NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

• "Y" - Normally leave to run at start-up
• "N" - Not required - typically infrequently used tasks that can be started manually if necessary
• "U" - User's choice - depends whether a user deems it necessary
• "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
• "?" - Unknown

	Startup Name	Process Name	Details
N	!NoLoad	winrecon.exe	"WinRecon keystroke logger/monitoring program - remove unless you installed it yourself!"
Consume	"Consumer Input Rewarded with MyPoints	U	"ConsumerInputRewardedwithMyPoints
Consume	"Consumer Input Rewarded with MyPoints	U	"ConsumerInputRewardedwithMyPoints
Version	"NVIDIA nView Control Panel	N	nwiz.exe
X	*MSConfig32	aecache.exe	"Detected by F-Secure as the OBFUSCATED.GP TROJAN!"
?	.NET config	sysmon32.exe	"??"
X	.TEXTCONV	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	.TEXTCONV	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
Y	36X Raid Configurer	JMRaidSetup.exe	"JMB36x series RAID configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers"
U	3Deep Control Panel	3DeepCTL.EXE	"3Deep® from E-Color corrects lighting
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
U	Access Connections	ACTray.exe	"System Tray access to the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
X	Access Control App	winsto.exe	"Added by the AGENT.DGO TROJAN!"
X	Access WebControl	[path to file]	"Added by the PPDOOR-M TROJAN!"
X	Aconti	aconti.exe	Adult content dialler
U	ACWLIcon	ACWLIcon.exe	"Part of the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
X	Admanager Controller	AdManCtl.exe	"Adware
X	Adobe	sysconfig.exe	Added by an unidentified WORM or TROJAN!
N	ADSL Diagnostic Tools	mapiicon.exe	System tray access to ADSL modem diagnostic tools. Available via Start -> Programs
N	AGEIA PhysX SysTray	TrayIcon.exe	"System Tray access to display properties for AGEIA PhysX graphics cards. Unless you change your desktop resolution
X	AHU	ANACON.EXE	"Added by the NACO.A WORM!"
N	America Online *.* Tray Icon	aoltray.exe	"Adds the AOL icon in the System Tray (*.* denotes version if present) for versions of AOL up to and including 9.0. Start AOL via the desktop or quick launch shortcuts or via Start → All Programs"
X	AntiSpyControl	pgs.exe	"AntiSpyControl rogue security software - not recommended
X	AntiSpywareControl	pgs.exe	"AntiSpywareControl rogue security software - not recommended
X	Aol Configuration Loader	aimsng.exe	"Added by the SDBOT-XE WORM!"
X	AolCon	config.com	"Added by the TAPLAK WORM!"
U	Appcon	vAppCon.exe	"Vital Application Console - part of POS-partner 2000 point-of-sale software from Vital. This is the taskbar icon and is enabled at startup by the "Auto-start when OS starts" option. Required for a connection to be established"
X	appconn	appconn.exe	"Added by the CARGAO WORM!"
X	ARCHIVE CONTROL	fixupdattr.exe	"Added by the MYTOB.GU WORM!"
N	ArcSoft Connect	ACDaemon.exe	"Used to serve notice of product information and updates when running ArcSoft products such as TotalMedia
N	ArcSoft Connection Service	ACDaemon.exe	"Used to serve notice of product information and updates when running ArcSoft products such as TotalMedia
U	Ashampoo HDD Control Guard	HDDControlGuard.exe	"Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access"
X	asnconsole	msasn.exe	"Added by the RBOT.EVU TROJAN!"
X	Ati Control Panel	atiphexx.EXE	"Added by the RBOT-BR WORM!"
Y	ATI Remote Control	ATIRW.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
Y	ATI Remote Control	ATIX10.exe	ATI Remote Wonder™ - PC wireless remote control driver. Required if you use it
X	ATI Video Driver Control	atigfx.exe	"Added by the RBOT-FWL WORM!"
X	ATI Video Driver Control	btorrent.exe	"Added by a variant of the IRCBOT TROJAN!"
X	ATI Video Driver Controls	[path to worm]	"Added by the SDBOT-DDS WORM!"
X	ATM Control	adpn.exe	"Added by the MMS.A WORM!"
X	AttuneContentUpdater	attune_cu.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	Auto File System Conversion Utility	scricon.exe	"Added by the SDBOT.EYB WORM!"
X	AVantivirus	Avconsol.exe	"Added by the MSNVB-D WORM!"
U	AvconsoleEXE	Avconsol.exe	From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Used to schedule regular scans. If you don't have scans scheduled you don't need it
X	avscan	Usbconeted.exe	"Added by the PROVIS-A TROJAN!"
U	AXIS Print System TrayIcon	TrayIcon.exe	"System Tray access to AXIS Print System from AXIS Communications - ""adds printer discovery
Y	BDMCon	Bdmcon.exe	"BitDefender antivirus"
U	BJPD HID Control	TVMon.exe	"Related to Canon Photo viewer"
X	Bluetooth Config	btwindin32.exe	"Added by the SDBOT-DFN WORM!"
U	Bluetooth Connection Assistant	LBTWiz.exe	"Bluetooth connection manager for Logitech based bluetooth wireless products"
U	Boingo Wireless Utility	Icon###XXX#X#.exe	"Starts the Boingo Wireless utility
X	Boot Config	bootconfig.exe	"Added by the FLOOD-EV TROJAN!"
U	C-Media Echo Control	EchoCtrl.exe	C-Media produce audio chipsets that are often found on popular motherboards with on-board audio. You may need it if you use the echo control feature of C-Media Mixer
U	CacheBoost	trayicon.exe	"CacheBoost ""optimizes the System Cache-Management of Windows XP/2000/NT and Windows .Net Servers
N	CallControl	ftctrl32.exe	"FaxTalk Messenger Pro is a Windows TAPI based 32-bit application. When installed
X	cartao	conflicted.exe	"Added by the DADOBRA-DV TROJAN!"
X	Catalyst Control Centre	atixvdm.exe	"Added by the RBOT.DMW TROJAN!"
U	CCUTRAYICON	CCU_TrayIcon.exe	"Related to Traybar Launcher from Intel Corporation belonging to Intel® Viiv®"
X	Cdrom Controller	cdromcntrl.exe	"Added by the BATTRY-A TROJAN!"
U	ChangeICON	SPMSMON.EXE	Card reader related program. Note - may cause problems with My Computer loading at startup. Disabling through MsConfig seems to solve the problem
X	Ciodiag	DECCONF.EXE	"Added by the STRAT.EL TROJAN!"
X	Cli Confg	cliconfig.exe	"Added by a variant of the SPYBOT WORM! See here"
X	CLICONFG	CLICONFG.EXE	"Added by the OPASERV.T WORM!"
X	Client Server Control Process	[path to trojan]	"Added by the AGENT-HR TROJAN!"
X	cmd32	configs.exe	"Hijacker
X	cmdcon	cmdcon.exe	"Added by the CRYPTER.A TROJAN!"
N	Colorific Control Panel	Hgcctl95.exe	"Colorific® from E-Color - ""delivers accurate gamma and color temperature across your entire system - monitor to printer and digital camera to monitor."" Now superseded by ColorWizzard™"
N	Compaq Connections	COMPAQ~1.EXE	"See here - ""messaging service that automatically sends you support information
N	Compaq Connections	BackWeb-1940576.exe	"See here - ""messaging service that automatically sends you support information
N	Compaq Connections	Compaq Connections.exe	"See here - ""messaging service that automatically sends you support information
X	Compaq32 Service Drivers	msconfig32.exe	"Added by the SDBOT-ADC WORM!"
X	con	[path to trojan]	"Added by the BRAVE-A TROJAN!"
?	Concurre	concurre.exe	"??"
X	ConducteurPrive	GDC.exe	"ConducteurPrive rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	Confg	bootconfig.exe	"Added by the VB-ERB WORM!"
X	ConfidentSurf	GDC.exe	"ConfidentSurf rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	ConfidentUser	SRP.exe	ConfidentUser rogue system error and cleaning utility - not recommended
X	Config	service.exe	"Added by the ISRAZ.B WORM!"
X	Config	WinService32.exe	"Added by the CRUTCHA-A TROJAN!"
X	Config	winconfig.exe	"Added by the GIP.113.B1 TROJAN!"
X	Config	CONFIG.EXE	"Added by the PSWGIP.B TROJAN!"
X	Config	TaskUpdate.exe	"Added by the MDROP-BRO TROJAN!"
X	Config Loadation	iEEexplore.exe	"Added by the SDBOT.H TROJAN!"
X	Config Loadatiorin	I3Explorer.exe	"Added by the SDBOT.H TROJAN!"
X	Config Loader	svchosl.exe	"Added by the GAOBOT.P WORM!"
X	Config Loader	sysldr32.exe	"Added by the GAOBOT WORM!"
X	Config Loader	scvhost.exe	"Added by the GAOBOT.AE or GAOBOT.AO WORMS!"
X	Config Loader	svhost.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Config Loader	svchost2.exe	"Added by the AGOBOT.XE WORM!"
X	Config Loader	[worm filename]	"Added by the AGOBOT-AE WORM!"
X	Config Loader	SYSMGR.EXE	"Added by the AGOBOT.C WORM!"
X	Config Loader	wincrt32.exe	"Added by the AGOBOT-AW WORM!"
X	Config Loader for Microsoft Windows	mwincfg32.exe	"Added by the AGOBOT.BD WORM!"
X	Config Loader2	explores.exe	"Added by the GAOBOT.BT WORM!"
X	Config Loadr	winsys32.exe	"Added by the AGOBOT-HN WORM!"
X	Config33.exe	Config33.exe	"Added by the SDBOT.T TROJAN!"
X	ConfiggLoader	cart322.exe	"Added by the GAOBOT.DJ WORM!"
U	ConfigSafe	CFGSAFE.EXE	"ConfigSafe - lets you identify changes to the registry
U	ConfigSafe	AUTOCHK.EXE	"ConfigSafe - lets you identify changes to the registry
N	ConfigServices	Config.exe	Part of initial setup on a Compaq PC
X	configsetup	configsetup32.exe	"Added by the AGOBOT-AFP WORM!"
X	Configuration	explorer32.exe	"Added by the SDBOT-ML WORM!"
X	configuration	apphost.exe	"Added by the SDBOT-VP WORM!"
X	Configuration	ntsys32.exe	"Added by the SDBOT-LN WORM!"
X	Configuration	msgfixs.exe	"Added by the SDBOT-NN WORM!"
X	Configuration Default	Wuxat.exe	"Added by the SPYBOT-CA WORM!"
X	Configuration Driver	scghost.exe	"Added by the SDBOT-DLA WORM!"
X	Configuration File	Winset32.exe	Added by the FLUX.101 TROJAN!
X	Configuration Loaded	wupdated.exe	"Added by the MOEGA or MOEGA.AG or MOEGA.AP WORMS!"
X	Configuration Loaded	lssas.exe	"Added by a variant of the SDBOT WORM!"
X	Configuration Loaded	iexploree.exe	"Added by the SDBOT-KC WORM!"
X	Configuration Loader	aim95.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	cmd32.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	syscfg32.exe	"Added by the SDBOT.B BACKDOOR!"
X	Configuration Loader	service5.exe	"Added by the GAOBOT.AF WORM!"
X	Configuration Loader	lfass.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	sycfg34.exe	"Added by the GAOBOT.AN WORM!"
X	Configuration Loader	wincrt32.exe	"Added by the GAOBOT.BF WORM!"
X	Configuration Loader	windex.exe	"Added by the GAOBOT.BZ WORM!"
X	Configuration Loader	dosrun32.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Service.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Servicess.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sw32.exe	"Added by the AGOBOT.BQ WORM!"
X	Configuration Loader	System.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Winreg.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sysinfo.exe	"Added by the GAOBOT.FQ WORM!"
X	Configuration Loader	microsoft.exe	"Added by the GAOBOT.JB WORM!"
X	Configuration Loader	confgldr.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	configuration loader	winicfg32.exe	"Added by the GAOBOT.RQ WORM!"
X	Configuration Loader	svhst.exe	"Added by the GAOBOT.YC WORM!"
X	Configuration Loader	msgfix.exe	"Added by the GAOBOT.AUS or SDBOT.J or SDBOT-QG WORMS!"
X	Configuration Loader	msnss.exe	"Added by the GAOBOT.AUS WORM!"
