NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

• "Y" - Normally leave to run at start-up
• "N" - Not required - typically infrequently used tasks that can be started manually if necessary
• "U" - User's choice - depends whether a user deems it necessary
• "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
• "?" - Unknown

	Startup Name	Process Name	Details
ME"	"MS Java Applets for Windows NT	X	javaapplets.exe
NT	"Ms Java for Windows 98	ME & XP"	X
NT	"Ms Java for Windows 98	XP & ME"	X
XP & ME	"MS Java for Windows NT	X	xpjavams.exe
Version	"NVIDIA Compatible Windows Vista Display driver	U	"RUNDLL32.EXE NvCpl.dll
Version	"NVIDIA Compatible Windows7 Display driver	U	"RUNDLL32.EXE NvCpl.dll
X	$WindowsRegKey%update	IEXPLORE.EXE	"Added by the RBOT-EZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	*windows update	wrauclt.exe	"Added by the RBOT-QU WORM!"
X	*windows update	wuanclt.exe	"Added by the RBOT-PG WORM!"
X	*windows update	wuaucrlt.exe	"Added by the SPYBOT.HUR WORM!"
X	*windows update	wuraclt.exe	"Added by the RBOT-PO WORM!"
X	*windows update	wurauclt.exe	"Added by the RBOT-SY WORM!"
X	*windows update	wsctl.exe	"Added by the SPYBOT.PR WORM!"
X	*windows update	wkmst.exe	"Added by the SDBOT.AVD WORM!"
X	*windows update	wscxt.exe	"Added by the RBOT.AOS WORM!"
X	*windows update	waurclt.exe	"Added by a variant of the RBOT WORM!"
X	*windows update	wuaruclt.exe	"Added by the RBOT-TF WORM!"
X	*Windows [filename] Checker	[filename]	"Added by the KEDEBE-B WORM!"
X	*WindowsAudio	systemupd.exe	"Added by the AGENT-TH WORM!"
U	12Ghosts JustAWindow	12window.exe	"12Ghosts JustAWindow - ""Cover annoying ads
X	A New Windows Updater	w32NTupdt.exe	"Added by the MYTOB.BM WORM!"
U	Actual Window Manager	ActualWindowManagerCenter.exe	"Actual Window Manager from Actual Tools - ""an innovative desktop organization application which introduces unconventional window controls and also automatic general window operations making your work more productive
U	Actual Window Minimizer	ActualWindowMinimizerCenter.exe	"Actual Window Minimizer - ""allows minimizing any window to task tray notification area or to the edge of the screen"""
U	AntiWindowsMessenger	AntiMsMsg.exe	"Anti-Windows_Messenger is a small application that prevents Windows Messenger from remaining resident in memory"
X	Auto Updat	WindowsSys32.exe	"Added by a variant of the FORBOT WORM!"
X	autoload	windowsupdate.exe	"Added by the POLYCRYP.DY TROJAN!"
X	Automated Windows Updates	wauclt.exe	"Added by the GAOBOT.AJD WORM!"
X	Automatic Microsoft Windows Updater	suchost.exe	"Added by the RBOT-EQ WORM!"
X	Automatic Windows Updater	Update.exe	"Added by the GAOBOT.AO WORM!"
X	BackUp Windows 2009	[random].exe	"Added by the AGENT-LUJ TROJAN!"
X	C:WINDOWSasam.exe	asam.exe	"Added by the PEACOMM.E TROJAN!"
X	C:WINDOWSIEXPLOR.EXE	IEXPLOR.EXE	"""Pop Marketing"" adware"
X	C:WINDOWSsystem32SetupCmd.exe	SetupCmd.exe	"Detected by Kaspersky as the AGENT.AAW TROJAN!"
X	C:WINDOWSWinTask.exe	WinTask.exe	"""Pop Marketing"" adware"
X	Cable Modem Adapter	WindowsSec.exe	"Added by the WOOTBOT.A WORM!"
X	Calc Microsoft Windows	wincalc.exe	Added by an unidentified WORM or TROJAN!
?	Canon PC1200 iC D600 iR1200G Status Window	CAPM1LAK.EXE	"Cannon printer related - is it required in startup?"
X	cftmon	WindowsUpdate.exe	"Added by the AGENT.AQK BACKDOOR!"
X	Compaq Sound Drivers For WINDOWS	sounddr.exe	"Added by the SDBOT-XG WORM!"
X	Config Loader for Microsoft Windows	mwincfg32.exe	"Added by the AGOBOT.BD WORM!"
X	CPU Windows Status	cpustats.exe	"Added by a variant of the RBOT WORM!"
U	cracked_windows1	cracked_windows1.exe	"Cracked Windows popup killer"
X	DirectX For Microsoft Windows	dtxservice.exe	"Added by the PROGENT TROJAN!"
X	DirectX for Microsoft Windows	Fservice.exe	"Added by the PRORAT TROJAN!"
X	DirectX for Microsoft Windows	Sservice.exe	"Added by the PRORAT TROJAN!"
X	DirectX For Microsoft® Windows	fservice.exe	"Added by the PRORAT-P TROJAN!"
X	DirectX For Microsoft® Windows	fservice.exe	"Added by the PRORAT-L TROJAN!"
X	DLINK dfe drivers for Windows NT	windfe.exe	"Added by the RANDEX.AK WORM!"
X	DRam prosessor	WindowsUpdate.exe	"Added by the RBOT-BBZ WORM!"
X	Explorer	Windows Explorer.exe	"Added by the SILLYFDC-I WORM!"
X	Framework Windows	frmwrk32.exe	"Added by the FAKEAV-KS TROJAN!"
X	FTP FOR WINDOWS	ftpwin32.exe	"Added by a variant of the RBOT WORM!"
X	Generic host proccess for windows	SVCHOSTS.EXE	"Added by the SPYBOT-GQ WORM!"
X	Gerenciamento de arquivos do Windows	Winmod32.exe	"Added by the DLOADER-WG TROJAN!"
X	gpmce	window.exe	"Added by the VB.CK WORM!"
X	HKLMRun	windowsupdate.exe	"Added by the FORBOT-BJ WORM (where HKLM\Run represents HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run)!"
X	Host Process for Windows Tasks	taskhost.exe	"Added by the BREDO-AI WORM! Note - this is not the valid Windows 7 process which has the same filename and the file description is also ""Host Process for Windows Tasks"". It is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	icrosoft Windows DLL Services Configuration	poker3.exe	"Added by the SDBOT-AER WORM!"
U	IE New Window Maximizer	iemaximizer.exe	"IE New Window Maximizer - automatically maximize new Internet Explorer and Outlook Express windows"
X	InternetExplorer2	windows.exe	"Added by the SDBOT-CZP WORM!"
N	Launch YahooPOPs! at Windows startup	YAHOOPOPS.EXE	"YahooPOPs - enables free POP3/SMTP access to Yahoo! Mail through a service on localhost that emulates the web interface. Available via Start -> Programs"
X	Live Windows Messenger Version	msnmessage7.7.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Live Windows Messenger Version	msnmsngrlive.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	LiveUpdate	[Windows username]05.exe	"Added by the LINEAGE TROJAN!"
X	LoadWindowsFile	Kernel32.exe	"Added by the DELF.B TROJAN!"
X	LoadWindowsFile	winreg.exe	"Added by the HUPIGON.A BACKDOOR!"
X	Major Microsoft Windows Driver Boot loader	bpool.exe	"Added by the MYTOB.AJ WORM!"
X	McAfee Windows Protection	mcafee32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsft Windows Adapter 5.1.3013	[random filename]	"Added by the SMALL.HIT TROJAN!"
X	microsft windows updates	mwupdate32.exe	"Added by a variant of the TOXBOT/CODBOT WORM!"
X	Microsof Windows Host	svhost32.exe	"Added by the RBOT.ADY WORM!"
X	Microsoft (R) Windows Configuration Backup Service	svchost.exe	"Added by the RANKY.X TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in either a ""config""
X	Microsoft (R) Windows DLL Loader	rundll32.exe	"Added by the RANKY.W TROJAN! Note - this is not the legitimate rundll32.exe process
X	Microsoft (R) Windows Network Latency Controller	1.tmp	"Added by a generic password stealer TROJAN - see here"
X	Microsoft (R) Windows Network Latency Controller	nlc.exe	"Added by a generic password stealer TROJAN - see here"
X	Microsoft (R) Windows Network Latency Controller	sp2vc.exe	"Added by a generic password stealer TROJAN - see here"
X	Microsoft (R) Windows Network Security Management Service	nsms.exe	"Added by the RANKY.LC TROJAN!"
X	Microsoft (R) Windows Protected Content Restoration Service	services.exe	"Added by the AGENT.AGV BACKDOOR! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\etc"
X	Microsoft (R) Windows Protocol Deployment Manager	[random].tmp	Added by an unidentified WORM or TROJAN!
X	Microsoft (R) Windows TCP/IP Socket Driver	[path to trojan]	"Added by the PROXY-DD TROJAN!"
X	Microsoft (R) Windows TCP/IP Socket Layer	services.exe	"Added by the RBOT.ARM WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\winsock"
X	Microsoft (R) Windows Update Service	wuauclt.exe	"Added by a variant of the SDBOT WORM! Note - this is not the legitimate wuauclt.exe process
X	Microsoft (R) Windows Vista/NT Runtime Compatibility Service	nrcs.exe	"Added by the RANKY.X TROJAN!"
X	Microsoft Corp SSL Certificates	windowz.exe	"Added by the RBOT-GCZ WORM!"
X	Microsoft Internet	windows32.exe	"Added by the SDBOT-F WORM!"
X	Microsoft IT Update	windows.exe	"Added by the RBOT-JM WORM!"
X	Microsoft Java Windows Update	[filename]	"Added by the RBOT-DZ WORM!"
X	Microsoft Kernel	Windows_kernel32.exe	"Added by the NETSKY.AE WORM!"
X	Microsoft Security Monitor Process	windowsupdate.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Service Pack	WindowsSP.exe	"Added by the RBOT-RF WORM!"
X	Microsoft Update	msawindows.exe	"Added by the GAOBOT.AFJ WORM!"
X	Microsoft Update	windows24.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	windows32.exe	"Added by the RBOT-BHQ WORM!"
X	Microsoft Update Machine	windowsu.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	windowsup.exe	"Added by the RBOT-FV WORM!"
X	Microsoft USB Windows2 Driver	usbautotuner.exe	"Added by the SILLYFDC.BCL WORM!"
X	MicroSoft Window Updater	winsupdater.exe	"Added by the RBOT-ZZ WORM!"
X	Microsoft Windows	mstask0.exe	"Added by the SDBOT.FQ WORM!"
X	Microsoft Windows	atup	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows	Microsoft Windows.hta	HTA file which creates an executable on the hard drive which subsequently proceeds to download files from a malware site!
X	Microsoft Windows	explorar.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows	[path to file]	"Added by the BDOOR-LI BACKDOOR!"
X	Microsoft Windows	bootini.exe	"Added by the VANEBOT-K WORM!"
X	Microsoft Windows	Kernel.exe	"Added by the EDIBARA-A VIRUS!"
X	Microsoft Windows	Kernel.vbs	"Added by the EDIBARA-A VIRUS!"
X	Microsoft Windows	pwjbvphi.exe	"Added by the RBOT-GQK WORM!"
X	Microsoft Windows	windets.com	"Added by the FLOOD-EQ TROJAN!"
X	Microsoft Windows (D)	iexplore.exe	Identified as a variant of the TrojanSpy.Agent malware
X	Microsoft Windows 128bit Subsystem	system12.exe	"Added by the RANCK-CZ TROJAN!"
X	Microsoft Windows 16Bit	mswinn16.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Windows 2000	Winupdsdgm.exe	"Added by the GAOBOT.AO WORM!"
X	Microsoft Windows 32 Update	win32update.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows 32Bit	mswinn32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows 64 Bit	mswin32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Adapter 5.1.3214	[worm filename].exe	"Added by the STRAT.GEN-3 WORM!"
X	Microsoft Windows Autowxckn	autowxckn.exe	"Added by the RBOT.DYZ BACKDOOR!"
X	Microsoft Windows Client Firewall	msclt.exe	"Added by the VANEBOT-F WORM!"
X	Microsoft Windows Communicator for NT/XP	wincomm.exe	"Added by the RBOT.ATH WORM!"
X	Microsoft Windows Config 32	win32conf.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Control	mswctl32.exe	"Added by the RBOT.JP WORM!"
X	Microsoft Windows CSRSS	csrss.exe	"Added by the KALEL-A WORM! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
N	Microsoft Windows Desktop Search System Tray	WindowsSearch.exe	System Tray access to Windows Desktop Search for XP from Microsoft - which adds additional search options including a search box on the Taskbar. This version (3.0.1) also includes the Windows Search (WSearch) service which indexes files and e-mails items so you can quickly find words and phrases. Disabling this entry does not affect the normal operation and this is the Windows Defender entry
N	Microsoft Windows Desktop Search Tool Tray Admin	WindowsSearch.exe	"System Tray access to Windows Desktop Search for XP from Microsoft - which adds additional search options including a search box on the Taskbar. For this version (2.6.*)
X	Microsoft Windows DHCP	___r.exe	"Added by the MASLAN.A or MASLAN.C WORMS!"
X	Microsoft Windows DLL 32-BIT	msncheck32.exe	"Added by the SDBOT-XX WORM!"
X	Microsoft Windows DLL Services	mwindll.exe	"Added by the SDBOT-VX WORM!"
X	Microsoft Windows DLL Services Configuration	newdll.exe	"Added by the SDBOT-ZR WORM!"
X	Microsoft Windows DLL Services Configuration	newdll2.exe	"Added by the SDBOT-ABD WORM!"
X	Microsoft Windows DLL Services Configuration	poker.exe	"Added by the SDBOT-ZY WORM!"
X	Microsoft Windows DLL Services Configuration	poker3.exe	"Added by the SDBOT-AAH WORM!"
X	Microsoft Windows DLL Services Configuration	proxy.exe	"Added by the SDBOT-ZL WORM!"
X	Microsoft Windows DLL Services Configuration	windir32.exe	"Added by the SDBOT.BHF WORM!"
X	Microsoft Windows DLL Services Configuration	windir32a.exe	"Added by a variant of the SDBOT.BHF WORM!"
X	Microsoft Windows DLL Services Configuration	windll32.exe	"Added by the SDBOT.BHD WORM!"
X	Microsoft Windows DLL Services Configuration	winDSL.exe	"Added by the SDBOT-ZG WORM!"
X	Microsoft Windows DLL Services Configuration	dllmanager32.exe	"Added by the SDBOT-BTU WORM!"
X	Microsoft Windows DLLHandler	bitpaint.exe	"Added by the SDBOT.AHG WORM!"
X	Microsoft Windows Drivers	windrv.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows DVR	windvr.exe	"Added by the RBOT-AXD WORM!"
X	Microsoft Windows Expl0rer	expl0rer.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Windows Explorer	iexplorer.exe	"Added by a variant of the RBOT WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Microsoft Windows Explorer	explorewin.exe	"Added by the IRCBOT.WORM.212480.H WORM!"
X	Microsoft Windows Express	Microsoft Update	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Windows Express	websploit.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Windows Express	windowslogonb.exe	"Added by the SDBOT.ABOO WORM!"
X	Microsoft Windows Files Loader	cgy32win.exe	"Added by the RBOT-AXR WORM!"
X	Microsoft Windows Game Updater	msgame32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows GUI	Windowz.exe	"Added by the RANDEX.AEV WORM!"
X	Microsoft Windows GUI	msmonk32.exe	"Added by the SDBOT-PE WORM!"
X	Microsoft Windows Kernel Services	winkrnl386.exe	"Added by the ZEBROXY TROJAN!"
X	Microsoft Windows Keyboard service	keyboard.exe	"Added by the RBOT-CRF WORM!"
X	Microsoft Windows Loader	wloader.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Windows Logon Process	winlogon.exe	"Added by the PROXYSER-R TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Windows Media Player	mediaplayer.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Media Player	wimp.exe	"Added by the RBOT-FN WORM!"
U	Microsoft Windows Media Player Network Sharing Service Configuration Application	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	Microsoft Windows Registry Service	wregistry.exe	"Added by the AGOBOT.AKG WORM!"
N	Microsoft Windows Search System Tray	WindowsSearch.exe	"System Tray access to Windows Search 4.0 for XP from Microsoft - which adds additional search options including a search box on the Taskbar. This version also includes the Windows Search (WSearch) service which indexes files and e-mails items so you can quickly find words and phrases. Disabling this entry does not affect the normal operation"
X	Microsoft Windows Secure	windocs.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Secure	windocs.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Secure Server	rpcxWindows.exe	"Added by the RBOT-LL WORM!"
X	Microsoft Windows Secure Update	rpcxwinupdt.exe	Added by an unidentified WORM or TROJAN!
X	Microsoft Windows Securety	wurguar.exe	"Added by the RBOT-KY WORM!"
X	Microsoft Windows Security	spvsper.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Security	wscndrives.exe	"Added by the RBOT-AJK WORM!"
X	Microsoft Windows Service	winsys.exe	"Added by the RBOT-ADP WORM!"
X	Microsoft Windows Service Pack	winspkn.exe	"Added by the RBOT-AYD WORM!"
X	Microsoft Windows Services	msw32.exe	"Added by the RBOT-FWQ WORM!"
X	Microsoft Windows Services	Sersices.exe	"Added by the SDBOT-NO WORM!"
X	Microsoft Windows Services Edt	ssvvcchhoosst.exe	"Added by the RBOT-FYF TROJAN!"
X	Microsoft Windows Services Edt	dllrun32.exe	"Added by the RBOT-GAF WORM!"
X	Microsoft Windows Session Manager Subsystem	smss.exe	"Added by the PROXYSER-R TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	Microsoft Windows Sidebar	Sidebar.exe	"Windows Sidebar is a pane on the side of the Microsoft Windows Vista desktop where you can keep your gadgets organized and always available. In Windows 7 this feature is known as Desktop Gadgets and each gadget can be placed anywhere on the desktop. If the file isn't located in %ProgramFiles%\Windows Sidebar or you're using other versions of Windows it could be part of the Searchcentrix hijacker"
X	Microsoft Windows Socketx32 Services	winsockx32.exe	"Added by the RBOT-FWT WORM!"
X	Microsoft Windows Sound	svghost.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Windows Sound	svshost.exe	"Added by the RBOT.RNE BACKDOOR!"
X	Microsoft Windows Sound	svuhost.exe	"Added by the KOLAB.XC WORM!"
X	Microsoft Windows Sound Drivers	sounddrivers.exe	"Added by the SLENFBOT.ABU WORM!"
X	Microsoft Windows Storage Machine Service	winms.exe	"Added by the RBOT-AHK WORM!"
X	Microsoft Windows SVCHOST	SVCHOST.exe	"Added by the VB.KV WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Microsoft Windows System	srwhost.exe	"Added by the RBOT-AWU WORM!"
X	Microsoft Windows System	syshost.exe	"Added by the RBOT-ASW WORM!"
X	Microsoft Windows System	System.exe	"Added by the VB.KV WORM!"
X	Microsoft Windows System Kernel	kernel32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows System Service Manager	winsvc.exe	"Added by the SPYBOT.LR WORM!"
X	Microsoft Windows Task Management	mstasks.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Task Manger	Mstosk.exe	"Added by the SDBOT-WW WORM!"
X	Microsoft Windows Tasks Management	taskmng.exe	"Added by the RBOT-FXK WORM!"
X	Microsoft Windows Updata	scvhost.exe	"Added by the RBOT.CEM BACKDOOR!"
X	Microsoft Windows Updata	windows.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Updata	[5 random letters].exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update	rundlls.exe	"Added by the HABRACK WORM!"
X	Microsoft Windows Update	msoffice2.exe	"Added by the RBOT-GB WORM!"
X	Microsoft Windows Update	spools.exe	"Added by the SDBOT.TD WORM!"
X	Microsoft Windows Update	svchos.exe	"Added by the SDBOT.AC WORM!"
X	Microsoft Windows Update	svcshost.exe	"Added by the FORBOT-CF WORM!"
X	Microsoft Windows Update	svmhost.exe	"Added by the FORBOT-CH WORM!"
X	Microsoft Windows Update	svshost.exe	"Added by the WOOTBOT.CJ WORM!"
X	Microsoft Windows Update	msnmessenger.exe	"Added by the SDBOT.AJ WORM!"
X	Microsoft Windows Update	msnwun.exe	"Added by the SDBOT-RM WORM!"
X	Microsoft Windows Update	scvvhost.exe	"Added by the FORBOT-DH WORM!"
X	Microsoft Windows Update	swwhost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update	MSNMSGR.EXE	"Added by the SDBOT-WM WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Microsoft Windows Update	svzhost.exe	"Added by the FORBOT-EV WORM!"
X	Microsoft Windows Update	sccvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update	scrhost.exe	"Added by the RBOT-AOW WORM!"
X	Microsoft Windows Update	mnswinsx.exe	"Added by the RBOT-AWH WORM!"
X	MICROSOFT Windows update	pdate.exe	"Added by the RBOT.BZT WORM!"
X	Microsoft Windows Update	srshost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update	rhost32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows Update	windowsupdate.exe	"Added by the AGOBOT.ON WORM!"
X	Microsoft Windows Update	servcs.exe	"Added by the SDBOT.AL BACKDOOR!"
X	Microsoft Windows Update	syssinfos.exe	"Added by the RBOT-FWR WORM!"
X	Microsoft Windows Update Application	wuap.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update Client	csrss.exe	"Added by the KEBEDE-G WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Systems32"
X	Microsoft Windows Update Client	services.exe	"Added by the AUTORUN.DVE WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Windows Update Logon	win-logon.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update Service	wupdmgr32.exe	"Added by the DOS.AUTOCAT TROJAN!"
X	Microsoft Windows Update Service	msnmsg.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Windows Update x86	[various filenames]	"Added by a variant of the RBOT WORM! Filenames seen include (but are not limited to firefox.exe
X	Microsoft Windows Update XP64	********.exe [* = random char]	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update XP64	updatexp64.exe	"Added by the SDBOT-AIM WORM!"
