NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

• "Y" - Normally leave to run at start-up
• "N" - Not required - typically infrequently used tasks that can be started manually if necessary
• "U" - User's choice - depends whether a user deems it necessary
• "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
• "?" - Unknown

Fatal error: Maximum execution time of 30 seconds exceeded in /home/iamnotag/domains/iamnotageek.com/public_html/startup/search.php on line 252

	Startup Name	Process Name	Details
N	!NoLoad	winrecon.exe	"WinRecon keystroke logger/monitoring program - remove unless you installed it yourself!"
ME"	"MS Java Applets for Windows NT	X	javaapplets.exe
NT	"Ms Java for Windows 98	ME & XP"	X
NT	"Ms Java for Windows 98	XP & ME"	X
XP & ME	"MS Java for Windows NT	X	xpjavams.exe
Version	"NVIDIA Compatible Windows Vista Display driver	U	"RUNDLL32.EXE NvCpl.dll
Version	"NVIDIA Compatible Windows7 Display driver	U	"RUNDLL32.EXE NvCpl.dll
X	$WindowsRegKey%update	IEXPLORE.EXE	"Added by the RBOT-EZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	%Windir%winnl.exe	winnl.exe	"Added by the KIDKITI TROJAN!"
X	%Windir%winnm.exe	winnm.exe	"Added by the KIDKITI TROJAN!"
X	(*)API Machine	winSOCKS.exe	"Homepage hijacker
X	(*)Run	win32API.exe	"Homepage hijacker
X	(Default)	winhelp.exe	"Added by the BLACKMAL.C WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	winbas12.exe	"Adware
X	(default)	winlog.exe	"Added by the RBOT-CVY WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	winligom.exe	"Added by the RBOT-GAI WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKCU\Run
X	*windows update	wrauclt.exe	"Added by the RBOT-QU WORM!"
X	*windows update	wuanclt.exe	"Added by the RBOT-PG WORM!"
X	*windows update	wuaucrlt.exe	"Added by the SPYBOT.HUR WORM!"
X	*windows update	wuraclt.exe	"Added by the RBOT-PO WORM!"
X	*windows update	wurauclt.exe	"Added by the RBOT-SY WORM!"
X	*windows update	wsctl.exe	"Added by the SPYBOT.PR WORM!"
X	*windows update	wkmst.exe	"Added by the SDBOT.AVD WORM!"
X	*windows update	wscxt.exe	"Added by the RBOT.AOS WORM!"
X	*windows update	waurclt.exe	"Added by a variant of the RBOT WORM!"
X	*windows update	wuaruclt.exe	"Added by the RBOT-TF WORM!"
X	*Windows [filename] Checker	[filename]	"Added by the KEDEBE-B WORM!"
X	*WindowsAudio	systemupd.exe	"Added by the AGENT-TH WORM!"
X	*WinLogon	[trojan path] ren time:[random number]	"Added by the VUNDO TROJAN!"
X	*winstats	winstats.exe	"Added by the GARGAFX TROJAN!"
X	.Prog	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
U	12Ghosts JustAWindow	12window.exe	"12Ghosts JustAWindow - ""Cover annoying ads
U	1Win32Cfg	SpyBuddy.exe	"SpyBuddy from ExploreAnywhere
U	1Win32Cfg	Keyloggerpro.exe	"Keyloggerpro keystroke logger/monitoring program - remove unless you installed it yourself!"
X	1WinCfg32	WebMailSpy.exe	"WebMailSpy spyware"
X	252	winmgr.exe	"Added by the LEGMIR-AT TROJAN!"
X	9m	winlog0n.exe	"Added by the LEGMIR-AQK TROJAN!"
X	@	regedit -s win.dll	"Added by the SEEKER.K TROJAN! Note that regedit is the the legitimate Windows Registry Editor and shouldn't be deleted. The ""win.dll"" file is located in %Windir%"
X	@	wincms.exe	"Added by the RBOT.CBR WORM!"
X	@	winsys32.exe	"Added by the DELF.CP BACKDOOR! Note that the entry under the Startup Item/Name field my be blank"
X	A New Windows Updater	w32NTupdt.exe	"Added by the MYTOB.BM WORM!"
Y	a-winpoet-service	winpppoverethernet.exe	"WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion
X	Abrada WIN32	abrada.exe	"Added by the DERMON-G TROJAN!"
X	Access Control App	winsto.exe	"Added by the AGENT.DGO TROJAN!"
U	Actual Window Manager	ActualWindowManagerCenter.exe	"Actual Window Manager from Actual Tools - ""an innovative desktop organization application which introduces unconventional window controls and also automatic general window operations making your work more productive
U	Actual Window Minimizer	ActualWindowMinimizerCenter.exe	"Actual Window Minimizer - ""allows minimizing any window to task tray notification area or to the edge of the screen"""
X	AdAware	wini.exe	"Added by the RBOT-XN WORM!"
X	Administrator	winlogon.exe	"Added by the RUBBLE-C WORM! Note - this is not the legitimate winlogon.exe process
X	AdobeReaderPro	winslog.exe	"Added by a variant of the RBOT WORM!"
X	AdobeReaderPro	winini.exe	"Added by a variant of the RBOT WORM!"
X	ADriver	windrv.exe	"Added by the DELF.WG TROJAN!"
U	AFAFilter	windefault.exe	"AFAFilter - internet filter software"
X	AKEYNAME	WinServ.exe	"Added by the EVILBOT.C TROJAN!"
U	All Aboard Status	stswin.exe	"All Aboard! Internet Connection Sharing status icon"
U	AMP WinOFF	winoff.exe	"WinOFF is "" a utility designed to shut down Windows computers automatically
X	Anti-Virus Update Scheduler	winsp3.exe	"Malware - detected by Kaspersky as the AGENT.FP TROJAN!"
X	antike	wingate32.exe	"Added by a variant of the RBOT WORM! See here"
X	AntiVir	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
Y	AntiVir XP	AVwin.exe	"AntiVir® PersonalEdition Classic - antivirus"
U	AntiWindowsMessenger	AntiMsMsg.exe	"Anti-Windows_Messenger is a small application that prevents Windows Messenger from remaining resident in memory"
X	APIMon	winapix.exe	Added by a variant of the TIBSER.A downloader TROJAN!
Y	Apvxd	APVXDWIN.EXE	"Part of Panda Antivirus and Internet Security. Required to enable permanent virus protection"
Y	Apvxdwin	APVXDWIN.EXE	"Part of Panda Antivirus and Internet Security. Required to enable permanent virus protection"
Y	APVXDWIN	ClShield.exe	"""Panda ClientShield with TruPrevent is designed for companies that want the best protection for their workstations. It protects against viruses and other known and unknown threats including spam
X	ASC-AntiSpyware	WinCleaner.exe	"WinCleaner 2009 rogue security software - not recommended
X	ASC-AntiSpyware	WinAntivirus.exe	"Win Antivirus Vista/XP rogue security software - not recommended
X	asdx	xwinrpc32.exe	"Added by the AGOBOT.VO WORM!"
X	atisrc2	windfind.exe	"Added by the WINDFIND-A TROJAN!"
X	Audio Device Manager	winfp.exe	"Added by the IRCBOT-XS WORM!"
X	Audio Device Manager	WinNT.exe	"Added by the IRCBOT.USP BACKDOOR!"
Y	Authentic-ID Toolbar	wintmr.exe	"System Tray access to Child Control parental control software by Salfield"
X	auto	win32.exe	"Added by an unidentified TROJAN! See here"
X	Auto Start	windos.exe	"Added by the SLINBOT.BO BACKDOOR!"
X	Auto Updat	WindowsSys32.exe	"Added by a variant of the FORBOT WORM!"
X	Auto WinUpdate	taskmrg.exe	"Added by the RBOT-AFA WORM!"
X	autoload	windowsupdate.exe	"Added by the POLYCRYP.DY TROJAN!"
X	Automated Windows Updates	wauclt.exe	"Added by the GAOBOT.AJD WORM!"
X	Automatic Microsoft Windows Updater	suchost.exe	"Added by the RBOT-EQ WORM!"
X	Automatic Windows Updater	Update.exe	"Added by the GAOBOT.AO WORM!"
X	autorun	winmain.exe	Added by a variant of the DELF.CNS TROJAN!
X	avp	win*.tmp.exe [* is a number]	Added by a variant of the ALPHABET TROJAN!
X	AVScan	winav.exe	Unidentfied rogue security software
X	BackUp Windows 2009	[random].exe	"Added by the AGENT-LUJ TROJAN!"
X	bawindo	bawindo.exe	"Added by the BEAGLE.AR or BEAGLE.AU WORMS!"
N	Bing Bar	mswinext.exe	"Bing Bar - the latest incarnation of the MSN Toolbar from version 5.* onwards. This entry loads the toolbar into memory at start-up before you open your internet browser. Not required - it will load with the browser and remains in memory after the browser is closed"
X	blah service	winupdate.exe	"Added by the GAOBOT.BIA WORM!"
X	blah service	winsysengine.exe	"Added by the RBOT-KI WORM!"
X	blah service	win32.exe	"Added by the RBOT-AXO WORM!"
X	Bluetooth Config	btwindin32.exe	"Added by the SDBOT-DFN WORM!"
X	BossIdea	winlogin.exe	"Added by the LINEAGE-I TROJAN!"
X	BuildLab	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	Bymer.Scanner	Wininit.exe	"Added by the BYMER WORM!"
X	c	c:archiv~1win.com	"Added by the CUYDOC TROJAN!"
U	C:Program Filesdfjdkjfdkjfldjfdfjdkjfdkjfldjfwinlogin.exe	CritProc.exe	"KeyProwler keystroke logger/monitoring program - remove unless you installed it yourself!"
X	C:WINDOWSasam.exe	asam.exe	"Added by the PEACOMM.E TROJAN!"
X	C:WINDOWSIEXPLOR.EXE	IEXPLOR.EXE	"""Pop Marketing"" adware"
X	C:WINDOWSsystem32SetupCmd.exe	SetupCmd.exe	"Detected by Kaspersky as the AGENT.AAW TROJAN!"
X	C:WINDOWSWinTask.exe	WinTask.exe	"""Pop Marketing"" adware"
X	Cable Modem Adapter	WindowsSec.exe	"Added by the WOOTBOT.A WORM!"
X	Calc Microsoft Windows	wincalc.exe	Added by an unidentified WORM or TROJAN!
?	Canon PC1200 iC D600 iR1200G Status Window	CAPM1LAK.EXE	"Cannon printer related - is it required in startup?"
X	ccApps	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
Y	CCWinTray	wintmr.exe	"System Tray access to Child Control parental control software by Salfield"
U	CD-DVD Lock for Win95/98/Me/2k/XP	CDVAgent.exe	"Loads CD-DVD Lock from Ixis Research
X	CDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	CFDStart	WinMuschi.exe	"WINMUSCHI dialler"
X	cftmon	WindowsUpdate.exe	"Added by the AGENT.AQK BACKDOOR!"
X	Cgywin	cgywin32.exe	"Added by the RBOT-AEI WORM!"
X	CheckWinPerf	perfinfo.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Ci Servs	SysTuwin.exe	"Added by the AGENT-NIQ TROJAN!"
Y	ClamWin	ClamTray.exe	"ClamWin antivirus"
X	CommonService	winup.exe	"Added by the DLOADR-BJJ TROJAN!"
X	Compaq Jes Drivers	winjes.exe	"Added by the SDBOT-XR WORM!"
X	Compaq Service Drivers	wincmd.exe	"Added by the RBOT.ATV WORM!"
X	Compaq Service Drivers	wind32.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	winmsn.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	winsvc.exe	"Added by the SDBOT-AGD WORM!"
X	Compaq Sound Drivers For WINDOWS	sounddr.exe	"Added by the SDBOT-XG WORM!"
U	CompuSpy KeyLogger	cswin2008.exe	"CompuSpy surveillance software. Uninstall this software unless you put it there yourself"
X	Config	WinService32.exe	"Added by the CRUTCHA-A TROJAN!"
X	Config	winconfig.exe	"Added by the GIP.113.B1 TROJAN!"
X	Config Loader	wincrt32.exe	"Added by the AGOBOT-AW WORM!"
X	Config Loader for Microsoft Windows	mwincfg32.exe	"Added by the AGOBOT.BD WORM!"
X	Config Loadr	winsys32.exe	"Added by the AGOBOT-HN WORM!"
X	Configuration File	Winset32.exe	Added by the FLUX.101 TROJAN!
X	Configuration Loader	wincrt32.exe	"Added by the GAOBOT.BF WORM!"
X	Configuration Loader	windex.exe	"Added by the GAOBOT.BZ WORM!"
X	Configuration Loader	Winreg.exe	"Added by the GAOBOT.AO WORM!"
X	configuration loader	winicfg32.exe	"Added by the GAOBOT.RQ WORM!"
X	Configuration Loader	wincffg.exe	"Added by the AGOBOT.A3 WORM!"
X	Configuration Loader	WinHelper.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	wincore.exe	"Added by the SDBOT.BHE WORM!"
X	Configuration Loader	WinSys32ys.exe	"Added by the SDBOT.BCS WORM!"
X	Configuration Loader	win32exec.exe	"Added by the SDBOT-LA WORM!"
X	Configuration Loader	winfix.exe	"Added by the SDBOT-MA WORM!"
X	Configuration Loader Service	Winsys32.exe	"Added by the RBOT-YV WORM!"
X	Configuration Servecie	sewins.exe	"Added by the SDBOT-COH WORM!"
X	Configuration32 Loader32	winamp32.exe	"Added by the SDBOT-BIC WORM!"
X	Content Service	winserv[LETTER].exe	"PurityScan adware"
X	ContentService	winservn.exe	"PurityScan adware - see here"
X	ControlPanel	"twink64.exe internat.dll	LoadKeyboardProfile"
X	cpanel	winlogin32.exe	"Added by the RBOT-FOY WORM!"
X	cpntmgc	wincomp.exe	"Added by the WINTRIM.A TROJAN!"
X	cpntmgc	winmgts.exe	"Added by the WINTRIM-B TROJAN!"
X	CPU Windows Status	cpustats.exe	"Added by a variant of the RBOT WORM!"
U	cracked_windows1	cracked_windows1.exe	"Cracked Windows popup killer"
X	crash0001	restorecrashwin32.bat	"Added by the AGENT-ZC TROJAN!"
X	csm Win Updates	csm.exe	"Added by the ZOTOB.B WORM!"
X	CSRSWIN	[trojan filename]	"Added by the WINSHELL.50 TROJAN!"
X	ctfmon	WinConst.exe	"Added by the ASSASIN-G TROJAN!"
X	CTFMON	wscript.exe /E:vbs winjpg.jpg	"Added by the RUNAUTO.F WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""winjpg.jpg"" file is located in %System%"
X	CTFMON	win.exe	"Added by the VBS.RUNAUTO.G WORM!"
X	ctfmon	WinUP.exe	"Added by the BANKER-VV TROJAN!"
X	CueX44_stil_here	WINLOGON.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate winlogon.exe process
X	cwingllib	atllsimm.exe	"Added by a variant of the SDBOT WORM!"
X	DDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	Devicewin	[path to trojan]	"Added by the BANKER-AEV TROJAN!"
X	DirectX For Microsoft Windows	dtxservice.exe	"Added by the PROGENT TROJAN!"
X	DirectX for Microsoft Windows	Fservice.exe	"Added by the PRORAT TROJAN!"
X	DirectX for Microsoft Windows	Sservice.exe	"Added by the PRORAT TROJAN!"
X	DirectX For Microsoft® Windows	fservice.exe	"Added by the PRORAT-P TROJAN!"
X	DirectX For Microsoft® Windows	fservice.exe	"Added by the PRORAT-L TROJAN!"
X	Distributed File System	win.exe	"Added by the MYFIP.AB WORM!"
X	DLINK dfe drivers for Windows NT	windfe.exe	"Added by the RANDEX.AK WORM!"
X	DNS Config service	win32.exe	"Added by the RBOT-TL WORM!"
X	Dos Prompt Loader	cygwin.exe	"Added by the SDBOT-VV WORM!"
X	DRam prosessor	WindowsUpdate.exe	"Added by the RBOT-BBZ WORM!"
X	DRam prosessor	winupl.exe	"Added by the RBOT-BCQ WORM!"
X	DRam rar proc	winupdaterar.exe	"Added by a variant of the IRCBOT TROJAN!"
X	DRam rare proc	updaterarwin.exe	"Added by the RBOT-GQW WORM!"
X	DsplObjects	windspl.exe	"Added by the BEAGLE.DN WORM!"
X	DSystemDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
U	DVD Device Lock for Win95/98/Me/2k/XP	DDLAgent.exe	"Loads Hide and Protect any Drives - which ""can be used to restrict read or write access to removable media devices such as CD
X	dvd98	windvd98.exe	"Added by the CULT.P WORM!"
X	Dynamic Dns Binary	winxp34.exe	"Added by a variant of the RBOT WORM!"
X	Dynamic Dns Binary	WinHelpcfn.exe	"Added by a variant of the RBOT WORM!"
U	ELSA WINman Suite	Winmsuit.exe	"Allows you to totally customize your ELSA graphics card settings
?	encapsulated command tool	wintr.com	"??"
X	Enh Win Updt	enhupdt.exe	"Adware - detected by Kaspersky as the ONECLICKNETSEARCH.H TROJAN!"
X	erfgddfk	wind2ll2.exe	"Added by the BEAGLE.CQ WORM!"
X	erghgjhgdr	windlhhl.exe	"Added by the BEAGLE.BG WORM!"
X	erghgjhjgdr	windlhhl.exe	"Added by the BEAGLE.BG or BEAGLE.BH or BEAGLE.BI or BEAGLE.BJ WORMS!"
X	erthegdr	windll2.exe	"Added by the BEAGLE.CG WORM!"
X	erthgdr	windll.exe	"Added by the BEAGLE.AO or BEAGLE.AQ WORMS!"
X	eTunnel	winfw.exe	Added by an unidentified TROJAN!
X	Explorer	Windows Explorer.exe	"Added by the SILLYFDC-I WORM!"
X	exporet	winset.exe	"Added by the QQPASS-I TROJAN!"
X	Fantasia injector	wincfg.exe	"Added by the AGOBOT.US WORM!"
X	FDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	Firewall auto setup	winlogon.exe	"Added by the AGENT-EDB TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
X	Firewall Update System1	WinedowsUpdater1.exe	"Added by the RBOT-ARU WORM!"
X	FIX	WinFIX1.0.vbs	"Added by the GORMLEZ-A WORM!"
N	Folding@home	WINFAH.EXE	"Folding@Home is a distributed computing project which studies protein folding
Y	FoolProof	fpwinldr.exe	"FoolProof Security PC security software from SmartStuff"
X	Framework Windows	frmwrk32.exe	"Added by the FAKEAV-KS TROJAN!"
X	FriendlyTypeName	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
N	Fromine WinPopup	winpopup.exe	Instant Messenger program
X	FTP FOR WINDOWS	ftpwin32.exe	"Added by a variant of the RBOT WORM!"
N	Gadwin PrintScreen	PrintScreen.exe	"Gadwin PrintScreen - utility to capture
X	Generic host proccess for windows	SVCHOSTS.EXE	"Added by the SPYBOT-GQ WORM!"
X	Generic Host Process for Win Services	mscvs.exe	"Added by a variant of the SDBOT WORM!"
X	Generic Host Process for Win32 Service	svlhost.exe	"Added by the WOOTBOT.EX WORM!"
X	Generic Host Process for Win32 Service	rpchost.exe	"Added by the IRCBOT.DCN WORM!"
X	Generic Host Process for Win32 Services	ntspcv.exe	"Added by the SDBOT.S TROJAN!"
X	Generic Host Process for Win32 Services	intspvc.exe	"Added by the DINFOR.D WORM!"
X	Generic Host Process for Win32 Services	winsvc.exe	"Added by the SDBOT-O WORM!"
X	Generic Host Process for Win32 Services	bazzi.exe	"Added by the AHKER.E WORM!"
X	Generic Host Process for Win32 Services	winsvc32.exe	"Added by the SDBOT-P WORM!"
X	Generic Host Process for Win32 Services	lspsvc.exe	"Added by the MUMU.C WORM!"
X	Generic Host Process for Win32 Services	SPSVC.EXE	"Added by the SDBOT.DA WORM!"
X	Generic Host Process for Win32 Services	svchost32.exe	"Added by the AGOBOT.ALH WORM!"
X	Generic Host Process for Win32 Services	svñhîst.exe	"Added by the DLOADER.AK TROJAN!"
X	Generic Host Process for Win32 Services	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Generic Host Process For Win32 Services	mtsc32.exe	"Added by the VB-CPL TROJAN!"
X	Generic Host Process for WinXP Services	mshelp.exe	"Added by the AGENT-GQP TROJAN!"
X	GenericHostXP	WinLoaderXP.exe	"Added by the BDOOR-ACX BACKDOOR!"
X	Gerenciamento de arquivos do Windows	Winmod32.exe	"Added by the DLOADER-WG TROJAN!"
X	german.exe	winsystems.exe	"Added by the BAGLEDl-AE TROJAN!"
X	german.exe	wintems.exe	"Added by the BAGLE-AS TROJAN!"
X	getwin	winB_.exe	"Added by the BANKER-HS TROJAN!"
X	Global Startup	WinDash.EXE	"Detected by Kaspersky as the VB.Q WORM!"
X	gpmce	window.exe	"Added by the VB.CK WORM!"
X	Graphics adapter service	windll.exe	"Added by the ATNAS.A WORM!"
N	GWInkMonitor	GWInkMonitor.exe	"Gateway ink monitor - makes an annoying popup that says your printer may be running out of ink
X	Hardware Shell Detection	WinHSD.exe	"Added by a variant of the RBOT WORM!"
X	Hhjg5jfd93dftdf	winlogan.exe	"Added by the ERTFOR.A TROJAN!"
U	Hide and Protect any Drives for Win95/98/Me/2k/XP	HPDAgent.exe	"Loads Hide and Protect any Drives - which allows you to ""Protect Hard drive
X	HKLMRun	windowsupdate.exe	"Added by the FORBOT-BJ WORM (where HKLM\Run represents HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run)!"
X	Host Process for Windows Tasks	taskhost.exe	"Added by the BREDO-AI WORM! Note - this is not the valid Windows 7 process which has the same filename and the file description is also ""Host Process for Windows Tasks"". It is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	HostsFileMgr	winHostsEdit.exe	"AdBin from Gilmore Software Development. An easy solution to managing your Window's hosts file"
X	HOT FIX	windsys2.exe	"Added by the AGOBOT.AOI BACKDOOR!"
X	HWINFO*	HWINFO*	"Added by the PUROL WORM! where * is a random character"
Y	HWinst	N/A	For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out
X	I am not Ranky. I am eTunnel!	winsys.exe	Added by an unidentified WORM or TROJAN!
U	IBWin Background process	IBackground.exe	"IBackup for Windows"
U	IBWin Monitor	IBMonitor.exe	"IBackup for Windows"
X	icq lite	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	ICQ Net	winlogon.exe	"Added by variants of the NETSKY WORMS! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
X	ICQNet	winlogon.exe	"Added by the NETSKY-C WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	icrosoft Windows DLL Services Configuration	poker3.exe	"Added by the SDBOT-AER WORM!"
U	IE New Window Maximizer	iemaximizer.exe	"IE New Window Maximizer - automatically maximize new Internet Explorer and Outlook Express windows"
X	IE Runtime	wini.exe	"Added by the PICRATE.B WORM!"
X	IE Runtimes	winis.exe	"Added by the RBOT-ADZ TROJAN!"
X	IE6	winsnt.exe	"Added by the RBOT-GOV WORM!"
X	IEWinserv	winserv.exe	"Added by the BANKER-MY TROJAN!"
X	IExplorerService	WinSock.exe	"Added by the AGENT.KIU TROJAN!"
X	imwinsrvc	acpmonsrv.exe	"Added by the SLAPER.E TROJAN!"
X	infwin	infwin.exe	"VX2.Transponder parasite updater/installer related"
X	Intec Service Drivers	wing32.exe	"Added by the RBOT.HAZ WORM!"
X	Intec Services Driverrs	winrvc.exe	"Added by a variant of the SDBOT WORM!"
X	Intel system tool	winnook.exe	"Added by the SPYRE-C TROJAN!"
X	internct	WinSocks5.exe	"Added by the GRAYBIRD.F TROJAN!"
X	Internet	winlogom.exe	"Added by a variant of the SDBOT WORM!"
X	internet	winsas32.exe	"Added by a variant of the SDBOT WORM!"
X	Internet	wins.exe	"Added by the RBOT.AAYF WORM!"
X	Internet Security Service	mysqlwin32.exe	"Added by the RBOT.UX TROJAN!"
X	INTERNET SERVISES	winz32.exe	"Added by the KWBOT.Z WORM!"
X	InternetExplorer2	windows.exe	"Added by the SDBOT-CZP WORM!"
X	InternetGetConnectedState	winupdate.exe	"Added by the SDBOT-JN WORM!"
X	InternetGetConnectedStateEx	winupdate.exe	"Added by the SDBOT-JN WORM!"
X	INTERNET_SERVISES	winz32.exe	"Added by the SDBOT.Q TROJAN!"
X	InterU	WINDRV.EXE	"Added by the IRCINTER.A TROJAN!"
N	Intervideo Win Cinema Manager	WinCinemaMgr.exe	"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	Intervideo Win Cinema Manager	WINCIN~1.EXE	"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	Intervideo WinCinema Manager	WinCinemaMgr.exe	"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	Intervideo WinCinema Manager	WINCIN~1.EXE	"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	Intervideo WinScheduler	WinScheduler.exe	"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
N	Intervideo WinScheduler	SchSvr.exe	"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
X	IPC Spool Manager	winspec.exe	"Added by the SDBOT-BLU WORM!"
X	IPTable Configuration	Winipcfgs.exe	"Added by a variant of the RBOT WORM!"
X	IpWins	ipwins.exe	"IPWins adware"
N	iRis Active Monitor	winmon32.exe	"Iris Antivirus - discontinued
X	ISPSERVICE	wintmp.exe	"Added by the IRCBOT.GP BACKDOOR!"
X	jkdfj94kgdftdf	winlogan.exe	"Added by the ZLOB.BZ TROJAN!"
X	Jufualt	winxp2.exe	"Added by the SDBOT-AAB WORM!"
X	KAVFOX	win1ogoin.exe	"Added by the GWGHOST-M TROJAN!"
X	KavRuns	Windll.exe	"Added by the TRYNOMA TROJAN!"
X	Kernel32	Kernel32.win	"Added by the GAGGLE.D or GAGGLE.E WORMS!"
X	KernelCheck	winser.exe	"Added by the TSPY_LMIR.SL TROJAN!"
X	KernelFaultCheck	winabc3.exe	"Added by the NUBYS-A VIRUS!"
X	KernelFaultCheck	winbin.exe	"Added by the DLOADR-AAX TROJAN!"
X	key	winxp.exe	"Added by the BEAGLE.AG WORM!"
X	key2	winlog.exe	"Added by the BAGLEDI-AL TROJAN!"
X	l44sys**	winmine	"Added by the VBS.LIDO WORM - where ** is a number between 33 and 44"
N	Launch YahooPOPs! at Windows startup	YAHOOPOPS.EXE	"YahooPOPs - enables free POP3/SMTP access to Yahoo! Mail through a service on localhost that emulates the web interface. Available via Start -> Programs"
X	Live Windows Messenger Version	msnmessage7.7.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Live Windows Messenger Version	msnmsngrlive.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	LiveUpdate	[Windows username]05.exe	"Added by the LINEAGE TROJAN!"
X	lnwin.exe	lnwin.exe	"Added by the DLOADR-ATC TROJAN!"
X	Load	win32.exe	"Added by the RUBBLE-A WORM!"
X	load	WinExplorer.exe	"Added by the VB.EIW WORM!"
X	load32	winldra.exe	"Added by the NIBU.J BACKDOOR or DUMARU-BI TROJAN! Note - also known as Srv.SSA-KeyLogger by Sunbelt Software which has developed a free removal tool for this keylogger"
?	load=	WINOSCFG.EXE	"Could it be something to do with configuring Windows on a new PC from an OEM supplier?"
X	load=	win32exec.exe	"Added by the BITTER WORM!"
X	loadwin	winset.exe	"Added by the QQPASS-I TROJAN!"
X	loadwin	winsys.exe	"Added by the QQPASS-J TROJAN!"
X	LoadWindowsFile	Kernel32.exe	"Added by the DELF.B TROJAN!"
X	LoadWindowsFile	winreg.exe	"Added by the HUPIGON.A BACKDOOR!"
X	LOCAL INTERNET WEB DRIVERS FOR WIN32	phqghume.exe	"Added by a variant of the RBOT WORM!"
U	Login	winlog.exe	"Salfeld Child Control - parental control software"
X	LogService	wincalc.exe	"Added by the PAPROXY TROJAN!"
X	LTM2	winupdate.exe	"Added by the LITMUS.203 TROJAN!"
X	LTM2	winscan.exe	"Added by the LITMUS-B TROJAN!"
X	LTM2	winvers16.exe	"Added by the SMALL.ND TROJAN!"
Y	LTWinModem1	ltmsg.exe	"Lucent Technologies (now Alcatel-Lucent) WinModem - which uses software rather than hardware
N	Lwinst Run Profiler	lwtest.exe	Logitech Wingman Profiler for the Logitech joysticks. Available via Start -> Programs
X	Major Microsoft Windows Driver Boot loader	bpool.exe	"Added by the MYTOB.AJ WORM!"
N	Mania Win Restore	RESWIN.EXE	Pinball Mania for Windows from 21st Century Entertainment LTD (1995). Runs briefly at start-up then terminates. Available via Start -> Programs
X	MC	wintrims.exe	"Added by the WINTRIM TROJAN!"
X	MC	WINTRIM.EXE	"Added by the WINTRIM.A TROJAN!"
X	mcafee	Win32.dll.vbs	"Added by the CATCHER-B WORM!"
X	McAfee Windows Protection	mcafee32.exe	"Added by a variant of the SPYBOT WORM!"
N	McAfee Winguage	??	"Part of McAfee Nuts & Bolts. ""WinGuage is a dynamic reporting tool that constantly monitors your use of Windows and your applications
X	MD IE Plugin	winy.exe	Adware
X	Micr Update System	upwin.exe	"Added by the SDBOT.YS WORM!"
X	Microfot Update	winldx32.exe	"Added by a variant of the RBOT WORM!"
X	Microft Update 32	winssx.exe	"Added by the RBOT-AQS WORM!"
X	MicroMix32	WinCon.exe	"Added by the VB-ECC TROJAN!"
X	MICROSFT MX UPDATE SUPPORT	winmx32.EXE	"Added by the IRCBOT-FD WORM!"
X	Microsft Windows Adapter 5.1.3013	[random filename]	"Added by the SMALL.HIT TROJAN!"
X	microsft windows updates	mwupdate32.exe	"Added by a variant of the TOXBOT/CODBOT WORM!"
X	Microsof Windows Host	svhost32.exe	"Added by the RBOT.ADY WORM!"
X	Microsof Winlog Host	wilogon32.exe	"Added by the RBOT.XC WORM!"
X	Microsoft	win32.exe	"Added by the DARKMOON TROJAN!"
X	Microsoft	windl32.exe	"Added by the SDBOT-DCZ WORM!"
X	Microsoft	WinSecUp.exe	"Added by the RBOT-GPL WORM!"
X	Microsoft	winampaa.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft	winline.exe	"Added by the AGENT.KT TROJAN!"
X	Microsoft	winsys32.exe	"Added by the RBOT-GSQ WORM!"
X	Microsoft	winnn.exe	"Added by the RANDEX.GGP WORM!"
X	Microsoft (R) Windows Configuration Backup Service	svchost.exe	"Added by the RANKY.X TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in either a ""config""
X	Microsoft (R) Windows DLL Loader	rundll32.exe	"Added by the RANKY.W TROJAN! Note - this is not the legitimate rundll32.exe process
X	Microsoft (R) Windows Network Latency Controller	1.tmp	"Added by a generic password stealer TROJAN - see here"
X	Microsoft (R) Windows Network Latency Controller	nlc.exe	"Added by a generic password stealer TROJAN - see here"
X	Microsoft (R) Windows Network Latency Controller	sp2vc.exe	"Added by a generic password stealer TROJAN - see here"
X	Microsoft (R) Windows Network Security Management Service	nsms.exe	"Added by the RANKY.LC TROJAN!"
X	Microsoft (R) Windows Protected Content Restoration Service	services.exe	"Added by the AGENT.AGV BACKDOOR! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\etc"
X	Microsoft (R) Windows Protocol Deployment Manager	[random].tmp	Added by an unidentified WORM or TROJAN!
X	Microsoft (R) Windows TCP/IP Socket Driver	[path to trojan]	"Added by the PROXY-DD TROJAN!"
X	Microsoft (R) Windows TCP/IP Socket Layer	services.exe	"Added by the RBOT.ARM WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\winsock"
X	Microsoft (R) Windows Update Service	wuauclt.exe	"Added by a variant of the SDBOT WORM! Note - this is not the legitimate wuauclt.exe process
X	Microsoft (R) Windows Vista/NT Runtime Compatibility Service	nrcs.exe	"Added by the RANKY.X TROJAN!"
X	Microsoft auto update	winupdate.exe	"Added by the BMBOT TROJAN!"
X	Microsoft Auto Update	WINHLP16.EXE	"Added by the RBOT.GY WORM!"
X	Microsoft Command C	winhost32.exe	"Added by the SDBOT-BBA WORM!"
X	Microsoft Command Line	wincmd.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Corp SSL Certificates	windowz.exe	"Added by the RBOT-GCZ WORM!"
X	Microsoft Crs Fix Serv	wincrs.exe	"Added by the SDBOT.BWF WORM!"
X	Microsoft Device Manager	svcswin.exe	"Added by the IRCBOT-YH TROJAN!"
X	Microsoft DirktorWin	[random filename]	"Added by the SPYBOT.GEN3 TROJAN!"
X	Microsoft DLL Library	winlib32.exe	"Added by the ATNAS.A WORM!"
X	Microsoft Dll Management	windll.exe	"Added by the RBOT-MT WORM!"
X	Microsoft DLL Verifier	winavguard.exe	Added by the SDBOT.AAD WORM!
X	Microsoft Driver Control	windrv.exe	"Added by the SDBOT.FW WORM!"
X	Microsoft Driver Manager	mswindrv.exe	"Added by the FORBOT-EZ WORM!"
X	Microsoft HDCP for NT and Win9x	msdhcprs.exe	"Added by a variant of the PEERBOT WORM!"
X	Microsoft Hosting Service	WINHOSTING.EXE	"Added by the RBOT.AEV WORM!"
X	Microsoft Internet	windows32.exe	"Added by the SDBOT-F WORM!"
X	Microsoft Internet	wincfg16.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft IT Update	win64.exe	"Added by the RBOT.GA WORM!"
X	Microsoft IT Update	winn43.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft IT Update	win43.exe	"Added by the RBOT-SA WORM!"
X	Microsoft IT Update	windows.exe	"Added by the RBOT-JM WORM!"
X	Microsoft IT Update	winsyst32.exe	"Added by the RBOT-FC WORM!"
X	Microsoft Java Virtual Machine	winscr32.exe	"Added by a variant of the WOOTBOT WORM!"
X	Microsoft Java Windows Update	[filename]	"Added by the RBOT-DZ WORM!"
X	Microsoft Kernel	Windows_kernel32.exe	"Added by the NETSKY.AE WORM!"
X	Microsoft Login	winlogin.exe	"Added by the RBOT-AJP WORM!"
X	Microsoft Logins	winlogins.exe	"Added by the SPYBOT.BCZ WORM!"
X	Microsoft Lsass Service	wintcp32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Machine	winjava.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Machine	winxp43.exe	"Added by the RBOT-IA WORM!"
X	Microsoft media	winmplayers.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft media services	winmplayer.exe	"Added by the RBOT.ZO WORM!"
X	Microsoft MediaScope	winmes.exe	"Added by the RBOT-XU WORM!"
X	Microsoft Network Daemon for Win32	Netd32.exe	"Added by the SDBOT.R TROJAN!"
X	Microsoft NT Update	winexec32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Office Start	winupdates.exe	"Added by the GAOBOT.BC WORM!"
X	Microsoft Problem Doctor	windr128.exe	"Added by the SMALLTRO.EF TROJAN!"
X	Microsoft Problem Doctor	windr32.exe	"Added by a variant of the SMALLTRO.EF TROJAN!"
X	Microsoft Problem Doctor	windr64.exe	"Added by a variant of the SMALLTRO.EF TROJAN!"
X	Microsoft Rundll	windos.exe	"Added by the SDBOT-WF WORM!"
X	Microsoft SDKP3	mswinsdq.exe	"Added by the RBOT-ARY WORM!"
X	Microsoft Security	winService.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Security Management	winnt.exe	"Added by the RBOT-MQ WORM!"
X	Microsoft Security Management	winserv.exe	"Added by the RBOT-MJ WORM!"
X	Microsoft Security Management	winamp.exe	"Added by a variant of the RBOT WORM! Note - this is NOT the popular Winamp media player which resides in a ""Winamp"" subdirectory of the Program Files directory"
X	Microsoft Security Manager	winamp.exe	"Added by the RBOT.TU WORM! Note - this is NOT the popular Winamp media player which is located in %ProgramFiles%\Winamp. This one is located in %System%"
X	Microsoft Security Monitor Process	windowsupdate.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Security Monitor Process	winsys32.exe	"Added by the VIRUT.N VIRUS!"
X	Microsoft Security Monitor Process	winsyss32.exe	"Added by the RBOT.AEU BACKDOOR!"
X	Microsoft Security Process	wininit.exe	"Added by the RBOT-FKM WORM!"
X	Microsoft Service	winsvc.exe	"Added by the SPYBOT-DB WORM!"
X	Microsoft Service	winspl.exe	"Spyman spyware"
X	Microsoft Service Login Manager	winlogin.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Service Manager	winsvc.exe	"Added by a variant of the RBOT WORM! See here"
X	Microsoft Service Pack	WindowsSP.exe	"Added by the RBOT-RF WORM!"
N	Microsoft Sidewinder Game Controller Software	SWTRAY.EXE	MS SideWinder game controller system tray icon. Available via Start -> Programs
X	Microsoft Sound Technology	winsound.exe	"Added by the RBOT-AGG WORM!"
X	Microsoft SpA Service	win32.exe	"Added by the RBOT.ATS WORM!"
X	Microsoft SpA Service	Winupd32.exe	"Added by the RBOT.LT WORM!"
X	Microsoft SpAr Service	winsbsd32.exe	"Added by the RBOT-RN WORM!"
X	Microsoft Spool Server for Win32	spoolsrv.exe	"Added by the RANDEX.H WORM!"
X	Microsoft Standard Executions Library	win32lib.exe	"Added by the RBOT-AUK WORM!"
X	Microsoft standard protector	winsocks5.exe	Added by the SMALL.CF TROJAN!
X	Microsoft Stuff you know	winslogin.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Svchost local services	winoem.exe	"Added by the RBOT-FPE WORM!"
X	Microsoft Synchronization Manager	WinLoginnn.exe	"Added by the SPYBOT.FO WORM!"
X	Microsoft Synchronization Manager	winupdate.exe	"Added by the SDBOT.ER WORM!"
X	Microsoft Synchronization Manager	win.exe	"Added by the SDBOT.AK WORM!"
X	Microsoft Synchronization Manager	winlogon32.exe	"Added by the SDBOT.AEU WORM!"
X	Microsoft Synchronization Manager	wincfg32.exe	"Added by the SDBOT.DO WORM!"
X	Microsoft Synchronization Manager	win932.exe	"Added by the SDBOT.AH WORM!"
X	Microsoft System	winamp1.exe	"Added by the SDBOT-UF WORM!"
X	Microsoft System DLL Services Configuration	windir32.exe	"Added by the SDBOT-ACY TROJAN!"
X	Microsoft System Service	winIogon2.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft TCP Protocol	wintcp32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Telecoms Center	winupn.exe	"Added by a variant of the SDBOT WORM!"
X	MICROSOFT UNPACK SYSTEM	winrarx.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	winsys32.exe	"Added by the RBOT.BD WORM!"
X	Microsoft Update	msawindows.exe	"Added by the GAOBOT.AFJ WORM!"
X	Microsoft Update	msiwin84.exe	"Added by the GAOBOT.AFJ WORM!"
X	Microsoft Update	prowind32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update	winscv.exe	"Added by the RBOT-BH WORM!"
X	Microsoft Update	winsys.exe	"Added by the RBOT-GV WORM!"
X	Microsoft Update	windows24.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	wingrd32.exe	"Added by the RBOT-DW WORM!"
X	Microsoft Update	WinUpdate32.exe	"Added by the RBOT-TI WORM!"
X	Microsoft Update	winamp.exe	"Added by a variant of the RBOT WORM! Note - this is NOT the popular Winamp media player"
X	Microsoft Update	win-mang.exe	"Added by the RBOT-AFK WORM!"
X	Microsoft Update	winupdater.exe	"Added by the RBOT.BIN WORM!"
X	Microsoft Update	win32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update	wininit.exe	"Added by the RBOT-AKR WORM!"
X	Microsoft Update	WINDOC.EXE	"Added by the SDBOT.PF WORM!"
X	Microsoft Update	WinDrv32.exe	"Added by the RBOT.EGW WORM!"
X	Microsoft update	winupdate.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	windows32.exe	"Added by the RBOT-BHQ WORM!"
X	Microsoft Update	winsyst.exe	"Added by the RBOT-DL WORM!"
X	Microsoft Update 32	wininit.exe	"Added by the RBOT-ANY WORM!"
X	Microsoft Update 32	wininit32.exe	"Added by the RBOT-AKJ WORM!"
X	Microsoft Update 32	winitXP32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	winin.exe	"Added by the RBOT-ARR WORM!"
X	Microsoft Update 32	winssx.exe	"Added by the RBOT-ARW WORM!"
X	Microsoft Update 64 BIT	wininit32.exe	"Added by the RBOT-AHE WORM!"
X	Microsoft Update 64 BIT	winman32.exe	"Added by the RBOT-AKI WORM!"
X	Microsoft Update 64 BIT	winl32xe.exe	"Added by the RBOT-AQO WORM!"
X	MICROSOFT UPDATE CONFIGURATION	WIN32SNC.EXE	"Added by the RBOT-AI WORM!"
X	Microsoft Update Debugger	wincfg32.exe	"Added by the SPYBOT.ZC WORM!"
X	Microsoft Update Loaders 2005	winusers.exe	"Added by the RBOT-AIQ WORM!"
X	Microsoft Update Loaders 2006	winusersystem32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update Machine	winini.exe	"Added by the RBOT-KV WORM!"
X	Microsoft Update Machine	winupdt.exe	"Added by the RBOT-FP WORM!"
X	Microsoft Update Machine	windowsu.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	wininigo.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	winmgr.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	Winmsixp32.exe	"Added by the RBOT.DN WORM!"
X	Microsoft Update Machine	Winregs32.exe	"Added by the RBOT.DN WORM!"
