av

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
Y	!AVG Anti-Spyware	avgas.exe	"System Tray access to and notifications for AVG Anti-Spyware 7.5. This has now been superseded by AVG Anti-Virus which includes Anti-Spyware"
ME"	"MS Java Applets for Windows NT	X	javaapplets.exe
NT	"Ms Java for Windows 98	ME & XP"	X
NT	"Ms Java for Windows 98	XP & ME"	X
XP & ME	"MS Java for Windows NT	X	xpjavams.exe
?	00DSKSVR00	desksaver.exe saskda	"Part of Advanced Desktop Shield
U	00DSKSVR01	desksaver.exe tray	"System Tray access to Advanced Desktop Shield
X	0_AVD32	xzboot.exe	"Added by the AGENT-IWI TROJAN!"
U	12Ghosts SaveLayout	12autosl.exe	"12Ghosts SaveLayout - ""Always (always!) keep the layout of your desktop icons"""
X	9xHtProtect	AVprotect9x.exe	"Added by the NETSKY.M WORM!"
N	AAATraySaver	TraySaver.exe	"System Tray management utility from Mike Lin which allows you to hide
X	AAMSFree702	Avengine.com	"Added by the DELF.LJ TROJAN!"
X	All Sea screen saver	TaskTray.exe	"Free screensaver
X	AlphaAV	AlphaAV.exe	"Alpha Antivirus rogue security software - not recommended
X	ansjava	[path to worm]	"Added by the RANDON-AN WORM!"
X	antispy	ieav.exe	"IE AntiVirus rogue security software - not recommended
Y	AntiVir XP	AVwin.exe	"AntiVir® PersonalEdition Classic - antivirus"
X	Antivirus	av.exe	"Added by the SINKIN TROJAN! Resets IE start page to realphx.com"
X	Antivirus	avm.exe	"Antivirus Master rogue security software - not recommended
X	Antivirus	vav.exe	"Vista Antivirus 2008 rogue security software - not recommended
X	Antivirus	aav.exe	"Advanced Antivirus rogue security software - not recommended
X	ANTIVIRUS	AVS.exe	"Antivirus Sentry rogue security software - not recommended
X	ANTIVIRUS	microAV.exe	"Micro Antivirus 2009 rogue security software - not recommended
X	ANTIVIRUS	UltraAV.exe	"Ultra Antivirus 2009 rogue security software - not recommended
X	Antivirus	sav.exe	"System Antivirus 2008 rogue security software - not recommended
X	Antivirus	uav.exe	"Ultimate Antivirus 2008 rogue security software - not recommended
X	Antivirus	wav.exe	"Windows Antivirus 2008 rogue security software - not recommended
X	Antivirus 2009	av2009.exe	"AntiVirus'09 rogue security software - not recommended
X	Antivirus PC 2009	avpc2009.exe	"Antivirus PC 2009 rogue security software - not recommended
X	Antivirus Updates	avupdchk.exe	"Added by the AGOBOT-IP WORM!"
Y	aol	avp.exe	"AOL's Active Virus Shield (by Kaspersky) - found in an AOLActive Virus Shield sub-directory"
?	AOLSAV	AOLAgent.exe	"AOL ISP related. What does it do and is it required?"
X	Application Layer Services	avrsvc.exe	"Added by the IRCBOT.BJM BACKDOOR!"
Y	ashAvast	ashAvast.exe	"Part of Avast antivirus"
?	ASUS Camera ScreenSaver	ASScrProlog.exe	"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
?	ASUS Screen Saver Protector	ASScrPro.exe	"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
U	ATI Technologies Inc. HydraVision Desktop Manager	HydraDM.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is the HYDRAVISION Desktop Manager - which ""customizes the behaviour of windows and dialog boxes
U	ATI Technologies Inc. HydraVision Viewport	HydraMD.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is HYDRAVISION MultiDesk - which ""creates
X	AUTOPROTECTU	navapq32.exe	Added by an unidentified WORM or TROJAN!
X	auto__antiav__key	antiav_exe.exe	"Added by the BAGLEDI-AA TROJAN!"
X	AV	UPDATE-28062004.exe[25 blank spaces].vbs	"Added by the MIDFIN WORM!"
X	AV	Antivir.exe	"Antivir rogue security software - not recommended
X	av	expressav.exe	"Express Antivirus 2009 rogue security software - not recommended
X	AV AntiSpyware	ava.exe	"AV AntiSpyware rogue security software - not recommended
X	AV Care	AvCare.exe	"AvCare rogue security software - not recommended
X	AV Client	patch31345.exe	"Added by the MYDOOM.AD WORM!"
X	AV Industry	patch31345.exe	"Added by the MYDOOM.AD WORM!"
X	AV UpDate	Update.exe	"Added by the FUROOT-A TROJAN!"
X	AV7	antivirus7.exe	"Antivirus7 rogue security software - not recommended
N	AvaFind	AvaFind.exe	"AvaFind file search utility"
X	avagent3974	chnb8895.exe	"AntiVirus ransomware security software - not recommended
X	AVantivirus	Avconsol.exe	"Added by the MSNVB-D WORM!"
X	avast	troyan.exe	"Added by the SMALL.CZ TROJAN!"
Y	Avast!	ashServ.exe	"Main part of avast! Antivirus - including the resident protection
Y	avast!	ashDisp.exe	"System Tray access to and notifications for avast! Antivirus - giving left-click access to the On-Access Scanner
Y	avast! Antivirus	ashDisp.exe	"System Tray access to and notifications for avast! Antivirus - giving left-click access to the On-Access Scanner
Y	avast! Web Scanner	Ashwebsv.exe	"Web scanning part of avast! Antivirus. Starts via a registry ""Run"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
Y	Avast32	Astart32.exe	"Part of Avast! anti-virus software"
X	avc	avmon.exe	Added by an unidentified TROJAN!
U	AvconsoleEXE	Avconsol.exe	From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Used to schedule regular scans. If you don't have scans scheduled you don't need it
X	Avengine	Avengine.com	"Added by the DELF.LJ TROJAN!"
X	AveoAttune	atmdlusr.exe	"Aveo Attune automated helpdesk software - adware/spyware"
U	AVFX Engine	StartFX.exe	"Advanced Video FX - supported by a number of Creative Web Cameras. ""Have more fun by adding a wide range of special effects and backgrounds to your video chat with Advanced Video FX"""
X	AvG	svchost323.exe	"Added by the RBOT-ZA WORM!"
Y	AVG Anti-Spyware	avgas.exe	"System Tray access to and notifications for AVG Anti-Spyware 7.5. This has now been superseded by AVG Anti-Virus which includes Anti-Spyware"
Y	AVG Anti-Virus system	avgcc.exe	"System Tray access to and notifications for the 7.* series of anti-virus products from AVG Technologies. If this entry is disabled
Y	AVG Anti-Virus System	avgemc.exe	"E-mail scanner for the 7.* series of anti-virus products from AVG Technologies. This process scans incoming and outgoing E-mails for viruses and other malware. From version 7.1 onwards this entry only appears in 9x/Me as a startup entry
Y	AVG Anti-Virus System	avgw.exe	"This entry is included with the 7.* series of anti-virus products from AVG Technologies. Once installed (or on first run for a different user) it runs the configuration sequence to set up the product and doesn't run on subsequent restarts"
X	Avg Antivirus	icpldrvx.exe	"Added by the BANKER.BYU TROJAN!"
X	AVG AntiVirus Scanner	avgscnx.exe	"Added by the SILLYFDC.BBE WORM! Note - this is not a legitimate AVG entry"
X	AVG AntiVirus Updater	avgwusv.exe	"Added by the SILLYFDC.BAX WORM! Note - this is not a legitimare AVG entry"
X	AVG Grisoft Updater	updater.exe	"Added by the AGOBOT-OT WORM!"
