NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

• "Y" - Normally leave to run at start-up
• "N" - Not required - typically infrequently used tasks that can be started manually if necessary
• "U" - User's choice - depends whether a user deems it necessary
• "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
• "?" - Unknown

Fatal error: Maximum execution time of 30 seconds exceeded in /home/iamnotag/domains/iamnotageek.com/public_html/startup/search.php on line 252

	Startup Name	Process Name	Details
X		svchost.exe	"Added by the DELF-UX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%. Note - has a blank entry under the Startup Item/Name field"
	Note the filename has a ""0"" rather than an upper case ""o"""
Y	!1_pgaccount	pgaccount.exe	"DiamondCS ProcessGuard security software - stops malicious worms and trojans from being executed silently in the background
Y	!1_ProcessGuard_Startup	procguard.exe	"DiamondCS ProcessGuard security software - stops malicious worms and trojans from being executed silently in the background
N	!NoLoad	winrecon.exe	"WinRecon keystroke logger/monitoring program - remove unless you installed it yourself!"
Consume	"Consumer Input Rewarded with MyPoints	U	"ConsumerInputRewardedwithMyPoints
Consume	"Consumer Input Rewarded with MyPoints	U	"ConsumerInputRewardedwithMyPoints
Inc."	"Machine Works	X	aecces.exe
Inc."	"Microsoft Associates	X	iexplorer.exe
Inc."	"Microsoft NetMeeting Associates	X	NetMeeting.exe
Version	"NVIDIA Compatible Windows Vista Display driver	U	"RUNDLL32.EXE NvCpl.dll
Version	"NVIDIA Compatible Windows7 Display driver	U	"RUNDLL32.EXE NvCpl.dll
Version	"NVIDIA Driver Helper Service	U	"RUNDLL32.EXE nvsvc.dll
Version	"NVIDIA nView Control Panel	N	nwiz.exe
Mass"	"Telechips	U	patch.exe
Y	#NAME?	ZkRunOnceR.exe	Internet Security Suite used by ISPs to protect customers against many attacks
X	$sys$cmp	$sys$xp.exe	"Added by the RYKNOS.B TROJAN! Attempts to utilize the Sony Rootkit A.K.A. SecurityRisk.First4DRM security risk to hide itself on the compromised computer"
X	$sys$crash	$sys$sonyTimer.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$crash	$sys$sos$sys$.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$crash	$sys$WeLoveMcCOL.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$momomomochin	$sys$sonyTimer.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$momomomochin	$sys$sos$sys$.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$momomomochin	$sys$WeLoveMcCOL.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$umaiyo	$sys$WeLoveMcCOL.exe	"Added by the WELOMOCH TROJAN!"
?	%cmpmixtitle%	%cmpmixstr%	"Possibly related to C-Media Mixer Control panel?"
X	(*)API Machine	winSOCKS.exe	"Homepage hijacker
X	(Default)	Mcafee.exe	"Added by the AGENT.AY TROJAN! Note - this is not a valid McAfee program and is located in %System%. This malware actually changes the value data of the ""(Default)"" key in HKCU\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	msarti.com	"Added by the SILLYFDC.CJ WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\..\Policies\Explorer\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	*Intelli Mouse Pro Version 2.0B*	ncsjapi32.exe	"Added by the BUZUS-O WORM!"
X	*JanisRuckenbrodII	janis.com	"Added by the POPS WORM!"
X	*Microsoft Update	ctxma.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	cxma.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wstcl.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wucxt.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wuytc.exe	"Added by the STMU TROJAN!"
X	*MSConfig32	aecache.exe	"Detected by F-Secure as the OBFUSCATED.GP TROJAN!"
X	*Security Center	secctr.exe	"Added by the SDBOT.BRO WORM!"
X	*windows update	wrauclt.exe	"Added by the RBOT-QU WORM!"
X	*windows update	wuanclt.exe	"Added by the RBOT-PG WORM!"
X	*windows update	wuaucrlt.exe	"Added by the SPYBOT.HUR WORM!"
X	*windows update	wuraclt.exe	"Added by the RBOT-PO WORM!"
X	*windows update	wurauclt.exe	"Added by the RBOT-SY WORM!"
X	*windows update	wsctl.exe	"Added by the SPYBOT.PR WORM!"
X	*windows update	wscxt.exe	"Added by the RBOT.AOS WORM!"
X	*windows update	waurclt.exe	"Added by a variant of the RBOT WORM!"
X	*windows update	wuaruclt.exe	"Added by the RBOT-TF WORM!"
X	*Windows [filename] Checker	[filename]	"Added by the KEDEBE-B WORM!"
X	*wuauclt.exe	w****.exe [* = random char]	"Added by a variant of the RBOT-UG WORM! Note - * in the filename represents a random char; variants spotted: wxmct.exe
X	..	ABC2007.exe	"Added by the DLOADR-ASH TROJAN!"
X	.mscdr	lassa.exe	"Added by the WEBUS.C TROJAN!"
X	.mscdr	lsvchost.exe	"Added by the WEBUS.D TROJAN!"
X	.mscdsr	lsvchost.exe	"Added by the BDOOR-CR BACKDOOR!"
X	.mscsbl	svhost.exe	"Added by the CMQ TROJAN!"
X	.mssecure	mssecure.exe	"Added by the DDOS_BOXED.X TROJAN!"
?	.NET config	sysmon32.exe	"??"
X	.norton	rchost.exe	"Added by the BOXED-H TROJAN!"
X	.nvsvc	smss.exe	"Added by the IRCBOT-FP TROJAN! Note - this is not the legitimate smss.exe process which should not normally figure in Msconfig/Startup!"
X	.nvsvcb	smssb.exe	"Added by the BOXED.CG TROJAN!"
X	.Prog	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
X	.protected	N/A	"Smitfraud variant"
X	.svchost	CSRSS.EXE	"Added by the WEBUS.F TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	.TEXTCONV	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	.TEXTCONV	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	.WMAudio	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
Y	00PCTFW	FirewallGUI.exe	"System Tray access to PC Tools Firewall Plus from PC Tools - which ""is a powerful personal firewall for Windows that protects your computer from intruders and controls the network traffic in and out of your PC"""
?	00saskda	newlock.exe saskda	"Part of Access Manager
Y	00TCrdMain	TCrdMain.exe	Related to the flash card slot on a Toshiba laptop. Ending this process will disable access to the flash cards
X	0mcamcap	0mcamcap.exe	"Added by the COSIAM-H TROJAN!"
X	0utlook Express	*****.exe [* = random char]	"Added by the RBOT-CC WORM! Note the first letter is actually the digit ""0"" and not a capital ""o"""
X	1	lsass.scr	"Added by the BANCOS.V TROJAN!"
X	1	svchost.scr	"Added by the BANCOS.X TROJAN!"
X	1	mrcmgr.exe	"Added by the BANKER.RQK TROJAN!"
U	101Clips	101Clips.exe	"101Clips - ""the simplest of all multi-clipboard programs. Just have it running minimized and it captures everything you cut or copy from other programs. It keeps the last 25"""
X	1029BB4B-16A9-4E77-AA3D-96930BD68EEC	sysockeu.exe	"Added by the FAKEALERT-AH TROJAN!"
X	1234klsjdc uiar924c af	sxgnsvuxct.exe	"Added by the FAKEALERT-AM TROJAN!"
X	1234klsjdc uiar924c af	sysvtypkbjx.exe	"Added by the FAKEALERT-AM TROJAN!"
U	12Ghosts Backup	12backup.exe	"12Ghosts Backup - ""Automatic Backups
U	12Ghosts Clip	12clip.exe	"12Ghosts Clip - ""Screen shots made easy"""
U	12Ghosts SetColor	12color.exe	"12Ghosts SetColor - ""Change your desktop icon text colors
U	12Ghosts Synchronize	12sync.exe	"12Ghosts Synchronize - ""Sync PC clock with an atomic clock over the Internet"""
U	12Ghosts TrayProtect	12srvc.exe	"12Ghosts TrayProtect - ""Hide tray icons
U	1455 Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX1455 multifunction printer
X	180ClientStubInstall	stubinstaller****.exe [* = digit]	"180Solutions adware related"
X	180ClientStubInstall	[path to trojan]	"180Solutions adware related"
X	180ClientStubInstall	******.tmp [* = random digit/char]	"180Solutions adware related"
U	1A:MacVisionTrayMonitor	TrayMonitor.exe	"Part of MacVision by Jeff Bargmann - an discontinued program that makes your PC's desktop look and feel incredibly like that of a Macintosh OS8 computer. Handler that puts the icons that are in your system tray into the MacVision taskbar
Y	1A:Stardock MCP	mcpserver.exe	"Master Control Program for Stardock apps
Y	1A:Stardock TrayMonitor	TrayServer.exe	For monitoring tray icons - if disabled icons will not be displayed in ObjectBar or DesktopX
U	1cla	1cla.exe	"1 Click & Lock from Softstack.com - ""a system tray security utility you can use to secure your desktop when you step away from your PC. It's secure and very easy-to-use. Just define a password
U	1cla.exe	1cla.exe	"1 Click & Lock from Softstack.com - ""a system tray security utility you can use to secure your desktop when you step away from your PC. It's secure and very easy-to-use. Just define a password
?	1CmailS	NETMAIL.EXE	"??"
U	1Win32Cfg	SpyBuddy.exe	"SpyBuddy from ExploreAnywhere
U	1Win32Cfg	Keyloggerpro.exe	"Keyloggerpro keystroke logger/monitoring program - remove unless you installed it yourself!"
X	1WinCfg32	WebMailSpy.exe	"WebMailSpy spyware"
X	2177F056-0AA6-4D6C-A944-13F71F341C29	sysokuaw.exe	"Added by the FAKEALERT-AH TROJAN!"
U	2335dn Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Dell 2335 multifunction laser printer
U	24Online Client	CyberoamClient.exe	"Related to Cyberroam from Elitecore Technologies Ltd"
X	27	csrss32.exe	"Added by the SLSORVE-D TROJAN!"
X	2k6 updatz	crss3.exe	"Added by the RBOT-CPD WORM!"
X	2Search	main.exe	"2Search adware"
X	2thousandbuck	[path to file]	"Added by the RANKY.L TROJAN!"
X	3.8853E+11	AutomaticUpdates.exe	"Added by the SDBOT-DEN WORM!"
U	3170 Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung CLX3170 multifunction laser printer
X	32-bit Thunking service	thunk32.exe	"Added by the DERDERO.A WORM!"
X	32.exe	nvscv32.exe	"Added by the AGENT-LOL TROJAN!"
X	333	svchost.exe	"Added by the JD-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Syswm1i"" directory"
Y	36X Raid Configurer	JMRaidSetup.exe	"JMB36x series RAID configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers"
Y	3c1807pd	3cmlink.exe 3cpipe-3c1807pd	"3Com WinModem driver. See here for more WinModem information"
Y	3capplnk	3capplnk.exe	US Robotics Modem driver
N	3cdminic	3CDMINIC.EXE	3Com DMI (DynamicAccess Desktop Management Interface) Agent associated with 3Com network cards
Y	3CM Link	3cmcnkw.exe	Required for a US Robotics WinModem as it provides the link to Windows - won't work without it
Y	3Cmlink	3CmlinkW.exe	"For a US Robotics WinModem. Provides the link to Windows as the CPU does the processing on WinModems - won't work without it. See here for more WinModem information"
?	3Com Launcher	Launcher.exe	"Related to networking products from 3Com Corporation. What does it do and is it required?"
N	3ComDMIAgent	3CDMINIC.EXE	3Com DMI (DynamicAccess Desktop Management Interface) Agent associated with 3Com network cards
Y	3cpipe-USRpdA	USRmlnkA.exe	Modem driver files from US Robotics
X	3D Text	3D Text.scr	"Added by the JERMY.A WORM!"
U	3Deep Control Panel	3DeepCTL.EXE	"3Deep® from E-Color corrects lighting
X	3Dfx Acc	GFXACC.EXE	"Added by the GIBE WORM!"
Y	3dfx Tools	3dfxCmn.dll	Updates the registry with information that can't be held for Voodoo 3/4/5 series graphics cards. Important for owners of these cards
X	3P_UDEC_IA	IAInstall.exe	"Installer for the Internet Antivirus and Internet Antivirus Pro rogue security software - not recommended
U	3qdctl.exe	3qdctl.exe	"Provided with Terratec 128i PCI and similar sound cards. Loads a sound profile at bootup
U	4x26 Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX4x26 multifunction laser printers
U	4x28 Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX4x28 multifunction laser printers
X	55278	grepclient1.exe	"Added by the LINEAGE-S TROJAN!"
U	6200 Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung CLX6200 multifunction laser printer
X	756349DC-6D9E-4F2A-9B24-269661F073C3	sysoghcx.exe	"Added by the FAKEALERT-AH TROJAN!"
X	7X29C2X78Y	syss_.exe	"Added by the AGENT-GMS TROJAN!"
X	852EBF20-A95D-4F1F-B9C2-B2CD24350F3E	sysodkcs.exe	"Added by the FAKEALERT-AH TROJAN!"
X	98D0CE0C16B1	"rundll32.exe D0CE0C16B1	D0CE0C16B1"
X	9xHtProtect	AVprotect9x.exe	"Added by the NETSKY.M WORM!"
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Lock (and maybe others) -.html" title="Access Lock (and maybe others) -">Access Lock (and maybe others) -
	Access Lock (and maybe others) -.html" title="Access Lock (and maybe others) -">Access Lock (and maybe others) -
X	?ekio Startups	?nksvc32.exe	"Added by the AGOBOT-OV WORM where ? is a random character"
X	@	wincms.exe	"Added by the RBOT.CBR WORM!"
N	@Hoc Toolbar	AtHoc.exe	"One-click activated browsing toolbar used by various web-sites. See here for more info"
Y	a-winpoet-service	winpppoverethernet.exe	"WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion
U	A1000 Settings Utility	cpqa1000.exe	"Compaq A1000 Print Fax All-in-One copy scan printer software. Required in the Startup in order to scan
?	a2dservice	a2dservice.exe	"Related to the Air2Data Wireless HISA (High-Speed Internet Access) service. What does it do and is it required?"
X	A70F6A1D-0195-42a2-934C-D8AC0F7C08EB	"rundll32.exe E6F1873B.DLL	D9EBC318C"
X	aa bbcc dde effgghh jj	update.exe	"Added by a variant of the IRCBOT BACKDOOR!"
?	AAACLEAN	AAACLEAN.INF	"??"
X	aacmeyf	aacmeyf.exe	"Added by the AF.20 TROJAN!"
U	aaLDISCN32	LDISCN32.EXE	"LANDesk® Management Suite software component"
U	aaLDTaskCompletion	amclient.EXE	"LANDesk® Management Suite software component"
X	AAMSFree702	Avengine.com	"Added by the DELF.LJ TROJAN!"
X	aaprotect	[path to trojan]	"Added by the BANCBAN-MJ TROJAN!"
?	aauclient	ACNUpdater.exe	"Appears to be related to software from Accenture.com"
?	ab EazyScheduler	ezsched.exe	"??"
N	ABBYY Community Agent	CAGENT.EXE	Installed with the Optical Character Recognition (OCR) software that comes bundled with a Compaq A3000 all-in-one printer/scanner. Its function appears to be to link you to the internet in an attempt to buy the 5.0 version of the software
U	ABC	keylogger.exe	Keystroke logger/monitoring program - remove unless you installed it yourself!
X	abcdefgh	abcdefgh.exe	"EPJ TROJAN!"
U	AbsoluteShield Internet Eraser	cseraser.exe	"AbsoluteShield Internet Eraser - ""protects your privacy by cleaning up all the tracks of your Internet and computer activities"""
X	abtu	mp3serch.exe	"Loads the executable for Lop.com - final version"
X	abtu	lopsearch.exe	"Loads the executable for Lop.com - beta version"
X	Ac97Sound	snddrv.exe	"Added by the VB.AXG TROJAN!"
U	aca	aca.exe	"Access Controller - ""a desktop locking security utility you can use to protect your desktop when you are not near your PC. To activate protection
U	aca.exe	aca.exe	"Access Controller - ""a desktop locking security utility you can use to protect your desktop when you are not near your PC. To activate protection
U	AcBtnMgr_X63	AcBtnMgr_X63.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X63 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	AcBtnMgr_X63.exe	AcBtnMgr_X63.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X63 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	AcBtnMgr_X73	AcBtnMgr_X73.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X73 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	AcBtnMgr_X83	AcBtnMgr_X83.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X83 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	AcBtnMgr_X84-X85	AcBtnMgr_X84-X85.exe	"""Lexmark Scan & Copy Control Program"" for the Lexmark X84-X85 all-in-one multifunction printer/copier/scanner. Button manager for features such as scan
U	acc	acc.exe	"Advanced Call Center - ""full-featured yet easy-to-use answering machine software for your voice modem"""
X	ACCDEFRAGINFO	[path to worm]	"Added by the DARBY-O WORM!"
U	Accelerate	accelerate.exe	Webroot Accelerate - allows you to optimize Windows network registry settings in order to boost surfing speeds. Leave this enabled if you find it improves your connection
Y	AccelerometerSt	AccelerometerSt.exe	HP 3D DriveGuard uses a digital accelerometer protects your disk drive by parking and halting I/O requests if you drop your PC or if you move your PC with the display lid closed
Y	AccelerometerSysTrayApplet	AccelerometerSt.exe	HP 3D DriveGuard uses a digital accelerometer protects your disk drive by parking and halting I/O requests if you drop your PC or if you move your PC with the display lid closed
U	Access Connections	ACTray.exe	"System Tray access to the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
X	Access Control App	winsto.exe	"Added by the AGENT.DGO TROJAN!"
N	Access IBM Message Center	ibmmessages.exe	"""The Access IBM Message Center displays messages to inform you about helpful software that may be pre-installed on your PC. The Message Center can also provide messages about new updates available from the IBM Support Center to keep your computer current"""
N	Access Ramp Monitor	armon32.exe	"Monitors your progress on the internet; hang-ups
X	Access WebControl	[path to file]	"Added by the PPDOOR-M TROJAN!"
U	AccessManager	AccessMgr.exe	"Part of SmartPipes SecureSite software. ""SecureSite enables rapid turnup and enhanced administration of VPNs. It automates and simplifies tasks for VPN design and policy management
X	AccessMedia P2P Loader	amp2pl.exe	"My AccessMedia toolbar related
U	AccessoriesPlus	clockplus.exe	"Clock Plus
N	AccessRamp Monitor01	ARMon32a.exe	"From a visitor ""Just wanted to provide you with some info on Access Ramp software installed with Verizon DSL accounts in those areas that use the Winpoet PPPoE software. The Access Ramp TSRs are installed as part of IP Insight software (can't remember the software maker). You can decline to install IP Insight during Winpoet setup
N	AccessRampLAN01	ARUpld32.exe	"Version of the AccessRamp Monitor01 entry for LAN connections - a history uploader. The key in turning it off is a file named ARUCfg32.exe. This file (ARUCfg32.exe) does not show up in the startup process. If you have this file
Y	accrdsub	accrdsub.exe	"ActivIdentity ActivClient - security software from ActivIdentity Corporation which ""enables organizations to secure workstations with smart cards and smart USB tokens while enforcing strong authentication for desktop access and network login"""
U	AcctMgr	AcctMgr.exe	"Norton™ Password Manager - part of Norton SystemWorks 2004 - stores passwords and other personal information
N	AccuWeather.com® Desktop	AccuWeatherDesktop.exe	"Desktop weather from AccuWeather"
N	AccuWeatherDesktopAlerts	AccuWeatherDesktopAlerts.exe	"Weather alerts for AccuWeather.com Desktop which ""provides you with the most accurate
X	accwizz.exe	accwizz.exe	"Added by the RULAND.A WORM!"
X	accwizzz.exe	accwizzz.exe	"Added by the RULAND.A WORM!"
N	ACDaemon	ACDaemon.exe	"Used to serve notice of product information and updates when running ArcSoft products such as TotalMedia
X	acdllib3	bcdlmem.exe	"Added by the MAILBOT-BA TROJAN!"
N	ACDSee	ACDSee8Pro.exe	"ACDSee 8 photo software. Organize
?	Ace bows	Ace bows.exe	"??"
N	AceGain LiveUpdate	LiveUpdate.exe	"""AceGain LiveUpdate can help to automate and optimize product updates. AceGain LiveUpdate will automatically detect new patch updates
U	Acer Assist Launcher	launcher.exe	"Acer Assist - program that provides information about new updates or notices from Acer"
U	Acer eAP Launch Tool	EAPLAU~1.EXE	"Empowering Technology Launcher
?	Acer Empowering Technology Monitor	SysMonitor.exe	"Part of Acer Empowering Technology. What does it do and is it required?"
U	Acer ePower Management	Acer ePower Management.exe	"Part of Acer Empowering Technology. ""Acer ePower Management is a straightforward interface that allows users to select from pre-configured power usage profiles
U	Acer ePower Management	ePowerTray.exe	"Acer® PowerSmart Manager power management utility included on some models in the Aspire range of notebooks. Also appears as the Packard Bell PowerSave power management utility included on some of their notebook models - as Packard Bell is now owned by Acer"
U	Acer ePower Management	ePowerTrayLauncher.exe	Launcher for the Acer® PowerSmart Manager power management utility included on some models in the Aspire range of notebooks
U	Acer ePresentation HPD	ePresentation.exe	"Part of Acer Empowering Technology. Allows you to manage both internal and external displays"
Y	Acer Launch Tool	Alaunch	"Part of Acer eRecovery - ""a powerful utility that does away with the need for recovery disks provided by the manufacturer
N	Acer Product Registration	ACE1.exe	Acer Product Registration - remove when registration is completed
N	Acer Tour Reminder	Reminder.exe	Popup reminder to take the tour of your new Acer laptop
U	AcerGoto	AcerGoto.exe	"Acer Computer ""Goto Drive"" Cold Swap Driver - a swappable second disk drive provides convenient backup of large files
U	AcerNotebookManager	almxptray.exe	System Tray access on some Acer Notebooks to give faster access to system settings
U	AcerPowerkey	Powerkey.exe	PowerKey utility for Acer TravelMate notebook PCs. Allows the user to quickly switch between different power schemes by pressing Fn+F3
X	Acess2007a	access2007a.exe	"Added by the GAOBOT.PQA WORM!"
X	Aceu	[random filename]	"PurityScan adware"
Y	acEventServ	acevtsrv.exe	"ActivCard Gold from ActivIdentity
U	AClntUsr	AClntUsr.exe	"Altiris AClient Service Windows Tray Icon"
N	Acme.PCHButton	pchbutton.exe	Used by HP Instant Support
Y	ACMON	ACMON.exe	"ASUS Splendid ""is a breathtaking innovation that brings the video viewing experience on PC to the next level. Built into the driver of ASUS graphics cards
U	ACMonitor_X63	ACMonitor_X63.exe	"Button monitor for the Lexmark X63 all-in-one multifunction printer/copier/scanner. Works in conjunction with the ""Lexmark Scan & Copy Control Program"" button manager whose filename is ""AcBtnMgr_X63.exe"""
U	ACMonitor_X63.exe	ACMonitor_X63.exe	"Button monitor for the Lexmark X63 all-in-one multifunction printer/copier/scanner. Works in conjunction with the ""Lexmark Scan & Copy Control Program"" button manager whose filename is ""AcBtnMgr_X63.exe"""
U	ACMonitor_X73	ACMonitor_X73.exe	"Button monitor for the Lexmark X73 all-in-one multifunction printer/copier/scanner. Works in conjunction with the ""Lexmark Scan & Copy Control Program"" button manager whose filename is ""AcBtnMgr_X73.exe"""
U	ACMonitor_X83	ACMonitor_X83.exe	"Button monitor for the Lexmark X83 all-in-one multifunction printer/copier/scanner. Works in conjunction with the ""Lexmark Scan & Copy Control Program"" button manager whose filename is ""AcBtnMgr_X83.exe"""
U	ACMonitor_X84-X85	ACMonitor_X84-X85.exe	"Button monitor for the Lexmark X84-X85 all-in-one multifunction printer/copier/scanner. Works in conjunction with the ""Lexmark Scan & Copy Control Program"" button manager whose filename is ""AcBtnMgr_X84-X85.exe"""
X	acocash	fastdown.exe	Adult content dialler
X	acocash	FASTFOWN.EXE	Adult content dialler
U	Acombo3dmouse	Acombo3d.exe	Mouse driver - required if you use non-standard Windows driver features
X	Aconti	aconti.exe	Adult content dialler
U	acoustic	acoustic.exe	"Control panel program for Philips Acoustic Edge soundcard. Not required unless changed settings aren't retained"
N	acpart	agpart11.exe	Program for finding trucks on-line
X	Acrobat	acrmon32.exe	"Added by the SMALL-ECT TROJAN!"
U	Acrobat Assistant	AcroTray.exe	"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
U	Acrobat Assistant 7.0	Acrotray.exe	"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
U	Acrobat Assistant 8.0	Acrotray.exe	"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
X	Acrobat Read	acroup32.exe	"Added by the VANBOT-BQ TROJAN!"
N	Acrobat Speed Launch	acrobat_sl.exe	"Speeds up the time it takes to load Adobe's Acrobat PDF creation and management tool. From version 7.0 onwards"
U	ACROMOUSE	ACROMAPP.exe	"Related to ACROMOUSE Laser mouse control"
U	Acronis Popup Blocker	"RunDll32.exe [path] Blocker.dll	Run"
U	Acronis Scheduler Helper	schedhlp.exe	"Part of Acronis True Image backup software. Co-operates with the ""schedul2.exe"" service to perform backup/restore tasks correctly. Required if you want to use True Image to do some real backup/restore tasks - not if you only want to explore/mount images"
U	Acronis Scheduler2 Service	schedhlp.exe	"Part of Acronis True Image - backup software. Co-operates with the ""schedul2.exe"" service to perform backup/restore tasks correctly. Required if you want to use True Image to do some real backup/restore tasks - not if you only want to explore/mount images"
U	Acronis True Image	TimounterMonitor.exe	"Part of Acronis True Image backup software. Monitor for the backup archive explorer for moving and viewing files within an archive"
N	Acronis True Image Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
N	Acronis TrueImage Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
N	Acronis*True*Image Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
U	AcronisTimounterMonitor	TimounterMonitor.exe	"Part of Acronis True Image backup software. Monitor for the backup archive explorer for moving and viewing files within an archive"
N	AcronisTrueImage Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
X	Acroread	AcroRD32.exe	"Added by the DLOADR-BDK TROJAN! Note - this is not the popular Adobe Reader"
X	Acroread	GoogleUpdate.exe	"Added by the AGENT-JGI TROJAN! Note - this is not the valid Google program which is normally located in %AppData%\Google\Update. This version resides in %Temp%"
U	Act! Preloader	Act8.exe	"Sage Software's ACT! ""enables individuals and small business customers to instantly access key contact and customer information
N	Action Manager 32	am32.exe	Associated with a Plustech scanner. Small utility that runs in the background for doing fax/copy/etc. Available via Start -> Programs
?	ActionAgent	actionagent.exe	"""A COM server that runs on the client as part of the Dell OpenManage Client Instrumentation 6.x package; provides a simple method for a remote administrator to perform actions on the instrumented client"". Is it required?"
N	Activation	Activation.exe	Part of Microsoft Money
U	Activboard	MMKeybd.exe	"Packard Bell ActiveBoard keyboard - multimedia keyboard manager. Required if you use the additional keys and want to see the status of the Num Lock
U	ACTIVBOARD	ABoard.exe	"Packard Bell ActiveBoard keyboard - multimedia keyboard manager. Required if you use the additional keys and want to see the status of the Num Lock
X	Active Bit Station	abs.exe	"Added by the MYTOB.BZ WORM!"
N	Active CPU	acpu.exe	"Active CPU - ""easy to use tool for Windows 95/98/ME/NT/2000 that enables you to watch a graphical representation of your CPU's activity"""
U	Active Desktop Calendar	ADC.EXE	"XemiComputers Active Desktop Calendar"
U	Active Email Monitor	aem25.exe	"Active Email Monitor checks multiple accounts for email
X	Active Security	asecurity.exe	"Active Security rogue security software - not recommended
U	Active shield	Activeshield.exe	"Active Shield is ""an heuristic screen that actively protects your computer from trojans
X	ActiveDesktop	systray32.exe	"Added by the DABOOM WORM!"
X	ACTIVEDS	ACTIVEDS.EXE	"Added by the OPASERV.T WORM!"
N	ActiveEyes	ActiveEyes.exe	"ActiveEyes from TFI Technology is a small utility that you can use to liven up your desktop. It follows your mouse around and can tell you how far your cursor has travelled or point out where the cursor is. It's small
U	ActiveKeys.AAB635BD7D054a37A576	akeys.exe	"""Active Keys is a powerful yet easy-to-use tool for creating and managing keyboard shortcuts for any system action"""
U	ActiveMenu	ActiveMenu.exe	Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
U	ActivePlus	activeplus.exe	"Interactive Agents Plugin for Messenger Plus! (MSN Messenger add-on)"
X	ActiveScan Antivirus	ActiveScan.exe	"Added by the RBOT-FKQ WORM!"
X	ActiveScript32	nod.exe	"Added by the SOHANA-AJ WORM!"
Y	ActiveShield	mcvsshld.exe	"ActiveShield - background scanner for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online which scans files in the background as and when they are accessed
N	ActiveSpeed	AS.exe	"Ascentive ActiveSpeed internet optimizer - not recommended
X	ActiveSync	wcescom32.exe	"Added by the MANCSYN-E TROJAN!"
N	ActiveWords	AWMonitor.exe	"ActiveWords from ActiveWord Systems
X	ActiveX File Registration Service	filereg.exe	"Added by the RBOT-DVD WORM!"
X	ActiveX Streamer	msgfix.exe	"Added by the SDBOT.NQ WORM!"
X	ActiveXUpdate	svcss.exe	"Added by a variant of the DEDLER.C TROJAN!"
U	Activity	actik.exe	"ActivityKey keystroke logger/monitoring program - remove unless you installed it yourself!"
N	ActivSurf	backweb*****.exe	Packard Bell ActivSurf - automatically detects an internet connection and downloads any available updates
U	ActMaker	ActMak25.exe	"""ActMaker mouse and keyboard toolkit can record the daily operation of your computer and reduce your workload. You don't need to do any coding
U	ActMaker	ActMaker25.exe	"ActMaker mouse and keyboard toolkit can record the daily operation of your computer and reduce your workload"
U	ACTray	ACTray.exe	"System Tray access to the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
U	Actual Window Manager	ActualWindowManagerCenter.exe	"Actual Window Manager from Actual Tools - ""an innovative desktop organization application which introduces unconventional window controls and also automatic general window operations making your work more productive
U	Actual Window Minimizer	ActualWindowMinimizerCenter.exe	"Actual Window Minimizer - ""allows minimizing any window to task tray notification area or to the edge of the screen"""
X	ACTX1	v1201.exe	"Added by the VB.IS TROJAN!"
U	ACU	ACU.exe	"Atheros wireless Client Utility"
U	ACU_QSB	ACU.exe	"Atheros wireless Client Utility"
U	ACWLIcon	ACWLIcon.exe	"Part of the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
U	Ad Blocker	blocker.exe	"Ad Blocker - blocks popups
U	Ad Blocker Pro	Ad Blocker Pro.exe	Ad Away popup and banner remover
U	Ad Muncher	AdMunch.exe	"Ad Muncher removes adverts
U	Ad-Muncher	ADMUNCH.EXE	"Ad Muncher removes adverts
U	Ad-Protect	ad-protect.exe	"Ad-Protect spyware and spam monitoring tool"
U	Ad-watch	Ad-watch.exe	"Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system"
U	AD2KClient	AD2KClient.exe	"Executable for Active Disk from Iomega - allows software applications to be run directly from an Iomega Zip® disk. Required if you wish the applications to launch on insertion of a disk"
N	Adaptec DirectCD	Directcd.exe	DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later
N	AdaptecDirectCD	Directcd.exe	DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later
X	Add**.exe [* = random char]	Add**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Add**32.exe [* = random char]	Add**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	AddClass	AddClass.exe	"CoolWebSearch Addclass parasite variant"
X	AddClass	[Installation_Path]	"Added by the STARTPAGE.F hijacker"
X	AddClass	[path to trojan]	"Added by the SECDL-A TROJAN!"
X	Additional Guard	WI[random characters].exe	"Additional Guard rogue security software - not recommended
X	ADDITIONAL Services	pkgadd.exe	"Added by a variant of the IRCBOT TROJAN!"
Y	adi CleanUp	CleanUp.exe	"Utility that only runs once after installing the drivers for Analog Devices SoundMax integrated soundcards to clean-up the files no longer required once the installation is complete. Other programs/drivers may use the same filename for the same purpose. In this case
X	adlhidp	psncc32.exe	"Added by the SLAPER.AI TROJAN!"
X	Admanager Controller	AdManCtl.exe	"Adware
X	Admilli Service	AdmilliServ.exe	Windupdates adware variant
X	Administrator	svchost.scr	"Added by the NOVACAL TROJAN!"
X	Adobe	sysconfig.exe	Added by an unidentified WORM or TROJAN!
N	Adobe Acrobat	READER~1.EXE	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
N	Adobe Acrobat	Reader_sl.exe	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
X	Adobe Acrobat Distiller Application	acrotray.exe	"Added by the RANDEX.DFJ WORM!"
X	Adobe Acrobat Reader CFG	[random filename]	"Added by a variant of the RBOT WORM!"
N	Adobe Acrobat Speed Launcher	acrobat_sl.exe	"Speeds up the time it takes to load Adobe's Acrobat PDF creation and management tool. From version 7.0 onwards"
N	Adobe Reader Speed Launch	Reader_sl.exe	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
N	Adobe Reader Speed Launch	READER~1.EXE	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
N	Adobe Reader Speed Launcher	Reader_sl.exe	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
U	Adobe Reader Synchronizer	AdobeCollabSync.exe	"Adobe Synchronizer - installed along with Adobe Reader 8.x. ""Synchronizer is a small application that runs in the background
X	Adobe Reader32	Acrord32.exe	"Added by the RBOT-BLC WORM! Note - this is not the popular Adobe Reader"
U	Adobe Version Cue CS2	VersionCueCS2Tray.exe	"File manager that's part of Adobe Creative Suite 2 - ""find files fast
X	AdobeReaderPro	cbdzfrsl.exe	"Added by the RBOT.AZQ BACKDOOR!"
X	AdobeReaderPro	msnsrcdv.exe	"Added by the INJECT-H WORM!"
X	AdobeReaderPro	chkdisk.exe	"Added by the RBOT-BDV WORM!"
X	AdobeReaderPro	service.exe	"Added by the RBOT-BCA WORM!"
N	AdobeVersionCue	VersionCueTray.exe	"""An exclusive feature of the Adobe® Creative Suite
X	Adobe_Reader	acrotray.exe	"Added by the AGENT-LNS TROJAN! Note that the legitimate Adobe file (if installed) would normally be found in %ProgramFiles%\Adobe%\%ProgramName% (where %ProgramName% is Acrobat 9.0\Acrobat or Acrobat 7.0\Distillr for example) whereas this one is located in %ProgramFiles%\Adobe"
X	Adobe_RLX	ccwap.exe	"Added by the BCKDR-RCL TROJAN!"
X	AdPopup	dcf5678.exe	"Added by the AGENT-FZ TROJAN!"
N	ADQuickAccess	Adtray.exe	After Dark for Windows. Screen saver creation program produced before screen savers became integrated into Win95
X	AdRotator.Application	[path to csrss.exe]	"Added by the SMALL-AQ TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	AdRotator.Application	services.exe	"FakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in an ""Inetsrv"" subfolder"
X	AdsBlocker	stopAds.exe	"AdsBlocker - detected by NOD32 as DIALER.DW!"
U	AdsCleaner	AdsCleaner.exe	"""AdsCleaner is a powerful ad blocking software designed to stop ads (block banners ad
U	ADService	ADService.exe	"Part of Active Disk from Iomega - allows software applications to be run directly from an Iomega Zip® disk. Required if you wish the applications to launch on insertion of a disk. Appears as a service in XP/Vista and under the ""RunServices"" registry key in Win98/ME"
N	ADSL Diagnostic Tools	mapiicon.exe	System tray access to ADSL modem diagnostic tools. Available via Start -> Programs
Y	AdslTaskBar	"rundll32.exe stmctrl.dll	TaskBar"
U	aDSProcMngr	aDSProcMngr.exe	"Part of PC Tools Disk Suite from PC Tools - which ""is an all-in-one hard-disk management utility that integrates disk optimization
X	AdStatus Service	AdStatServ.exe	"WindUpdates AdStatus Service adware"
U	AdSubtract	adsub.exe	"AdSubtract blocks ads
X	adtech2005	adtech2005.exe	"Detected by Kaspersky as the STARTPAGE.AW TROJAN!"
X	adtech2006	adtech2006.exe	"Detected by Kaspersky as the VB.KC WORM!"
X	Adtools Service	AdTools.exe	"Windupdates Adware"
X	Adult_Chat	Adult_Chat.exe	Adult content dialler
X	Adult_Chat1	Adult_Chat1.exe	Adult content dialler
X	Advanced DHTML Enable	exo32.exe	"Added by the RANCK-FI TROJAN!"
X	Advanced DHTML Enable	[path to trojan]	"Added by the AGENT.GLQ TROJAN!"
X	Advanced Internet Protocol	cerf.exe	"Added by a variant of the SPYBOT WORM!"
X	Advanced Protection System	advpsys.exe	"Added by a variant of the RBOT WORM!"
X	Advanced Spyware Remover	Asr.exe	"Advanced Spyware Remover rogue spyware remover - not recommended
X	Advanced Spyware Remover Pro	Asr.exe	"Advanced Spyware Remover rogue spyware remover - not recommended
U	Advanced SystemCare 3	AWC.exe	"Advanced SystemCare from IObit - ""helps protect
X	Advanced Tool Checks	advchks.exe	"Added by a variant of the RBOT WORM!"
N	Advanced Tools Check	ADVCHK.EXE	Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget
U	Advanced Uninstaller PRO Installation Monitor	monitor.exe	"Innovative Solutions Advanced Uninstaller PRO - ""easy-to-use suite for uninstalling applications and keeping your computer fast
X	AdvancedCleaner Free	UADC.exe	"AdvancedCleaner rogue security software - not recommended
X	advanceddefender	advanceddefender.exe	"Advanced Defender rogue security software - not recommended
X	AdvancedPrivacyGuard	apg.exe	"AdvancedPrivacyGuard rogue privacy program - not recommended
X	AdvancedPrivacySuite	APS.exe	"AdvancedPrivacySuite rogue privacy program - not recommended
N	ADVCHK	ADVCHK.EXE	Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget
X	AdwareKiller_schedules	schedules.exe	"EAdwareKiller rogue spyware remover - not recommended
X	AdwareProMFC	Ad-Ware Pro.exe	"Ad-Ware Pro rogue security software - not recommended"
X	AdwareProMFC	AntiTrojan Pro.exe	AntiTrojan Pro rogue security software - not recommended. Variant of Ad-Ware Pro
X	AdwareProtector	AdwareProtector.exe	"Part of rogue security tools
U	AEFltrs Application	AESTFltr.exe	"Part of the XP installation of the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
N	AELaunch	AELaunch.exe	"Audio Applications Launcher for the Philips Acoustic Edge soundcard"
X	AERVICESN	AERVICESN.exe	"Added by the RANDON-AO WORM!"
N	AeXAgentLogon	AeXAgentActivate.exe	"Altiris Agent transmits information about your machine for the purpose of asset management and deployment"
U	AEZBProc	aptezbp.exe	"IBM Aptiva keyboard customizer - enables certain special buttons on keyboard for CD operation
N	AGEIA PhysX SysTray	TrayIcon.exe	"System Tray access to display properties for AGEIA PhysX graphics cards. Unless you change your desktop resolution
U	AgfaCLnk	AgfaCLnk.exe	For Agfa digital cameras connected via USB. Enables Windows to access the contents of the memory stick (while the stick's still on the camera) via a virtual drive
X	AHU	ANACON.EXE	"Added by the NACO.A WORM!"
U	Ai Quicker Help	AsRc.exe	"ASUS DH Remote media portal launcher for their Digital Home range of motherboards that are designed for users to control the computer at a distance away
X	Aica	tuaa.exe	"PurityScan adware"
X	AIM Instant Message Cookies	[random filename]	"Added by the RBOT-AFV WORM!"
X	Aim Quick Start	Aim.exe	"Added by the FORBOT-BB WORM! Note - this is not the popular AOL Instant Messenger utility"
N	Aim6	AOLLaunch.exe	"AOL Instant Messenger - start it when you want to use it"
N	AimingClick	AimingClick.exe	"AimingClick from AimingTech. Web searching tool. Available via Start -> Programs"
Y	Aiptek Graphics Tablet (USB)	atwtusb.exe	USB interface for Aiptek Graphics Tablet (USB)
?	Air2Data	a2dservice.exe	"Related to the Air2Data Wireless HISA (High-Speed Internet Access) service. What does it do and is it required?"
X	aircity	aircity.exe	"Related to ""Prutect"" malware from e2Give"
Y	AirGCFG	AirGCFG.exe	"Driver and configuration utility for a number of wireless routers and adapters from D-Link"
Y	AirNCFG	AirNCFG.exe	"Driver and configuration utility for a number of wireless routers and adapters from D-Link"
Y	AirPlusCFG	AirPlusCFG.exe	"Driver and configuration utility for a number of wireless routers and adapters from D-Link"
U	AJC Active Backup	AJCActBk.exe	"AJC Active Backup from AJC Software - ""Instantly backup files you change on your PC and keep multiple versions to undo"""
?	AlarmWatcher	AlarmWatcher.exe	"Associated with SynTPEnh and SynTPLpr which are from Synaptics for touchpads on laptops. What does it do and is it required?"
Y	Alaunch	Alaunch	"Part of Acer eRecovery - ""a powerful utility that does away with the need for recovery disks provided by the manufacturer
?	AlcFDMonitor	ALCFDRTM.EXE	"RealTek related - Real-Time SPDIF-in Monitor for nVidia chipset - is it required in startup?"
?	ALCFDRTM16	ALCFDRTM16.com	"RealTek related - Real-Time SPDIF-in Monitor for nVidia chipset - is it required in startup?"
X	Alchem	Alchem.exe	"ClickAlchemy adware"
U	Alcmtr	ALCMTR.EXE	"Realtek Azalia Audio - Event Monitor
X	Alcmtr	Malware Doctor.exe	"MalwareDoc rogue security software - not recommended
N	Alcohol	Alcohol.exe	"Alcohol 120% - ""a powerful Windows CD and DVD burning software that makes it easy to create backups of DVDs and CDs. In addition
N	Alcohol 120%	Alcohol.exe	"Alcohol 120% - ""a powerful Windows CD and DVD burning software that makes it easy to create backups of DVDs and CDs. In addition
N	Alcohol Soft Development Team	axcmd.exe	"Part of Alcohol 120% - ""a powerful Windows CD and DVD burning software that makes it easy to create backups of DVDs and CDs. In addition
N	Alcohol.exe Autorun	Alcohol.exe	"Alcohol 120% - ""a powerful Windows CD and DVD burning software that makes it easy to create backups of DVDs and CDs. In addition
N	AlcoholAutomount	axcmd.exe	"Part of Alcohol 120% - ""a powerful Windows CD and DVD burning software that makes it easy to create backups of DVDs and CDs. In addition
?	Alcom PCL Capture	FMW_PCAP.EXE	"??"
X	alcomrg.exe	alcomrg.exe	"Added by the SDBOT-DNT WORM!"
U	AlcWzrd	ALCWZRD.EXE	"RealTek AlcWzrd Application
U	AlcxMonitor	Alcxmntr.exe	"Installed with hardware drivers for a Realtek AC97 audio device. It's believed that Realtek uses this file in order to gather data about the customer. Some users report problems with their on-board sound if this is disabled - hence the ""U"" recommendation"
X	aldefr ere service	tay0x.exe	"Added by the RBOT-XS WORM!"
X	AlfaCleaner	AlfaCleaner.exe	"AlphaCleaner is now a stealth install using exploits on unpatched systems. Seen alongside RazeSpyware"
U	AlfaClock Classic	AlfaClock.exe	"AlfaClock Free Edition from AlfaSoft Research Labs - ""enhances your taskbar clock (tray clock) with fully customizable clock display
U	AlfaClock2	AlfaClock2.exe	"AlfaClock2 from AlfaSoft Research Labs -""enhances your tray clock functionality. Of course
?	ALFY Accellerator	AlfyAC~1.exe	"??"
X	algchk.exe	algchk.exe	"Detected by Kaspersky as the VB.ATE TROJAN!"
N	Alias SketchBook Snapshot	ALIASS~2.EXE	Screen-capture utility for Alias Sketchbook
X	Alive SYstem	scchost.exe	"Added by the TOFDROP-B TROJAN!"
X	Alive SYstem	scchostc.exe	"Added by the TOFDROP-B TROJAN!"
X	All Sea screen saver	TaskTray.exe	"Free screensaver
N	AllerCalc	AllerCalc.exe	"AllerCalc is an expression calculator which allows you to directly enter an expression to be evaluated. Can be started manually"
U	ALLTEL DSL Check-up Center	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	ALM	csrss32.exe	"Added by the ANACON-D VIRUS!"
X	alpha	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
Y	Alps Electric USB Server	Monserv.exe	"Alps Electric USB Server - required according to this article"
X	alt CTRL Shift	et3rd.exe	"Added by the SDBOT-RH BACKDOOR!"
X	ALTER DATA	[path] repcale.exe [path] beird.exe	"Added by the IRCFLOOD.CD TROJAN! Both files are located in %System%\ccdew"
U	AltoMB_service	AltoMBsrv.exe	"Alto Memory Booster from Alto Software - boost the computers performance via more intelligent and efficient memory management. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
U	ALTOOLS	AccessL.exe	"ALTools family of PC utilities"
N	ALU Scheduler Service	ALUSchedulerSvc.exe	Symantec LiveUpdate scheduler for programs such as Norton AV or Internet Security
N	Aluria Security Center	SecurityCenter.exe	"Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU
U	AMD PowerNow!	GemBack.exe	"
Y	amd_dc_opt	amd_dc_opt.exe	"
N	America Online	aoltray.exe	"Adds the AOL icon in the System Tray (*.* denotes version if present) for versions of AOL up to and including 9.0. Start AOL via the desktop or quick launch shortcuts or via Start → All Programs"
N	America Online *.* Tray Icon	aoltray.exe	"Adds the AOL icon in the System Tray (*.* denotes version if present) for versions of AOL up to and including 9.0. Start AOL via the desktop or quick launch shortcuts or via Start → All Programs"
N	AME_CSA	"rundll32 amecsa.cpl	RUN_DLL"
U	AmIcoSinglun	AmIcoSinglun.exe	"Single LUN Icon Utility - System Tray access/notification for card readers using controllers from Alcor Micro which incorporate Single LUN
X	Amie Release V6.9D	services.exe	"Added by the VB-EAN TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	amircivil	svchost.exe…	"Added by the AMIRECIVEL WORM!"
U	AModemLockDown	ModemLockDown.exe	"ModemLockDown - allows you to supervise internet access by disabling the modem
X	Andware Defence	Zsoft32.exe	"Added by the GAOBOT.OO WORM!"
