or other non-standard functions on the keyboard
U	FLMTRUSTMOUSE	mouse32a.exe	Mouse utility for a Trust brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
?	Focus	Focus.exe	"ISDN configuration wizard?"
X	Folder Service	wssdtu.exe	"Added by the MANIFEST TROJAN!"
X	ForceShow	"rundll32.exe QaBar.dll	ForceShowBar"
U	Fortis Secure Layer Config	cseinst.exe	Fortis Bank Home Banking part. Installed during the installation of the software necessary to run the Home Banking. According to Fortis Bank this will not in any way be harmful to the system or relay system information
N	FotoStation Easy AutoLaunch	FotoStation Easy AutoLaunch.exe	Installed with a Nikon digital camera. Used to collect photos uploaded from camera program NkVwMon.exe. If your camera is not connected (via USB port) you do not need this program loaded either
U	Foul PX	FoulPX.exe	"Foul PX
U	FourthDay	FourthDay.exe	"The Fourth Day - ""astronomical clock and almanac for your system tray"""
X	foxwudy9912	service.exe	"Added by the BANCOS-BT TROJAN!"
X	fqor	stub_113_4_0_4_0.exe	"TargetSaver adware"
X	Framework module library	infocard.exe	"Added by the BUZUS.AYX TROJAN!"
X	FreeMP3download	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	freesurfer	fs20.exe	"EMS Free Surfer mk II - pop-up stopper"
?	frguk	shdrkmck.exe	"??"
N	FriendlyWebQuick-Launch	SELFCERT.EXE	selfcert.exe is a stand alone program for creating your own digital certificates for macros - the .exe is installed as an extra basically by clicking on MS Office in add/remove programs and selecting remove - also I would do away with the FriendlyWebQuickLaunchBar as well
U	FRISK FP-Scheduler	F-Sched.exe	"Scheduler for F-Prot anitvirus software. Leave enabled unless you scan manually on a regular basis"
N	Fromine WinPopup	winpopup.exe	Instant Messenger program
X	frun	derc32xz.exe	Added by an unidentified TROJAN!
U	fssui	fsui.exe	"System Tray access to and notifications from Windows Live Family Safety - optionally installed as part of Windows Live Essentials. ""With Family Safety
U	fssui	fssui.exe	"System Tray access to and notifications from Windows Live OneCare Family Safety - part of the Live OneCare range and now superseded by Windows Live Family Safety which is part of Windows Live Essentials. Allows you to decide how your kids experience the Internet by limiting searches
X	fstsvc	"rundll32.exe fstsvc.dll	start"
U	fsui	fsui.exe	"System Tray access to and notifications from Windows Live Family Safety - optionally installed as part of Windows Live Essentials. ""With Family Safety
U	FtLnSOP_setup	FtLnSOP.exe	Fujitsu scanner utility
U	FTMSFLT(USB)	FTMSFLTU.EXE	Fujitsu's Touch Panel Message Notifier
U	Ftpqueue	Ftpsched.exe	"Part of WS_FTP Pro from Ipswitch. Queueing facility for scheduling FTP transfers"
U	ftutil2	"rundll32.exe ftutil2.dll	SetWriteCacheMode"
X	FU	FUvirus.exe	"Added by the VB-EJC TROJAN!"
X	FuckD3w4	FuckD3w4.exe	"Added by the BRONTOK-DI WORM!"
X	Fucker	fucker.vbs	"Added by the CATCHER-A WORM!"
U	Fujitsu Hotkey Utility	IndicatorUty.exe	"Fujitsu Hotkey Utility displays icons on the screen when you use hotkeys on a Fujitsu Siemens Lifebook
U	Fujitsu Menu	FjMnuIco.exe	"From the ""Fujitsu Menu"" tray icon you have instant access to the Control Panel
X	fukerservice	fukerz.exe	"Added by a variant of the RBOT WORM!"
X	FUKLBAR	bar.exe	"PurityScan adware"
N	FullAudio	WMPImporter.exe	Used to import settings from Windows Media Player into Music Now software (from www.musicnow.com - which is no longer available) and possibly others
X	Fun	Fun.exe	"Added by the COIDUNG-A WORM!"
N	FusionHdtvTray	FusionHdtvTray.exe	"FusionTrayAgent - main executable for DVICO FusionHDTV software. It adds an icon to system tray that allows you to easily access Fusion HDTV software"
U	FusionRC	FusionRC.exe	"Remote control manager for DVICO FusionHDTV"
U	FusionRemote	FusionRc.exe	"Remote control manager for DVICO FusionHDTV"
N	FusionTrayAgent	FusionHdtvTray.exe	"FusionTrayAgent - main executable for DVICO FusionHDTV software. It adds an icon to system tray that allows you to easily access Fusion HDTV software"
X	Fwr Command Module	fwr.exe	"Added by the SDBOT-PP WORM!"
X	gabougool	nounina.exe	"Added by the AGENT-JVX TROJAN!"
N	Gadu-Gadu	gg.exe	Polish language Instant Messaging client
X	GAELICUM.EXE	GAELICUM.EXE	"Added by the PENTA-A TROJAN!"
N	Game Device	JOYUPDRV.EXE	Genius game controller profile activator
X	Game House	GameHouse.exe	"Added by the DELF-DRA WORM!"
X	Games toolbar	rundll32.exe [path] tbGame.dll DllShowTB	"Topconverting.com/180Search ""Games Toolbar"" adware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
U	gameutil.exe	gameutil.exe	Part of Redline RegTweak as supplied with Sapphire ATI graphics cards. You can configure different overlclocking settings on a per game basis and this sets those conditions following a re-boot
U	GARO Status Monitor	cnwism.exe	Print monitor for certain Canon printers
X	Gddlib	"rundll32.exe gddlib.dll	start"
X	Gekio Startups	gnksvc32.exe	"Added by the AGOBOT.AFJ WORM!"
U	Gene USB Monitor	USBMonit.exe	Monitors USB ports for insertion of Sandisk USB flashdrives
X	General Antivirus	GenAvir.exe	"General Antivirus rogue security software - not recommended
X	Generic Host Process2 System Backup	scvhost2.exe	"Added by the RBOT-BAH WORM!"
X	Generic Host Process326a System Backup	scvhost326a.exe	"Added by a variant of the SDBOT WORM!"
Y	Genie USB Monitor	USBmonitor.exe	Port monitor for an external USB hard drive. Required to enable access to the drive
X	Genius Mose Driver	svghost.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Geography TX 1.0 NT	CompuSpeed.vbs	"Added by the NEWLEY-A WORM!"
X	Gerenciamento de arquivos do Windows	Winmod32.exe	"Added by the DLOADER-WG TROJAN!"
X	Gestionnaire de disques universel	sysoobe.exe	"Added by the TOADER-A TROJAN!"
X	GetitAll	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	GetModule18	GetModule18.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule19	GetModule19.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule20	GetModule20.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule21	GetModule21.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule23	GetModule23.exe	"Internet Speed Monitor adware related"
X	GetModule24	GetModule24.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule25	GetModule25.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule27	GetModule27.exe	"Internet Speed Monitor adware related"
X	GetModule29	GetModule29.exe	"Internet Speed Monitor adware related - see example here"
X	GetModule30	GetModule30.exe	"Internet Speed Monitor adware related"
X	GetMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	GetTheMusic	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	gfxtray	"rundll32 ctccw32.dll	findwnd"
X	Ghost Antivirus	GhostAV.exe	"Ghost Antivirus rogue security software - not recommended
U	GhostSecuritySuite	gss.exe	"Ghost Security Suite - protect the registry from unauthorized reading and modification and other tools"
Y	GhostSurfDelSatellite	DeleteSatellite.exe	"Part of SpyCatcher spyware remover from Tenebril. Prevents rogue programs from sending personal information to a remote user via the Internet. If you use SpyCatcher with real time scanning
Y	Gilat SOM Enumerator	dllhost.exe	For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system
X	Global Startup	WinDash.EXE	"Detected by Kaspersky as the VB.Q WORM!"
X	Glock Suite 1.1	glock32.exe	"Added by the TINY.GV TROJAN!"
?	gluon	gluon.exe	"In a gluon/bin sub-directory"
Y	Gmouse	Gmouse.exe	Amouse mouse driver - required if you use non-standard Windows driver features
U	Gnetmous	gnetmous.exe	"Genius mouse driver - required if you use non-standard Windows driver features"
U	GNETMOUSE	gnetmouse.exe	"Genius mouse driver - required if you use non-standard Windows driver features"
?	gnub	gnub.exe	"??"
U	GoBack	GBMenu.exe	"Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
X	Golum	services.exe	"Added by the GOLUM.A TROJAN! Note - this is not the legitimate services.exe process
X	golumm	services.exe	"Added by the DLOADER-ET TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""golumm"" subfolder"
U	Google IME Autoupdater	GooglePinyinDaemon.exe	"Google Pinyin Input Method Editor (IME) - allows a user to input Chinese characters by entering the pinyin of a Chinese character (with or without tone
U	Google Quick Search Box	GoogleQuickSearchBox.exe	"Part of Google Toolbar (from version 6 onwards) for IE. The Quick Search Box sits between the ""Start"" button and Quick Launch toolbar and ""lets you easily search both your computer and the Web from a slick-looking search box that comes up only when you need it"""
X	Google service	Googlesetup.exe	"Added by the IRCBOT-RJ WORM!"
N	Google Update	GoogleUpdate.exe	"Update manager for the range of tools available from Google - such as the Chrome web browser and Picasa photo manager. Located in %AppData%\Google\Update"
X	Google Update	GoogleUpdate.exe	"Added by the BUZUS.DBFM TROJAN! Note - this is not the valid Google program which is normally located in %AppData%\Google\Update. This version resides in %System%"
N	Google Updater	GOOGLE~1.EXE	"Downloads and installs updates for Google applications (Google Earth
N	Google Updater	GoogleUpdater.exe	"Downloads and installs updates for Google applications (Google Earth
U	GoogleQuickSearchBox	GoogleQuickSearchBox.exe	"Part of Google Toolbar (from version 6 onwards) for IE. The Quick Search Box sits between the ""Start"" button and Quick Launch toolbar and ""lets you easily search both your computer and the Web from a slick-looking search box that comes up only when you need it"""
X	GoogleUpdater3	GoogleMapper.exe	"Added by the ROUTROBOT WORM!"
X	gotnewupdate000.exe	gotnewupdate000.exe	"Added by the FAKEAV-BGA TROJAN!"
U	GoTrusted	GoTrusted Secure Tunnel.exe	"""GoTrusted is the fast
X	gouday.exe	readme.exe	"Added by the BEAGLE.C WORM!"
X	govurarope	"Rundll32.exe retasevo.dll	s"
X	GP Updater	gpupdater.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Graphic Update	openglx.exe	"Added by the IRCBOT.AMU WORM!"
X	Graphics	_default.pif	"Added by the AUTOSKY WORM!"
U	Gravis Xperience Driver Support	Grxp4exe.exe	"Driver for Gravis game controllers such as the Eliminator Aftershock. Must be loaded if you run the supplied application software for the controller to be recognized. Start it manually via a shortcut if not used"
X	GreasyPalmUpdate	GreasyPalmUpdate.exe	"SearchFast adware"
X	GreatDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
Y	Groove Virtual Office	Groove.exe	"""Groove Virtual Office uses a peer-to-peer networking model to connect users in Groove Workspaces. In these workspaces geographically dispersed coworkers can do almost everything they could do in the same office. They can hold online meetings
U	GrooveMonitor Utility	GrooveMonitor.exe	"Part of MS Office Groove - a stand-alone product or included with the Enterprise/Ultimate versions of MS Office 2007. ""A collaboration software program that helps teams work together dynamically and effectively
U	GroupWise PDA Connect - 3CmPlm	AutoDet.exe	"3Com Palm PC specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
U	GroupWise PDA Connect - GrpWse	Agnt.exe	"GroupWise PDA Connect PDA synchronisation utility - from Novell"
U	GroupWise PDA Connect - PocketPC	AUTODE~1.EXE	"Windows Mobile Pocket PC specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
U	GroupWise PDA Connect - ScheduleSync	SCHEDU~1.EXE	"ScheduleSync specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
?	GsiFinal	"rundll32 gspndll.dll	postInstall final"
?	GSISETUP	[path] GsiInst.exe INSTALL [path] V205Res 13	"BT Voyager ADSL modem related - what does it do and is it required?"
X	GStartup	GMT.exe	"Gator spyware component - see here. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	GT15J4R49V	cpuserv.exe	Identified as a variant of the Trojan.Win32.Radi.gu malware
U	Guard	Guard.exe	"Related to Phoenix Technologies Core Managed Environment (cME) Integration and Certification program"
X	Guard Pro	VH339.exe	"Guard Pro rogue security software - not recommended
X	GuardCenter	GuardCenter.exe	"GuardCenter rogue security software - not recommended"
Y	GuardGui Application	GuardGui.exe	"System Tray access to the main user interface for Ashampoo® AntiVirus from Ashampoo GmbH & Co. KG."
U	Guardian	CMGrdian.exe	"McAfee Guardian shortcut menu on the System Tray (looks like a castle) given access to Internet Security
U	Guardian PC Security Tools	Pfft.exe	"Boomerang Software's Guardian PC Security Tools - now rebranded as the eXtendia Security Suite"
X	GuardPcs.exe	GuardPcs.exe	"GuardPcs rogue security software - not recommended
X	GuardWWW	GuardWWW.exe	"GuardWWW rogue security software - not recommended
X	guarnset	guarnset.exe	"Adlogix adware"
X	gummy	gummy.exe	"Added by the VANEBOT-AQ WORM!"
X	GURL	gurl.exe	"GURLWatcher spyware"
U	GuruNet	GuruNet.exe	"GuruNet lets you click on any word on your screen to get the relevant information you want"
X	GustavVED	[filename].exe	"Added by the OPASERV.H WORM!"
X	gvagfxj	rundll32 ...gvagfxj.dll	"Unidentified adware
U	gwum	gwum.exe	"Gigabyte utility manager. Loads if you have a Gigabyte motherboard and got a full bundle of utilities installed. Monitors CPU
U	H2OWIBU	CXWibu.exe	"Related to CodeMeter from WIBU-SYSTEMS AG. Software protection hardware"
U	Habu	razerhid.exe	"Microsoft Habu (by Razer) gaming mouse driver - required if you use the additional features and programmed keys/macros"
X	hachimitsu-lemon	hachimitsu-lemon.exe	"Added by the HACHILEM TROJAN!"
X	HackMuFpt	HackMuFpt.exe	"Added by the SCLOG-AG TROJAN!"
U	HalifaxHowardCluster	skinkers.exe	"""Howard the Weatherman"" desktop client from Halifax by Skinkers - marketing/messaging tool. Leave enabled if you want to receive messages"
U	Handy Backup 3.9	hbagent.exe	"Handy Backup - automatic backup of your critical data to virtually any type of storage media including CD-RW devices and remote FTP servers"
X	HanUpdate	hanz.exe	"Added by the RBOT-GLJ WORM!"
X	HardDriveGuard	SysRep.exe	"HardDriveGuard rogue system error and cleaning utility - not recommended
X	HataDuzelticisi	SysRep.exe	"HataDuzelticisi
U	Hawking HWU54G Utility	HWU54G.exe	"Wireless management utility for the HWU54G Mini Wireless-G USB Adapter from Hawking Technologies
U	Hawking Wireless Utility	HWU8DD.exe	"Wireless management utility for the HWU8DD Hi-Gain™ USB Wireless-G Dish Adapter from Hawking Technologies
U	HControlUser	HControlUser.exe	Hotkeys on an ASUS Notebook. Only required if you use the additional keys
N	HD Audio Control Panel	RtHDVCpl.exe	"Realtek HD Audio Manager
N	HDAShCut	HDAShCut.exe	High definition audio page shortcut for Realtek audio devices - not required
U	HDAudDeck	HDAudioCPL.exe	"Vista control panel for VIA Vinyl HD Audio Codecs from VIA Technologies
U	HDAudDeck	HDeck.exe	"XP control panel for VIA Vinyl HD Audio Codecs from VIA Technologies
X	HDAudio	hda.exe	"Added by the TACTSLAY.U TROJAN!"
X	HDAudio Driver 1.0	[random filename].exe	"Added by the TEADOOR-D TROJAN!"
X	HDAudio Driver 2.0	[random filename].exe	"Added by the TEADOOR-E TROJAN!"
U	HDDControlGuard	HDDControlGuard.exe	"Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access"
U	HDDControlGuard.exe	HDDControlGuard.exe	"Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access"
X	he3bbcff	"rundll32.exe he3bbcff.dll	EnableRunDLL32"
X	he3e3fc4	"rundll32.exe he3e3fc4.dll	EnableRunDLL32"
X	Hekio Startups	Hnksvc32.exe	"Added by the AGOBOT-QE WORM!"
X	helper.dll	rundll32.exe [path] helper.dll	"CnsMin (Chinese Keywords) hijacker related. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
?	HerculesCamService	CamService.exe	"Related to the Hercules Dualpix HD Webcam. What does it do and is it required?"
X	hErcUnes	softhost.exe	"Added by the GARROCH WORM!"
X	HF Security	hfsecure.exe	"Added by the AGOBOT-TI WORM!"
X	hfdtubvnx	keepSafe.exe	"Added by the KILLAV.KAX TROJAN!"
X	hhtnsn	rnxntup.exe	"Added by a variant of the ORCU.B TROJAN!"
?	HiberMonitor	HCount.exe	"??"
X	HideRun.exe	Hiderun.exe and svhost.exe and pro.gif	"Added by the BOOHOO WORM!"
X	HideStyle	Ante Browse Trust.exe	"IE toolbar taking you to Lop.com. If the exe is running
X	Hidup_Susah	Pembantu.exe	"Added by the SILLYFDC.BDM WORM!"
U	High Definition Audio Property Page Shortcut	CHDAudPropShortcut.exe	"Realtek audio card related. Probably adds the odd feature to one of the ""Sounds"" Control Panel applet tabs - doesn't appear to be required"
N	High Definition Audio Property Page Shortcut	HDAShCut.exe	High definition audio page shortcut for Realtek audio devices - not required
U	High Definition Audio Property Page Shortcut	CHDAudPropShortcut.exe	"Realtek audio card related. Probably adds the odd feature to one of the ""Sounds"" Control Panel applet tabs - doesn't appear to be required"
X	Highspeeddownloader	SetupClickHere.EXE	"Homepage hijacker
U	HijackThis startup scan	HijackThis.exe	"""HijackThis is a free utility which quickly scans your Windows computer to find settings that may have been changed by spyware
X	HistoriaLout.	GDC.exe	"HistoriaLout. rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
U	Hitman Pro SurfRight Helper	srhelper.exe	"Hitman Pro - a utility to start a number of Security Protection software. They can be started individualy"
X	HKCU	server.exe	"Added by the AGENT-NLT TROJAN!"
X	HKEYok	runlli32.exe	"Added by the QQPASS-U TROJAN!"
X	HKLMRun	windowsupdate.exe	"Added by the FORBOT-BJ WORM (where HKLM\Run represents HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run)!"
X	HKLM\Run	svhost.exe	"Added by the FORBOT-AO BACKDOOR (where HKLM\\Run represents HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run)!"
X	HLcleanup	hlsetup2.exe	"LinkReplacer/FFinder adware"
X	HML PowerSource	hmlsvc32.exe	"Added by the SDBOT-XL WORM!"
X	HMV PowerSource	hmusvc32.exe	"Added by the SDBOT-YW WORM!"
X	hohohhaha	ournik.com	"Added by the IRCFLOOD.AL BACKDOOR!"
X	Home Antivirus 2010	HomeAntivirus2010.exe	"Home Antivirus 2010 rogue security software - not recommended
X	HomeAntivirus 2009	HomeAntivirus2009.exe	"HomeAntivirus 2009 rogue security software - not recommended
?	HomeCentre WakeUp	LGWAKEUP.EXE	"Associated with the no longer supported Xerox HomeCentre printer/scanner"
U	Hook99startup	hk2re.exe	""Hook99 enables the user to customize the start button. You can change or remove the text and replace the Windows flag on button with icon of your choice. Supports Windows icons
X	Hotfix Updat	svdhost32.exe	"Added by the GAOBOT.ZW WORM!"
X	hotplug	hotplug.exe	"Added by the SILLYDL TROJAN!"
U	Hotplug	hot_plug.exe	"Related to the SiS_Hot_Plug_Application. Enables automated driver loading for hotpluggable devices. If this service is stopped
X	Hot_Tarts_Au	Hot_Tarts_Au.exe	Premium rate adult content dialler
U	HP AutoIndexer	hppautoindexer.exe	"Installed by HP multi-function printer driver software
N	hp center UI	ShadowBar.exe	"User Interface for HP Center - see here"
U	HP Health Check Schedule	HPHC_Scheduler.exe	HP Health Check Scheduler from Hewlett-Packard
?	HP IDScheduler	HPIDSCHD.exe	"HP Instant Delivery Scheduler"
U	HP Instant Support	matcli.exe	""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	HP Internet Center	SURFBRD.EXE	Loads the HP Internet center surfboard on startup. HP Internet Center allows you to customize the multimedia keys on the fly without having to go the Control Panel --> Keyboards to change them
N	HP JetSpeed Autostart	AUTOSTART.EXE	Autostart executable for the old multiplayer game HP Jetspeed
?	HP OfficeJet Series xxx Startup	HPOSTR03.EXE	"xxx represents the series number - such as 700. What does it do and it it required?"
?	HP OfficeJet Series xxx Startup	HPOstr05.exe	"xxx represents the series number - such as 700. What does it do and it it required?"
N	HP ScanPicture	hpsplmwa.exe	HP multifunction scanner software. Available from HP Office Jet R Toolbox so not required
?	hp Silent Service	HpSrvUI.exe	"HP related"
N	HP software update	HPWuSchd2.exe	HP software updates. If a shortcut doesn't exist create your own and run it manually
N	HP software update	HPWuSchd.exe	"HP software updates. If a shortcut doesn't exist
N	HP Status	hpstatus.exe	HP Printer Status and Alerts
?	HP Status Server	hpboid.exe	"Copied during installation of HP Inkjet Printer Drivers in Win2K/XP. What does it do and is it required?"
X	HP Update Assistant	HPAware.exe	Added by the MRO TROJAN!
N	HP Updates	??	"On HP PCs
?	HP Visualize Init	HpVisIni.exe	"HP Visualize software related. What does it do and is it required?"
U	HPDJ Taskbar Utility	hpztsb01.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb02.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb04.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb05.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb07.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb09.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb06.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb08.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb03.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb10.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb11.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb12.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb13.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPGamesActiveMenu	ActiveMenu.exe	Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
N	HPHUPD04	hphupd04.exe	HP software update checker and wizard launcher. Available via Start -> Programs
N	HPHUPD05	hphupd05.exe	HP software update checker and wizard launcher. Available via Start -> Programs
N	HPHUPD06	hphupd06.exe	HP software update checker and wizard launcher. Available via the Start menu
N	HPHUPD07	hphupd07.exe	HP software update checker and wizard launcher. Available via Start -> Programs
N	HPHUPD08	hphupd08.exe	HP software update checker and wizard launcher. Available via Start -> Programs
?	hpjsiroute	hpjsira.exe	"Related to HP laserjet printers and IP addresses. An IP address is appended to the name field - ie "hpjsiroute192.168.1.2""
U	HPLaptopGamesActiveMenu	ActiveMenu.exe	Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
N	HPU	ProvenTactics.exe	"Proven Internet Marketing software"
X	HP_runner	front.exe	"Added by the SILLYFDC WORM!"
?	HsuGuiControl	HsuGuiControl.exe	"Part of the Starband Internet satellite client. What does it do and is it required?"
X	HTTP Tunneling Server	mstunnel.exe	"Added by the RBOT.EDL WORM!"
X	http://www.lienvandekelder.be	Lientjeuh.exe	"Added by the MYTOB-P WORM!"
X	httpd	s_menu.exe	"Added by the TACTSLAY.C TROJAN!"
U	HughesNet Tools	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
?	huhdir	huhdir.exe	"??"
X	huigezi	HgzServer.exe	"Added by the GRAYBIRD.C TROJAN!"
X	huigezi	SP00LSV.EXE	"Added by the GRAYBIRD.J BACKDOOR! Note the digit ""0"" in the command"
U	HWSetup	HWSetup.exe hwSetUP	"""Toshiba Hardware Setup is the Toshiba configuration management tool available through Windows."" Allows the user to change BIOS
X	HXIUL.EXE	HXIUL.EXE	"Attune HelpExpress - spyware. Disable and uninstall - see here"
X	I am not Ranky. I am eTunnel!	msyervice.exe	Added by an unidentified WORM or TROJAN!
