NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

• "Y" - Normally leave to run at start-up
• "N" - Not required - typically infrequently used tasks that can be started manually if necessary
• "U" - User's choice - depends whether a user deems it necessary
• "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
• "?" - Unknown

	Startup Name	Process Name	Details
X	$WindowsRegKey%update	IEXPLORE.EXE	"Added by the RBOT-EZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	(Default)	QQUpdate.exe	"Added by the QUADRULE.A WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	msnupdate.exe	"Added by the RBOT-GWT BACKDOOR! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run & HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	*Microsoft Update	ctxma.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	cxma.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wstcl.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wucxt.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wuytc.exe	"Added by the STMU TROJAN!"
X	*windows update	wrauclt.exe	"Added by the RBOT-QU WORM!"
X	*windows update	wuanclt.exe	"Added by the RBOT-PG WORM!"
X	*windows update	wuaucrlt.exe	"Added by the SPYBOT.HUR WORM!"
X	*windows update	wuraclt.exe	"Added by the RBOT-PO WORM!"
X	*windows update	wurauclt.exe	"Added by the RBOT-SY WORM!"
X	*windows update	wsctl.exe	"Added by the SPYBOT.PR WORM!"
X	*windows update	wkmst.exe	"Added by the SDBOT.AVD WORM!"
X	*windows update	wscxt.exe	"Added by the RBOT.AOS WORM!"
X	*windows update	waurclt.exe	"Added by a variant of the RBOT WORM!"
X	*windows update	wuaruclt.exe	"Added by the RBOT-TF WORM!"
X	.msfupdate	msveup.exe	"Added by the ALLOCUP.A WORM!"
X	3.8853E+11	AutomaticUpdates.exe	"Added by the SDBOT-DEN WORM!"
X	A New Windows Updater	w32NTupdt.exe	"Added by the MYTOB.BM WORM!"
X	aa bbcc dde effgghh jj	update.exe	"Added by a variant of the IRCBOT BACKDOOR!"
?	aauclient	ACNUpdater.exe	"Appears to be related to software from Accenture.com"
N	AceGain LiveUpdate	LiveUpdate.exe	"""AceGain LiveUpdate can help to automate and optimize product updates. AceGain LiveUpdate will automatically detect new patch updates
X	Acroread	GoogleUpdate.exe	"Added by the AGENT-JGI TROJAN! Note - this is not the valid Google program which is normally located in %AppData%\Google\Update. This version resides in %Temp%"
X	ActiveXUpdate	svcss.exe	"Added by a variant of the DEDLER.C TROJAN!"
N	AdobeUpdater	AdobeUpdater.exe	Automatic updater for Adobe software - run manually
X	AdRoarUpdate	ARUpdate.exe	"AdRoar adware updater"
X	AdUpdater	sysupudt.exe	Unidentified adware downloader/updater
X	amsgupdate	ams.exe	Added by a variant of the MAILBOT TROJAN!
X	Anti-Virus Update Scheduler	[path to trojan]	"Added by the SPAMMIT-A TROJAN!"
X	Anti-Virus Update Scheduler	winsp3.exe	"Malware - detected by Kaspersky as the AGENT.FP TROJAN!"
X	Anti-Virus Update Scheduler V1.39.12R	[path to trojan]	"Added by the HEPLANE or STAPREW.B TROJANS! - different filenames have been spotted; examples: msvc.exe
X	AntiVirus Update	updates.exe	"Added by the RBOT-JF WORM!"
X	AntiVirus Update	antivirus.exe	"Added by the RBOT-IF WORM!"
X	Antivirus Updates	avupdchk.exe	"Added by the AGOBOT-IP WORM!"
X	aolupdater.exe	aolupdater.exe	"Added by a variant of the IRCBOT TROJAN!"
X	asrupdate.exe	asrupdate.exe	"Added by the VB.ATZ TROJAN!"
N	ASUS Live Update	ALU.exe	ASUS Live Update utility for their motherboards
X	atiupdate	ATIUPDATE5.EXE	"Added by the DEBESKI.A TROJAN!"
X	atiupdate	msshed32.exe	Added by the DELF.EP downloader TROJAN!
X	ATIUpdater	atiupdxx.exe	"Added by the RBOT-ABX WORM!"
U	ATTBroadbandUpdate	SAUpdate.exe	"Big Brother from Quest Software. System and network monitor"
U	ATTRedUpdate	AutoUpdate.exe	Additional item added to start-ups after AT&T took over the now bankrupt Excite@home high-speed internet service. Included for automatically downloading and installing updates. Leave it unless you plan to regularly run it to check for updates
X	AttuneContentUpdater	attune_cu.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	Auto Update	AUP.exe	Added by an unididentified WORM or TROJAN!
X	Auto Update	dma.exe	"Added by the RBOT-AVO WORM!"
X	Auto Update	svchost.exe	"Added by the DUMARDI-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Auto Updater	asclt.exe	"Added by the SLINBOT.CJ BACKDOOR!"
X	Auto Updates	svchost.exe	"Added by the CHEUKO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Auto WinUpdate	taskmrg.exe	"Added by the RBOT-AFA WORM!"
X	autoload	windowsupdate.exe	"Added by the POLYCRYP.DY TROJAN!"
X	AutoLoaderEnvoloAutoUpdater	auto_update_loader.exe	"Envolo/AproposMedia adware updater"
X	Automated Windows Updates	wauclt.exe	"Added by the GAOBOT.AJD WORM!"
X	Automatic Media Update	CACHE.RVD	Added by an unidentified WORM/TROJAN!
X	Automatic Media Update	HPLNT32.RVD	Added by an unidentified WORM/TROJAN!
X	Automatic Microsoft Windows Updater	suchost.exe	"Added by the RBOT-EQ WORM!"
X	Automatic Updates	algs.exe	"Added by the IRCBOT-AAM TROJAN!"
X	Automatic Windows Updater	Update.exe	"Added by the GAOBOT.AO WORM!"
X	autoupdate	"rundll32 DATADX.DLL	SHStart"
X	autoupdate	"rundll32 SUPDATE.DLL	SHStart"
X	AutoUpdate	smss.exe	"Added by WINSPY.88! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\debug64"
X	Autoupdate Service	kaka.exe	"Added by the SYMPE-B TROJAN!"
X	Autoupdate Service	[path to trojan]	"Added by the AGENT-CB TROJAN!"
X	AutoUpdate32	services.exe	"Added by WINSPY.88! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\debug64"
X	AutoUpdater	aupdate.exe	"Tinybar variant"
X	AutoUpdater	AutoUpdate.exe	"PeopleonPage foistware"
X	autoupdatev2	[path to file]	"Added by the DROPPER-BM TROJAN!"
X	autoupdatev2	autoupdatev2.exe	"Detected by Kaspersky as the AGENT.FQ TROJAN!"
X	AV	UPDATE-28062004.exe[25 blank spaces].vbs	"Added by the MIDFIN WORM!"
X	AV UpDate	Update.exe	"Added by the FUROOT-A TROJAN!"
X	AVG AntiVirus Updater	avgwusv.exe	"Added by the SILLYFDC.BAX WORM! Note - this is not a legitimare AVG entry"
X	AVG Grisoft Updater	updater.exe	"Added by the AGOBOT-OT WORM!"
X	AVupdate32 Update	AVupdate32.exe	"Added by the RBOT.CNI TROJAN!"
X	b3dUpdate	Zupdate.exe	"Associated with B3d Projector foistware - see here"
X	Back Updates	Uninstall.log.vbs	"Added by the YPSAN.D WORM!"
U	Bayswap2	TbUpdate.exe	Hot-swappable drive management on Compaq Notebooks which allows you to swap drives without closing down Windows. Only required if you frequently swap bay devices
X	Beegees Update	beegees.exe	"Added by the SDBOT-ADK WORM!"
N	BlackBerryAutoUpdate	RIMAutoUpdate.exe	"Automatic updates for BlackBerry smartphones
X	blah service	winupdate.exe	"Added by the GAOBOT.BIA WORM!"
N	BMupdate	BMupdate.exe	"Related to the BookmarkCentral entry. Typically added after downloading drivers for Visioneer scanners for example
X	Bouncer RunStartup	LiveUpdate.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
X	BrowserUpdateSched	[random filename]	"ZenoSearch adware"
U	BullGuard Update	avxlive.exe	"Part of Bullguard antivirus. Leave enabled unless you manually update virus definitions"
X	ccUpdate	ccUpdate.exe	"Added by the AGOBOT.YS WORM!"
X	cftmon	WindowsUpdate.exe	"Added by the AGENT.AQK BACKDOOR!"
N	Check for One Touch Update	wiseupdt.exe	Checks for updates for Visioneer OneTouch scanners
N	Check for TWS Updates	WiseUpdt.exe	Interactive Brokers - check for update to their standalone Java-based trading platform
N	CheckCustomWorksUpdate	CheckCWupdate.exe	"Update checker
U	ClauerUpdate	ClUpdate.exe	"Automatic updates for the software supporting the Clau-ACCV and Clauer-idCAT digital certificate USB keys"
N	Client Access Help Update	cwbinhlp.exe	"Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
X	Client Update	wup.exe	"Added by the OPANKI.O WORM!"
U	ClUpdate	ClUpdate.exe	"Automatic updates for the software supporting the Clau-ACCV and Clauer-idCAT digital certificate USB keys"
X	Config	TaskUpdate.exe	"Added by the MDROP-BRO TROJAN!"
X	Configuration Loaded	wupdated.exe	"Added by the MOEGA or MOEGA.AG or MOEGA.AP WORMS!"
X	Configuration Loader	svupdate.exe	"Added by the RANDEX.DXP WORM!"
X	Configuration Loader	update.exe	"Added by the SDBOT-OS WORM!"
X	Configuration Update	UPDT32V2.EXE	"Added by the SPYBOT-AA BACKDOOR!"
N	CONNECTAuto Update	CONNECTScheduler.exe	"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
X	Corporate Microsoft Update	uptask.exe	"Added by the RBOT-GVB WORM!"
N	Creative Software Update	AutoUpdate.exe	Auto-updater for Creative Labs software
X	Critical Update Check	battlenet.exe	"Added by the DELF-LB TROJAN!"
N	CriticalUpdate	Wucrtupd.exe	"MS Windows Critical Update Notification. If you want to keep Windows up-to-date
X	CriticalUpdate	wucrtupd.exe	"Added by the NOALA.B WORM! Note - this file is located in the Windows or Winnt folder
X	CS Update	copy /Y [path] ActivationManager.dll.upd [path] ActivationManager.dll	Added by an unidentified malware
X	csm Win Updates	csm.exe	"Added by the ZOTOB.B WORM!"
X	ctfmon.exe	msupdate32.exe	"Spy Sheriff/SpywareNO malware
X	CTUpdate	ctupdclt.exe	"Added by the RBOT-ABG WORM!"
U	cwupdate	cwupdate.exe	"ContentProtect from ContentWatch - internet filter"
X	CydoorUpdate	CD_Load.exe	"Adware. Check here for information about Cy-Door and here for a program that can remove it"
X	d3dupdate.exe	bbeagle.exe	"Added by the BEAGLE.A WORM!"
X	DAupdate	DAupdate.exe	NavEnhance adware
X	DealHelperUpdate	DHUpdt.exe	"DealHelper adware"
X	DeskMateAutoUpdate	DeskMateAutoUpdate.exe	"DeskMates: Virtual scantily clad girls enhance your desktop. BargainBuddy adware related"
X	DesktopUpdate	"rundll32.exe MSA64CHK.dll	DllMostrar"
Y	Digital Patrol Update 5	update.exe	"Digital Patrol - ""a powerful anti trojan scanner
U	Direct Update	DUControl.exe	"DirectUpdate dynamic DNS updater"
U	DiscUpdateManager	DiscUpdMgr.exe	"Disc Update Manager for Digital interactive's DISCover Console. Provider of on-demand video games"
N	DiscUpdateManager	DiscUpdateMgr.exe	"DISCover from Digital Interactive Systems Corporation Inc. ""The company's patented Drop 'n' Play technology provides a simple
X	DivX Updater	DivX.Exe	"Added by the NALDEM TROJAN or MASTAK VIRUS!"
X	DLLUPDATE32	dllupdate32.exe	"Added by the AGOBOT.IA WORM!"
Y	DPASUpdate	DPASAutoUpdate.exe	"Automatic updates for DefenderPro AntiSpy spyware remover - now incorporated Defender Pro 15-in-1 and 5-in-1"
X	DRam prosessor	WindowsUpdate.exe	"Added by the RBOT-BBZ WORM!"
X	DRam prosessor	msupdate.exe	"Added by the DELF-FAW TROJAN!"
X	DRam rar proc	winupdaterar.exe	"Added by a variant of the IRCBOT TROJAN!"
X	DRam rare proc	updaterarwin.exe	"Added by the RBOT-GQW WORM!"
X	Dxupdate.exe	Dxupdate.exe	"Added by the MAFEG WORM!"
U	DynDNS Updater	DynDNS.exe	"Dynamic DNS IP address updater tool
N	DynDNS-Updater Traytool	ddutray.exe	"DynDNS updater tray icon - allows easy configuration of the Dynamic DNSSM service. Can be run manually"
U	eanth_critical_update_alert	sys_alert.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
U	eanth_critical_update_alert	EANTHO~1.EXE	"eAcceleration Stop-Sign security software related - previously not recommended (see here). It has now been delisted
X	EasySearchBar	ESBUpdate.exe	EasySearchBar adware downloader
N	EgisTecLiveUpdate	EgisUpdate.exe	"Software updater for biometric and data encryption products from EgisTec Inc"
U	EMBASSY Trust Suite Secure Update	AutoUpdate.exe	"Updates for Wave Systems Corp. Embassy Trust Suite - ""delivers advanced levels of security to the client PC using the TPM security chip found on most enterprise PCs today"""
U	eScan Updater	Trayicos.exe	"MicroWorld eScan antivirus updater - allows users to automatically download updates and set the auto time interval for downloads"
X	ewupdater	ewupdater.exe	"EasyWebSearch adware updater"
X	Explorer Updater	IEXPLORE.exe	"Added by the SDBOT-WO WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
N	filehippo.com	UpdateChecker.exe	"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
N	FileHippo.com Update Checker	UpdateChecker.exe	"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
X	FireExplore Update	FireExplore.exe	"Added by a variant of the RBOT WORM!"
X	Firewall	SP2 UPDATE.exe	"Added by the ELITPER.E WORM!"
X	Firewall Update System1	WinedowsUpdater1.exe	"Added by the RBOT-ARU WORM!"
X	Firewall Updater	msnupdateit.exe	"Added by the RBOT-AAQ WORM!"
U	Google IME Autoupdater	GooglePinyinDaemon.exe	"Google Pinyin Input Method Editor (IME) - allows a user to input Chinese characters by entering the pinyin of a Chinese character (with or without tone
N	Google Update	GoogleUpdate.exe	"Update manager for the range of tools available from Google - such as the Chrome web browser and Picasa photo manager. Located in %AppData%\Google\Update"
X	Google Update	GoogleUpdate.exe	"Added by the BUZUS.DBFM TROJAN! Note - this is not the valid Google program which is normally located in %AppData%\Google\Update. This version resides in %System%"
N	Google Updater	GOOGLE~1.EXE	"Downloads and installs updates for Google applications (Google Earth
N	Google Updater	GoogleUpdater.exe	"Downloads and installs updates for Google applications (Google Earth
X	GoogleUpdater3	GoogleMapper.exe	"Added by the ROUTROBOT WORM!"
X	gotnewupdate000.exe	gotnewupdate000.exe	"Added by the FAKEAV-BGA TROJAN!"
X	GP Updater	gpupdater.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Graphic Update	openglx.exe	"Added by the IRCBOT.AMU WORM!"
X	GreasyPalmUpdate	GreasyPalmUpdate.exe	"SearchFast adware"
X	HanUpdate	hanz.exe	"Added by the RBOT-GLJ WORM!"
X	HKLMRun	windowsupdate.exe	"Added by the FORBOT-BJ WORM (where HKLM\Run represents HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run)!"