X	Configuration Loader	IEXPL0RE.EXE	"Added by the SDBOT BACKDOOR! Note the number ""0"" in the filename"
X	Configuration Loader	loadcfg32.exe	"Added by the SDBOT BACKDOOR! Note the number ""0"" in the filename"
X	Configuration Loader	MSTasks.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	systemry.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	ccSort.exe	"Added by the AGOBOT.SR WORM!"
X	Configuration Loader	smss32.exe	"Added by the AGOBOT.MB WORM!"
X	Configuration Loader	wincffg.exe	"Added by the AGOBOT.A3 WORM!"
X	Configuration Loader	seru32.exe	"Added by the SDBOT-VR WORM!"
X	Configuration Loader	botss.exe	"Added by the SDBOT-XS WORM!"
X	Configuration Loader	ldasp.exe	"Added by the AGOBOT.BH WORM!"
X	Configuration Loader	msgcfgsrv.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	smsai.exe	"Added by the SDBOT-YE WORM!"
X	Configuration Loader	svupdate.exe	"Added by the RANDEX.DXP WORM!"
X	Configuration Loader	crcss.exe	"Added by the AGOBOT.ADG WORM!"
X	Configuration Loader	lexplore.exe	"Added by the RBOT-AGX WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	Configuration Loader	scvhost.exe	"Added by the AGOBOT-AAE and SDBOT.AR WORMS!"
X	Configuration Loader	svchost.exe	"Added by the PARADROP-A WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Configuration Loader	svchost2.exe	"Added by the AGOBOT.JR WORM!"
X	Configuration Loader	dezi.exe	"Added by the SDBOT-OB WORM!"
X	Configuration Loader	mouse.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	msg.exe	"Added by the SDBOT.BT WORM!"
X	Configuration Loader	WinHelper.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	extrac.exe	"Added by the SDBOT-AFP WORM!"
X	Configuration Loader	DVD-Player.exe	"Added by a variant of the SDBOT WORM!"
X	Configuration Loader	IEXPLORE.EXE	"Added by the SDBOT-KW WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Configuration Loader	wincore.exe	"Added by the SDBOT.BHE WORM!"
X	Configuration Loader	configldr.exe	"Added by the AGOBOT-PP TROJAN!"
X	Configuration Loader	ahnhst.exe	"Added by the AGOBOT.MX WORM!"
X	Configuration Loader	ntdm.exe	"Added by the AGOBOT.RV WORM!"
X	Configuration Loader	msnmsgr.exe	"Added by the SDBOT-SO WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Configuration Loader	svschost.exe	"Added by the SDBOT-NS WORM!"
X	Configuration Loader	wump.exe	"Added by the AGOBOT-BU BACKDOOR!"
X	Configuration Loader	WinSys32ys.exe	"Added by the SDBOT.BCS WORM!"
X	Configuration Loader	cvcd.exe	"Added by the AGOBOT-DH BACKDOOR!"
X	Configuration Loader	asnclt32.exe	"Added by the AGOBOT-EB BACKDOOR!"
X	Configuration Loader	soundconf.exe	"Added by the AGOBOT-MH WORM!"
X	Configuration Loader	win32exec.exe	"Added by the SDBOT-LA WORM!"
X	Configuration Loader	mservs.exe	"Added by the SDBOT-NM WORM!"
X	Configuration Loader	update.exe	"Added by the SDBOT-OS WORM!"
X	Configuration Loader	FILENAME.EXE	"Added by the AGOBOT-DQ WORM!"
X	Configuration Loader	explore.exe	"Added by the GAOBOT.GW WORM!"
X	Configuration Loader	msgfixy.exe	"Added by the SLINBOT.QW BACKDOOR!"
X	Configuration Loader	winfix.exe	"Added by the SDBOT-MA WORM!"
X	Configuration Loader	scvh0st.exe	"Added by the AGOBOT-AX WORM!"
X	Configuration Loader	msrun.exe	"Added by the AGOBOT-Y WORM!"
X	Configuration Loader 2	confuldr.exe	"Added by the AGOBOT-FC WORM!"
X	Configuration Loader Service	Winsys32.exe	"Added by the RBOT-YV WORM!"
X	Configuration Loader Service	devl32.exe	"Added by the SDBOT-XY WORM!"
X	Configuration Loader10	ip7.exe	"Added by the AGOBOT-ANZ WORM!"
X	Configuration Loading	svchos1.exe	"Added by the GAOBOT.DK WORM!"
X	Configuration Loading	configldr.exe	"Added by the AGOBOT-EC WORM!"
X	Configuration Loading Service	wscel.exe	"Added by the SDBOT-WJ WORM!"
X	Configuration Loadr	iexplore.exee	Added by an unidentified WORM or TROJAN!
X	Configuration Manager	CNFGLD32.EXE	"Added by the SDBOT TROJAN!"
X	Configuration Manager	Cnfgldr.exe	"Added by the SDBOT TROJAN!"
X	Configuration Manager	cfg32.exe	"BookedSpace parasite. Note - the ""cfg32.exe"" file is located in %Windir%"
X	Configuration Servecie	sewins.exe	"Added by the SDBOT-COH WORM!"
X	Configuration Service	suchost.exe	"Added by the TREB TROJAN!"
X	Configuration Services	mswords.exe	"Added by the SDBOT-YM WORM!"
X	Configuration Update	UPDT32V2.EXE	"Added by the SPYBOT-AA BACKDOOR!"
N	Configuration Utility	CONFIG.EXE	Controls linksys wireless connection. Available from the Desktop
U	Configuration Utility	wlanutil.exe	"NetGear Wireless LAN configuration utility for the MA311 802.11b (and maybe other cards)"
X	Configuration Wizard	Cfgwiz32.exe	"Added by a variant of the HACKTACK TROJAN! Not to be confused with the legitimate MS ""ISDN Configuration Wizard"" (Cfgwiz32.exe)"
X	Configuration32 Loader32	winamp32.exe	"Added by the SDBOT-BIC WORM!"
X	Configurations Asclt	asclt.exe	"Added by the SDBOT-MX WORM!"
X	CONFIGUREv	antivir62.exe	"Added by the AGOBOT-ZD BACKDOOR!"
U	ConfigUtility	ConfigUtility.exe	"Wireless management utility for the HWC54G Hi-Speed Wireless-G CardBus Card from Hawking Technologies
X	ConfigVir	services.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
X	ConfLoader	sysconf16.exe	"Added by the SDBOT-FB TROJAN!"
X	conime.exe	conime.exe	"Added by the AVENDOG WORM! Note - this is not the legitimate Console IME process of the same filename which is located in %System%"
N	Conmgr	conmgr.exe	Starts Winfax pro at startup
U	ConMgr.exe	conmgr.exe	Connection Manager as used by Earthlink and others. If you need this to ensure a proper connection but don't want to connect at startup try creating your own shortcut
X	conmswf	conrnbne.exe	"Added by the SDBOT-DEX WORM!"
U	Connect Kasamba	Kasamba.exe	"""Finding the expert help that you need is easy on Kasamba. With more than 30
X	Connect2Party	connect2party.exe	Adult content dialler
N	CONNECTAuto Update	CONNECTScheduler.exe	"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
N	CONNECTAUTrayApp	CONNECTAUTrayApp.exe	"System Tray access to change update settings for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
U	Connection Keeper	ConKeepM.exe	"""Connection Keeper is an invaluable time-saving tool for dial-up users. This free program simulates Internet browsing (at a random interval) to prevent your connection from appearing idle
N	Connection Manager	CManager.exe	SBC Yahoo DSL service connection manager. You can connect from the network connections. Users having problems with this have been advised to uninstall the connection manager via Add/Remove Programs and it won't affect the service
X	Connectivity Tool	[path to trojan]	"Added by the LITEBOT-E TROJAN!"
X	Connector	SYS.EXE	"Nunci premium rate dialer"
X	Connector	sms.EXE	"Added by the ExDial-B premium rate adult content dialer"
N	CONNECTScheduler	CONNECTScheduler.exe	"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
X	Cons	consol32.exe	"Hijacker - redirects to an adult content portal
X	conscorr	conscorr.exe	"VX2.Transponder parasite updater/installer related"
X	Console de Gerenciamento Microsoft	csrss.exe	"Unidentified malware! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Level4"" subfolder"
X	Console de Gerenciamento Microsoft	csrss.exe	"Added by the BANCBAN-ET TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Central de Segurança"" subfolder"
U	Consumer Input	ConsumerInput.exe	"Consumer Input Toolbar. Opt-in market research monitoring you browsing habits - see the FAQ"
?	Contacte	contacte.exe	"Some kind of driver?"
X	Content connector	[random filename].exe	"Added by the DIALER-Y TROJAN! Note - uses a random filename and random folders. Usually the folder containing the file is a Temp folder"
X	Content List Management Subsystem	clmss.exe	"Added by the SPYBOT-EL WORM!"
X	Content Service	winserv[LETTER].exe	"PurityScan adware"
X	ContentDownload	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	ContentEraser	GDC.exe	"ContentEraser rogue privacy tool - not recommended
X	ContentService	winservn.exe	"PurityScan adware - see here"
U	ContentTransferWMDetector.exe	ContentTransferWMDetector.exe	"Part of Sony's Content Transfer Software which ""provides an easy way to transfer music
X	ContinueInstall	bpsinstall.exe	"BrowserAid/BrowserPal foistware"
X	Contraviro	Contraviro.exe	"Contraviro rogue security software - not recommended
X	ContraVirus	ContraVirusPro.exe	"ContraVirus rogue security software - not recommended
X	ContraVirus	ContraVirus.exe	"ContraVirus rogue security software - not recommended
X	Control	"rundll32.exe ctrlpan.dll	Restore ControlPanel"
U	Control Center	Center.exe	"Associated with Hawking Technologies
X	Control handler	***********.exe [* = random char]	"CoolWebSearch parasite variant"
X	Control handler	ahjinst.exe	"CoolWebSearch parasite variant"
X	Control handler	[10 to 14 random char]THD.EXE	"Added by the KREPPER-AI TROJAN!"
N	control panel	smctrlw.exe	System Tray icon for a Silicon Motion LynxEM based PCI Graphics Card
X	Control Panel	System.exe	"Added by the DANI TROJAN!"
X	control panel software service	cprs.exe	"Added by the RBOT-FPI WORM!"
X	Controladores	[path to trojan]	"Added by the TELEFO-A TROJAN!"
Y	ControlCenter	ctlcntr.exe	"Part of Lenovo's (IBM) ThinkVantage Fingerprint Software - used on laptops and keyboards with integrated fingerprint readers"
N	ControlCenter2.0	brctrcen.exe	Brother scanner 'Control Center' application - can be started manually
N	ControlCentreTray	XWCTray.exe	"System Tray access for the Xerox ControlCentre 2.0 software for their range of printers
X	Controlled Resource System Service	crss.exe	"Added by the AGOBOT.GH WORM!"
N	Controller	WFXCTL32.EXE	From Symantec's TalkWorks Pro and WinFax. Appears if you chose to have the program appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs
X	ControlPanel	"rundll32 internat.dll	LoadKeyboardProfile"
X	ControlPanel	"host32.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"cmd32.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"systemctrl.exe internet.dll	LoadNetworkProfile"
X	ControlPanel	"[path to executable] internat.dll	LoadKeyboardProfile"
X	ControlPanel	"popcorn.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"popcorn64.exe rundll.dll	LoadMouseProfile"
X	ControlPanel	"popcorn72.exe rundll.dll	LoadMouseProfile"
X	ControlPanel	"svcc.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"popcorn320.exe rundll.dll	LoadMouseProfile"
X	ControlPanel	"private.exe internat.dll	LoadMouseCarpetProfile"
X	ControlPanel	"twink64.exe internat.dll	LoadKeyboardProfile"
X	ControlServiceMgr	csmsv.exe	"Added by the AGENT-XC TROJAN!"
N	Corel Colleagues & Contacts Reminders	cffrem.exe	"Corel Colleagues & Contracts - all-in-one organizer for scheduling meetings
N	CorrectConnect	CConnect.exe	Broadband ISP diagnostic tool - as used by NTL and Cox Communications. Shortcut available
X	CPU Temp Control	wuitgurd.exe	"Added by the RBOT-AHV WORM!"
N	Creative PCI Audio Configuration Utility	starter.exe	"System Tray icon to configure a Creative Soundblaster PCI soundcard. Not required and re-instates itself when un-checked. Try one of the solutions on this special page. Similar to EnsoniqMixer"
?	Crystal 3D Audio Control	CWD3DSND.EXE	"Crystal 3D Audio sound driver. Is it required?"