X	I am not Ranky. I am eTunnel!	winsys.exe	Added by an unidentified WORM or TROJAN!
X	I am not Ranky. I am eTunnel!	disney.exe	Added by an unidentified WORM or TROJAN!
X	I just want to say I love Milko and I need a drink	svchost.exe	"Added by the CHIKO WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\Administrator\Local Settings\Application Data"
X	I-Worm.GiGu	uGiG.eXe	"Added by the GINK WORM!"
U	i8kfangui	i8kfangui.exe	Graphical interface for fan speed control
X	Iamnacho On Irc.MusIrc.com Is a Homosexual!	XBox64.exe	"Added by the RANDEX.Y WORM!"
Y	IBM Client Security	certtool.exe	"Part of Client Security Software for IBM\Lenovo notebooks. If you have configured the software via the associated wizard this will need to be running if you want to mount password protected areas of the disk (created with SafeGuard PrivateDisk)
N	IBM Client Security Software	csecwiz.exe	"Setup wizard for the Client Security Software for IBM\Lenovo notebooks. This entry only runs once
U	IBM ThinkPad EasyEject Support Application	EzEjMnAp.Exe	"EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
N	IBM ThinkPad EasyEject Tray Utility	EZEJTRAY.EXE	"System Tray access to the EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
N	IBM ThinkPad Tray Utility	TP98TRAY.EXE	"System Tray access to the ThinkPad Configuration utility for IBM/Lenovo ThinkPad notebooks. ""The ThinkPad Configuration utility is a control center to configure your ThinkPad hardware. With this utility
U	IBM ThinkPad Utility	NPDTray.exe	System Tray access to Presentation Director for IBM/Lenovo Thinkpad notebooks - which allows you to create and quickly select between various single and mulitple display options. Scheme selection and settings are also available via Fn+F7 key combination on some models
U	IBM TrackPoint Accessibility Features	tp4ex.exe	"Supports accessibility features for the TrackPoint stick and associated buttons on IBM/Lenovo ThinkPad notebooks. If features such as ""Click Sound""
U	IBMUltraBayHotSwapCPLLoader	IBMBAY2N.EXE	Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops
?	IBMUltraBayHotSwapSound	IBMBAYSN.EXE	"Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops. Is it needed though - does it just play a sound?"
U	IBWin Background process	IBackground.exe	"IBackup for Windows"
X	icdd7ee6	"rundll32.exe icdd7ee6.dll	EnableRunDLL32"
X	icddefff	"rundll32.exe icddefff.dll	EnableRunDLL32"
N	ICH Synth	eusexe.exe	"Sound related and can be disabled without affecting performance although advanced sound features may be sacrificed. May be related to Compaq PC's with "SoundMAX integrated Digital Audio" (Analog Devices Inc.) devices"
X	icifati	yujixit.exe	"Added by the SDBOT.ZZH WORM!"
N	ICQ Plus	vplus.exe	"ICQ Plus is a freeware utility makes your ICQ skinnable (change the look). Available via Start -> Programs"
X	IcqBeta	webcamupdate.exe	Added by an unidentified TROJAN!
X	icrosoft Visual	plscx.exe	"Added by the RBOT-AYO WORM!"
X	icrosoft Visual InterDevc	zvslmqb.exe	"Added by the RBOT-AYP WORM!"
X	icrosoft Windows DLL Services Configuration	poker3.exe	"Added by the SDBOT-AER WORM!"
U	ICSDCLT	"rundll32.exe Icsdclt.dll	ICSClient"
X	ICU-Sucker	Service32.exe	"Added by the ILLNOTIFIER.D TROJAN!"
U	IDriveE Startup	IDrvieEStartup.exe	"IDrive from Pro Softnet Corporation - free full featured online backup up to 2GB with the option of paying for more storage space and managing multiple accounts"
X	IE configure	explorer.exe	"Added by the LINEAGE-C TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually!"
X	IE Java Update	iejava.exe	"Added by the AGENT-HD TROJAN!"
X	IE Menu Extension toolbar	rundll32.exe [path] tbextn.dll DllShowTB	"Topconverting.com/180Search ""IEMenuExtension"" toolbar. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	IE Runtime	wini.exe	"Added by the PICRATE.B WORM!"
X	IE Runtimes	winis.exe	"Added by the RBOT-ADZ TROJAN!"
X	IE-Security	iescan.exe	"IE-Security rogue spyware remover - not recommended
X	IE-Security	wdscan.exe	"IE-Security rogue spyware remover - not recommended
X	IEACCESS	surfya.exe	"
X	IEAgent update check	iewatch.exe	"Added by the BOMKA TROJAN!"
U	IECleanAux	Ieboot6.exe	"IEClean by Kevin McAleavy - cookie manager
X	IEexplorer AUpdate	IEexplore32.exe	"Added by the RBOT-GRE WORM!"
X	IEFeatures	IEFeatures.exe	"Added by the POPMON.A TROJAN! - also known as PopMonster adware"
X	IEFeatures	Internetfeatures.exe	"Added by the POPMON.A TROJAN! - also known as PopMonster adware"
X	Iehelper	syslaunch.exe	Outwar adware downloader
X	iel2cde8	"rundll32.exe iel2cde8.dll	EnableRunDLL32"
X	ielcaabe	"rundll32.exe ielcaabe.dll	EnableRunDLL32"
X	iesetupi.exe	iesetupi.exe	"Added by a variant of the RBOT WORM!"
X	ieupdate	MCP**.exe [** = random char]	"Added by the ASOXY TROJAN!"
X	ieupdate	mcpdll32.exe	Adware downloader trojan
X	ieupdate	[random filename]	"Added by the AGENT-C BACKDOOR!"
X	ieupdates	ieupdates.exe	"Added by a number of TROJANS such as DWNLDR-HGI and AGENT-HGA and the Antivirus 2009 rogue security software - see here"
X	iExplore Ini	ie4uini.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	ifperx	xmliwvug.exe	"Added by the SLAPER.U TROJAN!"
X	igamatu	ekor.exe	"Added by the SDBOT.AQ TROJAN!"
X	igamatu	atecaca.exe	"Added by the IRCBOT.R WORM!"
X	IGuardPc.exe	IGuardPc.exe	"IGuardPc rogue security software - not recommended
X	iiuyvyu	uzcx.exe	"Added by the AGENT-EOF TROJAN!"
U	IJNetworkScanUtility	CNMNSUT.EXE	Network utility available for some Canon scanners and multifunction devices. Allows the device to see computers on a network and those computers running the utility to control scanning via the Control Panel on the scanner - which saves you having to run back and forth between the scanner and your computer
U	IKL	rundll32.exe [path] IKL.dll	"IKL surveillance software. Uninstall this software unless you put it there yourself"
X	Image	"rundll32 [path] [trojan filename]	Install"
U	ImageDrive-{hex numbers}	ImageDrive.exe	"Nero ImageDrive from Ahead - virtual CD/DVD drive software"
U	ImageTune	dthtml.exe	"ImageTune from Hyundai ImageQuest. Rebranded version of Display Tune from Portrait Displays
N	iMarkup Client	iUtil.exe	"Enables the iMarkup Client web page annotation utility to run in the background and be available in systray. Shortcut available via Start -> Programs"
X	imcssl	xmliwvug.exe	"Added by the SLAPER.U TROJAN!"
N	Imesh Auto Update	??	"Update check for the Imesh file sharing system. Turn the update off under ""options"""
U	Imonitor	Plguni.exe	"Part of McAfee's QuickClean - which removes internet clutter and unwanted programs. This entry monitor changes made to the registry so that they can be undone later using QuickClean - such as removing programs. QuickClean is now integrated into their Total Protection
U	IMVU	IMVUClient.exe	"IMVU chat client that allows you to create ""your own avatars who chat in animated 3D scenes"""
X	IMwire	imwireup.exe	"SafeSurfing adware variant"
X	imxecs	vbrun70sp4.exe	"Added by the AGOBOT.ALA WORM!"
X	im_autorn	im_1.exe	"Added by the IMAV.A WORM!"
X	im_autorn	im_2.exe	"Added by the BAGLEDL-BO TROJAN!"
U	IndicatorUty	IndicatorUty.exe	"Fujitsu Hotkey Utility displays icons on the screen when you use hotkeys on a Fujitsu Siemens Lifebook
X	InetChk	ms[random value].exe	"Added by the AGENT-IRL TROJAN!"
X	infamous.exe	wmplayer.exe	Added by unknown malware. WMPLAYER.EXE is stored in the location and uses the same name as Windows Media Player but that valid Windows program doesn't load at startup
X	InfoData	"rundll32.exe ********.dll	realset [* = random char]"
X	Information Update	iu.exe	"Detected by Kaspersky as the CENTIM.CH TROJAN!"
X	infus	infus.exe	Adult content dialler
U	Infuzer	Infuzer.exe	"Infuzer - ""is a service that copies dates from the web or an email straight to your electronic calendar"". Beware of the following adware trait - ""Infuzer provides web site owners with a unique opportunity to communicate with their visitors in a way that is useful and relevant to them
X	Install part II	updates.exe	"Added by the RELFEERWORM!"
N	InstallAurealDemos	InstallAurealDemos.js	Used to initialize the Aureal A3D demos InstallShield wizard
U	InstallBuddy	Ibtna.exe	"InstallBuddy - automatically translates and installs your desktop documents
?	InstallNAIProduct	SETUP.EXE	"Could be related to Network Associates Inc who own the McAfee VirusScan product amongst others. This was found in a directory called "VSC". Could it be an installation that failed and "SETUP.EXE" was left to run at startup as an error?"
U	Installstub	installstub.exe	"Tool for Outlook and Outlook Express from Plaxo for organising and keeping contacts organised and updated and providing online access to your contacts and access from PDA or mobile phone"
X	Instant Access	"rundll32.exe EGDHTML_1023.dll	InstantAccess"
X	Instant Access	"rundll32.exe eg_auth_****.dll	InstantAccess [**** = digits]"
X	Instant Access	"rundll32.exe EGCOMLIB_****.dll	InstantAccess [**** = digits]"
X	Instant Access	"rundll32.exe EGCOMSERVICE_****.dll	InstantAccess [**** = digits]"
X	Instant Access	"rundll32.exe p2esocks_****.dll	InstantAccess [**** = digits]"
X	Instant Buzz Daemon	IBDaemon.exe	"Instant Buzz adware"
N	Instant Update Center	reminder.exe	"Event reminder for calendar dates
U	Instant Wireless Configuration Utility	WUSB11cfg.exe	"Utility used by the LINKSYS LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
U	Instant Wireless Configuration Utility	WPC11Cfg.exe	"Utility used by the LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
X	InstantPleasure	instantpleasure.exe	Adult content dialler
X	InstantPleasureXXX	instantpleasurexxx.exe	Adult content dialler
?	InstUtlR.exe	InstUtlR.exe	"??"
X	InSysSecure	InSysSecure.exe	"InSysSecure rogue security software - not recommended
X	intdctrr	idctup20.exe	"SafeSurfing adware variant"
X	Intec Services Drivers	msupdate22e.exe	"Added by the RBOT-CGC WORM!"
X	Intel Audio Studio V2.0	fmideploy.exe	Detected by VBA32 as the BIFROSE.ADR TROJAN!
X	Intel Physical Routine 1.2A	stnetlib.exe	"Added by the BACKDR-AS BACKDOOR!"
U	Intel Product Number Utility	IntelProcNumUtility.exe	"Intel Processor Serial Number Control Utility allows you to enable and disable the processor serial number capability of an Intel PIII processor. You can find more information here. System Tray icon providing the user with a visual state indication. You can find more information here"
X	Intel system tool	hookdump.exe	"Added by the SPYRE-H TROJAN!"
U	Intel(R) Common User Interface	igfxtray.exe	"System Tray access to display settings for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
U	Intel(R) Common User Interface	hkcmd.exe	"Hot Key handler for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
U	Intel(R) Common User Interface	igfxpers.exe	"Installed with the graphics drivers for Intel desktop and mobile motherboard chipsets with integrated graphics. It's purpose or function isn't known at present but testing with it disabled would appear to indicate it isn't required - hence the recommended ""U"" status"
N	IntelAudioStudio	IntelAudioStudio.exe	"""Intel Audio Studio combines Intel® High Definition audio hardware features with Sonic Focus* Audio Refinement and Dolby* technologies to provide you with a comprehensive tool that puts you in control of your audio experience"". Audio utility supplied with some Intel motherboards"
X	Intelli Mouse Pro Version 2.0B	ncsjapi32.exe	"Added by the BUZUS-O WORM!"
X	Intelprc	Aas3lovu.exe	"Added by the SILLYFDC-CG WORM!"
U	IntelProcNumUtility	cpunumber.exe	"Intel Processor Serial Number Control Utility allows you to enable and disable the processor serial number capability of an Intel PIII processor. You can find more information here. System Tray icon providing the user with a visual state indication. You can find more information here"
X	Internal	regedit.exe /s c[month number]	"Added by the FORTNIGHT.D TROJAN! Note that the Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file ""c[month number]"" is located in %Windir%
X	Internet	recruit.exe	"Added by the RBOT-AJG WORM!"
X	Internet	nteusodp.exe	"Added by the RBOT-GFJ WORM!"
X	Internet Antivirus	IAvir.exe	"Internet Antivirus rogue security software - not recommended
X	Internet Antivirus Pro	IAPro.exe	"Internet Antivirus Pro rogue security software - not recommended
X	Internet Content Publisher	ICP.EXE	"Added by the RBOT-UD WORM!"
X	Internet Exploere Services	urlmon32.dll.exe	"Added by the EVIAN.C WORM!"
X	Internet Explorer Auto-Update	updt32v5.exe	"Added by the SPYBOT-AB BACKDOOR!"
X	Internet Explorer Configuration	IEXPLORE.EXE	"Added by the SDBOT-UL WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Internet Explorer Security	iexplore.pif	"Added by the RBOT-ALQ WORM!"
X	Internet Explorer Updater	lexbac.exe	"Added by the DOWNLOAD TROJAN!"
X	Internet Explorer Updater	iexplorer.exe	"Added by the REUR.B WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Internet Protocol Configuration Loader	ipcl32.exe	"Added by the SDBOT TROJAN!"
X	Internet Security 2010	IS2010.exe	"Internet Security 2010 rogue security software - not recommended
X	Internet Security Service	msq32.exe	"Added by the RBOT-GFP WORM!"
X	Internet Security Service	msq23.exe	"Added by the RBOT-GQL WORM!"
X	Internet Security Service	msql23.exe	"Added by the RBOT-GML WORM!"
X	Internet Security Service	mysqlwin32.exe	"Added by the RBOT.UX TROJAN!"
X	Internet Security Service	expllorer.exe	"Added by the REFROSO.AFF TROJAN!"
X	Internet Suspention	story.exe	"Added by the WOOTBOT.HV WORM!"
X	InternetGetConnectedState	winupdate.exe	"Added by the SDBOT-JN WORM!"
X	InternetGetConnectedStateEx	winupdate.exe	"Added by the SDBOT-JN WORM!"
U	InternodeUsage	mum.exe	Australian ISP's free monthly download meter
X	Inters Configuration Loader	RCL0ADERS.exe	"Added by the SDBOT-KX WORM!"
N	InterTrust Quick Start	it_cpq~1.exe	"InterTrust offers something known as Digital Rights Management to control legal software download and other E-commerce related business"
X	InterU	WINDRV.EXE	"Added by the IRCINTER.A TROJAN!"
N	Intervideo WinScheduler	WinScheduler.exe	"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
N	Intervideo WinScheduler	SchSvr.exe	"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
N	Introducing Media Manager	SPLASHA.EXE	"MS Media Manager tour. Not required"
N	Introduction-Registration	??	"For Compaq PC's. Should only run first time
X	IntruderAlert	ia99.exe	"Intruder Alert '99 from Bonzi - spyware"
Y	Intuit SyncManager	IntuitSyncManager.exe	"Synchronizes local Intuit Quickbooks data with online data - ""Use the Intuit Sync Manager to find the status of your latest QuickBooks data sync
Y	iolo AntiVirus	ioloAV.exe	"iolo AntiVirus"
N	iolo Utility Bar	SMUtilityBar.exe	"Iolo System Mechanic Utility Bar - can be launched manually"
U	ioloDelayModule	delay.exe	"Part of Iolo System Mechanic. Used to delay the start of an application which loads automatically as Windows loads"
U	Iomega Automatic Backup	ibackup.exe	"Iomega Automatic Backup - automatic backups for use with Iomega portable HDD"
U	Iomega Automatic Backup 1.0.1	ibackup.exe	"Iomega Automatic Backup - automatic backups for use with Iomega portable HDD"
N	Iomega Backup Scheduler	dtiom98.exe	"Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs"
?	Iomega QuickSync	Quicksync.exe	"??"
N	Iomega Startup Options	IMGSTART.EXE	"Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs"
X	ioroxxo microsoft sux	system32.exe	"Added by a variant of the RBOT WORM!"
X	IPLog Security	iplogsec.exe	"Added by the IRCBOT.GP BACKDOOR!"
?	iPlusAgent2	iAgent2.exe	"Related to iriver portable media products. What does it do and is it required?"
X	Ipnuker	Ipnuker.vbs	"Added by the INKER.B WORM!"
X	iPOD USB Driver	IPODUSB.EXE	"Added by a variant of the RBOT WORM!"
X	iPod USB Service	iPODService.exe	"Added by a variant of the RBOT WORM! Do not confuse with the Apple iPod process of the same name. The legitimate iPod file will always be located in the %ProgramFiles%\iPod\bin folder and is implemented as a system service
X	IPOT USB Service DRIVER	hpsebc087.exe	"Added by the SDBOT-WA WORM!"
X	IPOT USB Service DRV32	hpsebc08.exe	"Added by the SDBOT-WH WORM!"
U	iProtectYou	ip.exe	"iProtectYou - internet filtering/parental control and network monitoring software"
X	iprun	iPY.exe	"iProtectYou spyware"
X	IPSEC Configuration	wsupdate.exe	"Added by the AGOBOT-IQ WORM!"
X	IPTable Configuration	Winipcfgs.exe	"Added by a variant of the RBOT WORM!"
X	IPv6 STUN Service	netstun.exe	"Added by a variant of the SDBOT WORM!"
N	ipw	usbipw.exe	"Related to Internet Phone Wizard from Actiontec - Voice over IP (VoIP) that allows you to ""make and receive free Internet calls on your regular phone"" whilst ""at the same time
N	iRiS AntiVirus Active Monitor	WIMMUN32.exe	"Iris Antivirus - discontinued
U	iRiver AutoDB	MLService.exe	"Associated with the iRiver Music Manager"
N	iRiver Updater	Updater.exe	"Updates for the iRiver Music Manager - used with their digital music players"
X	iSecurity applet	"rundll32.exe iSecurity.cpl	SecurityMonitor"
X	ISMModule	ISMModule.exe	"Internet Speed Monitor C adware related - see example here"
X	ISMModule2	ISMModule2.exe	"Internet Speed Monitor C adware related - see example here"
X	ISMModule3	ISMModule3.exe	"Internet Speed Monitor C adware"
X	ISMModule4	ISMModule4.exe	"Internet Speed Monitor A adware related"
X	ISMModule6	ISMModule6.exe	"Internet Speed Monitor C adware related - see example here"
X	ISMModule7	ISMModule7.exe	"Internet Speed Monitor C adware related - see example here"
X	ISMModule8	ISMModule8.exe	"Internet Speed Monitor C adware related"
Y	ISP.COM High Speed	slipgui.exe	"User interface for Slipstream - internet acceleration through compression/decompression techniques
N	IsReminder	ISPopup.exe	"Related to GuardWare iShield - this is the registration reminder for the trial version
N	ISSI EZUpdate Service	issimsvc.exe	Part of IBM Global Services - used internally by IBM for automatic updating of software and Microsoft patching
X	ist service uninstall	[random filename]	"ISTBar adware related"
N	ISUSPM	ISUSPM.exe	"InstallShield is used by a number of software producers to install their programs and manage software updates. This entry searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis"
N	ISUSPM Startup	ISUSPM.exe	"InstallShield is used by a number of software producers to install their programs and manage software updates. This entry searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis"
N	ISUSScheduler	issch.exe	"InstallShield is used by a number of software producers to install their programs and manage software updates. This entry runs scheduled searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis"
X	ItalU	italfds.exe	"Added by a TROJAN - see here"
U	iTouch	iTouch.exe	"Loads the iTouch configuration settings for supported Logitech keyboards. It's required if your keyboard has shortcut buttons and you use them or have reconfigured them for different functions. It's also required if your keyboard does not have the num lock
N	ItsDeductiblePopUp	ItsDeductible.exe	"ItsDeductible from Income Dynamics. Calculates your noncash donations quickly and easily. This startup entry checks a registry entry for the next 'PopUp' date and if it is a past or current date displays a program related tip"
X	ITUNES	itune.exe	"Added by the RBOT-ZU WORM!"
X	ITUNES	itunes.exe	"Added by a variant of the RBOT WORM! Note - do not confuse with the legitimate Apple iTunes process with the same filename which is always located in %ProgramFiles%\iTunes. This one is located in %System%"
X	Itunes	dials.exe	"Detected by Kaspersky as the AGENT.MM TROJAN!"
X	Itunes	itunes.exe	"Added by the OSCABOT-L WORM! Note - do not confuse with the legitimate Apple iTunes process with the same filename which is always located in %ProgramFiles%\iTunes. This one is located in %Windir%"
Y	iTunes Helper	iTunesHelper.exe	Installed with Apple's iTunes for Windows. Uses ~3-4MB of memory and if disabled in MSCONFIG or deleted from the registry it will re-instate itself after running iTunes a few times - hence the reluctant Y recommendation
X	iTunes Music	iTunesHelper32.exe	"Added by the SDBOT.CHK WORM!"
X	iTunesAgent	ita.exe	"Added by the TACTSLAY.U TROJAN!"
X	itunesff	itunesff.exe	"Added by the EB adult premium dialer"
Y	iTunesHelper	iTunesHelper.exe	Installed with Apple's iTunes for Windows. Uses ~3-4MB of memory and if disabled in MSCONFIG or deleted from the registry it will re-instate itself after running iTunes a few times - hence the reluctant Y recommendation
N	Iusage	netdet.exe	"Internet Usage Monitor - utility to calculate the cost and time on the internet via dial-up"
X	iut75	uzcx.exe	"Added by the DLOADER-AXV TROJAN!"
X	iyelejiv	yujixit.exe	"Added by the SDBOT.BJK WORM!"
X	ϵͳע��	zhuruqi.exe	"Added by the QHOST.V TROJAN!"
N	j2 Tray Menu	HotTray.exe	"eFax Messenger Tray Menu system tray icon for eFax Messenger Plus. Available via Start -> Programs. Disabling instructions available here"
X	JA Cfg Util v2	jacfg2.exe	"Added by the RBOT-AL WORM!"
X	Java applet	javaup.exe	"Added by the SDBOT-ACF WORM!"
X	Java Auto Update	ujm.exe	"Added by the SDBOT-ADH WORM!"
X	Java Runtime Environment	jbuild.exe	"Added by the DELBOT-J WORM!"
X	Java Runtime Value	runjava.exe	"Added by the RBOT-DDJ WORM!"
X	Java Runtimes	iexplore.exe	"Added by the KILLAV.B WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This file is located in a %Windir%\Java\Java folder"
X	Java update	javaqs.exe	"Added by the SWARLEY.A WORM!"
X	Java Update	keeper.exe	"Added by the AGENT-DIS TROJAN!"
X	Java Update	svchost.exe.exe	"Added by the AGENT-LBS TROJAN!"
X	Java Update	hostwww.exe.exe	"Added by the AGENT-MFH TROJAN!"
X	Java Virtual Machine	javaw.exe	"Added by a variant of the RBOT WORM!"
N	Java(TM) Platform SE 6	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
N	Java(TM) Platform SE 6 U*	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now. U* represents the update version
N	Java(TM) Platform SE Auto Updater 2 0	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
X	java-plugin	javasctp.exe	"Added by the VB.AMX TROJAN!"
X	Java32 Configuration Loader	msnmesgr.exe	"Added by a variant of the RBOT WORM!"
X	JavaScript Debugging Service	JsDbgMan.exe	"Added by the DERDERO.E WORM!"
X	JavaUpdate0.07	[filename]	"Added by the JUPDATE TROJAN!"