X	Microsoft Update Machine	winxpini.exe	"Added by the RBOT-OB WORM!"
X	Microsoft Update Machine	winhost.exe	"Added by the RBOT-GK WORM!"
X	Microsoft Update Machine	winss.exe	"Added by the RBOT.JU WORM!"
X	Microsoft Update Machine	windowsup.exe	"Added by the RBOT-FV WORM!"
X	Microsoft Update Machine	winnie.exe	"Added by the RBOT-ACD WORM!"
X	Microsoft Update Machine	winortho.exe	"Added by the RBOT-NW WORM!"
X	Microsoft Update Machine	wins32.exe	"Added by the RBOT.EZ WORM!"
X	Microsoft Update Machine	Win32.exe	"Added by the SDBOT.UV WORM!"
X	Microsoft Update Machine	windns.exe	"Added by the RBOT.EF WORM!"
X	Microsoft Update Machine	WINSVC32.EXE	"Added by the RBOT.CU WORM!"
X	Microsoft Update Machine	winupdte.exe	"Added by the RBOT-GKL WORM!"
X	Microsoft Update Machine	winmngr.exe	"Added by the RBOT.GKQ BACKDOOR!"
X	Microsoft Update Manager	WINRLS.EXE	"Added by the RBOT-AF WORM!"
X	Microsoft Update Service	mswin32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update Win32a	winupdate32a.exe	"Added by the RBOT-LO WORM!"
X	Microsoft Update Win32x	winupdate32x.exe	"Added by the RBOT-AJN WORM!"
X	Microsoft Updater	winsys32.exe	"Added by the RBOT.RL WORM!"
X	Microsoft Updater	winupdate.exe	"Added by the AGENT-KIR TROJAN!"
X	Microsoft Updater Resources	WinFixd32.exe	"Added by the SPYBOT.CA WORM!"
X	Microsoft Updaters Pros	WINDLL32XP.EXE	Added by the SPYBOTTER.GEN VIRUS!
X	Microsoft Updates	winit.exe	"Added by the SDBOT-CSB WORM!"
X	Microsoft Updates Resources	WinFixIDs.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft USB Windows2 Driver	usbautotuner.exe	"Added by the SILLYFDC.BCL WORM!"
X	Microsoft Visual SourceSafe	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	Microsoft Win Corp TLS Verification	mswintls.exe	"Added by the RBOT-GCT WORM!"
X	Microsoft Win Update	WinUP.exe	"Added by the RBOT-BPR WORM!"
X	Microsoft WIN32 DOS	MSdos32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft WIN32 Security	MSsec32.exe	"Added by the RBOT-DOQ TROJAN!"
X	MicroSoft Wind0ws Updater	winsupdater.exe	"Added by a variant of the RBOT WORM!"
X	MicroSoft Window Updater	winsupdater.exe	"Added by the RBOT-ZZ WORM!"
X	Microsoft Windows	mstask0.exe	"Added by the SDBOT.FQ WORM!"
X	Microsoft Windows	atup	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows	Microsoft Windows.hta	HTA file which creates an executable on the hard drive which subsequently proceeds to download files from a malware site!
X	Microsoft Windows	explorar.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows	[path to file]	"Added by the BDOOR-LI BACKDOOR!"
X	Microsoft Windows	bootini.exe	"Added by the VANEBOT-K WORM!"
X	Microsoft Windows	Kernel.exe	"Added by the EDIBARA-A VIRUS!"
X	Microsoft Windows	Kernel.vbs	"Added by the EDIBARA-A VIRUS!"
X	Microsoft Windows	pwjbvphi.exe	"Added by the RBOT-GQK WORM!"
X	Microsoft Windows	windets.com	"Added by the FLOOD-EQ TROJAN!"
X	Microsoft Windows (D)	iexplore.exe	Identified as a variant of the TrojanSpy.Agent malware
X	Microsoft Windows 128bit Subsystem	system12.exe	"Added by the RANCK-CZ TROJAN!"
X	Microsoft Windows 16Bit	mswinn16.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Windows 2000	Winupdsdgm.exe	"Added by the GAOBOT.AO WORM!"
X	Microsoft Windows 32 Update	win32update.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows 32Bit	mswinn32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows 64 Bit	mswin32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Adapter 5.1.3214	[worm filename].exe	"Added by the STRAT.GEN-3 WORM!"
X	Microsoft Windows Autowxckn	autowxckn.exe	"Added by the RBOT.DYZ BACKDOOR!"
X	Microsoft Windows Client Firewall	msclt.exe	"Added by the VANEBOT-F WORM!"
X	Microsoft Windows Communicator for NT/XP	wincomm.exe	"Added by the RBOT.ATH WORM!"
X	Microsoft Windows Config 32	win32conf.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Control	mswctl32.exe	"Added by the RBOT.JP WORM!"
X	Microsoft Windows CSRSS	csrss.exe	"Added by the KALEL-A WORM! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
N	Microsoft Windows Desktop Search System Tray	WindowsSearch.exe	System Tray access to Windows Desktop Search for XP from Microsoft - which adds additional search options including a search box on the Taskbar. This version (3.0.1) also includes the Windows Search (WSearch) service which indexes files and e-mails items so you can quickly find words and phrases. Disabling this entry does not affect the normal operation and this is the Windows Defender entry
N	Microsoft Windows Desktop Search Tool Tray Admin	WindowsSearch.exe	"System Tray access to Windows Desktop Search for XP from Microsoft - which adds additional search options including a search box on the Taskbar. For this version (2.6.*)
X	Microsoft Windows DHCP	___r.exe	"Added by the MASLAN.A or MASLAN.C WORMS!"
X	Microsoft Windows DLL 32-BIT	msncheck32.exe	"Added by the SDBOT-XX WORM!"
X	Microsoft Windows DLL Services	mwindll.exe	"Added by the SDBOT-VX WORM!"
X	Microsoft Windows DLL Services Configuration	newdll.exe	"Added by the SDBOT-ZR WORM!"
X	Microsoft Windows DLL Services Configuration	newdll2.exe	"Added by the SDBOT-ABD WORM!"
X	Microsoft Windows DLL Services Configuration	poker.exe	"Added by the SDBOT-ZY WORM!"
X	Microsoft Windows DLL Services Configuration	poker3.exe	"Added by the SDBOT-AAH WORM!"
X	Microsoft Windows DLL Services Configuration	proxy.exe	"Added by the SDBOT-ZL WORM!"
X	Microsoft Windows DLL Services Configuration	windir32.exe	"Added by the SDBOT.BHF WORM!"
X	Microsoft Windows DLL Services Configuration	windir32a.exe	"Added by a variant of the SDBOT.BHF WORM!"
X	Microsoft Windows DLL Services Configuration	windll32.exe	"Added by the SDBOT.BHD WORM!"
X	Microsoft Windows DLL Services Configuration	winDSL.exe	"Added by the SDBOT-ZG WORM!"
X	Microsoft Windows DLL Services Configuration	dllmanager32.exe	"Added by the SDBOT-BTU WORM!"
X	Microsoft Windows DLLHandler	bitpaint.exe	"Added by the SDBOT.AHG WORM!"
X	Microsoft Windows Drivers	windrv.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows DVR	windvr.exe	"Added by the RBOT-AXD WORM!"
X	Microsoft Windows Expl0rer	expl0rer.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Windows Explorer	iexplorer.exe	"Added by a variant of the RBOT WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Microsoft Windows Explorer	explorewin.exe	"Added by the IRCBOT.WORM.212480.H WORM!"
X	Microsoft Windows Express	Microsoft Update	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Windows Express	websploit.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Windows Express	windowslogonb.exe	"Added by the SDBOT.ABOO WORM!"
X	Microsoft Windows Files Loader	cgy32win.exe	"Added by the RBOT-AXR WORM!"
X	Microsoft Windows Game Updater	msgame32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows GUI	Windowz.exe	"Added by the RANDEX.AEV WORM!"
X	Microsoft Windows GUI	msmonk32.exe	"Added by the SDBOT-PE WORM!"
X	Microsoft Windows Kernel Services	winkrnl386.exe	"Added by the ZEBROXY TROJAN!"
X	Microsoft Windows Keyboard service	keyboard.exe	"Added by the RBOT-CRF WORM!"
X	Microsoft Windows Loader	wloader.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Windows Logon Process	winlogon.exe	"Added by the PROXYSER-R TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Windows Media Player	mediaplayer.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Media Player	wimp.exe	"Added by the RBOT-FN WORM!"
U	Microsoft Windows Media Player Network Sharing Service Configuration Application	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	Microsoft Windows Registry Service	wregistry.exe	"Added by the AGOBOT.AKG WORM!"
N	Microsoft Windows Search System Tray	WindowsSearch.exe	"System Tray access to Windows Search 4.0 for XP from Microsoft - which adds additional search options including a search box on the Taskbar. This version also includes the Windows Search (WSearch) service which indexes files and e-mails items so you can quickly find words and phrases. Disabling this entry does not affect the normal operation"
X	Microsoft Windows Secure	windocs.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Secure	windocs.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Secure Server	rpcxWindows.exe	"Added by the RBOT-LL WORM!"
X	Microsoft Windows Secure Update	rpcxwinupdt.exe	Added by an unidentified WORM or TROJAN!
X	Microsoft Windows Securety	wurguar.exe	"Added by the RBOT-KY WORM!"
X	Microsoft Windows Security	spvsper.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Security	wscndrives.exe	"Added by the RBOT-AJK WORM!"
X	Microsoft Windows Service	winsys.exe	"Added by the RBOT-ADP WORM!"
X	Microsoft Windows Service Pack	winspkn.exe	"Added by the RBOT-AYD WORM!"
X	Microsoft Windows Services	msw32.exe	"Added by the RBOT-FWQ WORM!"
X	Microsoft Windows Services	Sersices.exe	"Added by the SDBOT-NO WORM!"
X	Microsoft Windows Services Edt	ssvvcchhoosst.exe	"Added by the RBOT-FYF TROJAN!"
X	Microsoft Windows Services Edt	dllrun32.exe	"Added by the RBOT-GAF WORM!"
X	Microsoft Windows Session Manager Subsystem	smss.exe	"Added by the PROXYSER-R TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	Microsoft Windows Sidebar	Sidebar.exe	"Windows Sidebar is a pane on the side of the Microsoft Windows Vista desktop where you can keep your gadgets organized and always available. In Windows 7 this feature is known as Desktop Gadgets and each gadget can be placed anywhere on the desktop. If the file isn't located in %ProgramFiles%\Windows Sidebar or you're using other versions of Windows it could be part of the Searchcentrix hijacker"
X	Microsoft Windows Socketx32 Services	winsockx32.exe	"Added by the RBOT-FWT WORM!"
X	Microsoft Windows Sound	svghost.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Windows Sound	svshost.exe	"Added by the RBOT.RNE BACKDOOR!"
X	Microsoft Windows Sound	svuhost.exe	"Added by the KOLAB.XC WORM!"
X	Microsoft Windows Sound Drivers	sounddrivers.exe	"Added by the SLENFBOT.ABU WORM!"
X	Microsoft Windows Storage Machine Service	winms.exe	"Added by the RBOT-AHK WORM!"
X	Microsoft Windows SVCHOST	SVCHOST.exe	"Added by the VB.KV WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Microsoft Windows System	srwhost.exe	"Added by the RBOT-AWU WORM!"
X	Microsoft Windows System	syshost.exe	"Added by the RBOT-ASW WORM!"
X	Microsoft Windows System	System.exe	"Added by the VB.KV WORM!"
X	Microsoft Windows System Kernel	kernel32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows System Service Manager	winsvc.exe	"Added by the SPYBOT.LR WORM!"
X	Microsoft Windows Task Management	mstasks.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Task Manger	Mstosk.exe	"Added by the SDBOT-WW WORM!"
X	Microsoft Windows Tasks Management	taskmng.exe	"Added by the RBOT-FXK WORM!"
X	Microsoft Windows Updata	scvhost.exe	"Added by the RBOT.CEM BACKDOOR!"
X	Microsoft Windows Updata	windows.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Updata	[5 random letters].exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update	rundlls.exe	"Added by the HABRACK WORM!"
X	Microsoft Windows Update	msoffice2.exe	"Added by the RBOT-GB WORM!"
X	Microsoft Windows Update	spools.exe	"Added by the SDBOT.TD WORM!"
X	Microsoft Windows Update	svchos.exe	"Added by the SDBOT.AC WORM!"
X	Microsoft Windows Update	svcshost.exe	"Added by the FORBOT-CF WORM!"
X	Microsoft Windows Update	svmhost.exe	"Added by the FORBOT-CH WORM!"
X	Microsoft Windows Update	svshost.exe	"Added by the WOOTBOT.CJ WORM!"
X	Microsoft Windows Update	msnmessenger.exe	"Added by the SDBOT.AJ WORM!"
X	Microsoft Windows Update	msnwun.exe	"Added by the SDBOT-RM WORM!"
X	Microsoft Windows Update	scvvhost.exe	"Added by the FORBOT-DH WORM!"
X	Microsoft Windows Update	swwhost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update	MSNMSGR.EXE	"Added by the SDBOT-WM WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Microsoft Windows Update	svzhost.exe	"Added by the FORBOT-EV WORM!"
X	Microsoft Windows Update	sccvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update	scrhost.exe	"Added by the RBOT-AOW WORM!"
X	Microsoft Windows Update	mnswinsx.exe	"Added by the RBOT-AWH WORM!"
X	MICROSOFT Windows update	pdate.exe	"Added by the RBOT.BZT WORM!"
X	Microsoft Windows Update	srshost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update	rhost32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows Update	windowsupdate.exe	"Added by the AGOBOT.ON WORM!"
X	Microsoft Windows Update	servcs.exe	"Added by the SDBOT.AL BACKDOOR!"
X	Microsoft Windows Update	syssinfos.exe	"Added by the RBOT-FWR WORM!"
X	Microsoft Windows Update Application	wuap.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update Client	csrss.exe	"Added by the KEBEDE-G WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Systems32"
X	Microsoft Windows Update Client	services.exe	"Added by the AUTORUN.DVE WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Windows Update Logon	win-logon.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update Service	wupdmgr32.exe	"Added by the DOS.AUTOCAT TROJAN!"
X	Microsoft Windows Update Service	msnmsg.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Windows Update x86	[various filenames]	"Added by a variant of the RBOT WORM! Filenames seen include (but are not limited to firefox.exe
X	Microsoft Windows Update XP64	********.exe [* = random char]	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update XP64	updatexp64.exe	"Added by the SDBOT-AIM WORM!"
X	Microsoft Windows Update XP64	Lcuninst.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update XP64	mzhxlixm.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updater	winupdgm.exe	"Added by the GAOBOT.BI WORM!"
X	Microsoft Windows Updater	WINIUPDATES.EXE	"Added by the RBOT-KK WORM!"
X	Microsoft Windows Updater	WINUPDATE.EXE	"Added by the RBOT-LI WORM!"
X	Microsoft Windows Updater	TMNTSrv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Updater	win32upd.exe	"Added by the RBOT-EC WORM!"
X	Microsoft Windows Updater	msnupdateit.exe	"Added by the AGOBOT-RL WORM!"
X	Microsoft Windows Updater	windates.exe	"Added by the SDBOT.TE WORM!"
X	Microsoft Windows Updater	spoolvs.exe	"Added by the RBOT.ACQ WORM!"
X	Microsoft Windows Updater	suvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updater	winfix.exe	"Added by the RBOT-CM WORM!"
X	Microsoft Windows updaterD	log32zx.exe	"Added by the MYDOOM.W WORM!"
X	Microsoft Windows Updates	explorer32.exe	"Added by the SDBOT.VQ WORM!"
X	Microsoft Windows Updates	wsap32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updating System	msresource.exe	"Added by the RBOT-EAM WORM!"
X	Microsoft Windows Visual V2.0	msiutil.exe	"Added by the DELF.JPH TROJAN!"
X	Microsoft Windows W32 Services	mssw32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Windows WinSaSS Management	winsass.exe	"Added by the RBOT-APW WORM!"
X	Microsoft Windows WKS Service	gt.exe	"Added by the SDBOT.IR BACKDOOR!"
X	Microsoft Windows WKS Service	mstask0.exe	"Added by the SDBOT.FV WORM!"
X	Microsoft Windows Workstation	devcode.exe	"Added by the RBOT-AWL WORM!"
X	Microsoft Windows XP Configuration Loader	m32svco.exe	"Added by the SDBOT.WORM!.48548 WORM!"
X	Microsoft Windows XP/2K Explorer	winexplorer.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Winedows startup	WinKey.exe	"Added by a variant of the SDBOT WORM! See here"
X	Microsoft Winedows Updateing	NinKey.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Winedows WinServ	iPodFix.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft WINGS32 Protocol	WinSGR32.exe	"Added by the RBOT-APU WORM!"
X	Microsoft WinRaR	winrar.exe	"Added by the RBOT-AEC WORM!"
X	Microsoft Winsock	mswinsck.exe	"Added by the RBOT-ANK WORM!"
X	Microsoft Winsock Service	msusvc.exe	"Added by the RBOT-ANS WORM!"
X	Microsoft Winsock Wrapper	ws2_32s.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Winsock32 System	winsock32.exe	"Added by the SPYBOT.AKKC WORM!"
X	Microsoft WinSound	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft winsupdater	WINSUPDATER.EXE	"Added by the SPYBOTER.FB BACKDOOR!"
X	Microsoft WinUpdate	mntcgf032.exe	"Added by the RBOT-PF WORM!"
X	Microsoft WinUpdate	svh0st.exe	"Added by the SPYBOT.DL WORM!"
X	Microsoft WinUpdate	syslx32.exe	"Added by an unidentified VIRUS
X	Microsoft WinUpdate	syswin32.exe	"Added by the RBOT-HO WORM!"
X	Microsoft WinUpdate	spfix.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft WinUpdate	Winamp61.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft WinUpdate	Winupd32.exe	"Added by the RBOT.MQ WORM!"
X	Microsoft WinUpdate	WinNTinit32.exe	"Added by the RBOT.VS WORM!"
X	Microsoft WinUpdate	msupdte.exe	"Added by an unidentified TROJAN! See examples here & here"
X	Microsoft WinUpdates	serm32.exe	"Added by the RBOT.GE WORM!"
X	Microsoft World Service	winworld.exe	Added by an unidentified IRC worm with backdoor capability!
X	Microsoft Xp Systems loader	winsystem32xp.exe	"Added by the KELVIR.W WORM!"
X	Microsoft Xp Systems loaders	win32xpsys.exe	"Added by the SPYBOT.NYT WORM!"
X	Microsoft32	win32sys.exe	Added by an unidentified WORM or TROJAN!
X	Microsoftkeysd	systemwin32s.exe	"Added by the WOOTBOT.CO WORM!"
X	MicrosoftNetwork Daemon for Win32	NETD32.EXE	"Added by the RANDEX.F WORM!"
X	Microsofts media	winmplayd.exe	Added by an undidentified WORM or TROJAN!
X	Microsofts media	wingtp.exe	"Added by the RBOT-VO WORM!"
X	Microsofts MediaScope	winmep.exe	"Added by the RBOT-WB WORM!"
X	Microsofts MediaScope	winmedplay.exe	"Added by a variant of the RBOT WORM!"
X	MicrosoftServiceManager	Wintsk32.exe	"Added by the YAHA.U WORM!"
X	MicrosoftUpdate	WinUp32.exe	"Added by an unidentified VIRUS
X	MicrosoftUpdate	windll.exe	"Added by the RBOT-IH WORM!"
X	MicrosoftWindows	[various filenames]	"MagicSearch - a CoolWebSearch parasite variant"
X	MicrosoftWindows	a@26m.exe	"Added by the KILLPAR-B TROJAN!"
U	Microsoft® Windows Mobile® Device Center	wmdc.exe	"Windows Mobile Device Center - mobile device management/synchronization software for Windows7/Vista
U	Microsoft® Windows® Operating System	Sidebar.exe	"Windows Sidebar is a pane on the side of the Microsoft Windows Vista desktop where you can keep your gadgets organized and always available. In Windows 7 this feature is known as Desktop Gadgets and each gadget can be placed anywhere on the desktop. If the file isn't located in %ProgramFiles%\Windows Sidebar or you're using other versions of Windows it could be part of the Searchcentrix hijacker"
N	Microsoft® Windows® Operating System	"RunDLL32.exe ehuihlp.dll	BootMediaCenter"
N	Microsoft® Windows® Operating System	p2phost.exe	"Signs a user into the People Near Me feature at login in Windows 7 and Vista. People Near Me enables you to use certain peer-to-peer (P2P) programs on a network - that ""identifies people nearby who are using computers and allows those people to send you invitations for programs such as Windows Meeting Space. They can only invite you to participate in programs that are installed on your computer."" Available via Start → Control Panel"
U	Microsoft® Windows® Operating System	ehTray.exe	"Media Center Tray Applet - part of Windows Media Center on XP MCE
N	Microsoft® Windows® Operating System	"rundll32.exe oobefldr.dll	ShowWelcomeCenter"
N	Microsoft® Windows® Operating System	stikynot.exe	"Microsoft Sticky Notes - virtual sticky notes tool from Windows Vista. This implementation of the popular yellow ""Post-It"" tool is part of the Tablet PC features and allows you to enter either handwriting (via a pen or mouse) or record a voice note. AVailable via Start → All Programs"
U	Microsoft® Windows® Operating System	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	Microsotufed Update 32	windinit.exe	"Added by the RBOT-CTJ WORM!"
X	Micrsoft Driver	windrive.exe	"Added by the SDBOT.AF TROJAN!"
X	Micrsoft Driver	windrive32.exe	"Added by the SLINBOT.TT BACKDOOR!"
X	Mircosoft Windows Developer Enviroment	devenv.exe	Added by an unidentified WORM or TROJAN!
X	Mircosoft Windows Developer Enviroment	devenv.exe	"Added by the RBOT.AUJ BACKDOOR!"
X	Mircrosoft Windows Config DLL	rundllc32b.exe	"Added by the RBOT-ZY WORM!"
X	Miscrosoft Windows Explorer	IEEXPLORER.exe	Reported as the SDBOT.YX WORM!
X	Mismo	win32x.exe	"Added by the RBOT-JP WORM!"
N	MMCWINMGMT	winmgmt.exe	"Used for Enterprise Management. If you are not an IT Administrator you don't need it to be running. Also runs from the PCHealth ""scheduler"" - refer here"
X	mmxrun	mswinindex.exe	"TwoSeven spyware"
X	mobiswing	[random].exe	"Mobis adware"
X	MS Config Loader	MSWin32bck.exe	"Added by the GAOBOT.AA WORM!"
X	MS Java Applets for Windows NT & XP	javaapplet.exe	"Added by the RBOT.BHG WORM!"
X	Ms Java for Windows NT	MS32.exe	"Added by the VANEBOT-H WORM!"
X	Ms Java for Windows NT	msi32java.exe	"Added by the VANEBOT-I WORM!"
X	Ms Java for Windows NT	msjava.exe	"Added by the VANEBOT-E WORM!"
X	Ms Java for Windows NT	msi32info.exe	"Added by the RBOT.AFX WORM!"
X	MS Java for Windows XP & NT	javanet.exe	"Added by the VANEBOT-A WORM!"
X	MS Java Service Wrapper Windows NT & XP	wrapper.exe	"Added by the VANEBOT-D WORM!"
X	Ms Java Update For Windows NT/XP	msijavaupdt32.exe	"Added by the RANDEX.AF WORM!"
X	MS Network Control	mswin.exe	"Added by the DUMBA TROJAN!"
X	ms ownage	winPE.exe	"Added by the RBOT-AJL WORM!"
X	MS Service Drivers	winscv.exe	"Added by the SDBOT-COG WORM!"
X	Ms sock for Windows NT	winser.exe	"Added by a variant of the SDBOT WORM!"
X	MS Sys Security	mswin.pif	"Added by the RBOT-APJ WORM!"
X	MS System Security	mswin32.pif	"Added by the RBOT-AOX WORM!"
X	MS Unix Binary	win32ttb.exe	"Added by the SPYBOT.OQ WORM!"
X	MS Unix Binary	Win32Update.exe	"Added by the RBOT-BAS WORM!"
X	MS Unix Binary	WinGuard.exe	"Added by the RBOT-ACL WORM!"
X	Ms Update WinServices NT/XP	winservnt32.exe	"Added by the VANEBOT-G WORM!"
X	MS USB 2.0 Windows Support	msusb32.exe	"Added by a variant of the RBOT WORM!"
X	MS Win32 Network Services	windriver.exe	"Added by the AGOBOT.ADH WORM!"
X	ms window update	******.exe [* = random character]	"Added by a variant of the RBOT WORM!"
X	MS Windows AOL Driver	MSAOLdrv.exe	"Added by the RBOT-ASP WORM!"
X	MS windows Data list process	MSDATLST.exe	Added by an unidentified WORM or TROJAN!
X	MS Windows Executor Process	MSEXECP32.exe	"Added by a variant of the RBOT WORM!"
X	MS Windows Local Directory	MSWLD32.exe	"Added by a variant of the RBOT WORM!"
X	MS Windows procces 32	msprocces.exe	"Added by the RBOT-AEZ WORM!"
X	MS Windows Process Class	MSPRCSS32.exe	"Added by the RBOT-YQ WORM!"
X	MS Windows Process Init	MSWPI32.exe	"Added by the RBOT-ASQ WORM!"
X	MS Windows Security Updater	updater.pif	"Added by the RBOT-AKY WORM!"
X	MS Windows System Alert	MSWSA32.exe	"Added by the RBOT-BFN WORM!"
X	MS Windows TASK Service	MSWTASK32.exe	"Added by a variant of the RBOT WORM!"
X	MS Windows Update	scguard.exe	"Added by the RBOT-YZ WORM!"
X	MS WINS Binary	ign32.pif	"Added by the RBOT-ASB WORM!"
X	MS Winsock	msws2_32.exe	"Added by the AKBOT-A TROJAN!"
X	MS-DOS Windows Service	MS-DOS.PIF	"Added by the RBOT-AJW WORM!"
X	mscheck	rundll32.exe wincheck071008.dll mymain	"Added by the AGENT.ADXI TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""wincheck071008.dll"" file is located in %System%"
X	msconfig	wins.exe	"Added by the RBOT.PF WORM!"
X	msconfig	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	MSControl31	winnsyst.exe	"Added by the RBOT.CFY WORM!"
X	MSDN for Windows NT	msdn.exe	"Added by a variant of the RBOT WORM!"
X	MSDN for Windows NT & WinXP	msdnxp.exe	"Added by the IRCBOT-PE WORM!"
X	MSDN for Windows with NT's	msdn-nt.exe	"Added by the RBOT-EWD WORM!"
X	MSDOS Windows Service	MSDOS.PIF	"Added by the RBOT-AKF WORM!"
X	MSIdll	winmp.exe	"Added by a variant of the RBOT WORM!"
X	MSMSGS	winlogon.exe	"Added by the BRONTOK-BS WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X	msn	winlogon.exe	"Added by the PROSTI.AA BACKDOOR! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Media"
X	MSN Administration For Windows	msnadp32.exe	"Added by the BROPIA.W WORM!"
X	MSN Messanger Live	winntmsn.exe	"Added by the RBOT-FSO WORM!"
X	Msn Messeng	windns.exe	"Added by a variant of the RBOT WORM!"
X	MSN Messenger Live Windows	messengerlive.exe	"Added by an unidentified WORM or TROJAN! See here"
X	MSN Registry loader	msmnwin.exe	"Added by the KELVIR.FK WORM!"
N	MSN Search Toolbar	WindowsSearch.exe	"System Tray access to Windows Desktop Search for XP from Microsoft - which adds additional search options including a search box on the Taskbar. For this version
X	MSN Service Updates	winproc.exe	"Added by the KELVIR-BB WORM!"
N	MSN Toolbar	mswinext.exe	"MSN Toolbar from version 4.* onwards (now known as Bing Bar from version 5.* onwards). This entry loads the toolbar into memory at start-up before you open your internet browser. Not required - it will load with the browser and remains in memory after the browser is closed"
X	Msn Updater	windatemanager.exe	"Added by the SDBOT.TS WORM!"
X	MsnExplorer	winagent.exe	"Added by the BDOOR-EQ BACKDOOR!"
X	MSNMSGRR	swin.bat	IRC backdoor TROJAN or WORM!
X	msnnt	winampb.exe	"Chinese originated adware - detected by Kaspersky as the AGENT.TL TROJAN!"
X	msnnt	winampf.exe	Added by the SMALL.DTS TROJAN!
X	MsnWin	messagewin.exe	"Added by the BANCBAN-D TROJAN!"
N	MSN® Toolbar	mswinext.exe	"MSN Toolbar from version 4.* onwards (now known as Bing Bar from version 5.* onwards). This entry loads the toolbar into memory at start-up before you open your internet browser. Not required - it will load with the browser and remains in memory after the browser is closed"
X	MSOleath32	winss.exe	"Added by the KATHER TROJAN!"
X	mssonfig	winupdate.exe	"Added by a variant of the SDBOT WORM!"
X	MSSQL for Windows NT & XP	mssqlsnt.exe	"Added by a variant of the SDBOT WORM!"
X	MSStartOptimizer	WINUPD.EXE	"Added by the DASMIN-E TROJAN!"
X	MSWin	mswin.exe	"Added by the BANKER-CU TROJAN!"
X	Mswincfg	Mswincfg32.exe	"Added by the CYBRSPY.D TROJAN!"
X	MsWindows DRT Drivers	wsdrt32.exe	"Added by the RBOT.ALT WORM!"
X	MsWindows SSL Drivers	mssl32.exe	"Added by the SPYBOT.API WORM!"
X	MSWindows SysCl	mscl32.exe	"Added by the RBOT.AHI WORM!"
X	MsWindows SysDate	sysmsvc.exe	"Added by the SPYBOT.FCD WORM!"
X	MSWindows Syspg	mspg32.exe	"Added by the RBOT-TB WORM!"
X	MSWindowsUpdate	Systern.exe	"Added by the RBOT-AFD WORM!"
X	MSWindowsUpdate	mswinup.exe	"Added by a variant of the SDBOT WORM!"
N	mswinext	mswinext.exe	"MSN Toolbar from version 4.* onwards (now known as Bing Bar from version 5.* onwards). This entry loads the toolbar into memory at start-up before you open your internet browser. Not required - it will load with the browser and remains in memory after the browser is closed"
X	MSWinlogon	SynCor.exe	"Added by the AGENT-FZL TROJAN!"
X	MSWinlogon	winlogon.exe	"Added by the AGENT-FZM TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Mswinpid32	mswinpid32.exe	Added by the LAPOS.A TROJAN! This is a keylogger which emails back to China PayPal passwords and account information - thus allowing the perpetrators to steal PayPal funds in the name of the victim!
X	MSWinSrv	MSWinSrv.exe	"Added by the MTRON TROJAN!"
X	MSWinSrv32	MSWinSrv32.exe	"Added by the MTRON-B TROJAN!"
X	MSWinupd	winupd.exe	"Added by the DLOADER-YE or DLOADR-AAA or DLOADER-ZF TROJANS - and others"
X	MSWinupdate	winupdate.exe	"Added by the DLOADR-AAW TROJAN!"
X	MsWinVgr	msvgr.exe	"Added by the MYTOB.LE WORM!"
X	MS_NETD_WIN32	netd32.EXE	"Added by the RANDEX.F WORM!"
X	Multimedia	windebug.exe	"Added by the VB-ERB WORM!"
X	mvsyswina	acsysiom.exe	"Added by a variant of the SDBOT WORM!"
X	mysoft	winexplor.exe	"Browser hijacker
X	Name Server	mswins.exe	"Added by a variant of the SDBOT WORM!"
X	NAV Agent	winsnav.vbs	"Added by the ANPES WORM!"
X	NAV Auto Updates	navwindows.exe	"Added by a variant of the SDBOT WORM!"
N	NB Windows Patterns	WINDBKGND.EXE	"Part of McAfee Nuts & Bolts. With Background Patterns
X	NC1565	winntsrv -l -p10001 -d -e cmd.exe -L	"Added by the NEWLEY-A WORM!"
X	NDIS Adapter	windows.exe	"Added by the FORBOT-BR WORM!"
X	NDIS Adapter	Winman.exe	"Added by the WOOTBOT.AG WORM!"
X	NDplDeamon	winlogin.exe	"Added by the RANDEX.E WORM!"
X	NeroUpdater6.8	winjava.exe	"Added by the AGOBOT.AMK WORM!"
X	Net	WINREG.EXE	"Added by the ASSASIN.D TROJAN!"
X	NetApp	winserv.exe	"Added by the SHADOWTHIEF TROJAN!"
U	NetPatrol	winclient.exe	"NetPatrol network monitoring software"
X	Network	netwin.exe	"Added by the SILLYFDC-CG WORM!"
X	Network Access	winssh.exe	"Added by a variant of the SDBOT WORM!"
X	Network protocol service	wintcp.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Network Provisioning Service	WinNPS.exe	Added by an unidentified WORM/TROJAN!
X	NI.UWA6P_0001_N56M1001	WinAntiVirusPro2006Installer.exe	"Installer for the WinAntiVirus Pro 2006 rogue security software"
X	NI.UWA6P_0001_N69M0303	WinAntiVirusPro2006Installer[1].exe	"Installer for the WinAntiVirus Pro 2006 rogue security software"
X	NI.UWA6P_0001_N73M1004	WinAntiVirusPro2006FreeInstall.exe	"Installer for the WinAntiVirus Pro 2006 rogue security software"
X	NI.UWA6P_0001_N91M1807	WinAntiVirusPro2006FreeInstall[1].exe	"Installer for the WinAntiVirus Pro 2006 rogue security software"
X	NI.UWA7P_0001_N91M0809	WinAntiVirusPro2007FreeInstall.exe	"Installer for the WinAntiVirus Pro 2007 rogue security software - see here"
X	NI.UWAS6_0001_N57M1312	WinAntiSpyware2006FreeInstall.exe	"Installer for the WinAntiSpyware 2006 rogue spyware remover - not recommended
X	NI.UWFX5	WinFixer2005ScannerInstall.exe	"WinFixer 2005 web installer - ""foistware""
X	Nod32 Service	AutoUpdateWin32.exe	"Added by the SDBOT-DJG WORM!"
X	Norton Personal Firewall	winmpts.exe	"Added by the RBOT.ANT WORM!"
X	Norton Update	winsvc.exe	"Added by the AGOBOT.ALP WORM!"
X	Norton Updater	winset.exe	"Added by a variant of the SPYBOT WORM!"
X	nsdcmd vid process	nsdcmdwin.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	NT LM Security Support Provider	WinNTLM.exe	"Added by a variant of the SDBOT WORM!"
X	NT Windows System Manager Loader	csrlss.exe	"Added by the AGOBOT.OX WORM!"
X	NTSF MICROSOFT SYSTEM	winsis32.exe	"Added by a variant of the RBOT WORM!"
X	NTsocket	NoeWinnt.exe	"Added by the ATAKA-E TROJAN!"
X	nvc Win32	nvcvc.exe	"Added by the RBOT-ADD WORM!"
X	nvchost	winlogon.exe	"Added by the KLONE-J TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	NvCpl	windowsp.exe	"Added by a variant of the SDBOT WORM!"
X	NvCplScan	winasp.exe	"Added by the FORBOT.BZ WORM!"
X	NVIDIA Media Center Library	winlogon.exe	"Added by the AUTORUN-AZK WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
?	OEPowerPlugs	winoeinit.exe	"??"
X	Offica Monitor Secura Systeme	winxp_sp3.exe	"Added by a variant of the RBOT WORM!"
Y	OfficeScan95	pccwin97.exe	"Trend Micro antivirus OfficeScan"
X	OKGO	winutade.exe	"Added by the BANKER-EHZ TROJAN!"
Y	OneCareUI	winssnotify.exe	"System Tray access to and notifications from Windows Live OneCare - now superseded by Microsoft Security Essentials. ""OneCare helps keep your PC safe and secure while making your life easier. From virus scanning and file backups
X	Optimize Windows	Kuntilanak.exe	"Added by the SILLYFDC WORM!"
X	Optional Web Drivers For WIN32	phqghume.exe	"Added by a variant of the RBOT WORM!"
X	OS Security	mswind32.pif	"Added by the RBOT-ASU WORM!"
X	OSA	winword.exe	"Added by the KANGAROO-A TROJAN!"
X	Pag Windows Monitor	pag.exe	"Added by the AGENT-EOT TROJAN!"
X	PaRaY_VM	winlogon.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
X	Patches Value	WinGamed.exe	"Added by the SDBOT.BR WORM!"
X	Performs peer to peer connection	WinPTTP.exe	"Added by the RBOT-GMI WORM!"
X	Pmedia	winsrvc.exe	"Internet marketing sofware from Permissioned Media Inc as used in E-Card FriendGreetings foistware - see here. Treated by Trend as the FRIENDGRT.B WORM!"
X	PopMark	WinTask.exe	"""Pop Marketing"" adware"
X	PPPOEOE	winlite.exe	"Added by the RBOT-AAN WORM!"
X	PreInstall Windows	[path] repcale.exe [path] beird.exe	"Added by a variant of the RANDON.AN WORM! Both files are located in %System%\detr"
X	Program in Windows	IEXPLORE.exe	"Added by the LOVGATE.AB WORM!"
?	ProgramWindow	more comp.exe	"??"
N	PSIWin2.3 Connection Server	Psconsv.exe	Allows connectivity between a PC and a Psion device. Access can be gained from the Desktop or Start -> Programs
U	Quick Hide Windows	qhw.exe	"Quick Hide Windows from CronoSoft - ""provides a quick and easy way for home and office PC users to quickly get sensitive materials off the screen without closing programs or losing documents"""
X	quicken	Winrar.exe	"CoolWebSearch Therealsearch parasite variant. Note - this is not the file zipping utility also known as WinRAR!"
X	Quicktime Mediaplayer	winmplyer32.exe	"Added by the RBOT-PM WORM!"
X	Quicktime Pro 3.0	winuodps.exe	"Added by the GAOBOT.BH WORM!"
X	RandomWin32	mgnwin32.exe	"Added by the SDBOT-DV WORM!"
U	Real Spy Monitor	Winrsm.exe	"Realspy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	RealTimeProtector	winlogon.exe	"Added by the AUTORUN.DIB WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~� subfolder"
X	Reg Service	winsy.exe	"Added by a variant of the SPYBOT WORM!"
X	Reg Service	winslogon.exe	"Added by the AGOBOT-SC WORM!"
X	Reg Service	WinnConfig.exe	"Added by the AGOBOT-PF WORM!"
X	Reg Services	Winboot32.exe	"Added by the RBOT.PB WORM!"
X	regdiit	winxp.exe	"Added by the RUNAUTO.F WORM!"
X	regdiit	win.exe	"Added by the VBSAUTO-A WORM!"
X	RegDone	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	Registry Checkup	winreg.exe	Added by an unidentified WORM or TROJAN!
X	Registry Checkup System326a Monitor	Winregs326a.exe	"Added by a variant of the SDBOT WORM!"
X	Registry Loader	winhlpp32.exe	"Added by the GAOBOT.AO WORM!"
X	Registry oidet	win32.exe	"Added by the RBOT.BMT WORM!"
X	Registry Value Name	winapi32.exe	"Added by a variant of the RBOT WORM!"
X	Registry Value Name	syswinxp.exe	"Added by the RBOT.BTZWORM!"
X	RegistryChk	winbackup.exe	"Added by the MERTIAN WORM!"
X	Regkey for autostart	winservice.exe	"Added by the RBOT-NU WORM!"
X	REGRUN	winfix22490.exe	"Adware downloader - also detected as a variant of the LOWZONES.BW or AGENT.RD TROJANS!"
U	RegRun WinBait	winbait.exe	"Part of RegRun - used to detect unknown viruses. RegRun compares winbait.exe with the original copy called winbait.org and warns if the files are different.."
X	Remote Desktop Help Session Manager	WinRDH.exe	"Added by a variant of the SDBOT WORM!"
X	Remote Procedure Call	winrpc.exe	"Added by the RBOT-KM WORM!"
X	Remote Procedure Call	winsysrpc.exe	"Added by the SDBOT-PS WORM!"
X	Remote Procedure Call For Windows 32bit	rpc.exe	"Added by the RBOT-MD WORM!"
X	Remote Procedure Calls	mswinrpc.exe	"Added by the RBOT.KJ WORM!"
X	Remote Procedure Calls	mswinc.exe	"Added by the RBOT-IT WORM!"
X	Remote Procedure Calls	win.exe	"Added by the SDBOT-QI WORM!"
X	REMOVE ME	windos.exe	"Added by the SDBOT.EE WORM!"
X	ROOT_Machine	winlogon.exe	"Added by the BANKER-FI TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\inf"
X	rpc Win32	shost32.exe	"Added by the RBOT-ABL WORM!"
X	rpc Win32	spoolscv.exe	"Added by a variant of the RBOT WORM!"
X	RPCall_WIN2K	Kurawas.exe	"Added by the BHARAT.A WORM!"
X	rpcda Win32	rpcda.exe	"Added by the RBOT-AEE WORM!"
X	RPCserr32g	winlogon.exe	"Added by the RITDOOR-B WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	RPCserv32g	WINLOGON.EXE	"Added by the BOBAX.AD WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	RpcxWindows Extensions	rpcxwinex.exe	"Added by the RBOT.ACP WORM!"
X	RsWin	lsass.exe	"Added by the DELCANTI-B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""12053"" subfolder"
X	RsWin	lsass.exe	"Added by the SILLY.BR WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""4350"" subfolder"
X	run	winsys32.exe	"Added by the DELF.CP BACKDOOR!"
X	run windows	servic.bat	"Added by the REBOOT-AP TROJAN!"
X	run32dll	WINClock.exe	"Added by an unidentified VIRUS
?	run=	win.ini	"??"
X	run=	mouse_configurator.win	"Added by the GAGGLE.E WORM!"
X	Rund1l32	Winfi1e32.exe	"Added by the MERTIAN WORM!"
X	RunDLL32	winupdate.exe	"Added by an unidentified TROJAN! - possibly a BMBOT variant"
X	Rundll32	Windows.exe	"Added by the QQPASS.E TROJAN!"
X	runing	win.exe	"Added by the DELF-LC TROJAN!"
X	RunProg	wini.exe	"Added by the OPTIX.04.D TROJAN!"
X	RunWin	[path to file]	"Added by the BANKER-ES TROJAN!"
X	runwin32	runwin32.exe	"Added by the ESEARCH-A TROJAN!"
X	RUNWIN32	runwin32.exe	"Added by the VB-AET TROJAN!"
X	RunWindowsUpdate	uptodate.exe	"BrowserAid/BrowserPal foistware"
X	runwinlogon	winlogon.exe	"Added by the AGENT.TQY TROJAN! Note - this is not the legitimate winlogon.exe process
X	Safe	SafeWin.exe	"Added by the FOCOSENHA TROJAN!"
X	ScheduIr	winagent.exe	"Added by a variant of the SDBOT WORM!"
X	Scheduler	winagent.exe	"Added by the TACTSLAY.B TROJAN!"
X	secure socket layer	wins32a.exe	"Added by an IRCBOT TROJAN!"