N	HP software update	HPWuSchd2.exe	HP software updates. If a shortcut doesn't exist create your own and run it manually
N	HP software update	HPWuSchd.exe	"HP software updates. If a shortcut doesn't exist
X	HP Update Assistant	HPAware.exe	Added by the MRO TROJAN!
N	HP Updates	??	"On HP PCs
X	IcqBeta	webcamupdate.exe	Added by an unidentified TROJAN!
X	IE Java Update	iejava.exe	"Added by the AGENT-HD TROJAN!"
X	IEAgent update check	iewatch.exe	"Added by the BOMKA TROJAN!"
X	IEexplorer AUpdate	IEexplore32.exe	"Added by the RBOT-GRE WORM!"
X	ieupdate	MCP****.exe [**** = random char]	"Added by the ASOXY TROJAN!"
X	ieupdate	mcpdll32.exe	Adware downloader trojan
X	ieupdate	[random filename]	"Added by the AGENT-C BACKDOOR!"
X	ieupdates	ieupdates.exe	"Added by a number of TROJANS such as DWNLDR-HGI and AGENT-HGA and the Antivirus 2009 rogue security software - see here"
N	Imesh Auto Update	??	"Update check for the Imesh file sharing system. Turn the update off under ""options"""
X	Information Update	iu.exe	"Detected by Kaspersky as the CENTIM.CH TROJAN!"
X	Install part II	updates.exe	"Added by the RELFEERWORM!"
N	Instant Update Center	reminder.exe	"Event reminder for calendar dates
X	Intec Services Drivers	msupdate22e.exe	"Added by the RBOT-CGC WORM!"
X	Internet Explorer Auto-Update	updt32v5.exe	"Added by the SPYBOT-AB BACKDOOR!"
X	Internet Explorer Updater	lexbac.exe	"Added by the DOWNLOAD TROJAN!"
X	Internet Explorer Updater	iexplorer.exe	"Added by the REUR.B WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	InternetGetConnectedState	winupdate.exe	"Added by the SDBOT-JN WORM!"
X	InternetGetConnectedStateEx	winupdate.exe	"Added by the SDBOT-JN WORM!"
X	IPSEC Configuration	wsupdate.exe	"Added by the AGOBOT-IQ WORM!"
N	iRiver Updater	Updater.exe	"Updates for the iRiver Music Manager - used with their digital music players"
N	ISSI EZUpdate Service	issimsvc.exe	Part of IBM Global Services - used internally by IBM for automatic updating of software and Microsoft patching
X	Java Auto Update	ujm.exe	"Added by the SDBOT-ADH WORM!"
X	Java update	javaqs.exe	"Added by the SWARLEY.A WORM!"
X	Java Update	keeper.exe	"Added by the AGENT-DIS TROJAN!"
X	Java Update	svchost.exe.exe	"Added by the AGENT-LBS TROJAN!"
X	Java Update	hostwww.exe.exe	"Added by the AGENT-MFH TROJAN!"
N	Java(TM) Platform SE Auto Updater 2 0	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
X	JavaUpdate0.07	[filename]	"Added by the JUPDATE TROJAN!"
X	JavaUpdateSched	jusched32.exe	"Added by the BCKDR-CKB BACKDOOR!"
X	Kazaa Download Accelerator Updater (required)	regsvr32 kdp****.dll [* = random char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	Kernel	Update.exe	"Added by the DELF-FN TROJAN!"
N	Kodak Software Updater	backweb*****.exe	"Software updater for Kodak Easyshare digital cameras"
N	KODAK Software Updater	Kodak Software Updater.exe	"Software updater for Kodak Easyshare digital cameras"
N	LG Intelligent Update	autoupdate.exe	"Automatic update utility for LG Notebooks"
U	LGODDFU	fwupdate.exe	Auto firmware update program for LG Electronics CD-ROM/DVD writer
X	Life FireWall Update1	FireWall-Update1.exe	"Added by the RBOT-ARS WORM!"
X	Live update monitor	srvany32.exe	"Added by the AGOBOT.AFM WORM!"
X	live update monitor	umxlu32.exe	"Added by the AGOBOT.ADK WORM!"
U	LiveUpdate	LiveUpdate.exe	"Web-update utility as used by various types of software - see here"
X	LiveUpdate	[Windows username]05.exe	"Added by the LINEAGE TROJAN!"
X	LiveUpdate	smss.exe	"Added by the VB.BAU BACKDOOR! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\isas"
N	LiveUpdate	Copyer.exe	"Samsung PC Studio is a Windows-based PC program package that you can use easily to manage personal data and multimedia files by connecting a Samsung Electronics Mobile phone (GSM/GPRS/UMTS) to your PC. You can launch the update manually - see the instructions
X	LiveUpdate32	services.exe	"Added by the VB.BAU BACKDOOR! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\isas"
X	lnternet Update	lExplore.exe	"Added by the RBOT-GRH WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
N	LogitechSoftwareUpdate	ManifestEngine.exe	"Automatic updater for versions of Logitech QuickCam webcam software. Check for updates via the System Tray icon - see the LogitechVideoTray entry"
X	lsass2k Update	lsass2k.exe	"Added by a variant of the RBOT WORM!"
X	LTM2	winupdate.exe	"Added by the LITMUS.203 TROJAN!"
X	LzioMediaUpdater	LzioMediaUpdater.exe	"LZIO.com adware downloader"
X	M1cr0s0ft Upd4t4zS	update32.exe	"Added by the RBOT-MI WORM!"
X	Machine Update Soft	wusas.exe	Added by an unidfentified WORM!
X	Macromedia Critical Updater	rarww.exe	"Added by a variant of the RBOT WORM!"
X	Macromedia Flash Update	scvhost.exe	"Added by a variant of the RBOT WORM!"
N	Macrovision Update Service	issch.exe	"InstallShield is used by a number of software producers to install their programs and manage software updates. This entry runs scheduled searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis"
N	Macrovision Update Service	ISUSPM.exe	"InstallShield is used by a number of software producers to install their programs and manage software updates. This entry searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis"
X	Mascro soft SDK updates2	SDKrepair2.exe	"Added by the SDBOT.BXM WORM!"
Y	McAfee SecurityCenter	McUpdate.exe	Automatic virus definition and software updates/upgrades for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online
U	McAfee.InstantUpdate.Monitor	RuLaunch.exe	"Instant Updater for McAfee's VirusScan
Y	McAfeeUpdaterUI	UpdaterUI.exe	McAfee common updater user interface
Y	McAfeeUpdaterUI	UdaterUI.exe	Updater user interface for McAfee's VirusScan Enterprise corporate anti-virus and anti-spyware security tool
X	Mcrosoftr Update	Mcrosoftr.exe	"Added by a variant of the RBOT WORM!"
Y	McUpdate	McUpdate.exe	Automatic virus definition and software updates/upgrades for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online
Y	MCUpdateExe	McUpdate.exe	Automatic virus definition and software updates/upgrades for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online
X	MCX Update	wisp.exe	"Added by the RBOT-AQH WORM!"
U	Media Codec Update Service	update.exe	"Windows Essentials Codec Pack 1.0 is a collection of the most commonly needed video and audio codecs. This program allows keeps these codecs updated"
X	Media Player Update	xpsp1mfh.exe	"Added by a variant of the RBOT WORM!"
X	Media Software UPdater	sscs.exe	"Added by the RBOT-ABE WORM!"
X	MediaPlayeS	MediaPlayer_update.exe	"Added by the STARTER-K TROJAN!"
X	Messenger Service Updater	svshost.exe	"Added by the MYTOB.GC WORM!"
X	Micr Update	soundblaster.exe	"Added by the SDBOT.NP WORM!"
X	Micr Update System	upwin.exe	"Added by the SDBOT.YS WORM!"
X	Micro Update	dailin.exe	"Added by the RBOT-ER WORM!"
X	Microfot Update	winldx32.exe	"Added by a variant of the RBOT WORM!"
X	Microft Update 32	winssx.exe	"Added by the RBOT-AQS WORM!"
X	Micromedia Flash Update	wdfmrg.exe	"Added by a variant of the SDBOT WORM!"
X	Micromedia Flash Update	xptxt.exe	"Added by the RBOT-GAB WORM!"
X	Microoft Timing	pupdate.exe	"Added by a variant of the RBOT WORM!"
X	MICROSFT ANTIVIRUS UPDATE SUPPORT	[random 10-letter filename].EXE	"Added by the RBOT-AQA WORM!"
X	MICROSFT ANTIVIRUS UPDATE SUPPORT	MSGUPDATED.EXE	"Added by the RBOT-APZ WORM!"
X	MICROSFT MX UPDATE SUPPORT	taskmngrs.exe	"Added by the RBOT-AUZ WORM!"
X	MICROSFT MX UPDATE SUPPORT	winmx32.EXE	"Added by the IRCBOT-FD WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	[random filename]	"Added by the RBOT-ASM or RBOT-AUW WORMS!"
X	MICROSFT RAMA UPDATE SUPPORT	MSN32.EXE	"Added by the RBOT-AWJ WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	mtakthmyn.EXE	"Added by the RBOT-AUJ WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	MSGUPDAT32.EXE	"Added by the RBOT-BBB WORM!"
X	microsft windows updates	mwupdate32.exe	"Added by a variant of the TOXBOT/CODBOT WORM!"
X	Microsoft	MSUPDATE.exe	Added by an unidentified WORM or TROJAN!
X	Microsoft	updater.exe	"Added by the RBOT-GHP WORM!"
X	Microsoft (R) Windows Update Service	wuauclt.exe	"Added by a variant of the SDBOT WORM! Note - this is not the legitimate wuauclt.exe process
X	Microsoft 16Bit Update	wuapdate16.exe	"Added by the RBOT.CZ WORM!"
X	Microsoft 64 Bit Runtime Updater	wupdt64.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Ansti Update	msie.exe	"Added by the RBOT-LE WORM!"
X	Microsoft AUT Update	MSlti32.exe	"Added by the RBOT-X WORM!"
X	Microsoft AUT Update	MSlti16.exe	"Added by the RBOT.EB WORM!"
X	Microsoft auto update	winupdate.exe	"Added by the BMBOT TROJAN!"
X	Microsoft Auto Update	WINHLP16.EXE	"Added by the RBOT.GY WORM!"
X	Microsoft auto update	wuauclt.exe	"Added by the CULT-B TROJAN! Note - this is not the legitimate wuauclt.exe process
X	Microsoft Automatic Update Serivce	msautou.exe	"Added by the RBOT-AOB WORM!"
X	Microsoft Automatic Updater	Explorer.exe	"Added by the RBOT-SG WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft AutoUpdater	svhost.exe	"Added by the RBOT.QG WORM!"
X	Microsoft Corp Updates	wupdates.exe	"Added by the RBOT-AUU WORM!"
X	Microsoft DirectX	wupdate.exe	"Added by the RBOT-L WORM!"
X	Microsoft driver update	Mshome.exe	Added by the SDBOT.BL WORM!
X	Microsoft explorer Update	internal.exe	Added by an unidentified WORM or TROJAN!
X	Microsoft Generic Update Manager	wupdate.exe	"Added by the RBOT-AWC TROJAN!"
X	Microsoft Internet Explorer Update	ieupdate.exe	"Added by the SHEUR.MH TROJAN!"
X	Microsoft Internet Firewall Update	updater.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft IT Update	win64.exe	"Added by the RBOT.GA WORM!"
X	Microsoft IT Update	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft IT Update	IEserv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft IT Update	msupdate.exe	"Added by the RBOT-FE WORM!"
X	Microsoft IT Update	winn43.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft IT Update	svchsst.exe	"Added by the RBOT-DH WORM!"
X	Microsoft IT Update	win43.exe	"Added by the RBOT-SA WORM!"
X	Microsoft IT Update	windows.exe	"Added by the RBOT-JM WORM!"
X	Microsoft IT Update	winsyst32.exe	"Added by the RBOT-FC WORM!"
X	Microsoft IT Update	Rhost32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Java Windows Update	[filename]	"Added by the RBOT-DZ WORM!"
X	Microsoft MachineUpdatese	tempes.exe	"Added by the RBOT.EWN BACKDOOR!"
X	Microsoft MSUPDATE	SpoolSvc.exe	"Added by the SXTB-A TROJAN!"
X	Microsoft NT Update	winexec32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Office Start	winupdates.exe	"Added by the GAOBOT.BC WORM!"
X	Microsoft Patch Update	bootini.exe	"Added by the RBOT-FMN WORM!"
X	Microsoft Security Hot Fix Update	mshotfix.exe	"Affilred adware"
X	Microsoft Security Monitor Process	windowsupdate.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Security Update	security32.exe	"Added by the DELF-JJ TROJAN!"
X	Microsoft Software Update	nmon.exe	"Added by the RBOT.HZ WORM!"
X	Microsoft Synchronization Manager	winupdate.exe	"Added by the SDBOT.ER WORM!"
X	Microsoft System Update	sysupdate.exe	"Added by the SDBOT.DG WORM!"
X	Microsoft System32 Update	cmsrg.exe	"Added by the RBOT-GN WORM!"
X	Microsoft Taskmanager Updater	keyboard.exe	"Added by the RBOT-ALU WORM!"
X	Microsoft UMA Update	MSuma32.exe	"Added by the RBOT.FS WORM!"
X	Microsoft Update	Microsoft.exe	"Added by the GAOBOT.AFJ WORM!"
X	Microsoft Update	mssmgrd.exe	"Added by the SDBOT.JT WORM!"
X	Microsoft Update	mvsc.exe	"Added by the SPYBOT.DAZ WORM!"
X	Microsoft Update	ascdl.exe	"Added by the GAOBOT.SY WORM!"
X	Microsoft Update	Isac.exe	"Added by the RBOT-AU WORM!"
X	Microsoft Update	automgr32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	mediap.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	Microsoftx.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	msconfg.exe	"Added by the RBOT.H WORM!"
X	Microsoft Update	Mslti32.exe	"Added by the RBOT-LX WORM!"
X	Microsoft Update	muamgrd.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update	navmgrd.exe	"Added by the SDBOT.DP TROJAN!"
X	Microsoft Update	Smss32.exe	"Added by the RBOT-CB WORM!"
X	Microsoft Update	sys32cfg.exe	"Added by the RBOT.DR WORM!"
X	Microsoft Update	VPC32.EXE	"Added by the AGOBOT.XM WORM!"
X	Microsoft Update	winsys32.exe	"Added by the RBOT.BD WORM!"
X	Microsoft Update	wuamgrd.exe	"Added by the RBOT-LK WORM!"
X	Microsoft Update	wuammgr32.exe	"Added by the RBOT-AW WORM!"
X	Microsoft Update	wudmate.exe	"Added by the RBOT.AP WORM!"
X	Microsoft Update	msawindows.exe	"Added by the GAOBOT.AFJ WORM!"
X	Microsoft Update	msiwin84.exe	"Added by the GAOBOT.AFJ WORM!"
X	Microsoft Update	wuamgrd32.exe	"Added by the RBOT.ZB WORM!"
X	Microsoft Update	NAV.exe	"Added by the RBOT-IV WORM!"
X	Microsoft Update	systemi32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update	xpupdate.exe	"Added by the RBOT-QE WORM!"
X	Microsoft Update	webm.exe	"Added by the SDBOT.WK WORM!"
X	Microsoft Update	wuagrd.exe	"Added by the RBOT-FK WORM!"
X	Microsoft Update	aaupdt.exe	"Added by the RBOT-RQ WORM!"
X	Microsoft Update	lsac.exe	"Added by the GAOBOT.XW WORM!"
X	Microsoft Update	Mupdate.exe	"Added by the RBOT-AG WORM!"
X	Microsoft Update	prowind32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update	snlogsvc.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	svhost.exe	"Added by the RBOT-PI WORM!"
X	Microsoft Update	wauguard.exe	"Added by the RBOT.AEE WORM!"
X	Microsoft Update	winscv.exe	"Added by the RBOT-BH WORM!"
X	Microsoft Update	winsys.exe	"Added by the RBOT-GV WORM!"