X	Microsoft Windows Update XP64	Lcuninst.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update XP64	mzhxlixm.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updater	winupdgm.exe	"Added by the GAOBOT.BI WORM!"
X	Microsoft Windows Updater	WINIUPDATES.EXE	"Added by the RBOT-KK WORM!"
X	Microsoft Windows Updater	WINUPDATE.EXE	"Added by the RBOT-LI WORM!"
X	Microsoft Windows Updater	TMNTSrv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Updater	win32upd.exe	"Added by the RBOT-EC WORM!"
X	Microsoft Windows Updater	msnupdateit.exe	"Added by the AGOBOT-RL WORM!"
X	Microsoft Windows Updater	windates.exe	"Added by the SDBOT.TE WORM!"
X	Microsoft Windows Updater	spoolvs.exe	"Added by the RBOT.ACQ WORM!"
X	Microsoft Windows Updater	suvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updater	winfix.exe	"Added by the RBOT-CM WORM!"
X	Microsoft Windows updaterD	log32zx.exe	"Added by the MYDOOM.W WORM!"
X	Microsoft Windows Updates	explorer32.exe	"Added by the SDBOT.VQ WORM!"
X	Microsoft Windows Updates	wsap32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updating System	msresource.exe	"Added by the RBOT-EAM WORM!"
X	Microsoft Windows Visual V2.0	msiutil.exe	"Added by the DELF.JPH TROJAN!"
X	Microsoft Windows W32 Services	mssw32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Windows WinSaSS Management	winsass.exe	"Added by the RBOT-APW WORM!"
X	Microsoft Windows WKS Service	gt.exe	"Added by the SDBOT.IR BACKDOOR!"
X	Microsoft Windows WKS Service	mstask0.exe	"Added by the SDBOT.FV WORM!"
X	Microsoft Windows Workstation	devcode.exe	"Added by the RBOT-AWL WORM!"
X	Microsoft Windows XP Configuration Loader	m32svco.exe	"Added by the SDBOT.WORM!.48548 WORM!"
X	Microsoft Windows XP/2K Explorer	winexplorer.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	MicrosoftWindows	[various filenames]	"MagicSearch - a CoolWebSearch parasite variant"
X	MicrosoftWindows	a@26m.exe	"Added by the KILLPAR-B TROJAN!"
U	Microsoft® Windows Mobile® Device Center	wmdc.exe	"Windows Mobile Device Center - mobile device management/synchronization software for Windows7/Vista
U	Microsoft® Windows® Operating System	Sidebar.exe	"Windows Sidebar is a pane on the side of the Microsoft Windows Vista desktop where you can keep your gadgets organized and always available. In Windows 7 this feature is known as Desktop Gadgets and each gadget can be placed anywhere on the desktop. If the file isn't located in %ProgramFiles%\Windows Sidebar or you're using other versions of Windows it could be part of the Searchcentrix hijacker"
N	Microsoft® Windows® Operating System	"RunDLL32.exe ehuihlp.dll	BootMediaCenter"
N	Microsoft® Windows® Operating System	p2phost.exe	"Signs a user into the People Near Me feature at login in Windows 7 and Vista. People Near Me enables you to use certain peer-to-peer (P2P) programs on a network - that ""identifies people nearby who are using computers and allows those people to send you invitations for programs such as Windows Meeting Space. They can only invite you to participate in programs that are installed on your computer."" Available via Start → Control Panel"
U	Microsoft® Windows® Operating System	ehTray.exe	"Media Center Tray Applet - part of Windows Media Center on XP MCE
N	Microsoft® Windows® Operating System	"rundll32.exe oobefldr.dll	ShowWelcomeCenter"
N	Microsoft® Windows® Operating System	stikynot.exe	"Microsoft Sticky Notes - virtual sticky notes tool from Windows Vista. This implementation of the popular yellow ""Post-It"" tool is part of the Tablet PC features and allows you to enter either handwriting (via a pen or mouse) or record a voice note. AVailable via Start → All Programs"
U	Microsoft® Windows® Operating System	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	Mircosoft Windows Developer Enviroment	devenv.exe	Added by an unidentified WORM or TROJAN!
X	Mircosoft Windows Developer Enviroment	devenv.exe	"Added by the RBOT.AUJ BACKDOOR!"
X	Mircrosoft Windows Config DLL	rundllc32b.exe	"Added by the RBOT-ZY WORM!"
X	Miscrosoft Windows Explorer	IEEXPLORER.exe	Reported as the SDBOT.YX WORM!
X	MS Java Applets for Windows NT & XP	javaapplet.exe	"Added by the RBOT.BHG WORM!"
X	Ms Java for Windows NT	MS32.exe	"Added by the VANEBOT-H WORM!"
X	Ms Java for Windows NT	msi32java.exe	"Added by the VANEBOT-I WORM!"
X	Ms Java for Windows NT	msjava.exe	"Added by the VANEBOT-E WORM!"
X	Ms Java for Windows NT	msi32info.exe	"Added by the RBOT.AFX WORM!"
X	MS Java for Windows XP & NT	javanet.exe	"Added by the VANEBOT-A WORM!"
X	MS Java Service Wrapper Windows NT & XP	wrapper.exe	"Added by the VANEBOT-D WORM!"
X	Ms Java Update For Windows NT/XP	msijavaupdt32.exe	"Added by the RANDEX.AF WORM!"
X	Ms sock for Windows NT	winser.exe	"Added by a variant of the SDBOT WORM!"
X	MS USB 2.0 Windows Support	msusb32.exe	"Added by a variant of the RBOT WORM!"
X	ms window update	******.exe [* = random character]	"Added by a variant of the RBOT WORM!"
X	MS Windows AOL Driver	MSAOLdrv.exe	"Added by the RBOT-ASP WORM!"
X	MS windows Data list process	MSDATLST.exe	Added by an unidentified WORM or TROJAN!
X	MS Windows Executor Process	MSEXECP32.exe	"Added by a variant of the RBOT WORM!"
X	MS Windows Local Directory	MSWLD32.exe	"Added by a variant of the RBOT WORM!"
X	MS Windows procces 32	msprocces.exe	"Added by the RBOT-AEZ WORM!"
X	MS Windows Process Class	MSPRCSS32.exe	"Added by the RBOT-YQ WORM!"
X	MS Windows Process Init	MSWPI32.exe	"Added by the RBOT-ASQ WORM!"
X	MS Windows Security Updater	updater.pif	"Added by the RBOT-AKY WORM!"
X	MS Windows System Alert	MSWSA32.exe	"Added by the RBOT-BFN WORM!"
X	MS Windows TASK Service	MSWTASK32.exe	"Added by a variant of the RBOT WORM!"
X	MS Windows Update	scguard.exe	"Added by the RBOT-YZ WORM!"
X	MS-DOS Windows Service	MS-DOS.PIF	"Added by the RBOT-AJW WORM!"
X	MSDN for Windows NT	msdn.exe	"Added by a variant of the RBOT WORM!"
X	MSDN for Windows NT & WinXP	msdnxp.exe	"Added by the IRCBOT-PE WORM!"
X	MSDN for Windows with NT's	msdn-nt.exe	"Added by the RBOT-EWD WORM!"
X	MSDOS Windows Service	MSDOS.PIF	"Added by the RBOT-AKF WORM!"
X	MSN Administration For Windows	msnadp32.exe	"Added by the BROPIA.W WORM!"
X	MSN Messenger Live Windows	messengerlive.exe	"Added by an unidentified WORM or TROJAN! See here"
N	MSN Search Toolbar	WindowsSearch.exe	"System Tray access to Windows Desktop Search for XP from Microsoft - which adds additional search options including a search box on the Taskbar. For this version
X	MSSQL for Windows NT & XP	mssqlsnt.exe	"Added by a variant of the SDBOT WORM!"
X	MsWindows DRT Drivers	wsdrt32.exe	"Added by the RBOT.ALT WORM!"
X	MsWindows SSL Drivers	mssl32.exe	"Added by the SPYBOT.API WORM!"
X	MSWindows SysCl	mscl32.exe	"Added by the RBOT.AHI WORM!"
X	MsWindows SysDate	sysmsvc.exe	"Added by the SPYBOT.FCD WORM!"
X	MSWindows Syspg	mspg32.exe	"Added by the RBOT-TB WORM!"
X	MSWindowsUpdate	Systern.exe	"Added by the RBOT-AFD WORM!"
X	MSWindowsUpdate	mswinup.exe	"Added by a variant of the SDBOT WORM!"
X	NAV Auto Updates	navwindows.exe	"Added by a variant of the SDBOT WORM!"
N	NB Windows Patterns	WINDBKGND.EXE	"Part of McAfee Nuts & Bolts. With Background Patterns
X	NDIS Adapter	windows.exe	"Added by the FORBOT-BR WORM!"
X	NT Windows System Manager Loader	csrlss.exe	"Added by the AGOBOT.OX WORM!"
X	NvCpl	windowsp.exe	"Added by a variant of the SDBOT WORM!"
X	Optimize Windows	Kuntilanak.exe	"Added by the SILLYFDC WORM!"
X	Pag Windows Monitor	pag.exe	"Added by the AGENT-EOT TROJAN!"
X	PreInstall Windows	[path] repcale.exe [path] beird.exe	"Added by a variant of the RANDON.AN WORM! Both files are located in %System%\detr"
X	Program in Windows	IEXPLORE.exe	"Added by the LOVGATE.AB WORM!"
?	ProgramWindow	more comp.exe	"??"
U	Quick Hide Windows	qhw.exe	"Quick Hide Windows from CronoSoft - ""provides a quick and easy way for home and office PC users to quickly get sensitive materials off the screen without closing programs or losing documents"""
X	Remote Procedure Call For Windows 32bit	rpc.exe	"Added by the RBOT-MD WORM!"
X	RpcxWindows Extensions	rpcxwinex.exe	"Added by the RBOT.ACP WORM!"
X	run windows	servic.bat	"Added by the REBOOT-AP TROJAN!"
X	Rundll32	Windows.exe	"Added by the QQPASS.E TROJAN!"
X	RunWindowsUpdate	uptodate.exe	"BrowserAid/BrowserPal foistware"
X	Security	WindowsSecurityUpdate.exe	"Added by a variant of the SDBOT WORM!"
X	Service System	windowsXP.exe	"Added by the BANCOS-EL TROJAN!"
X	services	windows32.exe	"Added by the FLYVB-C WORM!"
X	Shell Tray Window	ShellTraywnd.exe	"Added by the STULTDOR-A TROJAN!"
X	ShutDownWindows	"Rundll32.exe User	ExitWindows"
U	SiS Windows KeyHook	keyhook.exe	"Hotkey manager for Silicon Integrated Systems (SiS) based graphics chipsets - disable unless you use hotkeys"
X	Start	windows.vbs	Homepage hijacker
X	startwindowskeyuser	rundle2.exe	"Added by the JAVAKILLER TROJAN!"
X	Sun Java Console for Windows NT & XP	jconsole.exe	"Added by the VANEBOT-C WORM!"
X	svchost	windowsrx.exe	"Added by the AGOBOT-MZ WORM!"
X	Svchost Windows Remote Services	svhost.exe	"Added by the IRCBOT-IV WORM!"
X	svhost windows services	svhost8.exe	"Added by the RBOT-WQ WORM!"
X	Symantec Antivirus professional	windows .exe	"Added by a variant of the FORBOT WORM!"
X	Symantec Security Routine Addon for Microsoft Windows	navpxaw32.exe	"Added by the AGOBOT-GJ TROJAN!"
X	Syntax	windows32.exe	"Added by the SDBOT.CQ WORM!"
X	System	windowsps.exe	"Added by a variant of the RBOT WORM!"
X	System Information Manager	windowsNt.com	"Added by the SDBOT-ND WORM!"
X	System Service	msnwindows.exe	"Added by the SPYBOT.YCL WORM!"
X	systems usb driver	Windows2.exe	"Added by a variant of the RBOT WORM!"
X	SystemTray	Windowsupd.exe	"Added by a variant of the IRCBOT TROJAN!"
X	SystemWideHook for Windows NT	%WinHook32.exe	"Added by the MYDOOM.AC WORM!"
X	SystemWindows	scvhost.exe	"Added by the SILLYFDC-CG WORM!"
X	Syswindow	Syswindow.exe	"Added by the COW TROJAN!"
X	Tarefas do Windows	taskexec.exe	"Added by the AGENT-LSD TROJAN!"
X	Updade Windows	winlogom.exe	"Added by the TONAX-A TROJAN!"
X	Update for Windows	[various filenames]	"Added by the LERPA-A WORM! Note - the file name will be one of the following common.exe
X	Update Windows	EXPLORE.EXE	"Added by a variant of the SDBOT WORM!"
X	Update Windows	EXPLORE.EXE	"Added by a variant of the SDBOT WORM!"
X	WIN	windows.exe	"Added by the REATLE.C WORM!"
X	Win32 Info	windowsnfo.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Window	explore.exe	"Added by the GAOBOT.ADW WORM!"
X	Window Loader	Dos32.exe	"Added by the GAOBOT.AO WORM!"
X	Window Monitor	winmon32.exe	"Added by the SDBOT.RT WORM!"
X	Window Msn Live Messanger	msnmsgsls.exe	"Added by the RBOT.BJD BACKDOOR!"
X	Window service	[random filename]	"Added by the RBOT-ACH WORM!"
X	Window UDP Control Servic	winlogon.exe	"Added by the RBOT-GXN WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Window upadate	pe2.exe	"Added by a variant of the RBOT WORM!"
U	Window Washer	wwDisp.exe	"Window Washer from Webroot Software. Useful utility that deletes safe to remove files
X	window.exe	window.exe	"Added by the MITGLIEDER.H or MITGLIEDER.J TROJANS!"
X	window2	ssvchost.exe	"Added by the IRCBOT.H TROJAN!"
X	window2	ieupdate.exe	"Added by the FORBOT-BM WORM!"
U	WindowBlinds	wbload.exe	"WindowBlinds from Stardock. Skin application to change the appearence on Windows desktops. Available as an individual download or as part of Object Desktop. Required to restore settings if you use it. Available via right-click on the Desktop -> Properties -> Skins"
X	WindowEnhancer	Winex.exe	"SCBar foistware variant"
X	Windowfdgfds DasdLL Verifier	winupdatr.exe	"Added by the AGOBOT.HZ WORM!"
X	Windowfdgfds DasdLL Verifiew	[path to worm]	"Added by the RBOT-GGX WORM!"
X	Windowfdgfds DLL fgfdg Verifier	Windowsdldfglcheckkk.exe	"Added by the RBOT.CSP WORM!"
X	Windowfdgfds DLL fgfdg Verifier	winsecure.exe	"Added by a variant of the RBOT WORM!"
U	WindowFX	wfxload.exe	"Stardock WindowFX - ""Allows you to add an unprecedented number of special effects to windows"""
X	windown	wiusyt.exe	"Added by the QQPASS-M TROJAN!"
X	WindowRegKey update	wins.exe	"Added by the SPYBOT.I WORM!"
X	Windows	services.exe	"Added by the SOBER.X WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\WinSecurity and note the space at the beginning of the ""Startup Item"" field"
X	Windows	Kernel32.exe	"Added by the TENDOOLF.A WORM!"
X	Windows	msdos98.exe	Added by the PWSTEAL TROJAN!
X	Windows	Windows.exe	"Added by the KAZMOR.A
X	Windows	explorer.exe	"Added by the POEBOT-J WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	windows	[path to trojan]	"Added by the AIMWIN TROJAN!"
X	windows	hkey.exe	"Added by the GAOBOT.AFW WORM!"
X	windows	system copy.exe	"Added by the SALGA.A WORM!"
X	Windows	gearsec.exe	"Added by the STUBBOT-B WORM!"
X	Windows	run.exe	"Added by the SPYBOT.OFN WORM!"
X	Windows	system.exe	"Added by the SPYBOT.OBB WORM!"
X	WINDOWS	windows.exe	"Added by the MONBOT-A TROJAN!"
X	Windows	services.exe	"Added by the SOBER-Z WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\WinSecurity"
X	WINDOWS	jif.exe	"Added by the MYTOB.MK WORM!"
X	windows	iexplore.exe	"Added by the RBOT-UM WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows	services.exe	"Added by the DLOADR-GW TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Windows"" subfolder"
X	Windows	smss.exe	"Added by the BANCBAN-QF TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	windows	svchost.exe	"Added by the SLOMIRC-A WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	WINDOWS	ymssgr.exe	"Added by the BCKDR-PS BACKDOOR! Note - deactivates the Microsoft\Internet Connection Firewall (ICF)"
X	Windows	taskmngr.exe	"Added by a variant of the SDBOT WORM!"
X	Windows	Cfreer.exe	"Added by the CULLER-C WORM!"
X	Windows	Zser.exe	"Added by the CULLER-D WORM!"
X	Windows	spoovlss.exe	"Added by an unidentified WORM or TROJAN! See here"
X	windows	VBSyS.vbs	"Added by the ROCK-D WORM!"
U	Windows	WpcUmi.exe	"Notifications from the Parental Controls feature in Windows Vista. Note - disabling this entry does not disable Parental Controls and prevent it monitoring a users activity. On the controller account it prevents the pop-up on from displaying messages such as ""Reminder: View the Parental Controls activity report"". On the user account it prevents the warning messages appearing such as access has been denied and the Parental Controls icon appearing on the System Tray"
U	Windows & Internet Cleaner Pro	WICleaner.exe	"Windows & Internet Cleaner Pro - ""Powerful and easy to use internet surfing privacy protection & PC security software"""
X	Windows (ICS) Spooler	crtss.exe	"Added by a variant of the RBOT WORM!"
X	Windows (random character)	diskcheck.exe	"Added by the SINGU.B TROJAN!"
X	Windows .Net Manager	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows 128 Module	win128.exe	"Added by the FORBOT-ES WORM!"
X	Windows 2004	csrss.exe	"Added by the BANKER-DY TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Windows 2004\Tools"
X	Windows 32 Editor	Win32edit.exe	"Added by the WOOTBOT.GQ WORM!"
X	Windows 32 Rescue	win32resc.exe	"Added by the FORBOT-EU WORM!"
X	Windows 32 Update	Windows-Update.exe	"Added by a variant of the RBOT WORM!"
X	Windows 32-bit DLL Integrity Verifier	dllrun.exe	"Added by Remote Storm - a remote control tool that is a network application that allows users to manage and control PCs or networks from a remote location"
U	Windows Accelerators	setup.exe	"KeySpy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	Windows Account Alternation	wauclt.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Acer Service	acersv.exe	"Added by the IRCBOT.YFQ BACKDOOR!"
X	Windows Action	csrs.exe	"Added by the SECCMU-A WORM!"
X	Windows Activate System	syssv.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows AdControl	WinAdCtl.exe	Windupdates adware variant
X	Windows Additional Guard	WI[random characters].exe	"Windows Additional Guard rogue security software - not recommended
X	Windows AdService	WinAdServ.exe	Windupdates adware variant
X	Windows AdStatus	WinStat.exe	"Added by the BLESHARE!DR VIRUS!"
X	Windows AdTools	WinAdTools.exe	Windupdates adware variant
X	Windows Anti Verifier	Windows-Anti.exe	"Added by the RBOT.ETT WORM!"
X	Windows Anti Virus Control Center	avrscan.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Anti Virus Control Center	winavscan.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Anti-Virus Built 32	AntiVirus32.exe	"Added by the SDBOT-BG WORM!"
X	Windows APCI Verifier	dhcpserv.exe	"Added by the RBOT-FON WORM! Note - Disables the automatic startup of other software and deactivates the Microsoft Internet Connection Firewall (ICF)"
X	Windows API Control Task	apitsk32.exe	"Added by the MYTOB.HI WORM!"
X	Windows Application Layer	walg32.exe	"Added by the AGOBOT.ATN WORM!"
X	Windows Application Layer Gateway	walg32.exe	"Added by the AGOBOT-AAZ WORM!"
X	Windows applications server	SysShield.exe	"Added by the unregistered version of Personal Anti Malware rogue security software - not recommended
X	Windows ARP Detectionc	nvudlsp.exe	"Added by the AGENT.LMW BACKDOOR!"
X	Windows ARP Detectionc	winlogon.exe	"Added by the RBOT.EAB WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Windows ARP Detectioncx	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Windows ASN Service	rge.exe	"Added by the RBOT-AOK WORM!"
X	Windows ASN Service	[random filename]	"Added by the AGOBOT-TC WORM!"
X	Windows ASN4 Services	gamo.exe	"Added by the RBOT-EHK WORM!"
X	Windows Audio	snd.exe	"Added by the ACKANTTA.C WORM!"
X	Windows Audio Components	nncsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Audio Control	ppnsvc.exe	"Added by the HAM TROJAN!"
X	Windows Audio Layer	narsvc.exe	"Added by the IRCBOT.AFT BACKDOOR!"
X	Windows Audio Panel	nppsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Audio Service	sndmic32.exe	"Added by the ACKANTTA.C WORM!"
X	Windows Audio Services	jvm.exe	"Added by the ACKANTTA.F WORM!"
X	Windows Audio Startup	nndsvc.exe	"Added by the IRCBOT-AAE TROJAN!"
X	Windows Audio System	nndsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Authority Service	lsass.exe	"Added by the KALEL-E WORM! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	windows auto update	msblast.exe	"Added by the BLASTER.B WORM!"
X	windows auto update	penis32.exe	"Added by the BLASTER (or MSBLAST.A) WORM!"
X	Windows Auto Update	winupdater.exe	"Added by the SDBOT.TF WORM!"
X	Windows auto update	bazzi.exe	"Added by the AHKER.E WORM!"
X	Windows auto update	LSASS.exe	"Added by the AHKER.G WORM! Note - this is not the legitimate lsass.exe process
X	Windows Auto Updater	WINDOWSUPDATE.EXE	"Added by the SDBOT.PB WORM! Note the space at the beginning of the filename"
X	Windows Automatic Update	wuamgrder.exe	"Added by a variant of the RBOT WORM!"