X	Security	WindowsSecurityUpdate.exe	"Added by a variant of the SDBOT WORM!"
X	Security Patch	WinUpdate32.exe	"Added by the SDBOT-BM WORM!"
X	Security Patches	WinLab32.exe	"Added by the SDBOT-KB WORM!"
X	Service Client	winsvcli.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Service Monitor	WinOcx.exe	"Added by the RBOT-AQJ WORM!"
X	Service Monitor	winxpser.exe	"Added by the RBOT-BDF WORM!"
X	Service Process	winset.exe	"Added by a variant of the SPYBOT WORM!"
X	Service System	windowsXP.exe	"Added by the BANCOS-EL TROJAN!"
X	ServiceOptionMP3	winamp.dll.exe	"Added by the SAMSON-A TROJAN!"
X	Services	winread.exe	"Added by an unidentified VIRUS
X	Services	windns.exe	"Added by a variant of the RBOT WORM!"
X	services	windows32.exe	"Added by the FLYVB-C WORM!"
X	Services Start2	odcwinst.exe	"Added by the PYSKE-D WORM!"
X	Services32 Startup	win32dll.exe	"Added by the SDBOT-XO WORM!"
X	Servicewin	Hide32.exe	"Added by the MSNVB-D WORM!"
X	Sevice	winconfig.exe	"Added by the GIP.113.B1 TROJAN!"
N	SFP	vzSFPWin.EXE	Verizon Online Support Center - prompts for online updates
U	SfWinStartInfo	sfWinStartupInfo.exe	SFIRM32 Online Banking software
X	shccde	winssled.exe	"Added by the BUZUS.CQMU TROJAN!"
X	SheduIer	winagent.exe	"Added by the BDOOR-EB BACKDOOR!"
X	Shell	Explorer.exe winupdate.exe	"Added by the AGENT-FD TROJAN! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The ""winupdate.exe"" file is located in %System%"
X	Shell	Explorer.exe winsys32.exe	"Added by the DELF.CP BACKDOOR! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The ""winsys32.exe"" file is located in %Windir%"
X	Shell	Win32.dll.exe	"Added by the VB.BTX TROJAN!"
X	Shell Tray Window	ShellTraywnd.exe	"Added by the STULTDOR-A TROJAN!"
N	Shockwave Init	SWINIT.EXE	Part of Macromedia Shockwave. Controls the Shockwave Remote Control Panel. The Remote Control can be activated manually from the Start Menu by locating and selecting Shockwave and then Shockwave Remote under Programs
X	ShutDownWindows	"Rundll32.exe User	ExitWindows"
N	SideWinderTrayV4	SWTrayV4.exe	MS SideWinder game controller system tray icon. This is specific to version 4 of the software. Available via Start -> Programs
U	SiS Windows KeyHook	keyhook.exe	"Hotkey manager for Silicon Integrated Systems (SiS) based graphics chipsets - disable unless you use hotkeys"
X	sis32	winsos.exe	"Added by the QQPASS.IA WORM!"
X	Sistray32	win.bat	"Added by the JUMPRED.A WORM!"
X	SkynetRevenge	winlogon.scr	"Added by the NETSKY.AA WORM!"
N	SM56 Helper Win32 Utility	sm56hlpr.exe	Helper utility for Motorola based SM56 software modems - resides in the System Tray
X	SmansaApp	winlogon.exe	"Added by the ROMARIO-A WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	smcserv	winsrv.exe	"Added by the AGOBOT-OU WORM!"
U	SMS Win9x Message Agent	SMSMsg.exe	This program assigns a user to a Systems Management Server site
X	SMSERIALSTARTER	win32st.exe	"Added by the FAKEALERT-AH TROJAN! Installed with the SpyBurner spyware remover - which is not recommended
X	SMSERIALWORKERSTARTER	winstrse.exe	"Added by the RENOS.IC TROJAN! Installed with the SpyBurner spyware remover - which is not recommended
X	smsger	Win.exe	"Added by a variant of the SDBOT WORM!"
X	Smss.exe driver	winupd32.exe	"Added by the SDBOT.MI BACKDOOR!"
X	softIce Update 32	wininits.exe	"Added by the RBOT-ANB WORM!"
X	Sound System	WinSound1.exe	"Added by an unidentified VIRUS
X	spoolsvs	wintre.exe	"Added by the SDBOT.EGQ WORM!"
X	spoolsvs	wincfy.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	SpyEx	Winllogo.exe	"Added by the PRSKEY-A WORM!"
X	SpywareGuard	winproc32.exe	"Startpage adware Trojan"
X	SpywareGuardPlus	winmm64.exe	StartPage.ht homepage hijacker
X	sqservices	wins32.exe	"Added by the PROGENT-B TROJAN!"
X	srv	winlogon.exe	"Added by the SILLYFDC.BCA WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%\Local Settings\Application Data"
U	Srv32Win	SpyAgent4.exe	"SpyAgent - monitoring software that creates records of everything people do on a computer
U	Srv32Win	Svchost.exe	"Realtime-Spy keystroke logger/monitoring program - remove unless you installed it yourself!"
U	Srv32Win	sysdiag.exe	"SpyAgent surveillance software. Uninstall this software unless you put it there yourself"
U	srv32win	win16dll.exe	"Screenspy captures screenshots silently. If you didn't install this yourself remove it"
X	ssate.exe	winsys.exe	"Added by the BEAGLE.K WORM!"
X	ssgrate.exe	winerdir.exe	"Added by the MITGLIEDER.O TROJAN!"
X	ssgrate.exe	winsystems.exe	"Added by the BAGLEDL-J TROJAN!"
X	ssgrate.exe	wintems.exe	"Added by the MITGLIEDER.Q TROJAN!"
X	SSK Service	winssk32.exe	"Added by the SOBIG.E WORM!"
X	ssms.exe	winn.exe	"Added by the SDBOT-DHE WORM!"
X	Start	windows.vbs	Homepage hijacker
X	Start Upping	windupds.exe	"Added by the SDBOT.AFH WORM!"
X	Start Upping	windupdts.exe	"Added by a variant of the RBOT WORM!"
N	Start Wingman Profiler	lwtest.exe	"Logitech Wingman software required to operate Logitech joysticks and gamepads. Unless you're a hard-core gamer
N	Start Wingman Profiler	LWEMon.exe	Part of Logitech Gaming Software (formerly Wingman Software) for their range of game controllers. Starts the profiler (button configuration) and loads the last used profile at start-up - including System Tray access. Unless you're a hard-core gamer it's best to leave it disabled and load when needed
X	startkey	RunWinRaR.exe	Added by a variant of the BIFROSE-LV TROJAN!
X	startkey	win32i.exe	"Added by the BIFROSE-R TROJAN!"
X	startkey	winampXP.exe	"Added by the BIFROSE-OY TROJAN!"
X	startkey	winlogin.exe	"Added by the BIFROSE-PM TROJAN!"
X	Startup	WinlogonStartup	Unidentified malware
X	startwin	startwin.exe	"Added by the ANTIMAN.A WORM!"
X	startwindowskeyuser	rundle2.exe	"Added by the JAVAKILLER TROJAN!"
X	stup1db0t	_win.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	STV	winscrne.exe	"Added by a variant of the SDBOT WORM!"
X	Sun Java Console for Windows NT & XP	jconsole.exe	"Added by the VANEBOT-C WORM!"
U	SurfinGuard Pro	winsfcm.exe	"SurfinGuard Pro from Finjan - internet protection software
X	SvcH0st	WINAGENT.EXE	"Added by the BDOOR-EB BACKDOOR!"
X	Svchost	winhost.exe	"Added by the LOLAWEB.A TROJAN!"
X	svchost	winhelp.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	svchost	win.exe	"Added by the VBSAUTO-A WORM!"
X	svchost	windowsrx.exe	"Added by the AGOBOT-MZ WORM!"
X	Svchost Windows Remote Services	svhost.exe	"Added by the IRCBOT-IV WORM!"
X	Svcphpwin	sslphp32.exe	"Added by the AGOBOT-ABR WORM!"
X	svcshare	winampXP.exe	"Added by the FUJACKS-J VIRUS!"
X	svcwinprocess32	[path to worm]	"Added by the UPERING WORM!"
X	svhost windows services	svhost8.exe	"Added by the RBOT-WQ WORM!"
X	svwin32	unninst32.exe	"Added by the AGOBOT-NF WORM!"
U	SWd	winwd.exe	"PC Security™ from Tropical Software - ""is the ultimate in computer security
X	swingsys	SWINGSYS.EXE	"Added by the BANCOS-CX TROJAN!"
X	Sygate Personal Firewall	Win32x.exe	"Added by the RBOT-KZ WORM!"
X	Sygate Personal Firewall	wins.exe	"Added by the RBOT.AOB WORM!"
X	Sygate Personal Firewall	winxpstat.exe	"Added by a variant of the RBOT WORM!"
X	Sygate Personal Firewall	win31243.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Sygate Personal Port Blocker	winupdate.exe	"Added by a variant of the RBOT WORM!"
X	Symantec Antivirus professional	windows .exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	Winhp32.exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Antivirus professional	winudp.exe	"Added by a variant of the WOOTBOT WORM! See here"
X	Symantec Security Routine Addon for Microsoft Windows	navpxaw32.exe	"Added by the AGOBOT-GJ TROJAN!"
X	syncman	winsync.exe	"Added by the MANCSYN-A TROJAN!"
X	Syntax	windows32.exe	"Added by the SDBOT.CQ WORM!"
X	Sys29	win***32.exe [* = random char]	"EliteBar adware"
U	sys32cmd	sys32win.exe	"Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
U	sys32sql	sys32win.exe	"Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	SysA	win***32.exe [* = random char]	"EliteBar adware"
X	sysav	winav.exe	"WinPC Antivirus rogue security software - not recommended
X	Syscheck	win.hta	Browser hijacker
X	SysConfig	wincfg32.exe	"Added by the SDBOT.ZD WORM!"
X	Sysctrls	winupdate.exe	Added by an unidentified WORM or TROJAN!
X	Sysctrls	win32dll.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	sysdir	winrun.exe	"Added by the WINBUR.B WORM!"
X	sysdll	windll.exe	"Added by the AUTORUN.ECT WORM!"
X	SysInit	wininit32.exe	"Added by the XABOT WORM!"
X	SysStart	syswin.exe 1	"Added by the AUTORUN-EY WORM!"
X	Systam13	speedwin.exe	"Added by the RBOT.GVH BACKDOOR!"
X	System	serwin.exe	"Added by the LDPINCH-BN TROJAN!"
X	System	WINL0G0N.EXE	"Added by the BANCOS-DB TROJAN!"
X	System	windowsps.exe	"Added by a variant of the RBOT WORM!"
X	System	winupd.exe	"Added by a variant of the SDBOT WORM!"
X	SYSTEM	windmupdr.exe	"Added by a variant of the RBOT WORM!"
X	System	kernelwind32.exe	"Added by the VXIDL.FT TROJAN!"
X	System	kernelwind64.exe	"Added by the DLOADER.DJD TROJAN!"
X	system	Winhelp.exe	"Added by the IMAUT.CN WORM!"
X	System	winipck.exe	"Added by the RBOT-TK WORM!"
X	System Check	win_klr32.exe	"Added by the DELF-DRA WORM!"
X	System Document Application	wins.exe	"Added by the SDBOT.AUB WORM!"
X	System Document Application	winsvc32.exe	"Added by the SDBOT-VA WORM!"
X	System Drivers	wingmt.exe	"Added by the SDBOT-MG WORM!"
X	System Information Manager	win.exe	"Added by the SDBOT-MU WORM!"
X	System Information Manager	windowsNt.com	"Added by the SDBOT-ND WORM!"
X	System Manager	winsrv32.exe	Added by an unidentified WORM or TROJAN!
X	System Manager Updates	winsvc.exe	"Added by the AGOBOT.AEM WORM!"
X	System Service	msnwindows.exe	"Added by the SPYBOT.YCL WORM!"
X	System Update Service	winupd32.exe	"Added by the ADTODA-A TROJAN!"
X	System Update2	wininet.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	winlogon.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate winlogon.exe process
X	System Update2	winspool.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Updates	winsci.exe	"Added by a variant of the RBOT WORM!"
X	System Updates Manager	winserv32.exe	"Added by the AGOBOT-AGA WORM!"
X	System32	winds32.exe	"Added by the DWNLDR-HFY TROJAN!"
X	system32	lowinplay.exe	"Added by the VB.FVJ TROJAN!"
X	System32 Spool	winint.exe	"Added by the FORBOT-N WORM!"
X	SystemAdministration	Wincmp32.exe	"Added by the ASYLUM TROJAN!"
X	systemdll.dll	winsys32.exe	"Added by the DELF.CP BACKDOOR!"
X	SystemMigration	WinMedia.exe	"Added by the KELVIR.EI WORM!"
X	SystemReg	WINREG.EXE	"Added by the DEWIN.A TROJAN!"
X	Systems Backups	windrives.exe	"Added by the AGOBOT-RB WORM!"
X	systems usb driver	Windows2.exe	"Added by a variant of the RBOT WORM!"
X	SystemTray	lsvhostwinlk.exe	"Added by a variant of the SPYBOT WORM!"
X	SystemTray	Windowsupd.exe	"Added by a variant of the IRCBOT TROJAN!"
X	SystemWideHook for Windows NT	%WinHook32.exe	"Added by the MYDOOM.AC WORM!"
X	SystemWindows	scvhost.exe	"Added by the SILLYFDC-CG WORM!"
X	systhread	winkernal.exe	"Added by the LIAMED WORM!"
U	systray	winlogin.exe	"KidControl surveillance software. Uninstall this software unless you put it there yourself"
X	SysWin	SysWin.exe	"Added by the IRCCONTACT TROJAN!"
X	syswin	v6.exe	"Added by the AGENT-ECM TROJAN!"
X	syswin.txt	[3 random letters].exe	"Added by a variant of the SPYBOT WORM! See here"
X	syswin32	syswin32.exe	"Added by a variant of the SPYBOT WORM!"
X	Syswindow	Syswindow.exe	"Added by the COW TROJAN!"
X	sysygm64	winrxd64.exe	"Added by the IRCBOT-RK TROJAN!"
X	T4skM4n4g3r	Wink3sk9.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Tarefas do Windows	taskexec.exe	"Added by the AGENT-LSD TROJAN!"
X	Task manager	UPDATEWIN.exe	"Added by the RBOT.BBS WORM!"
X	Task Manager Win32	taskmngr32.exe	"Added by the RANCK-EX BACKDOOR!"
X	Taskmon driver	winampa.exe	"Added by the LOONY-I TROJAN! Note - this is NOT associated with the popular Winamp media player. The valid file for the Winamp Agent resides in a ""Winamp"" subdirectory of %ProgramFiles% whereas this file is located in %System%"
X	TEXTCONV	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	ThE	wind0s.exe	Added by an unidentified WORM or TROJAN!
X	this free	winsyst.exe	"Added by the MADAG.A WORM!"
X	Torjan Program	WINLOGON.EXE	"Added by the WOWCRAFT.D TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	Touch Manager	WinLED.exe	Dell keyboard utility. Disabling can result in loss of screen saver and power saver functionality
N	Tour	wincool.exe	"Annoying WinMe component that prompt you to play the %Windir%\Application Data\Microsoft\INTROCONTENT.HTA file - that plays a full screen version of the WinMe product preview and cannot be stopped until it finishes to my knowledge. That prompt will keep popping up after an install/reinstall of WinMe until you give in and watch the thing. It also puts a task scheduler entry to run that annoying thing every 30 minutes - and don't bother deleting that entry as Windows puts it right back. Not only should you disable it from running
U	Track4WinMonitor	STMonitor.exe	"Track4Win Monitor surveillance software. Uninstall this software unless you put it there yourself"
X	TrayX	winppr32.exe	"Added by the SOBIG.F WORM!"
X	Tsk Mng Hlp	wins32.exe	"Added by the AGOBOT-JB WORM!"
?	Tweak Manager	WinManager.Exe	"WinGuides Tweak Manager. Is this required for the live updates feature and/or if settings are changed?"
X	Undefined	winter.exe	"Added by the KILLAV.LW TROJAN!"
X	Universal Plug & Play devices	WinUPPD.exe	Added by an unidentified WORM/TROJAN!
X	Updade Windows	winlogom.exe	"Added by the TONAX-A TROJAN!"
X	update	winis.exe	"Added by the RBOT-VD WORM!"
X	UPDATE	WinUpdater5.0.vbs	"Added by the GORMLEZ-A WORM!"
X	Update	WinUpdate.exe	"Added by the SDBOT-CV BACKDOOR!"
X	Update Checker	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	Update for Windows	[various filenames]	"Added by the LERPA-A WORM! Note - the file name will be one of the following common.exe
X	Update Service	winu32.exe	"Added by the RBOT-MG WORM!"
X	update service	winx.exe	"Added by a variant of the RBOT WORM!"
X	Update Windows	EXPLORE.EXE	"Added by a variant of the SDBOT WORM!"
X	Update Windows	EXPLORE.EXE	"Added by a variant of the SDBOT WORM!"
X	UpdateCheck	winstall.exe	"Added by the SPYBOT-CY WORM!"
X	updater32	winload32.exe	"Added by the CULT.M WORM!"
X	updatewin	update.exe	"Added by a variant of the SDBOT WORM!"
X	UpdateWin	[random filename]	"Added by the IRCBOT.AZW BACKDOOR!"
X	updateWins	systrey.exe	"Added by the RANDON WORM!"
X	updatexwin	winxrpc.exe	"Added by the AGOBOT-KJ WORM!"
X	upddateit	winit.exe	"Added by the RBOT-MS WORM!"
X	Upgrade Service	winupd.exe	"Added by the TOFGER-U TROJAN!"
X	UPNPService	WinSVCservice.exe	"Added by the AGOBOT.UN WORM!"
X	UpTimes service	WinUp.exe	"Added by the RBOT-AKB WORM!"
X	urudjeffni	winlogon.exe	"Added by the ROMARIO-A WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	USB 2.0 Driver	Winsys32.exe	"Added by the AGOBOT-QM WORM!"
X	USB 2.0 Driver	winsystem.exe	"Added by the AGOBOT-QS WORM!"
X	USB 2.1 Driver	winupdate1.exe	"Added by a variant of the RBOT WORM!"
X	USB Device	win32usb.exe	"Added by the FORBOT-BQ WORM!"
X	USBHWINFO	mac.exe	"Added by the LOWZONE-I TROJAN!"
X	USBHWINFO	[path to trojan]	"Added by the LOWZONE-I TROJAN!"
X	USBHWINFO	sst6.exe	"Added by the LOWZONE-I TROJAN!"
X	userinit	winlogon.exe	"Added by the DLOADER-TP TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	vbe	win.vbe	"Added by the LOSESLP-A WORM!"
X	vbwq cute	winnt.exe	"Added by the MADAG.A WORM!"
X	Video	winamp32.exe	"Added by the AGOBOT-NG WORM!"
X	Video Poes	winii.exe	"Added by the AGOBOT-CP WORM!"
X	Video Proces	winaps.exe	"Added by the AGOBOT.HD WORM!"
X	Video Process	winasp.exe	"Added by the AGOBOT-IS WORM!"
X	Video Process	wincert32.exe	"Added by the AGOBOT.JT WORM!"
X	Video Process	wincrt32.exe	"Added by the AGOBOT-GR WORM!"
X	Video Proes	winaii.exe	"Added by the AGOBOT-FH WORM!"
X	VIEW POINT DRIVERS FOR WIN32	phqghu.exe	"Added by a variant of the RBOT WORM!"
X	virtual	winit.exe	"Added by the MUGLY.A or MUGLY.B WORMS!"
X	virtual	winprotect.exe	"Added by the MUGLY.C WORM!"
X	virtual	wini.exe	"Added by the RBOT-YX WORM!"
X	virtual-ie	winlogi.exe	"Added by the RBOT-BJU WORM!"
X	virtual-machine	winlogin.exe	"Added by the RBOT-VU WORM!"
X	virtual-machine	wini.exe	"Added by the RBOT-WR WORM!"
X	Vsample	winxpsock.exe	"Added by the SDBOT.BLK WORM!"
Y	Vshwin32EXE	VSHWIN32.EXE	From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Communicates between VSSTAT.EXE and the VShield System Scan module. Can be started automatically or available via Start -> Programs
X	W1N32.DLL	WINLOGON .exe	"Added by the DROPPERFL.A TROJAN!"
X	WCPC	wintsvcc.exe	"PurityScan adware"
X	WCPI	wintsvit.exe	"PurityScan adware"
X	WCPS	Wint**.exe [* = random char]	"PurityScan adware"
X	WCPT	wintsvtr.exe	"PurityScan adware"
X	WEB DRIVERS FOR WIN32	phqgh.exe	"Added by a variant of the RBOT WORM!"
X	Welcome	winconfig.exe	"Added by the GIP.113.B1 TROJAN!"
X	win	regedit -s win.dll	"Added by the SEEKER.K TROJAN! Note that regedit is the the legitimate Windows Registry Editor and shouldn't be deleted. The ""win.dll"" file is located in %Windir%"
X	win	xwinxrpc32.exe	"Added by the AGOBOT-MV WORM!"
X	win	xwinxrpc.exe	"Added by the AGOBOT-MV WORM!"
X	WIN	ehshell.exe	"Added by the MYTOB-CQ WORM!"
X	WIN	windows.exe	"Added by the REATLE.C WORM!"
U	win	homesec.exe	"Related to the Sentry Parental Controls software"
X	Win Antispyware Center	av.exe	"Win Antispyware Center rogue security software - not recommended
X	Win Antivir 2008	Win Antivir 2008.exe	"Win Antivir 2008 rogue security software - not recommended
X	Win Antivirus 2008	Win Antivirus 2008.exe	"Win Antivirus 2008 rogue security software - not recommended
U	Win Chimes	winchi~1.exe	"WinChimes - enhancement software for the system clock that runs in the system tray"
X	Win Comm	WinComm.exe	"Added by the WINCOM TROJAN!"
X	Win Command	command32.exe	"Added by the AGOBOT.XQ WORM!"
X	Win Config	winconfig.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Win CPU	sysin.pif	"Added by the RBOT-AXL WORM!"
X	win ctl app	wuctl.exe	"Added by a variant of the SDBOT WORM!"
X	Win Defrag	windfrag.exe	"Added by a variant of the SDBOT WORM! See here"
X	Win Defrag!	windefrag.exe	"Added by a variant of the SDBOT WORM! See here"
X	Win Defrags	defrag.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Win Drivers SSL	hpws.exe	"Added by the IRCBOT.67098 WORM!"
X	Win Drivers SSL	TASKMAN4.exe	"Added by a variant of the RBOT WORM!"
X	Win Drivers SSL32	hpwsnnsbc.exe	"Added by the SPYBOT.MAR WORM!"
X	Win exe file managr	crss.exe	"Added by the RBOT.CCI WORM!"
X	Win FTP	wintftp.exe	"Added by the SDBOT-KE WORM!"
X	WIN HOST PROCESS	WIN HOST PROCESS.EXE	"Added by the KEYLOGGER.CLONE TROJAN!"
X	Win I5oahder	[worm filename]	"Added by the AGOBOT-DS WORM!"
X	Win INI 32	msrp32.exe	"Added by the RBOT-FZC WORM!"
X	Win l5oahder	winampa.exe	"Added by a variant of the RBOT WORM! Note - this is NOT associated with the popular Winamp media player. The valid file for the Winamp Agent resides in a ""Winamp"" subdirectory of the Program Files directory"
X	Win Login	winlogin.exe	"Added by the RBOT-AWE WORM!"
X	Win Microsoft 98	win14.exe	"Added by the RBOT-AKX WORM!"
?	win name	stat.exe	"??"
X	Win Net Wks32	netwks32.exe	"Added by the RBOT.AA WORM!"
X	Win Patch	ntldr.exe	"Added by the SDBOT-GS WORM!"
X	Win Process Updates	winupdates.exe	"Added by a variant of the SDBOT WORM!"
X	Win Prosess0r	[random filename]	"Added by the RBOT-BIT WORM!"
X	WIN prosessor16	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	Win Proxy32 Protocol	bsvtem.exe	"Added by a variant of the SDBOT WORM!"
X	Win Secure Update	[random filename]	"Added by the RBOT-AGI WORM!"
X	Win Security	msw32.pif	"Added by the RBOT-AQT WORM!"
X	Win Security	winsecure.exe	"Added by the SLENFBOT.RD WORM!"
X	Win Security 360	WinSecurity360.exe	"Win Security 360 rogue security software - not recommended
X	Win Server	winserv.exe	"Added by the IMISERV.A TROJAN!"
X	Win Server Updt	wupdt.exe	"Added by the IMISERV.A TROJAN!"
X	Win Server Updt	winserver.exe	"Added by a variant of the IMISERV TROJAN!"
X	Win Server Updt	pxckdla.exe	"IEPlugin adware"
X	Win SSL	SP2s.exe	"Added by the RBOT.BBI WORM!"
X	Win startup	mscfg32.exe	"Added by the SPYBOT-AE WORM!"
X	Win Startup	WINCFG32.EXE	"Added by the SPYBOT-CL WORM!"
X	Win Sync montr	winsyncupx.exe	"Added by the RBOT.BYJ BACKDOOR!"
X	Win TaskLoader	msgmr.exe	"Added by the MYTOB.L WORM!"
X	win update	wupda32.exe	"Added by the SDBOT.J WORM!"
X	win update	wapdate.exe	"Added by a variant of the RBOT WORM!"
X	Win Update	SysUpdate.exe	"Added by the AGOBOT-TN WORM!"
X	Win Update	oleupdate.exe	"Added by the AGENT-UY TROJAN!"
X	Win Update	msnmger.exe	"Added by the RBOT-GDP WORM!"
X	win update	wupdate.exe	"Added by the RBOT-P BACKDOOR!"
X	Win Updater	WINUPDATER.EXE	"Added by the RBOT.IP WORM!"
X	Win Updator Services	ctfnom.exe	"Added by a variant of the WOOTBOT WORM!"
X	WIN USB 2.0	usbsystem.exe	Added by an unidentified WORM of TROJAN!
X	WIN USB 2.0	winusb.exe	"Added by a variant of the RBOT WORM!"
X	Win USB 2.0 USB Driver	HPPrint.exe	"Added by the SPYBOT.DNB WORM!"
X	WIN USB SUPPORT	grxsrv.exe	"Added by a variant of the RBOT WORM!"
X	Win Validation Application	DBExecCom.exe	"Added by the VBSILLY-A WORM!"
X	Win WinAmp	winamp.exe	"Added by the RBOT.AGF WORM! Note - this is NOT the popular Winamp media player which resides in a ""Winamp"" subdirectory of %ProgramFiles%. This file is located in %System%"
X	win************* [* = random digit]	win*************.exe [* = random digit]	"WINBO adware"
X	WIN-BUGSFIX	WIN-BUGSFIX.EXE	"Added by the LOVELETTER (I LOVE YOU) VIRUS!"
X	win-xp	nvsc32.exe	"Added by the BROPIA.N WORM!"
X	win-xp	winis.exe	"Added by the BROPIA.N WORM!"
X	win.exe	win.exe	"Added by the PODROP-C TROJAN!"
U	win16.dll	win16dll.exe	"Screenspy captures screenshots silently. If you didn't install this yourself
X	win23.exe	win23.exe	"Added by the BIFROSE.BSJ BACKDOOR!"
X	Win2Drv	[worm filename]	"Added by the WINTOO WORM!"
X	WIN32	WIN32.EXE	"Added by the RATEGA TROJAN!"
X	win32	Shakira_1997_Part_1_.Mpeg_.scr	"Added by the MYLIFE.N WORM!"
X	win32	Setup_32.exe	"Added by the EVILBOT.B TROJAN!"
X	Win32	Win32.exe	"Added by the ISRAZ.A WORM!"
X	win32	winsrv32.exe	"Added by the ADUENT TROJAN! Acts as a hi-jacker redirecting to Surferbar.com and adult content sites"
X	win32	WinSetup.exe	"Added by the EVILBOT.B TROJAN!"
X	Win32	system32.vbs	"Added by the SWERUN VIRUS!"
X	Win32	Game.exe.vbs	"Added by the SCAFENE WORM!"
X	Win32	arsetup.exe	Added by the SPAZBOX.A TROJAN!
X	win32	winhost.exe	"Added by the BROPIA.J WORM!"
X	Win32	winnnit.exe	"Added by a variant of the SDBOT WORM!"
X	Win32	msnsrv.exe	"Added by a variant of the SDBOT WORM!"
X	Win32	sysmon.exe	"Added by the MYTOB-HQ TROJAN!"
X	Win32	zaq.exe	"Added by the RBOT-GCE WORM!"
X	Win32 Bios	Winbios.exe	"Added by the SEMAPI-A WORM!"
X	Win32 Cnfg32	msconfgh.exe	"Added by the MYTOB.NB WORM!"
X	Win32 Configuration	videosd32.exe	"Added by the SDBOT.TT WORM!"
X	Win32 Configuration	dllhelp.exe	"Added by the SDBOT.UL WORM!"
X	Win32 Configuration	mplayer.exe	"Added by the FORBOT-BZ WORM!"
X	Win32 Console	cmd.exe	"Added by the ABI.C WORM! Note - this is not the legitimate cmd.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Win32 Critical File	Win32.exe	"Added by the RBOT-GUB WORM!"
X	WIN32 DDOSSER	dos.exe	"Added by the KELVIR.F WORM!"
X	Win32 Debug Manager	Win32Debug.exe	"Added by a variant of the WOOTBOT WORM!"
X	Win32 Debug Manager	microsoftupd.exe	"Added by the RBOT-GRJ WORM!"
X	Win32 Device Loader	Win32ldr.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Win32 Driver	svchosts.exe	"Added by the FORBOT-FD WORM!"
X	Win32 Driver	sysmls.exe	"Added by the MYTOB.JH WORM!"
X	Win32 Drivers	winlogons.exe	"Added by the FORBOT-FG WORM!"
X	Win32 DRK Driver	wdrk32.exe	"Added by the WOOTBOT.CY WORM!"
X	Win32 exe file	winstr32.exe	"Added by a variant of the SPYBOT WORM!"
X	Win32 Explorer	Explorer32.exe	"StartPa-MN homepage hijacker"
X	Win32 Firewall Driver	winfw.exe	"Added by a variant of the RBOT WORM!"
X	Win32 Firewall Drivers	winfirewall.exe	"Added by the WOOTBOT.GX WORM!"
X	Win32 FireWire Driver	CTHELPER32.EXE	"Added by the WOOTBOT TROJAN!"
X	Win32 FRT Driver	msfr32.exe	"Added by the WOOTBOT.EJ WORM!"
X	Win32 Help32 Service	win32help.exe	"Added by the DELBOT-U WORM!"
X	Win32 Info	windowsnfo.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Win32 Information Service	crsrs.exe	"Added by the RINBOT.Y WORM!"
X	win32 internet server	winserver.exe	"Added by the DERMON-D TROJAN!"
X	Win32 Kernel core component	Kernel32.pif	"Added by the MOKS VIRUS!"
X	Win32 Kernel Update	win32update.exe	"Added by the PROXY-BS TROJAN!"
X	Win32 LSA Driver	lsa.exe	"Added by the FORBOT-FJ WORM!"
X	Win32 Ms Auto Updater	AutomsUPD.exe	"Added by a variant of the RBOT WORM!"
X	Win32 NDIS	Ndiswin.exe	"Added by the RBOT.AMG WORM!"
X	Win32 NDIS Driver	xpndis.exe	"Added by a variant of the RBOT WORM!"
X	Win32 NDIS Driver	Ndistcp.exe	"Added by the WOOTBOT.EU WORM!"
X	Win32 Network Driver	crss.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Win32 NT Adv Services	taskmngr.exe	"Added by the RBOT-ADE WORM!"
X	Win32 nvc	nvcva.exe	"Added by the RBOT-ABF WORM!"
X	Win32 NVIDIA Driver	MSPMSPSU.EXE	"Added by a variant of the WOOTBOT.Y WORM!"
X	win32 regedit	msn32.exe	Added by an unidentified WORM or TROJAN!
X	Win32 Rundll Loader	Rundll32.exe	"Added by the SDBOT.A TROJAN! Note - this is not to be confused with the legitimate rundll32.exe file!"
X	Win32 Secure	msconfigsvc.exe	"Added by a variant of the SDBOT WORM!"
X	Win32 Security Protocol	secure32.exe	"Added by the RBOT-ETI WORM!"
X	Win32 Security Service	crsss.exe	"Added by the DELBOT-O WORM!"
X	win32 security updates downloader	tskmngr.exe	"Added by a variant of the SDBOT WORM! See here"
X	Win32 Service	bazzi.exe	"Added by the AHKER.E WORM!"
X	Win32 Service	[trojan filename]	"Added by the AGENT-GBO TROJAN!"
X	Win32 Services	odbc32.exe	"Added by the SPYBOT-EK WORM!"
X	Win32 Services	wuamngr.exe	"Added by the SDBOT-N WORM!"
X	Win32 Services Config	winwkys.exe	"Added by the RBOT.BKY WORM!"
X	Win32 Services1	wuamngr1.exe	"Added by the SDBOT-PV WORM!"
X	Win32 Src Service	win32src.exe	"Added by the RBOT-SX WORM!"
X	Win32 SSL Driver	winssv.exe	"Added by the FORBOT-BH WORM!"
X	Win32 Svchosts Driver	svchosts.exe	"Added by the FORBOT-FO WORM!"
X	Win32 System Kernel	winservice.exe	"Added by the SDBOT.KIN WORM!"
X	win32 system server	winserver.exe	"Added by the DERMON-A TROJAN!"
X	Win32 System Spool	spoolsvc.exe	"Added by the SDBOT.UK WORM!"
X	Win32 Test	bleatest.exe	"Added by a variant of the RBOT WORM!"
X	Win32 Update	svchosts.exe	"Added by a variant of the SDBOT WORM!"
X	Win32 Update	dl32.exe	Added by an unidentified WORM or TROJAN!
X	win32 update service	svchostt.exe	"Added by a variant of the SDBOT WORM!"
X	Win32 USB Driver	winxpinit.exe	"Added by the SDBOT.AA TROJAN!"
X	Win32 USB Driver	mvsecn.exe	"Added by the FORBOT-BK WORM!"
X	Win32 Usb Driver	svhosint32.exe	"Added by the FORBOT-BE or FORBOT-J WORMS!"
X	Win32 Usb Driver	usb32.exe	"Added by the SDBOT-OV WORM!"
X	Win32 Usb Driver	AvpG.exe	"Added by the FORBOT-BX WORM!"
X	Win32 USB Driver	rundll.exe	"Added by the FORBOT-BN WORM! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	Win32 USB2	wins32.exe	"Added by a variant of the RBOT WORM!"
X	Win32 USB2 Driver	win32usb.exe	"Added by the SPYBOT.DHV WORM!"
X	Win32 USB2 Driver	smsc.exe	"Added by the SDBOT.FO WORM!"
X	Win32 USB2 Driver	svchosting.exe	"Added by the FORBOT-J or SDBOT.HU WORM!"
X	Win32 USB2 Driver	sys32.exe	"Added by the WOOTBOT.X WORM!"
X	Win32 USB2 Driver	sys32snd.exe	"Added by the FORBOT-AN WORM!"
X	Win32 USB2 Driver	wind32.exe	"Added by the FORBOT-AH WORM!"
X	Win32 USB2 Driver	winupdate.exe	"Added by the AGOBOT.YE WORM!"
X	Win32 USB2 Driver	updatemgr.exe	"Added by a variant of the FORBOT WORM!"
X	Win32 USB2 Driver	winsnd32.exe	"Added by a variant of the SDBOT WORM!"
X	Win32 USB2 Driver	msn.exe	"Added by the FORBOT-EX WORM!"
X	Win32 USB2 Driver	syscfg32.exe	"Added by the FORBOT-R WORM!"
X	Win32 USB2 Driver	algg.exe	"Added by the TIBS.BF WORM!"
X	Win32 USB2 Driver	usb2.exe	"Added by the FORBOT-Y WORM!"
X	Win32 USB2 Driver	winusb32.exe	"Added by the FORBOT-M WORM!"
X	Win32 USB2.0 Driver	386.exe	"Added by the IRCBOT.D WORM!"
X	Win32 USB2.0 Driver	rundll16.exe	"Added by the WOOTBOT.H WORM!"
X	Win32 USB2.0 Driver	w32usb2.exe	"Added by the SPYBOT.DN WORM!"
X	Win32 USB2.0 Driver	service.exe	"Added by the SDBOT-QF WORM!"
X	Win32 USB3 Driver	win32tool.exe	"Added by a variant of the RBOT WORM!"
X	Win32 Wmls Driver	winitr32.exe	"Added by the WOOTBOT.B WORM!"
X	Win32 Word Services	msword32.exe	"Added by a variant of the RBOT WORM!"
X	win32.exe	win32.exe	"Added by the STARTPAGE TROJAN!"
X	Win32.exe	Win32.exe	"Added by the AWQ.A TROJAN!"
X	Win32.Exploit.mzH	mzrun.exe	"Added by the PAINTER TROJAN!"
X	Win32.Trojan.Downloader	netstat2.exe	"Added by the PAINTER TROJAN!"
X	win3208022-1336687	win3208022-1336687.exe	"Added by the VB-CFG TROJAN!"
X	Win32BaseServiceMOD	Wintask.exe	"Added by the NAVIDAD WORM!"
X	win32beta	win32sys4.exe	"Added by the BANKER-DA TROJAN!"
X	win32clf	win32clf.exe	"Added by an unidentified VIRUS
X	win32debug	win32debug.exe	"Added by the GUDEB WORM!"
X	Win32DLL	Win32DLL.vbs	"Added by the LOVELETTER (I LOVE YOU) VIRUS!"
X	Win32dll	Win32dll.exe	"Added by the BANPAES TROJAN!"
X	WIN32DS	clienttimer.exe	"Eziin adware"
X	Win32G	Kernel32.com	"Added by the ESTRELLA TROJAN!"
X	Win32G	Scandisk.com	"Added by the ESTRELLA TROJAN!"
X	win32gb	win32gb.exe	"Added by the DLUCA-F TROJAN!"
X	Win32Host Process	webemir.exe	"Added by the TURGEN -A TROJAN!"
X	win32info	win32info.exe	Adult content dialler
X	win32ini	systroy.exe	"Added by the IRC.ALADINZ.C TROJAN!"
X	WIN32io	clienttimer.exe	"Eziin adware"
X	win32Kernel	findx.exe	"Added by the BANLOA-EY TROJAN!"
X	Win32KernelStart	microsoft.exe	"Added by the DELF-EWZ TROJAN!"
X	Win32R	Server.com	"Added by the ESTRELLA TROJAN!"
X	WIn32S Java DLL	kavsvx.exe	"Added by the AGOBOT-RZ WORM!"
X	win32serv	devicer.exe	"Added by the CHECKOUT WORM!"
X	win32serv	servicesetup.exe	"Added by a variant of the PUSHBOT WORM! A family of worms that spread using MSN Messenger"
X	win32serv	systemdevices.exe	"Added by a variant of the PUSHBOT WORM! A family of worms that spread using MSN Messenger"
X	win32servv	load.exe	"iSearch adware"
X	win32servv	ms1.exe	"iSearch adware"
Y	WIN32SL	Win32sl.exe	"Part of Dell OpenManage Client Instrumentation - software that allows remote management application programs to access information about
X	WIN32SNDS	banc.exe	Added by an unidentified WORM or TROJAN!
X	Win32system	[random filename]	"Added by the DDV.B WORM!"
X	Win32System	win32s.exe	"Added by the MYDOOM.V WORM!"
X	Win32SystemMonitor	***.exe [* = random char]	Browser hijacker
X	Win32SysV	xin.exe	"Added by the FORBOT-EO WORM!"
X	win32update	win32update.exe	"Added by the GENOME.AQUV TROJAN!"
X	Win32Updater	KERNAL32.EXE	"Added by the SPYBOT-OK WORM!"
X	win32us	win32us.exe	All-In-One-Telcom (adult content dialler) variant
X	win32usbd	ssrs.exe	"Added by the RBOT-RA WORM!"
X	Win32Usr	WinCab.exe	"Added by the DEDMIR-A WORM!"
X	WIN32WN	system_wc.exe	"Eziin adware"
X	win32_i lptt01	win32_i.exe	"RapidBlaster variant (in a ""win32_i"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	win32_i ml097e	win32_i.exe	"RapidBlaster variant (in a ""win32_i"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Win386	Win386.exe	"Added by the GOSUSUB VIRUS!"
X	Win386	sp32.dll	Homepage hijacker. Not a dll but a regfile in disguise
X	WIN3S2SNDS	winabsmod.exe	"Added by the AGENT.DN TROJAN - known to BOClean as ""CWS/INDEX""
X	WIN3S2SNDS	winiprtx.exe	"Added by the AGENT.DN TROJAN - known to BOClean as ""CWS/INDEX""
X	Win64 Compatibility Check	load win64.drv	"CoolWebSearch parasite variant"
X	WIN95DEFVIEW	[path to file]	"Added by the DEDLER-D TROJAN! The most common filenames seen are ""csmss.exe"" and ""csmrs.exe""
X	win98 DNS	wingrd.exe	"Added by a variant of the RBOT WORM!"
X	winabc	"rundll32.exe [Temp][ORIGFILENAME].DLL	InstallLaunchEv"
X	WinAble	winable.exe	"Added by the MATCASH.BG TROJAN!"
X	WinAC v4	klsuicbn.exe	"Added by the FORBOT-CS WORM!"
U	Winacsr	Winacsr.exe	"AceScreenSpy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	winactive	WINACTIVE.EXE	"WinActive variant of the LOP.com hijacker"
X	WinActiveJ	WinActiveJ.exe	Added by the ROTARRAN VIRUS!
X	Winad Client	Winad.exe	WinAd adware by eXact Advertising
X	WinAdCnt.exe	WinAdCnt.exe	"Added by the BANKER-BU TROJAN!"
X	winadm	winadm.exe	"Browser hijacker - redirecting to Search-World.net. Related to the SMALL.AEX TROJAN!"
?	WinAgent	WinAgent.exe	"Standard Life Insurance program. Is it required at startup?"
X	Winahlp.exe	Winahlp.exe	"Added by a variant of the VAGRNOCKER TROJAN!"
X	winallap	winallap.exe	"Added by the DELF.E TROJAN!"
X	winallapu	winallapu.exe	"Added by the DELF.E TROJAN!"
X	Winammp	mccm.exe	"Added by the IRCBOT-HH BACKDOOR!"
X	Winamp	winamp.hta	Hijacker - re-directing to adult content sites. Note - this isn't the real Winamp
X	Winamp	winamp.exe	"Added by the AGOBOT.XI WORM! Note - this is NOT the popular Winamp media player"
X	WinAMP	winamp62.exe	"Added by the SDBOT-WN WORM!"
N	Winamp	winamp.exe	"Winamp media player. Resides in a ""Winamp"" subdirectory of the Program Files directory"
X	Winamp Agent	winamp.exe	"Added by a variant of the RBOT WORM! Note - this is NOT the popular Winamp media player. The valid filename for the Winamp Agent is ""winampa.exe"" - see here"
X	Winamp Agent	cvscc.exe	"Added by the AGOBOT-GK WORM!"