X	Microsoft Update	wserv32.exe	"Added by the RBOT.AF WORM!"
X	Microsoft Update	wtm32.exe	"Added by the RBOT-AQ WORM!"
X	Microsoft Update	wumgrd.exe	"Added by the SDBOT-KY WORM!"
X	Microsoft Update	wuampd.exe	"Added by the RBOT-UT WORM!"
X	Microsoft Update	msupdate32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update	Botnet.exe	"Added by the RBOT.AFL WORM!"
X	Microsoft Update	sghost.exe	"Added by the SDBOT.AKV WORM!"
X	Microsoft Update	update_w.exe	"Added by the RBOT-EW WORM!"
X	Microsoft Update	windows24.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	wingrd32.exe	"Added by the RBOT-DW WORM!"
X	Microsoft Update	wssvr.exe	"Added by the RBOT-OD WORM!"
X	Microsoft Update	wuamagr32.exe	"Added by the SPYBOT.CG WORM!"
X	Microsoft Update	WinUpdate32.exe	"Added by the RBOT-TI WORM!"
X	Microsoft Update	wkfix.exe	"Added by the RBOT-ABZ WORM!"
X	Microsoft Update	Kkk.exe	"Added by the RBOT-AHL WORM!"
X	Microsoft Update	mcupdate.exe	"Added by the RBOT.XT WORM! Note - this file is located in %System% and should not be confused with the McAfee antivirus executable as described here"
X	Microsoft Update	Micr0s0ft.exe	"Added by the AGOBOT.AAR WORM!"
X	Microsoft Update	Msnmsngr.exe	"Added by the RBOT.BQS WORM!"
X	Microsoft Update	msupdate32.exe	"Added by the SPYBOT.LZ WORM!"
X	Microsoft Update	scvhost.exe	"Added by the RBOT-AEM WORM!"
X	Microsoft Update	svghost.exe	"Added by the RBOT.BUJ WORM!"
X	Microsoft Update	sys.exe	"Added by the RBOT-AJ WORM!"
X	Microsoft Update	up2dat5.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	winamp.exe	"Added by a variant of the RBOT WORM! Note - this is NOT the popular Winamp media player"
X	Microsoft Update	win-mang.exe	"Added by the RBOT-AFK WORM!"
X	Microsoft Update	winupdater.exe	"Added by the RBOT.BIN WORM!"
X	Microsoft Update	wuamk0032.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	wuamk032.exe	"Added by the RBOT-AHD WORM!"
X	Microsoft Update	wuamk0p32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	wuamkop.exe	"Added by the RBOT-AFI WORM!"
X	Microsoft Update	wuamkop32.exe	"Added by the RBOT.BGU WORM!"
X	Microsoft Update	wuampkd.exe	"Added by the SDBOT.BBX WORM!"
X	Microsoft Update	svzhost.exe	"Added by the RBOT.OX WORM!"
X	Microsoft Update	win32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	wininit.exe	"Added by the RBOT-AKR WORM!"
X	Microsoft Update	wuamgrd3.exe	"Added by the RBOT-AMC WORM!"
X	Microsoft Update	Wudates.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	ms.exe	"Added by the SDBOT.CC WORM!"
X	Microsoft Update	wuagmsd.exe	"Added by the RBOT-AX WORM!"
X	Microsoft Update	cmss.exe	"Added by the RBOT-ATQ WORM!"
X	Microsoft Update	wuamgrb.exe	"Added by the RBOT-AZE WORM!"
X	Microsoft Update	WINDOC.EXE	"Added by the SDBOT.PF WORM!"
X	Microsoft Update	phqghumea.exe	"Added by the SDBOT.AFO WORM!"
X	Microsoft Update	system32.exe	"Added by the RBOT.IS WORM!"
X	Microsoft Update	bling.exe	"Added by the RBOT-AVK WORM!"
X	Microsoft Update	Sygate.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	update.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	WinDrv32.exe	"Added by the RBOT.EGW WORM!"
X	Microsoft Update	devmks32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft update	winupdate.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	msupdate.exe	"Added by the BOROBOT-I TROJAN!"
X	Microsoft Update	mixer.exe	"Added by the RBOT-AIR WORM!"
X	Microsoft Update	taskmgr32.exe	"Added by the RBOT-CV WORM!"
X	Microsoft Update	drive.exe	"Added by the BIFROSE-PN WORM!"
X	Microsoft Update	wangard.exe	"Added by the RBOT-LH WORM!"
X	MICROSOFT UPDATE	WUAGTRD.EXE	"Added by the RBOT-CJ WORM!"
X	Microsoft Update	spool.exe	"Added by the AGENT-GJC TROJAN!"
X	Microsoft Update	bnmveqfts.exe	"Added by the BANLOAD.KWQ TROJAN!"
X	Microsoft Update	dqbxhupdt	"Added by a variant of the SDBOT WORM! See here"
X	Microsoft Update	enule.exe	"Added by the IRCBOT.DU BACKDOOR!"
X	Microsoft Update	explorer.exe	"Added by the RBOT.AEU BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft Update	imchemaoa.exe	"Added by the BANLOAD.KWQ TROJAN!"
X	Microsoft Update	livemessenger.com	"Added by the ADLOAD-LN TROJAN!"
X	Microsoft Update	msnmsgl.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Update	nnwyaupdt	"Added by the RBOT.RHK BACKDOOR!"
X	Microsoft Update	ntservice.exe	"Added by the AGENT-DIS TROJAN!"
X	Microsoft Update	rundll32.dll	"Added by the CIADOOR.GN BACKDOOR!"
X	Microsoft Update	wuamgrdx.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Update	wutr.exe	"Added by the SPYBOT.AAR WORM!"
X	Microsoft Update	SetPoints.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Update	system.exe	"Added by a variant of the RBOT WORM! See here"
X	Microsoft Update	service.exe	"Added by a variant of the RBOT WORM! See here"
X	Microsoft Update	msgn.exe	"Added by the RBOT.RQ BACKDOOR!"
X	Microsoft Update	wuamgrd16.exe	"Added by the RBOT-BQ WORM!"
X	Microsoft Update	windows32.exe	"Added by the RBOT-BHQ WORM!"
X	Microsoft Update	winsyst.exe	"Added by the RBOT-DL WORM!"
X	Microsoft Update 23	NtKernelSystem.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 23	spoolvs.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	explore32.exe	"Added by the SPYBOT.CYM WORM!"
X	Microsoft Update 32	MSupdate32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update 32	wininit.exe	"Added by the RBOT-ANY WORM!"
X	Microsoft Update 32	wininit32.exe	"Added by the RBOT-AKJ WORM!"
X	Microsoft Update 32	[path to file]	"Added by the RBOT-AJJ WORM!"
X	Microsoft Update 32	mscnfg.exe	"Added by the RBOT-ALM WORM!"
X	Microsoft Update 32	servic.exe	"Added by the RBOT-AXN WORM!"
X	Microsoft Update 32	winitXP32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	mssetup32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	wiit.exe	"Added by the RBOT-AMS WORM!"
X	Microsoft Update 32	explorer.exe	"Added by the RBOT-ARF WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft Update 32	network.exe	"Added by the RBOT-ARZ WORM!"
X	Microsoft Update 32	om4r.exe	"Added by the RBOT-AQP WORM!"
X	Microsoft Update 32	winin.exe	"Added by the RBOT-ARR WORM!"
X	Microsoft Update 32	wuinit.exe	"Added by the AGOBOT-UE WORM!"
X	Microsoft Update 32	neta.exe	"Added by the RBOT-AMI WORM!"
X	Microsoft Update 32	spoolvs.exe	"Added by the RBOT-BBQ WORM!"
X	Microsoft Update 32	rundll32.exe	"Added by the RBOT.AIE BACKDOOR! Note that this BACKDOOR modifies the file rundll32.exe
X	Microsoft Update 32	taskMangr.exe	"Added by the RBOT.AIE BACKDOOR!"
X	Microsoft Update 32	winssx.exe	"Added by the RBOT-ARW WORM!"
X	Microsoft Update 33	init.exe	"Added by the RBOT-ATT WORM!"
X	Microsoft Update 64 BIT	wininit32.exe	"Added by the RBOT-AHE WORM!"
X	Microsoft Update 64 BIT	winman32.exe	"Added by the RBOT-AKI WORM!"
X	Microsoft Update 64 BIT	schvost.exe	"Added by the RBOT.CAU WORM!"
X	Microsoft Update 64 BIT	winl32xe.exe	"Added by the RBOT-AQO WORM!"
X	Microsoft Update Clinic	svsipconfig.exe	"Added by the RBOT.BR WORM!"
X	MICROSOFT UPDATE CONFIGURATION	WIN32SNC.EXE	"Added by the RBOT-AI WORM!"
X	Microsoft Update Control	Ms64.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Debugger	wincfg32.exe	"Added by the SPYBOT.ZC WORM!"
X	Microsoft Update Device	flolo.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Update Device Drivers	wuauclt.exe	"Added by a variant of the SDBOT WORM! Note - this is not the legitimate wuauclt.exe process
X	Microsoft Update DLL	rxxhost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Drivers	explorers.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update Emulator	kern-mxe.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Emulator	wuaddsff.exe	"Added by the RBOT-GX WORM!"
X	Microsoft Update Event	svnhost.exe	"Added by the AGOBOT-GW BACKDOOR!"
X	Microsoft Update Loader	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Loaders 2005	winusers.exe	"Added by the RBOT-AIQ WORM!"
X	Microsoft Update Loaders 2006	winusersystem32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update Machine	expl0rer.exe	"Added by the SDBOT.OK WORM!"
X	Microsoft Update Machine	rxhost.exe	"Added by the RBOT.FC WORM!"
X	Microsoft Update Machine	servicz.exe	"Added by the RBOT-HU WORM!"
X	Microsoft Update Machine	SP2.exe	"Added by the SPYBOT.FP WORM!"
X	Microsoft Update Machine	winini.exe	"Added by the RBOT-KV WORM!"
X	Microsoft Update Machine	xvshost.exe	"Added by the RBOT.QP WORM!"
X	Microsoft Update Machine	memstat.exe	"Added by the RBOT-OM WORM!"
X	Microsoft Update Machine	ntce.exe	"Added by the RBOT-FA WORM!"
X	Microsoft Update Machine	system03.exe	"Added by the RBOT-NM WORM!"
X	Microsoft Update Machine	wuawx.exe	"Added by the RBOT-CE WORM!"
X	Microsoft Update Machine	zonealarm.exe	"Added by the RBOT-BZ WORM! Note - this is not the valid Zone Labs firewall program!"
X	Microsoft Update Machine	systemll.exe	"Added by the RBOT-JT WORM!"
X	Microsoft Update Machine	winupdt.exe	"Added by the RBOT-FP WORM!"
X	Microsoft Update Machine	svshost.exe	"Added by the RBOT.AK WORM!"
X	Microsoft Update Machine	wuamgd.exe	"Added by the SDBOT.HQ WORM!"
X	Microsoft Update Machine	wupdt32x.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update Machine	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	linux.exe	"Added by the RBOT-IM WORM!"
X	Microsoft Update Machine	lmrss.exe	"Added by the RBOT-DY WORM!"
X	Microsoft Update Machine	windowsu.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	wininigo.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	winmgr.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	Winmsixp32.exe	"Added by the RBOT.DN WORM!"
X	Microsoft Update Machine	Winregs32.exe	"Added by the RBOT.DN WORM!"
X	Microsoft Update Machine	winxpini.exe	"Added by the RBOT-OB WORM!"
X	Microsoft Update Machine	wuamgrd.exe	"Added by the RBOT-HE WORM!"
X	Microsoft Update Machine	wuagrd.exe	"Added by the RBOT-GF WORM!"
X	Microsoft Update Machine	LANWAKE.EXE	"Added by the RBOT-QZ WORM!"
X	Microsoft Update Machine	scvhost.exe	"Added by the RBOT-GS WORM!"
X	Microsoft Update Machine	winhost.exe	"Added by the RBOT-GK WORM!"
X	Microsoft Update Machine	winss.exe	"Added by the RBOT.JU WORM!"
X	Microsoft Update Machine	WUAMGRDXS.EXE	"Added by the RBOT-GL WORM!"
X	Microsoft Update Machine	crss32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	lsasse.exe	"Added by the RBOT-DI WORM!"
X	Microsoft Update Machine	qwerty.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	rxxhost.exe	"Added by the RBOT.EP WORM!"
X	Microsoft Update Machine	servicez.exe	"Added by the SPYBOT.BI WORM!"
X	Microsoft Update Machine	spoolserv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	Systemnt.exe	"Added by the RBOT.DA WORM!"
X	Microsoft Update Machine	systemse.exe	"Added by the RBOT-BD WORM!"
X	Microsoft Update Machine	taskmngrs.exe	"Added by the RBOT-CR WORM!"
X	Microsoft Update Machine	windowsup.exe	"Added by the RBOT-FV WORM!"
X	Microsoft Update Machine	wuamgard.exe	"Added by the SPYBOT.CS WORM!"
X	Microsoft Update Machine	wupdate32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	system.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	TMEMSER.EXE	"Added by the RBOT-NQ WORM!"
X	Microsoft Update Machine	winnie.exe	"Added by the RBOT-ACD WORM!"
X	Microsoft Update Machine	winortho.exe	"Added by the RBOT-NW WORM!"
X	Microsoft Update Machine	wins32.exe	"Added by the RBOT.EZ WORM!"
X	Microsoft Update Machine	serviz.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	TASKMAN4.EXE	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	wftestb.exe	"Added by the RBOT-AFZ WORM!"
X	Microsoft Update Machine	Win32.exe	"Added by the SDBOT.UV WORM!"
X	Microsoft Update Machine	windns.exe	"Added by the RBOT.EF WORM!"
X	Microsoft Update Machine	MSOICONS.EXE	"Added by the RBOT.AWS WORM! Note - do no confuse with the legitimate Msoicons.exe file described here. The latter should not normally figure in Msconfig/Startup!"
X	Microsoft Update Machine	WINSVC32.EXE	"Added by the RBOT.CU WORM!"
X	Microsoft Update Machine	ntsystem.exe	"Added by the RBOT.GF WORM!"
X	Microsoft Update Machine	winupdte.exe	"Added by the RBOT-GKL WORM!"
X	Microsoft Update Machine	jkfrnz.exe	"Added by the RBOT-GOZ WORM!"
X	Microsoft Update Machine	wlimyc.exe	"Added by the RBOT-GQN WORM!"
X	Microsoft Update Machine	xagwxzy.exe	"Added by the RBOT.S WORM!"
X	Microsoft Update Machine	jkydxg.exe	"Added by the RBOT.AEA BACKDOOR!"
X	Microsoft Update Machine	opmmve.exe	"Added by the KOLABC.DES WORM!"
X	Microsoft Update Machine	paxrxo.exe	"Added by the PUSHBOT.A WORM!"
X	Microsoft Update Machine	psmszw.exe	"Added by the KOLABC.CC WORM!"
X	Microsoft Update Machine	syadpo.exe	"Added by the CIADOOR.GN BACKDOOR!"
X	Microsoft Update Machine	systemi.exe	"Added by the BUZUS.JKU TROJAN!"
X	Microsoft Update Machine	thvfyq.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	ubthec.exe	"Added by the AGENT.AWZ TROJAN!"
X	Microsoft Update Machine	winmngr.exe	"Added by the RBOT.GKQ BACKDOOR!"
X	Microsoft Update Machine	gbhglj.exe	"Added by the IRCBOT-ZJ TROJAN!"
X	Microsoft Update Machine	wuamgdr.exe	"Added by the RBOT-IO BACKDOOR!"
X	Microsoft Update Manager	WINRLS.EXE	"Added by the RBOT-AF WORM!"
X	Microsoft Update Manager	svshost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Manager	scvhost.exe	"Added by the AGOBOT.AXJ WORM!"
X	Microsoft Update Manager	scvideo.exe	"Added by the SDBOT-CVP TROJAN!"
X	Microsoft Update Mechene	Updatez.exe	"Added by the RBOT-GI WORM!"