X	CT Control Settings	CTSVCCD.EXE	"Added by the RBOT-YS WORM!"
X	ctfmon	WinConst.exe	"Added by the ASSASIN-G TROJAN!"
X	ctfmoon	microsoftconfigurator.exe	"Added by the DELF-ALS TROJAN!"
X	Current Security Config	csecure.exe	"Added by the RBOT-AMO WORM!"
X	Cvfjx	ANACON.EXE	"Added by the NACO.A WORM!"
N	DACONFIGEXE	daconfig.exe	3Com NIC Diagnostics. Available via Start -> Programs
X	DefaultConfiguration	defaultconfh.exe	"Added by the AGOBOT-JC WORM!"
X	Desktop	"rundll32.exe msconfd.dll	Restore ControlPanel"
U	DesktopIconToy	DesktopIconToy.exe	"""Desktop Icon Toy is an easy to use desktop icon enhancement tool
?	DevconDefaultDB	READREG	"Appears to be related to older Creative Soundblaster soundcards"
X	Device Configuration Loader	msdvc32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
U	Dialer Control	dc.exe	"Dialer-Control. Detects and protects from premium rate adult content diallers"
U	Direct Update	DUControl.exe	"DirectUpdate dynamic DNS updater"
X	Disk Panel Configuration	dpcsvc.exe	"Added by the IRCBOT.BSQ BACKDOOR!"
N	DiskeeperSystray	DkIcon.exe	"DisKeeper defragmentation software - can be started manually"
N	DisplayTrayIcon	TrayIcon.exe	"System Tray access to display properties for ABIT graphics cards. Unless you change your desktop resolution
X	DNS Config service	win32.exe	"Added by the RBOT-TL WORM!"
N	DPConfig	DPConfig.exe	"Compuware DevPartner Studio Configuration Utility
U	DriveIcons	DriveIcon.exe	"Drive Icons from Realtek - shows a specific icon for each card type for their card reader controllers"
X	DriverConf	dvrconf.exe	"Added by the AGOBOT-IY WORM!"
U	DrvIcon	DrvIcon.exe	"""Vista Drive Icon changes the drive icons shown in Windows ""My Computer""
U	E-color	IconMgr.Exe	Sets the colour of your monitor when running games that recognise E-Color so that you get 'what the game designer intended' when you see the game. Also allows monitor callibration through a program called 3-Deep. If you play a lot of games it can be useful. Can be disabled from starting up from within the program
U	eabconfg.cpl	EabServr.exe	Easy Access Buttons control panel on Compaq laptops. Only required if you use the extra keys
Y	Earthlink Protection Control Center	elnk_pcc.exe	"EarthLink Protection Control Center - ""powerful
U	Eicon NetworksLAN_DAEMON	watch.exe	"Associated with an Eicon Networks ISDN or ADSL modem. Watch protocols your connection with numbers and duration. You need callvu.exe (from Start Menu) to see your connection statistics. You can manually start watch.exe before you go online. Needs diinfo.exe (started by DiTask) to work correctly which can be started manually"
U	Eicon TechnologyLAN_DAEMON	watch.exe	"Associated with an Eicon Networks ISDN or ADSL modem. Watch protocols your connection with numbers and duration. You need callvu.exe (from Start Menu) to see your connection statistics. You can manually start watch.exe before you go online. Needs diinfo.exe (started by DiTask) to work correctly which can be started manually"
U	Enterra Icon Keeper	IcnKeepr.exe	"Icon Keeper - ""tool to save and restore icon positions on the desktop"""
N	Event Planner Reminders Tray Icon	PLNRnote.exe	Part of Sierra/Hallmark Card Studio - System Tray notification of events such as birthdays and anniversaries that you've scheduled with the customizable Event Planner
X	Explorer	config_.com	"Added by the FLOPPY-D WORM!"
X	Explorer5	config_.com	"Added by the VB.CBG WORM!"
X	ExplorerRun	conime.exe	"Added by the DLDR-G TROJAN! Note - this is not the legitimate Console IME process of the same filename which is located in %System%. This one is located in %Temp%"
N	FaxTalk CallControl 6.0	FTClCtrl.EXE	This allows the software to handle incoming and outgoing communications without requiring the FaxTalk Communicator application to be loaded into memory. Can be started manually
X	file laoder configuration	rnd32.exe	"Added by the RBOT.BQJ WORM!"
?	FireBox Control Panel	FireBox.exe	"Control panel for the Presonus FireBox firewire based music recording system. Is it required?"
X	Firewall config	ReadMe.exe	"Added by the SILLYFDC.BBT WORM!"
X	Firewall Controls	sys32.exe	"Added by the SDBOT-DGI WORM!"
X	Firewall Sp2 system	sys32Conf.exe	"Added by the RBOT-ABT WORM!"
U	Fortis Secure Layer Config	cseinst.exe	Fortis Bank Home Banking part. Installed during the installation of the software necessary to run the Home Banking. According to Fortis Bank this will not in any way be harmful to the system or relay system information
N	Gearbox	confsvr.exe	"NTL's Gearbox software for configuring internet connections with their NTLWorld software - does a similar job to the Internet Connection Wizard which can be used instead using the dial-up details available here"
U	GetRight - Tray Icon	getright.exe	"Entry added with older versions of the GetRight download manager from Headlight Software
U	GoBack Tray Icon	GBTray.exe	"Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
U	GroupWise PDA Connect - 3CmPlm	AutoDet.exe	"3Com Palm PC specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
U	GroupWise PDA Connect - GrpWse	Agnt.exe	"GroupWise PDA Connect PDA synchronisation utility - from Novell"
U	GroupWise PDA Connect - PocketPC	AUTODE~1.EXE	"Windows Mobile Pocket PC specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
U	GroupWise PDA Connect - ScheduleSync	SCHEDU~1.EXE	"ScheduleSync specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
N	GrpConv	grpconv.exe	"Microsoft Windows Program Group Converter - used by installers (ONLY in the RunOnce keys) - provides the translation of groups and group items to folders and links. Also see this MS Knowledge Base article"
N	Gsiconexe	Gsicon.exe	"ADSL modem monitor from Eicon Networks (as used by BT for its Broadband internet service for example). Can safely be disabled without affecting the connection - all this does is give an indication of connectivity and access to the diagnostic facilities"
Y	gw port controller	PORTCT95.EXE	"From a visitor - "I must keep it active in start up or my Lexmark printer and RCA Cam program cannot discover a working port to work". From the file properties
U	H/PC Connection Agent	WCESCOMM.EXE	"Connection manager for Microsoft ActiveSync - mobile device synchronization software for Windows XP (and earlier)
X	Hard drive Controller	hdcontroller.exe	"Added by the KIMAN.B WORM!"
U	HawkEye IV Control Panel	HAWK_32.EXE	"Control Panel application for the old Number Nine graphics cards to change resolution
U	Hcontrol	hcontrol.exe	Hotkeys on an ASUS Notebook. Only required if you use the additional keys
U	HControlUser	HControlUser.exe	Hotkeys on an ASUS Notebook. Only required if you use the additional keys
N	HD Audio Control Panel	RtHDVCpl.exe	"Realtek HD Audio Manager
U	HDDControlGuard	HDDControlGuard.exe	"Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access"
U	HDDControlGuard.exe	HDDControlGuard.exe	"Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access"
Y	HPLJ Config	SetConfig.exe	Connects system to networked HP printer.
X	hpsysconf1	[random filename]	"Added by a variant of the VIVIA.A TROJAN!"
?	HsuGuiControl	HsuGuiControl.exe	"Part of the Starband Internet satellite client. What does it do and is it required?"
X	Hvewsveqmg	ANACON.EXE	"Added by the NACO.A WORM!"
X	I/O Controllers	svcnet.exe	"Added by the TIBIK-B TROJAN!"
X	ICcontrol	iccontrol.exe	"ICcontrol premium rate adult content dialer"
N	Icon Animation	HDE.EXE	Part of McAfee Nuts & Bolts. Provides entertaining animation of your desktop icons
N	Icon Hearit 95	hearit95.exe	Audio desktop customization utility from Moon Valley Software. Resource hog
N	Icon Hearit 98	hearit98.exe	Audio desktop customization utility from Moon Valley Software. Resource hog
X	Icon lptt01	icon.exe	"RapidBlaster variant (in a ""Icon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Icon ml097e	icon.exe	"RapidBlaster variant (in a ""Icon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
Y	iconcache	icon.bat	"Related to the Vista Customization Pack"
Y	ICONCLNT	iconclnt.exe	"APC PowerChute® Personal Edition tray icon"
U	ICONDESK	ICONDESK.EXE	Small utility which will allow you the option of hiding or showing your desktop icons
N	Iconfig.exe	Iconfig.exe	Icon for LS-120 "Superdisk"
X	iConfigLoader	DIIhost.exe	"Added by the GAOBOT.AO WORM!"
N	Iconoid	Iconoid.exe	"Iconoid is a desktop icon manager"
N	Iconsaver	Iconsaver.exe	"IconSaver is a desktop icon manager"
X	icrosof Avps32 Control	av32.pif	"Added by the RBOT-AVC WORM!"
X	icrosoft Windows DLL Services Configuration	poker3.exe	"Added by the SDBOT-AER WORM!"
X	icrosoftf Avpx Control	avpx.exe	"Added by the RBOT-AYN WORM!"
X	IE configure	explorer.exe	"Added by the LINEAGE-C TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually!"
X	IME	conime.exe	"Added by the DLDR-G TROJAN! Note - this is not the legitimate Console IME process of the same filename which is located in %System%. This one is located in %Windir%"
U	ImgIcon	ImgIcon.exe	"Displays Iomega icons in Explorer/My Computer
N	InControl Desktop Manager	DMHKEY.EXE	For Diamond Multimedia video cards. Allows System Tray access to desktop utilities such as screen resolution. Available via Start -> Programs
?	InetConf	inetconf.exe	"??"
U	Instant Wireless Configuration Utility	WUSB11cfg.exe	"Utility used by the LINKSYS LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
U	Instant Wireless Configuration Utility	WPC11Cfg.exe	"Utility used by the LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
N	Intel PROSet Tray Icon	promon.exe	System Tray icon for Intel PRO series ethernet adapters giving access to the diagnostic features
X	Intel Service Drivers	msconfig16.exe	"Added by the MSCONFIG16 TROJAN!"
U	IntelZeroConfig	ZCfgSvc.exe	"Zero Config MFC Application
X	Internat Conf	bootconf.exe	"Homepage hijacker
X	Internet Config	svchosts.exe	"Added by the SDBOT TROJAN!"
X	Internet Connection Wizard	stisvsq.exe	"EasySearch adware"
X	Internet Connection Wizard	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Internet Connection Wizard	stisvsq1.exe	"Added by the DLOADR-AWD TROJAN!"
X	Internet Content Publisher	ICP.EXE	"Added by the RBOT-UD WORM!"
X	Internet Explorer Configuration	IEXPLORE.EXE	"Added by the SDBOT-UL WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Internet Protocol Configuration Loader	ipcl32.exe	"Added by the SDBOT TROJAN!"
X	InternetGetConnectedState	winupdate.exe	"Added by the SDBOT-JN WORM!"
X	InternetGetConnectedStateEx	winupdate.exe	"Added by the SDBOT-JN WORM!"
X	Inters Configuration Loader	RCL0ADERS.exe	"Added by the SDBOT-KX WORM!"
U	Iomega Disk Icons	IMGICON.EXE	"Displays Iomega icons in Explorer/My Computer
U	Iomega Drive Icons	IMGICON.EXE	"Displays Iomega icons in Explorer/My Computer
U	Iomega ImIconXP	imiconxp.exe	"Iomega REV System Software - allows your Iomega REV drive to interact with the operating system via the Iomega REV UDF file system
X	IPC Connection	ipcconn.exe	"Added by the RBOT-AEG WORM!"
X	IPConfig	svcxnv32.exe	"Added by the HACARMY.E TROJAN!"
X	IPConfig	svcxnw32.exe	"Added by a variant of the HACARMY.E TROJAN!"
X	IPConfig	ipconfigs.exe	"Added by the HACARMY.C BACKDOOR!"
X	IpCtrl	ipcon32.exe	"Added by an unidentified VIRUS
X	IPSEC Configuration	wsupdate.exe	"Added by the AGOBOT-IQ WORM!"
X	IPTable Configuration	Winipcfgs.exe	"Added by a variant of the RBOT WORM!"