X	Windows Automatic Updater	windrg.exe	"Added by a variant of the RBOT WORM!"
X	Windows Automatic Updates	dvldr.exe	"Added by the RBOT.MF WORM!"
X	Windows Automatical Updater	dcz.exe	"Added by the RBOT.CXS WORM!"
X	Windows AutomaticUpdater	runddls.exe	"Added by a variant of the RBOT WORM!"
X	windows automation	mslaugh.exe	"Added by the BLASTER.E WORM!"
X	Windows Automation	msdspr.exe	"Added by the SOLAME.A WORM!"
X	Windows Autostart Loader	notepad32.exe	"Added by a variant of the RBOT WORM!"
X	Windows backup	systemss.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Backup Configuration	IEXPLORER.exe	"Added by the GAOBOT.AZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Windows Baþlangýç Dosyasý	sistem.exe	"Added by the MUZK WORM!"
X	Windows Boot	winboot.exe	"Added by the AGENT.HBD TROJAN!"
X	Windows Boot	windowsboot.exe	"Added by the IRCBOT.AZT BACKDOOR!"
X	Windows Booter	winboot.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Booter!	winbooter.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Bootup	ms-wks32.exe	"Added by the RBOT-AFM WORM!"
X	Windows Bootup	Systemwks32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Bootup	task-mngr.exe	"Added by the RBOT-AWP WORM!"
X	Windows Browser Services	browser128.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Browser Services	browser32.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Browser Services	browser64.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Browser Services	Browsr32.exe	"Added by the IRCBOT.BUR BACKDOOR!"
X	Windows Browser Services	browsr64.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows bypass security SMSS Service	SbiCvy.exe	"Added by the RBOT-GRF WORM!"
X	Windows cfg	ascv.exe	"Added by the AGOBOT-SZ BACKDOOR!"
X	Windows Clean-Up Pro	WINDOWS CLEAN-UP PRO.Exe	"Windows Clean-Up Pro spyware remover - not recommended
X	Windows Cleaner Service	winclean.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Client	client.exe	"Added by the BACKDR-AM BACKDOOR!"
X	Windows Client Service 32	csrss.exe	"Added by the RBOT-ALB WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a drivers\winsdriver subfolder"
X	Windows Client/Server Runtime Server	csrs.exe	"Added by the RBOT.KD WORM!"
X	Windows CODE Fix Msy Startups	msyh32.exe	"Added by the AGOBOT.AKK WORM!"
X	Windows Command	wincmd.exe	"Added by the RBOT.ANV WORM!"
X	Windows Communicator	wincomm.exe	"Added by the AGOBOT-BH WORM!"
X	Windows Communicator for NT/XP	osndyrn.exe	"Added by the SDBOT-CPK WORM! Note - can terminate AV related processes"
X	Windows Compliant	[random filename]	"Added by the RBOT-IR WORM!"
X	Windows Computer Browser	bcwsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Conf	windowsconf.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Config	SSYS.EXE	"Added by the SPYBOT-DA WORM!"
X	Windows Config	wins.exe	"Added by the SPYBOT.JR WORM!"
X	Windows Config	RUNDLL.EXE	"Added by the SPYBOT-DX WORM! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	Windows Config	pvphost.exe	"Added by a variant of the SLAPER TROJAN!"
X	Windows Config	winconfig.exe	"Added by the IRCBOT.BAP BACKDOOR!"
X	Windows Config	ZANBOR.EXE	"Added by the SPYBOT-MH WORM!"
X	Windows Config Connection	msicll.exe	"Added by the RBOT-EXQ WORM!"
X	Windows Config Loader	Wincfg32.exe	"Added by the SILVERFTP TROJAN!"
X	Windows Config Manager	winconf.exe	"Added by the RBOT-AIT WORM!"
X	Windows Config Manager	Wincfgman32.exe	"Added by the AGOBOT-AL BACKDOOR!"
X	Windows Config System	config.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Configuration	wsys32.exe	"Added by the GAOBOT.FB WORM!"
X	Windows Configuration	wincfg32.exe	"Added by the MYTOB.ED WORM!"
X	Windows Configuration	WINHUB.EXE	"Added by the SPYBOT-CG WORM!"
X	Windows Configuration Loader	asclt.exe	"Added by the SDBOT-OA WORM!"
X	Windows Configuration Loader	msgfix.exe	"Added by the SDBOT-NP WORM!"
X	Windows Configuration System	IExplore.exe	"Added by the RBOT-DDG WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows Configuration Utility	winxupdate.exe	"Added by the AGOBOT.LW WORM!"
X	Windows Configurator	winconf.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows connection manager	Internet.exe	"Added by the RBOT-APN WORM! Note - file is found in the Windows or Winnt folder. Make sure you check the link on this one
X	Windows Console	wkssvc.exe	"Added by the SDBOT-DJX WORM!"
X	Windows Console Component	wrasvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Console Monitor	[path to worm]	"Added by the KEDEBE WORM!"
X	Windows Console Monitor	gcasAV32.exe	"Added by the KEDEBE-A WORM!"
X	Windows Console Norms	wnbsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Console Source	wnbsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Control	Control.exe	"Added by the GREK.A TROJAN! If there is another file with the same file name in the Windows folder
X	Windows ControlAd	WinCtlAd.exe	Windupdates adware variant
X	Windows Controls Center	winudmr.exe	"Added by the LAMER.AA BACKDOOR!"
X	Windows Core Kernel Update	win32bootcfg.exe	"Added by the RANCK-EL TROJAN!"
X	Windows CPU host	winbog32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Critical Alert	wincrt.exe	"Added by the ALEDO-A TROJAN!"
X	Windows Custom Services	CSRCS.EXE	"Added by the SPYBOT-EI WORM!"
X	Windows Data Server	autodisc.exe	"Added by the SPYBOT-CB WORM!"
X	Windows Data Server	[random name].exe	"Added by the SPYBOT-DS WORM!"
X	Windows Database	WinDat.exe	Added by an unidentified WORM or TROJAN!
X	Windows Database	wiinsvc.exe	"Added by the AGOBOT-RU WORM!"
X	Windows Dcom2 Fix	mscom32.exe	"Added by the RBOT-QT WORM!"
X	Windows DDE Loader	windde32.exe	"Added by the SDBOT-UZ WORM!"
X	Windows debug logging	winlogg.exe	"Added by the RBOT-OY WORM!"
X	Windows debug logging	winloggs.exe	"Added by the RBOT-QN WORM!"
X	Windows Debugger	windbg.exe	"Added by the FORBOT-BY WORM!"
X	Windows Debugger	msdbg32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Debugger	windbg32.exe	"Added by the ZOTOB.L WORM!"
X	Windows Debugging Tools	updatecfg.exe	"Added by the RBOT-AXU WORM!"
X	Windows Default Configuration	svchost.exe	"Added by the DLOADER-U TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Windows Default Server	wfdmgrsp.exe	"Added by the IRCBOT.BCX BACKDOOR!"
X	Windows Default Server	winampa.exe	"Added by the IRCBOT.AUN WORM! Note - this is NOT associated with the popular Winamp media player. The valid file for the Winamp Agent resides in a ""Winamp"" subdirectory of the Program Files directory"
Y	Windows Defender	MSASCui.exe	"Main user interface for Microsoft's Windows Defender on XP/Vista - which ""helps protect your computer against pop-ups
X	Windows Defender	wdc*.exe	"Added by a variant of the FakeAlert TROJAN! This infection displays fake Windows Defender alerts which link to spyware-kicker.com"
X	Windows Defender Adds	wda*.exe	"Added by a variant of the FakeAlert TROJAN! This infection displays fake Windows Defender alerts which link to spyware-kicker.com"
X	Windows Defender Monitor	wdm*.exe	"Added by a variant of the FakeAlert TROJAN! This infection displays fake Windows Defender alerts which link to spyware-kicker.com"
X	Windows Defender Updater	wdu*.exe	"Added by a variant of the FakeAlert TROJAN! This infection displays fake Windows Defender alerts which link to spyware-kicker.com"
X	WINDOWS DENEME	deneme.exe	"Added by the MYTOB-CR WORM!"
X	Windows Desktop Controler	windesktop.exe	"Added by the SDBOT-XH WORM!"
X	Windows Desktop Daemon	winpadg.exe	"Added by a variant of the SPYBOT WORM!"
N	Windows Desktop Search	WindowsSearch.exe	System Tray access to Windows Desktop Search for XP from Microsoft - which adds additional search options including a search box on the Taskbar. On earlier versions this entry also runs the indexing function at startup which indexes files and e-mails items so you can quickly find words and phrases (replaced by a service in later versions). Disabling this entry does not affect the normal operation and indexing will occur when you next perform a search
X	Windows Dialup Service	dialup.exe	"Added by the AGOBOT.AAH WORM!"
X	Windows Disk Defragmenter	wpabaln32.exe	"Added by the BANCOS-ASJ TROJAN!"
X	Windows Disk Manager	cmnvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Display Coupler	display.exe	"Added by the IRCBOT-YS TROJAN!"
X	Windows DLL host	winupd32.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows DLL Host	dllhost32.exe	Added by an unidentified WORM or TROJAN!
X	Windows DLL Loader	RUNDLL16.EXE	"Added by the DOMWIS TROJAN!"
X	Windows DLL Loader	defragfat32z.exe	"Added by the LINKBOT.A WORM!"
X	Windows DLL Loader	rundll32.exe	"Added by the WHIPSER-B WORM! Note - this is not the legitimate rundll32.exe process"
X	Windows DLL Loader	defragfat32pi.exe	"Added by the RBOT-QQ WORM!"
X	Windows DLL Loader	defragfat39.exe	"Added by the POEBOT-C WORM!"
X	Windows DLL Loader	defragfatz.exe	"Added by the LINKBOT.H WORM!"
X	Windows DLL Loader	defragfat32.exe	"Added by the SDBOT-SS WORM!"
X	Windows DLL Loader	defragfat32abc.exe	"Added by the RBOT-RG WORM!"
X	Windows DLL Loader	wdevice.exe	"Added by a variant of the SDBOT WORM!"
X	Windows DLL Loader	SYSCFG16.EXE	"Added by the DOMWIS-N WORM!"
X	Windows DLL Loader	WINCFG32.EXE	"Added by the AGOBOT-TE WORM!"
X	Windows DLL Loader	defragfatx.exe	"Added by the POEBOT-F WORM!"
X	Windows DLL Services	winsvc32.exe	"Added by the RBOT-ZF WORM!"
X	Windows DLL Services	svchost.exe	"AGENT.H spyware. Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Windows DLL Services	system.exe	"AGENT.H spyware"
X	Windows DLL Tracker	spoolsrv.exe	"Added by a variant of the WOOTBOT WORM!"
X	Windows DLL Verifier	xptl.exe	"Added by a variant of the RBOT WORM!"
X	Windows DLL Verifier	windlls.exe	"Added by the RBOT-AZQ WORM!"
X	Windows DNS	windns.exe	"Added by the SDBOT-XU WORM!"
X	Windows DNS Daemon	windnsd.exe	"Added by the WOOTBOT.AS WORM!"
X	Windows Domain Name Drivers	windns.exe	"Added by the FORBOT-EP WORM!"
X	Windows DOS	dosw.exe	"Added by the SALAY-A WORM!"
X	Windows DotFix live	msdotfix.exe	"Added by the IRCBOT.XGK BACKDOOR!"
X	Windows Download Manager	windlmngr.exe	Added by an unidentified TROJAN!
X	Windows Drive Compatibility	System32Driver32.exe	"Added by the SUPOVA.Z WORM!"
X	Windows Driver	winxpdriver.exe	"Added by the WOOTBOT.EE WORM!"
X	Windows Driver	windrive.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Driver Adapter	svchost.exe	"Added by the ANTINNY-K WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	Windows Driver Foundation	MTVSCMXT.EXE	"Added by a variant of the RBOT WORM!"
X	Windows Driver Services	msdrvs32.exe	"Added by the WOOTBOT.L WORM!"
X	Windows Driver Sup	windvrhost.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows driver update	dmsvc32.exe	"Added by the SDBOT-GP BACKDOOR!"
X	Windows driver update	Ipconfig32.exe	"Added by the SDBOT-JV WORM!"
X	Windows Driver!	windriver.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Drivers	ssms.exe	"Added by the RBOT-AT WORM!"
X	Windows drivers update	windowsupdate.exe	"Added by the RBOT-ACE WORM!"
X	Windows Dynamic Library Cache	dllcache.exe	"Added by the INJECT-HT TROJAN!"
X	Windows Dynamic Loading Header	winDLL32.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Email Server	wmserv.exe	"Added by the FOUNDU-AWORM!"
X	Windows Enterprise Defender	WindowsEDefender.exe	"Windows Enterprise Defender rogue security software - not recommended
X	Windows Enterprise Suite	WE[random characters].exe	"Windows Enterprise Suite rogue security software - not recommended
X	Windows Essensials	mvnesc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Event Detection	wecsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Event Provider	wposvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Event Section	sntsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Event Service	winserv.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Executable	winmys.exe	"Added by the RBOT-ABO WORM!"
X	Windows Executer	bling.exe	"Added by the SDBOT-DFT WORM!"
X	Windows Executer	svchostie.exe	"Added by the EGGDROP.V BACKDOOR!"
X	Windows ExpIorer	[random filename]	"Added by the RBOT-AKO WORM!"
X	Windows Explorer	[filename].exe	"Added by the SDBOT TROJAN!"
X	Windows Explorer	Lsas.exe	"Added by the GAOBOT.AO WORM!"
X	Windows Explorer	olecom32.exe	Added by an unidentified WORM or TROJAN!
X	Windows Explorer	EEXPLORER.EXE	"Added by a variant of the SPYBOT WORM!"
X	Windows Explorer	explorer.exe	"Added by the POEBOT-J WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Windows Explorer	explorer.pif	"Added by the RBOT-AID WORM!"
X	Windows Explorer	system32.exe	"Added by the RBOT-AJH WORM!"
X	Windows Explorer	explorer32.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Explorer	Windows Explorer.EXE	"Added by the VB-EBA WORM!"
X	Windows Explorer	system.exe	"Added by the STIRAUT WORM!"
X	Windows Explorer Key	explorer.exe	"Added by the IRCBOT-YB WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Windows Explorer Services	exploresys.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Explorer Shell	Winexec32.exe	"Added by the REDIST.B WORM!"
X	Windows Explorer SP2	csrss.exe	"Added by the BANKER-DM TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""JavaBeans"" subfolder"
X	Windows Explorer Update Build 1142	EXPLORER32.EXE	"Added by the KaZaA based KWBOT or KWBOT.Y WORMS!"
X	Windows Explorer-3212	WINRE16.EXE	"Added by the HARDOC WORM!"
X	Windows Explorer.exe	Explorer.exe	"Added by the FALTER-A TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Windows Express	pci32b.exe	"Added by the BUZUS.C TROJAN!"
X	Windows Extensions for Win32	winprgs32.exe	"Added by the SDBOT.AFA WORM!"
N	Windows Eyes	??	"For blind people
X	Windows FAT 32	WINFAT32B.exe	"Added by the SPYBOT-AGT WORM!"
X	Windows File Migration Wizard	HIMENSYST.EXE	"Added by the RBOT-EMO WORM!"
X	Windows File Protection	winprotect.exe	"Added by the AGOBOT.JB WORM!"
X	Windows File System Frame	ntframe.exe	Added by an unidentified WORM or TROJAN!
X	Windows File Verification Service	wfvs.exe	Added by the RANKY.AC TROJAN!
X	Windows File XP Manager	wfdmgr.exe	"Added by the SDBOT.XD TROJAN!"
X	Windows FileSharing Service	mcwsvc.exe	"Added by the IRCBOT.AJF BACKDOOR!"
X	Windows Firevall Control C	rundll.exe	"Added by the GAERTOB.A TROJAN!"
X	Windows Firewal	Lsess.exe	"Added by a variant of the RBOT WORM!"
X	Windows Firewall	WindowsFirewall.exe	"Added by the MYTOB.AO WORM!"
X	Windows Firewall	svchost.exe	"Added by the PROXY-HT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Firewall	ipservice32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Firewall	rundll32.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Firewall Log	winlog.exe	Added by an unidentified WORM or TROJAN!
X	Windows Firewall Manager	msfw.exe	"Added by the RBOT.WR WORM!"
X	Windows firewall manager	chh.exe	"Added by a variant of the RANDEX.GEL WORM!"
X	Windows firewall manager	msguard.exe	"Added by a variant of the RANDEX.GEL WORM!"
X	Windows Firewall Service	wfsvc.exe	"Added by the IRCBOT-YL WORM!"
X	Windows Firewall Updater	updatees.exe	"Added by the RBOT-GBX WORM!"
X	Windows Firewall Updater	cronos.exe	"Added by the RBOT-GBY WORM!"
X	Windows Firewall Updater	ctfcom.exe	"Added by the RBOT-GCB WORM!"
X	Windows Firewall Updater	windowsupdate.exe	"Added by the SPYBOT.AVEO WORM!"
X	Windows Firewalll	scvhost.exe	"Added by the RBOT-EK WORM!"
X	Windows Firewalll	sphost.exe	"Added by a variant of the RBOT WORM!"
X	Windows Firewalll	svvhost.exe	"Added by a variant of the RBOT WORM!"
X	Windows Firewalll	winmu.exe	"Added by a variant of the RBOT WORM!"
X	Windows Fix	integator.exe	"Added by the SDBOT.ZAB WORM!"
X	Windows Fixer	winfix.exe	"Added by the VIRUT-I VIRUS!"
X	Windows Fixes Systems	elite.exe	"Added by the MYTOB.EG WORM!"
X	Windows FormatAd	WinForm.exe	Windupdates adware variant
X	Windows Frame Works	frmwrks32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Framework	frmwrk.exe	"Added by the DWNLDR-GWV TROJAN!"
X	Windows Framework	scvh0st.exe	"Malware installed by different rogue security software including SpyKillerPro and the XP AntiVirus series"
X	WINDOWS FUCK BY CLASIC	fuck.exe	"Added by the ZOTOB.H or ZOTOB.J WORMS!"
X	Windows Gamma Display	wingamma.exe	"Antivirus 2010 rogue security software - not recommended
X	Windows Generic Proc	procmsg.exe	"Added by the ALLIM.B WORM!"
X	Windows Generic Services	winsvc32.exe	"Added by the AGOBOT-ZF BACKDOOR!"
X	Windows Genuine	svghost.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows Genuine Validate	winservicessss.exe	"Added by the IRCBOT.UUI BACKDOOR!"
X	Windows Global Init	ngpsvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows GMT32	wingmt32.exe	"Added by the MYTOB.KM WORM!"
X	Windows Graphics Loaders	wingraphics.exe	"Added by the SPYBOT.JG WORM!"
X	Windows Guard	WAUMGRD.EXE	"Added by the RBOT-GY WORM!"
X	Windows Guard Pro	WindowsGP.exe	"Windows Guard Pro rogue security software - not recommended
U	Windows Guardian	thehel1iawgrd32.exe	Part of First Aid by Cybermedia who were subsequently bought by McAfee (Network Associates). Protects your Windows system from application failure and crashes
U	Windows Guardian	Fawgrd32.exe	Part of First Aid by Cybermedia who were subsequently bought by McAfee (Network Associates). Protects your Windows system from application failure and crashes
X	Windows haz Layer	[5 random letters].exe	"Added by a variant of the RBOT WORM!"
X	Windows Help	mailinfo.exe	"Added by the MYTOB.JX WORM!"
X	Windows Help	Stney.exe	"Added by the AGOBOT-VI WORM!"
X	Windows Help File	winhelper32.exe	"Added by the SDBOT-QK TROJAN!"
X	Windows Help Manager	svchost32.exe	"Added by the RBOT-OZ WORM!"
X	Windows Help Service	winhelpsv.exe	"Added by the RBOT-LP WORM!"
X	Windows Help Service	winhlp.pif	"Added by the RBOT-AKW WORM!"
?	Windows Help System	Help.pif	"??"
X	Windows Helper	winhelp.exe	"Added by the BANKER.APE TROJAN!"
X	Windows Helper	wsctnfy.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Hijack Protection	comngr.exe	"Added by the AGENT-FYD TROJAN!"
X	Windows Hijack Protection System	commngr.exe	"Added by a variant of the AGENT-FYD TROJAN!"
X	Windows his Layer	pilotGame.exe	"Added by the RBOT.GLX WORM!"
X	Windows Host	hosts.exe	"Added by the KELVIR.U WORM!"
X	Windows Host	winhost.exe	"Added by the PRYSAT TROJAN!"
X	Windows Host Booter	hostbooter.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Windows Host Device	hostsvc.exe	"Added by the ZOOTY-A WORM!"
X	Windows Host Name	lmass.exe	"Added by the GAOBOT.O WORM!"
X	Windows Host Service	scvhosts.exe	"Added by the SPYBOT.NLI WORM!"
X	Windows Host Service	host.exe	"Added by the KELVIR.AN WORM!"
X	Windows Host Service	svchoste.exe	"Added by the KELVIR.BF WORM!"
X	Windows Host Service	svchosts32.exe	"Added by the KELVIR.AW WORM!"
X	Windows Host32 Starter	hostserv.exe	"Added by the SDBOT-WU WORM!"
X	Windows Hosts	hosts.exe	"Added by the KELVIR-O TROJAN!"
X	Windows Hosts	winhosts.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows HP Drivers	hpdmws.exe	"Added by the SDBOT.AQU WORM!"
X	Windows HTML file reader	Sysconf32.exe	"Added by the NOOMY.A WORM!"
X	Windows HTTP services	winhttps.exe	"Added by a variant of the SDBOT WORM! See here"
X	Windows Icons Manager	wicomgr.exe	"Added by the RBOT-AIF WORM!"
X	WINDOWS ID SYSTEM	wID32.exe	"Added by the MYTOB.LN WORM!"
X	Windows Identify	sysays.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows Image	wintimage.exe	"Detected by Avast as the SDBOT-GEN44 WORM!"