Y	ANIWZCS2Service	WZCSLDR2.exe	"ALPHA Networks wireless driver"
?	ANIWZCSService	WZCSLDR.exe	D-Link wireless PCI adapter related. In some cases reported to cause excessive CPU activity
?	AnnotateCheck	AnnCheck.exe	"Genius Wizard Pen Tablet driver related. Is it required?"
N	Announcements	Annclist.exe	MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it
X	Anti Spam Service	spamsvc.exe	"Added by the MYTOB-BK WORM!"
U	Anti-keylogger check	antikey.exe	"Anti-keylogger - protects against keylogger programs monitoring your keystrokes"
U	Anti-Trojan-Watch	ATWatch.exe	Anti-Trojan Watch - trojan detector
X	Anti-Virus Product Sync	[unprintable character][3 characters]log.exe	"Added by the KEDEBE.D WORM!"
X	Anti-Virus Update Scheduler	[path to trojan]	"Added by the SPAMMIT-A TROJAN!"
X	Anti-Virus Update Scheduler	winsp3.exe	"Malware - detected by Kaspersky as the AGENT.FP TROJAN!"
X	Anti-Virus Update Scheduler V1.39.12R	[path to trojan]	"Added by the HEPLANE or STAPREW.B TROJANS! - different filenames have been spotted; examples: msvc.exe
X	AntiCareMain	AntiCare.exe	"AntiCare rogue security software - not recommended"
X	AntiClicker	SVCHST32.EXE	"Added by the CBH TROJAN!"
U	antidialer.co.uk	Dialer_Watcher.exe	"Dialer_Watcher is an application that allows you to detect dialers on your computer"
X	Antimalware Doctor.exe	Antimalware Doctor.exe	"Antimalware Doctor rogue security software - not recommended
X	antispy	scan.exe	"IE AntiVirus rogue security software - not recommended
X	AntiSpyCheck	AntiSpyCheck.exe	"AntiSpyCheck rogue spyware remover - not recommended
X	AntiSpyCheck 2.1	AntiSpyCheck 2.1.exe	"AntiSpyCheck rogue spyware remover - not recommended
X	AntiSpyCheck 2.1.0	AntiSpyCheck.exe	"AntiSpyCheck rogue spyware remover - not recommended
X	AntiSpyControl	pgs.exe	"AntiSpyControl rogue security software - not recommended
X	AntiSpywareControl	pgs.exe	"AntiSpywareControl rogue security software - not recommended
X	Antivir	svchst.exe	"Added by the RAGRUK-A TROJAN!"
X	AntiVir	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	AntiVirProtect	AntiVirProtect.exe	"AntiVirProtect rogue security software - not recommended
X	ANTIVIRUS	microAV.exe	"Micro Antivirus 2009 rogue security software - not recommended
X	Antivirus PC 2009	avpc2009.exe	"Antivirus PC 2009 rogue security software - not recommended
X	AntiVirus Process	virprot.exe	"Added by a variant of the SDBOT WORM!"
X	Antivirus Protection Services	ccapp2.exe	"Added by the RBOT.EXI WORM!"
X	Antivirus Updates	avupdchk.exe	"Added by the AGOBOT-IP WORM!"
X	AntivirusDoc	AntivirusDoc.exe	"AntivirusDoc rogue security software - not recommended
X	AntivirusPCPakke	pgs.exe	"AntivirusPCPakke
X	AntivirusPCSuite	pgs.exe	"AntivirusPCSuite rogue security software - not recommended
X	AntiVirusProMFC	Antivirus Pro.exe	"AntiVirus Pro rogue security software - not recommended"
?	AntiVirusProtection	qumk.exe	"??"
X	AntivirusProtection	antivirusprotection.exe	"Antivirus Protection rogue security software - not recommended
X	Antivirusscherm	pgs.exe	"Antivirusscherm
X	antiware	elite***32.exe [*** = random char]	"Added by the DLOADER-HW TROJAN!"
U	AnVir Security Suite	AnVir.exe	"AnVir Security Suite - ""is a tool that controls everything running on computer and provides Windows enhancements that help in every-day work"". Monitors and manages startup programs
?	anycom bluetooth	ftflauncher.exe	"Associated with an Anycom bluetooth wireless card. What does it do and is it required?"
X	AOL 9.0 Optimized	AOLClient.exe	"Added by the SPYBOTER.A TROJAN!"
U	AOL Broadband Check-Up	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	AOL Companion	companion.exe	"The AOL Companion is a small window that appears when you connect to the service using verison 8.0 and early builds of version 9.0. ""Use the Companion to quickly get to your favourite features
X	Aol Configuration Loader	aimsng.exe	"Added by the SDBOT-XE WORM!"
N	AOL Service Libraries	AOLSoftware.exe	"Quoted from AOL Beta Team
X	AOL Services Hosts	aolserviceshosts.exe	Added by an unidentified WORM or TROJAN!
U	AOL Spyware Protection	AOLSP Scheduler.exe	AOL's spyware protection program
Y	AolAcsDaemon1	Acsd.exe	"AOL Connectivity Service - automatically restores the connection to AOL should you lose it while online. Negates having to go through the procedure of signing back on manually. This version is obsolete and has been replaced by AOLACSD.EXE so update your version of AOL. Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
Y	AolAcsDaemon1	AOLACSD.EXE	"AOL Connectivity Service - automatically restores the connection to AOL should you lose it while online. Negates having to go through the procedure of signing back on manually. Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
?	AOLCC	ACCAgnt.exe	"AOL ISP software related
X	AolCon	config.com	"Added by the TAPLAK WORM!"
X	AOLSPYWAREREMOVER32	AOLSPYWARECLEANER32.EXE	"Added by the SPYBOT-HJ WORM!"
Y	APC UPS Status	Display.exe	"APC PowerChute® Personal Edition status icon"
X	APcDefender	APcDefender.exe	"APcDefender rogue security software - not recommended
X	APCProtect.exe	APCProtect.exe	"APCProtect rogue security software - not recommended
X	APcSafe	APcSafe.exe	"APcSafe rogue security software - not recommended
X	APcSecure	APcSecure.exe	"APcSecure rogue security software - not recommended
U	APC_SERVICE	mainserv.exe	"APC PowerChute® Personal Edition - ""safe system shutdown software with sophisticated power management functions."" Appears as a service in XP/Vista and under the ""RunServices"" registry key in Win98"
Y	apc_tray	apc_tray.exe	Part of the APC UPS software loaded with the BACK-UPS CS 350 unit. Required to monitor the APC unit in case of power failure
X	Api**.exe [* = random char]	Api**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Api**32.exe [* = random char]	Api**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	APIClass	lexplore_.exe	"Added by the MSNOPT-A TROJAN!"
X	apisvc.exe	apisvc.exe	"Added by a variant of the LAMEBOT TROJAN!"
X	App**32.exe [* = random char]	App**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	ApPache System	ApPache.exe	"Added by the RBOT-YP BACKDOOR!"
U	Appcon	vAppCon.exe	"Vital Application Console - part of POS-partner 2000 point-of-sale software from Vital. This is the taskbar icon and is enabled at startup by the "Auto-start when OS starts" option. Required for a connection to be established"
X	appconn	appconn.exe	"Added by the CARGAO WORM!"
U	AppExtender	AppExtCB.exe	"Loads the Confimax add-in for popular E-mail programs to confirm E-mails have been sent and received"
N	AppleSyncNotifier	AppleSyncNotifier.exe	"From WinPatrol PLUS by BillP Studios - ""This file installs with iTunes and is used when syncing your iPhone
Y	Application	mdmsetsp.exe	"Aztech Labs modem driver"
X	Application	csrss.exe	"Added by the BEAGLE.EG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Application Adapter	abvsvc.exe	"Added by the CHECKOUT WORM!"
U	Application Explorer	Naldesk.exe	"Novell Zenworks Application Explorer Executable. ""For almost all users the Novell ZENworks agent (either Application Launcher or Application Explorer) will be run via the user's login script on each successful login. ZENworks is used to periodically deliver software updates and is also used to install the remote management components."""
U	Application Explorer	NalView.exe	"Application Explorer - file manager type access to Novell Application Launcher for installing and updating network residing applications"
X	Application Explorer	appexplr.exe	"Added by the AGENT-NMO TROJAN!"
X	Application In System	Snxmsh.exe	"Added by the AGENT-LNV TROJAN!"
N	Application Launcher	Application Launcher.exe	"System Tray access to the Sony Ericsson PC Suite and HTC Sync mobile phone management utilities. Run manually via the Start Menu (or optional desktop shortcut) before connecting the phone"
X	Application Layer Browser	abgsvc.exe	"Added by the ULPM.FX TROJAN!"
X	Application Layer Gateway Service	algs.exe	"Added by the LINKBOT.M WORM!"
X	Application Layer Scheduler	agtsvc.exe	"Added by the IRCBOT.BJJ BACKDOOR!"
X	Application Layer Services	avrsvc.exe	"Added by the IRCBOT.BJM BACKDOOR!"
X	Application Manager	acnsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Application Manager	apnsvc.exe	"Added by the SMALLTRO.FN TROJAN!"
X	ApplicationProtocolRun	smsbvl32.exe	"Added by the IRCBOT-CX TROJAN!"
Y	APVXDWIN	ClShield.exe	"""Panda ClientShield with TruPrevent is designed for companies that want the best protection for their workstations. It protects against viruses and other known and unknown threats including spam
X	aqadcup.exe	aqadcup.exe	"Added by the AGENT.BG WORM!"
Y	Aqua Dock	Aqua Dock.exe	"Aqua Dock - 'free program that allows you to have an ""OS X"" style
Y	ArcaCheck	ArcaCheck.exe	"Part of the ArcaVir antivirus suite from Polish company Arcabit. What does this part do?"
X	arcaderockstar	arcaderockstar32.exe	"Arcade Rockstar (now Gamevance) - free arcade games and prize tournaments. The program itself is clean
X	Archive	archive.exe	"Adware - detected by Kaspersky as the CENTIM.A TROJAN!"
X	ARCHIVE CONTROL	fixupdattr.exe	"Added by the MYTOB.GU WORM!"
N	ArcSoft Connect	ACDaemon.exe	"Used to serve notice of product information and updates when running ArcSoft products such as TotalMedia
N	ArcSoft Connection Service	ACDaemon.exe	"Used to serve notice of product information and updates when running ArcSoft products such as TotalMedia
N	ARCSolo Recovery	N/A	Backup software by Computer Associates - no longer supported
U	Arctosa	razerhid.exe	"Razer Arctosa gaming keyboard driver - required if you use the additional features and programmed keys/macros"
U	Argentum Backup	ab.exe	"Argentum Backup - a small backup program that lets you easily back up your documents and folders"
X	argq32	csrss_32.exe	"Added by the RBOT-CPM WORM!"
X	Arucer	"rundll32 Arucer.dll	Arucer"
X	Arucer Dynamic Link Library	"rundll32 Arucer.dll	Arucer"
X	ASC-AntiSpyware	WinCleaner.exe	"WinCleaner 2009 rogue security software - not recommended
X	ASC-AntiSpyware	WinAntivirus.exe	"Win Antivirus Vista/XP rogue security software - not recommended
X	asc32	asc 2.1.exe	"AntiSpyCheck rogue spyware remover - not recommended
X	asccacA	asacsqgl.exe	"Added by the MULTIDRP.AA TROJAN!"
X	ASDPLUGIN	dsldbaccess.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	canada.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	france.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	czech.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	dbaccess.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	dslgeaccess.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	geaccess.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	mexico.exe	"AsdPlug premium rate adult content dialer"
X	asdsaxcxz13	dasxcsx13.exe	"Added by the LEGMIR-ARF TROJAN!"
X	asdx	xwinrpc32.exe	"Added by the AGOBOT.VO WORM!"
N	ASE Scheduler	ASE Scheduler.exe	"Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU
Y	Ashampoo AntiVirus Service	GuardGui.exe	"System Tray access to the main user interface for Ashampoo® AntiVirus from Ashampoo GmbH & Co. KG."
U	Ashampoo Core Tuner	ct.exe	"Ashampoo® Core Tuner from Ashampoo GmbH & Co. KG - a utility which helps you to get the most out of a multi-processor (or dual core) computer. ""For instant results you just need to select Auto-Optimize to optimize all the programs you are running or Boost to give more power to a single program"". This entry loads Core Tuner with Windows (required if you use any optimized profiles) and gives System Tray access"
U	Ashampoo HDD Control Guard	HDDControlGuard.exe	"Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access"
U	Ashampoo Magical Defrag	aDefragCtrl.exe	"System Tray access to the main user interface for Ashampoo® Magical Defrag from Ashampoo GmbH & Co. KG - which ""runs in the background as a service
U	Ashampoo Magical Optimizer Taskplaner	AMO_TA~1.EXE	"Part of Ashampoo® Magical Optimizer from Ashampoo GmbH & Co. KG - which removes stagnant and unnecessary hard drive files
U	Ashampoo Magical Optimizer Taskplaner	AMO_Taskplaner.exe	"Part of Ashampoo® Magical Optimizer from Ashampoo GmbH & Co. KG - which removes stagnant and unnecessary hard drive files
N	ashampoo Magical UnInstall	MagicalUnInstall.exe	"Ashampoo® Magical UnInstall from Ashampoo GmbH & Co. KG - which monitors each new program installation
U	Ashampoo PopUpBlocker	PopUpKiller.exe	"Ashampoo popup blocker
N	ashampoo UnInstaller Watcher	UIWatcher.exe	"Part of the Ashampoo® UnInstaller series from Ashampoo GmbH & Co. KG - including UnInstaller Platinum 2
X	ashcap	servirsess.exe	"SpySure spyware"
X	Asicfc	icfca.exe	"Added by the AGENT.AAJE WORM!"
U	AsioReg	regsvr32.exe ctasio.dll	"ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality"
U	AsioThk32Reg	rregsvr32.exe ctasio.dll	"ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality"
X	asnconsole	msasn.exe	"Added by the RBOT.EVU TROJAN!"
X	ASocksrv	SocksA.exe	"Added by the VB.CBW WORM!"
X	asp-srvc	asp-srvc.exe	"Added by the AGOBOT-KG WORM!"
X	ASP.NET State Service	csrss.exe	"Added by the DLOADER-QI TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	ASP.NET State Service	crsass.exe	"Added by the BANLOAD-M TROJAN!"
X	ASP.NET State Service	servicos..exe	"Added by the DADOBRA-I TROJAN!"
?	AspireService	AspireService.exe	"Found on Acer laptops
Y	AspireTimeMachine	acertmb.exe	"System recovery software supplied with some Acer notebook PCs. Similar to GoBack and the restore program in WinXP
X	ASpyC	ASpyC.exe	"AntiSpyCheck rogue spyware remover - not recommended
X	Ass and titties	CMD32.EXE	"Added by the SDBOT-GG BACKDOOR!"
?	ASUS Camera ScreenSaver	ASScrProlog.exe	"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
?	ASUS Screen Saver Protector	ASScrPro.exe	"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
U	ASUS SmartDoctor	VGAProbe.exe	ASUS video card fan/thermal monitor
?	AsusACPIServer	AsAcpiSvr.exe	"Part of the ACPI driver for the Asus Eee PC range. What does it do and is it required?"
U	AsusEPCMonitor	AsEPCMon.exe	"Part of the ACPI driver for the Asus Eee PC range. Manages the Fn function keys and ""on screen display"""
X	asussvc	asussvc.exe	"Added by the AGENT-FPB TROJAN!"
U	AT&T Self Support Tool	matcli.exe	"AT&T Resolution Assistant. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	AT-Watch	ATWatch.exe	Anti-Trojan Watch - trojan detector
U	atchk	atchk.exe	"AMT Status Message from Intel. Users can manage this
U	ATI 2D Component	Ati2mdxx.exe	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. After testing it's exact function isn't known at this time and it doesn't appear to be running even with the startup entry enabled - hence the ""U"" recommendation"
X	ATI Active Graphics Card Monitor	atievx.exe	"Added by the IRCBOT-TL WORM!"
N	ATI CATALYST System Tray	CLI.exe SystemTray	"System Tray access to ATI's Catalyst™ Control Center. Note that this has ""SystemTray"" appended to CLI.exe in the ""Command"" column of MSCONFIG. Not required to run the control center - which is available via a right-click on the desktop"
X	Ati Control Panel	atiphexx.EXE	"Added by the RBOT-BR WORM!"
X	ATI Cpanel	atiphexx.exe	"Added by the AGOBOT-NV WORM!"
U	ATI Desktop Component	ATIPTAXX.EXE	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. Provides System Tray access to display settings (including desktop resolution
N	ATI DeviceDetect	ATIDtct.EXE	Utility meant for future use of the ATI TV WONDER USB 2.0 video driver and can be disabled
U	ATI Launchpad	launchpd.exe	"Convenient way to start all your Multimedia Center applications (DVD
Y	ATI Remote Control	ATIRW.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
Y	ATI Remote Control	ATIX10.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
N	ATI Scheduler	Atisched.exe	Component that remains resident in memory and automatically launches the ATI VIDEO PLAYER at a user selected time and date. Delete the shortcut in the Start -> Programs -> Startup folder as well. Functions could re-enable the program to load at start-up and re-introduce the shortcut. Try it and see
N	ATI Task Application	Atitkad.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display
N	ATI Task Application (Atikey)	Atitask.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display
U	ATI Technologies Inc. HydraVision Desktop Manager	HydraDM.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is the HYDRAVISION Desktop Manager - which ""customizes the behaviour of windows and dialog boxes
U	ATI Technologies Inc. HydraVision Viewport	HydraMD.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is HYDRAVISION MultiDesk - which ""creates
X	ATI Technology Startup	techstart.exe	"Added by the RBOT-AEU WORM!"
X	ATI Video Driver Control	atigfx.exe	"Added by the RBOT-FWL WORM!"
X	ATI Video Driver Control	btorrent.exe	"Added by a variant of the IRCBOT TROJAN!"
X	ATI Video Driver Controls	[path to worm]	"Added by the SDBOT-DDS WORM!"
?	Ati2cwxx	Ati2cwxx.exe	"For some ATI video cards. Probably used to access features and may not be required - for example the ATI Radeon works fine without it"
X	Ati2evxx	Ati2evxx.com	Added by the BACKDOOR-CPC TROJAN!
N	ATICCC	cli.exe runtime	"ATI's Catalyst™ CONTROL CENTER. Required if you want to change graphics settings on a regular basis but you must have internet access and Microsoft's .NET framework installed. Note that this has ""runtime"" appended to cli.exe in the ""Command"" column of MSCONFIG. Recommend that start the program manually via Start → Programs → ATI Catalyst Control Center → Advanced → Restart Runtime as it can cause problems when starting Windows"
N	ATICCC	CLIStart.exe	Puts the ATI Catalyst™ Control Center Icon/Shortcut on the System Tray - available via Start → Programs
X	AtiCpanel	atiphexx.exe	"Added by the AGOBOT.IL WORM!"
X	aticpaxx.exe	aticpaxx.exe	"Added by the RBOT-XP WORM!"
U	AtiCwd	AtiCwd.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
U	AtiCwd	AtiCwd32.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
U	AtiCwd	Ati2cwad.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
U	AtiCwd32	AtiCwd.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
U	AtiCwd32	AtiCwd32.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
U	AtiCwd32	Ati2cwad.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
U	ATIMACE	MACE.exe	ATI Technologies Control Centre - installed alongside ATI graphics hardware and provides additional configuration options for these devices in the Managed Access to Catalyst™ Environment (MACE) component
U	ATIModeChange	Ati2mdxx.exe	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. After testing it's exact function isn't known at this time and it doesn't appear to be running even with the startup entry enabled - hence the ""U"" recommendation"
U	AtiQiPcl	AtiQiPcl.exe	Used for hardware DVD decoding on ATI video cards supporting this feature. Not required unless you regularly play DVD's
U	AtiSound	csrss.exe	"WinSpy surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""ComRoot"" subfolder"
X	atisrc2	windfind.exe	"Added by the WINDFIND-A TROJAN!"
X	ATITech	Active.exe	"Added by the ROAMER-A TROJAN!"
X	Atl**.exe [* = random char]	Atl**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Atl**32.exe [* = random char]	Atl**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	ATM Control	adpn.exe	"Added by the MMS.A WORM!"
U	Atomic Time Synchronizer	TimeSync.exe	"TimeSync - lets you synchronize your computer's clock with any internet atomic clock"
X	Atomic-x27	Atomic-x27.exe	"Added by the KATOMIK-A WORM!"
X	Atomic-x27C	AtomicpartC.exe	"Added by the KATOMIK-A WORM!"
U	Atomic.exe	Atomic.exe	"Atomic Clock Sync - synchronizes your computer's time with the NIST time server"
N	Atomica	atomica.exe	"Atomica runs from the System Tray and allows the user to find out more about a word or phrase on any screen by pointing at it with the mouse and clicking button one while holding down the Alt key"
U	AtomicTime	ATOMICTIME.EXE	"AtomicTime - utility that synchronizes your PC clock to an atomic clock"
U	AtomSync	atomsync.exe	"AtomSync - ""this NTP client synchronizes your PC clock with an internet atomic time server or with a time server on your LAN"""
U	Atrack	atrack.exe	"New feature of Norton Internet Security (NIS) and Norton Personal Firewall (NPF) 3.0 is the Alert Tracker
X	AttuneClientEngine	attune_ce.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	AttuneContentUpdater	attune_cu.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	AttuneDiscovery	attune_di.exe	"Aveo Attune automated helpdesk software - adware/spyware"
Y	AUCBPNP	aucbnpn.exe	Adaptec USB CardBus Safe-Eject - driver for the Adaptec USB 2.0 CardBus which provides USB 2.0 ports for laptop users via a PCMCIA card slot
X	Aucompat	Aucompat.exe	"Added by the GEMA TROJAN!"
X	Audcntr	audcntr.exe	"Added by the GEMA TROJAN!"
?	AudCtrl	"RunDll32 AudCtrl.dll	RCMonitor"
X	Audio Device Manager	winfp.exe	"Added by the IRCBOT-XS WORM!"
X	Audio Device Manager	WinNT.exe	"Added by the IRCBOT.USP BACKDOOR!"
X	Audio Device Manager	WNDXP.exe	"Added by the IRCBOT.AJL BACKDOOR!"
X	Audio Device Manager	sfhgj.exe	"Added by the IRCBOT-ZA BACKDOOR!"
X	audiocfg.exe	audiocfg.exe	Added by the VB.ATE WORM!
X	Audiocntl	audiocntl.exe	"Added by a variant of the CRYPTER.C TROJAN!"
N	AudioCommander	AudioCommander.exe	"System Tray access to the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
N	AudioCommander Application	AudioCommander.exe	"System Tray access to the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
N	AudioCommanderVista	AudioCommander.exe	"System Tray access to the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
N	AudioDeck	ADeck.exe	ADeck.exe is a system tray application for VIA's sound cards which offers quick access to a number of sound card related items
X	audlmne32	dcmsxe.exe	"Added by the MAILBOT-CF TROJAN!"
X	Audoi Device Loader	smssv.exe	"Added by the AGOBOT-ZY WORM!"
X	aupd	symcsvc.exe	"Added by the ABWIZ.D TROJAN!"
X	aupd	sysvcs.exe	"Added by the ABWIZ.C TROJAN!"
X	aupd	sywsvcs.exe	"Added by the ORSE-M TROJAN!"
Y	Aureal A3D Interactive Audio	sa3dsrv.exe	For Aureal based 3D soundcards. A3D sound features won't work with this disabled
Y	Aureal A3D Interactive Audio Init	A3dInit.exe	For Aureal based 3D soundcards. A3D sound features won't work with this disabled
U	Auslogics BoostSpeed	boostspeed.exe	"System Tray access to Auslogics BoostSpeed system optimization utility - which allows you to ""Start programs faster. Speed up computer start time. Increase Internet speed
U	Auslogics BoostSpeed 4	boostspeed.exe	"System Tray access to Auslogics BoostSpeed 4 system optimization utility - which ""Start programs faster. Speed up computer start time. Increase Internet speed
X	ausvc	ausvc.exe	"Added by the AUTOUPDER TROJAN!"
Y	Authentic-ID Toolbar	wintmr.exe	"System Tray access to Child Control parental control software by Salfield"
Y	Authentic-ID Toolbar	"rundll32.exe [path] ToolbarATL.dll	LoadTrayIcon"
X	Auto CD-ROM Startup	cdaccess.exe	"Added by the SPYBOT.BLA WORM!"
U	Auto EPSON PictureMate Deluxe on X	E_FATI9TA.EXE	"Epson Status Monitor 3 for the PictureMate Deluxe compact photo printer - for monitoring printer status
U	Auto EPSON Stylus C45 Series on X	E_S4I3T1.EXE	"Epson Status Monitor 3 for the Stylus C45 Series printer - for monitoring printer status
U	Auto EPSON Stylus C48 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C48 Series printer - for monitoring printer status
U	Auto EPSON Stylus C48 Series on X	E_S4I091.EXE	"Epson Status Monitor 3 for the Stylus C48 Series printer - for monitoring printer status
U	Auto EPSON Stylus C60 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C60 Series printer - for monitoring printer status
U	Auto EPSON Stylus C62 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C62 Series printer - for monitoring printer status
U	Auto EPSON Stylus C64 Series on X	E_S4I2C1.EXE	"Epson Status Monitor 3 for the Stylus C64 Series printer - for monitoring printer status
U	Auto EPSON Stylus C82 Series on X	E_S0HIC1.EXE	"Epson Status Monitor 3 for the Stylus C82 Series printer - for monitoring printer status
U	Auto EPSON Stylus C84 Series on X	E_S4I2D1.EXE	"Epson Status Monitor 3 for the Stylus C84 Series printer - for monitoring printer status
U	Auto EPSON Stylus C87 Series on X	E_FATIABL.EXE	"Epson Status Monitor 3 for the Stylus C87 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3200 on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus CX3200 printer - for monitoring printer status
U	Auto EPSON Stylus CX3500 Series on X	E_FATI9 BL.EXE	"Epson Status Monitor 3 for the Stylus CX3500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3600 Series on X	E_FATI9BE.EXE	"Epson Status Monitor 3 for the Stylus CX3600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3700 Series on X	E_FATIACP.EXE	"Epson Status Monitor 3 for the Stylus CX3700 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3800 Series on X	E_FATIACA.EXE	"Epson Status Monitor 3 for the Stylus CX3800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4200 Series on X	E_FATIAEA.EXE	"Epson Status Monitor 3 for the Stylus CX4200 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4500 Series on X	E_FATI9AP.EXE	"Epson Status Monitor 3 for the Stylus CX4500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4600 Series on X	E_FATI9AA.EXE	"Epson Status Monitor 3 for the Stylus CX4600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4800 Series on X	E_FATIADA.EXE	"Epson Status Monitor 3 for the Stylus CX4800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX5000 Series on X	E_FATIBVA.EXE	"Epson Status Monitor 3 for the Stylus CX5000 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX5400 on X	E_S4I2G1.EXE	"Epson Status Monitor 3 for the Stylus CX5400 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX5500 Series on X	E_FATICAP.EXE	"Epson Status Monitor 3 for the Stylus CX5500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6000 Series on X	E_FATIBIA.EXE	"Epson Status Monitor 3 for the Stylus CX6000 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6400 on X	E_S4I2L1.EXE	"Epson Status Monitor 3 for the Stylus CX6400 printer - for monitoring printer status
U	Auto EPSON Stylus CX6600 Series on X	E_FATI9EE.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6600 Series on X	E_FATI9EA.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX7400 Series on X	E_FATICDA.EXE	"Epson Status Monitor 3 for the Stylus CX7400 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX7800 Series on X	E_FATIAFA.EXE	"Epson Status Monitor 3 for the Stylus CX7800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX9400Fax Series on X	E_FATICFA.EXE	"Epson Status Monitor 3 for the Stylus CX9400Fax Series printer - for monitoring printer status
U	Auto EPSON Stylus DX3800 Series on X	E_FATIACE.EXE	"Epson Status Monitor 3 for the Stylus DX3800 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo 820 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo 820 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R280 Series on X	E_FATICKA.EXE	"Epson Status Monitor 3 for the Stylus Photo R280 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX420 Series on X	E_FATI9CE.EXE	"Epson Status Monitor 3 for the Stylus Photo RX420 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX680 Series on X	E_FATICJA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX680 Series printer - for monitoring printer status
U	Auto EPSON Stylus Pro 7600 on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Pro 7600 printer - for monitoring printer status
X	Auto File System Conversion Utility	scricon.exe	"Added by the SDBOT.EYB WORM!"
X	Auto Scroll Loader	ASCRLL.EXE	"Added by the SPYBOT-T WORM!"
U	Auto Switch	TASKBAR.exe	Related to 2-port Bitronics AutoSwitch kit from Belkin
X	Auto updat	crcss.exe	"Added by the SDBOT.AAG WORM!"
X	Auto Update	svchost.exe	"Added by the DUMARDI-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Auto Updater	asclt.exe	"Added by the SLINBOT.CJ BACKDOOR!"
X	Auto Updates	svchost.exe	"Added by the CHEUKO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	AutoAdministrator	SERVICES.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Root%\Application Data\WINDOWS"
N	AutoCAD	acstart17.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
N	AutoCAD Startup Accelerator	acstart16.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
N	AutoCAD Startup Accelerator	acstart17.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
X	autochk	"rundll32.exe autochk.dll	_IWMPEvents@16"
X	autochk	"rundll32.exe protect.dll	_IWMPEvents@16"
U	autoclk	autoclk.exe	"Autoclik is a Windows utility ""that allows you to perform all mouse activity with absolutely no clicking"""
X	AutoDiscovery/AutoPurge (ADAP) Service	wmiadapi.exe	"Added by the RBOT.FLT WORM!"
X	autoload	cftmon.exe	"Added by the SOCKS-E WORM!"
X	Autoloaderaproposclient	Apropos_Client_Loader.exe	"AproposMedia adware"
X	Autoloaderaproposclient	cxtpls_loader.exe	"AproposMedia adware"
N	AutoMate Task Service	automate.exe	"Task scheduler for Unisyn Automate 4 task automation/macro running software. Available via a desktop shortcut or Start → Programs"
X	Automated Windows Updates	wauclt.exe	"Added by the GAOBOT.AJD WORM!"
X	Automatic Defrag Manager	defrag.exe	"Added by the RBOT-AKE WORM!"
X	Automatic Media Update	CACHE.RVD	Added by an unidentified WORM/TROJAN!
X	Automatic Media Update	HPLNT32.RVD	Added by an unidentified WORM/TROJAN!
X	Automatic Microsoft Windows Updater	suchost.exe	"Added by the RBOT-EQ WORM!"
X	Automatic Updates	algs.exe	"Added by the IRCBOT-AAM TROJAN!"
X	Automatic Windows Updater	Update.exe	"Added by the GAOBOT.AO WORM!"
N	Automatically launches the United Devices Agent when you start your computer	UD.EXE	The United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home but for medical research. Available via Start > Programs
X	autoMe	wscript.exe solution.vbs	"Added by the VBS.SASAN WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""solution.vbs"" file is found in %Windir%"
X	autoMe	wscript.exe samok.vbs	"Added by the SAMOK-A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""samok.vbs"" file is located in %Windir%"
X	AutoProtect	AutoProtect.vbs	"Added by the KILLBAT-C WORM!"
X	AUTOPROTECTU	navapq32.exe	Added by an unidentified WORM or TROJAN!
X	AUTORUN_VAL	AntiSpyCheck 2.1.exe	"AntiSpyCheck rogue spyware remover - not recommended
X	AUTORUN_VAL	asc 2.1.exe	"AntiSpyCheck rogue spyware remover - not recommended
?	AutoShutdown	pssvc.exe	"Utility to fix vCard Export in MS Outlook 2000 - although why are these together?"
N	AutoSpell 5	ASWATC32.EXE	"AutoSpell - spell checker"
X	Autoupdate Service	kaka.exe	"Added by the SYMPE-B TROJAN!"
X	Autoupdate Service	[path to trojan]	"Added by the AGENT-CB TROJAN!"
X	AutoUpdate32	services.exe	"Added by WINSPY.88! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\debug64"
X	AutoVirusProtection	ciscv.exe	"Added by a variant of the RBOT WORM!"
X	auxAudioDevice	aux32.exe	"Added by the AIZU WORM!"
X	AV	UPDATE-28062004.exe[25 blank spaces].vbs	"Added by the MIDFIN WORM!"
X	AV Care	AvCare.exe	"AvCare rogue security software - not recommended
X	AV Client	patch31345.exe	"Added by the MYDOOM.AD WORM!"
X	AV Industry	patch31345.exe	"Added by the MYDOOM.AD WORM!"
X	avagent3974	chnb8895.exe	"AntiVirus ransomware security software - not recommended
X	AVantivirus	Avconsol.exe	"Added by the MSNVB-D WORM!"
Y	avast! Web Scanner	Ashwebsv.exe	"Web scanning part of avast! Antivirus. Starts via a registry ""Run"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
X	avc	avmon.exe	Added by an unidentified TROJAN!
U	AvconsoleEXE	Avconsol.exe	From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Used to schedule regular scans. If you don't have scans scheduled you don't need it
X	Avengine	Avengine.com	"Added by the DELF.LJ TROJAN!"
X	AvG	svchost323.exe	"Added by the RBOT-ZA WORM!"
Y	AVG Anti-Virus system	avgcc.exe	"System Tray access to and notifications for the 7.* series of anti-virus products from AVG Technologies. If this entry is disabled
Y	AVG Anti-Virus System	avgemc.exe	"E-mail scanner for the 7.* series of anti-virus products from AVG Technologies. This process scans incoming and outgoing E-mails for viruses and other malware. From version 7.1 onwards this entry only appears in 9x/Me as a startup entry
X	Avg Antivirus	icpldrvx.exe	"Added by the BANKER.BYU TROJAN!"
X	AVG AntiVirus Scanner	avgscnx.exe	"Added by the SILLYFDC.BBE WORM! Note - this is not a legitimate AVG entry"
U	AVG Internet Security	avgtray.exe	"System Tray access to and notifications for the range of internet security products from AVG Technologies - including Internet Security
Y	AVG7_CC	avgcc.exe	"System Tray access to and notifications for the 7.* series of anti-virus products from AVG Technologies. If this entry is disabled
Y	AVG7_EMC	avgemc.exe	"E-mail scanner for the 7.* series of anti-virus products from AVG Technologies. This process scans incoming and outgoing E-mails for viruses and other malware. From version 7.1 onwards this entry only appears in 9x/Me as a startup entry
Y	avgcc	avgcc.exe	"System Tray access to and notifications for the 7.* series of anti-virus products from AVG Technologies. If this entry is disabled
Y	avgcc32	avgcc32.exe	"System Tray access to and notifications for the 6.* (and maybe earlier) series of anti-virus products from AVG Technologies. Also enables scheduled tests
Y	AVGCtrl	AVGCtrl.exe	"Part of AntiVir® PersonalEdition Classic antivirus"
Y	avgemc	avgemc.exe	"E-mail scanner for the 7.* series of anti-virus products from AVG Technologies. This process scans incoming and outgoing E-mails for viruses and other malware. From version 7.1 onwards this entry only appears in 9x/Me as a startup entry
Y	AVG_CC	avgcc32.exe	"System Tray access to and notifications for the 6.* (and maybe earlier) series of anti-virus products from AVG Technologies. Also enables scheduled tests
Y	AVG_EMC	AVGEMC.exe	"AVG Anti-Virus 7.0 Email Cleaner. Scans incoming and outgoing email for viruses"
Y	AVG_RegCleaner	AVGREGCL.exe	"Boot time registry cleaner for the 7.* series of anti-virus products from AVG Technologies - for checking the registry for virus additions and other security problems"
X	avidrv	drvsc.exe	"Detected by Kaspersky as the AGENT.PH TROJAN!"
Y	AVK Mail Checker	AVKPop.exe	"eXtendia AVK AntiVirus email checker"
X	AVManager	csrss.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
Y	AVMWlanClient	wlangui.exe	Related to broadband products from avm.de
Y	avpcc	avpcc.exe	"Kaspersky Labs anti-virus"
X	AvpWx	WErcx.exe	"Detected by Kaspersky as a variant of the AGENT.A TROJAN!"
X	avscan	avscan.exe	"Added by the SILLYFDC.BCR WORM! The file is in the users %Temp% directory"
X	AVScan	winav.exe	Unidentfied rogue security software
X	AvScan	avscan.exe	"Antivirus System PRO and Spyware Protect 2009 rogue security software. The file is located in %ProgramFiles%\<rogue name>"
X	avscan	Usbconeted.exe	"Added by the PROVIS-A TROJAN!"
Y	AVSCHED32	AVSched32.exe	"AntiVir® PersonalEdition Classic - antivirus"
Y	AVSchedScan	SCHSC9X.EXE	"Command Antivirus related"
X	AVScheduler	AVSCHSVC.EXE	"Part of the WinAntiVirus Pro 2005 rogue security software when installed in Win98/Me - not recommended
X	AvSer	msmpatch.exe	"Added by the SERFLOG.B WORM!"
X	AVSTRT	navpsrvc.exe	"Added by the FORBOT-EF WORM!"
X	AVSystemCare	pgs.exe	"AVSystemCare rogue security software - not recommended. There are number of variants in this family sharing the same filename and user interface - see here"
Y	avx communicator	xcommsur.exe	"Anti-virus part of BitDefender virus scanner/firewall"
U	Awatch	Awatch.exe	"Diagnosis tool that monitors DSL connections
U	AwaySch	AwaySch.EXE	"Part of the IBM ThinkVantage Productivity Center. ""The Away Manager application allows you preselect and run routine tasks to maintain your system's performance"""
U	AWC	AWC.exe	"Advanced SystemCare from IObit - ""helps protect
U	AWMON	Ad-Watch.exe	"Part of Lavasoft Ad-aware Plus - realtime spyware-monitor watching your memory and registry for spyware that tries to install or change your system"
N	axcmd	axcmd.exe	"Part of Alcohol 120% - ""a powerful Windows CD and DVD burning software that makes it easy to create backups of DVDs and CDs. In addition
U	AXIS Print System DriverScanner	DriverScanner.exe	"Part of AXIS Print System from AXIS Communications - ""adds printer discovery
U	AXIS Print System TrayIcon	TrayIcon.exe	"System Tray access to AXIS Print System from AXIS Communications - ""adds printer discovery
N	B'sCLiP	BSCLIP.exe	CD recording utility that comes with a lot of CDR/CDRW drives and isn't required
X	b3d	BDEsecureinstall.exe	"B3d Projector foistware - periodically trys to access the internet. (1) Uninstall it via Start -> Settings -> Control Panel -> Add/Remove Programs. (2) Remove the BDEsecureinstall.exe if still present in the ""System"" directory. (3) Disable and ideally delete it from the registry. (4) Remove the ""BDE"" directory and all its contents"
X	bab	svchst32.exe	"Added by the AGENT.Q TROJAN!"
X	babeie	"rundll32 cnbabe.dll	dllstartup"
N	Babylon Client	Babylon.exe	"Babylon-Pro is a powerful information tool that instantly provides relevant information
X	Back Updates	Uninstall.log.vbs	"Added by the YPSAN.D WORM!"
U	Back2zip	Back2zip.exe	"Back2zip is a simple and elegant backup solution which uses the industry's most powerful ZIP and ZIP-64 technologies to constantly monitor your documents and make sure that they are always properly backed up"
X	Backdoor.NuAgent	agent.exe	"Added by the AGENT-DP TROJAN!"
X	Background Intelligent Transfer Service	[path] rundll32.exe	"Added by the VB-ZD TROJAN! Note - this is not the legitimate rundll32.exe process
U	BackgroundSwitcher	bgswitch.exe	"Originally included with Microsoft's XP PowerToys (but now withdrawn - see here
U	BackgroundSwitcher	BackgroundSwitcher.exe	"John's Background Switcher (or JBS for short) periodically changes the background image on your computer (like every hour or every day) to something interesting"
N	Backpack UDF	bpudfmon.exe	"Backpack UDF packet writing software for Microssolutions' Back Pack external CD-RW drive. Similar to DirectCD. Run manually before insert an appropriately formatted CD-RW disk"
X	backup	[path to worm]	"Added by the AGOBOT-H WORM!"
U	Backup NOW! Scheduler	Schdlr32.exe	"Scheduled backups for the NTI Backup Now archiving utility. If a backup job has been scheduled
X	Backup One	smbguard.exe	"Added by the SDBOT-MI WORM!"
X	Backup Service	backup.svc	Unidentified adware
X	BackUp Windows 2009	[random].exe	"Added by the AGENT-LUJ TROJAN!"
U	Backup4all OTB Agent	B4AOTB.exe	"""Backup4all is an award-winning data backup software for Windows. This backup utility was designed to protect your valuable data from partial or total loss by automating backup tasks
U	BackupExecScheduler	besch.exe	"Veritas ""Back Up My PC"" software"
?	BackupNotify	backupnotify.exe	"HP Digital Imaging related. What does it do and is it required?"
N	BackWeb	backweb.exe	Automatically detects an internet connection and downloads any available updates. Typical on Compaq and HP PC's but not restricted to those OEM's. Resource hog and often causes malfunctions. Available via Start -> Programs
N	backWeb-8876480	backweb-8876480.exe	"Installed with older versions of the software for Logitech products. Automatically checks for software upgrades and new products
N	Backwork	Backwork.exe	"Backwork trojan detector"
U	BACPI10	bacpi10a.exe	"Known as ""PowerKey"" - a minimalist keyboard driver that allows power management keys on BTC keyboards to function properly in older OS's (i.e. Win9x/NT4). Also adds an icon to the system tray"
N	BacsTray	BacsTray.exe	Broadcom Advanced Control Suite - for modems and set top boxes based upon Broadcom chipsets. Not required unless you have networking problems
X	BagleAV	csrss.exe	"Added by the NETSKY.AB WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	BaRloNdDiLhep	services.exe	"Added by the AUTORUN.DIB WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~� subfolder"
U	Bart Station	PPCOLink.exe	Dialer for PeoplePC ISP
N	bascstray	BascsTray.exe	Broadcom Advanced Control Suite - for modems and set top boxes based upon Broadcom chipsets. Not required unless you have networking problems
X	Bat	secure2.bat	"Added by the ZCREW.C TROJAN!"
N	Batchreg1	N/A	"Part of the Windows System Recovery process. Added to the registry via Msbatch.inf. The existence of this key or process after the last reboot during installation indicates an unsuccessful installation
U	Battery Scope	batmgr.exe	Monitors battery levels on a notebook/laptop PC
X	BatzBack	BatzBack.scr	"Added by the BACKZAT WORM!"
U	Bayden SlickRun	sr.exe	"""SlickRun is a floating command line utility for Windows. It gives you almost instant access to any program or website. SlickRun allows you to create command aliases (known as MagicWords)
U	BayMgr	DockApp.exe	Hot-swappable drive management on laptops allowing you to change drives without closing down Windows. Only required if you frequently swap bay devices
N	BBC Alerts	BBC_Alerts.exe	"BBC Alerts - ""You can now have all the latest news and sports headlines delivered straight to your desktop with the new BBC Alerts service"""
U	BBC News alerts	skinkers.exe	"BBC News Desktop Alerts service - see here. Desktop alert and breaking news e-mail services let you find out about all the latest news as it happens"
N	BBLauncher.exe	BBLauncher.exe	"BounceBack Professional - back-up software"
U	bca	bca.exe	"BeClean Agent - registry
U	BCDetect	bcdetect.exe	Bcdetect.exe searches the system to make sure Creative drivers are installed for the video card. It loads the BlasterControl when the drivers are detected. Your choice - try it and see
Y	BCMDMMSG	bcmdmmsg.exe	BCM voicemodem driver. Required for dial-up if you have one of these modems
U	BCMHal	"rundll32.exe bcmhal9x.dll	bcinit"
Y	BCMSMMSG	BCMSMMSG.exe	BCM voicemodem driver. Required for dial-up if you have one of these modems
?	bcmwltry	bcmwltry.exe	"Broadcom Corporation Wireless Network Tray Applet. Is it required?"
N	BCNT	bcnt.exe	"AWS Weatherbug related. What does it do?"
X	BCPC	bcpc.exe	"BroadcastPC adware variant"
X	bcpc_c	bcpc_c.exe	"BroadcastPC adware variant"
U	BCSSync	BCSSync.exe	"Part of SharePoint Server 2010 which is part of the Microsoft Office 2010 suite. ""Business Connectivity Services (BCS) uses a cache to store a copy of the external data required by the BCS solutions deployed on the Office client. A process called BCSSync.EXE runs on the client and provides automatic cache refresh and data synchronization of the entity instances."" For more information - see here"
U	BCTweak	bctweak.exe	"BlasterControl for Creative video cards - controls for desktop settings
X	Bcvsrv32	bcvsrv32.exe	"Added by the GAOBOT.BQJ WORM!"
X	Bcvsrv32	he3.exe	"Added by the AGOBOT.AKB WORM!"
X	Bcvsrv32	msxml22.exe	"Added by the AGOBOT.AKH WORM!"
X	Bcvsrv32	msc32.exe	"Added by the AGOBOT.AKD WORM!"
X	Bcvsrv32	msbvd32.exe	"Added by the AGOBOT-SR WORM!"
X	Bcvsrv32	system2.exe	"Added by the AGOBOT-PU BACKDOOR!"
N	BCWipeTM	bcwipetm.exe	"BCWipe Task Manager - scheduler for BCWipe so that it runs at convenient times. You can set a time for running the task
X	BD	dc.exe	"Added by the RASDOOR-A TROJAN!"
Y	BDMCon	Bdmcon.exe	"BitDefender antivirus"
Y	BDSwitchAgent	bdswitch.exe	"Bitdefender 8 antivirus and firewall"
U	BeatNik Internet Clock	BeatNik.exe	"BeatNik Internet Clock is a Windows clock add-on that supports 'skins'. It can also synchronize your computer's clock with an atomic clock"
U	Belgacom	sprtcmd.exe /P Belgacom	"Self-help support tool for Belgacom broadband users (provided by SupportSoft
U	Belkin F5D8013 N Wireless Notebook Card Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8013 N Wireless Notebook Card"
U	Belkin F5D8053 N Wireless USB Adapter Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8053 N Wireless USB Adapter"
U	Belkin F5D8073 N Wireless ExpressCard Adapter Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8073 N Wireless ExpressCard Adapter"
N	Belkin PCMCIA WLAN Monitor	monitorbk.exe	Belkin USB Network Adapter Management utility - can be started manually
U	Belkin Wireless G Notebook Card Client Utility	Belkinwcui.exe	Wireless configuration utility for the Belkin F5D701F Wireless G Notebook Card
U	Belkin Wireless USB Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D7050 Wireless G USB Adapter"
U	Belkin Wireless Utility	Belkinwcui.exe	"Wireless configuration utility for some Belkin cards such as the F5D7000 Wireless G Desktop Card"
X	BeschermingsTool	SysRep.exe	"BeschermingsTool
U	BestCrypt Auto Open	BestCrypt.exe	"BestCrypt from Jetico
U	BestSync 2008	BestSyncApp.exe	"System Tray access to BestSync® 2008 from Risefly Software - ""a professional utility for synchronizing files between your local folders and Network Drives
X	beta	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
U	BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}	NMBgMonitor.exe	"Associated with Nero Scout
N	BHOCop	BHOCop.exe	"PC Magazine's
X	BigfileSearch	BigfileSearch.exe	"BigfileSearch adware. File located in %Program Files%\BigfileSearch"
N	BigPondCable	bpcable.exe	Telstra Bigpond Cable login software - can be started manually
Y	BigPondWirelessBroadbandCM	BigPond_CM.exe	"Related to BigPond_Wireless_Broadband Service by Telstra"
?	Bingo Charm	charms.exe	"Some kind of screen icon kind of like desk flag
?	BIOVCIP	BIOVCIP.exe	"??"