X	Winamp Media	qmedia.exe	"Added by the DIAZMON-A TROJAN!"
X	Winamp media player	winapa.exe	"Added by an unidentified VIRUS
X	Winamp Media Player	winamap.exe	"Added by the SDBOT.ACJM BACKDOOR!"
X	Winamp Media Player	winamp.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is NOT the popular Winamp media player which resides in a ""Winamp"" subdirectory of %ProgramFiles%"
X	WinAmp Player	winampp.exe	"Added by the RBOT-AQI WORM! Note - this is NOT the popular Winamp media player which has a different filename"
X	Winamp Player 6	Winamp6.exe	"Added by a variant of the SPYBOT WORM!"
U	Winamp to Google Talk	winamptogoogletalk.exe	"Winamp to Google Talk
X	Winamp Update	yhn.exe	"Added by the SDBOT-ACR WORM!"
U	Winampa	WINAMPa.exe	"Loads the System Tray icon for the popular Winamp media player - see here. Can be used to mantain file associations so programs like QuickTime and RealPlayer don't take over as default player for various media types. Available via Start -> Programs. Resides in a ""Winamp"" subdirectory of the Program Files directory"
X	Winampa	winampa.exe	"Added by the AGOBOT-GS TROJAN! Note - this is NOT associated with the popular Winamp media player. The valid file for the Winamp Agent resides in a ""Winamp"" subdirectory of %ProgramFiles% whereas this file is located in %System%"
X	Winampa Agent	WINAMPA.EXE	"Added by the SPYBOT-BR WORM! Note - this is NOT the popular Winamp media player which is normally located in %ProgramFiles%\Winamp. This one is found in %System%"
U	WinampAgent	WINAMPa.exe	"Loads the System Tray icon for the popular Winamp media player - see here. Can be used to mantain file associations so programs like QuickTime and RealPlayer don't take over as default player for various media types. Available via Start -> Programs. Resides in a ""Winamp"" subdirectory of the Program Files directory"
X	WinAmpAgent	Msexploren.exe	"Added by the BDOOR-EB BACKDOOR! Note - this is NOT the popular Winamp media player which has a different filename"
X	WinAmpAgent	Shch.exe	"Added by the BDOOR-EB BACKDOOR! Note - this is NOT the popular Winamp media player which has a different filename"
X	WinAmpAgent	svchst.exe	"Added by the BDOOR-EB BACKDOOR! Note - this is NOT the popular Winamp media player which has a different filename"
X	WinAmpAgent	Winagent.exe	"Added by the BDOOR-EB BACKDOOR! Note - this is NOT the popular Winamp media player which has a different filename"
X	WinAmpAgent	msnexploren.exe	"Added by the TACTSLAY.B TROJAN!"
X	WinAmpAgent	sdhch.exe	"Added by the TACTSLAY.B TROJAN!"
X	WinAnonymous	GDC.exe	"WinAnonymous rogue privacy tool - not recommended
X	WinAntiSpyware 2005	was5.exe	"WinAntiSpyware 2005 rogue spyware remover - not recommended
X	WinAntiSpyware 2006	was6.exe	"WinAntiSpyware 2006 rogue spyware remover - not recommended
X	WinAntiSpyware 2006 Free	was6.exe	"WinAntiSpyware 2006 rogue spyware remover - not recommended
X	WinAntiSpyware 2006 Scanner	was6.exe	"WinAntiSpyware 2006 rogue spyware remover - not recommended
X	WinAntiSpyware 2007	was7.exe	"WinAntiSpyware 2007 rogue spyware remover - not recommended"
X	WinAntiSpyware 2007 Free	was7.exe	"WinAntiSpyware 2007 rogue spyware remover - not recommended"
X	WinAntispyware2008	WinAntispyware2008.exe	"WinAntiSpyware 2008 rogue spyware remover - not recommended
X	WinAntivirus	AVSVC.EXE	"Part of the WinAntiVirus Pro 2005 rogue security software when installed in Win98/Me - not recommended
X	WinAntiVirus Pro 2007	WinAv.exe	"WinAntiVirus Pro 2007 rogue security software - not recommended
X	WinAntiVirusPro2006	WinAV.exe	"WinAntiVirus Pro 2006 rogue security software - not recommended
X	WinApi	winapix.exe	Added by a variant of the TIBSER.A downloader TROJAN!
X	WINAPLOGUPD	WINAPLOGUPD.EXE	"Added by the CAPSIDE-C WORM!"
X	Winapp	winpup32.exe	Produces popup ads to adult content sites
X	WinApp32	msapp.exe	"Added by the RSBOT TROJAN!"
U	WinAppLog	svchost.exe	"StingKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	WinAuth	winlogon.exe	"Added by the STRTPAGE.BE TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	WinAvX	WinAvX.exe	"Added by the VIRANTIX TROJAN!"
X	WinAvX	WinAvXX.exe	"Malware installed by different rogue security software including SpyKillerPro. Also detected as the SPYWAD-AR TROJAN!"
X	WinAwk	WinAwk.exe	"Added by the SDBOT-AYF WORM!"
U	WinBackup Scheduler	Wbsched.exe	"LIUtilities WinBackup scheduler - backup software"
U	WinBar	WinBar.exe	""WinBar is a free and compact program that lets you monitor your system and provides easy access to frequently used controls""
X	winbar.pif	packe.pif	"Added by the RBOT-AVI WORM!"
X	Winbed	winbed.exe	Hijacker
X	Winbin	swchost.exe	"Added by the RBOT.CLS WORM!"
X	winbin32	win32exe.exe	"Added by the RBOT-ZL WORM!"
X	WinBlueSoft	WinBlueSoft.exe	"WinBlueSoft rogue spyware remover - not recommended
X	winbo32	winbo32.exe	"Added by the RBOT-GRU WORM!"
X	winboot	winboot.exe	"Added by the BANLOAD-W TROJAN!"
X	winbot	winbot.exe	"Added by the MIDRUG-A TROJAN!"
U	WinBrush	winbrush.exe	"WinBrush - ""handy tool that keep your privacy and make your system clean. It works by cleaning up your tracks (document histories
X	WinButler	WinButler.exe	Identified as a variant of the Trojan-Dropper.Agent.DKN malware
X	wincfg	syscnfg.exe	"Added by an unidentified VIRUS
X	WinCheck	services.exe	"Added by the SOBER.V WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\ConnectionStatus\Microsoft and note the space at the beginning of the ""Startup Item"" field"
X	WinCheck	WinCheck.exe	"Added by the PWS-CY TROJAN!"
X	WinCheck	services.exe	"Added by the SOBER.S WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\ConnectionStatus\Microsoft"
X	WinCheck	check.exe	"Added by the DELBOT-Y WORM!"
U	winchk	winchk.exe	"RemoteSpy surveillance software. Uninstall this software unless you put it there yourself"
X	winchost	winchost.exe	"Added by the DLOADER-PO TROJAN!"
N	WINCINEMAMGR	WINCIN~1.EXE	"WinCinema_Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	WinCinemaMgr	WinCinemaMgr.exe	"WinCinema_Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
U	WINCINEMAMGR	WinRemote.exe	"InterVideo WinCinema Manager - needed for the use of WinDVD Remote Control"
X	winclean	winclean.exe	"Added by the AGENT.GXR TROJAN!"
X	wincls	"rundll32.exe wincls.dll	start"
X	wincmap	wincmapp.exe	"CasClient adware variant - also detected as the CMAPP TROJAN!"
U	WinColorReminder	WinColorReminder.exe	"The Microsoft Color Control Panel Applet for Windows XP ""helps you manage Windows color settings in one place."" Part of the Pro Imaging Powertoys"
X	wincom	vbrun6win.exe	"Added by the AGOBOT-AFK WORM!"
X	WinConfig9324	wincfgkop9.exe	"Added by the RBOT.BVD WORM!"
X	winconn	vbrun6nt.exe	"Added by the AGOBOT-AEI BACKDOOR!"
X	WinCore32.exe	WinCore32.exe	"Added by the CLICKER-EN TROJAN!"
X	wincrt.exe	[path to worm]	"Added by the STRATIO-HA WORM!"
X	WinCRT32	wincrt32.exe	"Added by the DOGBOT-D WORM!"
X	WinCSRSS	MSGRT32.EXE	"Added by the REWINDO-A TROJAN!"
X	winctl	winctl.exe	"Added by the IRCBOT-YI TROJAN!"
X	WINCX	wincore332.exe	"Added by the AGOBOT-MG WORM!"
X	Wind Logd File	servicelogd.exe	"Added by a variant of the RBOT WORM!"
X	Wind Optimizer	WindOptimizer.exe	"Wind Optimizer rogue system optimization tool - not recommended
X	Wind River Systems	vxworks.exe	"Added by the ACKANTTA WORM! Note that this is not related to the VxWorks platform from Wind River"
X	Wind Security	mswi32.pif	"Added by the RBOT-ARH WORM!"
X	wind.exe	wind.exe	"Added by the MITGLIEDER.BD TROJAN!"
X	WIND0WS	WIND0WS.exe	"Added by the SPYBOT.DQ WORM!"
X	WIND0WS	mella.bat	"Added by the ALLEM WORM!"
X	Wind0ws	wordpad.exe	"Added by the AGOBOT-TL WORM! Note - this is not the legitimate Windows application wordpad.exe (which is found in the %ProgramFiles%\Accessories folder) which should not normally be seen in Msconfig or as a Startup item. This one is Located in %System%"
X	Wind0ws Ser7ice Agent	colwindos.exe	"Added by the RBOT-GQO TROJAN!"
X	Wind0ws Sharing	ssprotecter.exe	"Added by the RBOT-AHW WORM!"
X	Wind32	Wind32.exe	Identified as a variant of the Backdoor.Win32.Poison.avs malware
X	WinData	services.exe	"Added by the SOBER-AD WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\PoolData and note the space at the beginning of the ""Startup Item"" field"
N	WinDates	windates.exe	"WinDates is a calendar
X	windbs	winxtc.exe	"Added by the AGOBOT-WD WORM!"
X	Winde	winde.exe	"Added by the DLUCA TROJAN!"
X	windef	Win32sp.vbs	"Added by the ANPES WORM!"
X	windef	windef.exe	"Added by the WURMARK-O WORM!"
X	windefender	windefender.exe	"Added by the AGENT.BYH TROJAN!"
X	WinDefender 2008	WDefDemo.exe	"WinDefender 2008 rogue privacy program - not recommended
X	WinDefender2009	windef.exe	"WinDefender 2009 rogue security software - not recommended
X	Windeows NetStart Service2	tesakrmger.exe	"Added by the RBOT-AMY WORM!"
X	WinDevils	WinDevils.exe	"Added by the BRONTOK-BS WORM!"
X	windhost.exe	osrwin32.exe	"Added by the BANKER-CB TROJAN!"
X	windhost.exe	windhost.exe	"Added by the BANKER-BV TROJAN!"
X	windhost.exe	winos.exe	"Added by the PWSAGENT-A WORM!"
X	windir	winrun.exe	"Added by the WINBUR.B WORM!"
X	Windir Working	wuaumqr1.exe	"Added by a variant of the IRCBOT TROJAN!"
X	WinDirectories	tdirs.exe	"Added by the VB-EPB VIRUS!"
X	Windll	Windll.exe	"Added by the TRYNOMA TROJAN!"
U	WINDLL	WSYS.EXE	"STARR key logger. "It logs almost everything that goes through the box. It logs all key strokes
X	windll	windll32.exe	"Added by the ASTEF or RESPAN WORMS!"
X	windll	windotnetsrv.exe	"Added by the AUTORUN-ANO WORM!"
X	WinDLL (algs.exe)	"rundll32.exe algs.exe	start"
X	WinDLL (aqls32.exe)	aqls32.exe	"Added by a variant of the IRCBOT BACKDOOR! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""aqls32.exe"" file is found in %System%"
X	WinDLL (asdfsa.exe)	"rundll32.exe asdfsa.exe	start"
X	WinDLL (bee.dll)	"rundll32.exe bee.dll	start"
X	WinDLL (bix.exe)	"rundll32.exe bix.exe	start"
X	WinDLL (csmss.exe)	"rundll32.exe CSMSS.EXE	start"
X	WinDLL (ctfmonm.exe)	"rundll32.exe ctfmonm.exe	start"
X	WinDLL (dasda.com)	"rundll32.exe dasda.com	start"
X	WinDLL (diem.exe)	"rundll32.exe diem.exe	start"
X	WinDLL (dlfksdld.exe)	"rundll32.exe dlfksdld.exe	start"
X	WinDLL (jbi32.dll)	"rundll32.exe jbi32.dll	start"
X	WinDLL (lcass.exe)	"rundll32.exe lcass.exe	start"
X	WinDLL (mysnlive.exe)	"rundll32.exe mysnlive.exe	start"
X	WinDLL (ProsFix.exe)	ProsFix.exe	"Added by a variant of the IRCBOT BACKDOOR! The ""ProsFix.exe"" file is found in %System%"
X	WinDLL (qwex.dll)	"rundll32.exe qwex.dll	start"
X	WinDLL (redyLive.exe)	"rundll32.exe redyLive.exe	start"
X	WinDLL (scvhost32.dll)	"rundll32.exe scvhost32.dll	start"
X	WinDLL (service.exe)	service.exe	"Added by the AGENT.BX WORM! The ""service.exe"" file is found in %System%"
X	WinDLL (slmss.exe)	"rundll32.exe slmss.exe	start"
X	WinDLL (slsass.exe)	"rundll32.exe slsass.exe	start"
X	WinDLL (smaprnter.exe)	"rundll32.exe smaprnter.exe	start"
X	WinDLL (smms.exe)	"rundll32.exe smms.exe	start"
X	WinDll (sslms.exe)	"rundll32.exe sslms.exe	start"
X	WinDLL (start0s.exe)	"rundll32.exe start0s.exe	start"
X	WinDLL (steam.dll)	"rundll32.exe steam.dll	start"
X	WinDLL (svc.exe)	"rundll32.exe svc.exe	start"
X	WinDLL (svchost.dll)	"rundll32.exe svchost.dll	start"
X	WinDLL (sysx32.dll)	"rundll32.exe sysx32.dll	start"
X	WinDLL (tepmlayer.exe)	"rundll32.exe tepmlayer.exe	start"
X	WinDLL (tmp.exe)	"rundll32.exe tmp.exe	start"
X	WinDLL (tock24.dll)	"rundll32.exe tock24.dll	start"
X	WinDLL (tqurity.exe)	"rundll32.exe tqurity.exe	start"
X	WinDLL (v4mon.dll)	"rundll32.exe v4mon.dll	start"
X	WinDLL (vdm32.dll)	"rundll32.exe vdm32.dll	start"
X	WinDLL (vxd32.dll)	"rundll32.exe vxd32.dll	start"
X	WinDLL (wchshield.exe)	"rundll32.exe wchshield.exe	start"
X	WinDLL (wimimi.exe)	"rundll32.exe wimimi.exe	start"
X	WinDLL (windns32.dll)	"rundll32.exe windns32.dll	start"
X	WinDLL (wingatey32.exe)	"rundll32.exe wingatey32.exe	start"
X	WinDLL (wintmp.exe)	"rundll32.exe wintmp.exe	start"
X	WinDLL (Wseclayer.exe)	"rundll32.exe Wseclayer.exe	start"
X	WinDLL (wsync32.dll)	"rundll32.exe wsync32.dll	start"
X	WinDLL (xvd32.dll)	"rundll32.exe xvd32.dll	start"
X	Windll.exe	Windll.exe	"Added by the STEALER TROJAN!"
X	Windll32	Windll32.exe	"Added by the MSNPWS TROJAN!"
X	WinDll32	_WIN32.EXE	"Added by the LEGMIR.AQ TROJAN!"
X	windllsys32.exe	windllsys32.exe	"Added by a variant of the MITGLIE-A TROJAN!"
X	WinDNS	windns32.exe	"Added by the GAOBOT.WX WORM!"
X	Windo Servic Agen	alirexe.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windo Servic Agent 32	xagw.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windoes Kernel	kernel32.exe	"Added by the KICKIN.A (or CYDOG.C) WORM!"
X	WindoFix	WindoFix.exe	"WindoFix rogue system error utility"
X	Windos Seres Agnts	[worm filename].exe	"Added by the RBOT-GUN WORM!"
X	Windosupdate manager	runwin32.exe	"Added by the SDBOT.NNS BACKDOOR!"
X	Window	explore.exe	"Added by the GAOBOT.ADW WORM!"
X	Window Loader	Dos32.exe	"Added by the GAOBOT.AO WORM!"
X	Window Monitor	winmon32.exe	"Added by the SDBOT.RT WORM!"
X	Window Msn Live Messanger	msnmsgsls.exe	"Added by the RBOT.BJD BACKDOOR!"
X	Window service	[random filename]	"Added by the RBOT-ACH WORM!"
X	Window UDP Control Servic	winlogon.exe	"Added by the RBOT-GXN WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Window upadate	pe2.exe	"Added by a variant of the RBOT WORM!"
U	Window Washer	wwDisp.exe	"Window Washer from Webroot Software. Useful utility that deletes safe to remove files
X	window.exe	window.exe	"Added by the MITGLIEDER.H or MITGLIEDER.J TROJANS!"
X	window2	ssvchost.exe	"Added by the IRCBOT.H TROJAN!"
X	window2	ieupdate.exe	"Added by the FORBOT-BM WORM!"
U	WindowBlinds	wbload.exe	"WindowBlinds from Stardock. Skin application to change the appearence on Windows desktops. Available as an individual download or as part of Object Desktop. Required to restore settings if you use it. Available via right-click on the Desktop -> Properties -> Skins"
X	WindowEnhancer	Winex.exe	"SCBar foistware variant"
X	Windowfdgfds DasdLL Verifier	winupdatr.exe	"Added by the AGOBOT.HZ WORM!"
X	Windowfdgfds DasdLL Verifiew	[path to worm]	"Added by the RBOT-GGX WORM!"
X	Windowfdgfds DLL fgfdg Verifier	Windowsdldfglcheckkk.exe	"Added by the RBOT.CSP WORM!"
X	Windowfdgfds DLL fgfdg Verifier	winsecure.exe	"Added by a variant of the RBOT WORM!"
U	WindowFX	wfxload.exe	"Stardock WindowFX - ""Allows you to add an unprecedented number of special effects to windows"""
X	windown	wiusyt.exe	"Added by the QQPASS-M TROJAN!"
X	WindowRegKey update	wins.exe	"Added by the SPYBOT.I WORM!"
X	Windows	services.exe	"Added by the SOBER.X WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\WinSecurity and note the space at the beginning of the ""Startup Item"" field"
X	Windows	Kernel32.exe	"Added by the TENDOOLF.A WORM!"
X	Windows	msdos98.exe	Added by the PWSTEAL TROJAN!
X	Windows	Windows.exe	"Added by the KAZMOR.A
X	Windows	explorer.exe	"Added by the POEBOT-J WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	windows	[path to trojan]	"Added by the AIMWIN TROJAN!"
X	windows	hkey.exe	"Added by the GAOBOT.AFW WORM!"
X	windows	system copy.exe	"Added by the SALGA.A WORM!"
X	Windows	gearsec.exe	"Added by the STUBBOT-B WORM!"
X	Windows	run.exe	"Added by the SPYBOT.OFN WORM!"
X	Windows	system.exe	"Added by the SPYBOT.OBB WORM!"
X	WINDOWS	windows.exe	"Added by the MONBOT-A TROJAN!"
X	Windows	services.exe	"Added by the SOBER-Z WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\WinSecurity"
X	WINDOWS	jif.exe	"Added by the MYTOB.MK WORM!"
X	windows	iexplore.exe	"Added by the RBOT-UM WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows	services.exe	"Added by the DLOADR-GW TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Windows"" subfolder"
X	Windows	smss.exe	"Added by the BANCBAN-QF TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	windows	svchost.exe	"Added by the SLOMIRC-A WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	WINDOWS	ymssgr.exe	"Added by the BCKDR-PS BACKDOOR! Note - deactivates the Microsoft\Internet Connection Firewall (ICF)"
X	Windows	taskmngr.exe	"Added by a variant of the SDBOT WORM!"
X	Windows	Cfreer.exe	"Added by the CULLER-C WORM!"
X	Windows	Zser.exe	"Added by the CULLER-D WORM!"
X	Windows	spoovlss.exe	"Added by an unidentified WORM or TROJAN! See here"
X	windows	VBSyS.vbs	"Added by the ROCK-D WORM!"
U	Windows	WpcUmi.exe	"Notifications from the Parental Controls feature in Windows Vista. Note - disabling this entry does not disable Parental Controls and prevent it monitoring a users activity. On the controller account it prevents the pop-up on from displaying messages such as ""Reminder: View the Parental Controls activity report"". On the user account it prevents the warning messages appearing such as access has been denied and the Parental Controls icon appearing on the System Tray"
U	Windows & Internet Cleaner Pro	WICleaner.exe	"Windows & Internet Cleaner Pro - ""Powerful and easy to use internet surfing privacy protection & PC security software"""
X	Windows (ICS) Spooler	crtss.exe	"Added by a variant of the RBOT WORM!"
X	Windows (random character)	diskcheck.exe	"Added by the SINGU.B TROJAN!"
X	Windows .Net Manager	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows 128 Module	win128.exe	"Added by the FORBOT-ES WORM!"
X	Windows 2004	csrss.exe	"Added by the BANKER-DY TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Windows 2004\Tools"
X	Windows 32 Editor	Win32edit.exe	"Added by the WOOTBOT.GQ WORM!"
X	Windows 32 Rescue	win32resc.exe	"Added by the FORBOT-EU WORM!"
X	Windows 32 Update	Windows-Update.exe	"Added by a variant of the RBOT WORM!"
X	Windows 32-bit DLL Integrity Verifier	dllrun.exe	"Added by Remote Storm - a remote control tool that is a network application that allows users to manage and control PCs or networks from a remote location"
U	Windows Accelerators	setup.exe	"KeySpy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	Windows Account Alternation	wauclt.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Acer Service	acersv.exe	"Added by the IRCBOT.YFQ BACKDOOR!"
X	Windows Action	csrs.exe	"Added by the SECCMU-A WORM!"
X	Windows Activate System	syssv.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows AdControl	WinAdCtl.exe	Windupdates adware variant
X	Windows Additional Guard	WI[random characters].exe	"Windows Additional Guard rogue security software - not recommended
X	Windows AdService	WinAdServ.exe	Windupdates adware variant
X	Windows AdStatus	WinStat.exe	"Added by the BLESHARE!DR VIRUS!"
X	Windows AdTools	WinAdTools.exe	Windupdates adware variant
X	Windows Anti Verifier	Windows-Anti.exe	"Added by the RBOT.ETT WORM!"
X	Windows Anti Virus Control Center	avrscan.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Anti Virus Control Center	winavscan.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Anti-Virus Built 32	AntiVirus32.exe	"Added by the SDBOT-BG WORM!"
X	Windows APCI Verifier	dhcpserv.exe	"Added by the RBOT-FON WORM! Note - Disables the automatic startup of other software and deactivates the Microsoft Internet Connection Firewall (ICF)"
X	Windows API Control Task	apitsk32.exe	"Added by the MYTOB.HI WORM!"
X	Windows Application Layer	walg32.exe	"Added by the AGOBOT.ATN WORM!"
X	Windows Application Layer Gateway	walg32.exe	"Added by the AGOBOT-AAZ WORM!"
X	Windows applications server	SysShield.exe	"Added by the unregistered version of Personal Anti Malware rogue security software - not recommended
X	Windows ARP Detectionc	nvudlsp.exe	"Added by the AGENT.LMW BACKDOOR!"
X	Windows ARP Detectionc	winlogon.exe	"Added by the RBOT.EAB WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Windows ARP Detectioncx	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Windows ASN Service	rge.exe	"Added by the RBOT-AOK WORM!"
X	Windows ASN Service	[random filename]	"Added by the AGOBOT-TC WORM!"
X	Windows ASN4 Services	gamo.exe	"Added by the RBOT-EHK WORM!"
X	Windows Audio	snd.exe	"Added by the ACKANTTA.C WORM!"
X	Windows Audio Components	nncsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Audio Control	ppnsvc.exe	"Added by the HAM TROJAN!"
X	Windows Audio Layer	narsvc.exe	"Added by the IRCBOT.AFT BACKDOOR!"
X	Windows Audio Panel	nppsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Audio Service	sndmic32.exe	"Added by the ACKANTTA.C WORM!"
X	Windows Audio Services	jvm.exe	"Added by the ACKANTTA.F WORM!"
X	Windows Audio Startup	nndsvc.exe	"Added by the IRCBOT-AAE TROJAN!"
X	Windows Audio System	nndsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Authority Service	lsass.exe	"Added by the KALEL-E WORM! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	windows auto update	msblast.exe	"Added by the BLASTER.B WORM!"
X	windows auto update	penis32.exe	"Added by the BLASTER (or MSBLAST.A) WORM!"
X	Windows Auto Update	winupdater.exe	"Added by the SDBOT.TF WORM!"
X	Windows auto update	bazzi.exe	"Added by the AHKER.E WORM!"
X	Windows auto update	LSASS.exe	"Added by the AHKER.G WORM! Note - this is not the legitimate lsass.exe process
X	Windows Auto Updater	WINDOWSUPDATE.EXE	"Added by the SDBOT.PB WORM! Note the space at the beginning of the filename"
X	Windows Automatic Update	wuamgrder.exe	"Added by a variant of the RBOT WORM!"
X	Windows Automatic Updater	windrg.exe	"Added by a variant of the RBOT WORM!"
X	Windows Automatic Updates	dvldr.exe	"Added by the RBOT.MF WORM!"
X	Windows Automatical Updater	dcz.exe	"Added by the RBOT.CXS WORM!"
X	Windows AutomaticUpdater	runddls.exe	"Added by a variant of the RBOT WORM!"
X	windows automation	mslaugh.exe	"Added by the BLASTER.E WORM!"
X	Windows Automation	msdspr.exe	"Added by the SOLAME.A WORM!"
X	Windows Autostart Loader	notepad32.exe	"Added by a variant of the RBOT WORM!"
X	Windows backup	systemss.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Backup Configuration	IEXPLORER.exe	"Added by the GAOBOT.AZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Windows Baþlangýç Dosyasý	sistem.exe	"Added by the MUZK WORM!"
X	Windows Boot	winboot.exe	"Added by the AGENT.HBD TROJAN!"
X	Windows Boot	windowsboot.exe	"Added by the IRCBOT.AZT BACKDOOR!"
X	Windows Booter	winboot.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Booter!	winbooter.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Bootup	ms-wks32.exe	"Added by the RBOT-AFM WORM!"
X	Windows Bootup	Systemwks32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Bootup	task-mngr.exe	"Added by the RBOT-AWP WORM!"
X	Windows Browser Services	browser128.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Browser Services	browser32.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Browser Services	browser64.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Browser Services	Browsr32.exe	"Added by the IRCBOT.BUR BACKDOOR!"
X	Windows Browser Services	browsr64.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows bypass security SMSS Service	SbiCvy.exe	"Added by the RBOT-GRF WORM!"
X	Windows cfg	ascv.exe	"Added by the AGOBOT-SZ BACKDOOR!"
X	Windows Clean-Up Pro	WINDOWS CLEAN-UP PRO.Exe	"Windows Clean-Up Pro spyware remover - not recommended
X	Windows Cleaner Service	winclean.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Client	client.exe	"Added by the BACKDR-AM BACKDOOR!"
X	Windows Client Service 32	csrss.exe	"Added by the RBOT-ALB WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a drivers\winsdriver subfolder"
X	Windows Client/Server Runtime Server	csrs.exe	"Added by the RBOT.KD WORM!"
X	Windows CODE Fix Msy Startups	msyh32.exe	"Added by the AGOBOT.AKK WORM!"
X	Windows Command	wincmd.exe	"Added by the RBOT.ANV WORM!"
X	Windows Communicator	wincomm.exe	"Added by the AGOBOT-BH WORM!"
X	Windows Communicator for NT/XP	osndyrn.exe	"Added by the SDBOT-CPK WORM! Note - can terminate AV related processes"
X	Windows Compliant	[random filename]	"Added by the RBOT-IR WORM!"
X	Windows Computer Browser	bcwsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Conf	windowsconf.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Config	SSYS.EXE	"Added by the SPYBOT-DA WORM!"
X	Windows Config	wins.exe	"Added by the SPYBOT.JR WORM!"
X	Windows Config	RUNDLL.EXE	"Added by the SPYBOT-DX WORM! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	Windows Config	pvphost.exe	"Added by a variant of the SLAPER TROJAN!"
X	Windows Config	winconfig.exe	"Added by the IRCBOT.BAP BACKDOOR!"
X	Windows Config	ZANBOR.EXE	"Added by the SPYBOT-MH WORM!"
X	Windows Config Connection	msicll.exe	"Added by the RBOT-EXQ WORM!"
X	Windows Config Loader	Wincfg32.exe	"Added by the SILVERFTP TROJAN!"
X	Windows Config Manager	winconf.exe	"Added by the RBOT-AIT WORM!"
X	Windows Config Manager	Wincfgman32.exe	"Added by the AGOBOT-AL BACKDOOR!"
X	Windows Config System	config.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Configuration	wsys32.exe	"Added by the GAOBOT.FB WORM!"
X	Windows Configuration	wincfg32.exe	"Added by the MYTOB.ED WORM!"
X	Windows Configuration	WINHUB.EXE	"Added by the SPYBOT-CG WORM!"
X	Windows Configuration Loader	asclt.exe	"Added by the SDBOT-OA WORM!"
X	Windows Configuration Loader	msgfix.exe	"Added by the SDBOT-NP WORM!"
X	Windows Configuration System	IExplore.exe	"Added by the RBOT-DDG WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows Configuration Utility	winxupdate.exe	"Added by the AGOBOT.LW WORM!"
X	Windows Configurator	winconf.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows connection manager	Internet.exe	"Added by the RBOT-APN WORM! Note - file is found in the Windows or Winnt folder. Make sure you check the link on this one
X	Windows Console	wkssvc.exe	"Added by the SDBOT-DJX WORM!"
X	Windows Console Component	wrasvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Console Monitor	[path to worm]	"Added by the KEDEBE WORM!"
X	Windows Console Monitor	gcasAV32.exe	"Added by the KEDEBE-A WORM!"
X	Windows Console Norms	wnbsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Console Source	wnbsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Control	Control.exe	"Added by the GREK.A TROJAN! If there is another file with the same file name in the Windows folder
X	Windows ControlAd	WinCtlAd.exe	Windupdates adware variant
X	Windows Controls Center	winudmr.exe	"Added by the LAMER.AA BACKDOOR!"
X	Windows Core Kernel Update	win32bootcfg.exe	"Added by the RANCK-EL TROJAN!"
X	Windows CPU host	winbog32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Critical Alert	wincrt.exe	"Added by the ALEDO-A TROJAN!"
X	Windows Custom Services	CSRCS.EXE	"Added by the SPYBOT-EI WORM!"
X	Windows Data Server	autodisc.exe	"Added by the SPYBOT-CB WORM!"
X	Windows Data Server	[random name].exe	"Added by the SPYBOT-DS WORM!"
X	Windows Database	WinDat.exe	Added by an unidentified WORM or TROJAN!
X	Windows Database	wiinsvc.exe	"Added by the AGOBOT-RU WORM!"
X	Windows Dcom2 Fix	mscom32.exe	"Added by the RBOT-QT WORM!"
X	Windows DDE Loader	windde32.exe	"Added by the SDBOT-UZ WORM!"
X	Windows debug logging	winlogg.exe	"Added by the RBOT-OY WORM!"
X	Windows debug logging	winloggs.exe	"Added by the RBOT-QN WORM!"
X	Windows Debugger	windbg.exe	"Added by the FORBOT-BY WORM!"
X	Windows Debugger	msdbg32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Debugger	windbg32.exe	"Added by the ZOTOB.L WORM!"
X	Windows Debugging Tools	updatecfg.exe	"Added by the RBOT-AXU WORM!"
X	Windows Default Configuration	svchost.exe	"Added by the DLOADER-U TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Windows Default Server	wfdmgrsp.exe	"Added by the IRCBOT.BCX BACKDOOR!"
X	Windows Default Server	winampa.exe	"Added by the IRCBOT.AUN WORM! Note - this is NOT associated with the popular Winamp media player. The valid file for the Winamp Agent resides in a ""Winamp"" subdirectory of the Program Files directory"
Y	Windows Defender	MSASCui.exe	"Main user interface for Microsoft's Windows Defender on XP/Vista - which ""helps protect your computer against pop-ups
X	Windows Defender	wdc*.exe	"Added by a variant of the FakeAlert TROJAN! This infection displays fake Windows Defender alerts which link to spyware-kicker.com"
X	Windows Defender Adds	wda*.exe	"Added by a variant of the FakeAlert TROJAN! This infection displays fake Windows Defender alerts which link to spyware-kicker.com"
X	Windows Defender Monitor	wdm*.exe	"Added by a variant of the FakeAlert TROJAN! This infection displays fake Windows Defender alerts which link to spyware-kicker.com"
X	Windows Defender Updater	wdu*.exe	"Added by a variant of the FakeAlert TROJAN! This infection displays fake Windows Defender alerts which link to spyware-kicker.com"
X	WINDOWS DENEME	deneme.exe	"Added by the MYTOB-CR WORM!"
X	Windows Desktop Controler	windesktop.exe	"Added by the SDBOT-XH WORM!"
X	Windows Desktop Daemon	winpadg.exe	"Added by a variant of the SPYBOT WORM!"
N	Windows Desktop Search	WindowsSearch.exe	System Tray access to Windows Desktop Search for XP from Microsoft - which adds additional search options including a search box on the Taskbar. On earlier versions this entry also runs the indexing function at startup which indexes files and e-mails items so you can quickly find words and phrases (replaced by a service in later versions). Disabling this entry does not affect the normal operation and indexing will occur when you next perform a search
X	Windows Dialup Service	dialup.exe	"Added by the AGOBOT.AAH WORM!"
X	Windows Disk Defragmenter	wpabaln32.exe	"Added by the BANCOS-ASJ TROJAN!"
X	Windows Disk Manager	cmnvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Display Coupler	display.exe	"Added by the IRCBOT-YS TROJAN!"
X	Windows DLL host	winupd32.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows DLL Host	dllhost32.exe	Added by an unidentified WORM or TROJAN!
X	Windows DLL Loader	RUNDLL16.EXE	"Added by the DOMWIS TROJAN!"
X	Windows DLL Loader	defragfat32z.exe	"Added by the LINKBOT.A WORM!"
X	Windows DLL Loader	rundll32.exe	"Added by the WHIPSER-B WORM! Note - this is not the legitimate rundll32.exe process"
X	Windows DLL Loader	defragfat32pi.exe	"Added by the RBOT-QQ WORM!"
X	Windows DLL Loader	defragfat39.exe	"Added by the POEBOT-C WORM!"
X	Windows DLL Loader	defragfatz.exe	"Added by the LINKBOT.H WORM!"
X	Windows DLL Loader	defragfat32.exe	"Added by the SDBOT-SS WORM!"
X	Windows DLL Loader	defragfat32abc.exe	"Added by the RBOT-RG WORM!"
X	Windows DLL Loader	wdevice.exe	"Added by a variant of the SDBOT WORM!"
X	Windows DLL Loader	SYSCFG16.EXE	"Added by the DOMWIS-N WORM!"
X	Windows DLL Loader	WINCFG32.EXE	"Added by the AGOBOT-TE WORM!"
X	Windows DLL Loader	defragfatx.exe	"Added by the POEBOT-F WORM!"
X	Windows DLL Services	winsvc32.exe	"Added by the RBOT-ZF WORM!"
X	Windows DLL Services	svchost.exe	"AGENT.H spyware. Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Windows DLL Services	system.exe	"AGENT.H spyware"
X	Windows DLL Tracker	spoolsrv.exe	"Added by a variant of the WOOTBOT WORM!"
X	Windows DLL Verifier	xptl.exe	"Added by a variant of the RBOT WORM!"
X	Windows DLL Verifier	windlls.exe	"Added by the RBOT-AZQ WORM!"
X	Windows DNS	windns.exe	"Added by the SDBOT-XU WORM!"
X	Windows DNS Daemon	windnsd.exe	"Added by the WOOTBOT.AS WORM!"
X	Windows Domain Name Drivers	windns.exe	"Added by the FORBOT-EP WORM!"
X	Windows DOS	dosw.exe	"Added by the SALAY-A WORM!"
X	Windows DotFix live	msdotfix.exe	"Added by the IRCBOT.XGK BACKDOOR!"
X	Windows Download Manager	windlmngr.exe	Added by an unidentified TROJAN!
X	Windows Drive Compatibility	System32Driver32.exe	"Added by the SUPOVA.Z WORM!"
X	Windows Driver	winxpdriver.exe	"Added by the WOOTBOT.EE WORM!"
X	Windows Driver	windrive.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Driver Adapter	svchost.exe	"Added by the ANTINNY-K WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	Windows Driver Foundation	MTVSCMXT.EXE	"Added by a variant of the RBOT WORM!"
X	Windows Driver Services	msdrvs32.exe	"Added by the WOOTBOT.L WORM!"
X	Windows Driver Sup	windvrhost.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows driver update	dmsvc32.exe	"Added by the SDBOT-GP BACKDOOR!"
X	Windows driver update	Ipconfig32.exe	"Added by the SDBOT-JV WORM!"
X	Windows Driver!	windriver.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Drivers	ssms.exe	"Added by the RBOT-AT WORM!"
X	Windows drivers update	windowsupdate.exe	"Added by the RBOT-ACE WORM!"
X	Windows Dynamic Library Cache	dllcache.exe	"Added by the INJECT-HT TROJAN!"
X	Windows Dynamic Loading Header	winDLL32.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Email Server	wmserv.exe	"Added by the FOUNDU-AWORM!"
X	Windows Enterprise Defender	WindowsEDefender.exe	"Windows Enterprise Defender rogue security software - not recommended
X	Windows Enterprise Suite	WE[random characters].exe	"Windows Enterprise Suite rogue security software - not recommended
X	Windows Essensials	mvnesc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Event Detection	wecsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Event Provider	wposvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Event Section	sntsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Event Service	winserv.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Executable	winmys.exe	"Added by the RBOT-ABO WORM!"
X	Windows Executer	bling.exe	"Added by the SDBOT-DFT WORM!"
X	Windows Executer	svchostie.exe	"Added by the EGGDROP.V BACKDOOR!"
X	Windows ExpIorer	[random filename]	"Added by the RBOT-AKO WORM!"
X	Windows Explorer	[filename].exe	"Added by the SDBOT TROJAN!"
X	Windows Explorer	Lsas.exe	"Added by the GAOBOT.AO WORM!"
X	Windows Explorer	olecom32.exe	Added by an unidentified WORM or TROJAN!
X	Windows Explorer	EEXPLORER.EXE	"Added by a variant of the SPYBOT WORM!"
X	Windows Explorer	explorer.exe	"Added by the POEBOT-J WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Windows Explorer	explorer.pif	"Added by the RBOT-AID WORM!"
X	Windows Explorer	system32.exe	"Added by the RBOT-AJH WORM!"
X	Windows Explorer	explorer32.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Explorer	Windows Explorer.EXE	"Added by the VB-EBA WORM!"
X	Windows Explorer	system.exe	"Added by the STIRAUT WORM!"
X	Windows Explorer Key	explorer.exe	"Added by the IRCBOT-YB WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Windows Explorer Services	exploresys.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Explorer Shell	Winexec32.exe	"Added by the REDIST.B WORM!"
X	Windows Explorer SP2	csrss.exe	"Added by the BANKER-DM TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""JavaBeans"" subfolder"
X	Windows Explorer Update Build 1142	EXPLORER32.EXE	"Added by the KaZaA based KWBOT or KWBOT.Y WORMS!"
X	Windows Explorer-3212	WINRE16.EXE	"Added by the HARDOC WORM!"
X	Windows Explorer.exe	Explorer.exe	"Added by the FALTER-A TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Windows Express	pci32b.exe	"Added by the BUZUS.C TROJAN!"
X	Windows Extensions for Win32	winprgs32.exe	"Added by the SDBOT.AFA WORM!"
N	Windows Eyes	??	"For blind people
X	Windows FAT 32	WINFAT32B.exe	"Added by the SPYBOT-AGT WORM!"
X	Windows File Migration Wizard	HIMENSYST.EXE	"Added by the RBOT-EMO WORM!"
X	Windows File Protection	winprotect.exe	"Added by the AGOBOT.JB WORM!"
X	Windows File System Frame	ntframe.exe	Added by an unidentified WORM or TROJAN!
X	Windows File Verification Service	wfvs.exe	Added by the RANKY.AC TROJAN!
X	Windows File XP Manager	wfdmgr.exe	"Added by the SDBOT.XD TROJAN!"
X	Windows FileSharing Service	mcwsvc.exe	"Added by the IRCBOT.AJF BACKDOOR!"
X	Windows Firevall Control C	rundll.exe	"Added by the GAERTOB.A TROJAN!"
X	Windows Firewal	Lsess.exe	"Added by a variant of the RBOT WORM!"
X	Windows Firewall	WindowsFirewall.exe	"Added by the MYTOB.AO WORM!"
X	Windows Firewall	svchost.exe	"Added by the PROXY-HT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Firewall	ipservice32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Firewall	rundll32.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Firewall Log	winlog.exe	Added by an unidentified WORM or TROJAN!
X	Windows Firewall Manager	msfw.exe	"Added by the RBOT.WR WORM!"
X	Windows firewall manager	chh.exe	"Added by a variant of the RANDEX.GEL WORM!"
X	Windows firewall manager	msguard.exe	"Added by a variant of the RANDEX.GEL WORM!"
X	Windows Firewall Service	wfsvc.exe	"Added by the IRCBOT-YL WORM!"
X	Windows Firewall Updater	updatees.exe	"Added by the RBOT-GBX WORM!"
X	Windows Firewall Updater	cronos.exe	"Added by the RBOT-GBY WORM!"
X	Windows Firewall Updater	ctfcom.exe	"Added by the RBOT-GCB WORM!"
X	Windows Firewall Updater	windowsupdate.exe	"Added by the SPYBOT.AVEO WORM!"
X	Windows Firewalll	scvhost.exe	"Added by the RBOT-EK WORM!"
X	Windows Firewalll	sphost.exe	"Added by a variant of the RBOT WORM!"
X	Windows Firewalll	svvhost.exe	"Added by a variant of the RBOT WORM!"
X	Windows Firewalll	winmu.exe	"Added by a variant of the RBOT WORM!"
X	Windows Fix	integator.exe	"Added by the SDBOT.ZAB WORM!"
X	Windows Fixer	winfix.exe	"Added by the VIRUT-I VIRUS!"
X	Windows Fixes Systems	elite.exe	"Added by the MYTOB.EG WORM!"
X	Windows FormatAd	WinForm.exe	Windupdates adware variant
X	Windows Frame Works	frmwrks32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Framework	frmwrk.exe	"Added by the DWNLDR-GWV TROJAN!"