X	Windows Image Acquisition (WIASC)	WIAcs.exe	"Added by the RIZO.A TROJAN!"
X	Windows Image Acquisition (WIASSC)	WIAcss.exe	"Added by the RIZO.A TROJAN!"
X	Windows iMessenger Messenger	winimsg.exe	"Added by the ALLIM.A WORM!"
X	Windows Incontext	InSearch.exe	"PacerD_Media/Pacimedia.com/Z-Quest adware installer"
X	Windows Insecure	[path to worm]	"Added by the RBOT-FSM WORM!"
X	Windows installer	winstall.exe	"SpySheriff malware. For more information on registry key changes see SPYWAD-E"
X	Windows Installer	ntdll.exe	Added by an unidentified WORM or TROJAN!
X	Windows Installer 1	msnconfig.exe	"Added by the PURITYSCN.B TROJAN!"
X	Windows Instruction Services	winstruct32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Internet Browser Services	internet.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Internet Browser Services	internet128.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Internet Browser Services	internet32.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Internet Browser Services	internet64.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Internet Explorer 6	firefox.exe	"Added by the SPYBOT.ANA WORM! Note - this is not the Mozilla Firefox web browser which is always located in %ProgramFiles%\Mozilla Firefox. This file is found in %System%"
X	Windows Internet Manager	svchost.exe	"Added by the IRCBOT-AAC TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Internet Protocol	winproc32.exe	"CoolWebSearch Winproc32 parasite variant - also detected as the STARTPA-BF TROJAN!"
X	Windows Internet Protocol	deinst_qfe001.exe	Added by a variant of the Win32.Small TROJAN!
X	Windows Internet Service	wininet.exe	"Added by the RBOT-AUX WORM!"
U	Windows IP Security	ipsec.exe	"Related to the VPN IPSec utility - used to create Security Policy (SP) entries and Security Association (SA) entries in the kernel"
X	Windows IP Security Service	ipsecs.exe	"Added by the RBOT.BPW WORM!"
X	Windows IPv6 Drivers	wipv6.exe	"Added by the SDBOT-VJ WORM!"
X	Windows Java Update	weatherBug32.exe	"Added by a variant of the RBOT WORM!"
X	Windows JavaScript Daemon	Winjsd.exe	"Added by the WOOTBOT.AF WORM!"
X	Windows Kernel 64	kernal64.exe	"Added by the YIMP-B WORM!"
X	Windows Kernel System Service	wkssvr.exe	"Added by a variant of the RANDEX.GEL WORM!"
X	Windows kev Messenger	mskev.exe	"Added by the SDBOT-XV WORM!"
X	Windows Keyboard Services	winkeyboard.exe	"Added by the IRCBOT.AFS WORM!"
X	Windows Keyboard Services	winkeybrd.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Keyboard Services	winkeybrd32.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Live	msgnms.exe	"Added by the XPACK.AV TROJAN!"
X	Windows Live	WindowsLive.exe	"Added by the REALBOT-A WORM!"
X	Windows Live Care.exe	WindowsLiveCare.exe	"Added by unidentfied MALWARE - see here! Do not confuse with Microsoft's Windows Live OneCare security software which is found in %ProgramFiles%\Microsoft Windows OneCare Live. This one is found in %System% and runs from both the HKLM\Run & HKLM\RunServices registry keys"
X	Windows Live Client	msnclient.exe	"Added by a variant of the IRCBOT TROJAN! See here"
U	Windows Live Family Safety Filter	fsui.exe	"System Tray access to and notifications from Windows Live Family Safety - optionally installed as part of Windows Live Essentials. ""With Family Safety
X	Windows Live Manager	winlivemgr.exe	"Added by the SHEUR.EB TROJAN!"
X	Windows Live Messages	msgnlive.exe	"Added by the AGENT.AYH WORM!"
X	Windows Live Messenger	msnmsgr.exe	"Added by a variant of the RBOT WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Windows live Messenger	msn.com	"Added by the IRCBOT-AAV WORM!"
X	Windows Live Messenger	msnlive.exe	"Added by the RBOT.BMV BACKDOOR!"
X	windows Live Messenger	iexplore.exe	"Added by the BCKDR-QTS BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
N	Windows Live Messenger	msnmsgr.exe	"Windows Live Messenger (was MSN Messenger) utility - available via the Start menu. Disable by clicking on the ""Show menu"" icon and select Tools → Options → Sign In → deselect ""Automatically run Windows Live Messenger when I log on to Windows"". This is the Windows Defender/Vista MSConfig entry for version 14.*"
X	Windows Live Messenger	[random].exe	"Added by the RBOT-GVL WORM!"
X	Windows Live Messenger	msnd.exe	"Added by the BCKDR-QQQ BACKDOOR!"
X	Windows Live Messenger 8.12	ctfmon.exe	"Added by the LIPARK-A WORM! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in %UserProfile%"
X	Windows Live Messenger Addon	wllivemsngr.exe	"Added by a variant of the SDBOT WORM! See here"
X	Windows Live Messenger Servicer	msmgslive.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Live Messenger Services	msgrlive.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Live Messenger!	livemsngr.exe	"Added by the IRCBOT.AWE BACKDOOR!"
X	Windows Live Messenger!	msgrlive.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Live Msgs	wlivemsg.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Live Msgs!	wlivemsgs.exe	"Added by a variant of the IRCBOT TROJAN! See here"
Y	Windows Live OneCare	winssnotify.exe	"System Tray access to and notifications from Windows Live OneCare - now superseded by Microsoft Security Essentials. ""OneCare helps keep your PC safe and secure while making your life easier. From virus scanning and file backups
X	Windows Live Service	msnlive.exe	"Added by the SLENFBOT.DI WORM!"
X	Windows Live Servicer	usrserv.exe	"Added by the SMALL.LU BACKDOOR!"
X	Windows live Support	wlmsngr.exe	"Added by the RBOT-BKL WORM!"
U	Windows Live Sync	WindowsLiveSync.exe	"Windows Live Sync from Microsoft (formerly known as Windows Live FolderShare) - ""a free-to-use internet-based file synchronization application by Microsoft that is designed to allow files and folders between two or more computers be in sync with each other on Windows (Vista and later) and Mac OS X based computers"""
U	Windows Live™ OneCare™ Family Safety	fssui.exe	"System Tray access to and notifications from Windows Live OneCare Family Safety - part of the Live OneCare range and now superseded by Windows Live Family Safety which is part of Windows Live Essentials. Allows you to decide how your kids experience the Internet by limiting searches
?	Windows Load	windows.com	"??"
X	Windows Loader	wstart32.exe	"Added by the GAOBOT.CA WORM!"
X	Windows Loader	winServices.pif	"Detected by Kaspersky as the CARDSPY.D TROJAN!"
X	Windows Loader	SysUpdate.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Loader Service	civsc.exe	"Added by a variant of the RBOT WORM!"
X	windows Loadxm	Win_.exe	"Added by the FODDER-A TROJAN!"
X	Windows Local ISP	winthcr.exe	"Added by the SDBOT.ENZ BACKDOOR!"
X	Windows Local Services	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Spooler	lssas.exe	"Added by the RBOT.BXQ WORM!"
X	Windows Locator	wsass.exe	"Added by the IRCBOT.N TROJAN!"
X	Windows Log Agent	winlogon.exe	"Added by the KEYLOGGER.AVK TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files"
X	Windows Logger	winlog.exe	"Added by the NSHADOW-B TROJAN!"
X	Windows logging	winlogd.exe	"Added by the RBOT-ON WORM!"
X	Windows logging	asgasg.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Logical Adapter	wsrsvc.exe	"Added by the IRCBOT.ARU BACKDOOR!"
X	Windows Logical Connection	wcnsvc.exe	"Added by the VIRUT.AO VIRUS!"
X	Windows Login	explored.exe	"Added by the GAOBOT.SY WORM!"
X	Windows Login	winlog.exe	"Added by the AGOBOT.MG WORM!"
X	Windows Login	lmss.exe	"Added by the AGOBOT-JA WORM!"
X	Windows Login	msnmsgr.exe	"Added by the AGOBOT-UC WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Windows Login	login.exe	"Detected by NOD32 as a variant of the BIFROSE TROJAN!"
X	Windows Login	lms.exe	"Added by the AGOBOT-IC WORM!"
X	Windows Login Folder	winzep.exe	"Added by the AGOBOT-TZ WORM!"
X	Windows Login Manager	winlogin.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Login Security	winlogin.pif	Added by an unidentified WORM or TROJAN!
X	Windows Login Service	winlog.exe	"Added by the RBOT-AFN WORM!"
X	Windows Login Service	winlogin.pif	"Added by the SDBOT-ACU WORM!"
X	Windows Logon	winlogin.exe	"Added by the SPYBOT-C TROJAN!"
X	Windows Logon	winlogon.exe	"Added by the VB.HE VIRUS! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\system"
X	Windows Logon Application	WinIogon.exe	"Added by the LINKBOT.M WORM!"
X	Windows Logon Application	logon.exe	"Added by the POEBOT-J WORM!"
X	Windows Logon Application	services.exe	"Added by the CIADOOR-L TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Logon Application	win32help.exe	"Added by the DELBOT-X WORM!"
X	Windows Logon Application	winlogon.exe	"Added by the POEBOT-KW WORM! Note - this is not the legitimate winlogon.exe process
X	Windows Logon Application	winamp.exe	"Added by the POEBOT-LR WORM! Note - this is NOT the popular Winamp media player which resides in a ""Winamp"" subdirectory of the Program Files directory"
X	Windows Logon Applicationedc	winlogon.exe	"Added by the DWNLDR-HGR TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%"
X	Windows Logon Applicatonedc	winlogon.exe	"Added by the VB-EBV TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%"
X	Windows Logon Manager	logon.exe	"Added by a variant of the RBOT WORM!"
X	Windows Logon Procedure	Svchoste.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Logon Procedure	Svchosta.exe	"Added by a variant of the SPYBOT WORM!"
X	windows logon procedure	winlogonpc.exe	"Added by the WINLOGON TROJAN!"
X	Windows Logon Service	winlogon.pif	"Added by the RBOT-AOU WORM!"
X	Windows Logon Service	napi32.exe	"Added by the SPYBOT.ANDM WORM!"
X	Windows Logon Service	winlogoservice.exe	"Added by the SPYBOT.ANOO WORM!"
X	Windows LoL Layer	gqwdcr.exe	"Added by the AGOBOT-AHS WORM!"
X	Windows LoL Layer	win.exe	"Added by the RBOT-FTO WORM!"
X	Windows LoL Layer	[random filename].exe	"Added by the RBOT-GMD WORM!"
X	Windows LoL Layer	pyvnpt.exe	"Added by the RBOT-GKV WORM!"
X	Windows LoL Layer	winlolx.exe	"Added by the RBOT-FOR WORM!"
X	Windows LoL Layer	azypbrx.exe	"Added by the RBOT-GMZ WORM!"
X	Windows LoL Layer	blvpnmcny.exe	"Added by the RBOT-GOR WORM!"
X	Windows Lord Anti-Virus	winlord32.exe	"Added by the SDBOT-GW WORM!"
X	Windows Management Informant	wmmiexe.exe	"Added by the IRCBOT-V BACKDOOR!"
X	Windows Management Instrumentation	mwd.exe	"Added by the GRAPS WORM!"
X	Windows Management Instrumentation	[path to file]	"Added by the QEDS-A WORM!"
X	Windows Management Instrumentations	winmg.exe	"Added by the GAOBOT.GW WORM!"
X	WINDOWS MANAGEMENT SYSTEM	wm1exe.exe	"Added by the RBOT-VT WORM!"
X	Windows Manager	winmants.exe	"Added by the MANTAS WORM!"
X	Windows Manager	winsrv.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Windows Manager	taskmgrs.exe	"Added by the SILLYFDC.BBZ WORM!"
X	Windows Manager Control	WINMUR32.EXE	"Added by the AGOBOT-AR WORM!"
X	Windows Manager Update Inc	tgb.exe	"Added by the SDBOT-ACM WORM!"
X	Windows mangement	winlogonn.exe	"Added by the RANDEX.FC WORM!"
X	Windows Media AP	winmapp.exe	Added by an unidentified WORM or TROJAN!
X	Windows Media APP	wmapp.exe	Added by an unidentified WORM or TROJAN!
N	Windows Media Center	"RunDLL32.exe ehuihlp.dll	BootMediaCenter"
X	Windows Media Center	smss.exe	"Added by the WARBOT TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
N	Windows Media Connect 2	WMCCFG.exe	"Windows Media Connect from Microsoft - stream digital media files on your computer to digital media receivers (DMRs) that are connected to your home network"
X	Windows Media Driver	msnger.exe	"Added by a variant of the RBOT WORM!"
X	Windows Media Loader	wmloader.exe	"Added by a variant of the GAOBOT WORM!"
X	Windows Media Player	wmediaplayer.exe	"Added by the AGOBOT-NQ WORM!"
X	Windows Media Player	MediaPIayer.exe	"Added by the SDBOT-QO TROJAN! Note - the lower case ""l"" in ""MediapIayer"" is a capital ""i"""
X	Windows Media Player	[random filename]	"Added by a variant of the RBOT WORM!"
X	Windows Media Player	msa.exe	"Added by the RBOT-SI WORM!"
X	Windows Media Player	mcafe32.exe	"Added by the RBOT-YO WORM!"
X	Windows Media Player	wmplayer.exe	"Added by the KELVIR.G WORM or variants! Note - this is not the valid Windows Media Player as the file is located in %System% rather than %ProgramFiles%\Windows Media Player"
X	Windows Media Player	50cent.exe	"Added by a variant of the RBOT WORM!"
X	Windows Media Player	mpwe.exe	"Added by the RBOT-TT WORM!"
X	Windows Media Player	msams.exe	"Added by the RBOT.AHR WORM!"
X	Windows Media Player	vmmreg32.exe	"Added by the AGENT.AQO TROJAN!"
X	Windows Media Player	msass43.exe	"Added by the RBOT-RT WORM!"
X	Windows Media Player	mpupdata.exe	"Added by the SDBOT.BBG WORM!"
X	Windows Media Player	wmplayerc.exe	"Added by the SILLYFDC.DBG WORM!"
X	Windows Media Player 3.6	wmpa36.exe	"Added by a variant of the RBOT WORM!"
X	Windows Media Player 3.6b	WMPA36B.EXE	"Added by the RBOT-VV WORM!"
X	Windows Media Player 3.6d	wmpa36d.exe	"Added by the RBOT-YA WORM!"
X	Windows Media Player 3.9	wmpa36.exe	"Added by a variant of the RBOT WORM!"
X	Windows Media Player 6.1.2	wmplayer612.exe	"Added by the RBOT.AIB BACKDOOR!"
X	Windows Media Player Service	wmedia.exe	"Added by the RBOT.213504 WORM!"
X	Windows Media Player Update	[random filename]	"Added by the RBOT-ET WORM!"
N	Windows Media Powerpoint Helper	NSPPTHLP.EXE	German software (comes with some Toshiba CD writers) that helps convert Powerpoint files to ASF (Streaming Media) files. Available via Start -> Programs
X	Windows Media Server	wmserv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Media Server!	wmserver.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows media service	crvss.exe	"Added by the SDBOT.VP WORM!"
X	Windows media service	crsss.exe	"Added by the RBOT.ACY WORM!"
X	Windows media service	Sygate32.exe	"Added by the RBOT.ADE WORM!"
X	Windows media services	cvrsss.exe	"Added by the RBOT-MW WORM!"
X	Windows Media SP.2.37	[random filename]	"Added by the LEMIR.C TROJAN!"
X	Windows Media Updater	crease.exe	"Added by the RBOT-ATI WORM!"
X	Windows Media Upgrade	NeUpgrade.exe	"Added by the RBOT.BMF TROJAN!"
X	Windows Media Utility	wmediautil.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Memory Drivers	memretain.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Memory Manager	windowsmem.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Memory Running Services	memrun.exe	"Added by the IRCBOT.BLL BACKDOOR!"
X	Windows Memory Sharing	memoryshr.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Memory Sharing	memshare.exe	"Added by the IRCBRUTE.AG TROJAN!"
X	Windows Memory Sharing	memshr.exe	"Added by the IRCBOT.MC BACKDOOR!"
X	Windows Messanger Control Center	svchosl.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Messanger Control Center	svhost.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Messanger Control Center	winlogin.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Messanger Control Center	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Messanger Control Center	winsys.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows messenger	messengers.exe	"Added by the MYTOB.EI WORM!"
X	Windows Messenger	msnsmgs.exe	"Added by the RBOT-ANJ WORM!"
X	Windows Messenger	msnmsg.exe	"Added by the SPYBOT.BV WORM!"
X	Windows Messenger 4.14	landisc.exe	"Added by the SDBOT-KR WORM!"
X	Windows Messenger Connect	wmdsvc.exe	"Added by the SLENFBOT.S WORM!"
X	Windows Messenger Fileshare	wivsvc.exe	"Added by the SILLYIM WORM!"
X	Windows Messenger Live MSN	winlivemsnmessenger.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Messenger Live Startup	windowslivemsn.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Windows Messenger Live Startup	windowsmsnlive.exe	"Added by the DELF.DAX TROJAN!"
X	Windows Messenger Messenger	winmsg.exe	"Added by the VELKBOT.A WORM!"
X	Windows Messenger Panel	wbcsvc.exe	"Added by the IRCBOT.ADA BACKDOOR!"
X	Windows Messenger Service	winsmsgr.exe	"Added by the RBOT-VW WORM!"
X	Windows Messenger Service	kaspersky.exe	"Added by the MYTOB.HY WORM!"
X	Windows Messenger Share	wmssvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Messenger Starter	wmvsvc.exe	"Added by the DELF.DAX TROJAN!"
X	Windows MeTaLRoCk service	metalrock.exe	"Added by the TASTYRED TROJAN!"
X	Windows Micro Drivers	wupdates32.exe	"Added by the RBOT-AEH WORM!"
X	Windows Microsoft Service	[random filename]	"Added by the AGENT-HCD TROJAN!"
X	Windows Microsoft Services	[8 random letters].exe	"Added by the KOLAB.AW WORM!"
X	Windows Microsoft Update	wintask32.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Microsoft Verifier	winauth23.exe	"Added by a variant of the RBOT WORM!"
U	Windows Mobile Device Center	wmdc.exe	"Windows Mobile Device Center - mobile device management/synchronization software for Windows7/Vista
U	Windows Mobile-based device management	wmdSync.exe	"Part of Windows Mobile Device Center in Vista. Microsoft Windows Mobile Device Center enables you to set up new partnerships
U	Windows Mobile-based device management	wmdc.exe	"Windows Mobile Device Center - mobile device management/synchronization software for Windows7/Vista
X	Windows mod Verifier	Windows-mod.exe	"Added by the RBOT.DSU WORM!"
X	Windows modez Verifier	w1nz0zz0.exe	"Added by a variant of the SDBOT WORM!"
X	Windows modez Verifier	Window2.exe	"Added by a variant of the RBOT WORM!"
X	Windows modez Verifier	WindowsLogon.exe	"Added by a variant of the SDBOT WORM!"
X	Windows modez Verifier	Wwuamguard.exe	"Added by the RBOT.EZJ WORM!"
X	Windows modez Verifier	winlogom.exe	"Added by a variant of the RBOT WORM!"
X	Windows modez Verifier	Windows-.exe	"Added by the RBOT-DIO WORM!"
X	Windows modez Verifier	taskmngr.exe	"Added by a variant of the RBOT WORM!"
X	Windows modez Verifier	winl0g0z.exe	"Added by the RBOT-FNB WORM!"
X	Windows modez Verifier	wuamguard.exe	"Added by the RBOT.EZJ BACKDOOR!"
X	Windows Monitor	winmon.exe	"Added by the SDBOT.VB WORM!"
X	Windows Monitor	arsetup.exe	Added by the SPAZBOX.A TROJAN!
X	Windows Monitor Services	winmonitor.exe	"Added by the RBOT-XX WORM!"
X	Windows Monitoring Service	winmon.exe	"Added by a variant of the SDBOT WORM!"
X	Windows More Choice	TopContext.exe	"ZQuest adware"
X	Windows Mouse Services	winmouse.exe	"Added by the IRCBOT.AGA BACKDOOR!"
X	Windows Mouse Services	winmouse64.exe	"Added by the IRCBOT.AIA BACKDOOR!"
X	Windows Mouse Utilities	mouseutils.exe	"Added by the RBOT-ABU WORM!"
X	Windows ms Drivers	msnup32.exe	"Added by the SDBOT-AAL WORM!"
X	Windows MS Update 32	fhm.exe	"Added by the IRCBOT.GEN WORM!"
X	Windows MS Update 32	sucker.exe	"Added by the FORBOT-GJ WORM!"
X	Windows MS Update 32	jebote.exe	"Added by the FORBOT-GK WORM!"
X	Windows MSConfig Startup Logger	winlog.exe	"Added by the RBOT.BCU WORM!"
X	Windows MSN	MSN.msn	"Added by the TRIXCU.A WORM!"
X	Windows Msn Live Messanger	msnmsgsman.exe	"Added by a variant of the SDBOT WORM!"
X	Windows MSN Live Messanger	wmsnlive.exe	"Added by the RBOT.BMV BACKDOOR!"
X	Windows MSN Live Messanger	livemsngs.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows MSN Live Messenger	winlivemsn.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Windows MSN Live Messenger	winmessengerlive.exe	"Added by the IRCBOT.EAD BACKDOOR!"
X	Windows MSN Updates	wnd32.exe	"Added by the IRCBOT-ABA TROJAN!"
X	Windows MSN2 XP	swchost.exe	"Added by the KOLAB.AA WORM!"
X	Windows MSX drivers	winmsx.exe	"Added by the RBOT-AYG TROJAN!"
X	Windows Net Cfg	service.exe	"Added by a variant of the RBOT WORM!"
X	Windows NetDDe	wrmana32.exe	"Added by the MYTOB.IM WORM!"
X	Windows Nets	WinNET.exe	"Added by the RBOT-MO WORM!"