X	Microsoft Update Module	rundll24.exe	"Added by the RBOT-PS WORM!"
X	Microsoft Update Process	wmipcvse.exe	"Added by the AGOBOT-JF TROJAN!"
X	Microsoft Update Security Patch	mssecurityupdatepatch.exe	Added by the AGENT.EF TROJAN!
X	Microsoft Update Server	mssrv.exe	"Added by an unidentified VIRUS
X	Microsoft Update Service	csrss32.exe	"Added by the AGOBOT-HC WORM!"
X	Microsoft Update Service	mswin32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft update service	systemm.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update SERVICE	phqghum.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Service	msupdate.pif	"Added by the RBOT-AQB WORM!"
X	Microsoft Update Service	wmiprvre.exe	"Added by the AGOBOT-NN WORM!"
X	Microsoft Update Services	wcsnfty.exe	"Added by the RBOT-AGK WORM!"
X	Microsoft Update Services	wsnfty.exe	"Added by the RBOT-AFU WORM!"
X	Microsoft Update Time	wuam.exe	"Added by the RBOT-M WORM!"
X	Microsoft Update USB2	wuammgrd32.exe	"Added by the RBOT-ADT WORM!"
X	Microsoft Update v2.6	lxxex.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Win32a	winupdate32a.exe	"Added by the RBOT-LO WORM!"
X	Microsoft Update Win32x	winupdate32x.exe	"Added by the RBOT-AJN WORM!"
X	Microsoft Update32	wuamgrd32.exe	"Added by the RBOT-PU WORM!"
X	Microsoft Updater	winsys32.exe	"Added by the RBOT.RL WORM!"
X	Microsoft Updater	msconsole.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Updater	svhost.exe	"Added by the AGENT.CDF TROJAN!"
X	Microsoft Updater	vbcjlg.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Updater	wuamgrds.exe	"Added by the RBOT.A WORM!"
X	Microsoft Updater	winupdate.exe	"Added by the AGENT-KIR TROJAN!"
X	Microsoft Updater Resources	WinFixd32.exe	"Added by the SPYBOT.CA WORM!"
X	Microsoft Updater v2	[path to worm]	"Added by the AUTORUN-BCI WORM!"
X	Microsoft UPDATER32	lsass.exe	"Added by the RANDEX.AR WORM! Note - this is not the legitimate Lsass.exe system file should normally NOT figure in Msconfig/Startup!"
X	Microsoft UPDATER32	LSASS32.EXE	"Added by the RANDEX.AR WORM!"
X	Microsoft Updaters	tskmgr.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updaters	sysconfigs.exe	"Added by the RBOT-DF TROJAN!"
X	Microsoft Updaters Pros	WINDLL32XP.EXE	Added by the SPYBOTTER.GEN VIRUS!
X	Microsoft Updates	systemc32.exe	"Added by the RBOT-GR WORM!"
X	Microsoft Updates	wkssvr.exe	"Added by the RBOT.R WORM!"
X	Microsoft Updates	wkssvrs.exe	"Added by the RBOT-EB WORM!"
X	Microsoft Updates	wuamgrd.exe	"Added by the RBOT-CO WORM!"
X	Microsoft Updates	wtemp32.exe	"Added by the RBOT-AHQ WORM!"
X	Microsoft Updates	svehost.exe	"Added by the RBOT-GRW WORM!"
X	Microsoft Updates	svshost.exe	"Added by the AGOBOT-AIW WORM!"
X	Microsoft Updates	svdhost.exe	"Added by the RBOT-GVH WORM!"
X	Microsoft Updates	service.exe	"Added by the POISON.HPT BACKDOOR!"
X	Microsoft Updates	[worm filename]	"Added by the AGOBOT-AIZ WORM!"
X	Microsoft Updates	wgcptsud.exe	"Added by the RBOT-GTF WORM!"
X	Microsoft Updates	winit.exe	"Added by the SDBOT-CSB WORM!"
X	Microsoft Updates 2 USB	wgafixer.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updates 5 USB	sp3fixer.exe	"Added by the RBOT-ADS WORM!"
X	Microsoft UpdateS Machine	wgrd.exe	"Added by the RBOT-FI WORM!"
X	Microsoft Updates Resources	WinFixIDs.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updatting	miroupdate.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft upnp Update	msie.exe	"Added by the RBOT-LQ WORM!"
X	Microsoft Vertupdate	MSvert32.exe	"Added by the MYTOB-CY WORM!"
X	Microsoft web update	webmsn.exe	"Added by the RBOT-EMQ WORM!"
X	Microsoft Win Update	WinUP.exe	"Added by the RBOT-BPR WORM!"
X	MicroSoft Wind0ws Updater	winsupdater.exe	"Added by a variant of the RBOT WORM!"
X	MicroSoft Window Updater	winsupdater.exe	"Added by the RBOT-ZZ WORM!"
X	Microsoft Windows 32 Update	win32update.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows Express	Microsoft Update	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Windows Game Updater	msgame32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Secure Update	rpcxwinupdt.exe	Added by an unidentified WORM or TROJAN!
X	Microsoft Windows Update	rundlls.exe	"Added by the HABRACK WORM!"
X	Microsoft Windows Update	msoffice2.exe	"Added by the RBOT-GB WORM!"
X	Microsoft Windows Update	spools.exe	"Added by the SDBOT.TD WORM!"
X	Microsoft Windows Update	svchos.exe	"Added by the SDBOT.AC WORM!"
X	Microsoft Windows Update	svcshost.exe	"Added by the FORBOT-CF WORM!"
X	Microsoft Windows Update	svmhost.exe	"Added by the FORBOT-CH WORM!"
X	Microsoft Windows Update	svshost.exe	"Added by the WOOTBOT.CJ WORM!"
X	Microsoft Windows Update	msnmessenger.exe	"Added by the SDBOT.AJ WORM!"
X	Microsoft Windows Update	msnwun.exe	"Added by the SDBOT-RM WORM!"
X	Microsoft Windows Update	scvvhost.exe	"Added by the FORBOT-DH WORM!"
X	Microsoft Windows Update	swwhost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update	MSNMSGR.EXE	"Added by the SDBOT-WM WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Microsoft Windows Update	svzhost.exe	"Added by the FORBOT-EV WORM!"
X	Microsoft Windows Update	sccvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update	scrhost.exe	"Added by the RBOT-AOW WORM!"
X	Microsoft Windows Update	mnswinsx.exe	"Added by the RBOT-AWH WORM!"
X	MICROSOFT Windows update	pdate.exe	"Added by the RBOT.BZT WORM!"
X	Microsoft Windows Update	srshost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update	rhost32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows Update	windowsupdate.exe	"Added by the AGOBOT.ON WORM!"
X	Microsoft Windows Update	servcs.exe	"Added by the SDBOT.AL BACKDOOR!"
X	Microsoft Windows Update	syssinfos.exe	"Added by the RBOT-FWR WORM!"
X	Microsoft Windows Update Application	wuap.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update Client	csrss.exe	"Added by the KEBEDE-G WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Systems32"
X	Microsoft Windows Update Client	services.exe	"Added by the AUTORUN.DVE WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Windows Update Logon	win-logon.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update Service	wupdmgr32.exe	"Added by the DOS.AUTOCAT TROJAN!"
X	Microsoft Windows Update Service	msnmsg.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Windows Update x86	[various filenames]	"Added by a variant of the RBOT WORM! Filenames seen include (but are not limited to firefox.exe
X	Microsoft Windows Update XP64	********.exe [* = random char]	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update XP64	updatexp64.exe	"Added by the SDBOT-AIM WORM!"
X	Microsoft Windows Update XP64	Lcuninst.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update XP64	mzhxlixm.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updater	winupdgm.exe	"Added by the GAOBOT.BI WORM!"
X	Microsoft Windows Updater	WINIUPDATES.EXE	"Added by the RBOT-KK WORM!"
X	Microsoft Windows Updater	WINUPDATE.EXE	"Added by the RBOT-LI WORM!"
X	Microsoft Windows Updater	TMNTSrv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Updater	win32upd.exe	"Added by the RBOT-EC WORM!"
X	Microsoft Windows Updater	msnupdateit.exe	"Added by the AGOBOT-RL WORM!"
X	Microsoft Windows Updater	windates.exe	"Added by the SDBOT.TE WORM!"
X	Microsoft Windows Updater	spoolvs.exe	"Added by the RBOT.ACQ WORM!"
X	Microsoft Windows Updater	suvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updater	winfix.exe	"Added by the RBOT-CM WORM!"
X	Microsoft Windows updaterD	log32zx.exe	"Added by the MYDOOM.W WORM!"
X	Microsoft Windows Updates	explorer32.exe	"Added by the SDBOT.VQ WORM!"
X	Microsoft Windows Updates	wsap32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Winedows Updateing	NinKey.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft winsupdater	WINSUPDATER.EXE	"Added by the SPYBOTER.FB BACKDOOR!"
X	Microsoft WinUpdate	mntcgf032.exe	"Added by the RBOT-PF WORM!"
X	Microsoft WinUpdate	svh0st.exe	"Added by the SPYBOT.DL WORM!"
X	Microsoft WinUpdate	syslx32.exe	"Added by an unidentified VIRUS
X	Microsoft WinUpdate	syswin32.exe	"Added by the RBOT-HO WORM!"
X	Microsoft WinUpdate	spfix.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft WinUpdate	Winamp61.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft WinUpdate	Winupd32.exe	"Added by the RBOT.MQ WORM!"
X	Microsoft WinUpdate	WinNTinit32.exe	"Added by the RBOT.VS WORM!"
X	Microsoft WinUpdate	msupdte.exe	"Added by an unidentified TROJAN! See examples here & here"
X	Microsoft WinUpdates	serm32.exe	"Added by the RBOT.GE WORM!"
N	Microsoft Works Update Detection	wkdetect.exe	Checks for updates to MS Works
X	Microsoft X Update	wuamkoppnp.exe	"Added by the RBOT-ANI WORM!"
X	Microsoft--Updates	sxvhost.exe	"Added by the RBOT-FH WORM!"
X	Microsoft-Update	wngard.exe	"Added by the RBOT-JV WORM!"
X	Microsoft-Updates	svxhost.exe	"Added by the RBOT-CT WORM!"
X	MicrosoftCorp	update.exe	"Added by the AUTORUN-ASG WORM!"
X	MicrosoftCorp	wupdate.exe	"Added by the AGENT-LAY TROJAN!"
X	MicrosoftNAPC	update.exe	"Added by the AUTORUN-ASG WORM!"
X	MicrosoftNAPC	wupdate.exe	"Added by the AGENT-LAY TROJAN!"
X	Microsofts Updates	lsasss.exe	"Added by the RBOT-AEX WORM!"
X	Microsofts Updatez	cmsssr.exe	"Added by an unidentified VIRUS
X	Microsofts Updatez	exploirez.exe	"Added by a variant of the RBOT WORM!"
X	MicrosoftUpdate	syshelper.exe	"Added by the WOOTBOT.AC WORM!"
X	MicrosoftUpdate	WinUp32.exe	"Added by an unidentified VIRUS
X	MicrosoftUpdate	MicrosoftUpdate.exe	"Added by the BANKER-EHC TROJAN!"
X	MicrosoftUpdate	windll.exe	"Added by the RBOT-IH WORM!"
X	MicrosoftUpdate	RBuilder.exe	"Added by the DLOADR-BMV TROJAN!"
X	MicrosoftUpdate	svhest.exe	"Added by the RBOT-ES WORM!"
X	MicrosoftUpdate	downnew.exe	"Added by the TANTO-D TROJAN!"
X	MicrosoftUpdates	[path to trojan]	"Added by the DELF-LO TROJAN!"
X	MicrosoftUpdates	syshelped.exe	"Added by the FORBOT-AZ WORM!"
X	Microsotufed Update 32	windinit.exe	"Added by the RBOT-CTJ WORM!"
X	Microszoft Update Mach1nezs	svchst.exe	"Added by the RBOT-ED WORM!"
X	Miosf Update	wimsqaad.exe	"Added by the SDBOT.AG TROJAN!"
X	Mircosoft Update	wuampkd.exe	"Added by a variant of the SDBOT WORM!"
X	Modem Driverz Updates	mdmdrv.exe	"Added by a variant of the SDBOT WORM!"
X	MouseDrv	update.exe	"Added by the ZOTOB.N WORM!"
X	Ms Java Update For Windows NT/XP	msijavaupdt32.exe	"Added by the RANDEX.AF WORM!"
X	MS Security Update 993	msident.exe	"Added by a variant of the SDBOT WORM!"
X	MS UniX	navupdate64.exe	"Added by the RBOT.CRZ BACKDOOR!"
X	MS Unix Binary	msnupdate.exe	"Added by the RBOT-AAM WORM!"
X	MS Unix Binary	outlookexpressupdate.exe	"Added by the RBOT-YU WORM!"
X	MS Unix Binary	Win32Update.exe	"Added by the RBOT-BAS WORM!"
X	MS Unix Binary	Norton2005Update.exe	"Added by a variant of the RBOT WORM!"
X	MS Unix Binary	trmupdate.exe	"Added by the RBOT-ACC WORM!"
X	MS Update	syshost.exe	"Added by the EVAMAN-F WORM!"
X	Ms Update WinServices NT/XP	winservnt32.exe	"Added by the VANEBOT-G WORM!"
X	MS UPDATER	update.exe	"Added by the RBOT-VC WORM!"
X	MS Updates	mscache.exe	Spyware web downloader
X	MS Updates	syshosts.exe	"Added by the MYDOOM.Y WORM!"
X	MS Updates	aupd.exe	Spyware web downloader
X	MS Updating Utility	msupdater.exe	"Added by the RBOT-XR WORM!"
X	ms window update	******.exe [* = random character]	"Added by a variant of the RBOT WORM!"
X	MS Windows Security Updater	updater.pif	"Added by the RBOT-AKY WORM!"
X	MS Windows Update	scguard.exe	"Added by the RBOT-YZ WORM!"
X	MSConfig Manager	msupdate.exe	"CoolWebSearch parasite variant"
X	msconfig service	MSupdate32.exe	"Added by a variant of the SPYBOT WORM!"
X	msliveupdate	msliveupdate.exe	"Added by the AGOBOT.ALT WORM!"
X	MSN Auto-Updater	msnaupdater.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	MSN Auto-Updater	msnupdates.exe	"Added by the AUTORUN.WORM.GEN WORM!"
X	Msn Messenger Update	msnupdate.exe	"Added by a variant of the RBOT WORM!"
X	Msn Messenger update	msnservice.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Msn Plus Updater	msnplus.exe	"Added by the RBOT-MU WORM!"
X	MSN Service Updates	winproc.exe	"Added by the KELVIR-BB WORM!"
X	MSN Update	mscon.exe	"Added by the RBOT-QA WORM!"
X	MSN Update	msn32.exe	"Added by the RBOT.AHN WORM!"
X	MSN Update	DLLCON.EXE	"Added by the RBOT-EA WORM!"
X	MSN Update Cfg	msnupdbt.exe	"Added by an unidentified WORM or TROJAN! See here"
X	MSN Update Client	msnupdater.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	MSN Update Client	msnupdcli.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Msn Update Manager (Sp2)	MSMSGS.EXE	"Added by the AGOBOT-NL WORM! Note - this particular msmsgs.exe file is located in %System% and should not be mistaken for the MSN Messenger file of the same name which is located in %Program Files%\Messenger"
X	Msn Update Service	userx.exe	"Added by the MYTOB.JF WORM!"
X	MSN Update Service	msnupdsv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Msn Update SUPPORT	[random filename]	"Added by the RBOT-BPS WORM!"
X	MSN Updater	msnms.exe	"Added by the FORBOT-CG WORM!"
X	Msn Updater	msnplugins.exe	"Added by the RBOT-HS WORM!"
X	Msn Updater	windatemanager.exe	"Added by the SDBOT.TS WORM!"
X	MSN UPDATERS	virtualmemory.exe	"Added by the RBOT-JK WORM!"
X	MSN Updating	msnupdate.exe	"Added by the QHOST.AEI TROJAN!"