X	Windows Framework	scvh0st.exe	"Malware installed by different rogue security software including SpyKillerPro and the XP AntiVirus series"
X	WINDOWS FUCK BY CLASIC	fuck.exe	"Added by the ZOTOB.H or ZOTOB.J WORMS!"
X	Windows Gamma Display	wingamma.exe	"Antivirus 2010 rogue security software - not recommended
X	Windows Generic Proc	procmsg.exe	"Added by the ALLIM.B WORM!"
X	Windows Generic Services	winsvc32.exe	"Added by the AGOBOT-ZF BACKDOOR!"
X	Windows Genuine	svghost.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows Genuine Validate	winservicessss.exe	"Added by the IRCBOT.UUI BACKDOOR!"
X	Windows Global Init	ngpsvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows GMT32	wingmt32.exe	"Added by the MYTOB.KM WORM!"
X	Windows Graphics Loaders	wingraphics.exe	"Added by the SPYBOT.JG WORM!"
X	Windows Guard	WAUMGRD.EXE	"Added by the RBOT-GY WORM!"
X	Windows Guard Pro	WindowsGP.exe	"Windows Guard Pro rogue security software - not recommended
U	Windows Guardian	thehel1iawgrd32.exe	Part of First Aid by Cybermedia who were subsequently bought by McAfee (Network Associates). Protects your Windows system from application failure and crashes
U	Windows Guardian	Fawgrd32.exe	Part of First Aid by Cybermedia who were subsequently bought by McAfee (Network Associates). Protects your Windows system from application failure and crashes
X	Windows haz Layer	[5 random letters].exe	"Added by a variant of the RBOT WORM!"
X	Windows Help	mailinfo.exe	"Added by the MYTOB.JX WORM!"
X	Windows Help	Stney.exe	"Added by the AGOBOT-VI WORM!"
X	Windows Help File	winhelper32.exe	"Added by the SDBOT-QK TROJAN!"
X	Windows Help Manager	svchost32.exe	"Added by the RBOT-OZ WORM!"
X	Windows Help Service	winhelpsv.exe	"Added by the RBOT-LP WORM!"
X	Windows Help Service	winhlp.pif	"Added by the RBOT-AKW WORM!"
?	Windows Help System	Help.pif	"??"
X	Windows Helper	winhelp.exe	"Added by the BANKER.APE TROJAN!"
X	Windows Helper	wsctnfy.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Hijack Protection	comngr.exe	"Added by the AGENT-FYD TROJAN!"
X	Windows Hijack Protection System	commngr.exe	"Added by a variant of the AGENT-FYD TROJAN!"
X	Windows his Layer	pilotGame.exe	"Added by the RBOT.GLX WORM!"
X	Windows Host	hosts.exe	"Added by the KELVIR.U WORM!"
X	Windows Host	winhost.exe	"Added by the PRYSAT TROJAN!"
X	Windows Host Booter	hostbooter.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Windows Host Device	hostsvc.exe	"Added by the ZOOTY-A WORM!"
X	Windows Host Name	lmass.exe	"Added by the GAOBOT.O WORM!"
X	Windows Host Service	scvhosts.exe	"Added by the SPYBOT.NLI WORM!"
X	Windows Host Service	host.exe	"Added by the KELVIR.AN WORM!"
X	Windows Host Service	svchoste.exe	"Added by the KELVIR.BF WORM!"
X	Windows Host Service	svchosts32.exe	"Added by the KELVIR.AW WORM!"
X	Windows Host32 Starter	hostserv.exe	"Added by the SDBOT-WU WORM!"
X	Windows Hosts	hosts.exe	"Added by the KELVIR-O TROJAN!"
X	Windows Hosts	winhosts.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows HP Drivers	hpdmws.exe	"Added by the SDBOT.AQU WORM!"
X	Windows HTML file reader	Sysconf32.exe	"Added by the NOOMY.A WORM!"
X	Windows HTTP services	winhttps.exe	"Added by a variant of the SDBOT WORM! See here"
X	Windows Icons Manager	wicomgr.exe	"Added by the RBOT-AIF WORM!"
X	WINDOWS ID SYSTEM	wID32.exe	"Added by the MYTOB.LN WORM!"
X	Windows Identify	sysays.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows Image	wintimage.exe	"Detected by Avast as the SDBOT-GEN44 WORM!"
X	Windows Image Acquisition (WIASC)	WIAcs.exe	"Added by the RIZO.A TROJAN!"
X	Windows Image Acquisition (WIASSC)	WIAcss.exe	"Added by the RIZO.A TROJAN!"
X	Windows iMessenger Messenger	winimsg.exe	"Added by the ALLIM.A WORM!"
X	Windows Incontext	InSearch.exe	"PacerD_Media/Pacimedia.com/Z-Quest adware installer"
X	Windows Insecure	[path to worm]	"Added by the RBOT-FSM WORM!"
X	Windows installer	winstall.exe	"SpySheriff malware. For more information on registry key changes see SPYWAD-E"
X	Windows Installer	ntdll.exe	Added by an unidentified WORM or TROJAN!
X	Windows Installer 1	msnconfig.exe	"Added by the PURITYSCN.B TROJAN!"
X	Windows Instruction Services	winstruct32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Internet Browser Services	internet.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Internet Browser Services	internet128.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Internet Browser Services	internet32.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Internet Browser Services	internet64.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Internet Explorer 6	firefox.exe	"Added by the SPYBOT.ANA WORM! Note - this is not the Mozilla Firefox web browser which is always located in %ProgramFiles%\Mozilla Firefox. This file is found in %System%"
X	Windows Internet Manager	svchost.exe	"Added by the IRCBOT-AAC TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Internet Protocol	winproc32.exe	"CoolWebSearch Winproc32 parasite variant - also detected as the STARTPA-BF TROJAN!"
X	Windows Internet Protocol	deinst_qfe001.exe	Added by a variant of the Win32.Small TROJAN!
X	Windows Internet Service	wininet.exe	"Added by the RBOT-AUX WORM!"
U	Windows IP Security	ipsec.exe	"Related to the VPN IPSec utility - used to create Security Policy (SP) entries and Security Association (SA) entries in the kernel"
X	Windows IP Security Service	ipsecs.exe	"Added by the RBOT.BPW WORM!"
X	Windows IPv6 Drivers	wipv6.exe	"Added by the SDBOT-VJ WORM!"
X	Windows Java Update	weatherBug32.exe	"Added by a variant of the RBOT WORM!"
X	Windows JavaScript Daemon	Winjsd.exe	"Added by the WOOTBOT.AF WORM!"
X	Windows Kernel 64	kernal64.exe	"Added by the YIMP-B WORM!"
X	Windows Kernel System Service	wkssvr.exe	"Added by a variant of the RANDEX.GEL WORM!"
X	Windows kev Messenger	mskev.exe	"Added by the SDBOT-XV WORM!"
X	Windows Keyboard Services	winkeyboard.exe	"Added by the IRCBOT.AFS WORM!"
X	Windows Keyboard Services	winkeybrd.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Keyboard Services	winkeybrd32.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Live	msgnms.exe	"Added by the XPACK.AV TROJAN!"
X	Windows Live	WindowsLive.exe	"Added by the REALBOT-A WORM!"
X	Windows Live Care.exe	WindowsLiveCare.exe	"Added by unidentfied MALWARE - see here! Do not confuse with Microsoft's Windows Live OneCare security software which is found in %ProgramFiles%\Microsoft Windows OneCare Live. This one is found in %System% and runs from both the HKLM\Run & HKLM\RunServices registry keys"
X	Windows Live Client	msnclient.exe	"Added by a variant of the IRCBOT TROJAN! See here"
U	Windows Live Family Safety Filter	fsui.exe	"System Tray access to and notifications from Windows Live Family Safety - optionally installed as part of Windows Live Essentials. ""With Family Safety
X	Windows Live Manager	winlivemgr.exe	"Added by the SHEUR.EB TROJAN!"
X	Windows Live Messages	msgnlive.exe	"Added by the AGENT.AYH WORM!"
X	Windows Live Messenger	msnmsgr.exe	"Added by a variant of the RBOT WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Windows live Messenger	msn.com	"Added by the IRCBOT-AAV WORM!"
X	Windows Live Messenger	msnlive.exe	"Added by the RBOT.BMV BACKDOOR!"
X	windows Live Messenger	iexplore.exe	"Added by the BCKDR-QTS BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
N	Windows Live Messenger	msnmsgr.exe	"Windows Live Messenger (was MSN Messenger) utility - available via the Start menu. Disable by clicking on the ""Show menu"" icon and select Tools → Options → Sign In → deselect ""Automatically run Windows Live Messenger when I log on to Windows"". This is the Windows Defender/Vista MSConfig entry for version 14.*"
X	Windows Live Messenger	[random].exe	"Added by the RBOT-GVL WORM!"
X	Windows Live Messenger	msnd.exe	"Added by the BCKDR-QQQ BACKDOOR!"
X	Windows Live Messenger 8.12	ctfmon.exe	"Added by the LIPARK-A WORM! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in %UserProfile%"
X	Windows Live Messenger Addon	wllivemsngr.exe	"Added by a variant of the SDBOT WORM! See here"
X	Windows Live Messenger Servicer	msmgslive.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Live Messenger Services	msgrlive.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Live Messenger!	livemsngr.exe	"Added by the IRCBOT.AWE BACKDOOR!"
X	Windows Live Messenger!	msgrlive.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Live Msgs	wlivemsg.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Live Msgs!	wlivemsgs.exe	"Added by a variant of the IRCBOT TROJAN! See here"
Y	Windows Live OneCare	winssnotify.exe	"System Tray access to and notifications from Windows Live OneCare - now superseded by Microsoft Security Essentials. ""OneCare helps keep your PC safe and secure while making your life easier. From virus scanning and file backups
X	Windows Live Service	msnlive.exe	"Added by the SLENFBOT.DI WORM!"
X	Windows Live Servicer	usrserv.exe	"Added by the SMALL.LU BACKDOOR!"
X	Windows live Support	wlmsngr.exe	"Added by the RBOT-BKL WORM!"
U	Windows Live Sync	WindowsLiveSync.exe	"Windows Live Sync from Microsoft (formerly known as Windows Live FolderShare) - ""a free-to-use internet-based file synchronization application by Microsoft that is designed to allow files and folders between two or more computers be in sync with each other on Windows (Vista and later) and Mac OS X based computers"""
U	Windows Live™ OneCare™ Family Safety	fssui.exe	"System Tray access to and notifications from Windows Live OneCare Family Safety - part of the Live OneCare range and now superseded by Windows Live Family Safety which is part of Windows Live Essentials. Allows you to decide how your kids experience the Internet by limiting searches
?	Windows Load	windows.com	"??"
X	Windows Loader	wstart32.exe	"Added by the GAOBOT.CA WORM!"
X	Windows Loader	winServices.pif	"Detected by Kaspersky as the CARDSPY.D TROJAN!"
X	Windows Loader	SysUpdate.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Loader Service	civsc.exe	"Added by a variant of the RBOT WORM!"
X	windows Loadxm	Win_.exe	"Added by the FODDER-A TROJAN!"
X	Windows Local ISP	winthcr.exe	"Added by the SDBOT.ENZ BACKDOOR!"
X	Windows Local Services	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Spooler	lssas.exe	"Added by the RBOT.BXQ WORM!"
X	Windows Locator	wsass.exe	"Added by the IRCBOT.N TROJAN!"
X	Windows Log Agent	winlogon.exe	"Added by the KEYLOGGER.AVK TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files"
X	Windows Logger	winlog.exe	"Added by the NSHADOW-B TROJAN!"
X	Windows logging	winlogd.exe	"Added by the RBOT-ON WORM!"
X	Windows logging	asgasg.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Logical Adapter	wsrsvc.exe	"Added by the IRCBOT.ARU BACKDOOR!"
X	Windows Logical Connection	wcnsvc.exe	"Added by the VIRUT.AO VIRUS!"
X	Windows Login	explored.exe	"Added by the GAOBOT.SY WORM!"
X	Windows Login	winlog.exe	"Added by the AGOBOT.MG WORM!"
X	Windows Login	lmss.exe	"Added by the AGOBOT-JA WORM!"
X	Windows Login	msnmsgr.exe	"Added by the AGOBOT-UC WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Windows Login	login.exe	"Detected by NOD32 as a variant of the BIFROSE TROJAN!"
X	Windows Login	lms.exe	"Added by the AGOBOT-IC WORM!"
X	Windows Login Folder	winzep.exe	"Added by the AGOBOT-TZ WORM!"
X	Windows Login Manager	winlogin.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Login Security	winlogin.pif	Added by an unidentified WORM or TROJAN!
X	Windows Login Service	winlog.exe	"Added by the RBOT-AFN WORM!"
X	Windows Login Service	winlogin.pif	"Added by the SDBOT-ACU WORM!"
X	Windows Logon	winlogin.exe	"Added by the SPYBOT-C TROJAN!"
X	Windows Logon	winlogon.exe	"Added by the VB.HE VIRUS! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\system"
X	Windows Logon Application	WinIogon.exe	"Added by the LINKBOT.M WORM!"
X	Windows Logon Application	logon.exe	"Added by the POEBOT-J WORM!"
X	Windows Logon Application	services.exe	"Added by the CIADOOR-L TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Logon Application	win32help.exe	"Added by the DELBOT-X WORM!"
X	Windows Logon Application	winlogon.exe	"Added by the POEBOT-KW WORM! Note - this is not the legitimate winlogon.exe process
X	Windows Logon Application	winamp.exe	"Added by the POEBOT-LR WORM! Note - this is NOT the popular Winamp media player which resides in a ""Winamp"" subdirectory of the Program Files directory"
X	Windows Logon Applicationedc	winlogon.exe	"Added by the DWNLDR-HGR TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%"
X	Windows Logon Applicatonedc	winlogon.exe	"Added by the VB-EBV TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%"
X	Windows Logon Manager	logon.exe	"Added by a variant of the RBOT WORM!"
X	Windows Logon Procedure	Svchoste.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Logon Procedure	Svchosta.exe	"Added by a variant of the SPYBOT WORM!"
X	windows logon procedure	winlogonpc.exe	"Added by the WINLOGON TROJAN!"
X	Windows Logon Service	winlogon.pif	"Added by the RBOT-AOU WORM!"
X	Windows Logon Service	napi32.exe	"Added by the SPYBOT.ANDM WORM!"
X	Windows Logon Service	winlogoservice.exe	"Added by the SPYBOT.ANOO WORM!"
X	Windows LoL Layer	gqwdcr.exe	"Added by the AGOBOT-AHS WORM!"
X	Windows LoL Layer	win.exe	"Added by the RBOT-FTO WORM!"
X	Windows LoL Layer	[random filename].exe	"Added by the RBOT-GMD WORM!"
X	Windows LoL Layer	pyvnpt.exe	"Added by the RBOT-GKV WORM!"
X	Windows LoL Layer	winlolx.exe	"Added by the RBOT-FOR WORM!"
X	Windows LoL Layer	azypbrx.exe	"Added by the RBOT-GMZ WORM!"
X	Windows LoL Layer	blvpnmcny.exe	"Added by the RBOT-GOR WORM!"
X	Windows Lord Anti-Virus	winlord32.exe	"Added by the SDBOT-GW WORM!"
X	Windows Management Informant	wmmiexe.exe	"Added by the IRCBOT-V BACKDOOR!"
X	Windows Management Instrumentation	mwd.exe	"Added by the GRAPS WORM!"
X	Windows Management Instrumentation	[path to file]	"Added by the QEDS-A WORM!"
X	Windows Management Instrumentations	winmg.exe	"Added by the GAOBOT.GW WORM!"
X	WINDOWS MANAGEMENT SYSTEM	wm1exe.exe	"Added by the RBOT-VT WORM!"
X	Windows Manager	winmants.exe	"Added by the MANTAS WORM!"
X	Windows Manager	winsrv.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Windows Manager	taskmgrs.exe	"Added by the SILLYFDC.BBZ WORM!"
X	Windows Manager Control	WINMUR32.EXE	"Added by the AGOBOT-AR WORM!"
X	Windows Manager Update Inc	tgb.exe	"Added by the SDBOT-ACM WORM!"
X	Windows mangement	winlogonn.exe	"Added by the RANDEX.FC WORM!"
X	Windows Media AP	winmapp.exe	Added by an unidentified WORM or TROJAN!
X	Windows Media APP	wmapp.exe	Added by an unidentified WORM or TROJAN!
N	Windows Media Center	"RunDLL32.exe ehuihlp.dll	BootMediaCenter"
X	Windows Media Center	smss.exe	"Added by the WARBOT TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
N	Windows Media Connect 2	WMCCFG.exe	"Windows Media Connect from Microsoft - stream digital media files on your computer to digital media receivers (DMRs) that are connected to your home network"
X	Windows Media Driver	msnger.exe	"Added by a variant of the RBOT WORM!"
X	Windows Media Loader	wmloader.exe	"Added by a variant of the GAOBOT WORM!"
X	Windows Media Player	wmediaplayer.exe	"Added by the AGOBOT-NQ WORM!"
X	Windows Media Player	MediaPIayer.exe	"Added by the SDBOT-QO TROJAN! Note - the lower case ""l"" in ""MediapIayer"" is a capital ""i"""
X	Windows Media Player	[random filename]	"Added by a variant of the RBOT WORM!"
X	Windows Media Player	msa.exe	"Added by the RBOT-SI WORM!"
X	Windows Media Player	mcafe32.exe	"Added by the RBOT-YO WORM!"
X	Windows Media Player	wmplayer.exe	"Added by the KELVIR.G WORM or variants! Note - this is not the valid Windows Media Player as the file is located in %System% rather than %ProgramFiles%\Windows Media Player"
X	Windows Media Player	50cent.exe	"Added by a variant of the RBOT WORM!"
X	Windows Media Player	mpwe.exe	"Added by the RBOT-TT WORM!"
X	Windows Media Player	msams.exe	"Added by the RBOT.AHR WORM!"
X	Windows Media Player	vmmreg32.exe	"Added by the AGENT.AQO TROJAN!"
X	Windows Media Player	msass43.exe	"Added by the RBOT-RT WORM!"
X	Windows Media Player	mpupdata.exe	"Added by the SDBOT.BBG WORM!"
X	Windows Media Player	wmplayerc.exe	"Added by the SILLYFDC.DBG WORM!"
X	Windows Media Player 3.6	wmpa36.exe	"Added by a variant of the RBOT WORM!"
X	Windows Media Player 3.6b	WMPA36B.EXE	"Added by the RBOT-VV WORM!"
X	Windows Media Player 3.6d	wmpa36d.exe	"Added by the RBOT-YA WORM!"
X	Windows Media Player 3.9	wmpa36.exe	"Added by a variant of the RBOT WORM!"
X	Windows Media Player 6.1.2	wmplayer612.exe	"Added by the RBOT.AIB BACKDOOR!"
X	Windows Media Player Service	wmedia.exe	"Added by the RBOT.213504 WORM!"
X	Windows Media Player Update	[random filename]	"Added by the RBOT-ET WORM!"
N	Windows Media Powerpoint Helper	NSPPTHLP.EXE	German software (comes with some Toshiba CD writers) that helps convert Powerpoint files to ASF (Streaming Media) files. Available via Start -> Programs
X	Windows Media Server	wmserv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Media Server!	wmserver.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows media service	crvss.exe	"Added by the SDBOT.VP WORM!"
X	Windows media service	crsss.exe	"Added by the RBOT.ACY WORM!"
X	Windows media service	Sygate32.exe	"Added by the RBOT.ADE WORM!"
X	Windows media services	cvrsss.exe	"Added by the RBOT-MW WORM!"
X	Windows Media SP.2.37	[random filename]	"Added by the LEMIR.C TROJAN!"
X	Windows Media Updater	crease.exe	"Added by the RBOT-ATI WORM!"
X	Windows Media Upgrade	NeUpgrade.exe	"Added by the RBOT.BMF TROJAN!"
X	Windows Media Utility	wmediautil.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Memory Drivers	memretain.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Memory Manager	windowsmem.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Memory Running Services	memrun.exe	"Added by the IRCBOT.BLL BACKDOOR!"
X	Windows Memory Sharing	memoryshr.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Memory Sharing	memshare.exe	"Added by the IRCBRUTE.AG TROJAN!"
X	Windows Memory Sharing	memshr.exe	"Added by the IRCBOT.MC BACKDOOR!"
X	Windows Messanger Control Center	svchosl.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Messanger Control Center	svhost.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Messanger Control Center	winlogin.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Messanger Control Center	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Messanger Control Center	winsys.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows messenger	messengers.exe	"Added by the MYTOB.EI WORM!"
X	Windows Messenger	msnsmgs.exe	"Added by the RBOT-ANJ WORM!"
X	Windows Messenger	msnmsg.exe	"Added by the SPYBOT.BV WORM!"
X	Windows Messenger 4.14	landisc.exe	"Added by the SDBOT-KR WORM!"
X	Windows Messenger Connect	wmdsvc.exe	"Added by the SLENFBOT.S WORM!"
X	Windows Messenger Fileshare	wivsvc.exe	"Added by the SILLYIM WORM!"
X	Windows Messenger Live MSN	winlivemsnmessenger.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Messenger Live Startup	windowslivemsn.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Windows Messenger Live Startup	windowsmsnlive.exe	"Added by the DELF.DAX TROJAN!"
X	Windows Messenger Messenger	winmsg.exe	"Added by the VELKBOT.A WORM!"
X	Windows Messenger Panel	wbcsvc.exe	"Added by the IRCBOT.ADA BACKDOOR!"
X	Windows Messenger Service	winsmsgr.exe	"Added by the RBOT-VW WORM!"
X	Windows Messenger Service	kaspersky.exe	"Added by the MYTOB.HY WORM!"
X	Windows Messenger Share	wmssvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Messenger Starter	wmvsvc.exe	"Added by the DELF.DAX TROJAN!"
X	Windows MeTaLRoCk service	metalrock.exe	"Added by the TASTYRED TROJAN!"
X	Windows Micro Drivers	wupdates32.exe	"Added by the RBOT-AEH WORM!"
X	Windows Microsoft Service	[random filename]	"Added by the AGENT-HCD TROJAN!"
X	Windows Microsoft Services	[8 random letters].exe	"Added by the KOLAB.AW WORM!"
X	Windows Microsoft Update	wintask32.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Microsoft Verifier	winauth23.exe	"Added by a variant of the RBOT WORM!"
U	Windows Mobile Device Center	wmdc.exe	"Windows Mobile Device Center - mobile device management/synchronization software for Windows7/Vista
U	Windows Mobile-based device management	wmdSync.exe	"Part of Windows Mobile Device Center in Vista. Microsoft Windows Mobile Device Center enables you to set up new partnerships
U	Windows Mobile-based device management	wmdc.exe	"Windows Mobile Device Center - mobile device management/synchronization software for Windows7/Vista
X	Windows mod Verifier	Windows-mod.exe	"Added by the RBOT.DSU WORM!"
X	Windows modez Verifier	w1nz0zz0.exe	"Added by a variant of the SDBOT WORM!"
X	Windows modez Verifier	Window2.exe	"Added by a variant of the RBOT WORM!"
X	Windows modez Verifier	WindowsLogon.exe	"Added by a variant of the SDBOT WORM!"
X	Windows modez Verifier	Wwuamguard.exe	"Added by the RBOT.EZJ WORM!"
X	Windows modez Verifier	winlogom.exe	"Added by a variant of the RBOT WORM!"
X	Windows modez Verifier	Windows-.exe	"Added by the RBOT-DIO WORM!"
X	Windows modez Verifier	taskmngr.exe	"Added by a variant of the RBOT WORM!"
X	Windows modez Verifier	winl0g0z.exe	"Added by the RBOT-FNB WORM!"
X	Windows modez Verifier	wuamguard.exe	"Added by the RBOT.EZJ BACKDOOR!"
X	Windows Monitor	winmon.exe	"Added by the SDBOT.VB WORM!"
X	Windows Monitor	arsetup.exe	Added by the SPAZBOX.A TROJAN!
X	Windows Monitor Services	winmonitor.exe	"Added by the RBOT-XX WORM!"
X	Windows Monitoring Service	winmon.exe	"Added by a variant of the SDBOT WORM!"
X	Windows More Choice	TopContext.exe	"ZQuest adware"
X	Windows Mouse Services	winmouse.exe	"Added by the IRCBOT.AGA BACKDOOR!"
X	Windows Mouse Services	winmouse64.exe	"Added by the IRCBOT.AIA BACKDOOR!"
X	Windows Mouse Utilities	mouseutils.exe	"Added by the RBOT-ABU WORM!"
X	Windows ms Drivers	msnup32.exe	"Added by the SDBOT-AAL WORM!"
X	Windows MS Update 32	fhm.exe	"Added by the IRCBOT.GEN WORM!"
X	Windows MS Update 32	sucker.exe	"Added by the FORBOT-GJ WORM!"
X	Windows MS Update 32	jebote.exe	"Added by the FORBOT-GK WORM!"
X	Windows MSConfig Startup Logger	winlog.exe	"Added by the RBOT.BCU WORM!"
X	Windows MSN	MSN.msn	"Added by the TRIXCU.A WORM!"
X	Windows Msn Live Messanger	msnmsgsman.exe	"Added by a variant of the SDBOT WORM!"
X	Windows MSN Live Messanger	wmsnlive.exe	"Added by the RBOT.BMV BACKDOOR!"
X	Windows MSN Live Messanger	livemsngs.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows MSN Live Messenger	winlivemsn.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Windows MSN Live Messenger	winmessengerlive.exe	"Added by the IRCBOT.EAD BACKDOOR!"
X	Windows MSN Updates	wnd32.exe	"Added by the IRCBOT-ABA TROJAN!"
X	Windows MSN2 XP	swchost.exe	"Added by the KOLAB.AA WORM!"
X	Windows MSX drivers	winmsx.exe	"Added by the RBOT-AYG TROJAN!"
X	Windows Net Cfg	service.exe	"Added by a variant of the RBOT WORM!"
X	Windows NetDDe	wrmana32.exe	"Added by the MYTOB.IM WORM!"
X	Windows Nets	WinNET.exe	"Added by the RBOT-MO WORM!"
X	Windows NetStart Service	winsN2S.exe	"Added by the RBOT-ZX WORM!"
X	Windows NetStart Service2	winsN2S.exe	"Added by the RBOT-ABN WORM!"
X	Windows NetStart Service2	winsN2SD.exe	"Added by a variant of the RBOT WORM!"
X	Windows Netsystem Layer	Netsystem.exe	"Added by the RBOT.BEI WORM!"
X	Windows Network Controller	Mqguard.exe	"Added by the FORBOT-CL WORM!"
X	Windows Network Controller	WinxPupd.exe	"Added by the FORBOT-DK WORM!"
X	Windows Network Controller	winmms32.exe	"Added by the FORBOT-ED WORM!"
X	Windows Network Controller	wingmt.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Network Controller	Win9x.exe	"Added by the WOOTBOT.I WORM!"
X	Windows Network Controller	winmms32.exe.exe	"Added by the FORBOT-ED WORM!"
X	Windows Network Firewall	firewall.exe	"Added by the POEBOT-J WORM! Located in %System%"
X	Windows Network Logon	npesvc.exe	"Added by the AGENT.ERZ TROJAN!"
X	Windows Network Service	winvc32.exe	"Added by the RBOT.RY WORM!"
X	Windows Network Service	Msconf32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Network Service	Realteks.exe	"Added by the RBOT-GTG WORM!"
X	Windows Network Services	winnetwork.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Network Services	winnetwork128.exe	"Added by the SLENFBOT.J WORM!"
X	Windows Network Services	winnetwork32.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Network Services	winnetwork64.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Network Session	nspsvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Networking	winsys32.exe	"Added by the GAOBOT.FL WORM!"
X	Windows Networking Monitor	mdm.exe	"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate Machine Debug Manager (mdm.exe) process which is located in %ProgramFiles%\Common Files\Microsoft Shared\VS7Debug (98/Me/XP/Vista) or C:\WINDOWS\SYSTEM (Me only)"
X	Windows Networking Monitorin	xmdmx.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Networking Monitoring	mdm.exe	"Added by the IRCBOT.AKZ WORM! Note - this is not the legitimate Machine Debug Manager (mdm.exe) process which is located in %ProgramFiles%\Common Files\Microsoft Shared\VS7Debug (98/Me/XP/Vista) or C:\WINDOWS\SYSTEM (Me only)"
X	Windows Networks	netcog.exe	"Added by the MYTOB.FH WORM!"
X	Windows Nivedia Driver	sysMGT.exe	"Added by a variant of the RBOT WORM!"
X	Windows NNT	[path to trojan]	"Added by the RANKY.E TROJAN!"
X	Windows NT	twain.exe	"Added by the AGENT.BEA TROJAN!"
X	Windows NT 32	ntlogin32.exe	"Added by the RANDEX.BRD WORM!"
X	Windows NT Login	ntlogin32.exe	"Added by the SDBOT.WG WORM!"
X	Windows NT Login Session Manager	WNSM.EXE	"Added by the RBOT.BIV WORM!"
X	Windows NT Logon Application	winlogon.scr	"Added by the RBOT-ALP WORM!"
X	Windows NT Service Name	winshock.exe	"Added by the RBOT-PK WORM!"
X	Windows NT Service Name	svchcst.exe	"Added by the RBOT-NV WORM!"
X	Windows NT Session Manager	sess.exe	"Added by a variant of the RBOT WORM!"
X	Windows NT Update Manager	WINL0G0N.exe	"Added by the AGOBOT-NU WORM! Note that those are zeroes in the filename and not capital ""o"""
X	Windows NTFS Volume Manage	[6 random letters].exe	"Added by the RBOT.EDL BACKDOOR!"
X	Windows OEM Tools	winres32.exe	"Added by the SPYBOT.FD WORM!"
X	Windows Offical Netvvorks	mywriter32.exe	"Added by a variant of the SDBOT WORM! See here"
X	Windows Office Monitor	emdm.exe	"Added by the RBOT.AFV BACKDOOR!"
X	Windows OLE Automation Server	ole32aut.vbe	"CoolWebSearch parasite variant"
X	Windows Online Updater	dllman.exe	"Added by the RBOT-TE WORM!"
X	Windows pack Control Center	taskmam.exe	"Added by the TOMETA-J TROJAN!"
X	Windows Pc	winmgr.exe	"Added by the BIBOT-A WORM!"
X	Windows PC Defender	WP[random characters].exe	"Windows PC Defender rogue security software - not recommended
X	Windows PDG	winpdg.exe	"Added by the RBOT-ADW WORM!"
X	Windows Performance Monitor	wmscupd.exe	"Added by the IRCBOT_GEN WORM!"
X	Windows PNP	winpnp.exe	"Added by the RBOT-AKN WORM!"
X	Windows PNP Server	pnpsrv.exe	"Added by the RBOT-AKM WORM!"
X	Windows Pool Manager	poolsc.exe	"Added by the OBOT.CH WORM!"
X	Windows Pool Setup	poolmc.exe	"Added by the IRCBOT.RU BACKDOOR!"
X	Windows Population Logger	winpo32.exe	"Added by the AGENT.YKR WORM!"
X	Windows Portable Device Drivers	MSKSVRVS.EXE	"Added by a TROJAN - see here"
X	Windows Portable Devices	MSKSVRTSS.EXE	"Added by the SPYBOT.APEO WORM!"
X	Windows Print Monitor Daemon	[random filename].exe	"Added by a variant of the SDBOT WORM!"
?	Windows Print Spooler	SCVHOSTS.EXE	"Suspicious due to the similarity to the valid ""svchost.exe"" file"
X	Windows Print Spooler	NavAgent32.exe	"Added by an unidentified VIRUS
X	Windows Print Spooler	SVEHOST.EXE	"Added by the SPYBOT.H WORM!"
X	Windows Printing Driver	WinPrint.exe	"Added by a variant of the RBOT WORM!"
X	Windows Printing Driver	WinSpooler.exe	"Added by the ARCHIVARIUS series of WORMS!"
X	Windows Printing Driver	ciadvs.exe	"Added by the BUZUS-M TROJAN!"
X	Windows Printing Driver	ciadvss.exe	"Added by the ARCHIVARIUS series of WORMS!"
X	Windows Printing Driver	gpedits.exe	"Added by the DCKEYG.A WORM!"
X	Windows Process	win_update.exe	"Added by the LASTWORD WORM!"
X	Windows Process Manager	winproc.exe	Added by an unidentified WORM or TROJAN!
X	Windows Processe Manager	mspn32.exe	"Added by the RBOT.AXO WORM!"
X	Windows Proffesional Security	WinSecure32.exe	"Added by the AGOBOT.VA WORM"
X	Windows Protected Storage	npssvc.exe	"Added by the IRCBOT.AUL BACKDOOR!"
X	Windows Protection Suite	WI[random characters].exe	"Windows Protection Suite rogue security software - not recommended
X	Windows Protectot	boxide.exe	"Added by a variant of the WOOTBOT WORM!"
X	Windows Recavery Adware	lsass.exe	"Added by an unidentified TROJAN - see here. Note - this is not the legitimate lsass.exe process
X	Windows Recovery Console	recovery.exe	"Added by the RANSOM.FD WORM!"
X	Windows Recylinder Check	zwdomsgemw.exe	"Added by the RBOT-EGJ WORM!"
X	Windows Reg Services	ffservice.exe	"Added by the DLOADER-PL or DLOADER-XM TROJANS!"
X	Windows Reg Services	dservice.exe	"Added by the PRORAT-D TROJAN!"
X	Windows Reg Services	fservice.exe	"Added by the PRORAT-D TROJAN!"
X	Windows Reg Services	ssservice.exe	"Added by the PRORAT-D TROJAN!"
X	Windows Reg Services	lncom.exe	"Added by the PRORAT-O TROJAN!"
X	Windows Reg Services	lservice.exe	"Added by the PRORAT-O TROJAN!"
X	Windows Reg Services	wservice.exe	"Added by the PRORAT-O TROJAN!"
X	WINDOWS REGISTER EDIT	registr32.exe	Added by an unidentified WORM or TROJAN!
X	Windows Register Settings	svmhost.exe	"Added by a variant of the FORBOT WORM!"
X	Windows Registers	winservicess.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Registery Center	svhchosts.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Registry	msnmsg.exe	"Added by a variant of the RBOT WORM!"
X	Windows Registry	winhost.exe	"Added by a variant of the RBOT WORM!"
X	Windows Registry Cleaner	winclean.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Registry Control	winreg.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Registry DLL	winregdll.exe	"Added by the IRCBOT.FB BACKDOOR!"
X	Windows Registry Express Loader	regexpress.exe	"Added by the FORBOT-CJ WORM!"
X	Windows Registry Manager	tasksmanagers.exe	"Added by the MYTOB.ER WORM!"
X	Windows Registry Name	[random filename]	"Added by the RBOT-AEB WORM!"
X	Windows Registry Name	winses.exe	"Added by the RBOT-ADB WORM!"
U	Windows Registry Repair Pro	RegistryRepairPro.exe	"Registry Repair Pro. ""Scans the Windows Registry for invalid or obsolete information in the registry"""
X	Windows Registry Scan	regscan32.exe	"Added by the RBOT.KE WORM!"
X	Windows Registry Scan	timeupdate.exe	"Added by the SPYBOT.JE WORM!"
X	Windows Registry Scan	svcdll.exe	"Added by the RBOT-TP WORM!"
X	Windows Registry Scan	regscan23.exe	"Added by a variant of the RBOT WORM!"
X	Windows Registry Scan	regscan.exe	"Added by the RBOT-HA WORM!"
X	Windows Registry Scan	winmedia.exe	"Added by the SPYBOT.GK WORM!"
X	Windows Registry Security	crss.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Registry Services	regserv.exe	"Added by the SLENFBOT.BB WORM!"
X	Windows Registry Startup	wind32.exe	"Added by the AGOBOT-BZ WORM!"
X	Windows Registry XP	winxptdl.exe	"Added by the IRCBOT.AUN WORM!"
X	Windows Relay Service	ipcbind.exe	"Added by the DELFINJECT.F TROJAN!"
X	Windows Relay Service	irfnga.exe	"Added by the DROPPER.ACO TROJAN!"
X	Windows Remote Addressing	wnpcgs.exe	"Added by the DELF-EZN TROJAN!"
X	Windows Remote Launcher	wnpmcs.exe	"Added by the IRCBOT.ASX BACKDOOR!"
X	Windows Repair	toxikx.exe	"Added by the SDBOT-ADL WORM!"
X	Windows report	swchost.exe	"Added by the SMALL-BD TROJAN!"
X	Windows Rescue System	winsto.exe	"Added by the SUURCH.CG TROJAN!"
X	Windows Reverse Preperation	winrvp.exe	"Added by the SLENFBOT.CB WORM!"
X	Windows Reversed Virus Protection	winrsvp.exe	"Added by the SLENFBOT.HX WORM!"
X	windows run	system.exe	"Added by the ICPASS-A WORM!"
X	Windows Run-Time 64bit	win64rt.exe	"Added by a variant of the RBOT WORM!"
X	Windows Rundll Center	msnsmgr.exe	"Added by the AGENT-LLB TROJAN!"
X	Windows Rundll Center	msmsgrs.exe	"Added by the IRCBOT-AFA WORM!"
X	Windows Running DLL Service	rundll128.exe	"Added by the IRCBOT.XDH BACKDOOR!"
X	Windows Running DLL Service	rundll64.exe	"Added by the SLENFBOT.HV WORM!"
X	Windows Runtime Help	win32hlp.exe	"Added by a variant of the AIMVISION TROJAN!"
X	Windows Runtime Help	WinRunHelp.wrh	"Added by a variant of the AIMVISION TROJAN!"
X	Windows Runtime Proccess	32RUNdll.exe	"Added by the SDBOT.QW WORM!"
X	Windows SA	omniscient.exe	"BLAZEFIND adware"
X	Windows Scheduler	wmscheduler.exe	"Added by a variant of the SDBOT WORM! See here"
X	Windows Scheduler!	scheduler.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Screensaver	Service.exe	"Added by the KELVIR.P WORM!"
X	WINDOWS SCREENSAVER	ssaver.scr	"Added by the SDBOT-YZ WORM!"
N	Windows Search	WindowsSearch.exe	"System Tray access to Windows Search 4.0 for XP from Microsoft - which adds additional search options including a search box on the Taskbar. This version also includes the Windows Search (WSearch) service which indexes files and e-mails items so you can quickly find words and phrases. Disabling this entry does not affect the normal operation"
X	Windows secure	setver32.exe	"Added by the SPYBOT.EP WORM!"
X	Windows Secure Connection	winsc.exe	"Added by the SDBOT.BTN WORM!"
X	Windows Secure Fix	iPodFixer.exe	"Added by the WOOTBOT.BM BACKDOOR!"
X	Windows Secure Layer	[random filename]	"Added by the RBOT.DRF WORM!"
X	Windows Secure Messaging System	msnmsgrsrvc.exe	"Added by the RBOT-RE WORM!"
X	Windows Secure Services	ssms.exe	"Added by the RBOT-GAR WORM!"
X	Windows Secure talal32	[7 random letters].exe	"Added by the RBOT.HTP TROJAN!"
X	Windows Secure Update	winupser.exe	"Added by the RBOT-GCG WORM!"
X	Windows Secure Update	WinSecUp.exe	"Added by the RBOT-GCD WORM!"
X	Windows Secure Update	load.exe	"Added by the FORBOT-GU WORM!"
X	Windows Secure Update	WinSecure.exe	"Added by the RBOT-GDO WORM!"
X	Windows Securety	wurger.exe	"Added by the AGOBOT-NC BACKDOOR!"
X	WINDOWS SECURITY	wingrd.exe	"Added by a variant of the RBOT WORM!"
X	Windows Security	win.pif	"Added by the RBOT-APT WORM!"
X	Windows Security	ms32.pif	"Added by the RBOT-ARN WORM!"
X	Windows Security	winscure.exe	"Added by the RBOT-BAF WORM!"
X	Windows Security Assistant	rundll32.vbe	"CoolWebSearch Alfasearch parasite variant - also detected as the STARTPA-U TROJAN!"
X	Windows Security Assistant	winsec.exe	"CoolWebSearch parasite variant"
X	Windows Security Authority Service	lsass.exe	"Added by the KALEL-A WORM! Note - this is not the legitimate lsass.exe process
X	Windows Security Center Notification App	wscnfty.exe	"Added by a variant of the RBOT WORM!"
X	Windows Security Center Notification Appls	sxe.exe	"Added by the RBOT-GKX WORM!"
X	Windows Security Center Notification Applse	sxes.exe	"Added by the RBOT-GLR WORM!"
X	Windows Security Center Notification Applse	os.exe	"Added by a variant of the RBOT-GLR WORM!"
X	Windows Security Center Notification Applsee	sysecurex.exe	"Added by a variant of the RBOT-GKX WORM!"
X	Windows Security Control	wuaucls.exe	"Added by the FORBOT-V WORM!"
X	Windows Security Manager	winsecurity.exe	"Added by the AGOBOT-KI WORM!"
X	Windows Security Manager	winsecure.exe	"Affilred adware"
X	Windows Security Manager	svchost.exe	"Added by the ANTINNY.AX WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Microsoft"" subfolder"
X	Windows Security Manager	svhost.exe	"Added by the GAOBOT.ALU WORM!"
X	Windows Security Module	module.exe	"Added by a variant of the RBOT WORM!"
X	Windows Security Policy	lsass32.exe	"Added by the AGOBOT-CR WORM!"
X	Windows Security Service	[random file name]	"Added by the RBOT-ALV WORM!"
X	Windows Security Service	arrdt.exe	"Added by a variant of the RBOT WORM!"
X	Windows Security Service	windows.pif	"Added by the RBOT-AMG WORM!"
X	Windows Security Suite	WI[random characters].exe	"Windows Security Suite rogue security software - not recommended
X	Windows Security Survy	svchosl.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Security Tool	WinSecure.exe	"Added by the AGENT-GPY TROJAN!"
X	Windows Security Update	security32.exe	"Affilred adware"
X	Windows Security Update	ndsass.exe	"Added by the RBOT.ESM BACKDOOR!"
X	Windows Serv Patch	Mcaffe2005.exe	"Added by a variant of the RBOT WORM!"
X	Windows Servce Agent	[random filename]	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Servcesc	[9 random letters].exe	"Added by a variant of the SDBOT WORM! See here"
X	Windows ServeAd	WinServAd.exe	Windupdates adware variant
X	Windows Server	winserv.exe	"Added by the IRCBOT.AVM BACKDOOR!"
X	Windows Server Client Verification Service	wscvs.exe	"Added by the AGENT.AWC TROJAN!"
X	Windows Server Drivers	syssrv.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Server Information	servinfo.exe	"Added by the FORBOT-EN WORM!"
X	Windows Server IP Verification Service	wsivs.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Windows Server Peer Verification Service	wspvs.exe	"Added by a variant of the RANKY TROJAN!"
X	Windows Server!	winsvr.exe	"Added by the IRCBOT.AYC BACKDOOR!"
X	Windows Servic2	winsy.exe	"Added by the RBOT-AIA WORM!"
