d.exe

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
Y	!1_ProcessGuard_Startup	procguard.exe	"DiamondCS ProcessGuard security software - stops malicious worms and trojans from being executed silently in the background
Y	'Ashampoo AntiSpyWare 2 Guard'	AntiSpyWare2Guard.exe	"Part of Ashampoo® AntiSpyWare 2 from Ashampoo GmbH & Co. KG. This part is the realtime monitor that looks for changes on the users system such as BHO
X	(Default)	NOTEPAD.exe	"Added by the RUSTY WORM! Note - not to be confused with the valid Windows ""NOTEPAD"" text editor! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	KEYBOARD.exe	"Added by the AUTORUN.BUK WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	*WindowsAudio	systemupd.exe	"Added by the AGENT-TH WORM!"
X	*zggjmyd	zggjmyd.exe	"Added by the AFCORE.O BACKDOOR!"
X	3d_sound	3d_sound.exe	"Added by the RIADOS-A TROJAN!"
X	6.54388E+16	rkgnd.exe	"ANG AntiVirus 09 rogue security software - not recommended
X	7.61125E+16	angpd.exe	"ANG AntiVirus 09 rogue security software - not recommended
X	@	sysload.exe	"Added by the DELF-EL TROJAN!"
Y	a-squared	a2guard.exe	"System Tray access to and Anti-Malware Guard feature of Emsisoft Anti-Malware from Emsi Software GmbH - which provides ""comprehensive PC protection against viruses
Y	a-squared	a2adguard.exe	"System Tray access to and Background Guard feature of Emsisoft Anti-Dialer from Emsi Software GmbH - which provides ""provides a complete defense against Dialers"""
Y	a-squared Anti-Dialer	a2adguard.exe	"System Tray access to and Background Guard feature of Emsisoft Anti-Dialer from Emsi Software GmbH - which provides ""provides a complete defense against Dialers"""
Y	a2adguard	a2adguard.exe	"System Tray access to and Background Guard feature of Emsisoft Anti-Dialer from Emsi Software GmbH - which provides ""provides a complete defense against Dialers"""
Y	a2guard	a2guard.exe	"System Tray access to and Anti-Malware Guard feature of Emsisoft Anti-Malware from Emsi Software GmbH - which provides ""comprehensive PC protection against viruses
?	ab EazyScheduler	ezsched.exe	"??"
U	Abyssus	razerhid.exe	"Razer Abyssus gaming mouse driver - required if you use the additional features and programmed keys/macros"
U	Acombo3dmouse	Acombo3d.exe	Mouse driver - required if you use non-standard Windows driver features
U	Activboard	MMKeybd.exe	"Packard Bell ActiveBoard keyboard - multimedia keyboard manager. Required if you use the additional keys and want to see the status of the Num Lock
U	ACTIVBOARD	ABoard.exe	"Packard Bell ActiveBoard keyboard - multimedia keyboard manager. Required if you use the additional keys and want to see the status of the Num Lock
U	Active shield	Activeshield.exe	"Active Shield is ""an heuristic screen that actively protects your computer from trojans
X	ActiveScript32	nod.exe	"Added by the SOHANA-AJ WORM!"
Y	ActiveShield	mcvsshld.exe	"ActiveShield - background scanner for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online which scans files in the background as and when they are accessed
N	Adaptec DirectCD	Directcd.exe	DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later
N	AdaptecDirectCD	Directcd.exe	DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later
X	ADDITIONAL Services	pkgadd.exe	"Added by a variant of the IRCBOT TROJAN!"
?	Agente	Remupd.exe	"Part of an older version of Panda Antivirus. Is this an update reminder (guess because of the name)
Y	AHNSD	AhnSD.exe	"AhnLab V3 antivirus updater - leave enabled unless you manually update on a regular basis"
N	Alcohol Soft Development Team	axcmd.exe	"Part of Alcohol 120% - ""a powerful Windows CD and DVD burning software that makes it easy to create backups of DVDs and CDs. In addition
N	AlcoholAutomount	axcmd.exe	"Part of Alcohol 120% - ""a powerful Windows CD and DVD burning software that makes it easy to create backups of DVDs and CDs. In addition
U	AlcWzrd	ALCWZRD.EXE	"RealTek AlcWzrd Application
X	alt CTRL Shift	et3rd.exe	"Added by the SDBOT-RH BACKDOOR!"
X	ALTER DATA	[path] repcale.exe [path] beird.exe	"Added by the IRCFLOOD.CD TROJAN! Both files are located in %System%\ccdew"
X	AntiAdd.exe	AntiAdd.exe	"AntiAdd rogue security software - not recommended
X	AntiAID	AntiAID.exe	"AntiAID rogue security software - not recommended
X	AntiSpyGuard	AntiSpyGuard.exe	"AntiSpyGuard rogue security software - not recommended
Y	AntiSpyWare2Guard	AntiSpyWare2Guard.exe	"Part of Ashampoo® AntiSpyWare 2 from Ashampoo GmbH & Co. KG. This part is the realtime monitor that looks for changes on the users system such as BHO
X	AntispywareD	AntispywareD.exe	"AntiSpywareDeluxe rogue security software - not recommended
X	AntiSpywareShield	AntiSpywareShield.exe	"AntiSpywareShield rogue security software - not recommended
X	AntivirusGold	AntivirusGold.exe	"AntivirusGold rogue security software - not recommended
U	AnyDVD	AnyDVD.exe	"AnyDVD - descrambles DVD-Movies automatically in the background and the DVD appears unprotected and region code free. Also removes prohibited operations from the DVD such as skipping adverts - hence the ""U"" recommendation"
Y	AolAcsDaemon1	Acsd.exe	"AOL Connectivity Service - automatically restores the connection to AOL should you lose it while online. Negates having to go through the procedure of signing back on manually. This version is obsolete and has been replaced by AOLACSD.EXE so update your version of AOL. Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
Y	AolAcsDaemon1	AOLACSD.EXE	"AOL Connectivity Service - automatically restores the connection to AOL should you lose it while online. Negates having to go through the procedure of signing back on manually. Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
Y	APVXDWIN	ClShield.exe	"""Panda ClientShield with TruPrevent is designed for companies that want the best protection for their workstations. It protects against viruses and other known and unknown threats including spam
U	Arctosa	razerhid.exe	"Razer Arctosa gaming keyboard driver - required if you use the additional features and programmed keys/macros"
Y	Arovax Shield	ArovaxShield.exe	"Part of Arovax Shield from Arovax
Y	ArovaxShield	ArovaxShield.exe	"Part of Arovax Shield from Arovax
X	ASDd	ASDd.exe	"AntiSpywareDeluxe rogue security software - not recommended
X	ASDPLUGIN	Finland.exe	"AsdPlug premium rate adult content dialer"
Y	Ashampoo AntiSpyWare 2	AntiSpyWare2Guard.exe	"Part of Ashampoo® AntiSpyWare 2 from Ashampoo GmbH & Co. KG. This part is the realtime monitor that looks for changes on the users system such as BHO
Y	Ashampoo AntiSpyWare 2 Guard	AntiSpyWare2Guard.exe	"Part of Ashampoo® AntiSpyWare 2 from Ashampoo GmbH & Co. KG. This part is the realtime monitor that looks for changes on the users system such as BHO
U	Ashampoo HDD Control Guard	HDDControlGuard.exe	"Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access"
N	ASUSGamerOSD	GamerOSD.exe	"GamerOSD by ASUSTek - for ""real-time overclocking
N	ASUSWebStorage	ASUSWSDashBoard.exe	"System Tray access to ASUS Webstorage online backup and sharing utility which is pre-installed on some ASUS systems or available for free (with 1GB available) for others. Disable unless you want to automatically backup and sync your files every time your system starts"
N	AsusWSDashBoard	ASUSWSDashBoard.exe	"System Tray access to ASUS Webstorage online backup and sharing utility which is pre-installed on some ASUS systems or available for free (with 1GB available) for others. Disable unless you want to automatically backup and sync your files every time your system starts"
X	ATI Display Driver	atixd.exe	"Added by the RBOT-FOV WORM!"
U	ATI Launchpad	launchpd.exe	"Convenient way to start all your Multimedia Center applications (DVD
N	ATI Scheduler	Atisched.exe	Component that remains resident in memory and automatically launches the ATI VIDEO PLAYER at a user selected time and date. Delete the shortcut in the Start -> Programs -> Startup folder as well. Functions could re-enable the program to load at start-up and re-introduce the shortcut. Try it and see
N	ATI Task Application	Atitkad.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display
U	ATI Technologies Inc. HydraVision Viewport	HydraMD.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is HYDRAVISION MultiDesk - which ""creates
X	ATI VIDEO REGKEY	ati2vid.exe	"Added by the SDBOT.UR WORM!"
U	AtiCwd	AtiCwd.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
U	AtiCwd	Ati2cwad.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
U	AtiCwd32	AtiCwd.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
U	AtiCwd32	Ati2cwad.exe	This utility adds the ATI tab in the advanced display properties (gives the option for TV out). Do not uncheck if there is TV out on the video card
N	AtiKey	atiptkad.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Control Panel → Display
X	atisrc2	windfind.exe	"Added by the WINDFIND-A TROJAN!"
X	AUDIO	SOUND.exe	"Added by the PLOYB-A TROJAN!"
U	Auslogics BoostSpeed	boostspeed.exe	"System Tray access to Auslogics BoostSpeed system optimization utility - which allows you to ""Start programs faster. Speed up computer start time. Increase Internet speed
U	Auslogics BoostSpeed 4	boostspeed.exe	"System Tray access to Auslogics BoostSpeed 4 system optimization utility - which ""Start programs faster. Speed up computer start time. Increase Internet speed
U	AutoMate5	Am5HkWnd.exe	"""Automate is the Leading Software for Automation of front and back-office business processes.It provides all the tools necessary to completely automate business processes
N	Automatically launches the United Devices Agent when you start your computer	UD.EXE	The United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home but for medical research. Available via Start > Programs
N	autoupd	autoupd.exe	Raxco Software auto update utility
X	autoupd	autoupd.exe	"Added by an unidentified VIRUS
N	AvaFind	AvaFind.exe	"AvaFind file search utility"
Y	AVGuard	AVGuard.exe	"AntiVir® PersonalEdition Classic antivirus. Background task which scans files transparently"
X	avscan	Usbconeted.exe	"Added by the PROVIS-A TROJAN!"
N	axcmd	axcmd.exe	"Part of Alcohol 120% - ""a powerful Windows CD and DVD burning software that makes it easy to create backups of DVDs and CDs. In addition
?	a_vpd	vpd.exe	"Located in an IBMTOOLS\VPD sub-directory. What does it do and is it required?"
Y	a�	a2guard.exe	"System Tray access to and Anti-Malware Guard feature of Emsisoft Anti-Malware from Emsi Software GmbH - which provides ""comprehensive PC protection against viruses
X	Backup One	smbguard.exe	"Added by the SDBOT-MI WORM!"
?	BBDial	BT Broadband.exe	"Part of BT Broandband - is it required?"