X	JavaUpdateSched	jusched32.exe	"Added by the BCKDR-CKB BACKDOOR!"
X	jete	yujixit.exe	"Added by the SDBOT.BRT WORM!"
X	jiahus	svchqs.exe	"Added by the WOWPWS-AL TROJAN!"
U	JMB36X Configure	JMRaidTool.exe	"JMB36x series RAID configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers"
Y	JMB36X Configure	JMRaidSetup.exe	"JMB36x series RAID configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers"
U	JMB36X IDE Setup	JMInsIDE.exe	"JMB36x series IDE (or Parallel ATA) configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers"
U	JMB36X IDE Setup	xInsIDE.exe	"JMB36x series IDE (or Parallel ATA) configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers. This is normally located in %Windir%\RaidTool"
X	jmudkve.dll	"rundll32.exe jmudkve.dll	mzrwkwf"
U	JOYTECH USB Neo S Controller	JoytechNeoSTrayIcon.exe	"System Tray access to Joytech Neo S PC gamepad controller software"
X	jpupd	jpupd.exe	"Added by the DIALER.CM TROJAN!"
X	jucheck	jucheck.exe	"Added by the SCRIMGE.O WORM!"
X	Jufualt	winxp2.exe	"Added by the SDBOT-AAB WORM!"
X	Jufualt	svhost.exe	"Added by the SDBOT-ADJ WORM!"
X	Jufualt	java2.exe	"Added by the SDBOT.AOE WORM!"
N	Juice	Juice.exe	"Juice - a free utility that ""allows you to select and download audio files from anywhere on the Internet to your desktop"". This entry is present if you choose the option to add it to the startup group during installation"
N	Juno_uoltray	exec.exe	Juno ISP software - not required
X	JuPo	jupos.exe	"Added by the SDBOT-CAG WORM!"
N	jusched	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
X	jusched	[path to trojan]	"Added by the BANKER-BWR TROJAN!"
X	jusched	jusched.exe	"Added by the BANKER-BOV TROJAN! Note that this is not the legitimate Sun Microsystems file (of the same name) which is usually located in %Program Files%\Java\version number\bin. This one is located in %System%"
X	jushed32.exe	jushed32.exe	"CoolWebSearch parasite variant - also detected as the BIZTEN-L TROJAN!"
X	jusodl	severe.exe	"Added by the QQPASS.48436 TROJAN!"
U	JussDropUtility	JussDrop.exe	"Related to DropShots Inc. A subscription based service for family to connect
N	JustVoip	JustVoip.exe	"JustVoip - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X	jutsu	jutsu.exe	"Added by the RBOT-LS WORM!"
U	jx_Key	"Rundll32 JXKey.dll	Rundll32Main"
X	K2ps_full.task	K2ps_full.exe	"Added by the JUNTADOR.K TROJAN!"
N	K6CPU.EXE	K6CPU.EXE	Authenticates CPU as K6 in system properties
U	Kalibump	Kalibump.exe	"Used with the now unsupported Kali software for on-line gaming. This is used to automatically bump up the priority of WinProxy to GREATLY improve game speed when using a SOCKS proxy"
X	Kasper Antivirus	KASPERANTIVIRUS.EXE	"Added by a variant of the SPYBOT WORM!"
Y	Kaspersky Anti-Virus Monitor	AvpM.exe	"Kaspersky Anti-Virus Lite - no longer available"
X	Kaspersky Antivirus	KasperskyAV.exe	"Added by a variant of the RBOT WORM!"
X	Kaspersky Email Security	javaupd.exe	"Added by the SWARLEY.A WORM!"
U	KatMouse	KatMouse.exe	"KatMouse - utility to enhance the functionality of mice with a scroll wheel
X	KavRuns	Windll.exe	"Added by the TRYNOMA TROJAN!"
X	KavSvc	*****.exe reg_run [ = random char]	"Added by the QOOLOGIC TROJAN!"
X	KAVutil	[worm filename]	"Added by the WINTOO.B WORM!"
X	Kazaa Download Accelerator Updater (required)	regsvr32 kdp***.dll [ = random char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	KAZAACuf	9	"Added by the KITRO.D (or ARGEN.A) WORM!"
X	kb	AUTO.txt	"Added by the BRONTOK-CV WORM!"
Y	KB926239	"rundll32.exe apphelp.dll	ShimFlushCache"
U	KBD	KbdStub.EXE	Key Watcher from HP - watches for Multimedia Keys on HP keyboards
U	KClient	kstatus.exe	KClient Kerberos client software for Win32 systems. It provides the libraries and utilities needed to use Kerberos-based PC applications developed by Computing Services such as KWeb and NiftyTelnet
X	Keenvalue	Keenvalue.exe	"KeenVal adware"
X	Kernal Fault Check	ntosrkl.exe	"Added by a variant of the SDBOT WORM!"
X	kernctl32	"rundll32 kctl32.dll	initialize"
X	Kernel	Update.exe	"Added by the DELF-FN TROJAN!"
X	Kernel Faults	ftphost.exe	"Added by the RBOT.BHU WORM!"
X	kernel32dll	guardpc.exe	"Added by the FORBOT-CU WORM!"
N	kernelfaultcheck	dumprep 0 -k	"Used in connection with memory dumps - you can disable these by - right clicking on My Computer
N	kernelfaultcheck	dumprep 0 -u	"Used in connection with memory dumps - you can disable these by - right clicking on My Computer
X	KernelFaultCheck	ptool32.exe	"Added by the LEGMIR-BN TROJAN!"
X	KernelFaultCheck	msime.exe	"Added by the TINY-P TROJAN!"
X	KernelFaultCheck	tell32.exe	"Added by the LEGMIR-BF TROJAN!"
X	KernelFaultCheck	winabc3.exe	"Added by the NUBYS-A VIRUS!"
X	KernelFaultCheck	winbin.exe	"Added by the DLOADR-AAX TROJAN!"
X	KernelFaultChk	sms.exe	"Added by the DEADHAT WORM! Do not confuse with the valid ""kernelfaultcheck"" which runs ""dumprep 0 -k"" or ""dumprep 0 -u"""
X	KernelRuntime	[path to worm]	"Added by the MYTOB-JO WORM!"
X	keyboard	keyboard.exe [ = number]	"Detected by Kaspersky as the VB.ZG TROJAN!"
N	Keyboard Customizer	TpKmapAp.exe	"Part of the Keyboard Customizer Utility for IBM/Lenovo Thinkpad notebooks. This is the main user interface for the utility but it doesn't normally seem to be running if enabled at startup. Also
?	Keyboard Status	KeyStat.exe	"Multimedia keyboard manager for Medion desktop and notebook PCs? Located in %ProgramFiles%\Medion\KeyStat"
X	keyboard_enum	keyboard_enum.exe	"Added by the BDOOR-GP BACKDOOR!"
X	keymgrldr	"rundll32 setupapi	InstallHinfSection... keymgr3.inf"
U	keyplusplus	startk.exe	"Key++ Invisible Spy Keylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	Kiamat Sudah Dekat_16_04	ISASS.exe	"Added by the PAHATIA.B WORM!"
U	Kill Popup	KillPopup.exe	"KillPopup - pop-up stopper"
X	KIT3	hpprintqueue.exe	"Added by the ADCLICK-DS TROJAN!"
X	KL AntiFunLove	flcss.exe	"Added by the FUNLOVE.4099 VIRUS!"
U	klp	run32dll.exe	"PAL PC Spy - key recorder and screen capture utility which controls and monitors everything that happens on your pc and online"
U	KM9801U	MMHotKey.exe	Multimedia key handling for the relevant type of Turbo-Media keyboard. Shortcut available. Note that with this running it can crash DirectX8/9 under WinXP when a game switches to full-screen
U	kmw_run.exe	kmw_run.exe	Kensington MouseWorks - mouse/trackball software. Not required unles you use any special features
X	KnowledgeBase GUI	wppewafaj.exe	"Added by the RBOT-GRZ WORM!"
N	Kodak Picture Easy . Batch Transfer	PezDownload.exe	"Part of ""Kodak Picture Easy"" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC. . represents the version"
N	Kodak Picture Transfer Software	pts.exe	Looks for Kodak camera connection and media insertion. Available via Start -> Programs
N	Kodak Software Updater	backweb*****.exe	"Software updater for Kodak Easyshare digital cameras"
N	KODAK Software Updater	Kodak Software Updater.exe	"Software updater for Kodak Easyshare digital cameras"
U	Komunikator	tlen.exe	"Tlen - a Polish language instant messaging client"
N	Konni Symbol Autostart	KonniSymbol.exe	"Gives configuration access to RagTime Solo professional business publishing software. RagTime Solo is the private user version of RagTime 5"
X	KTAX Auto Loader	ktax.exe	"Added by the SDBOT-MZ WORM!"
X	kviurs	kav.exe	"Added by the SILLYFDC.BBJ WORM!"
X	KvmSecure.exe	KvmSecure.exe	"KvmSecure rogue security software - not recommended
X	kw3eef76	"rundll32.exe kw3eef76.dll	EnableRunDLL32"
X	KYM Control Settings	phqghum.exe	"Added by the RBOT.BQD WORM!"
U	LaCie Backup	LaCieBackup.exe	"LaCie '1-Click' backup software for their range of mobile hard drives"
X	laltin	L90112201.Stub.exe	"Delfin Media Viewer adware related"
X	lanbrup	lanbrup.exe	"SafeSurfing adware"
U	LanguageMonitor	Oplmsb01.exe	OKI Printer language support monitor
?	LanguageShortcut	Language.exe	"Part of Cyberlink's PowerDVD prior to version 8. Language settings?"
X	LanGuard	languard.exe	"Adware downloader - also detected as the SECONDT-C TROJAN!"
X	LanGuard	[path to trojan]	"Added by the DLOADER-VO TROJAN!"
?	LanzarL2007	[path] setup.exe	"??"
U	Laplink PDASync 3.1 - PocketPC	AUTODE~1.EXE	"Laplink PDASync for Windows Mobile Pocket PC - PDA synchronisation utility"
U	Laplink PDASync 3.1 - ScheduleSync	ScheduleSync.exe	"Laplink PDASync for ScheduleSync - PDA synchronisation utility"
U	LapLink scheduler	Llsched.exe	Utility that automatically performs file transfers as unattended background operations
X	LARISSA ANTI VIRUS	LARISSA_ANTI_VIRUS.exe	"Added by the KLASSIR TROJAN!"
U	LaunApp	LaunApp.exe	Part of Acer Launch Manager - programmable keys on such laptops as the TravelMate 610
?	Launcg	launcg.exe	"??"
U	Launch Ai Booster	OverClk.exe	"Included with some ASUS motherboards (such as the Maximus Extreme & Striker II Extreme)
N	Launch Application	LaunchApplication.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
N	Launch Context 5.0	Launch.exe	"Context - electronic dictionary"
U	Launch K9	K9.exe	"K9 by Robert Keir - ""an email filtering application that works in conjunction with your regular POP3 email program and automatically classifies incoming emails as spam (junk email) or non-spam without the need for maintaining dozens of rules or constant updates to be downloaded. It uses intelligent statistical analysis that can result in extremely high accuracy over time"""
Y	Launch LCDMon	LCDMon.exe	Part of the GamePanel Software for the Logitech G-Series of gaming keyboards. This the LCD control panel driver on models where it's included such as the G15 and G19
U	Launch LGDCore	LGDCore.exe	Part of the GamePanel Software for the Logitech G-Series of gaming keyboards. This is the keyboard driver and if it's disabled you will lose access to special features and programmed keys
?	Launch LgDeviceAgent	LgDevAgt.exe	"Part of the GamePanel Software for the Logitech G-Series of gaming keyboards. What does it do and is it required?"
U	Launch Manager	QtZgAcer.EXE	Acer Launch Manager - on Acer laptops it supports the dedicated multimedia buttons and allows users to configure their function. If the optional WLAN module and Bluetooth radio are installed the associated buttons can set their operating state
X	Launch Norton AntiVirus 2000	jorgf.exe	"Added by the RBOT-AUI WORM!"
U	Launch PC Probe II	Probe2.exe	"Included with some ASUS motherboards (such as the Maximus Extreme & Striker II Extreme)
N	Launch YahooPOPs! at Windows startup	YAHOOPOPS.EXE	"YahooPOPs - enables free POP3/SMTP access to Yahoo! Mail through a service on localhost that emulates the web interface. Available via Start -> Programs"
U	LaunchAp	LaunchAp.exe	"Programmable keys on Acer
Y	LaunchApp	Alaunch	"Part of Acer eRecovery - ""a powerful utility that does away with the need for recovery disks provided by the manufacturer
N	LaunchApplication	LaunchApplication.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
U	Launchboard	lnchbrd.exe	""LaunchBoard software from Darwin turns your keyboard into a remote control for the Internet and your computer! With LaunchBoard 2.0
X	Launcher	launcher.exe	Spyware component related to DownloadWare and found in %ProgramFiles%\KFH
N	Launcher	relaunch.exe	Audio Applications Launcher for the Philips Rythmic Edge soundcard (the Philips Rhythmic Edge is the same as the Thunderbird PCI soundcard - see TBtray). Available via Start -> Programs
U	Launcher	launcher.exe	"PC Angel recovery program from SoftThinks. Located in a ""SMINST"" sub-folder of the Windows or Winnt directory"
U	Launcher	Launcher.exe	"SpeedUpMyPC 2009 from Uniblue - which ""lets you monitor and control all your PC resources with easy
?	LaunchList	LaunchList2.exe	"Part of Pinnacle Studio video editing suite. What does it do and is it required?"
U	LaunchU3	LaunchU3.exe	"U3 LaunchPad system software for U3 smart flash drives. Provides password protected access to applications and personal settings installed and saved on a U3 enabled drive - allowing the user to effectively treat any Windows Vista/XP/2000 PC as though it's their own PC"
X	Layersecurity Servicemonitor	LSSMON.EXE	"Added by the BANKER.ZAQ TROJAN!"
X	Letum	[path to worm]	"Added by the LETUM.A WORM!"
U	Lexmark X125 Settings Utility	LEX125SU.exe	Settings utility for the Lexmark X125 printer
U	Lexmark X63 Button Manager	AcBtnMgr_X63.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X63 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	Lexmark X63 Button Monitor	ACMonitor_X63.exe	"Button monitor for the Lexmark X63 all-in-one multifunction printer/copier/scanner. Works in conjunction with the ""Lexmark Scan & Copy Control Program"" button manager whose filename is ""AcBtnMgr_X63.exe"""
U	Lexmark X73 Button Manager	AcBtnMgr_X73.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X73 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	Lexmark X73 Button Monitor	ACMonitor_X73.exe	"Button monitor for the Lexmark X73 all-in-one multifunction printer/copier/scanner. Works in conjunction with the ""Lexmark Scan & Copy Control Program"" button manager whose filename is ""AcBtnMgr_X73.exe"""
U	Lexmark X83 Button Manager	AcBtnMgr_X83.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X83 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	Lexmark X83 Button Monitor	ACMonitor_X83.exe	"Button monitor for the Lexmark X83 all-in-one multifunction printer/copier/scanner. Works in conjunction with the ""Lexmark Scan & Copy Control Program"" button manager whose filename is ""AcBtnMgr_X83.exe"""
U	Lexmark X84-X85 Button Manager	AcBtnMgr_X84-X85.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X84-X85 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	Lexmark X84-X85 Button Monitor	ACMonitor_X84-X85.exe	"Button monitor for the Lexmark X84-X85 all-in-one multifunction printer/copier/scanner. Works in conjunction with the ""Lexmark Scan & Copy Control Program"" button manager whose filename is ""AcBtnMgr_X84-X85.exe"""
U	LG Direct Media Button Service	LGDMEBTN.exe	"Supports the Direct Media button on LG Notebooks that support it - such as the S1 PRO EXPRESS DUAL. Pressing this button launches the application for watching movies or listening to music"
N	LG Intelligent Update	autoupdate.exe	"Automatic update utility for LG Notebooks"
U	LGODDFU	fwupdate.exe	Auto firmware update program for LG Electronics CD-ROM/DVD writer
N	lhttseng	"rundll32.exe ..lhttseng.inf	RemoveCabinet"
X	li-multi****	li-multi****.exe	Adult web-dialler - **** is random
X	li-thund****	li-thund****.exe	Adult web-dialler - **** is random
X	li01f948	"rundll32.exe li01f948.dll	EnableRunDLL32"
X	libtec	"rundll32.exe libtec.dll	start"
N	LicCrtl	runservice.exe	"Part of the eLicense Copy Protection scheme employed by some software and games. When this service is not running
U	LicCtrl	"rundll32.exe MMFS.DLL	Service"
X	Life FireWall Update1	FireWall-Update1.exe	"Added by the RBOT-ARS WORM!"
X	lify	yujixit.exe	"Added by a variant of the SDBOT WORM!"
N	LimeWire On Startup	LimeWire.exe	"LimeWire - Peer to Peer (P2P) file-sharing client. Note - as with all P2P sharing programs they are susceptible to various forms of malware"
U	Lingvo Launcher	Lvagent.exe	"ABBYY Lingvo Electronic Dictionaries"
U	LingvoTraining	Tutor.exe	"ABBYY Lingvo Electronic Dictionaries"
X	linkyuu	linkuyy.exe	"Added by the DLOADER.MC TROJAN!"
X	Linux	Linux.vbs	"Added by the LOVELETTER.AS VIRUS!"
U	LiquidView	lviewj.exe	"""Liquid View lets you increase the legibility of the Microsoft Windows interface regardless of your display's native resolution. The software lets you increase the size of items that are hard to read on your monitor"""
N	LIU	LIU.exe	"Logitech Internet Update. Used to update drivers/software for Logitech's Wingman
N	LIU	Rubicon.exe	"Logitech Internet Update. Used to update drivers/software for Logitech's Wingman
N	Live Menu	Dllcmd32.exe	"eFax Send button for eFax Messenger Plus. Available via Start -> Programs Disabling instructions available here"
?	live rdr	loadloud.exe	"??"
X	Live Security Suite	LiveSS.exe	"Live Security Suite rogue security software - not recommended
X	Live update monitor	srvany32.exe	"Added by the AGOBOT.AFM WORM!"
X	live update monitor	umxlu32.exe	"Added by the AGOBOT.ADK WORM!"
U	LiveUpdate	LiveUpdate.exe	"Web-update utility as used by various types of software - see here"
X	LiveUpdate	[Windows username]05.exe	"Added by the LINEAGE TROJAN!"
X	LiveUpdate	smss.exe	"Added by the VB.BAU BACKDOOR! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\isas"
N	LiveUpdate	Copyer.exe	"Samsung PC Studio is a Windows-based PC program package that you can use easily to manage personal data and multimedia files by connecting a Samsung Electronics Mobile phone (GSM/GPRS/UMTS) to your PC. You can launch the update manually - see the instructions
X	LiveUpdate32	services.exe	"Added by the VB.BAU BACKDOOR! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\isas"
X	Ljx	rundll32.exe	"Added by the LINEAG-ABD TROJAN! Note - this is not the legitimate rundll32.exe process
?	LLMODCL2	"rundll.exe setupx.dll	InstallHinfSection ..LLMODCL2.INF"
N	LM Status	LMSTATUS.EXE	Xerox WorkCenter XE - language monitor status application
N	LMSTATUS	LMSTATUS.EXE	Xerox WorkCenter XE - language monitor status application
X	lmu	LMU.exe	"Detected by Kaspersky as the AGENT.BG TROJAN!"
X	lnternet Update	lExplore.exe	"Added by the RBOT-GRH WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	load	rundll32.exe	"Added by the WOWCRAFT TROJAN!"
X	load	rundl132.exe	"Added by the LOOKED-CK WORM!"
X	Load-Guard	Wscript.exe LGuarg.exe.vbs	"Added by the YENO.B and YENO.C WORMS! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""LGuarg.exe.vbs"" file is located in %Windir%"
X	LoadDBackUp	BcTool.exe	"Added by the GIBE WORM!"
U	LoadFujitsuQuickTouch	QuickTouch.exe	Maps the keys on a Fujitsu Siemens Lifebook application panel to various programs and functions
X	LoadGolfCourses	LoadGolfCourses.exe	PlayMiniGolf.com foistware - stealth installed!
X	Loadhg	rundll32.exe	"Added by the LINEAG-ABX TROJAN!"
X	LoadHTML	"rundll32.exe regsvr32.exe	MShtmpre"
X	loadMecq3	rundll32.exe	"Added by the LEGMIR-AS TROJAN! Note - this is not the legitimate rundll32.exe process
X	loadMefs	rundll32.exe	"Added by the LEGMIR-JB TROJAN! Note - this is not the legitimate rundll32.exe process
U	Loadout Manager	nost_LM.exe	"Manager for the Belkin Nostromo n50 SpeedPad game controller - see here"
U	LoadPowerProfile	Rundll32.exe powrprof.dll	"Power management specifics such as monitor shut-off
X	LoadPowerProfile	Rundll.exe powerprof.dll	"Added by the LOXOSCAM TROJAN! Note - do not confuse with the valid LoadPowerProfile entry! Notice that the infected version uses ""Rundll.exe"" whereas the uninfected version uses ""Rundll32.exe"""
X	LoadPowerProfile	rundl.exe	"Added by the TOFAZZOL TROJAN! Not to be confused with the valid LoadPowerProfile entry where the command is Rundll32.exe powrprof.dll"
X	LoadPowerProfile	Rundll32.exe	"Added by the MIROOT WORM! Note - do not confuse with the valid LoadPowerProfile entry which has ""powrprof.dll"" appended to the command/data line"
X	LoadPowerScheme	rundll32.exe powerprof.dll CheckPowerProfile	"Ulubione adult content dialer. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	loads.exe	suploads.exe	"Added by the AGENT-BZ TROJAN!"
X	LoadService	Virus	"Added by the CAGER.A WORM!"
X	LoadSIPS	"rundll32.exe SIPSPI32.dll	SIPSPI32"
X	Local Authority Service	lsass.exe	"Added by the MARKTMAN-C TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	LOCAL INTERNET WEB DRIVERS FOR WIN32	phqghume.exe	"Added by a variant of the RBOT WORM!"
X	Local Page	http://find.naupoint.com	"Naupoint browser hijacker"
X	Local runole service	srvc32.exe	"Added by the SMALL-DP TROJAN!"
X	Local Security Authority Servce	lssas.exe	"Added by the POEBOT-T WORM!"
X	Local Security Authority Service	lssas.exe	"Added by the POEBOT-J WORM!"
X	Local Security Authority Service	Isass.exe	"Added by the LINKBOT.M WORM!"
X	Local-Settings-of-[User Name]	[User Name].exe	"Added by the GAVGENT.A WORM!"
X	loginui32	loginui32.exe	"Added by the LONGNU.A TROJAN!"
Y	Logitech	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
N	Logitech . Product Registration	eReg.exe	"Registration reminder from Leader Technologies for Logitech software such as SetPoint for their range of wired and wireless keyboards and pointing devices (mice
X	Logitech Camera	Soundcane.exe	"Added by the SDBOT.MUC WORM!"