Y	AVG IDS	AVGIDSUI.exe	"System Tray access to and notifications for AVG Identity Protection - identity theft prevention which is available as a stand-alone product or included with AVG Internet Security. ""Always-on identity theft prevention for Windows from one of the world's most trusted security companies. Shop and ensure safe surfing of the web
U	AVG Internet Security	avgtray.exe	"System Tray access to and notifications for the range of internet security products from AVG Technologies - including Internet Security
Y	AVG7_AMSVR	AVGAMSVR.EXE	"This is the AVG7 Alert Manager for the 7.* series of anti-virus products from AVG Technologies. It is essential for both scheduled activities (such as automatic updates and scans) and for displaying alerts and reports via the Control Center (avgcc.exe). Appears in 9x/Me as a startup entry and as a service in 2K and higher"
Y	AVG7_CC	avgcc.exe	"System Tray access to and notifications for the 7.* series of anti-virus products from AVG Technologies. If this entry is disabled
Y	AVG7_EMC	avgemc.exe	"E-mail scanner for the 7.* series of anti-virus products from AVG Technologies. This process scans incoming and outgoing E-mails for viruses and other malware. From version 7.1 onwards this entry only appears in 9x/Me as a startup entry
Y	AVG7_Run	avgw.exe	"This entry is included with the 7.* series of anti-virus products from AVG Technologies. Once installed (or on first run for a different user) it runs the configuration sequence to set up the product and doesn't run on subsequent restarts"
U	AVG8_TRAY	avgtray.exe	"System Tray access to and notifications for the 8.* series of internet security products from AVG Technologies - including Internet Security
U	AVG9_TRAY	avgtray.exe	"System Tray access to and notifications for the 9.* series of internet security products from AVG Technologies - including Internet Security
Y	avgamsvr.exe	Avgamsvr.exe	"This is the AVG7 Alert Manager for the 7.* series of anti-virus products from AVG Technologies. It is essential for both scheduled activities (such as automatic updates and scans) and for displaying alerts and reports via the Control Center (avgcc.exe). Appears in 9x/Me as a startup entry and as a service in 2K and higher"
Y	avgas	avgas.exe	"System Tray access to and notifications for AVG Anti-Spyware 7.5. This has now been superseded by AVG Anti-Virus which includes Anti-Spyware"
Y	avgcc	avgcc.exe	"System Tray access to and notifications for the 7.* series of anti-virus products from AVG Technologies. If this entry is disabled
Y	avgcc32	avgcc32.exe	"System Tray access to and notifications for the 6.* (and maybe earlier) series of anti-virus products from AVG Technologies. Also enables scheduled tests
Y	AVGCtrl	AVGCtrl.exe	"Part of AntiVir® PersonalEdition Classic antivirus"
Y	avgemc	avgemc.exe	"E-mail scanner for the 7.* series of anti-virus products from AVG Technologies. This process scans incoming and outgoing E-mails for viruses and other malware. From version 7.1 onwards this entry only appears in 9x/Me as a startup entry
Y	avgfwsrv	AVGFWSRV.EXE	"Integrated firewall for the 7.* series of anti-virus products from AVG Technologies. Protects the users computer from outside attacks
Y	AVGIDS	AVGIDSUI.exe	"System Tray access to and notifications for AVG Identity Protection - identity theft prevention which is available as a stand-alone product or included with AVG Internet Security. ""Always-on identity theft prevention for Windows from one of the world's most trusted security companies. Shop and ensure safe surfing of the web
Y	AVGIDSUI	AVGIDSUI.exe	"System Tray access to and notifications for AVG Identity Protection - identity theft prevention which is available as a stand-alone product or included with AVG Internet Security. ""Always-on identity theft prevention for Windows from one of the world's most trusted security companies. Shop and ensure safe surfing of the web
Y	avgmsvr.exe	avgmsvr.exe	"AVG Anti-Virus 7.0 related"
Y	AVGnt	AVGnt.exe	"AntiVir® PersonalEdition Classic antivirus. System Tray icon and control program"
Y	Avgserv9.exe	Avgserv9.exe	"Background monitoring and scanning for the 6.* (and maybe earlier) series of anti-virus products from AVG Technologies when running on 9x/Me. Loaded from the ""RunServices"" registry key"
U	avgtray	avgtray.exe	"System Tray access to and notifications for the range of internet security products from AVG Technologies - including Internet Security
Y	AVGuard	AVGuard.exe	"AntiVir® PersonalEdition Classic antivirus. Background task which scans files transparently"
X	avguard3876	000b09274b.exe	"AntiVirus ransomware security software - not recommended
Y	AVG_CC	avgcc32.exe	"System Tray access to and notifications for the 6.* (and maybe earlier) series of anti-virus products from AVG Technologies. Also enables scheduled tests
Y	AVG_EMC	AVGEMC.exe	"AVG Anti-Virus 7.0 Email Cleaner. Scans incoming and outgoing email for viruses"
Y	AVG_RegCleaner	AVGREGCL.exe	"Boot time registry cleaner for the 7.* series of anti-virus products from AVG Technologies - for checking the registry for virus additions and other security problems"
X	avidrv	drvsc.exe	"Detected by Kaspersky as the AGENT.PH TROJAN!"
X	Avimgt	Avimgt.exe	"Added by the GEMA TROJAN!"
X	Avimgt32	Avimgt32.exe	"Added by the GEMA TROJAN!"
Y	avinit	AVINIT9X.EXE	"Command Antivirus related"
X	Avira Anti-Virus Pro 2008	explorear.exe	Added by an unidentified WORM or TROJAN!
X	AvirTr	AvirTr.exe	"AntivirusTrigger rogue security software - not recommended
Y	AVK Mail Checker	AVKPop.exe	"eXtendia AVK AntiVirus email checker"
Y	AVKBar	AVKBar.exe	"GData AntiVirusKit Anti-virus"
Y	AVKTray	AVKTray.exe	"System Tray access to the antivirus part of G Data range of internet security products"
Y	AvMaiSrv	Avmaisrv.exe	"Part of Avast! anti-virus software - E-mail scanner"
X	AVManager	csrss.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
?	AvMenu	AVMenu.exe	"Part of the ArcaVir antivirus suite from Polish company Arcabit. What does this part do and is it required?"
Y	AVMWlanClient	wlangui.exe	Related to broadband products from avm.de
X	avnort	formatsys.exe	"Added by the SERFLOG.A WORM!"
X	avnort	msmbw.exe	"Added by the SERFLOG.A WORM!"
X	avnort	serbw.exe	"Added by the SERFLOG.A WORM!"
Y	avp	avp.exe	"Kaspersky anti-virus and AOL's Active Virus Shield (by Kaspersky) - found in either a Kaspersky or AOL sub-directory"
X	AVP	[path to trojan]	"Added by the MUTBO-A TROJAN!"
X	avp	avp.exe	"Detected by Kaspersky as the ALPHABET.B TROJAN!"
X	avp	win.tmp.exe [ is a number]	Added by a variant of the ALPHABET TROJAN!
X	avp	xar6000v7.exe	"Detected by Kaspersky as the ALPHABET.B TROJAN!"
X	AVP-SE	avp-32.exe	"Added by the AGOBOT.FS WORM!"
X	avpa	avpo.exe	"Added by the LEGMIR-ARK TROJAN!"
Y	avpcc	avpcc.exe	"Kaspersky Labs anti-virus"
X	avpl	Antivirus.exe	"AntiVirus Plasma rogue security software - not recommended
X	AvpM	AvpM.exe	"Added by the STARTPAGE-ID TROJAN! Note - this is not the popular Kaspersky antivirus and this file is located in %Windir%\pchealth\UploadLB\Config"
X	avpms	avpms.exe	"Added by the ONLINEGAMES.CPV TROJAN!"
X	Avpr	avpr.exe	"Added by the MYDOOM.AF WORM!"
X	AVPSrv	AVPSrv.exe	"Added by the ONLINE-GEN TROJAN!"
X	avptask	[path to trojan]	"Added by the NOFERE-G TROJAN!"
X	avptask	expl0rer.exe	"Added by the AGENT.JJO TROJAN!"
X	Avptask	rund1132.exe	"Added by the AGENT.PKZ TROJAN!"
X	AvpWx	WErcx.exe	"Detected by Kaspersky as a variant of the AGENT.A TROJAN!"
X	Avril Lavigne - Muse	[random filename]	"Added by the AVRIL-A WORM!"
X	avrlabs	avrlabs.exe	"VirusResponse Lab 2009 rogue security software - not recommended"
X	avscan	avscan.exe	"Added by the SILLYFDC.BCR WORM! The file is in the users %Temp% directory"
X	AVScan	winav.exe	Unidentfied rogue security software
X	AvScan	avscan.exe	"Antivirus System PRO and Spyware Protect 2009 rogue security software. The file is located in %ProgramFiles%\<rogue name>"
X	avscan	Usbconeted.exe	"Added by the PROVIS-A TROJAN!"
Y	AVSCHED32	AVSched32.exe	"AntiVir® PersonalEdition Classic - antivirus"
Y	AVSchedScan	SCHSC9X.EXE	"Command Antivirus related"
X	AVScheduler	AVSCHSVC.EXE	"Part of the WinAntiVirus Pro 2005 rogue security software when installed in Win98/Me - not recommended
X	AVSeguro	pgs.exe	"AVSeguro
X	AvSer	dsm.exe	"Added by the SERFLOG.B WORM!"
X	AvSer	msmpatch.exe	"Added by the SERFLOG.B WORM!"
X	AvSer	svosm.exe	"Added by the SERFLOG.B WORM!"
X	AvSer	sysup.exe	"Added by the SERFLOG.B WORM!"
X	avserve.exe	avserve.exe	"Added by the SASSER WORM!"
X	avserve2.exe	avserve2.exe	"Added by the SASSER.B or SASSER.C WORMS!"