N	BitComet	BitComet.exe	"BitComet P2P client - can be launched from Start -> Programs"
Y	BitDefender Communicator	xcommsvr.exe	"BitDefender antivirus"
Y	BitDefender Scan Server	bdss.exe	"BitDefender antivirus"
N	BJ Printer Status Monitor	Cjstsr.exe	Canon BJ printer status monitor
N	BJ Status Monitor 5xx	CJSTRxx.EXE	Canon printer status monitor - where "xx" is different depending upon the version. Not required as you can check the printer status via My Computer -> Printers
N	bjcfd	cdf.exe	"BroadJump Client Foundation. Broadband troubleshooting software installed by various companies. Not required and you can remove it via Add/Remove programs"
U	BJLaunchEXE	BJLaunch.exe	"Memory Card Utility for the Canon i470D
U	BJPD HID Control	TVMon.exe	"Related to Canon Photo viewer"
N	BlackBerryAutoUpdate	RIMAutoUpdate.exe	"Automatic updates for BlackBerry smartphones
N	BlackICE PC Protection	blackice.exe	"Loads the user interface for the BlackICE PC Protection (was Defender) firewall. From the parent site - '(the user interface) starts in the ""Startup"" menu and adds itself to the taskbar. The user interface is independent from the rest of the system and only displays the output or reconfigures the system. It does not need to be running for the rest of the system to run.' BlackICE was supported by IBM Internet Security Systems (formerly just ISS) when them acquired the NetworkICE parent but is no longer available. See also LoadBlackD"
N	BlackIce Utility	blackice.exe	"Loads the user interface for the BlackICE PC Protection (was Defender) firewall. From the parent site - '(the user interface) starts in the ""Startup"" menu and adds itself to the taskbar. The user interface is independent from the rest of the system and only displays the output or reconfigures the system. It does not need to be running for the rest of the system to run.' BlackICE was supported by IBM Internet Security Systems (formerly just ISS) when them acquired the NetworkICE parent but is no longer available. See also LoadBlackD"
X	blah service	winupdate.exe	"Added by the GAOBOT.BIA WORM!"
X	blah service	winsysengine.exe	"Added by the RBOT-KI WORM!"
X	blah service	internet.exe	"Added by a variant of the RBOT WORM!"
X	blah service	smnp.exe	"Added by the RBOT.IZ WORM!"
X	blah service	msnmsgrr.exe	"Added by the RBOT.PZ WORM!"
X	blah service	tazkmgr.exe	"Added by the RBOT.UA WORM!"
X	blah service	FaLeH.exe	"Added by the RBOT-AES WORM!"
X	blah service	microsoft.exe	"Added by a variant of the RBOT WORM!"
X	blah service	evosys.exe	"Added by a variant of the RBOT WORM!"
X	blah service	win32.exe	"Added by the RBOT-AXO WORM!"
X	Blah service	CCAPPS32.EXE	"Added by the RBOT.TV WORM!"
X	blah services	iczw.exe	"Added by the RBOT-GMP WORM!"
X	blahh service	msengine.exe	"Added by a variant of the RBOT WORM!"
X	blahx service	msnjompa.exe	"Added by the SDBOT.AML WORM!"
X	Blank AntiViri	AUT0EXEC.BAT StartUp	"Added by the BRONTOK-CJ WORM!"
N	BlazeChanger	FBZPaper.exe	"Ember graphic file viewer
?	BlazeServoTool	MediaDetector.exe	"Related to BlazeDVD from BlazeVideo - which ""is leading powerful and easy-to-use DVD player software."" What does it do and is it required?"
U	BlockAds	blads.exe	"A Tweak-XP component
X	BlockChecker	Block-checker.exe	"BlockChecker adware"
X	BlockDefense	BlockDefense.exe	"BlockDefense rogue security software - not recommended
X	Blocker System611 Monitoring	PopUpBlocker611.exe	"Added by the RBOT.BLJ WORM!"
X	BlockKeeper	BlockKeeper.exe	"BlockKeeper rogue security software - not recommended
X	BlockProtector.exe	BlockProtector.exe	"BlockProtector rogue security software - not recommended
X	BlockScanner	BlockScanner.exe	"BlockScanner rogue security software - not recommended. A member of the WiniGuard family"
N	BlockTracker	BlockTracker.exe	If present on a HP machine it tracks all the processes and logs them to a blocklog.txt file
X	BlockWatcher	BlockWatcher.exe	"BlockWatcher rogue security software - not recommended
X	Blue Service	[path to trojan]	"Added by the BANCOS-BCW TROJAN!"
?	BlueLight_uoltray	exec.exe	"Related to BlueLight Internet. What does it do and is it required?"
U	BlueSpace NE	BlueSpaceNE.exe	"""BlueSpace NE is a utility program used to run the Bluetooth function on VAIO computers that support the Bluetooth function or on VAIO computers connected to the Bluetooth USB adapter"". Shortcut available via Start -> Programs"
X	Bluetooth Config	btwindin32.exe	"Added by the SDBOT-DFN WORM!"
U	Bluetooth Connection Assistant	LBTWiz.exe	"Bluetooth connection manager for Logitech based bluetooth wireless products"
?	Bluetooth HCI Monitor	"RunDll32 HCIMNTR.DLL	RunCheckHCIMode"
U	BluetoothAuthenticationAgent	"rundll32.exe irprops.cpl
U	BluetoothAuthenticationAgent	"rundll32.exe bthprops.cpl
U	blueyonder Instant Support Tool	matcli.exe	"Blueyonder Instant Support Tool. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	BMail Installation	FTP_back.exe	"Part of iMesh - a file sharing system. Reported by Norton AntiVirus as a trojan. Once deleted does not prevent file sharing working. Older versions of iMesh re-instate this but the newer versions do not"
X	BMN	dcmon.exe	"SystemDoctor rogue security software - not recommended
U	BMO MasterCard Wallet	EWALLET.EXE	"The wallet conveniently stores billing
X	Boarddata	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are often located in %System%"
X	boby	csrs.scr	"Added by the BANCBAN-PC TROJAN!"
X	boby	netburn.scr	"Added by the BANCBAN-OX TROJAN!"
X	boby.	Isass.scr	"Added by the BANCBAN-OH TROJAN!"
Y	BOC-412	BOC412.exe	"NSClean (now Comodo) BOClean anti-malware software - ""Protect yourself from online identity theft. The greatest threat on the Internet today is having your personal information hijacked remotely"". Version 4.12"
Y	BOC-420	BOC420.exe	"NSClean (now Comodo) BOClean anti-malware software - ""Protect yourself from online identity theft. The greatest threat on the Internet today is having your personal information hijacked remotely"". Version 4.20"
Y	BOC-421	BOC421.exe	"NSClean (now Comodo) BOClean anti-malware software - ""Protect yourself from online identity theft. The greatest threat on the Internet today is having your personal information hijacked remotely"". Version 4.21"
Y	BOC-422	BOC422.exe	"NSClean (now Comodo) BOClean anti-malware software - ""Protect yourself from online identity theft. The greatest threat on the Internet today is having your personal information hijacked remotely"". Version 4.22"
Y	BOC-423	BOC423.exe	"Comodo BOClean anti-malware software - ""Protect yourself from online identity theft. The greatest threat on the Internet today is having your personal information hijacked remotely"". Version 4.23"
Y	BOC-424	BOC424.exe	"Comodo BOClean anti-malware software - ""Protect yourself from online identity theft. The greatest threat on the Internet today is having your personal information hijacked remotely"". Version 4.24"
Y	BOC-425	BOC425.exe	"Comodo BOClean anti-malware software - ""Protect yourself from online identity theft. The greatest threat on the Internet today is having your personal information hijacked remotely"". Version 4.25"
Y	BOC-426	BOC426.exe	"Comodo BOClean anti-malware software - ""Protect yourself from online identity theft. The greatest threat on the Internet today is having your personal information hijacked remotely"". Version 4.26"
Y	BOC-427	BOC427.exe	"Comodo BOClean anti-malware software - ""Protect yourself from online identity theft. The greatest threat on the Internet today is having your personal information hijacked remotely"". Version 4.27"
Y	BOCleanautostart	Boclean.exe	"NSClean's BOClean anti-trojan software"
U	BOINC Manager	boincmgr.exe	"BOINC manager - ""controls the use of your computer's disk
U	Boingo Wireless Utility	Icon###XXX#X#.exe	"Starts the Boingo Wireless utility
X	BONZI Task Switcher	Taskswitch.exe	"Added by the SPYBOT.DTR WORM!"
X	BookedSpace	"RunDLL32.EXE bs2.dll	DllRun"
N	BookmarkCentral	BMLauncher.exe	"Bookmark Express - "offers a more flexible way to manage Web site bookmarks
N	BookMarkSink	syncit.exe	Bookmark synchronization utility
N	BookMarkSync	syncit.exe	"Sync2IT BookMarkSync - ""real-time automatic synchronization service that allows you to access your bookmarks
N	BookMarkSync2It	sync2it.exe	"Sync2IT BookMarkSync - ""real-time automatic synchronization service that allows you to access your bookmarks
U	Boost XP Service	bxservice.exe	"Boost XP from Systweak - WinXP tweaking utility"
X	Boot Check	bootchk.exe	"Added by the DELBOT-AB WORM!"
X	Boot Client	bootcli.exe	"Added by the IRCBOT-ACF BACKDOOR!"
X	Boot Config	bootconfig.exe	"Added by the FLOOD-EV TROJAN!"
X	Boot Service	bootservice.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Boot Service	bootsv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	BootCfg	Install.log.vbs	"Added by the YPSAN.D WORM!"
X	BootClean	smartdrv.exe	"Added by the LURKA-A VIRUS!"
X	BootCTRL	bootctrl.exe	Added by an unidentified WORM or TROJAN!
?	Boots Insert Detect	InsDetect.exe	"Part of Boots Picture Suite. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
X	BootsCfg	wscript.exe [path] Date.POP.vbs	"Added by the KUULLIO WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbs	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbe	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe Install.log.vbs	"Added by the YPSAN.E WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""Install.log.vbs"" file is located in %System%"
X	bootsec	NAVSSE.exe	"Added by the FORBOT-CY WORM!"
X	boot_reg	svchot.exe	"Added by the BANCBAN-BQ TROJAN!"
N	Bose Wave/PC Monitor	wavepcmonitor.exe	"System Tray access for this system (more info on the system here). Available via Start -> Programs"
X	Bot Loader	svchostt.exe	"Added by the GAOBOT.ALV WORM!"
X	Bouncer RunStartup	bouncer.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
X	Bouncer RunStartup	LiveUpdate.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
U	bpcpost.exe	bpcpost.exe	MS TV Viewer Post Setup Program. Part of MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it
X	BPCV2	BPCV2.exe	"BroadcastPC adware"
X	BPCv2 re	bpc2 re inst.exe	"BroadcastPC adware variant"
X	Brct	trdb.exe	"Detected by Kaspersky as the PURITYSCAN.Y TROJAN!"
Y	Bredbandsbolaget	servicecenter.exe	"Related to the Brebband Swedish Broadband provider"
X	Breg	bcre.exe	"BroadcastPC adware variant"
U	broadband medic	matcli.exe	"NTL's Broadband Medic. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	BroadCamRun	broadCam.exe	"BroadCam is an easy to use video streamer designed to broadcast live video using a webcam (or other camera) and microphone"
U	Broadcom Wireless Manager UI	bcmntray.exe	"Related to Broadcom Network Adapters for additional configuration options for these devices. Should not be terminated unless suspected to be causing problems"
N	Broadcom Wireless Manager UI	wltray.exe	System tray access to wireless LAN card configuration options
X	Bron-Spizaetus	CVT.exe	"Added by the RONTOKBRO WORM!"
X	Bron-Spizaetus-cfgmktoq	bbm-qotkmgfc.exe	"Added by the BRONTOK-M WORM!"
X	Bron-Spizaetus-cfgmmnru	bbm-urnmmgfc.exe	"Added by the BRONTOK-N WORM!"
X	BrowseProxy	FindService.exe	"Actual Names (AdvSearch) Internet Keywords parasite"
X	Browser Help Svc	BHSV.EXE	"Added by the RBOT-AVQ WORM!"
Y	Browser Hijack Blaster	bhblaster.exe	"Browser Hijack Blaster - protects your system from browser hijackers and spyware that alters your IE settings. Now replaced by SpywareGuard"
U	Browser Launcher	Commandr.exe	Logitech internet keyboard "Commander" software - loads the software for the shortcut keys on the keyboard. Not required unless you want to use the short cut keys
X	Browser Pal	adblck.exe	"BrowserAid/BrowserPal foistware"
X	BrowserUpdateSched	[random filename]	"ZenoSearch adware"
N	BrowserWebCheck	loadwc.exe	Checks to make sure that IE is still your default browser
X	BrO_AcT	BrO-AcT.exe	"Added by the SILLYFDC-D WORM!"
N	BsCLiP	BSCLIP.exe	CD recording utility that comes with a lot of CDR/CDRW drives and isn't required
X	BSVCHOST	SVCH0ST.EXE	"Added by the VOXOM TROJAN! Notice the digit ""0"" in the filename rather than the upper case ""o"""
U	BT Broadband Basic Help	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	BT Broadband Desktop Help	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	BT Broadband Help	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	BT00003*	abcdefg23.exe	"Added by the VB-VT TROJAN where * = 5
U	btbb_wcm_McciTrayApp	McciTrayApp.exe	"System tray access to Motive's Broadband 2.0 configuration and repair utility"
U	BtcMaestro	KMaestro.exe	Multimedia keyboard manager. Required if you use the multimedia keys
U	BTModemProtection	BTModemProtection.exe	"BT Privacy Online modem protection software
X	BtvC	btvclean.exe	"BroadcastPC adware"
Y	BufferZone	CLIENTGUI.EXE	"BufferZone from Trustware - ""is the only security software that creates a separate environment allowing you unlimited freedom to enjoy all Internet activities without the fear of external threats"""
U	bugwatcher service	bugwatcher.exe	"
X	BuildLab	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
X	BuildLabs	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
U	Bulldog Service	upsd.exe	Belkin's Bulldog Plus control software which runs under Windows 95 or later and monitors the UPS (Uninterrupted Power Supply) via a serial or USB link
Y	BullGuard XComm	XCOMMSVR.EXE	"Part of Bullguard antivirus"
?	BullsEye Tracker	BeTrack.exe	Bullseye - intelligent research assistant
X	buohxqtfswb	gcjydr.exe	"Added by the AGENT-NRC TROJAN!"
N	BurnQuick Queue	BQTray.exe	"System Tray access to BurnQuick CD burning software. Only required if you use the queueing facility
U	BuzMe	RCUI.exe	"Display Client for the BuzMe Internet Call Waiting Service"
X	Bymer.Scanner	Wininit.exe	"Added by the BYMER WORM!"
X	Bymer.Scanner	Msinit.exe	"Added by the BYMER WORM!"
?	BZEnvironmentVariableCollector	BZEnvironmentVariableCollector.exe	"Part of BlazentAgent from Blazent who provide ""outsourcing governance automation for IT Outsourcing (ITO) relationships"". What does it do and is it required?"
?	BZUtilizationCollector	BZUtilizationCollector.exe	"Part of BlazentAgent from Blazent who provide ""outsourcing governance automation for IT Outsourcing (ITO) relationships"". What does it do and is it required?"
X	c	c:archiv~1win.com	"Added by the CUYDOC TROJAN!"
U	C-Media Echo Control	EchoCtrl.exe	C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. You may need it if you use the echo control feature of C-Media Mixer
N	C-Media Mixer	Mixer.exe	C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. Provides System Tray access to change audio settings. Available via Start -> Settings -> Control Panel or Start -> Programs
U	C2K	CYB2K.EXE	CYBERsitter 2000 or 2001 - anti-adult content filter primarily. Required if you want the sites you visit filtered without having to load the software every time you launch your browser
U	c32cs2	c32cs2.exe	"Cyber Sentinel - internet filtering software"
X	C7	[path to worm]	"Added by the MEDIAKILL.A WORM!"
U	C:Program Filesdfjdkjfdkjfldjfdfjdkjfdkjfldjfwinlogin.exe	CritProc.exe	"KeyProwler keystroke logger/monitoring program - remove unless you installed it yourself!"
U	C:Program FilesNetMeterNetMeter.exe	NetMeter.exe	"""Net Meter is a small
X	C:WINDOWSasam.exe	asam.exe	"Added by the PEACOMM.E TROJAN!"
X	C:WINDOWSIEXPLOR.EXE	IEXPLOR.EXE	"""Pop Marketing"" adware"
X	C:WINDOWSsystem32SetupCmd.exe	SetupCmd.exe	"Detected by Kaspersky as the AGENT.AAW TROJAN!"
X	C:WINDOWSWinTask.exe	WinTask.exe	"""Pop Marketing"" adware"
U	CA-AMAgent	amagent.exe	"Unicenter Asset Management is a solution for proactively managing IT assets in a business environment. It provides full-featured asset tracking capabilities through automated discovery
Y	CaAvTray	CAVTray.exe	"eTrust™ EZ Antivirus system tray application from Computer Associates"
X	Cabchk	Cabchk.exe	"Added by the GEMA TROJAN!"
X	Cabchk32	Cabchk32.exe	"Added by the GEMA TROJAN!"
X	CABCInstall	CABCInstall.exe	"Ignite Technologies (was CABC) content delivery software"
X	Cable Modem Adapter	WindowsSec.exe	"Added by the WOOTBOT.A WORM!"
U	CacheBoost	trayicon.exe	"CacheBoost ""optimizes the System Cache-Management of Windows XP/2000/NT and Windows .Net Servers
X	CacheLoader	[path to trojan]	"Added by the DLOADER-NZ TROJAN!"
N	Cacheman	Cacheman.exe	"Freeware disk cache tweaker from Outer Technologies. Should only be run once and not loaded at start-up"
Y	CacheMgr	CacheMgr.exe	"Sophos Antivirus Remote Update"
U	CacheSentry Pro	CacheSentry Pro.exe	"""CacheSentry Pro is a program that takes over the management of the Internet Explorer (and AOL) web browser cache"""
N	CACStarter	cacstart.exe	Cash A Check - check writing software
U	Caddais BackupOnDemand	BODMon.exe	"Caddais BackupOnDemand - "runs in the background and monitors your important files for changes. Within seconds of changing
U	Cadenza	CdzSvc.exe	"Cadenza mNotes for Palm and Pocket PC enables users to access Lotus Notes on their mobile devices"
U	CADS	cads.exe	"Cyber Sentinel - internet filtering software"
U	CafeStation	CafeStation.exe	"""CafeSuite is the solution for your internet cafe. Our software provides you with ameans to control the workstations
Y	cafwc	cafw.exe	"CA Personal Firewall - part of the CA Internet Security Suite"
N	CAgent	CAgent.exe	"Abbyy Fine Reader OCR (Optical Character Recognition) software for scanning and converting documents"
X	cAgOu	[filename].hta	"Added by the KAKWORM WORM!"
N	CahootWebcard	CahootWebcard.exe	"""The Cahoot Webcard is a virtual card that allows you to use your Cahoot credit card online without ever having to expose your real card numbers over the web. It works by generating one-off transaction numbers as a substitute for your real cahoot credit card details"". Run manually when needed"
X	caidiysetup	diynetsetupuni.exe	"DIYNet adware"
Y	CAISafe	isafe.exe	"Part of Computer Associates eTrust EZ Antivirus"
U	CaISSDT	caissdt.exe	"Computer Associates Dashboard Tray applet"
N	Cal Reminder Shortcut	calrem.exe	Produces a pop-up reminder of events scheduled using the MS Office Calendar
X	calc	"rundll32.exe [path] ntuser.dll	_IWMPEvents@0"
X	calc	"rundll32.exe calc.dll	_IWMPEvents@0"
X	Calc Microsoft Windows	wincalc.exe	Added by an unidentified WORM or TROJAN!
X	CALC32	CALC32.EXE	"Added by the SPYBOT-EC WORM!"
U	Calendar	Calendar.exe	"This entry can be added by PlainSight Desktop Calendar and older versions of Desktop iCalendar from Desksware and the older Calendar 200X - which is no longer supported by or available from the author"
?	Calendar 200X Monitor	calmonitor.exe	"Background task for Calendar 200X by Joel Graffman - which is no longer supported or available from it's author. The exact purpose of this startup entry is unknown at present but it appears to be related to the Calendar 200X Reminder entry - as disabling that entry via the program also disables this one"
N	Calendar 200X Reminder	calendar.exe	"Part of Calendar 200X by Joel Graffman - which is no longer supported or available from it's author. Displays reminders for holidays
?	Calendar Monitor	calmonitor	"Background task for Calendar 200X by Joel Graffman - which is no longer supported or available from it's author. The exact purpose of this startup entry is unknown at present"
U	Calendarscope	cs.exe	"Calendarscope calendar software"
X	calk	calk.exe	"Added by the STARTPA-FH TROJAN!"
X	Call Function System32	sddriver.exe	"Added by a variant of the SDBOT TROJAN!"
X	Call32	Call32.exe	"Added by the SPAMMIT-H TROJAN!"
Y	CallBumping	cbpopw.exe	"Related to the Gazel 128 PCI ISDN adapter. Required if you use it"
U	CallCenter Main Application	V3calmcp.exe	"""V3 Inc. CallCenter is a free 32-bit
U	CallCenter Printer Interface	V3faxecp.exe	"""V3 Inc. CallCenter is a free 32-bit
N	CallControl	ftctrl32.exe	"FaxTalk Messenger Pro is a Windows TAPI based 32-bit application. When installed
?	calmonitor	calmonitor.exe	"Background task for Calendar 200X by Joel Graffman - which is no longer supported or available from it's author. The exact purpose of this startup entry is unknown at present but it appears to be related to the Calendar 200X Reminder entry - as disabling that entry via the program also disables this one"
?	calmonitor	calmonitor	"Background task for Calendar 200X by Joel Graffman - which is no longer supported or available from it's author. The exact purpose of this startup entry is unknown at present"
N	CamCheck	CamCheck.exe	"NuCam camera software related"
U	Cameno	Cameno.exe	"Cameno is a program which brings tabbed windows to MSN Messenger 6.0 and above"
U	Camera Assistant Software	traybar.exe	Camera Assistant Software utility for Toshiba laptops - allows you to take pictures with and control the integrated WebCam
U	Camera Detector	CAMDET~*.EXE	"ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically"
U	Camera Detector	Camdetect.exe	"ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically"
U	Camera Detector	DEVDET~*.EXE	"ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically"
?	CameraApplicationLauncher	CameraApplicationLaunchpadLauncher.exe	"Supports the integrated webcam on IBM/Lenovo Thinkpad notebooks. What does it do and is it required?"
U	CameraAssistant	CameraAssistant.exe	"Entry added when you install versions of the Logitech QuickCam webcam software and used to configure and tweak your webcam settings. Includes support for the Quick Assistant - which launches when a video application (such as video conferencing in an instant messaging client) accesses to camera so you can quickly fine tune face tracking and zoom
N	Camio Viewer x	IXApplet.exe	Image viewing program that comes with digital cameras. Shows pictures that are in the camera before downloading them. "x" in the name is the version
?	CamMonitor	hpqcmon.exe	"From HP and related to digital imaging"
Y	CamWizard	CamWizrd.exe	Launches the Logitech Camera Wizard on the first reboot after installing versions of Logitech QuickCam webcam software
N	Canada	Canada.exe	"Known to be a dialler - but is it maliscous or clean?"
U	Canary	canary-std.exe	"Canary keystroke logger/monitoring program - remove unless you installed it yourself!"
X	candy	command32.exe	"Added by the RBOT-LV WORM!"
X	candynet	Taskmsg.exe	"Added by the RBOT-NA WORM!"
U	CANoe	CANoe32.exe	"CANoe from Vector Informatik. Development and test tool for Engine Control Units (ECU) based upon the CAN
U	Canon MultiPASS Status Monitor	monitr32.exe	Cannon Multi-Pass status monitor - your choice
?	Canon PC1200 iC D600 iR1200G Status Window	CAPM1LAK.EXE	"Cannon printer related - is it required in startup?"
N	Canon Printer Monitor BJCxxx	Cjstlst.exe	Trayicon for Canon printer. xxx denotes model. Available via Start -> Programs
U	CanonMyPrinter	BJMyPrt.exe	Printer software for Canon Bubblejet printers
U	CanonSolutionMenu	CNSLMAIN.exe	"
?	CAP3ON	CAP3ONN.EXE	"Canon driver
Y	capfasem	capfasem.exe	"CA Personal Firewall - part of the CA Internet Security Suite"
N	Capfax	capfax.exe	"PhoneTools fax software"
U	capfupgrade	capfupgrade.exe	"CA Personal Firewall - part of the CA Internet Security Suite"
U	CAPing	CAPing.exe	Citibank Citianywhere software
Y	Capon	Capon.exe	Canon printer driver
Y	Capon	Caponn.exe	Canon printer driver
X	Captcha7	rundll captcha.dll	"Added by the TINY.WRE TROJAN!"
X	CaptionMgr32	crssr.exe	"Added by the ZAR.A WORM!"
X	capture	capture.exe	"Added by the THEEF-B TROJAN!"
N	Capture Express 2000	capexp.exe	"Capture Express - screen capture utility"
U	CaptureAssistant	CaptureAssistant.exe	"Capture Assistant ""is a convenient and easy-to-use text and graphics capture tool"". It allows you to capture text
N	CaptureBat	Capture.exe	"!Quick Screen Capture from EtruSoft Inc. - ""allows you to take screenshots from any part of your screen in more than 10 ways
N	Carbonite Backup	CarboniteUI.exe	"""Carbonite's online backup service starts automatically and works quietly and continuously in the background protecting your data"""
N	Card Monitor	REGCNT09.exe	For the USB connection on a Panasonic PV-DV701 Digital Camcorder. Available via Start -> Programs
?	CardScan AutoSync	CSyncCfg.exe	"Related to the CardScan business card reader range of products. May be related to synchronization with E-mail software and mobile devices (see here)?"
X	Care20	Care20.exe	"TopMoxie adware"
U	Care2GTU	Care2GTU.exe	"Care2 Green Thumbs-Up (from the Care2 site). Every online purchase helps environmental causes; tells you how eco-friendly a company really is
U	carpserv	carpserv.exe	"Associated with Zoltrix and Conexant modems - enables the internal modem speaker
X	CARPserver	CARPserver.exe	"Added by the BANKER-AN TROJAN!"
U	CARPservice	carpserv.exe	"Associated with Zoltrix and Conexant modems - enables the internal modem speaker
X	cartao	[path to file]	"Added by the DLOADER-QD TROJAN!"
X	cartao	conflicted.exe	"Added by the DADOBRA-DV TROJAN!"
X	cartao	killing.exe	"Added by the DLOADER-QN TROJAN!"
X	cartao	cartao.exe	"Added by the BANKER-FA TROJAN!"
X	CAS Client	casclient.exe	"CasinoClient adware"
X	Cas2Stub	cas2stub.exe	"CasinoClient adware"
U	CasAgnt	CasAgnt.exe	Program by Extended Systems which allows you to sync your Casio PDA with your PC
X	Casdvqwa	bmqnzkg.exe	"Added by the RANDEX.BE WORM!"
X	caseyvideo	caseyvideo.exe	Malware causing adult content popups
X	caseyvideo[*] [* = digit]	caseyvideo[*].exe [* = digit]	Malware causing adult content popups
X	CashBack	cashback.exe	"Part of eXact Advertising Software
X	CashFiesta	Cashfiesta.exe	"CASHFIESTA.A pay-per-surf adware"
N	Cashsurfers Cashbar Navigator	Cashbar.Exe	"Cashsurfers CashBar Navigator - ""The CashBar rotates banner advertisements once per minute and provides you with access to up to date special offers and deals"""
X	CashToolbar	MSCStat.exe	"Added by the DOWNLOADER-MY TROJAN!"
X	CashToolbar	svchost.exe	"BrowserAid/CashToolbar adware! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Casino Royale	jamesbond.exe	"Added by the RBOT-FZO WORM!"
X	Cassandra	[10 to 14 random char]THD.EXE	"Added by the KREPPER-AI TROJAN!"
X	Cassandra	cassandra.exe	"SuperSpider hijacker - a CoolWebSearch parasite variant. Also detected as a variant of the KREPPER TROJAN!"
X	CasStub	casstub.exe	"Added by the CASS-A TROJAN!"
X	Catalyst Control Centre	atixvdm.exe	"Added by the RBOT.DMW TROJAN!"
X	catsrv	catsrv.exe	"Added by the PAPLOK TROJAN!"
Y	CAVRID	CAVRID.exe	"eTrust™ EZ Antivirus Real Time Infection Report from Computer Associates"
Y	CAVS	CAVS.exe	"Cheyenne (now eTrust) antivirus"
X	CAZNOVAS	CAZNOVAS.exe	"Added by the CAZNO TROJAN!"
X	CBACK.EXE	CBACK.EXE	"Added by the PENTA-A TROJAN!"
U	cbInterface	cbInterface.exe	"System Tray access to Cobian Backup versions 8 thru 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
X	cbvcs	urretnd.exe	"Added by the FRETHOG-C WORM!"
U	CBWAttn	CBWAttn.exe	"Required for Bitware to answer incoming faxes
U	CBWHost	CBWHost.exe	"Required for Bitware to answer incoming faxes
?	CBWUser	CBWDial.exe	"Associated with Bitware that integrates fax
X	CC2KUI	comet.exe	"Comet Cursor adware"
X	ccagent.exe	ccagent.exe	"Control Center and Control Components rogue security software - not recommended
X	Ccao	regedit.exe	"Probably a variant of MediaTickets adware. Note - this is not the valid Windows registry editor which resides in %Windir% and will not figure in Msconfig/Startup! This version resides in a ""mduu"" subfolder
Y	ccApp	ccApp.exe	"Part of earlier versions of Norton AntiVirus - Auto-protect and E-mail check will not function without this"
X	ccApp	[random filename]	"Added by the OBSORB TROJAN! Note the random filename compared to the valid Norton AntiVirus"
X	ccApp	WMADZ.EXE	"Added by the RBOT-LJ WORM!"
X	ccApp	.EXE	"Added by the RBOT-LJ WORM!"
X	ccApp	gcasServ.exe	"Added by a variant of the RBOT WORM! Do not confuse with the Microsoft AntiSpyware executable of the same name"
X	ccApp	example.exe	"TwoSeven spyware"
X	ccAppr	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccAppr	expIorer.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccAppr	outIook.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccAppr	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccApps	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
X	ccApps	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	ccApps	N/A	"Added by the KANGAROO-A TROJAN!"
X	ccApps	ccApps.exe	"Added by the KANGAROO-B WORM!"
X	ccctp	HistoryJMTi.exe	"Added by the GANBATE.A WORM!"
U	CCD Manager	DDS.EXE	"Project Labs Century CD manager for their CD/DVD storage device"
N	Ccdecode	"rundll32.exe streamci	StreamingDeviceSetup"
X	ccDHCP32	ccDHCP32.exe	"Added by the AGOBOT-HJ WORM!"
Y	CCDoctorLogonTesting	ccdoctor.exe	"Checks your system to make sure it's configured properly for running IBM Rational ClearCase
Y	ccenter	CCenter.exe	"RAV AntiVirus"
Y	CcEvtMgr	ccEvtMgr.exe	"Part of Norton AntiVirus 2003. Event manager for scheduling weekly scans and or automatic virus updates. Used to start automatically via ""ccApp"" and was not required as a seperate entry but a recent update changed this"
X	ccEvtMrg.exe	ccEvtMrg.exe	"Added by the RBOT.GZ WORM!"
X	ccExecute	bootcfg1.exe	"Added by the NEMSI-B VIRUS!"
X	ccHelp	ccHelp.hta	"Searchq adware"
U	CCleaner	CCleaner.exe	"CCleaner from Piriform Ltd. - ""is a freeware system optimization
X	ccpApps	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	ccpApps	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
U	ccProxy	CCPROXY.EXE	"Part of Norton Internet Security
X	ccPrxy.exe	ccPrxy.exe	"Added by the SHIPUP-H WORM!"
Y	CcPxySvc	CCPXYSVC.exe	"Part of Norton's AntiVirus 2003
X	ccreg	explorer.exe	"Added by the ZCREW BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
Y	ccRegVfy	ccRegVfy.exe	"Part of earlier versions of Norton AntiVirus - ""ccRegVfy.exe is responsible for checking the integrity of the NAV registry entries to make sure that the information has not been changed by a malicious threat or a hack"""
X	ccRegVfY	expIorer.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccRegVfY	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccRegVfY	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccRegVfY	outIook.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccrss	msdtc.exe	"Added by the STAP-C WORM!"
Y	ccSetMgr	ccSetMgr.exe	"Part of Norton AntiVirus 2004. What does it do?"
X	ccStart	ccStart.exe	"Added by the AGOBOT-IR WORM!"
X	ccStart	ccInfo.exe	"Added by the AGOBOT-GQ BACKDOOR!"
X	ccSvcHst.exe	ccSvcHst.exe	"Added by the SDBOT-DIW WORM!"
X	ccsvit.exe	ccsvit.exe	"Added by the STARTPA-HP TROJAN!"
U	cctray	cctray.exe	"Part of CA Internet Security Suite"
X	ccUpdate	ccUpdate.exe	"Added by the AGOBOT.YS WORM!"
U	ccUpdMgr	ccUpdMgr.exe	"In Loco Parentis remote surveillance software. Uninstall this software unless you put it there yourself!"
U	CCUTRAYICON	CCU_TrayIcon.exe	"Related to Traybar Launcher from Intel Corporation belonging to Intel® Viiv®"
U	ccWasher	aolwasher.exe	"Webroot Cache & Cookie Washer - cleaning browser tracks
U	CCWC7a	ac.exe	"Moleculesoft Cache
U	CCWC7I	idxl.exe	"Moleculesoft Cache
U	CCWC7s	stealth.exe	"Moleculesoft Cache
Y	CCWinTray	wintmr.exe	"System Tray access to Child Control parental control software by Salfield"
N	CD Storage Master	cdstorager.exe	"CD Storage Master - a program designed to catalog CD information
U	CD-DVD Lock for Win95/98/Me/2k/XP	CDVAgent.exe	"Loads CD-DVD Lock from Ixis Research
X	cd1	cd1.exe	Premium rate adult content dialler
N	CDANTSRV	CDANTSRV.exe	"C-Dilla License Management software. Used for any program that uses C-dilla Protection
X	Cdcompat	Cdcompat.exe	"Added by the GEMA TROJAN!"
X	cddrv32	cddrv32.exe	"Added by a variant of the CRYPTER.C TROJAN!"
N	CDInterceptor	cdi.exe	CD indexer for measuring the speed of CD players
Y	cdloader	cdloader2.exe	"From MagicJack - ""A softphone device that allows you to attach an analog phone into the PC so you can have a traditional-style phone system in your house without any monthly charge"""
U	CDLoader	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
X	cdmmslpo	klpllsm.exe	"Added by the TEDIJINI-A TROJAN!"
X	CdnCtr	cdnup.exe	"CNNIC Update pest"
X	cdoosoft	herss.exe	"Added by the SILLYFDC.BCT WORM!"
X	cdoosoft	olhrwef.exe	"Added by the AUTORUN-AAG WORM!"
X	CDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	CDriver	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
X	Cdrom Controller	cdromcntrl.exe	"Added by the BATTRY-A TROJAN!"
X	cds	cds.exe	"Added by the SPYMON TROJAN!"
X	CDSpeed.exe	CDSpeed.exe	"Added by the IRCBOT.AEX BACKDOOR!"
N	CDTray	CDTray.exe	"On HP PCs
U	CDVAgent	CDVAgent.exe	"Loads CD-DVD Lock from Ixis Research
U	CeEKEY	CeEKey.exe	Hot Key utility included on Toshiba Satellite laptops
U	CeEPOWER	cepmtray.exe	"Toshiba's Power Management Utility - allows the user to setup different profiles for both AC power and Battery Power on laptops. Contols CPU speed
?	Ceic	Ceic.exe	"??"
X	Cekirge	[path to worm]	"Added by the KERGEZ.A WORM!"
X	center	[random name]32.exe	"Added by the BOFRA.A WORM!"
X	CentralProcessor	taskimgr.exe	"Added by the BANCOS.J TROJAN!"
?	CEPA	wsot.exe	"??"
X	Cerb	DivXx.exe	"Added by the KEYLOG-LV TROJAN!"
U	CertificateRegistration	SafeSignCertReg.exe	SafeSign Certificate Registration Utility for Microsoft Crypto applications
U	CertReg	certreg.exe	"Related to Gemplus Card Reader"
Y	CertStoreInit	CertStoreInit	"Aladdin eToken authentication and password management"
Y	certtool	certtool.exe	"Part of Client Security Software for IBM\Lenovo notebooks. If you have configured the software via the associated wizard this will need to be running if you want to mount password protected areas of the disk (created with SafeGuard PrivateDisk)
N	CesarFTP FTP Server	server.exe	"CesarFTPd - FTP server"
X	cesmain.dll	"Rundll32.exe [path] cmail.dll	Rundll32"
X	CEventMgr	Cell.exe	"Added by the BIFROSE-AK TROJAN!"
N	CFD	CFD.exe	"BroadJump Client Foundation. Broadband troubleshooting software installed by various companies. Not required and you can remove it via Add/Remove programs"
X	CFDStart	WinMuschi.exe	"WINMUSCHI dialler"
N	cfFncEnabler.exe	cfFncEnabler.exe	"Toshiba ""Config Free"" wireless network manager on their range of laptops"
X	cfgboost	cfgboot.exe	Added by an unidentified WORM or TROJAN!
Y	cfgintpr	cfgintpr.exe	"Configuration Interpreter - part of Tiny Personal Firewall V4"
X	cfgmgr51	"RunDLL32.EXE cfgmgr51.dll	DllRun"
X	cfgmgr52	"RunDLL32.EXE cfgmgr52.dll	DllRun"
N	cfgwiz	cfgwiz.exe	"Introduced with Norton Anti-Virus 2002
U	CFi ShellToys Utility Manager	CFiShlMan.exe	"Manager for CFi ShellToys from Cool Focus International Ltd - which ""puts all the tools you need right where you need them - just a click away on your context menu. Right-click one or more files or folders
?	cFosDNT	cFosDNT.exe	"cFos DSL Modem driver related. What does it do and is it required?"
?	cFosInst_Check	cfosinst.exe	"cFos DSL Modem driver related. What does it do and is it required?"
U	cFosSpeed	cFosSpeed.exe	"cFos Software Internet acceleration program related. Note - may be necessary for the software to work properly"
U	CFSServ.exe	CFSServ.exe	Belongs to Toshiba's configfree utility and searches for Wireless Devices
X	cftmon	sfcmonit.exe	Added by a variant of the AGENT.ERG TROJAN!
X	cftmon	WindowsUpdate.exe	"Added by the AGENT.AQK BACKDOOR!"
X	cftmon32	taskmgr*.exe [* = number]	"Added by the SOWSAT.C and SOWSAT.J WORMS!"
X	Cftmon32	afd.exe	"Added by the AUTORUN-AUB WORM! The ""afd.exe"" file is located in %Windir%"
X	Cftmon32	afd.exe	"Added by the SCAR.AYWK TROJAN! The ""afd.exe"" file is located in %AppData%"
X	cfy	cfy.exe	"Surfenhance.com SearchForIt adware variant"
X	CGI Firewall Script	CGIAGENT.EXE	"Added by the BROPIA-U WORM!"
U	CGServer	cgserver.exe	"Associated with an Eicon Networks ISDN or ADSL modem. Call Guard Server (CGserver) watches your modem and blocks incoming or outgoing calls. You need cgard.exe (from Startmenu) to configure cgserver with rules and telephone numbers. Good against unwanted dialer programs"
X	Cgtask Services	cgtask.exe	"Added by the LALA.B TROJAN!"
X	Cgywin	cgywin32.exe	"Added by the RBOT-AEI WORM!"
U	ChamClock	ChamClock.exe	"Chameleon Clock - system tray clock replacement"
X	change-me-now	msgfix1.exe	"Added by the SDBOT.ZD WORM!"
U	ChangeICON	SPMSMON.EXE	Card reader related program. Note - may cause problems with My Computer loading at startup. Disabling through MsConfig seems to solve the problem
?	ChangeLines	chngline.exe	"??"
X	ChansonsMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
Y	Charter High-Speed Security Suite	fspex.exe	"Charter High-Speed Security Suite - security software in collaboration with F-Secure"
X	Chat login	chatlogin.exe	"Added by the ANTINNY.F WORM!"
N	Chatango	Chatango.exe	"Chatango - ""allows people to be connected in real time through their Web browsers. Include your Chatango contact link or button when you create eBay auctions
U	ChatStat	ChatStat.exe	"ChatStat from ChatStat Technologies
N	Chcenter	chcenter.exe	"IMSI HiJaak - ""the easiest way to convert
X	Chckup	Netverchk.exe	"Covert Sys Exec malware variant"
X	chcp.exe	chcp.exe	"Added by the SDBOT.BMH BACKDOOR!"
X	che32	che.ocx.vbs	"Added by the ADENU-B VIRUS!"
X	Cheatle	GigaByte.exe	"Added by the SHODI.B VIRUS!"
U	cheatmonitor	start.exe	"CheatMonitor surveillance software. Uninstall this software unless you put it there yourself"
X	Check	Check.exe	"Added by the VB-DRN WORM!"
N	Check for One Touch Update	wiseupdt.exe	Checks for updates for Visioneer OneTouch scanners
N	Check for TWS Updates	WiseUpdt.exe	Interactive Brokers - check for update to their standalone Java-based trading platform
U	Check Messenger	cmesseng.exe	Check Messenger from Qchex.com - program that helps you manage the activity of your Qchex account. Qchex appear to be no longer in buisness
U	Check&Get	Check&Get.exe	"Check&Get from ActiveURLs. Manages your browser bookmarks and favorites. Monitors Web sites for changes and updates
N	CheckCustomWorksUpdate	CheckCWupdate.exe	"Update checker
U	CheckDialer	ChkDial.exe	"Added by the CheckDialer modem connection monitoring tool"
X	Checkdisk	mscas.exe	"Added by the VAGON-A TROJAN!"
X	CheckFaultKernel	mswdm.exe	"Added by the SMALL-CSK TROJAN!"
U	CheckIt	ToolBox.exe	"CheckIt Toolbox from
U	CheckIt 86	CheckIt86.exe	"CheckIt 86 popup blocker"
Y	CheckMsgPlus	"MsgPlusH.dll	VerifyInstallation"
X	checkrun	elite***32.exe [* = random char]	"EliteBar adware"
X	checkrun	elitelsj32.exe	"Added by the MULTIDR-ER TROJAN!"
X	CheckScan32	regload16.exe	"Added by the AEBOT.K WORM!"
?	checktime	ct.exe	"Found in the HPSelectFrontend directory on a HP machine. What is it's purpose and is it required?"
Y	CheckVCR	IOMagic.exe	"Driver for the I/OMagic Personal Video Recorder (DR-PCTV100)"
X	CheckWinPerf	perfinfo.exe	"Added by a variant of the IRCBOT TROJAN!"
U	CherryKeyMan	KeyMan.exe	"Multimedia keyboard manager for the Cherry keyboard series. Only required if you use any of the special keys"
X	chiCkie	chiCkie.exe	"Added by the CHIKO WORM!"
U	ChicoSys	webtmr.exe	"Child Control parental control software"
U	ChikkaDefault	ChikkaLauncher.exe	"Chikka PC text messanger and IM client"
U	ChilyClient	ChilyClient.exe	"Chily Employee Activity Monitoring surveillance software. Uninstall this software unless you put it there yourself"
X	china11msn	CHINA11MSN.EXE	"Added by the ENVID.O WORM!"
X	Chinagnq	vasdd.exe	"Added by the SDBOT-SE WORM!"
U	ChineseStar	cstar.exe	Chinese language support software
U	CHIPDRIVEPinManager	sokscmpn.exe	"ChipDrive Smartcard software"
U	CHIPDRIVESmartcardManager	SCMgr.exe	"ChipDrive Smartcard software"
X	CHK Disker	chkdsker.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	CHK NT	chkntf.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
N	CHKADMIN	CHKADMIN.EXE	"Compaq Network Management System. When running
X	ChkDisk	chk_disk.exe	Added by an unidentified WORM or TROJAN!
X	chkdrv	iemon.exe	"Detected by Symantec as the ADCLICKER TROJAN!"
X	chkdsk	autoexec.bat	"Added by the ANPES WORM!"
U	ChkMail	ChkMail.exe	Mail-checking program supplied with Acer notebooks
U	ChoiceMail	CHOICEMAIL.EXE	"ChoiceMail from DigiPortal Software. Block spam with an Email firewall"
X	Choke	Choke.exe -blahhh	"Added by the CHOKE WORM!"
X	chope	runlli32.exe	"Added by the QQPASS-U TROJAN!"
X	chostsv	chostsv.exe	"Added by the BANPAES.C TROJAN!"
U	CHotKey	mhotkey.exe	"Enables special keys on Chicony keyboards. Special combinations include Internet
U	CHotKey	MK9805.EXE	"Enables special keys on Chicony keyboards. Special combinations include Internet
U	CHotKey	zHotkey.exe	"Enables special keys on Chicony keyboards. Special combinations include Internet
N	Christmas Music Player	TTEST6.EXE	"Christmas Music Player brings the music of the Christmas Holiday to your desktop"
?	ChromeMark	keysh.exe	"Related to this. Don't know what keysh.exe does though and if it's required"
?	ChronitelInitTV	CHTVINIT.EXE	"??"
U	chrono	chrono.exe	"Chronograph is a simple utility that synchronizes internal computer clock to the atomic time. Chronograph automatically maintains correct time using atomic clock servers of the National Institute of Standards and Technology (NIST)."" Shows seconds and shows the date without having to hover the mouse. Shows a calendar when hovered over"
X	Ci Servs	SysTuwin.exe	"Added by the AGENT-NIQ TROJAN!"
X	Ci Svr	cisvr.exe	"Added by the IRCBOT.AWN BACKDOOR!"
X	ci1gnt	ci1gnt.exe	"Detected by Kaspersky as the AGENT.DHU TROJAN!"
X	CiaBackdoor	msldr.com	Added by a VIRUS!
X	cihost.exe	cihost.exe	"Added by the LINST TROJAN!"
N	CIJxP2PSERVER	CIJxP2PS.EXE	"Compaq printer utility which is required in order to make the printer work correctly - "x" depends upon the model
Y	Cingular Communication Manager	CingularCCM.exe	"Cingular Communication Manager - now taken over by AT&T. ""provides a robust set of wireless communication tools for businesses and individuals. With wireless access to email
X	Cinnabd Prompt32	CmdPrompt32.pif	"Added by the ASSIRAL-B WORM!"