X	MSN6.1 Auto-Updater	v6msn.exe	"Added by the AUTORUN-MM WORM!"
X	msoft-updater23	mssysstems.exe	"Added by the RBOT-ATU WORM!"
X	msoft-updater23	slssystem.exe	"Added by the RBOT-ASR WORM!"
X	msoupdater	msoupdater.exe	"Added by the DLOADER.GBD TROJAN!"
X	MSPP System Update 64	wiaadmgr.exe	"Detected by Kaspersky as the RANKY.GEN TROJAN!"
X	mssonfig	winupdate.exe	"Added by a variant of the SDBOT WORM!"
X	MSUpdate	wupd.exe	"Added by the ALADINZ.M TROJAN!"
X	MSUpdate	svchosthlp.exe	"Added by the BLASTER.T WORM!"
X	msupdate	msupdate.exe	"Added by the RBOT-MZ WORM!"
X	MSUpdate	criticalUpdate.exe	"Affilred adware"
X	msupdate	update.exe	"Added by a variant of the SDBOT WORM!"
X	Msupdate	expIorer.exe	"Added by the TACTSLAY.A TROJAN!"
X	Msupdate	outIook.exe	"Added by the TACTSLAY.A TROJAN!"
X	Msupdate	svchosts.exe	"Added by a variant of the TACTSLAY TROJAN!"
X	Msupdate	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	Msupdate	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	MSupdate.exe	N/A	"CoolWebSearch parasite variant - resets home page to an adult content site"
X	MSUpdateDevKit	axfd.exe	"Added by the SDBOT-ZD WORM!"
X	msupdater	msupdater.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X	MsUpdater System	udpsys32.exe	"Added by the RBOT.AAA WORM!"
X	MSupdater.exe	N/A	"CoolWebSearch parasite variant. Installs the Winshow.dll browser plugin"
X	msupdater25	lsasser.exe	"Added by the RBOT-ATS WORM!"
X	msupdates	msupdt.exe	"Added by the RBOT-JO WORM!"
X	msvupdater	msvupdater.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X	MSWindowsUpdate	Systern.exe	"Added by the RBOT-AFD WORM!"
X	MSWindowsUpdate	mswinup.exe	"Added by a variant of the SDBOT WORM!"
X	MSWinupdate	winupdate.exe	"Added by the DLOADR-AAW TROJAN!"
X	MSWUpdate	[path to worm]	"Added by the SILLYFD-V WORM! The most common filename is lsass.exe but it not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	MS_Update Check	wdfmgr.exe	"Added by the AGOBOT-TB WORM!"
X	MS_update_0704_KB74073.exe	MS_update_0704_KB74073.exe	"Added by a variant of the UPDATEKB TROJAN!"
X	MyFastAccess	myfastupdate.exe	My-Fast-Access toolbar updater
X	napv.exe	wupdate.exe	"Added by the AGOBOT-JX BACKDOOR!"
X	NAV Auto Update	[random filename]	"Added by the SPYBOT-E WORM!"
X	NAV Auto Update	iamsad.exe	"Added by the SPYBOT-CE BACKDOOR!"
X	NAV Auto Update	Sadness.exe	"Added by the SPYBOT-E WORM!"
X	NAV Auto Updates	csrssp.exe	"Added by a variant of the SDBOT WORM!"
X	NAV Auto Updates	navwindows.exe	"Added by a variant of the SDBOT WORM!"
X	NAV Auto Updates	slserves.exe	"Added by the RBOT.COI BACKDOOR!"
X	NAV Auto Updates	navupdaterx.exe	"Added by a variant of the RBOT WORM!"
X	NAV Live Update	[path to worm]	"Added by the DEBORMS.C WORM! Note - this is not a valid Norton Anti-Virus (NAV) function from Symantec"
X	NAV_Update	NAV_Update.exe	Unidentified WORM or TROJAN!
X	Nero Updater.6.12	wmp9.exe	"Added by the AGOBOT-AAG WORM!"
X	NeroUpdate Check	msjava.exe	"Added by the AGOBOT.AMH WORM!"
X	NeroUpdater6.8	winjava.exe	"Added by the AGOBOT.AMK WORM!"
?	netfxupdate	netfxupdate.exe	"Would appear to be a valid Microsoft .NET file (see here) but other sources suggest it could be a trojan"
?	NetFxUpdate_v1.0.3705	netfxupdate.exe	"Would appear to be a valid Microsoft .NET file (see here) but other sources suggest it could be a trojan"
X	netupdate32	netupdate32.exe	"Added by the RBOT-GQZ WORM!"
X	NiroFile Updated	NiroFile.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Nod32 Service	AutoUpdateWin32.exe	"Added by the SDBOT-DJG WORM!"
Y	Nokia Software Updater	nsu_ui_client.exe	"Utility that only runs once after installing the Nokia Software Updater which is used to update the operating system (or firmware) for selected Nokia mobile devices"
X	Norton Antivirus Updater	nortonav.exe	"Added by the DELBOT-T WORM! Note - this is not the real Norton AV!"
X	Norton Live Update Server	cpsdv.exe	"Added by the AGOBOT.EW TROJAN!"
X	Norton Live Updater	Cavapsvc.exe	"Added by the GAOBOT.AO WORM!"
X	Norton Live Updater	Sochost.exe	"Added by the GAOBOT.AO WORM!"
X	Norton Live Updater	Avapsvc.exe	"Added by the AGOBOT-BG BACKDOOR!"
X	Norton SpySweeper AutoUpdate	navsw.exe	"Added by the FORBOT-AS WORM!"
X	Norton Update	ccUpdate.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Norton Update	winsvc.exe	"Added by the AGOBOT.ALP WORM!"
X	Norton Update	cUpdate.exe	"Added by the AGOBOT.APP WORM!"
X	Norton updated	NVSV32.EXE	"Added by the SDBOT.ABH WORM!"
X	Norton Updater	winset.exe	"Added by a variant of the SPYBOT WORM!"
X	Norton Updater	lsa.exe	"Added by a variant of the RBOT WORM!"
X	Norton Updater	NortonUpdate.exe	Added by an unidentified WORM or TROJAN!
X	Norton Updater	ccUpdate.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Norton Updater	navupdtr.exe	"Added by the SDBOT.AXV WORM!"
X	NSupdate	NSupdate.exe	"Added by the Dial/Laet-B premium rate dialer!"
X	ntupdate	dnsvc.exe	"Added by the SDBOT-TC WORM!"
X	NTupdater	[path to trojan]	"Added by the DIGARIX-D TROJAN!"
X	NvUpdater	nwiz32.exe	"Added by a variant of the RBOT WORM!"
X	OB Updater	ob.exe	"Added by the AGOBOT-IH WORM!"
X	Office Monitors	GoogleUpdater.exe	"Added by the RBOT-GKZ WORM! Note - this is not the updater for the popular Google tools"
X	office_update	[path to trojan]	"Added by the DLOADER-ZB TROJAN!"
U	OpenDNS Update	OpenDNS Updater.exe	"Updater for OpenDNS which ""is a free service that works for networks of all sizes
U	Openwares LiveUpdate	LiveUpdate.exe	"Web-update utility as used by various types of software - see here"
X	opsql update check	opsql.exe	"Added by the RBOT-ACJ WORM!"
N	OrangeShark	OSharkUpdater.exe	"Orange Shark updater - online games for all ages"
X	OrbitUpdate	update.exe	"Xupiter OrbitExplorer toolbar related. Drive-by foistware. Use Spybot S&D
X	OuterinfoUpdate	OuterinfoUpdate.exe	"Clickspring.Outerinfo adware"
X	outpostupdate	outpostupdate.exe	"Added by the COSIAM-C TROJAN!"
N	Palo Alto Software Update Manager 8.0	PAS8_UD.exe	"Update manager for small business planning software from Palo Alto Software - such as Business Plan Pro
X	PCHEasySearch	STUpdate.exe	PCH EasySearch bar
X	Personal Firewall V9	Firewall-UpdateV9.exe	"Added by the RBOT-BJR WORM!"
N	PluckSvr	PluckUpdater.exe	"Pluck Toolbar updater"
X	Popup Blocker Updater	regsvr32 veev****.dll [* = random char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	Popup Defence Updater	regsvr32 pdfupd.dll	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
U	PP2000 Instaupdate	PPInupdt.exe	Protector Plus anti-virus software - instant update program for virus data updates. Not required if you regularly update virus data manually
U	PPUpdate	ppupdater.exe	"PPUpdater - updater that used to be part of PestPatrol before CA's acquisition"
X	Printer Spool	updater.exe	"Added by a variant of the RBOT WORM!"
?	Printer Update	CFGREG.EXE	"Maybe a registration reminder or automatically updates drivers or application software for a printer?"
Y	QH Live Update Scheduler	UPSCHD.EXE	"Quick Heal Anti-Virus"
N	Quickbooks Update Agent	qbupdate.exe	Associated with Intuit's Quickbooks but not required. Possibly to do with the payroll update service but you're prompted to check for updates when appropriate whether this is running or not
N	Quicken Scheduled Updates	bagent.exe	Quicken background downloading module
N	QuickTime Update Completion x	quicktimeupdatehelper.exe	"Different numbers caused by number of launches. So if 3 updates are made separately
X	QuickTimeUpdate	QuickUpdate.exe	"Added by the BIFROSE-CW TROJAN!"
X	RCAutoLiveUpdate	MaxLURC.exe	"Max Registry Cleaner rogue registry cleaner - not recommended
X	Real player updater	realupd.exe	"Added by the PARLAY TROJAN!"
X	RealPlayerUpdater	realupd32.exe	"Added by the LOHAV-T TROJAN!"
?	RealTimeUpdate	RealTimeUpdate.exe	"Product description in properties is ""InternetExplorerCommunicationAgent Module"" ?"
X	RealUpdater	realupd.exe	"Added by the PARLAY or MITGLIEDER.I TROJANS!"
U	RegUpdate	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
Y	Remote Update Monitor	imonitor.exe	"Sophos Antivirus Remote Update utility - provides an easy way for remote workers to keep up to date with their virus protection via a website or network connection provided by their employer"
X	RunDLL32	winupdate.exe	"Added by an unidentified TROJAN! - possibly a BMBOT variant"
X	runner1	updater.exe	Added by the CRYPT.ULPM.GEN TROJAN!
X	RunWindowsUpdate	uptodate.exe	"BrowserAid/BrowserPal foistware"
X	SafeGuard Popup Blocker Updater	regsvr32 sfgupd.dll	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	SafeGuard Popup Blocker Updater (required)	regsvr32 sfg****.dll [* = ramdom char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	SafeGuard Popup Updater (required)	regsvr32 sfg****.dll [* = random char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	SafeGuard Popup Updater (required)	regsvr32 PDF****.dll [* = random char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	SafeSurfingUpdate	SSUpdate.exe	"MoneyTree parasite - ActiveX control used to download premium-rate dialers"
U	SAUpdate	SAUpdate.exe	"Big Brother from Quest Software. System and network monitor"
U	SBAutoUpdate	sbautoupdate.exe	"SpywareBlaster auto-updater"
X	ScanRegistry	update.exe	"Added by the DWNLDR-FZY TROJAN!"
U	SDAutoLiveupdate	LiveUpdateSD.exe	"Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here"
X	sdfsdfsdf	sp2update.exe	"Added by a variant of the SPYBOT WORM!"
X	SDKcore Update Components2	SDKC0R3.exe	"Added by the RBOT-ABA WORM!"
X	sdkupdate22	SDK0mCORE.exe	"Added by the FORBOT-DT WORM!"
X	Security	WindowsSecurityUpdate.exe	"Added by a variant of the SDBOT WORM!"
X	Security Patch	WinUpdate32.exe	"Added by the SDBOT-BM WORM!"
X	Security Update Service	wmiprvce.exe	"Added by the AGOBOT.ZW WORM!"
X	Security Update Service Process	svrhost23.exe	"Added by the AGOBOT-GN WORM!"
X	Service Update Client	svcupdcli.exe	"Added by an unidentified WORM or TROJAN! See here"
X	SGPUpdater	sgpUpdaters.exe	"Fast Browser Search/Search Guard Plus parasite - installed with ""Make the Web Better"" applications such as My Web Tattoo
X	Shell	Explorer.exe winupdate.exe	"Added by the AGENT-FD TROJAN! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The ""winupdate.exe"" file is located in %System%"
X	shell update	shellexec.exe	"Added by the RBOT-ANC WORM!"
X	softIce Update 32	wininits.exe	"Added by the RBOT-ANB WORM!"
N	Sony Auto Update Tray Application	CONNECTAUTrayApp.exe	"System Tray access to change update settings for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
X	SP2 Firewall/Internet Updater	crssrs.exe	"Added by the RBOT.BJO WORM!"
X	sp2update	sp2update.exe	"SP2Update adware! Tracks URLs visited and search terms entered into Internet Explorer"
X	sp2update	updatesp2.exe	"Added by the SDBOT.CAS WORM!"
X	Spruce - Auto Update	Spruce.exe	"Rabio ""Search Enhancer"" adware variant"
X	SpyFighterUpdate	AutoUpdate.exe	"SpyFighter spyware remover - not recommended
Y	SpywareTerminatorUpdate	SpywareTerminatorUpdate.exe	"Automatic updates for Spyware Terminator. Initially not recommended due to false positives but the later versions have since improved - see here"
X	SQUpdatesChecker	uc.exe	"Xupiter SQWire toolbar related. Use Spybot S&D
X	SrchfstUpdate	srchupdt.exe	SearchFast adware downloader
N	SSBkgdUpdate	SSBkgdupdate.exe	"Automatic updates for ScanSoft (now Nuance) products such as OmniPage and PaperPort. Can be disabled using the main program's options. Note - if you have a Soundblaster Audigy2 ZS soundcard installed on your computer and the volume of your sound system is turned on extremely high disabling this will solve the problem"
X	SSUpdate	SSUpdate.exe	"MoneyTree parasite - ActiveX control used to download premium-rate dialers"
X	Start Uppings	mssupdate.exe	"Added by a variant of the RBOT WORM!"
X	startkey	update.exe	"Added by the BIFROSE-DG TROJAN!"
X	Startup Update	Cvshost.exe	"Added by the GAOBOT.AO WORM!"
X	StartUpDate	[path to trojan]	"Added by the BIFROSE.F BACKDOOR!"
X	Sun Java Updater	stacsv.exe	"Added by the BUZUS.DBFM TROJAN!"
X	Sun Java Updater v5	javajre.exe	"Added by the AUTORUN-XI WORM!"
X	Sun Java Updater v7.4	javawx.exe	"Added by the ACKANTTA.B WORM!"
X	SunJava Updater v7	javale.exe	"Added by the ACKANTTA.B WORM!"
X	SunJavaSched Updater	avamx.exe	"Added by the RBOT-ABJ WORM!"
X	SunJavaUpdate	smvss.exe	"Added by the DEDLER-G TROJAN!"
X	SunJavaUpdater	javaw.exe	"Added by the MYTOB.QR WORM!"
X	SunJavaUpdaterv13	javaupdater.exe	"Added by the ROUTROBOT WORM!"
N	SunJavaUpdateSched	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
X	SunJavaUpdateSched	scvhost.exe	"Added by the SDBOT-AVX WORM!"
X	SunJavaUpdateSched	javamx.exe	"Added by the SDBOT-WI WORM!"
X	SunJavaUpdateSched10	jushed.exe	"Added by the ACKANTTA.F WORM!"
X	SunJavaUpdateSched132	jschd.exe	"Added by the AUTORUN-AQY WORM!"
X	SunJavaUpdateSched16	jvshed.exe	"Added by the ACKANTTA.G WORM!"
X	supdate	supdate.exe	"Added by the MALWARE.D TROJAN!"
X	supdate2.dll	"rundll32.exe supdate2.dll	Run"
X	supdate2.dll	regsvr32.exe /s supdate2.dll	"Added by the ZLOB-VL TROJAN! Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The ""supdate2.dll"" file is found in %System%"
X	SustemUpdate	explorer.exe	"Added by an unidentified VIRUS
X	SVCHOST	updater32.exe	"Added by the RANTS.A WORM!"