U	Belgacom	sprtcmd.exe /P Belgacom	"Self-help support tool for Belgacom broadband users (provided by SupportSoft
Y	bg	bullguard.exe	"Bullguard antivirus and firewall. The P2P version is free with KaZaA Media Desktop and Grokster"
N	bgsmsnd	bgsmsnd.exe	Printer driver to generate PDF files from any program
N	Billminder	Billmind.exe	Can be setup in Quicken to remind user of due payments. Available via Start -> Programs
U	BoostSpeed	boostspeed.exe	"System Tray access to Auslogics BoostSpeed 4 system optimization utility - which ""Start programs faster. Speed up computer start time. Increase Internet speed
X	bootpd.exe	bootpd.exe	"Added by the AGENT-DT TROJAN!"
X	browser aid	browseraid.exe	"BrowserAid/BrowserPal foistware"
U	Bulldog Service	upsd.exe	Belkin's Bulldog Plus control software which runs under Windows 95 or later and monitors the UPS (Uninterrupted Power Supply) via a serial or USB link
Y	BullGuard	BullGuard.exe	"Part of BullGuard antivirus"
Y	BullguardoptIn	bulldownload.exe	"Part of Bullguard antivirus"
X	C:WINDOWSsystem32SetupCmd.exe	SetupCmd.exe	"Detected by Kaspersky as the AGENT.AAW TROJAN!"
N	CahootWebcard	CahootWebcard.exe	"""The Cahoot Webcard is a virtual card that allows you to use your Cahoot credit card online without ever having to expose your real card numbers over the web. It works by generating one-off transaction numbers as a substitute for your real cahoot credit card details"". Run manually when needed"
Y	CamWizard	CamWizrd.exe	Launches the Logitech Camera Wizard on the first reboot after installing versions of Logitech QuickCam webcam software
U	Canary	canary-std.exe	"Canary keystroke logger/monitoring program - remove unless you installed it yourself!"
X	cartao	conflicted.exe	"Added by the DADOBRA-DV TROJAN!"
X	Casino Royale	jamesbond.exe	"Added by the RBOT-FZO WORM!"
X	Cassandra	[10 to 14 random char]THD.EXE	"Added by the KREPPER-AI TROJAN!"
Y	CAVRID	CAVRID.exe	"eTrust™ EZ Antivirus Real Time Infection Report from Computer Associates"
X	cbvcs	urretnd.exe	"Added by the FRETHOG-C WORM!"
X	CDSpeed.exe	CDSpeed.exe	"Added by the IRCBOT.AEX BACKDOOR!"
N	CFD	CFD.exe	"BroadJump Client Foundation. Broadband troubleshooting software installed by various companies. Not required and you can remove it via Add/Remove programs"
U	cFosSpeed	cFosSpeed.exe	"cFos Software Internet acceleration program related. Note - may be necessary for the software to work properly"
X	Cftmon32	afd.exe	"Added by the AUTORUN-AUB WORM! The ""afd.exe"" file is located in %Windir%"
X	Cftmon32	afd.exe	"Added by the SCAR.AYWK TROJAN! The ""afd.exe"" file is located in %AppData%"
X	Chinagnq	vasdd.exe	"Added by the SDBOT-SE WORM!"
X	ClickTheButton	cd_load.exe	"Added by the DOWNLOADER-MY TROJAN!"
U	Client Access API Daemon	cwbappcd.exe	"IBM iSeries Client Access
X	clipboard.exe	clipboard.exe	Added by an unidentified WORM or TROJAN!
X	ClipSrv	CLIPBRD3D.EXE	"Added by the MOFEI-D WORM!"
X	CLSID	sed.exe	Adult content dialler
?	CM-SmWizard	SmWizard.exe	"SmartWizard MFC Application - associated with C-Media who produce audio chipsets commonly used for on-board sound on motherboards. What does it do and is it required?"
X	CmeUPD	CMEupd.exe	"Part of Gator advertising spyware - see here for removal instructions. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	Codename Dashboard	dashboard.exe	"Codename: Dashboard - "an application that resides at the side of your screen. Built on the Microsoft .NET Framework
X	COMMAND	command.exe	"Added by the QQPASS.E TROJAN!"
N	Compaq Internet Setup	inetwizard.exe	For Compaq PC's. Runs Compaq internet setup wizard and offers you to signup from ISP list
X	Compaq Service Drivers	wincmd.exe	"Added by the RBOT.ATV WORM!"
N	COMSMDEXE	comsmd.exe	3Com tray icon
X	Configuration Loaded	wupdated.exe	"Added by the MOEGA or MOEGA.AG or MOEGA.AP WORMS!"
X	Configuration Loader	cvcd.exe	"Added by the AGOBOT-DH BACKDOOR!"
X	Control handler	[10 to 14 random char]THD.EXE	"Added by the KREPPER-AI TROJAN!"
U	Copperhead	razerhid.exe	"Razer Copperhead gaming mouse driver - required if you use the additional features and programmed keys/macros"
X	Core System Hardware	syscorehd.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
Y	CPD_EXE	CPD.EXE	Firewall bundled with McAfee VirusScan 6.*
X	CPU Temp Control	wuitgurd.exe	"Added by the RBOT-AHV WORM!"
N	CreateCD	Createcd.exe	Adaptec Easy CD Creator system tray application (pre version 5). Available via Start -> Programs
?	CreativeTaskScheduler	CTSched.exe	"Creative Task Scheduler. What does it do and is it required?"
N	CriticalUpdate	Wucrtupd.exe	"MS Windows Critical Update Notification. If you want to keep Windows up-to-date
X	CriticalUpdate	wucrtupd.exe	"Added by the NOALA.B WORM! Note - this file is located in the Windows or Winnt folder
?	Crystal 3D Audio Control	CWD3DSND.EXE	"Crystal 3D Audio sound driver. Is it required?"
X	CSCRS Value Check	MsPMSPSd.exe	"Added by a variant of the SDBOT WORM!"
X	CT Control Settings	CTSVCCD.EXE	"Added by the RBOT-YS WORM!"
X	CTF Device Loader	ctfmond.exe	"Added by the AGOBOT-FO WORM!"
?	CTSched	CTSched.exe	"Creative Task Scheduler. What does it do and is it required?"
Y	CVPND	cvpnd.exe	Sub-system used by Cisco VPN client for making a connection to a remote IPSec server
X	cximddl	ldfrmmd.exe	"Added by the BUZUS.CQMU TROJAN!"
X	CyDoor	CD_Load.exe	"Adware. Check here for information about Cy-Door and here for a program that can remove it"
X	CydoorUpdate	CD_Load.exe	"Adware. Check here for information about Cy-Door and here for a program that can remove it"
X	D SYSTEM	dd.exe	"Added by the MYTOB-FN WORM!"
X	dasxdads	fsdqd.exe	"Added by the GAOBOT.BIQ WORM!"
X	DATABASE MySql	[path] repcale.exe [path] beird.exe	"Added by the RANDON-AL WORM! Both files are often located in %System%\qsws"
U	ddoctorv2	sprtcmd.exe /P ddoctorv2	"Comcast Desktop Doctor (provided by SupportSoft
X	DealHelperDown	download.exe	"DealHelper adware"
U	DeathAdder	razerhid.exe	"Razer DeathAdder gaming mouse driver - required if you use the additional features and programmed keys/macros"
X	Deewoo	ncntnkwd.exe	Identified as a variant of the AdWare.Win32.ZenoSearch.am malware
U	DellSupportCenter	sprtcmd.exe /P DellSupportCenter	"Dell Support Center (provided by SupportSoft
U	DellTouch	MMKeybd.exe	Dell multimedia keyboard manager. Required if you use the additional keys
X	Device Hardware	devicehnd.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	DfqwSfS	ffsqsd.exe	"Added by the SDBOT-SH WORM!"
U	dguard	dguard.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
U	Dialer Detect	dd.exe	"DialerDetect detects stealth installed premium rate diallers
U	Diamondback	razerhid.exe	"Razer Diamondback 3G gaming mouse driver - required if you use the additional features and programmed keys/macros"
X	DigiD	DigitalSound.exe	Adware downloader
N	DigitalWizard	ISWizard.exe	"InstallShield's DigitalWizard - free
X	Diomacd	fdafbfd.exe	"Added by the MULDROP.F TROJAN!"
X	Direct X Direct3D	dxd3d.exe	"Added by a variant of the SDBOT WORM!"
X	direct3d.exe	direct3d.exe	"Added by the CERTIF-F TROJAN!"
N	DirectCD	DirectCD.exe	DirectCD primarily allows you to drag and drop files onto a suitably formatted CD-RW disc. Unless you use this on a frequent basis it isn't required and is available via Start -> Programs. Start the program before inserting a DirectCD formatted CD-RW in the drive. A re-boot is recommended if you close Adaptec DirectCD before re-opening it again later
X	directx	NTCmd.exe	"Added by the SDBOT.D TROJAN!"
X	directx	PipeCmd.exe	"Added by the SDBOT.D TROJAN!"
X	DirectX9	direct3d.exe	"Added by the AGENT.EAK TROJAN!"
X	DiskCheck	msdarkend.exe	Added by an unidentified WORM or TROJAN!
X	Doggy Style	MsPMSPSd.exe	"Added by the SDBOT-AAP WORM!"
U	DoubleDesktop	dd.exe	"""DoubleDesktop is a smart and elegant system tray utility that effectively doubles the width of your Windows desktop"""
X	Dr. Guard	drguard.exe	"Dr. Guard rogue security software - not recommended
X	DRam prosessor	plscd.exe	"Added by the RBOT.CYA WORM!"
?	dried.exe	dried.exe	"??"
U	DriveLED	OODLed.exe	"O&O DriveLED - hard disk monitoring and crash prevention"
X	DRM Upgrade	drmupgd.exe	"Added by the IRCBOT.AWU BACKDOOR!"
X	drocher	d.exe	Adult content dialler
Y	Drwebscheduler	Drwebscd.exe	"DrWeb antivirus related - scheduler that allows you to manage an automatic launch of applications
X	DVAScvssdfa	AsSDdwd.exe	"Added by the LIOTEN.IP TROJAN!"
X	DVD Upgrade	dvdupgd.exe	"Added by a variant of the IRCBOT BACKDOOR!"
N	DVDUpgrade	DVDUpgrd.exe	"Microsoft program to upgrade your DVD decoder program - see Q306331. Available via Start -> Programs"
X	DW_Start	rwwnw64d.exe	Identified as a variant of the AdWare.Win32.ZenoSearch.am malware
X	dxvid	dxvid.exe	"Added by the DLUCA-Y TROJAN!"
X	E-Card	ecard.exe	"Added by the YODI WORM!"
X	Eac Download	download.exe	"Webcelerator from eAcceleration speeds your Web browsing by both remembering where you have been and anticipating where you will go. Only needed if you find it improves web browsing. Now no longer available and supported and when available was classed as spyware - see here"
N	EAPCISETUP	wizard.exe	Part of the Creative Sounblaster PIC Installation Wizard. Probably left as a result of a failed installation
U	eBoard	Eboard.exe	eMachines multimedia keyboard manager. Required if you use the extra keys
N	eBot	DownloadWizard.exe	"eBot from Digital River - ""helps ensure your computer always has the latest technology
X	editpad	editpad.exe	"Added by the CONSPER-B TROJAN!"