X	avserve3.exe	avserve3.exe	"Added by the SASSER.G WORM!"
U	AVStation premium	AVStation agent.exe	"Related to Samsung AV Station - instant playback of music
X	AVSTRT	navpsrvc.exe	"Added by the FORBOT-EF WORM!"
X	AVSystemCare	pgs.exe	"AVSystemCare rogue security software - not recommended. There are number of variants in this family sharing the same filename and user interface - see here"
X	avtapi	avtapi.exe	"Added by the AGENT.AM TROJAN! Note - example names include ""XviD""
N	Avtray	Avtray.exe	"Command Antivirus tray icon"
X	AVTray	AVTray.exe	"Part of the WinAntiVirus Pro 2005 rogue security software when installed in Win98/Me - not recommended
X	AVupdate32 Update	AVupdate32.exe	"Added by the RBOT.CNI TROJAN!"
?	AVWLPSTA	AVWLPSTA.exe	"PRISM Status Tray Applet - but what is it for and is it required?"
Y	AVWUpd32	AVWUPD32.EXE	"AntiVir® PersonalEdition Classic - updater"
Y	avx communicator	xcommsur.exe	"Anti-virus part of BitDefender virus scanner/firewall"
Y	Avxlive	avxlive.exe	"Bullguard or BitDefender antivirus"
Y	avxlni	avxinit.exe	"Anti-virus part of BitDefender virus scanner/firewall"
?	Avxnews	??	"??"
X	BagleAV	csrss.exe	"Added by the NETSKY.AB WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
Y	bitdefenderlive	avxlive.exe	"Main program of BitDefender virus scanner/firewall"
X	bootsec	NAVSSE.exe	"Added by the FORBOT-CY WORM!"
N	Bose Wave/PC Monitor	wavepcmonitor.exe	"System Tray access for this system (more info on the system here). Available via Start -> Programs"
X	Brave-Sentry	BraveSentry.exe	"BraveSentry rogue security software - not recommended
X	BraveSentry	BraveSentry.exe	"BraveSentry rogue security software - not recommended
X	braviax	braviax.exe	"Added by the FAKEALER.LE TROJAN!"
U	BUFFALO Power Save Utility for HD	HDManage.exe	"Power Save utility for Buffalo backup hard discs"
U	BullGuard Update	avxlive.exe	"Part of Bullguard antivirus. Leave enabled unless you manually update virus definitions"
Y	BullGuardInit	AVXINIT.EXE	"Part of Bullguard antivirus"
Y	CaAvTray	CAVTray.exe	"eTrust™ EZ Antivirus system tray application from Computer Associates"
N	Cashsurfers Cashbar Navigator	Cashbar.Exe	"Cashsurfers CashBar Navigator - ""The CashBar rotates banner advertisements once per minute and provides you with access to up to date special offers and deals"""
Y	CAVRID	CAVRID.exe	"eTrust™ EZ Antivirus Real Time Infection Report from Computer Associates"
Y	CAVS	CAVS.exe	"Cheyenne (now eTrust) antivirus"
N	CmFlywaveName	CmFlywav.exe	"Driver for Linksys Wireless-G Music Bridge"
Y	cnfgCav	CMain.exe	"Part of Comodo Antivirus"
X	command	javaw.exe	"Added by the AGOBOT-LG WORM!"
X	Compaq Service Drivers	navapqwa.exe	"Added by the SDBOT.BBQ WORM!"
X	Contraviro	Contraviro.exe	"Contraviro rogue security software - not recommended
X	ContraVirus	ContraVirusPro.exe	"ContraVirus rogue security software - not recommended
X	ContraVirus	ContraVirus.exe	"ContraVirus rogue security software - not recommended
N	Corel Reminder	NAVBROWSER.EXE	If you don't want to register Corel products and be reminded about it every 2 weeks disable it
N	Corel Reminder	NAVBrowser.exe	Registration reminder for CorelDRAW 10
X	cpntmgc	navpmc.exe	"Added by the SIMCSS TROJAN!"
X	Cpusave	Cpusave.exe	"Added by the GEMA TROJAN!"
X	Cpusave32	Cpusave32.exe	"Added by the GEMA TROJAN!"
X	Crnsava	scrnsave.pif	"Added by the SDBOT-ZV WORM!"
Y	CSAV_CheckViruses	vchk.exe	"Command Antivirus related"
N	CTAVTray	CTAvTray.exe	For Creative Soundblaster Live! series soundcards. Plays the EAX animation on start-up and adds a System Tray icon for it. Available via AudioHQ
X	DASDS VSAVdjs	dsabdw.exe	"Added by the SDBOT-RE WORM!"
N	DataViz Inc Messenger	DvzIncMsgr.exe	"Installed with DataViz ""Documents to Go"" software"
N	DataViz Messenger	DvzMsgr.exe	"DataViz Documents to Go - "allows you to use your Word
U	desksaver	desksaver.exe	"Part of Advanced Desktop Shield
U	DeskSaver	DeskSaver.exe	"DeskSaver from Headway Creative - utility that allows you ""to backup and to restore the icons position easily on the Windows desktop"". The Pro version also includes a ""Taskbar Economizer"" which minimizes an open window to the System Tray instead of the taskbar. Located in %ProgramFiles%\Headway Creative\DeskSaver"
U	DeskSaver Pro	DeskSaver.exe	"DeskSaver Pro from Headway Creative - utility that allows you ""to backup and to restore the icons position easily on the Windows desktop"". Includes a ""Taskbar Economizer"" which minimizes an open window to the System Tray instead of the taskbar. Located in %ProgramFiles%\Headway Creative\DeskSaver"
U	desksaver.exe	desksaver.exe	"Part of Advanced Desktop Shield
X	dlcipscl	dcpavss.exe	"Added by the MAILBOT-CB TROJAN!"
Y	Dpcnav	dpcnav.exe	"DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access"
X	Drives swap	AV1i.exe	"Anti-Virus Number-1 rogue security software - not recommended
X	DrWeb Antivirus	DRWEBAV.EXE	Added by an unidentified WORM or TROJAN!
?	DZKillMe	DZSAVEME.EXE	"??"
X	EasyAV	EasyAV.exe	"Added by the NETSKY.S or NETSKY.T WORMS!"
U	ELSAChipGuard	elsavect.exe	"ChipGuard for ELSA graphics cards - monitoring solution which monitors both the GPU temperature and fan speed
N	Energizer FileSaver	Energizer FileSaver.exe	"Energizer FileSaver - UPS back-up utility for Energizer UPS products. From their Tech Support staff this is known to have a memory leak since it's release - with no fix planned! It will grab 2-5 handles per second and crash the average system in less than 3 days - therefore not recommended"
Y	eScan Monitor	AVKWCTL9X.EXE	"MicroWorld eScan antivirus"
U	eScan Scheduler	avkserv.exe	"MicroWorld eScan antivirus scheduler"
X	Etraffic	JavaRun.exe	"TopMoxie adware"
X	Extra Antivirus	ExtraAV.exe	"Extra Antivirus rogue security software - not recommended
X	Fast Antivirus 2009	FastAV.exe	"Fast Antivirus rogue security software - not recommended
U	FavoriteSync	FavoriteSync.exe	"FavoriteSync keeps the same set of Internet Explorer Favorites on several computers in sync"
X	ffeqOME	vcvsav.exe	"Added by the RANKY.AB TROJAN!"
Y	Fix-it AV	memcheck.exe	Part of Ontrack's Fix-it Utilities Suite anti-virus. Performs a quick check of memory for signs of any virus. Exits afterward and returns all resources used in one user's experience. Not required but could be left without a drain on resources
N	fontnav	FontNav.exe	"Font Navigator from Bitstream Inc. - a font management utility"
X	free-save	[path to risk]	"Freesave security risk that tracks and sends browser information and visited websites on the computer. Uninstall this software unless you put it there yourself"
N	GCS	GrabClipSave.exe	"GrabClipSave screen capture tool"
X	General Antivirus	GenAvir.exe	"General Antivirus rogue security software - not recommended
X	Ghost Antivirus	GhostAV.exe	"Ghost Antivirus rogue security software - not recommended
U	Gravis Appawareloader	dbserver.exe	"Looks like it's associated with Gravis game controllers and the Keyset Manager
U	Gravis Xperience Driver Support	Grxp4exe.exe	"Driver for Gravis game controllers such as the Eliminator Aftershock. Must be loaded if you run the supplied application software for the controller to be recognized. Start it manually via a shortcut if not used"
X	GustavVED	[filename].exe	"Added by the OPASERV.H WORM!"
X	hagent	avp.exe	"Added by the ""Herman Agent"" remote access TROJAN!"