N	Logitech Desktop Messenger	setup-8876480.exe	"Installer for Logitech Desktop Messenger included with older versions of the software for Logitech products - which automatically checks for software upgrades and new products
U	Logitech ImageStudio	ISStart.exe	"Installed with Logitech's ImageStudio webcam software. The exact purpose of this startup entry is unknown at present
U	Logitech ImageStudio	LogiTray.exe	"System Tray access to ImageStudio
U	Logitech ImageStudio	LVCOMS.EXE	Entry added when you install Logitech ImageStudio webcam software. It allows the camera to be accessed by both the Logitech software and (amongst others) NetMeeting and Windows Movie Maker. If you don't use the camera on a daily basis create your own shortcut and run it manually when required
U	Logitech QuickCam	CameraAssistant.exe	"Entry added when you install versions of the Logitech QuickCam webcam software and used to configure and tweak your webcam settings. Includes support for the Quick Assistant - which launches when a video application (such as video conferencing in an instant messaging client) accesses to camera so you can quickly fine tune face tracking and zoom
U	Logitech QuickCam	ISStart.exe	"Installed with older versions of Logitech's QuickCam webcam software. The exact purpose of this startup entry is unknown at present
U	Logitech QuickCam	LogiTray.exe	"System Tray access to My Logitech Pictures
U	Logitech QuickCam	LVCOMS.EXE	Entry added when you install older versions of Logitech QuickCam webcam software. It allows the camera to be accessed by both the Logitech software and (amongst others) NetMeeting and Windows Movie Maker. If you don't use the camera on a daily basis create your own shortcut and run it manually when required
U	Logitech QuickCam	LVComSX.exe	Entry added when you install versions of the Logitech QuickCam webcam software - allows the full camera features (such as face tracking) to be accessed by both the Logitech software and (amongst others) NetMeeting and Windows Movie Maker. If you don't use the camera on a daily basis create your own shortcut and run it manually when required
N	Logitech QuickCam	ManifestEngine.exe	"Automatic updater for versions of Logitech QuickCam webcam software. Check for updates via the System Tray icon - see the LogitechVideoTray entry"
U	Logitech Utility	Logi_MwX.exe	"Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as ""SmartMove"". If you disable it and find you don't need it leave it disabled"
N	Logitech Wakeup	lgwakeup.exe	Loads at startup and monitors the scanner. When a document is inserted in the scanner the wakeup program feeds the document a fraction of a inch into the scanner and then it launches the control center software. From the control center you can select whether to fax or copy or print the scanned documents. If you uncheck the Logitech wakeup software from the startup it no longer launches the control center or feeds the document a fraction of an inch. You can manually launch the control center software via Start ->Programs and still be able to scan images
Y	LogitechCommunicationsManager	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
U	LogitechImageStudioTray	LogiTray.exe	"System Tray access to ImageStudio
N	LogitechQuickCamRibbon	QuickCam10.exe	"Loads versions of the Logitech QuickCam webcam software and is required to support features such as face tracking. If enabled
N	LogitechQuickCamRibbon	LWS.exe	"Loads versions of the Logitech Webcam Software and is required to support features such as face tracking. If enabled
N	LogitechQuickCamRibbon	Quickcam.exe	"Loads versions of the Logitech QuickCam webcam software and is required to support features such as face tracking. If enabled
N	LogitechSoftwareUpdate	ManifestEngine.exe	"Automatic updater for versions of Logitech QuickCam webcam software. Check for updates via the System Tray icon - see the LogitechVideoTray entry"
U	LogMeIn GUI	LogMeInSystray.exe	"RemotelyAnywhere is a remote administration and remote control solution for Windows. It allows access to the host computer via the network (the LAN
U	LogMeIn GUI	ragui.exe	"RemotelyAnywhere is a remote administration and remote control solution for Windows. It allows access to the host computer via the network (the LAN
Y	Logoff	SCTUINotify.exe	"Part of Windows SteadyState
X	Logon	CSRSS.EXE	"Added by the BRONTOK-BH WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
U	LogonStudio	logonstudio.exe	"WinCustomize LogonStudio - "Allows Windows XP users to edit
X	logonUiInit	Rundll32.exe rgtndz.dll	"Identified as a variant of the Trojan-Clicker.Win32.Agent.bqy malware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""rgtndz.dll"" file is found in %System%"
X	Lookup_Sys	lookupsys.exe	P04n trojan
X	LosMejoresMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	LotsOfGames	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	LotsOfJokes	"rundll32.exe MSA64CHK.dll	DllMostrar"
N	Lotus Organizer EasyClip	easyclip.exe	""The Easy Clip icon automates the collection of information from sources such as e-mail to create an Organizer address
N	Lotus QuickStart	smartctr.exe	"Lotus central application
U	Lotus SuiteStart	suitest.exe	Puts the individual Lotus components in the system tray taskbar when you start Windows. Can be disabled via MSCONFIG -> Startup as "Lotus SuiteStart 97 Edition". All individual components available via Start -> Programs
X	LotusHlp	LotusHlp.exe	"Added by the WINKO.AO WORM!"
X	LowRiskFileTypes	sysguard.exe	"Added by the FAKEAV-UY TROJAN!"
X	LowVersionSupport	[filename]	"Added by the LASTRAS TROJAN!"
X	LRBZ Utility 32	lrbz32.exe	"Added by the AGOBOT-JQ WORM!"
N	LS120 Superdisk	??	"Supposed to accelerate transfer rate on LS-120
X	LSA Shellu	lsass.exe	"Added by the AUTORUN-CW WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%"
X	LSASS Authority	lshosts32.exe	"Added by the SDBOT-UY TROJAN!"
X	LSASS Authority	lsvhosts.exe	"Added by the SDBOT.BCE WORM!"
X	lsass2k Update	lsass2k.exe	"Added by a variant of the RBOT WORM!"
Y	lsburnwatcher	lsburnwatcher.exe	"HP software which helps one create labels after a music CD is burned using LightScribe discs. If you want to use LightScribe labeling
Y	LSBWatcher	lsburnwatcher.exe	"HP software which helps one create labels after a music CD is burned using LightScribe discs. If you want to use LightScribe labeling
X	Lssas Monitoring Startup	LSSAS.EXE	"Added by the RBOT.XJ WORM!"
X	LTM2	winupdate.exe	"Added by the LITMUS.203 TROJAN!"
X	LTM2	RundlI.exe	"Added by the MULTIDRP.BG TROJAN!"
X	ltssvc	"rundll32.exe ltssvc.dll	start"
X	LTT2	rundll32.exe	"Added by the LINEAGE-BI TROJAN!"
X	luacai	luacai.exe	"Added by the AUTOINF-AK WORM!"
Y	LUCENT TECHNOLOGIES ltmsg	ltmsg.exe	"Lucent Technologies (now Alcatel-Lucent) WinModem - which uses software rather than hardware
X	Lucky charms CD	mylcuky.exe	"Added by the SDBOT-SP WORM!"
U	LUGuard	LUGuard.exe	"PC-Duo Remote Control enables your help desk technicians to take instant control of any remote desktop PC at any location across the LAN
X	lup	lup.exe	"Added by the IRCBOT_GEN WORM!"
Y	Lusetup	LUSetup.exe	"Symantec LiveUpdate installer - required to install a new version of the application. Will only run once
U	LWBMOUSE	lwbwheel.exe	Mouse driver - required if you use non-standard Windows driver features
U	LWBMOUSE	MOUSE32A.EXE	Mouse utility for a Lenovo brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
N	Lwinst Run Profiler	lwtest.exe	Logitech Wingman Profiler for the Logitech joysticks. Available via Start -> Programs
X	lwjcjuti.exe	lwjcjuti.exe	"Added by the DWNLDR-GTQ TROJAN!"
Y	LXBSCATS	"rundll32 [path] LXBStime.dll	_RunDLLEntry@16"
Y	LXBTCATS	"rundll32 [path] LXBTtime.dll	_RunDLLEntry@16"
Y	LXBUCATS	"rundll32 [path] LXBUtime.dll	_RunDLLEntry@16"
U	lxbumon.exe	lxbumon.exe	Lexmark 6200 Series printer device monitor
Y	LXBXCATS	"rundll32 [path] LXBXtime.dll	_RunDLLEntry@16"
Y	LXBYCATS	"rundll32 [path] LXBYtime.dll	_RunDLLEntry@16"
Y	LXCCCATS	"rundll32 [path] LXCCtime.dll	_RunDLLEntry@16"
U	LXCDCATS	"rundll32 [path] LXCDtime.dll	_RunDLLEntry@16"
Y	LXCECATS	"rundll32 [path] LXCEtime.dll	_RunDLLEntry@16"
Y	LXCFCATS	"rundll32 [path] LXCFtime.dll	_RunDLLEntry@16"
Y	LXCGCATS	"rundll32 [path] LXCGtime.dll	_RunDLLEntry@16"
Y	LXCJCATS	"rundll32 [path] LXCJtime.dll	_RunDLLEntry@16"
Y	LXCQCATS	"rundll32 [path] LXCQtime.dll	_RunDLLEntry@16"
Y	LXCRCATS	"rundll32 [path] LXCRtime.dll	_RunDLLEntry@16"
Y	LXCTCATS	"rundll32 [path] LXCTtime.dll	_RunDLLEntry@16"
Y	LXCYCATS	"rundll32 [path] LXCYtime.dll	_RunDLLEntry@16"
Y	LXDBCATS	"rundll32 [path] LXDBtime.dll	_RunDLLEntry@16"
Y	LXDCCATS	"rundll32 [path] LXDCtime.dll	_RunDLLEntry@16"
Y	LXDDCATS	"rundll32 [path] LXDDtime.dll	_RunDLLEntry@16"
Y	LXDICATS	"rundll32 [path] LXDItime.dll	_RunDLLEntry@16"
U	LXDJCATS	"rundll32 [path] LXDJtime.dll	_RunDLLEntry@16"
N	LXSUPMON	LXSUPMON.EXE	"Lexmark printer related. The printer should work fine without it but what does it do?"
X	LzioMediaUpdater	LzioMediaUpdater.exe	"LZIO.com adware downloader"
N	M-Audio Delta Taskbar Icon	DeltTray.exe	M-Audio Delta Control Panel for M-Audio brand Delta series audio cards. System Tray access to audio settings - available through Control Panel
U	M-Audio MobilePre Control Panel Launcher	MPTask.exe	"Control Panel Launcher for MobilePre USB bus-powered preamp and audio interface from M-Audio"
U	M-Audio Taskbar Icon	DeltaIITray.exe	"System Tray access to the Delta Control Panel for the M-Audio Delta series of PCI audio cards"
X	M1cr0s0ft S3rcurity	systemconfig.exe	"Added by the RBOT.BKB WORM!"
X	M1cr0s0ft Upd4t4zS	update32.exe	"Added by the RBOT-MI WORM!"
X	M3Development_WhenUSave_Installer	M3Development_WhenUSave_Installer.exe	"WhenU.Save adware"
X	Mabochine Deybug Malnager	kdm.exe	"Added by the SDBOT-SD WORM!"
?	MacDrive7.0.4TimeOutPatch	TimeOutPatch.EXE	"Part of MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
X	Macfee Security Patch	Mpfsheild.exe	"Added by the RBOT-NP WORM!"
U	Machine Debug Manager	MDM.EXE	"Used by developers for debugging and is a component of several MS products including Office and Visual Studio. Those who have encountered it have unchecked it with no degradation in performance. It may cause your computer to ""hang"" if you have Visual Studio installed and this disabled because it appears to take over error handling - hence the U recommendation. For this entry it loads under the ""RunServices"" key in Me (located in C:\WINDOWS\SYSTEM). It also loads a service in XP/Vista (located in %ProgramFiles%\Common Files\Microsoft Shared\VS7Debug)"
X	Machine Debug Manager	msdn.exe	"Added by a variant of the RBOT WORM!"
X	Machine Debug Manager	mdm.exe	"Added by the SDBOT-APE WORM! Note - this is not the legitimate Machine Debug Manager (mdm.exe) process which is located in %ProgramFiles%\Common Files\Microsoft Shared\VS7Debug (98/Me/XP/Vista) or %System% (Me only). This one is located in %Windir%"
X	Machine Debug Manager	mdms.exe	"Added by the SDBOT-CH WORM!"
X	Machine Update Soft	wusas.exe	Added by an unidfentified WORM!
X	machine-debugger	WMIPRVSW.exe	"Added by the AGOBOT.WW WORM!"
X	machine-debugger	mdmsv.exe	"Added by the AGOBOT-BR WORM!"
X	Macromedia Critical Updater	rarww.exe	"Added by a variant of the RBOT WORM!"
X	Macromedia Flash Update	scvhost.exe	"Added by a variant of the RBOT WORM!"
N	Macrovision Update Service	issch.exe	"InstallShield is used by a number of software producers to install their programs and manage software updates. This entry runs scheduled searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis"
N	Macrovision Update Service	ISUSPM.exe	"InstallShield is used by a number of software producers to install their programs and manage software updates. This entry searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis"
N	MadExe	LaunchRA.exe	"Part of Dell Resolution Assistant - ""a diagnostic program that allows you to contact Dell. When factory-installed by Dell
N	MagicalUnInstall	MagicalUnInstall.exe	"Ashampoo® Magical UnInstall from Ashampoo GmbH & Co. KG - which monitors each new program installation
N	MagUninstall	MagicalUnInstall.exe	"Ashampoo® Magical UnInstall from Ashampoo GmbH & Co. KG - which monitors each new program installation
X	mahmud	mahmud.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
Y	MailScan Dispatcher	Launch.exe	"MicroWorld MailScan Dispatcher splits each e-mail message into various components such as the header
?	Main Executable (HP)	HP05T0R5.exe	"HP (Hewlett-Packard) related. Maybe related to printers. Now - what does it do?"
X	MainDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	main_module	drvmmx32.exe	"Added by the DILA TROJAN!"
X	Malware Cleaner	[random numbers].exe	"Malware Cleaner rogue security software - not recommended
X	Malware Destructor 2009	MD345d.exe	"Malware Destructor 2009 rogue security software - not recommended
X	MalwareBurn 6.9	MalwareBurn 6.9.exe	"MalwareBurn rogue security software - not recommended
X	MalwareBurn 7.0	MalwareBurn 7.0.exe	"MalwareBurn rogue security software - not recommended
X	MalwareBurn 7.1	MalwareBurn 7.1.exe	"MalwareBurn rogue security software - not recommended
X	MalwareBurn 7.2	MalwareBurn 7.2.exe	"MalwareBurn rogue security software - not recommended
X	MalwareBurn 7.3	MalwareBurn 7.3.exe	"MalwareBurn rogue security software - not recommended
Y	Malwarebytes' Anti-Malware	mbamgui.exe	"System tray access to and realtime protection agent for the registered version of MalwareBytes' Anti-Malware - which is ""considered to be the next step in the detection and removal of malware. In our product we have compiled a number of new technologies that are designed to quickly detect
Y	Malwarebytes' RogueRemover PRO	RogueRemoverPRO.exe	"Part of Malwarebytes' RogueRemover PRO - the realtime ""RogueMonitor will alert you before you download a rogue application keeping you safe and secure before trouble occurs."" Now discontinued and the funtionality is included in Malwarebytes' Anti-Malware"
X	MalwareCrush	MalwareCrush.exe	"MalwareCrush rogue security software - not recommended
Y	Mamutu	mamutu.exe	"Background Guard feature of Mamutu from Emsi Software GmbH - which provides behaviour rather than signature based protection that ""recognizes new and unknown Trojans
Y	Mamutu Guard	mamutu.exe	"Background Guard feature of Mamutu from Emsi Software GmbH - which provides behaviour rather than signature based protection that ""recognizes new and unknown Trojans
X	Mascro soft SDK updates2	SDKrepair2.exe	"Added by the SDBOT.BXM WORM!"
N	Mass storage check registry	"rundll32.exe MSDServ.dll	check registry"
X	Master Card Updaate 32	Mastercard32.exe	"Added by a variant of the RBOT WORM!"
U	Master Volume Spy	MASTERVOLUMESPY.EXE	"Volume control for the Gateway Destination ""DestiVu"" media interface"
X	MasterBoot Switch	popupkill.exe	"Added by a variant of the RBOT WORM!"
U	Matador	mlfbuddy.exe	"MailFrontier - anti-spam application"
N	Matrox QuickDesk	mgaqdesk.exe	For Matrox video cards. Quick access to tweak your card to your liking
X	MAV_check	mav_startupmon.exe	"Part of the WinAntiVirus Pro 2007 rogue security software - not recommended
X	mav_startupmon	mav_startupmon.exe	"Part of the WinAntiVirus Pro 2007 rogue security software - not recommended
U	MaxBackSchedule	maxbackservice.exe	Backup scheduler for the Maxtor (now Seagate) range of external hard drives - part of Maxtor Quick Start
Y	MaxtorCombo	ComboButton.exe	Required to be able to use the Maxtor OneTouch button on your external Maxtor harddrive. It is used to start up backup software (Retrospect)
U	MaxtorOneTouch	OneTouch.exe	"Maxtor OneTouch Hard Drives/OneTouch Family hard disk backup software"
U	MaxtorReg	AUTOREG.EXE	Part of SYSagent - small utility for retrieving all the hardware and software information required by anyone administering a machine and/or the network it's a part of
Y	mbamgui	mbamgui.exe	"System tray access to and realtime protection agent for the registered version of MalwareBytes' Anti-Malware - which is ""considered to be the next step in the detection and removal of malware. In our product we have compiled a number of new technologies that are designed to quickly detect
U	MBMon	"Rundll32 CTMBHA.DLL	MBMon"
X	mbssm32	monstu.exe	"Detected by AVG as the AGENT.CNM TROJAN - see here"
X	McAfee Antivirus	McAfeeAV.exe	"Added by a variant of the RBOT WORM!"
X	McAfee Antivirus 32	MCAFEEAV32.EXE	"Added by the SPYBOT-EH WORM!"
X	Mcafee Antivirus Monitoring System326	VSStatmn326.exe	"Added by a variant of the SDBOT WORM!"
X	Mcafee Antivirus Monitoring System32mn	VSStatmn32.exe	"Added by a variant of the RBOT WORM!"
X	McAfee Antivirus Protection	mcafeeAV.exe	"Added by a variant of the RBOT WORM!"
X	Mcafee Auto Protect	mcafeshield.exe	"Added by the RBOT-UH WORM!"
U	McAfee Backup	McAfeeDataBackup.exe	"McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
U	McAfee Backup and Restore	McAfeeDataBackup.exe	"McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
U	McAfee Data Backup	LogOnHook.exe	"Part of McAfee Data Backup (now Online Backup) - which ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection. The exact purpose of this entry is unknown at present but it unloads after startup"
U	McAfee Data Backup	McAfeeDataBackup.exe	"McAfee Data Backup (now Online Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
U	McAfee Guardian	CMGrdian.exe	"McAfee Guardian shortcut menu on the System Tray (looks like a castle) given access to Internet Security
U	McAfee Online Backup	MOBKstat.exe	"System Tray access to McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
U	McAfee Online Backup Status	MOBKstat.exe	"System Tray access to McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
X	McAfee Online virus Scanner	avp.exe	"Added by the RBOT-GCV WORM! Not to be confused with Kaspersky anti-virus and AOL's Active Virus Shield (by Kaspersky) - found in either a Kaspersky or AOL sub-directory"
X	McAfee Online Virus Scanner	nzm.exe	"Added by the IRCBOT.XV WORM!"
U	McAfee QuickClean Imonitor	Plguni.exe	"Part of McAfee's QuickClean - which removes internet clutter and unwanted programs. This entry monitor changes made to the registry so that they can be undone later using QuickClean - such as removing programs. QuickClean is now integrated into their Total Protection
Y	McAfee SecurityCenter	mcagent.exe	"McAfee SecurityCenter is the main support center for McAfee's range of internet security products such as Total Protection
Y	McAfee SecurityCenter	McUpdate.exe	Automatic virus definition and software updates/upgrades for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online
Y	McAfee VirusScan	mcmnhdlr.exe	"Part of older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online. When Windows boots it checks whether a virus scan is necessary before you do anything with your PC. Typically
Y	McAfee VirusScan	mcvsshld.exe	"ActiveShield - background scanner for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online which scans files in the background as and when they are accessed
Y	McAfee VirusScan	oasclnt.exe	"On-access real-time scanner for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online which scans files for malware as you access
X	Mcafee VirusScan Manager	mvcsvm.exe	"Added by the SILLYFDC.BBV TROJAN!"
N	McAfee Winguage	??	"Part of McAfee Nuts & Bolts. ""WinGuage is a dynamic reporting tool that constantly monitors your use of Windows and your applications
U	McAfee.InstantUpdate.Monitor	RuLaunch.exe	"Instant Updater for McAfee's VirusScan
U	McAfeeDataBackup	McAfeeDataBackup.exe	"McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
X	MCAFEEIPS	setup.exe	"Added by the WHITEWELL TROJAN!"
X	McAfeeScanPlus	McAfeeScanPlus.exe	"Added by the MEPCOD TROJAN! This trojan file does not belong to any McAfee Antivirus Software and is found in the Windows or Winnt folder"
Y	McAfeeUpdaterUI	UpdaterUI.exe	McAfee common updater user interface
Y	McAfeeUpdaterUI	UdaterUI.exe	Updater user interface for McAfee's VirusScan Enterprise corporate anti-virus and anti-spyware security tool
Y	McAfeeVirusScanService	Avsynmgr.exe	"From McAfee VirusScan version 5.x. Runs VirusScan System Tray (Vsstat.exe)
X	Mcaffe Antivirus	Mcafeescn.exe	"Added by a variant of the SPYBOT WORM!"
N	McENUI	McENUI.exe	"McAfee's EasyNetwork user interface - ""enables secure file sharing
U	MCI USB Icon	USBIcon.exe	MCI USB software used for managing a USB card reader
N	MCPLaunch	MCPLaunch.exe	"Launcher for Message Center Plus ""which alerts you when conditions arise on your computer that require your attention"" on IBM/Lenovo ThinkCentre desktops
X	Mcrosoftr Update	Mcrosoftr.exe	"Added by a variant of the RBOT WORM!"
Y	mcui_exe	mcagent.exe	"McAfee SecurityCenter is the main support center for McAfee's range of internet security products such as Total Protection
Y	McUpdate	McUpdate.exe	Automatic virus definition and software updates/upgrades for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online
Y	MCUpdateExe	McUpdate.exe	Automatic virus definition and software updates/upgrades for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online
X	MCX Update	wisp.exe	"Added by the RBOT-AQH WORM!"
X	MCX Updte	scorti.exe	"Added by the RBOT-ARP WORM!"
X	MD IE Plugin	md.exe	"Marketdart spyware"
X	MD IE Plugin	winy.exe	Adware
N	mdac_runonce	runonce.exe	Associated with MS Data Access Components (MDAC). Sometimes left over after installation - not required. NOTE :- don't delete "runonce.exe".
U	Media Codec Update Service	update.exe	"Windows Essentials Codec Pack 1.0 is a collection of the most commonly needed video and audio codecs. This program allows keeps these codecs updated"
U	Media Manager Indexer	AIRSVCU.EXE	"Part of MS Visual InterDev
X	Media Player Update	xpsp1mfh.exe	"Added by a variant of the RBOT WORM!"
X	Media Plug x.1.2	msdm.exe	Added by the MULDROP.352 VIRUS!
X	Media Software UPdater	sscs.exe	"Added by the RBOT-ABE WORM!"
U	MediaButtons	MediaButtons.exe	"Supports the eject button on the front on the Dell Studio Hybrid desktop. If disabled
U	Mediafour Mac Volume Notifications	MACVNTFY.EXE	"Part of MacDrive 6 CrossStripe Edition from Mediafour Corporation - ""a perfect way to share files between Mac OS and Windows."" Unlike the standard version of MacDrive 7
U	Mediafour MacDrive	MacDrive.exe	"MacDrive 7 & MacDrive 6 CrossStripe Edition from Mediafour Corporation - ""a perfect way to share files between Mac OS and Windows."" Version 6 is not Vista compatible but doesn ""include support for striped Mac arrays created with ATTO ExpressStripe software."""
U	Mediafour MacDrive	MDDiskProtect.exe	"Part of MacDrive 6 CrossStripe Edition from Mediafour Corporation - ""a perfect way to share files between Mac OS and Windows."" Unlike the standard version of MacDrive 7
U	Mediafour MacDrive	MDGetStarted.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
U	Mediafour XPlay Tray Notification Icon	Xptryicn.exe	"Mediafour Xplay - allows you to use an Apple iPod digital music player with a PC running Windows. If not used regularily start manually before connecting the iPod"
U	Mediafour XPlay Tray Notification Icon	Xptryicn.exe	"Xplay 2 from Mediafour Corporation - ""expands what you can do with any iPod
U	MediafourGettingStartedWithMacDrive6	MacDrive.exe	"MacDrive 6 CrossStripe Edition from Mediafour Corporation - ""a perfect way to share files between Mac OS and Windows."" Unlike the standard version of MacDrive 7
X	mediamotor.exe	mmups.exe	"Added by the AGENT-BY TROJAN!"
X	MediaPlayeS	MediaPlayer_update.exe	"Added by the STARTER-K TROJAN!"
X	mediapluscash.exe	mediapluscash.exe	"MediaGateway adware"
X	media_stub	stub.exe	"Mini-Player
X	Meeting Connection	comsutil.exe	"Added by the PPDOOR-E TROJAN!"
X	MegaVirusKit	pgs.exe	"MegaVirusKit rogue security software - not recommended. A member of the AVSystemCare family"
X	MemConfig	SetupIE.com	"Added by the TAPLAK WORM!"
X	memory	outlookrem.exe	"Added by the NOPIR.C WORM!"
U	MemoryZipperPlus	memzip.exe	"Memory Zipper Plus - ""optimizes the memory management of your system and boost-up its performance amazingly!"""