U	Edwizard	Edwizard.exe	"SafeGuard Easy - ""provides total company-wide protection for sensitive information on laptops and workstations. Boot protection
U	eFax 4.1	J2GDllCmd.exe	"DLL Command Utility for version 4.1 of eFax Messenger from j2 Global Communications
U	eFax 4.2	J2GDllCmd.exe	"DLL Command Utility for version 4.2 of eFax Messenger from j2 Global Communications
U	eFax 4.3	J2GDllCmd.exe	"DLL Command Utility for version 4.3 of eFax Messenger from j2 Global Communications
U	eFax 4.4	J2GDllCmd.exe	"DLL Command Utility for version 4.4 of eFax Messenger from j2 Global Communications
U	eFax DllCmd	J2GDllCmd.exe	"DLL Command Utility for eFax Messenger from j2 Global Communications
U	eFax DllCmd 3.5	J2GDllCmd.exe	"DLL Command Utility for version 3.5 of eFax Messenger from j2 Global Communications
U	eFax DllCmd 4.0	J2GDllCmd.exe	"DLL Command Utility for version 4.0 of eFax Messenger from j2 Global Communications
U	eFax Live Menu 3.3	J2GDllCmd.exe	"DLL Command Utility for version 3.3 of eFax Messenger from j2 Global Communications
X	ehSched	ehSched.exe	"Added by the SDBOT-DHF WORM!"
U	eMachines eBoard	Eboard.exe	eMachines multimedia keyboard manager. Required if you use the extra keys
Y	Emsisoft Anti-Malware	a2guard.exe	"System Tray access to and Anti-Malware Guard feature of Emsisoft Anti-Malware from Emsi Software GmbH - which provides ""comprehensive PC protection against viruses
N	Encarta Dictionary Quickshelf	QSHLFED.EXE	"Provides quick access to Encarta's Dictionary features?"
?	ENCSurf	surfboard.exe	"??"
X	ErrorGuard	ErrorGuard.exe	"ErrorGuard rogue spyware remover - not recommended
?	ESS Daemon	Essd.exe	"Related to an ESS based soundacard. Is it required?"
?	eSupInit	eSupCmd.exe	"Related to SupportSoft (aka Support.com) ""Real-Time Service Management software"". What does it do and is it required?"
N	Event Reminder	pmremind.exe	"Event reminder for calendar dates
X	explord.exe	explord.exe	"Added by the DLOADR-AYW TROJAN!"
X	eZmmod	mmod.exe	"eZula TopText adware"
X	ezula	eZmmod.exe	"eZula TopText adware"
X	FDD SYSTEM	Fdd.exe	"Added by the MYTOB-FO WORM!"
U	FD_SAP	FD.exe	Reported to be the autopassword program from the Sony Microvault thumb drive
X	File-Sharing Wizard	shwizard.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
U	Filterguard	Filtrgrd.exe	"An icon located in the lower left of the screen and looks like a lifesaver. This icon is a ""short-cut"" to access the basic features of SOS-Guardian
X	Find	find.exe	"Added by the OPANKI WORM!"
Y	FirePod	FIREPOD.EXE	"Driver for the PreSonus FP10 (formerly FirePod) Firewire recording system"
X	Firewall Administrating	infocard.exe	"Added by the AUTORUN-AYV WORM! Note - this is not the valid InfoCard Service which is part of the .NET Framework from Microsoft and uses the same filename"
N	FJUPDNV_Chitose	fjdvrupd.exe	Driver update for a Fujitsu Siemens Lifebook laptop
X	FlashGuard	FlashGuard.exe	"Added by the AUTOIT.AL WORM!"
U	Flexicd	Flexicd.exe	"CD player - part of the Win95 Power Toys"
U	FLMK08KB	MMKEYBD.EXE	Multimedia keyboard manager. Required if you use the additional keys
N	Forget Me Not	AGRemind.exe	"Calendar reminder part of Broderbund's American Greetings® CreataCard®"
X	foxdh	foxdhend.exe	"Added by the MENGHUAN TROJAN!"
?	FPWGMWZD	FPWGMWZD.exe	"??"
X	Framework module library	infocard.exe	"Added by the BUZUS.AYX TROJAN!"
U	FRISK FP-Scheduler	F-Sched.exe	"Scheduler for F-Prot anitvirus software. Leave enabled unless you scan manually on a regular basis"
Y	fspr	FolderShield.exe	"Folder Shield - hide personal files and folders"
U	Ftpqueue	Ftpsched.exe	"Part of WS_FTP Pro from Ipswitch. Queueing facility for scheduling FTP transfers"
X	gcasServ	realsched.exe	"Added by a variant of the TACTSLAY.A TROJAN! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name"
U	Getting started with MacDrive	MDGetStarted.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
N	Greetings Workshop	GWREMIND.EXE	You really want to be reminded about somebody's birthday at the expense of resources?
U	Guard	Guard.exe	"Related to Phoenix Technologies Core Managed Environment (cME) Integration and Certification program"
U	Habu	razerhid.exe	"Microsoft Habu (by Razer) gaming mouse driver - required if you use the additional features and programmed keys/macros"
X	Hardware Shell Detection	WinHSD.exe	"Added by a variant of the RBOT WORM!"
U	Hawking Wireless Utility	HWU8DD.exe	"Wireless management utility for the HWU8DD Hi-Gain™ USB Wireless-G Dish Adapter from Hawking Technologies
U	hcenter	tgcmd.exe	"Part of software from SupportSoft (aka Support.com) provided to manufacturers and ISPs that allows them to offer on-line support - to update drivers
U	HDDControlGuard	HDDControlGuard.exe	"Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access"
U	HDDControlGuard.exe	HDDControlGuard.exe	"Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access"
U	HelpCenter	sprtcmd.exe /P HelpCenter	"Self-help support tool for BellSouth's FastAccess® DSL (now owned by AT&T) broadband service (provided by SupportSoft
U	HelpCenter4.1	sprtcmd.exe /P HelpCenter4.1	"Self-help support tool for BellSouth's FastAccess® DSL (now owned by AT&T) broadband service (provided by SupportSoft
X	HELPER	new_zealand.exe	"AsdPlug premium rate adult content dialer variant"
X	Hid.exe	hid.exe	"Added by the RATSOU.B TROJAN!"
U	hkcmd	hkcmd.exe	"Hot Key handler for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
Y	HorngTech4D	bally4d.exe	HorngTech 4D mouse driver
U	HotKeysCmds	hkcmd.exe	"Hot Key handler for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
U	HP Gaming Keyboard	razerhid.exe	HP VoodooDNA Gaming Keyboard (powered by Razer) driver - required if you use the additional features and programmed keys/macros
?	HP IDScheduler	HPIDSCHD.exe	"HP Instant Delivery Scheduler"
N	HP Internet Center	SURFBRD.EXE	Loads the HP Internet center surfboard on startup. HP Internet Center allows you to customize the multimedia keys on the fly without having to go the Control Panel --> Keyboards to change them
N	HP software update	HPWuSchd.exe	"HP software updates. If a shortcut doesn't exist
?	HP Status Server	hpboid.exe	"Copied during installation of HP Inkjet Printer Drivers in Win2K/XP. What does it do and is it required?"
X	hpcmd	cmd.exe	"Added by the ADCLICK-DS TROJAN!"
N	hpfsched	hpfsched.exe	HPFSCHED is a small TSR that will remind you to clean the cartridges in your DeskJet from time to time in order to keep print quality high. It can be removed from the run line in win.ini if you do not want that feature
N	hpgs2wnd	hpgs2wnd.exe	"Share-to-Web - HP-created software and Internet-based application that enables easy uploading and sharing of photos via affiliated photo-sharing Web sites. Available via Start → Programs"
U	HpMmKbd	HpMmKbd.exe	HP's multimedia keyboard driver which enables the end-user to use the automation features of the HP multimedia keyboard
U	HPSCANMonitor	hpsjvxd.exe	HP scanning software that enables you to scan images from your scanner. Needed if you're using the scanner
X	Hvid	Hvid.exe	"Added by the GEMA TROJAN!"
U	HydraMD	HydraMD.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is HYDRAVISION MultiDesk - which ""creates
U	HydraVisionViewPort	HydraMD.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is HYDRAVISION MultiDesk - which ""creates
U	IBWin Background process	IBackground.exe	"IBackup for Windows"
N	Iconoid	Iconoid.exe	"Iconoid is a desktop icon manager"
X	IEDriver	TD.exe	"IeDriver adware variant"
U	igfxhkcmd	hkcmd.exe	"Hot Key handler for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
X	IMAPI	load.exe	"Added by the DOWNDEL-A TROJAN!"
X	ImMsn	timed.exe	"Added by the WEBDOR.AK TROJAN!"
Y	InCD	incd.exe	"Ahead InCD packet writing software - similar to DirectCD. For Nero 5.0 or 5.5 (InCD3)
X	Installs SP4	[path] repcale.exe [path] p0rd.exe	"Added by the RANDON-AK WORM! Both files are located in %System%\ekrlgc"
U	Intel(R) Common User Interface	hkcmd.exe	"Hot Key handler for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
U	Internet Call Director	ICD.EXE	"TELUS Internet Call Director (ICD) provides Internet users with real-time call notification while connected to the Internet"
X	InternetShield	InternetShield.exe	"InternetShield rogue security software - not recommended
?	IPHSend	IPHSend.exe	"AOL related. What does it do and is it required?"
X	irassync	irasyncd.exe	"IRASSync adware"
X	irssyncd	irssyncd.exe	"SafeSurfing adware variant"
U	iShield	iShield.exe	"""GuardWare iShield blocks pornographic images when you surf the Internet on your computer using a web browser"""
X	Jammer2nd	Jammer2nd.exe	"Added by the NETSKY.Z WORM!"
X	Java Runtime Environment	jbuild.exe	"Added by the DELBOT-J WORM!"
N	Java(TM) Platform SE 6	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
N	Java(TM) Platform SE 6 U*	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now. U* represents the update version
N	Java(TM) Platform SE Auto Updater 2 0	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
X	johkjh	srvd.exe	"Added by a variant of the SLAPER TROJAN!"
U	Jomantha	razerhid.exe	"Belkin n52te (powered by Razer) gaming keypad driver - required if you use the additional features and programmed keys/macros"
X	jpupd	jpupd.exe	"Added by the DIALER.CM TROJAN!"
N	jusched	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
X	jusched	jusched.exe	"Added by the BANKER-BOV TROJAN! Note that this is not the legitimate Sun Microsystems file (of the same name) which is usually located in %Program Files%\Java\version number\bin. This one is located in %System%"
U	Karen's Once-A-Day II	PTOAD.exe	"""Have a job that should be run exactly once each day? Karen's Once-A-Day II is just what you need!"" Scheduler that lets you specify progams
X	Kaspersky Email Security	javaupd.exe	"Added by the SWARLEY.A WORM!"
U	KBD	KBD.EXE	Multimedia keyboard manager. Required if you use the multimedia keys
X	Key1	Rlid.exe	"Added by the LIXY TROJAN!"
U	KeyBoard	Keyboard.exe	"
U	Keyboard Manager	MMKeybd.exe	Multimedia keyboard manager. Required if you use the additional keys
Y	Keyboard Preload Check	Preload.exe	Millenium Multi-Function Keyboard driver
N	Kodak Picture Easy . Batch Transfer	PezDownload.exe	"Part of ""Kodak Picture Easy"" software for digital cameras. Includes the display of an icon in the System Tray to quickly transfer photos to a PC. . represents the version"
U	Krait	razerhid.exe	"Razer Krait gaming mouse driver - required if you use the additional features and programmed keys/macros"
U	Krnlmod	Krnlmod.exe	Keystroke logger/monitoring program - remove unless you installed it yourself!