X	HomeAV	homeav.exe	"Home Personal Antivirus rogue security software - not recommended
?	HPAiODevice(hp officejet g series)	hpoavn07.exe	"HP Printer related
U	HPPWRSAV	HPPWRSAV.EXE	"Power save related for HP Scanners. Many users have complained of system freezes with it running but it stops the light from remaining on all the time. Try www.hp.com
X	HtProtect	AVprotect.exe	"Added by the NETSKY.L WORM!"
U	HydraVisionDesktopManager	desk98.exe	ATI/Appian HydraVision Desktop Manager software - monitors and regulates window and dialog box placement according to user preferences when using a multi monitor setup
U	HydraVisionDesktopManager	HydraDM.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is the HYDRAVISION Desktop Manager - which ""customizes the behaviour of windows and dialog boxes
U	HydraVisionViewport	viewport.exe	ATI/Appian HydraVision Desktop Manager software - monitors and regulates window and dialog box placement according to user preferences when using a multi monitor setup
U	HydraVisionViewPort	HydraMD.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is HYDRAVISION MultiDesk - which ""creates
N	Iconsaver	Iconsaver.exe	"IconSaver is a desktop icon manager"
X	icrosof Avps32 Control	av32.pif	"Added by the RBOT-AVC WORM!"
X	icrosoftf Avpx Control	avpx.exe	"Added by the RBOT-AYN WORM!"
X	IE Java Update	iejava.exe	"Added by the AGENT-HD TROJAN!"
X	IExplorer32 Java Scripting	IExplore32b.exe	"Added by the RBOT.ABO WORM!"
X	IExplorer32c Java Scripting	IExplore32cb.exe	"Added by the RBOT.ABN WORM!"
X	IExplorer6 Java Scripting	IExplore326.exe	"Added by a variant of the SDBOT WORM!"
X	IExplorer7 Java Scripting	IExplore327.exe	"Added by a variant of the SDBOT WORM!"
X	Internet Antivirus	IAvir.exe	"Internet Antivirus rogue security software - not recommended
Y	iolo AntiVirus	ioloAV.exe	"iolo AntiVirus"
X	iSafeAV	iSafeAV.exe	"iSafe AntiVirus rogue security software - not recommended
X	java	remote.cmd	"Added by the BANKER-EHG TROJAN!"
X	java	system.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Java (VM) v6.9	jav.bat	"Added by the AGENT-GZK TROJAN!"
X	Java applet	javaup.exe	"Added by the SDBOT-ACF WORM!"
X	Java Application	vssmf32.exe	"Added by the SPIGOT BACKDOOR!"
X	Java Auto Update	ujm.exe	"Added by the SDBOT-ADH WORM!"
X	Java Runtime Environment	jbuild.exe	"Added by the DELBOT-J WORM!"
X	Java Runtime Value	runjava.exe	"Added by the RBOT-DDJ WORM!"
X	Java Runtimes	iexplore.exe	"Added by the KILLAV.B WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This file is located in a %Windir%\Java\Java folder"
X	Java Softe	Java32.com	"Added by the RBOT.ECN WORM!"
X	Java update	javaqs.exe	"Added by the SWARLEY.A WORM!"
X	Java Update	keeper.exe	"Added by the AGENT-DIS TROJAN!"
X	Java Update	svchost.exe.exe	"Added by the AGENT-LBS TROJAN!"
X	Java Update	hostwww.exe.exe	"Added by the AGENT-MFH TROJAN!"
X	Java Virtual Machine	javaw.exe	"Added by a variant of the RBOT WORM!"
X	Java VM v6.9.2	jav.bat	"Added by the DWNLDR-HLM TROJAN!"
X	Java VM v6.91	jav.bat	"Added by the DWNLDR-HLL TROJAN!"
N	Java(TM) Platform SE 6	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
N	Java(TM) Platform SE 6 U*	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now. U* represents the update version
N	Java(TM) Platform SE Auto Updater 2 0	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
X	Java*.exe [ = random char]	Java*.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Java*32.exe [ = random char]	Java*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	java-plugin	javasctp.exe	"Added by the VB.AMX TROJAN!"
X	Java32 Configuration Loader	msnmesgr.exe	"Added by a variant of the RBOT WORM!"
X	JavaCore	JavaCore.exe	"Added by the MATCASH TROJAN!"
X	Javascript	jscript.exe	"Added by the DELBOT-AD WORM!"
X	JavaScript Debugging Service	JsDbgMan.exe	"Added by the DERDERO.E WORM!"
X	JavaScriptMsxrs	Msxrs.exe	"Added by the VB.BL WORM!"
X	JavaTray	traymgr.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	JavaUpdate0.07	[filename]	"Added by the JUPDATE TROJAN!"
X	JavaUpdateSched	jusched32.exe	"Added by the BCKDR-CKB BACKDOOR!"
X	JavaVM	java.exe	"Added by the MYDOOM.M WORM and variants! Note - not to be confused with the valid Windows ""java.exe"" which is located in %System% as this is located in %Windir%"
X	javawsa.exe	javawsa.exe	"Added by the BANK-Y TROJAN!"
X	Jufualt	java2.exe	"Added by the SDBOT.AOE WORM!"
Y	Kaspersky Anti-Hacker	KAVPF.exe	"Kaspersky Anti-Hacker personal firewall - no longer available"
Y	Kaspersky Anti-Virus Monitor	AvpM.exe	"Kaspersky Anti-Virus Lite - no longer available"
X	Kaspersky Antivirus	KasperskyAV.exe	"Added by a variant of the RBOT WORM!"
X	Kaspersky Email Security	javaupd.exe	"Added by the SWARLEY.A WORM!"
X	KasperskyAv	kaspersky.exe	"Added by the MIMAIL.T WORM! Note - this has nothing to do with the real Kaspersky anti-virus"
X	KasperskyAVEng	Kasperskyaveng.exe	"Added by the NETSKY.V WORM!"
Y	kav	avp.exe	"Kaspersky anti-virus and AOL's Active Virus Shield (by Kaspersky) - found in either a Kaspersky or AOL sub-directory"
X	kava	kavo.exe	"Added by the LINEAG-GLG TROJAN!"
X	KAVFOX	win1ogoin.exe	"Added by the GWGHOST-M TROJAN!"
X	kavir	kavir.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X	KAVPersonal	svchost.exe	"Added by the LINEAGE-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
Y	KAVPersonal50	Kav.exe	"Kaspersky Anti-Virus Personal 5.0"
X	KAVPersonal90	wscntfy.exe	"Added by the BANKER-FZ TROJAN!"
Y	KavPFW	KavPFW.exe	"KingSoft Personal Firewall"
X	KavRuns	Windll.exe	"Added by the TRYNOMA TROJAN!"
Y	KavStart	KAVStart.exe	"KingSoft Personal Firewall"
Y	kavsvc	kavsvc.exe	"Kaspersky antivirus"
X	KavSvc	*****.exe reg_run [ = random char]	"Added by the QOOLOGIC TROJAN!"
X	kavsvc	[random 6 char filename]	"Added by the QOOLOGIC TROJAN! Uses random file names (examples: nzkklz.exe
X	KAVutil	[worm filename]	"Added by the WINTOO.B WORM!"
X	kviurs	kav.exe	"Added by the SILLYFDC.BBJ WORM!"
X	Lavasoft Ad-Aware	Ad-Aware.exe	"Added by the RBOT-SO WORM! Note - this is not the popular Ad-Aware spware/adware removal tool and is located in %System%"
U	Lavasoft Adwatch	Ad-watch.exe	"Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system"
X	Login Screen Saver	login.scr	"Added by the RBOT-AVN WORM!"
X	Lsass	kavmm.exe	"Added by an unidentified WORM or TROJAN! NOTE - do NOT confuse with the legitimate Kaspersky antivirus module as described here. Contrary to this impostor
X	M3Development_WhenUSave_Installer	M3Development_WhenUSave_Installer.exe	"WhenU.Save adware"
X	Macromedia Dreamweaver XM	macdwXM.exe	"Added by the AGOBOT-RI WORM!"
X	MatrixScreenSaver	mss.exe	Unidentified malware
X	MAV_check	mav_startupmon.exe	"Part of the WinAntiVirus Pro 2007 rogue security software - not recommended
X	mav_startupmon	mav_startupmon.exe	"Part of the WinAntiVirus Pro 2007 rogue security software - not recommended
X	McAfee	McAffeAv.exe	"Added by the NETSKY.AL WORM!"
X	McAfee Antivirus	McAfeeAV.exe	"Added by a variant of the RBOT WORM!"
X	McAfee Antivirus 32	MCAFEEAV32.EXE	"Added by the SPYBOT-EH WORM!"
X	McAfee Antivirus Protection	mcafeeAV.exe	"Added by a variant of the RBOT WORM!"