X	Windows service	wuamgrd.exe	"Added by the RBOT-QW WORM!"
X	Windows Service	dddd.exe	"Detected by Kaspersky as Dialer.Salc
X	Windows Service	prvdi.exe	"Malware - detected by Kaspersky as the SMALL.RD TROJAN!"
X	Windows Service	video.exe	Added by an unidentified TROJAN!
X	Windows Service	svvhost.exe	"Added by the AGOBOT-HL WORM!"
X	Windows Service	private-zone.exe	Added by an unidentified WORM or TROJAN!
X	Windows Service	pd7.exe	"Added by the SMALL.VZ TROJAN!"
X	Windows Service	dstart4.exe	Added by an unidentified TROJAN!
X	Windows Service	pd14.exe	"Adware - detected by DiamondCS TDS-3 anti-trojan as the DELF.DG TROJAN!"
X	Windows Service	video2.exe	Added by the DOWNLOADER.SMALL.MY TROJAN!
X	Windows Service	services.exe	"Added by the KALEL-A WORM! Note - this is not the legitimate services.exe process
X	Windows Service	WINSVC.EXE	"Added by the SPYBOT-DH TROJAN!"
X	Windows Service	r.exe	"Added by a variant of the SMALL.VZ TROJAN!"
X	Windows Service	windowz.exe	"Added by the SDBOT-AYI WORM! Note - dissables the automatic startup of other software and deactivates the Microsoft Internet Connection Firewall (ICF)"
X	Windows service	iexpl0rer.exe	"Added by the SDBOT.RO WORM!"
X	Windows Service	service.exe	"Added by the IRCBOT-ACV WORM!"
X	Windows Service	svchost.exe	"Added by the SPYBOT-AW TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Windows Service Ag3nt	[6 random letters].exe	"Added by the SDBOT.EZX TROJAN!"
X	Windows Service Agccnt	jeqcfyo.exe	"Added by the RBOT-GST WORM!"
X	Windows Service Agccnt	[random].exe	"Added by the SDBOT-DHL WORM!"
X	Windows Service Agccnt	rmizjgz.exe	"Added by the SDBOT-SIM WORM!"
X	Windows Service Agent	czf.exe	"Added by the RBOT-GAJ WORM!"
X	Windows Service Agent	[random filename].exe	"Added by the IRCBOT-XE TROJAN!"
X	Windows Service Agent	agl23.exe	"Added by the RBOT-GQU WORM!"
X	Windows Service Agent	co0l.exe	"Added by the RBOT-GQY WORM!"
X	Windows Service Agent	dsass.exe	"Added by the RBOT.MIRCO.BNG WORM!"
X	Windows Service Agent	msnmagr.exe	"Added by a variant of the SLAPER TROJAN!"
X	Windows Service Agent	taskmgr32.exe	"Added by the RBOT-GMN WORM!"
X	Windows Service Agent	win32wins.exe	"Added by the RBOT-LOL WORM!"
X	Windows Service Agent	winup32.exe	"Added by the RBOT-GQX WORM!"
X	Windows Service Agent	winupds32.exe	"Added by the RBOT-GQT WORM!"
X	Windows Service Agent	wit.exe	"Added by the RBOT-GQV WORM!"
X	Windows Service Agent	wmscc.exe	"Added by the RBOT-GQP WORM!"
X	Windows Service Agent	spoolvs.exe	"Added by the RBOT-GXI WORM!"
X	Windows Service Agent	spools.exe	"Added by the AGENT-GJF TROJAN!"
X	Windows Service Agent	msngear.exe	"Added by the RBOT.AHW BACKDOOR!"
X	Windows Service Agent	msngerr.exe	"Added by the RBOT.EOZ WORM!"
X	Windows Service Agent	[3 random letters].exe	"Added by the AGENT.AMEB TROJAN - see examples here and here"
X	Windows Service Agent	cxfrru.exe	"Added by the SDBOT.GAV WORM!"
X	Windows Service Agent	izszbayz.exe	"Added by the KOLAB.TC WORM!"
X	Windows Service Agent	jnxrcyc.exe	"Added by the RBOT.XAT BACKDOOR!"
X	Windows Service Agent	kafdprs.exe	"Added by the IRCBOT.HDE BACKDOOR!"
X	Windows Service Agent	krqbs.exe	"Added by the IRCBRUTE.AZ TROJAN!"
X	Windows Service Agent	lcaqmsp.exe	"Added by the RBOT.WFR BACKDOOR!"
X	Windows Service Agent	msnmsgr.exe	"Added by the RBOT.ABIK BACKDOOR! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Windows Service Agent	mxjunj.exe	"Added by the RBOT.EMC BACKDOOR!"
X	Windows Service Agent	ndibbeu.exe	"Added by the RBOT.XVD BACKDOOR!"
X	Windows Service Agent	nimcoo.exe	"Added by the RBOT.EWV WORM!"
X	Windows Service Agent	nod32.exe	"Added by the RBOT.BNG BACKDOOR!"
X	Windows Service Agent	sjbsm.exe	"Added by the SMALLTRO.II TROJAN!"
X	Windows Service Agent	sjbsmgm.exe	"Added by the IRCBOT.AHX WORM!"
X	Windows Service Agent	tjybssd.exe	"Added by the RBOT.XVD BACKDOOR!"
X	Windows Service Agent	umvcnm.exe	"Added by the RBOT.EMC BACKDOOR!"
X	Windows Service Agent	uqgpq.exe	"Added by the SMALLTRO.II TROJAN!"
X	Windows Service Agent	vbsxkhk.exe	"Added by the IRCBOT.AHX WORM!"
X	Windows Service Agent	wge23.exe	"Added by the RBOT.HHK BACKDOOR!"
X	Windows Service Agent	Windo.exe	"Added by the RBOT.NQS WORM!"
X	Windows Service Agent	ywgma.exe	"Added by the RBOT.DZT BACKDOOR!"
X	Windows Service Agent	winupd32.exe	"Added by the SDBOT.SYM WORM!"
X	Windows Service Agent	WinTcpip.exe	"Added by the SPYBOT.AP WORM!"
X	Windows Service Agent	idvcqv.exe	"Added by the AGOBOT-AJB WORM!"
X	Windows Service Agent 32	mrthd.exe	"Added by the AGENT-GAQ TROJAN!"
X	Windows Service Agnts	[8 random letters].exe	"Added by the SDBOT.BCQ WORM!"
X	Windows Service Ajav	java128.exe	"Added by the RBOT.BNG WORM!"
X	Windows Service alge	[random filename]	"Added by the RBOT.GJO TROJAN!"
X	Windows Service Controller	services.exe	"Added by the KALEL-B WORM! Note - this is not the legitimate services.exe process
X	Windows Service Controller Agent	taksmgr.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Service DC	uhpnjcjl.exe	"Added by the RBOT-GLY WORM!"
X	Windows Service Exec	ServiceLayer.exe	"Added by the SPYBOT-OI WORM! Note - do not confuse this with the Nokia service of the same name which resides in %ProgramFiles%\Common Files\PCSuite\Services or %Program Files%\PC Connectivity Solution. This one is located in %Windir%"
X	Windows Service Find	wrfkuk.exe	"Added by the IRCBOT-XZ TROJAN!"
X	Windows Service help	winservices.exe	"Added by the DROPPER.TT TROJAN!"
X	Windows Service Host	scvhost.exe	"Added by the SDBOT.N TROJAN!"
X	Windows Service Host	svchost.exe	"Added by the CONE.B WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Service Host	svchost.exe	"Added by the KALEL-C WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	Windows Service Host	schost.exe	"Added by the GAOBOT.AO WORM!"
X	Windows Service Host Process	[path to file]	"Added by the EZIO-A WORM!"
X	Windows Service Hosting	USERINIT.exe	"Added by the GOMMER-A WORM!"
X	Windows Service Layer	config.exe	"Added by the RBOT.DDJ WORM!"
X	Windows Service Loader	Window.exe	"Added by the RBOT-XO WORM!"
X	Windows Service Management	svcmngmt.exe	"Added by the AGOBOT-NM WORM!"
X	Windows Service Manager	userint32.exe	"Added by the OSCABOT-C WORM!"
X	Windows Service Manager	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	msgs.exe	"Added by the OSCABOT-E WORM!"
X	Windows Service Manager	msnmrg.exe	"Added by the OSCABOT-G WORM!"
X	Windows Service Manager	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	svcmgr32.exe	"Added by the OSCABOT-D WORM!"
X	Windows Service Manager	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	taskmgr.exe	"Detected by Kaspersky as the IAMBIGBROTHER.91 TROJAN! Note - this is not the legitimate taskmgr.exeprocess which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""fonts\svc"" sub-folder"
X	Windows Service Manager	initsvc.exe	"Added by the RBOT-BWT WORM!"
X	Windows Service oi worms	[6 random letters].exe	"Added by the SYSTEMHI.OS TROJAN!"
X	Windows Service Pack 2	WindowsSP2.exe	"Added by the SDBOT-TQ WORM!"
X	Windows Service Pack Auto Update	winworks.exe	"Adware downloader - detected by eScan antivirus as the AGENT.BT TROJAN!"
X	Windows Service Pack Auto Update	figgaz.exe	"Detected by Kaspersky as the AGENT.BT TROJAN!"
X	Windows Service Pack Auto Update	ballin.exe	Added by an unidentified WORM or TROJAN!
X	Windows Service Pack Auto Update	del-me.exe	"Adware
X	Windows Service Pack2	svchhost.exe	"Added by a variant of the RBOT WORM!"
X	Windows Service Pack2	WIN43.EXE	"Added by the GAOBOT.G WORM!"
X	Windows Service Supply	winsupply.exe	"Added by the SLENFBOT.CZ WORM!"
X	Windows Service Support Call	SVSS32.EXE	"Added by the RBOT-XQ WORM!"
X	Windows Service SV	sv32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Service Threads	svcthreading.exe	"Added by the SHEUR.AUM TROJAN!"
X	Windows Service Threads	svcthreads.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Service Update	livecal.exe	"Added by the SDBOT-DEY WORM!"
X	Windows Service Update	crsss.exe	"Added by the SDBOT.CWX WORM!"
X	Windows Service Update	mswsgs.exe	"Added by the RBOT.FQB WORM!"
X	Windows Service Utitity	winsrvc.exe	"Added by the RBOT-ASI WORM!"
X	Windows Service XP	XpFirewall.exe	"Added by the MYTOB.AM WORM!"
X	Windows Servicer	xqobypik.exe	"Added by the SDBOT-DFB WORM!"
X	Windows Services	service.exe	"Added by the RANDEX.R WORM!"
X	Windows Services	svchosts.exe	"Added by the AGOBOT-KL TROJAN!"
X	Windows Services	Explorer.exe	"Added by the SDBOT-WT WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Windows Services	NetworkDriver32.exe	"Added by the RBOT-ACR WORM!"
X	Windows Services	scmsg.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Services	scvhoste.exe	"Added by the SPYBOT.OBZ WORM!"
X	Windows Services	winsvc32.exe	"Added by the MYTOB-CB WORM!"
X	Windows Services	NetworkDrivers.exe	"Added by the SDBOT-YO WORM!"
X	Windows Services	smsc.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Services	spoolsvc.exe	"Added by the SDBOT.CPZ WORM!"
X	Windows Services	iexplore.exe	"Added by the RBOT-WE WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows Services	avsrv32.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Services	servicez.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services	w32edus.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services	w32service.exe	"Added by the AUTORUN-FU WORM!"
X	Windows Services	w32services.exe	"Added by the AUTORUN-FT WORM!"
X	Windows Services	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Services	winsysdll.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services	winsyssrv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services	winudp.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Services	filename.exe	"Added by the SDBOT.FSK BACKDOOR!"
X	Windows Services	svhost33.exe	"Added by the RBOT.AFN WORM!"
X	Windows Services	services.exe	"Added by the AGENT-MVC TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Services	wupdate.exe	"Added by the GAOBOT.ZT WORM!"
X	Windows Services Agant	regs32.exe	"Added by the SDBOT-DIK WORM!"
X	Windows Services Aganters	[10 random letters].exe	"Added by the RBOT.CUN WORM!"
X	Windows Services Agent	msngears.exe	"Added by the VB-EMS TROJAN!"
X	Windows Services alges2	[8 random letters].exe	"Added by a variant of the RBOT WORM!"
X	Windows Services B-Runner	svcbrun.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services B-Runner	svcbrunner.exe	"Added by the IRCBOT.BYV BACKDOOR!"
X	Windows Services Certification	svccert.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services Guide	svcguide.exe	"Added by the SLENFBOT.KQ WORM!"
X	Windows Services Guide	svcguides.exe	"Added by the SHEUR.YS BACKDOOR!"
X	Windows Services Host	svchost.exe	"Added by the CONE or CONE.E WORMS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	Windows Services Hosts	svhosts.exe	"Added by the SDBOT-YH TROJAN!"
X	Windows Services Ink Platform Tablet Input Subsystem	wsiptis.exe	"Added by the RBOT.APC WORM!"
X	Windows Services Jog	svcjog.exe	"Added by the AGENT.ALWZ WORM!"
X	Windows Services Jog	svcjogg.exe	"Added by the AGENT.QAF WORM!"
X	Windows Services Joger	svcjoger.exe	"Added by the RBOT.CAT WORM!"
X	Windows Services Jogging	svcjogging.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services Joging	svcjoging.exe	"Added by the IRCBOT.AVI BACKDOOR!"
X	Windows Services Layer	winlogz2.exe	"Added by the RBOT-FZE WORM!"
X	Windows Services Layer	winl0g0.exe	"Added by the RBOT-FZQ WORM!"
X	Windows Services Layer	sslms.exe	"Added by the RBOT-GAH WORM!"
X	Windows Services M7	ctfmon32.exe	"Added by the AGENT.WOH TROJAN!"
X	Windows Services Tower	svctowers.exe	"Added by the IRCBOT.AGJ BACKDOOR!"
X	Windows Services Tower	svctowing.exe	"Added by the SLENFBOT.LA WORM!"
X	Windows Services Update	svch0st.exe	"Added by a variant of the RBOT WORM! Note - the filename has the digit 0 rather then the uppercase ""o"""
X	Windows Serviece Agents	[8 random letters].exe	"Added by the AGENT.BHR TROJAN!"
X	Windows Servser	serviser.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Session Manager	smss32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Session Manager Subsystem	smss.exe	"Added by the KALEL-B WORM! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup!"
?	Windows shell	win70.exe	"??"
X	Windows Shell	shell.exe	"Added by the MYTOB-CA WORM!"
X	Windows Shell	taskgmr.exe	"Added by the MYTOB.BV WORM!"
X	Windows Shell Library Loader	load shell.dll	"CoolWebSearch parasite variant"
X	windows shellext.32	mschost.exe	"Added by the BLASTER.K WORM!"
X	WINDOWS SKY	sky.exe	"Added by the MYTOB.CH WORM!"
X	Windows Smart Manager	smart.exe	"Added by the RBOT-SL WORM!"
X	Windows SMB Manager	smb32.exe	"Added by the RBOT-BHZ WORM!"
X	Windows smss service	service.exe	"Added by the AGENT-FPY TROJAN!"
X	Windows Socket Procedure	WinSock32.exe	"Added by the RBOT-FMX WORM!"
X	Windows Software	hbsppe.exe	"Added by the RBOT-GLL WORM!"
X	Windows Sound	svdhost.exe	"Added by the SDBOT.EFX BACKDOOR!"
X	Windows Sound Driver	SndMon32.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Sound Emulator	snd32_win.exe	"Added by the ATNAS.A WORM!"
X	Windows Sound Manager	SndMon32.exe	"Added by the FORBOT-BU WORM!"
X	Windows Sound Manager	SndMon16.exe	"Added by a variant of the FORBOT WORM!"
X	Windows Sound Manager	sound.exe	"Added by the AGOBOT-CD WORM!"
X	Windows Sound Manager	gearsec.exe	"Added by the PUSHBOT.DF WORM!"
X	Windows Sound Verifier	WinIp32.exe	"Added by the RBOT-FMO WORM!"
X	Windows SP2 Firewall	wfirewall7.exe	"Added by a variant of the RBOT WORM!"
X	Windows SP2 Update	Sp2update.exe	"Added by the WOOTBOT.BS WORM!"
X	Windows SP2 Version Load	wuauclt32.exe	"Added by the GAOBOT.CX WORM!"
X	Windows SP4	directCC.exe	"Added by the RBOT-ACX WORM!"
X	Windows Spool	winspool.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Spool Server	spoolsrv.exe	"Added by the SDBOT-ACT WORM!"
X	Windows SpoolaPrint Service	spoolasrv.exe	"Added by the SDBOT-AYD WORM!"
X	Windows Spooler	SPOOLSRV.EXE	"Added by the SPYBOT.P WORM!"
X	Windows Spooler	spoolsv32.exe	Added by an unidentified WORM or TROJAN!
X	Windows Spooler	winsplr.exe	"Added by the SHEUR.ANX TROJAN!"
X	Windows Spooler Control Service	qwidh.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows Spooler Services	spool.exe	"Added by the AGOBOT-AMO WORM!"
X	Windows SpoolPrint Service	spoolersrv.exe	"Added by the SDBOT-ZT WORM!"
X	Windows Spools SV	winsv.exe	"Added by the RBOT-AUQ WORM!"
X	Windows spoolservr Service	spoolservr.exe	"Added by the SDBOT-AAN WORM!"
X	Windows Spoolsre Service	spoolsre.exe	"Added by the SDBOT-AAE WORM!"
X	Windows Spoolsrv Service	spoolmsv.exe	"Added by the SDBOT-ZS WORM!"
X	windows spoolsrv service	spoolssv.exe	"Added by the SDBOT-AWV WORM!"
X	Windows Spoolsurf Service	spoolsurf.exe	"Added by the SDBOT-ZZ WORM!"
X	Windows SpooltPrint Service	spooltsrv.exe	"Added by the SDBOT-AYE WORM!"
X	Windows Spoolvvv Service	spoolvvv.exe	"Added by the SDBOT-AAW WORM!"
X	Windows spyware remover	Windows-spyware.exe	"Added by the SystemPoser TROJAN!"
X	Windows sq Drivers	winmsn32.exe	"Added by the RBOT-ADI WORM!"
X	Windows SQL management 1.33	scvhost.exe	"Added by the SPYBOT-OB WORM!"
X	Windows Sql Service For Windows 32 Bit	winsql32.exe	"Added by the FORBOT-FC WORM!"
X	Windows SRS Client	winsrs.exe	"Added by the RBOT-BXQ WORM!"
X	Windows SRT Client	winsrt.exe	"Added by the RBOT-BFR WORM!"
X	Windows SSH Client	winssh.exe	"Added by the RBOT-AXC WORM!"
X	Windows SSL File	winssv.exe	"Added by the WOOTBOT.CA WORM!"
X	Windows SSL Secondary Drivers	SSL32Dr.exe	"Added by the SDBOT.ASQ WORM!"
X	Windows Stand Sound Drivers	Sounddrv.exe	"Added by the SDBOT-XF WORM!"
X	Windows Standard Securty	[random 3-letter filename]	"Added by the RBOT-ALF WORM!"
X	Windows Start Server 2000	traficy.exe	"Added by the RBOT-AHM WORM!"
X	Windows Startup	winsta~1.exe	"GoHip foistware"
X	Windows Startup	winstartup.exe	"GoHip foistware"
X	Windows Startup	Wdrun32.exe	"Added by the GAOBOT.AO WORM!"
X	Windows Startup	services21.exe	"Added by the AGOBOT-MX WORM!"
X	Windows Startup	Winsys32.exe	"Added by the RBOT.AAB WORM!"
X	Windows Startup 32 Bits	sysrun32.exe	Added by a variant of the DARKSUN TROJAN!
Y	Windows SteadyState - Bubble Messages	Bubble.exe	"Part of Windows SteadyState
Y	Windows SteadyState - Session Timer Notify (UI)	SCTUINotify.exe	"Part of Windows SteadyState
X	Windows Storm-Memory Drivers	memorystorm.exe	"Added by the SLENFBOT.CO WORM!"
X	Windows Stortup	svchost.exe	"Added by the TOGER-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Streams Server	localsrv.exe	"Added by the SDBOT.LN WORM!"
X	Windows Subsys	winload.exe	"Added by the NETSPREE.C WORM!"
U	Windows Supervisor	winspvr.exe	"Windows Supervisor surveillance software. Uninstall this software unless you put it there yourself"
X	WINDOWS SVC	winsvc.exe	"Added by the MYTOB-EY WORM!"
X	Windows svchost	avserv.exe	"Added by the PUSHBOT.FM WORM!"
X	Windows svchost	ctfmon32.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows svchost	happy2008.exe	"Added by the PUSHBOT.AM WORM!"
X	Windows svchost	service.exe	"Added by the PUSHBOT.DU WORM!"
X	Windows svchost	serviceaaa.exe	"Added by the PUSHBOT.ER WORM!"
X	Windows svchost	servicean.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows svchost	svchost.exe	"Added by the IRCBOT-ZQ WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows svchost	ups.exe	"Added by the PUSHBOT.A WORM!"
X	Windows svchost	upss.exe	"Added by the PUSHBOT.GJ WORM!"
X	Windows svchost	serviceam.exe	"Added by the PUSHBOT.EY WORM!"
X	Windows svchost	svchostx.exe	"Added by the PUSHBOT.CC WORM!"
X	Windows Svchost Authority	slsass.exe	"Added by the RBOT-UA WORM!"
X	Windows Svshost Service Update 32	svcsshost32.exe	"Added by the FORBOT-GD WORM!"
X	Windows SYN Control Center	winmnon32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows SyncroAd	SyncroAd.exe	Windupdates adware variant
X	Windows SysNotify	mssecc.exe	"Added by the AGENT-GFR TROJAN!"
X	WINDOWS SYSTEM	beta.exe	"Added by the MYTOB.DF WORM!"
X	WINDOWS SYSTEM	dcomuser.exe	"Added by the MYTOB.EO WORM!"
X	WINDOWS SYSTEM	lf66prc.exe	"Added by the MYTOB.GC WORM!"
X	WINDOWS SYSTEM	msdev32.exe	"Added by the MYTOB.EH WORM!"
X	WINDOWS SYSTEM	nec.exe	"Added by the MYTOB-L WORM and variants!"
X	WINDOWS SYSTEM	nibie.exe	"Added by the MYTOB-BY WORM!"
X	WINDOWS SYSTEM	ninfoie.exe	"Added by the MYTOB-EP WORM!"
X	WINDOWS SYSTEM	skybot.exe	"Added by the MYTOB-CX WORM!"
X	WINDOWS SYSTEM	skybotx.exe	"Added by the MYTOB-BY WORM!"
X	WINDOWS SYSTEM	smoc.exe	"Added by the MYTOB.FU WORM!"
X	WINDOWS SYSTEM	smsc.exe	"Added by the MYTOB-BR WORM!"
X	WINDOWS SYSTEM	test.exe	"Added by the MYTOB.DJ WORM!"
X	WINDOWS SYSTEM	test2.exe	"Added by the MYTOB.DJ WORM!"
X	WINDOWS SYSTEM	test3.exe	"Added by the MYTOB.DV WORM!"
X	WINDOWS SYSTEM	wdns33.exe	"Added by the MYTOB-BY WORM!"
X	WINDOWS SYSTEM	win.exe.exe	"Added by the MYTOB.FA WORM!"
X	WINDOWS SYSTEM	winaup.exe	"Added by the MYTOB-DN WORM!"
X	WINDOWS SYSTEM	winligon.exe	"Added by the MYTOB.EP WORM!"
X	WINDOWS SYSTEM	winmon.exe	"Added by the MYTOB.GB WORM!"
X	WINDOWS SYSTEM	winNTsys32.exe	"Added by the MYTOB-DM WORM!"
X	WINDOWS SYSTEM	winsvc32.exe	"Added by the MYTOB.HH WORM!"
X	Windows System	WINSYS.exe	"Added by the RBOT-AEF WORM!"
X	WINDOWS SYSTEM	winsys33.exe	"Added by the MYTOB.EK WORM!"
X	WINDOWS SYSTEM	winvnc.exe	"Added by the MYTOB.EU WORM!"
X	WINDOWS SYSTEM	winxpserv.exe	"Added by the MYTOB-BQ WORM!"
X	WINDOWS SYSTEM	xxx.exe	"Added by the MYTOB.CZ WORM!"
X	Windows System	winsys32.exe	"Added by the MYTOB-IS WORM!"
X	WINDOWS SYSTEM	skybot.exe	"Added by the MYTOB.JU WORM!"
X	WINDOWS SYSTEM	botzor.exe	"Added by the ZOTOB WORM!"
X	WINDOWS SYSTEM	gothica.exe	"Added by the MYTOB.HU WORM!"
X	WINDOWS SYSTEM	msnl.exe	"Added by the MYTOB.IK WORM!"
X	WINDOWS SYSTEM	per.exe	"Added by the ZOTOB.C WORM!"
X	WINDOWS SYSTEM	twunk_65.exe	"Added by the MYTOB-EG WORM!"
X	WINDOWS SYSTEM	servce.exe	"Added by the MYTOB-EI WORM!"
X	WINDOWS SYSTEM	servises.exe	"Added by the ZOTOB-I WORM!"
X	WINDOWS SYSTEM	xpupdate.exe	"Added by the ZOTOB-G WORM!"
X	WINDOWS SYSTEM	expI0rer.exe	"Added by the MYTOB-FI WORM! Note the upper case ""i"" and number ""0"" in the filename"
X	WINDOWS SYSTEM	msn32.exe	"Added by the MYTOB-FX WORM!"
X	WINDOWS SYSTEM	sky.exe	"Added by the MYTOB.LB WORM!"
X	WINDOWS SYSTEM	Win32IMAPSVR.exe	"Added by the MYTOB-FQ or MYTOB-FU WORMS!"
X	WINDOWS SYSTEM	winsvc.exe	"Added by the MYTOB.LM WORM!"
X	WINDOWS SYSTEM	mswins.exe	"Added by the MYTOB.DP WORM!"
X	WINDOWS SYSTEM	mtrnqs.exe	"Added by the MYTOB.IG WORM!"
X	WINDOWS SYSTEM	logic.exe	"Added by the MYTOB.IC WORM!"
X	WINDOWS SYSTEM	ctech.exe	"Added by the MYTOB-KD WORM!"
X	WINDOWS SYSTEM	efefefe.exe	"Added by the MYTOB-KH WORM!"
X	WINDOWS SYSTEM	svchost2.exe	"Added by the MYTOB.OZ WORM!"
X	WINDOWS SYSTEM	skybot.exe	"Added by the MYTOB.EB WORM!"
X	WINDOWS SYSTEM	wupdate.exe	"Added by the MYTOB-HT WORM!"
X	Windows System	system.exe	"Added by the MYTOB-GN WORM!"
X	Windows System 32	winsys_32.exe	"Added by the RBOT-FTR WORM!"
X	Windows System 32-Bat Service	win32bat.exe	"Added by the MYTOB.FI WORM!"
X	Windows System Backup	SysBackup.exe	Unidentified malware
X	WINDOWS SYSTEM By FEnR	windasz-updote.exe	"Added by the MYTOB.LR WORM!"
X	WINDOWS SYSTEM Cleaner	h3.exe	"Added by the MYTOB.EQ WORM!"
X	WINDOWS SYSTEM CLEANER	iexplore.exe	"Added by the MYTOB.ET WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows System Configuration	SYSCFG16.EXE	"Added by the WISDOOR-K TROJAN!"
X	Windows System Configuration	Passcfg16.exe	"Added by the DOMWIS-E TROJAN!"
X	Windows System Configuration	Winfrw.exe	"Added by the SOLUFINA TROJAN or the DOMWIS-J WORM!"
X	Windows System Configuration	wincfg.exe	"Added by the AGOBOT.OP WORM!"
X	Windows System Configuration	WINCFG32.EXE	"Added by the AGOBOT-TE WORM!"
X	Windows System Configuration	WinNeth.exe	"Added by the RETHE-A WORM!"
X	Windows System Configuration	nether.exe	"Added by the OPANKI-AB WORM!"
X	Windows System Configuration	WINSYS32.exe	"Added by the SDBOT.AXK WORM!"
X	Windows System Defender	WS[random characters].exe	"Windows System Defender rogue security software - not recommended
X	WINDOWS SYSTEM Dns	windsns.exe	"Added by the MYTOB.EY WORM!"
X	WINDOWS SYSTEM DNSPOOL	hbmail.exe	"Added by the MYTOB.FW WORM!"
X	Windows System Drivers	sysretain.exe	"Added by the SLENFBOT.BY WORM!"
X	Windows System File	cmxp.exe	"Added by the SPYBOT.KHO WORM!"
X	WINDOWS SYSTEM FILE	winload.exe	"Added by the MYTOB.DK WORM!"
X	Windows System Gateway	SPOOLER.EXE	"Added by a variant of the RBOT WORM!"
X	Windows System Guard	egun.exe	"Added by the AGENT-NHY TROJAN!"
X	Windows System Guard	msdn.exe	"Added by the FAKEAV-BJD TROJAN!"
X	Windows System Guard	msng.exe	"Added by the EGGDROP-BO WORM!"
X	Windows System Guard	msns.exe	"Added by the DWNLDR-IGD TROJAN!"
X	Windows System Init	winit32.exe	"Added by a variant of the RBOT WORM!"
X	Windows System Manager	winsystem.exe	"Added by the RBOT-AN WORM!"
X	Windows System Manager	CRSL.EXE	"Added by the SDBOT.MG WORM!"
X	Windows System Manager	sysconf.exe	"Added by the MYTOB.AL WORM!"
X	Windows System Manager	smsc.exe	"Added by a variant of the RBOT WORM!"
X	Windows System Manager	crssm.exe	"Added by the RBOT-AFH WORM!"
X	WINDOWS SYSTEM MANAGER	spoolsvc.exe	"Added by the MYTOB-LY WORM!"
X	Windows System Manager	winsysmgr.exe	"Added by the IRCBOT.BJG BACKDOOR!"
X	Windows System Manager Loader	smsls.exe	"Added by the AGOBOT.TF WORM!"
X	Windows System Manager Proc	winsmc.exe	"Added by the RBOT.JH WORM!"
X	WINDOWS SYSTEM MEMORY LOADER	memloader.exe	"Added by the MYTOB-IN WORM!"
X	WINDOWS SYSTEM mscdvvs	mscdvvs.exe	"Added by the MYTOB.MD WORM!"
X	windows system notepad	wnpsm.exe	"Added by a variant of the RBOT WORM!"
X	Windows System Restore Configuration	Sblhost.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows System Restorer	SystemRestorer.exe	"Added by the DULOAD.C WORM!"
X	WINDOWS SYSTEM SCALPE	scalpe91.exe	"Added by the MYTOB-HI WORM!"
X	Windows System Security	winmp.exe	"Added by the RBOT.IV WORM!"
X	Windows System Security	sys32.pif	"Added by the RBOT-AOL WORM!"
X	Windows System Security Monitor	[4 random letters].exe	"Added by the PINKTON.A WORM!"
X	Windows System Serivce	winserv.exe	"Added by the RBOT.ACA WORM!"
X	windows system service	winsock.exe	"Added by the RBOT-MR WORM!"
X	Windows System Service	wnuserv.exe	"Added by the SPYBOT.ANDM WORM!"
X	Windows System Service	[worm filename]	"Added by the RBOT.XG WORM!"
X	Windows System Suite	WS[random characters].exe	"Windows System Suite rogue security software - not recommended
U	Windows System Tray	msni.exe	"Iambigbrother monitoring software"
X	Windows System Tray	swhost.exe	"Added by an unidentified VIRUS
X	WINDOWS SYSTEM UPDATE	xDcc.exe	"Added by the MYOTB-EH WORM!"
X	Windows System Update Tools	upds.exe	"Added by the VANBOT.CX BACKDOOR!"
X	Windows System-Control Drivers	syscontrl.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows System32	windowsp.exe	"Added by the MYTOB.GD WORM!"
X	Windows System32	winsys32.exe	"Added by the SDBOT-AHS WORM!"
X	Windows System32	clsas32.exe	"Added by the RBOT-AZO WORM!"
X	Windows System32	explorer.exe	"Added by the OPANKI-V WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is also copied to %System%"
X	Windows System32	System32.exe	"Added by the SDBOT-ALI WORM!"
X	Windows SYSTEM32	Realplayer.exe	"Added by the SPYBOT.ZH WORM!"
X	Windows System32	wingrd32.exe	"Added by a variant of the RBOT WORM!"
X	Windows System32	windows32.exe	"Added by the RBOT-FPB WORM!"
X	Windows System32 Driver	clsass32.exe	"Added by the SDBOT-AGG WORM!"
X	Windows System32 Kernel	system32.exe	"Added by the SDBOT-AAT WORM!"
X	Windows SystemDll	SYSTEMDLL.EXE	"Added by the AGOBOT-LP WORM!"
X	WINDOWS SYSTEMn	servicces.exe	"Added by the MYTOB-EL WORM!"
X	Windows Systemnmg	stagmr.exe	"Added by the MYTOB.S WORM!"
X	Windows Systems16	winjews16.exe	"Added by the SDBOT-CXT WORM!"
X	Windows SYStry	spoolsvr.exe	"Added by the SDBOT.GN BACKDOOR!"
X	Windows SYStry	systry.exe	"Added by the SDBOT-E WORM!"
X	Windows Sz Host	winshvc.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Task Manager	ACCOUNT_DETAILS.DOC.exe	"Added by the QUATERS.A WORM!"
X	Windows Task Manager	taskmgn.exe	"Added by the AGENT-CIP BACKDOOR!"
X	Windows Task Manager	taskmrg.exe	"Added by the MYTOB.AV WORM!"
X	Windows Task Manager	taskgmr.exe	"Added by the MYTOB.BJ WORM!"
X	Windows Task Manager	taskmg.exe	"Browser hijacker - identified by DrWeb antivirus as ""Trojan.StartPage.601"""
X	Windows Task Manager	taskmngr.exe	"Added by the RBOT-ANM WORM!"
X	Windows Task Manager Emulator	kennewr.exe	"Added by the SPYBOT-FA WORM!"
X	Windows Task Mgr	mstasks.exe	"Added by the IRCBOT.UN BACKDOOR!"
X	Windows Task Mgr!	mstasker.exe	"Added by the IRCBOT.OE BACKDOOR!"
X	Windows Task Scheduler	asijdie.exe	Added by an unidentified WORM or TROJAN!
X	Windows Task Service (32-bits)	tasksys.exe	"Added by the DREFIR.D WORM!"
X	Windows TaskAd	Wintaskad.exe	Windupdates adware variant
X	Windows Taskbar Manager	internat.exe	"Added by the PROTORIDE-H WORM!"
X	Windows Taskbar Manager	[path to file]	"Added by the PROTORIDE.B WORM!"
X	Windows Taskbar System	tasksys.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Taskmanager	lsassx.exe	"Added by the KELVIR.E WORM!"
X	Windows Taskmanager	iexplorer.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Windows Taskmanager	service.exe	"Added by the PUSHBOT.OR WORM!"
X	Windows Taskmanager	svchost.exe	"Added by the IMBOT.AC WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Taskmanager	taskmrg.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Taskmanager	taskngr.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Taskmanager	tskmngr.exe	"Added by the IRCBOT.DHR BACKDOOR!"
X	Windows Taskmanager	wdtsvc.exe	"Added by the PUSHBOT.AU WORM!"
X	Windows Taskmanager	winpifviewer.exe	"Added by the PUSHBOT.BB WORM!"
X	Windows Taskmanager	winrl.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Taskmanager	taskxphost.exe	"Added by the PUSHBOT.BI WORM!"
X	Windows Taskmanager Data	csrrss.exe	"Added by the RBOT-BBH WORM!"
X	Windows TaskManager Service	windns32.exe	"Added by the AGOBOT-JP WORM!"
X	Windows TCP/IP	wintcp.exe	"Added by the AGOBOT-ZH WORM!"
X	Windows Telnet Server	wintel.exe	"Added by the AGOBOT-MW WORM!"
X	Windows Temperate Services	wintmp.exe	"Added by the SLENFBOT.ZW WORM!"
X	Windows Terminal Manager	rmbsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Time	tmservice.exe	"Added by a variant of the RBOT-YK WORM!"
X	Windows Time	winmgr.exe	"Added by the RBOT-XC WORM!"
X	Windows Time Server	TimeSRV.exe	"Added by the SPYBOT.DNC WORM!"
X	Windows Time Service Diagnostic Tool	winscrvs.exe	"Added by the RBOT.FTV BACKDOOR!"
X	Windows TM	SVPHOST.exe	"Added by a variant of the RBOT WORM!"
X	Windows TM	rundlI32.exe	"Added by the RBOT.EL BACKDOOR!"
X	Windows TM	windowssys32.exe	"Added by a variant of the RBOT WORM!"
X	Windows TM	WinxSys.exe	"Added by a variant of the RBOT WORM!"
X	Windows TM	pdpatbcyj.exe	"Added by the RBOT.FEF WORM!"
X	Windows TM	Syss.exe	"Added by the RBOT.ADF BACKDOOR!"
X	Windows Tracking Client	ctwsvc.exe	"Added by the AGENT-GMB TROJAN!"
X	Windows UDP	winudp.exe	"Added by the IRCBOT.GAT WORM!"
X	Windows UDP Control	winudspm.exe	"Added by a variant of the SDBOT WORM! See here"
X	Windows UDP Control Center	auth.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	ehSched.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	fxstaller.exe	"Added by the AGENT-IEE TROJAN!"
X	Windows UDP Control Center	installer.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows UDP Control Center	msnmngs.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	msnpd.exe	"Added by the SDBOT.EBA BACKDOOR!"
X	Windows UDP Control Center	mswinudpmgr32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	scvhost.exe	"Added by the PUSHBOT.EH WORM!"
X	Windows UDP Control Center	taksmrg.exe	"Added by the AGENT.WOH TROJAN!"
X	Windows UDP Control Center	tmps.exe	"Added by the SDBOT.EBA BACKDOOR!"
X	Windows UDP Control Center	winlive32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	winmsn.exe	"Added by the SDBOT.EBA BACKDOOR!"
X	Windows UDP Control Center	winrofl32.exe	"Added by the LDPINCH-RZ TROJAN!"
X	Windows UDP Control Center	winudpmg.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	winudpmgrs.exe	"Added by the DROPPER.CMV TROJAN!"
X	Windows UDP Control Center	winudpmsgr.exe	"Added by the SDBOT.GAV WORM!"
X	Windows UDP Control Center	winupmgr.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	winuscn32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	wksvcsc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	winudpmgr.exe	"Added by the DLOADR-HQL TROJAN!"
X	Windows UDP Control Center	fxsteller.exe	"Added by the IRCBOT-J BACKDOOR!"
X	Windows UDP Control Center	msnsmsgrs.exe	"Added by the PUSHBOT.MF WORM!"
X	Windows UDP Control Center	winmgrs.exe	"Added by the PUSHBOT.MY WORM!"
X	Windows UDP Control Manager	winudpmgr.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Services	wksvcsc.exe	"Added by the ANTIAV-C TROJAN!"
X	Windows Upate	rundll.exe	"Added by the HAKO TROJAN! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	Windows Update	[filename]	"Added by the NORIO TROJAN! Acts as a hi-jacker redirecting to adult content sites"
X	Windows Update	iexplorere.exe	"Added by the GAOBOT.AP WORM!"
X	windows update	uddater.exe	"Added by the LEOX TROJAN!"
X	Windows Update	wudate.exe	"Added by the AGOBOT.ML WORM!"
X	Windows Update	wupdate.exe	"Wengs adware"
X	windows update	sychost.exe	"Added by the LEOX.B WORM!"
X	Windows Update	Wuamgrd.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Update	inetinf.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Windows Update	WindowsUpdate.exe	"Added by the BAYROB-A TROJAN!"
X	Windows Update	host32.exe	"Added by the RBOT-GU WORM!"
X	windows update	wuraclt.exe	"Added by the RBOT-PO WORM!"
X	windows update	Wuanclt.exe	"Added by the RBOT.XZ WORM!"
X	Windows Update	svchosts.exe	"Added by the FRUCTA TROJAN!"
X	Windows Update	ebay.exe	"Added by the GAOBOT.BUU WORM!"
X	Windows Update	windows.exe	"Added by the RBOT-RB WORM!"
X	windows update	wuaurlt.exe	"Added by the RBOT.ADG WORM!"
X	Windows Update	Update.exe	"Added by the DELF-FN TROJAN!"
X	Windows Update	winmguard.exe	"Added by the RBOT-EM WORM!"
X	Windows Update	wuampd.exe	"Added by the RBOT.UM WORM!"
X	windows update	wuarclt.exe	"Added by the RBOT-OF WORM!"
X	Windows Update	winupdate.exe	"Added by the SDBOT-WS WORM!"
X	Windows Update	msnwinsb.exe	"Added by the RBOT-AAH WORM!"
X	Windows Update	scvhost.exe	"Added by the SDBOT-XT WORM!"
X	windows update	Microsoft.exe	"Added by the LMIR.A TROJAN!"
X	Windows Update	mplupdate.exe	"Added by the MOEGA WORM!"
X	windows update	msnsever.exe	"Added by the RBOT-AHN WORM!"
X	Windows Update	taskmr.exe	"Added by the MYTOB-GZ WORM!"
X	Windows Update	update32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update	wininfo.exe	"Added by the MYTOB.GA WORM!"
X	Windows Update	winlogin.exe	"Added by the BANKER-DV TROJAN!"
X	Windows Update	msnupdates.exe	"Added by the RBOT-ALK WORM! Note - this file has nothing to do with Windows updates or MSN"
X	Windows Update	qtask.exe	"Added by the RBOT-AKU WORM! Note - do not confuse with the Quicken file of the same name as described here"
X	windows update	real.exe	"Added by the LEGMIR-AU WORM!"
X	Windows Update	windowsx.exe	"Added by the BANCD-A TROJAN!"
X	Windows update	wudupdate.exe	"ISTBar adware related"
X	Windows Update	wupdmgr.exe	"Added by the BANCBAN-FC TROJAN and variants!"
X	Windows Update	csrss.exe	"Added by the BANKER-HM TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Update	msnsupdate.exe	"Added by the RBOT-AXS WORM!"
X	Windows Update	XPLoogNT.exe	"Added by the BANCD-B TROJAN!"
X	Windows Update	install.exe	"Added by the BANKER-IB TROJAN!"
X	Windows Update	msi.exe	"Added by the BANKER-XB TROJAN!"
X	Windows Update	Sqltob.exe	"Added by the DASHER.A WORM!"
X	windows update	logonuit.exe	"Added by the LEGMIR-AO TROJAN!"
X	Windows Update	avkir.exe	"Added by the RBOT-GJP WORM!"
X	Windows Update	easypwnt.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update	MSDEVS30.exe	Added by the SPYBOT.AHC WORM!
X	Windows Update	SecretStub.exe	"Added by the SRAMLER.C WORM!"
X	Windows Update	Winload.exe	"Added by the DEDMIR-A WORM!"
X	Windows Update	taskngr.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Update	usnsvc.exe	"Added by the KOBOT-C WORM!"