X	KV2005	word.EXE	"Added by the VB-IW TROJAN!"
X	KYK Control Settings	KYSVCXD.EXE	"Added by a variant of the RBOT WORM!"
U	Lachesis	razerhid.exe	"Razer Lachesis gaming mouse driver - required if you use the additional features and programmed keys/macros"
X	LanGuard	languard.exe	"Adware downloader - also detected as the SECONDT-C TROJAN!"
U	LapLink scheduler	Llsched.exe	Utility that automatically performs file transfers as unattended background operations
X	LAsIAf32	RePEAtLD.exe	"Added by the REPEATLD WORM!"
U	Launchboard	lnchbrd.exe	""LaunchBoard software from Darwin turns your keyboard into a remote control for the Internet and your computer! With LaunchBoard 2.0
X	ld	ld.exe	"CoolWebSearch Tooncomics parasite affiliate variant - redirects to fastwebfinder.com"
?	live rdr	loadloud.exe	"??"
Y	LMSXXD	LMSXXD.exe	Driver for Xerox XD series printer/copiers
?	load=	WPSLOAD.EXE	"Windows printing system that comes with the setup for Canon BJC series on the manufacturer's disk"
Y	LoadBlackD	blackd.exe	"""Intrusion detection system"" of the BlackICE PC Protection (was Defender) firewall which loads independently of the ""user interface"" (BlackICE Utility). BlackICE was supported by IBM Internet Security Systems (formerly just ISS) when them acquired the NetworkICE parent but is no longer available. Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
U	LoadBtnHnd	BtnHnd.exe	Fujitsu Siemens Lifebook laptops have some buttons on the case that can be programmed to execute specified programs (like hotkeys). The buttons can also be used as a combination lock input
X	LoadManager	msload.exe	"Added by the OPASERV.T WORM!"
X	loads.exe	medload.exe	"Medload adware"
N	Logitech Vid	Vid.exe	"""Logitech Vid™ is the fast
X	LowRiskFileTypes	sysguard.exe	"Added by the FAKEAV-UY TROJAN!"
X	Lsass	woekd.exe	Added by an unidentified WORM or TROJAN!
X	LSASS Daemon	LSASSd.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
U	LUGuard	LUGuard.exe	"PC-Duo Remote Control enables your help desk technicians to take instant control of any remote desktop PC at any location across the LAN
U	Lycosa	razerhid.exe	"Razer Lycosa gaming keyboard driver - required if you use the additional features and programmed keys/macros"
X	Macfee Security Patch	Mpfsheild.exe	"Added by the RBOT-NP WORM!"
Y	MAD.EXE	MAD.EXE	MAD.exe is the MS Exchange 5.5 System Attendant and can also consume a large amount of resources - resolved by the latest Exchange 5.5 Service Pack. Also part of Exchange 2000 Server but does it have the same problems?. Apparently you need to leave this running but is it needed at start-up?
U	MagicKeyboard	PreMKBD.exe	"Related to Samsung laptops. Provides ability to program keys to perform specific functions"
X	mahmud	mahmud.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X	Malware Destructor 2009	MD345d.exe	"Malware Destructor 2009 rogue security software - not recommended
X	Malware-Wiped	Malware-Wiped.exe	"MalwareWipe rogue security software variant - not recommended
X	MalwareWiped	MalwareWiped.exe	"MalwareWipe rogue security software variant - not recommended
X	Mcafee Auto Protect	mcafeshield.exe	"Added by the RBOT-UH WORM!"
Y	McAfee Firewall	CPD.EXE	Firewall bundled with McAfee VirusScan 6.*. Can also be listed as CPD_EXE
Y	McAfee VirusScan	mcvsshld.exe	"ActiveShield - background scanner for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online which scans files in the background as and when they are accessed
X	MCAFFE FLD LOADER	MCAFFEFLD.EXE	"Added by the RBOT-PY WORM!"
X	Mcaffee	mcsheild.exe	"Added by the RBOT-FDP WORM!"
Y	MCTskShd	mctskshd.exe	"Part of older versions of McAfee's internet security products such as VirusScan and VirusScan Online and used to schedule tasks such as automatic updates
Y	mcvsshld	mcvsshld.exe	"ActiveShield - background scanner for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online which scans files in the background as and when they are accessed
X	MD IE Plugin	md.exe	"Marketdart spyware"
U	MDGetStarted	MDGetStarted.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
U	MDGetStarted.exe	MDGetStarted.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
X	Media service	notpad.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
U	Mediafour MacDrive	MDGetStarted.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
U	MEDIC	sprtcmd.exe /P MEDIC	"Self-help support tool for an unidentified high-speed internet provider (provided by SupportSoft
U	medicsp2	sprtcmd.exe /P medicsp2	"Self-help support tool for an unidentified high-speed internet provider (provided by SupportSoft
X	melg34	mdmd.exe	"Added by an unidentified WORM or TROJAN - see here"
X	melg3445	mdmdd.exe	"Added by a variant of the RBOT WORM!"
U	MemoryCardManager	MemCard.exe	"Memory Card Manager - for removable memory cards found on Dell or Lexmark photo printers"
X	MEMreaload	MEMreaload.exe	"Added by the LAZAR TROJAN!"
X	MicroedSoft Toolbar	Smoked.exe	"Added by the RBOT-ALN WORM!"
X	MICROSFT ANTIVIRUS UPDATE SUPPORT	MSGUPDATED.EXE	"Added by the RBOT-APZ WORM!"
X	Microsft Remote Procedure Daemon	msrpcd.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft	guard.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Command Line	wincmd.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft DirectX	PDSched.exe	"Added by the SDBOT.CN WORM!"
X	Microsoft DirectX	wuamgrd.exe	"Added by the SDBOT.MY WORM!"
X	Microsoft DLL Verifier	winavguard.exe	Added by the SDBOT.AAD WORM!
N	Microsoft Greetings Reminders	MHPRMIND.EXE	Microsoft Home Publishing greetings reminder
N	Microsoft Greetings Workshop Reminder	Gwremind.exe	You really want to be reminded about somebody's birthday at the expense of resources?
X	Microsoft media services	Iassd.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft messenger sd	msngersd.exe	Added by an unidentified TROJAN!
X	Microsoft NotePad	notepad.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Restore	scrgrd.exe	"Added by the SPYBOT.BR WORM!"
X	Microsoft Security Monitor Process	msword.exe	"Added by the VIRUT.P VIRUS!"
X	Microsoft Security Monitor Process	word.exe	"Added by the EGGDROP.DC BACKDOOR!"
X	Microsoft Server Application	Sound.exe	"Added by the RBOT-NE WORM!"
X	Microsoft Sound Technology	winsound.exe	"Added by the RBOT-AGG WORM!"
X	Microsoft Synchronization Manager	asgard.exe	"Added by the SDBOT-AEA WORM!"
X	Microsoft Taskmanager Updater	keyboard.exe	"Added by the RBOT-ALU WORM!"
X	Microsoft Update	mssmgrd.exe	"Added by the SDBOT.JT WORM!"
X	Microsoft Update	muamgrd.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update	navmgrd.exe	"Added by the SDBOT.DP TROJAN!"
X	Microsoft Update	wuamgrd.exe	"Added by the RBOT-LK WORM!"
X	Microsoft Update	wuagrd.exe	"Added by the RBOT-FK WORM!"
X	Microsoft Update	wauguard.exe	"Added by the RBOT.AEE WORM!"
X	Microsoft Update	wumgrd.exe	"Added by the SDBOT-KY WORM!"
X	Microsoft Update	wuampd.exe	"Added by the RBOT-UT WORM!"
X	Microsoft Update	wuampkd.exe	"Added by the SDBOT.BBX WORM!"
X	Microsoft Update	wuagmsd.exe	"Added by the RBOT-AX WORM!"
X	Microsoft Update	wangard.exe	"Added by the RBOT-LH WORM!"
X	MICROSOFT UPDATE	WUAGTRD.EXE	"Added by the RBOT-CJ WORM!"
X	Microsoft Update Machine	wuamgd.exe	"Added by the SDBOT.HQ WORM!"
X	Microsoft Update Machine	wuamgrd.exe	"Added by the RBOT-HE WORM!"
X	Microsoft Update Machine	wuagrd.exe	"Added by the RBOT-GF WORM!"
X	Microsoft Update Machine	wuamgard.exe	"Added by the SPYBOT.CS WORM!"
X	Microsoft Updates	wuamgrd.exe	"Added by the RBOT-CO WORM!"
X	Microsoft Updates	wgcptsud.exe	"Added by the RBOT-GTF WORM!"
X	Microsoft UpdateS Machine	wgrd.exe	"Added by the RBOT-FI WORM!"
X	Microsoft Updating	navguard.exe	"Added by the RBOT.HW WORM!"
X	Microsoft Windows Keyboard service	keyboard.exe	"Added by the RBOT-CRF WORM!"
X	Microsoft Windows Updater	win32upd.exe	"Added by the RBOT-EC WORM!"
X	Microsoft World Service	winworld.exe	Added by an unidentified IRC worm with backdoor capability!
X	Microsoft-Update	wngard.exe	"Added by the RBOT-JV WORM!"
X	MicrosoftCorp	securebind.exe	"Added by the INJECT TROJAN!"
X	MicrosoftNAPC	securebind.exe	"Added by the INJECT TROJAN!"
X	Microsofts media	winmplayd.exe	Added by an undidentified WORM or TROJAN!
X	MicrosoftUpdates	syshelped.exe	"Added by the FORBOT-AZ WORM!"
X	Microsoftvirus	sysoverload.exe	"Added by the FORBOT-AL WORM!"
X	Miosf Update	wimsqaad.exe	"Added by the SDBOT.AG TROJAN!"
X	Mircosoft Update	wuampkd.exe	"Added by a variant of the SDBOT WORM!"
U	MMKeybd	MMKeybd.exe	Multimedia keyboard manager. Required if you use the additional keys
X	mmod	mmod.exe	"eZula TopText adware"
N	Mouse Suite 98 Daemon	pelmiced.exe	Mouse driver. Appears to cause a behaviour where the desktop suddenly flips back up when playing DirectX associated games
X	mousepad	mousepad.exe	"Added by the CLICKER TROJAN!"
X	Ms Builders	Wupated.exe	"Added by the AGOBOT-SS WORM!"
X	MS PLUS INC	wpad.exe	"Added by the MYTOB-AN WORM!"
X	MS Unix Binary	WinGuard.exe	"Added by the RBOT-ACL WORM!"
X	MS Updates	aupd.exe	Spyware web downloader
X	MS Windows Update	scguard.exe	"Added by the RBOT-YZ WORM!"
X	Msfind	Msfind.exe	"CoolWebSearch parasite variant"
X	Msg Fixage	msgfixed.exe	"Added by the SDBOT.ZD WORM!"
X	msjava service	xpcd.exe	"Added by the SDBOT.VM WORM!"
X	MSMessnger	msnupd.exe	"Added by the RBOT-ADY WORM!"
X	MSN	msscomd.exe	"Added by a variant of the SPYBOT WORM! See here"
X	MSN Messenger 6.2	tyd.exe	"Added by a variant of the RBOT WORM!"