U	MemTurbo	memturbo.exe	"MemTurbo memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
X	MenaceSecure	pgs.exe	"MenaceSecure rogue security software - not recommended. A member of the AVSystemCare family"
N	MenuSnap	MenuSnap.exe	"MenuSnap from Rietta Solutions. Utility that re-orders your Start Menu items alphabetically. You may not want this utility if you're able to do this manually by selecting Start -> Programs and right-clicking and choosing "Sort by Name" if availabe"
N	Message Center Plus	MCPLaunch.exe	"Launcher for Message Center Plus ""which alerts you when conditions arise on your computer that require your attention"" on IBM/Lenovo ThinkCentre desktops
X	Message Queuing	msmqs.exe	"Added by the FREEFORS TROJAN!"
X	Messanger	s_menu.exe	"Added by the TACTSLAY.C TROJAN!"
X	Messenger	ntsubsys.exe	"Added by the SDBOT.BGE WORM!"
X	Messenger Service Updater	svshost.exe	"Added by the MYTOB.GC WORM!"
X	Messenger start-up	Msgran.exe	"Added by the GRAMOS WORM!"
N	MessengerPlus	MsgPlus.exe	"MessengerPlus - third party MSN Messenger extension that adds a number of useful features. Bundles the hard to remove C2Media LOP adware. The software does offer you a choice during setup - make sure to install MessengerPlus WITHOUT that ""sponsor program""!"
N	MessengerPlus2	MsgPlus.exe	"MessengerPlus - third party MSN Messenger extension that adds a number of useful features. Bundles the hard to remove C2Media LOP adware. The software does offer you a choice during setup - make sure to install MessengerPlus WITHOUT that ""sponsor program""!"
N	MessengerPlus3	MsgPlus.exe	"MessengerPlus - third party MSN Messenger extension that adds a number of useful features. Bundles the hard to remove C2Media LOP adware. The software does offer you a choice during setup - make sure to install MessengerPlus WITHOUT that ""sponsor program""!"
X	MeTaLRoCk (irc.musirc.com) has sex with printers	metalrock-is-gay.exe	"Added by the RANDEX.Q WORM!"
X	MeuPrograma	accwizz.exe	"Added by the RULAND.A WORM!"
X	mfhsornwnduy	regsvr32.exe gisyflngpshcvuakv.dll	"Pro AntiSpyware 2009 rogue spyware remover - not recommended
N	MGA Quickdesk	MGAQDESK.EXE	For Matrox video cards. Quick access to tweak your card to your liking
N	MGA_CD_Install	mgasetup.exe	Matrox Millennium video driver. Not required once drivers installed
X	Mickey Mouse Cereal	[random filename].exe	"Added by the RANKY.Q TROJAN!"
X	Micosoft Data Core	runservice.exe	"Added by the IRCBOT.BK WORM!"
X	Micosoft Data Core stuff	svshosts.exe	"Added by the RBOT.FZA WORM!"
X	Micosoft Startup	syscall.exe	"Added by the SDBOT-JI WORM!"
X	Micosoft Startup	systall.exe	"Added by the SDBOT-GM BACKDOOR!"
X	Micr Update	soundblaster.exe	"Added by the SDBOT.NP WORM!"
X	Micr Update System	upwin.exe	"Added by the SDBOT.YS WORM!"
X	Micr0s0ft Upd4t4z	svchost32.exe	"Added by the RBOT.ALF WORM!"
X	Micrcoft Updat	spoolsae.exe	"Added by the RBOT-AIB WORM!"
X	Micrcoft Updat	spoolsaex.exe	"Added by the RBOT-AJM WORM!"
X	Micrcoft Updat	Internet.exe	"Added by the RBOT-ANA WORM!"
X	Micro Update	dailin.exe	"Added by the RBOT-ER WORM!"
N	Microangelo Desktop	Muamgr.exe	"Using MicroAngelo On Display
N	microAttuneDownload	atmdlusr.exe	"Application Launcher
X	Microfot Update	winldx32.exe	"Added by a variant of the RBOT WORM!"
X	Microft Update 32	winssx.exe	"Added by the RBOT-AQS WORM!"
X	Micromedia Flash Update	wdfmrg.exe	"Added by a variant of the SDBOT WORM!"
X	Micromedia Flash Update	xptxt.exe	"Added by the RBOT-GAB WORM!"
X	Microoft Timing	pupdate.exe	"Added by a variant of the RBOT WORM!"
X	MICROSFT ANTIVIRUS UPDATE SUPPORT	[random 10-letter filename].EXE	"Added by the RBOT-AQA WORM!"
X	MICROSFT ANTIVIRUS UPDATE SUPPORT	MSGUPDATED.EXE	"Added by the RBOT-APZ WORM!"
X	Microsft Confige 32	msaconfigurez.exe	"Added by the RBOT.CLC WORM!"
X	MICROSFT MX UPDATE SUPPORT	taskmngrs.exe	"Added by the RBOT-AUZ WORM!"
X	MICROSFT MX UPDATE SUPPORT	winmx32.EXE	"Added by the IRCBOT-FD WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	[random filename]	"Added by the RBOT-ASM or RBOT-AUW WORMS!"
X	MICROSFT RAMA UPDATE SUPPORT	MSN32.EXE	"Added by the RBOT-AWJ WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	mtakthmyn.EXE	"Added by the RBOT-AUJ WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	MSGUPDAT32.EXE	"Added by the RBOT-BBB WORM!"
X	Microsft Remote Procedure Daemon	msrpcd.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsft Security Monitor Process	cmh.exe	"Added by the EGGDROP.V WORM!"
X	Microsft Security Monitor Process	mssmppp.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsft Security Monitor Process	mssmpp.exe	"Added by the SDBOT-DJW WORM!"
X	Microsft Updtes	sarvice.exe	"Added by a variant of the SDBOT WORM!"
X	Microsft Upgraed	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	microsft windows updates	mwupdate32.exe	"Added by a variant of the TOXBOT/CODBOT WORM!"
X	Microsof Value	nmatt.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft	wuauclt.exe	"Added by the QQROB-AAQ TROJAN! Note - this is not the legitimate wuauclt.exe process
X	Microsoft	guard.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft	MSUPDATE.exe	Added by an unidentified WORM or TROJAN!
X	Microsoft	updater.exe	"Added by the RBOT-GHP WORM!"
X	Microsoft	rundll.exe	"Added by the RBOT-GSJ WORM! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	Microsoft	WinSecUp.exe	"Added by the RBOT-GPL WORM!"
X	Microsoft	soundvol32.exe	"Added by the RBOT.CIJ BACKDOOR!"
X	Microsoft (R) Windows Configuration Backup Service	svchost.exe	"Added by the RANKY.X TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in either a ""config""
X	Microsoft (R) Windows DLL Loader	rundll32.exe	"Added by the RANKY.W TROJAN! Note - this is not the legitimate rundll32.exe process
X	Microsoft (R) Windows Network Security Management Service	nsms.exe	"Added by the RANKY.LC TROJAN!"
X	Microsoft (R) Windows Update Service	wuauclt.exe	"Added by a variant of the SDBOT WORM! Note - this is not the legitimate wuauclt.exe process
X	Microsoft (R) Windows Vista/NT Runtime Compatibility Service	nrcs.exe	"Added by the RANKY.X TROJAN!"
X	Microsoft .NET Confingurator	msnconf.exe	"Added by an unidentified VIRUS
X	Microsoft 16Bit Update	wuapdate16.exe	"Added by the RBOT.CZ WORM!"
X	Microsoft 64 Bit Runtime Updater	wupdt64.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft ActiveX Debugger NT	[path to trojan]	"Added by the BANCOS-DO TROJAN!"
N	Microsoft Announcement Listener	Annclist.exe	MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it
X	Microsoft Ansti Update	msie.exe	"Added by the RBOT-LE WORM!"
X	Microsoft Anti Virus Controller	msavc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Anti Virus Controller	msavc32.exe	"Added by the SDBOT.EPW BACKDOOR!"
X	Microsoft AUT Update	MSlti32.exe	"Added by the RBOT-X WORM!"
X	Microsoft AUT Update	MSlti16.exe	"Added by the RBOT.EB WORM!"
X	Microsoft Authority Service	lsass.exe	"Added by the KALEL-D WORM! Note - this is not the legitimate lsass.exe process
X	Microsoft auto update	winupdate.exe	"Added by the BMBOT TROJAN!"
X	Microsoft Auto Update	WINHLP16.EXE	"Added by the RBOT.GY WORM!"
X	Microsoft auto update	wuauclt.exe	"Added by the CULT-B TROJAN! Note - this is not the legitimate wuauclt.exe process
X	Microsoft Automatic Update Serivce	msautou.exe	"Added by the RBOT-AOB WORM!"
X	Microsoft Automatic Updater	Explorer.exe	"Added by the RBOT-SG WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft AutoUpdater	svhost.exe	"Added by the RBOT.QG WORM!"
X	Microsoft Bool Value	MV2.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Buffer App	msbuffer.exe	"Added by the SLINBOT.NQ BACKDOOR!"
X	Microsoft Calculator	calc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Client/Server Runtime Server Subsystem	csrs.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Client/Server Runtime Server Subsystem	csrssa.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft ConfgKeys	wurmgrd32.exe	"Added by the RBOT-ARX WORM!"
X	Microsoft Config Loader	msrun32.exe	"Added by the AGOBOT-DY WORM!"
X	Microsoft Configuewe	msconfiguwe.exe	"Added by the SDBOT-BPK WORM!"
X	Microsoft Configuration	msconfig32.exe	"Added by the SDBOT.MQ WORM!"
X	Microsoft Configuration 35	microsot1.exe	"Added by an unidentified TROJAN!"
X	Microsoft Configuration Wizard	taskmrg.exe	"Added by the SDBOT-MX TROJAN!"
X	Microsoft Configure 32	msgconfigre.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Core Support	MSxUP32.exe	"Added by the RBOT-ANR WORM!"
X	Microsoft Core Support	[random filename]	"Added by a variant of the RBOT TROJAN!"
X	Microsoft Corp TLS Certificates	msauth.exe	"Added by the RBOT-GAC WORM!"
X	Microsoft Corp Updates	wupdates.exe	"Added by the RBOT-AUU WORM!"
X	Microsoft CPU Over Heat Manager	CPU.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft DDE Control	wupades.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft DDEs Control	Erun.pif	"Added by the RBOT-AMU WORM!"
X	Microsoft Debug Manager Console	mdm32.exe	"Added by the AGOBOT-AQ WORM!"
X	Microsoft Debug Service	dbgbgr.exe	"Added by a variant of the RBOT WORM!"
U	Microsoft Default Manager	DefMgr.exe	"Part of MSN Toolbar from version 4.* onwards (renamed ""Bing Bar"" from version 5.* onwards) which includes the Bing search engine. Via Start → All Programs → Microsoft Default Manager you can elect to keep Bing as the default search engine and set it to notify you of any changes to your browsers default settings. Not required if you choose not to use Bing"
X	Microsoft Development Debugger	msdev.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft DirectX	wuamgrd.exe	"Added by the SDBOT.MY WORM!"
X	Microsoft DirectX	wupdate.exe	"Added by the RBOT-L WORM!"
X	Microsoft Directx push	directxpushup.exe	"Added by a variant of the RBOT-GHT WORM!"
X	Microsoft DLL	fumeta.exe	"Added by the RBOT-AUG WORM!"
X	Microsoft Dll	runapidll.exe	"Added by the RBOT-GRG WORM!"
X	Microsoft DLL Authentification	dllsecure.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft DLL Source	dllsrc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft DLL Verifier	winavguard.exe	Added by the SDBOT.AAD WORM!
X	Microsoft DNS Host Resolution	hostres.exe	"Added by the AGOBOT-MK BACKDOOR!"
X	Microsoft DNS Query	msdns.exe	"Added by the AGENT-BS TROJAN!"
X	Microsoft Document	krisp.exe	"Added by the SDBOT-RQ WORM!"
X	Microsoft Driver Setup	msddrv42.exe	"Added by the PALEVO WORM!"
X	Microsoft Driver Setup	Jwrb.exe	"Added by the AUTORUN-AOB WORM!"
X	Microsoft Driver Setup	dllhost.exe	"Added by the AUTORUN-AOZ WORM!"
X	Microsoft Driver Setup	sysmngsr322.exe	"Added by the BUZUS-AS TROJAN!"
X	Microsoft Driver Setup	w7services.exe	"Added by the AUTORUN-ARJ WORM!"
X	Microsoft Driver Setup	mslsrv32.exe	"Added by the SDBOT-DPF TROJAN!"
X	Microsoft Driver Setup	ccdrive32.exe	"Added by the AGENT-LYL TROJAN!"
X	Microsoft Driver Setup	cidrive32.exe	"Added by the AGENT-NES TROJAN!"
X	Microsoft driver update	Mshome.exe	Added by the SDBOT.BL WORM!
X	Microsoft Excell	wuamngr32.exe	"Added by the RBOT-QH WORM!"
X	Microsoft Executing	microsoft.exe	"Added by the AGOBOT.UV WORM!"
X	Microsoft explorer Update	internal.exe	Added by an unidentified WORM or TROJAN!
X	Microsoft Features	ms32cfg.exe	"Added by the RBOT.HO WORM!"
X	Microsoft Features	msie.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft FixUp	pevblbvr.exe	"Added by the RBOT.DWK WORM!"
X	Microsoft FixUp	wnpzjpuw.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Generic Update Manager	wupdate.exe	"Added by the RBOT-AWC TROJAN!"
X	Microsoft Genuine Logon	msnmsg.exe	"Added by the IRCBOT-XH WORM!"
X	Microsoft Genuine Logon	svchost.exe	"Added by the SDBOT.EXT WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Help Support	mshelp32.exe	"Addded by the KELVIR-BF WORM!"
X	Microsoft IE Execute shell	IEExec.exe	"Added by the ALADINZ.N TROJAN!"
X	Microsoft Information	securenet.exe	"Added by the SDBOT.AJM WORM!"
X	Microsoft Install Shield Services	rundll64	"Added by the RBOT-FSH WORM!"
X	Microsoft Installshield	nundll32.exe	"Added by the AGOBOT-AHZ WORM!"
X	Microsoft Internal AntiVirus Systems	dIlhost.exe	"Added by the RBOT-AEV WORM!"
X	Microsoft Internet Acceleration Utility	iau.exe	"EasySearch adware"
X	Microsoft Internet Acceleration Utility	[path to file]	"Added by the AGENT-CX TROJAN!"
X	Microsoft Internet Acceleration Utility	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Microsoft Internet Antivirus Protection	antivirus.exe	"Detected by Kaspersky as the IRCBOT.BSK TROJAN!"
X	Microsoft Internet Dumping Protocol	inetdump.exe	"Added by the IRCBOT.BLL BACKDOOR!"
X	Microsoft Internet Explorer Update	ieupdate.exe	"Added by the SHEUR.MH TROJAN!"
X	Microsoft Internet Firewall Update	updater.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Intrenet Explorer	Soundsyst.exe	"Added by the RBOT-AQU WORM!"
X	Microsoft Intrenet Explorer	wcumrg.exe	"Added by the SDBOT-AFD WORM!"
X	Microsoft IT Update	win64.exe	"Added by the RBOT.GA WORM!"
X	Microsoft IT Update	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft IT Update	IEserv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft IT Update	msupdate.exe	"Added by the RBOT-FE WORM!"
X	Microsoft IT Update	winn43.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft IT Update	svchsst.exe	"Added by the RBOT-DH WORM!"
X	Microsoft IT Update	win43.exe	"Added by the RBOT-SA WORM!"
X	Microsoft IT Update	windows.exe	"Added by the RBOT-JM WORM!"
X	Microsoft IT Update	winsyst32.exe	"Added by the RBOT-FC WORM!"
X	Microsoft IT Update	Rhost32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Java Virtual Machine	MsConfiG.exe	"Added by the FORBOT-DV WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting"
X	Microsoft Java Virtual Machine	msjvm.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Java Virtual Machine	javavm.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Java Virtual Machine	msjavarxp.exe	"Added by the FORBOT-DL WORM!"
X	Microsoft Java Virtual Machine	winscr32.exe	"Added by a variant of the WOOTBOT WORM!"
X	Microsoft Java Windows Update	[filename]	"Added by the RBOT-DZ WORM!"
X	Microsoft JavaVM	msjarun.exe	"Added by the RBOT-JW WORM!"
X	Microsoft Logon User Interface	logonnui.exe	"Added by the RBOT-BCC WORM!"
X	Microsoft Machine	updata.exe	"Added by the RBOT-DJ WORM!"
X	Microsoft MachineUpdatese	tempes.exe	"Added by the RBOT.EWN BACKDOOR!"
X	Microsoft Macro Protection SubSsy	msacroprots386.exe	"Added by the RBOT-KE WORM!"
X	Microsoft Macro Protection Subsystems	msmacroprotxz.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Macro Protection Subsystems	Msmacroprot32.exe	"Added by the RBOT.KN WORM!"
X	Microsoft Memory Dumping Protocol	memdump.exe	"Added by the IRCBOT.BJK BACKDOOR!"
X	Microsoft MSGPLUS32 Protocol	msgplus32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft msnseru	msnseru.exe	"Added by the RBOT-APB WORM!"
X	Microsoft MSUPDATE	SpoolSvc.exe	"Added by the SXTB-A TROJAN!"
X	Microsoft Network Neighbourhood	networknbh.exe	"Added by the RBOT.DMN WORM!"
X	Microsoft Norotn Anti Virus	mnhpot.exe	"Added by the RBOT-GRO WORM!"
X	Microsoft Norton Antivirus	norton.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft NT Update	winexec32.exe	"Added by a variant of the RBOT WORM!"
N	Microsoft Office OneNote 2003 Quick Launch	ONENOTEM.EXE	"System Tray access to MS Office OneNote 2003 - an electronic notebook that allows you to create free-form notes
X	Microsoft Office quick launch	OSA.exe	"Added by the VBOT.A BACKDOOR! Note that OSA.exe was used in older versions of Office to launch common components to help speed up the launch but it is no longer normally used - see here. This file is located in a valid MS Office 2003 (aka Office 11) directory - %Program Files%\Microsoft Office\OFFICE11 - and may overwrite a valid file"
X	Microsoft Office Quick Launcher	iau1.exe	"Added by the DLOADR-AWD TROJAN!"
N	Microsoft Office Shortcut Bar	Msoffice.exe	Feature included with older versions of MS Office giving you access to common Office functions and optional shortcuts to Office (and other) programs. Some people prefer it but a better way is to create desktop shortcuts if you want access these features and programs quickly. Also available via Start → All Programs
X	Microsoft Office Start	winupdates.exe	"Added by the GAOBOT.BC WORM!"
N	Microsoft Office Startup	osa.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
N	Microsoft Office Startup	Osa9.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
X	Microsoft Office Studio	scvhvst.exe	"Added by the RANDEX.CST WORM!"
X	Microsoft Outlook Express Protocol	svchst.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Patch Update	bootini.exe	"Added by the RBOT-FMN WORM!"
X	Microsoft Procedure Call	MSPCALL.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft quick launch	OSA.exe	"Added by a variant of the VBOT.A BACKDOOR! Note that OSA.exe was used in older versions of Office to launch common components to help speed up the launch but it is no longer normally used - see here. This file is located in a valid MS Office 2003 (aka Office 11) directory - %Program Files%\Microsoft Office\OFFICE11 - and may overwrite a valid file"
X	MicroSoft Remote Secure Service	MSRSS.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Router Manager	linksys.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Router Manager	router.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Rundll	windos.exe	"Added by the SDBOT-WF WORM!"
X	Microsoft Runtime	CfgDll32.exe	"Added by the RANDEX.BD WORM!"
X	Microsoft Secure	Messenger.NET Service	"Added by the FORBOT-AM WORM!"
X	Microsoft Secure Messenger.NET Service	securitychk.exe	"Added by the SDBOT.VT WORM!"
X	Microsoft Security	winService.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft security adviser	mssadv.exe	"Microsoft Security Adviser rogue security software - not recommended"
X	Microsoft Security Center	savservices.exe	"Added by the RBOT-ANU WORM!"
X	Microsoft Security Center	wcsntfy.exe	"Added by the SDBOT.BYD WORM!"
X	Microsoft Security Controlers	fxsecues.exe	"Added by a variant of the SDBOT WORM!"
Y	Microsoft Security Essentials	msseces.exe	"System Tray access to a notifications from Microsoft Security Essentials which ""provides real-time protection for your home PC that guards against viruses
X	Microsoft Security GManagers	[random filename]	"Added by a variant of the SDBOT WORM!"
X	Microsoft Security Hot Fix Update	mshotfix.exe	"Affilred adware"
X	Microsoft Security Management	winnt.exe	"Added by the RBOT-MQ WORM!"
X	Microsoft Security Management	winserv.exe	"Added by the RBOT-MJ WORM!"
X	Microsoft Security Management	winamp.exe	"Added by a variant of the RBOT WORM! Note - this is NOT the popular Winamp media player which resides in a ""Winamp"" subdirectory of the Program Files directory"
X	Microsoft Security Management	wuauct1.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Security Management	bling.exe	"Added by the RBOT.XL WORM!"
X	Microsoft Security Management	sp2fix.exe	"Added by the RBOT.UB WORM!"
X	Microsoft Security Manager	winamp.exe	"Added by the RBOT.TU WORM! Note - this is NOT the popular Winamp media player which is located in %ProgramFiles%\Winamp. This one is located in %System%"
X	Microsoft Security Monitor Process	mssmp.exe	"Added by the RBOT-FUB WORM!"
X	Microsoft Security Monitor Process	mnsmp.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Security Monitor Process	msmp.exe	"Added by the RBOT.GKQ WORM!"
X	Microsoft Security Monitor Process	mssm32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Security Monitor Process	lsas.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Security Monitor Process	msword.exe	"Added by the VIRUT.P VIRUS!"
X	Microsoft Security Monitor Process	service.exe	"Added by the DELF.BERW BACKDOOR!"
X	Microsoft Security Monitor Process	svcchost.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Security Monitor Process	windowsupdate.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Security Monitor Process	[random filename]	"Added by variants of the RBOT WORM! See here"
X	Microsoft Security Monitor Process	com.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Security Monitor Process	exel.exe	"Added by the SDBOT.AFX BACKDOOR!"
X	Microsoft Security Monitor Process	firewall.exe	"Added by a variant of the IRCBOT BACKDOOR! Located in %System%"
X	Microsoft Security Monitor Process	flash.exe	"Added by the EGGDROP.EE BACKDOOR!"
X	Microsoft Security Monitor Process	hel.exe	"Added by the EGGDROP.V BACKDOOR!"
X	Microsoft Security Monitor Process	HelpMe.exe	"Added by the VB.BJO TROJAN!"
X	Microsoft Security Monitor Process	kar.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Security Monitor Process	lindicracker.exe	"Added by the BIFROSE.GR BACKDOOR!"
X	Microsoft Security Monitor Process	mail.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Security Monitor Process	mmp.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Security Monitor Process	mssm32.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Security Monitor Process	mssmpi32.exe	"Added by a variant of the RBOT WORM! See here"
X	Microsoft Security Monitor Process	nitty.exe	"Added by the RBOT.AEU BACKDOOR!"
X	Microsoft Security Monitor Process	ofice.exe	"Added by the VIRUT.N VIRUS!"
X	Microsoft Security Monitor Process	point.exe	"Added by the IRCBOT.AVP BACKDOOR!"
X	Microsoft Security Monitor Process	princ.exe	"Added by the HUPIGON.WTL TROJAN!"
X	Microsoft Security Monitor Process	web.exe	"Added by the EGGDROP.V BACKDOOR!"
X	Microsoft Security Monitor Process	winsys32.exe	"Added by the VIRUT.N VIRUS!"
X	Microsoft Security Monitor Process	winsyss32.exe	"Added by the RBOT.AEU BACKDOOR!"
X	Microsoft Security Monitor Process	word.exe	"Added by the EGGDROP.DC BACKDOOR!"
X	Microsoft Security Panager	[filename]	"Added by the RBOT-ANL WORM!"
X	Microsoft Security Panagers	[random filename]	"Added by the RBOT-AIG WORM!"
X	Microsoft Security Panagers	zzoboony.exe	"Added by the RBOT-AOI WORM!"
X	Microsoft Security Pansasagers	dgkztsqgn.exe	"Added by the RBOT-BBJ WORM!"
X	Microsoft Security Process	wininit.exe	"Added by the RBOT-FKM WORM!"
X	Microsoft Security System	mssecsys.exe	"Added by the IRCBOT-WJ TROJAN!"