X	Windows Update	win32update.exe	"Added by the SDBOT.FTK WORM!"
X	Windows Update	livesrvs.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update	McAfee.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not a valid McAfee program"
X	Windows Update	McAfee3.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Windows Update	msconfig32.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows Update	msnsa32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Update	scrigz.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Update	winsc.exe	"Added by the BUZUS.RYI TROJAN!"
X	Windows Update	wuauclt32.exe	"Added by the SDBOT.DHY WORM!"
X	Windows Update	dllhostup.exe	"Added by the BANCBAN-NB TROJAN!"
X	Windows Update	explored.exe	"Added by the GAOBOT.MF WORM!"
X	Windows Update	smsscr.exe	"Added by the BANKER-DK TROJAN!"
X	Windows Update	sysdrv.exe	"Added by the AGENT-IYE TROJAN!"
X	Windows Update	winupupdate1.exe	"Added by the RBOT-UV WORM!"
X	Windows Update	klass.exe	"Added by the BIFROSE-ZH TROJAN!"
X	Windows Update	winlogonEvt.exe	"Added by the VB-DXM TROJAN!"
X	Windows update	explore.exe	"Added by the GAOBOT.AL WORM!"
X	Windows Update	fdos.exe	"Added by the RBOT-COG WORM!"
X	Windows Update	leak32x.exe	"Added by the AGENT.ALY BACKDOOR!"
X	Windows update	msb32.exe	"Added by the GAOBOT.CG WORM!"
X	Windows update	svdhost.exe	"Added by the GAOBOT.CG WORM!"
X	Windows Update	tskmngr.exe	"Added by the AGENT.ALY BACKDOOR!"
X	Windows Update	windb32.exe	"Added by the AGENT.ALY BACKDOOR!"
X	Windows update 2005	[random filename]	"Added by the RBOT.ARP WORM!"
X	Windows Update 32	winlogons.exe	"Added by the FORBOT-FI WORM!"
X	Windows Update 32	rempss.exe	"Added by the FORBOT-FW WORM!"
X	Windows Update 32	slsys.exe	"Added by the FORBOT-FT WORM!"
X	Windows update 32bit	winupd32.exe	"Added by the SDBOT.BE WORM!"
X	Windows Update 63	shupd64.exe	"Added by the FORBOT-GA WORM!"
X	Windows Update 64	nbupd64.exe	"Added by a variant of the FORBOT WORM!"
X	Windows Update 64	WinV.exe	"Added by the FORBOT-FP WORM!"
X	Windows Update Auto Update	wuaumgr.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Update Automatic Updates	[path to backdoor]	"Added by the VBBOT.AM BACKDOOR!"
X	Windows Update Automation	winuptdate.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update AutoUpdate Client	waucult.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update AutoUpdate Client	wuauclt.exe	"Added by the LAZAR.B TROJAN! Note - this is not the legitimate wuauclt.exe process
X	Windows Update AutoUpdate Client Product	wuauct.exe	"Added by the AGOBOT.ACL WORM!"
X	Windows Update Center	svthx.exe	"Added by the STUBBOT.A WORM!"
X	Windows Update Center	W32RSA.exe	Added by an unidentified WORM or TROJAN!
X	Windows Update Check	syslodr.exe	"Added by the SMALL.LU TROJAN!"
X	Windows Update Checker	[random filename]	Adware downloader trojan
X	Windows Update Checker	msupdte32.exe	"Added by the SDBOT-AEF WORM!"
X	Windows Update Checker	deinst_qfe001.exe	Added by a variant of the Win32.Small TROJAN!
X	Windows Update Checker	deinst_qfe002.exe	Added by a variant of the Win32.Small TROJAN!
X	Windows Update Client	wuclient.exe	"Added by the SMALL-RN TROJAN!"
X	Windows Update Client Service	windrvl32.exe	"Added by the AGOBOT-MM TROJAN!"
X	Windows update config	svhost.exe	"Added by the SDBOT-PF WORM!"
X	windows update configurator	svghost.exe	"Added by a variant of the SPYBOT WORM!"
X	windows update configurator	explore.exe	"Added by the SDBOT.RY BACKDOOR!"
X	Windows Update Controller	mwoffice.exe	"Added by the BATTRY-A TROJAN!"
X	Windows Update Draven	draven.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update Drive	updrvs.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update Files	dnetc.exe	"Added by an unidentified VIRUS
X	Windows Update Firewall System	ctfmoom.exe	"Added by the RBOT-GAN WORM!"
X	Windows Update Firewall System	winmsfw.exe	"Added by the RBOT-EEO WORM!"
X	Windows Update Firewall System	ctfmom.exe	"Added by the SPYBOT.ANDM WORM!"
X	Windows Update GUI Executable x32x	wupdategux32.exe	"Added by the RBOT.CXY WORM!"
X	Windows Update Host	winupsvc.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update IPv6 Layer	WIN32IPV6.EXE	"Added by the RBOT.DUD WORM!"
X	Windows update loader	xpupdate.exe	"Malware installed by different rogue security software including SpyKillerPro. Also detected as the BRAVE-A TROJAN!"
X	Windows Update Manager	wupdmngr.exe	"Added by the RANDEX.BTB WORM!"
X	Windows Update Manager	Winlog0n.exe	"Added by the AGENT-BO TROJAN!"
X	Windows Update Manager	wupdate.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update Manager	bootwiz.exe	Added by the MYBOT WORM!
X	Windows Update Manager	WindowsUpdateManager.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Update Manager for NT	wupdmgr32.exe	"Added by the SDBOT.AH WORM!"
X	windows update microsoft	updatem.exe	"Added by the RBOT-CHE WORM!"
X	Windows Update Monitoring Service	winupdt.exe	"Added by the RBOT-PL WORM!"
X	Windows Update Process	wmiprvsc.exe	"Added by the SDBOT-CB WORM!"
X	Windows Update Service	csrs.exe	"Added by the AGOBOT-NI WORM!"
X	Windows Update Service	smcg.exe	"Added by the SDBOT.QY WORM!"
X	Windows Update Service	SP00ISS.exe	"Added by the SDBOT-ZH WORM!"
X	Windows Update Service	update32.pif	"Added by the RBOT-ALC WORM!"
X	Windows Update Service	trest.exe	Identified by BitDefender as a variant of the PEED TROJAN!
X	Windows Update Service	wmiprvse32.exe	"Added by the AGOBOT.NI WORM!"
X	Windows Update Service	regscv.exe	"Added by the AGOBOT-AM BACKDOOR!"
X	Windows Update Service	msupdate32.exe	"Added by the DLOADR-CRJ TROJAN!"
X	Windows Update Service 2004/2005	systemupdate.exe	"Added by the RBOT-JE WORM!"
X	Windows Update services	wins32svcs.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update Services	winupdate32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update Software	system.exe	"TOFGER.BX spyware"
X	Windows Update SP3	Windat.EXE	"Added by the RBOT-GTS WORM!"
X	Windows Update Svc	rundll32.exe xpupdate.dll	"ContraVirus rogue security software - not recommended
X	Windows Update System	mswins.exe	"Added by the IRCBOT.DN WORM!"
X	Windows Update System Shell	svhostcs32.exe	"Added by the RBOT-AAZ WORM!"
X	Windows Update V6	[random filename]	"Added by the RBOT-KT WORM!"
X	Windows Update.exe	N/A	Homepage hijacker
X	Windows Updated	spoolsae.exe	"Added by the RBOT-APM WORM!"
X	Windows Updated	updatr.exe	"Added by the RBOT-AYB WORM!"
X	Windows Updater	wupdmgr32.exe	"Added by a variant of the DOS.AUTOCAT TROJAN!"
X	Windows Updater	iexplorerrs.exe	"Added by the RBOT-TN WORM!"
X	Windows Updater	svigost.exe	"Added by the RBOT-VS WORM!"
X	Windows Updater	wupdate.exe	"Added by the WOOTBOT.AJ WORM!"
X	Windows Updater	sdsys.exe	"Added by the FORBOT-JG WORM!"
X	Windows Updater Online	winupdatexx.exe	"Added by a variant of the RBOT WORM!"
X	Windows Updater Servc	xpuupdate.exe	"ContraVirus rogue security software - not recommended
X	Windows Updater Service Manager	winupdatr.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Updater Services	msnupdate.exe	"Added by a variant of the RBOT WORM!"
X	windows updaters	winupdats.exe	"Added by the SPYBOT-IS WORM!"
X	Windows Updates	lsassx.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Updates	winupd32.exe	"Added by the MYTOB.CE WORM!"
X	Windows Updates	w32dns.exe	"Added by the SDBOT-BFW WORM!"
X	Windows Updates Agent	winupdate.exe	"Added by the SPYBOT.HW WORM!"
X	Windows Updating Service	updating.pif	"Added by the RBOT-ALW WORM!"
X	Windows Updtee Mgnr	W1NT45K.exe	"Added by the MYTOB.DC WORM!"
X	Windows Upgrate Utility	winulty.exe	"Added by the AUTORUN-ASR WORM!"
X	Windows USB 2.0 Driver	usbtskmgr.exe	"Added by the RBOT-BKG WORM!"
X	Windows USB 2.0 Driver	usb2ctrl.exe	"Added by the RBOT-BIW WORM!"
X	Windows USB 2.0 Driver	usbservice.exe	"Added by the RBOT-BLF WORM!"
X	Windows USB Control Driver	iexplore.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows USB controler	winusb.exe	"Added by the RBOT-HR WORM!"
X	Windows USB Driver Support	Windowsusb.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows USB Hub Manager	usbhub.exe	"Added by the RBOT-BJX WORM!"
X	Windows USB Monitor	servupdate.exe	"Added by the IRCBRUTE.AQ TROJAN!"
X	Windows USB Printer	exe.exe	"Added by a variant of the RBOT WORM!"
X	Windows USB Printer	unqgod.exe	"Added by the RBOT.BKC BACKDOOR!"
X	Windows USB Printer	xqteby.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows USB Service	666.exe	"Added by the MYTOB.AR WORM!"
X	Windows USB v3	wsvc.exe	"Added by a variant of the SDBOT WORM!"
X	Windows USBD	msifirewall.exe	Added by an unidentified WORM or TROJAN!
X	Windows User Mode Driver Manager	wdfmrg.exe	"Added by the SDBOT-ZN WORM!"
X	Windows User Starter	winuser32.exe	"Added by the RBOT.SN WORM!"
N	Windows Version Check	ver_chk.exe	"Version checker for CyberAudioLibrary - ""a new way to exchange information through the Internet"""
X	Windows Version Service	sysvers.exe	"Added by the SLENFBOT.IF WORM!"
X	Windows Version Service	sysvers32.exe	"Added by the SLENFBOT.HZ WORM!"
X	Windows video	vide_32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Windows Video Acquisition (WVA)	wvsvc.exe	"Added by the AGOBOT.YM WORM!"
X	Windows Video Component	wvcsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Video Drivers	videons32.exe	"Added by the GAOBOT.AZT WORM!"
X	Windows Video Drivers	VIDEONS3.EXE	"Added by the AGOBOT-KZ BACKDOOR!"
X	Windows Video Input	viwsvc.exe	"Added by the SLENFBOT.GS WORM!"
X	Windows Virtual Manager	vmnat.exe	"Added by the SILLYFDC.BCB WORM!"
X	Windows Virtual Services	winvirtual.exe	"Added by the SLENFBOT.IE WORM!"
X	Windows Virtual Services	winvirtual32.exe	"Added by the SLENFBOT.IB WORM!"
X	Windows Virus Control	plou.exe	"Added by the SDBOT-ACZ WORM!"
X	Windows Virus Scanner	winvsvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Vista Corparation Agent Services	winxp_sp3.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Vista Transformation	IEXPLORE.exe	"Added by the FORBOT-GV WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows Volume Control	ongsvc.exe	"Added by the SLENFBOT.DZ WORM!"
X	Windows Web Services	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Winhlp32 Stub Service	winhlp32.pif	"Added by the AIMBOT.AH TROJAN!"
X	Windows WKS	wsass.exe	"Added by the SDBOT-DK WORM!"
X	Windows WKS Services	wkssvr1.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows WMF Fix	winfix.exe	"Added by the RBOT-FTQ WORM!"
X	Windows Workstation	mpci.exe	"Added by a variant of the RBOT WORM!"
X	Windows Workstation	msup32a.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Workstation Service	explore.exe	Added by unknown malware
X	Windows Workstation Service	wkssvc.exe	"Added by the IRCBOT-AAI WORM!"
X	Windows Workstation Service (32-bits)	wkssvc32.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Workstation Service [5.1-2600]	windrm.exe	"Added by the RBOT-CNY WORM!"
X	Windows Workstation Start Service	mslanmgr.exe	"Added by a variant of the RBOT WORM!"
X	Windows Xp	nortonguard.exe	"Added by the MYTOB-DZ WORM!"
X	Windows xp	Wins.exe	"Added by the RBOT.VH BACKDOOR!"
X	Windows XP Automatic Update	wXPupdate.exe	"Added by the RBOT-AFC WORM!"
X	Windows Xp Service Pack 2	svchost.exe	"Added by the XPLOS-A TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	Windows XP SP2 KeyGen	Windows XP SP2 KeyGen.exe	"Added by the TIBICK-C WORM!"
X	Windows Zero Spooler	nmvcs.exe	"Added by the SLENFBOT.JQ WORM!"
X	Windows-System	System32.exe	"Added by the LOGPOLE.C WORM!"
X	Windows-TCP-IP	rfkampig.exe	"Added by the GIPMA TROJAN!"
X	Windows-Xdate	wuamclt32.exe	"Added by the SPYBOT.AMUV WORM!"
X	Windows-XP-Service-Pack	xpspz.exe	"Added by the SDBOT-AAC WORM!"
X	windows16	windows16.exe	"Added by the VB-XU TROJAN!"
X	Windows32	rundll.exe	"Added by the AGOBOT-LK or AGOBOT-ND WORMS! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	windows32	windows32.exe	"Added by the VB-XU TROJAN!"
X	Windows32	wuuaclt.exe	"Added by the BRATLE.B WORM!"
X	Windows32	win.exe	"Added by the AGOBOT-KN WORM!"
X	Windows32	system.exe	Unknown malware
X	Windows32 Configuration Loader	msrf32.exe	"Added by the SDBOT-ABX WORM!"
X	Windows32 Messenger Service	msmsgv.exe	"Added by the RBOT.ANS WORM!"
X	Windows32 Net Database	msnd32.exe	"Added by the RBOT-AAL WORM!"
X	Windows32 Serivces	winser32.exe	"Added by the SPYBOT.AAF WORM!"
X	Windows32KernelStart	wks.exe	"Added by the LAPURD TROJAN!"
Y	Windows7FirewallControl	Windows7FirewallControl.exe	"Windows 7 Firewall Control from Sphinx Software - ""Protects your applications from undesirable network incoming and outgoing activity
X	WindowsACEbar	acebarupdate.exe	"BarACE adware"
X	WindowsAgent	WindowsAgent.exe	"Added by the GOP.G WORM!"
X	WindowsAgent	sysexhook.exe	"Added by the GOP keyboard logger/TROJAN!"
X	WindowsAPI.DLL	Server5.exe	"Added by the ""Fear and Hope"" TROJAN!"
X	WindowsAudio	systemupd.exe	"Added by the AGENT-TH WORM!"
X	WindowsBackup	WINDOWSBACKUP.EXE	"Added by the STANG WORM!"
X	WindowsBool	aimplg.exe	"Added by the SDBOT-CNG WORM!"
X	WindowsCRC	wscrc.exe	"Added by the SDBOT-VU WORM!"
X	WindowsCriticalUpdate	windows_critical_update.exe	"Added by the ASTEF or RESPAN WORMS!"
X	WindowsD	s1.exe	"Added by the MSNDIABLO.A WORM!"
X	WindowsDiskEvt	svcsvh32.exe	"Added by the NANINF.D TROJAN!"
X	WindowsDiskLog	cstsm.exe	"Added by the STINX-C or STINX-D TROJANS!"
X	WindowsExplorer	csrss.exe	"Messenger Blocker rogue security software - not recommended. Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\System"
X	WindowsExplorer	svchost.exe	"Messenger Blocker rogue security software - not recommended. Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\System"
X	WindowsFileSystem	winsfs32.exe	"Added by the RBOT-FMQ WORM!"
X	WindowsFileSystem	cidaemon32.exe	"Added by the RBOT-FSP WORM!"
X	WindowsFirewall	lsass.exe	"Messenger Blocker rogue security software - not recommended. Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\System"
X	WindowsFirewallSvc	winsvcup.exe	"Added by a variant of the SDBOT WORM!"
X	WINDOWSflashbrg	sqldata1.exe	"Added by a variant of the AGENT-IC TROJAN!"
X	WindowsFS	winfs.exe	"Added by the AGOBOT-BO WORM!"
X	Windowsfw	vssmf32.exe	"Added by the SPIGOT BACKDOOR!"
X	Windowsfw	windowsfw.exe	"Added by the AGOBOT-TA WORM!"
X	WindowsFY	wp.exe	"Part of a ""Security IGuard"" parasite infestation - also detected as DESKTOPHIJACK"
X	WindowsFY	bsw.exe	"Added by a variant of the DESKTOPHIJACK TROJAN! For removal see here"
X	WindowsFY	[path to trojan]	"Added by the FAKEALE-E TROJAN!"
X	WindowsFZ	[path to file]	"Added by the DESKTOPHIJACK VIRUS! Also see DESKTOPHIJACK.B TROJAN!"
X	WindowsFZ	A5281300.so	"Variant of the SmitFraud alias FAKEALE-C TROJAN!"
X	WindowsFZ	zloader3.exe	"Variant of the SmitFraud alias FAKEALE-C TROJAN!"
X	WindowsHive	rpcc.exe	"Added by the DLENA-A TROJAN!"
X	WindowsInstaller	[path to file]	"Added by the DEDLER-D TROJAN! The most common filenames seen are ""csmss.exe"" and ""csmrs.exe""
X	WindowsIPRelay	winipsvc.exe	"Added by the IRCBOT-AAA WORM!"
X	Windows�Updates	Update.exe	"Added by the RBOT.TRA BACKDOOR!"
X	WindowsK	a1.exe	"Added by the MSNDIABLO.A WORM!"
X	WindowsKeyUpdate	master.exe	"Added by the JOSAM WORM!"
X	WindowsMGM	Winmgm32.exe	"Added by the SOBIG.A WORM and LALA.C TROJAN!"
X	windowsmp	windowsmp.exe	"Added by the AUTORUN-DP WORM!"
X	WindowsNT CWServices	CWServices.com	"Detected by Bitdefender as the AGENT.AGDK TROJAN! See here"
X	WindowsNT Services	Services.com	"Detected by Bitdefender as the DELF.OFC TROJAN! See here"
X	WindowsProtocolLog	lsadst.exe	"Added by the NANINF.C TROJAN!"
X	WindowsReg% update	[random filename].exe	"Added by the RBOT-HH WORM!"
X	WindowsRegistration	[random filename]	"Added by the RBOT-NO WORM!"
X	WindowsRegKey Autoupdate	[random filename]	"Added by a variant of the RBOT WORM!"
X	WindowsRegKey upd4te2d4te	*********.exe [* = random char]	"Added by the RBOT.XQ WORM!"
X	WindowsRegKey update	winupdate.exe	"Added by the RBOT-QJ WORM!"
X	WindowsRegKey update	windns.exe	"Added by the RBOT.IE WORM!"
X	WindowsRegKey update	winupdatexx.exe	"Added by the RBOT.LW WORM!"
X	WindowsRegKey update	[random filename]	"Added by the RBOT.QT WORM!"
X	WindowsRegKey update	svchoosts.exe	"Added by the RBOT.ADB WORM!"
X	WindowsRegKey update	svchostc.exe	"Added by the RBOT.IF WORM!"
X	WindowsRegKey update	wdnupdate.exe	"Added by the SDBOT.QX WORM!"
X	WindowsRegKey update	Windowsup.exe	"Added by the SDBOT.PU WORM!"
X	WindowsRegKey update	WINUPDATES.EXE	"Added by the RBOT-MM WORM!"
X	WindowsRegKey update	rkbuouoxfl.exe	"Added by the RBOT-OO WORM!"
X	WindowsRegKey update	winsys.exe	"Added by the RBOT-JY WORM!"
X	WindowsRegKey update	winupdat32.exe	"Added by the RBOT-AGW WORM!"
X	WindowsRegKey update XP	windexv1.exe	"Added by the RBOT-ABM WORM!"
X	WindowsRegKey%$ update	msi332.exe	"Added by the RBOT-IX WORM!"
X	WindowsRegKey%update	ethernet32m.exe	"Added by the RBOT-EN WORM!"
X	WindowsRegKeys update	winsysi.exe	"Added by the SDBOT.WE WORM!"
X	Windowss Service Agent	mssngear.exe	"Added by the RBOT.KGU BACKDOOR!"
X	WindowsService	[random name].dll	"Added by the VUNDO-X TROJAN!"
X	WindowsServicesH	servicedhs.exe	"Added by the AGOBOT-JD WORM!"
X	WindowsServicesStartup	svchost.exe	"Added by the ECUP WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
X	WindowsSetup	[path to trojan]	"Added by the EZBOT TROJAN!"
X	WindowsSp2	sp2.exe	"Added by the POSSE WORM!"
X	WindowsSystem32	asper.exe	"Added by the AGENT-EFP TROJAN!"
X	WindowsSystem32	svchosts.exe	"Added by the AGENT-EDA TROJAN!"
X	WindowsSystem32	[path to worm]	"Added by the SDBOT-DFG WORM!"
X	WindowsSystem32	msnmssgr.exe	"Added by the AGENT.ALY BACKDOOR!"
X	WindowsSystem32	msn_kilo.exe	"Added by the AGENT.ALY BACKDOOR!"
X	WindowsSystem32	msnmgaer.exe	"Added by the AGENT.ALY BACKDOOR!"
X	windowstime.exe	windowstime.exe	"Added by the DLOADR-AQV TROJAN!"
U	WindowsTranslator	DWinTrsl.exe	"Delta Translator® English < > Portugese (Brazilian) version - ""an automatic
U	WindowsTranslator_Espanhol	DWinTrsl.exe	"Delta Translator® Spanish < > Portugese (Brazilian) version - ""an automatic
X	WindowsUpd	WindowsUpd4.exe	"VirtuMonde adware"
X	WindowsUpd1	WindowsUpd1.exe	"VirtuMonde adware"
X	WindowsUpd2	WindowsUpd2.exe	"VirtuMonde adware"
X	WindowsUpdate	windows_update.exe	"Added by the LOFNI WORM!"
X	WindowsUpdate	svchost.exe	"Added by the ASTEF or RESPAN WORMS or AGENT-V TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	windowsupdate	RPC[RANDOM CHARACTERS].exe	"Added by the IRCBOT.B TROJAN!"
X	WindowsUpdate	USRINIT.EXE	"Added by the MADDIS.B WORM!"
X	windowsupdate	winupdate.exe	"Added by the WARPI WORM!"
X	WindowsUpdate	svchost.exe	"Added by the BDOOR-IK BACKDOOR! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	WindowsUpdate	winnnint.exe	Added by an unidentified WORM or TROJAN!
X	WindowsUpdate	[path to file]	"Added by the DUPA-B TROJAN!"
X	WindowsUpdate	svchostw.exe	"Added by the COBFINN_B TROJAN!"
X	WindowsUpdate	Nzil.exe	"Added by the CULLER-C WORM!"
X	WindowsUpdate	Strad.exe	"Added by the CULLER-D WORM!"
X	Windowsupdate	Windowsupdate.exe	"Added by the BANKER.ARK TROJAN!"
X	Windowsupdate	wupdmgr98.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	WinDOwsUPdate	smss.exe	"Added by the AUTORUN.DIB WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~� subfolder"
X	windowsupdate	autoupdate.exe	"Added by the IRCBOT-P BACKDOOR!"
X	WindowsUpdate	svdhost.exe	"Added by the AGOBOT-BP WORM!"
X	WindowsUpdate	twain.exe	"Added by the AGENT.BEA TROJAN!"
X	WindowsUpdate renew	iexplore.exe	"Added by the AGENT.QG TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	WindowsUpdate Service	wuautlc.exe	"Added by the RBOT-NR WORM!"
X	Windowsupdate Service	csrss.exe	"Added by the BABA-B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in the root folder (ie
X	WindowsUpdatecrss	crss.exe	"Added by a variant of the AGENT-HZ TROJAN!"
X	WindowsUpdateDirect	dupadirect.exe	"Added by the DUPA-C TROJAN!"
X	WindowsUpdatelsasss	lsasss.exe	"Added by a variant of the AGENT-HZ TROJAN!"
X	WindowsUpdatem1	[path to file]	"Added by the AGENT-AAJ TROJAN!"
X	WindowsUpdatem2	svchost.exe	"Added by an unidentified WORM or TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	WindowsUpdateManager	wupdmng.exe	"Added by the IRCBOT.OE BACKDOOR!"
X	WindowsUpdateNT	svwhost.exe	"Added by the SHELLOT-B TROJAN!"
X	WindowsUpdateR	regserv.exe	"Added by the COBFINN_B TROJAN!"
X	WindowsUpdatesvchostss	svchostss.exe	"Added by the AGENT-HZ TROJAN!"
X	WindowsUpdatev4	w32gins.exe	"Added by an unidentified WORM or TROJAN! Located in the Root folder (C:\)
X	WindowsUpdatewinsec	winsec.exe	"Added by a variant of the AGENT-HZ TROJAN!"
N	WindowsWelcomeCenter	"rundll32.exe oobefldr.dll	ShowWelcomeCenter"
X	WindowsXP Module	DirectX3D.exe	"Malware
X	WindowsXp Security	spool.exe	"Added by the RBOT-GRK WORM!"
X	WindowsXP Update	windowsxpupdate.exe	"Added by the RBOT-PB WORM!"
X	WindowsXPserv	svcnxp32.exe	"Addee by the NANINF-A TROJAN!"
X	windowsxxx	windowsxxx.exe	"Added by the DUBING-A TROJAN!"
X	windowsxxx2	windowsxxx2.exe	"Added by the DUBING-A TROJAN!"
X	Windows_LowLevel_Security_Core	lsass.exe	"Added by the PADMIN-A TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Repair"
X	Windows_Protect	winsystem.exe	"Added by a variant of the RBOT WORM!"
X	Windows_Protect	winregal.exe	"Added by a variant of the RBOT WORM!"
X	Windows_Protect	lsas.exe	"Added by the RBOT.ARO WORM!"
X	Windows_Protect	wincontrol32.exe	"Added by the RBOT-ADK WORM!"
X	Windows_Serivce	SERVICE.exe	"Added by the WOOTBOT.AH WORM!"
X	Windows_Updates	svthost.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows_VXD	user32.exe	"Added by the PPORT TROJAN!"
X	Windowz	[original worm filename].vbs	"Added by the NUKIP WORM!"
X	Windowz Update V2.0	Explorer.exe	"Added by the YODO WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Windowz Update V2.0	updater.exe	"Added by the YODO-C WORM!"
X	Window_Protect	winsi32.exe	"Added by a variant of the RBOT WORM!"
X	Windoxs Update Center	W32RfSA.exe	"Added by a variant of the SDBOT WORM!"
X	WinDrg32	windrg32.exe	"Added by the DRUDGEBOT.A WORM!"
X	WinDriv32	WinDriv32.exe	"Added by the SMALL-BA TROJAN!"
X	WinDriver Configuration	windrvconf.exe	"Added by the AGOBOT-LX TROJAN!"
X	WinDrives	WinDrives.EXE	"Added by the SMALL.DIG WORM!"
X	WINDRUN	taskgmrs.exe	"Added by the MYTOB-BT WORM!"
X	windrv	windrv32.exe	"Added by an unidentified VIRUS
X	WinDrv	windrvx.exe	Added by a variant of the TIBSER.A downloader TROJAN!
X	Winds Sers Agts	[5 random letters].exe	"Added by a variant of the RBOT WORM!"
X	Winds Sersc Agts	rzrzncrtz.exe	"Added by the RBOT-GTV WORM!"
U	WinDSL MTU-Adjust	WinDSL_MTU.exe	Adjusts the registry setting of the DUN-Adapters (MTU) and the TCP/IP-Protocol (RWIN) by ENGEL Technologieberatung
?	WinDSL_MTU	WinDSL_MTU.exe	"May be realted to Tiscali broadband
X	WinDSNX	Win****.exe [* = random char]	"Added by the DSNX TROJAN!"
U	Windstream Broadband Check-up Center	matcli.exe	"Part of the Windstream Broadband service from AllTel. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	windtbs	winsysvc	"Added by the AGOBOT-NH WORM!"
X	WindUpdates	[path to trojan]	"Added by the AGENT.BF TROJAN!"
X	WindUpdates	WinUpdt.exe	Windupdates adware variant
U	WINDVDpatch	CTHELPER.EXE	"CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers
N	WinDVR SchSvr	SchSvr.exe	"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
N	WinDVRCtrl	WinDVRCtrl.exe	Control center software for an AOpen VA1000 TV tuner card
X	Windws Configuration Loader	LEXPLORE.exe	"Added by the SODABOT WORM!"
X	WinDynManager	amsnmsg.exe	"Added by the SDBOT-IA BACKDOOR!"
X	winenv	winenv.exe	"Added by a variant of the SDBOT WORM!"
X	WinEssential	Keyhost.exe	Hijacker - hailing from jraun.com
X	WinEssential	keyword.exe	"Jraun adware"
X	WineWork	WineWork.exe	"Added by the BANCOS.AB TROJAN!"
X	WinEx	lexplore_.exe	"Added by the MSNOPT-A TROJAN!"
X	WinExec	Winexec.exe.vbs	"Added by the AINESEY.A WORM!"
X	WinExec	WinExec.exe	"Added by the FALUS-A WORM!"
X	WinExec	Lsass.exe	"Added by the CRUTLE-B WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	WinExec32	WinExec32.exe	"Added by the KAZWIN WORM!"
X	Winexec32	windhelp32.exe	"Added by the AGENT-HKU TROJAN!"
X	winexecs	winexecs.exe	"Added by the SILLYFDC.BBB WORM!"
U	WinFast Schedule	Wfwiz.exe	Leadtek WinFast TV tuner scheduler and remote control driver - required if you use the latter
U	Winfast2KLoadDefault	"rundll32.exe wf2kcpl.dll	DllLoadDefaultSettings"
U	WinFastDTV	DTVSchdl.exe	"Scheduler for WinFast DTV digital TV cards from Leadtek Research Inc"
U	Winfast_2K	WF2K.EXE	System Tray application that starts up the Winfox utility for a Leadtek Winfast graphics card to restore settings. Can be started manually via Start → Control Panel → Display. Only needed if you wish to run things like the hardware monitor or overclock your card
U	WinFast_Gamma	"Rundll32.exe wfcpl.dll	DllLoadGammaRampSettings"
U	WinFast_Taskbar	"rundll32.exe wftask.dll	WFDllLoadDefaultSettings"
X	WinFavorites	WinFavorites.exe1	Loudmarketing.com adware downloader
N	WinFax PRO	FAXMNG32.EXE	"WinFax PRO from Symantec - fax management software"
N	WinFax PRO Controller	WFXCTL32.EXE	From WinFax 10.0 and possibly earlier versions. Appears if you chose to have WinFax appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs
Y	WinFaxAppPortStarter	wfxsnt40.exe	WinFax 10.0 and maybe earlier versions. Used to initiate the WinFax port to enable printing to the WinFax printer (send a fax) from any application.
X	WinFire	WF.exe	"Added by the DELF-SY TROJAN!"
X	WinFix service	rsswjzgp.exe	"Added by the RBOT-FAE WORM!"
X	WinFixer 2005	wfx5.exe	"WinFixer 2005 web installer - ""foistware""
X	WinFixer 2006	uwfx6.exe	"WinFixer 2006 web installer - ""foistware""
X	WinFixer helper	wfxcwr.exe	"WinFixer web installer - ""foistware""
X	WinFixer service	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	WinFixer2005	uwfx5.exe	"WinFixer 2005 web installer - ""foistware""
X	WinFixer2006	uwfx6.exe	"WinFixer 2006 web installer - ""foistware""
X	WinFixer_2005	uwfx5.exe	"WinFixer 2005 web installer - ""foistware""
U	WinFlip	WinFlip.exe	"WinFlip from Tokyo Downstairs - a 'Flip-3D' task switcher alternative to the standard Alt+Tab on Windows XP that adds the equivalent 'Aero' feature from Windows 7 and Vista. You can either click on the tray icon
U	WinFlip.exe	WinFlip.exe	"WinFlip from Tokyo Downstairs - a 'Flip-3D' task switcher alternative to the standard Alt+Tab on Windows XP that adds the equivalent 'Aero' feature from Windows 7 and Vista. You can either click on the tray icon
X	WinFlyer32.dll	WinFlyer32.dll	"Added by the WINFLYER TROJAN!"
X	winfont	winfont.exe	"Added by the DEATH TROJAN!"
X	winform	winform.exe	"Added by the PWS-ALB TROJAN!"
U	WinFoxV2	WF2K.EXE	System Tray application that starts up the Winfox utility for a Leadtek Winfast graphics card to restore settings. Can be started manually via Start → Control Panel → Display. Only needed if you wish to run things like the hardware monitor or overclock your card
X	WinFX	cssrs.exe	"Added by the AGOBOT.FX WORM!"
X	WinFX	cssrs.exe	"Added by the GAOBOT.CD WORM!"
X	WinFX	lsas.exe	"Added by the GAOBOT.CD WORM!"
U	WinGate Engine Monitor	wgengmon.exe	"WinGate Internet Client Dialup Monitor - component of WinGate proxy server software. Displays the status of the WinGate engine
X	WinGate initialize	WinGate.exe	"Added by the LOVGATE.F WORM!"
X	wingerver2.0.exe	wingerver2.0.exe	"Added by the GRAYBRD-AE TROJAN!"
X	wingo	wingo.exe	"Added by the BEAGLE.AW or BEAGLE.AV WORMS!"
X	wingo	[various filenames]	"Added by the BAGLE-AU WORM!"
N	WinGuage Pro	WGPRO32.EXE	"Part of McAfee Nuts & Bolts. "WinGauge is a dynamic reporting tool that constantly monitors your use of Windows and your applications
Y	Winguard	WGFE95.EXE	"Dr Solomon's Virex antivirus"
X	winguard	wingrd32.exe	"Added by a variant of the RBOT WORM!"
X	WinGuard	winguard.exe	"Added by the AGOBOT-OQ WORM! The file is located in %System%"
U	WinGuard	Winguard.exe	"Winguard Popup Remover - pop-up stopper. The file is located in %ProgramFiles%\Winguard Popup Remover"
U	WinGuard Pro	wgp.exe	"Winguard Pro"
N	WinHacker	"rundll32.exe wh95.dll	HackMe"
X	Winhelp	winhe1p.exe	"Added by the QQPASS.E TROJAN!"
X	WinHelp	WinHelp.exe	"Added by the LOVGATE.F WORM! Note - this file is located in %System% whereas the valid one is located in %Windir%"
X	WinHelp	realsched.exe	"Added by the LOVGATE-F WORM! Note - this is not the legitimate RealPlayer (realsched.exe) application of the same name. This one is located in %System%"
X	Winhelp	TkBellExe.exe...	"Added by the LOVGATE.Z WORM!"
X	winhelp	dns32.exe	"Added by a variant of the RBOT WORM!"
X	winhelp	Updadv.exe	"Added by the QQPASS-N TROJAN!"
X	Winhelp	TkBellExe.exe	"Added by the LOVGATE.E WORM!"
X	winhlp.exe	winhlp.exe	"Added by the FORMGLIEDER TROJAN!"
X	winhlp3.exe	winhlp3.exe	"Added by a variant of the EASTO.A TROJAN!"
X	Winhlp32	Wscript.exe Msexec32.vbs	"Added by the GANT.B WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""Msexec32.vbs"" file is found in %System%"
X	winhlp32.exe	winhlp32.exe	"Added by the EASTO.A TROJAN!"
X	winhlpp32.exe	winhlpp32.exe	"Added by the GAOBOT.SY WORM!"
X	Winhost	wintt.exe	"Added by the LOLAWEB.B TROJAN!"
X	Winhost	win.exe	"Added by the DLOADER-AP TROJAN!"
X	Winhost	yahoo.exe	"Added by the DELF-KM TROJAN!"
X	Winhost	winhost.exe	"Added by the REATLE.F WORM!"
X	winhost.exe	winhost.exe	"Added by the LOHAV-R TROJAN!"
X	winhost32.exe	winhost32.exe	"Added by the TABDIM TROJAN!"
X	WinHound	WinHound.exe	"WinHound spyware remover - not recommended
X	WiniBlueSoft	WiniBlueSoft.exe	"WiniBlueSoft rogue security software - not recommended
X	WinIeRun	winierun.exe	"Added by the RNWATCH-A WORM!"
X	WiniFighter	WiniFighter.exe	"WiniFighter rogue security software - not recommended
X	WinIFixer	WinIFixer.exe	"WinIFixer rogue security software - not recommended
X	WiniGuard	WiniGuard.exe	"WiniGuard rogue security software - not recommended. There are number of variants in this family sharing the same user interface - see here"
X	winimage	wvsvc.exe	"Added by the RBOT.TX WORM!"
X	WinINet	services.exe	"Added by the SOBER.R WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\ConnectionStatus and note the space at the beginning of the ""Startup Item"" field"
X	wininet	wininet.exe	"Added by the STUBBOT-C WORM!"
X	wininet.dll	regperf.exe	"Added by the ZLOB TROJAN and variants!"
X	wininet32	wininet32.exe	"Added by the RAZNEW-A TROJAN!"
X	wininetd	wininetd.exe	"Added by the WINET TROJAN!"
X	Winini.dll	winini.vbs	"Added by the STARTP-M TROJAN!"
X	Winini32	winini32.exe	"Added by the AGOBOT-J WORM!"
X	wininit	wininit.exe	"Added by the WOLLF.16 TROJAN!"
X	WinInit	Win86.exe	"Added by the SMALL-PB TROJAN!"
X	winint	winint.exe	"Added by the SDBOT-ADA WORM!"
X	winIogom	winIogom.exe	"Added by the BANCBAN-ML TROJAN!"
X	winipsec	winipsec.exe	Unidentified malware
U	WinIRXHelper	WinIRXHelper.exe	"MSI Media Center Deluxe software - see here"
X	winis	winis.exe	"Added by the RBOT-WI WORM!"
X	WiniShield	WiniShield.exe	"WiniShield rogue security software - not recommended
X	Winjava xml	dirx9.exe	"Added by the HAXDOOR ROOTKIT!"
X	Wink*.exe	Wink*.exe [* = random char]	"Added by a variant of the KLEZ WORM!"
U	Winkb6	winkb6.exe	"Part of We-Blocker - gives parents the opportunity to monitor their children's Internet access and provide them with age-appropriate content
X	WinKernel	WinKer.exe	"Added by the MIRAB or SERVIDOR TROJANS!"
X	WinKernel	[path to virus]	"Added by the PLEA VIRUS!"
X	winkernel32	wWin32.com	"Added by the BANSAP TROJAN!"
U	WinKey	winkey.exe	"Loads Copernic's WinKey. Used to map out Windows key hotkey combinations. Not required for the system
X	winla	winla.exe	"Added by the DLOADR-AQL TROJAN!"
X	winldr	[path to file]	"Added by the VIDLO-P TROJAN!"
X	winldr	Rechnung.pdf.exe	"Added by the ACS TROJAN!"
U	winlgn	winsplg.exe	"Related to the Sentry Parental Controls software"
X	winlgz2	winlgz2.exe	"Added by the KILLFIL-Q TROJAN!"
X	winlibs.exe	winlibs.exe	"Added by the EVAMAN.C WORM!"
X	WinLibUpdate	libupdate.exe	"Added by the BIONET series of TROJANS such as BIONET.31 or BIONET.310"
X	WinLibUpdate32	libupdate32.exe	Added by the BIONET.405 TROJAN!
X	WinLibUpdte	libupdte.exe	"Added by the BIONET.318 TROJAN!"
X	Winlink	winlink32.exe	"Added by the GAOBOT.AAY WORM!"
X	Winlme	windll.exe	"Added by the GOP.F WORM!"
U	WinLoad	Winload.exe	"PCTattletale is a surveillance software program that monitors user activity
X	winload	winload.exe	"Added by the AGENT-GNY TROJAN! Note - the file is located in %ProgramFiles%\Internet Explorer"
X	WinLoader	[random filename]	"Added by variants of the SUBSEVEN TROJAN!"
X	winlocatorupdate	updatewinlocator.exe	Locator adult content toolbar related
X	winlog	winlog.exe	"Added by the GAOBOT.DF WORM!"
X	winlog	windowxs.exe	"Added by the SDBOT-KT BACKDOOR!"
X	winlog manager	winlog.exe	"Added by the DONBOMB.A TROJAN!"
X	winlog.exe	winlog.exe	"Added by the BCKDR-RBJ TROJAN!"
X	WINLOG0N	WINLOG0N.EXE	"Added by the MYDOOM.BI WORM!"
X	WinLogin	winlogin.exe	"Added by the AGOBOT-IX WORM!"
X	winlogin	win32x.exe	"Browser hijacker
X	winlogin	ReadMe.exe	"Added by the SILLYFDC.BBT WORM!"
X	Winlogin.exe	log.exe	Added by a variant of the AGENT.AH downloader TROJAN!
X	winlogin.exe	logfile.exe	Added by the AGENT.AH TROJAN!
X	winlogin.exe	mspaint.exe	Added by a variant of the AGENT.AH TROJAN!
X	Winlogin.exe	steam.exe	Added by a variant of the AGENT.AH TROJAN!
X	winlogins.exe	winlogins.exe	"Added by the OPTIX.H BACKDOOR!"
X	winlogoff	winlogoff.exe	"Added by the AGOBOT-TR WORM!"
X	winlogon	winlogin.exe	"Added by the RANDEX.E WORM!"
X	winlogon	winlogon.exe	"Added by the TRODAL TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	winlogon	msreg32.exe	"Added by the SDBOT.EO WORM!"
X	winlogon	winlogon32.exe	"Added by the MASLAN.C WORM!"
X	winlogon	wpwlogon.exe	Added by an unidentified WORM or TROJAN!
X	WINLOGON	wscript.exe WINLOGON.vbs	"Added by the YSPAN.F WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""WINLOGON.vbs"" file is found in %System%"
X	Winlogon	Lsass.exe	"Added by the ALCOP-B WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	winlogon	nvchost.exe	Added by an unidentified WORM or TROJAN!
X	Winlogon	WINLOGON.EXE	"Added by the PUNYA-B WORM! Note - this is not the legitimate winlogon.exe process
X	winlogon	system.exe	Added by a variant of the DELF.CNS TROJAN!
X	winlogon	cleanmg.exe	"Added by the AGENT-ICR TROJAN!"
X	Winlogon	scssrr.exe	"Added by the AGENT-LXB TROJAN!"
X	winlogon service	urx.exe	"Added by the SPYBOT.EN WORM!"