X	McAfee Online virus Scanner	avp.exe	"Added by the RBOT-GCV WORM! Not to be confused with Kaspersky anti-virus and AOL's Active Virus Shield (by Kaspersky) - found in either a Kaspersky or AOL sub-directory"
Y	McAfeeVirusScanService	Avsynmgr.exe	"From McAfee VirusScan version 5.x. Runs VirusScan System Tray (Vsstat.exe)
X	MegaVirusKit	pgs.exe	"MegaVirusKit rogue security software - not recommended. A member of the AVSystemCare family"
Y	mgavctrl	mgavrtcl.exe	Part of older versions of McAfee's internet security products such as VirusScan and VirusScan Online
Y	mgavrtclexe	mgavrtcl.exe	Part of older versions of McAfee's internet security products such as VirusScan and VirusScan Online
Y	mgavrtclexe	mgavrte.exe	Part of older versions of McAfee's internet security products such as VirusScan and VirusScan Online
X	Microsoft Anti Virus Controller	msavc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Anti Virus Controller	msavc32.exe	"Added by the SDBOT.EPW BACKDOOR!"
X	Microsoft DLL Verifier	winavguard.exe	Added by the SDBOT.AAD WORM!
X	Microsoft Gina V Encryption	MSGINAV.EXE	"Added by an unidentified VIRUS
X	Microsoft Java Virtual Machine	MsConfiG.exe	"Added by the FORBOT-DV WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting"
X	Microsoft Java Virtual Machine	msjvm.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Java Virtual Machine	javavm.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Java Virtual Machine	msjavarxp.exe	"Added by the FORBOT-DL WORM!"
X	Microsoft Java Virtual Machine	winscr32.exe	"Added by a variant of the WOOTBOT WORM!"
X	Microsoft Java Windows Update	[filename]	"Added by the RBOT-DZ WORM!"
X	Microsoft JavaVM	msjarun.exe	"Added by the RBOT-JW WORM!"
X	Microsoft Machine	winjava.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft PC Health Remote Assistance File Open & Save controls	sfrcdlg32.exe	"Added by the RBOT-AVY WORM!"
X	Microsoft Security Center	savservices.exe	"Added by the RBOT-ANU WORM!"
X	Microsoft Service Disk Cycle	disksave.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Synchronization Manager	java.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft System Saver	[path to worm]	"Added by the RBOT.BSK WORM!"
X	Microsoft Update	navmgrd.exe	"Added by the SDBOT.DP TROJAN!"
X	Microsoft Update	NAV.exe	"Added by the RBOT-IV WORM!"
X	Microsoft Updating	navguard.exe	"Added by the RBOT.HW WORM!"
X	Microsoft Word Profissional	Java Plug In close.exe	"Added by the BANKER-EL TROJAN!"
X	MicrosoftCorp	javaw.exe	"Added by the BUZUS.BULO TROJAN!"
X	MicrosoftNAPC	javaw.exe	"Added by the BUZUS.BULO TROJAN!"
U	MilShieldSlave	ShieldWorker.exe	"Mil Shield from Mil Incorporated. It protects your privacy by removing all tracks from your online or offline computer activities"
N	MiniMavis	MiniMavis.exe	Mavis Beacon typing tutor
X	Monitor calibration	AV1i.exe	"Anti-Virus-1 rogue security software - not recommended
X	MS Java Applets for Windows NT & XP	javaapplet.exe	"Added by the RBOT.BHG WORM!"
X	Ms Java for Windows NT	MS32.exe	"Added by the VANEBOT-H WORM!"
X	Ms Java for Windows NT	msi32java.exe	"Added by the VANEBOT-I WORM!"
X	Ms Java for Windows NT	msjava.exe	"Added by the VANEBOT-E WORM!"
X	Ms Java for Windows NT	msi32info.exe	"Added by the RBOT.AFX WORM!"
X	MS Java for Windows XP & NT	javanet.exe	"Added by the VANEBOT-A WORM!"
X	MS Java Service Wrapper Windows NT & XP	wrapper.exe	"Added by the VANEBOT-D WORM!"
X	Ms Java Update For Windows NT/XP	msijavaupdt32.exe	"Added by the RANDEX.AF WORM!"
X	MS Java virtual machine	javavm.exe	"Added by the RBOT.ABG WORM!"
X	MS Screen Saver	scrsave.scr	"Added by the RBOT-AGT WORM!"
X	MS UniX	navupdate64.exe	"Added by the RBOT.CRZ BACKDOOR!"
X	msavsc.exe	msavsc.exe	"Added by the AGENT.ANQ TROJAN!"
X	MSFWAVTSM	FTPDev.exe	"Added by the RBOT-ACF WORM!"
X	MSInfo	AVBgle.exe	"Added by the NETSKY.O WORM!"
X	msjava service	xpcd.exe	"Added by the SDBOT.VM WORM!"
X	MSMcAfeee	Avsynmgr32e.exe	"Added by the FRAMAR TROJAN!"
X	MSMcAfeeh	Avsynmgr32h.exe	"Added by the FRANGO TROJAN!"
X	MSMcAfeeS	Avsynmgr32S.exe	"Added by the VOLAC or VOLAC.DR TROJANS!"
X	MSNavWH	MSWkwrH.exe	"Added by the ANAV-A WORM!"
X	MSOfficeCfg	navchk.exe	Premium rate adult content dialer
X	msvcav	msvcav.exe	"Added by the AGENT-ACR TROJAN!"
X	mswave	mswave.exe	"Added by the CRYPTER.A TROJAN!"
X	Mswavedll	mswavedll.exe	"Added by the CRYPTER-C TROJAN!"
U	mwavscan	mwavscan.com	"MicroWorld Anti Virus Toolkit is a free anti-virus scanner that runs on-demand. You can choose to scan your entire system
X	MyAV	avpguard.exe	"Added by the NETSKY.J WORM!"
X	Nano Antivirus	nanoav.exe	"Nano Antivirus rogue security software - not recommended
X	NAV	RuxDLL32.exe	"Added by the MAPSON.D WORM!"
Y	NAV Agent	navapw32.exe	Norton Anti-Virus's background scanning process
X	nAv AGENT	N/A	"Added by the RIOSYS MACRO! Note the lower-case ""n"" and ""v"" in the name as this is not the valid Norton AntiVirus entry of the same name - indeed it closes Norton AV processes"
X	NAV Agent	systems.exe	"Added by the TARNO.C TROJAN! Note - this is not the valid Norton Antivirus entry of the same name"
X	NAV Agent	winsnav.vbs	"Added by the ANPES WORM!"
X	NAV Agent	wmilib32.exe	"Added by the VB-XU TROJAN!"
X	NAV Auto Prot	navprot1.exe	"Added by the RBOT.ZAC WORM!"
X	NAV Auto Protect	msfwe1.exe	"Added by a variant of the RBOT WORM!"
X	NAV Auto Protect	navprotect.exe	"Added by the RBOT.BKW WORM! Note - this is not a valid Norton AntiVirus product from Symantec"
X	NAV Auto Protect	dnsserv.exe	"Added by a variant of the SDBOT WORM!"
X	NAV Auto Protect	mcafee32.exe	"Added by a variant of the SPYBOT WORM!"
X	NAV Auto Update	[random filename]	"Added by the SPYBOT-E WORM!"
X	NAV Auto Update	iamsad.exe	"Added by the SPYBOT-CE BACKDOOR!"
X	NAV Auto Update	Sadness.exe	"Added by the SPYBOT-E WORM!"
X	NAV Auto Updates	csrssp.exe	"Added by a variant of the SDBOT WORM!"
X	NAV Auto Updates	navwindows.exe	"Added by a variant of the SDBOT WORM!"
X	NAV Auto Updates	slserves.exe	"Added by the RBOT.COI BACKDOOR!"
X	NAV Auto Updates	navupdaterx.exe	"Added by a variant of the RBOT WORM!"
N	NAV CfgWiz	cfgwiz.exe	"Introduced with Norton Anti-Virus 2002
N	NAV Configuration Wizard	cfgwiz.exe	"Introduced with Norton Anti-Virus 2002
U	NAV DefAlert	DefAlert.exe	Norton Anti-Virus Definitions Alert. Warns you if virus definitions are out of date. Leave enabled unless you manually update virus definitions on a regular basis
X	NAV Live Update	[path to worm]	"Added by the DEBORMS.C WORM! Note - this is not a valid Norton Anti-Virus (NAV) function from Symantec"
X	NAV Scan Service	NAVSCAN32.EXE	"Added by the SDBOT.VG WORM!"
X	NavAgent32	lasvr32.exe	"Added by the FEMOT.D WORM!"
X	NavAgent32	SCardSvr32.Exe	"Added by the MOFEI.B WORM!"
X	navapp	navapp.exe	"NavExcel adware variant"
Y	navapw32	navapw32.exe	Norton Anti-Virus's background scanning process
X	NAVCheck	navchk.exe	Premium rate adult content dialer
X	NAVCheck	shman.exe	Premium rate adult content dialer
X	Navegate	iiexplorer.exe	"Added by the BANCBAN-OP TROJAN!"