X	Microsoft Security Update	security32.exe	"Added by the DELF-JJ TROJAN!"
X	Microsoft Server Applacations	wuauct1.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Server Application	Sound.exe	"Added by the RBOT-NE WORM!"
X	Microsoft Service	rundll.exe	"Added by the POPO-A WORM! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	Microsoft Service Execution Manager	execute.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Microsoft Services	module.exe	"Added by the LAVITS WORM!"
X	Microsoft Services Unitd	MSU32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Session Manager Subsystem	smss.exe	"Added by the KALEL-D WORM! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup!"
X	Microsoft Setup Initializazion	localhost.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Sinsup	odjiwjf.exe	"Added by the RBOT-DN WORM!"
X	Microsoft Software Update	nmon.exe	"Added by the RBOT.HZ WORM!"
X	Microsoft Sound Driver	sound32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Sound Technology	winsound.exe	"Added by the RBOT-AGG WORM!"
N	Microsoft Sound Volume Tool	mssvol.exe	This is a Blue version of the yellow speaker icon on the system tray and is used to edit advanced Sound Features that the MS DSS80 Speakers add. Should be accessible via Start -> Settings -> Control Panel
X	Microsoft Sounds	soundman.exe	"Added by the RBOT-GCI WORM!"
X	Microsoft SpA Service	Winupd32.exe	"Added by the RBOT.LT WORM!"
X	Microsoft Standard Executions Library	win32lib.exe	"Added by the RBOT-AUK WORM!"
X	Microsoft startup	wmpIayer.exe	Added by the IRCBOT.ACI TROJAN!
X	Microsoft Startup Manager	sysservice.exe	"Added by the AVALANEC TROJAN!"
X	Microsoft Stuff you know	winslogin.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Sum32	sum32.exe	"Added by the RBOT-YW WORM!"
X	Microsoft Support	sys32ms.exe	"Added by the RBOT-AHI WORM!"
X	microsoft support	svchostt.exe	"Added by the AGOBOT.AWN WORM!"
X	Microsoft Synchronization Manager	winupdate.exe	"Added by the SDBOT.ER WORM!"
X	Microsoft Synchronization Manager	mircup.exe	"Added by the SDBOT.BQD WORM!"
X	Microsoft System	msupdtm.exe	"Added by the SPYBOT.PKC WORM!"
X	Microsoft System Backup	[random filename]	"Added by the RBOT-AGM WORM!"
X	Microsoft System Checkup	Cool.exe	"Added by the DONK.B WORM!"
X	Microsoft System Checkup	Wnetlib.exe	"Added by the DONK.C WORM!"
X	Microsoft System Checkup	dbnetlib.exe	"Added by the DONK.L WORM!"
X	Microsoft System Checkup	Keymgr.exe	"Added by the DONK.M WORM!"
X	Microsoft System Checkup	inetman.exe	"Added by the DONK.O WORM!"
X	Microsoft System Checkup	ntsysmgr.exe	"Added by the DONK.S WORM!"
X	Microsoft System Checkup	ntsysman.exe	"Added by the SDBOT-QW WORM!"
X	Microsoft System Checkup	libsysmgr.exe	"Added by the SDBOT-CAF WORM!"
X	Microsoft System Checkup	sysmgr.exe	"Added by the SDBOT-OO TROJAN!"
X	Microsoft System Checkup	netapi32.exe	"Added by the DONK-E WORM!"
X	Microsoft System Checkup	wnetmgr.exe	"Added by the DONK.Q WORM!"
X	Microsoft System Checkup	libsys32.exe	"Added by the SDBOT-ACK WORM!"
X	Microsoft System Checkup	netlogin32.exe	"Added by the SDBOT-GN BACKDOOR!"
N	Microsoft System Configuration Utility	msconfig.exe	Entry that appears when you uncheck an item in the MSConfig Startup group and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode. Located in %System% (98/Me/Vista) or %Windir%\PCHealth\HelpCtr\Binaries (XP)
X	Microsoft System Debug	services32.exe	"Added by the RBOT.AKH WORM!"
X	Microsoft System DLL Services Configuration	windir32.exe	"Added by the SDBOT-ACY TROJAN!"
X	Microsoft System Restore Configuration	CBRSS.EXE	"Added by a variant of the SPYBOT WORM!"
X	Microsoft System Security Agent	MSTSA.EXE	"Added by the RBOT.CCM WORM!"
X	Microsoft System Update	sysupdate.exe	"Added by the SDBOT.DG WORM!"
X	Microsoft system Value	sys57.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft System32 Update	cmsrg.exe	"Added by the RBOT-GN WORM!"
X	Microsoft Taskmanager Updater	keyboard.exe	"Added by the RBOT-ALU WORM!"
X	Microsoft Telecoms Center	winupn.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft U	wuamkopxp.exe	"Added by the RBOT-AHC WORM!"
X	Microsoft UMA Update	MSuma32.exe	"Added by the RBOT.FS WORM!"
X	MICROSOFT UNPACCKER SYSTEM	unpak32.exe	"Added by a variant of the RBOT WORM!"
X	MICROSOFT UNPACK SYSTEM	winrarx.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updat3	mswkst32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	Microsoft.exe	"Added by the GAOBOT.AFJ WORM!"
X	Microsoft Update	mssmgrd.exe	"Added by the SDBOT.JT WORM!"
X	Microsoft Update	mvsc.exe	"Added by the SPYBOT.DAZ WORM!"
X	Microsoft Update	ascdl.exe	"Added by the GAOBOT.SY WORM!"
X	Microsoft Update	Isac.exe	"Added by the RBOT-AU WORM!"
X	Microsoft Update	automgr32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	mediap.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	Microsoftx.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	msconfg.exe	"Added by the RBOT.H WORM!"
X	Microsoft Update	Mslti32.exe	"Added by the RBOT-LX WORM!"
X	Microsoft Update	muamgrd.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update	navmgrd.exe	"Added by the SDBOT.DP TROJAN!"
X	Microsoft Update	Smss32.exe	"Added by the RBOT-CB WORM!"
X	Microsoft Update	sys32cfg.exe	"Added by the RBOT.DR WORM!"
X	Microsoft Update	VPC32.EXE	"Added by the AGOBOT.XM WORM!"
X	Microsoft Update	winsys32.exe	"Added by the RBOT.BD WORM!"
X	Microsoft Update	wuamgrd.exe	"Added by the RBOT-LK WORM!"
X	Microsoft Update	wuammgr32.exe	"Added by the RBOT-AW WORM!"
X	Microsoft Update	wudmate.exe	"Added by the RBOT.AP WORM!"
X	Microsoft Update	msawindows.exe	"Added by the GAOBOT.AFJ WORM!"
X	Microsoft Update	msiwin84.exe	"Added by the GAOBOT.AFJ WORM!"
X	Microsoft Update	wuamgrd32.exe	"Added by the RBOT.ZB WORM!"
X	Microsoft Update	NAV.exe	"Added by the RBOT-IV WORM!"
X	Microsoft Update	systemi32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update	xpupdate.exe	"Added by the RBOT-QE WORM!"
X	Microsoft Update	webm.exe	"Added by the SDBOT.WK WORM!"
X	Microsoft Update	wuagrd.exe	"Added by the RBOT-FK WORM!"
X	Microsoft Update	aaupdt.exe	"Added by the RBOT-RQ WORM!"
X	Microsoft Update	lsac.exe	"Added by the GAOBOT.XW WORM!"
X	Microsoft Update	Mupdate.exe	"Added by the RBOT-AG WORM!"
X	Microsoft Update	prowind32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update	snlogsvc.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	svhost.exe	"Added by the RBOT-PI WORM!"
X	Microsoft Update	wauguard.exe	"Added by the RBOT.AEE WORM!"
X	Microsoft Update	winscv.exe	"Added by the RBOT-BH WORM!"
X	Microsoft Update	winsys.exe	"Added by the RBOT-GV WORM!"
X	Microsoft Update	wserv32.exe	"Added by the RBOT.AF WORM!"
X	Microsoft Update	wtm32.exe	"Added by the RBOT-AQ WORM!"
X	Microsoft Update	wumgrd.exe	"Added by the SDBOT-KY WORM!"
X	Microsoft Update	wuampd.exe	"Added by the RBOT-UT WORM!"
X	Microsoft Update	msupdate32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update	Botnet.exe	"Added by the RBOT.AFL WORM!"
X	Microsoft Update	sghost.exe	"Added by the SDBOT.AKV WORM!"
X	Microsoft Update	update_w.exe	"Added by the RBOT-EW WORM!"
X	Microsoft Update	windows24.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	wingrd32.exe	"Added by the RBOT-DW WORM!"
X	Microsoft Update	wssvr.exe	"Added by the RBOT-OD WORM!"
X	Microsoft Update	wuamagr32.exe	"Added by the SPYBOT.CG WORM!"
X	Microsoft Update	WinUpdate32.exe	"Added by the RBOT-TI WORM!"
X	Microsoft Update	wkfix.exe	"Added by the RBOT-ABZ WORM!"
X	Microsoft Update	Kkk.exe	"Added by the RBOT-AHL WORM!"
X	Microsoft Update	mcupdate.exe	"Added by the RBOT.XT WORM! Note - this file is located in %System% and should not be confused with the McAfee antivirus executable as described here"
X	Microsoft Update	Micr0s0ft.exe	"Added by the AGOBOT.AAR WORM!"
X	Microsoft Update	Msnmsngr.exe	"Added by the RBOT.BQS WORM!"
X	Microsoft Update	msupdate32.exe	"Added by the SPYBOT.LZ WORM!"
X	Microsoft Update	scvhost.exe	"Added by the RBOT-AEM WORM!"
X	Microsoft Update	svghost.exe	"Added by the RBOT.BUJ WORM!"
X	Microsoft Update	sys.exe	"Added by the RBOT-AJ WORM!"
X	Microsoft Update	up2dat5.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	winamp.exe	"Added by a variant of the RBOT WORM! Note - this is NOT the popular Winamp media player"
X	Microsoft Update	win-mang.exe	"Added by the RBOT-AFK WORM!"
X	Microsoft Update	winupdater.exe	"Added by the RBOT.BIN WORM!"
X	Microsoft Update	wuamk0032.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	wuamk032.exe	"Added by the RBOT-AHD WORM!"
X	Microsoft Update	wuamk0p32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	wuamkop.exe	"Added by the RBOT-AFI WORM!"
X	Microsoft Update	wuamkop32.exe	"Added by the RBOT.BGU WORM!"
X	Microsoft Update	wuampkd.exe	"Added by the SDBOT.BBX WORM!"
X	Microsoft Update	svzhost.exe	"Added by the RBOT.OX WORM!"
X	Microsoft Update	win32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	wininit.exe	"Added by the RBOT-AKR WORM!"
X	Microsoft Update	wuamgrd3.exe	"Added by the RBOT-AMC WORM!"
X	Microsoft Update	Wudates.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	ms.exe	"Added by the SDBOT.CC WORM!"
X	Microsoft Update	wuagmsd.exe	"Added by the RBOT-AX WORM!"
X	Microsoft Update	cmss.exe	"Added by the RBOT-ATQ WORM!"
X	Microsoft Update	wuamgrb.exe	"Added by the RBOT-AZE WORM!"
X	Microsoft Update	WINDOC.EXE	"Added by the SDBOT.PF WORM!"
X	Microsoft Update	phqghumea.exe	"Added by the SDBOT.AFO WORM!"
X	Microsoft Update	system32.exe	"Added by the RBOT.IS WORM!"
X	Microsoft Update	bling.exe	"Added by the RBOT-AVK WORM!"
X	Microsoft Update	Sygate.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	update.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	WinDrv32.exe	"Added by the RBOT.EGW WORM!"
X	Microsoft Update	devmks32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft update	winupdate.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	msupdate.exe	"Added by the BOROBOT-I TROJAN!"
X	Microsoft Update	mixer.exe	"Added by the RBOT-AIR WORM!"
X	Microsoft Update	taskmgr32.exe	"Added by the RBOT-CV WORM!"
X	Microsoft Update	drive.exe	"Added by the BIFROSE-PN WORM!"
X	Microsoft Update	wangard.exe	"Added by the RBOT-LH WORM!"
X	MICROSOFT UPDATE	WUAGTRD.EXE	"Added by the RBOT-CJ WORM!"
X	Microsoft Update	spool.exe	"Added by the AGENT-GJC TROJAN!"
X	Microsoft Update	bnmveqfts.exe	"Added by the BANLOAD.KWQ TROJAN!"
X	Microsoft Update	dqbxhupdt	"Added by a variant of the SDBOT WORM! See here"
X	Microsoft Update	enule.exe	"Added by the IRCBOT.DU BACKDOOR!"
X	Microsoft Update	explorer.exe	"Added by the RBOT.AEU BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft Update	imchemaoa.exe	"Added by the BANLOAD.KWQ TROJAN!"
X	Microsoft Update	livemessenger.com	"Added by the ADLOAD-LN TROJAN!"
X	Microsoft Update	msnmsgl.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Update	nnwyaupdt	"Added by the RBOT.RHK BACKDOOR!"
X	Microsoft Update	ntservice.exe	"Added by the AGENT-DIS TROJAN!"
X	Microsoft Update	rundll32.dll	"Added by the CIADOOR.GN BACKDOOR!"
X	Microsoft Update	wuamgrdx.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Update	wutr.exe	"Added by the SPYBOT.AAR WORM!"
X	Microsoft Update	SetPoints.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Update	system.exe	"Added by a variant of the RBOT WORM! See here"
X	Microsoft Update	service.exe	"Added by a variant of the RBOT WORM! See here"
X	Microsoft Update	msgn.exe	"Added by the RBOT.RQ BACKDOOR!"
X	Microsoft Update	wuamgrd16.exe	"Added by the RBOT-BQ WORM!"
X	Microsoft Update	windows32.exe	"Added by the RBOT-BHQ WORM!"
X	Microsoft Update	winsyst.exe	"Added by the RBOT-DL WORM!"
X	Microsoft Update 23	NtKernelSystem.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 23	spoolvs.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	explore32.exe	"Added by the SPYBOT.CYM WORM!"
X	Microsoft Update 32	MSupdate32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update 32	wininit.exe	"Added by the RBOT-ANY WORM!"
X	Microsoft Update 32	wininit32.exe	"Added by the RBOT-AKJ WORM!"
X	Microsoft Update 32	[path to file]	"Added by the RBOT-AJJ WORM!"
X	Microsoft Update 32	mscnfg.exe	"Added by the RBOT-ALM WORM!"
X	Microsoft Update 32	servic.exe	"Added by the RBOT-AXN WORM!"
X	Microsoft Update 32	winitXP32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	mssetup32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	wiit.exe	"Added by the RBOT-AMS WORM!"
X	Microsoft Update 32	explorer.exe	"Added by the RBOT-ARF WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft Update 32	network.exe	"Added by the RBOT-ARZ WORM!"
X	Microsoft Update 32	om4r.exe	"Added by the RBOT-AQP WORM!"
X	Microsoft Update 32	winin.exe	"Added by the RBOT-ARR WORM!"
X	Microsoft Update 32	wuinit.exe	"Added by the AGOBOT-UE WORM!"
X	Microsoft Update 32	neta.exe	"Added by the RBOT-AMI WORM!"
X	Microsoft Update 32	spoolvs.exe	"Added by the RBOT-BBQ WORM!"
X	Microsoft Update 32	rundll32.exe	"Added by the RBOT.AIE BACKDOOR! Note that this BACKDOOR modifies the file rundll32.exe
X	Microsoft Update 32	taskMangr.exe	"Added by the RBOT.AIE BACKDOOR!"
X	Microsoft Update 32	winssx.exe	"Added by the RBOT-ARW WORM!"
X	Microsoft Update 33	init.exe	"Added by the RBOT-ATT WORM!"
X	Microsoft Update 64 BIT	wininit32.exe	"Added by the RBOT-AHE WORM!"
X	Microsoft Update 64 BIT	winman32.exe	"Added by the RBOT-AKI WORM!"
X	Microsoft Update 64 BIT	schvost.exe	"Added by the RBOT.CAU WORM!"
X	Microsoft Update 64 BIT	winl32xe.exe	"Added by the RBOT-AQO WORM!"
X	Microsoft Update Clinic	svsipconfig.exe	"Added by the RBOT.BR WORM!"
X	MICROSOFT UPDATE CONFIGURATION	WIN32SNC.EXE	"Added by the RBOT-AI WORM!"
X	Microsoft Update Control	Ms64.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Debugger	wincfg32.exe	"Added by the SPYBOT.ZC WORM!"
X	Microsoft Update Device	flolo.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Update Device Drivers	wuauclt.exe	"Added by a variant of the SDBOT WORM! Note - this is not the legitimate wuauclt.exe process
X	Microsoft Update DLL	rxxhost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Drivers	explorers.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update Emulator	kern-mxe.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Emulator	wuaddsff.exe	"Added by the RBOT-GX WORM!"
X	Microsoft Update Event	svnhost.exe	"Added by the AGOBOT-GW BACKDOOR!"
X	Microsoft Update Loader	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Loaders 2005	winusers.exe	"Added by the RBOT-AIQ WORM!"
X	Microsoft Update Loaders 2006	winusersystem32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update Machine	expl0rer.exe	"Added by the SDBOT.OK WORM!"
X	Microsoft Update Machine	rxhost.exe	"Added by the RBOT.FC WORM!"
X	Microsoft Update Machine	servicz.exe	"Added by the RBOT-HU WORM!"
X	Microsoft Update Machine	SP2.exe	"Added by the SPYBOT.FP WORM!"
X	Microsoft Update Machine	winini.exe	"Added by the RBOT-KV WORM!"
X	Microsoft Update Machine	xvshost.exe	"Added by the RBOT.QP WORM!"
X	Microsoft Update Machine	memstat.exe	"Added by the RBOT-OM WORM!"
X	Microsoft Update Machine	ntce.exe	"Added by the RBOT-FA WORM!"
X	Microsoft Update Machine	system03.exe	"Added by the RBOT-NM WORM!"
X	Microsoft Update Machine	wuawx.exe	"Added by the RBOT-CE WORM!"
X	Microsoft Update Machine	zonealarm.exe	"Added by the RBOT-BZ WORM! Note - this is not the valid Zone Labs firewall program!"
X	Microsoft Update Machine	systemll.exe	"Added by the RBOT-JT WORM!"
X	Microsoft Update Machine	winupdt.exe	"Added by the RBOT-FP WORM!"
X	Microsoft Update Machine	svshost.exe	"Added by the RBOT.AK WORM!"
X	Microsoft Update Machine	wuamgd.exe	"Added by the SDBOT.HQ WORM!"
X	Microsoft Update Machine	wupdt32x.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update Machine	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	linux.exe	"Added by the RBOT-IM WORM!"
X	Microsoft Update Machine	lmrss.exe	"Added by the RBOT-DY WORM!"
X	Microsoft Update Machine	windowsu.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	wininigo.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	winmgr.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	Winmsixp32.exe	"Added by the RBOT.DN WORM!"
X	Microsoft Update Machine	Winregs32.exe	"Added by the RBOT.DN WORM!"
X	Microsoft Update Machine	winxpini.exe	"Added by the RBOT-OB WORM!"
X	Microsoft Update Machine	wuamgrd.exe	"Added by the RBOT-HE WORM!"
X	Microsoft Update Machine	wuagrd.exe	"Added by the RBOT-GF WORM!"
X	Microsoft Update Machine	LANWAKE.EXE	"Added by the RBOT-QZ WORM!"
X	Microsoft Update Machine	scvhost.exe	"Added by the RBOT-GS WORM!"
X	Microsoft Update Machine	winhost.exe	"Added by the RBOT-GK WORM!"
X	Microsoft Update Machine	winss.exe	"Added by the RBOT.JU WORM!"
X	Microsoft Update Machine	WUAMGRDXS.EXE	"Added by the RBOT-GL WORM!"
X	Microsoft Update Machine	crss32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	lsasse.exe	"Added by the RBOT-DI WORM!"
X	Microsoft Update Machine	qwerty.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	rxxhost.exe	"Added by the RBOT.EP WORM!"
X	Microsoft Update Machine	servicez.exe	"Added by the SPYBOT.BI WORM!"
X	Microsoft Update Machine	spoolserv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	Systemnt.exe	"Added by the RBOT.DA WORM!"
X	Microsoft Update Machine	systemse.exe	"Added by the RBOT-BD WORM!"
X	Microsoft Update Machine	taskmngrs.exe	"Added by the RBOT-CR WORM!"
X	Microsoft Update Machine	windowsup.exe	"Added by the RBOT-FV WORM!"
X	Microsoft Update Machine	wuamgard.exe	"Added by the SPYBOT.CS WORM!"
X	Microsoft Update Machine	wupdate32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	system.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	TMEMSER.EXE	"Added by the RBOT-NQ WORM!"
X	Microsoft Update Machine	winnie.exe	"Added by the RBOT-ACD WORM!"
X	Microsoft Update Machine	winortho.exe	"Added by the RBOT-NW WORM!"
X	Microsoft Update Machine	wins32.exe	"Added by the RBOT.EZ WORM!"
X	Microsoft Update Machine	serviz.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	TASKMAN4.EXE	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	wftestb.exe	"Added by the RBOT-AFZ WORM!"
X	Microsoft Update Machine	Win32.exe	"Added by the SDBOT.UV WORM!"
X	Microsoft Update Machine	windns.exe	"Added by the RBOT.EF WORM!"
X	Microsoft Update Machine	MSOICONS.EXE	"Added by the RBOT.AWS WORM! Note - do no confuse with the legitimate Msoicons.exe file described here. The latter should not normally figure in Msconfig/Startup!"
X	Microsoft Update Machine	WINSVC32.EXE	"Added by the RBOT.CU WORM!"
X	Microsoft Update Machine	ntsystem.exe	"Added by the RBOT.GF WORM!"
X	Microsoft Update Machine	winupdte.exe	"Added by the RBOT-GKL WORM!"
X	Microsoft Update Machine	jkfrnz.exe	"Added by the RBOT-GOZ WORM!"
X	Microsoft Update Machine	wlimyc.exe	"Added by the RBOT-GQN WORM!"
X	Microsoft Update Machine	xagwxzy.exe	"Added by the RBOT.S WORM!"
X	Microsoft Update Machine	jkydxg.exe	"Added by the RBOT.AEA BACKDOOR!"
X	Microsoft Update Machine	opmmve.exe	"Added by the KOLABC.DES WORM!"
X	Microsoft Update Machine	paxrxo.exe	"Added by the PUSHBOT.A WORM!"
X	Microsoft Update Machine	psmszw.exe	"Added by the KOLABC.CC WORM!"
X	Microsoft Update Machine	syadpo.exe	"Added by the CIADOOR.GN BACKDOOR!"
X	Microsoft Update Machine	systemi.exe	"Added by the BUZUS.JKU TROJAN!"
X	Microsoft Update Machine	thvfyq.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	ubthec.exe	"Added by the AGENT.AWZ TROJAN!"
X	Microsoft Update Machine	winmngr.exe	"Added by the RBOT.GKQ BACKDOOR!"
X	Microsoft Update Machine	gbhglj.exe	"Added by the IRCBOT-ZJ TROJAN!"
X	Microsoft Update Machine	wuamgdr.exe	"Added by the RBOT-IO BACKDOOR!"
X	Microsoft Update Manager	WINRLS.EXE	"Added by the RBOT-AF WORM!"
X	Microsoft Update Manager	svshost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Manager	scvhost.exe	"Added by the AGOBOT.AXJ WORM!"
X	Microsoft Update Manager	scvideo.exe	"Added by the SDBOT-CVP TROJAN!"
X	Microsoft Update Mechene	Updatez.exe	"Added by the RBOT-GI WORM!"
X	Microsoft Update Module	rundll24.exe	"Added by the RBOT-PS WORM!"
X	Microsoft Update Process	wmipcvse.exe	"Added by the AGOBOT-JF TROJAN!"
X	Microsoft Update Security Patch	mssecurityupdatepatch.exe	Added by the AGENT.EF TROJAN!
X	Microsoft Update Server	mssrv.exe	"Added by an unidentified VIRUS
X	Microsoft Update Service	csrss32.exe	"Added by the AGOBOT-HC WORM!"
X	Microsoft Update Service	mswin32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft update service	systemm.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update SERVICE	phqghum.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Service	msupdate.pif	"Added by the RBOT-AQB WORM!"
X	Microsoft Update Service	wmiprvre.exe	"Added by the AGOBOT-NN WORM!"