X	Windows NetStart Service	winsN2S.exe	"Added by the RBOT-ZX WORM!"
X	Windows NetStart Service2	winsN2S.exe	"Added by the RBOT-ABN WORM!"
X	Windows NetStart Service2	winsN2SD.exe	"Added by a variant of the RBOT WORM!"
X	Windows Netsystem Layer	Netsystem.exe	"Added by the RBOT.BEI WORM!"
X	Windows Network Controller	Mqguard.exe	"Added by the FORBOT-CL WORM!"
X	Windows Network Controller	WinxPupd.exe	"Added by the FORBOT-DK WORM!"
X	Windows Network Controller	winmms32.exe	"Added by the FORBOT-ED WORM!"
X	Windows Network Controller	wingmt.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Network Controller	Win9x.exe	"Added by the WOOTBOT.I WORM!"
X	Windows Network Controller	winmms32.exe.exe	"Added by the FORBOT-ED WORM!"
X	Windows Network Firewall	firewall.exe	"Added by the POEBOT-J WORM! Located in %System%"
X	Windows Network Logon	npesvc.exe	"Added by the AGENT.ERZ TROJAN!"
X	Windows Network Service	winvc32.exe	"Added by the RBOT.RY WORM!"
X	Windows Network Service	Msconf32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Network Service	Realteks.exe	"Added by the RBOT-GTG WORM!"
X	Windows Network Services	winnetwork.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Network Services	winnetwork128.exe	"Added by the SLENFBOT.J WORM!"
X	Windows Network Services	winnetwork32.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Network Services	winnetwork64.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Network Session	nspsvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Networking	winsys32.exe	"Added by the GAOBOT.FL WORM!"
X	Windows Networking Monitor	mdm.exe	"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate Machine Debug Manager (mdm.exe) process which is located in %ProgramFiles%\Common Files\Microsoft Shared\VS7Debug (98/Me/XP/Vista) or C:\WINDOWS\SYSTEM (Me only)"
X	Windows Networking Monitorin	xmdmx.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Networking Monitoring	mdm.exe	"Added by the IRCBOT.AKZ WORM! Note - this is not the legitimate Machine Debug Manager (mdm.exe) process which is located in %ProgramFiles%\Common Files\Microsoft Shared\VS7Debug (98/Me/XP/Vista) or C:\WINDOWS\SYSTEM (Me only)"
X	Windows Networks	netcog.exe	"Added by the MYTOB.FH WORM!"
X	Windows Nivedia Driver	sysMGT.exe	"Added by a variant of the RBOT WORM!"
X	Windows NNT	[path to trojan]	"Added by the RANKY.E TROJAN!"
X	Windows NT	twain.exe	"Added by the AGENT.BEA TROJAN!"
X	Windows NT 32	ntlogin32.exe	"Added by the RANDEX.BRD WORM!"
X	Windows NT Login	ntlogin32.exe	"Added by the SDBOT.WG WORM!"
X	Windows NT Login Session Manager	WNSM.EXE	"Added by the RBOT.BIV WORM!"
X	Windows NT Logon Application	winlogon.scr	"Added by the RBOT-ALP WORM!"
X	Windows NT Service Name	winshock.exe	"Added by the RBOT-PK WORM!"
X	Windows NT Service Name	svchcst.exe	"Added by the RBOT-NV WORM!"
X	Windows NT Session Manager	sess.exe	"Added by a variant of the RBOT WORM!"
X	Windows NT Update Manager	WINL0G0N.exe	"Added by the AGOBOT-NU WORM! Note that those are zeroes in the filename and not capital ""o"""
X	Windows NTFS Volume Manage	[6 random letters].exe	"Added by the RBOT.EDL BACKDOOR!"
X	Windows OEM Tools	winres32.exe	"Added by the SPYBOT.FD WORM!"
X	Windows Offical Netvvorks	mywriter32.exe	"Added by a variant of the SDBOT WORM! See here"
X	Windows Office Monitor	emdm.exe	"Added by the RBOT.AFV BACKDOOR!"
X	Windows OLE Automation Server	ole32aut.vbe	"CoolWebSearch parasite variant"
X	Windows Online Updater	dllman.exe	"Added by the RBOT-TE WORM!"
X	Windows pack Control Center	taskmam.exe	"Added by the TOMETA-J TROJAN!"
X	Windows Pc	winmgr.exe	"Added by the BIBOT-A WORM!"
X	Windows PC Defender	WP[random characters].exe	"Windows PC Defender rogue security software - not recommended
X	Windows PDG	winpdg.exe	"Added by the RBOT-ADW WORM!"
X	Windows Performance Monitor	wmscupd.exe	"Added by the IRCBOT_GEN WORM!"
X	Windows PNP	winpnp.exe	"Added by the RBOT-AKN WORM!"
X	Windows PNP Server	pnpsrv.exe	"Added by the RBOT-AKM WORM!"
X	Windows Pool Manager	poolsc.exe	"Added by the OBOT.CH WORM!"
X	Windows Pool Setup	poolmc.exe	"Added by the IRCBOT.RU BACKDOOR!"
X	Windows Population Logger	winpo32.exe	"Added by the AGENT.YKR WORM!"
X	Windows Portable Device Drivers	MSKSVRVS.EXE	"Added by a TROJAN - see here"
X	Windows Portable Devices	MSKSVRTSS.EXE	"Added by the SPYBOT.APEO WORM!"
X	Windows Print Monitor Daemon	[random filename].exe	"Added by a variant of the SDBOT WORM!"
?	Windows Print Spooler	SCVHOSTS.EXE	"Suspicious due to the similarity to the valid ""svchost.exe"" file"
X	Windows Print Spooler	NavAgent32.exe	"Added by an unidentified VIRUS
X	Windows Print Spooler	SVEHOST.EXE	"Added by the SPYBOT.H WORM!"
X	Windows Printing Driver	WinPrint.exe	"Added by a variant of the RBOT WORM!"
X	Windows Printing Driver	WinSpooler.exe	"Added by the ARCHIVARIUS series of WORMS!"
X	Windows Printing Driver	ciadvs.exe	"Added by the BUZUS-M TROJAN!"
X	Windows Printing Driver	ciadvss.exe	"Added by the ARCHIVARIUS series of WORMS!"
X	Windows Printing Driver	gpedits.exe	"Added by the DCKEYG.A WORM!"
X	Windows Process	win_update.exe	"Added by the LASTWORD WORM!"
X	Windows Process Manager	winproc.exe	Added by an unidentified WORM or TROJAN!
X	Windows Processe Manager	mspn32.exe	"Added by the RBOT.AXO WORM!"
X	Windows Proffesional Security	WinSecure32.exe	"Added by the AGOBOT.VA WORM"
X	Windows Protected Storage	npssvc.exe	"Added by the IRCBOT.AUL BACKDOOR!"
X	Windows Protection Suite	WI[random characters].exe	"Windows Protection Suite rogue security software - not recommended
X	Windows Protectot	boxide.exe	"Added by a variant of the WOOTBOT WORM!"
X	Windows Recavery Adware	lsass.exe	"Added by an unidentified TROJAN - see here. Note - this is not the legitimate lsass.exe process
X	Windows Recovery Console	recovery.exe	"Added by the RANSOM.FD WORM!"
X	Windows Recylinder Check	zwdomsgemw.exe	"Added by the RBOT-EGJ WORM!"
X	Windows Reg Services	ffservice.exe	"Added by the DLOADER-PL or DLOADER-XM TROJANS!"
X	Windows Reg Services	dservice.exe	"Added by the PRORAT-D TROJAN!"
X	Windows Reg Services	fservice.exe	"Added by the PRORAT-D TROJAN!"
X	Windows Reg Services	ssservice.exe	"Added by the PRORAT-D TROJAN!"
X	Windows Reg Services	lncom.exe	"Added by the PRORAT-O TROJAN!"
X	Windows Reg Services	lservice.exe	"Added by the PRORAT-O TROJAN!"
X	Windows Reg Services	wservice.exe	"Added by the PRORAT-O TROJAN!"
X	WINDOWS REGISTER EDIT	registr32.exe	Added by an unidentified WORM or TROJAN!
X	Windows Register Settings	svmhost.exe	"Added by a variant of the FORBOT WORM!"
X	Windows Registers	winservicess.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Registery Center	svhchosts.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Registry	msnmsg.exe	"Added by a variant of the RBOT WORM!"
X	Windows Registry	winhost.exe	"Added by a variant of the RBOT WORM!"
X	Windows Registry Cleaner	winclean.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Registry Control	winreg.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Registry DLL	winregdll.exe	"Added by the IRCBOT.FB BACKDOOR!"
X	Windows Registry Express Loader	regexpress.exe	"Added by the FORBOT-CJ WORM!"
X	Windows Registry Manager	tasksmanagers.exe	"Added by the MYTOB.ER WORM!"
X	Windows Registry Name	[random filename]	"Added by the RBOT-AEB WORM!"
X	Windows Registry Name	winses.exe	"Added by the RBOT-ADB WORM!"
U	Windows Registry Repair Pro	RegistryRepairPro.exe	"Registry Repair Pro. ""Scans the Windows Registry for invalid or obsolete information in the registry"""
X	Windows Registry Scan	regscan32.exe	"Added by the RBOT.KE WORM!"
X	Windows Registry Scan	timeupdate.exe	"Added by the SPYBOT.JE WORM!"
X	Windows Registry Scan	svcdll.exe	"Added by the RBOT-TP WORM!"
X	Windows Registry Scan	regscan23.exe	"Added by a variant of the RBOT WORM!"
X	Windows Registry Scan	regscan.exe	"Added by the RBOT-HA WORM!"
X	Windows Registry Scan	winmedia.exe	"Added by the SPYBOT.GK WORM!"
X	Windows Registry Security	crss.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Registry Services	regserv.exe	"Added by the SLENFBOT.BB WORM!"
X	Windows Registry Startup	wind32.exe	"Added by the AGOBOT-BZ WORM!"
X	Windows Registry XP	winxptdl.exe	"Added by the IRCBOT.AUN WORM!"
X	Windows Relay Service	ipcbind.exe	"Added by the DELFINJECT.F TROJAN!"
X	Windows Relay Service	irfnga.exe	"Added by the DROPPER.ACO TROJAN!"
X	Windows Remote Addressing	wnpcgs.exe	"Added by the DELF-EZN TROJAN!"
X	Windows Remote Launcher	wnpmcs.exe	"Added by the IRCBOT.ASX BACKDOOR!"
X	Windows Repair	toxikx.exe	"Added by the SDBOT-ADL WORM!"
X	Windows report	swchost.exe	"Added by the SMALL-BD TROJAN!"
X	Windows Rescue System	winsto.exe	"Added by the SUURCH.CG TROJAN!"
X	Windows Reverse Preperation	winrvp.exe	"Added by the SLENFBOT.CB WORM!"
X	Windows Reversed Virus Protection	winrsvp.exe	"Added by the SLENFBOT.HX WORM!"
X	windows run	system.exe	"Added by the ICPASS-A WORM!"
X	Windows Run-Time 64bit	win64rt.exe	"Added by a variant of the RBOT WORM!"
X	Windows Rundll Center	msnsmgr.exe	"Added by the AGENT-LLB TROJAN!"
X	Windows Rundll Center	msmsgrs.exe	"Added by the IRCBOT-AFA WORM!"
X	Windows Running DLL Service	rundll128.exe	"Added by the IRCBOT.XDH BACKDOOR!"
X	Windows Running DLL Service	rundll64.exe	"Added by the SLENFBOT.HV WORM!"
X	Windows Runtime Help	win32hlp.exe	"Added by a variant of the AIMVISION TROJAN!"
X	Windows Runtime Help	WinRunHelp.wrh	"Added by a variant of the AIMVISION TROJAN!"
X	Windows Runtime Proccess	32RUNdll.exe	"Added by the SDBOT.QW WORM!"
X	Windows SA	omniscient.exe	"BLAZEFIND adware"
X	Windows Scheduler	wmscheduler.exe	"Added by a variant of the SDBOT WORM! See here"
X	Windows Scheduler!	scheduler.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Screensaver	Service.exe	"Added by the KELVIR.P WORM!"
X	WINDOWS SCREENSAVER	ssaver.scr	"Added by the SDBOT-YZ WORM!"
N	Windows Search	WindowsSearch.exe	"System Tray access to Windows Search 4.0 for XP from Microsoft - which adds additional search options including a search box on the Taskbar. This version also includes the Windows Search (WSearch) service which indexes files and e-mails items so you can quickly find words and phrases. Disabling this entry does not affect the normal operation"
X	Windows secure	setver32.exe	"Added by the SPYBOT.EP WORM!"
X	Windows Secure Connection	winsc.exe	"Added by the SDBOT.BTN WORM!"
X	Windows Secure Fix	iPodFixer.exe	"Added by the WOOTBOT.BM BACKDOOR!"
X	Windows Secure Layer	[random filename]	"Added by the RBOT.DRF WORM!"
X	Windows Secure Messaging System	msnmsgrsrvc.exe	"Added by the RBOT-RE WORM!"
X	Windows Secure Services	ssms.exe	"Added by the RBOT-GAR WORM!"
X	Windows Secure talal32	[7 random letters].exe	"Added by the RBOT.HTP TROJAN!"
X	Windows Secure Update	winupser.exe	"Added by the RBOT-GCG WORM!"
X	Windows Secure Update	WinSecUp.exe	"Added by the RBOT-GCD WORM!"
X	Windows Secure Update	load.exe	"Added by the FORBOT-GU WORM!"
X	Windows Secure Update	WinSecure.exe	"Added by the RBOT-GDO WORM!"
X	Windows Securety	wurger.exe	"Added by the AGOBOT-NC BACKDOOR!"
X	WINDOWS SECURITY	wingrd.exe	"Added by a variant of the RBOT WORM!"
X	Windows Security	win.pif	"Added by the RBOT-APT WORM!"
X	Windows Security	ms32.pif	"Added by the RBOT-ARN WORM!"
X	Windows Security	winscure.exe	"Added by the RBOT-BAF WORM!"
X	Windows Security Assistant	rundll32.vbe	"CoolWebSearch Alfasearch parasite variant - also detected as the STARTPA-U TROJAN!"
X	Windows Security Assistant	winsec.exe	"CoolWebSearch parasite variant"
X	Windows Security Authority Service	lsass.exe	"Added by the KALEL-A WORM! Note - this is not the legitimate lsass.exe process
X	Windows Security Center Notification App	wscnfty.exe	"Added by a variant of the RBOT WORM!"
X	Windows Security Center Notification Appls	sxe.exe	"Added by the RBOT-GKX WORM!"
X	Windows Security Center Notification Applse	sxes.exe	"Added by the RBOT-GLR WORM!"
X	Windows Security Center Notification Applse	os.exe	"Added by a variant of the RBOT-GLR WORM!"
X	Windows Security Center Notification Applsee	sysecurex.exe	"Added by a variant of the RBOT-GKX WORM!"
X	Windows Security Control	wuaucls.exe	"Added by the FORBOT-V WORM!"
X	Windows Security Manager	winsecurity.exe	"Added by the AGOBOT-KI WORM!"
X	Windows Security Manager	winsecure.exe	"Affilred adware"
X	Windows Security Manager	svchost.exe	"Added by the ANTINNY.AX WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Microsoft"" subfolder"
X	Windows Security Manager	svhost.exe	"Added by the GAOBOT.ALU WORM!"
X	Windows Security Module	module.exe	"Added by a variant of the RBOT WORM!"
X	Windows Security Policy	lsass32.exe	"Added by the AGOBOT-CR WORM!"
X	Windows Security Service	[random file name]	"Added by the RBOT-ALV WORM!"
X	Windows Security Service	arrdt.exe	"Added by a variant of the RBOT WORM!"
X	Windows Security Service	windows.pif	"Added by the RBOT-AMG WORM!"
X	Windows Security Suite	WI[random characters].exe	"Windows Security Suite rogue security software - not recommended
X	Windows Security Survy	svchosl.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Security Tool	WinSecure.exe	"Added by the AGENT-GPY TROJAN!"
X	Windows Security Update	security32.exe	"Affilred adware"
X	Windows Security Update	ndsass.exe	"Added by the RBOT.ESM BACKDOOR!"
X	Windows Serv Patch	Mcaffe2005.exe	"Added by a variant of the RBOT WORM!"
X	Windows Servce Agent	[random filename]	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Servcesc	[9 random letters].exe	"Added by a variant of the SDBOT WORM! See here"
X	Windows ServeAd	WinServAd.exe	Windupdates adware variant
X	Windows Server	winserv.exe	"Added by the IRCBOT.AVM BACKDOOR!"
X	Windows Server Client Verification Service	wscvs.exe	"Added by the AGENT.AWC TROJAN!"
X	Windows Server Drivers	syssrv.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Server Information	servinfo.exe	"Added by the FORBOT-EN WORM!"
X	Windows Server IP Verification Service	wsivs.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Windows Server Peer Verification Service	wspvs.exe	"Added by a variant of the RANKY TROJAN!"
X	Windows Server!	winsvr.exe	"Added by the IRCBOT.AYC BACKDOOR!"
X	Windows Servic2	winsy.exe	"Added by the RBOT-AIA WORM!"
X	Windows service	wuamgrd.exe	"Added by the RBOT-QW WORM!"
X	Windows Service	dddd.exe	"Detected by Kaspersky as Dialer.Salc
X	Windows Service	prvdi.exe	"Malware - detected by Kaspersky as the SMALL.RD TROJAN!"
X	Windows Service	video.exe	Added by an unidentified TROJAN!
X	Windows Service	svvhost.exe	"Added by the AGOBOT-HL WORM!"
X	Windows Service	private-zone.exe	Added by an unidentified WORM or TROJAN!
X	Windows Service	pd7.exe	"Added by the SMALL.VZ TROJAN!"
X	Windows Service	dstart4.exe	Added by an unidentified TROJAN!
X	Windows Service	pd14.exe	"Adware - detected by DiamondCS TDS-3 anti-trojan as the DELF.DG TROJAN!"
X	Windows Service	video2.exe	Added by the DOWNLOADER.SMALL.MY TROJAN!
X	Windows Service	services.exe	"Added by the KALEL-A WORM! Note - this is not the legitimate services.exe process
X	Windows Service	WINSVC.EXE	"Added by the SPYBOT-DH TROJAN!"
X	Windows Service	r.exe	"Added by a variant of the SMALL.VZ TROJAN!"
X	Windows Service	windowz.exe	"Added by the SDBOT-AYI WORM! Note - dissables the automatic startup of other software and deactivates the Microsoft Internet Connection Firewall (ICF)"
X	Windows service	iexpl0rer.exe	"Added by the SDBOT.RO WORM!"
X	Windows Service	service.exe	"Added by the IRCBOT-ACV WORM!"
X	Windows Service	svchost.exe	"Added by the SPYBOT-AW TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Windows Service Ag3nt	[6 random letters].exe	"Added by the SDBOT.EZX TROJAN!"
X	Windows Service Agccnt	jeqcfyo.exe	"Added by the RBOT-GST WORM!"
X	Windows Service Agccnt	[random].exe	"Added by the SDBOT-DHL WORM!"
X	Windows Service Agccnt	rmizjgz.exe	"Added by the SDBOT-SIM WORM!"
X	Windows Service Agent	czf.exe	"Added by the RBOT-GAJ WORM!"
X	Windows Service Agent	[random filename].exe	"Added by the IRCBOT-XE TROJAN!"
X	Windows Service Agent	agl23.exe	"Added by the RBOT-GQU WORM!"
X	Windows Service Agent	co0l.exe	"Added by the RBOT-GQY WORM!"
X	Windows Service Agent	dsass.exe	"Added by the RBOT.MIRCO.BNG WORM!"
X	Windows Service Agent	msnmagr.exe	"Added by a variant of the SLAPER TROJAN!"
X	Windows Service Agent	taskmgr32.exe	"Added by the RBOT-GMN WORM!"
X	Windows Service Agent	win32wins.exe	"Added by the RBOT-LOL WORM!"
X	Windows Service Agent	winup32.exe	"Added by the RBOT-GQX WORM!"
X	Windows Service Agent	winupds32.exe	"Added by the RBOT-GQT WORM!"
X	Windows Service Agent	wit.exe	"Added by the RBOT-GQV WORM!"
X	Windows Service Agent	wmscc.exe	"Added by the RBOT-GQP WORM!"
X	Windows Service Agent	spoolvs.exe	"Added by the RBOT-GXI WORM!"
X	Windows Service Agent	spools.exe	"Added by the AGENT-GJF TROJAN!"
X	Windows Service Agent	msngear.exe	"Added by the RBOT.AHW BACKDOOR!"
X	Windows Service Agent	msngerr.exe	"Added by the RBOT.EOZ WORM!"
X	Windows Service Agent	[3 random letters].exe	"Added by the AGENT.AMEB TROJAN - see examples here and here"
X	Windows Service Agent	cxfrru.exe	"Added by the SDBOT.GAV WORM!"
X	Windows Service Agent	izszbayz.exe	"Added by the KOLAB.TC WORM!"
X	Windows Service Agent	jnxrcyc.exe	"Added by the RBOT.XAT BACKDOOR!"
X	Windows Service Agent	kafdprs.exe	"Added by the IRCBOT.HDE BACKDOOR!"
X	Windows Service Agent	krqbs.exe	"Added by the IRCBRUTE.AZ TROJAN!"
X	Windows Service Agent	lcaqmsp.exe	"Added by the RBOT.WFR BACKDOOR!"
X	Windows Service Agent	msnmsgr.exe	"Added by the RBOT.ABIK BACKDOOR! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Windows Service Agent	mxjunj.exe	"Added by the RBOT.EMC BACKDOOR!"
X	Windows Service Agent	ndibbeu.exe	"Added by the RBOT.XVD BACKDOOR!"
X	Windows Service Agent	nimcoo.exe	"Added by the RBOT.EWV WORM!"
X	Windows Service Agent	nod32.exe	"Added by the RBOT.BNG BACKDOOR!"
X	Windows Service Agent	sjbsm.exe	"Added by the SMALLTRO.II TROJAN!"