N	IW ControlCenter	iwctrl.exe	"Pinnacle Systems InstantWrite enables you to use your CD-R
U	IW_Drop_Icon	iwctrl.exe	"Pinnacle Systems InstantWrite enables you to use your CD-R
X	JA Config 32	Awesome32.exe	"Added by a variant of the SDBOT WORM!"
X	Java32 Configuration Loader	msnmesgr.exe	"Added by a variant of the RBOT WORM!"
U	JMB36X Configure	JMRaidTool.exe	"JMB36x series RAID configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers"
Y	JMB36X Configure	JMRaidSetup.exe	"JMB36x series RAID configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers"
U	JOYTECH USB Neo S Controller	JoytechNeoSTrayIcon.exe	"System Tray access to Joytech Neo S PC gamepad controller software"
X	KernelConfig	destiny32.exe	"Added by the AGOBOT.AMB WORM!"
?	KYE_Showicon	shwicon.exe	"Card reader for memory cards from digital cameras. Is it required? "
X	KYK Control Settings	KYSVCXD.EXE	"Added by a variant of the RBOT WORM!"
X	KYM Control Settings	phqghum.exe	"Added by the RBOT.BQD WORM!"
N	Launch Context 5.0	Launch.exe	"Context - electronic dictionary"
?	LCIDConfig	lcidchng.exe	"??"
N	Lightscribe	LightScribeControlPanel.exe	"System Tray access to the LightScribe Control Panel for CD/DVD writers based upon HP's LightScribe laser-etching process - which allows you to burn a label straight onto specially coated blank disks. Part of the main LightScribe System Software (LSS)"
N	LightScribe Control Panel	LightScribeControlPanel.exe	"System Tray access to the LightScribe Control Panel for CD/DVD writers based upon HP's LightScribe laser-etching process - which allows you to burn a label straight onto specially coated blank disks. Part of the main LightScribe System Software (LSS)"
N	LightScribeControlPanel	LightScribeControlPanel.exe	"System Tray access to the LightScribe Control Panel for CD/DVD writers based upon HP's LightScribe laser-etching process - which allows you to burn a label straight onto specially coated blank disks. Part of the main LightScribe System Software (LSS)"
N	LIU	Rubicon.exe	"Logitech Internet Update. Used to update drivers/software for Logitech's Wingman
X	Local Internet Connection	LIC.exe	"Added by the SDBOT-YA WORM!"
X	Logitech Desktop	IPCONN.EXE	"Added by the SDBOT-WE WORM!"
X	Logitech Desktop Controller	wrcam.exe	"Added by a variant of the RBOT WORM!"
N	Logitech Desktop Messenger	ldmconf.exe	"Installed with older versions of the software for Logitech products. Configures the options for Logitech Desktop Messenger to activate notifications about software upgrades and/or new products
N	Logitech Desktop Messenger Agent	ldmconf.exe	"Installed with older versions of the software for Logitech products. Configures the options for Logitech Desktop Messenger to activate notifications about software upgrades and/or new products
N	M-Audio Delta Taskbar Icon	DeltTray.exe	M-Audio Delta Control Panel for M-Audio brand Delta series audio cards. System Tray access to audio settings - available through Control Panel
U	M-Audio MobilePre Control Panel Launcher	MPTask.exe	"Control Panel Launcher for MobilePre USB bus-powered preamp and audio interface from M-Audio"
U	M-Audio Taskbar Icon	DeltaIITray.exe	"System Tray access to the Delta Control Panel for the M-Audio Delta series of PCI audio cards"
X	M1cr0s0ft S3rcurity	systemconfig.exe	"Added by the RBOT.BKB WORM!"
N	Matrox Color Control	hgcctl95.exe	For Matrox video cards. Quick access to changing colors
N	Matrox Control Center	mgactrl.exe	For Matrox video cards. Quick access to settings
X	MC	MAGICON.EXE	"Added by the MAGICON.A TROJAN!"
U	MCI USB Icon	USBIcon.exe	MCI USB software used for managing a USB card reader
U	Mediafour XPlay Tray Notification Icon	Xptryicn.exe	"Mediafour Xplay - allows you to use an Apple iPod digital music player with a PC running Windows. If not used regularily start manually before connecting the iPod"
U	Mediafour XPlay Tray Notification Icon	Xptryicn.exe	"Xplay 2 from Mediafour Corporation - ""expands what you can do with any iPod
X	Meeting Connection	comsutil.exe	"Added by the PPDOOR-E TROJAN!"
X	Meeting Connection	wowdache.exe	"Added by the PPDOOR-D TROJAN!"
X	Meeting Connection	hgakdl32.exe	"Looks like a variant of the PPDOOR-E TROJAN!"
X	MemConfig	SetupIE.com	"Added by the TAPLAK WORM!"
X	Messenger Sharing Control	mnwsvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Micro Process	appconf.exe	Added by an unidentified WORM or TROJAN!
X	MicroMix32	WinCon.exe	"Added by the VB-ECC TROJAN!"
X	Microsft Conf 32	msaconf.exe	"Added by the RBOT.EYA WORM!"
X	Microsft Confige 32	msaconfigurez.exe	"Added by the RBOT.CLC WORM!"
X	Microsoft (R) Windows Configuration Backup Service	svchost.exe	"Added by the RANKY.X TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in either a ""config""
X	Microsoft (R) Windows Network Latency Controller	1.tmp	"Added by a generic password stealer TROJAN - see here"
X	Microsoft (R) Windows Network Latency Controller	nlc.exe	"Added by a generic password stealer TROJAN - see here"
X	Microsoft (R) Windows Network Latency Controller	sp2vc.exe	"Added by a generic password stealer TROJAN - see here"
X	Microsoft (R) Windows Protected Content Restoration Service	services.exe	"Added by the AGENT.AGV BACKDOOR! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\etc"
X	Microsoft .NET Confingurator	msnconf.exe	"Added by an unidentified VIRUS
X	Microsoft Anti Virus Controller	msavc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Anti Virus Controller	msavc32.exe	"Added by the SDBOT.EPW BACKDOOR!"
X	Microsoft Conf Ldr	sysconf.exe	"Added by a variant of the SDBOT TROJAN!"
X	Microsoft ConfgKeys	wurmgrd32.exe	"Added by the RBOT-ARX WORM!"
X	Microsoft Config	msconf.exe	"Added by the RBOT.PV WORM!"
X	Microsoft Config	MSCONF.EXE	"Added by the RBOT-LG WORM!"
X	Microsoft Config 32	msconfigx32.exe	Reported as the MSCONFIGX32 TROJAN! Possible Rbot variant
X	Microsoft Config 32bit	mscnfg32.exe	"Added by the RBOT-Z WORM!"
X	Microsoft Config File	config.exe	Added by the KILLFILES.GR TROJAN! This is malware that will attempt to delete all system dlls!
X	Microsoft Config Loader	msconfig32.exe	"Added by the AGOBOT.XX WORM!"
X	Microsoft Config Loader	msrun32.exe	"Added by the AGOBOT-DY WORM!"
X	Microsoft Config Loader	msconf32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Configoration Service	msconfigs.exe	"Added by the RBOT-ETT WORM!"
X	Microsoft Configs 32	msgconfigrs.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Configuewe	msconfiguwe.exe	"Added by the SDBOT-BPK WORM!"
X	Microsoft Configuration	msconfig32.exe	"Added by the SDBOT.MQ WORM!"
X	Microsoft Configuration 35	microsot1.exe	"Added by an unidentified TROJAN!"
X	Microsoft Configuration Wizard	taskmrg.exe	"Added by the SDBOT-MX TROJAN!"
X	Microsoft Configure 32	msgconfigre.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Connection Manager Monitor	cmmon.pif	"Added by the RBOT-AKV WORM!"
X	Microsoft Control Center	crtl.exe	"Added by the RBOT-VX WORM!"
X	Microsoft DDE Control	wupades.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft DDEs Control	Erun.pif	"Added by the RBOT-AMU WORM!"
X	Microsoft Debug Manager Console	mdm32.exe	"Added by the AGOBOT-AQ WORM!"
X	Microsoft DLL Verifier	mscon.exe	"Added by the SDBOT.EAH WORM!"
X	Microsoft Domain Controller	mstc.exe	"Added by the NUGACHE.A WORM!"
X	Microsoft Driver Control	windrv.exe	"Added by the SDBOT.FW WORM!"
X	Microsoft Drivers	WSconf.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Java Virtual Machine	MsConfiG.exe	"Added by the FORBOT-DV WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting"
X	Microsoft Management Console	lssas.exe	"EasySearch adware"
X	Microsoft Management Console	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Microsoft Management Console	lssas1.exe	"Added by the DLOADR-AWD TROJAN!"
X	Microsoft Messenger Management Controls	msmgmctl.exe	"Added by the RBOT-APA WORM!"
X	Microsoft Network Services Controller	mmsvc32.exe	"Added by the NANPY-A WORM!"
X	Microsoft Office	msoicons.exe	"Added by the RBOT-ZI WORM! - NOTE - do no confuse with the legitimate Msoicons.exe file described here. The latter wil not be listed among your startups!"
X	Microsoft PC Health Remote Assistance File Open & Save controls	sfrcdlg32.exe	"Added by the RBOT-AVY WORM!"
X	Microsoft RDLL	sysconf32.exe	"Added by a variant of the SDBOT TROJAN!"
X	Microsoft sddcE Contol	taskmnegr.exe	"Added by the RBOT-AUM WORM!"
X	Microsoft sddcE Contol	taskmn.exe	"Added by the RBOT-BJZ WORM!"
X	Microsoft Security Controlers	fxsecues.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Service Controller	services.exe	"Added by the KALEL-D WORM! Note - this is not the legitimate services.exe process
N	Microsoft Sidewinder Game Controller Software	SWTRAY.EXE	MS SideWinder game controller system tray icon. Available via Start -> Programs
N	Microsoft System Configuration Utility	msconfig.exe	Entry that appears when you uncheck an item in the MSConfig Startup group and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode. Located in %System% (98/Me/Vista) or %Windir%\PCHealth\HelpCtr\Binaries (XP)
X	Microsoft System DLL Services Configuration	windir32.exe	"Added by the SDBOT-ACY TROJAN!"
X	Microsoft System Restore Configuration	CBRSS.EXE	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Task Messenger Config	taskmgsr.exe	"Added by the SDBOT-JK WORM!"
X	Microsoft TCP/IP Connection Monitor	svchost32.exe	"Added by the RBOT.KS WORM!"
X	Microsoft Update	msconfg.exe	"Added by the RBOT.H WORM!"
X	Microsoft Update Clinic	svsipconfig.exe	"Added by the RBOT.BR WORM!"
X	MICROSOFT UPDATE CONFIGURATION	WIN32SNC.EXE	"Added by the RBOT-AI WORM!"
X	Microsoft Update Control	Ms64.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	MSOICONS.EXE	"Added by the RBOT.AWS WORM! Note - do no confuse with the legitimate Msoicons.exe file described here. The latter should not normally figure in Msconfig/Startup!"
X	Microsoft Updater	msconsole.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Updaters	sysconfigs.exe	"Added by the RBOT-DF TROJAN!"
X	Microsoft Video Capture Controls	MSsrvs32.exe	"Added by the SDBOT-AAK WORM!"
X	Microsoft Video Controls	tskmsgr.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Windows Config 32	win32conf.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Control	mswctl32.exe	"Added by the RBOT.JP WORM!"
X	Microsoft Windows DLL Services Configuration	newdll.exe	"Added by the SDBOT-ZR WORM!"
X	Microsoft Windows DLL Services Configuration	newdll2.exe	"Added by the SDBOT-ABD WORM!"
X	Microsoft Windows DLL Services Configuration	poker.exe	"Added by the SDBOT-ZY WORM!"
X	Microsoft Windows DLL Services Configuration	poker3.exe	"Added by the SDBOT-AAH WORM!"
X	Microsoft Windows DLL Services Configuration	proxy.exe	"Added by the SDBOT-ZL WORM!"
X	Microsoft Windows DLL Services Configuration	windir32.exe	"Added by the SDBOT.BHF WORM!"
X	Microsoft Windows DLL Services Configuration	windir32a.exe	"Added by a variant of the SDBOT.BHF WORM!"
X	Microsoft Windows DLL Services Configuration	windll32.exe	"Added by the SDBOT.BHD WORM!"
X	Microsoft Windows DLL Services Configuration	winDSL.exe	"Added by the SDBOT-ZG WORM!"
X	Microsoft Windows DLL Services Configuration	dllmanager32.exe	"Added by the SDBOT-BTU WORM!"