X	Winlogon Shell	Explorer.exe svchost.exe	"Added by the KIPIS.M WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""1032"" sub-folder"
X	Winlogon.exe	N/A	"CoolWebSearch parasite variant - resets home page to an adult content site"
X	winlogon.exe	helper.exe	"Added by the FAKESPY-A TROJAN!"
X	winlogon.exe	msole32.exe	"Adware
X	winlogon32_	[path to file]	"Added by the RULAND.A WORM!"
X	WinLogonnd	winlogonnd.exe	"Added by the AGENT-NNQ TROJAN!"
X	winlogon_user	ccIsass.exe	"Added by the SILLYFDC.BBT WORM!"
X	Winlogun	winlogin.exe	"Added by the P2LOAD-C WORM!"
X	WinLsass	servicec.exe	"Added by the SCANE WORM!"
X	WinLsass	[path to trojan]	"Added by the SCANE WORM!"
X	winltmpv	winln.exe	"Added by the TCXMEDI-C TROJAN!"
X	winltmpv	wutop.exe	"Added by the TCXMEDI-C TROJAN!"
X	Winmain	winmain.exe	"One of the first of a new breed of malware. When run it immediately loads MSHTA.EXE from the Windows folder
X	WinManage	wmanage.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
?	WinManager	schost.exe	"??"
U	winmatrix.exe	WinMatrixXP.exe	"WinMatrix XP - wallpaper replacement that shows different matrix effects (including flowing matrix codes from 'The Matrix' movie) on your desktop"
X	WinMed	winmed.exe	"Added by the AGENT.AIRF TROJAN!"
X	WinMedia	[path to trojan]	"Added by the ZEROBE-A TROJAN!"
X	WinMedia	msupd******.exe [*= random digit]	Added by the INJECT.163 TROJAN!
X	WinMedia32	winmedia32.exe	"Added by the YABE.F TROJAN!"
U	WinMem	WinMem.exe	"WinMem Cleaner - part of Ultra WinCleaner Utility Suite. Makes more memory available for your programs and the Operating System. It also defragments your system"
X	WinMenssage	winmax.exe	"Added by the BANCOS.B TROJAN!"
X	WinMenssage	winmaxy.exe	"Added by the BANCOS TROJAN!"
X	WinMessenger	syshost.exe	"Added by the OPANKI-E WORM!"
N	WinMgmt	WinMgmt.exe	"Used for Enterprise Management. If you are not an IT Administrator you don't need it to be running. Also runs from the PCHealth ""scheduler"" - refer here"
X	winmgmt	wmiprvse.exe	"Added by the AGENT-GHP TROJAN!"
X	winmgmt32.exe	winmgmt32.exe	"Added by the LUZIA.AD TROJAN!"
X	WINMGR	taskgmgr.exe	"Added by the MYTOB.AN WORM!"
X	WinMgr	winmgr32.exe	"Added by the VB-EDY TROJAN!"
X	Winmgr.exe	scvhost.exe	"Added by the AGOBOT.AFG WORM!"
X	WinMgr32	winmgr32.exe	"Added by the MIMAIL.P WORM!"
X	WinMine	D4NG3.vbs	"Added by the BISCUIT.A WORM!"
X	WinMngn	dllhost.exe	"Added by the SIVION-A TROJAN! Note - this is not the legitimate dllhost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %System%\system"
X	winmngr.exe	[path to trojan]	"Added by the AGENT-ZB TROJAN!"
Y	winmodem	wmexe.exe	"Software for software based modems. Required if you have one of these. WinModems use software rather than hardware - hence putting a load on the CPU. Needed if you have it for loading the drivers. See here for more WinModem information"
X	Winmon32	winmon32.exe	"Added by the RBOT-OQ WORM!"
X	WinMoviePlugIn	WinMoviePlugIn.exe	"Sfonditalia adult content premium rate dialer"
X	Winmsg	winwork.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	WinMsg	winmsgr.exe	"Added by the DLOADR-AS TROJAN!"
X	Winmsg	winwork8.exe	"Added by the AGOBOT-GC WORM!"
X	WinMsrv32	WinMsrv32.exe	"Added by the GAOBOT.AFJ WORM!"
N	WinMX	WinMX.exe	"WinMX file sharing application"
N	winmysqladmin	winmysqladmin.exe	Starts the MySQL database admin tool
N	WinMySQLadmin Tool	winmysqladmin.exe	Starts the MySQL database admin tool
X	winnet	winnet.exe	"CommonName Toolbar spyware. To uninstall see here"
X	WinNetDDE	[random characters].exe	"Added by the NETDEPIX.B TROJAN!"
X	WinNite	niteaim.exe	"Added by the OPANKI.B WORM!"
X	winnload	winnload.COM	"Added by the DOWNLD-ABG TROJAN!"
?	Winnov Menu	WnvMenu.Exe	"Winnov Video Capture Card related. What does it do and is it required?"
?	Winnov Remote	WnvRsvr.Exe	"Winnov Video Capture Card related. What does it do and is it required?"
?	Winnov Status	WvStatus.Exe	"Winnov Video Capture Card related. What does it do and is it required?"
X	winnsvc	msvc.exe	"Added by the PWS.O TROJAN!"
X	winnt	winnt.exe	"Added by the MONA-E WORM!"
X	WinNT	WinNT.com	"Added by the AUTOSKY WORM!"
X	winnt DNS ident	wuamgrd32.exe	"Added by the RBOT-BAU WORM!"
X	winnt DNS ident	iexplorer.exe	"Added by a variant of the RBOT WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	winnt DNS ident	pidchk32.exe	"Added by the RBOT-ACY WORM!"
X	winnt DNS ident	windowxp.exe	"Added by a variant of the RBOT WORM!"
X	winnt DNS ident	Winupd32.exe	"Added by the RBOT.AVU WORM!"
X	winnt DNS ident	winupdate32.exe	"Added by a variant of the RBOT WORM!"
X	winnt DNS ident	wuamgrd33.exe	"Added by a variant of the RBOT WORM!"
X	Winnt DNS ident	windowsp.exe	"Added by the RBOT.BAL WORM!"
X	Winnt DNS ident	msnmsrg.exe	"Added by the RBOT.BVQ WORM!"
X	winNT updatc	wupgrd.exe	"Added by a variant of the RBOT WORM!"
X	winnt2	winnt2.exe	"Added by the AGENT.CJZO TROJAN and variants"
X	winnt3	winnt3.exe	"Added by the AGENT.CJZO TROJAN and variants"
X	winnt4	winnt4.exe	"Added by the AGENT.CJZO TROJAN and variants"
X	winnt5	winnt5.exe	"Added by the AGENT.CJZO TROJAN and variants"
X	winnt6	winnt6.exe	"Added by the AGENT.CJZO TROJAN and variants"
X	WinNtBB	WinntBB.exe	"Added by the DULOAD.C WORM!"
X	winntR1	winntR1.exe	"Added by the AGENT.CJZO TROJAN and variants"
X	winntR2	winntR2.exe	"Added by the AGENT.CJZO TROJAN and variants"
X	Winnup	win32nls.exe	"Added by a variant of the SPYBOT WORM!"
X	winocx32	winocx32.exe	"Added by the PROTORIDE.I WORM!"
X	WINOWS SYSTEM	winnt.exe	"Added by the MYTOB.ID WORM!"
X	WINP	winmic.exe	"Added by the SPYBOT-EB WORM!"
X	Winpack	winpack.exe	"Adware - detected by Kaspersky as the AGENT.GG TROJAN!"
X	WinPatch Protection	winpatch.exe	Added by an unidentified WORM or TROJAN!
U	WinPatrol	winpatrol.exe	"WinPatrol - ""Manage Startup programs
Y	WinPatrol Explorer	WinPatrolEx.exe	"Part of WinPatrol"
U	WinPatrol Monitor	winpatrol.exe	"WinPatrol - ""Manage Startup programs
X	WinPCDoctor	SysRep.exe	"WinPCDoctor rogue system error and cleaning utility - not recommended
X	WinPerformance	WinPerformance.lnk	"Windows Performance rogue optimization utility - not recommended"
X	winphonics7536	vbsystem35.exe setups.exe vb.vb	"Added by a variant of the MUTIN-C TROJAN!"
X	winpipe	winpipe.exe	Browser hijacker redirecting to wow-access.com
U	WinPLOSION	WinPlosion.exe	"""WinPLOSION allows you to immediately view and select from all the windows running on your computer
X	WinPN32	winpn32.exe	"Added by the AGOBOT-FJ WORM!"
Y	WinPoet	WinPPPoverEthernet.exe	"WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion
X	winpol	winpol.exe	"Added by the AGENT.IWD TROJAN!"
Y	Winpooch	Winpooch.exe	"""Winpooch is a Windows watchdog
X	WinPop	winpop.exe	"Brudevic A adware"
N	WinPopup	WINPOPUP.EXE	"Intranet chat software provided by windows for chat on small networks. Handy little LAN messaging utility. Has been included in Windows since 95
X	winpopup	winupie.exe	Adware by Tradeexit.com
N	Winpower	Winpower.exe	"Part of InstallAnywhere from Zero G Software
X	WinProc32	winproc32.exe	"Added by the AGOBOT-4 WORM!"
X	Winprocer32 Update	winprocer32.exe	"Added by the RBOT.GW WORM!"
X	winprocessor Update	winprocessor.exe	"Added by the RBOT.IO WORM!"
X	WinProfile	Command.exe	"Added by the BUDDY.E TROJAN!"
X	WinProfile	sndcfg16.exe	"Added by the SNDC.A WORM!"
X	winprofile	iexpiore.exe	Added by a variant of the MONCHER WORM!
X	WinProfile	iexpIore.exe	"Added by the CHUM-C TROJAN!"
X	WinProt	Winprot.exe	"Added by the CHUPACABRA TROJAN!"
X	WinProt	server.exe	"Added by the CHUPACABRA TROJAN!"
X	winprotect	win32.exe	"Added by the MUGLY.E WORM!"
X	winprotect	winprotect.exe	"Added by the SDBOT-SB WORM!"
X	winprotection	ccsrss.exe	"Added by the SILLYFDC.BBT WORM!"
X	WinProtector	WinProtector.exe	"WinProtector rogue security software - not recommended
U	WinProxy	WinProxy.EXE	""WinProxy is the world-first proxy server and a firewall with integrated mail server for Windows 95/98/ME/NT/2000/XP""
X	Winproxy Personal	WINPROXY.EXE	"Added by the SDBOT.BMF WORM!"
X	winpsd	winpsd.exe	"Added by the MYDOOM.Q WORM!"
X	WinPWD Manager	wpwdmgr.exe	"Added by the RBOT-AUT WORM!"
X	winrapid	winrapid.exe	"Added by a variant of the RBOT WORM!"
X	winrar	winrar.exe	"CoolWebSearch Therealsearch parasite variant. Note - this is not the file zipping utility also known as WinRAR!"
X	WinRaR Service	WinrarCO.com	Added by an unidentified WORM/TROJAN!
X	winrarshell	winrarshell32.exe	"Added by the SALIRA TROJAN!"
X	WinReader	read.exe	"Added by the DELBOT-V WORM!"
X	WinReanimator	WinReanimator.exe	"WinReanimator rogue security software - not recommended
X	winReg	winReg.exe	"Added by the YAHA.H or YAHA.J WORMS!"
X	WinReg	ournik.com	"Added by the IRCFLOOD.AL BACKDOOR!"
X	WinReg32 service	holqdnoxpmeu.exe	"Added by a variant of the SDBOT WORM!"
X	winregsrv	winregsrv.exe	"Added by the SYNRG TROJAN!"
X	winreg_32	svchosst.exe	"Added by the BANCOS-CE TROJAN!"
X	winreg_32	[path to trojan]	"Added by the BANKER-DB TROJAN!"
X	winreg_32	sysdll.exe	"Added by the DLOADER-IJ TROJAN!"
X	winreg_32	Vc030405.exe	"Added by the BANCOS-CT TROJAN!"
U	WINREMOTE	WinRemote.exe	"InterVideo WinCinema Manager - needed for the use of WinDVD Remote Control"
X	Winres32vis	[path to worm]	"Added by the THRAX.A WORM!"
X	winrestore1	winrestore.exe	"Added by the KILLFIL-Q TROJAN!"
X	winreups	winreups.exe	"Added by a variant of the RBOT WORM!"
U	WinRoll	winroll.exe	"WinRoll - a small utility that allows you to ""make a window roll into its title bar
X	winroot	winsn.exe	"Added by the QQPASS.IA WORM!"
N	winroute	winroute.exe	"Win-Route 4.27. WinRoute Tray Icon for starting and stopping the WrCtrl.exe process
X	WinRPC	winrpcmx.exe	"Added by the BANKER-EEI TROJAN!"
X	winrun	msconfig.exe	"Added by the WINUR WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting. This one is located in c:\winrun"
X	winrun	winrun.exe	"Added by the WINBUR.B WORM!"
X	WINRUN	taskgmr32.exe	"Added by the MYTOB.AP WORM!"
X	WINRUN	svchost32.exe	"Added by the MYTOB-AI WORM!"
X	WINRUN	taskgmr.exe	"Added by the MYTOB-BX WORM!"
X	WinRun	AutoRun.ini	"Added by the LOVELET-AD WORM!"
X	WINRUN	TASKMGR32.exe	"Added by the MYTOB.AX WORM!"
X	WINRUN z	W1NT45K.exe	"Added by the MYTOB.BL WORM!"
X	WinRunners	WinDrivers.exe	"Added by the DULOAD.C WORM!"
X	Wins Loader5	Gadu-Gadu.exe	"Added by a variant of the IRCBOT TROJAN! Note - doe not confuse with the Polish language Instant Messaging client also called Gadu-Gadu"
X	Wins Service Driver	winet.exe	"Added by the RBOT-APV WORM!"
X	Wins Update 32	services32.exe	"Added by the FORBOT-FN WORM!"
X	Wins32 Online	cfgpwnz.exe	"Added by the BROPIA.R WORM!"
X	WinScMngr	winsmc.exe	"Added by the SDBOT-BPZ WORM!"
X	WinSec	winsec16.exe	"Added by the AGOBOT.ZF WORM!"
X	winsecure	winsecure.exe	"Browser hijacker
X	WinSecure	[random].exe	"Added by the AGENT-LR TROJAN!"
X	Winsecure Antivirus	Secureantivirus.exe	"Added by a variant of the SPYBOT WORM!"
X	WinSecureAv	pgs.exe	"WinSecureAv rogue security software - not recommended
X	WinSecured32	ssmr.exe	"Added by a variant of the FORBOT WORM!"
X	WinSecurity	uninstall.exe	"Added by the SILLYFDC.BCJ WORM!"
X	Winserv	Winserv.ila	"Added by the NODMIN WORM!"
X	winserver	Server.txt.vbs	"Added by the DELTAD.A WORM!"
X	Winservice	winmain.exe	Adult content related malware
X	winservice	svchost.exe	"Added by the CVK BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""services"" sub-folder"
X	WinService	hosth.exe	"Added by the DWNLDR-FUX TROJAN!"
X	WinService	Ttt.exe	"Added by the MSNVB-D WORM!"
X	WinService	WinServ.exe	"Added by the SKOWOR-O WORM!"
U	WinService32	ssmgr.exe	"007 Spy Software - ""stealthy monitoring program which allows you to secretly track all activities of computer users and automatically deliver logs to you via Email or FTP"""
U	WinService32	svchost.exe	"007 Spy Software - ""stealthy monitoring program which allows you to secretly track all activities of computer users and automatically deliver logs to you via Email or FTP"""
X	WinServices	WinServices.exe	"Added by the YAHA.K or YAHA.M WORMS!"
X	winservices	bootvfy.exe	Added by an unidentified WORM or TROJAN!
X	winservit	cassl.exe	"Added by the RBOT.ASG WORM!"
X	winservn	winservn.exe	"PurityScan adware"
X	winservs	winservs.exe	"PurityScan adware"
X	WinSetBrowse	BasicUpdate.dll.vbs	"Added by the BISCUIT.A WORM!"
X	winsfc	winsfc.exe	"Added by the WISFC VIRUS!"
X	Winshell	remote.exe	"Added by the MYTOB.LJ WORM!"
X	winshell	windll32lib.exe	"Added by the BAGLE-DM WORM!"
?	Winshoe	wuadfdqr.exe	"Probably an unidentified VIRUS! Adds itself to 3 registry ""Run"" keys and prevents Task Manager being displayed. This is not the Winshoe IRC Client as the visitor did not have it installed"
X	winshost.exe	winshost.exe	"Added by the TOOSO WORM and variants!"
X	winshow	[path to trojan]	"Added by the VB-DXP TROJAN!"
X	WinShowUpdate	copy [path] winshow.new [path] winshow.dll	"Winshow parasiate related - from the ""RunOnce"" keys it replaces ""winshow.dll"" with a new version"
X	WinSig	NetXP.exe	"Added by the BANKER-FN TROJAN!"
X	WinSistem	Tunggul.vbs	"Added by the VBS.STEMCLOVER WORM!"
X	Winsk system Loader	winsk.exe	"Added by the AGOBOT-IZ WORM!"
X	winskype	winskype.exe	"Added by the BROGGER-C TROJAN!"
U	WinSL	WinSL.exe	"StarLogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	winsock	svch0st.exe	"Added by the SAGE-A WORM! Note - the filename has the digit 0 rather then the uppercase ""o"""
X	Winsock driver	winnt update.exe	"Added by the SPYBOT-DM TROJAN!"
X	Winsock driver	winnt64.exe	"Added by the SPYBOT-DR WORM!"
X	Winsock Driver	nvscv32.exe	"Added by the AGOBOT-FD WORM!"
X	Winsock Driver	scvhost.exe	"Added by the RBOT.AEU BACKDOOR!"
X	Winsock driver	win.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Winsock driver	tcpmngr.exe	"Added by the SPYBOT-CK WORM!"
X	Winsock driver	winupdate32.exe	"Added by the SPYBOT-JZ TROJAN!"
X	Winsock Startup	Main2.exe	"Added by a variant of the SDBOT WORM!"
X	winsock.client	winsock.exe	"Added by the DIABLO-M TROJAN!"
X	winsock2	netsvr.exe	"Added by the AGOBOT.LY WORM!"
X	Winsock2 dlls	W32DLL.EXE	"Added by the SPYBOT-CS BACKDOOR!"
X	Winsock2 driver	SDJOIJE.EXE	"Added by the SPYBOT.DR TROJAN!"
X	Winsock2 driver	MIRC32.exe	"Added by the SPYBUZZ TROJAN!"
X	Winsock2 driver	kgzgjkpcw.exe	"Added by the SDBOT.T TROJAN!"
X	Winsock2 driver	ZONEALARM.EXE	"Added by the SDBOT.T TROJAN! Note - ZONEALARM.EXE is not the valid Zone Labs firewall program"
X	Winsock2 driver	wincfg.scr	"Added by the SPYBOT-E TROJAN!"
X	Winsock2 driver	winupdate.exe	"Added by the SPYBOT-BX WORM!"
X	Winsock2 driver	SPOLSV.EXE	"Added by the SPYBOT-CM WORM!"
X	Winsock2 driver	[random filename]	"Added by members of the SPYBOT family of WORMS! Note - the random filename is located in %System%"
X	Winsock2 driver	sysreq.exe	"Added by the SPYBOT-CC WORM!"
X	Winsock2 driver	WUAUMQR.EXE	"Added by the SPYBOT-DP WORM!"
X	Winsock2 driver	wincfg.exe	"Added by the SPYBOT.CO WORM!"
X	Winsock2 driver	svchorsst.exe	"Added by the SPYBOT-EE WORM!"
X	Winsock2 driver	SYSTEM32.EXE	"Added by the SPYBOT-EG WORM!"
X	Winsock2 driver	dllcfg32.exe	"Added by the SPYBOT.AG WORM!"
X	Winsock2 driver	CFTMON.EXE	"Added by a variant of the IRCBOT BACKDOOR!"
X	Winsock2 driver	ntsys32.exe	"Added by the SPYBOT-DD WORM!"
X	Winsock2 driver	WINNT32.EXE	"Added by the SPYBOT-CN WORM!"
X	Winsock2 driver	PAC.EXE	"Added by the SPYBOT-ET WORM!"
X	Winsock2 driver	winsock2.exe	"Added by the SPYBOT-CT BACKDOOR!"
X	Winsock2 driver	mmtask5.exe	"Added by the SPYBOT-CD WORM!"
X	Winsock2 driver	WWEUMQR.EXE	"Added by the SPYBOT-BY WORM!"
X	Winsock2 driver	IEXPLORE .EXE	"Added by the SPYBOT-AU WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process as there is a space before the "".exe"""
X	Winsock2 driver	WINSOUND.EXE	"Added by the SPYBOT-H WORM!"
X	Winsock2 Loader	WICONF.EXE	"Added by the SDBOT-LA WORM!"
X	Winsock2 wqr1s	WUAUMQR1.EXE	"Added by the SPYBOT.KD WORM!"
X	Winsock2.dll	WINLODR.SCR	"Added by an unidentified VIRUS
X	Winsock32 driver	TESTING.EXE	"Added by the SPYBOT-B WORM!"
X	Winsock32 driver	system32.exe	"Added by the IRCBOT-VT TROJAN!"
X	Winsock32driver	win32server.scr	"Added by the HACARMY TROJAN!"
X	Winsock32driver	sp2XPupdate.exe	"Added by the HACKARMY.S TROJAN!"
X	Winsock32driver	win32server.exe	"Added by the BACKDOOR-AZV TROJAN!"
X	Winsock32driver	ZoneAlarmPr0.exe	"Added by the HACKARMY-B TROJAN!"
X	Winsock32driver	ZoneLockup.exe	"Added by the HACARMY.D TROJAN!"
X	Winsock32driver	win32server.exe	"Added by the HACARMY.F TROJAN!"
X	Winsock32driver	winXPupdate.exe	"Added by the HACKARMY.9728 TROJAN!"
X	Winsock32driver	svchhost.exe	"Added by the HACKARMY.I TROJAN!"
X	Winsock6 MIC driver	ieservicesupd.exe	"Added by the SPYBOT.AFZ WORM!"
X	winsockdriver	tskmg.exe	"Added by the SDBOT.GEN TROJAN or WARPIGS.C WORM!"
X	winsockdriver	winsock2.2.exe	"Added by a variant of the SPYBOT WORM!"
X	winsockdriver	iexplor.exe	"Added by the BLATIC.A WORM!"
X	winsockdriver	winsock3.exe	"Added by the SPYBOT-DO WORM!"
X	winsockdriver	bot.exe	"Added by the WARPIGS-D WORM!"
X	winsockdriver	winsock4.1.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	winsockdriver	winsock2.exe	"Added by the SPYBOT-AC WORM!"
X	WinSocketComponent	nthost.exe	"Added by an unidentified VIRUS
X	Winsocks2 driver	mznmgr.exe	"Added by a variant of the SDBOT WORM!"
U	WINSOS VERIFY	WINSOS.EXE	"WinSOS - ""deletes spyware
X	WinSP	[path] REGEDIT.EXE -s [path] sysreg.reg	"Added by the STARTPA-ME TROJAN!"
X	WINSP00L	WINSP00L.EXE	"Added by the AGENT.XAB TROJAN! Notice the digit ""0"" in both columns rather than the upper case ""o"""
X	winspd32dll	winspd32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	WinSPF	windrv32.exe	"Added by the MYDOOM.T WORM!"
X	WinSPF	winspf32.exe	"Added by the MYDOOM.S WORM!"
X	Winspl	winsplx.exe	"Added by a variant of the TROLL-A TROJAN!"
X	winsplog	wsmmlog.exe	"Added by the MAILBOT-CA TROJAN!"
X	Winspool	spoolsvr.exe	"Added by a variant of the SDBOT WORM!"
X	WinSpyControl	pgs.exe	"WinSpyControl rogue security software - not recommended. A member of the AVSystemCare family"
X	WinSpyDemo	WinSpyDemo.exe	"WinSpy rogue spyware remover - not recommended"
X	WinSpyKiller	WinSpyKiller.exe	"WinSpyKiller rogue spyware remover - not recommended
X	WinSpywareProtect	WinSpywareProtect.exe	"WinSpywareProtect rogue security software - not recommended
X	WinSpywareProtect (ver. 5.1)	WinSpywareProtect.exe	"WinSpywareProtect rogue security software - not recommended
X	WinSrv	kn0x.exe	"Added by the HOBBIT.F WORM!"
X	WinSrv	SHIZZLE.EXE	"Added by the HOBBIT.C WORM!"
X	Winsrv	winsrv.exe	"Added by the OPASERV.T WORM!"
X	winsrv	winsrv.exe	"Added by the NETSNAK-B TROJAN!"
X	winsrv3	services.exe	"Added by the NAFBOT-A TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
Y	winssnotify	winssnotify.exe	"System Tray access to and notifications from Windows Live OneCare - now superseded by Microsoft Security Essentials. ""OneCare helps keep your PC safe and secure while making your life easier. From virus scanning and file backups
X	WinsSystem	syssmss.exe	"Added by the DELF.IG TROJAN!"
X	WinStabilizer	WinStabilizer.exe	"Added by the AGOBOT-SW WORM!"
X	WinStar	IEXPL0RE.exe	"Added by the WOSRIST A TROJAN!"
X	WinStart	services.exe	"Added by the SOBER.O WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Connection Wizard\Status and note the space at the beginning of the ""Startup Item"" field"
X	WinStart	WinStart.exe	"From IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words
X	WinStart	Wscript.exe WinStart.vbs	"Added by the CIAN.C WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""WinStart.vbs"" file is located in %System%"
X	WinStart	winstart32.exe	"Added by the PUROL WORM!"
X	WinStart	WinStart.pif	"Added by the CONE.E WORM!"
X	winstart	winstart.exe	"Added by the SCKEYLO-AB TROJAN!"
X	WinStart001	WinStart001.exe	"From IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words
X	WinStart001.EXE	WinStart001.exe	"From IGetNet - turns the IE address bar into a keyword engine piped into IGetNet. In other words
X	winstats	winstats.exe	"Added by the GARGAFX TROJAN!"
X	Winsta~1	winsta~1.exe	"GoHip foistware"
X	WinSth16	WinSth16.exe	"Added by the CAKE WORM!"
X	winstro	RUN32DLL.exe	"Added by the FTP_ANA TROJAN!"
X	winsupdater	winsupdater.exe	"Added by the ALCRA-F WORM!"
X	winsupdatesysmngr64	winsys64mnger.exe	"Added by the RBOT-BAG WORM!"
X	WinSvc16.exe	WinSvc16.exe	"Added by the SDBOT.FQ TROJAN!"
X	winsvc32	winsvc32.exe	"Added by the IRCBOT-AEG WORM!"
X	winsvc32.exe	winsvc32.exe	"Added by the GREPAGE TROJAN!"
X	Winsvr	msupd******.exe [*= random digit]	Added by the INJECT.163 TROJAN!
X	Winsvr	[random filename].exe	"Added by the ADCLICK-DK TROJAN!"
X	Winsvr manager	DDEsvr.exe	"Added by the TIRBOT-C WORM!"
X	winsy32.exe	winsy32.exe	"CoolWebSearch parasite variant"
X	winsync	******.exe reg_run [* = random char]	"Added by a variant of the QOOLOGIC TROJAN!"
U	Winsys	Winsys.exe	"Win-Spy keyboard logger/monitoring software - remove unless you installed it yourself"
X	WINSYS	[path to trojan]	"Added by the GOLDPLAY TROJAN!"
X	winsys	syschost.exe	Added by an unidentified TROJAN!
X	WinSys	winmgmt.com	"Added by the VB.EIW WORM!"
X	WinSys	system.exe	"Added by the DAPROSY WORM!"
X	WinSys32	Winsys32.exe	"Added by the CIGIVIP TROJAN or RECKUS WORM!"
X	winsys32 Driver	winsys32.exe	"Added by the LOONY-O TROJAN!"
U	WinSysAppMon	WinSysRM.exe	"Home & Family Content Filter related. See here"
X	winsysban	[path to trojan]	"Added by the CLICKER-CD TROJAN!"
U	WinSysCheck	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
X	winsyslog lptt01	winsyslog.exe	"RapidBlaster variant (in a ""Winsyslog"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	WinSysM	371662M.exe	"Added by the WINKO.AO WORM!"
X	WinSysModule	[path to trojan]	"Added by the AGENT-DIQ TROJAN!"
X	WinSysStartUpWKbLw	TaskSystemDll.Exe	"Added by the BACKZAT.G WORM!"
X	WinSyst32	winsyst32.exe	"Added by the MORB WORM!"
X	WinSystem	winsystem.exe	"Added by the WHITEBAIT WORM!"
U	WinSystem	WinSystems.exe	"CMKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	Winsystem	Freevideo5.EXE	"Added by the AGENT.FZS WORM!"
X	winsystem.sys	smss.exe	"Added by the SOBER.K WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\msagent\win32 and note the space at the beginning of the ""Startup Item"" field"
X	WinSystems	winsystems16.exe	"Added by the SDBOT-CZT WORM!"
X	winsystems25	winsystems.exe	"Added by the RBOT-CNZ WORM!"
X	winsysupd	[path to trojan]	"Added by the STARTPA-NI TROJAN!"
X	WinSysW	371662L.exe	"Added by the WINKO.AO WORM!"
X	WINT	wcp****.exe [* = random char]	"PurityScan adware"
X	WINT	wcp**.exe [* = random char]	"PurityScan adware"
X	WinTask	Wintask.exe	"Added by the HIPO or LEMIR.F TROJANS!"
X	WINTASK	taskgmr.exe	"Added by the MYTOB.I WORM and variants!"
X	WINTASK	taskgamr.exe	"Added by the MYTOB.AU WORM!"
X	WINTASK	sys32.exe	"Added by the MYTOB.K WORM!"
X	WINTASK	msmgrxp.exe	"Added by the MYTOB.AQ WORM!"
X	WINTASK	iexplorer.exe	"Added by the MYTOB-CH WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	WINTASK	taskgmr32.exe	"Added by the MYTOB.BU WORM!"
X	WINTASK	msvhost.exe	"Added by the MYTOB-AR WORM!"
X	WINTASK	t4skmgr.exe	"Added by the MYTOB-AK WORM!"
X	WINTASK	taskfile.exe	"Added by the MYTOB.EF WORM!"
X	WINTASK	taskgm.exe	"Added by the MYTOB-AO WORM!"
X	WINTASK	taskgmrs.exe	"Added by the MYTOB.DH WORM!"
X	WINTASK	yahooicons.exe	"Added by the MYTOB-HM WORM!"
X	WINTASK	t4skgmr.exe	"Added by the MYTOB.CM WORM!"
X	WINTASK DLL	jusched32.exe	"Added by the MYTOB.AI WORM!"
X	WINTASK DLL32	smsrss.exe	"Added by the MYTOB.BS WORM!"
X	WINTASK DLL32	updatewin	"Added by the MYTOB.NI WORM!"
X	WinTask driver	wintask.exe	"Added by the DLOADER-NA TROJAN!"
X	WINTASK32	taskgmr32.exe	"Added by the MYTOB.BN WORM!"
X	WINTASK32	taskgmrr.exe	"Added by the MYTOB.FX WORM!"
X	wintask32	Jwintask.com	"Added by the NAFBOT-A WORM!"
X	WINTASKMANAGER	taskgmr.exe	"Added by the MYTOB-AF WORM!"
X	WINTASKMGR	ccsrs.exe	"Added by the MYTOB.Q WORM!"
X	WINTASKMGR	sp2winfix.exe	"Added by the MYTOB.KJ WORM!"
X	WINTASKS	taskgmr.exe	"Added by the MYTOB.BO WORM!"
X	WINTASKS	winxpro.exe	"Added by the MYTOB.EZ WORM!"
X	WinTasks DLL Library (32-bits)	winkll.exe	"Added by the RBOT-AJZ WORM!"
U	WinTasks Traybar	wintasks.exe	"WinTasks - ""Efficient Resource and Task Management is absolutely critical if you want to achieve the highest system performance levels possible. WinTasks 4 will not only help you achieve this task
X	wintasks.exe	wintasks.exe	"Added by the EVAMAN WORM!"
X	Wintbp.exe	wintbp.exe	"Added by the ZOTOB.E WORM!"
X	Wintbpx.exe	wintbpx.exe	"Added by the ZOTOB.F WORM!"
U	wintective	wintective.exe	"Wintective logs keystrokes
X	WintelUpdate	[path to trojan]	"Added by the SMALL-EKW TROJAN!"
X	winter	happy.exe	"Added by the SDBOT-YF WORM!"
N	Wintercooler Pro	WINCOOL.EXE	"Wintercooler Pro - utility that monitors CPU usage
X	winthelp	winthelp.exe	"Associated with the AdvancedCleaner rogue security software - see here. Removal instructions here"
N	WinTidy	WinTidy.exe	"Desktop icon manager from
X	Wintime	Wintime.exe	"Added by the HARNIG TROJAN!"
U	WinTime	wintime.exe	"WinTime - change desktop icons' color and font"
N	Wintime Wtxpload	Wxpload.exe Wintime	"Part of the software to support a Dexxa USB graphics tablet. From a visitor - "This gets started anyway when you plug in the USB connector for the graphics tablet
X	WinTimer	msupdate.cmd	"Hijacker - detected by Kaspersky as the STARTPAGE.TJ TROJAN!"
X	Wintl	msdred.exe	Identified as a variant of the Trojan-Spy.Win32.Agent.cch malware
X	wintnask32.exe	wintnask32.exe	"Added by the RBOT-AFP WORM!"
X	wintnl.exe	wintnl.exe	"Added by a variant of the ZOTOB.K WORM!"
X	wintnpx.exe	wintnpx.exe	"Added by the ZOTOB.H WORM!"
X	WinTools	WToolsA.exe	"Wintools adware"
N	WinTOTAL Scheduler	guru.exe	WinTOTAL Real estate appraisal software related
X	WinTouch	WinTouch.exe	"Detected by Kaspersky as the AGENT.BUO TROJAN!"
X	WinTray	wintray.exe	"Added by the LEGUARDIEN.B TROJAN!"
X	wintsk32dll	wintsk32dll.exe	"Added by the RBOT-AAJ WORM!"
X	winudll.exe	winudll.exe	"Added by the MITGLIE-CE TROJAN!"
X	winui	z.exe	"Added by the KONDELI TROJAN!"
X	WinUp	svchost.exe	"Added by the SILLY.BR WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This file is located in a ""4350"" sub-folder"
X	winupated.exe	winupated.exe	"Added by a variant of the SDBOT WORM!"
X	winupd	"RUNDLL32.EXE [random value].dll	_mainRD"
X	winupd	winupd.exe	"SearchNew adware"
X	winupd.exe	winupd.exe	"Added by the BEAGLE.M or BEAGLE.N WORMS!"
X	WinUPD32	explorer.exe	"Added by an unidentified VIRUS
X	winupdat	winupdat.exe	"Added by the CANBOT.A WORM!"
X	WinUpdate	RBSKQQBO.EXE	"Added by the VBSWG2B.A WORM!"
X	WinUpdate	wmbem.exe	"Added by the REVCUSS.B TROJAN!"
X	WinUpdate	updsys.exe	"Added by a variant of the RBOT WORM!"
X	winupdate	winupdate.exe	"Added by the ALCAN.B WORM!"
X	WinUpdate	svhost.exe	"Added by a variant of the SDBOT WORM!"
X	WinUpdate	svchots.exe	"Added by the SMALL.GXJ TROJAN!"
X	winupdate	jusched.exe	"Added by the DWNLDR-FUX TROJAN! Note that this is not the legitimate Sun Microsystems file (of the same name) which is usually located in %Program Files%\Java\version number\bin. This one is located in %Windir%"
X	Winupdate	lsas.exe	"Added by the COSPET.JR TROJAN!"
X	Winupdate Engine	wupeng.exe	"MalwareCrush rogue security software - not recommended
X	WinUpdate Loader	msnnm.exe	"Added by the REVCUSS.C TROJAN!"
X	Winupdate Service	winxp.exe	"Added by the SPYBOT.IR WORM!"
X	winupdate.exe	winupdate.exe	"Added by the RADO TROJAN!"
X	winupdate.reg	winupdate.exe	"Added by the SPYBOT.EAS WORM!"
X	winupdate2846	vbsystem35.exe msvbrun.exe	"Added by a variant of the MUTIN-C TROJAN!"
X	winupdate86.exe	winupdate86.exe	"Added by the FAKEAV-AHQ TROJAN!"
X	WinUpdateAdministrator	CSRSS.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in C:\Application Data\WINDOWS"
X	WinUpdateB	breatle.exe	"Added by the BRATLE.AWORM!"
X	winupdateconn	[path to file]	"Added by the COMBRA-A WORM!"
X	winupdateconn_	Explorer.EXE	"Added by the COMBRA-B WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Winupdatee	winsvcc.exe	"Added by the AGENT.AN TROJAN!"
X	winupdatefiv_	[path to file]	"Added by the COMBRA.C WORM!"
U	WinUpdateProtection	csrss.exe	"EmployeeWatch is a commercial surveillance software program designed to monitor user activity on a computer. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a subfolder of C:\windowsupdate\ufp"
X	WinUpdater	update.exe	"Added by the STARTPAGE.C TROJAN!"
X	winupdates	winupdates.exe	"Added by the ALCRA-B WORM!"
X	winupdate_	[path to file]	"Added by the COMDOR.A WORM!"
X	WinUpdating	WinUpdating.exe	"Added by the AGENT-GSC TROJAN!"
X	WinUPDbc	winupdbc.exe	"Added by the BANKER-DSN TROJAN!"
X	WinUpdsv	winupdsv.exe	"Added by the DROPO MACRO!"
X	winupdt	RUNDLL32.EXE [random.dll]	"Added by the MABUT.A WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The random DLL file is found in the Windows or Winnt folder"
X	winupdtl	winupdtl.exe	"SecondThought adware"
X	WinUpgrader	[path to trojan]	"Added by the AGENT-DZ TROJAN!"
X	WinUPPD.exe	[random filename]	Added by an unidentified WORM/TROJAN!
X	winur	winrun.exe	"Added by the WINUR.B WORM!"
X	winusb.dll	winguard.exe	"Added by the FORBOT-CN WORM!"
X	WinUser32K	usr32wink.exe	Added by the HK TROJAN!
X	WinUsr	WinUsr.exe K1S2	"Added by the CLUNK.A WORM!"
U	WinUtilities Memory Optimizer	ToolMemoryOptimizer.exe	"""WinUtilities Memory Optimizer optimizes the memory management of your system and boost-up its performance amazingly!"" MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
X	Winux Piriax Service	PH32.EXE	"Added by the RANDEX.G WORM!"
X	winversion	winversion.exe	"Browser hijacker
U	WinVNC	WinVNC.exe	"WinVNC is an application that allows you to remote control your PC from another PC somewhere on the internet. Now superseded by RealVNC"
X	WinVNC	iexplorer.exe	"Added by the EVIVINC BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	winvxd32	winvxd32.exe	"Added by the GABLOLIZ.A WORM!"
X	winwan lptt01	winwan.exe	"RapidBlaster variant (in a ""Winwan"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	winwan ml097e	winwan.exe	"RapidBlaster variant (in a ""Winwan"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	WinwebSecurity	WinwebSecurity.exe	"Winweb Security rogue security software - not recommended
X	winword	winword.exe	"Added by the TORPID-C TROJAN!"
X	WINWORD.exe	WINWORD.exe	"Added by the DRIVUS TROJAN! Note - this is not the legitimate MS Word process of the same name
X	WinWorks	vstmgr.exe	"Added by the AGOBOT.ACJ WORM!"
X	winwsl.exe	winwsl.exe	"Added by the ZOTOB-J WORM!"
X	WinX Security Center	WinX Security Center.exe	"WinX Security Center rogue security software - not recommended
X	WINX16	winx16.exe	"Added by the AGOBOT-LS WORM!"
X	WinXDefender	WinXDefender.exe	"WinXDefender rogue spyware remover - not recommended
X	WinxDiagUpdate	WinxDiagUpdate	"Added by the RBOT.BWQ BACKDOOR!"
X	winXP	33.exe	"Added by the ANPES WORM!"
X	WinXP	plugin1.exe	Added by the Downloader-JW TROJAN!
X	WinXP	csrss.exe	"Added by the BANCOS-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\WinXP\Tools"
X	winxp	winxp.exe	"Added by the BRONTOK-DN WORM!"
X	WinXP fix	[path to file]	"Added by the RANKY.P TROJAN!"
X	WinXP Processor Generator v1.2	intspnsr32.exe	"Added by the SDBOT.LP WORM!"
X	Winxp update	Cappp.exe	"Added by the RBOT.DKO WORM!"
X	WinXp Updater	winxp32.exe	"Added by the RBOT-HG WORM!"
X	WinXP-98	CSRSS.exe	"Added by the BANKER-DS TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\WinXP-98\Tools"
X	winxpdll32.exe	winxpdll32.exe	Added by a variant of the SMALL downloader TROJAN!
X	WinXPHome	plugin2.exe	"Added by the malicious INOR.T SCRIPT!"
U	WinXPLoad	"Rundll32 LoadDll	LoadExe WinXPLoad.exe"
X	WinXProtector	WinXProtector.exe	"WinXProtector rogue security software - not recommended
X	WinXPService	lsass.exe	"Added by the ZAPCHAS-AS TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Lavan"" subfolder"
X	WinXPService	taksmgr.exe	Identified as a variant of the IRC/Flood.tool malware
X	WinXPService	Tskdbg.exe	"Added by the MDROP-BPQ TROJAN!"
X	WinXPService	ctfmon.exe	"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in a ""ctf"" sub-folder"
X	WinXPService	mirc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	WinXPService	nero.exe	"Added by the IRCFLOOD.AG BACKDOOR! Note - this is not the Nero CD/DVD burning software by Ahead Software which is normally located in %ProgramFiles%\Ahead\Nero. This file is found in %System%"
X	WinXPService	taksmgr.exe	"Added by the KIRSUN.A BACKDOOR! The file is located in %System%"
X	WinXPService	taksmgr.exe	"Added by the KIRSUN.A BACKDOOR! The file is located in the root directory
X	WinXPService	wacult.exe	"Added by the KIRSUN.A BACKDOOR! The file is located in %Windir%\Fonts"
X	WinXPService	wacult.exe	"Added by the KIRSUN.A BACKDOOR! The file is located in %System%\mnut"
X	WinXpUpdate32	WinXpUpdate32.exe	"Added by the AGENT.YWL WORM!"
X	winxpusbd	winxp64.exe	"Added by a variant of the RBOT WORM!"
X	winystems25	winystems.exe	"Added by a variant of the SDBOT WORM!"
X	Winz Firewall	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	WinZap Check	winzbp.exe	"Added by the RBOT-AWZ WORM!"
X	winzip	[path to trojan]	"Added by the BANCOS.G or BANCOS.K TROJANS! Note - this is not part of the popular WinZip file compression utility"
X	Winzip	[various filenames]	"Added by the LERPA-A WORM! Note - the file name will be one of the following common.exe
X	winzip	winzip.exe	"Added by the RBOT.BDA WORM! Note - this is not part of the popular WinZip file compression utility"
X	winzip	ir_ftp.exe	"Added by the BANCBAN-S TROJAN!"