X	Windows Service Agent	sjbsmgm.exe	"Added by the IRCBOT.AHX WORM!"
X	Windows Service Agent	tjybssd.exe	"Added by the RBOT.XVD BACKDOOR!"
X	Windows Service Agent	umvcnm.exe	"Added by the RBOT.EMC BACKDOOR!"
X	Windows Service Agent	uqgpq.exe	"Added by the SMALLTRO.II TROJAN!"
X	Windows Service Agent	vbsxkhk.exe	"Added by the IRCBOT.AHX WORM!"
X	Windows Service Agent	wge23.exe	"Added by the RBOT.HHK BACKDOOR!"
X	Windows Service Agent	Windo.exe	"Added by the RBOT.NQS WORM!"
X	Windows Service Agent	ywgma.exe	"Added by the RBOT.DZT BACKDOOR!"
X	Windows Service Agent	winupd32.exe	"Added by the SDBOT.SYM WORM!"
X	Windows Service Agent	WinTcpip.exe	"Added by the SPYBOT.AP WORM!"
X	Windows Service Agent	idvcqv.exe	"Added by the AGOBOT-AJB WORM!"
X	Windows Service Agent 32	mrthd.exe	"Added by the AGENT-GAQ TROJAN!"
X	Windows Service Agnts	[8 random letters].exe	"Added by the SDBOT.BCQ WORM!"
X	Windows Service Ajav	java128.exe	"Added by the RBOT.BNG WORM!"
X	Windows Service alge	[random filename]	"Added by the RBOT.GJO TROJAN!"
X	Windows Service Controller	services.exe	"Added by the KALEL-B WORM! Note - this is not the legitimate services.exe process
X	Windows Service Controller Agent	taksmgr.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Service DC	uhpnjcjl.exe	"Added by the RBOT-GLY WORM!"
X	Windows Service Exec	ServiceLayer.exe	"Added by the SPYBOT-OI WORM! Note - do not confuse this with the Nokia service of the same name which resides in %ProgramFiles%\Common Files\PCSuite\Services or %Program Files%\PC Connectivity Solution. This one is located in %Windir%"
X	Windows Service Find	wrfkuk.exe	"Added by the IRCBOT-XZ TROJAN!"
X	Windows Service help	winservices.exe	"Added by the DROPPER.TT TROJAN!"
X	Windows Service Host	scvhost.exe	"Added by the SDBOT.N TROJAN!"
X	Windows Service Host	svchost.exe	"Added by the CONE.B WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Service Host	svchost.exe	"Added by the KALEL-C WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	Windows Service Host	schost.exe	"Added by the GAOBOT.AO WORM!"
X	Windows Service Host Process	[path to file]	"Added by the EZIO-A WORM!"
X	Windows Service Hosting	USERINIT.exe	"Added by the GOMMER-A WORM!"
X	Windows Service Layer	config.exe	"Added by the RBOT.DDJ WORM!"
X	Windows Service Loader	Window.exe	"Added by the RBOT-XO WORM!"
X	Windows Service Management	svcmngmt.exe	"Added by the AGOBOT-NM WORM!"
X	Windows Service Manager	userint32.exe	"Added by the OSCABOT-C WORM!"
X	Windows Service Manager	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	msgs.exe	"Added by the OSCABOT-E WORM!"
X	Windows Service Manager	msnmrg.exe	"Added by the OSCABOT-G WORM!"
X	Windows Service Manager	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	svcmgr32.exe	"Added by the OSCABOT-D WORM!"
X	Windows Service Manager	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	taskmgr.exe	"Detected by Kaspersky as the IAMBIGBROTHER.91 TROJAN! Note - this is not the legitimate taskmgr.exeprocess which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""fonts\svc"" sub-folder"
X	Windows Service Manager	initsvc.exe	"Added by the RBOT-BWT WORM!"
X	Windows Service oi worms	[6 random letters].exe	"Added by the SYSTEMHI.OS TROJAN!"
X	Windows Service Pack 2	WindowsSP2.exe	"Added by the SDBOT-TQ WORM!"
X	Windows Service Pack Auto Update	winworks.exe	"Adware downloader - detected by eScan antivirus as the AGENT.BT TROJAN!"
X	Windows Service Pack Auto Update	figgaz.exe	"Detected by Kaspersky as the AGENT.BT TROJAN!"
X	Windows Service Pack Auto Update	ballin.exe	Added by an unidentified WORM or TROJAN!
X	Windows Service Pack Auto Update	del-me.exe	"Adware
X	Windows Service Pack2	svchhost.exe	"Added by a variant of the RBOT WORM!"
X	Windows Service Pack2	WIN43.EXE	"Added by the GAOBOT.G WORM!"
X	Windows Service Supply	winsupply.exe	"Added by the SLENFBOT.CZ WORM!"
X	Windows Service Support Call	SVSS32.EXE	"Added by the RBOT-XQ WORM!"
X	Windows Service SV	sv32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Service Threads	svcthreading.exe	"Added by the SHEUR.AUM TROJAN!"
X	Windows Service Threads	svcthreads.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Service Update	livecal.exe	"Added by the SDBOT-DEY WORM!"
X	Windows Service Update	crsss.exe	"Added by the SDBOT.CWX WORM!"
X	Windows Service Update	mswsgs.exe	"Added by the RBOT.FQB WORM!"
X	Windows Service Utitity	winsrvc.exe	"Added by the RBOT-ASI WORM!"
X	Windows Service XP	XpFirewall.exe	"Added by the MYTOB.AM WORM!"
X	Windows Servicer	xqobypik.exe	"Added by the SDBOT-DFB WORM!"
X	Windows Services	service.exe	"Added by the RANDEX.R WORM!"
X	Windows Services	svchosts.exe	"Added by the AGOBOT-KL TROJAN!"
X	Windows Services	Explorer.exe	"Added by the SDBOT-WT WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Windows Services	NetworkDriver32.exe	"Added by the RBOT-ACR WORM!"
X	Windows Services	scmsg.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Services	scvhoste.exe	"Added by the SPYBOT.OBZ WORM!"
X	Windows Services	winsvc32.exe	"Added by the MYTOB-CB WORM!"
X	Windows Services	NetworkDrivers.exe	"Added by the SDBOT-YO WORM!"
X	Windows Services	smsc.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Services	spoolsvc.exe	"Added by the SDBOT.CPZ WORM!"
X	Windows Services	iexplore.exe	"Added by the RBOT-WE WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows Services	avsrv32.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Services	servicez.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services	w32edus.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services	w32service.exe	"Added by the AUTORUN-FU WORM!"
X	Windows Services	w32services.exe	"Added by the AUTORUN-FT WORM!"
X	Windows Services	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Services	winsysdll.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services	winsyssrv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services	winudp.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Services	filename.exe	"Added by the SDBOT.FSK BACKDOOR!"
X	Windows Services	svhost33.exe	"Added by the RBOT.AFN WORM!"
X	Windows Services	services.exe	"Added by the AGENT-MVC TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Services	wupdate.exe	"Added by the GAOBOT.ZT WORM!"
X	Windows Services Agant	regs32.exe	"Added by the SDBOT-DIK WORM!"
X	Windows Services Aganters	[10 random letters].exe	"Added by the RBOT.CUN WORM!"
X	Windows Services Agent	msngears.exe	"Added by the VB-EMS TROJAN!"
X	Windows Services alges2	[8 random letters].exe	"Added by a variant of the RBOT WORM!"
X	Windows Services B-Runner	svcbrun.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services B-Runner	svcbrunner.exe	"Added by the IRCBOT.BYV BACKDOOR!"
X	Windows Services Certification	svccert.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services Guide	svcguide.exe	"Added by the SLENFBOT.KQ WORM!"
X	Windows Services Guide	svcguides.exe	"Added by the SHEUR.YS BACKDOOR!"
X	Windows Services Host	svchost.exe	"Added by the CONE or CONE.E WORMS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	Windows Services Hosts	svhosts.exe	"Added by the SDBOT-YH TROJAN!"
X	Windows Services Ink Platform Tablet Input Subsystem	wsiptis.exe	"Added by the RBOT.APC WORM!"
X	Windows Services Jog	svcjog.exe	"Added by the AGENT.ALWZ WORM!"
X	Windows Services Jog	svcjogg.exe	"Added by the AGENT.QAF WORM!"
X	Windows Services Joger	svcjoger.exe	"Added by the RBOT.CAT WORM!"
X	Windows Services Jogging	svcjogging.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services Joging	svcjoging.exe	"Added by the IRCBOT.AVI BACKDOOR!"
X	Windows Services Layer	winlogz2.exe	"Added by the RBOT-FZE WORM!"
X	Windows Services Layer	winl0g0.exe	"Added by the RBOT-FZQ WORM!"
X	Windows Services Layer	sslms.exe	"Added by the RBOT-GAH WORM!"
X	Windows Services M7	ctfmon32.exe	"Added by the AGENT.WOH TROJAN!"
X	Windows Services Tower	svctowers.exe	"Added by the IRCBOT.AGJ BACKDOOR!"
X	Windows Services Tower	svctowing.exe	"Added by the SLENFBOT.LA WORM!"
X	Windows Services Update	svch0st.exe	"Added by a variant of the RBOT WORM! Note - the filename has the digit 0 rather then the uppercase ""o"""
X	Windows Serviece Agents	[8 random letters].exe	"Added by the AGENT.BHR TROJAN!"
X	Windows Servser	serviser.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Session Manager	smss32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Session Manager Subsystem	smss.exe	"Added by the KALEL-B WORM! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup!"
?	Windows shell	win70.exe	"??"
X	Windows Shell	shell.exe	"Added by the MYTOB-CA WORM!"
X	Windows Shell	taskgmr.exe	"Added by the MYTOB.BV WORM!"
X	Windows Shell Library Loader	load shell.dll	"CoolWebSearch parasite variant"
X	windows shellext.32	mschost.exe	"Added by the BLASTER.K WORM!"
X	WINDOWS SKY	sky.exe	"Added by the MYTOB.CH WORM!"
X	Windows Smart Manager	smart.exe	"Added by the RBOT-SL WORM!"
X	Windows SMB Manager	smb32.exe	"Added by the RBOT-BHZ WORM!"
X	Windows smss service	service.exe	"Added by the AGENT-FPY TROJAN!"
X	Windows Socket Procedure	WinSock32.exe	"Added by the RBOT-FMX WORM!"
X	Windows Software	hbsppe.exe	"Added by the RBOT-GLL WORM!"
X	Windows Sound	svdhost.exe	"Added by the SDBOT.EFX BACKDOOR!"
X	Windows Sound Driver	SndMon32.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Sound Emulator	snd32_win.exe	"Added by the ATNAS.A WORM!"
X	Windows Sound Manager	SndMon32.exe	"Added by the FORBOT-BU WORM!"
X	Windows Sound Manager	SndMon16.exe	"Added by a variant of the FORBOT WORM!"
X	Windows Sound Manager	sound.exe	"Added by the AGOBOT-CD WORM!"
X	Windows Sound Manager	gearsec.exe	"Added by the PUSHBOT.DF WORM!"
X	Windows Sound Verifier	WinIp32.exe	"Added by the RBOT-FMO WORM!"
X	Windows SP2 Firewall	wfirewall7.exe	"Added by a variant of the RBOT WORM!"
X	Windows SP2 Update	Sp2update.exe	"Added by the WOOTBOT.BS WORM!"
X	Windows SP2 Version Load	wuauclt32.exe	"Added by the GAOBOT.CX WORM!"
X	Windows SP4	directCC.exe	"Added by the RBOT-ACX WORM!"
X	Windows Spool	winspool.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Spool Server	spoolsrv.exe	"Added by the SDBOT-ACT WORM!"
X	Windows SpoolaPrint Service	spoolasrv.exe	"Added by the SDBOT-AYD WORM!"
X	Windows Spooler	SPOOLSRV.EXE	"Added by the SPYBOT.P WORM!"
X	Windows Spooler	spoolsv32.exe	Added by an unidentified WORM or TROJAN!
X	Windows Spooler	winsplr.exe	"Added by the SHEUR.ANX TROJAN!"
X	Windows Spooler Control Service	qwidh.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows Spooler Services	spool.exe	"Added by the AGOBOT-AMO WORM!"
X	Windows SpoolPrint Service	spoolersrv.exe	"Added by the SDBOT-ZT WORM!"
X	Windows Spools SV	winsv.exe	"Added by the RBOT-AUQ WORM!"
X	Windows spoolservr Service	spoolservr.exe	"Added by the SDBOT-AAN WORM!"
X	Windows Spoolsre Service	spoolsre.exe	"Added by the SDBOT-AAE WORM!"
X	Windows Spoolsrv Service	spoolmsv.exe	"Added by the SDBOT-ZS WORM!"
X	windows spoolsrv service	spoolssv.exe	"Added by the SDBOT-AWV WORM!"
X	Windows Spoolsurf Service	spoolsurf.exe	"Added by the SDBOT-ZZ WORM!"
X	Windows SpooltPrint Service	spooltsrv.exe	"Added by the SDBOT-AYE WORM!"
X	Windows Spoolvvv Service	spoolvvv.exe	"Added by the SDBOT-AAW WORM!"
X	Windows spyware remover	Windows-spyware.exe	"Added by the SystemPoser TROJAN!"
X	Windows sq Drivers	winmsn32.exe	"Added by the RBOT-ADI WORM!"
X	Windows SQL management 1.33	scvhost.exe	"Added by the SPYBOT-OB WORM!"
X	Windows Sql Service For Windows 32 Bit	winsql32.exe	"Added by the FORBOT-FC WORM!"
X	Windows SRS Client	winsrs.exe	"Added by the RBOT-BXQ WORM!"
X	Windows SRT Client	winsrt.exe	"Added by the RBOT-BFR WORM!"
X	Windows SSH Client	winssh.exe	"Added by the RBOT-AXC WORM!"
X	Windows SSL File	winssv.exe	"Added by the WOOTBOT.CA WORM!"
X	Windows SSL Secondary Drivers	SSL32Dr.exe	"Added by the SDBOT.ASQ WORM!"
X	Windows Stand Sound Drivers	Sounddrv.exe	"Added by the SDBOT-XF WORM!"
X	Windows Standard Securty	[random 3-letter filename]	"Added by the RBOT-ALF WORM!"
X	Windows Start Server 2000	traficy.exe	"Added by the RBOT-AHM WORM!"
X	Windows Startup	winsta~1.exe	"GoHip foistware"
X	Windows Startup	winstartup.exe	"GoHip foistware"
X	Windows Startup	Wdrun32.exe	"Added by the GAOBOT.AO WORM!"
X	Windows Startup	services21.exe	"Added by the AGOBOT-MX WORM!"
X	Windows Startup	Winsys32.exe	"Added by the RBOT.AAB WORM!"
X	Windows Startup 32 Bits	sysrun32.exe	Added by a variant of the DARKSUN TROJAN!
Y	Windows SteadyState - Bubble Messages	Bubble.exe	"Part of Windows SteadyState
Y	Windows SteadyState - Session Timer Notify (UI)	SCTUINotify.exe	"Part of Windows SteadyState
X	Windows Storm-Memory Drivers	memorystorm.exe	"Added by the SLENFBOT.CO WORM!"
X	Windows Stortup	svchost.exe	"Added by the TOGER-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Streams Server	localsrv.exe	"Added by the SDBOT.LN WORM!"
X	Windows Subsys	winload.exe	"Added by the NETSPREE.C WORM!"
U	Windows Supervisor	winspvr.exe	"Windows Supervisor surveillance software. Uninstall this software unless you put it there yourself"
X	WINDOWS SVC	winsvc.exe	"Added by the MYTOB-EY WORM!"
X	Windows svchost	avserv.exe	"Added by the PUSHBOT.FM WORM!"
X	Windows svchost	ctfmon32.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows svchost	happy2008.exe	"Added by the PUSHBOT.AM WORM!"
X	Windows svchost	service.exe	"Added by the PUSHBOT.DU WORM!"
X	Windows svchost	serviceaaa.exe	"Added by the PUSHBOT.ER WORM!"
X	Windows svchost	servicean.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows svchost	svchost.exe	"Added by the IRCBOT-ZQ WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows svchost	ups.exe	"Added by the PUSHBOT.A WORM!"
X	Windows svchost	upss.exe	"Added by the PUSHBOT.GJ WORM!"
X	Windows svchost	serviceam.exe	"Added by the PUSHBOT.EY WORM!"
X	Windows svchost	svchostx.exe	"Added by the PUSHBOT.CC WORM!"
X	Windows Svchost Authority	slsass.exe	"Added by the RBOT-UA WORM!"
X	Windows Svshost Service Update 32	svcsshost32.exe	"Added by the FORBOT-GD WORM!"
X	Windows SYN Control Center	winmnon32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows SyncroAd	SyncroAd.exe	Windupdates adware variant
X	Windows SysNotify	mssecc.exe	"Added by the AGENT-GFR TROJAN!"
X	WINDOWS SYSTEM	beta.exe	"Added by the MYTOB.DF WORM!"
X	WINDOWS SYSTEM	dcomuser.exe	"Added by the MYTOB.EO WORM!"
X	WINDOWS SYSTEM	lf66prc.exe	"Added by the MYTOB.GC WORM!"
X	WINDOWS SYSTEM	msdev32.exe	"Added by the MYTOB.EH WORM!"
X	WINDOWS SYSTEM	nec.exe	"Added by the MYTOB-L WORM and variants!"
X	WINDOWS SYSTEM	nibie.exe	"Added by the MYTOB-BY WORM!"
X	WINDOWS SYSTEM	ninfoie.exe	"Added by the MYTOB-EP WORM!"
X	WINDOWS SYSTEM	skybot.exe	"Added by the MYTOB-CX WORM!"
X	WINDOWS SYSTEM	skybotx.exe	"Added by the MYTOB-BY WORM!"
X	WINDOWS SYSTEM	smoc.exe	"Added by the MYTOB.FU WORM!"
X	WINDOWS SYSTEM	smsc.exe	"Added by the MYTOB-BR WORM!"
X	WINDOWS SYSTEM	test.exe	"Added by the MYTOB.DJ WORM!"
X	WINDOWS SYSTEM	test2.exe	"Added by the MYTOB.DJ WORM!"
X	WINDOWS SYSTEM	test3.exe	"Added by the MYTOB.DV WORM!"
X	WINDOWS SYSTEM	wdns33.exe	"Added by the MYTOB-BY WORM!"
X	WINDOWS SYSTEM	win.exe.exe	"Added by the MYTOB.FA WORM!"
X	WINDOWS SYSTEM	winaup.exe	"Added by the MYTOB-DN WORM!"
X	WINDOWS SYSTEM	winligon.exe	"Added by the MYTOB.EP WORM!"
X	WINDOWS SYSTEM	winmon.exe	"Added by the MYTOB.GB WORM!"
X	WINDOWS SYSTEM	winNTsys32.exe	"Added by the MYTOB-DM WORM!"
X	WINDOWS SYSTEM	winsvc32.exe	"Added by the MYTOB.HH WORM!"
X	Windows System	WINSYS.exe	"Added by the RBOT-AEF WORM!"
X	WINDOWS SYSTEM	winsys33.exe	"Added by the MYTOB.EK WORM!"
X	WINDOWS SYSTEM	winvnc.exe	"Added by the MYTOB.EU WORM!"
X	WINDOWS SYSTEM	winxpserv.exe	"Added by the MYTOB-BQ WORM!"
X	WINDOWS SYSTEM	xxx.exe	"Added by the MYTOB.CZ WORM!"
X	Windows System	winsys32.exe	"Added by the MYTOB-IS WORM!"
X	WINDOWS SYSTEM	skybot.exe	"Added by the MYTOB.JU WORM!"
X	WINDOWS SYSTEM	botzor.exe	"Added by the ZOTOB WORM!"
X	WINDOWS SYSTEM	gothica.exe	"Added by the MYTOB.HU WORM!"
X	WINDOWS SYSTEM	msnl.exe	"Added by the MYTOB.IK WORM!"
X	WINDOWS SYSTEM	per.exe	"Added by the ZOTOB.C WORM!"
X	WINDOWS SYSTEM	twunk_65.exe	"Added by the MYTOB-EG WORM!"
X	WINDOWS SYSTEM	servce.exe	"Added by the MYTOB-EI WORM!"
X	WINDOWS SYSTEM	servises.exe	"Added by the ZOTOB-I WORM!"
X	WINDOWS SYSTEM	xpupdate.exe	"Added by the ZOTOB-G WORM!"
X	WINDOWS SYSTEM	expI0rer.exe	"Added by the MYTOB-FI WORM! Note the upper case ""i"" and number ""0"" in the filename"
X	WINDOWS SYSTEM	msn32.exe	"Added by the MYTOB-FX WORM!"
X	WINDOWS SYSTEM	sky.exe	"Added by the MYTOB.LB WORM!"
X	WINDOWS SYSTEM	Win32IMAPSVR.exe	"Added by the MYTOB-FQ or MYTOB-FU WORMS!"
X	WINDOWS SYSTEM	winsvc.exe	"Added by the MYTOB.LM WORM!"
X	WINDOWS SYSTEM	mswins.exe	"Added by the MYTOB.DP WORM!"
X	WINDOWS SYSTEM	mtrnqs.exe	"Added by the MYTOB.IG WORM!"
X	WINDOWS SYSTEM	logic.exe	"Added by the MYTOB.IC WORM!"
X	WINDOWS SYSTEM	ctech.exe	"Added by the MYTOB-KD WORM!"
X	WINDOWS SYSTEM	efefefe.exe	"Added by the MYTOB-KH WORM!"
X	WINDOWS SYSTEM	svchost2.exe	"Added by the MYTOB.OZ WORM!"
X	WINDOWS SYSTEM	skybot.exe	"Added by the MYTOB.EB WORM!"
X	WINDOWS SYSTEM	wupdate.exe	"Added by the MYTOB-HT WORM!"
X	Windows System	system.exe	"Added by the MYTOB-GN WORM!"
X	Windows System 32	winsys_32.exe	"Added by the RBOT-FTR WORM!"