N	CIO	che7e1~1.exe	"ChatItOut webcam chat program"
X	Ciodiag	DECCONF.EXE	"Added by the STRAT.EL TROJAN!"
X	CirebonPunya	XXrocks.exe	"Added by the BHARAT.A WORM!"
X	Cisco Systems	[path to worm]	"Added by the AUTORUN.UHR WORM!"
U	Cisco Systems VPN Client	ipsecdialer.exe	"Cisco VPN Client - lets local users gain Administrator privileges on the operating system"
U	Cisco Systems VPN Client	vpngui.exe	"Sets up IPSec communications for Cisco's VPN Client"
N	CISrvr Program	CISRVR.EXE	Related to internet setup on Compaq PC's
X	Cissi	Cissi.exe	"Added by the CISSI.A WORM!"
U	CitiUCS	CitiUCS.exe	"Citibank Virtual Account Numbers - ""With this free service for Citi cardmembers
N	CitiVAN	CitiVAN.exe	"Option from Citibank to change a credit card number in a random fashion for each purchase. The number will only be used once and never again"
X	cjb	cjb.exe	"Added by the AGENT.ALZE TROJAN!"
X	cjb	cjb*.exe	"Added by a variant of the AGENT.ALZE TROJAN - where * is a random digit and the file is located in %ProgramFiles%\cjb"
X	CJET	CJet.exe	"FFToolBar adware toolbar"
Y	Cjstcom	Cjstcom.exe	Canon printer BJ status language monitor
Y	ClamWin	ClamTray.exe	"ClamWin antivirus"
X	Classes	int1.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	intl.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	run_21.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	srv.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	srv2.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	MSTAR2.EXE	"""Switch"" premium rate adult content dialler variant"
X	Classes	mstart.exe	"""Switch"" premium rate adult content dialler variant"
U	ClauerUpdate	ClUpdate.exe	"Automatic updates for the software supporting the Clau-ACCV and Clauer-idCAT digital certificate USB keys"
X	clcbt.exe	clcbt.exe	"Added by the AGENT.CBA TROJAN!"
X	clcl3	clcl3.exe	Added by the AGENT.ES TROJAN!
X	clcl7	clcl7.exe	"Added by a variant of the Covert Sys Exec TROJAN!"
U	CLCLSet	CLCL.exe	CLCL clipboard caching utility
N	Clean Access Agent	CCAAgent.exe	"Cisco Clean Access Agent from Cisco Systems
X	Clean Mgr	cleanmg.exe	"Added by the IRCBOT.BBO BACKDOOR!"
X	Clean up	service.exe	"Added by the AGENT-FPY TROJAN!"
X	Cleanator	Cleanator.exe	"Cleanator rogue privacy program - not recommended
?	CleanEasyImg	cleanall.exe	"??"
X	Cleaner2009 Freeware	UCLN.exe	"Cleaner2009 rogue privacy program - not recommended
X	CleanPCTool	SysRep.exe	"CleanPCTool rogue system error and cleaning utility - not recommended
?	CleanRegPath	CleanReg.exe	"Apparently Annex A ADSL modem related. What does it do and is it required?"
U	CleanSweep Smart Sweep- Internet Sweep	Csinsm32.exe	Automatic logging of installs from Norton CleanSweep - available via Start -> Programs
N	CleanSweep Useage Watch	CSUSEM32.EXE	Quarterdeck/Norton CleanSweep component - tracks how often you use files and alerts you to files that have not been used for a specified period of time
X	cleansweep.exe	cleansweep.exe	"Added by the AGENT-NEU TROJAN!"
U	CleanTemp	CLEANT~1.EXE	"CleanTemp - deletes the contents of the TEMP directory when Windows starts and then closes - using no memory"
U	CleanTemp	CleanTemp.exe	"CleanTemp - deletes the contents of the TEMP directory when Windows starts and then closes - using no memory"
N	Cleanup	ONICTASK.EXE	"Internet Cleanup from Allume Systems (used to be by OnTrack) - cleans up tracks left by browsing the internet"
Y	CleanUp	mcappins.exe	Used by older versions of McAfee internet security related products to clean up installation files that are no longer required once the product is installed. This entry will normally only appear once the product has been installed before the system is rebooted
Y	CleanUp	CleanUp.exe	"Utility that only runs once after installing the drivers for Analog Devices SoundMax integrated soundcards to clean-up the files no longer required once the installation is complete. Other programs/drivers may use the same filename for the same purpose. In this case
X	CleanUp Antivirus	CU[random characters].exe	"Cleanup Antivirus rogue security software - not recommended
?	CleanupProgram	cleanup.exe	"Sony Vaio related - what does it do and is it required? Located in a C:\Sonysys folder"
X	CleanupTool	SysRep.exe	"CleanupTool rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
X	clean_service	clean_service.cmd	"Added by the REFAZ WORM!"
U	CleverKeys	CK.exe	"CleverKeys - ""is free software that provides instant access to definitions at Dictionary.com
X	clfmon	clfmon.exe	"Added by the TACTSLAY.E TROJAN!"
X	clfmon	nvsvca32.exe	"Added by the TACTSLAY.E TROJAN!"
X	clfmon.exe	clfmon.exe	"Added by the AGENT-BJ TROJAN!"
X	Cli Confg	cliconfig.exe	"Added by a variant of the SPYBOT WORM! See here"
X	CLI Services	clisrv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
N	Click Radio Tuner	clickr~1.exe	"ClickRadio - subscription service playing radio music via the internet"
N	Click Tray Calendar	ClickT~1.EXE	"ClickTray Calendar - shows holidays
N	ClickMe	ClickMe.exe	"ClickM ""JOKE"" program"
U	Clickoff	Clickoff.exe	"Clickoff automatically dismisses annoying dialog boxes"
N	ClickSight Launcher	cs.exe	"Launcher for the ClickSight® marketing tool from ClickStream Technologies - which ""is a patented data-collection technology that helps independent software vendors understand the current and future usage of their product"""
X	ClickTheButton	CTB.EXE	"ClickTheButton adware"
X	ClickTheButton	csrss.exe	"ClickTheButton adware. Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	ClickTheButton	cd_load.exe	"Added by the DOWNLOADER-MY TROJAN!"
X	CLICONFG	CLICONFG.EXE	"Added by the OPASERV.T WORM!"
U	Client Access API Daemon	cwbappcd.exe	"IBM iSeries Client Access
N	Client Access Check Version	cwbckver.exe	"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
?	Client Access Express Welcome	cwbwlwiz.exe	"Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
N	Client Access Help Update	cwbinhlp.exe	"Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
N	Client Access Service	CwbSvStr.Exe	"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
U	Client Access Taskbar	cwbuitsk.exe	"IBM iSeries Client Access taskbar
X	Client Agent	ipxwping.exe	"Added by the PPDOOR-N TROJAN!"
X	Client Agent	photes.exe	"Added by the PPDOOR-P TROJAN!"
X	Client Agent	[path to file]	"Added by the PPDOOR-J TROJAN!"
?	Client agent for ARCserve	W95AGENT.EXE	"Part of Brightstor ARCserve Backup from Computer Associates. What does it do and is it required?"
X	Client for Microsoft Networks	msclient32.exe	"Added by the SDBOT-BXQ WORM!"
N	Client Security Solution	cssauth.exe	"Part of Thinkvantage Client Security Solution for Lenovo ThinkPad notebooks and ThinkCentre desktops. Once configured via the associated setup screens this loads via winlogon.exe (and loads the password manager) and therefore disabling this entry has no effect"
X	Client Server Control Process	[path to trojan]	"Added by the AGENT-HR TROJAN!"
X	Client Server Run Time Proccess	csrsrv.exe	"Added by a variant of the SDBOT WORM!"
X	Client Server Runtime	[path to worm]	"Added by the POEBOT-KR WORM!"
X	Client Server Runtime Process	csrsss.exe	"Added by the SDBOT-LD WORM!"
X	Client Server Runtime Process	csrs.exe	"Added by the LINKBOT.M WORM!"
X	Client Server Runtime Process	smmss.exe	"Backdoor TROJAN! Possible SDBOT-GEN variant"
X	Client Update	wup.exe	"Added by the OPANKI.O WORM!"
Y	Cliente DLO	DLOClientu.exe	"Part of the backup suites from VERITAS - Backup Exec and NetBackup. Both have now been replaced by their Symantec equivalents since they acquired VERITAS in 2005"
X	ClientMan1	mscman.exe	"ClientMan parasite variant"
N	Clik Status Monitor	toolsclickstat.exe	Part of Iomega Tools to let you know whether an Iomega PocketZip (nee Clik) removable drive cartridge is installed
X	Clip Service Manager	clipmg.exe	"Added by the DELF.DXJ TROJAN!"
X	Clip Servicer	clipsrvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Clip Srv	clipsv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	clipboard.exe	clipboard.exe	Added by an unidentified WORM or TROJAN!
N	Clipbook Service	Clipsrv.exe	"Supports Windows XP ClipBook Viewer
U	clipdiary	clipdiary.exe	"Clipdiary from Softvoile - ""Free Clipboard Manager for keeping the clipboard history"""
N	ClipMate5x	ClipMt5x.exe	"Clip Mate 5.x by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs"
N	Clipmate6	CLIPMT60.EXE	"Clip Mate 6 by Thornsoft. Utility that allows you to store more than one item in the clipboard. Available via Start -> Programs"
N	ClipMate7	ClipMate.exe	"Clip Mate 7 by Thornsoft - utility that allows you to store more than one item in the clipboard"
N	Clipomatic	Clipomatic.exe	"Mike Lin's Clipomatic is a clipboard cache program - it remembers what was copied to the clipboard even after new data is copied
N	Clipsrv	Clipsrv.exe	"Supports Windows XP ClipBook Viewer
X	ClipSrv	clipserv.exe	"Added by the SDBOT-AAV and SDBOT-AFE WORMS!"
X	ClipSrv	CLIPBRD3D.EXE	"Added by the MOFEI-D WORM!"
X	Clipsvc	clipsv.exe	"Added by the BLACKHOLE.F BACKDOOR!"
N	ClipTrak	ClipTrak.exe	"
N	ClipTrakker	ClipTrakker.exe	"Cliptrakker - clipboard extender"
N	CLISTART	CLIStart.exe	Puts the ATI Catalyst™ Control Center Icon/Shortcut on the System Tray - available via Start → Programs
X	clkhost	[path to trojan]	"Added by the WIXUD-B TROJAN!"
U	CLMFrontPanel	clmpanel.exe	"System tray status/display/configuration utility for a number of modems. Can be disabled by right-clicking on the tray icon. If disabled
?	CLMLServer for HP TouchSmart	CLMLSvc.exe	"Found on the HP Touchsmart range of desktops and notebooks. What does it do and is it required?"
?	clnwall	"rundll.exe setupx.dll	InstallHinfSection ..delwall.inf"
X	clock	[various filenames]	"LiveChat Adware - known file names include: mssetup.exe
X	Clock Manager	amsngr.exe	"Added by the SDBOT-XM TROJAN!"
X	ClockSync	Sync.exe	"ClockSync - synchronizes your system clock with an internet time server. It's by WhenU
U	ClockWise	CLOCKWISE.EXE	"ClockWise - produced by R J Software - a time utility. It is a schedueler not only for dates
U	ClocX	ClocX.exe	"ClocX - places a clock on the desktop that can be moved and then changed into a calendar plus you can set alarms etc?"
U	CloneCD	CloneCDTray.exe	"System tray for the now discontinued CloneCD. The only useful option is ""Hide CDR Media"" only available via this tray. Has additional unknown functions in later versions"
U	CloneCDElbyCDFL	ElbyCheck.exe	"From Elaborate Bytes who make CloneCD - monitors the installed filters of CD-ROMs/DVD-ROMs. Note - under Win2K removing this from startup causes the CD drive in the computer to not be recognized in the OS and after rechecking it prompts that the driver has been corrupted and asks you to restart the computer to fix it"
U	CloneCDTray	CloneCDTray.exe	"System tray for the now discontinued CloneCD. The only useful option is ""Hide CDR Media"" only available via this tray. Has additional unknown functions in later versions"
?	Clotusorgreg0	prtStart.exe [path] Orgprt.exe	"IBM Lotus SmartSuite related. In a LotusOrgReg folder. Unclear what exactly it does?"
X	Clre	mmdc.exe	"Added by the PURSCAN-AI TROJAN!"
X	ClrSchLoader	[path to file]	"ClearSearch adware"
X	CLSID	com.exe	Adult content dialler
X	CLSID	dll.exe	Adult content dialler
X	CLSID	msgplus.exe	Adult content dialler
X	CLSID	plugin.exe	Adult content dialler
X	CLSID	sed.exe	Adult content dialler
X	CLSID	msgplus.exe	Premium rate adult content dialer. Note - this is NOT the MSN Messenger 'MessengerPlus' extension
X	CLSRSS	LSACS.EXE	"Added by the SILLYFDC-X WORM!"
X	cls_pack.exe	cls_pack.exe	"Added by the Malware Defense rogue security software. Also detected as the FAKEAV-AQB TROJAN!"
U	ClUpdate	ClUpdate.exe	"Automatic updates for the software supporting the Clau-ACCV and Clauer-idCAT digital certificate USB keys"
?	CM-SmWizard	SmWizard.exe	"SmartWizard MFC Application - associated with C-Media who produce audio chipsets commonly used for on-board sound on motherboards. What does it do and is it required?"
U	cma	cma.exe	"DeskSite CMA siftware - ""retrieves new content from the DeskSite Data Center"""
X	CMAPP	cmappclient.exe	"CasClient adware - also detected as the CMAPP TROJAN!"
N	Cmaudio	"Rundll32 cmicnfg.cpl	CMICtrlWnd"
X	Cmd	cmd32.exe	"Added by the TANKED WORM!"
X	cmd32	configs.exe	"Hijacker
X	cmd64	cmd64.exe	"CoolWebSearch Msconfd parasite variant"
X	cmdbcs	cmdbcs.exe	"Added by the LINEAG-GKW TROJAN!"
X	cmdcon	cmdcon.exe	"Added by the CRYPTER.A TROJAN!"
X	cmds	vtsqn.dll	"Added by a variant of the VUNDO TROJAN!"
X	CmdShell.exe	CmdShell.exe	"Added by the BCKDR-QHY BACKDOOR!"
X	CME	cme.exe	"Part of Gator advertising spyware - see here for removal instructions. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	CmeSYS	CMEsys.exe	"Part of Gator advertising spyware - see here for removal instructions. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	CmeUPD	CMEupd.exe	"Part of Gator advertising spyware - see here for removal instructions. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	CMFibula	CMFibula.exe	"CASClient adware"
N	CmFlywaveName	CmFlywav.exe	"Driver for Linksys Wireless-G Music Bridge"
U	CMGrdian	CMGrdian.exe	"McAfee Guardian shortcut menu on the System Tray (looks like a castle) given access to Internet Security
U	CMGShieldUI	CMGShieldUI.exe	"UI for CMG (CREDANT Mobile Guardian) Shield from Credant Technologies. ""The CMG Shield resides on devices and external media to enforce security policies even if the device is disconnected from the network."" Used to protect sensitive corporate on laptops
X	CMMan	CMMan.exe	"Added by the CMAPP TROJAN!"
X	Cmmon32Sys	cmmon32.exe	Added by the SMALL.CL TROJAN!
X	cmonitor	startupmon.exe	"SystemDoctor rogue security software - not recommended
X	cmonitor	pasmon.exe	"SystemDoctor rogue security software - not recommended
U	CmPCIaudio	"RunDll32 CMICNFG3.CPL	CMICtrlWnd"
U	CMPDPSRV	CMPDPSRV.EXE	"Printer Driver Plus from ViewAhead Technology (formerly DeviceGuys
X	Cmpnt	Devices2.exe	"Added by the TOMPAI-D TROJAN!"
X	Cmpnt	mainsv.exe	"Added by the TOMPAI-C TROJAN!"
X	cmrsf	cmrsf.exe	"Added by the DELF-HU TROJAN!"
X	cmrss	cmrss.exe	"Added by the DELF.DU TROJAN!"
X	cmrss	crmss.exe	"Added by the DLOADER-EK TROJAN!"
X	cmrss	[path to trojan]	"Added by the DLOADER-QQ TROJAN!"
X	cmrst	cmrst.exe	"Added by the BANCOS.S TROJAN!"
X	cmrst	cmrst.scr	"Added by the DLOADER-FP TROJAN!"
X	cms	iserver.exe	"Added by the DLOADER-WK TROJAN!"
X	CMSally	callmesally.exe	"Added by the CASAL.A TROJAN!"
U	CMSETTINGS	ctmn.exe	"Part of NetNanny
X	cmsound	vcpdll.exe	"Added by the TCXMEDI-D downloader TROJAN!"
X	cmsound	vcsystem.exe	"Added by the TCXMEDI-D downloader TROJAN!"
X	cmss	system.exe	"Added by a variant of the RBOT WORM!"
X	cmssapp	iexplore_.exe	"Added by the BANCBAN-CQ TROJAN!"
X	cmssapp	iexplore.exe	"Added by the BANCBAN-GF TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	cmssSystemProcess	csmss.exe	"Added by the AGENT-CO TROJAN!"
X	cmssSystemProcess	mcsmss.exe	"Added by the PROXYSER-F TROJAN!"
X	cmssSystemProcess	csms.exe	"Added by the AGENT-Y TROJAN!"
X	CMSystem	CMSystem.exe	"CASClient adware"
X	cmt101	cmt101.exe	"Added by a variant of the CRYPTER.C TROJAN!"
?	CmUCRRun	CmUCReye.exe	"Related to Medion Display Information. What does it do and is it required?"
X	cmutil	cmutil.exe	"Added by the AGENT-DFN TROJAN!"
X	cmx32	cmx32.exe	"Added by the GEMA.D TROJAN!"
X	Cn323	cnfrm33.exe	"Added by the MIMAIL.G WORM!"
X	Cn911	ODBCJET.exe	"Added by the BIFROSE-PR TROJAN!"
X	CNBABE	CNBABE.EXE	Appears to be spyware added by KAZAA (and maybe others) that displays pop-up ads whilst you're browsing
N	cnet	kontiki.exe	"Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops"
Y	cnfgCav	CMain.exe	"Part of Comodo Antivirus"
X	Cnfrm32	cnfrm.exe	"Added by the MIMAIL.D WORM!"
X	CnsMax	Internat.exe	"Added by the POINTEX TROJAN! Note - the real internat.exe resides in %windir%\system (where %windir% is the Windows directory - C:\Windows or C:\Winnt) whereas this version resides in %windir%"
X	CnsMin	"Rundll32.exe [path] CNSMIN.DLL	Rundll32"
Y	CnwiDeviceAgent	cnwida.exe	"Part of the Canon imagePROGRAF W8400 printer management software"
Y	CnxAdslL	CnxAdslL.exe	"DLink
N	CnxDslTaskBar	CnxDslTb.exe	Connexant DSL Taskbar as used on Acess Runner and Samsung AHT-E310 ADSL modems
U	CobBU	CobBU.exe	"Cobian Backup versions 6 and 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian	Cobian.exe	"Cobian Backup versions 8 thru 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup	cbInterface.exe	"System Tray access to Cobian Backup 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup	CobBU.exe	"Cobian Backup 6 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 10	Cobian.exe	"Cobian Backup 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (XP/Vista/7). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 10 Interface	cbInterface.exe	"System Tray access to Cobian Backup 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup 6	CobBU.exe	"Cobian Backup 6 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 7	CobBU.exe	"Cobian Backup 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 7 Application	CobBU.exe	"Cobian Backup 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 7 Interface	cobui.exe	"System Tray access to Cobian Backup 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup 8	Cobian.exe	"Cobian Backup 8 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 8 interface	cbInterface.exe	"System Tray access to Cobian Backup 8 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup 9	Cobian.exe	"Cobian Backup 9 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup 9 interface	cbInterface.exe	"System Tray access to Cobian Backup 9 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup Amanita	cbInterface.exe	"System Tray access to Cobian Backup 9 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup Amanita	Cobian.exe	"Cobian Backup 9 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup Black Moon	cbInterface.exe	"System Tray access to Cobian Backup 8 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	Cobian Backup Black Moon	Cobian.exe	"Cobian Backup 8 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP/Vista). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup Boletus	Cobian.exe	"Cobian Backup 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (XP/Vista/7). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Cobian Backup Interface 6	cobui.exe	"System Tray access to Cobian Backup 6 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
U	cobui	cobui.exe	"System Tray access to Cobian Backup versions 6 and 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program using the default settings as service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup installation option and run it manually when required"
X	CodeClean	CCIntro.exe	"CodeClean rogue security software - not recommended"
U	Codename Dashboard	dashboard.exe	"Codename: Dashboard - "an application that resides at the side of your screen. Built on the Microsoft .NET Framework
?	COEMsgDisplay	COEMsgDisplay.exe	"Part of HP's PC Common Operating Environment (PC COE) project. Located in %ProgramFiles%\Hewlett-Packard\PC COE. What does it do and is it required?"
X	cof.updit	[random filename]	"Added by a variant of the SDBOT WORM!"
U	CognizanceTS	"rundll32.exe [path] AsTsVcc.dll	RegisterModule"
X	Coldlife -icmp	Systray.exe	"Added by the FLOOD.AV TROJAN! Note - this is not the legitimate systray.exe process"
N	CollaborationHost	p2phost.exe	"Signs a user into the People Near Me feature at login in Windows 7 and Vista. People Near Me enables you to use certain peer-to-peer (P2P) programs on a network - that ""identifies people nearby who are using computers and allows those people to send you invitations for programs such as Windows Meeting Space. They can only invite you to participate in programs that are installed on your computer."" Available via Start → Control Panel"
U	coloreal	coloreal.exe	"Makes colours sharper and brighter
N	Colorific	Hgcctl95.exe	"Colorific® from E-Color - ""delivers accurate gamma and color temperature across your entire system - monitor to printer and digital camera to monitor."" Now superseded by ColorWizzard™"
N	Colorific Control Panel	Hgcctl95.exe	"Colorific® from E-Color - ""delivers accurate gamma and color temperature across your entire system - monitor to printer and digital camera to monitor."" Now superseded by ColorWizzard™"
X	COM Service	mscom32.com	"Added by the BEASTY.H TROJAN!"
X	COM Service	msynvr.com	"Added by the BEASTY.G TROJAN!"
X	COM Service	msjclh.com	"Added by the BEASTY.E TROJAN!"
X	COM Service	msdrce.com	"Added by the BEASTY.I TROJAN!"
X	COM Service	msflyx.com	"Added by the BEASTDO-O TROJAN!"
X	COM Service	mskwda.com	"Added by the AGENT-JIX TROJAN!"
X	COM+ Event System	DRWTSN16.EXE	"Added by the LOVGATE.AB WORM!"
X	COM+ EventSystem Services	ECSERVER.EXE	"Added by a variant of the SDBOT WORM!"
X	Com+ Sys	csrs.exe	"Added by the FORBOT-BT WORM!"
X	COM+ System Application	lsas.exe	"Added by the AGOBOT-MO WORM!"
X	COM+ System Applications	lsas.exe	"Added by the AGOBOT.SE WORM!"
X	COM++ System	exploier.exe	"Added by the LOVGATE.Z WORM!"
X	COM++ System	suchost.exe	"Added by the LOVGATE-F WORM!"
X	COM++ System	svchost.exe...	"Added by a variant of the LOVGATE WORM!"
N	COM-IP	COMIP.EXE	COM-IP Virtual Modem Driver (COM-IP Creates a Fake Serial Port that allows you to use older DOS Based Communications Programs over Telnet. Type atdt host.domain.com instead of atdt 5551212)
U	com.codeode.cactusspamfilter	cactusspamfilter.exe	"Cactus Spam - free easy-to-use spam blocker"
U	com.codeode.privacymantra	privacymantra.exe	"""Privacy Mantra keeps your computer clean from online and offline tracks"""
U	ComAgent	ComAgent.exe	"ComAgent - MDaemon's instant messaging client"
X	combo.exe	combo.exe	"Added by the CHIMO-C TROJAN!"
X	combop.exe	combop.exe	"Added by the BOWFEED-A TROJAN!"
X	Comcast Network	ribiva.exe	"Added by a variant of the IRC TROJAN!"
X	ComcastSUPPORT	tgkill.exe	Comcast (the cable folks who are replacing @home in some parts of the USA) have struck a deal with Tioga to provide an "enhanced" support and self-repairing tool. This is "beta" at present and was made available to download by mistake at present. Remove via Start -> Settings -> Add/Remove Programs
X	COMCFG	comcfg.exe	"Added by the TOADCOM.A TROJAN!"
X	comctl32	comctl32.exe	"Adware - detected by Kaspersky as the AGENT.AM TROJAN!"
U	COMDRV32	svdhost.exe	"Orvell Monitoring 2003 surveillance software. Uninstall this software unless you put it there yourself. Note - asks for permission to contact the IP address of http://www.protectcom.com/"
U	Comm Driver	commh32.exe	"G Data ""PC Spion"". PC monitoring and surveilling software
X	Command	system.exe	"Added by the GATECRASH.A or GATECRASH.B TROJANS!"
X	Command	Gotit.exe	"Added by the TITOG WORM!"
X	COMMAND	command.exe	"Added by the QQPASS.E TROJAN!"
X	command	javaw.exe	"Added by the AGOBOT-LG WORM!"
X	Command Prompt32	CmdPrompt32.pif	"Added by the ASSIRAL.B WORM!"
U	Command WorkStation 4	cws 4.exe	"EFI's Command WorkStation makes ""managing demanding workflows easier by centralizing job management. The software automatically identifies the Fiery servers on the network and offers customization options for displaying information"" - for high-end print environments"
X	command32	command32.exe	"Added by the LINEADI-A TROJAN!"
N	CommCtr	commctr.exe	"""Net2Phone CommCenter is the latest in Internet voice technology allowing you to place calls easily all over the world right from your PC!"". Available via Start -> Programs"
Y	Common Client	ccApp.exe	"Part of earlier versions of Norton AntiVirus - Auto-protect and E-mail check will not function without this"
Y	Common Client	ccRegVfy.exe	"Part of earlier versions of Norton AntiVirus - ""ccRegVfy.exe is responsible for checking the integrity of the NAV registry entries to make sure that the information has not been changed by a malicious threat or a hack"""
X	Common Files	twain.exe	"Added by the AGENT.BEA TROJAN!"
N	CommonSDK	RoxWatchTray9.exe	"System Tray access to managing the ""Watched Folders""
X	CommonService	winup.exe	"Added by the DLOADR-BJJ TROJAN!"
Y	Communications_Helper	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	Communications_Helper.exe	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	COMMUNICATOR	Communicator.exe	"Part of Microsoft Office Communicator
U	Comodo Firewall	CPF.exe	"Comodo Firewall"
Y	COMODO Firewall Pro	cfp.exe	"Comodo Firewall Pro"
U	Comodo Launch Pad Tray	CLPTray.exe	"System Tray access to LaunchPad as bundled with Comodo's freebie offerings such as Comodo Anti-Virus. Some allege that LaunchPad is impossible-to-uninstall adware
Y	COMODO Memory Firewall	cmf.exe	"""Comodo Memory Firewall is a buffer overflow detection and prevention tool which provides the ultimate defence against one of the most serious and common attack types on the Internet - the buffer overflow attack"""
U	Companion Module	companion.exe	"The AOL Companion is a small window that appears when you connect to the service using verison 8.0 and early builds of version 9.0. ""Use the Companion to quickly get to your favourite features
X	CompanionWizard	compwiz.exe	"Part of WinAntiVirusPro 2007 rogue security software (and possibly others) - not recommended
U	Compaq Alerter	CPQAlert.exe	"Compaq's Insight Manager Agent - a tool that allows for ""fault
N	Compaq Computer Corp SCCenter Module	SCCENTER.EXE	For Compaq PC's. Part of Backweb
?	Compaq Computer Security	"Rundll32.exe SECURE32.CPL	Service"
N	Compaq Connections	COMPAQ~1.EXE	"See here - ""messaging service that automatically sends you support information
N	Compaq Connections	BackWeb-1940576.exe	"See here - ""messaging service that automatically sends you support information
N	Compaq Connections	Compaq Connections.exe	"See here - ""messaging service that automatically sends you support information
N	Compaq DMI	cpqdmi.exe	Compaq version of the Desktop Management Interface
X	Compaq Drivers	F1rewalls.exe	"Added by the SDBOT-WD WORM!"
N	Compaq Internet Setup	inetwizard.exe	For Compaq PC's. Runs Compaq internet setup wizard and offers you to signup from ISP list
X	Compaq Jes Drivers	winjes.exe	"Added by the SDBOT-XR WORM!"
U	Compaq Knowledge Center	silent.exe & matcli.exe	""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	Compaq Message Server	COMPAQ-RBA.EXE	"Applies to the CPQBootPerfDB entry as well. These files generate some kind of server or servlet that attempts to connect with Compaq online. They are like Trojans
U	Compaq PK Daemon	cpqkl.exe	For Compaq laptops for programming user configurable keys. Not required unless you use them
X	Compaq Print Fax	cpqa1000.exe	"Added by the SDBOT.BCV WORM! Please take note of the difference between the legitimate Compaq Fax Utility Name (A1000 Settings Utility) and the name (Compaq Print Fax) used by this worm"
X	Compaq Service Drivers	systeminfos.exe	"Added by the SDBOT-XC WORM!"
X	Compaq Service Drivers	compq.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	navapqwa.exe	"Added by the SDBOT.BBQ WORM!"
X	Compaq Service Drivers	amsn.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	compqs.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	msnt.exe	"Added by the SDBOT.CQL WORM!"
X	Compaq Service Drivers	NtKernelSystem.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	wincmd.exe	"Added by the RBOT.ATV WORM!"
X	Compaq Service Drivers	wind32.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	winmsn.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	compaq.exe	"Added by the SDBOT-AFU WORM!"
X	Compaq Service Drivers	msnsvc.exe	"Added by the RBOT.BKT WORM!"
X	Compaq Service Drivers	ntsys32.exe	"Added by the RBOT.CIW WORM!"
X	Compaq Service Drivers	winsvc.exe	"Added by the SDBOT-AGD WORM!"
X	Compaq Service Drivers 32	compq32.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivrs	copq.exe	"Added by a variant of the RBOT WORM!"
X	Compaq Services Drivers	ndt32.exe	"Added by the RBOT.CQZ WORM!"
X	Compaq Sound Drivers For WINDOWS	sounddr.exe	"Added by the SDBOT-XG WORM!"
N	Compaq Video CD Watcher	??	For Compaq PC's. MPEG viewer
X	Compaq32 Service Drivers	ms32.exe	"Added by the SDBOT.BWH WORM!"
X	Compaq32 Service Drivers	msconfig32.exe	"Added by the SDBOT-ADC WORM!"
X	Compaq32 Service Drivers	msnt32.exe	"Added by the RBOT.BVF WORM!"
?	CompaqHW Comp Manager	cpqhcm.exe	"Running on a Compaq laptop - any ideas?"
N	CompaqPrinTray	printray.exe	Puts printer icon in the System Tray. When this option is disabled you will no longer be able to access the Control Program or Printer Driver directly from your desktop
X	Compaqs Service Driver	copypad32.exe	"Added by the SDBOT.CSO WORM!"
X	Compaqs Service Drivers	compqs.exe	"Added by a variant of the SDBOT WORM!"
N	CompaqSystray	cpqpscp.exe	Compaq System Tray icon
X	Compatibility Service Process	regsvs.exe	"Added by the GAOBOT.YN WORM!"
X	Compd Service Drivrs	codq.exe	"Added by a variant of the SDBOT WORM!"
X	Compliant	[worm filename]	"Added by the RBOT-LB WORM!"
X	ComPlus Applications	twain.exe	"Added by the AGENT.AQO TROJAN!"
U	ComproRemote	ComproRemote.exe	"VideoMate TV tuner and capture card - remote control driver"
U	ComproSchedulerDTV	ComproSchedulerDTV.exe	"VideoMate TV tuner and capture card - scheduler"
U	CompuSpy	CompuSpy.exe	"CompuSpy surveillance software. Uninstall this software unless you put it there yourself"
U	CompuSpy KeyLogger	cswin2008.exe	"CompuSpy surveillance software. Uninstall this software unless you put it there yourself"
X	Computer Defender 2009	cd2009.exe	"Computer Defender 2009 rogue security software - not recommended
X	Computing Technologie Firewall	lsauth.exe	"Added by the SDBOT-WX WORM!"
N	COMSMDEXE	comsmd.exe	3Com tray icon
X	ComStart	Trojan Guarder.exe	"TrojanGuarder rogue security software - not recommended"
X	ComTry Web Searcher	wstray.exe	Comtry MP3 Downloader related - spyware
X	comxt	comxt.exe	"Added by the COMXT TROJAN!"
X	con	[path to trojan]	"Added by the BRAVE-A TROJAN!"
?	Concurre	concurre.exe	"??"
X	ConducteurPrive	GDC.exe	"ConducteurPrive rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	Confg	bootconfig.exe	"Added by the VB-ERB WORM!"
X	ConfidentSurf	GDC.exe	"ConfidentSurf rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	ConfidentUser	SRP.exe	ConfidentUser rogue system error and cleaning utility - not recommended
X	Config	service.exe	"Added by the ISRAZ.B WORM!"
X	Config	WinService32.exe	"Added by the CRUTCHA-A TROJAN!"
X	Config	winconfig.exe	"Added by the GIP.113.B1 TROJAN!"
X	Config	CONFIG.EXE	"Added by the PSWGIP.B TROJAN!"
X	Config	TaskUpdate.exe	"Added by the MDROP-BRO TROJAN!"
X	Config Loadation	iEEexplore.exe	"Added by the SDBOT.H TROJAN!"
X	Config Loadatiorin	I3Explorer.exe	"Added by the SDBOT.H TROJAN!"
X	Config Loader	svchosl.exe	"Added by the GAOBOT.P WORM!"
X	Config Loader	sysldr32.exe	"Added by the GAOBOT WORM!"
X	Config Loader	scvhost.exe	"Added by the GAOBOT.AE or GAOBOT.AO WORMS!"
X	Config Loader	svhost.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Config Loader	svchost2.exe	"Added by the AGOBOT.XE WORM!"
X	Config Loader	[worm filename]	"Added by the AGOBOT-AE WORM!"
X	Config Loader	SYSMGR.EXE	"Added by the AGOBOT.C WORM!"
X	Config Loader	wincrt32.exe	"Added by the AGOBOT-AW WORM!"
X	Config Loader for Microsoft Windows	mwincfg32.exe	"Added by the AGOBOT.BD WORM!"
X	Config Loader2	explores.exe	"Added by the GAOBOT.BT WORM!"
X	Config Loadr	winsys32.exe	"Added by the AGOBOT-HN WORM!"
X	Config33.exe	Config33.exe	"Added by the SDBOT.T TROJAN!"
X	ConfiggLoader	cart322.exe	"Added by the GAOBOT.DJ WORM!"
U	ConfigSafe	CFGSAFE.EXE	"ConfigSafe - lets you identify changes to the registry
U	ConfigSafe	AUTOCHK.EXE	"ConfigSafe - lets you identify changes to the registry
N	ConfigServices	Config.exe	Part of initial setup on a Compaq PC
X	configsetup	configsetup32.exe	"Added by the AGOBOT-AFP WORM!"
X	Configuration	explorer32.exe	"Added by the SDBOT-ML WORM!"
X	configuration	apphost.exe	"Added by the SDBOT-VP WORM!"
X	Configuration	ntsys32.exe	"Added by the SDBOT-LN WORM!"
X	Configuration	msgfixs.exe	"Added by the SDBOT-NN WORM!"
X	Configuration Default	Wuxat.exe	"Added by the SPYBOT-CA WORM!"
X	Configuration Driver	scghost.exe	"Added by the SDBOT-DLA WORM!"
X	Configuration File	Winset32.exe	Added by the FLUX.101 TROJAN!
X	Configuration Loaded	wupdated.exe	"Added by the MOEGA or MOEGA.AG or MOEGA.AP WORMS!"
X	Configuration Loaded	lssas.exe	"Added by a variant of the SDBOT WORM!"
X	Configuration Loaded	iexploree.exe	"Added by the SDBOT-KC WORM!"
X	Configuration Loader	aim95.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	cmd32.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	syscfg32.exe	"Added by the SDBOT.B BACKDOOR!"
X	Configuration Loader	service5.exe	"Added by the GAOBOT.AF WORM!"
X	Configuration Loader	lfass.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	sycfg34.exe	"Added by the GAOBOT.AN WORM!"
X	Configuration Loader	wincrt32.exe	"Added by the GAOBOT.BF WORM!"
X	Configuration Loader	windex.exe	"Added by the GAOBOT.BZ WORM!"
X	Configuration Loader	dosrun32.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Service.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Servicess.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sw32.exe	"Added by the AGOBOT.BQ WORM!"
X	Configuration Loader	System.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Winreg.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sysinfo.exe	"Added by the GAOBOT.FQ WORM!"
X	Configuration Loader	microsoft.exe	"Added by the GAOBOT.JB WORM!"
X	Configuration Loader	confgldr.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	configuration loader	winicfg32.exe	"Added by the GAOBOT.RQ WORM!"
X	Configuration Loader	svhst.exe	"Added by the GAOBOT.YC WORM!"
X	Configuration Loader	msgfix.exe	"Added by the GAOBOT.AUS or SDBOT.J or SDBOT-QG WORMS!"
X	Configuration Loader	msnss.exe	"Added by the GAOBOT.AUS WORM!"
X	Configuration Loader	IEXPL0RE.EXE	"Added by the SDBOT BACKDOOR! Note the number ""0"" in the filename"
X	Configuration Loader	loadcfg32.exe	"Added by the SDBOT BACKDOOR! Note the number ""0"" in the filename"
X	Configuration Loader	MSTasks.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	systemry.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	ccSort.exe	"Added by the AGOBOT.SR WORM!"
X	Configuration Loader	smss32.exe	"Added by the AGOBOT.MB WORM!"
X	Configuration Loader	wincffg.exe	"Added by the AGOBOT.A3 WORM!"
X	Configuration Loader	seru32.exe	"Added by the SDBOT-VR WORM!"
X	Configuration Loader	botss.exe	"Added by the SDBOT-XS WORM!"
X	Configuration Loader	ldasp.exe	"Added by the AGOBOT.BH WORM!"
X	Configuration Loader	msgcfgsrv.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	smsai.exe	"Added by the SDBOT-YE WORM!"
X	Configuration Loader	svupdate.exe	"Added by the RANDEX.DXP WORM!"
X	Configuration Loader	crcss.exe	"Added by the AGOBOT.ADG WORM!"
X	Configuration Loader	lexplore.exe	"Added by the RBOT-AGX WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	Configuration Loader	scvhost.exe	"Added by the AGOBOT-AAE and SDBOT.AR WORMS!"
X	Configuration Loader	svchost.exe	"Added by the PARADROP-A WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Configuration Loader	svchost2.exe	"Added by the AGOBOT.JR WORM!"
X	Configuration Loader	dezi.exe	"Added by the SDBOT-OB WORM!"
X	Configuration Loader	mouse.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	msg.exe	"Added by the SDBOT.BT WORM!"
X	Configuration Loader	WinHelper.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	extrac.exe	"Added by the SDBOT-AFP WORM!"
X	Configuration Loader	DVD-Player.exe	"Added by a variant of the SDBOT WORM!"
X	Configuration Loader	IEXPLORE.EXE	"Added by the SDBOT-KW WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Configuration Loader	wincore.exe	"Added by the SDBOT.BHE WORM!"
X	Configuration Loader	configldr.exe	"Added by the AGOBOT-PP TROJAN!"
X	Configuration Loader	ahnhst.exe	"Added by the AGOBOT.MX WORM!"
X	Configuration Loader	ntdm.exe	"Added by the AGOBOT.RV WORM!"
X	Configuration Loader	msnmsgr.exe	"Added by the SDBOT-SO WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Configuration Loader	svschost.exe	"Added by the SDBOT-NS WORM!"
X	Configuration Loader	wump.exe	"Added by the AGOBOT-BU BACKDOOR!"
X	Configuration Loader	WinSys32ys.exe	"Added by the SDBOT.BCS WORM!"
X	Configuration Loader	cvcd.exe	"Added by the AGOBOT-DH BACKDOOR!"
X	Configuration Loader	asnclt32.exe	"Added by the AGOBOT-EB BACKDOOR!"
X	Configuration Loader	soundconf.exe	"Added by the AGOBOT-MH WORM!"
X	Configuration Loader	win32exec.exe	"Added by the SDBOT-LA WORM!"
X	Configuration Loader	mservs.exe	"Added by the SDBOT-NM WORM!"
X	Configuration Loader	update.exe	"Added by the SDBOT-OS WORM!"
X	Configuration Loader	FILENAME.EXE	"Added by the AGOBOT-DQ WORM!"
X	Configuration Loader	explore.exe	"Added by the GAOBOT.GW WORM!"
X	Configuration Loader	msgfixy.exe	"Added by the SLINBOT.QW BACKDOOR!"
X	Configuration Loader	winfix.exe	"Added by the SDBOT-MA WORM!"
X	Configuration Loader	scvh0st.exe	"Added by the AGOBOT-AX WORM!"
X	Configuration Loader	msrun.exe	"Added by the AGOBOT-Y WORM!"
X	Configuration Loader 2	confuldr.exe	"Added by the AGOBOT-FC WORM!"
X	Configuration Loader Service	Winsys32.exe	"Added by the RBOT-YV WORM!"
X	Configuration Loader Service	devl32.exe	"Added by the SDBOT-XY WORM!"
X	Configuration Loader10	ip7.exe	"Added by the AGOBOT-ANZ WORM!"
X	Configuration Loading	svchos1.exe	"Added by the GAOBOT.DK WORM!"
X	Configuration Loading	configldr.exe	"Added by the AGOBOT-EC WORM!"
X	Configuration Loading Service	wscel.exe	"Added by the SDBOT-WJ WORM!"
X	Configuration Loadr	iexplore.exee	Added by an unidentified WORM or TROJAN!
X	Configuration Manager	CNFGLD32.EXE	"Added by the SDBOT TROJAN!"
X	Configuration Manager	Cnfgldr.exe	"Added by the SDBOT TROJAN!"
X	Configuration Manager	cfg32.exe	"BookedSpace parasite. Note - the ""cfg32.exe"" file is located in %Windir%"
X	Configuration Servecie	sewins.exe	"Added by the SDBOT-COH WORM!"
X	Configuration Service	suchost.exe	"Added by the TREB TROJAN!"
X	Configuration Services	mswords.exe	"Added by the SDBOT-YM WORM!"
X	Configuration Update	UPDT32V2.EXE	"Added by the SPYBOT-AA BACKDOOR!"
N	Configuration Utility	CONFIG.EXE	Controls linksys wireless connection. Available from the Desktop
U	Configuration Utility	wlanutil.exe	"NetGear Wireless LAN configuration utility for the MA311 802.11b (and maybe other cards)"
X	Configuration Wizard	Cfgwiz32.exe	"Added by a variant of the HACKTACK TROJAN! Not to be confused with the legitimate MS ""ISDN Configuration Wizard"" (Cfgwiz32.exe)"
X	Configuration32 Loader32	winamp32.exe	"Added by the SDBOT-BIC WORM!"
X	Configurations Asclt	asclt.exe	"Added by the SDBOT-MX WORM!"
X	CONFIGUREv	antivir62.exe	"Added by the AGOBOT-ZD BACKDOOR!"
U	ConfigUtility	ConfigUtility.exe	"Wireless management utility for the HWC54G Hi-Speed Wireless-G CardBus Card from Hawking Technologies
X	ConfigVir	services.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
X	ConfLoader	sysconf16.exe	"Added by the SDBOT-FB TROJAN!"
X	conime.exe	conime.exe	"Added by the AVENDOG WORM! Note - this is not the legitimate Console IME process of the same filename which is located in %System%"
N	Conmgr	conmgr.exe	Starts Winfax pro at startup
U	ConMgr.exe	conmgr.exe	Connection Manager as used by Earthlink and others. If you need this to ensure a proper connection but don't want to connect at startup try creating your own shortcut
X	conmswf	conrnbne.exe	"Added by the SDBOT-DEX WORM!"
U	Connect Kasamba	Kasamba.exe	"""Finding the expert help that you need is easy on Kasamba. With more than 30
X	Connect2Party	connect2party.exe	Adult content dialler
N	CONNECTAuto Update	CONNECTScheduler.exe	"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
N	CONNECTAUTrayApp	CONNECTAUTrayApp.exe	"System Tray access to change update settings for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
U	Connection Keeper	ConKeepM.exe	"""Connection Keeper is an invaluable time-saving tool for dial-up users. This free program simulates Internet browsing (at a random interval) to prevent your connection from appearing idle
N	Connection Manager	CManager.exe	SBC Yahoo DSL service connection manager. You can connect from the network connections. Users having problems with this have been advised to uninstall the connection manager via Add/Remove Programs and it won't affect the service
X	Connectivity Tool	[path to trojan]	"Added by the LITEBOT-E TROJAN!"
X	Connector	SYS.EXE	"Nunci premium rate dialer"
X	Connector	sms.EXE	"Added by the ExDial-B premium rate adult content dialer"
N	CONNECTScheduler	CONNECTScheduler.exe	"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
X	Cons	consol32.exe	"Hijacker - redirects to an adult content portal
X	conscorr	conscorr.exe	"VX2.Transponder parasite updater/installer related"
X	Console de Gerenciamento Microsoft	csrss.exe	"Unidentified malware! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Level4"" subfolder"
X	Console de Gerenciamento Microsoft	csrss.exe	"Added by the BANCBAN-ET TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Central de Segurança"" subfolder"
U	Consumer Input	ConsumerInput.exe	"Consumer Input Toolbar. Opt-in market research monitoring you browsing habits - see the FAQ"
?	Contacte	contacte.exe	"Some kind of driver?"
X	Content connector	[random filename].exe	"Added by the DIALER-Y TROJAN! Note - uses a random filename and random folders. Usually the folder containing the file is a Temp folder"
X	Content List Management Subsystem	clmss.exe	"Added by the SPYBOT-EL WORM!"
X	Content Service	winserv[LETTER].exe	"PurityScan adware"
X	ContentDownload	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	ContentEraser	GDC.exe	"ContentEraser rogue privacy tool - not recommended
X	ContentService	winservn.exe	"PurityScan adware - see here"
U	ContentTransferWMDetector.exe	ContentTransferWMDetector.exe	"Part of Sony's Content Transfer Software which ""provides an easy way to transfer music
X	ContinueInstall	bpsinstall.exe	"BrowserAid/BrowserPal foistware"
X	Contraviro	Contraviro.exe	"Contraviro rogue security software - not recommended
X	ContraVirus	ContraVirusPro.exe	"ContraVirus rogue security software - not recommended
X	ContraVirus	ContraVirus.exe	"ContraVirus rogue security software - not recommended
X	Control	"rundll32.exe ctrlpan.dll	Restore ControlPanel"
U	Control Center	Center.exe	"Associated with Hawking Technologies
X	Control handler	***********.exe [* = random char]	"CoolWebSearch parasite variant"
X	Control handler	ahjinst.exe	"CoolWebSearch parasite variant"
X	Control handler	[10 to 14 random char]THD.EXE	"Added by the KREPPER-AI TROJAN!"