X	Msn Service	raloded.exe	"Added by the MYTOB-DY WORM!"
X	MSNS PLUS XP2	msdupd.exe	"Added by the RBOT-BCE WORM!"
X	msnshed	msnshed.exe	"Added by the RBOT-YN WORM!"
X	MSOOBD	MSOOBD.EXE	"Added by the MAGISTR.A VIRUS!"
X	MsPrint32D	MsPrint32D.exe	"Added by the WINKO.AO WORM!"
U	MSRegScan	YEKPND.exe	"EyeCandy Computer Monitor surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	YKPND.exe	"YKPMD surveillance software. Uninstall this software unless you put it there yourself"
X	MSService_v1.0	realsched.exe	"EHU adware. Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name"
X	Msshield.exe	Msshield.exe	"Added by a variant of the IRCBOT TROJAN!"
X	MSStartOptimizer	WINUPD.EXE	"Added by the DASMIN-E TROJAN!"
X	msupd	msupd.exe	"Added by the IEACCESS DIALER!"
X	MSUpdate	wupd.exe	"Added by the ALADINZ.M TROJAN!"
X	MSUpdateDevKit	axfd.exe	"Added by the SDBOT-ZD WORM!"
X	msvccc66	dload.exe	"Added by a variant of the RBOT WORM!"
X	MSVXD	MSVXD.EXE	"Added by the DATOM.A WORM!"
X	MSWinupd	winupd.exe	"Added by the DLOADER-YE or DLOADR-AAA or DLOADER-ZF TROJANS - and others"
X	msword	msword.exe	"Added by the RBOT-ADR WORM!"
X	MSWorld	msworld.exe	"Added by the AGENT.DED TROJAN!"
U	Multimedia KBD	MMKeybd.exe	Multimedia keyboard manager. Required if you use the additional keys
U	MULTIMEDIA KEYBOARD	MMKeybd.exe	Multimedia keyboard manager. Required if you use the additional keys
X	MyAV	avpguard.exe	"Added by the NETSKY.J WORM!"
X	nah_Shell	nah_cord.exe	"Added by the HANAMBOT TROJAN!"
X	NAV Auto Update	iamsad.exe	"Added by the SPYBOT-CE BACKDOOR!"
X	Navegate	wisterd.exe	"Added by the BANKER-BOS TROJAN!"
N	NB Windows Patterns	WINDBKGND.EXE	"Part of McAfee Nuts & Bolts. With Background Patterns
X	NBT System alias	[path] repcale.exe [path] beird.exe	"Added by a variant of the RANDON.AN WORM!"
?	nbustrce1D	nbustrce1D.exe	"Device driver
X	NC1565	winntsrv -l -p10001 -d -e cmd.exe -L	"Added by the NEWLEY-A WORM!"
N	NCD	ncd.exe	Norton Change Directory - from the DOS days that allows the user to change directories on their machine without typing the complete path
N	Nero DriveSpeed	DRIVESPEED.EXE	"Ahead Nero DriveSpeed - set the CD reading speed of a CD/DVD drive on-the-fly to reduce the noise on high-speed drives"
U	Net Activity Diagram	nad.exe	"Net Activity Diagram from MetaProducts. Monitors your computer internet activity. Available via Start -> Programs"
U	Net iD	iid.exe	"""With the Net_iD program
X	NetDy	VisualGuard.exe	"Added by the NETSKY.N or NETSKY.W WORMS!"
U	NetGuard	NetGuard.exe	FBM Software ZeroSpyware 2004 spyware detector and remover - real time monitor
X	Network Protocol Service	wuamgrd.exe	"Added by the RBOT.EA WORM!"
X	Netzip Smart Downloader	npnzdad.exe	Advertising spyware
N	NewsUpd	newsupd.exe	"For Creative Soundblaster Live! series soundcards. System tray application for News updates. Available via Start -> Programs. Also spyware - see here."
X	NLS Keyboard	keyboard.exe	"Added by a variant of the SPYBOT WORM!"
X	NLS MonBoard	NSBARD.EXE	"Added by the SPYBOT.T TROJAN!"
X	Noha	aasd.exe	"PurityScan adware"
?	Norton AV Preload	Premend.exe	"Norton Antivirus related. What does it do and is it required"
X	Notepad	ntoepad.exe	"Added by the DELBOT-AK WORM!"
X	Notepad lptt01	notepad.exe	"RapidBlaster variant (in a ""Notepad"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not Windows Notepad which has the same executable name"
X	Notepad ml097e	notepad.exe	"RapidBlaster variant (in a ""Notepad"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not Windows Notepad which has the same executable name"
X	notepad.exe	upx.exe	Added by a variant of the AGENT.AH TROJAN!
X	notepad.exe	msmsgs.exe	"Added by the ZLOB TROJAN and variants! Note - this particular msmsgs.exe file is located in %System% and should not be mistaken for the MSN Messenger file of the same name which is located in %Program Files%\Messenger"
X	notes	notepaad.exe	"Added by the RBOT.BME WORM!"
U	NovastorSchedulerd	SCHENGD.EXE	NovaStor NovaBACKUP Scheduler - back-up utility. If you don't have regularly scheduled back-ups you don't need it
X	NT MICROSOFT SVCD	ntvsvcd.exe	"Added by a variant of the RBOT WORM!"
X	ntsmod	ntsmod.exe	"Adware downloader/installer
U	nTuneCmd	nTuneCmd.exe	"Now part of NVIDIA System Tools under the ""Peformance"" tag. NVIDIA nTune is utilty for monitoring and modifying the settings (such as temperatures
X	ntvdmd	ntvdmd.exe	"Adware downloader - also detected as the DLOADER-YP TROJAN!"
U	NVIDIA nTune	nTuneCmd.exe	"Now part of NVIDIA System Tools under the ""Peformance"" tag. NVIDIA nTune is utilty for monitoring and modifying the settings (such as temperatures
X	NVIDIA Video drivers	video_32D.exe	"Added by the AGOBOT.KV WORM!"
X	NVIDIA Video drivers	video_32sD.exe	"Added by the RBOT-BB WORM!"
X	NvVideoCenter	NvVid.exe	"Added by the HAXDOOR-DO TROJAN!"
U	nxpclient	sprtcmd.exe /P nxpclient	"NetExpert - ""India's first ever automated Broadband care technology."" Identifies and automatically fixes typical problems that may occur with your high-speed internet service"
U	OmniHTTPd	ohttpd.exe	"OmniHTTPd web server from Omnicron"
U	On Screen Display	OSD.EXE	"By Netropa for HP and other brands. Same group as KBD MediaCenter & Touch Manager. Pressing a "hot key" on such a keyboard brings a corresponding panel on the screen for volume
?	online cdrom	Active acid.exe	"??"
X	OnlineGuard	OnlineGuard.exe	"OnlineGuard rogue security software - not recommended
X	OpenGL Drivers	0penGLD.exe	"Added by the YIMP-A WORM!"
X	OS Boot Load	bootload.exe	"Added by a variant of the IRCBOT TROJAN!"
X	OSA	winword.exe	"Added by the KANGAROO-A TROJAN!"
U	OSD	OSD.exe	"By Netropa for HP and other brands. Same group as KBD MediaCenter & Touch Manager. Pressing a "hot key" on such a keyboard brings a corresponding panel on the screen for volume
U	OsdMaestro	OSD.exe	"By Netropa for HP and other brands. Same group as KBD MediaCenter & Touch Manager. Pressing a ""hot key"" on such a keyboard brings a corresponding panel on the screen for volume
U	OsdMaestroOSD.exe	OSD.EXE	"By Netropa for HP and other brands. Same group as KBD MediaCenter & Touch Manager. Pressing a ""hot key"" on such a keyboard brings a corresponding panel on the screen for volume
N	Palo Alto Software Update Manager 8.0	PAS8_UD.exe	"Update manager for small business planning software from Palo Alto Software - such as Business Plan Pro
U	Panda Scheduler	pavsched.exe	"Scheduler for older versions of Panda Antivirus. Required if you have scans scheduled on a regular basis"
U	PandaScheduler	pavsched.exe	"Scheduler for older versions of Panda Antivirus. Required if you have scans scheduled on a regular basis"
X	Patches Value	WinGamed.exe	"Added by the SDBOT.BR WORM!"
Y	PCBG	PCBODYGUARD.EXE	"PC Bodyguard from Calluna - protects system files and settings from being deleted
Y	PCBODYGUARD	PCBODYGUARD.EXE	"PC Bodyguard from Calluna - protects system files and settings from being deleted
N	PCHealth	pchschd.exe	"This is a ""scheduler"" and does not turn off PC Health. For more information refer here"
U	pdfMachine dispatcher	mapisnd.exe	"pdfMachine Windows print driver"
X	personalguard	personalguard.exe	"Personal Guard 2009 rogue security software - not recommended
X	photo_id	photo_id.exe	"Added by the AGENT-LTF TROJAN! The file is located in %System%"
?	PLoader	umsd.exe	"USB Mass Storage Disk related tray icon. Is it required?"
U	Popup Defender	PD.exe	"
X	popuppers64	a64sddd.exe	"Popuppers adware
N	PowerDVD	PowerDVD.exe	"Launches Cyberlink's PowerDVD software and creates a system tray icon. If enabled
N	PP3100b	flatbed.exe	"Twain driver for the Visioneer PaperPort 3100b scanner that allows you to scan
U	PPHIDPAD	pphidpad.exe	"PenPower Chinese handwriting recognition software"
U	Praize Messenger	itLoad.exe	"Praize IM Christian chat instant messenger"
X	Prcgd	Prcgd.exe	"Added by the AUTORUN-BCJ WORM!"
X	PreInstall Windows	[path] repcale.exe [path] beird.exe	"Added by a variant of the RANDON.AN WORM! Both files are located in %System%\detr"
Y	Preload	Preload.exe	Millenium Multi-Function Keyboard driver
?	PreloadApp	hphprld.exe	"HP PhotoSmart printers related. What does it do and is it required?"
U	Primax 3D Mouse	3dmoused.exe	Enables the scroll button on the Primax 3-D Scroll mouse
N	Print Master Event Reminder	PMremind.exe	"Event reminder for calendar dates
U	PrivacyKeyboard	PrivacyKeyboard.exe	"PrivacyKeyboard is a product ""that can provide every computer with strong protection against ALL types of keylogging programs and keylogging hardware devices
N	ProdikeysAutorun	Prodload.exe	"Creative Prodikeys software - 'an interactive music entertainment device which not only functions as a full-featured
X	ProtocolEventTsk	csrwjd.exe	"Added by the STINX-N TROJAN!"
X	PSGuard	PSGuard.exe	"Variant of the SmitFraud alias FAKEALE-C TROJAN!"
X	PSGuard spyware remover	PSGuard.exe	"Variant of the SmitFraud alias FAKEALE-C TROJAN!"