U	Microsoft Windows Media Player Network Sharing Service Configuration Application	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	Microsoft Windows XP Configuration Loader	m32svco.exe	"Added by the SDBOT.WORM!.48548 WORM!"
X	Microsoftf DDEs ContDLL	rune.pif	"Added by the RBOT-AGF WORM!"
X	Microsoftf DDEs ContrDL	runm.pif	"Added by the RBOT-AFQ WORM!"
X	Microsoftf DDEs Control	lxes.exe	"Added by the RBOT.BOF WORM!"
X	Microsoftf DDEs Control	wees.exe	"Added by a variant of the RBOT WORM!"
X	Microsoftf DDEs Control	soff.pif	"Added by the RBOT-AKH WORM!"
X	Microsoftf DDEs Control	why-.exe	"Added by the RBOT-AMV WORM!"
X	Microsoftf DDEs Control	msnn.exe	"Added by the RBOT-AXT WORM!"
X	Microsoftf DDEs Control	FEnR.exe	"Added by the RBOT-AIM WORM!"
X	Microsoftf DDEs Control	w33s.exe	"Added by a variant of the RBOT WORM!"
X	Microsoftf DDEs Control	waes.exe	"Added by a variant of the RBOT WORM!"
X	Microsoftz turn Control	aexl.exe	"Added by the SDBOT.BCO WORM!"
X	Microsoftz turn Control	read.pif	"Added by the RBOT-AFS WORM!"
N	MightyFAX Controller	MFNTCTL.EXE	"Mighty FAX from RKS Software - "installs a printer driver so that you can fax directly from Windows software""
X	Mircrosoft Windows Config DLL	rundllc32b.exe	"Added by the RBOT-ZY WORM!"
N	Mobile Connectivity Suite	Application Launcher.exe	"System Tray access to the HTC Sync mobile phone management utility for models including the Hero
X	ModularConfig	syscnfg.exe	"Added by an unidentified VIRUS
X	MonContenuassistant	GDC.exe	"MonContenuassistant French rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	MoreContent	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Motherboard Config	Ati2xxx.exe	"Added by the RBOT-AIK WORM!"
U	Motorola Desktop Suite mRouter Config	mRouterConfig.exe	"Configuration for Motorola's version of Intuwave's m-Router - ""that enables easy connectivity between mobile devices and PCs across Bluetooth
U	mRouterConfig	mRouterConfig.exe	"Configuration for Intuwave's m-Router - ""that enables easy connectivity between mobile devices and PCs across Bluetooth
X	MS Config	msdconfig.exe	"Added by the RBOT-CZH WORM!"
X	MS Config Loader	svchos1.exe	"Added by the AGOBOT.R WORM!"
X	MS Config Loader	MSWin32bck.exe	"Added by the GAOBOT.AA WORM!"
X	MS Config Loader	svcrhost.exe	"Added by a variant of the RBOT WORM!"
X	MS Config Service	Msloader32.exe	"Added by the RBOT-KJ WORM!"
X	MS Config Stream	msasm.exe	"Added by the AGOBOT-BA WORM!"
X	MS Config v12	mscfg12.exe	"Added by the AGOBOT.YP WORM!"
X	MS Config v13	lrbz32.exe	"Added by the GAOBOT.AOL WORM!"
X	MS Config v13	mscfg13.exe	"Added by the AGOBOT.YQ WORM!"
X	Ms configsu	msconfigsu.exe	"Added by a variant of the SDBOT WORM!"
X	MS Configuration	MSFramer.exe	"Added by the RANDEX.OL WORM!"
X	Ms Configuration	microsoftsa32.exe	"Added by the KELVIR.X WORM!"
X	MS Configuration Utility	msconfig32.exe	"Added by the WOOTBOT.DY WORM!"
?	MS management console	mms.exe	"Suspicious as the legitimate ""Microsoft Management Console"" is ""mmc.exe"" and not ""mms.exe"" and doesn't normally run at startup"
X	MS Network Control	mswin.exe	"Added by the DUMBA TROJAN!"
X	MS Sound Config 16bit	sndcfg16.exe	"Added by the SDBOT.MB TROJAN!"
X	Ms System Config	Mscfg.exe	"Added by the SDBOT-CCR WORM!"
X	Ms System Config	pcedit.exe	"Added by a variant of the SDBOT WORM!"
X	MS-Connect	arr.exe	"Adult content dialler - see here"
X	MS-Connect	cdm.exe	"Adult content dialler - see here"
X	MS-Connect	game.exe	"Adult content dialler - see here"
X	MS-Connect	msite18.exe	"Adult content dialler - see here"
X	MS-Connect	web.exe	"Adult content dialler - see here"
X	MS-patch	msconfig32.exe	"Added by the RBOT-AUF WORM!"
X	Msconf32	Msconf32.exe	"Added by the AGOBOT-NR WORM!"
X	MSCONFG32.EXE	MSCONFG32.EXE	"Added by the OPTIX.04.C TROJAN!"
N	MSConfig	msconfig.exe	Entry that appears when you uncheck an item in the MSConfig Startup group and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode. Located in %System% (98/Me/Vista) or %Windir%\PCHealth\HelpCtr\Binaries (XP)
X	MSConfig	MSCONFIG32.EXE	"Added by the SPYBOT.B WORM!"
X	msconfig	msconfig.exe	"CoolWebSearch MSConfig parasite variant. Note - this overwrites the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting"
X	msconfig	msconfig.exe	"Added by the WINUR WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting. This one is located in c:\winrun"
X	msconfig	wins.exe	"Added by the RBOT.PF WORM!"
X	MSConfig	MSCONFIG35.EXE	"Added by a variant of the SPYBOT WORM!"
X	msconfig	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	msconfig	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	Msconfig	icpldrvx.exe	"Added by the BANLOAD.BFT TROJAN!"
X	msconfig	msconfig.com	"Added by the IRCBOT-SM WORM!"
X	msconfig	msconfig.bat	"Added by the PAHATIA.B WORM!"
X	MSConfig	lssas.exe	"Added by the AUTORUN.CEY WORM!"
X	MSConfig	xwpwqf.exe	"Added by the AGENT-NEW TROJAN!"
X	Msconfig lptt01	msconfig.exe	"RapidBlaster variant (in a ""msconfig"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Windows Msconfig which has the same executable name"
X	MSConfig Manager	msupdate.exe	"CoolWebSearch parasite variant"
X	Msconfig ml097e	msconfig.exe	"RapidBlaster variant (in a ""msconfig"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Windows Msconfig which has the same executable name"
X	msconfig service	MSupdate32.exe	"Added by a variant of the SPYBOT WORM!"
X	msconfig.	msconf.exe	"Added by the BUZUS-AY WORM!"
X	msconfig.exe	proxy.exe	Added by a variant of the AGENT.AH downloader TROJAN!
X	msconfig.exe	uline.exe	Added by a variant of the AGENT.AH downloader TROJAN!
X	msconfig38	mssvcc.exe	"Added by the RBOT-BJV WORM!"
X	MSConfig45	MSConfig45.exe	"Added by the SDBOT.OJ TROJAN!"
X	MSConfigr	jdbgmrg.exe	"Added by the DASMIN.C TROJAN! Note - this is not the valid JDBGMGR.EXE file - see here"
N	MSConfigReminder	msconfig.exe	Entry that appears when you uncheck an item in the MSConfig Startup group and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode. This particular entry is specific only to 98/Me and is located in %System%
X	MsConfigs	MsConfigs.exe	"Added by the ALCAN.A WORM!"
X	MSConfigs	RUNDLL64.dll.vbs	"Added by the WEKODE-B WORM!"
X	msconfigurator	ctfsdk.exe	"Added by the DELF-ALS TROJAN!"
X	MSControl28	crsss.exe	"Added by the SPYBOT.AJX WORM!"
X	MSControl31	winnsyst.exe	"Added by the RBOT.CFY WORM!"
X	MSControl3d1	isasse.exe	"Added by the RBOT.CGU WORM!"
X	msdev	msconfig.exe	"Added by the AGOBOT.AAU WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting"
X	msdev control	msdevctrl.exe	"Added by the SPYBOT.N BACKDOOR!"
X	MSFTP Service Config	r3grun.exe	"Added by a variant of the SDBOT WORM!"
X	MSI Configuration	msiconf.exe	"Added by the AGENT.AKSZ TROJAN!"
X	msiconf.exe	msiconf.exe	Added by a variant of the FAKEALERT TROJAN!
X	Msn Config	msngf.exe	"Added by the RBOT-QG WORM!"
X	MSN Configuration	msnconfig.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Msn Configuration Loader	msngms.exe	"Added by the KELVIR.T WORM!"
X	MSN Configuration Loader	msmsncfg.exe	"Added by the AGOBOT-KX BACKDOOR!"
X	MSN File Configuration	msnfilecfg.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	MSN Messenger User Controls	msmsgr.exe	"Added by the KELVIR.HI WORM!"
X	MSN Update	mscon.exe	"Added by the RBOT-QA WORM!"
X	MSN Update	DLLCON.EXE	"Added by the RBOT-EA WORM!"
X	MyContentAssistant	GDC.exe	"MyContentAssistant rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
U	MyEmoticons	MYEMOTICONS.EXE	"MyEmoticons from Persona Ltd - add icons (emoticons) to your E-mail"
N	NAV Configuration Wizard	cfgwiz.exe	"Introduced with Norton Anti-Virus 2002
N	NeroNETTrayIcon	NNServiceCtrl.exe	"System tray access to NeroNET - Ahead Software's network-capable extension of their CD/DVD burning program. NeroNET allows a burner to be shared across a network"
X	Net CoNN	Antispy.exe	"Added by the AGOBOT.ALK WORM!"
X	netconfig	netconfig.exe	"Added by the NETWARE TROJAN!"
X	Network Connections	internat.exe	"Added by the VB-ZD TROJAN!"
X	Network Host Controller	[path to trojan]	"Added by the WHISPER TROJAN!"
X	Networks Configurator	NetConfs.exe	"Added by the RBOT-OX WORM!"
X	Networks Controler	Netsis.exe	"Added by the RBOT-NG WORM!"
N	Nokia Connection Monitor	NclConf.exe	"Monitors the infrared port
U	NotebookHardwareControl	nhc.exe	"""With Notebook Hardware Control you can easily control the hardware components of your Notebook"""
U	NovaBackup * Tray Control	NbkCtrl.exe	"Scheduling engine of NovaSTOR Backup Service. Only required if scheduling is enabled and wanted - see here. * represents the version number"
X	nssysconf	[random filename]	"Added by the VIVIA.A TROJAN!"
X	Nvidia Control Daemon	nksvc32.exe	Added by an unidentified WORM or TROJAN!
X	Nvidia Control Panel	ncsvc32.exe	"Added by an unidentified VIRUS
U	ODSPConfig	ODSPConfig.exe	"DsktopSurveil surveillance software. Uninstall this software if you did not install it yourself"
U	Omega ASIO Control Panel	ASIOSysTray.exe	"System Tray access to the control panel for the Lexicon Omega ASIO (Audio Streaming I/O) desktop recording studio"
Y	Orange Connection Kit	atdialler1.exe	"Part of the Orange Connection Kit - changes the dial-up for Orange Any Time if access problems are encountered"
X	OS Boot Configuration	bootconfig.exe	"Added by the IRCBOT.HJ WORM!"
X	OS Boot Configuration!	bootconf.exe	"CoolWebSearch BootConf adware"
X	Outlook Express Config	*****.exe [* = random char]	"Added by a variant of the RBOT WORM!"
?	Packard Bell EverSafe Tray Control	TrayControl.exe	"Packard Bell EverSafe software. What does it do
?	Palm MultiUser Config	Configtool.exe	"MultiUser configuration for a Palm PDA device?. Is it required?"
N	PaperQuote System Tray Icon	PQTRAY.EXE	PaperQuote is a "wallpaper" changer with daily quotes that are either for inspiration or motivation
U	ParentalControl	ParentalControl.Exe	"Crawler Parental Control - ""Get perfect control of websites your children browse
X	PC-Config32	corona.exe	"Added by the CORONEX.A WORM!"
?	PDF Converter Registry Controller	RegistryController.exe	"Part of PDF Converter Professional version 2 from Scansoft (now Nuance). what does it do and is it required?"
?	PDF4 Registry Controller	RegistryController.exe	"Part of PDF Converter Professional version 4 from Scansoft (now Nuance). what does it do and is it required?"
?	PDF5 Registry Controller	RegistryController.exe	"Part of PDF Converter Professional and PDF Create (both version 5) - from Nuance. what does it do and is it required?"