N	control panel	smctrlw.exe	System Tray icon for a Silicon Motion LynxEM based PCI Graphics Card
X	Control Panel	System.exe	"Added by the DANI TROJAN!"
X	control panel software service	cprs.exe	"Added by the RBOT-FPI WORM!"
X	Controladores	[path to trojan]	"Added by the TELEFO-A TROJAN!"
Y	ControlCenter	ctlcntr.exe	"Part of Lenovo's (IBM) ThinkVantage Fingerprint Software - used on laptops and keyboards with integrated fingerprint readers"
N	ControlCenter2.0	brctrcen.exe	Brother scanner 'Control Center' application - can be started manually
N	ControlCentreTray	XWCTray.exe	"System Tray access for the Xerox ControlCentre 2.0 software for their range of printers
X	Controlled Resource System Service	crss.exe	"Added by the AGOBOT.GH WORM!"
N	Controller	WFXCTL32.EXE	From Symantec's TalkWorks Pro and WinFax. Appears if you chose to have the program appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs
X	ControlPanel	"rundll32 internat.dll	LoadKeyboardProfile"
X	ControlPanel	"host32.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"cmd32.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"systemctrl.exe internet.dll	LoadNetworkProfile"
X	ControlPanel	"[path to executable] internat.dll	LoadKeyboardProfile"
X	ControlPanel	"popcorn.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"popcorn64.exe rundll.dll	LoadMouseProfile"
X	ControlPanel	"popcorn72.exe rundll.dll	LoadMouseProfile"
X	ControlPanel	"svcc.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"popcorn320.exe rundll.dll	LoadMouseProfile"
X	ControlPanel	"private.exe internat.dll	LoadMouseCarpetProfile"
X	ControlPanel	"twink64.exe internat.dll	LoadKeyboardProfile"
X	ControlServiceMgr	csmsv.exe	"Added by the AGENT-XC TROJAN!"
U	Cookie Cop 2	CookieCop.exe	"
U	Cookie Pal	CPBRWTCH.EXE	"Kookaburra Software's Cookie Pal cookie manager. Allows you to decide which internet sites can add ""cookies"" related to their sites for the next time you return"
U	CookieJar	Cookiejar.exe	"Cookie Jar cookie manager from Jason's Toolbox. Allows you to decide which internet sites can add ""cookies"" related to their sites for the next time you return. No longer being actively supported"
U	CookiePatrol	CookiePatrol.exe	"CookiePatrol - cookie interceptor stopping spyware cookies that used to be part of PestPatrol before CA's aquisition"
U	CookieWall	cookie.exe	"CookieWall from Analog X. Allows you to decide which internet sites can add "cookies" related to their sites for the next time you return"
X	cookw	cookw.exe	"Part of the ErrClean rogue system error and cleaning utility - not recommended. See here"
U	Cool Desk	cdesk.exe	"Cool Desk is a virtual desktops manager. "Ever you wished to have several screens on your computer? Cool Desk creates up to 9 virtual desktops and offers you to have different windows on each of them". Not required but may be of use to you"
X	CoolDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	CoolMon	CoolMon.exe	"""CoolMon monitors vital system stats and almost anything else you wish to display on the desktop"""
X	CoolMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	CoolSwitch	taskswitch.exe	ALT+TAB replacement Powertoy for Windows XP - enhances the graphics displayed when you want to switch between programs running full-screen
N	Coolwallpaper	cwm_tray.exe	"Cool Wallpaper software allows you to manage high quality photos as desktop wallpaper and screen savers"
X	coolwebprogram	clrssn.exe	"CoolWebSearch Smartsearch parasite variant"
N	Copernic Desktop Search	DesktopSearch.exe	"Copernic Desktop Search - ""Easily search your entire hard drive in less than a second to pinpoint the right file
U	Copernic Desktop Search 2	DesktopSearchService.exe	"Copernic Desktop Search - search agent"
U	CopernicPerUserTaskMgr	CopernicPerUserTaskMgr.exe	Automatic tasking feature of Copernic Pro multi-search engine tool
U	Copperhead	razerhid.exe	"Razer Copperhead gaming mouse driver - required if you use the additional features and programmed keys/macros"
U	Copy handler	Copy Handler.exe	"Copy Handler lets you copy between hard disks
N	Copyright	mwcpyrt.exe	Displays copyright information on IBM ThinkPads
X	Core Process Aplication	ccapl.exe	"Added by the QHOSTS.G TROJAN!"
X	Core Process Aplication x16	ccapl16.exe	"Added by the SPYBOT.AFT WORM!"
X	Core Process Aplication x32	ccapl32.exe	"Added by the SRAMLER.E TROJAN!"
X	Core System Hardware	syscorehd.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
U	CoreCenter	CoreCenter.exe	"MSI Core Center - motherboard utility for monitoring CPU speed
U	CoreCenter	CORECE~1.EXE	"MSI Core Center - motherboard utility for monitoring CPU speed
X	Coreguard Antivirus 2009	Coreguard 2009.exe	"Coreguard Antivirus 2009 rogue security software - not recommended
N	Corel Colleagues & Contacts Reminders	cffrem.exe	"Corel Colleagues & Contracts - all-in-one organizer for scheduling meetings
N	Corel Desktop Application Director	dadx.exe	The Desktop Application Director (DAD) gives you easy access to all Corel applications - x represents ther version number. Available via Start -> Programs
N	Corel Family & Friends reminders	CFFREM.EXE	"Corel Family & Friends - all-in-one calender
N	Corel Photo Downloader	MediaDetect.exe	"Related to Corel Photo Album"
N	Corel Registration	Remind32.exe	If you don't want to register Corel products and be reminded about it every 2 weeks disable it
N	Corel Registration Reminder	Remind32.exe	If you don't want to register Corel products and be reminded about it every 2 weeks disable it
N	Corel Reminder	NAVBROWSER.EXE	If you don't want to register Corel products and be reminded about it every 2 weeks disable it
N	Corel Reminder	NAVBrowser.exe	Registration reminder for CorelDRAW 10
N	CorelCENTRAL 10	I_26dadCC.exe	"CorelCENTRAL 10 - personal information manager (PIM). Supplied as part of Corel WordPerfect Office 2002. Available via Start -> Programs"
X	CorelDraw Toolbox	CorelDraw.exe	"Added by the SDBOT-VZ WORM!"
N	CorelMedia FoldersIndexer8	MFindexer.exe	Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office
N	CorelMedia FoldersIndexer8	MFINDE~1.EXE	Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office
X	CoreSrv	coresrv.exe	"Some IRC trojans/worms use this - see here for more information"
?	CORESYS	coresys.exe	"??"
X	Corporate Microsoft Update	uptask.exe	"Added by the RBOT-GVB WORM!"
N	CorrectConnect	CConnect.exe	Broadband ISP diagnostic tool - as used by NTL and Cox Communications. Shortcut available
X	cosine	cosine.exe	"Added by the RBOT-SW WORM!"
U	CostAware	niIPCApp.exe	"NetInternals CostAware - download quota measuring tool"
X	Counterstrike Service Agent	czrzns.exe	"Added by the MEDBOT.AR WORM!"
N	Country Select	pctptt.exe	"Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell
N	CountrySelection	pctptt.exe	"Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell
?	Coupon Offers	??	"??"
X	couponica	couponica.exe	"Adware - see here"
?	CP	CopyProtectionNotifier.exe	"Related to Emuzed Systems and Middleware. Comes included with Windows XP Media Edition"
U	CP32NOT	CP32BTN.EXE	For the programmable "one-touch" buttons on HP laptops (and others?). Safe to disable if you don't use these buttons
U	CP4HPOT	OneTouch.EXE	"Supports the additional multimedia keys on HP/Compaq laptops which give single button press access to standard functions such as Mail
N	CP888M1	CP888M1.EXE	Related to EZbutton quick launcher for the Media player app that comes with certain laptops
?	CPA9P2PSERVER	CPA9P2PS.exe	"Found on a Compaq Presario but what is it?"
X	cpanel	winlogin32.exe	"Added by the RBOT-FOY WORM!"
U	CPATR10	CPATR10.EXE	"Dritek/Compal ATR10 Easy Button driver. Used on certain laptops (e.g. Toshiba
U	CPBrWtch	CPBrWtch.exe	"Kookaburra Software's Cookie Pal cookie manager. Allows you to decide which internet sites can add ""cookies"" related to their sites for the next time you return"
X	CPCmscl0ck	CPCmsclock.ExE	"Added by the IRCFLOOD.BF TROJAN!"
Y	CPD_EXE	CPD.EXE	Firewall bundled with McAfee VirusScan 6.*
X	cpl	deamon.exe	"Added by the TACTSLAY.C TROJAN!"
X	cpl	msgaol.exe	"Added by the TACTSLAY.C TROJAN!"
X	cpl	s_menu.exe	"Added by the TACTSLAY.C TROJAN!"
X	cpl	browse.exe	"Added by the TACTSLAY.C TROJAN!"
N	CplBTQ00	CplBTQ00.EXE	Related to EZbutton quick launcher for the Media player app that comes with certain laptops
N	CPLDBL10	CPLDBL10.exe	Related to EZbutton quick launcher for the Media player app that comes with certain laptops
U	CPLDFL10	CPLDFL10.EXE	Part of the EzButton feature on some Toshiba (and maybe others) laptops which support additional buttons
X	cpntmgc	wincomp.exe	"Added by the WINTRIM.A TROJAN!"
X	cpntmgc	simcss.exe	"Added by the MAGICON.A TROJAN!"
X	cpntmgc	navpmc.exe	"Added by the SIMCSS TROJAN!"
X	cpntmgc	winmgts.exe	"Added by the WINTRIM-B TROJAN!"
?	CPortPatch	cppatch.exe	"CPortPatch is a utility is required for Dell laptops that are using a docking station. Is it needed though?"
X	cppc	[path to trojan]	"Added by the VB-NV BACKDOOR!"
Y	CPQAcDc	CPQAcDc.exe	Compaq PowerCon power management software for laptops
U	CPQAlert	CPQAlert.exe	"Compaq's Insight Manager Agent - a tool that allows for ""fault
N	CPQBootPerfDB	CPQBootPerfDB.EXE	See the entry for Compaq Message Server
Y	CPQCalib	CPQCalib.exe	Compaq PowerCon power management software for laptops
N	CPQDFWAG	CpqDfwAg.exe	For Compaq PC's. Runs Compaq diagnostics on every boot
U	CPQEASYACC	cpqeadm.exe	For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
U	CPQEASYACC	StartEAK.exe	"Easy Access Button Support for Compaq PCs. Allows the use of programmable keys on multimedia keyboards. Required if you use the additional keys"
U	CPQEASYACC	STARTDRV.exe	For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
U	cpqeaui	cpqeaui.exe	For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
U	cpqek	kcpqek.exe	"For Compaq PC's. Easy Access button support for the keyboard"
X	CPQHotKeys	hotkeysvc.exe	"Added by the RBOT-XA WORM!"
U	CPQInet Runtime Service	CpqInet.exe	"For Compaq PC's. Allows AOL and Compuserve to use the Easy Access buttons for the internet. Is not required if you don't use the ISP providers"
N	CPQINKAGENT	cpqinkag.exe	"That is the Compaq Ink Agent for some inkjet printers
U	cpqns	cpqnpcss.exe	Related to Compaq.Net - not required if you don't use that
N	Cpqset	Cpqset.exe	Default settings software in Hewlett Packard notebook
Y	CPQSTUTFIX	stutfix.exe	"For Compaq PC's. Fixes audio stutter problems for ESS Maestro soundcards. You can download it here. This is a Compaq originated file and has been verified as free from viruses by McAfree/Norton"
U	CPQTEAM	cpqteam.exe	This program is bundled with HP servers. When loaded a system tray icon will be available that launches the HP Network Configuration Tool
X	cpr	cpr	Adroar.com adware downloader
X	cprocsvc	cproc.exe	Added by MSIL.AGENT.C TROJAN!
X	CPU Idle	cpuidlexp.exe	"Added by the AGOBOT-BW WORM!"
U	Cpu Level Up help	CpuLevelUpHelp.exe	"Included with some ASUS motherboards (such as the Maximus Extreme & Striker II Extreme)
X	CPU Manager	cpumgr.exe	"Added by the PANDEM.B WORM!"
U	CPU Power Monitor	CpuPowerMonitor.exe	"Included with some ASUS motherboards (such as the Maximus Extreme & Striker II Extreme). Associated with the ""Energy Saving"" feature of AI Gear - which ""is a utility designed to configure and support all ASUS EPU (Energy Processing Unit) features."" Part of AI Suite"
X	CPU Temp Control	wuitgurd.exe	"Added by the RBOT-AHV WORM!"
X	CPU Watcher	"rundll32.exe cpu.dll	load"
X	CPU Windows Status	cpustats.exe	"Added by a variant of the RBOT WORM!"
U	CPUcool	Cpucool.exe	Program to keep the processor cool when idle in "overclocked" systems. Also available via Start -> Settings -> Control Panel
N	CPUMon	CPUMon.exe	"""CPUMon continuously displays the updated system statistics in a floating window as well as in system tray area"""
X	Cpusave	Cpusave.exe	"Added by the GEMA TROJAN!"
X	Cpusave32	Cpusave32.exe	"Added by the GEMA TROJAN!"
X	CPVHOST Settings	cpvhost.exe	"Added by a variant of the SDBOT TROJAN!"
X	cpyt	hidep.exe	"Added by the MIRJACK-A TROJAN!"
X	cqlyg	world_cup_.bat	"Added by the WCUP.A WORM!"
?	CQSCP2PS	CQSCP2PS.EXE	"""Compaq printer utility which is required in the startup menu in order to make the printer work correctly"". Is it actually required?"
?	CQSCP2PSERVER	CQSCP2PS.EXE	"""Compaq printer utility which is required in the startup menu in order to make the printer work correctly"". Is it actually required?"
X	Cr**.exe [* = random char]	Cr**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Cr**32.exe [* = random char]	Cr**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
U	cracked_windows1	cracked_windows1.exe	"Cracked Windows popup killer"
X	crash0001	restorecrashwin32.bat	"Added by the AGENT-ZC TROJAN!"
X	CrashDump	[path to trojan]	"Added by the DROPPER.EAT TROJAN!"
N	CrazyTalk Serve	"rundll32.exe CrazyTalk.dll	DIIServeMediaFile"
U	CRBroadCasting	CRBroadCasting.exe	"CardReader2 from On Track Inovations Ltd. USB Card Reader"
X	CRC Value Verifier	crsss32.exe	"Added by a variant of the RBOT WORM!"
X	CRC Value Verifier	Crsss64.exe	"Added by the RBOT-NY WORM!"
X	CRC Value Verifier	svchost32.exe	"Added by the RBOT-OA WORM!"
X	CRC Value Verifier	crsss.exe	"Added by the SPYBOT.UK WORM!"
X	Crc32stats Dependencies	Crc32stats.exe	"Added by the MYTOB.GT WORM!"
X	CRCSS	crcss.exe	"Added by the IRCBOT-TH WORM!"
U	Creata Mail	JMSrvr.exe	"Creata_Mail. Smileys
X	Create A Monster	createAMonster.exe	"Kudd.com CreateAMonster. Reportedly stealth installed and Look2Me adware related"
N	CreateCD	Createcd.exe	Adaptec Easy CD Creator system tray application (pre version 5). Available via Start -> Programs
N	CreateCD50	Createcd50.exe	Adaptec Easy CD Creator version 5 system tray application. Available via Start -> Programs
N	CreateCD_Reminder	reminder.exe	Reminder to create system recovery CD/DVDs on a Sony Vaio laptop or desktop
X	Creates stractures for system management	stacture.exe	"Added by the SDBOT-DHS WORM!"
N	Creative AGP Wizard	agpwiz.exe	Part of Creative's BlasterControl
X	Creative Audio Drivers	creative.exe	"Added by the RBOT-FKR WORM!"
N	Creative Detector	CTDetect.exe	"Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player
N	Creative Launcher	CTLauncher.exe	For Creative Soundblaster Live! series soundcards. Adds a quick-launch bar to the top of the display and a System Tray icon. Available via Start -> Programs
U	Creative Live! Cam Manager	CTLCMgr.exe	"Creative Live! Cam Manager"
U	Creative MediaSource Go	CTCMSGo.exe	"Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
U	Creative MediaSource Go	CTCMSGoU.exe	"Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
N	Creative PCI Audio Configuration Utility	starter.exe	"System Tray icon to configure a Creative Soundblaster PCI soundcard. Not required and re-instates itself when un-checked. Try one of the solutions on this special page. Similar to EnsoniqMixer"
N	Creative Software Update	AutoUpdate.exe	Auto-updater for Creative Labs software
N	Creative WebCam Tray	Camtray.exe	Creative WebCam tray control - can be started manually
X	Creative.exe	Creative.exe	"Added by the PROLIN WORM!"
N	CreativeDiscNotifier	CTNOTIFY.EXE	"For Creative Soundblaster Live! series soundcards. Detects when you insert a CD-ROM
U	CreativeMixer	CTMIX32.EXE	"Creative soundcard System Tray access to
?	CreativeTaskScheduler	CTSched.exe	"Creative Task Scheduler. What does it do and is it required?"
X	CrisysTec Sentry	Sentry.exe	"CrisysTec Sentry rogue privacy program - not recommended"
X	Critical Error Safe32	GetWaylayer32.exe	Added by the RBOT.IAL WORM!
X	Critical Update Check	battlenet.exe	"Added by the DELF-LB TROJAN!"
N	CriticalUpdate	Wucrtupd.exe	"MS Windows Critical Update Notification. If you want to keep Windows up-to-date
X	CriticalUpdate	wucrtupd.exe	"Added by the NOALA.B WORM! Note - this file is located in the Windows or Winnt folder
X	crmssrlt	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	Crnsava	scrnsave.pif	"Added by the SDBOT-ZV WORM!"
X	cronos	MARCO!.SCR	"Added by the OPASERV.G WORM!"
X	CrossMenu	CrossMenu	Toshiba CrossMenu Utility - allows the user to create their own menus
U	CrossMenu	CrossMenu.exe	Toshiba CrossMenu Utility - allows the user to create their own menus
X	CRP386 Networking	crp386.exe	"Added by the IRCBOT.N TROJAN!"
X	crs	crs.exe	"Added by the AGOBOT-TJ WORM!"
X	crsmons	iomssls.exe	"Added by the BACKDR-AU TROJAN!"
X	CRSS	CRSS.exe	"Added by the AGOBOT-RM WORM!"
X	CRSS	lssas.exe	Added by an unidentified WORM or TROJAN!
X	crsss	crsss.exe	"Added by the AUTORUN.FM WORM!"
X	CRSSXP SysInfo	crssxp.exe	"Added by a variant of the SDBOT TROJAN!"
X	Crusty	dmcpl.exe	"Added by the RUSTY WORM!"
X	cryptdlg	cryptdlg.exe	Added by an unidentified TROJAN!
N	CryptLoad	RouterClient.exe	"CryptLoad download manager"
U	cryptoexpert	cexpert.exe	"CryptoExpert from SecureAction Research. Advanced on the fly encryption system"
X	Cryptographic Service	******.exe [* = random char]	"Added by the KORGO.W or KORGO.X or KORGO.AB WORMS!"
?	Crystal 3D Audio Control	CWD3DSND.EXE	"Crystal 3D Audio sound driver. Is it required?"
X	CS	tsc.exe	"Cyber Security rogue security software - not recommended
X	CS Update	copy /Y [path] ActivationManager.dll.upd [path] ActivationManager.dll	Added by an unidentified malware
N	csaRem	spqmdmui.exe	Compaq modem country selection
Y	CSAV_CheckViruses	vchk.exe	"Command Antivirus related"
U	csc	csc.exe	Command line compiler for Microsoft C# it gets installed with the .NET SDK
X	cscripts	cscripts.exe	"Added by the BDOOR-AAP BACKDOOR!"
X	CSCRS Value	cscrs.exe	"Added by the RBOT-AAA WORM!"
X	CSCRS Value Check	MsPMSPSd.exe	"Added by a variant of the SDBOT WORM!"
X	Csec	cs.exe	"Cyber Security rogue security software - not recommended
N	csecwiz	csecwiz.exe	"Setup wizard for the Client Security Software for IBM\Lenovo notebooks. This entry only runs once
X	cserv32	cserv32.exe	"Added by the STRATION.EC WORM!"
X	CsimPlayer	CsimPlayer.exe	"Added by the KOOBFACE-AD WORM!"
U	CSINJECT.EXE	CSINJECT.EXE	"Part of Quarterdeck/Norton CleanSweep. ""Csinject must be loaded in order for Smart Sweep to automatically monitor installations and properly track registry changes"""
X	csm Win Updates	csm.exe	"Added by the ZOTOB.B WORM!"
X	CSNetManagerXp	isass.exe	"Added by the HIDER-O TROJAN!"
X	csoftok	softok.exe	"Added by the QQPASS.G TROJAN!"
X	csos	csos.exe	"Added by the SDBOT-DFE WORM!"
X	csrcs	csrcs.exe	"Added by the AGENT-HUA TROJAN!"
X	csrs	csrs.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	csrsc	csrsc.exe	"Added by an unidentified VIRUS
X	CSRSS	CSRSS.EXE	"Search page hijacker
X	Csrss	csrss.exe	"Added by the CHOD WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a random subfolder"
X	csrss	csrss.exe	"Added by the KEYLOG-AQ KEYLOGGER! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	csrss	csrss.exe	"Added by the CHODE-J WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a random subfolder"
X	csrss	msmsgs.exe	"Added by the CHODE-J BACKDOOR! Note - this malware uses MSN Messenger (which is located in %Program Files%\Messenger) in the background to propogate itself"
X	csrss	nwiz.exe	"Added by the CHODE-J WORM!"
U	csrss	csrss.exe	"BeyondKeylog surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Supremtec"
X	Csrss	CSRSS.EXE	"Added by the PUNYA-B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in C:\Documents and Settings\Administrator\Local Settings\Application Data\WINDOWS"
X	csrss	ssms.exe	Added by an unidentified malware
X	Csrss Host	csrhost.exe	"Added by the IRCBOT.BIZ WORM!"
X	CSRSS Loader	csrsss.exe	"Added by the AGOBOT.TX WORM!"
X	csrss.exe	csrss.exe	"Added by the DALBUG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	csrssLevel4	csrss.exe	"Unidentified malware! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Level4"" subfolder"
X	CSRSSU	CSRSSU.exe	"CoolWebSearch parasite variant - hijacking to Slawsearch.com. Also detected as the CWS-E TROJAN!"
X	CSRSSW	CSRSSW.EXE	"Added by the CWS-F TROJAN!"
X	CSRSWIN	[trojan filename]	"Added by the WINSHELL.50 TROJAN!"
X	CSRSX	[trojan filename]	"Added by the WINSHELL.50.B TROJAN!"
X	csrvss	csrvss.exe	"Added by a variant of the SDBOT TROJAN!"
U	CSS Server	CSSServer.exe	"ComSpySysSvr surveillance software. Uninstall this software unless you put it there yourself"
N	cssauth	cssauth.exe	"Part of Thinkvantage Client Security Solution for Lenovo ThinkPad notebooks and ThinkCentre desktops. Once configured via the associated setup screens this loads via winlogon.exe (and loads the password manager) and therefore disabling this entry has no effect"
N	cssauthe	cssauthe.exe	"Part of Thinkvantage Client Security Solution for IBM/Lenovo ThinkPad notebooks and ThinkCentre desktops. Once configured via the associated setup screens this loads via winlogon.exe (and loads the password manager) and therefore disabling this entry has no effect"
Y	CSScheduleCheck	SCHWIZEX.EXE	"Part of ConfigSafe - lets you identify changes to the registry
X	cssrs	cssrs.exe	"Added by the BANCBAN-DW TROJAN!"
X	cssrss.exe	cssrss.exe	"Malware installed by different rogue security software including SpyKillerPro"
X	csss	Csss.exe	"Added by the BALICK TROJAN!"
U	CSS_Central	CSS_1631.EXE	"CSS Communication Agent (95 Host) from Command Software Systems (now Authentium). ""CSS Central™ provides administrators with a powerfully proactive tool to effectively manage and maintain the anti-virus strategy from a centralized console"""
X	CSV10P1	CSP001.exe	"ClearSearch adware"
X	CSV10P70	CSv10P070.exe	"ClearSearch adware"
X	CSV7P26	CSV7P26.exe	"ClearSearch adware"
X	CSV7P70	CSV7P070.exe	"ClearSearch adware"
X	CSV7P91	CSV7P91.exe	"ClearSearch adware"
U	csvdea	csvdea.exe	"SpyArsenalLog surveillance software. Uninstall this software unless you put it there yourself"
X	csvhost.exe	csvhost.exe	"Added by the CIMUZ-BD TROJAN!"
Y	ct	ct.exe	ct.exe is a file is for the HP Learning Adventure software and if you use this software it is required to run it
X	CT Control Settings	CTSVCCD.EXE	"Added by the RBOT-YS WORM!"
U	CTAPR2	CTAPR2.exe	"Console Launcher for the Creative Sound Blaster X-Fi series"
N	CTAVTray	CTAvTray.exe	For Creative Soundblaster Live! series soundcards. Plays the EAX animation on start-up and adds a System Tray icon for it. Available via AudioHQ
U	CTCheck	CTCheck.exe	"Associated with the ZEN range of MP3 players from Creative Technology Ltd. A visitor recommended the ""U"" status but what does it do?"
U	CTCMonitor	CTCMonitor.exe	"Click-to-Convert - document-to-HTML or doc-to-PDF converter. Only required if you are going to use the File -> Print method of using Click-to-Convert. If converting directly from MS Office
X	CTDrive	"rundll32.exe drvmod.dll	startup"
N	CTDVDDet	CTDVDDet.exe	"Auto-detect and play a DVD when using a Creative Soundblaster Audigy2 soundcard. Uses about 2.2 MB of memory. Disable it by heading to the MediaSource DVD Audio Player
X	CTF Device Loader	ctfmond.exe	"Added by the AGOBOT-FO WORM!"
X	ctf.exe	ctf.exe	Added by a variant of the BIFROSE TROJAN!
X	ctflog manager	ctflog.exe	"Added by the DONBOMB.A TROJAN!"
X	CTFM0N.exe	CTFM0N.exe	"Added by the STARTPAGE.P TROJAN! Notice the digit ""0"" in both columns rather than the upper case ""o"""
X	ctfmen	cssrs.exe	"Added by the STARTP-DC TROJAN!"
X	ctfmom	ctfnom.exe	"Added by the BCKDR-QTA BACKDOOR!"
U	ctfmon	ctfmon.exe	"Supports multiple languages and alternative method inputs in Windows and MS Office. The language bar is displayed alongside the System Tray if more than one keyboard layout is enabled (for switching input languages) or
X	ctfmon	taskmgr32*.exe [* = number]	"Added by the SOWSAT.B WORM!"
X	ctfmon	cftmon.exe	"Added by the DELIVE-A BACKDOOR! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in %Windir%"
X	ctfmon	mIRC.dll	"Added by the DELBOT-E TROJAN!"
X	ctfmon	WinConst.exe	"Added by the ASSASIN-G TROJAN!"
U	CTFMon	ctfmon.exe	"Family KeyLogger keystroke logger/monitoring program - remove unless you installed it yourself! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in a ""CTF"" sub-folder"
X	ctfmon	msnmsgr.exe	"Added by the BDOOR-JV BACKDOOR! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	CTFMON	wscript.exe /E:vbs winjpg.jpg	"Added by the RUNAUTO.F WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""winjpg.jpg"" file is located in %System%"
X	CTFMON	wscript.exe /E:vbs regedit.sys	"Added by the VBSAUTO-A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""regedit.sys"" file is located in %System%"
X	CTFMON	win.exe	"Added by the VBS.RUNAUTO.G WORM!"
X	Ctfmon	wmisys.exe	"Added by the IRCBOT-ADS WORM!"
X	ctfmon	WinUP.exe	"Added by the BANKER-VV TROJAN!"
X	CTFMON.CPL	CTFM0N.CMD	"Detected by Symantec as the SILLYFDC WORM! See here"
X	Ctfmon.exe	ctfmon32.exe	"CoolWebSearch Ctfmon32 parasite variant"
X	ctfmon.exe	ctfmon.exe	"Added by the RAIDYS TROJAN! Note - this overwrites the legitimate ctfmon.exe process associated with alternate text inputs which is located in %System%"
X	ctfmon.exe	msupdate32.exe	"Spy Sheriff/SpywareNO malware
U	ctfmon.exe	ctfmon.exe	"Supports multiple languages and alternative method inputs in Windows and MS Office. The language bar is displayed alongside the System Tray if more than one keyboard layout is enabled (for switching input languages) or
X	ctfmon.exe	ctfmon.exe eminem.exe	"Added by the BHARAT.A WORM!"
X	CTFMON.EXE	svchost.exe	"Added by the JUEGO-B WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	CTFMON32	CTFMON32.EXE	"CoolWebSearch Ctfmon32 parasite variant - also detected as the CWS-E TROJAN!"
X	ctfmon32	[random filename].exe	"Added by the RBOT-GSN WORM!"
X	ctfmon32	taskmgr32*.exe [* = digit]	"Added by the SOWSAT.C WORM!"
X	ctfmona	ctfmona.exe	"Added by the DLOADR-BME TROJAN!"
X	CTFMONSS	CTFMONSS.EXE	"Added by the CWS-F TROJAN!"
X	ctfmoon	microsoftconfigurator.exe	"Added by the DELF-ALS TROJAN!"
X	ctfmun	ctfmun.exe	"Added by the AGENT.ACEZ TROJAN!"
X	ctfnnon	ctfmon.exe	"Added by the TURKOJAN.IL BACKDOOR! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in %Windir%"
X	ctfnom	rundIl32.exe	"Added by the LEGMIR-AW TROJAN!"
X	ctfnom.exe	SVOHOST.exe	"Added by the DIGIDOR-A TROJAN!"
X	ctfnom.exe	OSRSS.exe	"Added by the DLOADER-UQ TROJAN!"
X	cthelp	cthelp.exe	"Added by the SDBOT TROJAN!"
U	CTHELPER	CTHELPER.EXE	"CTHELPER is a background task that is a plug-in manager for Creative drivers. The theory is that 3rd party manufacturers can use the CTHELPER plug-in interface to produce drivers
X	CTHelper	cthelper.exe	"Added by the RBOT-XB WORM! Note - do not confuse with the Creative application of the same name described here"
X	CTHELPER	svhost.exe	"Added by the SDBOT-RZ WORM!"
X	CTime	[path to trojan]	"Added by the HTTPDOS TROJAN!"
X	CTin10	CTin10.exe	"Added by the BANCOS.E TROJAN!"
X	CtModule	CtModule.exe	"Added by the CLICKER-EG TROJAN!"
X	CTMON.EXE	cfmon.exe	"Added by the CLCKR-AN TROJAN!"
U	CTNMRUN	ctnmrun.exe	Detects the Creative NOMAD jukebox/MP3 player at the time it is attached to USB and starts the needed application (Creative PlayCentre 2) that you use to copy MP3 files to and from it. This is required if you want PlayCentre 2 to take control of the NOMAD once connected
?	CTPDPSRV	CTPDPSRV.EXE	"Compaq A3000 printer driver (in the %System%\spool\DRIVERS\W32\X86 folder). Is it required?"
N	CTPerformanceUtility	CTPowUti.exe	"Related to Creative PowerSysTrayApp. This program is a non-essential process
X	ctpmon	ctpmon.exe	"Registry Cleaner rogue - not recommended
N	CTRegRun	CTRegRun.exe	For Creative Soundblaster Live! series soundcards. Reminds you to register your card with Creative
U	CtrlVol	CtrlVol.exe	"Volume control key on Acer
?	CTSched	CTSched.exe	"Creative Task Scheduler. What does it do and is it required?"
N	CTStartup	CTEaxSpl.exe	Splash screen with sound on every boot up. Installed with a Sound Blaster Audigy soundcard
U	CTSVolFE	CTSVolFE.exe	Creative Labs Mixer applet for the Sound Blaster Audigy
U	CTSVolFE.exe	CTSVolFE.exe	Creative Labs Mixer applet for the Sound Blaster Audigy
N	CTSyncU.exe	CTSyncU.exe	"Creative Sync Manager - synchronizes music tracks on your computer with your player"
U	CTsysVol	CTSYSVOL.exe	Creative sound card volume controls
?	cttdpsrv	cttdpsrv.exe	"??"
X	CTUpdate	ctupdclt.exe	"Added by the RBOT-ABG WORM!"
N	CTxfiHlp	CTXFIHLP.EXE	Added by the installation of a Creative Labs X-Fi sound card. This particular process provides the help functionality for your card
N	CTXFIREG	CTxfiReg.exe	Creative Labs sound card driver related. It appears that it isn't required and maybe registration related
X	Ctykd	[path to file]	"SMALL.SN spyware"
N	CTZDetec.exe	CTZDetec.exe	"Auto-detect feature of Creative Media Lite which assists you in managing your music
X	CU1	VCClient.exe	Associated with the Surf Sidekick adware and should be removed
X	CU2	VCMain.exe	Associated with the Surf Sidekick adware and should be removed
Y	cuagentExe	Cuagent.exe	"Command Antivirus related"
X	CueX44	Dago.exe	"Added by the PUNYA-B WORM!"
X	CueX44_stil_here	WINLOGON.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate winlogon.exe process
X	cuo	cuo.exe	"Added by the BUGBEAR.A WORM!"
X	Current Security Config	csecure.exe	"Added by the RBOT-AMO WORM!"
X	Current32	msnpla.exe	"Added by the SDBOT-DIS WORM!"
N	CurseClient	CurseClient.exe	"CurseClient add-on manager for World of Warcraft and Warhammer Online games"
N	cursor	Screendragon_VS_Taskbar.exe	"ScreenDragon video player"
U	CursorGizmo	CursorGizmo.exe	"Cursor Gizmo - cursor management utility"
N	CursorXP	CursorXP.exe	"CursorXP from Stardock - tool for creating mouse cursors"
U	Curtain	Curtain.exe	"Curtain (from Chaotic Visions) - ""is a Windows utility which gives you the power to hide any window or group of windows to your system tray"""
U	Customizer2000	logon.exe	"Automatic logon feature of Customizer 2000 - ""a special utility which is designed to optimize Win9x/ME performance. The program lets you explore the many hidden settings in Windows
N	CuteMX	CuteMX.EXE	File sharing utility
X	Cvfjx	ANACON.EXE	"Added by the NACO.A WORM!"
X	cvhnykzx	keepSafe.exe	"Added by the KILLAV.KAX TROJAN!"
X	cvmonitor.exe	cvmonitor.exe	"Added by the SDBOT.BV WORM!"
X	cvmsyslpd	sdservss.exe	"Added by the MAILBOT-BY TROJAN!"
Y	CVPND	cvpnd.exe	Sub-system used by Cisco VPN client for making a connection to a remote IPSec server
U	CW	cw4.exe	"Chat Watch ""is a monitoring and logging software for online chat and instant messaging programs"""
U	CWatch	cw.exe	"ChatWatch - chat monitoring tool"
N	cwbckver	cwbckver.exe	"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
N	cwbinhlp	cwbinhlp.exe	"Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
N	cwbsvstr	cwbsvstr.exe	"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
?	cwbwlwiz	cwbwlwiz.exe	"Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
?	Cwcdschk.exe	Cwcdschk.exe	"IBM Thinkpad related?"
U	cwcptray	cwcptray.exe	"Related to ContentWatch Parental Control internet filter"
X	cwingllib	atllsimm.exe	"Added by a variant of the SDBOT WORM!"
X	cwriter	ucookw.exe	"Part of the ErrClean rogue system error and cleaning utility and other members of this family. See here for more examples"
X	cwriter	cwriter.exe	"Part of PcRaiser
U	cwupdate	cwupdate.exe	"ContentProtect from ContentWatch - internet filter"
X	cximddl	ldfrmmd.exe	"Added by the BUZUS.CQMU TROJAN!"
N	CXMon	Hpi_Monitor.exe	Autodetects when a HP camera is attached to the computer and launches the "HP Photoimaging Software". Available via Start -> Programs
X	cybansos	cyban.exe	"Added by the TATERF-V WORM!"
N	Cyber	cyberchk.exe	"Part of Belkins ""Multimedia Cleaning Kit"" and is automatically installed when you run their optical disk drive cleaning utility - to remind you to clean your drive after ""x"" amount of time has passed"
U	Cyber Trio	showmode.exe	"From G-Tek Technologies. Allows you to set the PC in one of three modes
U	Cyber-Defender 2003	uwcdsvr.exe	"
N	Cyber-shot Viewer Media Check Tool	SPUVolumeWatcher.exe	"Part of the Sony Picture Uility software supplied with Sony Cyber-shot digital cameras. Automatically invokes an import process if the camera is connected and has media on it"
N	Cyber-shot Viewer Media Check Tool	SPUVOL~1.EXE	"Part of the Sony Picture Utility software supplied with Sony Cyber-shot digital cameras. Automatically invokes an import process if the camera is connected and has media on it"
X	cyberfree.exe	****.dat [* = random char]	Unidentified adware
U	Cyberhawk	CHTray.exe	"Cyberhawk from Novatix. Protects against viruses
U	CyberLat Ram Cleaner	CLRamCleaner.exe	"CyberLat RAM Cleaner - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
U	CyberLat Ram Cleaner	CyberLat Ram Cleaner 1.1.exe	"CyberLat RAM Cleaner - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
N	Cyberlink PowerCinema 3.0	PCMService.exe	"Part of Cyberlink's PowerCinema - which can be used to watch movies
N	CyberMedia Agent	CMAGENT.EXE	"Part of CyberMedia's Oil Change program. Not normally required. Note - if you have TextBridge
U	CyberPatrolNew	cphq.exe	"""CyberPatrol is one of the most powerful and popular client-based
X	CyberWolf	CyberWolf.exe	"Added by the KICKIN.A (or CYDOG.C) WORM!"
X	CyDoor	CD_Load.exe	"Adware. Check here for information about Cy-Door and here for a program that can remove it"
X	CydoorUpdate	CD_Load.exe	"Adware. Check here for information about Cy-Door and here for a program that can remove it"
?	CYNHKey	CYNHKey.exe	"??"
N	CyphTray	CyphTray.exe	"Cypherus - encryption software"
U	CypressLinkMon	CypressLinkMon.exe	"Related to CypressViewer from Siemens that ""allows ACUSON Cypress cardiovascular system PLUS users to store
Y	D-Link Air USB Utility	AirCFG.exe	D-Link Air USB wireless driver and configuration utility
Y	D-Link Air Utility	AirCFG.exe	D-Link Air PCI wireless driver and configuration utility
Y	D-Link AirPlus G	AirGCFG.exe	D-Link Airplus G wireless router driver and configuration utility
Y	D-Link AirPlus XtremeG	AirPlusCFG.exe	"D-Link AirPlus Xtreme G wireless access point driver and configuration utility"
Y	D-Link D-Link DWA-125	AirGCFG.exe	"D-Link DWA-125 Wireless 150 USB adapter driver and configuration utility"
Y	D-Link D-Link RangeBooster N DWA-140	AirNCFG.exe	"D-Link DWA-140 RangeBooster N USB adapter driver and configuration utility"
Y	D-Link D-Link Wireless 108G DWA-120	AirPlusCFG.exe	D-Link DWA-120 Wireless 108G USB adapter driver and configuration utility
Y	D-Link D-Link Wireless 108G DWA-520	AirPlusCFG.exe	D-Link DWA-520 Wireless 108G desktop adapter driver and configuration utility
Y	D-Link D-Link Wireless G DWA-110	AirGCFG.exe	D-Link DWA-110 Wireless G USB adapter driver and configuration utility
Y	D-Link D-Link Wireless G DWA-510	AirGCFG.exe	D-Link DWA-510 Wireless G desktop adapter driver and configuration utility
Y	D-Link D-Link Wireless N Dual Band DWA-160	AirNCFG.exe	"D-Link DWA-160 Xtreme N Dual Band USB adapter driver and configuration utility"
Y	D-Link D-Link Wireless N DWA-130	AirNCFG.exe	"D-Link DWA-130 Wireless N USB adapter driver and configuration utility"
Y	D-Link D-Link Xtreme N Dual Band DWA-160	AirNCFG.exe	"D-Link DWA-160 Xtreme N Dual Band USB adapter driver and configuration utility"
Y	D-Link RangeBooster G WDA-2320	AirPlusCFG.exe	"D-Link WDA-2320 RangeBooster G desktop adapter driver and configuration utility"
Y	D-Link RangeBooster G WUA-2340	AirPlusCFG.exe	"D-Link WUA-2340 RangeBooster G USB adapter driver and configuration utility"
Y	D-Link Wireless G WDA-1320	AirGCFG.exe	"D-Link WDA-1320 Wireless G desktop adapter driver and configuration utility"
Y	D-Link Wireless G WUA-1340	AirGCFG.exe	"D-Link WUA-1340 Wireless G USB adapter driver and configuration utility"
X	D3**.exe [* = random char]	D3**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	D3**32.exe [* = random char]	D3**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
N	DACONFIGEXE	daconfig.exe	3Com NIC Diagnostics. Available via Start -> Programs
X	Daemon	daemon.exe c daemon2.exe	"Added by the SELOTIMA.A WORM!"
X	Daily Weather Forecast	weather.exe	"Added by the DLOADER-IP TROJAN!"
X	DamedWare Services	dwdrce.exe	"Added by the RBOT-AOJ WORM!"
U	Dancer	DncLE.exe	"Part of Microsoft Plus! Digital Media Edition - see here"
X	dark	imgst.scr	"Added by the BANCOS.U TROJAN!"
X	dark	imgrt.scr	"Added by the BANCBAN-FH TROJAN!"
X	dark	csrs.scr	"Added by the BANCBAN-GT or BANCBAN-GU TROJANS!"
X	daskgfkkcx15	dasdsaads15.exe	"Added by the ONLINEG-Q TROJAN!"
N	Data LifeGuard	BACKWE~1.EXE	Data LifeGuard diagnostic tools for Western Digital's series of hard drives
X	Data Protection	datprot.exe	"Data Protection rogue security software - not recommended
X	Data Restore Service	prq8.exe	"Added by the KELVIR.AI WORM!"
X	DATABASE MySql	[path] repcale.exe [path] beird.exe	"Added by the RANDON-AL WORM! Both files are often located in %System%\qsws"
N	DataCaching	FlashKsk.exe	"SmartMedia Card management from the installation of a SanDisk reader for a camera's SmartMedia card and also adds the "Unplug and Eject Hardware" System Tray icon"
N	DataViz Inc Messenger	DvzIncMsgr.exe	"Installed with DataViz ""Documents to Go"" software"
X	Datcheck	datcheck.exe	"Added by the KEYPANIC TROJAN!"
?	Datechecker	N/A	"Could be related to this?"
U	DAZEL Delivery Agent	DcDaemon.exe	"Control and send documents
X	dc	dc.exe	"Added by the COIDUNG-A WORM!"
X	dc2k5	SVIQ.EXE	"Added by the COIDUNG-A WORM!"
U	DC300 Monitor	cmonitor.exe	Monitor for a Acer DC300 digital camera
X	DC6	dc6_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	DC6cw	DC6cw.exe	"Part of the DriveCleaner rogue security software - not recommended
X	DC6_Check	uwasdc.exe	"Part of the WinAntiSpyware 2006 and WinAntiSpyware 2007 rogue spyware removers - not recommended"
X	DC6_check	dc6_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	dc6_check	dcmon.exe	"SystemDoctor rogue security software - not recommended
X	dcc	dcc_.exe	"Added by the AGENT-GBJ TROJAN!"
X	DCE Manager	dcemgr.exe	"Added by the TUMAG TROJAN!"
U	DCfssvc	dcfssvc.exe	"Associated with digital cameras and can cause problems which disappear if disabled. If this program is unchecked in startup
U	dcfssve	dcfssvc.exe	"Associated with digital cameras and can cause problems which disappear if disabled. If this program is unchecked in startup
X	DCOM Server	[path to trojan]	"Added by the AGENT-CCQ BACKDOOR!"
X	Dcom System Patch	Microsoft.exe	"Added by the RANDEX.MS WORM!"
X	dcsm	dcsm.exe	"Part of the PrivacyProtector and DriveCleaner rogue security tools"
N	DDCActiveMenu	DDCActiveMenu.exe	Digital Distribution Channel - formally part of the WildTangent on-line games delivery service. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
N	DDCM	DDCMan.exe	Digital Distribution Channel - formally part of the WildTangent on-line games delivery service. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
N	DDCMan	DDCMan.exe	Digital Distribution Channel - formally part of the WildTangent on-line games delivery service. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
X	ddeproc	ddeproc.exe	"Webcelerator from eAcceleration speeds your Web browsing by both remembering where you have been and anticipating where you will go. Only needed if you find it improves web browsing. Now no longer available and supported and when available was classed as spyware - see here"
U	ddoctorv2	sprtcmd.exe /P ddoctorv2	"Comcast Desktop Doctor (provided by SupportSoft
X	DDriver	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
N	DeadAIM	"rundll32.exe DeadAIM.ocm	ExportedCheckODLs"
X	Deewoo	ncntnkwd.exe	Identified as a variant of the AdWare.Win32.ZenoSearch.am malware
X	Default System Research	vhchost.exe	"Added by the TARNO.I TROJAN!"
X	DefaultConfiguration	defaultconfh.exe	"Added by the AGOBOT-JC WORM!"
X	Default_Page_URL	http://find.naupoint.com	"Naupoint browser hijacker"
X	Default_Search_URL	http://find.naupoint.com	"Naupoint browser hijacker"
X	DefendAPc	DefendAPc.exe	"DefendAPc rogue security software - not recommended
X	Defense Center	defcnt.exe	"Defense Center rogue security software - not recommended
X	DefenseNetSurfage	GDC.exe	"DefenseNetSurfage rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	defragm_check	defragment.exe	"CoolWebSearch parasite variant"
X	defragsys	svchost.exe	"Added by the BIFROSE-TH TROJAN! Note - this is not the legitimate svchost.exe process which should normally figure in Msconfig/Startup!"
U	defwatch	defwatch.exe	Detects out-of-date virus definitions for Norton Anti-Virus Corporate Edition and runs the Defwatch Wizard. Only required if you don't update the virus definitions manually on a regular basis
N	DelayShred	ShrCL.EXE	McAfee Shredder - not required at startup. You can run it manually via McAfee Security Center
?	delcab	deltreew.exe C:cabs	"??"
U	Dell DataSafe Scheduler	DataSafeOnlineScheduler.exe	"Scheduler for Dell DataSafe™ Online which ""helps protect your music
N	Dell QuickSet	quickset.exe	Dell taskbar icon allowing you to quickly change settings
Y	Dell Webcam Central	WebcamDell.exe	"Dell Webcam Central - webcam management software controlling aspects such as picture control
N	DELL Webcam Manager	DellWMgr.exe	Dell Webcam Manager - Webcam management software provided on Dell PCs
Y	DellAutomatedPCTuneUp	PTAgnt.exe	"PC TuneUp from Dell - ""silently monitors your system
N	DellSC	dellsc.exe	Dell Solution Center - web-based troubleshooting tools and educational offerings
U	DellSupportCenter	sprtcmd.exe /P DellSupportCenter	"Dell Support Center (provided by SupportSoft
U	DellTouch	MMKeybd.exe	Dell multimedia keyboard manager. Required if you use the additional keys
U	DellTouch	DELLMMKB.EXE	Multimedia keyboard control for Dell based PCs - only required if you use the multimedia keys
X	delol	hiquooc.exe	"Added by the BDOOR-AMP TROJAN!"