X	Windows System 32-Bat Service	win32bat.exe	"Added by the MYTOB.FI WORM!"
X	Windows System Backup	SysBackup.exe	Unidentified malware
X	WINDOWS SYSTEM By FEnR	windasz-updote.exe	"Added by the MYTOB.LR WORM!"
X	WINDOWS SYSTEM Cleaner	h3.exe	"Added by the MYTOB.EQ WORM!"
X	WINDOWS SYSTEM CLEANER	iexplore.exe	"Added by the MYTOB.ET WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows System Configuration	SYSCFG16.EXE	"Added by the WISDOOR-K TROJAN!"
X	Windows System Configuration	Passcfg16.exe	"Added by the DOMWIS-E TROJAN!"
X	Windows System Configuration	Winfrw.exe	"Added by the SOLUFINA TROJAN or the DOMWIS-J WORM!"
X	Windows System Configuration	wincfg.exe	"Added by the AGOBOT.OP WORM!"
X	Windows System Configuration	WINCFG32.EXE	"Added by the AGOBOT-TE WORM!"
X	Windows System Configuration	WinNeth.exe	"Added by the RETHE-A WORM!"
X	Windows System Configuration	nether.exe	"Added by the OPANKI-AB WORM!"
X	Windows System Configuration	WINSYS32.exe	"Added by the SDBOT.AXK WORM!"
X	Windows System Defender	WS[random characters].exe	"Windows System Defender rogue security software - not recommended
X	WINDOWS SYSTEM Dns	windsns.exe	"Added by the MYTOB.EY WORM!"
X	WINDOWS SYSTEM DNSPOOL	hbmail.exe	"Added by the MYTOB.FW WORM!"
X	Windows System Drivers	sysretain.exe	"Added by the SLENFBOT.BY WORM!"
X	Windows System File	cmxp.exe	"Added by the SPYBOT.KHO WORM!"
X	WINDOWS SYSTEM FILE	winload.exe	"Added by the MYTOB.DK WORM!"
X	Windows System Gateway	SPOOLER.EXE	"Added by a variant of the RBOT WORM!"
X	Windows System Guard	egun.exe	"Added by the AGENT-NHY TROJAN!"
X	Windows System Guard	msdn.exe	"Added by the FAKEAV-BJD TROJAN!"
X	Windows System Guard	msng.exe	"Added by the EGGDROP-BO WORM!"
X	Windows System Guard	msns.exe	"Added by the DWNLDR-IGD TROJAN!"
X	Windows System Init	winit32.exe	"Added by a variant of the RBOT WORM!"
X	Windows System Manager	winsystem.exe	"Added by the RBOT-AN WORM!"
X	Windows System Manager	CRSL.EXE	"Added by the SDBOT.MG WORM!"
X	Windows System Manager	sysconf.exe	"Added by the MYTOB.AL WORM!"
X	Windows System Manager	smsc.exe	"Added by a variant of the RBOT WORM!"
X	Windows System Manager	crssm.exe	"Added by the RBOT-AFH WORM!"
X	WINDOWS SYSTEM MANAGER	spoolsvc.exe	"Added by the MYTOB-LY WORM!"
X	Windows System Manager	winsysmgr.exe	"Added by the IRCBOT.BJG BACKDOOR!"
X	Windows System Manager Loader	smsls.exe	"Added by the AGOBOT.TF WORM!"
X	Windows System Manager Proc	winsmc.exe	"Added by the RBOT.JH WORM!"
X	WINDOWS SYSTEM MEMORY LOADER	memloader.exe	"Added by the MYTOB-IN WORM!"
X	WINDOWS SYSTEM mscdvvs	mscdvvs.exe	"Added by the MYTOB.MD WORM!"
X	windows system notepad	wnpsm.exe	"Added by a variant of the RBOT WORM!"
X	Windows System Restore Configuration	Sblhost.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows System Restorer	SystemRestorer.exe	"Added by the DULOAD.C WORM!"
X	WINDOWS SYSTEM SCALPE	scalpe91.exe	"Added by the MYTOB-HI WORM!"
X	Windows System Security	winmp.exe	"Added by the RBOT.IV WORM!"
X	Windows System Security	sys32.pif	"Added by the RBOT-AOL WORM!"
X	Windows System Security Monitor	[4 random letters].exe	"Added by the PINKTON.A WORM!"
X	Windows System Serivce	winserv.exe	"Added by the RBOT.ACA WORM!"
X	windows system service	winsock.exe	"Added by the RBOT-MR WORM!"
X	Windows System Service	wnuserv.exe	"Added by the SPYBOT.ANDM WORM!"
X	Windows System Service	[worm filename]	"Added by the RBOT.XG WORM!"
X	Windows System Suite	WS[random characters].exe	"Windows System Suite rogue security software - not recommended
U	Windows System Tray	msni.exe	"Iambigbrother monitoring software"
X	Windows System Tray	swhost.exe	"Added by an unidentified VIRUS
X	WINDOWS SYSTEM UPDATE	xDcc.exe	"Added by the MYOTB-EH WORM!"
X	Windows System Update Tools	upds.exe	"Added by the VANBOT.CX BACKDOOR!"
X	Windows System-Control Drivers	syscontrl.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows System32	windowsp.exe	"Added by the MYTOB.GD WORM!"
X	Windows System32	winsys32.exe	"Added by the SDBOT-AHS WORM!"
X	Windows System32	clsas32.exe	"Added by the RBOT-AZO WORM!"
X	Windows System32	explorer.exe	"Added by the OPANKI-V WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is also copied to %System%"
X	Windows System32	System32.exe	"Added by the SDBOT-ALI WORM!"
X	Windows SYSTEM32	Realplayer.exe	"Added by the SPYBOT.ZH WORM!"
X	Windows System32	wingrd32.exe	"Added by a variant of the RBOT WORM!"
X	Windows System32	windows32.exe	"Added by the RBOT-FPB WORM!"
X	Windows System32 Driver	clsass32.exe	"Added by the SDBOT-AGG WORM!"
X	Windows System32 Kernel	system32.exe	"Added by the SDBOT-AAT WORM!"
X	Windows SystemDll	SYSTEMDLL.EXE	"Added by the AGOBOT-LP WORM!"
X	WINDOWS SYSTEMn	servicces.exe	"Added by the MYTOB-EL WORM!"
X	Windows Systemnmg	stagmr.exe	"Added by the MYTOB.S WORM!"
X	Windows Systems16	winjews16.exe	"Added by the SDBOT-CXT WORM!"
X	Windows SYStry	spoolsvr.exe	"Added by the SDBOT.GN BACKDOOR!"
X	Windows SYStry	systry.exe	"Added by the SDBOT-E WORM!"
X	Windows Sz Host	winshvc.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Task Manager	ACCOUNT_DETAILS.DOC.exe	"Added by the QUATERS.A WORM!"
X	Windows Task Manager	taskmgn.exe	"Added by the AGENT-CIP BACKDOOR!"
X	Windows Task Manager	taskmrg.exe	"Added by the MYTOB.AV WORM!"
X	Windows Task Manager	taskgmr.exe	"Added by the MYTOB.BJ WORM!"
X	Windows Task Manager	taskmg.exe	"Browser hijacker - identified by DrWeb antivirus as ""Trojan.StartPage.601"""
X	Windows Task Manager	taskmngr.exe	"Added by the RBOT-ANM WORM!"
X	Windows Task Manager Emulator	kennewr.exe	"Added by the SPYBOT-FA WORM!"
X	Windows Task Mgr	mstasks.exe	"Added by the IRCBOT.UN BACKDOOR!"
X	Windows Task Mgr!	mstasker.exe	"Added by the IRCBOT.OE BACKDOOR!"
X	Windows Task Scheduler	asijdie.exe	Added by an unidentified WORM or TROJAN!
X	Windows Task Service (32-bits)	tasksys.exe	"Added by the DREFIR.D WORM!"
X	Windows TaskAd	Wintaskad.exe	Windupdates adware variant
X	Windows Taskbar Manager	internat.exe	"Added by the PROTORIDE-H WORM!"
X	Windows Taskbar Manager	[path to file]	"Added by the PROTORIDE.B WORM!"
X	Windows Taskbar System	tasksys.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Taskmanager	lsassx.exe	"Added by the KELVIR.E WORM!"
X	Windows Taskmanager	iexplorer.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Windows Taskmanager	service.exe	"Added by the PUSHBOT.OR WORM!"
X	Windows Taskmanager	svchost.exe	"Added by the IMBOT.AC WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Taskmanager	taskmrg.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Taskmanager	taskngr.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Taskmanager	tskmngr.exe	"Added by the IRCBOT.DHR BACKDOOR!"
X	Windows Taskmanager	wdtsvc.exe	"Added by the PUSHBOT.AU WORM!"
X	Windows Taskmanager	winpifviewer.exe	"Added by the PUSHBOT.BB WORM!"
X	Windows Taskmanager	winrl.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Taskmanager	taskxphost.exe	"Added by the PUSHBOT.BI WORM!"
X	Windows Taskmanager Data	csrrss.exe	"Added by the RBOT-BBH WORM!"
X	Windows TaskManager Service	windns32.exe	"Added by the AGOBOT-JP WORM!"
X	Windows TCP/IP	wintcp.exe	"Added by the AGOBOT-ZH WORM!"
X	Windows Telnet Server	wintel.exe	"Added by the AGOBOT-MW WORM!"
X	Windows Temperate Services	wintmp.exe	"Added by the SLENFBOT.ZW WORM!"
X	Windows Terminal Manager	rmbsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Time	tmservice.exe	"Added by a variant of the RBOT-YK WORM!"
X	Windows Time	winmgr.exe	"Added by the RBOT-XC WORM!"
X	Windows Time Server	TimeSRV.exe	"Added by the SPYBOT.DNC WORM!"
X	Windows Time Service Diagnostic Tool	winscrvs.exe	"Added by the RBOT.FTV BACKDOOR!"
X	Windows TM	SVPHOST.exe	"Added by a variant of the RBOT WORM!"
X	Windows TM	rundlI32.exe	"Added by the RBOT.EL BACKDOOR!"
X	Windows TM	windowssys32.exe	"Added by a variant of the RBOT WORM!"
X	Windows TM	WinxSys.exe	"Added by a variant of the RBOT WORM!"
X	Windows TM	pdpatbcyj.exe	"Added by the RBOT.FEF WORM!"
X	Windows TM	Syss.exe	"Added by the RBOT.ADF BACKDOOR!"
X	Windows Tracking Client	ctwsvc.exe	"Added by the AGENT-GMB TROJAN!"
X	Windows UDP	winudp.exe	"Added by the IRCBOT.GAT WORM!"
X	Windows UDP Control	winudspm.exe	"Added by a variant of the SDBOT WORM! See here"
X	Windows UDP Control Center	auth.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	ehSched.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	fxstaller.exe	"Added by the AGENT-IEE TROJAN!"
X	Windows UDP Control Center	installer.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows UDP Control Center	msnmngs.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	msnpd.exe	"Added by the SDBOT.EBA BACKDOOR!"
X	Windows UDP Control Center	mswinudpmgr32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	scvhost.exe	"Added by the PUSHBOT.EH WORM!"
X	Windows UDP Control Center	taksmrg.exe	"Added by the AGENT.WOH TROJAN!"
X	Windows UDP Control Center	tmps.exe	"Added by the SDBOT.EBA BACKDOOR!"
X	Windows UDP Control Center	winlive32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	winmsn.exe	"Added by the SDBOT.EBA BACKDOOR!"
X	Windows UDP Control Center	winrofl32.exe	"Added by the LDPINCH-RZ TROJAN!"
X	Windows UDP Control Center	winudpmg.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	winudpmgrs.exe	"Added by the DROPPER.CMV TROJAN!"
X	Windows UDP Control Center	winudpmsgr.exe	"Added by the SDBOT.GAV WORM!"
X	Windows UDP Control Center	winupmgr.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	winuscn32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	wksvcsc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	winudpmgr.exe	"Added by the DLOADR-HQL TROJAN!"
X	Windows UDP Control Center	fxsteller.exe	"Added by the IRCBOT-J BACKDOOR!"
X	Windows UDP Control Center	msnsmsgrs.exe	"Added by the PUSHBOT.MF WORM!"
X	Windows UDP Control Center	winmgrs.exe	"Added by the PUSHBOT.MY WORM!"
X	Windows UDP Control Manager	winudpmgr.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Services	wksvcsc.exe	"Added by the ANTIAV-C TROJAN!"
X	Windows Upate	rundll.exe	"Added by the HAKO TROJAN! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	Windows Update	[filename]	"Added by the NORIO TROJAN! Acts as a hi-jacker redirecting to adult content sites"
X	Windows Update	iexplorere.exe	"Added by the GAOBOT.AP WORM!"
X	windows update	uddater.exe	"Added by the LEOX TROJAN!"
X	Windows Update	wudate.exe	"Added by the AGOBOT.ML WORM!"
X	Windows Update	wupdate.exe	"Wengs adware"
X	windows update	sychost.exe	"Added by the LEOX.B WORM!"
X	Windows Update	Wuamgrd.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Update	inetinf.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Windows Update	WindowsUpdate.exe	"Added by the BAYROB-A TROJAN!"
X	Windows Update	host32.exe	"Added by the RBOT-GU WORM!"
X	windows update	wuraclt.exe	"Added by the RBOT-PO WORM!"
X	windows update	Wuanclt.exe	"Added by the RBOT.XZ WORM!"
X	Windows Update	svchosts.exe	"Added by the FRUCTA TROJAN!"
X	Windows Update	ebay.exe	"Added by the GAOBOT.BUU WORM!"
X	Windows Update	windows.exe	"Added by the RBOT-RB WORM!"
X	windows update	wuaurlt.exe	"Added by the RBOT.ADG WORM!"
X	Windows Update	Update.exe	"Added by the DELF-FN TROJAN!"
X	Windows Update	winmguard.exe	"Added by the RBOT-EM WORM!"
X	Windows Update	wuampd.exe	"Added by the RBOT.UM WORM!"
X	windows update	wuarclt.exe	"Added by the RBOT-OF WORM!"
X	Windows Update	winupdate.exe	"Added by the SDBOT-WS WORM!"
X	Windows Update	msnwinsb.exe	"Added by the RBOT-AAH WORM!"
X	Windows Update	scvhost.exe	"Added by the SDBOT-XT WORM!"
X	windows update	Microsoft.exe	"Added by the LMIR.A TROJAN!"
X	Windows Update	mplupdate.exe	"Added by the MOEGA WORM!"
X	windows update	msnsever.exe	"Added by the RBOT-AHN WORM!"
X	Windows Update	taskmr.exe	"Added by the MYTOB-GZ WORM!"
X	Windows Update	update32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update	wininfo.exe	"Added by the MYTOB.GA WORM!"
X	Windows Update	winlogin.exe	"Added by the BANKER-DV TROJAN!"
X	Windows Update	msnupdates.exe	"Added by the RBOT-ALK WORM! Note - this file has nothing to do with Windows updates or MSN"
X	Windows Update	qtask.exe	"Added by the RBOT-AKU WORM! Note - do not confuse with the Quicken file of the same name as described here"
X	windows update	real.exe	"Added by the LEGMIR-AU WORM!"
X	Windows Update	windowsx.exe	"Added by the BANCD-A TROJAN!"
X	Windows update	wudupdate.exe	"ISTBar adware related"
X	Windows Update	wupdmgr.exe	"Added by the BANCBAN-FC TROJAN and variants!"
X	Windows Update	csrss.exe	"Added by the BANKER-HM TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Update	msnsupdate.exe	"Added by the RBOT-AXS WORM!"
X	Windows Update	XPLoogNT.exe	"Added by the BANCD-B TROJAN!"
X	Windows Update	install.exe	"Added by the BANKER-IB TROJAN!"
X	Windows Update	msi.exe	"Added by the BANKER-XB TROJAN!"
X	Windows Update	Sqltob.exe	"Added by the DASHER.A WORM!"
X	windows update	logonuit.exe	"Added by the LEGMIR-AO TROJAN!"
X	Windows Update	avkir.exe	"Added by the RBOT-GJP WORM!"
X	Windows Update	easypwnt.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update	MSDEVS30.exe	Added by the SPYBOT.AHC WORM!
X	Windows Update	SecretStub.exe	"Added by the SRAMLER.C WORM!"
X	Windows Update	Winload.exe	"Added by the DEDMIR-A WORM!"
X	Windows Update	taskngr.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Update	usnsvc.exe	"Added by the KOBOT-C WORM!"
X	Windows Update	win32update.exe	"Added by the SDBOT.FTK WORM!"
X	Windows Update	livesrvs.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update	McAfee.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not a valid McAfee program"
X	Windows Update	McAfee3.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Windows Update	msconfig32.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows Update	msnsa32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Update	scrigz.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Update	winsc.exe	"Added by the BUZUS.RYI TROJAN!"
X	Windows Update	wuauclt32.exe	"Added by the SDBOT.DHY WORM!"
X	Windows Update	dllhostup.exe	"Added by the BANCBAN-NB TROJAN!"
X	Windows Update	explored.exe	"Added by the GAOBOT.MF WORM!"
X	Windows Update	smsscr.exe	"Added by the BANKER-DK TROJAN!"
X	Windows Update	sysdrv.exe	"Added by the AGENT-IYE TROJAN!"
X	Windows Update	winupupdate1.exe	"Added by the RBOT-UV WORM!"
X	Windows Update	klass.exe	"Added by the BIFROSE-ZH TROJAN!"
X	Windows Update	winlogonEvt.exe	"Added by the VB-DXM TROJAN!"
X	Windows update	explore.exe	"Added by the GAOBOT.AL WORM!"
X	Windows Update	fdos.exe	"Added by the RBOT-COG WORM!"
X	Windows Update	leak32x.exe	"Added by the AGENT.ALY BACKDOOR!"
X	Windows update	msb32.exe	"Added by the GAOBOT.CG WORM!"
X	Windows update	svdhost.exe	"Added by the GAOBOT.CG WORM!"
X	Windows Update	tskmngr.exe	"Added by the AGENT.ALY BACKDOOR!"
X	Windows Update	windb32.exe	"Added by the AGENT.ALY BACKDOOR!"
X	Windows update 2005	[random filename]	"Added by the RBOT.ARP WORM!"
X	Windows Update 32	winlogons.exe	"Added by the FORBOT-FI WORM!"
X	Windows Update 32	rempss.exe	"Added by the FORBOT-FW WORM!"
X	Windows Update 32	slsys.exe	"Added by the FORBOT-FT WORM!"
X	Windows update 32bit	winupd32.exe	"Added by the SDBOT.BE WORM!"
X	Windows Update 63	shupd64.exe	"Added by the FORBOT-GA WORM!"
X	Windows Update 64	nbupd64.exe	"Added by a variant of the FORBOT WORM!"
X	Windows Update 64	WinV.exe	"Added by the FORBOT-FP WORM!"
X	Windows Update Auto Update	wuaumgr.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Update Automatic Updates	[path to backdoor]	"Added by the VBBOT.AM BACKDOOR!"
X	Windows Update Automation	winuptdate.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update AutoUpdate Client	waucult.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update AutoUpdate Client	wuauclt.exe	"Added by the LAZAR.B TROJAN! Note - this is not the legitimate wuauclt.exe process
X	Windows Update AutoUpdate Client Product	wuauct.exe	"Added by the AGOBOT.ACL WORM!"
X	Windows Update Center	svthx.exe	"Added by the STUBBOT.A WORM!"
X	Windows Update Center	W32RSA.exe	Added by an unidentified WORM or TROJAN!
X	Windows Update Check	syslodr.exe	"Added by the SMALL.LU TROJAN!"
X	Windows Update Checker	[random filename]	Adware downloader trojan
X	Windows Update Checker	msupdte32.exe	"Added by the SDBOT-AEF WORM!"
X	Windows Update Checker	deinst_qfe001.exe	Added by a variant of the Win32.Small TROJAN!
X	Windows Update Checker	deinst_qfe002.exe	Added by a variant of the Win32.Small TROJAN!
X	Windows Update Client	wuclient.exe	"Added by the SMALL-RN TROJAN!"
X	Windows Update Client Service	windrvl32.exe	"Added by the AGOBOT-MM TROJAN!"
X	Windows update config	svhost.exe	"Added by the SDBOT-PF WORM!"
X	windows update configurator	svghost.exe	"Added by a variant of the SPYBOT WORM!"
X	windows update configurator	explore.exe	"Added by the SDBOT.RY BACKDOOR!"
X	Windows Update Controller	mwoffice.exe	"Added by the BATTRY-A TROJAN!"
X	Windows Update Draven	draven.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update Drive	updrvs.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update Files	dnetc.exe	"Added by an unidentified VIRUS
X	Windows Update Firewall System	ctfmoom.exe	"Added by the RBOT-GAN WORM!"
X	Windows Update Firewall System	winmsfw.exe	"Added by the RBOT-EEO WORM!"
X	Windows Update Firewall System	ctfmom.exe	"Added by the SPYBOT.ANDM WORM!"
X	Windows Update GUI Executable x32x	wupdategux32.exe	"Added by the RBOT.CXY WORM!"
X	Windows Update Host	winupsvc.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update IPv6 Layer	WIN32IPV6.EXE	"Added by the RBOT.DUD WORM!"
X	Windows update loader	xpupdate.exe	"Malware installed by different rogue security software including SpyKillerPro. Also detected as the BRAVE-A TROJAN!"
X	Windows Update Manager	wupdmngr.exe	"Added by the RANDEX.BTB WORM!"
X	Windows Update Manager	Winlog0n.exe	"Added by the AGENT-BO TROJAN!"
X	Windows Update Manager	wupdate.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update Manager	bootwiz.exe	Added by the MYBOT WORM!
X	Windows Update Manager	WindowsUpdateManager.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Update Manager for NT	wupdmgr32.exe	"Added by the SDBOT.AH WORM!"
X	windows update microsoft	updatem.exe	"Added by the RBOT-CHE WORM!"
X	Windows Update Monitoring Service	winupdt.exe	"Added by the RBOT-PL WORM!"