?	PDF6 Registry Controller	RegistryController.exe	"Part of PDF Converter Professional version 6 from Nuance. what does it do and is it required?"
X	Performs peer to peer connection	WinPTTP.exe	"Added by the RBOT-GMI WORM!"
U	PestPatrol Control Center	PPControl.exe	"PestPatrol Control Terminal - utility that launched PestPatrol features such as PPMemCheck and CookiePatrol before CA's acquisition"
U	Phone Connection Monitor	audevicemgr.exe	"Connection monitor part of the Sony Ericsson PC Suite mobile phone management utility for some models
N	PocketCam 3Mega Monitor	ICON.exe	Installed with the Aiptek PocketCam 3Mega digital camera. Automatically invokes an import process if the camera is connected and has media on it
U	pop3 Server	config.cfg	"Part of HTML2POP3 - ""Convert Webmail to POP3.Is also included a SMTP/POP3 tunneling system that allow send and receive email in a private network HTTP PROXY based. All connection are plugin based. Over 250 email server supported and tested"""
U	PowerTools Tray Icon	pttray.exe	"PowerTools - add-on for AOL"
Y	PP2000 Taskbar Control	PPTbc.exe	Protector Plus anti-virus software - system tray access
U	PPControl	PPControl.exe	"PestPatrol Control Terminal - utility that launched PestPatrol features such as PPMemCheck and CookiePatrol before CA's acquisition"
Y	PrevxOne	PXConsole.exe	"Prevx intrusion prevention software"
X	PrivacyConductor	GDC.exe	"PrivacyConductor rogue privacy tool - not recommended
X	ProgramControl	ProgramControl.exe	"Added by the DLOADR-BAG TROJAN!"
X	ProtectionConue	pgs.exe	"ProtectionConue rogue security software - not recommended. A member of the AVSystemCare family"
N	PSIWin2.3 Connection Server	Psconsv.exe	Allows connectivity between a PC and a Psion device. Access can be gained from the Desktop or Start -> Programs
U	PspContr	pspcontr.exe	Driver/controller for the Philips SpeechMike 6174. As the Philips FreeSpeech application is no longer supported it can be disabled but the Mike can still be used for certain functions using this driver
U	Qchex Tray Icon	Qchex.exe	"Related to G7 Productivity Systems Check Software"
U	QCWLICON	QCWLICON.EXE	"Part of IBM Access Connections - forerunner to the current ThinkVantage verison. Connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
U	Quick Controls	Astrotoolbar.exe	Gateway Astro Screen and Sound Controls tray icon
N	RaConfig2500	RaConfig2500.exe	"RaLink wireless LAN configuration utility"
?	RAMConnectionChecker	RAMConnChecker.exe	"Part of Remote Access Manager (RAM) for Nortel Networks - which ""combines an intuitive
?	RAMGINAConnWatch	RAMConnWatcher.exe	"Part of Remote Access Manager (RAM) for Nortel Networks - which ""combines an intuitive
X	RasCon Remote Access Service Manager	rasmngr.exe	"Added by the SPYBOT.EM WORM!"
U	readericon	readericon45G.exe	Tray icon to set various configuration settings for Sunkist (and maybe other) media card readers
?	readericon10	readericon10.exe	"Related to a multimedia card reader - possibly based upon an Alcor Micro chipset. What does it do and is it required?"
X	Reg Service	WinnConfig.exe	"Added by the AGOBOT-PF WORM!"
X	RegistryConfig	rundll.exe	"Added by the AGOBOT-KN WORM! Note - this is NOT the Win9x/Me system file of the same name as described here"
N	Remote Control	Rc.exe	Hinet Hi-Five ISP software
N	Remote Controller	TVRMVCR.EXE	"ProLink PlayTVpro TV tuner software"
U	Remote Data Backups TaskBar Icon	CBSysTray.exe	"System Tray access to Remote Data Backups online system/data backup utility"
U	RemoteControl	rmctrl.exe	"Remote Control background application for Cyberlink's PowerDVD version 4 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control
U	RemoteControl	PDVDServ.exe	"Remote Control background application for Cyberlink's PowerDVD version 5 and above. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control
U	RemoteControl8	PDVD8Serv.exe	"Remote Control background application for Cyberlink's PowerDVD version 8. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control
N	RoboForm	RoboTaskBarIcon.exe	"Roboform - password manager and web form filler. Will work without this startup entry
U	Run Nintendo Wi-Fi USB Connector Registration Tool	NintendoWFCReg.exe	"Related to Wi-Fi USB Connector from Nintendo"
X	run=	mouse_configurator.win	"Added by the GAGGLE.E WORM!"
U	Sabre Task Tray Icon	Sabstart.exe	"Part of the Sabre computer reservations system/global distribution system (GDS) - used by airlines
N	SAClient	RegCon.exe	"AT&T or ComCast BBClient - monitors system and network-delivered services for availability. Your current network status is displayed on a color-coded web page in near-real time. When problems are detected
U	SaitekAutoConfigure	saicnfig.exe	"Configuration for Saitek game controllers"
U	Sametime Connect	Connect.exe	"IBM Lotus Sametime - instant messaging and Web conferencing software"
U	SandboxieControl	Control.exe	"SandBoxie - allows data to be read from the hard drive by an application but never written back unless you allow it"
U	SandboxieControl	SbieCtrl.exe	"""SandBoxie runs your programs in an isolated space which prevents them from making permanent changes to other programs and data in your computer"""
N	SandIcon	SandIcon.exe	"SanDisk ImageMate CompactFlash card reader SDDR-31 (USB). Very little use except to place the Sandisk icon beside its drive designation in Windows Explorer. The reader itself will work fine without it. The simplest thing is to just unplug the reader when you're not using it. It may slow the startup by a few nanoseconds
N	SBC Yahoo! Connection Manager	ConnectionManager.exe	Used to create and connect your SBC Yahoo DSL connection. This program has been reported to cause problems for some users. If you find that it causes you pc to become slow or unstable you should uninstall it (using Add/Remove programs) and manually connect your DSL connection
X	SchijfControleur	GDC.exe	"SchijfControleur Dutch rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
N	Screen Saver Control	FSScrCtl.exe	Installs as part of the Hubble Space Telescope screen saver (and possibly others). Lets you control your installed screensavers from a System Tray icon
U	Second Copy 2000	SecCopy.exe	"Related to Second Copy? - a files/folders backup utility"
U	SecondChance	sctray.exe	"Power Quest Second Chance. Sets checkpoints for saving a backup copy of the registry to a disk so you can restore it if you have a crash"
X	Security Center	AppControl.exe	"Added by the SDBOT.CFT WORM!"
N	Service Connection	sccenter.exe	For Compaq PC's. Part of Backweb
N	Service Connection	bwtray.exe	For Compaq PC's. Part of Backweb
X	Service Control Manager	scm.exe	"Added by the AGOBOT-GD BACKDOOR!"
X	Service Controller	Csrrs.exe	"Added by the GAOBOT.AO WORM!"
X	Service Controller	service.exe	"Added by the PREVERT TROJAN!"
U	ServiceConfig	ispbeg.exe	"Comcast Transition Wizard. On June 30th
X	serviceconnect	serviceconnect.exe	"Added by the AGOBOT.AIR WORM!"
X	Services Controller	lsassa.exe	Added by the CIADOOR.122 VIRUS!
X	Services Controller	services.exe	"Added by the CIADOOR-F TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
?	ServUTrayIcon	ServUTray.exe	"System Tray icon for Serv-U FTP server. Is it required?"
N	SetIcon	SetIcon.exe	"Installed by a 6-in-1 (4 Media Card slots
N	SetupICWDesktop	icwconn1.exe	Appears to be the "Internet Connection Wizard" from Internet Explorer being set-up as a desktop shortcut. Appears under the RunOnce registry key but is available under Start -> Programs -> Accessories -> Communication (or similar) anyway
X	Sevice	winconfig.exe	"Added by the GIP.113.B1 TROJAN!"
X	Shedule Connection	arpo412.exe	"Added by the PPDOOR-R WORM!"
?	ShowIcon_Justrams_USB Product Driver v2.12r012	shwicon.exe	"Related to Just Rams USB product driver. Is it required?"
U	ShowIcon_PNY_PNY Attaché	shwicon.exe	"PNY Attaché USB flash memory stick System Tray icon - shows when the device is plugged in"
?	ShowIcon_SmartDisk Corporation_USB Card Reader v1.14e051	shwicon.exe	"Card reader for memory cards from digital cameras. Is it required? "
U	ShowLOMControl	[strange symbol]	"Note that there is a strange symbol in the command field and in logs it's shown as ""O4 - HKLM\..\Run: [ShowLOMControl] [strange symbol]"". Additional registry information for the entry is ""Reg_DWORD 0x00000001 (1)"". It means Show ""LAN on Motherboard"" Control. On systems where you can install an external LAN interface
X	Sistema de Comm	conmsyrtl.exe	"Added by the AGENT-LMV TROJAN!"
U	Smart Connect Monitor	SCMon.exe	Appears on a Sony Vaio. Smart Connect Version 2.1 enables data transfer between Vaios via i.LINK cable. Smart Connect supports File and Printer Sharing for MS networks. You can copy files from your Vaio to another Vaio or print using a printer connected to a remote Vaio
U	Smart Connect Setup	SCSetup.exe	Appears on a Sony Vaio. Smart Connect Version 2.1 enables data transfer between Vaios via i.LINK cable. Smart Connect supports File and Printer Sharing for MS networks. You can copy files from your Vaio to another Vaio or print using a printer connected to a remote Vaio
N	Smileycons	smileycons.exe	"Smileycons - free smileys
X	SMSERIALWORKERSTART	shellexcon.exe	"Added by the FAKEALERT-AH TROJAN! Installed with the SpyBurner spyware remover - which is not recommended
N	Snsicon	Snsicon.exe	Launches a screensaver program from Second Nature
U	Softany Monitor Control	MonitorControl.exe	"Softany Monitor Control - ""control your computer's monitor and screensaver"""
N	Sonic A3D Control	vrtxctrl.exe	Sound related options
N	Sony Auto Update Tray Application	CONNECTAUTrayApp.exe	"System Tray access to change update settings for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
X	soundcontrl	soundcontrl.exe	"Added by the GAOBOT.AFJ WORM!"
N	SoundMAX Control Panel	Smax4.exe	"System Tray icon for Analog Devices SoundMax integrated soundcards. Sound properties can be accessed through the Start Menu or Control Panel"
U	SP2 Connection Patcher	SP2ConnPatcher.exe	Changes limit of concurrent TCP connections of Windows Service Pack 2
X	SPOOL Configuration	spoolsvc.exe	"Added by the SDBOT-KD WORM!"
X	Spools Service Controller	spools.exe	"Added by the KASSBOT-C WORM!"
X	Spy-Control	Spy-Control.exe	"Spy-Control spyware remover - not recommended
U	Spyware Guard Control Panel	spywareguardcp.exe	"""SpywareGuard provides a real-time protection solution against spyware"""
X	SQConfigChecker	cc.exe	"Xupiter SQWire toolbar related. Use Spybot S&D
X	Startup Configuration	[six character filename]	"Added by the RBOT-ARV WORM!"
X	Startup Configuration	wztoid.exe	"Added by the RBOT-ASD WORM!"
N	Stay Connected!	StayCon.exe	"More than just a pinger
X	stratas	xmconfig.exe	"Added by the RBOT-AHR WORM!"
X	Sun Java Console for Windows NT & XP	jconsole.exe	"Added by the VANEBOT-C WORM!"
U	Sunkist	shwicon98.exe	"Card reader for memory cards from digital cameras
U	Sunkist2k	shwicon2k.exe	"Card reader for memory cards from digital cameras
U	SunKistEM	shwiconem.exe	"Used by your computer to communicate with your Alcor Micro Multimedia Card Reader - necessary if you're using this software"
X	svchost connection monitor	svchost32.exe	"Added by a variant of the SDBOT WORM!"
X	Svconr	Svconr.exe	"WaveRevenue-lBann adware"
X	SVX Control Service	svxhost.exe	"Added by the FORBOT-K WORM!"
U	SX Virtual Link	Connect.exe	"SX Virtual Link from Silex Technology America
X	Symantec Configuration Loader	ccApp32.exe	"Added by the AGOBOT-EE WORM!"
X	syscon	syscon.exe	"Added by the APRILCONE.A WORM!"