X	Microsoft Update Services	wcsnfty.exe	"Added by the RBOT-AGK WORM!"
X	Microsoft Update Services	wsnfty.exe	"Added by the RBOT-AFU WORM!"
X	Microsoft Update Time	wuam.exe	"Added by the RBOT-M WORM!"
X	Microsoft Update USB2	wuammgrd32.exe	"Added by the RBOT-ADT WORM!"
X	Microsoft Update v2.6	lxxex.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Win32a	winupdate32a.exe	"Added by the RBOT-LO WORM!"
X	Microsoft Update Win32x	winupdate32x.exe	"Added by the RBOT-AJN WORM!"
X	Microsoft Update32	wuamgrd32.exe	"Added by the RBOT-PU WORM!"
X	Microsoft Updater	winsys32.exe	"Added by the RBOT.RL WORM!"
X	Microsoft Updater	msconsole.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Updater	svhost.exe	"Added by the AGENT.CDF TROJAN!"
X	Microsoft Updater	vbcjlg.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Updater	wuamgrds.exe	"Added by the RBOT.A WORM!"
X	Microsoft Updater	winupdate.exe	"Added by the AGENT-KIR TROJAN!"
X	Microsoft Updater Resources	WinFixd32.exe	"Added by the SPYBOT.CA WORM!"
X	Microsoft Updater v2	[path to worm]	"Added by the AUTORUN-BCI WORM!"
X	Microsoft UPDATER32	lsass.exe	"Added by the RANDEX.AR WORM! Note - this is not the legitimate Lsass.exe system file should normally NOT figure in Msconfig/Startup!"
X	Microsoft UPDATER32	LSASS32.EXE	"Added by the RANDEX.AR WORM!"
X	Microsoft Updaters	tskmgr.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updaters	sysconfigs.exe	"Added by the RBOT-DF TROJAN!"
X	Microsoft Updaters Pros	WINDLL32XP.EXE	Added by the SPYBOTTER.GEN VIRUS!
X	Microsoft Updates	systemc32.exe	"Added by the RBOT-GR WORM!"
X	Microsoft Updates	wkssvr.exe	"Added by the RBOT.R WORM!"
X	Microsoft Updates	wkssvrs.exe	"Added by the RBOT-EB WORM!"
X	Microsoft Updates	wuamgrd.exe	"Added by the RBOT-CO WORM!"
X	Microsoft Updates	wtemp32.exe	"Added by the RBOT-AHQ WORM!"
X	Microsoft Updates	svehost.exe	"Added by the RBOT-GRW WORM!"
X	Microsoft Updates	svshost.exe	"Added by the AGOBOT-AIW WORM!"
X	Microsoft Updates	svdhost.exe	"Added by the RBOT-GVH WORM!"
X	Microsoft Updates	service.exe	"Added by the POISON.HPT BACKDOOR!"
X	Microsoft Updates	[worm filename]	"Added by the AGOBOT-AIZ WORM!"
X	Microsoft Updates	wgcptsud.exe	"Added by the RBOT-GTF WORM!"
X	Microsoft Updates	winit.exe	"Added by the SDBOT-CSB WORM!"
X	Microsoft Updates 2 USB	wgafixer.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updates 5 USB	sp3fixer.exe	"Added by the RBOT-ADS WORM!"
X	Microsoft UpdateS Machine	wgrd.exe	"Added by the RBOT-FI WORM!"
X	Microsoft Updates Resources	WinFixIDs.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updating	navguard.exe	"Added by the RBOT.HW WORM!"
X	Microsoft Updating	syswr.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updating	wuamguards.exe	"Added by the RBOT-BY WORM!"
X	Microsoft Updating Client	websvc.exe	"Added by the RBOT.AQ WORM!"
X	Microsoft Updating Machine	sysc0de.exe	"Added by the RBOT.RB WORM!"
X	Microsoft Updatting	miroupdate.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updote	[random filename]	"Added by the RBOT-ARC WORM!"
X	Microsoft UpMachine	doezs.exe	"Added by the RBOT.BCT WORM!"
X	Microsoft upnp Update	msie.exe	"Added by the RBOT-LQ WORM!"
X	Microsoft uptime Service	sysuptime.exe	"Added by the RBOT-ACG WORM!"
X	Microsoft uptime Service	sycuptime.exe	"Added by the RBOT-AHY WORM!"
X	Microsoft UpToDate Driver (32-bits)	[random filename].exe	"Added by the SPYBOT.LXJ WORM!"
X	Microsoft Urlmon	urlmon.exe	"Added by the AGENT-GOO TROJAN!"
X	Microsoft USA Plug	usaplug.exe	"Added by the RBOT-DVC WORM!"
X	Microsoft USB Windows2 Driver	usbautotuner.exe	"Added by the SILLYFDC.BCL WORM!"
X	Microsoft USB2 Driver	crmss.exe	"Added by the RBOT-VK WORM!"
X	Microsoft usnsvc Service	usnsvc.exe	"Added by a variant of the KOBOT-C WORM!"
N	Microsoft Utility Startup	OSA9.exe	On older versions of MS Office this launches common Office components to help speed up the launch of Office programs. On slower machines it can be a resource hog and some users claim there's no difference with or without it - but it usually isn't required. This must be left enabled if you use the Microsoft Office Shortcut Bar (MSOFFICE.EXE) and have set it to load at startup. Available via Start → All Programs
X	Microsoft Values	igfkishc.exe	"Added by the RBOT-GLO WORM!"
X	Microsoft Vertupdate	MSvert32.exe	"Added by the MYTOB-CY WORM!"
X	Microsoft Video Capture Controls	MSsrvs32.exe	"Added by the SDBOT-AAK WORM!"
X	Microsoft Virtual Service Manager	vservice32.exe	"Added by the MSNWORM.T WORM!"
X	Microsoft Virual Machine	sms.exe	"Added by the RBOT-SP WORM!"
X	Microsoft Vista Upgrade Validation Service	cfmon.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Visual Application	vpcrtf.exe	"Added by the IRCBOT-XJ TROJAN!"
X	Microsoft Visual Debuger	mdm.exe	"Added by the SDBOT-DOO WORM! Note - this is not the legitimate Machine Debug Manager (mdm.exe) process which is located in %ProgramFiles%\Common Files\Microsoft Shared\VS7Debug (98/Me/XP/Vista) or C:\WINDOWS\SYSTEM (Me only)"
X	Microsoft Visual SourceSafe	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
X	Microsoft Visual SourceSafe	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	MicroSoft Visual SP	igxdfdfds.com	"Added by the SDBOT.GAV WORM!"
X	MicroSoft Visual SP2	igfxsrvc32.exe	"Added by the SDBOT.GAV WORM!"
X	Microsoft Visual Studio	plscdksxg.exe	"Added by the RBOT-AWV WORM!"
X	Microsoft Visual Studio VSA	varpc32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft web update	webmsn.exe	"Added by the RBOT-EMQ WORM!"
X	Microsoft Win Update	WinUP.exe	"Added by the RBOT-BPR WORM!"
X	Microsoft WIN32 Security	MSsec32.exe	"Added by the RBOT-DOQ TROJAN!"
X	MicroSoft Wind0ws Updater	winsupdater.exe	"Added by a variant of the RBOT WORM!"
X	MicroSoft Window Updater	winsupdater.exe	"Added by the RBOT-ZZ WORM!"
X	Microsoft Windows	atup	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows 128bit Subsystem	system12.exe	"Added by the RANCK-CZ TROJAN!"
X	Microsoft Windows 2000	Winupdsdgm.exe	"Added by the GAOBOT.AO WORM!"
X	Microsoft Windows 32 Update	win32update.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows Autowxckn	autowxckn.exe	"Added by the RBOT.DYZ BACKDOOR!"
X	Microsoft Windows Communicator for NT/XP	wincomm.exe	"Added by the RBOT.ATH WORM!"
X	Microsoft Windows DLL Services Configuration	newdll.exe	"Added by the SDBOT-ZR WORM!"
X	Microsoft Windows DLL Services Configuration	newdll2.exe	"Added by the SDBOT-ABD WORM!"
X	Microsoft Windows DLL Services Configuration	poker.exe	"Added by the SDBOT-ZY WORM!"
X	Microsoft Windows DLL Services Configuration	poker3.exe	"Added by the SDBOT-AAH WORM!"
X	Microsoft Windows DLL Services Configuration	proxy.exe	"Added by the SDBOT-ZL WORM!"
X	Microsoft Windows DLL Services Configuration	windir32.exe	"Added by the SDBOT.BHF WORM!"
X	Microsoft Windows DLL Services Configuration	windir32a.exe	"Added by a variant of the SDBOT.BHF WORM!"
X	Microsoft Windows DLL Services Configuration	windll32.exe	"Added by the SDBOT.BHD WORM!"
X	Microsoft Windows DLL Services Configuration	winDSL.exe	"Added by the SDBOT-ZG WORM!"
X	Microsoft Windows DLL Services Configuration	dllmanager32.exe	"Added by the SDBOT-BTU WORM!"
X	Microsoft Windows Express	Microsoft Update	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Windows Game Updater	msgame32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows GUI	Windowz.exe	"Added by the RANDEX.AEV WORM!"
X	Microsoft Windows GUI	msmonk32.exe	"Added by the SDBOT-PE WORM!"
U	Microsoft Windows Media Player Network Sharing Service Configuration Application	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	Microsoft Windows Secure	windocs.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Secure	windocs.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Secure Server	rpcxWindows.exe	"Added by the RBOT-LL WORM!"
X	Microsoft Windows Secure Update	rpcxwinupdt.exe	Added by an unidentified WORM or TROJAN!
X	Microsoft Windows Securety	wurguar.exe	"Added by the RBOT-KY WORM!"
X	Microsoft Windows Security	spvsper.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Security	wscndrives.exe	"Added by the RBOT-AJK WORM!"
X	Microsoft Windows Services Edt	dllrun32.exe	"Added by the RBOT-GAF WORM!"
X	Microsoft Windows Session Manager Subsystem	smss.exe	"Added by the PROXYSER-R TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Windows Sound	svghost.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Windows Sound	svshost.exe	"Added by the RBOT.RNE BACKDOOR!"
X	Microsoft Windows Sound	svuhost.exe	"Added by the KOLAB.XC WORM!"
X	Microsoft Windows Sound Drivers	sounddrivers.exe	"Added by the SLENFBOT.ABU WORM!"
X	Microsoft Windows Updata	scvhost.exe	"Added by the RBOT.CEM BACKDOOR!"
X	Microsoft Windows Updata	windows.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Updata	[5 random letters].exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update	rundlls.exe	"Added by the HABRACK WORM!"
X	Microsoft Windows Update	msoffice2.exe	"Added by the RBOT-GB WORM!"
X	Microsoft Windows Update	spools.exe	"Added by the SDBOT.TD WORM!"
X	Microsoft Windows Update	svchos.exe	"Added by the SDBOT.AC WORM!"
X	Microsoft Windows Update	svcshost.exe	"Added by the FORBOT-CF WORM!"
X	Microsoft Windows Update	svmhost.exe	"Added by the FORBOT-CH WORM!"
X	Microsoft Windows Update	svshost.exe	"Added by the WOOTBOT.CJ WORM!"
X	Microsoft Windows Update	msnmessenger.exe	"Added by the SDBOT.AJ WORM!"
X	Microsoft Windows Update	msnwun.exe	"Added by the SDBOT-RM WORM!"
X	Microsoft Windows Update	scvvhost.exe	"Added by the FORBOT-DH WORM!"
X	Microsoft Windows Update	swwhost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update	MSNMSGR.EXE	"Added by the SDBOT-WM WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Microsoft Windows Update	svzhost.exe	"Added by the FORBOT-EV WORM!"
X	Microsoft Windows Update	sccvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update	scrhost.exe	"Added by the RBOT-AOW WORM!"
X	Microsoft Windows Update	mnswinsx.exe	"Added by the RBOT-AWH WORM!"
X	MICROSOFT Windows update	pdate.exe	"Added by the RBOT.BZT WORM!"
X	Microsoft Windows Update	srshost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update	rhost32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows Update	windowsupdate.exe	"Added by the AGOBOT.ON WORM!"
X	Microsoft Windows Update	servcs.exe	"Added by the SDBOT.AL BACKDOOR!"
X	Microsoft Windows Update	syssinfos.exe	"Added by the RBOT-FWR WORM!"
X	Microsoft Windows Update Application	wuap.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update Client	csrss.exe	"Added by the KEBEDE-G WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Systems32"
X	Microsoft Windows Update Client	services.exe	"Added by the AUTORUN.DVE WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Windows Update Logon	win-logon.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update Service	wupdmgr32.exe	"Added by the DOS.AUTOCAT TROJAN!"
X	Microsoft Windows Update Service	msnmsg.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Windows Update x86	[various filenames]	"Added by a variant of the RBOT WORM! Filenames seen include (but are not limited to firefox.exe
X	Microsoft Windows Update XP64	*******.exe [ = random char]	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update XP64	updatexp64.exe	"Added by the SDBOT-AIM WORM!"
X	Microsoft Windows Update XP64	Lcuninst.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update XP64	mzhxlixm.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updater	winupdgm.exe	"Added by the GAOBOT.BI WORM!"
X	Microsoft Windows Updater	WINIUPDATES.EXE	"Added by the RBOT-KK WORM!"
X	Microsoft Windows Updater	WINUPDATE.EXE	"Added by the RBOT-LI WORM!"
X	Microsoft Windows Updater	TMNTSrv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Updater	win32upd.exe	"Added by the RBOT-EC WORM!"
X	Microsoft Windows Updater	msnupdateit.exe	"Added by the AGOBOT-RL WORM!"
X	Microsoft Windows Updater	windates.exe	"Added by the SDBOT.TE WORM!"
X	Microsoft Windows Updater	spoolvs.exe	"Added by the RBOT.ACQ WORM!"
X	Microsoft Windows Updater	suvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updater	winfix.exe	"Added by the RBOT-CM WORM!"
X	Microsoft Windows updaterD	log32zx.exe	"Added by the MYDOOM.W WORM!"
X	Microsoft Windows Updates	explorer32.exe	"Added by the SDBOT.VQ WORM!"
X	Microsoft Windows Updates	wsap32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updating System	msresource.exe	"Added by the RBOT-EAM WORM!"
X	Microsoft Windows Visual V2.0	msiutil.exe	"Added by the DELF.JPH TROJAN!"
X	Microsoft Windows XP Configuration Loader	m32svco.exe	"Added by the SDBOT.WORM!.48548 WORM!"
X	Microsoft Winedows startup	WinKey.exe	"Added by a variant of the SDBOT WORM! See here"
X	Microsoft Winedows Updateing	NinKey.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Winsock Service	msusvc.exe	"Added by the RBOT-ANS WORM!"
X	Microsoft WinSound	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft winsupdater	WINSUPDATER.EXE	"Added by the SPYBOTER.FB BACKDOOR!"
X	Microsoft WinUpdate	mntcgf032.exe	"Added by the RBOT-PF WORM!"
X	Microsoft WinUpdate	svh0st.exe	"Added by the SPYBOT.DL WORM!"
X	Microsoft WinUpdate	syslx32.exe	"Added by an unidentified VIRUS
X	Microsoft WinUpdate	syswin32.exe	"Added by the RBOT-HO WORM!"
X	Microsoft WinUpdate	spfix.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft WinUpdate	Winamp61.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft WinUpdate	Winupd32.exe	"Added by the RBOT.MQ WORM!"
X	Microsoft WinUpdate	WinNTinit32.exe	"Added by the RBOT.VS WORM!"
X	Microsoft WinUpdate	msupdte.exe	"Added by an unidentified TROJAN! See examples here & here"
X	Microsoft WinUpdates	serm32.exe	"Added by the RBOT.GE WORM!"
X	Microsoft Word Profissional	Java Plug In close.exe	"Added by the BANKER-EL TROJAN!"
N	Microsoft Works Update Detection	wkdetect.exe	Checks for updates to MS Works
X	Microsoft Wxdate	Syswu32.exe	"Added by the SPYBOT.HZ WORM!"
X	Microsoft X Update	wuamkoppnp.exe	"Added by the RBOT-ANI WORM!"
X	Microsoft's System Module	Sysmodule.exe	"Added by the BDOOR-FJ BACKDOOR!"
X	Microsoft--Updates	sxvhost.exe	"Added by the RBOT-FH WORM!"
X	Microsoft-Update	wngard.exe	"Added by the RBOT-JV WORM!"
X	Microsoft-Updates	svxhost.exe	"Added by the RBOT-CT WORM!"
X	MicrosoftCorp	securebind.exe	"Added by the INJECT TROJAN!"
X	MicrosoftCorp	update.exe	"Added by the AUTORUN-ASG WORM!"
X	MicrosoftCorp	wupdate.exe	"Added by the AGENT-LAY TROJAN!"
X	Microsoftf DDEs ContDLL	rune.pif	"Added by the RBOT-AGF WORM!"
X	Microsoftf DDEs ContrDL	runm.pif	"Added by the RBOT-AFQ WORM!"
X	microsoftm eegs cuntrol	loor.pif	"Added by a variant of the RBOT WORM!"
X	MicrosoftMultimediaTask	Mmtask.exe	Adware downloader - not the valid MusicMatch Jukebox which shares the same filename
X	MicrosoftNAPC	securebind.exe	"Added by the INJECT TROJAN!"
X	MicrosoftNAPC	update.exe	"Added by the AUTORUN-ASG WORM!"
X	MicrosoftNAPC	wupdate.exe	"Added by the AGENT-LAY TROJAN!"
X	MicroSoftRun	MSCOMM.dll	"Added by the AGENT-DJG TROJAN!"
X	Microsofts Security Manager	**.exe [** = random char]	"Added by the RBOT-WH TROJAN!"
X	Microsofts Updates	lsasss.exe	"Added by the RBOT-AEX WORM!"
X	Microsofts Updatez	cmsssr.exe	"Added by an unidentified VIRUS
X	Microsofts Updatez	exploirez.exe	"Added by a variant of the RBOT WORM!"
X	MicrosoftServiceManager	msupdat.exe	"Added by the YAHA.AA WORM!"
X	MicrosoftSourceSafe	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	MicrosoftSourceSafe	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	MicrosoftUpdate	syshelper.exe	"Added by the WOOTBOT.AC WORM!"
X	MicrosoftUpdate	WinUp32.exe	"Added by an unidentified VIRUS
X	MicrosoftUpdate	MicrosoftUpdate.exe	"Added by the BANKER-EHC TROJAN!"
X	MicrosoftUpdate	windll.exe	"Added by the RBOT-IH WORM!"
X	MicrosoftUpdate	RBuilder.exe	"Added by the DLOADR-BMV TROJAN!"
X	MicrosoftUpdate	svhest.exe	"Added by the RBOT-ES WORM!"
X	MicrosoftUpdate	downnew.exe	"Added by the TANTO-D TROJAN!"
X	MicrosoftUpdates	[path to trojan]	"Added by the DELF-LO TROJAN!"
X	MicrosoftUpdates	syshelped.exe	"Added by the FORBOT-AZ WORM!"
X	MicrosoftValue	syscnfg.exe	"Added by an unidentified VIRUS
X	Microsoftvirus	sysoverload.exe	"Added by the FORBOT-AL WORM!"
X	MicrosoftWindows	[various filenames]	"MagicSearch - a CoolWebSearch parasite variant"
X	Microsoftz turn Control	aexl.exe	"Added by the SDBOT.BCO WORM!"
X	Microsoftz turn Control	read.pif	"Added by the RBOT-AFS WORM!"
X	Microsoft� ActiveX Debugger NT	setdebugnt.exe	"Added by the BANCOS-CZ TROJAN!"
N	Microsoft� Windows� Operating System	"RunDLL32.exe ehuihlp.dll	BootMediaCenter"
N	Microsoft� Windows� Operating System	"rundll32.exe oobefldr.dll	ShowWelcomeCenter"
X	Microsot NT Support	[random filename].exe	"Added by the RBOT-CTI WORM!"
X	Microsotufed Update 32	windinit.exe	"Added by the RBOT-CTJ WORM!"
X	Microszoft Update Mach1nezs	svchst.exe	"Added by the RBOT-ED WORM!"
X	Micrsft Updese	xagwxz.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Micrsoft CFG 32	lrbzus32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Micrsoft DerSystem	uqieelpb.exe	"Added by the RBOT-GRI WORM!"
X	Micsoft-Published-Software	explrer.exe	"Added by the RBOT-GFL WORM!"
X	Micsorosft Security Center	wcnsfty.exe	"Added by the RBOT-AHU WORM!"
?	MigrationVendorSetupCaller	"rundll32.exe migrate.dll	CallVendorSetupDlls"
U	Mindful	Mindful.exe	"Mindful from Felitec inc. ""Event reminder software with date and time tools in a simple to use system tray application"""
X	MINIBUG	MINIBUG.EXE	"Displays ads inside Weatherbug - see here"
N	MiniEYE-MiniREAD Launch	ARLaunch.exe	"eyeQ - improve your reading speed"
X	miniport	usb2chk.exe	"Added by the LAZAR-A TROJAN!"
X	Miosf Update	wimsqaad.exe	"Added by the SDBOT.AG TROJAN!"
X	Mircosoft Update	wuampkd.exe	"Added by a variant of the SDBOT WORM!"
X	Mircrosoft Windows Config DLL	rundllc32b.exe	"Added by the RBOT-ZY WORM!"
X	MistikotitaTuIpologisti	GDC.exe	"MistikotitaTuIpologisti Greek rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
U	ML1HelperStartUp	ML1HEL~1.EXE	"ScreenScenes ""Midnight Lake"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	ML1HelperStartUp	ML1Helper.exe	"ScreenScenes ""Midnight Lake"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
?	MM Install	setup.exe	"Possibly Money Manager from Moneysoft?"
X	MMicrosoft Security Management	inetforn.exe	"Added by the RBOT.AFZ WORM!"
?	MMRun	mmrun.exe	"??"
X	MMSystem	"rundll32.exe mmsystem.dll	RunDll32"
?	mmusrstp	procrun.exe	"??"
X	mmxrun	msosa.exe	Added by an unidentified TROJAN or WORM!
X	mmxrun	mswinindex.exe	"TwoSeven spyware"
?	mnu	igomnu.exe	"Wanadoo broadband ISP (now rebranded as Orange) related. What does it do and is it required?"
N	Mobile Connectivity Suite	Application Launcher.exe	"System Tray access to the HTC Sync mobile phone management utility for models including the Hero
U	Mobile Phone Suite	MobilePhoneSuite.exe	Logitech Mobile Phone Suite
N	MOD	muamgr.exe	"Using MicroAngelo On Display
X	Modem Driverz Updates	mdmdrv.exe	"Added by a variant of the SDBOT WORM!"
N	ModemUtility	mdmsetpe.exe	System Tray configuration icon for Aztech modems
X	Modifiet Amateur HTPB	wuaclt.exe	"Added by the IRCBOT.AYS WORM!"
X	ModularConfig	syscnfg.exe	"Added by an unidentified VIRUS
X	Module Call initialize	"RUNDLL32.EXE reg.dll	ondll_reg"
X	Modulo 00FE0F01 Host Internet	syschost.exe	"Added by the DELF-KW TROJAN!"
X	MonContenuassistant	GDC.exe	"MonContenuassistant French rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
N	MoneyStartUp	Money Startup.exe	Microsoft Money
N	MoneyStartUp10.0	Activation.exe	Part of MS Money 2002. Available via Start -> Programs
X	MONPluginSrIvcs	n3monap23.exe	"Added by a variant of the RBOT WORM!"
N	Monstersoundtray	Freectrl.exe	Diamond Multimedia sound card control panel
X	MoreContent	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MoreResults	MoreResults.exe	"MoreResults adware"
N	Morpheus	morpheus.exe	"MusicCity Networks' Morpheus - another peer-to-peer client based on Kazaa. Notable in that this one doesn't seem to install the adware that clog the Kazaa download. They claim they are adware free
X	MotherBoard Sounds	Sounds.exe	"Added by the RBOT-AAP WORM!"
X	motoin	mm15201518.Stub.exe	"Delfin Promulgate adware variant"
U	Motorola Desktop Suite	DesktopSuite.exe	"Related to Motorola Desktop Suite - PC software managing Motorola mobiles such as the A1000"
U	Motorola Desktop Suite mRouter Config	mRouterConfig.exe	"Configuration for Motorola's version of Intuwave's m-Router - ""that enables easy connectivity between mobile devices and PCs across Bluetooth
U	Mount Safe & Sound	Fbmount.exe	From McAfee VirusScan version 5.x. Creates back-up sets of critical files in a separate area of a hard drive. If you make regular back-ups it's not needed and can be painful during system start
U	mount.exe	mount.exe	"Part of ""GiPo@FileUtilities - GiPo@Mount ""Provides advanced substitutional and mounting services. It allows to attach a local drive to an empty folder on an NTFS volume (only for Windows 2000/XP) and to substitute a local folder for a drive letter"""
X	mouse	mouse.exe	"Added by the RBOT-AHJ WORM!"