X	delsubmit	"rundll32.exe advpack.dll	DelNodeRunDLL32 submit.exe"
X	DeluxeCommunications	Dxc.exe	"Deluxe Communications adware - successor to SurfSideKick"
X	DELXP Protocol	delxp.exe	"Added by a variant of the SDBOT WORM!"
X	Deneca	Virus salvado	"Added by the DELUZ VIRUS!"
X	deryheruxc	keepSafe.exe	"Added by the KILLAV.KAX TROJAN!"
X	DescargaBromas	"rundll32.exe MSA64CHK.dll	DllMostrar"
?	Description of Shortcuts	*.exe	"* seems to be a sequence of alphanumerics that can be different
?	desk-top-service	desk-top-service.exe	"??"
X	DeskAd Service	DeskAdServ.exe	"DeskAd.Service adware"
N	DeskColor	DESKCOLOR.EXE	Provides transparent icon text backgrounds and coloured icon text
U	deskmech	deskmech.exe	"Part of Desktop Maestro from PC Tools - which ""combines the features of our award winning products
U	Desksite CMA	cma.exe	"DeskSite CMA siftware - ""retrieves new content from the DeskSite Data Center"""
U	DeskSpace	deskspace.exe	"DeskSpace desktop management utility from Otaku Software Pty Ltd - which ""gives you more space for your windows and icons. You can eliminate desktop clutter by arranging your windows and icons across up to six desktops
X	Desktop	"rundll32.exe msconfd.dll	Restore ControlPanel"
X	Desktop	Desktop.com	"Added by the VB-DRN WORM!"
N	Desktop Architect	DATRAY.EXE	"Desktop theme manager available
U	Desktop Calendar	Desktop Calendar.exe	"Desktop Calendar - ""Desktop Calendar is a highly customizable calendar program that turns your desktop into a traditional wall calendar
U	Desktop iCalendar	Calendar.exe	"Older version of Desktop iCalendar/Desktop iCalendar Lite by Desksware which include support for Google Calendar and add weather
U	Desktop iCalendar	Desktop iCalendar Lite.exe	"Desktop iCalendar Lite by Desksware - ""is a free desktop calendar for Windows. It allows you to manage your events
U	Desktop iCalendar	Desktop iCalendar.exe	"Desktop iCalendar by Desksware - ""is a handy desktop calendar for Windows. It stays on your desktop and shows the days of the current month. It can sync with your Google Calendar
U	Desktop iCalendar Lite	Desktop iCalendar Lite.exe	"Desktop iCalendar Lite by Desksware - ""is a free desktop calendar for Windows. It allows you to manage your events
U	Desktop iCalendar Lite.exe	Desktop iCalendar Lite.exe	"Desktop iCalendar Lite by Desksware - ""is a free desktop calendar for Windows. It allows you to manage your events
U	Desktop iCalendar.exe	Desktop iCalendar.exe	"Desktop iCalendar by Desksware - ""is a handy desktop calendar for Windows. It stays on your desktop and shows the days of the current month. It can sync with your Google Calendar
U	Desktop Maestro	deskmech.exe	"Part of Desktop Maestro from PC Tools - which ""combines the features of our award winning products
X	Desktop Search	desktop.exe	"iSearch adware"
X	Desktop Security 2010	Desktop Security 2010.exe	"Desktop Security 2010 rogue security software - not recommended
N	Desktop Service Centre	DSC.exe	OptusNet DSL or Dial-Up connection software
N	Desktop Weather	THE WEATHER CHANNEL.exe	"Desktop Weather by The Weather Channel - provides current temperature
N	Desktop Weather 3	THE WEATHER CHANNEL.exe	"Desktop Weather 3 by The Weather Channel - provides current temperature
U	DesktopIconToy	DesktopIconToy.exe	"""Desktop Icon Toy is an easy to use desktop icon enhancement tool
U	DesktopMaestro	deskmech.exe	"Part of Desktop Maestro from PC Tools - which ""combines the features of our award winning products
X	DesktopUpdate	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	detect	idetect.exe	"iNTERNET Turbo from Clasys Ltd. "It accelerates any Windows 95/98/Me/NT/2000/XP internet connection in seconds". If you find it helps your connectivity leave it enabled"
?	detect	turbodetect.exe	"??"
N	Detector	detector.exe	"USB port detector for LG scanners. Sits in the System Tray
U	DetectorApp	DetectorApp.exe	"Related to Roxio MyDVD (was Sonic) DVD authoring software"
X	Deus Cleaner	DCleaner.exe	"Deus Cleaner rogue system cleaner utility - not recommended"
?	DevconDefaultDB	READREG	"Appears to be related to older Creative Soundblaster soundcards"
X	Device Configuration Loader	msdvc32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
U	Device Detector	DevDetect.exe	"ACDSee Auto Device Detector detects when a device is connected to your PC and gives you the option to acquire images from it automatically"
N	Device Detector 2	DevDtct2.exe	"Installed by various Olympus products
X	Device Hardware	devicehnd.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Device IO System	deviceio.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Device Management	wnsystem.exe	"Added by the AGOBOT-LH WORM!"
X	Device Manager	wfxmgr.exe	"Added by the RBOT.AJU WORM!"
X	Device Security	dvcsecure.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Device Security Driver	devicesec.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Device Security Manager	dvcsecure.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
U	DeviceDiscovery	hpotdd01.exe	"Detection of new imaging
X	DevicePath	Proyecto1.exe	"Added by the GRUEL WORM!"
X	DevicePath	Root.exe	"Added by the GRUEL WORM!"
U	Devices	olesvr.exe	"Salfeld Child Control - parental control software"
X	Devicewin	[path to trojan]	"Added by the BANKER-AEV TROJAN!"
X	DHCP	smss.exe	"Added by the WINSPY.AG TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\display"
X	DHCP Server	regsvr.exe	"Added by the RBOT-PR WORM!"
X	DHCP32	services.exe	"Added by the WINSPY.AG TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\display"
Y	dhcpagnt	dhcpagnt.exe	Intel DSL modem driver - leave enabled or you'll have to re-install the drivers
X	DhcpCep	PYJJKIME.exe	"Added by the AGENT-BXQ TROJAN!"
X	Diagnostic	diagnostic.exe	"Added by the ALPHA-C TROJAN!"
X	Diagnostic Agent	diagent.exe	"Added by the AGOBOT-CW WORM!"
X	Dialer	"rundll32.exe MSA32CHK.dll	Reg"
U	Dialer Control	dc.exe	"Dialer-Control. Detects and protects from premium rate adult content diallers"
U	Dialer Detect	dd.exe	"DialerDetect detects stealth installed premium rate diallers
X	DialUp Network Application	Rnaap.exe	"Added by a variant of the SDBOT WORM!"
U	Diamondback	razerhid.exe	"Razer Diamondback 3G gaming mouse driver - required if you use the additional features and programmed keys/macros"
X	DIECOX	csrss.exe	"Added by a variant of the ATM.GEN TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Diesel	Recalculate.exe	"Added by the LAZAR TROJAN!"
U	DigiCell	DigiCell.exe	"MSI DigiCell - ""the most useful and powerful utility that MSI has spent much research and efforts to develop
N	DigiGuide	CLIENT.EXE	TV guide and reminder
N	DigiGuide	client01.exe	TV guide and reminder
N	Digital Line Detect	DLG.exe	Detects whether your are plugged into a digital telephone line and displays the information graphically. Installed by Dell (and maybe others) and is included with all Connexant V.92 and Broadcom modems
X	Digital Protection	digprot.exe	"Digital Protection rogue security software - not recommended
U	DIGServices	DIGServices	Created by Disney but licensed to ESPN for watching videos
N	DIGServices	DIGServices.exe	Created by Disney but licensed to ESPN for watching videos
X	Diomacd	fdafbfd.exe	"Added by the MULDROP.F TROJAN!"
X	Dir1	caKe	"Added by the CAKE WORM!"
X	Direct settings	sdchost.exe	"Added by the DAEMONI-I TROJAN!"
U	Direct Update	DUControl.exe	"DirectUpdate dynamic DNS updater"
X	Direct X Direct3D	dxd3d.exe	"Added by a variant of the SDBOT WORM!"
X	Direct X Opengl	dxopengl.exe	"Added by a variant of the RBOT-CJ WORM!"
X	direct3d.exe	direct3d.exe	"Added by the CERTIF-F TROJAN!"
N	DirectCD	DirectCD.exe	DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later
X	Director Video	btnmgern.exe	"Added by the MYTOB-KL WORM!"
Y	Directory Opus Desktop Dblclk	dopusrt.exe	"Directory Opus - an advanced file manager. ""Directory Opus goes beyond the simple file manager metaphor
X	directs.exe	directs.exe	"Added by the BEAGLE.O or BEAGLE.R or BEAGLE.S or BEAGLE.T WORMS!"
U	DIRECTVDSL	Directvdsl.exe	Starts DirectTV DSL modem at boot up. Can also be started manually
X	DirectX	ddhelp32.exe	"Added by the BIONET.318 TROJAN! Note - not the DirectX helper which is ddhelp.exe"
X	directx	Directx.exe	"Added by the SDBOT.D TROJAN!"
X	directx	Sqlexploit.exe	"Added by the SDBOT.D TROJAN!"
X	DirectX	DirectX.exe	"Added by the BLAXE or LOGPOLE WORMS!"
X	directx	NTCmd.exe	"Added by the SDBOT.D TROJAN!"
X	directx	PipeCmd.exe	"Added by the SDBOT.D TROJAN!"
X	DirectX 32	directx32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	DirectX Driver	stdhost.exe	"Added by the SDBOT.GVJ BACKDOOR!"
X	DirectX For Microsoft Windows	dtxservice.exe	"Added by the PROGENT TROJAN!"
X	DirectX for Microsoft Windows	Fservice.exe	"Added by the PRORAT TROJAN!"
X	DirectX for Microsoft Windows	Sservice.exe	"Added by the PRORAT TROJAN!"
X	DirectX For Microsoft® Windows	fservice.exe	"Added by the PRORAT-P TROJAN!"
X	DirectX For Microsoft® Windows	fservice.exe	"Added by the PRORAT-L TROJAN!"
X	DirectX shell driver	[path to trojan]	"Added by the MARKTMAN-B TROJAN!"
X	Directx Startup Drivers	direct.exe	"Added by the RBOT.UXL WORM!"
X	DirectX Video Driver	dxterm5.exe	"Added by the WILAB-A TROJAN!"
X	DirectX64	DirectXset.exe	"Added by the BROWNEY.A WORM!"
X	DirectX9	direct3d.exe	"Added by the AGENT.EAK TROJAN!"
X	DirectX9	svchost32.exe	"Added by the RBOT.AQG WORM!"
X	DirectX9 Diag	dx9diag.exe	"Added by the RBOT-ALT WORM!"
X	DirecX	DirecX.exe	"Added by the AGOBOT-HU BACKDOOR!"
X	DirLocker	dirlock.exe	"Added by the AUTORUN-AMS WORM!"
?	Disable EHCI	nousb20.exe	"??"
N	Disc Detector	CtNotify.exe	"For Creative sound cards. Detects when you insert a CD
?	disc detector	qnetquestnotifty.exe	"??"
?	discoveg	discoveg.exe	"??"
?	DISCover	DISCover.exe	"Related to DISCover Drop from Digital Interactive Systems Corporation. What does it do and is it required?"
N	DiscoverDeskshop	Deskshop.exe	"Discover Deskshop - single use ""virtual"" credit card"
U	DiscUpdateManager	DiscUpdMgr.exe	"Disc Update Manager for Digital interactive's DISCover Console. Provider of on-demand video games"
N	DiscUpdateManager	DiscUpdateMgr.exe	"DISCover from Digital Interactive Systems Corporation Inc. ""The company's patented Drop 'n' Play technology provides a simple
U	DiscWizardMonitor.exe	DiscWizardMonitor.exe	"Seagate DiscWizard - hard disk utility for Seagate's SATA and PATA (IDE) drives"
X	Disk Check	chkdsk32.exe	"Added by the IM TROJAN!"
U	Disk Cleaner	DiskCleaner.Exe	"Hard disk management part of TuneUp Utilities from TuneUp Distribution GmbH"
X	Disk Defragmentation Loader	pmsvcr.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Disk Essensial Tools	detsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Disk Keeper	SECURITY.EXE	"Daosearch adware"
X	Disk Panel Configuration	dpcsvc.exe	"Added by the IRCBOT.BSQ BACKDOOR!"
X	Disk Panel Setup	npcsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	DiskCheck	msdarkend.exe	Added by an unidentified WORM or TROJAN!
N	DiskeeperSystray	DkIcon.exe	"DisKeeper defragmentation software - can be started manually"
X	Diskstart	Code.exe	Adult content dialler
X	Diskstart	cat.exe	MS-Connect dialler
U	DiskSuite	aDSProcMngr.exe	"Part of PC Tools Disk Suite from PC Tools - which ""is an all-in-one hard-disk management utility that integrates disk optimization
X	Dispatcher	dispatcher.exe	"Added by the DLOADR-AS TROJAN!"
X	Display	backup.exe	"Added by the BRONTOK-CR WORM!"
X	Display Drivers	cssrs.exe	"Added by the AGOBOT.FX WORM!"
N	DisplayTrayIcon	TrayIcon.exe	"System Tray access to display properties for ABIT graphics cards. Unless you change your desktop resolution
X	Dist-FBGeneve	GDC.exe	"NettoyeurDePC French rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	Distributed File System	Dfsvc.exe	"Added by the MYFIP.A or MYFIP.K WORMS!"
X	Distributed Link Tracking	ascvt.exe	"Added by the AGOBOT-GH BACKDOOR!"
U	distributed.net client	DNETC.EXE	"Dsitributed computing projects client from Distributed.net where numerous computers are used to share a projects workload - similar to SETI@Home and Folding@Home. Also prone to being distributed by viruses"
X	divx	divxenc.exe	"Added by the SPBOT.B TROJAN!"
X	Divx	codll.exe	"Added by the GRAVEBOT-A TROJAN!"
X	Divx4 codec	devldr32.exe	"Added by an unidentfied VIRUS! Note - this is not the legitimate Creative Labs devldr32.exe file"
X	DivXCodec	NEWMAIL.exe	"Added by the DELF-RQ BACKDOOR!"
?	Dixons Insert Detect	InsDetect.exe	"Part of Dixons Picture Suite. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
N	DJRegFix	regedit /s c:hpdjregfix.reg	"DJRegFix showed up first in WinME as a ""clever"" way to ensure that all Hewlett-Packard DeskJet printers actually worked with WinME - since most were having major problems. This ""utility"" adds the functionality and compatibility HP forgot to add in its WinME drivers"
?	DJSNetCN	DJSNetCN.exe	"""Symantec Licensing Detect Internet Connection""
Y	DkService	DkService.exe	"From Executive Software's Diskeeper defragmenting utility - a replacement for Windows Disk Defragmenter. It's recommended to leave this enabled
Y	dla	tfswctrl.exe	"Drive letter access to a UDF packet writer for CD-RW - from HP
Y	DLA	DLACTRLW.EXE	"Drive letter access to a UDF packet writer for CD-RW - from HP
Y	DLACTRLW	DLACTRLW.EXE	"Drive letter access to a UDF packet writer for CD-RW - from HP
Y	DLACTRLW.EXE	DLACTRLW.EXE	"Drive letter access to a UDF packet writer for CD-RW - from HP
N	dlbcserv	dlbcserv.exe	Related to Dell Photo Printers and provides additional configuration options for these devices
Y	DLBTCATS	"rundll32 [path] DLBTtime.dll	_RunDLLEntry@16"
Y	DLBUCATS	"rundll32 [path] DLBUtime.dll	_RunDLLEntry@16"
Y	DLBXCATS	"rundll32 [path] DLBXtime.dll	_RunDLLEntry@16"
Y	DLCCCATS	"rundll32 [path] DLCCtime.dll	_RunDLLEntry@16"
U	dlccmon.exe	dlccmon.exe	Dell Photo AIO Printer 924 device monitor
Y	DLCDCATS	"rundll32 [path] DLCDtime.dll	_RunDLLEntry@16"
U	dlcdmon.exe	dlcdmon.exe	Dell Photo AIO Printer 944 device monitor
Y	DLCFCATS	"rundll32 [path] DLCFtime.dll	_RunDLLEntry@16"
Y	DLCGCATS	"rundll32 [path] DLCGtime.dll	_RunDLLEntry@16"
U	dlcgmon.exe	dlcgmon.exe	Dell Photo AIO Printer 810 device monitor
Y	DLCICATS	"rundll32 [path] DLCItime.dll	_RunDLLEntry@16"
X	dlcipscl	dcpavss.exe	"Added by the MAILBOT-CB TROJAN!"
Y	DLCJCATS	"rundll32 [path] DLCJtime.dll	_RunDLLEntry@16"
U	dlcjmon.exe	dlcjmon.exe	Dell Photo AIO Printer 964 device monitor
Y	DLCQCATS	"rundll32 [path] DLCQtime.dll	_RunDLLEntry@16"
U	dlcqmon.exe	dlcqmon.exe	Dell Photo AIO Printer 966 device monitor
Y	DLCXCATS	"rundll32 [path] DLCXtime.dll	_RunDLLEntry@16"
U	dlcxmon.exe	dlcxmon.exe	Dell Photo AIO Printer 926 device monitor
X	DlDir1	caKe	"Added by the CAKE WORM!"
?	DLForcerExe	DLForcerEXE.exe	"??"
N	DLF_00000B00	Vcdlf.exe	"Known to cause problems with "Out of memory" errors (see here). Otherwise
N	DLG	DLGCHBW.exe	Backweb part of Data LifeGuard - diagnostic tools for Western Digital's series of hard drives. Automatically detects an internet connection and downloads any available updates
N	DLHelperEXE	WATCH.exe	Download helper distributed with some software that allows the software installation to redirect download locations. Not required once the installation is finished
X	Dll Link	svchoist.exe	"Added by the AUTOSKY WORM!"
X	Dll Link	svchost.exe	"Added by the AUTOSKY WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Favourites folder"
X	DLL Service Manager	[path to worm]	"Added by the RPCBOT.F TROJAN!"
X	dll services	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	dllcache.exe	dllcache.exe	"Added by the VISPAT.A WORM!"
X	DllCacherv2	dllcachev2.exe	"Added by the LATEDA TROJAN!"
X	dllcvss	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	DllExecutable	[path to file]	"Added by the VB-SP WORM!"
X	DLLService32	dllsvc32.exe	"Added by the AGOBOT.VX WORM!"
Y	DLO Agent	DLOClientu.exe	"Part of the backup suites from VERITAS - Backup Exec and NetBackup. Both have now been replaced by their Symantec equivalents since they acquired VERITAS in 2005"
X	dluca	dluca.exe	"Added by the DLUCA.C TROJAN!"
X	dm***.exe [* = random char]	dm***.exe [* = random char]	"Wareout - malware masquerading as a spyware and dialer remover"
N	DMAScheduler	DMAScheduler.exe	"Related to DigitalMedia Plus Archiver. This program is non-essential process to the running of the program
X	DMC	dmc.exe	Added by Trojan-Downloader.Win32.Dluca.bv TROJAN!
X	Dmsvc32	Dmsvc32.exe	"Added by the AGOBOT.ABU WORM!"
U	DmwClient	dmwclient.exe	"DMW ""anti-cheating"" software for online gaming"
U	DMXLauncher	DMXLauncher.exe	"Part of Dell's Media Experience
X	dm_service	[path to file]	"Added by the MITGLIEDER.P TROJAN!"
Y	DNE Binding Watchdog	"rundll dnes.dll	DnDneCheckBindings"
Y	DNE DUN Watchdog	"rundll dnes.dll	DnDneCheckDUN13"
X	DNS	mc-58-12-0000080.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-58-12-0000093.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-110-12-0000079.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-58-12-0000120.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-58-12-0000140.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS Config service	win32.exe	"Added by the RBOT-TL WORM!"
X	DNS Service	dnsresolver.exe	"Added by the RBOT-PQ WORM!"
X	DNS Service	dnssvc.exe	"Added by the DELBOT-Z WORM!"
?	DNS2GoClient	dns2goclient.exe	"DNS2Go is a Domain Name System that will make your computer accessible anytime
X	DnsCache	Wscript.exe dns_cache.vbs	"Added by the AUTORUN-AWI WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""dns_cache.vbs"" file is located in %System%"
X	DNSCacheBoost	dnsping.exe	"Added by the DNSBUST-A TROJAN!"
X	dnscleaner	dnscleaner.exe	"CoolWebSearch parasite variant"
?	DNXVC	dnxvc.exe	"??"
X	doc	doc.exe	"Added by the AGOBOT-BJ WORM!"
X	DocTor	Doctor.exe	"Added by the DOTOR.A WORM!"
X	Doctor Antivirus 2008	antvr.exe	"Doctor Antivirus 2008 rogue security software - not recommended
N	DocuMagix Init	PWATCH.EXE	"PaperMaster is an application for the PC designed to automate the process of organizing
U	Document Manager	docmgr.exe	"Wave Systems Corp. Document Manager - ""provides secure storage and management capabilities for file and folder level encryption"""
X	Domain Name Resolve Service	dnsresolver.exe	"Added by the KIMAN.A WORM!"
X	DomPlayer Service	wakeservice.exe	"DomPlayer adware"
U	Don't Panic	dontpanicdemodp.exe	"30-day trial version of Don't Panic privacy software from Panicware. "Clean up Internet tracks and quickly hide personal documents with this privacy suite.""
U	Don't Panic Pop-Up Stopper	dpps2.exe	"Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group"
U	Don't Panic!	DP.EXE	"Don't Panic! privacy software from Panicware. ""Clean up Internet tracks and quickly hide personal documents with this privacy suite"""
X	Dos Prompt Loader	cygwin.exe	"Added by the SDBOT-VV WORM!"
X	Dot1XCfg	Dot1XCfg.exe	"Added by the AGOBOT.EA TROJAN!"
N	Download Accelerator Manager Free Edition	dam.exe	"Download Accelerator Manager Free Edition from Tensons Corp"
N	Download Accelerator Plus 5.0	DAP.exe	"Download Accelerator Plus from Speedbit. Download manager for resuming downloads
N	DownloadAccelerator	DAP.EXE	"Download Accelerator Plus from Speedbit. Download manager for resuming downloads
X	DownloadLegalMusic	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	DownloadMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	DownloadsAndMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
Y	Dpcnav	dpcnav.exe	"DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access"
N	DPConfig	DPConfig.exe	"Compuware DevPartner Studio Configuration Utility
X	dpcproxy	dpcproxy.exe	"Added by the GOLDENP-A TROJAN!"
Y	DPCProxyLoadOnStartup	dpcstart.exe	"DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access"
Y	Dpcstart	dpcstart.exe	"DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access"
N	dptracker	dptracker.exe	"CamTrack webcam software that enhances the way people video chat"
X	dpzProtect	n.vbe	"Added by the RUNAUTO.H WORM!"
X	DR service	[path to worm]	"Added by the RBOT-CZT WORM!"
N	Drag'n'Drop_Autolaunch	Autolaunch.exe	"Iomega HotBurn - CD-RW burning software"
N	Drag-to-Disc	DrgToDsc.exe	"System Tray access to Roxio Drag-to-Disc - part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools. ""Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically"". Not required for Roxio to work properly and available via the Start menu"
N	DragnDrop_Autolaunch	Autolaunch.exe	"Iomega HotBurn - CD-RW burning software"
X	DRam prosessor	plscd.exe	"Added by the RBOT.CYA WORM!"
X	DRam rar proc	winupdaterar.exe	"Added by a variant of the IRCBOT TROJAN!"
X	DRam rare proc	updaterarwin.exe	"Added by the RBOT-GQW WORM!"
X	DrCache	MSTDC.EXE	"Added by the BDOOR-JM BACKDOOR!"
N	DrgToDsc	DrgToDsc.exe	"System Tray access to Roxio Drag-to-Disc - part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools. ""Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically"". Not required for Roxio to work properly and available via the Start menu"
X	DriveCleaner 2006 Free	UDC2006.exe	"DriveCleaner rogue security software - not recommended
X	DriveCleaner Free	UDC.exe	"DriveCleaner rogue security software - not recommended
X	DriveDefender	GDC.exe	"DriveDefender rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
U	DriveIcons	DriveIcon.exe	"Drive Icons from Realtek - shows a specific icon for each card type for their card reader controllers"
X	Driver32	Scam32.exe	"Added by the SIRCAM WORM!"
X	DriverCheck	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	DriverConf	dvrconf.exe	"Added by the AGOBOT-IY WORM!"
X	DriverDB	svcmdx32.exe	"Added by the BERPI TROJAN!"
X	DriverLoad	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
U	DriverMagicLogon	dmschedule.exe	"Part of DriverMagic - ""the easiest way to locate device drivers"""
N	DriverMax	devices.exe	"DriverMax from Innovative Solutions - ""a new tool that allows you to download the latest driver updates for your computer. No more searching for rare drivers on discs or on the web or inserting one installation CD after the other"""
X	DriverModule	csrnvrt.exe	"Added by the IRCBOT.I TROJAN!"
X	Drivers for Internet Explorer	accesweb.exe	"Added by the STARTPAGE.FW TROJAN!"
N	DriveSelect	driveselect.exe	"DVD X Copy XPress by 321 Studios. Creates a pop-up at Windows startup that asks for the DVD drive to be selected. Available via Start -> Programs"
X	drocher	d.exe	Adult content dialler
X	DrProtection	DrProtection.exe	"DrProtection rogue security software - not recommended"
U	DrvIcon	DrvIcon.exe	"""Vista Drive Icon changes the drive icons shown in Windows ""My Computer""
Y	Drwebscheduler	Drwebscd.exe	"DrWeb antivirus related - scheduler that allows you to manage an automatic launch of applications
U	DS Clock	dsclock.exe	"Digital desktop clock including synchronization with atomic servers - see here"
X	dS35DLL	ffqca.exe	"Added by the SDBOT-KV WORM!"
X	DSAcass	[path to file]	"Added by the RANKY.M TROJAN!"
U	dscactivate	dsca.exe	Dell Support Agent offers additional support and update features for your Dell computer or laptop
X	dsgb	lcsass.exe	"Added by the AGENT.TGZ BACKDOOR!"
X	Dskcompat	Dskcompat.exe	"Added by the GEMA TROJAN!"
X	DsmSer	msmpatch.exe	"Added by the SERFLOG.B WORM!"
X	DsplObjects	windspl.exe	"Added by the BEAGLE.DN WORM!"
X	DSService	dmrss.exe	"Added by the AGOBOT-XX WORM!"
X	dstiosys	plsitctl.exe	"Added by the MAILBOT-BX TROJAN!"
U	DT 11Mbps WLAN PC Card Station	DTCARDMonitor.exe	11Mbps PC Card based wireless LAN connection monitor - possibly from Deutsche Telekom
U	DualCoreCenter	StartUpDualCoreCenter.exe	"Unified control center for overclocking both the graphics card and the CPU
?	Duane Reade Insert Detect	InsDetect.exe	"Part of Duane Read Picture Suite & Digital Image Pack. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
X	duck	duck.exe	"Added by the AGOBOT-AVG WORM!"
X	Dumeter Services	dumeter.exe	"Added by the SDBOT-AEQ WORM!"
X	dumprep	spoolc.exe	"Detected by Kaspersky as a variant of the AGENT.CXF TROJAN!"
X	DUN_SERVICES3	dun3.exe	"Added by the SOKIRON TROJAN!"
X	Duweculey	yujixit.exe	"Added by the SDBOT.BRP WORM!"
X	Duwee wong Cerbon	Cirebons.exe	"Added by the BHARAT.A WORM!"
X	DVAScvssdfa	AsSDdwd.exe	"Added by the LIOTEN.IP TROJAN!"
U	DVD Device Lock for Win95/98/Me/2k/XP	DDLAgent.exe	"Loads Hide and Protect any Drives - which ""can be used to restrict read or write access to removable media devices such as CD
N	DVD@ccess	DVDAccess.exe	"Part of DVD Studio Pro from Apple Inc. - ""The DVD@CCESS feature allows you to add additional interactivity to your DVD title when it is played on a computer"""
?	DVDCheck	DVDCheck.exe	"Related to an Intervideo program. What does it do and is it required in startup?"
X	Dvdcompat	Dvdcompat.exe	"Added by the GEMA TROJAN!"
N	DVDLauncher	DVDLauncher.exe	"Part of Cyberlink's Power Cinema - allows you to play DVDs upon insertion"
U	dvHighMem	cfgmng32.exe	"Related to PureSight PC - designed to offer maximum flexibility and choice as families manage their internet use"
U	DVSync	dvsync.exe	DVSync is the program that allows you to synchronize your daVinci's PDA's data with your Personal Information Manager on the PC
X	Dvx	wsxsvc.exe	"Delfin Media Viewer or ""Promulgate"" adware variant"
N	DwlClient	support.exe	Download manager for Dell support alerts
X	Dx8compat	Dx8compat.exe	"Added by the GEMA TROJAN!"
N	DXM6Patch_981116	p_981116.exe	"Win32 cabinet self extractor. More info here"
X	DyFuCA	optimize.exe	"Adult content dialler - see here"
X	DyFuCA Active Alert	actalert.exe	"Adult content dialler - see here"
X	Dynamic DHCP	dydhcp.exe	"Added by the RINBOT.B TROJAN!"
X	Dynamic Dns Binary	dynitora.exe	"Added by the RBOT-WT WORM!"
X	Dynamic Dns Binary	CMD16.EXE	"Added by the RBOT-XM WORM!"
X	Dynamic Dns Binary	winxp34.exe	"Added by a variant of the RBOT WORM!"
X	Dynamic Dns Binary	WinHelpcfn.exe	"Added by a variant of the RBOT WORM!"
X	Dynamic Link Library loader	Loader32.exe	"Added by the KOL TROJAN!"
U	Dynu Basic Client	dynubas.exe	"Dynu online dynamic IP update client. Useful when using a dial up modem"
X	E-Card	ecard.exe	"Added by the YODI WORM!"
U	E-color	IconMgr.Exe	Sets the colour of your monitor when running games that recognise E-Color so that you get 'what the game designer intended' when you see the game. Also allows monitor callibration through a program called 3-Deep. If you play a lot of games it can be useful. Can be disabled from starting up from within the program
N	E-Color Registration	SonnReg.exe	"Registration for Colorific® and 3Deep® monitor calibration sofware from E-Color. Now superseded by ColorWizzard™ and 3DxWizzard™"
U	E06DXLRD_7604703	EDICT.EXE	"Related to Microsoft Encarta dictionary functions"
N	EA Core	Core.exe	"Electronic Arts EA Link software - ""gives you a secure yet simple way to download EA PC games and patches
U	eabconfg.cpl	EabServr.exe	Easy Access Buttons control panel on Compaq laptops. Only required if you use the extra keys
X	Eac Download	download.exe	"Webcelerator from eAcceleration speeds your Web browsing by both remembering where you have been and anticipating where you will go. Only needed if you find it improves web browsing. Now no longer available and supported and when available was classed as spyware - see here"
U	EACLEAN	eaclean.exe	"For Compaq PC's. Easy Access button support for the keyboard"
X	Eac_Cnry	canary.exe	"Added by the CANARY TROJAN!"
?	Eac_rnvdl	ANTIVIRUS_INSTALL.EXE	"??"
Y	EAFRCliStart	EAFRCliStart.exe	"Related to Encryption Anywhere hard disk encryption products from GuardianEdge"
U	eanth_critical_update_alert	sys_alert.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
U	eanth_critical_update_alert	EANTHO~1.EXE	"eAcceleration Stop-Sign security software related - previously not recommended (see here). It has now been delisted
U	eanth_system_patcher	sys_alert.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
N	Eapcisetup	sbsetup.exe	Rockwell RipTide soundcard application software. Sound works without it
N	EAPCISETUP	wizard.exe	Part of the Creative Sounblaster PIC Installation Wizard. Probably left as a result of a failed installation
Y	Earthlink Protection Control Center	elnk_pcc.exe	"EarthLink Protection Control Center - ""powerful
N	Easy CD Creator	RoxAssist.exe	"Roxio Assistant is designed to correct engine initialization errors in Easy CD & DVD Creator 6. If the engine does not initialize
N	EasyNetwork	McENUI.exe	"McAfee's EasyNetwork user interface - ""enables secure file sharing
X	EasySearchBar	ESBUpdate.exe	EasySearchBar adware downloader
X	EasySpywareCleaner	EasySpywareCleaner.exe	"EasySpywareCleaner rogue spyware remover - not recommended
U	EasySync Pro	XCPCMenu.exe	"""IBM® Lotus® EasySync® Pro is a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - 3CmPlm	AutoDet.exe	"3Com Palm PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - LtNts4	NtsAgent.exe	"Lotus Notes 4 specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - PocketPC	AUTODE~1.EXE	"Windows Mobile Pocket PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - PocketPC	AutoDetect.exe	"Windows Mobile Pocket PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
X	EbatesMoeMoneyMaker	wjview ...Code	"Ebates adware"
U	EC21	EZQ.EXE	"Related to EC21 ""the world's largest B2B marketplace to facilitate online trades between exporters and importers from all around the world"""
U	ECenter	gtb.exe	Dell E-Center/Google Toolbar related
N	ECenter	EULALauncher.exe	End User License Agreement (EULA) launcher - related to Dell E-Center/Google Toolbar
X	ecko	claro.exe	"Added by the DLOADR-AQJ TROJAN!"
?	ecpe	ECPE.EXE	"??"
U	eDataSecurity Loader	eDSloader.exe	"Part of Acer Empowering Technology. ""Acer eDataSecurity Management is a handy file encryption utility that protects files from being accessed by unauthorized persons
?	EDFcsn	discfcsn.exe	"Related to Hewlett-Packard's Discovery Agent. What does it do and is it required?"
X	educational writer	[random filename]	"Added by the RBOT-LZ WORM!"
X	EDxMC110	Isass.exe	"Added by the VB-NIA WORM!"
X	Eech	hoor.exe	"PurityScan adware"
U	Eee Docking	Eee Docking.exe	"Intuitive shortcuts for easy access to digital content
X	Efata	[random 5 characters].exe	"Added by the FLUKAN-D WORM!"
U	eFax 4.1	J2GDllCmd.exe	"DLL Command Utility for version 4.1 of eFax Messenger from j2 Global Communications
U	eFax 4.2	J2GDllCmd.exe	"DLL Command Utility for version 4.2 of eFax Messenger from j2 Global Communications
U	eFax 4.3	J2GDllCmd.exe	"DLL Command Utility for version 4.3 of eFax Messenger from j2 Global Communications
U	eFax 4.4	J2GDllCmd.exe	"DLL Command Utility for version 4.4 of eFax Messenger from j2 Global Communications
U	eFax DllCmd	J2GDllCmd.exe	"DLL Command Utility for eFax Messenger from j2 Global Communications
U	eFax DllCmd 3.5	J2GDllCmd.exe	"DLL Command Utility for version 3.5 of eFax Messenger from j2 Global Communications
U	eFax DllCmd 4.0	J2GDllCmd.exe	"DLL Command Utility for version 4.0 of eFax Messenger from j2 Global Communications
U	eFax Live Menu 3.3	J2GDllCmd.exe	"DLL Command Utility for version 3.3 of eFax Messenger from j2 Global Communications
N	eFax.com Tray Menu	HotTray.exe	"eFax Messenger Tray Menu system tray icon for eFax Messenger Plus. Available via Start -> Programs. Disabling instructions available here"
X	egikugu	napolecy.exe	"Added by the SDBOT.AOE WORM!"
N	EgisTecLiveUpdate	EgisUpdate.exe	"Software updater for biometric and data encryption products from EgisTec Inc"
X	ehSched	ehSched.exe	"Added by the SDBOT-DHF WORM!"
U	Eicon NetworksLAN_DAEMON	watch.exe	"Associated with an Eicon Networks ISDN or ADSL modem. Watch protocols your connection with numbers and duration. You need callvu.exe (from Start Menu) to see your connection statistics. You can manually start watch.exe before you go online. Needs diinfo.exe (started by DiTask) to work correctly which can be started manually"
U	Eicon TechnologyLAN_DAEMON	watch.exe	"Associated with an Eicon Networks ISDN or ADSL modem. Watch protocols your connection with numbers and duration. You need callvu.exe (from Start Menu) to see your connection statistics. You can manually start watch.exe before you go online. Needs diinfo.exe (started by DiTask) to work correctly which can be started manually"
X	eixfi	china.bat	"Added by the WCUP.A WORM!"
U	ELBERTRicoh_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Ricoh MFP Type 104 multifunction printer
U	ELBERT_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX-5x30 Series multifunction printers
U	Elbycheck	ElbyCheck.exe	"From Elaborate Bytes who make CloneCD - monitors the installed filters of CD-ROMs/DVD-ROMs. Note - under Win2K removing this from startup causes the CD drive in the computer to not be recognized in the OS and after rechecking it prompts that the driver has been corrupted and asks you to restart the computer to fix it"
U	Electron Microscope	EMIII.exe	"Electron Microscope or EM - is a program used to track Stanford's distributed computing program client called Folding at Home
X	element furth	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are often located in %System%\vert"
X	EliteProtector	EliteProtector.exe	"EliteProtector rogue spyware remover - not recommended
?	ElkCtrl	ElkCtrl.exe	Entry added when you install versions of the Logitech QuickCam webcam software. It's exact purpose is unknown at the present time
Y	ElsaCapiCtl	Rcapi.exe	"Assumed to stand for Remote Common Application Programming Interface (RCAPI)
U	ELSAChipGuard	elsavect.exe	"ChipGuard for ELSA graphics cards - monitoring solution which monitors both the GPU temperature and fan speed
U	ELSBLaunch	ELSBLaunch.exe	"EarthLink SpamBlocker"
U	eMachines eBoard	Eboard.exe	eMachines multimedia keyboard manager. Required if you use the extra keys
Y	Email Protection	emlproxy.exe	"AntiVirus Quick Heal - E-mail protection"
Y	EmailScan	mcvsescn.exe	Related to McAfee AntiVirus suite - used to automatically scan incoming e-mails
U	EMBASSY Trust Suite Secure Update	AutoUpdate.exe	"Updates for Wave Systems Corp. Embassy Trust Suite - ""delivers advanced levels of security to the client PC using the TPM security chip found on most enterprise PCs today"""
X	eMCryT Sh3ars Panagers	[path to worm]	"Added by the RBOT-AWI WORM!"
X	emoc0re	emo.exe	"Added by the AGOBOT-AGE WORM!"
?	Empowering Technology Launcher	eAPLauncher.exe	"Part of Acer Empowering Technology. What does it do and is it required?"
?	EmpoweringTechnology	Framework.Launcher.exe	"Part of Acer Empowering Technology. What does it do and is it required?"
N	eMusicClient Systray	eMusicClient.exe	"eMusic MP3 download software"
U	EM_EXEC	EM_EXEC.EXE	"Logitech Mouseware driver. Needed to support some additional functionality of Logitech mice/trackballs such as ""SmartMove"". If you disable it and find you don't need it leave it disabled"
N	EN4060C Taskbar	en4060ct.exe	Comes with Efficient Networks DSL Modems. Little red/green/yellow flashing icon in system tray
?	encapsulated command tool	wintr.com	"??"
N	Encarta Dictionary Quickshelf	QSHLFED.EXE	"Provides quick access to Encarta's Dictionary features?"
N	ENCMONITOR	monitor.exe	The Encompass Monitor. This program is the Connect Direct Program. It is more trouble than it is worth and few use it
N	Encoder Agent	WMENCAGT.EXE	"MS Windows Media Encoder
U	Encompass_ENCMONTR	ENCMONTR.EXE	Optional simple browser from Yahoo (Encompass)
?	ENCSurf	surfboard.exe	"??"
U	enginecs2	enginecs2.exe	"Cyber Sentinel - internet filtering software"
X	enhance32	enhance32.exe	"Added by the CRYPTER.A TROJAN!"
X	Enterprise Suite	WE[random characters].exe	"Enterprise Suite rogue security software - not recommended
U	Enterra Icon Keeper	IcnKeepr.exe	"Icon Keeper - ""tool to save and restore icon positions on the desktop"""
X	EntraOcio	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Enumerate Service	wsys.exe	"Added by the MANIFEST TROJAN!"
Y	EnvyHFCPL	EnMixCPL.exe	"VIA Envy24 PCI Audio Controller driver"
U	EPGServiceTool	EPGClient.exe	"Electronic Programme Guide (EPG) for the WinTV range of TV Tuners from Hauppauge"
U	EPGServiceTool	EPGCLI~1.EXE	"Electronic Programme Guide (EPG) for the WinTV range of TV Tuners from Hauppauge"
U	ePower_DMC	ePower_DMC.exe	"Part of Acer Empowering Technology. ""Acer ePower Management is a straightforward interface that allows users to select from pre-configured power usage profiles
N	ePrint 3.0 Service	EPRINT3.EXE	"LEADTOOLS ePrint file conversion software - ""convert any file to and from over 150 document and image formats including searchable PDF
N	ePrint 4.0 Service	EPRINT4.EXE	"A component of the ""LEADTOOLS ePrint File Conversion Software - Convert ANY file to and from over 150 document and image formats including searchable PDF
N	EPS	e_srcv02.exe	"According to the Epson info: ""Use this utility to automatically check for errors and also check the level of ink remaining."" This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check"
N	EPS	e_srcv03.exe	"According to the Epson info: ""Use this utility to automatically check for errors and also check the level of ink remaining."" This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check"
N	EPSON Background Monitor	STMS.EXE	Supposed to keep an Epson printer ready for quick printing. Users report little difference whether it is on or not
U	EPSON CardMonitor	EPSON CardMonitor1.0.exe	Monitors the PCMCIA memory card slot on EPSON cameras and printers and launches PhotoStarter or PhotoPrint
U	EPSON PictureMate Deluxe	E_FATI9TA.EXE	"Epson Status Monitor 3 for the PictureMate Deluxe compact photo printer - for monitoring printer status
N	EPSON Status Monitor 3 Environment Check	e_srcv03.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check	e_srcv02.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check 2	e_srcv03.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check 2	e_srcv02.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
U	EPSON Stylus C120 Series	E_FATICCA.EXE	"Epson Status Monitor 3 for the Stylus C120 Series printer - for monitoring printer status
U	EPSON Stylus C40 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C40 Series printer - for monitoring printer status
U	EPSON Stylus C41 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C41 Series printer - for monitoring printer status
U	EPSON Stylus C42 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C42 Series printer - for monitoring printer status
U	EPSON Stylus C43 Series	E_S08IC1.EXE	"Epson Status Monitor 3 for the Stylus C43 Series printer - for monitoring printer status
U	EPSON Stylus C43 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C43 Series printer - for monitoring printer status
U	EPSON Stylus C44 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C44 Series printer - for monitoring printer status
U	EPSON Stylus C45 Series	E_S4I3T1.EXE	"Epson Status Monitor 3 for the Stylus C45 Series printer - for monitoring printer status
U	EPSON Stylus C46 Series	E_S4I0T1.EXE	"Epson Status Monitor 3 for the Stylus C46 Series printer - for monitoring printer status
U	EPSON Stylus C48 Series	E_S4I091.EXE	"Epson Status Monitor 3 for the Stylus C48 Series printer - for monitoring printer status
U	EPSON Stylus C60 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C60 Series printer - for monitoring printer status
U	EPSON Stylus C61 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C61 Series printer - for monitoring printer status
U	Epson Stylus C62 Series	E-S0BIC1.EXE	"Epson Status Monitor 3 for the Stylus C62 Series printer - for monitoring printer status
U	EPSON Stylus C62 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C62 Series printer - for monitoring printer status
U	EPSON Stylus C63 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C63 Series printer - for monitoring printer status
U	EPSON Stylus C64 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C64 Series printer - for monitoring printer status
U	EPSON Stylus C64 Series	E_S4I2C1.EXE	"Epson Status Monitor 3 for the Stylus C64 Series printer - for monitoring printer status
U	EPSON Stylus C66 Series	E_S4I0S2.EXE	"Epson Status Monitor 3 for the Stylus C66 Series printer - for monitoring printer status
U	EPSON Stylus C67 Series	E_FATIAAL.EXE	"Epson Status Monitor 3 for the Stylus C67 Series printer - for monitoring printer status
U	Epson Stylus C82 Series	E_S0HIC1.EXE	"Epson Status Monitor 3 for the Stylus C82 Series printer - for monitoring printer status
U	EPSON Stylus C82 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C82 Series printer - for monitoring printer status
U	EPSON Stylus C84 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C84 Series printer - for monitoring printer status
U	EPSON Stylus C84 Series	E_S4I2D1.EXE	"Epson Status Monitor 3 for the Stylus C84 Series printer - for monitoring printer status
U	EPSON Stylus C87 Series	E_FATIABL.EXE	"Epson Status Monitor 3 for the Stylus C87 Series printer - for monitoring printer status
U	EPSON Stylus CX2900 Series	E_FATIBFP.EXE	"Epson Status Monitor 3 for the Stylus CX2900 Series printer - for monitoring printer status
U	EPSON Stylus CX3100	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus CX3100 printer - for monitoring printer status
U	EPSON Stylus CX3200	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus CX3200 printer - for monitoring printer status
U	EPSON Stylus CX3500 Series	E_FATI9 BL.EXE	"Epson Status Monitor 3 for the Stylus CX3500 Series printer - for monitoring printer status
U	EPSON Stylus CX3600 Series	E_FATI9BE.EXE	"Epson Status Monitor 3 for the Stylus CX3600 Series printer - for monitoring printer status
U	EPSON Stylus CX3700 Series	E_FATIACP.EXE	"Epson Status Monitor 3 for the Stylus CX3700 Series printer - for monitoring printer status
U	EPSON Stylus CX3800 Series	E_FATIACA.EXE	"Epson Status Monitor 3 for the Stylus CX3800 Series printer - for monitoring printer status
U	EPSON Stylus CX3900 Series	E_FATIBEP.EXE	"Epson Status Monitor 3 for the Stylus CX3900 Series printer - for monitoring printer status
U	EPSON Stylus CX4200 Series	E_FATIAEA.EXE	"Epson Status Monitor 3 for the Stylus CX4200 Series printer - for monitoring printer status
U	EPSON Stylus CX4500 Series	E_FATI9AP.EXE	"Epson Status Monitor 3 for the Stylus CX4500 Series printer - for monitoring printer status
U	EPSON Stylus CX4600 Series	E_FATI9AA.EXE	"Epson Status Monitor 3 for the Stylus CX4600 Series printer - for monitoring printer status
U	EPSON Stylus CX4700 Series	E_FATIADL.EXE	"Epson Status Monitor 3 for the Stylus CX4700 Series printer - for monitoring printer status
U	EPSON Stylus CX4800 Series	E_FATIADA.EXE	"Epson Status Monitor 3 for the Stylus CX4800 Series printer - for monitoring printer status
U	EPSON Stylus CX5000 Series	E_FATIBVA.EXE	"Epson Status Monitor 3 for the Stylus CX5000 Series printer - for monitoring printer status
U	EPSON Stylus CX5400	E_S4I2G1.EXE	"Epson Status Monitor 3 for the Stylus CX5400 printer - for monitoring printer status
U	EPSON Stylus CX5500 Series	E_FATICAP.EXE	"Epson Status Monitor 3 for the Stylus CX5500 Series printer - for monitoring printer status
U	EPSON Stylus CX6000 Series	E_FATIBIA.EXE	"Epson Status Monitor 3 for the Stylus CX6000 Series printer - for monitoring printer status
U	EPSON Stylus CX6500 Series	E_FATI9EP.EXE	"Epson Status Monitor 3 for the Stylus CX6500 Series printer - for monitoring printer status
U	EPSON Stylus CX6600 Series	E_FATI9EE.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	EPSON Stylus CX6600 Series	E_FATI9EA.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	EPSON Stylus CX7000F Series	E_FATIBKA.EXE	"Epson Status Monitor 3 for the Stylus CX7000F Series printer - for monitoring printer status
U	EPSON Stylus CX7400 Series	E_FATICDA.EXE	"Epson Status Monitor 3 for the Stylus CX7400 Series printer - for monitoring printer status
U	EPSON Stylus CX7800 Series	E_FATIAFA.EXE	"Epson Status Monitor 3 for the Stylus CX7800 Series printer - for monitoring printer status
U	EPSON Stylus CX8300 Series	E_FATICEP.EXE	"Epson Status Monitor 3 for the Stylus CX8300 Series printer - for monitoring printer status
U	EPSON Stylus CX8400 Series	E_FATICEA.EXE	"Epson Status Monitor 3 for the Stylus CX8400 Series printer - for monitoring printer status
U	EPSON Stylus CX9300F Series	E_FATICFP.EXE	"Epson Status Monitor 3 for the Stylus CX9300F Series printer - for monitoring printer status
U	EPSON Stylus CX9400Fax Series	E_FATICFA.EXE	"Epson Status Monitor 3 for the Stylus CX9400Fax Series printer - for monitoring printer status
U	EPSON Stylus DX3800 Series	E_FATIACE.EXE	"Epson Status Monitor 3 for the Stylus DX3800 Series printer - for monitoring printer status
U	EPSON Stylus DX4400 Series	E_FATICAE.EXE	"Epson Status Monitor 3 for the Stylus DX4400 Series printer - for monitoring printer status
U	EPSON Stylus DX7400 Series	E_FATICDE.EXE	"Epson Status Monitor 3 for the Stylus DX7400 Series printer - for monitoring printer status
U	EPSON Stylus DX8400 Series	E_FATICEE.EXE	"Epson Status Monitor 3 for the Stylus DX8400 Series printer - for monitoring printer status
U	EPSON Stylus Photo 2200	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo 2200 printer - for monitoring printer status
U	EPSON Stylus Photo 825	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo 825 printer - for monitoring printer status
U	EPSON Stylus Photo 925	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo 925 printer - for monitoring printer status
U	EPSON Stylus Photo R280 Series	E_FATICKA.EXE	"Epson Status Monitor 3 for the Stylus Photo R280 Series printer - for monitoring printer status
U	EPSON Stylus Photo R285 Series	E_FATICKE.EXE	"Epson Status Monitor 3 for the Stylus Photo R285 Series printer - for monitoring printer status
U	EPSON Stylus Photo R300 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX420 Series	E_FATI9CE.EXE	"Epson Status Monitor 3 for the Stylus Photo RX420 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX430 Series	E_FATI9CP.EXE	"Epson Status Monitor 3 for the Stylus Photo RX430 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX680 Series	E_FATICJA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX680 Series printer - for monitoring printer status
U	EPSON Stylus Pro 4000	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Pro 4000 printer - for monitoring printer status
U	EPSON Stylus Pro 7600	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Pro 7600 printer - for monitoring printer status
U	EPSON WorkForce 30 Series	E_FATIEEA.EXE	"Epson Status Monitor 3 for the WorkForce 30 Series printer - for monitoring printer status
U	EPSON WorkForce 500 Series	E_FATIEQA.EXE	"Epson Status Monitor 3 for the WorkForce 500 Series printer - for monitoring printer status
U	EPSON WorkForce 600 Series	E_FATIEKA.EXE	"Epson Status Monitor 3 for the WorkForce 600 Series printer - for monitoring printer status
X	EQAdvice	EQAdvice.exe	"NewAds1 adware"
X	EQArticle	EQArticle.exe	"EQArticle adware"
Y	eRecoveryService	check.exe	"Now part of Acer Empowering Technology. ""Acer eRecovery Management is a powerful utility that does away with the need for recovery disks provided by the manufacturer
U	eRecoveryService	Monitor.exe	"Part of Acer Empowering Technology. ""Acer eRecovery Management is a powerful utility that does away with the need for recovery disks provided by the manufacturer
U	eRecoveryService	eRAgent.exe	"Part of Acer Empowering Technology. ""Acer eRecovery Management is a powerful utility that does away with the need for recovery disks provided by the manufacturer
X	Eroca	Eroca.exe	"Insider.i adware"
X	ErrClean	SysRep.exe	"ErrClean rogue system error and cleaning utility - not recommended. There are number of variants in this family sharing the same filename and user interface - see here"
X	ErreurChasseur	SysRep.exe	"ErreurChasseur
X	ErrorProtector Free	ertmain.exe	"ErrorProtector rogue system error and cleaning utility - not recommended"
X	ERScw	ERScw.exe	"Part of the ErrorSafe rogue system error and cleaning utility - not recommended"
X	ERS_check	ers_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	ERS_Check	uwasers.exe	"Part of the WinAntiSpyware 2006 and WinAntiSpyware 2007 rogue spyware removers - not recommended"
X	erthgdr	svc.exe	"Added by the BEAGLE.BN or BEAGLE.BP WORM!"