X	svhost updates	Svhost.exe	"Added by a variant of the RBOT WORM!"
X	Svshost Update Service	svcbind.exe	"Added by the MYTOB.LH WORM!"
X	svshostdriver	msnmessengerupdate.exe	"Added by the SDBOT-BI BACKDOOR!"
X	Swf32	AVupdate.exe	"Added by the MERKUR.E WORM!"
X	Sygate Personal Firewall	Mcafeeupdate.exe	"Added by the RBOT.YN WORM!"
X	Sygate Personal Port Blocker	winupdate.exe	"Added by a variant of the RBOT WORM!"
X	Sysctrls	winupdate.exe	Added by an unidentified WORM or TROJAN!
X	Syss	ehuupdate.exe	"EHU adware"
X	System	Updaterun.exe	"Added by the QQHELP-DX TROJAN!"
X	system check	updater.exe	Unidentified adware downloader
U	System Files Updater	System Files Updater.exe	"System Files Updater from Flyakiteosx ""will transform the look of an ordinary Windows XP system to resemble the look of Mac OS X"""
X	System Manager Updates	winsvc.exe	"Added by the AGOBOT.AEM WORM!"
N	System Mechanic Professional Update [Incinerator.dll]	SysMech4.exe /REREG: [path] Incinerator.dll	"Iolo System Mechanic ""Incinerator"" feature securely deletes files and folders from your PC so they can never be recovered again"
X	System Security Updaters	vsmons.exe	"Added by the RBOT-OW WORM!"
X	System Update	[filename].exe	"CoolWebSearch parasite variant"
X	System Update	[random filename]	"Added by the KORGO.W or KORGO.X WORMS!"
X	System Update	wupdmgr.exe	"Added by the SOROMO-A TROJAN!"
X	System Update	[random filename]	"Added by the SOROMO-A TROJAN!"
X	System Update	wauluclt.exe	"Added by the SDBOT.EF WORM!"
X	System Update	[path to trojan]	"Added by the AUTOTROJ-D TROJAN!"
X	System Update	mssetupconf.exe	"Added by the RBOT.DLC WORM!"
X	System Update Application	msbuffer.exe	"Added by the SDBOT.AFF WORM!"
X	System Update Service	wmiprvsa.exe	"Added by the AGOBOT-RG TROJAN!"
X	System Update Service	winupd32.exe	"Added by the ADTODA-A TROJAN!"
X	System Update Service	system.pif	"Added by the RBOT-ALL WORM!"
X	System Update Service	update.pif	"Added by the SPYBOT.WOE WORM!"
X	System Update Service	wmiprvsv.exe	"Added by the AGOBOT.YG WORM!"
X	System Update Service	csrss32.exe	"Added by the AGOBOT-HI WORM!"
X	System Update2	explorer.exe	"Added by the AUTOTROJ-C TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	System Update2	services.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	System Update2	svchost.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	System Update2	system.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	taskman.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	taskmon.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate Win98/Me file of the same name which is located in %Windir% as this version is located in %System%. It is not normally found on a WinXP system"
X	System Update2	update.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	webcheck.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	wininet.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	winlogon.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate winlogon.exe process
X	System Update2	winspool.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	wupdmgr.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Updated	svchoes.exe	"Added by the RBOT-ASF WORM!"
X	System Updater Machine	crhwss.exe	"Added by the CIADOOR-DQ TROJAN!"
X	System Updater Machine	system.exe	"Added by the CIADOOR.GN BACKDOOR!"
X	System Updater Process	wmiprvsw.exe	"Added by the AGOBOT-IL WORM!"
X	System Updater Service	wmiprvsw.exe	"Added by the GAOBOT.AFC WORM!"
X	System Updates	winsci.exe	"Added by a variant of the RBOT WORM!"
X	System Updates	szwi.exe	"Added by the RBOT-AXE WORM!"
X	System Updates	unve.exe	"Added by the RBOT-AWG TROJAN!"
X	System Updates	wmkl.exe	"Added by the RBOT-AYJ WORM!"
X	System Updates 4	mssysfix.exe	"Added by the RBOT-ADU WORM!"
X	System Updates Manager	winserv32.exe	"Added by the AGOBOT-AGA WORM!"
X	System Updates Service	updates.pif	"Added by the RBOT-AMA WORM!"
X	SystemBooster2009	sbr_updater.exe	"SystemBooster2009 rogue system suite - not recommended
X	Systemiom Updater	Systemiom.exe	"Added by the SPYBOT.TY WORM!"
X	SystemUpdate	Negdo.exe	"Added by the CULLER-C WORM!"
X	SystemUpdate	Xeyu.exe	"Added by the CULLER-D WORM!"
X	systemyom Updater	systemyom.exe	"Added by a variant of the IRCBOT TROJAN!"
X	sysupdate	cmman32.exe	"Added by a variant of the SDBOT WORM!"
X	Task manager	UPDATEWIN.exe	"Added by the RBOT.BBS WORM!"
X	TCPXP Update	tcpxp.exe	"Added by the RBOT-UL WORM!"
X	tcupdater	tcupdater.exe	Topconverting.com/180Search adware updater
X	Terminal Update	biosefui.exe	"Added by the PPDOOR-O TROJAN!"
X	tlc	update911.js	Hijacker installer
X	tmax	pupdate.exe	Adware pop-up generator
X	tpcupdater	updatetc.exe	"Antivirus XP 2008 rogue security software - not recommended"
X	Update	[original file path]	"Added by the LYNDEGG WORM!"
X	Update	CDUpdater.exe	"""Carpe Diem"" adult premium rate dialler related"
X	Update	Sysupd.exe	Added by the SLACKBOT VIRUS!
X	Update	Zupdate.exe	"Associated with B3d Projector foistware - see here"
X	Update	mshtm.exe	Browser hijacker - redirecting to buldog-search.com
X	Update	UPDATE-28062004.exe[25 blank spaces].vbs	"Added by the MIDFIN WORM!"
X	update	winis.exe	"Added by the RBOT-VD WORM!"
X	update	r00t.exe	"Added by the RBOT-ACO WORM!"
X	UPDATE	WinUpdater5.0.vbs	"Added by the GORMLEZ-A WORM!"
X	UpDate	RAuth.exe	"Added by the DLOADER-UL TROJAN!"
X	Update	csrss.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Update	csrss.exe	"Added by the MEHEERWAR TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""winupdate"" subfolder"
X	Update	lsass.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Update	svchost.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Update	Update.exe	"QuickButton adware"
X	Update	hanz.exe	"Added by a variant of the RBOT-GLJ WORM!"
X	Update	WinUpdate.exe	"Added by the SDBOT-CV BACKDOOR!"
X	Update Checker	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	Update Checker	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	update driver	SNDVOL32.EXE	"Added by the SPYBOT-CU BACKDOOR!"
X	Update Explorer	iexploreupd.exe	"Added by a variant of the RBOT WORM!"
X	Update for Windows	[various filenames]	"Added by the LERPA-A WORM! Note - the file name will be one of the following common.exe
?	Update for Works	MSWkstz.exe	"Maybe related to later versions of MS Works?"
N	Update Grokster	WiseUpdt.exe	"Automatically updates the Grokster file sharing software. Beware of adware and spyware when using this type of program
X	Update Install	Schost.exe	"Added by the GAOBOT.AO WORM!"
?	Update local	SetCPQLC.exe	"Running on a Compaq desktop. Any ideas?"
N	Update Manager	UpdateManager.exe	"Searches for updates for the Rogers Yahoo! Browser - can be run manually"
X	update mon sys	updaterar.exe	"Added by a variant of the RBOT WORM!"
X	update run dos	logon.exe	"Added by a variant of the SDBOT WORM!"
X	Update Run MSword	LOGON.EXE	"Added by the RBOT.TY WORM!"
Y	Update Service	Update.exe	"Loaded by Handybits programs such as EasyCrypto. Re-instates itself every time the program is run so best to leave it enabled. Prevent it dialling out via a firewall"
X	update service	svxhost.exe	"Added by the RBOT-MG WORM!"
X	Update Service	winu32.exe	"Added by the RBOT-MG WORM!"
X	update service	winx.exe	"Added by a variant of the RBOT WORM!"
?	Update TUT	WiseUpdt.exe	"??"
X	Update ver 1.0	Swap.exe	"Added by the SWAP-C WORM!"
X	Update Windows	EXPLORE.EXE	"Added by a variant of the SDBOT WORM!"
X	Update Windows	EXPLORE.EXE	"Added by a variant of the SDBOT WORM!"
X	Update.exe	ravseuper.exe	"Added by the QQPASS-P TROJAN!"
X	Update32	configs.exe	"Hijacker
X	UpdateCheck	winstall.exe	"Added by the SPYBOT-CY WORM!"
N	UpdateChecker	UpdateChecker.exe	"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
X	UpdateComponent	CNF UPD.EXE	Added by the SPYBOT.GEN VIRUS!
?	UpdateFW	fwdload.exe	"Appears to be firmware update software for a Network Associates ATMbook OC-3 SMF Interface Module?"
?	UPDATEHOOK	Rundll32.exe	"??"
X	updatelavasoft	updatelavasoft.exe	"CoolWebSearch parasite variant - redirecting to lalasearch.com"
U	UpdateManager	sgtray.exe	"StorageGuard from Veritas (this version by Sonic). Free utility that integrates with Backup MyPC (formerly Backup Exec Desktop)
X	UpdateManager	updmanager.exe	"Added by the ANYHOMB.F TROJAN!"
X	UpdateMedia	UpdateMedia.exe	"MediaUpdate foistware"
X	UpdateMgr	updmgr.exe	"SouthBeachTel premium rate adult content dialer"
N	updateMgr	AdobeUpdateManager.exe	Automatic updates for the Adobe Reader file viewer
N	updatemgr.exe	updatemgr.exe	"Once a month
X	UPDATEMSN	svhost.exe	Added by an unidentified WORM or TROJAN!
X	updater	wupdater.exe	"KeenVal adware"
?	updater	updater.exe	"??"
X	Updater	adservernow.exe	"AdServerNow adware"
X	updater	wisvc.exe	"Added by the ORSE-A TROJAN!"
X	UpDaTer	csrss.exe	"Added by the AUTORUN.DIB WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~� subfolder"
X	Updater Service Process	svhost32.exe	"Added by the AGOBOT.TY WORM!"
X	Updater Service Process	csrss32.exe	"Added by the AGOBOT-GP BACKDOOR!"
X	updater32	winload32.exe	"Added by the CULT.M WORM!"
X	updatereal	realupdate.exe	Chinese originated adware
X	UpdaterUI	UpdaterUI.exe	"Added by the AGENT-TM TROJAN!"
X	Updates	msupdate.exe	"CoolWebSearch parasite variant"
N	Updates from HP	backweb*****.exe	"See here - ""messaging service that automatically sends you support information
N	Updates from HP	Updates from HP.exe	Automatically detects an internet connection and downloads any available updates
X	updatesched	[random filename]	"ZenoSearch adware"
X	UpdateService	wservice.exe	"Added by the DREF-K WORM!"
X	Updatestats	Updatestats.exe	"Statblaster adware"
X	UpdateStats	UpdateStats.exe	"SeekSeek search hijacker related - see here"
N	updatev01	updatev01.exe	Ultra-networks.com software updater/downloader
X	updatewin	update.exe	"Added by a variant of the SDBOT WORM!"
X	UpdateWin	[random filename]	"Added by the IRCBOT.AZW BACKDOOR!"
X	updateWins	systrey.exe	"Added by the RANDON WORM!"
?	Updatewiz	updatewiz.exe	"??"
X	UpdateXpSp	MS045-XP2.exe	"Added by the IRCBOT.NY TROJAN!"
X	updatexwin	winxrpc.exe	"Added by the AGOBOT-KJ WORM!"
N	UPDATE~1	updatemgr.exe	"Once a month
U	Upromise Update	UpromiseUa.exe	"Updater for the Upromise college savings program"
X	USB 2.0 Driver	updateXPSPC.exe	"Added by the AGOBOT-RJ WORM!"
X	USB 2.0 Driver	updateXP.exe	"Added by the AGOBOT-QP WORM!"
X	USB 2.0 Driver	UpdateXPSP.exe	"Added by the AGOBOT-QD WORM!"
X	USB 2.1 Driver	winupdate1.exe	"Added by a variant of the RBOT WORM!"
X	USB Driver4	UpdateXP*.exe [* = random digit]	"Added by a variant of the SDBOT WORM!"
X	USB Drivers1	msupdate.exe	"Added by a variant of the RBOT WORM!"
X	USB MS Update	USBS.exe	"Added by a variant of the RBOT WORM!"
X	USB Updates	mservices.exe	"Added by a variant of the SDBOT WORM!"
X	USB Updates	msfirewalls.exe	"Added by a variant of the RBOT WORM!"
X	USB Updates 2	wugfixx.exe	"Added by a variant of the RBOT WORM!"
U	VAIO Update 2	VAIOUpdt.exe	Related to Sony Vaio Update service
X	VBS_AUTO_UPDATE	0548656X.vbs	"Added by the GORMLEZ-A WORM!"
X	Vdat Update	lalaa.exe	"Added by a variant of the RBOT WORM!"
X	virusbye	virusbyeUpdater.exe	"VirusBye rogue security software - not recommended"
X	VnCplUpdate	msdm.exe	"Masssend - spam relayer. Listens on a port for the spammers to feed it a list of addresses and what to send out. More information in
X	WebSUpdater	wupda.exe	"Added by the STARTPAGE.C TROJAN!"
U	WildTangent Web Driver updater	wcmdmgrl.exe	"Web Driver delivery system for WildTangent on-line games. Periodically checks for updates - can be disabled within the programs control panel. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case"
X	Win Process Updates	winupdates.exe	"Added by a variant of the SDBOT WORM!"
X	Win Secure Update	[random filename]	"Added by the RBOT-AGI WORM!"
X	win update	wupda32.exe	"Added by the SDBOT.J WORM!"
X	win update	wapdate.exe	"Added by a variant of the RBOT WORM!"
X	Win Update	SysUpdate.exe	"Added by the AGOBOT-TN WORM!"
X	Win Update	oleupdate.exe	"Added by the AGENT-UY TROJAN!"
X	Win Update	msnmger.exe	"Added by the RBOT-GDP WORM!"
X	win update	wupdate.exe	"Added by the RBOT-P BACKDOOR!"
X	Win Updater	WINUPDATER.EXE	"Added by the RBOT.IP WORM!"
X	Win32 Kernel Update	win32update.exe	"Added by the PROXY-BS TROJAN!"
X	Win32 Ms Auto Updater	AutomsUPD.exe	"Added by a variant of the RBOT WORM!"
X	win32 security updates downloader	tskmngr.exe	"Added by a variant of the SDBOT WORM! See here"
X	Win32 Update	svchosts.exe	"Added by a variant of the SDBOT WORM!"
X	Win32 Update	dl32.exe	Added by an unidentified WORM or TROJAN!
X	win32 update service	svchostt.exe	"Added by a variant of the SDBOT WORM!"
X	Win32 USB2 Driver	winupdate.exe	"Added by the AGOBOT.YE WORM!"
X	Win32 USB2 Driver	updatemgr.exe	"Added by a variant of the FORBOT WORM!"
X	win32update	win32update.exe	"Added by the GENOME.AQUV TROJAN!"
X	Win32Updater	KERNAL32.EXE	"Added by the SPYBOT-OK WORM!"
X	Winamp Update	yhn.exe	"Added by the SDBOT-ACR WORM!"
X	Windosupdate manager	runwin32.exe	"Added by the SDBOT.NNS BACKDOOR!"
X	window2	ieupdate.exe	"Added by the FORBOT-BM WORM!"
X	WindowRegKey update	wins.exe	"Added by the SPYBOT.I WORM!"
X	Windows 32 Update	Windows-Update.exe	"Added by a variant of the RBOT WORM!"
X	windows auto update	msblast.exe	"Added by the BLASTER.B WORM!"