X	syscon lptt01	syscon.exe	"RapidBlaster variant (in a ""Syscon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	syscon ml097e	syscon.exe	"RapidBlaster variant (in a ""Syscon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	sysconfig	iexplorer.exe	"Added by the CULT.C WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	SysConfig	syscfg35.exe	"Added by the KAZMOR.C WORM!"
X	SysConfig	wincfg32.exe	"Added by the SDBOT.ZD WORM!"
U	Sysconfig	Stealth KeySpy.exe	"StealthKeySpy - keystroke logger/monitoring program - remove unless you installed it yourself!"
X	sysconfig32	sysconfig32.exe	"Added by the AGENT-MSP TROJAN!"
X	sysPnP	bootconf.exe	"Homepage hijacker
X	System Config	BF3.EXE	"Added by the SPYBOT-DT WORM!"
X	System Config	sysloadcnf.exe	"Added by a variant of the SDBOT WORM! See here"
X	System Config Boot	syscgboot.exe	"Added by the AGENT.VWU TROJAN!"
X	System Config Manager	crss.exe	"Added by the AGOBOT.GH WORM!"
X	System Config Manager	smssl.exe	"Added by the AGOBOT-ZJ WORM!"
X	System Configuration	iexplore.exe	"Added by the RANDEX.AD WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	System Configuration	syscfg32.exe	"Added by the MYTOB.EA WORM!"
X	System Configurator32	SYSTEMCFG.EXE	"Added by the AGOBOT-KS WORM!"
X	system configure	svchost.exe	"Added by the LINEAGE-C TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	System Services	connection.exe	Added by an unidentified WORM or TROJAN!
X	System Update	mssetupconf.exe	"Added by the RBOT.DLC WORM!"
X	System-Config	msptmf32.com	"Added by the LIOTEN.FA WORM!"
X	SystemCONF98i	SystemCONF98i.exe	"Added by the GLITCH TROJAN!"
X	systrasx	CONSOLES.EXE	"Added by the SDBOT-NW WORM!"
U	T3Console	T3Console.exe	"Related to T3 Security Suite - prevents unauthorized or inappropriate access to your PC and data"
U	Taakcontrole	taskmon.exe	"Task Monitor (on Dutch language versions of Windows) - checks the disk-access patterns of programs when they are started and stores this information in log files in the Applog folder. Task Monitor also records the number of times you use a program. The Disk Defragmenter tool uses this information to optimize your hard disk so that programs that you use frequently are loaded faster. Not required - but can be useful. Note: for Norton Anti-Virus 2002 users
N	Taskbar Display Controls	"RunDLL deskcp16.dll	QUICKRES_RUNDLLENTRY"
X	TEXTCONV	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
X	TEXTCONV	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
N	ThinkPad Configuration Utility	TP98TRAY.EXE	"System Tray access to the ThinkPad Configuration utility for IBM/Lenovo ThinkPad notebooks. ""The ThinkPad Configuration utility is a control center to configure your ThinkPad hardware. With this utility
U	ThinkVantage Access Connections	ACTray.exe	"System Tray access to the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
U	ThinkVantage Access Connections	ACWLIcon.exe	"Part of the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
U	TOSHIBA Volume Indicator	VolControl.exe	On-screen volume indicator for Toshiba notebooks
X	totacon	totacon.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
U	tranicon	tranicon.exe	"A Tweak-XP component (only in the registered version)
U	TransparentIcons	tranicon.exe	"A Tweak-XP component (only in the registered version)
Y	Tray control for Malwarebytes' Anti-Malware	mbamtrayctrl.exe	"Malwarebytes' Anti-Malware - ""monitors every process and actually stops malicious processes before they even start. It uses our impressive technology that is in fact a completely novel way of heuristic scanning and it is our response to the increasingly complex malware threats"""
Y	TridentTVIcon	tvicon.exe	"Trident Microsystems
U	True Internet Color Icon	internetcolor.exe	"Part of 3Deep® from E-Color (now superseded by 3DxWizzard™) - ""With True Internet Color PCs can display the best color possible over the web. Enabled web sites will know how connected monitors display color and will send them color corrected images"""
N	Turbine Download Manager Tray Icon	TurbineDownloadManagerIcon.exe	"Turbine Download Manager (TDM) - download manager associated with the game ""The Lord of the Rings Online™"""
U	TV878 Remote Control	C7XRCtl.exe	"Related to Kworld TV878 Tuner"
U	U.S.Robotics WLAN Adapter Configuration Utility	USRWLAN.exe	"U.S.Robotics LAN Adapter - wireless LAN (WLAN) configuration utility"
U	UberIcon	UberIcon Manager.exe	"Uber Icon by Punk Labs. Creates a more customizable atmosphere on your desktop by extending Windows to perform new effects when you launch your icons and folders"
N	UpConfgVer	UpgConf.exe	"Part of Panda Antivirus and Internet Security. Purpose unclear
X	Update32	configs.exe	"Hijacker
X	USB controller	Svcmm32.exe	SvcMM backdoor parasite downloader
X	USBConfigration2	wmmndir.exe	"Added by the AGOBOT-SV WORM!"
X	UsrManagementConf	umcss.exe	"Added by the IRCBOT-W TROJAN!"
X	Vagiconline	vadaSq.exe	"Added by the SDBOT-TD WORM!"
U	Venturi Configurator	ventcfg.exe	"Venturi Wireless mobile broadband configuration utility"
U	Veo Velocity Connect	stim11.exe	Support software for the Veo Velocity Connect webcam
N	Verizon Control Pad	cpad.exe	"Control Pad - installed with Verizon DSL accounts. Tool designed to streamline the online experience"
X	Video Process	sysconf.exe	"Added by the GAOBOT.GEN!POLY or GAOBOT.UM or GAOBOT.ADX WORMS!"
X	Video Processor	msconfsys88.exe	"Added by the AGOBOT-QG WORM!"
U	ViewpointPhotosDeviceConnect	FotomatDeviceConnect.exe	"Related to Viewpoint which is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything ""bad"". This will change from what we know in 2006 according to this article. You can remove it via Start -> Settings -> Control Panel -> Add/Remove Programs list..."
Y	VistaFirewallControl	VistaFirewallControl.exe	"Vista Firewall Control from Sphinx Software (forerunner to Windows 7 Firewall Control) - ""Protects your applications from undesirable network incoming and outgoing activity
?	VMConsole.exe	VMConsole.exe	"Sony VAIO Media Console - installed on the VAIO Media Integrated Server PCs. What does it do and is it required?"
X	Volume Controller	VolumeControl.exe	"Added by the SDBOT.AYI WORM!"
X	Volume Shadow Configuration	vbmsvc.exe	"Added by the SLENFBOT.DH WORM!"
X	VSP32 Controls	vsp32.exe	"Added by the RBOT-VA WORM!"
X	W32.Formalin.Beta	Pocong.exe	"Added by the SILLYFDC WORM!"
N	War FTPD Tray Icon	wartray.exe	"War-ftpd - FTP server"
X	Welcome	winconfig.exe	"Added by the GIP.113.B1 TROJAN!"
X	Welcome	CONFIG.EXE	"Added by the PSWGIP.B TROJAN!"
X	Wifi Configuration	wificonfig.exe	"Added by the IRCBOT.AWB BACKDOOR!"
X	Wifi Configuration!	wificonfigs.exe	"Added by the IRCBOT.AWB BACKDOOR!"
X	Wifi Connection	wificon.exe	"Added by the SLENFBOT.AC WORM!"
X	Wifi Connection!	wificonnect.exe	"Added by the IRCBOT.XEL BACKDOOR!"
X	Win Config	winconfig.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Win32 Cnfg32	msconfgh.exe	"Added by the MYTOB.NB WORM!"
X	Win32 Configuration	videosd32.exe	"Added by the SDBOT.TT WORM!"
X	Win32 Configuration	dllhelp.exe	"Added by the SDBOT.UL WORM!"
X	Win32 Configuration	mplayer.exe	"Added by the FORBOT-BZ WORM!"
X	Win32 Console	cmd.exe	"Added by the ABI.C WORM! Note - this is not the legitimate cmd.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Win32 Secure	msconfigsvc.exe	"Added by a variant of the SDBOT WORM!"
X	Win32 Services Config	winwkys.exe	"Added by the RBOT.BKY WORM!"
X	WinConfig9324	wincfgkop9.exe	"Added by the RBOT.BVD WORM!"
X	winconn	vbrun6nt.exe	"Added by the AGOBOT-AEI BACKDOOR!"
X	Window UDP Control Servic	winlogon.exe	"Added by the RBOT-GXN WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows AdControl	WinAdCtl.exe	Windupdates adware variant
X	Windows Anti Virus Control Center	avrscan.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Anti Virus Control Center	winavscan.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows API Control Task	apitsk32.exe	"Added by the MYTOB.HI WORM!"
X	Windows Audio Control	ppnsvc.exe	"Added by the HAM TROJAN!"
X	Windows Backup Configuration	IEXPLORER.exe	"Added by the GAOBOT.AZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Windows Conf	windowsconf.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Config	SSYS.EXE	"Added by the SPYBOT-DA WORM!"
X	Windows Config	wins.exe	"Added by the SPYBOT.JR WORM!"
X	Windows Config	RUNDLL.EXE	"Added by the SPYBOT-DX WORM! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	Windows Config	pvphost.exe	"Added by a variant of the SLAPER TROJAN!"
X	Windows Config	winconfig.exe	"Added by the IRCBOT.BAP BACKDOOR!"
X	Windows Config	ZANBOR.EXE	"Added by the SPYBOT-MH WORM!"
X	Windows Config Connection	msicll.exe	"Added by the RBOT-EXQ WORM!"
X	Windows Config Loader	Wincfg32.exe	"Added by the SILVERFTP TROJAN!"
X	Windows Config Manager	winconf.exe	"Added by the RBOT-AIT WORM!"
X	Windows Config Manager	Wincfgman32.exe	"Added by the AGOBOT-AL BACKDOOR!"
X	Windows Config System	config.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Configuration	wsys32.exe	"Added by the GAOBOT.FB WORM!"
X	Windows Configuration	wincfg32.exe	"Added by the MYTOB.ED WORM!"
X	Windows Configuration	WINHUB.EXE	"Added by the SPYBOT-CG WORM!"
X	Windows Configuration Loader	asclt.exe	"Added by the SDBOT-OA WORM!"
X	Windows Configuration Loader	msgfix.exe	"Added by the SDBOT-NP WORM!"
X	Windows Configuration System	IExplore.exe	"Added by the RBOT-DDG WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows Configuration Utility	winxupdate.exe	"Added by the AGOBOT.LW WORM!"
X	Windows Configurator	winconf.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows connection manager	Internet.exe	"Added by the RBOT-APN WORM! Note - file is found in the Windows or Winnt folder. Make sure you check the link on this one
X	Windows Console	wkssvc.exe	"Added by the SDBOT-DJX WORM!"
X	Windows Console Component	wrasvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Console Monitor	[path to worm]	"Added by the KEDEBE WORM!"
X	Windows Console Monitor	gcasAV32.exe	"Added by the KEDEBE-A WORM!"
X	Windows Console Norms	wnbsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Console Source	wnbsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Control	Control.exe	"Added by the GREK.A TROJAN! If there is another file with the same file name in the Windows folder
X	Windows ControlAd	WinCtlAd.exe	Windupdates adware variant
X	Windows Controls Center	winudmr.exe	"Added by the LAMER.AA BACKDOOR!"
X	Windows Default Configuration	svchost.exe	"Added by the DLOADER-U TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Windows Desktop Controler	windesktop.exe	"Added by the SDBOT-XH WORM!"
X	Windows driver update	Ipconfig32.exe	"Added by the SDBOT-JV WORM!"
X	Windows Firevall Control C	rundll.exe	"Added by the GAERTOB.A TROJAN!"
X	Windows HTML file reader	Sysconf32.exe	"Added by the NOOMY.A WORM!"
X	Windows Icons Manager	wicomgr.exe	"Added by the RBOT-AIF WORM!"
X	Windows Incontext	InSearch.exe	"PacerD_Media/Pacimedia.com/Z-Quest adware installer"
X	Windows Installer 1	msnconfig.exe	"Added by the PURITYSCN.B TROJAN!"
X	Windows Logical Connection	wcnsvc.exe	"Added by the VIRUT.AO VIRUS!"
X	Windows Manager Control	WINMUR32.EXE	"Added by the AGOBOT-AR WORM!"