X	erthgdr2	svc23.exe	"Added by the BAGLE.CG WORM!"
U	ERUNT AutoBackup	AUTOBACK.EXE	"ERUNT backup utility - when added to the user's startup folder automatically backs up the registry each time the system boots
X	erwghjjrjt	ucbcg.exe	"Added by the SMALL.CUL TROJAN!"
U	ES Current Services	[FILE NAME].exe	"123Keylogger surveillance software. Uninstall this software unless you put it there yourself"
Y	eSafe Protect	ESPWatch.exe	"eSafe from Aladdin - internet security for gateway and E-mail servers"
Y	eScan Monitor	AVKWCTL9X.EXE	"MicroWorld eScan antivirus"
U	eScan Scheduler	avkserv.exe	"MicroWorld eScan antivirus scheduler"
U	eScan Updater	Trayicos.exe	"MicroWorld eScan antivirus updater - allows users to automatically download updates and set the auto time interval for downloads"
X	EScorcher	escorcher.exe	"Part of eScorcher anti-virus software - responsible for performing virus checks and deletions. Used to collect information about the user and therefore treated as spyware - now the web-site is dead"
U	eSnips	ClientGW.exe	"eSnips Client Gateway from eSnips"
X	Especial	Deneca.bat	"Added by the DELUZ VIRUS!"
Y	Essdc	essdc.exe	Related to an ESS Solo soundcard. Seems as though it's required
?	eSupInit	eSupCmd.exe	"Related to SupportSoft (aka Support.com) ""Real-Time Service Management software"". What does it do and is it required?"
X	etbrun	elit***32.exe [* = random char]	"EliteBar adware"
U	eTCertManger	eTCrtMng.exe	"eToken Certificate Manager from Aladdin Knowledge Systems
U	ETDWare	ETDCtrl.exe	Elantech smart-pad touchpad driver for the Asus Eee PC range
X	eth0 driver	exec.exe	"Added by the SPYBOT-Z WORM!"
N	Ethernet	tcaudiag.exe	3Com NIC Installation/Diagnostic MFC application. Diagnostics may be run from the Start -> Programs
X	ethernet adapter	csrmss.exe	"Added by a variant of the RBOT WORM!"
X	Ethernet Driver	cmsrrs.exe	"Added by a variant of the RBOT WORM!"
X	Etraffic	JavaRun.exe	"TopMoxie adware"
U	eTrust PestPatrol Active Protection	PPActiveDetection.exe	"PestPatrol real-time protection feature. ""Stops spyware before it infects your system"""
Y	eTrustCIPE	ezdsmain.exe	eTrust EZ Deskshield from Computer Associates. Protects against malicious email attachments and unauthorized use of email by detecting and blocking unusual behavior
X	EUP Service	eupsvc.exe	"Added by the DELBOT-Q WORM!"
N	Event Planner Reminders Tray Icon	PLNRnote.exe	Part of Sierra/Hallmark Card Studio - System Tray notification of events such as birthdays and anniversaries that you've scheduled with the customizable Event Planner
X	EventApplicationCmd	smschk.exe	"Added by the IRCBOT-AO TROJAN!"
?	EverioService	EverioService.exe	"Related to the Cyberlink software supplied with JVC's Everio camcorders. What does it do and is it required?"
U	EVGAPrecision	EVGAPrecision.exe	"EVGA Precision overclocking utility - ""allows you to fine tune your EVGA graphics card for the maximum performance possible
U	Evidence Cleaner	ecleaner.exe	"Evidence Cleaner cleans up tracks left by your PC and Internet activities"
N	Evidence Eliminator	ee.exe	"Evidence Eliminator - cover the tracks of your browsing habits and E-mails if you think you need to. Run manually on a regular basis"
N	evntsvc	evntsc.exe	"Application Scheduler installed along with RealOne Player. Once installed
U	Evoluent Mouse Manager	EvoMouExec.exe	"Mouse manager for Evoluent VertcialMouse"
N	Excite Platform	Exlaunch.exe	Loads an Icon in the startup tray that allows you to receive service update notices for Excite@Home if you desire (note that since Excite@Home appears to be winding down this becomes irrelevant). May also allow you to kill the Excite Toolbar that automatically loads in Internet Explorer
?	Excite Private Messenger Pipe	x8impipe.exe	"??"
N	ExciteAssistantEXE	ASSISTANT.EXE	"With Excite Assistant
X	execfg4	execfg4.exe	"Added by the ELECTRON WORM!"
X	ExecUser	ExecUser.exe	"Added by a variant of the RBOT WORM!"
?	Execute	delfolders.exe	"??"
X	ExeName32	Warm.scr	"Added by the SCOLD WORM!"
X	ExFilter	"Rundll32.exe [path] cdnspie.dll	ExecFilter"
U	Exif Launcher	Exiflaquickdcr.exe	USB mass storage driver used by some digital cameras such as the Fuji Finepix. Only required if you use it regularly
U	Exif Launcher	QuickDCF.exe	USB mass storage driver used by some digital cameras such as the Fuji Finepix. Only required if you use it regularly
X	Expatch	[random filename]	"Added by the PWSLMIR-G TROJAN!"
X	expcrt	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	explorer	wscript.exe [filename]	"Sneaky way to start any VBS script. Many viruses use VBS files. Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	Explorer	config_.com	"Added by the FLOPPY-D WORM!"
X	EXPLORER MICROSOFT SYSTEM	explore.exe	"Added by a variant of the RBOT WORM!"
X	Explorer soft	explorer.com	"Added by the RBOT-ARM WORM!"
X	Explorer.exe	csrss.exe	"Added by the JUEGO-B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %AppData%\Microsoft"
X	Explorer5	config_.com	"Added by the VB.CBG WORM!"
X	ExplorerRun	conime.exe	"Added by the DLDR-G TROJAN! Note - this is not the legitimate Console IME process of the same filename which is located in %System%. This one is located in %Temp%"
X	ExploreUpdSched	[random filename]	"ZenoSearch adware"
U	Express ClickYes	ClickYes.exe	"""Express ClickYes is a handy tool that runs in the system tray automatically clicks the Yes button for the Outlook Security security prompt
N	Extender Resource Monitor	RMSysTry.exe	"Related to Windows Media Center from Microsoft"
X	External Dependencies	External.exe	"Added by the MYTOB.EC WORM!"
N	Eye Tide Launcher	oneeyetideone.exe	Nascar wallpaper
X	EYORE	Notepad.scr	"Added by the GIMLET-A WORM!"
Y	EZ Firewall	ca.exe	"eTrust EZ Armor Internet Security"
Y	ezShieldProtector for Px	ezSP_Px.exe	"Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings"
Y	ezShieldProtector for Px	ezSP_PxEngine.exe	"Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings"
U	E_S10IC2	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C44 Series printer - for monitoring printer status
U	E_S23	E_SICN03.exe	"Epson printer status monitor - for checking ink levels
U	E_SOEIC1	E_SOEIC1.exe	"Epson Status Monitor 3 - for monitoring printer status
X	f	ftkclean.exe	"FlashEnhancer adware"
U	F-PROT Antivirus Tray application	FProtTray.exe	"System Tray access to F-PROT Antivirus"
X	F-Secure 2005	svchost.exe	"Added by the BIFROSE-CH TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
Y	F-Secure 2006	fspex.exe	"F-Secure Anti-Virus automatic updater"
X	F-Secure Gatekeeper	[malware name].exe	"Added by the NUWAR.AXQ WORM!"
U	F-Secure Management Agent	FSMA32.EXE	"F-Secure antivirus - F-Secure Policy Manager provides tools for administering F-Secure software products"
Y	F-Secure Manager	FSM32.EXE	"F-Secure antivirus - carry out scheduled virus scans automatically"
Y	F-Secure Startup Wizard	FSSW.EXE	"F-Secure antivirus"
Y	F-Secure TNB	TNBUtil.exe	"F-Secure antivirus"
U	F5D7050v3	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D7050 Wireless G USB Adapter"
U	F5D8001	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8001 N1 Wireless Desktop Card"
U	F5D8011	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8011 N1 Wireless Notebook Card"
U	F5D8055v1	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8055 Wireless N+ USB Adapter"
U	F5D8071	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8071 N1 Wireless ExpressCard"
U	F5D9010	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D9010 Wireless G+ MIMO USB Network Adapter"
U	F5D9050	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D9050 Wireless G+ MIMO USB Network Adapter"
X	f73cdc8ee94e	btsendto.exe	Associated with mysearchnow.com/searchbar.html
U	Fabrik Ultimate Backup Status	fabrikhomestat.exe	"Status monitor for Fabrik Ultimate Backup from Fabrik Inc. ""No matter what happens to the drive on your desk - a spilled drink
X	FaltCheck	allps.exe	"Added by the AGENT.RAP TROJAN!"
U	FamilyKeyLogger	cisvc.exe	"Family Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Located in %ProgramFiles%\FamilyKeyLogger"
X	Fantasia injector	wincfg.exe	"Added by the AGOBOT.US WORM!"
X	Fast Home	svcnvt.exe	"Detected by Kaspersky as the DELF.KS TROJAN! This file may be found in the System folder on 9x machines
X	Fast Search	svcnv.exe	"Homepage
X	Fast start	svcnt.exe	"Adware - detected by Kaspersky as a variant of the FAVADD TROJAN!"
U	FastCache	fc.exe	"FastCache from AnalogX - speeds up browsing by resolving DNS requests locally"
X	FastDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	FastStart	svcnut.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
X	FastStart	svcnut32.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
N	FastTrack Accelerator	SPEED UP.EXE	"FastTrack Accelerator - ""speedup"" utility for programs that use the FastTrack network such as KaZaA Media Desktop
X	FASTTRACKNETVISION	NETVISION.exe	"DialCar-Z premium rate dialer"
U	FastTVSync	FastTVSync.exe	"Part of InterVideo (now Corel) DVD Copy - ""fast DVD copying and file conversion software. In just three steps
X	Fat32 Microsoft	fat32.exe	"Added by the RBOT-EL WORM!"
U	FatPipe	DHCP	Software enabling high speed internet browsing (2-4 times faster) and internet connection sharing for up to 5 users
U	fatrecov	fatrecov.exe	SCKeyLog.j keystroke logger/monitoring program - remove unless you installed it yourself!
U	FavoriteSync	FavoriteSync.exe	"FavoriteSync keeps the same set of Internet Explorer Favorites on several computers in sync"
U	FaxCenterServer	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software. Incorporated into software by Lexmark
U	FaxCenterServer4_in_1	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software. Incorporated into software by Lexmark
U	FaxCtrl.exe	ASMediaProxyServer.exe	"Part of Avaya's Contact Center Express - ""a multi-channel
N	FaxTalk CallControl 6.0	FTClCtrl.EXE	This allows the software to handle incoming and outgoing communications without requiring the FaxTalk Communicator application to be loaded into memory. Can be started manually
U	FBDirect	FBDirect.exe	"Software that monitors the status of a Visioneer OneTouch scanner button and allows you to scan
X	FBSearch	FastBrowserSearchProtection.exe	"Fast Browser Search/Search Guard Plus parasite - installed with ""Make the Web Better"" applications such as My Web Tattoo
X	FBSearch	SearchGuardPlus.exe	"Fast Browser Search/Search Guard Plus parasite - installed with ""Make the Web Better"" applications such as My Web Tattoo
X	fc	runfc.exe	"Added by the CAMPURF WORM!"
X	FCEngine	FCEngine.exe	"CASClient adware"
X	FCHelp	FCHelp.exe	"Added by either FCHelp adware or a variant of it"
X	FCMan	FCMan.exe	"FCHelp adware"
X	Fdaemon security	fsecur.exe	"Added by the SDBOT.KXO WORM!"
X	Fdr Command Module	sp2.exe	"Added by the SDBOT.WP WORM!"
X	FeCPY	fecpy.exe	"FlashEnhancer adware"
X	feelalright	mirc.exe	"Added by the IRCFLOOD-M WORM!"
U	FEELitDeviceManager	feelitdm.exe	Associated with Immersion TouchSense devices (Logitech Wingman Force Feedback Mouse and possibly other peripherals)
X	fegoze	SVCH0ST.EXE	"Added by the GRAYBIRD.D VIRUS! Note - the filename has the digit 0 rather then the uppercase ""o"""
X	Fen Startups	fensvc32.exe	"Added by the RANDEX.CCF WORM!"
X	Fenio Startups	fnesvc32.exe	"Added by the AGOBOT-OS BACKDOOR!"
X	FestPlattenCleaner	SysRep.exe	"FestPlattenCleaner
X	FestplattenReiniger	GDC.exe	"FestplattenReiniger
X	ffeqOME	vcvsav.exe	"Added by the RANKY.AB TROJAN!"
X	ffis	ffisearch.exe	"iSearch adware"
?	fgl23DoubleScreenHooks	f23happ.exe	"Related to the now discontinued ATI Fire GL3 graphics card. What does it do and is it required?"
X	FHPage	shdochp.exe	"Added by the WINHOUND TROJAN!"
X	FHStart	shdocsvc.exe	"Added by the WINHOUND TROJAN!"
U	FieldForms Sync	SyncService.exe	"Resco FieldForms. A solution for building of mobile forms that can be viewed or filled in on the run
X	FiendlyType	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	FILE	abcdefg.exe	"Added by the KELVIR.DD WORM!"
?	file indexing service	msfindfile.exe	"New version of MS FindFast and still a resource hog?"
X	file laoder configuration	rnd32.exe	"Added by the RBOT.BQJ WORM!"
X	File Mapping Services	hp-1003.exe	"Added by the RBOT.FAN WORM!"
X	File Protection Monitor	filemon.exe	"Added by a variant of the RBOT WORM!"
X	File System Service	wmiprvsc.exe	"Added by the AGOBOT-HZ TROJAN!"
X	File1	Dia Claro.htm	"Added by the DLOADER-OR TROJAN!"
N	filehippo.com	UpdateChecker.exe	"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
N	FileHippo.com Update Checker	UpdateChecker.exe	"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
X	FileManager32	Wscript.exe ChkMgr32.vbs	"Added by the NOTUP.A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""ChkMgr32.vbs"" file is located in %System%"
X	filename process	kerneldll.exe	"Added by the AGOBOT-PO WORM!"
X	filename process	explore.exe	"Added by the AGOBOT-QN WORM!"
X	filename process	Rundil16.exe	"Added by the GAOBOT.ZX WORM!"
X	FileSoft	Wscript.exe UpdataFiles.vbs	"Added by the SST.B WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""UpdataFiles.vbs"" file is located in %Windir%"
U	FilmLoop	FilmLoopService.exe	"Related to FilmLoop - a photocasting network. Share your pictures with your family and friends"
X	FilterProgram	GDC.exe	"FilterProgram rogue privacy tool - not recommended
Y	Find Virus Launch Program	fvlaunch.exe	"Part of Dr. Solomon's Antivirus"
X	FindHack	[path to worm]	"Added by the KELVIR-BA WORM!"
U	FinePrint Dispatcher v4	fpdisp4a.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 4.x of the software. ""FinePrint saves ink
U	FinePrint Dispatcher v4	fpdisp4.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 4.x of the software. ""FinePrint saves ink
U	FinePrint Dispatcher v5	fpdisp5a.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 5.x of the software. ""FinePrint saves ink
X	Fire Wall services	[random filename]	"Added by the IRCBOT-QY WORM!"
X	Fire Wall services	wnlmzsfhobi.exe	"Added by the IRCBOT-QY WORM!"
X	Fire Well service	[random].exe	"Added by the RBOT-FJU WORM!"
?	FireBox Control Panel	FireBox.exe	"Control panel for the Presonus FireBox firewire based music recording system. Is it required?"
X	FireFox Service Drivers	ssmss.exe	"Added by a variant of the SDBOT WORM!"
X	FireFox Startup Drivers	wuaclt.exe	"Added by the RBOT.BYX WORM!"
X	FiresWallservices	[random].exe	"Added by the RBOT-FJT WORM!"
X	Firewall	wmlaunch .exe	"Added by the ELIPTER.A or ELIPTER.B WORMS! Note the space at the beginning of the filename"
X	Firewall	wmlaunch .exe	"Added by the ELIPTER.D WORM!"
X	Firewall	ctfmon.exe	"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in %Windir%"
X	Firewall Administrating	infocard.exe	"Added by the AUTORUN-AYV WORM! Note - this is not the valid InfoCard Service which is part of the .NET Framework from Microsoft and uses the same filename"
X	Firewall config	ReadMe.exe	"Added by the SILLYFDC.BBT WORM!"
X	Firewall Controls	sys32.exe	"Added by the SDBOT-DGI WORM!"
X	Firewall Policy	MidiDef32.exe	"Added by the PIEBOT-A TROJAN!"
X	Firewall Sp2 system	sys32Conf.exe	"Added by the RBOT-ABT WORM!"
X	FirewallActivies	csrss.exe	"Added by the BANKER-AQ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""3041"" subfolder"
X	FireWire Service	nvscv32.exe	"Added by a variant of the SDBOT WORM!"
X	FireWire Services	nvcsv32.exe	"Added by a variant of the SPYBOT WORM!"
X	First Home Page	http://find.naupoint.com	"Naupoint browser hijacker"
?	First Principle Group	fpg.exe	"Related to the E-Players Card from First Principle Group"
Y	Fix-it AV	memcheck.exe	Part of Ontrack's Fix-it Utilities Suite anti-virus. Performs a quick check of memory for signs of any virus. Exits afterward and returns all resources used in one user's experience. Not required but could be left without a drain on resources
X	Fixnice	vcvw.exe	"Added by the SDBOT TROJAN!"
N	FJUPDNV_Chitose	fjdvrupd.exe	Driver update for a Fujitsu Siemens Lifebook laptop
X	FlaCPY	flacpy.exe	"FlashEnhancer adware"
X	Flash Media	services.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
X	Flash32	FLASH32.COM	"Added by the STARTER-F TROJAN!"
U	FlashEnc	FlashEnc.exe	"Supplied with EasyDisk USB pen devices. The utility manages the encryption and compressed folders options. It will create these folders if running on the USB key without permission
X	FlenCPY	flencpy.exe	"FlashEnhancer adware"
U	Flexicd	Flexicd.exe	"CD player - part of the Win95 Power Toys"
U	FLMLABTECMOUSE	mouse32A.exe	Mouse utility for a Labtec brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
U	FLMOFFICE4DMOUSE	moffice.exe	Mouse utility for a Labtec brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
U	FLMOFFICE4DMOUSE	mouse32a.exe	Mouse utility for a Micro Innovations brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
X	FlnCPY	flncpy.exe	"FlashEnhancer adware"
X	flpycntl	flpycntl.exe	"Added by the CRYPTER.C TROJAN!"
?	FLSVCI	FLSVCI.exe	"??"
Y	FltProcess	msinet.exe	"Part of Cyber Patrol internet filtering software to restrict access to certain types of material on the internet. It can be disabled but do not ask how it's done"
U	FmctrlTray	Fmctrl.EXE	Genius SM-Live Control Panel. Enhances audio output through Genius sound cards (makes a big difference and worth the 3MB Ram used)
?	Focus	Focus.exe	"ISDN configuration wizard?"
X	foffice	nm.exe	"Added by the DELF-CB TROJAN!"
X	Folder Service	wssdtu.exe	"Added by the MANIFEST TROJAN!"
U	FolderClone v*.*.*	folderclone.exe	"Folderclone backup and synchronization software"
N	FoneSyncSystemTray	FoneSyncSystemTray.exe	System Tray icon for Nokia FoneSync utility for the 7160/7190 mobiles. Useful to send data from/to the cell phone and the computer. You can use it to backup data or even to input data through the computer keyboard (which naturally is much more comfortable). Run manually when required
X	ForceShow	"rundll32.exe QaBar.dll	ForceShowBar"
Y	FortiClient	FortiClient.exe	"Fortinet security systems are the new generation of real time network protection systems"
U	Fortis Secure Layer Config	cseinst.exe	Fortis Bank Home Banking part. Installed during the installation of the software necessary to run the Home Banking. According to Fortis Bank this will not in any way be harmful to the system or relay system information
N	FotoStation Easy AutoLaunch	FotoStation Easy AutoLaunch.exe	Installed with a Nikon digital camera. Used to collect photos uploaded from camera program NkVwMon.exe. If your camera is not connected (via USB port) you do not need this program loaded either
X	FoWilCo	fowilco.exe	"Added by the WOOTBOT.CR WORM!"
X	foxwudy9912	service.exe	"Added by the BANCOS-BT TROJAN!"
N	Fpx	mnmsrvc.exe	Remote Desktop Sharing service part of Microsoft's Netmeeting allowing users to share items on their screens across remote locations
X	Framework module library	infocard.exe	"Added by the BUZUS.AYX TROJAN!"
X	France	svchost.exe	"Added by the MIMAIL.L WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
?	Free Downloads Monitor	fdcmon.exe	"??"
N	Free DVD Direct	FreeDVDDirect.exe	"Free DVD Direct - provides a program to access a peer-to-peer (P2P) file-sharing network (see here)"
N	FreeCall	FreeCall.exe	"FreeCall - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X	FreeMP3download	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	freestyle	lockx.exe	"Added by the RBOT-ATH WORM!"
X	freexstyle	lockbar.exe	"Added by the LOXBOT.D WORM!"
X	freexstyle	lockbr.exe	"Added by the LOXBOT.C WORM!"
N	freshclam	freshclam.exe	"Auto update agent of the open source Clamwin virus scanner"
?	frguk	shdrkmck.exe	"??"
X	FriendlyTypeName	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
N	FriendlyWebQuick-Launch	SELFCERT.EXE	selfcert.exe is a stand alone program for creating your own digital certificates for macros - the .exe is installed as an extra basically by clicking on MS Office in add/remove programs and selecting remove - also I would do away with the FriendlyWebQuickLaunchBar as well
U	FRISK FP-Scheduler	F-Sched.exe	"Scheduler for F-Prot anitvirus software. Leave enabled unless you scan manually on a regular basis"
?	FRITZ!DSL Startcenter	StCenter.exe	"FRITZ! ISP software ""StartCenter"" User interface that allows you to manage
U	FRITZ!webProtect	FwebProt.exe	Firewall included in FRITZ! ISP DSL software
X	frun	derc32xz.exe	Added by an unidentified TROJAN!
N	FSCBoss	FSCBoss.exe	Free Store Club shop online software
X	fsdsft	[path to backdoor]	"Added by the RANKY.S BACKDOOR!"
X	FSH	svcnva.exe	Identified by Ewido Security Suite (Ewido is now part of AVG Technologies) as the DELF.KA TROJAN!
N	FSScrCtl	FSScrCtl.exe	Screen saver control applet used by the "Stardust Screen Saver Toolkit" and "SolidWorks Screen Saver"
X	fstsvc	"rundll32.exe fstsvc.dll	start"
X	ftk	ftkclean.exe	"FlashEnhancer adware"
X	FtkCPY	ftkcpy.exe	"FlashEnhancer adware"
U	Ftpqueue	Ftpsched.exe	"Part of WS_FTP Pro from Ipswitch. Queueing facility for scheduling FTP transfers"
X	FuckD3w4	FuckD3w4.exe	"Added by the BRONTOK-DI WORM!"
X	Fucker	fucker.vbs	"Added by the CATCHER-A WORM!"
U	Fujitsu Hotkey Utility	IndicatorUty.exe	"Fujitsu Hotkey Utility displays icons on the screen when you use hotkeys on a Fujitsu Siemens Lifebook
U	Fujitsu Menu	FjMnuIco.exe	"From the ""Fujitsu Menu"" tray icon you have instant access to the Control Panel
X	fukerservice	fukerz.exe	"Added by a variant of the RBOT WORM!"
U	FusionRC	FusionRC.exe	"Remote control manager for DVICO FusionHDTV"
U	FusionRemote	FusionRc.exe	"Remote control manager for DVICO FusionHDTV"
X	FW Manager	fwcheck.exe	"Added by the DELBOT-H WORM!"
Y	fwenc.exe	fwenc.exe	"Check Point SecuRemote VPN client - ""dynamic and fixed IP addressing for all ISP services - dial-up
X	Fwr Command Module	fwr.exe	"Added by the SDBOT-PP WORM!"
N	fwrastrc	fwrastrc.exe	Dial-up software for Friendly Technologies/1NationOnLine free ISP
U	fwservice	fwservice	"eAcceleration Stop-Sign security software related. Previously not recommended
?	g3dctl	g3dctl.exe	"??"
X	ga6pcw	ga6pcw.exe	"Part of the AVSystemCare rogue security software and other members of this family. See here for more examples"
X	gac	gac.exe	"Part of VirusVakt
?	GACService	GACService.exe	"Related to a Gemplus product. What does it do and is it required?"
X	gadcom	gadcom.exe	"Added by the AGENT-HIC TROJAN!"
N	Gadwin PrintScreen	PrintScreen.exe	"Gadwin PrintScreen - utility to capture
X	GAELICUM.EXE	GAELICUM.EXE	"Added by the PENTA-A TROJAN!"
X	game	patcher.scr	"Added by the PSW-ED TROJAN!"
N	Game Device	JOYUPDRV.EXE	Genius game controller profile activator
X	Games Acceleration	svshost.exe	"EasySearch adware"
X	Games Acceleration	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Games Acceleration	svshost1.exe	"Added by the DLOADR-AWD TROJAN!"
N	GameTracker	GTLite.exe	"GameTracker - ""Keep track of and launch all your games from one application with the Game Tracker Client. Instantly announce on your profile and to your friends what game and on which server you are playing!"""
X	gamma	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
U	GARO Status Monitor	cnwism.exe	Print monitor for certain Canon printers
N	Gateway Extended Warranty	GWCares.exe	Gateway Extended Warranty reminder
Y	GBSpaceMan	SpaceMan.exe	"GreenBorder - secure your browsing activities on the internet"
X	gCac	gcac.exe	"Added by the TACTSLAY.U TROJAN!"
X	gcasDtServ	gcasDtServ.exe	Added by an unidentified WORM or TROJAN. Note - this is not related to Microsoft Antispyware which has a process bearing the same name which doesn't appear as a startup
Y	gcasServ	gcasServ.exe	"Giant Antipsyware - now superseded by Microsoft's Windows Defender"
X	gcasServ	realsched.exe	"Added by a variant of the TACTSLAY.A TROJAN! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name"
?	GCC Reminder	gccrem.exe	"Associated with AcraMax Greeting Card Creator. Is it a registration reminder?"
N	GCS	GrabClipSave.exe	"GrabClipSave screen capture tool"
X	gcw	gcw.exe	"Part of BestsellerAntivirus
X	GDAX	[path to backdoor]	"Added by the RANKY.K TROJAN!"
X	gdcw	GDCW.exe	"Part of ContentEraser
N	Gearbox	confsvr.exe	"NTL's Gearbox software for configuring internet connections with their NTLWorld software - does a similar job to the Internet Connection Wizard which can be used instead using the dial-up details available here"
N	GEARsec	gearsec.exe	Installed by Apple Quicktime package - iPod®/iTunes® CDRW support. Can be disabled if you only require Quicktime player
X	GEDZAC	GEDZAC.exe	"Added by the GEMEL WORM!"
X	Gekio Startups	gnksvc32.exe	"Added by the AGOBOT.AFJ WORM!"
X	gencroot	gencroot.exe	"Added by the SDBOT-AED WORM!"
X	Generic host proccess for windows	SVCHOSTS.EXE	"Added by the SPYBOT-GQ WORM!"
X	Generic Host Process	SCHOST.EXE	"Added by the RBOT-NC WORM!"
X	Generic Host Process	svchost.exe	"Added by the DLOADER-NX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Generic Host Process	camacttiv.exe	"Detected by AVG as the CIADOOR.13 TROJAN!"
X	Generic Host Process	lsassw.exe	"Added by the AGOBOT-N WORM!"
X	Generic Host Process for Win Services	mscvs.exe	"Added by a variant of the SDBOT WORM!"
X	Generic Host Process for Win32 Service	svlhost.exe	"Added by the WOOTBOT.EX WORM!"
X	Generic Host Process for Win32 Service	rpchost.exe	"Added by the IRCBOT.DCN WORM!"
X	Generic Host Process for Win32 Services	ntspcv.exe	"Added by the SDBOT.S TROJAN!"
X	Generic Host Process for Win32 Services	intspvc.exe	"Added by the DINFOR.D WORM!"
X	Generic Host Process for Win32 Services	winsvc.exe	"Added by the SDBOT-O WORM!"
X	Generic Host Process for Win32 Services	bazzi.exe	"Added by the AHKER.E WORM!"
X	Generic Host Process for Win32 Services	winsvc32.exe	"Added by the SDBOT-P WORM!"
X	Generic Host Process for Win32 Services	lspsvc.exe	"Added by the MUMU.C WORM!"
X	Generic Host Process for Win32 Services	SPSVC.EXE	"Added by the SDBOT.DA WORM!"
X	Generic Host Process for Win32 Services	svchost32.exe	"Added by the AGOBOT.ALH WORM!"
X	Generic Host Process for Win32 Services	svñhîst.exe	"Added by the DLOADER.AK TROJAN!"
X	Generic Host Process for Win32 Services	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Generic Host Process For Win32 Services	mtsc32.exe	"Added by the VB-CPL TROJAN!"
X	Generic Host Process for WinXP Services	mshelp.exe	"Added by the AGENT-GQP TROJAN!"
X	Generic Host Process2 System Backup	scvhost2.exe	"Added by the RBOT-BAH WORM!"
X	Generic Host Process326a System Backup	scvhost326a.exe	"Added by a variant of the SDBOT WORM!"
X	Generic Host Service	lshost.exe	"Added by the RBOT.LU WORM!"
X	Generic Service Process	regsvc32.exe	"Added by the GAOBOT.UJ or GAOBOT.UL WORMS!"
X	Generic Service Process	serv1ces.exe	"Added by the AGOBOT-JK WORM!"
X	Generic Service Process	nvsvc.exe	"Added by the AGOBOT.BY WORM! Note - this is not the valid NVIDIA Driver Helper Service and is located in %System%"
X	Generic Service Process	srvhost.exe	"Added by the AGOBOT-FX WORM!"
X	Generic Service Process	regsvr32.exe	"Added by the AGOBOT-AGD WORM!"
X	Generic Service Process	SRCHOST.EXE	"Added by the AGOBOT-DG WORM!"
X	Generic Services Process	regsvc32.exe	"Added by the GAOBOT.SY WORM!"
X	GenericHostXP	WinLoaderXP.exe	"Added by the BDOOR-ACX BACKDOOR!"
X	Geography TX 1.0 NT	CompuSpeed.vbs	"Added by the NEWLEY-A WORM!"
X	Gerenciamento de arquivos do Windows	Winmod32.exe	"Added by the DLOADER-WG TROJAN!"
X	gescw	gescw.exe	"Part of BeschermingsTool
X	Get-Torrent Service	wakeservice.exe	Get-Torrent bittorrent client - Installs LOP adware
Y	Getca	InfoMyCa.exe	"Monitor for a Belkin USB Wireless adapter"
X	GetitAll	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	GetMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	GetPack18	GetPack18.exe	"Internet Speed Monitor adware related - see example here"
X	GetPack19	GetPack19.exe	"Internet Speed Monitor adware related - see example here"
X	GetPack20	GetPack20.exe	"Internet Speed Monitor adware related - see example here"
X	GetPack21	GetPack21.exe	"Internet Speed Monitor adware related - see example here"
X	GetPack22	GetPack22.exe	"Internet Speed Monitor adware related"
X	GetPack23	GetPack23.exe	"Internet Speed Monitor adware related"
X	GetPack24	GetPack24.exe	"Internet Speed Monitor adware related - see example here"
X	GetPack25	GetPack25.exe	"Internet Speed Monitor adware related"
U	GetRight - Tray Icon	getright.exe	"Entry added with older versions of the GetRight download manager from Headlight Software
X	GetTheMusic	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	Getting started with MacDrive	MDGetStarted.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
X	gfxtray	"rundll32 ctccw32.dll	findwnd"
U	GhostSecuritySuite	gss.exe	"Ghost Security Suite - protect the registry from unauthorized reading and modification and other tools"
N	GhostStartService	GhostStartService.exe	"Required to run the Windows based wizard in Norton Ghost - added from the 2003 version. Will start automatically when you run the wizard"
X	GigaByte	Cheatle.exe	"Added by the SHODI.B VIRUS!"
U	Giganews Accelerator	GiganewsAccelerator.exe	"Giganews Accelerator from Giganews
Y	GilatFTC	ftc.exe	For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system
X	GlobalFlagACER	ACER.exe	"Added by the VB.BL WORM!"
X	GlobalSCAPE	[random filename]	"Added by the RBOT-AYM WORM!"
X	Glock Suite 1.1	glock32.exe	"Added by the TINY.GV TROJAN!"
X	GLSetIT32	msiexec16.exe	"Added by the OPTIX PRO TROJAN!"
X	GLSetT32	smsiexec.exe	"Added by the OPTIX-D TROJAN!"
X	Gmsvc32	gmsvc32.exe	"Added by the AGOBOT.ABN WORM!"
X	GNP Generic Host Process	svchost.exe	"Added by the ZAPCHAS-F BACKDOOR! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	go	cvir.exe	"Added by the SILOV-A WORM!"
U	GoBack	GBMenu.exe	"Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
U	GoBack	GBTray.exe	"System Tray icon access to Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
U	GoBack Polling Service	GBPoll.exe	"Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
U	GoBack Tray Icon	GBTray.exe	"Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
X	Golum	services.exe	"Added by the GOLUM.A TROJAN! Note - this is not the legitimate services.exe process
X	golumm	services.exe	"Added by the DLOADER-ET TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""golumm"" subfolder"
U	Google Desktop Search	GoogleDesktop.exe	"Google Desktop - ""a desktop search application that provides full text search over your email
U	Google Quick Search Box	GoogleQuickSearchBox.exe	"Part of Google Toolbar (from version 6 onwards) for IE. The Quick Search Box sits between the ""Start"" button and Quick Launch toolbar and ""lets you easily search both your computer and the Web from a slick-looking search box that comes up only when you need it"""
X	Google service	Googlesetup.exe	"Added by the IRCBOT-RJ WORM!"
X	Google Service FR	GO0GLEFREE.EXE	"Added by a variant of the SPYBOT WORM!"
N	GoogleDCClient	GoogleDCC.exe	"Google Compute Client - only present if you installed the Google Toolbar with ""Google Compute"" client active. Does complex calculations in the background when idle. If you want to turn it off go to your browser
U	GoogleQuickSearchBox	GoogleQuickSearchBox.exe	"Part of Google Toolbar (from version 6 onwards) for IE. The Quick Search Box sits between the ""Start"" button and Quick Launch toolbar and ""lets you easily search both your computer and the Web from a slick-looking search box that comes up only when you need it"""
U	GoToMyPC	g2svc.exe	"ExpertCity GoToMyPc logon - web-based remote-access solution that allows individuals and companies to register their computers online and then securely access those computers from any web browser"
U	GoTrusted	GoTrusted Secure Tunnel.exe	"""GoTrusted is the fast
X	gpmce	window.exe	"Added by the VB.CK WORM!"
X	Graphic Driver	smss32.exe	"Added by a variant of the RBOT WORM!"
X	Graphic Loader	ntvdm32.exe	"Added by a variant of the RBOT WORM!"
X	Graphic Update	openglx.exe	"Added by the IRCBOT.AMU WORM!"
X	Graphics	_default.pif	"Added by the AUTOSKY WORM!"
X	Graphics adapter service	windll.exe	"Added by the ATNAS.A WORM!"
U	Gravis Xperience Driver Support	Grxp4exe.exe	"Driver for Gravis game controllers such as the Eliminator Aftershock. Must be loaded if you run the supplied application software for the controller to be recognized. Start it manually via a shortcut if not used"
X	GreatDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	gremier	wscript.exe gpremier.vbs	"Added by the GPREMIER WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""gpremier.vbs"" file is located in %System%"
Y	Groove Virtual Office	Groove.exe	"""Groove Virtual Office uses a peer-to-peer networking model to connect users in Groove Workspaces. In these workspaces geographically dispersed coworkers can do almost everything they could do in the same office. They can hold online meetings
U	GroupWise PDA Connect - 3CmPlm	AutoDet.exe	"3Com Palm PC specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
U	GroupWise PDA Connect - GrpWse	Agnt.exe	"GroupWise PDA Connect PDA synchronisation utility - from Novell"
U	GroupWise PDA Connect - PocketPC	AUTODE~1.EXE	"Windows Mobile Pocket PC specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
U	GroupWise PDA Connect - ScheduleSync	SCHEDU~1.EXE	"ScheduleSync specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
N	GrpConv	grpconv.exe	"Microsoft Windows Program Group Converter - used by installers (ONLY in the RunOnce keys) - provides the translation of groups and group items to folders and links. Also see this MS Knowledge Base article"
?	Gscbc	Gscbc.exe	"??"
N	Gsiconexe	Gsicon.exe	"ADSL modem monitor from Eicon Networks (as used by BT for its Broadband internet service for example). Can safely be disabled without affecting the connection - all this does is give an indication of connectivity and access to the diagnostic facilities"
X	gssomatic	gssomatic.exe	"Searchcentrix hijacker"
X	GT15J4R49V	cpuserv.exe	Identified as a variant of the Trojan.Win32.Radi.gu malware
U	GTVRec	GTVRec.exe	"Part of Got All Media - control your TV tuner and other utilities from your PC"
N	Gtwatch	gtwatch.exe	Associated with a Mustec scanner and not required
X	gtydf	iisca.exe	"Added by the CLAGGER-BB TROJAN!"
X	gtydf	iscca.exe	"Added by the DWNLDR-GTK TROJAN!"
X	GuardCenter	GuardCenter.exe	"GuardCenter rogue security software - not recommended"
Y	GuardGui Application	GuardGui.exe	"System Tray access to the main user interface for Ashampoo® AntiVirus from Ashampoo GmbH & Co. KG."
U	Guardian	CMGrdian.exe	"McAfee Guardian shortcut menu on the System Tray (looks like a castle) given access to Internet Security
U	Guardian PC Security Tools	Pfft.exe	"Boomerang Software's Guardian PC Security Tools - now rebranded as the eXtendia Security Suite"
X	GuardPcs.exe	GuardPcs.exe	"GuardPcs rogue security software - not recommended
Y	gw port controller	PORTCT95.EXE	"From a visitor - "I must keep it active in start up or my Lexmark printer and RCA Cam program cannot discover a working port to work". From the file properties
U	H/PC Connection Agent	WCESCOMM.EXE	"Connection manager for Microsoft ActiveSync - mobile device synchronization software for Windows XP (and earlier)
Y	H2O	cledx.exe	"Related to copyright protection products by SyncroSoft"
U	H2OWIBU	CXWibu.exe	"Related to CodeMeter from WIBU-SYSTEMS AG. Software protection hardware"
X	h4te Service Drivers	h4te.exe	"Added by a variant of the RBOT WORM!"
X	hachimitsu-lemon	hachimitsu-lemon.exe	"Added by the HACHILEM TROJAN!"
X	HackMuFpt	HackMuFpt.exe	"Added by the SCLOG-AG TROJAN!"
U	HalifaxHowardCluster	skinkers.exe	"""Howard the Weatherman"" desktop client from Halifax by Skinkers - marketing/messaging tool. Leave enabled if you want to receive messages"
Y	Hamachi	hamachi.exe	"LogMeIn Hamachi remote control and VPN software"
U	Handy Backup 3.9	hbagent.exe	"Handy Backup - automatic backup of your critical data to virtually any type of storage media including CD-RW devices and remote FTP servers"
X	Hard drive Controller	hdcontroller.exe	"Added by the KIMAN.B WORM!"
U	Hardware Doctor	Hwdoctor.exe	"Winbond Hardware Doctor - as included on some motherboard using Winbond's hardware monitoring chips. Displays fan speeds
X	Hardware Monitor Service	mshms.exe	"Added by the WOLLF-A TROJAN!"
X	Hardware Shell Detection	WinHSD.exe	"Added by a variant of the RBOT WORM!"
U	Harmony 98 - CasioOrg	CasAgnt.exe	"Enterprise Harmony 98 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000"
X	HataDuzelticisi	SysRep.exe	"HataDuzelticisi
U	HawkEye IV Control Panel	HAWK_32.EXE	"Control Panel application for the old Number Nine graphics cards to change resolution
N	HC Reminder	hc.exe	"For Compaq PC's. Help Compiler
N	HCDetect	HCDetect.exe	"MS HomeClick Network - simple home network setup and configuration program included with 3Com HomeConnect home networking products. Runs in the background for network printer notification
X	hcen	hcen.exe	"Added by the SMALL.LR TROJAN!"
U	hcenter	tgcmd.exe	"Part of software from SupportSoft (aka Support.com) provided to manufacturers and ISPs that allows them to offer on-line support - to update drivers
U	hcenter	hcenter.exe	"Bellsouth help center. Part of software from SupportSoft (aka Support.com) provided to manufacturers and ISPs that allows them to offer on-line support - to update drivers
X	hclean32.exe	hclean32.exe	"Wareout - malware masquerading as a spyware and dialer remover"
U	Hcontrol	hcontrol.exe	Hotkeys on an ASUS Notebook. Only required if you use the additional keys
U	HControlUser	HControlUser.exe	Hotkeys on an ASUS Notebook. Only required if you use the additional keys
N	hcsystray	hc_tray.exe	"Kuma Notifier for the Shootout! game from the History Channel. ""It lets you know whenever there's a new episode that's been released or an announcement from the Kuma team. Just click it to get up-to-the-minute game and event information"""
N	HD Audio Control Panel	RtHDVCpl.exe	"Realtek HD Audio Manager
N	HDAShCut	HDAShCut.exe	High definition audio page shortcut for Realtek audio devices - not required
U	HDAudDeck	HDAudioCPL.exe	"Vista control panel for VIA Vinyl HD Audio Codecs from VIA Technologies
U	HDAudDeck	HDeck.exe	"XP control panel for VIA Vinyl HD Audio Codecs from VIA Technologies
U	HDDControlGuard	HDDControlGuard.exe	"Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access"
U	HDDControlGuard.exe	HDDControlGuard.exe	"Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access"
X	hdlfoe df98ndf	svchots.exe	"Added by a variant of the RBOT WORM!"