U	PsMFCard	PsMFCard.exe	"Component of the Toshiba Controls. Provides power-saving functions for the PCMCIA slots. Through the Power Save Mode Properties dialogue
Y	PsPCCard	PsPCCard.EXE	Background Power Saving task found on Toshiba laptops and which handles turning Power Saving ON and OFF on any inserted PC Card (PCMCIA card). Only ever disable if you do not use any power saving or hibernation settings (ie: they are all OFF)
U	PsSound	PsSound.exe	"On a Toshiba laptop. Operates your sound in one of 4 modes
Y	QH Live Update Scheduler	UPSCHD.EXE	"Quick Heal Anti-Virus"
U	QUICKCARE	sprtcmd.exe /P QUICKCARE	"Qwest Broadband QuickCare (provided by SupportSoft
U	QuickCare2.2	sprtcmd.exe /P QuickCare2.2	"Qwest Broadband QuickCare (provided by SupportSoft
N	QuickFinder Scheduler	QFSched.exe	Used in Corel 2002 & Corel Suite 7 - finds files faster by indexing your files (similar to Microsoft's Find Fast or Fast Search for its Office products)
N	QuikShield	qkshield.exe	"QuikShield popup blocker - reportedly stealth installed
U	razer	razerhid.exe	"Razer gaming mouse/keyboard driver - required if you use the additional features and programmed keys/macros"
U	RCScheduleCheck	RCSCHED.EXE	"Scheduler for VCOM's Recovery Commander - which ""can restore your non-booting system back to normal. It only takes a few minutes to get your system back up and running"""
X	Real player updater	realupd.exe	"Added by the PARLAY TROJAN!"
X	RealDownload Express	npnzdad.exe	Advertising spyware
X	Realplayer Codec Support	realsched.exe	"Added by the AGOBOT-AAD WORM! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name"
N	Realsched	realsched.exe	"Application Scheduler installed along with RealOne Player. Runs independently of RealOne Player
U	RealSPEED	RealSPEED.Exe	"RealSPEED - tweaking utility to speed-up your internet connection"
X	realtpsk	realsched.exe	"Chinese originated adware - detected by Panda as NewWeb. Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name and this file is located in %System%"
X	RealUpdater	realupd.exe	"Added by the PARLAY or MITGLIEDER.I TROJANS!"
Y	Recguard	recguard.exe	"On HP computers
U	Reclusa	razerhid.exe	"Microsoft Reclusa (by Razer) gaming keyboard driver - required if you use the additional features and programmed keys/macros"
X	reg1.reg	vuamgard.exe	"Added by a variant of the IRCBOT TROJAN!"
U	regdefend	regdefend.exe	"""RegDefend is a configurable
X	RegSrv64D	RegSrv64D.exE	"Added by the WINKO.AO WORM!"
X	Reload	reload.exe	"Added by the LAZAR TROJAN!"
X	Remndr	CsRemnd.exe	CasinoOnline foistware
X	Removed.exe	Removed.exe	GatorCheat - adware downloader
X	Rg2catbd	Rg2catbd.exe	Added by a variant of the BANLOAD family of TROJANS!
?	ROUTD	ROUTD.exe	"??"
X	run=	RAVMOND.exe	"Added by the LOVGATE-F WORM!"
Y	run=	wswpd.exe	"Used with some models of Panasonic
X	rundl332	math.exe ...pluged.exe	"Added by the DOOMJUICE WORM!"
X	RUNLOAD	l0ad.exe	"PurityScan/Clickspring adware"
X	RUNLOUD	loud.exe	"PurityScan/Clickspring adware"
X	RunSearvices	tread.exe	IESearchToolbar parasite. Identified by Ewido Security Suite (Ewido is now part of AVG Technologies) as the DELF.LF TROJAN!
X	Run_cd	Run_cd.exe	"Added by the GHOST.23 TROJAN!"
X	rxres32	ati2vid.exe	"Added by the RBOT-FL WORM!"
X	Safeguard.exe	Safeguard.exe	"Super Spyware Killer rogue spyware remover - not recommended"
X	Saggwwgg	CVAvwwd.exe	"Added by the LIOTEN.HT WORM!"
U	SaiMfd	SaiMfd.exe	"Saitek MFD File System Driver - associated with the Saitek SST (Saitek Smart Technolgy) configuration software for their game controllers. Create a shortcut and run manually when required"
U	Salmosa	razerhid.exe	"Razer Salmosa gaming mouse driver - required if you use the additional features and programmed keys/macros"
U	SATARaid	SATARaid.exe	RAID driver for serial ATA disks on some motherboards such as the DFI Lanparty range. Only loaded if one is using RAID support on SATA drives
X	Savasddwq	ffasd.exe	"Added by the SDBOT-SI WORM!"
N	ScrapPad	Scrappad.exe	"ScrapPad allows you to quickly and easily record notes
U	SDAutoLiveupdate	LiveUpdateSD.exe	"Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here"
X	sdchosts32	vbdd.exe	Added by the RANKY.AG TROJAN!
X	Security iGuard	Security iGuard.exe	"Security iGuard spyware remover - not recommended
X	Service Manager	dxsound.exe	"Added by the PROXY-GRIC TROJAN!"
X	Services	winread.exe	"Added by an unidentified VIRUS
X	Servicing	hostd.exe	"Added by the SDBOT.BUI WORM!"
X	SESync	sed.exe	"DownloadWare adware"
N	setup	hphprld.exe ....setup.exe	HP DeskJet Setup - printers function normally without it
N	Share-to-Web Namespace Daemon	hpgs2wnd.exe	"Share-to-Web - HP-created software and Internet-based application that enables easy uploading and sharing of photos via affiliated photo-sharing Web sites. Available via Start → Programs"
X	ShareSearcher	wsusupd.exe	"Added by the ENCLAG-A TROJAN!"
X	shccde	winssled.exe	"Added by the BUZUS.CQMU TROJAN!"
X	Shell Tray Window	ShellTraywnd.exe	"Added by the STULTDOR-A TROJAN!"
X	Shield Security	shield.exe	"Added by the RIZO.A TROJAN!"
X	Showbehind	SHOWBEHIND.EXE	"Advertisement display which can be stopped here"
U	ShowWnd	ShowWnd.exe	"Found on Gateway computers (and maybe others) - see here. ""Showwnd is included with the Chicony keyboard software and is used by the software to stop the keyboard driver's taskbar entry from reappearing. It is not necessary to remove the keyboard software
U	SightSpeed	SightSpeed.exe	"SightSpeed Video Chat - ""lets you connect with all your friends and family easily. Make video calls
U	SiSRaid	SRaid.exe	"Related to the SIS Raid system from Silicon Integrated Systems"
U	SiSSWLED	sisswled.exe	System Tray utility for SiS 900 network cards
X	sload	sload.exe	"Win SynchroAd adware
U	Smart Keyboard	Smartkbd.exe	Netropa Smart Keyboard driver
?	SmWizard	SmWizard.exe	"SmartWizard MFC Application - associated with C-Media who produce audio chipsets commonly used for on-board sound on motherboards. What does it do and is it required?"
N	snp2std	vsnp2std.exe	Digital camera related
?	snpstd	vsnpstd.exe	"Sonix PC Camera Monitor MFC Application. What does it do and is it required?"
X	SoftStronghold	SoftStronghold.exe	"SoftStronghold rogue security software - not recommended
X	Special Firewall Service	avguard.exe	"Added by the NETSKY.G WORM! Note - do not confuse with AntiVir® antivirus which uses the same filename. This one is located in %Windir%"
U	sprtcmd	sprtcmd.exe	"Self-help support tool for a number of high-speed internet providers and computer suppliers such as Comcast
U	Spybot-S&D	SpybotSD.exe	"Main program part of the popular Spybot - Search & Destroy spyware removal tool from Safer Networking Limited. A number of other options are available if this runs at start up (enabled under Mode → Advanced : Settings → Settings → Automation → System Start) - including autocheck
U	SpybotSD	SpybotSD.exe	"Main program part of the popular Spybot - Search & Destroy spyware removal tool from Safer Networking Limited. A number of other options are available if this runs at start up (enabled under Mode → Advanced : Settings → Settings → Automation → System Start) - including autocheck
U	SpybotSnD	SpybotSD.exe	"Main program part of the popular Spybot - Search & Destroy spyware removal tool from Safer Networking Limited. A number of other options are available if this runs at start up (enabled under Mode → Advanced : Settings → Settings → Automation → System Start) - including autocheck
X	SpyHazard	SpyHazard.exe	"SpyHazard rogue spyware remover - not recommended
X	SpyLocked	SpyLocked.exe	"Spylocked rogue spyware remover - not recommended
X	SpyRid	Spy-Rid.exe	"Spy-Rid rogue spyware remover - not recommended"
U	SpyWare Shield	Shield.exe	"Acronis Privacy Expert Spyware Shield prevents spyware and other suspicious programs from being installed on PCs"
X	spywareguard	spywareguard.exe	"Spyware Guard 2008 rogue spyware remover - not recommended
X	Spywareguard lptt01	Spywareguard.exe	"RapidBlaster variant (in a ""Spyguard"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Spywareguard ml097e	Spywareguard.exe	"RapidBlaster variant (in a ""Spyguard"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	SpywareLocked	SpywareLocked.exe	"Spylocked rogue spyware remover - not recommended
X	SpywareQuaked	SpywareQuaked.exe	"SpywareQuake 2.4 rogue spyware remover - not recommended
Y	SpywareTerminator	SpywareTerminatorShield.exe	"Spyware Terminator's real-time protection. Initially not recommended due to false positives but the later versions have since improved - see here"
X	sqlpdro	providd.exe	"Added by the AGENT-LXF TROJAN!"
N	SsAAD	SsAAD.exe	"Starts Sony's SonicStage CP digital music manager automatically when an ATRAC audio device is connected - such as a Walkman MP3 player or a PlayStation® Portable"
N	SsAAD.exe	SsAAD.exe	"Starts Sony's SonicStage CP digital music manager automatically when an ATRAC audio device is connected - such as a Walkman MP3 player or a PlayStation® Portable"
Y	Ssd	Std.exe	"Stealthdisk - file and folder hiding/locking utility"
X	Start aThx Roll	f0mered.exe	"Added by the RBOT.AAV WORM!"
X	Startup Configuration	wztoid.exe	"Added by the RBOT-ASD WORM!"
N	Status Monitor	BrMfcWnd.exe	Brother scanner status monitor - can be started manually
U	Sticky Pad	StickyPad.exe	"Sticky Pad from Green Eclipse. Place sticky notes on your desktop"
X	suck	l0ad.exe	"PurityScan adware"
N	SunJavaUpdateSched	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
X	SunJavaUpdateSched10	jushed.exe	"Added by the ACKANTTA.F WORM!"
X	SunJavaUpdateSched132	jschd.exe	"Added by the AUTORUN-AQY WORM!"
X	SunJavaUpdateSched16	jvshed.exe	"Added by the ACKANTTA.G WORM!"
U	Support.com Scheduler and Command Dispatcher	tgcmd.exe	"Part of software from SupportSoft (aka Support.com) provided to manufacturers and ISPs that allows them to offer on-line support - to update drivers
X	Svced	Svced.exe	"Added by the DELF.F TROJAN!"
X	Svshost Update Service	svcbind.exe	"Added by the MYTOB.LH WORM!"
U	SWd	winwd.exe	"PC Security™ from Tropical Software - ""is the ultimate in computer security
N	sXe Injected	sXe Injected.exe	"sXe Injected anti-cheat system client/server for Half-Life server based games that prevents cheat programs being loaded"
X	sysdxvid	sysdxvid.exe	"Added by the DLUCA-S TROJAN!"