X	windows auto update	penis32.exe	"Added by the BLASTER (or MSBLAST.A) WORM!"
X	Windows Auto Update	winupdater.exe	"Added by the SDBOT.TF WORM!"
X	Windows auto update	bazzi.exe	"Added by the AHKER.E WORM!"
X	Windows auto update	LSASS.exe	"Added by the AHKER.G WORM! Note - this is not the legitimate lsass.exe process
X	Windows Auto Updater	WINDOWSUPDATE.EXE	"Added by the SDBOT.PB WORM! Note the space at the beginning of the filename"
X	Windows Automatic Update	wuamgrder.exe	"Added by a variant of the RBOT WORM!"
X	Windows Automatic Updater	windrg.exe	"Added by a variant of the RBOT WORM!"
X	Windows Automatic Updates	dvldr.exe	"Added by the RBOT.MF WORM!"
X	Windows Automatical Updater	dcz.exe	"Added by the RBOT.CXS WORM!"
X	Windows AutomaticUpdater	runddls.exe	"Added by a variant of the RBOT WORM!"
X	Windows Configuration Utility	winxupdate.exe	"Added by the AGOBOT.LW WORM!"
X	Windows Core Kernel Update	win32bootcfg.exe	"Added by the RANCK-EL TROJAN!"
X	Windows Debugging Tools	updatecfg.exe	"Added by the RBOT-AXU WORM!"
X	Windows Defender Updater	wdu*.exe	"Added by a variant of the FakeAlert TROJAN! This infection displays fake Windows Defender alerts which link to spyware-kicker.com"
X	Windows driver update	dmsvc32.exe	"Added by the SDBOT-GP BACKDOOR!"
X	Windows driver update	Ipconfig32.exe	"Added by the SDBOT-JV WORM!"
X	Windows drivers update	windowsupdate.exe	"Added by the RBOT-ACE WORM!"
X	Windows Explorer Update Build 1142	EXPLORER32.EXE	"Added by the KaZaA based KWBOT or KWBOT.Y WORMS!"
X	Windows Firewall Updater	updatees.exe	"Added by the RBOT-GBX WORM!"
X	Windows Firewall Updater	cronos.exe	"Added by the RBOT-GBY WORM!"
X	Windows Firewall Updater	ctfcom.exe	"Added by the RBOT-GCB WORM!"
X	Windows Firewall Updater	windowsupdate.exe	"Added by the SPYBOT.AVEO WORM!"
X	Windows Java Update	weatherBug32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Loader	SysUpdate.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Manager Update Inc	tgb.exe	"Added by the SDBOT-ACM WORM!"
X	Windows Media Player Update	[random filename]	"Added by the RBOT-ET WORM!"
X	Windows Media Updater	crease.exe	"Added by the RBOT-ATI WORM!"
X	Windows Micro Drivers	wupdates32.exe	"Added by the RBOT-AEH WORM!"
X	Windows Microsoft Update	wintask32.exe	"Added by a variant of the SDBOT WORM!"
X	Windows MS Update 32	fhm.exe	"Added by the IRCBOT.GEN WORM!"
X	Windows MS Update 32	sucker.exe	"Added by the FORBOT-GJ WORM!"
X	Windows MS Update 32	jebote.exe	"Added by the FORBOT-GK WORM!"
X	Windows MSN Updates	wnd32.exe	"Added by the IRCBOT-ABA TROJAN!"
X	Windows NT Update Manager	WINL0G0N.exe	"Added by the AGOBOT-NU WORM! Note that those are zeroes in the filename and not capital ""o"""
X	Windows Online Updater	dllman.exe	"Added by the RBOT-TE WORM!"
X	Windows Process	win_update.exe	"Added by the LASTWORD WORM!"
X	Windows Registry Scan	timeupdate.exe	"Added by the SPYBOT.JE WORM!"
X	Windows Secure Update	winupser.exe	"Added by the RBOT-GCG WORM!"
X	Windows Secure Update	WinSecUp.exe	"Added by the RBOT-GCD WORM!"
X	Windows Secure Update	load.exe	"Added by the FORBOT-GU WORM!"
X	Windows Secure Update	WinSecure.exe	"Added by the RBOT-GDO WORM!"
X	Windows Security Update	security32.exe	"Affilred adware"
X	Windows Security Update	ndsass.exe	"Added by the RBOT.ESM BACKDOOR!"
X	Windows Service Pack Auto Update	winworks.exe	"Adware downloader - detected by eScan antivirus as the AGENT.BT TROJAN!"
X	Windows Service Pack Auto Update	figgaz.exe	"Detected by Kaspersky as the AGENT.BT TROJAN!"
X	Windows Service Pack Auto Update	ballin.exe	Added by an unidentified WORM or TROJAN!
X	Windows Service Pack Auto Update	del-me.exe	"Adware
X	Windows Service Update	livecal.exe	"Added by the SDBOT-DEY WORM!"
X	Windows Service Update	crsss.exe	"Added by the SDBOT.CWX WORM!"
X	Windows Service Update	mswsgs.exe	"Added by the RBOT.FQB WORM!"
X	Windows Services	wupdate.exe	"Added by the GAOBOT.ZT WORM!"
X	Windows Services Update	svch0st.exe	"Added by a variant of the RBOT WORM! Note - the filename has the digit 0 rather then the uppercase ""o"""
X	Windows SP2 Update	Sp2update.exe	"Added by the WOOTBOT.BS WORM!"
X	Windows Svshost Service Update 32	svcsshost32.exe	"Added by the FORBOT-GD WORM!"
X	WINDOWS SYSTEM	xpupdate.exe	"Added by the ZOTOB-G WORM!"
X	WINDOWS SYSTEM	wupdate.exe	"Added by the MYTOB-HT WORM!"
X	WINDOWS SYSTEM UPDATE	xDcc.exe	"Added by the MYOTB-EH WORM!"
X	Windows System Update Tools	upds.exe	"Added by the VANBOT.CX BACKDOOR!"
X	Windows Update	[filename]	"Added by the NORIO TROJAN! Acts as a hi-jacker redirecting to adult content sites"
X	Windows Update	iexplorere.exe	"Added by the GAOBOT.AP WORM!"
X	windows update	uddater.exe	"Added by the LEOX TROJAN!"
X	Windows Update	wudate.exe	"Added by the AGOBOT.ML WORM!"
X	Windows Update	wupdate.exe	"Wengs adware"
X	windows update	sychost.exe	"Added by the LEOX.B WORM!"
X	Windows Update	Wuamgrd.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Update	inetinf.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Windows Update	WindowsUpdate.exe	"Added by the BAYROB-A TROJAN!"
X	Windows Update	host32.exe	"Added by the RBOT-GU WORM!"
X	windows update	wuraclt.exe	"Added by the RBOT-PO WORM!"
X	windows update	Wuanclt.exe	"Added by the RBOT.XZ WORM!"
X	Windows Update	svchosts.exe	"Added by the FRUCTA TROJAN!"
X	Windows Update	ebay.exe	"Added by the GAOBOT.BUU WORM!"
X	Windows Update	windows.exe	"Added by the RBOT-RB WORM!"
X	windows update	wuaurlt.exe	"Added by the RBOT.ADG WORM!"
X	Windows Update	Update.exe	"Added by the DELF-FN TROJAN!"
X	Windows Update	winmguard.exe	"Added by the RBOT-EM WORM!"
X	Windows Update	wuampd.exe	"Added by the RBOT.UM WORM!"
X	windows update	wuarclt.exe	"Added by the RBOT-OF WORM!"
X	Windows Update	winupdate.exe	"Added by the SDBOT-WS WORM!"
X	Windows Update	msnwinsb.exe	"Added by the RBOT-AAH WORM!"
X	Windows Update	scvhost.exe	"Added by the SDBOT-XT WORM!"
X	windows update	Microsoft.exe	"Added by the LMIR.A TROJAN!"
X	Windows Update	mplupdate.exe	"Added by the MOEGA WORM!"
X	windows update	msnsever.exe	"Added by the RBOT-AHN WORM!"
X	Windows Update	taskmr.exe	"Added by the MYTOB-GZ WORM!"
X	Windows Update	update32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update	wininfo.exe	"Added by the MYTOB.GA WORM!"
X	Windows Update	winlogin.exe	"Added by the BANKER-DV TROJAN!"
X	Windows Update	msnupdates.exe	"Added by the RBOT-ALK WORM! Note - this file has nothing to do with Windows updates or MSN"
X	Windows Update	qtask.exe	"Added by the RBOT-AKU WORM! Note - do not confuse with the Quicken file of the same name as described here"
X	windows update	real.exe	"Added by the LEGMIR-AU WORM!"
X	Windows Update	windowsx.exe	"Added by the BANCD-A TROJAN!"
X	Windows update	wudupdate.exe	"ISTBar adware related"
X	Windows Update	wupdmgr.exe	"Added by the BANCBAN-FC TROJAN and variants!"
X	Windows Update	csrss.exe	"Added by the BANKER-HM TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Update	msnsupdate.exe	"Added by the RBOT-AXS WORM!"
X	Windows Update	XPLoogNT.exe	"Added by the BANCD-B TROJAN!"
X	Windows Update	install.exe	"Added by the BANKER-IB TROJAN!"
X	Windows Update	msi.exe	"Added by the BANKER-XB TROJAN!"
X	Windows Update	Sqltob.exe	"Added by the DASHER.A WORM!"
X	windows update	logonuit.exe	"Added by the LEGMIR-AO TROJAN!"
X	Windows Update	avkir.exe	"Added by the RBOT-GJP WORM!"
X	Windows Update	easypwnt.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update	MSDEVS30.exe	Added by the SPYBOT.AHC WORM!
X	Windows Update	SecretStub.exe	"Added by the SRAMLER.C WORM!"
X	Windows Update	Winload.exe	"Added by the DEDMIR-A WORM!"
X	Windows Update	taskngr.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Update	usnsvc.exe	"Added by the KOBOT-C WORM!"
X	Windows Update	win32update.exe	"Added by the SDBOT.FTK WORM!"
X	Windows Update	livesrvs.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update	McAfee.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not a valid McAfee program"
X	Windows Update	McAfee3.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Windows Update	msconfig32.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows Update	msnsa32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Update	scrigz.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Update	winsc.exe	"Added by the BUZUS.RYI TROJAN!"
X	Windows Update	wuauclt32.exe	"Added by the SDBOT.DHY WORM!"
X	Windows Update	dllhostup.exe	"Added by the BANCBAN-NB TROJAN!"
X	Windows Update	explored.exe	"Added by the GAOBOT.MF WORM!"
X	Windows Update	smsscr.exe	"Added by the BANKER-DK TROJAN!"
X	Windows Update	sysdrv.exe	"Added by the AGENT-IYE TROJAN!"
X	Windows Update	winupupdate1.exe	"Added by the RBOT-UV WORM!"
X	Windows Update	klass.exe	"Added by the BIFROSE-ZH TROJAN!"
X	Windows Update	winlogonEvt.exe	"Added by the VB-DXM TROJAN!"
X	Windows update	explore.exe	"Added by the GAOBOT.AL WORM!"
X	Windows Update	fdos.exe	"Added by the RBOT-COG WORM!"
X	Windows Update	leak32x.exe	"Added by the AGENT.ALY BACKDOOR!"
X	Windows update	msb32.exe	"Added by the GAOBOT.CG WORM!"
X	Windows update	svdhost.exe	"Added by the GAOBOT.CG WORM!"
X	Windows Update	tskmngr.exe	"Added by the AGENT.ALY BACKDOOR!"
X	Windows Update	windb32.exe	"Added by the AGENT.ALY BACKDOOR!"
X	Windows update 2005	[random filename]	"Added by the RBOT.ARP WORM!"
X	Windows Update 32	winlogons.exe	"Added by the FORBOT-FI WORM!"
X	Windows Update 32	rempss.exe	"Added by the FORBOT-FW WORM!"
X	Windows Update 32	slsys.exe	"Added by the FORBOT-FT WORM!"
X	Windows update 32bit	winupd32.exe	"Added by the SDBOT.BE WORM!"
X	Windows Update 63	shupd64.exe	"Added by the FORBOT-GA WORM!"
X	Windows Update 64	nbupd64.exe	"Added by a variant of the FORBOT WORM!"
X	Windows Update 64	WinV.exe	"Added by the FORBOT-FP WORM!"
X	Windows Update Auto Update	wuaumgr.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Update Automatic Updates	[path to backdoor]	"Added by the VBBOT.AM BACKDOOR!"
X	Windows Update Automation	winuptdate.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update AutoUpdate Client	waucult.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update AutoUpdate Client	wuauclt.exe	"Added by the LAZAR.B TROJAN! Note - this is not the legitimate wuauclt.exe process
X	Windows Update AutoUpdate Client Product	wuauct.exe	"Added by the AGOBOT.ACL WORM!"
X	Windows Update Center	svthx.exe	"Added by the STUBBOT.A WORM!"
X	Windows Update Center	W32RSA.exe	Added by an unidentified WORM or TROJAN!
X	Windows Update Check	syslodr.exe	"Added by the SMALL.LU TROJAN!"
X	Windows Update Checker	[random filename]	Adware downloader trojan
X	Windows Update Checker	msupdte32.exe	"Added by the SDBOT-AEF WORM!"
X	Windows Update Checker	deinst_qfe001.exe	Added by a variant of the Win32.Small TROJAN!
X	Windows Update Checker	deinst_qfe002.exe	Added by a variant of the Win32.Small TROJAN!
X	Windows Update Client	wuclient.exe	"Added by the SMALL-RN TROJAN!"
X	Windows Update Client Service	windrvl32.exe	"Added by the AGOBOT-MM TROJAN!"
X	Windows update config	svhost.exe	"Added by the SDBOT-PF WORM!"
X	windows update configurator	svghost.exe	"Added by a variant of the SPYBOT WORM!"
X	windows update configurator	explore.exe	"Added by the SDBOT.RY BACKDOOR!"
X	Windows Update Controller	mwoffice.exe	"Added by the BATTRY-A TROJAN!"
X	Windows Update Draven	draven.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update Drive	updrvs.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update Files	dnetc.exe	"Added by an unidentified VIRUS
X	Windows Update Firewall System	ctfmoom.exe	"Added by the RBOT-GAN WORM!"
X	Windows Update Firewall System	winmsfw.exe	"Added by the RBOT-EEO WORM!"
X	Windows Update Firewall System	ctfmom.exe	"Added by the SPYBOT.ANDM WORM!"
X	Windows Update GUI Executable x32x	wupdategux32.exe	"Added by the RBOT.CXY WORM!"
X	Windows Update Host	winupsvc.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update IPv6 Layer	WIN32IPV6.EXE	"Added by the RBOT.DUD WORM!"
X	Windows update loader	xpupdate.exe	"Malware installed by different rogue security software including SpyKillerPro. Also detected as the BRAVE-A TROJAN!"
X	Windows Update Manager	wupdmngr.exe	"Added by the RANDEX.BTB WORM!"
X	Windows Update Manager	Winlog0n.exe	"Added by the AGENT-BO TROJAN!"
X	Windows Update Manager	wupdate.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update Manager	bootwiz.exe	Added by the MYBOT WORM!
X	Windows Update Manager	WindowsUpdateManager.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Update Manager for NT	wupdmgr32.exe	"Added by the SDBOT.AH WORM!"
X	windows update microsoft	updatem.exe	"Added by the RBOT-CHE WORM!"
X	Windows Update Monitoring Service	winupdt.exe	"Added by the RBOT-PL WORM!"
X	Windows Update Process	wmiprvsc.exe	"Added by the SDBOT-CB WORM!"
X	Windows Update Service	csrs.exe	"Added by the AGOBOT-NI WORM!"
X	Windows Update Service	smcg.exe	"Added by the SDBOT.QY WORM!"
X	Windows Update Service	SP00ISS.exe	"Added by the SDBOT-ZH WORM!"
X	Windows Update Service	update32.pif	"Added by the RBOT-ALC WORM!"
X	Windows Update Service	trest.exe	Identified by BitDefender as a variant of the PEED TROJAN!