X	hdlpscom	[8 random letters].exe	"Added by the RBOT-FUL WORM!"
X	he3bbcff	"rundll32.exe he3bbcff.dll	EnableRunDLL32"
X	he3e3fc4	"rundll32.exe he3e3fc4.dll	EnableRunDLL32"
X	Hekio Startups	Hnksvc32.exe	"Added by the AGOBOT-QE WORM!"
X	HELLBOT3	coolbot.exe	"Added by the MYTOB.AB WORM!"
X	hellfire	svchost.exe	"Added by the LEOX.D TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	help	help.scr	"Added by the BANCOS-BBU TROJAN!"
U	HelpCenter	sprtcmd.exe /P HelpCenter	"Self-help support tool for BellSouth's FastAccess® DSL (now owned by AT&T) broadband service (provided by SupportSoft
U	HelpCenter4.1	sprtcmd.exe /P HelpCenter4.1	"Self-help support tool for BellSouth's FastAccess® DSL (now owned by AT&T) broadband service (provided by SupportSoft
X	helpctl.exe	helpctl.exe	"Added by the GASLIDE TROJAN!"
X	Helper	eschlp.exe	"Added by the BLASTER.T WORM!"
X	HELPER	greece_nm.exe	"AsdPlug premium rate adult content dialer variant"
X	HELPER	canada.exe	"AsdPlug premium rate adult content dialer variant"
X	HELPER	france.exe	"AsdPlug premium rate adult content dialer variant"
Y	HEProtect	HSockPE.exe	"Part of the AntiSpam function of the HAURI ViRobot Desktop internet security suite"
?	HerculesCamService	CamService.exe	"Related to the Hercules Dualpix HD Webcam. What does it do and is it required?"
X	hErcUnes	softhost.exe	"Added by the GARROCH WORM!"
X	Hewlett Packard Manager	hpmanager.exe	"Added by the MYTOB.KE WORM! Note - this is not a valid Hewlett-Packard program"
N	Hewlett Packard Recorder	Remind32.exe	HP multifunction registration
X	HF Security	hfsecure.exe	"Added by the AGOBOT-TI WORM!"
?	HiberMonitor	HCount.exe	"??"
U	Hide and Protect any Drives for Win95/98/Me/2k/XP	HPDAgent.exe	"Loads Hide and Protect any Drives - which allows you to ""Protect Hard drive
U	High Definition Audio Property Page Shortcut	CHDAudPropShortcut.exe	"Realtek audio card related. Probably adds the odd feature to one of the ""Sounds"" Control Panel applet tabs - doesn't appear to be required"
N	High Definition Audio Property Page Shortcut	HDAShCut.exe	High definition audio page shortcut for Realtek audio devices - not required
U	High Definition Audio Property Page Shortcut	CHDAudPropShortcut.exe	"Realtek audio card related. Probably adds the odd feature to one of the ""Sounds"" Control Panel applet tabs - doesn't appear to be required"
X	Highspeeddownloader	SetupClickHere.EXE	"Homepage hijacker
U	HijackThis	HijackThis.exe	"""HijackThis is a free utility which quickly scans your Windows computer to find settings that may have been changed by spyware
U	HijackThis startup scan	HijackThis.exe	"""HijackThis is a free utility which quickly scans your Windows computer to find settings that may have been changed by spyware
X	HistoriaLout.	GDC.exe	"HistoriaLout. rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
U	hkcmd	hkcmd.exe	"Hot Key handler for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
X	HKCU	server.exe	"Added by the AGENT-NLT TROJAN!"
X	HLcleanup	hlsetup2.exe	"LinkReplacer/FFinder adware"
X	HLL Data Parameter	hllcxpa.exe	"Added by the RBOT.AFG WORM!"
X	HMI PowerSystem	hmisvc32.exe	"Added by the RANDEX.CZZ WORM!"
X	HML PowerSource	hmlsvc32.exe	"Added by the SDBOT-XL WORM!"
X	HMV PowerSource	hmusvc32.exe	"Added by the SDBOT-YW WORM!"
X	hohohhaha	ournik.com	"Added by the IRCFLOOD.AL BACKDOOR!"
X	HOI Services	holsvc32.exe	"Added by the AGOBOT-SF WORM!"
X	Hollaback	slvhosts.exe	"Added by the SDBOT.BMO WORM!"
N	Home Theater SchSvr	SchSvr.exe	"WinScheduler is installed with Home Theater Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
?	HomeCentre WakeUp	LGWAKEUP.EXE	"Associated with the no longer supported Xerox HomeCentre printer/scanner"
Y	HorngTech4D	bally4d.exe	HorngTech 4D mouse driver
X	Host Process	mame.exe	"Added by the RBOT-APO WORM!"
X	Host Process	svchost.exe	"Added by the IRCBOT.AGF BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in the Fonts directory"
X	Host Process for Windows Tasks	taskhost.exe	"Added by the BREDO-AI WORM! Note - this is not the valid Windows 7 process which has the same filename and the file description is also ""Host Process for Windows Tasks"". It is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	HostSrv	sachostx.exe	"Added by the LOOKSKY.H WORM! Drops multiple files in %System%"
X	HostSrv	sachostx.exe	"Added by the LOOKSKY.A or LOOKSKY.F or LOOKSKY.G WORMS!"
X	HostSrv	sachostx.exe...	"Added by the LOOKSKY.E WORM!"
X	HostSVC syse	HostSVC.exe	"Added by the RBOT-ANZ WORM!"
U	Hot Corners	Hotc.exe	"Hot Corners - ""lets you quickly activate or disable your screen saver by moving the mouse into a given corner of the screen"""
X	HOT FIX	Gothic.exe	"Added by the SDBOT.FIR WORM!"
X	HOT FIX	E0chis.exe	"Added by the HUPIGON.JTY TROJAN!"
X	HOT FIX	QOching.exe	"Added by the WOOTBOT.VH WORM!"
X	HotAction_hr	hotaction_hr.exe	"Added by the SITEICON-B DIALER! An uninstall option can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as ""HotAction_hr"""
X	hotdlll	remote.cmd	"Added by the BANKER-EHG TROJAN!"
U	HotKeysCmds	hkcmd.exe	"Hot Key handler for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
X	HotKeysCmds	[path to worm]	"Added by the PAHATIA-A WORM!"
N	HotSync Manager	hotsync.exe	Installed when connecting a Palm HotSync cradle up to a USB port. The Blue and Red Arrow Icon that enables Palm / Handspring Synchronizing. Available via Start → Programs
X	Hot_Tarts_mc	Hot_Tarts_mc.exe	"HotTarts adult content dialer"
N	HP CD Writer	hpcdtray.exe	System Tray access to a HP CD-Writer's functions. Available via Start -> Programs
N	HP CD-DVD	hpcdtray.exe	System Tray access to a HP CD-Writer's functions. Available via Start -> Programs
N	HP CD-Writer	hpcdtray.exe	System Tray access to a HP CD-Writer's functions. Available via Start -> Programs
X	hp center	BACKWEB-*****.exe	"See here - ""messaging service that automatically sends you support information
N	hp center UI	ShadowBar.exe	"User Interface for HP Center - see here"
N	HP Component Manager	hpcmpmgr.exe	"Checks the internet for updated drivers/utilities for your HP product - update manually. Disabling will remove the error ""Windows can't shutdown the computer because hpcmpmgr.exe can't be ended"""
X	HP Desktop	ccappms.exe	"Added by the SDBOT-TG WORM!"
U	HP Health Check Schedule	HPHC_Scheduler.exe	HP Health Check Scheduler from Hewlett-Packard
?	HP IDScheduler	HPIDSCHD.exe	"HP Instant Delivery Scheduler"
U	HP Instant Support	matcli.exe	""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	HP Internet Center	SURFBRD.EXE	Loads the HP Internet center surfboard on startup. HP Internet Center allows you to customize the multimedia keys on the fly without having to go the Control Panel --> Keyboards to change them
N	HP JetDiscovery	HPJETDSC.EXE	HP JetAdmin software which monitors printing jobs on a network environment
U	HP Laser Jet Director	hppdirector.exe	"System Tray icon that opens various functions such as copy
?	HP OfficeJet Series xxx Startup	HPOSTR03.EXE	"xxx represents the series number - such as 700. What does it do and it it required?"
?	HP OfficeJet Series xxx Startup	HPOstr05.exe	"xxx represents the series number - such as 700. What does it do and it it required?"
N	HP Precision Scan	hpmdlbwx.exe	HP multifunction scanner software. Available from HP Office Jet R Toolbox so not required
U	hp psc 2000 Series	hpobnz08.exe	System Tray icon indicating when the printer is ready. Can be started manually with HP Director but takes time to start
U	HP RecordNow	??	"From HP ""Software for the CD writer. Do not prevent from starting unless the CD writer is never going to be used."""
U	HP ScanPatch	HPScanFix.exe	"Program that starts up and automatically fixes earlier versions of the Scanjet 5100c software. If a Scanjet 5100C scanner is not going to be used
N	HP ScanPicture	hpsplmwa.exe	HP multifunction scanner software. Available from HP Office Jet R Toolbox so not required
U	HP SchedIndexer	hppschedindexer.exe	"Installed by HP multi-function printer driver software
X	HP Service Drivers	hdsys.exe	"Added by the SDBOT-ZE WORM!"
?	hp Silent Service	HpSrvUI.exe	"HP related"
N	HP Simple Trax	Hpcron.exe	Supplied with HP CD-RW drives - stores information about CD contents on your hard drive. Available via Start -> Programs or Desktop Icon
N	HP software update	HPWuSchd2.exe	HP software updates. If a shortcut doesn't exist create your own and run it manually
N	HP software update	HPWuSchd.exe	"HP software updates. If a shortcut doesn't exist
N	hpaiodevice	hpodev07.exe	"Direct from HP - "Device Objects Server - detects all device events and handles all ongoing communication on the device. Loads in the Startup group (except when "portable" is chosen during installation)". Related to various HP all-in-one printer/scanner/copier devices. They print and copy fine with those files disabled
?	HPAiODevice(hp officejet g series)	hpoavn07.exe	"HP Printer related
N	HPAiODevice(hp psc 900 series) -1	hpobrt07.exe	"Installed with a Hewlett Packard 900 series colour printer
X	hpcmd	cmd.exe	"Added by the ADCLICK-DS TROJAN!"
N	hpcmpmgr	hpcmpmgr.exe	"Checks the internet for updated drivers/utilities for your HP product - update manually. Disabling will remove the error ""Windows can't shutdown the computer because hpcmpmgr.exe can't be ended"""
N	hpfsched	hpfsched.exe	HPFSCHED is a small TSR that will remind you to clean the cartridges in your DeskJet from time to time in order to keep print quality high. It can be removed from the run line in win.ini if you do not want that feature
U	HPGamesActiveMenu	ActiveMenu.exe	Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
X	HPl Services	hmlsvc32.exe	"Added by the AGOBOT-SI WORM and variants!"
U	hplampc	hplampc.exe	HP Scanner Lamp Utility - fixes an issue with the scanner lamp not going off
U	HPLaptopGamesActiveMenu	ActiveMenu.exe	Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
Y	HPLJ Config	SetConfig.exe	Connects system to networked HP printer.
?	hpqcmon	hpqcmon.exe	"From HP and related to digital imaging"
U	HPSCANMonitor	hpsjvxd.exe	HP scanning software that enables you to scan images from your scanner. Needed if you're using the scanner
?	hpScannerFirstBoot	scannerfb.exe	"HP scanner related"
X	hpsysconf1	[random filename]	"Added by a variant of the VIVIA.A TROJAN!"
X	hptools	microsoft.exe	"Added by a variant of the SDBOT WORM!"
N	HPU	ProvenTactics.exe	"Proven Internet Marketing software"
X	HQI Services	hqisvc32.exe	"Added by the AGOBOT-RO WORM!"
X	HQI Services	hqlsvc32.exe	"Added by the AGOBOT-RP WORM!"
U	HREF.OCX	regsvr32.exe ....HREF.OCX	"HREF.OCX is an ActiveX control developed by xFX JumpStart and used to provide HTML-alike clickable links on Windows-based programs such as PopUpKiller"
X	Hrn_qtv	hrnsvc32.exe	"Added by the SDBOT-AET WORM!"
X	Hservice	msservice.exe	"Added by the AUTORUN-KL WORM!"
X	hsim	isearch.exe	Unidentified malware
?	HsuGuiControl	HsuGuiControl.exe	"Part of the Starband Internet satellite client. What does it do and is it required?"
U	HTpatch	htpatch.exe	HTpatch.exe is part of the SiS AGP patch - BUT unless your processor (and motherboard) supports HyperThreading (HT) and this feature is enabled it will actually SLOW your graphics card by around 6%
X	HtProtect	AVprotect.exe	"Added by the NETSKY.L WORM!"
X	http://www.lienvandekelder.com	Lien Van de Kelder.exe	"Added by the MYTOB-EQ WORM!"
X	http://www.lienvandekelder.com/	LienVandeKelder.exe	"Added by the MYTOB-EO WORM!"
X	httpd	c_pan.exe	Added by a variant of the DELF-A TROJAN!
U	HughesNet Tools	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	Hvewsveqmg	ANACON.EXE	"Added by the NACO.A WORM!"
X	Hwp	system_wc.exe	"Eziin adware"
X	hxadsec	[path to trojan]	"Added by the ADCLICK-AP TROJAN!"
X	I am not Ranky. I am eTunnel!	msyervice.exe	Added by an unidentified WORM or TROJAN!
X	I just want to say I love Milko and I need a drink	svchost.exe	"Added by the CHIKO WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\Administrator\Local Settings\Application Data"
X	I/O Controllers	svcnet.exe	"Added by the TIBIK-B TROJAN!"
X	Iamnacho On Irc.MusIrc.com Is a Homosexual!	XBox64.exe	"Added by the RANDEX.Y WORM!"
Y	IBM Client Security	certtool.exe	"Part of Client Security Software for IBM\Lenovo notebooks. If you have configured the software via the associated wizard this will need to be running if you want to mount password protected areas of the disk (created with SafeGuard PrivateDisk)
N	IBM Client Security Software	csecwiz.exe	"Setup wizard for the Client Security Software for IBM\Lenovo notebooks. This entry only runs once
N	IBM RecordNow!	RecordNow.exe	"IBM customized version of the RecordNow! CD-writing utility from Sonic Solutions"
U	IBM ThinkPad EasyEject Support Application	EzEjMnAp.Exe	"EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
N	IBM ThinkPad EasyEject Tray Utility	EZEJTRAY.EXE	"System Tray access to the EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
U	IBM TrackPoint Accessibility Features	tp4ex.exe	"Supports accessibility features for the TrackPoint stick and associated buttons on IBM/Lenovo ThinkPad notebooks. If features such as ""Click Sound""
?	IBM Warranty Notification	ERTS0749.exe	"IBM Warranty Notification - presumably it's a reminder to either register or that warranty is about to expire?"
U	Ibmpmsvc	ibmpmsvc.exe	"Power management driver for IBM laptops. Provides support for the use of four keys on the thinkpad keyboard with blue key tops - Fn
?	IBMPRC	ibmprc.exe	IBM application - what does it do and is it required?
U	IBMUltraBayHotSwapCPLLoader	IBMBAY2N.EXE	Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops
U	IBWin Background process	IBackground.exe	"IBackup for Windows"
Y	IcaBar	icabar.exe	Related to Citrix MetaFrame
U	iCalendar	Calendar.exe	"Older version of Desktop iCalendar/Desktop iCalendar Lite by Desksware which include support for Google Calendar and add weather
X	icasServ	icasServ.exe	"Browser hijacker
X	icccomp	[8 random letters].exe	"Added by the ZHELATIN.EQ WORM!"
X	ICcontrol	iccontrol.exe	"ICcontrol premium rate adult content dialer"
X	icdd7ee6	"rundll32.exe icdd7ee6.dll	EnableRunDLL32"
X	icddefff	"rundll32.exe icddefff.dll	EnableRunDLL32"
Y	ICF	mfp.exe	"McAfee Family Protection - which 'is easy-to-use and built to empower parents to say ""yes"" to their children's online interests while protecting them as they learn and explore' and ""protects children of all ages from exposure to inappropriate content
N	ICH Synth	eusexe.exe	"Sound related and can be disabled without affecting performance although advanced sound features may be sacrificed. May be related to Compaq PC's with "SoundMAX integrated Digital Audio" (Analog Devices Inc.) devices"
X	icifati	yujixit.exe	"Added by the SDBOT.ZZH WORM!"
U	iClean	iClean.exe	"IEClean - ""advanced
U	ICM	ICM.EXE	"Starts Internet Call Manager dialog box and/or taskbar icons at bootup. This is a subscription program from internetcallmanager.com that monitors a dialup phone line for incoming calls and handles voicemail"
X	ICManagement	msic32.exe	"Added by the MSIC BACKDOOR!"
N	iCn	NAG.EXE	"iChoose - shopping browser enhancement that alerts you to cheaper deals for goods you want to buy
U	ICO	ICO.EXE	"Found on some Sony Vaio
N	Icon Animation	HDE.EXE	Part of McAfee Nuts & Bolts. Provides entertaining animation of your desktop icons
N	Icon Hearit 95	hearit95.exe	Audio desktop customization utility from Moon Valley Software. Resource hog
N	Icon Hearit 98	hearit98.exe	Audio desktop customization utility from Moon Valley Software. Resource hog
X	Icon lptt01	icon.exe	"RapidBlaster variant (in a ""Icon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Icon ml097e	icon.exe	"RapidBlaster variant (in a ""Icon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
Y	iconcache	icon.bat	"Related to the Vista Customization Pack"
Y	ICONCLNT	iconclnt.exe	"APC PowerChute® Personal Edition tray icon"
U	ICONDESK	ICONDESK.EXE	Small utility which will allow you the option of hiding or showing your desktop icons
N	Iconfig.exe	Iconfig.exe	Icon for LS-120 "Superdisk"
X	iConfigLoader	DIIhost.exe	"Added by the GAOBOT.AO WORM!"
N	Iconoid	Iconoid.exe	"Iconoid is a desktop icon manager"
N	Iconsaver	Iconsaver.exe	"IconSaver is a desktop icon manager"
X	ICQ	ICQNET.vbs	"Added by the GORMLEZ-A WORM!"
X	ICQ Agent	icq6.exe	"Added by the AGENT-FZJ TROJAN!"
X	ICQ Center	[path to worm]	"Added by the RANDIN WORM!"
X	ICQ Chat Service	icqjdhs.exe	"Added by a variant of the RBOT WORM!"
X	ICQ Hacking Pro	ICQpro.exe	"Added by a variant of the NETSPY TROJAN!"
N	ICQ Lite	ICQLite.exe	"ICQ Lite - compact version of the popular messaging program"
X	icq lite	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	icq lite	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	ICQ Lite Messenger	ICQLITE.EXE	"Added by an unidentified VIRUS
X	ICQ Messenger 2002	ICQ2002.exe	"Added by the SDBOT-ABL WORM!"
X	ICQ Net	winlogon.exe	"Added by variants of the NETSKY WORMS! Note - this is not the legitimate winlogon.exe process which should not appear in Msconfig/Startup!"
N	ICQ Plus	vplus.exe	"ICQ Plus is a freeware utility makes your ICQ skinnable (change the look). Available via Start -> Programs"
X	IcqBeta	webcamupdate.exe	Added by an unidentified TROJAN!
U	ICQMonitor	ICQMonitor.exe	"ICQ Monitor Sniffer surveillance software for the ICQ instant messenger. Uninstall this software unless you put it there yourself"
X	ICQMsn	[path to trojan]	"Added by the RANCK-AH TROJAN! The most common example is ""cbfks.exe"" located in %System%"
X	ICQNet	winlogon.exe	"Added by the NETSKY-C WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	icrosof Avps32 Control	av32.pif	"Added by the RBOT-AVC WORM!"
X	icrosoft Visual	plscx.exe	"Added by the RBOT-AYO WORM!"
X	icrosoft Visual InterDevc	zvslmqb.exe	"Added by the RBOT-AYP WORM!"
X	icrosoft Windows DLL Services Configuration	poker3.exe	"Added by the SDBOT-AER WORM!"
X	icrosoftf Avpx Control	avpx.exe	"Added by the RBOT-AYN WORM!"
U	ICSDCLT	"rundll32.exe Icsdclt.dll	ICSClient"
N	ICServer	Icserver.exe	Intel Intercast viewer software. Gives access to selected internet pages which are broadcasted by several TV stations
Y	ICSMGR	ICSMGR.EXE	Monitors DNS and DHCP requests for ICS (Internet Connection Sharing). Needed if you're sharing the internet on various computers
X	ICU-Sucker	Service32.exe	"Added by the ILLNOTIFIER.D TROJAN!"
N	IC_KEY_3	spvic.exe	"Instant Chess related"
N	ID Commander	IDCom.exe	Caller ID utility for identifying incoming telephone numbers
X	idecntl	idecntl.exe	"Added by a variant of the CRYPTER.C TROJAN!"
X	IE configure	explorer.exe	"Added by the LINEAGE-C TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually!"
U	IE Doctor	IEDoctor.exe	"IE Doctor Toolbar - ""IE Doctor can help you to Repair IE easily
X	IE**.exe [* = random char]	IE**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	IE**32.exe [* = random char]	IE**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	IE-Security	iescan.exe	"IE-Security rogue spyware remover - not recommended
X	IE-Security	wdscan.exe	"IE-Security rogue spyware remover - not recommended
X	IEACCESS	temp532.exe	"AsdPlug premium rate adult content dialer variant"
X	IEACCESS	surfya.exe	"
X	IEAgent update check	iewatch.exe	"Added by the BOMKA TROJAN!"
X	IECache	IECache.exe	"Detected by Bitdefender as the DELF.OFC TROJAN! See here"
N	iecheck	iecheck.exe	"Integrity checker for IconEdit2 icon editor. It serves for IconEdit2 internal tasks only and can be safely deleted from the system if you are running the latest version of IconEdit2"
X	IECheck	MSDTCs.exe	"Added by the TIRBOT-D WORM!"
X	IECheck	xpssl.exe	"Added by the TIRBOT-E WORM!"
X	IECheck	mssvp.exe	"Added by the TIRBOT-G WORM!"
U	IECleanAux	Ieboot6.exe	"IEClean by Kevin McAleavy - cookie manager
X	Iehelper	syslaunch.exe	Outwar adware downloader
X	iel2cde8	"rundll32.exe iel2cde8.dll	EnableRunDLL32"
X	ielcaabe	"rundll32.exe ielcaabe.dll	EnableRunDLL32"
X	Iesearch.exe	Iesearch.exe	"LookNSearch adware"
X	IEService.exe	IEService.exe	"FastFind adware variant"
X	ieupdate	MCP****.exe [**** = random char]	"Added by the ASOXY TROJAN!"
X	ieupdate	mcpdll32.exe	Adware downloader trojan
X	Iexplore Services	iexplore.exe	"Added by the LITHIUM BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup!"
X	IEXPLORER	msiecfg.exe	"Added by the BDOOR-JU BACKDOOR or BANCBAN-IP TROJAN!"
X	IExplorer32 Java Scripting	IExplore32b.exe	"Added by the RBOT.ABO WORM!"
X	IExplorer32c Java Scripting	IExplore32cb.exe	"Added by the RBOT.ABN WORM!"
X	IExplorer6 Java Scripting	IExplore326.exe	"Added by a variant of the SDBOT WORM!"
X	IExplorer7 Java Scripting	IExplore327.exe	"Added by a variant of the SDBOT WORM!"
X	IExplorerService	WinSock.exe	"Added by the AGENT.KIU TROJAN!"
X	igamatu	atecaca.exe	"Added by the IRCBOT.R WORM!"
U	igfxhkcmd	hkcmd.exe	"Hot Key handler for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
X	igfxtras	svchots.exe	"Added by the AUTORUN-AIW WORM!"
X	IGuardPc.exe	IGuardPc.exe	"IGuardPc rogue security software - not recommended
?	iHP-100	iHPDetect.exe	"Drive Letter Searcher
X	iilc	IILC.EXE	Homepage hijacker
X	iiuyvyu	uzcx.exe	"Added by the AGENT-EOF TROJAN!"
U	IJNetworkScanUtility	CNMNSUT.EXE	Network utility available for some Canon scanners and multifunction devices. Allows the device to see computers on a network and those computers running the utility to control scanning via the Control Panel on the scanner - which saves you having to run back and forth between the scanner and your computer
Y	IKE Service 95	IKEService.exe	"Associated with PGP. The PGP Tray can be disabled
?	ILO_Office_Manager	IntEdReg.exe /OFFMAN	"Intense Educational Ltd - Language Office Software. Is it required?"
U	iLyric	iLyric.exe	"iLyric plugin for Winamp media player. Allows you to retrieve the lyrics for your songs with the press of a button"
N	iM Start Center	iM_Tray.exe	Installed with the Sound Blaster Audigy range of soundcards. A radio tuner installed if the user chooses during installation. Available via Start -> Programs -> iM Networks -> iM Radio Tuner
N	iMarkup Client	iUtil.exe	"Enables the iMarkup Client web page annotation utility to run in the background and be available in systray. Shortcut available via Start -> Programs"
X	imchat	imchat.exe	"Added by a variant of the IRCBOT TROJAN!"
X	IMClass	Svhosl.exe	Added by an unidentified WORM or TROJAN!
X	imcssl	xmliwvug.exe	"Added by the SLAPER.U TROJAN!"
X	IME	conime.exe	"Added by the DLDR-G TROJAN! Note - this is not the legitimate Console IME process of the same filename which is located in %System%. This one is located in %Windir%"
U	ImgIcon	ImgIcon.exe	"Displays Iomega icons in Explorer/My Computer
X	IMJPMIG6.1	HelpCat.exe	"Added by the BESVERIT WORM!"
?	immcheck.exe	immcheck.exe	"Related to I-FORCE driver for force feedback steering wheel?"
X	IMprocess	IM-svr.EXE	"IMNames adware"
U	ImScInst	ImScInst.exe	"Microsoft's Input Method Editor which is used to both display and enable the input of characters from East Asian and Right-to-left (e.g. Arabic) languages in e-mails
U	ImScInst.exe	ImScInst.exe	"Microsoft's Input Method Editor which is used to both display and enable the input of characters from East Asian and Right-to-left (e.g. Arabic) languages in e-mails
U	IMVU	IMVUClient.exe	"IMVU chat client that allows you to create ""your own avatars who chat in animated 3D scenes"""
X	imwinsrvc	acpmonsrv.exe	"Added by the SLAPER.E TROJAN!"
X	imxecs	vbrun70sp4.exe	"Added by the AGOBOT.ALA WORM!"
Y	InCD	incd.exe	"Ahead InCD packet writing software - similar to DirectCD. For Nero 5.0 or 5.5 (InCD3)
N	IncMail	IncMail.exe	"""IncrediMail is an advanced
X	incognito	incognito.exe	"Added by an unidentified WORM or TROJAN! See here"
N	InControl Desktop Manager	DMHKEY.EXE	For Diamond Multimedia video cards. Allows System Tray access to desktop utilities such as screen resolution. Available via Start -> Programs
X	Incredible Keylogger	AdvKeylog.exe	"IncredibleKeylogger spyware"
N	Incredimail	incredimail.exe	""IncrediMail is an advanced
N	Incredimail	IncMail.exe	"""IncrediMail is an advanced
X	Index Service	dllhost32.exe	"Added by the AGOBOT.CH WORM!"
X	Indexindicator	Indexindicator.exe	"Added by the LAZAR TROJAN!"
N	IndexSearch	IndexSearch.exe	"Part of Nuance (ScanSoft) PaperPort - ""scan
U	IndicatorUty	IndicatorUty.exe	"Fujitsu Hotkey Utility displays icons on the screen when you use hotkeys on a Fujitsu Siemens Lifebook
U	IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}	NMIndexStoreSvr.exe	"Indexing service that catalogs all the media on your computer so that the files are available to all of the programs in the Nero suite of applications"
X	ine	svchosts.exe	"Added by the RBOT.BNL WORM!"
X	INET	inetsync.exe	"Meplex adware"
X	InetChk	ms[random value].exe	"Added by the AGENT-IRL TROJAN!"
U	inetcntrl	inetcntrl.exe	Bsafe Online - internet filter
?	InetConf	inetconf.exe	"??"
X	InetServices	wsock32.exe	"Added by the WOCK32-A TROJAN!"
X	INFO DATA	apc.exe	"Added by the RANDON.B WORM!"
U	Info Select	is.exe	"Info Select from Micro Logic - personal information manager"
N	InkWatch	InkWatch.exe	Associated with Canon (and maybe other) printers. Tells you when the ink's running low and asks if you want to buy another cartridge on-line
Y	InoRPC	InoRpc.exe	"Associated with eTrust Antivirus/InoculateIT"
X	iNotice	iservice.exe	Added by a variant of an MSN worm that tries to lure people to an infected site by using nude pictures and videos
?	insCOA5	insCOA5.exe	"??"
X	InstallCleaner	InstallCleaner.exe	"Added by the ANYHOMB.F TROJAN!"
X	Installed shell32.dll	Office.exe...	"Added by the LOVGATE.AO WORM!"
X	Installed shell32.dll	Office.exe	"Added by the LOVGATE.E WORM!"
?	InstallNAIProduct	SETUP.EXE	"Could be related to Network Associates Inc who own the McAfee VirusScan product amongst others. This was found in a directory called "VSC". Could it be an installation that failed and "SETUP.EXE" was left to run at startup as an error?"
X	Installs SP2	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are located in %System%\qpalsp"
X	Installs SP4	[path] repcale.exe [path] p0rd.exe	"Added by the RANDON-AK WORM! Both files are located in %System%\ekrlgc"
X	Instance 001	[path to worm]	"Added by the ALASROU-A WORM!"
X	Instant Access	"rundll32.exe EGDHTML_1023.dll	InstantAccess"
X	Instant Access	"rundll32.exe eg_auth_****.dll	InstantAccess [**** = digits]"
X	Instant Access	"rundll32.exe EGCOMLIB_****.dll	InstantAccess [**** = digits]"
X	Instant Access	"rundll32.exe EGCOMSERVICE_****.dll	InstantAccess [**** = digits]"
X	Instant Access	"rundll32.exe p2esocks_****.dll	InstantAccess [**** = digits]"
X	Instant Access	mwsrvacc.exe	"InstantAccess premium rate adult content dialer"
X	Instant Access	linewsrv.exe	"InstantAccess premium rate adult content dialer variant"
X	Instant Messenger Service	imservice.exe	"Detected by Kaspersky as the HEUR TROJAN!"
N	Instant Update Center	reminder.exe	"Event reminder for calendar dates
U	Instant Wireless Configuration Utility	WUSB11cfg.exe	"Utility used by the LINKSYS LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
U	Instant Wireless Configuration Utility	WPC11Cfg.exe	"Utility used by the LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
N	InstantAccess	INSTAN~1.EXE	From TextBridge Pro 9.0 OCR scanner software. Available via Start -> Programs
N	InstantTray	PCLETray.exe	"Pinnacle InstantCD/DVD disc creation software. Tray icon enabling a pop-up menu that lets you call up any of Instant CD/DVD's tools with one click. Can be started manually"
X	InSysSecure	InSysSecure.exe	"InSysSecure rogue security software - not recommended
X	intdctrr	idctup20.exe	"SafeSurfing adware variant"
X	Intec Service Drivers	msmsgrs.exe	"Added by the SDBOT-ADN WORM!"
X	Intec Service Drivers	[path to worm]	"Added by the RBOT-GLU WORM!"
X	Intec Service Drivers	wing32.exe	"Added by the RBOT.HAZ WORM!"
X	Intec Service Drivers	msmsgredss.exe	"Added by the SDBOT-AGL WORM!"
X	Intec Services Driverrs	winrvc.exe	"Added by a variant of the SDBOT WORM!"
X	Intec Services Drivers	msupdate22e.exe	"Added by the RBOT-CGC WORM!"
U	Intel Active Monitor	imontray.exe	"System tray monitoring of fans
X	Intel Driver	csrs.exe	"Added by a variant of the SDBOT WORM!"
X	Intel Management Services v32	mstime32.exe	"Added by the AUTORUN-AYG WORM!"
X	Intel Physical Routine 1.2A	stnetlib.exe	"Added by the BACKDR-AS BACKDOOR!"
U	Intel Product Number Utility	IntelProcNumUtility.exe	"Intel Processor Serial Number Control Utility allows you to enable and disable the processor serial number capability of an Intel PIII processor. You can find more information here. System Tray icon providing the user with a visual state indication. You can find more information here"
N	Intel PROSet Tray Icon	promon.exe	System Tray icon for Intel PRO series ethernet adapters giving access to the diagnostic features
X	Intel Service Drivers	msconfig16.exe	"Added by the MSCONFIG16 TROJAN!"
U	Intel(R) Common User Interface	igfxtray.exe	"System Tray access to display settings for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
U	Intel(R) Common User Interface	hkcmd.exe	"Hot Key handler for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
U	Intel(R) Common User Interface	igfxpers.exe	"Installed with the graphics drivers for Intel desktop and mobile motherboard chipsets with integrated graphics. It's purpose or function isn't known at present but testing with it disabled would appear to indicate it isn't required - hence the recommended ""U"" status"
U	IntelAPMClient	amclient.exe	"LANDesk® Management Suite software component"
X	Intelli Mouse Pro Version 2.0B	ncsjapi32.exe	"Added by the BUZUS-O WORM!"
X	Intelprc	Aas3lovu.exe	"Added by the SILLYFDC-CG WORM!"
U	IntelProcNumUtility	cpunumber.exe	"Intel Processor Serial Number Control Utility allows you to enable and disable the processor serial number capability of an Intel PIII processor. You can find more information here. System Tray icon providing the user with a visual state indication. You can find more information here"
U	IntelZeroConfig	ZCfgSvc.exe	"Zero Config MFC Application
?	Intense Registry Service	IntEdReg.exe /CHECK	"Intense Educational Ltd - Language Office Software. Is it required?"
X	InterceptedSystem	[path to worm]	"Added by the ANACON-B WORM!"
Y	InterCheck Monitor	Icmon.exe	"Part of Sophos ant-virus sofware"
Y	InterCheckMonitor	ICMON.EXE	"Part of Sophos anti-virus sofware"
X	Internal	regedit.exe /s c[month number]	"Added by the FORTNIGHT.D TROJAN! Note that the Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file ""c[month number]"" is located in %Windir%
X	Internat Conf	bootconf.exe	"Homepage hijacker
X	internct	WinSocks5.exe	"Added by the GRAYBIRD.F TROJAN!"
X	Internet	recruit.exe	"Added by the RBOT-AJG WORM!"
U	Internet Answering Machine	IAMNET~1.EXE	"From Callwave. It offers a free utility to monitor your incoming phonecalls if you only have a single telephone line for internet access"
U	Internet Answering Machine	IAM.exe	"From Callwave - offers a free utility to monitor your incoming phonecalls if you only have a single telephone line for internet access"
X	Internet Application Driver	expIorer.exe	"Added by the IRCBOT-WK TROJAN!"
U	Internet Call Director	ICD.EXE	"TELUS Internet Call Director (ICD) provides Internet users with real-time call notification while connected to the Internet"
U	Internet Call Manager	ICM.EXE	"Starts Internet Call Manager dialog box and/or taskbar icons at bootup. This is a subscription program from internetcallmanager.com that monitors a dialup phone line for incoming calls and handles voicemail"
X	Internet Config	svchosts.exe	"Added by the SDBOT TROJAN!"
X	Internet Connection Wizard	stisvsq.exe	"EasySearch adware"
X	Internet Connection Wizard	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Internet Connection Wizard	stisvsq1.exe	"Added by the DLOADR-AWD TROJAN!"
X	Internet Content Publisher	ICP.EXE	"Added by the RBOT-UD WORM!"
U	Internet Disk Cleaner	CLEARH~1.EXE	"""Internet Disk Cleaner from Elongsoft ""protects your privacy by cleaning up all Internet tracks and past computer activities"""
U	Internet Download Accelerator	ida.exe	"Internet Download Accelerator download manager"
X	Internet download manager service	idman.exe	"Added by the RBOT-BMS WORM!"
X	Internet Exploere Services	urlmon32.dll.exe	"Added by the EVIAN.C WORM!"
X	Internet Explore Microsoft	lEXPLORE.EXE	"Added by the RBOT-AOF WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	Internet Explorer Configuration	IEXPLORE.EXE	"Added by the SDBOT-UL WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Internet Explorer Security	iexplore.pif	"Added by the RBOT-ALQ WORM!"
X	Internet Explorer Updater	lexbac.exe	"Added by the DOWNLOAD TROJAN!"
X	Internet Protocol Configuration Loader	ipcl32.exe	"Added by the SDBOT TROJAN!"
X	Internet Security 2010	IS2010.exe	"Internet Security 2010 rogue security software - not recommended
X	Internet Security Service	msq32.exe	"Added by the RBOT-GFP WORM!"
X	Internet Security Service	msq23.exe	"Added by the RBOT-GQL WORM!"
X	Internet Security Service	msql23.exe	"Added by the RBOT-GML WORM!"
X	Internet Security Service	mysqlwin32.exe	"Added by the RBOT.UX TROJAN!"
X	Internet Security Service	expllorer.exe	"Added by the REFROSO.AFF TROJAN!"
X	Internet Service	intersvc.exe	"Added by the SPYBOT-DE WORM!"
X	internet service	syscfg32.exe	"Added by the RBOT-QS WORM!"
X	internet service	ssvhost.exe	"Added by a variant of the RBOT WORM!"
X	internet service	svho0st98.exe	"Added by the RBOT.EAT WORM!"
X	Internet Services	systemdev.exe	"Added by the SDBOT-PW WORM!"
X	Internet Services	internet.exe	"Added by the MYTOB.BT WORM!"
X	Internet Services	interserv.exe	"Added by the RBOT.BNT WORM!"
X	Internet Services	Netsvc.exe	"Added by the MYTOB.MN WORM!"
N	InternetCalls	InternetCalls.exe	"InternetCalls - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X	InternetGetConnectedState	winupdate.exe	"Added by the SDBOT-JN WORM!"
X	InternetGetConnectedStateEx	winupdate.exe	"Added by the SDBOT-JN WORM!"
X	Internet_Explorer	microsoft.exe	"Added by the BANKER-EUQ TROJAN!"
X	Inters Configuration Loader	RCL0ADERS.exe	"Added by the SDBOT-KX WORM!"
N	InterTrust Quick Start	it_cpq~1.exe	"InterTrust offers something known as Digital Rights Management to control legal software download and other E-commerce related business"
N	Intervideo Win Cinema Manager	WinCinemaMgr.exe	"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	Intervideo Win Cinema Manager	WINCIN~1.EXE	"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	Intervideo WinCinema Manager	WinCinemaMgr.exe	"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	Intervideo WinCinema Manager	WINCIN~1.EXE	"WinCinema Manager is needed when using the WinDVD Remote Control for WinDVD from Intervideo. Available via Start -> Programs"
N	Intervideo WinScheduler	WinScheduler.exe	"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
N	Intervideo WinScheduler	SchSvr.exe	"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
X	intranet	SYS32CFG.EXE	"Added by the SPYBOT-DW WORM!"
X	Intranet	schost.exe	"Added by the RBOT.SV BACKDOOR!"
N	Introducing Media Manager	SPLASHA.EXE	"MS Media Manager tour. Not required"
N	Introduction-Registration	??	"For Compaq PC's. Should only run first time
Y	Intuit SyncManager	IntuitSyncManager.exe	"Synchronizes local Intuit Quickbooks data with online data - ""Use the Intuit Sync Manager to find the status of your latest QuickBooks data sync
U	Inventory Scan	LDISCN32.EXE	"LANDesk® Management Suite software component"
N	iobi	iobiClient.exe	"iobi Home - a mail/voice service by Verizon"
U	Iomega Automatic Backup	ibackup.exe	"Iomega Automatic Backup - automatic backups for use with Iomega portable HDD"
U	Iomega Automatic Backup 1.0.1	ibackup.exe	"Iomega Automatic Backup - automatic backups for use with Iomega portable HDD"
N	Iomega Backup Scheduler	dtiom98.exe	"Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs"
U	Iomega Disk Icons	IMGICON.EXE	"Displays Iomega icons in Explorer/My Computer
U	Iomega Drive Icons	IMGICON.EXE	"Displays Iomega icons in Explorer/My Computer
U	Iomega ImIconXP	imiconxp.exe	"Iomega REV System Software - allows your Iomega REV drive to interact with the operating system via the Iomega REV UDF file system
?	Iomega QuickSync	Quicksync.exe	"??"
N	Iomega Watch	IOWATCH.EXE	Used by Iomega drives. Available via Start -> Programs
N	IomegaWare	COMMANDER.EXE	"Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs"
X	ioroxxo microsoft sux	system32.exe	"Added by a variant of the RBOT WORM!"
U	IP Changer 2.0	IPChanger.exe	"IP Changer 2.0 from Plustech Inc - network configuration management tool"
X	IP Packet Redirect Service	ipredirect.exe	"Added by the FORBOT.SM WORM!"
X	IP Stack	ipstack.exe	"Added by the AGOBOT.CW WORM!"
X	IP**.exe [* = random char]	IP**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	IP**32.exe [* = random char]	IP**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	IPC Connection	ipcconn.exe	"Added by the RBOT-AEG WORM!"
X	IPC Spool Manager	wnmgre.exe	"Added by the SDBOT-ZC WORM!"
X	IPC Spool Manager	winspec.exe	"Added by the SDBOT-BLU WORM!"
X	ipcfg.exe	ipcfg.exe	"Adware - detected by McAfee as a variant of the ADCLICKER-BM TROJAN!"
X	IPConfig	svcxnv32.exe	"Added by the HACARMY.E TROJAN!"
X	IPConfig	svcxnw32.exe	"Added by a variant of the HACARMY.E TROJAN!"
X	IPConfig	ipconfigs.exe	"Added by the HACARMY.C BACKDOOR!"
X	IpCtrl	ipcon32.exe	"Added by an unidentified VIRUS
N	IPInSightLAN 01	IPClient.exe	"IP Insight is a Quality of Service monitor and diagnostic tool that isn't required - see here for more information. Included with services from BellSouth
X	IPLog Security	iplogsec.exe	"Added by the IRCBOT.GP BACKDOOR!"
X	iPod USB Service	iPODService.exe	"Added by a variant of the RBOT WORM! Do not confuse with the Apple iPod process of the same name. The legitimate iPod file will always be located in the %ProgramFiles%\iPod\bin folder and is implemented as a system service
?	iPodWatcher	iPodWatcher.exe	"Associated with Apple's iPod® player. Detects when the iPod® is connected?"
X	IPOT Service Drivers	compaq.exe	"Added by a variant of the FUROOTKIT TROJAN!"
X	IPOT USB Service DRIVER	hpsebc087.exe	"Added by the SDBOT-WA WORM!"
X	IPOT USB Service DRV32	hpsebc08.exe	"Added by the SDBOT-WH WORM!"
N	IPPDetect	IPP4Detect.exe	"Part of Presto! Mr.Photo - ""an ideal program for creating
?	iPrint LPT Redirector	nipplpte.exe	"Related to Novell iPrint - ""a printing solution that enables you to send documents to printers located throughout the Net."" Is it required?"
N	iPrint Tray	iprntctl.exe	"Novell® iPrint - based on Novell Distributed Print Services - enables you to send documents to printers located throughout the Net"
U	iProtectYou	ip.exe	"iProtectYou - internet filtering/parental control and network monitoring software"
X	IPSEC Configuration	wsupdate.exe	"Added by the AGOBOT-IQ WORM!"
X	iPSec7	ipsec7.exe	"Added by the AGENT.AHVR TROJAN!"
U	ipsecdialer	IPSECD~1.EXE	"Cisco VPN Client - lets local users gain Administrator privileges on the operating system"
U	ipsecdialer	ipsecdialer.exe	"Cisco VPN Client - lets local users gain Administrator privileges on the operating system"
Y	IPSecMon	IPSecMon.exe	"Microsoft L2TP/IPSec VPN Client for Win98/Me/NT. Secure technology for making remote access virtual private network (VPN) connections across public networks such as the Internet"
X	IPTable Configuration	Winipcfgs.exe	"Added by a variant of the RBOT WORM!"
X	IPv6 Helper Driver	csass.exe	"Added by the AGOBOT.TC WORM!"
X	IPv6 STUN Service	netstun.exe	"Added by a variant of the SDBOT WORM!"
X	irassync	irasyncd.exe	"IRASSync adware"
X	irc session	sessionmgr.exe	"Added by the SDBOT-ACE WORM!"
N	iRis Active Monitor	winmon32.exe	"Iris Antivirus - discontinued
N	iRiS AntiVirus Active Monitor	WIMMUN32.exe	"Iris Antivirus - discontinued
U	IRIS_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung CLX-3160 Series multifunction laser printer
U	IRIS_XRX_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Xerox Phaser 6110MFP multifunction laser printer
U	iRiver AutoDB	MLService.exe	"Associated with the iRiver Music Manager"
?	IRPMonitor	itcnmon.exe	"??"
X	irssyncd	irssyncd.exe	"SafeSurfing adware variant"
N	IS CfgWiz	cfgwiz.exe	Norton Internet Security configuration wizard
X	IsassRenascimento	Issas.exe	"Added by the BANKER.GAX TROJAN!"
X	iscch	iscch.exe	"Added by the LCPRANK-A WORM!"
N	isdbdc	isdbdc.exe	For Compaq PC's. May install properties in dial-up networking when you register with an ISP
U	ISDNwatch	IWatch.exe	"FRITZ!X ISDNWatch - ""dialing filter for more security and control on the ISDN PC. The PC is doubly protected against dialer programs and premium-service numbers: ISDNWatch allows the user to block calls to and from both individual numbers and whole number blocks"""
X	iSecurity applet	"rundll32.exe iSecurity.cpl	SecurityMonitor"
X	ISMPack5	ISMPack5.exe	"Internet Speed Monitor C adware related - see example here"
X	ISMPack6	ISMPack6.exe	"Internet Speed Monitor C adware related - see example here"
X	ISMPack7	ISMPack7.exe	"Internet Speed Monitor C adware"
X	ISMPack8	ISMPack8.exe	"Internet Speed Monitor C adware related - see example here"
Y	ISP.COM High Speed	slipgui.exe	"User interface for Slipstream - internet acceleration through compression/decompression techniques
X	ISPSERVICE	psycho.exe	"Added by the IRCFLOOD-O TROJAN!"
X	ISPSERVICE	wintmp.exe	"Added by the IRCBOT.GP BACKDOOR!"