X	sysguard	sysguard.exe	"Added by the FAKEAV-KI TROJAN!"
X	sysmod	sysmod.exe	"Added by the SPYBOT-DU WORM!"
X	SysR	sysmd.exe	"Ulubione adult content dialer"
X	SYSTEM	d.exe	"Added by the MYTOB.LP WORM!"
X	System	winupd.exe	"Added by a variant of the SDBOT WORM!"
X	System Document Application	nmod.exe	"Added by the SDBOT-ABB WORM!"
X	System Efficiency Monitor	mscommand.exe	"Added by the KWBOT.P WORM!"
X	System Guard	mhguard.exe	"Added by the RBOT-AGU WORM!"
U	System LifeGuard Scheduler	Slsched.exe	"System LifeGuard scheduler"
U	System Mechanic Startup Guard	StartupGuard.exe	"System Mechanic Startup Guard protects the Window's startup locations from being modified by viruses
X	System Net Database	sysnd.exe	"Added by the RBOT-AAW WORM!"
X	System Restore Data	[path] repcale.exe [path] beird.exe	"Added by the RANDON.AN WORM! Both files are located in %System%\frbyjed"
X	System Setup	rpcxcmod.exe	Added by an unidentified WORM or TROJAN!
X	system tool	sysguard.exe	"Antivirus System Pro rogue security software - not recommended
X	system23	notPad.exe	"Added by the ESTEEMS.D TROJAN!"
X	systemguard	systemguard.exe	"System Guard 2009 rogue security software - not recommended
X	SystemMD	md.exe	Homepage hijacker
X	Systems	itDDD.exe	"Added by the DLOADER-PP TROJAN!"
X	SystemTasks	loaded.exe	Adult content dialler
X	SystemTray	Windowsupd.exe	"Added by a variant of the IRCBOT TROJAN!"
N	SystemUpd	SystemUpd.exe	"Updater for Swapoo.com
X	SysUpd	Sysupd.exe	"VirtuMonde adware"
N	Tad	tad.exe	From Turtle Beach's Santa Cruz on a Dell WinME system. Not required - works fine without it including keyboard hot controls for volume and mute
U	TalkTalk	sprtcmd.exe /P TalkTalk	"Self-help support tool for TalkTalk Broadband users (provided by SupportSoft
U	Tarantula	razerhid.exe	"Razer Tarantula gaming keyboard driver - required if you use the additional features and programmed keys/macros"
X	Taskschd	TRAYWND.EXE	"Added by the LITMUS.002 TROJAN!"
U	tgcmd	tgcmd.exe	"Part of software from SupportSoft (aka Support.com) provided to manufacturers and ISPs that allows them to offer on-line support - to update drivers
U	tgcmdprovidersbc	tgcmd.exe	"Part of software from SupportSoft (aka Support.com) provided to manufacturers and ISPs that allows them to offer on-line support - to update drivers
N	The Assistant	eSched.exe	"Related to WinTotal from a la mode inc. FormFiller for appraisers"
X	The Spy Guard	spyguard.exe	"The SpyGuard rogue spyware remover - not recommended
X	TheDefend.exe	TheDefend.exe	"TheDefend rogue security software - not recommended
U	THGuard	TH_Guard.exe	"Resident memory scanning for TrojanHunter"
U	THGuard	THGuard.exe	"Resident memory scanning for TrojanHunter"
X	Timer	timed.exe	"Added by the BDOOR-LV BACKDOOR!"
X	tipguard.exe	tipguard.exe	"Privacy Commander rogue privacy program - not recommended
N	TkBell.Exe	realsched.exe	"Application Scheduler installed along with RealOne Player. Once installed
N	TkBellExe	realsched.exe	"Application Scheduler installed along with RealOne Player. Once installed
N	TOSCDSPD	toscdspd.exe	"Related to Toshiba laptop CD/DVD drivers. This is a non-essential process. Disabling or enabling this is down to user preference"
U	TotRecSched	TotRecSched.exe	"Scheduler for Total Recorder - allows automatic recording of a show at a given time for later playback or you can use the scheduler as an alarm"
U	Touch Manager	WinLED.exe	Dell keyboard utility. Disabling can result in loss of screen saver and power saver functionality
U	TouchED	TouchED.exe	TouchPad On/Off Utility on a Toshiba laptop
U	Transparent	TransparentD.exe	"Utility to turn desktop icon text backgrounds transparent. The last letter defines the icon text color: D= as desktop
U	Trashgrd	TRASHGRD.EXE	"Part of McAfee Nuts & Bolts. Protects all the files you delete
X	trend	trend.exe	"Added by the BANCOS-AZ TROJAN!"
U	Trojancheck 6 Guard	tcguard.exe	"TrojanCheck anti-trojan software"
U	TrueAssistant	TrueWizard.exe	"""TrueSwitch makes changing your Internet Service Provider easy. We copy all your personal data to the new account
N	tsnp2std	tsnp2std.exe	Digital camera related
X	TVMD	tvmd.exe	"Total Velocity - ""Secure commerce company that enables the 'checkout' process for our customers in order to safely and securely purchase our award winning software"". Autointsalling spyware"
X	TVTMD	TVTMD.EXE	"Total Velocity variant - autoinstalling spyware"
X	tymsetvc	osskhbd.exe	"Added by the MAILBOT-BW TROJAN!"
U	UD Agent	UD.EXE	The United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home but for medical research. Available via Start > Programs
X	Uninstall****	upd.exe	Adult content based screen saver where **** can be any number
X	Universal Plug & Play devices	WinUPPD.exe	Added by an unidentified WORM/TROJAN!
X	upd.exe	upd.exe	"Added by the DELF-AJW BACKDOOR!"
X	Update	Sysupd.exe	Added by the SLACKBOT VIRUS!
X	Update Explorer	iexploreupd.exe	"Added by a variant of the RBOT WORM!"
X	UpdateComponent	CNF UPD.EXE	Added by the SPYBOT.GEN VIRUS!
?	UpdateFW	fwdload.exe	"Appears to be firmware update software for a Network Associates ATMbook OC-3 SMF Interface Module?"
X	Upgrade Service	winupd.exe	"Added by the TOFGER-U TROJAN!"
Y	UPSentry 2000	upsd.exe	Used with Belkin UPS (Uninterruptable Power Supply) for support in the event of a power-loss
Y	UPSlim	upsd.exe	Used with Belkin UPS (Uninterruptable Power Supply) for support in the event of a power-loss
X	upxdnd	upxdnd.exe	"Added by the JD-A TROJAN!"
X	Usbd	usb_d.exe	"Added by the CIDRA-A TROJAN!"
U	USBMMKBD	usbmmkbd.exe	USB multimedia keyboard for HP systems. Allows the use of special function keys on USB keyboards. The latest version no longer pings a server when on-line wheras the older version did but did not transmit any user information
X	VasddwDg	zxXZwd.exe	"Added by the SDBOT-SN WORM!"
X	vcmicrec	msccsed.exe	"Added by the MAILBOT-CE TROJAN!"
N	Verizon Control Pad	cpad.exe	"Control Pad - installed with Verizon DSL accounts. Tool designed to streamline the online experience"
X	VGA Startup	vgacard.exe	"Added by a variant of the RBOT WORM!"
N	vid	Vid.exe	"""Logitech Vid™ is the fast
X	Video	explored.exe	"Added by the GAOBOT.RF WORM!"
X	Virtual CD v6	grplscd.exe	"Added by the RBOT-AXV WORM!"
X	Virus Shield 2009	VShield.exe	"Virus Shield 2009 rogue security software - not recommended
Y	VirusScan Online	mcvsshld.exe	"ActiveShield - background scanner for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online which scans files in the background as and when they are accessed
Y	VrProxyd	vrproxyd.exe	"Part of the HAURI ViRobot series of internet security products. HAURI's ViRobot engine is included in those used by VirusTotal
N	vTPass	vtpassld.exe	"Part of vTrails - a live media delivery solution. vTPass is the driver enabling the system to work. If unavailable via Start -> Programs
X	VxD Driver Initialization	ntsvxd.exe	"Added by the SDBOT-LW WORM!"
N	war-ftpd.exe	WAR-FTPD.EXE	"War FTP Daemon from JGAA's Internet - FTP client"
N	WARSVR	war-ftpd.exe	""War FTP Daemon - the original free FTP server for windows"""
X	WebSpyShield	WebSpyShield.exe	"WebSpyShield rogue security software - not recommended"
X	Whvlxd	Whvlxd.exe	"Added by the ZAPCHAS-CS TROJAN!"
X	Wifi Loader	wifiload.exe	"Added by the IRCBOT.XEL BACKDOOR!"
N	Willow Road	WillowRoad.exe	Willow Road Screen Saver
X	Win32 Console	cmd.exe	"Added by the ABI.C WORM! Note - this is not the legitimate cmd.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Win32 Debug Manager	microsoftupd.exe	"Added by the RBOT-GRJ WORM!"
X	Win32 Ms Auto Updater	AutomsUPD.exe	"Added by a variant of the RBOT WORM!"
X	Win32 USB2 Driver	sys32snd.exe	"Added by the FORBOT-AN WORM!"
X	win32servv	load.exe	"iSearch adware"
X	WIN3S2SNDS	winabsmod.exe	"Added by the AGENT.DN TROJAN - known to BOClean as ""CWS/INDEX""
X	win98 DNS	wingrd.exe	"Added by a variant of the RBOT WORM!"
X	Winad Client	Winad.exe	WinAd adware by eXact Advertising
X	WINAPLOGUPD	WINAPLOGUPD.EXE	"Added by the CAPSIDE-C WORM!"
U	WinBackup Scheduler	Wbsched.exe	"LIUtilities WinBackup scheduler - backup software"
X	Winbed	winbed.exe	Hijacker
X	Wind Logd File	servicelogd.exe	"Added by a variant of the RBOT WORM!"
X	wind.exe	wind.exe	"Added by the MITGLIEDER.BD TROJAN!"
X	Wind0ws	wordpad.exe	"Added by the AGOBOT-TL WORM! Note - this is not the legitimate Windows application wordpad.exe (which is found in the %ProgramFiles%\Accessories folder) which should not normally be seen in Msconfig or as a Startup item. This one is Located in %System%"
X	WinDLL (dlfksdld.exe)	"rundll32.exe dlfksdld.exe	start"
X	WinDLL (wchshield.exe)	"rundll32.exe wchshield.exe	start"
U	WindowBlinds	wbload.exe	"WindowBlinds from Stardock. Skin application to change the appearence on Windows desktops. Available as an individual download or as part of Object Desktop. Required to restore settings if you use it. Available via right-click on the Desktop -> Properties -> Skins"
U	WindowFX	wfxload.exe	"Stardock WindowFX - ""Allows you to add an unprecedented number of special effects to windows"""
X	Windows applications server	SysShield.exe	"Added by the unregistered version of Personal Anti Malware rogue security software - not recommended
X	Windows Audio	snd.exe	"Added by the ACKANTTA.C WORM!"
X	Windows Command	wincmd.exe	"Added by the RBOT.ANV WORM!"
X	Windows ControlAd	WinCtlAd.exe	Windupdates adware variant
X	Windows DNS Daemon	windnsd.exe	"Added by the WOOTBOT.AS WORM!"
X	Windows firewall manager	msguard.exe	"Added by a variant of the RANDEX.GEL WORM!"