X	Navegate	wisterd.exe	"Added by the BANKER-BOS TROJAN!"
U	NaverPCGreen	NPCGreenUpgrader.exe	"Related to Naver_Anti-virus Realtime Monitor From NHNCorp"
U	Naviscope	naviscope.exe	"Naviscope is a multipurpose browser enhancement that can speed up Web searches
X	NaviSearch	nls.exe	"NaviSearch
N	NavLoad	NAVBrowser.exe	Registration reminder for CorelDRAW 10
X	navman_20	sysnav32.exe	"Hijacker
?	NAVMD25	UpdtNv28.exe	Added by Symantec for updating the MicroDefs for their AV products - is it required?
X	NAVMon32	NAVMon32.exE	"Added by the WINKO.AO WORM!"
X	NAVNet	**.tmp [ = random digit]	Unidentified adware
X	navp.exe	navp.exe	"Added by the AGOBOT-OE WORM!"
X	NavPass	NavPass.exe	Free system for gaining access to and downloading from adult content web-sites
X	NavScan	[filename]	"Added by the OBSORB TROJAN!"
X	NAVSCAN32.EXE	NAVSCAN32.exe	"Added by the SDBOT-DO WORM!"
X	NAVSCANNER32	NAVSCANNER32.EXE	"Added by the RBOT.QC WORM!"
X	NAVtask	NAVtask.exe	"Added by the REMBOT-A BACKDOOR!"
X	NAVUpd	"rundll32.exe navupd.dll	Startup"
X	NAVWatch	NAVWatcher.exe	"VX2.Transponder parasite updater/installer related"
X	NAV_Update	NAV_Update.exe	Unidentified WORM or TROJAN!
X	NDAv	csnss.exe	"Added by the SERFLOG.C WORM!"
X	NDAv	svhost.exe	"Added by the SERFLOG.C WORM!"
X	NeroFileCheck	msjavam32.exe	"Added by the AGOBOT.AKM WORM!"
X	NeroUpdate Check	msjava.exe	"Added by the AGOBOT.AMH WORM!"
X	NeroUpdater6.8	winjava.exe	"Added by the AGOBOT.AMK WORM!"
X	Newman	playavi.exe	"Added by the LINEAGE-AT TROJAN!"
X	NI.UAVIFR_0001_N105M2404	[path to file]	"Installer for the VirusGarde French rogue security software - see here"
X	Norton Antiviral Scanner	navscnr.exe	"Added by the DELBOT-K WORM!"
X	Norton Antivirus	nortonav.exe	"Added by the RBOT-AYE TROJAN! Note - this is not the real Norton AV!"
X	Norton Antivirus 2004	SYMANTECAV2.EXE	"Added by the SPYBOT-DY WORM! Note - this is not the real Norton AV!"
X	Norton Antivirus AV	FVProtect.exe	"Added by the NETSKY.P WORM! Note - this is not the popular AV software!"
X	Norton AntiVirus Sys	NAVsys32.exe	"Added by a variant of the WOOTBOT WORM!"
X	Norton Antivirus Updater	nortonav.exe	"Added by the DELBOT-T WORM! Note - this is not the real Norton AV!"
X	Norton Auto Protect	nava.exe	Added by an unidentified WORM or TROJAN!
Y	Norton Auto-Protect	navapw32.exe	Norton Anti-Virus's background scanning process
?	Norton AV Preload	Premend.exe	"Norton Antivirus related. What does it do and is it required"
X	Norton AV Protection Startup	Ati2xxx.exe	"Added by a variant of the RBOT WORM!"
X	Norton Live Updater	Cavapsvc.exe	"Added by the GAOBOT.AO WORM!"
X	Norton Live Updater	Avapsvc.exe	"Added by the AGOBOT-BG BACKDOOR!"
N	Norton Navigator Loader	nnloader.exe	"An older Norton utility for file management under Windows 95. More information here"
X	Norton Service Process	navapvc.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Norton Service Process	navapsvc.exe	"Added by the AGOBOT-GV WORM! Note - this is not the valid Norton Anti-Virus service which has the same file and is located in %ProgramFiles%\Norton AntiVirus. This one is located in %System%"
X	Norton SpySweeper AutoUpdate	navsw.exe	"Added by the FORBOT-AS WORM!"
X	Norton Updater	navupdtr.exe	"Added by the SDBOT.AXV WORM!"
X	NortonAV	norton_antivirus.exe	"Added by the NETJOE TROJAN! Note - this is not the legitimate Symantec AV program"
X	nortonav	CCUPD32.EXE	Added by an unidentified WORM or TROJAN!
X	Nortons AV SYSTEM	scvchost.exe	"Added by a variant of the RBOT WORM!"
X	Nortons AVS Systems	arse.exe	"Added by the RBOT.AWY WORM!"
X	nsdcmd services	nsdcmdav.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	NvCplDmn	NAVSVC.EXE	"Added by an unidentified VIRUS
X	NvCplScan	kav32.exe	"Added by the FORBOT-EW WORM!"
X	nVidia Application Drivers	nvidiav32.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Paladin Antivirus	pav.exe	"Paladin Antivirus rogue security software - not recommended
Y	Panda Cleaner	pavdr.exe	"Panda internet security software related. Possibly the ActiveScan on-line scanner?"
U	Panda Scheduler	pavsched.exe	"Scheduler for older versions of Panda Antivirus. Required if you have scans scheduled on a regular basis"
X	PandaAVEngine	PandaAVEngine.exe	"Added by the NETSKY.R WORM!"
U	PandaScheduler	pavsched.exe	"Scheduler for older versions of Panda Antivirus. Required if you have scans scheduled on a regular basis"
X	PAV	pav.exe	"Personal Antivirus rogue security software - not recommended. Located in %ProgramFiles%\PAV"
X	PAV.EXE	%Number%	"Added by the KITRO.D (or ARGEN.A) WORM! %Number% can be any number"
Y	PAV.EXE	PAV.EXE	"PER Antivirus"
Y	PAVFIRES	PavFires.exe	"Firewall included with older versions of Panda Antivirus and Internet Security"
Y	PAVFNSVR	PavFnSvr.exe	"Part of Panda Antivirus and Internet Security"
Y	Pavkre9x	pavkre9x.exe	"Part of the 2005 & 2006 versions of Panda Antivirus and Internet Security"
Y	PavProc	PavPrS9x.exe	"Part of Panda Antivirus and Internet Security"
Y	PavProt	PavProt.exe	"Part of the 2004 & 2005 versions of Panda Antivirus and Internet Security"
Y	Pavprot9	Pavprot9.exe	"Part of the 2005 versions of Panda Antivirus and Internet Security"
Y	PC Tools AntiVirus Client	PCTAV.exe	"System Tray access to PC Tools AntiVirus from PC Tools - which ""provides world-leading protection against viruses
Y	PCTAV	PCTAV.exe	"System Tray access to PC Tools AntiVirus from PC Tools - which ""provides world-leading protection against viruses
Y	PCTAVApp	PCTAV.exe	"System Tray access to PC Tools AntiVirus from PC Tools - which ""provides world-leading protection against viruses
N	pdfSaver3	pdfSaver3.exe	"PDF-XChange - create Adobe compatible PDF files from virtually any Windows software such as MS Word
Y	PER Email Protection	pavmail.exe	"PER Antivirus"
X	Perfomance Monitor	davcsync.exe	"Added by the LAMUD-A WORM!"
X	Personal Antivirus	PerAvir.exe	"Personal Antivirus rogue security software - not recommended
X	PersonalAV	pav.exe	"PersonalAV rogue security software - not recommended. Detected as the FAKEAV.FT TROJAN by Trend. Located in %ProgramFiles%\PersonalAV"
X	Playboy	playavi.exe	"Added by the GAMANLOCK TROJAN!"
X	PoliceAV	xppolice.exe	"XP Police Antivirus rogue security software - not recommended
X	PopularScreensaversWallpaper	"rundll32 [path] F3SCRCTR.DLL	LES"
X	Postdavatch	nvdas.exe	"Added by the RANDEX.T WORM!"
X	Protocol Settings	kav.exe	"Added by a variant of the RBOT WORM!"
U	Pwrsave	Pwrsave.exe	Toshiba Power Saver utilities. Required on a laptop if you run of a battery and want to conserve power
X	QQKAV	scvhsot.exe	"Added by the QQROB.ARQ WORM!"
X	QTSvc	navchk.exe	Premium rate adult content dialler
X	RA Server	Slave.exe	Added by the RA TROJAN!
X	Rapdata	ravsecs.exe	"Added by the QQPASS-V TROJAN!"
X	Rapdatybs	ravseteyns.exe	"Added by the PWS-ACP TROJAN!"