U	Mouse 32A	Mouse32A.exe	Mouse utility. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
N	Mouse Suite 98 Daemon	pelmiced.exe	Mouse driver. Appears to cause a behaviour where the desktop suddenly flips back up when playing DirectX associated games
U	Mouse Suite 98 Daemon	ICO.EXE	"Found on some Sony Vaio
X	mousebut	mousebut.exe	"Added by the CRYPTER.A TROJAN!"
X	Mousecntl	mousecntl.exe	"Added by a variant of the CRYPTER.C TROJAN!"
N	MouseCount	MC.exe	"MouseCount by Kittyfeet Software. "Utility for counting how many times us computer junkies click our mouse in a given session/day/week/month/year." Not required"
X	mousedrive.exe	instantmsgrs.exe	"Added by the FORBOT-ER WORM!"
X	MouseDrv	[path to worm]	"Added by the ZOLOAD-B WORM!"
X	MouseDrv	update.exe	"Added by the ZOTOB.N WORM!"
U	mouseElf	MC.exe	"Genius NetScroll mouse driver - required if you use non-standard Windows driver features"
U	mouseElf	mouseElf.exe	System Tray access to the mouse control panel for Genius Netscroll mice. Required if you use non-standard Windows driver features
U	MouseImp	MImpHost.exe	"MouseImp Pro - "A reliable assistant that turns your mouse into a simple
X	mousepad	mousepad.exe	"Added by the CLICKER TROJAN!"
U	MouseWare	Logi_MwX.exe	"Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as ""SmartMove"". If you disable it and find you don't need it leave it disabled"
U	Mousinfo	mousinfo.exe	MS mouse information tool - for troubleshooting mouse problems
X	MoussaEvil	[path to file]	"Added by the MUSANUB-A WORM!"
N	Movielink Manager Uninstall	msvcmm32.exe	"Auto-update for Movielink - internet movie rental System Tray access"
N	Mozilla Quick Launch	Netscp6.exe	Netscape 6 and Mozilla browsers
N	Mozilla Quick Launch	Mozilla.exe	Netscape 6 and Mozilla browsers
N	mozilla_cleanup	xpicleanup.exe	"Firefox Mozilla cleans up after installation. It is invoked on a restart after installation
U	Mozy Status	mozystat.exe	"Mozy - free backup at a secure
X	MP3Collection	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3download	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3files	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3freeDownload	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3freeDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3nice	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3Themes	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	MP3ToTheMax	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	MplSetup	MplSetup.exe	Used by Ricoh network printers to enable network printing from the client
U	MP_STATUS_MONITOR	monitr32.exe	Cannon Multi-Pass status monitor - your choice
X	mqbkup	mqbkup.exe	"Added by the OPASERV.K WORM!"
U	mRouterConfig	mRouterConfig.exe	"Configuration for Intuwave's m-Router - ""that enables easy connectivity between mobile devices and PCs across Bluetooth
U	MRU-Blaster Scheduler	scheduler.exe	"Scheduler for MRU-Blaster - ""a program made to do one large task - detect and clean MRU (most recently used) lists on your computer"""
N	MRU-Blaster Silent Clean	mrublaster.exe	"MRU-Blaster - performs silent cleaning of MRU lists at boot"
U	MRUBlaster	indexcleaner.exe	"MRU-Blaster related - runs once in order to delete the index.dat file in the Temporary Internet Files and/or Cookies folder"
X	MS Auto-IPSec Protection	MSASP32.exe	"Added by the RBOT-AER WORM!"
X	MS Autoloader 32	MSAuto32.exe	"Added by the SPYBOT.BD WORM!"
X	Ms Builders	Wupated.exe	"Added by the AGOBOT-SS WORM!"
X	Ms configsu	msconfigsu.exe	"Added by a variant of the SDBOT WORM!"
X	MS Configuration	MSFramer.exe	"Added by the RANDEX.OL WORM!"
X	Ms Configuration	microsoftsa32.exe	"Added by the KELVIR.X WORM!"
X	MS Configuration Utility	msconfig32.exe	"Added by the WOOTBOT.DY WORM!"
X	MS DirectX Sound Drivers	msdrvdx.exe	"Added by the RBOT.BCX WORM!"
X	MS DVD DirectX Sound Drivers	msdrvdx.exe	"Added by the SDBOT-XJ WORM!"
X	MS Internet Executor 32	MSIXEC32.exe	"Added by the RBOT-AEQ WORM!"
X	Ms Java Update For Windows NT/XP	msijavaupdt32.exe	"Added by the RANDEX.AF WORM!"
X	MS Java virtual machine	javavm.exe	"Added by the RBOT.ABG WORM!"
X	MS lsass Startup	lsass135.exe	"Added by the RBOT.WM WORM!"
X	MS PLUS INC	wpad.exe	"Added by the MYTOB-AN WORM!"
X	MS Remote Procedure Call	msrpc32.exe	"Added by the RBOT-QL WORM!"
X	MS Security	systm.pif	"Added by the RBOT-AQN WORM!"
X	MS Security Authority Service	lsass.exe	"Added by the KALEL-B WORM! Note - this is not the legitimate lsass.exe process
X	MS Security Hotfix	service5.exe	"Added by the GAOBOT.AG WORM!"
X	MS Security Update 993	msident.exe	"Added by a variant of the SDBOT WORM!"
X	MS Sound Config 16bit	sndcfg16.exe	"Added by the SDBOT.MB TROJAN!"
X	Ms Sound Drivers	msdrv.exe	"Added by the SDBOT-WR WORM!"
X	MS Sys Security	mswin.pif	"Added by the RBOT-APJ WORM!"
X	MS System Call Function	msscf32.exe	"Added by the RBOT-GBZ WORM!"
X	MS System Security	mswin32.pif	"Added by the RBOT-AOX WORM!"
X	MS UniX	navupdate64.exe	"Added by the RBOT.CRZ BACKDOOR!"
X	MS Unix Binary	win32ttb.exe	"Added by the SPYBOT.OQ WORM!"
X	MS Unix Binary	msmq2inst.exe	"Added by the RBOT-YF WORM!"
X	MS Unix Binary	msnupdate.exe	"Added by the RBOT-AAM WORM!"
X	MS Unix Binary	outlookexpressupdate.exe	"Added by the RBOT-YU WORM!"
X	MS Unix Binary	Win32Update.exe	"Added by the RBOT-BAS WORM!"
X	MS Unix Binary	Norton2005Update.exe	"Added by a variant of the RBOT WORM!"
X	MS Unix Binary	trmupdate.exe	"Added by the RBOT-ACC WORM!"
X	MS Unix Binary	WinGuard.exe	"Added by the RBOT-ACL WORM!"
X	MS Unix Binary	msnq3insller.exe	"Added by the RBOT.GXH BACKDOOR!"
X	MS Update	syshost.exe	"Added by the EVAMAN-F WORM!"
X	Ms Update WinServices NT/XP	winservnt32.exe	"Added by the VANEBOT-G WORM!"
X	MS UPDATER	update.exe	"Added by the RBOT-VC WORM!"
X	MS Updates	mscache.exe	Spyware web downloader
X	MS Updates	syshosts.exe	"Added by the MYDOOM.Y WORM!"
X	MS Updates	aupd.exe	Spyware web downloader
X	MS Updating Utility	msupdater.exe	"Added by the RBOT-XR WORM!"
X	MS USB 2.0 Windows Support	msusb32.exe	"Added by a variant of the RBOT WORM!"
X	Ms Valud Loader	Svhots.exe	"Added by the AGOBOT-SP WORM!"
X	ms window update	*****.exe [ = random character]	"Added by a variant of the RBOT WORM!"
X	MS Windows Executor Process	MSEXECP32.exe	"Added by a variant of the RBOT WORM!"
X	MS Windows Security Updater	updater.pif	"Added by the RBOT-AKY WORM!"
X	MS Windows Update	scguard.exe	"Added by the RBOT-YZ WORM!"
X	MS-DOS Security Service	ms-dos.pif	"Added by the RBOT-AMR WORM!"
X	MS-RunKey	arr.exe	MS-Connect dialler/hijacker
Y	MSASCui	MSASCui.exe	"Main user interface for Microsoft's Windows Defender on XP/Vista - which ""helps protect your computer against pop-ups
X	MsAudio	explorer.exe	"Added by the LEGMIR-BY TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	MsAudio	"MsVM_STI.EXE RunDll32 cmicnfg.cpl	CMICtrlWnd"
X	MSbackups	backups.exe	"Added by the BANLOAD-TL TROJAN!"
X	mscheck	rundll32.exe wincheck071008.dll mymain	"Added by the AGENT.ADXI TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""wincheck071008.dll"" file is located in %System%"
X	MSChoExE	suge.exe	"Added by a variant of the RBOT WORM!"
X	Mscolour	mscolour.exe	"Added by the GEMA TROJAN!"
X	MSConfig Manager	msupdate.exe	"CoolWebSearch parasite variant"
X	msconfig service	MSupdate32.exe	"Added by a variant of the SPYBOT WORM!"
X	msconfig.exe	uline.exe	Added by a variant of the AGENT.AH downloader TROJAN!
X	MSConfigs	RUNDLL64.dll.vbs	"Added by the WEKODE-B WORM!"
X	msconfigurator	ctfsdk.exe	"Added by the DELF-ALS TROJAN!"
?	MSCRMStartup	Microsoft.Crm.Application.Hoster.exe	"Related to Microsoft Dynamics CRM integrated solutions for Financial
X	MSDOS Security Service	msdos.pif	"Added by the RBOT-AMP WORM!"
X	MSDrive	rundll32.exe drvkoc.dll	"Added by a variant of the OP DIALER! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""drvmod.dll"" file is found in %System%"
X	MSDrive	rundll32.exe drvmod.dll	"Added by a variant of the OP DIALER! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""drvmod.dll"" file is found in %System%"
X	MSDrive	rundll32.exe drvsoh.dll	"Added by a variant of the OP DIALER! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""drvmod.dll"" file is found in %System%"
X	Msemu32	Msemu32.exe	Unidentified spyware/adware/hijacker
X	msennger	ournik.com	"Added by the IRCFLOOD.AL BACKDOOR!"
X	MSFTP Service Config	r3grun.exe	"Added by a variant of the SDBOT WORM!"
X	msgina	wuauclt2.exe	"Added by the IYUS-H TROJAN!"
X	MSI Configuration	msiconf.exe	"Added by the AGENT.AKSZ TROJAN!"
X	msliveupdate	msliveupdate.exe	"Added by the AGOBOT.ALT WORM!"
X	msmautoprotect	msmssgs.exe	"Added by the BIFROSE-AJ TROJAN!"
X	MSMessnger	msnupd.exe	"Added by the RBOT-ADY WORM!"
X	MSN	iTuneshelp.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Msn	"rundll32.exe ilss32.dll	network"
X	MSN 9.0 Plus	[random letters].exe	"Added by the RBOT-ALY WORM!"
X	MSN Auto-Updater	msnaupdater.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	MSN Auto-Updater	msnupdates.exe	"Added by the AUTORUN.WORM.GEN WORM!"
X	MSN Communication Manager	msncommgr.exe	"Added by an unidentified WORM or TROJAN! See here"
X	MSN Configuration	msnconfig.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Msn Configuration Loader	msngms.exe	"Added by the KELVIR.T WORM!"
X	MSN Configuration Loader	msmsncfg.exe	"Added by the AGOBOT-KX BACKDOOR!"
X	MSN Debug Mgr	msndebugs.exe	"Added by a variant of the IRCBOT TROJAN!"
X	MSN File Configuration	msnfilecfg.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	MSN File Sharing	msnusr.exe	"Added by the SLENFBOT.AM WORM!"
X	MSN File Sharing!	msnuser.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	MSN Funny Images	imsngsr.exe	"Added by the AGOBOT-TT WORM!"
X	MSN Manager	usnmsn.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Msn Message Acount Helper 7.7	msnmessage7.7.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	MSN Message Background loader	[path to worm]	"Added by the RBOT-AIE WORM!"
X	MSN Messenger 32	msniu.exe	"Added by the RBOT-AWB WORM!"
X	MSN Messenger 323	msniu3.exe	"Added by the RBOT-AXB WORM!"
X	MSN Messenger Service Startup	msnservice.exe	"Added by a variant of the RBOT WORM! See here"
X	Msn Messenger Update	msnupdate.exe	"Added by a variant of the RBOT WORM!"
X	Msn Messenger update	msnservice.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	MSN Messenger User Controls	msmsgr.exe	"Added by the KELVIR.HI WORM!"
X	MSN Messengger	MsRun32.exe	"Added by the IMAUT.CO WORM!"
X	Msn Plus Updater	msnplus.exe	"Added by the RBOT-MU WORM!"
X	MSN Popup Blocker	msnpopblck.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
N	MSN Quick View	Msndc.exe	Quick way to connect to MSN internet service
X	MSN Router	msnrouter.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	MSN Security Agent	msnsecure.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	MSN Service Updates	winproc.exe	"Added by the KELVIR-BB WORM!"
X	MSN Service Utilities	nkn.exe	"Added by the KELVIR-BC WORM!"
X	MSN Setup	MSN.msn	"Added by the JAMBU WORM!"
X	Msn Startup	msnstartup.exe	"Added by the ARBOT.AA WORM!"
X	MSN Update	mscon.exe	"Added by the RBOT-QA WORM!"
X	MSN Update	msn32.exe	"Added by the RBOT.AHN WORM!"
X	MSN Update	DLLCON.EXE	"Added by the RBOT-EA WORM!"
X	MSN Update Cfg	msnupdbt.exe	"Added by an unidentified WORM or TROJAN! See here"
X	MSN Update Client	msnupdater.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	MSN Update Client	msnupdcli.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Msn Update Manager (Sp2)	MSMSGS.EXE	"Added by the AGOBOT-NL WORM! Note - this particular msmsgs.exe file is located in %System% and should not be mistaken for the MSN Messenger file of the same name which is located in %Program Files%\Messenger"
X	Msn Update Service	userx.exe	"Added by the MYTOB.JF WORM!"
X	MSN Update Service	msnupdsv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Msn Update SUPPORT	[random filename]	"Added by the RBOT-BPS WORM!"
X	MSN Updater	msnms.exe	"Added by the FORBOT-CG WORM!"
X	Msn Updater	msnplugins.exe	"Added by the RBOT-HS WORM!"
X	Msn Updater	windatemanager.exe	"Added by the SDBOT.TS WORM!"
X	MSN UPDATERS	virtualmemory.exe	"Added by the RBOT-JK WORM!"
X	MSN Updating	msnupdate.exe	"Added by the QHOST.AEI TROJAN!"
X	msn upddate	mesenger.exe	"Added by the RBOT-AVZ WORM!"
X	MSN User	mymsnusr.exe	"Added by the IRCBOT.AVD BACKDOOR!"
X	MSN User Server	msnserver.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	MSN User Server!	msnservices.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	MSN User Service	msnsvc.exe	"Added by the SLENFBOT.NS WORM!"
X	MSN User Service!	msnserv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	MSN User Services	msnuserv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	MSN User Svc	msnusnsvc.exe	"Added by the IRCBOT.AVV BACKDOOR!"
N	MSN Webcam Recorder	ml20gui.exe	"""MSN Webcam Recorder is a tool that allows you to record video streamed to and from your computer by MSN Messenger's Webcam Feature"""
X	MSN6.1 Auto-Updater	v6msn.exe	"Added by the AUTORUN-MM WORM!"
X	MSN8m Startup	msn8m.exe	"Added by a variant of the RBOT WORM!"
N	msnappau	msnappau.exe	"Updater for the MSN toolbar that can be downloaded onto IE. Calls home every day or so to ""update"" the toolbar"
X	MSNPluginSrIvcs	n3vasap23.exe	"Added by a variant of the RBOT WORM!"
X	MSNPluginSrvcs	p6.exe	"Added by the SDBOT.AKJ or RBOT-VJ WORMS!"
X	MSNPluginSrvcs	sagate.exe	"Added by the SDBOT.AKJ WORM!"
X	MSNPlus	msnplus.exe	"Added by the BANKER-DAN TROJAN!"
X	MSNS PLUS XP2	msdupd.exe	"Added by the RBOT-BCE WORM!"
X	msnupdt	kolie.exe	"Added by a variant of the RBOT WORM!"
X	msoft-updater23	mssysstems.exe	"Added by the RBOT-ATU WORM!"
X	msoft-updater23	slssystem.exe	"Added by the RBOT-ASR WORM!"
X	msoupdater	msoupdater.exe	"Added by the DLOADER.GBD TROJAN!"
X	MSPluginSrvc	p3.exe	"Added by the RBOT-WV WORM!"
X	MSPLUS	msplus32.exe	"Added by the MYTOB-AM or MYTOB-CL WORMS!"
X	MSPP System Update 64	wiaadmgr.exe	"Detected by Kaspersky as the RANKY.GEN TROJAN!"
U	mspwr	pupstman.exe	"""Transparent icon background"" feature of Ashampoo'sPowerUp XP (WinNT/2K/XP) and PowerUp Deluxe (Win98/Me)"
U	mspwr	pupxpman.exe	"Related to Ashampoo's PowerUp XP"
U	mspwr	pwrupst.exe	"Ashampoo's PowerUp XP is a ""tool for fine-tuning your Windows NT4
U	mspwr	PuXpMan2.exe	"System Tray access to the Ashampoo® PowerUp XP Platinum 2 tweaking utility from Ashampoo GmbH & Co. KG - which includes (amongst others) one-click tuning
X	msrundll	msrund1l32.exe	"Added by the BINGHE TROJAN!"
X	msrunocx32	msrunocx32.exe	"Added by the SKUS WORM!"
X	mssaru	mssaru.exe	"Added by the AGENT.AM TROJAN! Note - example names include ""XviD""
X	mssdbsrv	msupdtck.exe	Added by a variant of a password stealing TROJAN!
X	MsServer	msfun80.exe	"Added by the VB-CYG WORM!"
X	MSServer	"Rundll32.exe [random].dll	#1"
X	mssonfig	winupdate.exe	"Added by a variant of the SDBOT WORM!"
X	mssoul	msmscc2.exe	"Added by the DAPIZL.A banker WORM! (A ""banker worm"" is designed to pillage banking information and send it back to the perpetrators!)"
X	mssoul	msmscc.exe	"Added by the BANCOS.HKT TROJAN!"
X	MSStartOptimizer	WINUPD.EXE	"Added by the DASMIN-E TROJAN!"
X	mssurfer lptt01	mssurfer.exe	"RapidBlaster variant (in a ""surfer"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	mssurfer ml097e	mssurfer.exe	"RapidBlaster variant (in a ""surfer"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	MSTask	run dll.exe	"Yuupsearch adware"
X	MSTray	rundll.exe	"Added by the BAMER-B TROJAN! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	msupd	msupd.exe	"Added by the IEACCESS DIALER!"
X	MSUpdate	wupd.exe	"Added by the ALADINZ.M TROJAN!"
X	MSUpdate	svchosthlp.exe	"Added by the BLASTER.T WORM!"
X	msupdate	msupdate.exe	"Added by the RBOT-MZ WORM!"
X	MSUpdate	criticalUpdate.exe	"Affilred adware"
X	msupdate	update.exe	"Added by a variant of the SDBOT WORM!"
X	Msupdate	expIorer.exe	"Added by the TACTSLAY.A TROJAN!"
X	Msupdate	outIook.exe	"Added by the TACTSLAY.A TROJAN!"
X	Msupdate	svchosts.exe	"Added by a variant of the TACTSLAY TROJAN!"
X	Msupdate	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	Msupdate	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	MSupdate.exe	N/A	"CoolWebSearch parasite variant - resets home page to an adult content site"
X	MSUpdateDevKit	axfd.exe	"Added by the SDBOT-ZD WORM!"
X	msupdater	msupdater.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X	MsUpdater System	udpsys32.exe	"Added by the RBOT.AAA WORM!"
X	MSupdater.exe	N/A	"CoolWebSearch parasite variant. Installs the Winshow.dll browser plugin"
X	msupdater25	lsasser.exe	"Added by the RBOT-ATS WORM!"
X	msupdates	msupdt.exe	"Added by the RBOT-JO WORM!"
X	MSUpdSrv	msupdsrv.exe	"Browser hijacker
X	msupdtwiz	msupdtwiz.exe	"Added by the STRATION.DD WORM!"
X	msurl	msurl32.exe	"Added by the CRYPTER.A TROJAN!"
X	msuser32.exe	msuser32.exe	"Added by the ANDROV TROJAN!"
X	msvecurity	msvecurity.exe	"Added by the DORF-BO WORM!"
X	MSVersion	INTERNETFEATURES.exe	"Added by the POPMON.A TROJAN! - also known as PopMonster adware"
X	msvupdater	msvupdater.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X	MSWindowsUpdate	Systern.exe	"Added by the RBOT-AFD WORM!"
X	MSWindowsUpdate	mswinup.exe	"Added by a variant of the SDBOT WORM!"
X	MSWinupd	winupd.exe	"Added by the DLOADER-YE or DLOADR-AAA or DLOADER-ZF TROJANS - and others"
X	MSWinupdate	winupdate.exe	"Added by the DLOADR-AAW TROJAN!"
X	mswspl	plugin1.exe	"Added by the SMALL.IQ TROJAN!"
X	MSWUpdate	[path to worm]	"Added by the SILLYFD-V WORM! The most common filename is lsass.exe but it not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	MSxmlHpr	"RUNDLL32.EXE [path] msxm192z.dll	w"
X	Msy Startups	msyh32.exe	"Added by the AGOBOT-QC WORM!"
X	Msy1 Startups	msyj32.exe	"Added by the AGOBOT-QQ WORM!"
X	MS_SETUP.EXE	MS_SETUP.EXE	"Added by the CHARGE TROJAN!"
X	MS_Update Check	wdfmgr.exe	"Added by the AGOBOT-TB WORM!"
X	MS_update_0704_KB74073.exe	MS_update_0704_KB74073.exe	"Added by a variant of the UPDATEKB TROJAN!"
?	MtdAcqu	MtdAcqu.exe	"Metadata monitor part of Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly."" Collects information on the songs. Is it required?"
U	MUAL	mual.exe	Millesky video mail updater and launcher
N	muamgr	muamgr.exe	"Using MicroAngelo On Display
X	muBlinder	muBlinder.exe	Program that bypasses Microsoft Update's Genuine Windows Validation
?	Mufix	mufix.exe	"Part of INFOConnect
X	mule_st_key	flec006.exe	"Added by the BAGLE.AV TROJAN!"
U	Multi-function keyboard	GWHotkey.exe	"Software that sets up the Gateway AnyKey keyboard shortcuts (a series of buttons that allow one-click access to e-mail
U	MultiCAM Initializer	MCamBoot.exe	"The MultiCAM Initializer is part of the MultiCAM software package provided by Vista Imaging in order to run up to 10 USB ViCAM or 3Com Home Connect PC Digital cameras on a single computer. Clears itself from memory once initialized but can also be safely disabled"
X	Multimedia	windebug.exe	"Added by the VB-ERB WORM!"
X	Multimedia Codecs	mcc.exe	"Added by the DLOADER-MB TROJAN!"
X	Multimedia extensions	mservice.exe	"EasySearch adware"
X	Multimedia extensions	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Multimedia extensions	mservice1.exe	"Added by the DLOADR-AWD TROJAN!"
U	Multimedia KBD	MMKeybd.exe	Multimedia keyboard manager. Required if you use the additional keys
U	MULTIMEDIA KEYBOARD	MMKeybd.exe	Multimedia keyboard manager. Required if you use the additional keys
X	MULTIMEDIA KEYBOARD88	smss.exe	"Added by the SILLYFDC WORM! Note - this is not the legitimate smss.exe process which should not normally figure in Msconfig/Startup!"
X	multiran	multiran.exe	"Added by the COSIAM-E TROJAN!"
U	MultiRes	MultiRes.exe	"MultiRes - system tray utility allowing quick access to changing desktop resolutions and has the ability to lock the screen refresh rate in WinNT/2K/XP"
N	mumservice	mumservice.exe	"Software updater for Motorola products"