X	Windows Guard	WAUMGRD.EXE	"Added by the RBOT-GY WORM!"
X	Windows JavaScript Daemon	Winjsd.exe	"Added by the WOOTBOT.AF WORM!"
X	Windows Keyboard Services	winkeyboard.exe	"Added by the IRCBOT.AFS WORM!"
X	Windows Keyboard Services	winkeybrd.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Live Messenger	msnd.exe	"Added by the BCKDR-QQQ BACKDOOR!"
X	Windows logging	winlogd.exe	"Added by the RBOT-ON WORM!"
X	Windows Login	explored.exe	"Added by the GAOBOT.SY WORM!"
X	Windows Management Instrumentation	mwd.exe	"Added by the GRAPS WORM!"
X	Windows Media Player 3.6d	wmpa36d.exe	"Added by the RBOT-YA WORM!"
X	Windows mod Verifier	Windows-mod.exe	"Added by the RBOT.DSU WORM!"
X	Windows modez Verifier	Wwuamguard.exe	"Added by the RBOT.EZJ WORM!"
X	Windows modez Verifier	wuamguard.exe	"Added by the RBOT.EZJ BACKDOOR!"
X	Windows NetStart Service2	winsN2SD.exe	"Added by a variant of the RBOT WORM!"
X	Windows Network Controller	Mqguard.exe	"Added by the FORBOT-CL WORM!"
X	Windows Network Controller	WinxPupd.exe	"Added by the FORBOT-DK WORM!"
X	Windows Performance Monitor	wmscupd.exe	"Added by the IRCBOT_GEN WORM!"
X	Windows Relay Service	ipcbind.exe	"Added by the DELFINJECT.F TROJAN!"
X	Windows Secure Update	load.exe	"Added by the FORBOT-GU WORM!"
X	WINDOWS SECURITY	wingrd.exe	"Added by a variant of the RBOT WORM!"
X	Windows ServeAd	WinServAd.exe	Windupdates adware variant
X	Windows service	wuamgrd.exe	"Added by the RBOT-QW WORM!"
X	Windows Service	dddd.exe	"Detected by Kaspersky as Dialer.Salc
X	Windows Service Agent	tjybssd.exe	"Added by the RBOT.XVD BACKDOOR!"
X	Windows Service Agent 32	mrthd.exe	"Added by the AGENT-GAQ TROJAN!"
X	Windows Sound Manager	sound.exe	"Added by the AGOBOT-CD WORM!"
X	Windows Subsys	winload.exe	"Added by the NETSPREE.C WORM!"
X	Windows SyncroAd	SyncroAd.exe	Windupdates adware variant
X	WINDOWS SYSTEM FILE	winload.exe	"Added by the MYTOB.DK WORM!"
X	Windows TaskAd	Wintaskad.exe	Windupdates adware variant
X	Windows UDP Control Center	ehSched.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	msnpd.exe	"Added by the SDBOT.EBA BACKDOOR!"
X	Windows Update	Wuamgrd.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Update	winmguard.exe	"Added by the RBOT-EM WORM!"
X	Windows Update	wuampd.exe	"Added by the RBOT.UM WORM!"
X	Windows Update	Winload.exe	"Added by the DEDMIR-A WORM!"
X	Windows Update	explored.exe	"Added by the GAOBOT.MF WORM!"
X	Windows USB Printer	unqgod.exe	"Added by the RBOT.BKC BACKDOOR!"
X	Windows Xp	nortonguard.exe	"Added by the MYTOB-DZ WORM!"
X	WindowsAudio	systemupd.exe	"Added by the AGENT-TH WORM!"
X	WindowsUpdate	Strad.exe	"Added by the CULLER-D WORM!"
X	WindowsXP Module	DirectX3D.exe	"Malware
X	WinEssential	keyword.exe	"Jraun adware"
X	WinGuard	winguard.exe	"Added by the AGOBOT-OQ WORM! The file is located in %System%"
U	WinGuard	Winguard.exe	"Winguard Popup Remover - pop-up stopper. The file is located in %ProgramFiles%\Winguard Popup Remover"
X	WinHelp	realsched.exe	"Added by the LOVGATE-F WORM! Note - this is not the legitimate RealPlayer (realsched.exe) application of the same name. This one is located in %System%"
X	WinHound	WinHound.exe	"WinHound spyware remover - not recommended
X	WiniGuard	WiniGuard.exe	"WiniGuard rogue security software - not recommended. There are number of variants in this family sharing the same user interface - see here"
X	wininetd	wininetd.exe	"Added by the WINET TROJAN!"
X	WiniShield	WiniShield.exe	"WiniShield rogue security software - not recommended
U	WinLoad	Winload.exe	"PCTattletale is a surveillance software program that monitors user activity
X	winload	winload.exe	"Added by the AGENT-GNY TROJAN! Note - the file is located in %ProgramFiles%\Internet Explorer"
X	WinLogonnd	winlogonnd.exe	"Added by the AGENT-NNQ TROJAN!"
X	WinMed	winmed.exe	"Added by the AGENT.AIRF TROJAN!"
X	winNT updatc	wupgrd.exe	"Added by a variant of the RBOT WORM!"
X	WinProfile	Command.exe	"Added by the BUDDY.E TROJAN!"
X	winpsd	winpsd.exe	"Added by the MYDOOM.Q WORM!"
X	winrapid	winrapid.exe	"Added by a variant of the RBOT WORM!"
X	WinReader	read.exe	"Added by the DELBOT-V WORM!"
X	Winsock2 driver	WINSOUND.EXE	"Added by the SPYBOT-H WORM!"
X	Winsock6 MIC driver	ieservicesupd.exe	"Added by the SPYBOT.AFZ WORM!"
N	Wintime Wtxpload	Wxpload.exe Wintime	"Part of the software to support a Dexxa USB graphics tablet. From a visitor - "This gets started anyway when you plug in the USB connector for the graphics tablet
X	Wintl	msdred.exe	Identified as a variant of the Trojan-Spy.Win32.Agent.cch malware
X	winupated.exe	winupated.exe	"Added by a variant of the SDBOT WORM!"
X	winupd	winupd.exe	"SearchNew adware"
X	winupd.exe	winupd.exe	"Added by the BEAGLE.M or BEAGLE.N WORMS!"
X	winupdate	jusched.exe	"Added by the DWNLDR-FUX TROJAN! Note that this is not the legitimate Sun Microsystems file (of the same name) which is usually located in %Program Files%\Java\version number\bin. This one is located in %Windir%"
X	WinUPPD.exe	[random filename]	Added by an unidentified WORM/TROJAN!
X	winusb.dll	winguard.exe	"Added by the FORBOT-CN WORM!"
X	winword	winword.exe	"Added by the TORPID-C TROJAN!"
X	WINWORD.exe	WINWORD.exe	"Added by the DRIVUS TROJAN! Note - this is not the legitimate MS Word process of the same name
X	win_upd.exe	WINdirect.exe	"Added by the MITGLIEDER.M TROJAN!"
N	wkfud	wkfud.exe	A marketing program for MS Works
N	WkUFind	WkUFind.exe	"MS Works Update Detection. MS Picture It! (versions 7 to current) use this automatic update feature during the log on process. It can also cause your system to automatically dial into your ISP as it tries to access the internet
X	WLiveCD.exe	WLiveCD.exe	"Added by the VB-EQI TROJAN!"
X	wmon	jusched.exe	"Added by the AGOBOT-OW WORM! Note that this is not the legitimate Sun Microsystems file (of the same name) which is usually located in %Program Files%\Java\version number\bin. This one is located in %System%"
X	WMSDOS-ServicePack2	cmd.exe /c C:WMSDOS.sys	"Detected by Bitdefender as the DELF.OFC TROJAN! See here. Note that cmd.exe is a legitimate Microsoft file normally located in %System% and shouldn't be deleted"
X	WNAD	WNAD.EXE	"Spyware added as a result of running a program called "Yo Mama Osama" (osama.exe). See here for more and how to get rid of it. There are other ways this can show up on your system
X	Woods Inc	wcmd.exe	"Added by the KILLFIL-O TROJAN!"
N	WorksFUD	wkfud.exe	A marketing program for MS Works
U	Worm Detector	wd.exe	"Worm Detector - antivirus add-on for Outlook 2K or XP for handling worms and spam"
X	wqdfadads	sdqdad.exe	"Added by the MULDROP.F TROJAN!"
X	WSAConfiguration	win32upd.exe	"Added by a variant of the RBOT WORM!"
Y	wswpd	wswpd.exe	"Used with some models of Panasonic
U	WTIndicator	SchedInd.exe	"WinTask - software that automates a variety of routine tasks quickly and simply"
X	wupd32	wupd.exe	"Added by the STRATION.EL WORM!"
X	wzxzxds	fdfddad.exe	"Added by the RANKY.AB TROJAN!"
N	X-Grabber	sswizard.exe	"ScreenShot Wizard"
?	XeroxEndeavorBackgroundTask	xGKOHbgnd.exe	"Associated with a Xerox multifunction and/or scanner. What does it do and is it required?"
X	xload32	netdd.exe	"Added by the NETSPY TROJAN!"
X	XPGuard	XP-Guard.exe	"XP-Guard rogue security software - not recommended
X	XPShield	XP-Shield.exe	"XP-Shield rogue security software - not recommended
N	Yahoo! Friend	YahooFriend.exe	"Yahoo!_Friend - plug-in for Yahoo! Messenger that add lots of emoticons and windows effects"
X	ynavmrcd.exe	ynavmrcd.exe	"Added by the DLOADR-AVC TROJAN!"
U	Zboard	Zboard.exe	"Ideazon Zboard gaming software"
X	zggjmyd	zggjmyd.exe	"Added by the AFCORE.O BACKDOOR!"
Y	ZPLED	ZPKBDLED.exe	Driver for the Advent ADE-AD2 Wireless Keyboard
U	zSPGuard	Spguard.exe	""StartPage Guard (SPG) protects your PC from cyberscam
X	[random name]	w?crtupd.exe	"PurityScan adware"
X	[random name]	n?tepad.exe	"PurityScan adware"
X	[random name]	w?nword.exe	"PurityScan adware"
X	[random name]	wucrtupd.exe	"PurityScan adware. Do not confuse with the legitimate Windows Critical Update Notification (wucrtupd.exe) process"
X	[random name]	notepad.exe	"PurityScan adware. Note - this is not Windows Notepad which has the same executable name"
X	[random]	[random]tssd.exe	"Antivirus Suite and AntiSpyware Soft rogue security software - not recommended
X	[random]	[random]sysguard.exe	"Antivirus Soft
X	[various names]	win32snd.exe	"Added by the RBOT-DQ WORM!"
X	[various names]	AliceSD.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	backd.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	DCC_send.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	newbreed.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	_	mzqdd.exe	"Added by the AGENT.BZB TROJAN!"
X	{----**}	rwwnw64d.exe	"Identified as a variant of the AdWare.Win32.ZenoSearch.am malware
X	{05CD0D77-4947-4a56-94FA-0DF0DC644D7B}	sysqyzwud.exe	"Added by the FAKEALERT-AM TROJAN!"
X	{BAAA759D-56F0-428c-B8DA-827EA3B08C2C}	sysawechod.exe	"Added by the FAKEALERT-AH TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.