X	Raptelnet	ravspeger.exe	"Added by the QQPASS-AA TROJAN!"
X	Raptelt	ravspegtl.exe	"Added by the QQPASS-AB TROJAN!"
Y	RAV8Tray	ravtray8.exe	"RAV anti-virus related"
X	RavAv	RavMonE.exe	"Added by the RJUMPF-F WORM!"
X	RavAv	AdobeR.exe	"Added by the RJUMP.D WORM!"
X	RAVEN_VLZS.EXE	RAVEN_VLZS.EXE	"DownloadReceiver parasite - no longer in existence"
Y	RavMon	RavMon.exe	"RAV AntiVirus"
X	ravshell	expl0rer.exe	"Added by the DLOADER.MAR TROJAN!"
X	Ravshell	explore3.exe	"Added by the PAKES.HZ TROJAN!"
X	Ravshell	IEXPLORER.EXE	"Added by the AGENT.URZ TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Ravshell	rund1132.exe	"Added by the AGENT.OKZ TROJAN!"
X	Ravshell	svch0st.exe	"Added by the NSPM.PU TROJAN! Notice the digit ""0"" in the filename rather than the lower case ""O"""
X	ravshell	1explore.exe	"Added by the DLOADER.MJF TROJAN!"
X	ravshell	iexpl0re.exe	"Added by the NOFERE-A TROJAN! Note the number ""0"" in the filename"
Y	RavStub	ravstub.exe	"Rising antivirus"
X	ravtask	rund1132.exe	"Added by the DLOADER.IYT TROJAN!"
X	ravtask	svch0st.exe	"Added by the LINEAG-AIN TROJAN!"
Y	RavTask	RavTask.exe	"Rising antivirus"
X	ravtask	iexpl0re.exe	"Added by the AGENT.AIR BACKDOOR! Note the number ""0"" in the filename"
X	RavTime	Mstray.exe	"Added by the WUKILL.A WORM!"
Y	RavTimer	RavTimer.exe	"RAV AntiVirus"
X	RavTimer	explores.exe	"Added by the HOMEY-A TROJAN!"
X	RavTimeXP	[worm filename]	"Added by the WULLIK.B WORM!"
X	RavTimeXP	Virus	"Added by the CAGER.A WORM!"
X	RavTimXP	[worm filename]	"Added by the WULLIK.B WORM!"
X	RavUptets	agetlke.exe	"Added by the QQPASS-AK TROJAN!"
X	RavUptkt	agetlktz.exe	"Added by the QQPASS-AJ TROJAN!"
X	RavUptpe	ravsesur.exe	"Added by the QQPASS-T TROJAN!"
?	rav_temp.exe	rav_temp.exe	"??"
X	RBOT v2 with NetAPI exploit traded with billgates I gave my mother Greetz - OG - Bluehell Irc Server	glossary.exe	"Added by the VANEBOT-J WORM!"
X	RealAV.exe	RealAV.exe	"Real Antivirus rogue security suite - not recommended
N	RegShave	regshave.exe	"Part of the USB driver for your Fuji digital cameras - used when uninstalling the USB drivers
X	Remote Access Slave	Synchost.exe	"Added by the RIPJAC TROJAN!"
X	run=	RAVMOND.exe	"Added by the LOVGATE-F WORM!"
X	s9201	av2008xp.exe	"Antivirus 2008 XP rogue security software - not recommended
X	SafePcAv	SafePcAv.exe	"SafePcAv rogue security software - not recommended
X	Saggwwgg	CVAvwwd.exe	"Added by the LIOTEN.HT WORM!"
X	Salestart	mav_startupmon.exe	"Part of the WinAntiVirus Pro 2007 rogue security software - not recommended
Y	SAVAgent	SAVAgent.exe	"Part of Sophos anti-virus software. Required for centrally administered Sophos updates to work correctly
X	Savasddwq	ffasd.exe	"Added by the SDBOT-SI WORM!"
X	Save	Save.exe	"WhenU.Save adware"
X	Save	lssas.exe	"Added by an unidentified TROJAN! See here"
X	SaveArmor	SaveArmor.exe	"SaveArmor rogue security software - not recommended
X	SaveDate	SaveStartDate.Exe	Unidentified adware
X	SaveDefender	SaveDefender.exe	"SaveDefender rogue security software - not recommended
X	SaveDefense	SaveDefense.exe	"SaveDefense rogue security software - not recommended
X	SaveKeep	SaveKeep.exe	"SaveKeep rogue security software - not recommended
X	SaveKeeper	SaveKeeper.exe	"SaveKeeper rogue security software - not recommended
X	Savenow	SaveNow.exe	"WhenU.Save adware"
X	SaveSoldier	SaveSoldier.exe	"SaveSoldier rogue security software - not recommended
X	Savsvc	"rundll32.exe savsvc.dll	start"
N	ScanSoft PaperPort 7 Registration Reminder	NAVBrowser.EXE	"Registration reminder for PaperPort 7 from Scansoft (now Nuance)"
X	SchedulerMgr	navchk.exe	Premium rate adult content dialer
X	Screen Saver	scrnsaver.scr	"Added by the RBOT-AGP WORM!"
N	Screen Saver Control	FSScrCtl.exe	Installs as part of the Hubble Space Telescope screen saver (and possibly others). Lets you control your installed screensavers from a System Tray icon
X	ScreenSaverPlus	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	SDAv	csnss.exe	"Added by the SERFLOG.C WORM!"
X	SDAv	svhost.exe	"Added by the SERFLOG.C WORM!"
X	searchnav	searchnav.exe	SearchNav adware - IEFeatures/Popnav variant
X	SearchNavVersion	searchnavversion.exe	SearchNav adware - IEFeatures/Popnav variant
X	Secure AntiVirus Pro	av.exe	"Secure AntiVirus Pro rogue security software - not recommended
X	SecurePcAv	SecurePcAv.exe	"SecurePcAv rogue security software - not recommended
X	Security Master AV	SM[random characters].exe	"Security Master AV rogue security software - not recommended
X	Service Monitor	javams32.exe	"Added by the DELF-NK TROJAN!"
X	Service Monitor	javams64.exe	"Added by the SDBOT-AFO WORM!"
X	Service Registry NT Save	jdbgmgrnt.exe	"Added by the BANCOS-CG TROJAN!"
X	Service Registry NT Save	taskmgrnt.exe	"Added by the BANCOS-BY TROJAN!"
X	Service Registry NT Save	regeditnt.exe	"Added by the BANCOS-BM TROJAN!"
X	Shockwave	csrss.exe	"Added by the SNDOG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
N	Shockwave Init	SWINIT.EXE	Part of Macromedia Shockwave. Controls the Shockwave Remote Control Panel. The Remote Control can be activated manually from the Start Menu by locating and selecting Shockwave and then Shockwave Remote under Programs
X	Shockwave Support	FlashPlayer.exe	"Added by the DELF-DRA WORM!"
U	SiteAdvisor	SiteAv.exe	"Refer to the SiteAdv.exe entry. This entry only appears to originate from version 2.0.0.75 (Build 4295) of SiteAdvisor and the registry entry incorrectly points to the invalid filename ""SiteAv.exe"" - when it should be ""SiteAdv.exe"""
U	SiteAv	SiteAv.exe	"Refer to the SiteAdv.exe entry. This entry only appears to originate from version 2.0.0.75 (Build 4295) of SiteAdvisor and the registry entry incorrectly points to the invalid filename ""SiteAv.exe"" - when it should be ""SiteAdv.exe"""
X	skynetave.exe	skynetave.exe	"Added by the SASSER.D WORM!"
X	Sndsaver	Sndsaver.exe	"Added by the GEMA TROJAN!"
X	Special Firewall Service	avguard.exe	"Added by the NETSKY.G WORM! Note - do not confuse with AntiVir® antivirus which uses the same filename. This one is located in %Windir%"
X	Sun Java Console for Windows NT & XP	jconsole.exe	"Added by the VANEBOT-C WORM!"
X	Sun Java Updater	stacsv.exe	"Added by the BUZUS.DBFM TROJAN!"
X	Sun Java Updater v5	javajre.exe	"Added by the AUTORUN-XI WORM!"
X	Sun Java Updater v7.4	javawx.exe	"Added by the ACKANTTA.B WORM!"
X	Sunjava	javasmart.exe	"Added by the AGENT.AHV TROJAN!"
X	SunJava Updater v7	javale.exe	"Added by the ACKANTTA.B WORM!"
X	SunJavaSched	ccEvtMngr.exe	"Added by the SDBOT-YP WORM!"
X	SunJavaSched Updater	avamx.exe	"Added by the RBOT-ABJ WORM!"
X	SunJavaUpdate	smvss.exe	"Added by the DEDLER-G TROJAN!"
X	SunJavaUpdater	javaw.exe	"Added by the MYTOB.QR WORM!"