X	Windows Update Service	wmiprvse32.exe	"Added by the AGOBOT.NI WORM!"
X	Windows Update Service	regscv.exe	"Added by the AGOBOT-AM BACKDOOR!"
X	Windows Update Service	msupdate32.exe	"Added by the DLOADR-CRJ TROJAN!"
X	Windows Update Service 2004/2005	systemupdate.exe	"Added by the RBOT-JE WORM!"
X	Windows Update services	wins32svcs.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update Services	winupdate32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update Software	system.exe	"TOFGER.BX spyware"
X	Windows Update SP3	Windat.EXE	"Added by the RBOT-GTS WORM!"
X	Windows Update Svc	rundll32.exe xpupdate.dll	"ContraVirus rogue security software - not recommended
X	Windows Update System	mswins.exe	"Added by the IRCBOT.DN WORM!"
X	Windows Update System Shell	svhostcs32.exe	"Added by the RBOT-AAZ WORM!"
X	Windows Update V6	[random filename]	"Added by the RBOT-KT WORM!"
X	Windows Update.exe	N/A	Homepage hijacker
X	Windows Updated	spoolsae.exe	"Added by the RBOT-APM WORM!"
X	Windows Updated	updatr.exe	"Added by the RBOT-AYB WORM!"
X	Windows Updater	wupdmgr32.exe	"Added by a variant of the DOS.AUTOCAT TROJAN!"
X	Windows Updater	iexplorerrs.exe	"Added by the RBOT-TN WORM!"
X	Windows Updater	svigost.exe	"Added by the RBOT-VS WORM!"
X	Windows Updater	wupdate.exe	"Added by the WOOTBOT.AJ WORM!"
X	Windows Updater	sdsys.exe	"Added by the FORBOT-JG WORM!"
X	Windows Updater Online	winupdatexx.exe	"Added by a variant of the RBOT WORM!"
X	Windows Updater Servc	xpuupdate.exe	"ContraVirus rogue security software - not recommended
X	Windows Updater Service Manager	winupdatr.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Updater Services	msnupdate.exe	"Added by a variant of the RBOT WORM!"
X	windows updaters	winupdats.exe	"Added by the SPYBOT-IS WORM!"
X	Windows Updates	lsassx.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Updates	winupd32.exe	"Added by the MYTOB.CE WORM!"
X	Windows Updates	w32dns.exe	"Added by the SDBOT-BFW WORM!"
X	Windows Updates Agent	winupdate.exe	"Added by the SPYBOT.HW WORM!"
X	Windows USB Monitor	servupdate.exe	"Added by the IRCBRUTE.AQ TROJAN!"
X	Windows XP Automatic Update	wXPupdate.exe	"Added by the RBOT-AFC WORM!"
X	WindowsACEbar	acebarupdate.exe	"BarACE adware"
X	WindowsCriticalUpdate	windows_critical_update.exe	"Added by the ASTEF or RESPAN WORMS!"
X	Windows�Updates	Update.exe	"Added by the RBOT.TRA BACKDOOR!"
X	WindowsKeyUpdate	master.exe	"Added by the JOSAM WORM!"
X	WindowsReg% update	[random filename].exe	"Added by the RBOT-HH WORM!"
X	WindowsRegKey Autoupdate	[random filename]	"Added by a variant of the RBOT WORM!"
X	WindowsRegKey update	winupdate.exe	"Added by the RBOT-QJ WORM!"
X	WindowsRegKey update	windns.exe	"Added by the RBOT.IE WORM!"
X	WindowsRegKey update	winupdatexx.exe	"Added by the RBOT.LW WORM!"
X	WindowsRegKey update	[random filename]	"Added by the RBOT.QT WORM!"
X	WindowsRegKey update	svchoosts.exe	"Added by the RBOT.ADB WORM!"
X	WindowsRegKey update	svchostc.exe	"Added by the RBOT.IF WORM!"
X	WindowsRegKey update	wdnupdate.exe	"Added by the SDBOT.QX WORM!"
X	WindowsRegKey update	Windowsup.exe	"Added by the SDBOT.PU WORM!"
X	WindowsRegKey update	WINUPDATES.EXE	"Added by the RBOT-MM WORM!"
X	WindowsRegKey update	rkbuouoxfl.exe	"Added by the RBOT-OO WORM!"
X	WindowsRegKey update	winsys.exe	"Added by the RBOT-JY WORM!"
X	WindowsRegKey update	winupdat32.exe	"Added by the RBOT-AGW WORM!"
X	WindowsRegKey update XP	windexv1.exe	"Added by the RBOT-ABM WORM!"
X	WindowsRegKey%$ update	msi332.exe	"Added by the RBOT-IX WORM!"
X	WindowsRegKey%update	ethernet32m.exe	"Added by the RBOT-EN WORM!"
X	WindowsRegKeys update	winsysi.exe	"Added by the SDBOT.WE WORM!"
X	WindowsUpdate	windows_update.exe	"Added by the LOFNI WORM!"
X	WindowsUpdate	svchost.exe	"Added by the ASTEF or RESPAN WORMS or AGENT-V TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	windowsupdate	RPC[RANDOM CHARACTERS].exe	"Added by the IRCBOT.B TROJAN!"
X	WindowsUpdate	USRINIT.EXE	"Added by the MADDIS.B WORM!"
X	windowsupdate	winupdate.exe	"Added by the WARPI WORM!"
X	WindowsUpdate	svchost.exe	"Added by the BDOOR-IK BACKDOOR! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	WindowsUpdate	winnnint.exe	Added by an unidentified WORM or TROJAN!
X	WindowsUpdate	[path to file]	"Added by the DUPA-B TROJAN!"
X	WindowsUpdate	svchostw.exe	"Added by the COBFINN_B TROJAN!"
X	WindowsUpdate	Nzil.exe	"Added by the CULLER-C WORM!"
X	WindowsUpdate	Strad.exe	"Added by the CULLER-D WORM!"
X	Windowsupdate	Windowsupdate.exe	"Added by the BANKER.ARK TROJAN!"
X	Windowsupdate	wupdmgr98.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	WinDOwsUPdate	smss.exe	"Added by the AUTORUN.DIB WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~� subfolder"
X	windowsupdate	autoupdate.exe	"Added by the IRCBOT-P BACKDOOR!"
X	WindowsUpdate	svdhost.exe	"Added by the AGOBOT-BP WORM!"
X	WindowsUpdate	twain.exe	"Added by the AGENT.BEA TROJAN!"
X	WindowsUpdate renew	iexplore.exe	"Added by the AGENT.QG TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	WindowsUpdate Service	wuautlc.exe	"Added by the RBOT-NR WORM!"
X	Windowsupdate Service	csrss.exe	"Added by the BABA-B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in the root folder (ie
X	WindowsUpdatecrss	crss.exe	"Added by a variant of the AGENT-HZ TROJAN!"
X	WindowsUpdateDirect	dupadirect.exe	"Added by the DUPA-C TROJAN!"
X	WindowsUpdatelsasss	lsasss.exe	"Added by a variant of the AGENT-HZ TROJAN!"
X	WindowsUpdatem1	[path to file]	"Added by the AGENT-AAJ TROJAN!"
X	WindowsUpdatem2	svchost.exe	"Added by an unidentified WORM or TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	WindowsUpdateManager	wupdmng.exe	"Added by the IRCBOT.OE BACKDOOR!"
X	WindowsUpdateNT	svwhost.exe	"Added by the SHELLOT-B TROJAN!"
X	WindowsUpdateR	regserv.exe	"Added by the COBFINN_B TROJAN!"
X	WindowsUpdatesvchostss	svchostss.exe	"Added by the AGENT-HZ TROJAN!"
X	WindowsUpdatev4	w32gins.exe	"Added by an unidentified WORM or TROJAN! Located in the Root folder (C:\)
X	WindowsUpdatewinsec	winsec.exe	"Added by a variant of the AGENT-HZ TROJAN!"
X	WindowsXP Update	windowsxpupdate.exe	"Added by the RBOT-PB WORM!"
X	Windows_Updates	svthost.exe	"Added by a variant of the SPYBOT WORM!"
X	Windowz Update V2.0	Explorer.exe	"Added by the YODO WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Windowz Update V2.0	updater.exe	"Added by the YODO-C WORM!"
X	Windoxs Update Center	W32RfSA.exe	"Added by a variant of the SDBOT WORM!"
X	WindUpdates	[path to trojan]	"Added by the AGENT.BF TROJAN!"
X	WindUpdates	WinUpdt.exe	Windupdates adware variant
X	WinLibUpdate	libupdate.exe	"Added by the BIONET series of TROJANS such as BIONET.31 or BIONET.310"
X	WinLibUpdate32	libupdate32.exe	Added by the BIONET.405 TROJAN!
X	winlocatorupdate	updatewinlocator.exe	Locator adult content toolbar related
X	winnt DNS ident	winupdate32.exe	"Added by a variant of the RBOT WORM!"
X	Winprocer32 Update	winprocer32.exe	"Added by the RBOT.GW WORM!"
X	winprocessor Update	winprocessor.exe	"Added by the RBOT.IO WORM!"
X	Wins Update 32	services32.exe	"Added by the FORBOT-FN WORM!"
X	WinSetBrowse	BasicUpdate.dll.vbs	"Added by the BISCUIT.A WORM!"
X	WinShowUpdate	copy [path] winshow.new [path] winshow.dll	"Winshow parasiate related - from the ""RunOnce"" keys it replaces ""winshow.dll"" with a new version"
X	Winsock driver	winnt update.exe	"Added by the SPYBOT-DM TROJAN!"
X	Winsock driver	winupdate32.exe	"Added by the SPYBOT-JZ TROJAN!"
X	Winsock2 driver	winupdate.exe	"Added by the SPYBOT-BX WORM!"
X	Winsock32driver	sp2XPupdate.exe	"Added by the HACKARMY.S TROJAN!"
X	Winsock32driver	winXPupdate.exe	"Added by the HACKARMY.9728 TROJAN!"
X	winsupdater	winsupdater.exe	"Added by the ALCRA-F WORM!"
X	winsupdatesysmngr64	winsys64mnger.exe	"Added by the RBOT-BAG WORM!"
X	WINTASK DLL32	updatewin	"Added by the MYTOB.NI WORM!"
X	WintelUpdate	[path to trojan]	"Added by the SMALL-EKW TROJAN!"
X	WinTimer	msupdate.cmd	"Hijacker - detected by Kaspersky as the STARTPAGE.TJ TROJAN!"
X	WinUpdate	RBSKQQBO.EXE	"Added by the VBSWG2B.A WORM!"
X	WinUpdate	wmbem.exe	"Added by the REVCUSS.B TROJAN!"
X	WinUpdate	updsys.exe	"Added by a variant of the RBOT WORM!"
X	winupdate	winupdate.exe	"Added by the ALCAN.B WORM!"
X	WinUpdate	svhost.exe	"Added by a variant of the SDBOT WORM!"
X	WinUpdate	svchots.exe	"Added by the SMALL.GXJ TROJAN!"
X	winupdate	jusched.exe	"Added by the DWNLDR-FUX TROJAN! Note that this is not the legitimate Sun Microsystems file (of the same name) which is usually located in %Program Files%\Java\version number\bin. This one is located in %Windir%"
X	Winupdate	lsas.exe	"Added by the COSPET.JR TROJAN!"
X	Winupdate Engine	wupeng.exe	"MalwareCrush rogue security software - not recommended
X	WinUpdate Loader	msnnm.exe	"Added by the REVCUSS.C TROJAN!"
X	Winupdate Service	winxp.exe	"Added by the SPYBOT.IR WORM!"
X	winupdate.exe	winupdate.exe	"Added by the RADO TROJAN!"
X	winupdate.reg	winupdate.exe	"Added by the SPYBOT.EAS WORM!"
X	winupdate2846	vbsystem35.exe msvbrun.exe	"Added by a variant of the MUTIN-C TROJAN!"
X	winupdate86.exe	winupdate86.exe	"Added by the FAKEAV-AHQ TROJAN!"
X	WinUpdateAdministrator	CSRSS.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in C:\Application Data\WINDOWS"
X	WinUpdateB	breatle.exe	"Added by the BRATLE.AWORM!"
X	winupdateconn	[path to file]	"Added by the COMBRA-A WORM!"
X	winupdateconn_	Explorer.EXE	"Added by the COMBRA-B WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Winupdatee	winsvcc.exe	"Added by the AGENT.AN TROJAN!"
X	winupdatefiv_	[path to file]	"Added by the COMBRA.C WORM!"
U	WinUpdateProtection	csrss.exe	"EmployeeWatch is a commercial surveillance software program designed to monitor user activity on a computer. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a subfolder of C:\windowsupdate\ufp"
X	WinUpdater	update.exe	"Added by the STARTPAGE.C TROJAN!"
X	winupdates	winupdates.exe	"Added by the ALCRA-B WORM!"
X	winupdate_	[path to file]	"Added by the COMDOR.A WORM!"
X	WinxDiagUpdate	WinxDiagUpdate	"Added by the RBOT.BWQ BACKDOOR!"
X	Winxp update	Cappp.exe	"Added by the RBOT.DKO WORM!"
X	WinXp Updater	winxp32.exe	"Added by the RBOT-HG WORM!"
X	WinXpUpdate32	WinXpUpdate32.exe	"Added by the AGENT.YWL WORM!"
X	WinZip Update	WinZip.exe	"Added by a variant of the RBOT WORM! Note - this is not part of the popular WinZip file compression utility"
X	WMP Auto Update	WINMEDUP.EXE	"Added by the RBOT.CF WORM!"
X	wmupdate	wmupdate.exe	"Added by the AGENT-GGJ TROJAN!"
X	wnxpupdate	spvspool.exe	"Added by the DABORA.B WORM!"
X	wnxupdate	updatexp.exe	"Added by the COMBRA-G WORM!"
X	won update	WAPDATE.EXE	"Added by the RBOT.N WORM!"
X	wupdate	wisvccz.exe	"Added by the ORSE-B TROJAN!"
X	wupdate	wi32.exe	"Detected by Panda as Trustbid spyware"
X	WUpdate	1037v.exe	"Added by the CLAGGER-AR TROJAN!"
X	Wupdate driver	[various filenames]	"Added by a variant of the SPYBOT WORM!"
X	Wupdate driver	wupdadte.exe	"Added by the SPYBOT-CQ WORM!"
X	WUpdates	WUpdates.exe	"Added by the SWEPDAT TROJAN!"
X	Wxp4	Norton Update.exe	"Added by the ERKEZ.D WORM!"
X	xDRam rar procx	xwinupdaterarx.exe	"Added by the RILER-W TROJAN!"
X	xp32win	xpupdater02.exe	"Added by the MOSUCK-A TROJAN!"
X	xpiupdate	xpiupdate.exe	"Added by the RBOT-AAB WORM!"
X	xpsp2install	xpsp2Update.exe	"Added by the AGENT-DPK BACKDOOR!"
X	xpsp2Update	xpsp2Update.exe	"Added by the AGENT-DPK BACKDOOR!"
X	xpupdate	updates.exe	"Added by the BROPIA.L WORM!"
X	XTServiceUpdate	XTServiceUpdate.exe	hahame.net adware downloader
X	Yahoo Update	Yahoo!.exe	"Added by the YAHOO! TROJAN!"
X	Yahoo Update	Yahoo.exe	"Added by the RBOT.AH BACKDOOR!"
X	Yahoo Updater	Messenger.exe	"Added by the FORBOT-FE WORM!"
X	YhooUpdates	ymsmsgs.exe	"Added by the SMALL_K TROJAN!"
X	zervpack2	update2.exe	"Added by the SDBOT.WD WORM!"
X	Zi5	AntiVirus Update.exe	"Added by the ERKEZ.G WORM!"
U	ZoneUpdate	csrss.exe	"WinSpy surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""ComRoot"" subfolder"
X	Zupdate	Zupdate.exe	"Associated with B3d Projector foistware - see here"
X	{C0FB7D08-056E-1033-0501-03020730002c}	Update.exe	"Added by the AGENT-EOG TROJAN!"