X	Windows Update Process	wmiprvsc.exe	"Added by the SDBOT-CB WORM!"
X	Windows Update Service	csrs.exe	"Added by the AGOBOT-NI WORM!"
X	Windows Update Service	smcg.exe	"Added by the SDBOT.QY WORM!"
X	Windows Update Service	SP00ISS.exe	"Added by the SDBOT-ZH WORM!"
X	Windows Update Service	update32.pif	"Added by the RBOT-ALC WORM!"
X	Windows Update Service	trest.exe	Identified by BitDefender as a variant of the PEED TROJAN!
X	Windows Update Service	wmiprvse32.exe	"Added by the AGOBOT.NI WORM!"
X	Windows Update Service	regscv.exe	"Added by the AGOBOT-AM BACKDOOR!"
X	Windows Update Service	msupdate32.exe	"Added by the DLOADR-CRJ TROJAN!"
X	Windows Update Service 2004/2005	systemupdate.exe	"Added by the RBOT-JE WORM!"
X	Windows Update services	wins32svcs.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update Services	winupdate32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update Software	system.exe	"TOFGER.BX spyware"
X	Windows Update SP3	Windat.EXE	"Added by the RBOT-GTS WORM!"
X	Windows Update Svc	rundll32.exe xpupdate.dll	"ContraVirus rogue security software - not recommended
X	Windows Update System	mswins.exe	"Added by the IRCBOT.DN WORM!"
X	Windows Update System Shell	svhostcs32.exe	"Added by the RBOT-AAZ WORM!"
X	Windows Update V6	[random filename]	"Added by the RBOT-KT WORM!"
X	Windows Update.exe	N/A	Homepage hijacker
X	Windows Updated	spoolsae.exe	"Added by the RBOT-APM WORM!"
X	Windows Updated	updatr.exe	"Added by the RBOT-AYB WORM!"
X	Windows Updater	wupdmgr32.exe	"Added by a variant of the DOS.AUTOCAT TROJAN!"
X	Windows Updater	iexplorerrs.exe	"Added by the RBOT-TN WORM!"
X	Windows Updater	svigost.exe	"Added by the RBOT-VS WORM!"
X	Windows Updater	wupdate.exe	"Added by the WOOTBOT.AJ WORM!"
X	Windows Updater	sdsys.exe	"Added by the FORBOT-JG WORM!"
X	Windows Updater Online	winupdatexx.exe	"Added by a variant of the RBOT WORM!"
X	Windows Updater Servc	xpuupdate.exe	"ContraVirus rogue security software - not recommended
X	Windows Updater Service Manager	winupdatr.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Updater Services	msnupdate.exe	"Added by a variant of the RBOT WORM!"
X	windows updaters	winupdats.exe	"Added by the SPYBOT-IS WORM!"
X	Windows Updates	lsassx.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Updates	winupd32.exe	"Added by the MYTOB.CE WORM!"
X	Windows Updates	w32dns.exe	"Added by the SDBOT-BFW WORM!"
X	Windows Updates Agent	winupdate.exe	"Added by the SPYBOT.HW WORM!"
X	Windows Updating Service	updating.pif	"Added by the RBOT-ALW WORM!"
X	Windows Updtee Mgnr	W1NT45K.exe	"Added by the MYTOB.DC WORM!"
X	Windows Upgrate Utility	winulty.exe	"Added by the AUTORUN-ASR WORM!"
X	Windows USB 2.0 Driver	usbtskmgr.exe	"Added by the RBOT-BKG WORM!"
X	Windows USB 2.0 Driver	usb2ctrl.exe	"Added by the RBOT-BIW WORM!"
X	Windows USB 2.0 Driver	usbservice.exe	"Added by the RBOT-BLF WORM!"
X	Windows USB Control Driver	iexplore.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows USB controler	winusb.exe	"Added by the RBOT-HR WORM!"
X	Windows USB Driver Support	Windowsusb.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows USB Hub Manager	usbhub.exe	"Added by the RBOT-BJX WORM!"
X	Windows USB Monitor	servupdate.exe	"Added by the IRCBRUTE.AQ TROJAN!"
X	Windows USB Printer	exe.exe	"Added by a variant of the RBOT WORM!"
X	Windows USB Printer	unqgod.exe	"Added by the RBOT.BKC BACKDOOR!"
X	Windows USB Printer	xqteby.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows USB Service	666.exe	"Added by the MYTOB.AR WORM!"
X	Windows USB v3	wsvc.exe	"Added by a variant of the SDBOT WORM!"
X	Windows USBD	msifirewall.exe	Added by an unidentified WORM or TROJAN!
X	Windows User Mode Driver Manager	wdfmrg.exe	"Added by the SDBOT-ZN WORM!"
X	Windows User Starter	winuser32.exe	"Added by the RBOT.SN WORM!"
N	Windows Version Check	ver_chk.exe	"Version checker for CyberAudioLibrary - ""a new way to exchange information through the Internet"""
X	Windows Version Service	sysvers.exe	"Added by the SLENFBOT.IF WORM!"
X	Windows Version Service	sysvers32.exe	"Added by the SLENFBOT.HZ WORM!"
X	Windows video	vide_32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Windows Video Acquisition (WVA)	wvsvc.exe	"Added by the AGOBOT.YM WORM!"
X	Windows Video Component	wvcsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Video Drivers	videons32.exe	"Added by the GAOBOT.AZT WORM!"
X	Windows Video Drivers	VIDEONS3.EXE	"Added by the AGOBOT-KZ BACKDOOR!"
X	Windows Video Input	viwsvc.exe	"Added by the SLENFBOT.GS WORM!"
X	Windows Virtual Manager	vmnat.exe	"Added by the SILLYFDC.BCB WORM!"
X	Windows Virtual Services	winvirtual.exe	"Added by the SLENFBOT.IE WORM!"
X	Windows Virtual Services	winvirtual32.exe	"Added by the SLENFBOT.IB WORM!"
X	Windows Virus Control	plou.exe	"Added by the SDBOT-ACZ WORM!"
X	Windows Virus Scanner	winvsvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Vista Corparation Agent Services	winxp_sp3.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Vista Transformation	IEXPLORE.exe	"Added by the FORBOT-GV WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows Volume Control	ongsvc.exe	"Added by the SLENFBOT.DZ WORM!"
X	Windows Web Services	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Winhlp32 Stub Service	winhlp32.pif	"Added by the AIMBOT.AH TROJAN!"
X	Windows WKS	wsass.exe	"Added by the SDBOT-DK WORM!"
X	Windows WKS Services	wkssvr1.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows WMF Fix	winfix.exe	"Added by the RBOT-FTQ WORM!"
X	Windows Workstation	mpci.exe	"Added by a variant of the RBOT WORM!"
X	Windows Workstation	msup32a.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Workstation Service	explore.exe	Added by unknown malware
X	Windows Workstation Service	wkssvc.exe	"Added by the IRCBOT-AAI WORM!"
X	Windows Workstation Service (32-bits)	wkssvc32.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Workstation Service [5.1-2600]	windrm.exe	"Added by the RBOT-CNY WORM!"
X	Windows Workstation Start Service	mslanmgr.exe	"Added by a variant of the RBOT WORM!"
X	Windows Xp	nortonguard.exe	"Added by the MYTOB-DZ WORM!"
X	Windows xp	Wins.exe	"Added by the RBOT.VH BACKDOOR!"
X	Windows XP Automatic Update	wXPupdate.exe	"Added by the RBOT-AFC WORM!"
X	Windows Xp Service Pack 2	svchost.exe	"Added by the XPLOS-A TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	Windows XP SP2 KeyGen	Windows XP SP2 KeyGen.exe	"Added by the TIBICK-C WORM!"
X	Windows Zero Spooler	nmvcs.exe	"Added by the SLENFBOT.JQ WORM!"
X	Windows-System	System32.exe	"Added by the LOGPOLE.C WORM!"
X	Windows-TCP-IP	rfkampig.exe	"Added by the GIPMA TROJAN!"
X	Windows-Xdate	wuamclt32.exe	"Added by the SPYBOT.AMUV WORM!"
X	Windows-XP-Service-Pack	xpspz.exe	"Added by the SDBOT-AAC WORM!"
X	windows16	windows16.exe	"Added by the VB-XU TROJAN!"
X	Windows32	rundll.exe	"Added by the AGOBOT-LK or AGOBOT-ND WORMS! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	windows32	windows32.exe	"Added by the VB-XU TROJAN!"
X	Windows32	wuuaclt.exe	"Added by the BRATLE.B WORM!"
X	Windows32	win.exe	"Added by the AGOBOT-KN WORM!"
X	Windows32	system.exe	Unknown malware
X	Windows32 Configuration Loader	msrf32.exe	"Added by the SDBOT-ABX WORM!"
X	Windows32 Messenger Service	msmsgv.exe	"Added by the RBOT.ANS WORM!"
X	Windows32 Net Database	msnd32.exe	"Added by the RBOT-AAL WORM!"
X	Windows32 Serivces	winser32.exe	"Added by the SPYBOT.AAF WORM!"
X	Windows32KernelStart	wks.exe	"Added by the LAPURD TROJAN!"
Y	Windows7FirewallControl	Windows7FirewallControl.exe	"Windows 7 Firewall Control from Sphinx Software - ""Protects your applications from undesirable network incoming and outgoing activity
X	WindowsACEbar	acebarupdate.exe	"BarACE adware"
X	WindowsAgent	WindowsAgent.exe	"Added by the GOP.G WORM!"
X	WindowsAgent	sysexhook.exe	"Added by the GOP keyboard logger/TROJAN!"
X	WindowsAPI.DLL	Server5.exe	"Added by the ""Fear and Hope"" TROJAN!"
X	WindowsAudio	systemupd.exe	"Added by the AGENT-TH WORM!"
X	WindowsBackup	WINDOWSBACKUP.EXE	"Added by the STANG WORM!"
X	WindowsBool	aimplg.exe	"Added by the SDBOT-CNG WORM!"
X	WindowsCRC	wscrc.exe	"Added by the SDBOT-VU WORM!"
X	WindowsCriticalUpdate	windows_critical_update.exe	"Added by the ASTEF or RESPAN WORMS!"
X	WindowsD	s1.exe	"Added by the MSNDIABLO.A WORM!"
X	WindowsDiskEvt	svcsvh32.exe	"Added by the NANINF.D TROJAN!"
X	WindowsDiskLog	cstsm.exe	"Added by the STINX-C or STINX-D TROJANS!"
X	WindowsExplorer	csrss.exe	"Messenger Blocker rogue security software - not recommended. Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\System"
X	WindowsExplorer	svchost.exe	"Messenger Blocker rogue security software - not recommended. Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\System"
X	WindowsFileSystem	winsfs32.exe	"Added by the RBOT-FMQ WORM!"
X	WindowsFileSystem	cidaemon32.exe	"Added by the RBOT-FSP WORM!"
X	WindowsFirewall	lsass.exe	"Messenger Blocker rogue security software - not recommended. Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\System"
X	WindowsFirewallSvc	winsvcup.exe	"Added by a variant of the SDBOT WORM!"
X	WINDOWSflashbrg	sqldata1.exe	"Added by a variant of the AGENT-IC TROJAN!"
X	WindowsFS	winfs.exe	"Added by the AGOBOT-BO WORM!"
X	Windowsfw	vssmf32.exe	"Added by the SPIGOT BACKDOOR!"
X	Windowsfw	windowsfw.exe	"Added by the AGOBOT-TA WORM!"
X	WindowsFY	wp.exe	"Part of a ""Security IGuard"" parasite infestation - also detected as DESKTOPHIJACK"
X	WindowsFY	bsw.exe	"Added by a variant of the DESKTOPHIJACK TROJAN! For removal see here"
X	WindowsFY	[path to trojan]	"Added by the FAKEALE-E TROJAN!"
X	WindowsFZ	[path to file]	"Added by the DESKTOPHIJACK VIRUS! Also see DESKTOPHIJACK.B TROJAN!"
X	WindowsFZ	A5281300.so	"Variant of the SmitFraud alias FAKEALE-C TROJAN!"
X	WindowsFZ	zloader3.exe	"Variant of the SmitFraud alias FAKEALE-C TROJAN!"
X	WindowsHive	rpcc.exe	"Added by the DLENA-A TROJAN!"
X	WindowsInstaller	[path to file]	"Added by the DEDLER-D TROJAN! The most common filenames seen are ""csmss.exe"" and ""csmrs.exe""
X	WindowsIPRelay	winipsvc.exe	"Added by the IRCBOT-AAA WORM!"
X	Windows�Updates	Update.exe	"Added by the RBOT.TRA BACKDOOR!"
X	WindowsK	a1.exe	"Added by the MSNDIABLO.A WORM!"
X	WindowsKeyUpdate	master.exe	"Added by the JOSAM WORM!"
X	WindowsMGM	Winmgm32.exe	"Added by the SOBIG.A WORM and LALA.C TROJAN!"
X	windowsmp	windowsmp.exe	"Added by the AUTORUN-DP WORM!"
X	WindowsNT CWServices	CWServices.com	"Detected by Bitdefender as the AGENT.AGDK TROJAN! See here"
X	WindowsNT Services	Services.com	"Detected by Bitdefender as the DELF.OFC TROJAN! See here"
X	WindowsProtocolLog	lsadst.exe	"Added by the NANINF.C TROJAN!"
X	WindowsReg% update	[random filename].exe	"Added by the RBOT-HH WORM!"
X	WindowsRegistration	[random filename]	"Added by the RBOT-NO WORM!"
X	WindowsRegKey Autoupdate	[random filename]	"Added by a variant of the RBOT WORM!"
X	WindowsRegKey upd4te2d4te	*********.exe [* = random char]	"Added by the RBOT.XQ WORM!"
X	WindowsRegKey update	winupdate.exe	"Added by the RBOT-QJ WORM!"
X	WindowsRegKey update	windns.exe	"Added by the RBOT.IE WORM!"
X	WindowsRegKey update	winupdatexx.exe	"Added by the RBOT.LW WORM!"
X	WindowsRegKey update	[random filename]	"Added by the RBOT.QT WORM!"
X	WindowsRegKey update	svchoosts.exe	"Added by the RBOT.ADB WORM!"
X	WindowsRegKey update	svchostc.exe	"Added by the RBOT.IF WORM!"
X	WindowsRegKey update	wdnupdate.exe	"Added by the SDBOT.QX WORM!"
X	WindowsRegKey update	Windowsup.exe	"Added by the SDBOT.PU WORM!"
X	WindowsRegKey update	WINUPDATES.EXE	"Added by the RBOT-MM WORM!"
X	WindowsRegKey update	rkbuouoxfl.exe	"Added by the RBOT-OO WORM!"
X	WindowsRegKey update	winsys.exe	"Added by the RBOT-JY WORM!"
X	WindowsRegKey update	winupdat32.exe	"Added by the RBOT-AGW WORM!"
X	WindowsRegKey update XP	windexv1.exe	"Added by the RBOT-ABM WORM!"
X	WindowsRegKey%$ update	msi332.exe	"Added by the RBOT-IX WORM!"
X	WindowsRegKey%update	ethernet32m.exe	"Added by the RBOT-EN WORM!"
X	WindowsRegKeys update	winsysi.exe	"Added by the SDBOT.WE WORM!"
X	Windowss Service Agent	mssngear.exe	"Added by the RBOT.KGU BACKDOOR!"
X	WindowsService	[random name].dll	"Added by the VUNDO-X TROJAN!"
X	WindowsServicesH	servicedhs.exe	"Added by the AGOBOT-JD WORM!"
X	WindowsServicesStartup	svchost.exe	"Added by the ECUP WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
X	WindowsSetup	[path to trojan]	"Added by the EZBOT TROJAN!"
X	WindowsSp2	sp2.exe	"Added by the POSSE WORM!"
X	WindowsSystem32	asper.exe	"Added by the AGENT-EFP TROJAN!"
X	WindowsSystem32	svchosts.exe	"Added by the AGENT-EDA TROJAN!"
X	WindowsSystem32	[path to worm]	"Added by the SDBOT-DFG WORM!"
X	WindowsSystem32	msnmssgr.exe	"Added by the AGENT.ALY BACKDOOR!"
X	WindowsSystem32	msn_kilo.exe	"Added by the AGENT.ALY BACKDOOR!"
X	WindowsSystem32	msnmgaer.exe	"Added by the AGENT.ALY BACKDOOR!"
X	windowstime.exe	windowstime.exe	"Added by the DLOADR-AQV TROJAN!"
U	WindowsTranslator	DWinTrsl.exe	"Delta Translator® English < > Portugese (Brazilian) version - ""an automatic
U	WindowsTranslator_Espanhol	DWinTrsl.exe	"Delta Translator® Spanish < > Portugese (Brazilian) version - ""an automatic
X	WindowsUpd	WindowsUpd4.exe	"VirtuMonde adware"
X	WindowsUpd1	WindowsUpd1.exe	"VirtuMonde adware"
X	WindowsUpd2	WindowsUpd2.exe	"VirtuMonde adware"
X	WindowsUpdate	windows_update.exe	"Added by the LOFNI WORM!"
X	WindowsUpdate	svchost.exe	"Added by the ASTEF or RESPAN WORMS or AGENT-V TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	windowsupdate	RPC[RANDOM CHARACTERS].exe	"Added by the IRCBOT.B TROJAN!"
X	WindowsUpdate	USRINIT.EXE	"Added by the MADDIS.B WORM!"
X	windowsupdate	winupdate.exe	"Added by the WARPI WORM!"
X	WindowsUpdate	svchost.exe	"Added by the BDOOR-IK BACKDOOR! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	WindowsUpdate	winnnint.exe	Added by an unidentified WORM or TROJAN!
X	WindowsUpdate	[path to file]	"Added by the DUPA-B TROJAN!"
X	WindowsUpdate	svchostw.exe	"Added by the COBFINN_B TROJAN!"
X	WindowsUpdate	Nzil.exe	"Added by the CULLER-C WORM!"
X	WindowsUpdate	Strad.exe	"Added by the CULLER-D WORM!"
X	Windowsupdate	Windowsupdate.exe	"Added by the BANKER.ARK TROJAN!"
X	Windowsupdate	wupdmgr98.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	WinDOwsUPdate	smss.exe	"Added by the AUTORUN.DIB WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~� subfolder"
X	windowsupdate	autoupdate.exe	"Added by the IRCBOT-P BACKDOOR!"
X	WindowsUpdate	svdhost.exe	"Added by the AGOBOT-BP WORM!"
X	WindowsUpdate	twain.exe	"Added by the AGENT.BEA TROJAN!"
X	WindowsUpdate renew	iexplore.exe	"Added by the AGENT.QG TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	WindowsUpdate Service	wuautlc.exe	"Added by the RBOT-NR WORM!"
X	Windowsupdate Service	csrss.exe	"Added by the BABA-B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in the root folder (ie
X	WindowsUpdatecrss	crss.exe	"Added by a variant of the AGENT-HZ TROJAN!"
X	WindowsUpdateDirect	dupadirect.exe	"Added by the DUPA-C TROJAN!"
X	WindowsUpdatelsasss	lsasss.exe	"Added by a variant of the AGENT-HZ TROJAN!"
X	WindowsUpdatem1	[path to file]	"Added by the AGENT-AAJ TROJAN!"
X	WindowsUpdatem2	svchost.exe	"Added by an unidentified WORM or TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	WindowsUpdateManager	wupdmng.exe	"Added by the IRCBOT.OE BACKDOOR!"
X	WindowsUpdateNT	svwhost.exe	"Added by the SHELLOT-B TROJAN!"
X	WindowsUpdateR	regserv.exe	"Added by the COBFINN_B TROJAN!"
X	WindowsUpdatesvchostss	svchostss.exe	"Added by the AGENT-HZ TROJAN!"
X	WindowsUpdatev4	w32gins.exe	"Added by an unidentified WORM or TROJAN! Located in the Root folder (C:\)
X	WindowsUpdatewinsec	winsec.exe	"Added by a variant of the AGENT-HZ TROJAN!"
N	WindowsWelcomeCenter	"rundll32.exe oobefldr.dll	ShowWelcomeCenter"
X	WindowsXP Module	DirectX3D.exe	"Malware
X	WindowsXp Security	spool.exe	"Added by the RBOT-GRK WORM!"
X	WindowsXP Update	windowsxpupdate.exe	"Added by the RBOT-PB WORM!"
X	WindowsXPserv	svcnxp32.exe	"Addee by the NANINF-A TROJAN!"
X	windowsxxx	windowsxxx.exe	"Added by the DUBING-A TROJAN!"
X	windowsxxx2	windowsxxx2.exe	"Added by the DUBING-A TROJAN!"
X	Windows_LowLevel_Security_Core	lsass.exe	"Added by the PADMIN-A TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Repair"
X	Windows_Protect	winsystem.exe	"Added by a variant of the RBOT WORM!"
X	Windows_Protect	winregal.exe	"Added by a variant of the RBOT WORM!"
X	Windows_Protect	lsas.exe	"Added by the RBOT.ARO WORM!"
X	Windows_Protect	wincontrol32.exe	"Added by the RBOT-ADK WORM!"
X	Windows_Serivce	SERVICE.exe	"Added by the WOOTBOT.AH WORM!"
X	Windows_Updates	svthost.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows_VXD	user32.exe	"Added by the PPORT TROJAN!"
X	Windowz	[original worm filename].vbs	"Added by the NUKIP WORM!"
X	Windowz Update V2.0	Explorer.exe	"Added by the YODO WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Windowz Update V2.0	updater.exe	"Added by the YODO-C WORM!"
X	Window_Protect	winsi32.exe	"Added by a variant of the RBOT WORM!"
X	winlog	windowxs.exe	"Added by the SDBOT-KT BACKDOOR!"
X	winnt DNS ident	windowxp.exe	"Added by a variant of the RBOT WORM!"
X	Winnt DNS ident	windowsp.exe	"Added by the RBOT.BAL WORM!"
X	[various names]	Windows32.exe	Added by any of a number of WORM or TROJAN variants
X	_Windows	services.exe	"Added by the SOBER.X WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %windir%\WinSecurity"