N	Windows Media Connect 2	WMCCFG.exe	"Windows Media Connect from Microsoft - stream digital media files on your computer to digital media receivers (DMRs) that are connected to your home network"
X	Windows Messanger Control Center	svchosl.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Messanger Control Center	svhost.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Messanger Control Center	winlogin.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Messanger Control Center	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Messanger Control Center	winsys.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Messenger Connect	wmdsvc.exe	"Added by the SLENFBOT.S WORM!"
X	Windows More Choice	TopContext.exe	"ZQuest adware"
X	Windows MSConfig Startup Logger	winlog.exe	"Added by the RBOT.BCU WORM!"
X	Windows Network Controller	Mqguard.exe	"Added by the FORBOT-CL WORM!"
X	Windows Network Controller	WinxPupd.exe	"Added by the FORBOT-DK WORM!"
X	Windows Network Controller	winmms32.exe	"Added by the FORBOT-ED WORM!"
X	Windows Network Controller	wingmt.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Network Controller	Win9x.exe	"Added by the WOOTBOT.I WORM!"
X	Windows Network Controller	winmms32.exe.exe	"Added by the FORBOT-ED WORM!"
X	Windows Network Service	Msconf32.exe	"Added by a variant of the RBOT WORM!"
X	Windows pack Control Center	taskmam.exe	"Added by the TOMETA-J TROJAN!"
X	Windows Recovery Console	recovery.exe	"Added by the RANSOM.FD WORM!"
X	Windows Registry Control	winreg.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Secure Connection	winsc.exe	"Added by the SDBOT.BTN WORM!"
X	Windows Security Control	wuaucls.exe	"Added by the FORBOT-V WORM!"
X	Windows Service Controller	services.exe	"Added by the KALEL-B WORM! Note - this is not the legitimate services.exe process
X	Windows Service Controller Agent	taksmgr.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Service Layer	config.exe	"Added by the RBOT.DDJ WORM!"
X	Windows Spooler Control Service	qwidh.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows SSL Secondary Drivers	SSL32Dr.exe	"Added by the SDBOT.ASQ WORM!"
X	Windows SYN Control Center	winmnon32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows System Configuration	SYSCFG16.EXE	"Added by the WISDOOR-K TROJAN!"
X	Windows System Configuration	Passcfg16.exe	"Added by the DOMWIS-E TROJAN!"
X	Windows System Configuration	Winfrw.exe	"Added by the SOLUFINA TROJAN or the DOMWIS-J WORM!"
X	Windows System Configuration	wincfg.exe	"Added by the AGOBOT.OP WORM!"
X	Windows System Configuration	WINCFG32.EXE	"Added by the AGOBOT-TE WORM!"
X	Windows System Configuration	WinNeth.exe	"Added by the RETHE-A WORM!"
X	Windows System Configuration	nether.exe	"Added by the OPANKI-AB WORM!"
X	Windows System Configuration	WINSYS32.exe	"Added by the SDBOT.AXK WORM!"
X	Windows System Manager	sysconf.exe	"Added by the MYTOB.AL WORM!"
X	Windows System Restore Configuration	Sblhost.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows System-Control Drivers	syscontrl.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control	winudspm.exe	"Added by a variant of the SDBOT WORM! See here"
X	Windows UDP Control Center	auth.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	ehSched.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	fxstaller.exe	"Added by the AGENT-IEE TROJAN!"
X	Windows UDP Control Center	installer.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows UDP Control Center	msnmngs.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	msnpd.exe	"Added by the SDBOT.EBA BACKDOOR!"
X	Windows UDP Control Center	mswinudpmgr32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	scvhost.exe	"Added by the PUSHBOT.EH WORM!"
X	Windows UDP Control Center	taksmrg.exe	"Added by the AGENT.WOH TROJAN!"
X	Windows UDP Control Center	tmps.exe	"Added by the SDBOT.EBA BACKDOOR!"
X	Windows UDP Control Center	winlive32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	winmsn.exe	"Added by the SDBOT.EBA BACKDOOR!"
X	Windows UDP Control Center	winrofl32.exe	"Added by the LDPINCH-RZ TROJAN!"
X	Windows UDP Control Center	winudpmg.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	winudpmgrs.exe	"Added by the DROPPER.CMV TROJAN!"
X	Windows UDP Control Center	winudpmsgr.exe	"Added by the SDBOT.GAV WORM!"
X	Windows UDP Control Center	winupmgr.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	winuscn32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	wksvcsc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	winudpmgr.exe	"Added by the DLOADR-HQL TROJAN!"
X	Windows UDP Control Center	fxsteller.exe	"Added by the IRCBOT-J BACKDOOR!"
X	Windows UDP Control Center	msnsmsgrs.exe	"Added by the PUSHBOT.MF WORM!"
X	Windows UDP Control Center	winmgrs.exe	"Added by the PUSHBOT.MY WORM!"
X	Windows UDP Control Manager	winudpmgr.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Services	wksvcsc.exe	"Added by the ANTIAV-C TROJAN!"
X	Windows Update	msconfig32.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows update config	svhost.exe	"Added by the SDBOT-PF WORM!"
X	windows update configurator	svghost.exe	"Added by a variant of the SPYBOT WORM!"
X	windows update configurator	explore.exe	"Added by the SDBOT.RY BACKDOOR!"
X	Windows Update Controller	mwoffice.exe	"Added by the BATTRY-A TROJAN!"
X	Windows USB Control Driver	iexplore.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows USB controler	winusb.exe	"Added by the RBOT-HR WORM!"
X	Windows Virus Control	plou.exe	"Added by the SDBOT-ACZ WORM!"
X	Windows Volume Control	ongsvc.exe	"Added by the SLENFBOT.DZ WORM!"
X	Windows32 Configuration Loader	msrf32.exe	"Added by the SDBOT-ABX WORM!"
Y	Windows7FirewallControl	Windows7FirewallControl.exe	"Windows 7 Firewall Control from Sphinx Software - ""Protects your applications from undesirable network incoming and outgoing activity
X	Windows_Protect	wincontrol32.exe	"Added by the RBOT-ADK WORM!"
X	WinDriver Configuration	windrvconf.exe	"Added by the AGOBOT-LX TROJAN!"
X	Windws Configuration Loader	LEXPLORE.exe	"Added by the SODABOT WORM!"
N	WinFax PRO Controller	WFXCTL32.EXE	From WinFax 10.0 and possibly earlier versions. Appears if you chose to have WinFax appear in the taskbar (System Tray) during installation and displays a yellow fax/telephone icon. Available via Start -> Programs
X	winrun	msconfig.exe	"Added by the WINUR WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting. This one is located in c:\winrun"
X	Winsock2 Loader	WICONF.EXE	"Added by the SDBOT-LA WORM!"
X	WinSpyControl	pgs.exe	"WinSpyControl rogue security software - not recommended. A member of the AVSystemCare family"
X	WINTASK	yahooicons.exe	"Added by the MYTOB-HM WORM!"
X	winupdateconn	[path to file]	"Added by the COMBRA-A WORM!"
X	winupdateconn_	Explorer.EXE	"Added by the COMBRA-B WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	win_supp00.exe	Win Const.exe	"Added by the ASSASIN-H TROJAN!"
X	WIP Config GUI	Winipcfgs.exe	"Added by the RBOT-CN WORM!"
X	Wireless Conections	WireConnect.exe	"Added by the SDBOT-VF WORM!"
U	Wireless Connection Manager	wirelesscm.exe	"Wireless adapter configuration utility for D-Link's range"
X	Wireless Connections	WIRECONNECT.EXE	"Added by the SDBOT-VM WORM!"
N	Wireless Console	wcourier.exe	"ASUS Wireless Console - installed alongside ASUS wireless components and provides additional configuration options for these devices"
N	Wireless Console 2	wcourier.exe	"ASUS Wireless Console - installed alongside ASUS wireless components and provides additional configuration options for these devices"
N	Wireless Console 3	wcourier.exe	"ASUS Wireless Console - installed alongside ASUS wireless components and provides additional configuration options for these devices"
U	Wireless PCI Card Configuration Utility	WMP11Cfg.exe	"Utility used by the LINKSYS wireless PCI card (WMP11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
X	WMI Standard Event Consumer - Scripting	scrcons32.exe	"Added by the RBOT-GRD WORM!"
X	WMI Standard Event Consumer - Scripting	scrcs.exe	"Added by a variant of the RBOT-GRD WORM!"
N	WOOTASKBARICON	GestMaj.exe TaskbarIcon.exe	"Wanadoo broadband ISP (now rebranded as Orange) taskbar icon - not required"
X	WSAConfiguration	wmon32.exe	"Added by the GAOBOT.BAJ WORM!"
X	WSAConfiguration	svchostt.exe	"Added by the AGOBOT.ZT WORM!"
X	WSAConfiguration	rpcxmn32.exe	"Added by the AGOBOT.ABG WORM!"
X	WSAConfiguration	win32upd.exe	"Added by a variant of the RBOT WORM!"
X	WSAConfiguration	drrss.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	WSAConfiguration	winlogon32.exe	"Added by the AGOBOT-WC WORM!"
X	WSAConfiguration	ntguard32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	WSAConfiguration	csrsvcs.exe	"Added by the AGOBOT.VI WORM!"
X	WSAConfiguration	winmx32.exe	"Added by the AGOBOT-JE WORM!"
X	WSAConfiguration	kernel32.exe	"Added by the AGOBOT-KV WORM!"
X	WSAConfiguration	winmon32.exe	"Added by the AGOBOT.TM WORM!"
X	WSAConfiguration	msnote30.exe	"Added by the AGOBOT-KF BACKDOOR!"
X	WSAConfiguration	syxtem32.exe	"Added by the AGOBOT-MF BACKDOOR!"
X	WSAConfiguration	svchostx.exe	"Added by the AGOBOT-JV BACKDOOR!"
X	WSAConfiguration1	csass.exe	"Added by the AGOBOT.WH WORM!"
X	WSConfiguration	spoolsc.exe	"Added by the AGOBOT-HY WORM!"
X	Wsdata service	WSconf.exe	"Added by the SDBOT.ZU WORM!"
U	WSEP Status+Configuration	controldGUI.exe	"User interface for the WatchGuard Security Event Processor (WSEP) Status/Configuration dialog box associated with the Firebox series of security products from Watchguard"
X	WSSAConfiguration	wmmon32.exe	"Added by the AGOBOT-KC WORM!"
?	xicon	xicon.exe	"Part of the IBM/XPoint Rapid Restore utility. What does it do and is it required?"
U	xPlanetControl	xPlanetControl.exe	"Tool that displays a globe with current day/night zones and clouds on users desktop."
U	XTNDConnect PC	XCPCMenu.exe	"XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
U	XTNDConnect PC - 3CmPlm	Autodet.exe	"3Com Palm PC specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
U	XTNDConnect PC - CasioOrg	CasAgnt.exe	"Casio Pocket PC specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
U	XTNDConnect PC - ErPhn2	ErTray.exe	"Sony Ericsson IrMC (Infrared Mobile Connectivity) phones and smartphones specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
U	XTNDConnect PC - LtNts4	NtsAgnt.exe	"(IBM) Lotus Notes 4 specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
U	XTNDConnect PC - MyPalm	MPTray.exe	"Palm OS specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
U	XTNDConnect PC - PocketPC	AutoDetect.exe	"Windows Mobile Pocket PC specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
U	XTNDConnect PC - ScheduleSync	SCHEDU~1.EXE	"ScheduleSync specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
U	Xtrem parental control	pcx.exe	ParentXtreme - surveillance software. Uninstall this software unless you put it there yourself
N	YBrowser	ybrwicon.exe	SBC Yahoo! Browser system tray icon
?	ZDConfig	ZDConfig.exe	"Related to various brands of Wireless USB LAN Adapter - what does it do and is it required?"
X	Zekio Startups	condll.exe	"Added by the AGOBOT-AGD WORM!"
Y	ZENRC Tray Icon	zentray.exe	"Part of Novell's ZenWorks - "Complete End-to-End Directory-enabled Network Management". Best left alone"
U	ZipDisk Icons	IMGICON.EXE	"Displays Iomega icons in Explorer/My Computer
X	[random name]	m?config.exe	"PurityScan adware"
X	[Randomly chosen existing folder name]	_config.exe	"Added by the ANTINNY-L WORM!"
X	[username] config	[path to trojan]	"Added by the MOSUCK-H TROJAN!"
X	[various names]	control64.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	LOPTCON.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	sysconf16.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	typeconf.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	_svchost.con	svchost.com	"Added by the ERKEZ.C WORM!"