X	SunJavaUpdaterv13	javaupdater.exe	"Added by the ROUTROBOT WORM!"
N	SunJavaUpdateSched	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
X	SunJavaUpdateSched	scvhost.exe	"Added by the SDBOT-AVX WORM!"
X	SunJavaUpdateSched	javamx.exe	"Added by the SDBOT-WI WORM!"
X	SunJavaUpdateSched10	jushed.exe	"Added by the ACKANTTA.F WORM!"
X	SunJavaUpdateSched132	jschd.exe	"Added by the AUTORUN-AQY WORM!"
X	SunJavaUpdateSched16	jvshed.exe	"Added by the ACKANTTA.G WORM!"
X	SunJavaUpdatSched	spoolsv.exe	"Added by the BANCBAN-NP TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %ProgramFiles%\MSN Messenger"
N	Swap Nut	javaw.exe	"javaw.exe can be loaded by other programs at startup but in this instance it's SwapNut
X	Swf32	AVupdate.exe	"Added by the MERKUR.E WORM!"
X	Symantec Security Routine Addon	navpaw.exe	"Added by the AGOBOT-ES BACKDOOR!"
X	Symantec Security Routine Addon for Microsoft Windows	navpxaw32.exe	"Added by the AGOBOT-GJ TROJAN!"
X	SymAV	SymAV.exe	"Added by the NETSKY.U WORM!"
X	SysAntivirus 2009	sysav.exe	"SysAntivirus 2009 rogue security software - not recommended
X	sysav	winav.exe	"WinPC Antivirus rogue security software - not recommended
X	System Information Manager	Navcpe.exe	"Added by the SDBOT-QB WORM!"
X	SystemService	navchk.exe	Premium rate adult content dialler
X	tava	tavo.exe	"Added by the CRPYT.DE TROJAN!"
X	Tiny AV	fooding.exe	"Added by the NETSKY.I WORM!"
?	TlcR	avp.exe	"??"
X	topmoxie	JavaRun.exe	"TopMoxie adware"
X	TRE AntiVirus	treav.exe	"TRE AntiVirus rogue security software - not recommended
Y	Trend Micro AntiVirus 2007	tavui.exe	"Part of Trend Micro AntiVirus 2007"
X	Trend Micro AV	trendav.exe	"Added by the AGOBOT-OH WORM! Note - this is not a valid Trend Micro antivirus entry"
Y	TrendMicro Antivirus	Aveagent.exe	Virus scanner
X	Ultimate System Guard	MainFAVProj.exe	"Ultimate System Guard rogue security software - not recommended
X	Update.exe	ravseuper.exe	"Added by the QQPASS-P TROJAN!"
X	updatelavasoft	updatelavasoft.exe	"CoolWebSearch parasite variant - redirecting to lalasearch.com"
X	UsB driver	msjavx86.exe	"Added by the AGOBOT-PQ WORM!"
X	Video Process	Avg123.exe	"Added by the AGOBOT-MS WORM!"
X	Video Process	Navapsvcc.exe	"Added by the SPYBOT-CW WORM!"
X	VirusCheckII	AVIRCHK.EXE	"Added by the DASMIN TROJAN!"
U	VoiceCenter	AndreaVC.exe	"Related to Andrea's Superbeam microphone utility"
U	VZRemoteCommander	AvRmtCtr.exe	Related to Sony's VAIO Zone Remote Commander
Y	WaveFramer	WaveFramer.exe	"Part of SafeSpace (from Artificial Dynamics) which ""protects computers from Internet malware infection without the need for signature updates or regular maintenance"""
N	WaveTop Launcher	WaveTop.exe	"WaveTop - ""Get push content from TV without an Internet connection"" - now possibly a defunct system in the US included as an optional part of WebTV in Win98"
N	WaveTop Receiver 1	N/A	"WaveTop - ""Get push content from TV without an Internet connection"" - now possibly a defunct system in the US included as an optional part of WebTV in Win98"
N	WaveTop Receiver 2	N/A	"WaveTop - ""Get push content from TV without an Internet connection"" - now possibly a defunct system in the US included as an optional part of WebTV in Win98"
N	WaveTop Upload Manager	N/A	"WaveTop - ""Get push content from TV without an Internet connection"" - now possibly a defunct system in the US included as an optional part of WebTV in Win98"
Y	WavXMgr	WavXDocMgr.exe	"Part of Wave Systems Corp. Embassy Trust Suite. ""Document Manager uses the hardware security provided by the TPM to provide strong protection for data. Files encrypted by Document Manager cannot be located or viewed by others"""
X	Webdav.exe	webdav.exe	IRC DDoS bot which gives the hacker full control over your system
U	websaverlive	websaverlive.exe	"WebSaver Live! is a companion program to Websaver that retrieves information from the Internet on a schedule and displays it on your screen when your computer is idle"
X	WebSavingsfromEbates	WebSavingsfromEbatesrun.exe	"Web Savings From Ebates Software
X	WebSavingsFromEbates0	WebSavingsFromEbates0.exe	"Web Savings From Ebates Software
U	webscan	stopsignav.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
X	WhenUSave	Save.exe	"WhenU.Save adware"
X	Win Antispyware Center	av.exe	"Win Antispyware Center rogue security software - not recommended
X	Win32 Usb Driver	AvpG.exe	"Added by the FORBOT-BX WORM!"
X	WIn32S Java DLL	kavsvx.exe	"Added by the AGOBOT-RZ WORM!"
X	WinAntivirus	AVSVC.EXE	"Part of the WinAntiVirus Pro 2005 rogue security software when installed in Win98/Me - not recommended
X	WinAntiVirus Pro 2007	WinAv.exe	"WinAntiVirus Pro 2007 rogue security software - not recommended
X	WinAntiVirusPro2006	WinAV.exe	"WinAntiVirus Pro 2006 rogue security software - not recommended
X	WinAvX	WinAvX.exe	"Added by the VIRANTIX TROJAN!"
X	WinAvX	WinAvXX.exe	"Malware installed by different rogue security software including SpyKillerPro. Also detected as the SPYWAD-AR TROJAN!"
X	Windows Anti Virus Control Center	avrscan.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Anti Virus Control Center	winavscan.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Console Monitor	gcasAV32.exe	"Added by the KEDEBE-A WORM!"
X	Windows Java Update	weatherBug32.exe	"Added by a variant of the RBOT WORM!"
X	Windows JavaScript Daemon	Winjsd.exe	"Added by the WOOTBOT.AF WORM!"
X	Windows Print Spooler	NavAgent32.exe	"Added by an unidentified VIRUS
X	Windows Recavery Adware	lsass.exe	"Added by an unidentified TROJAN - see here. Note - this is not the legitimate lsass.exe process
X	Windows Screensaver	Service.exe	"Added by the KELVIR.P WORM!"
X	WINDOWS SCREENSAVER	ssaver.scr	"Added by the SDBOT-YZ WORM!"
X	Windows Service Ajav	java128.exe	"Added by the RBOT.BNG WORM!"
X	Windows Services	avsrv32.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows svchost	avserv.exe	"Added by the PUSHBOT.FM WORM!"
X	Windows Update	avkir.exe	"Added by the RBOT-GJP WORM!"
X	Windows Update Draven	draven.exe	"Added by a variant of the SDBOT WORM!"
X	WinFavorites	WinFavorites.exe1	Loudmarketing.com adware downloader
X	Winjava xml	dirx9.exe	"Added by the HAXDOOR ROOTKIT!"
X	WinSecureAv	pgs.exe	"WinSecureAv rogue security software - not recommended
X	Wlan Driver	avscan.exe	"Added by the WOOTBOT.DH WORM!"
?	XeroxEndeavorBackgroundTask	xGKOHbgnd.exe	"Associated with a Xerox multifunction and/or scanner. What does it do and is it required?"
X	ynavmrcd.exe	ynavmrcd.exe	"Added by the DLOADR-AVC TROJAN!"
U	You've Got Pictures Screensaver	ygpsstra.exe	AOL You've Got Pictures Screensaver
X	Zonavirus	0	"Added by the KITRO.D (or ARGEN.A) WORM!"
X	[12 random characters]	avifile5.exe	"IeDriver adware variant"
X	[32 random numbers]	av2009.exe	"AntiVirus 2009 rogue security software - not recommended
X	[32 random numbers]	av360.exe	"Antivirus 360 rogue security software - not recommended
X	[32 random numbers]	AVS.exe	"Antivirus Sentry rogue security software - not recommended
X	[random]	[random]sftav.exe	"Antivirus Soft rogue security software - not recommended
X	[various names]	avpmondll.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	clamav.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	SYSTRAV.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	{2C70168B-97CE-4f31-B85D-1FEC5002721D}	sysavxjgdu.exe	"Added by the FAKEALERT-AM TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.