p.exe

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	$sys$cmp	$sys$xp.exe	"Added by the RYKNOS.B TROJAN! Attempts to utilize the Sony Rootkit A.K.A. SecurityRisk.First4DRM security risk to hide itself on the compromised computer"
X	(Default)	winhelp.exe	"Added by the BLACKMAL.C WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	.msfupdate	msveup.exe	"Added by the ALLOCUP.A WORM!"
X	0mcamcap	0mcamcap.exe	"Added by the COSIAM-H TROJAN!"
U	12Ghosts Backup	12backup.exe	"12Ghosts Backup - ""Automatic Backups
U	12Ghosts Clip	12clip.exe	"12Ghosts Clip - ""Screen shots made easy"""
U	12Ghosts Popup-Killer	12popup.exe	"12Ghosts Popup-Killer"
N	12Voip	12Voip.exe	"12Voip - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
Y	36X Raid Configurer	JMRaidSetup.exe	"JMB36x series RAID configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers"
N	AccuWeather.com� Desktop	AccuWeatherDesktop.exe	"Desktop weather from AccuWeather"
U	ACROMOUSE	ACROMAPP.exe	"Related to ACROMOUSE Laser mouse control"
U	Acronis Scheduler Helper	schedhlp.exe	"Part of Acronis True Image backup software. Co-operates with the ""schedul2.exe"" service to perform backup/restore tasks correctly. Required if you want to use True Image to do some real backup/restore tasks - not if you only want to explore/mount images"
U	Acronis Scheduler2 Service	schedhlp.exe	"Part of Acronis True Image - backup software. Co-operates with the ""schedul2.exe"" service to perform backup/restore tasks correctly. Required if you want to use True Image to do some real backup/restore tasks - not if you only want to explore/mount images"
X	AddrPlus3	[path] stup.exe [path] Adplus.dll Rundll32	"TCent adware"
Y	adi CleanUp	CleanUp.exe	"Utility that only runs once after installing the drivers for Analog Devices SoundMax integrated soundcards to clean-up the files no longer required once the installation is complete. Other programs/drivers may use the same filename for the same purpose. In this case
Y	adi DSndUp	DSndUp.exe	"Utility that only runs once after installing the drivers for Analog Devices SoundMax integrated soundcards. It's exact purpose is unknown at the present time but from the filename it's probably used to configure the default or generic speaker arrangement for the system it's used on"
X	Adobe Flash Player	AdobeFP.exe	"Added by the AUTORUN-BBP WORM!"
X	AdobeReaderPro	msnxpsp.exe	"Added by the RBOT-ASK or RBOT-AUS WORMS!"
X	Adobe_RLX	ccwap.exe	"Added by the BCKDR-RCL TROJAN!"
X	adp	adp.exe	"Spyware installed by Net2Phone
X	Adstartup	Adstartup.exe	"Adlogix adware"
X	AdVantage Setup	AdVantageSetup.exe	"MeMedia.Advantage adware - optionally installed with older versions of the DAEMON Tools Lite CD emulation tool (if you don't uncheck the ""DAEMON Tools sponsor ad module"" option during install) and possibly others"
U	AEZBProc	aptezbp.exe	"IBM Aptiva keyboard customizer - enables certain special buttons on keyboard for CD operation
U	ahfp	ahfp.exe	"Advanced Hide Folders - ""is powerful security program that allows you to hide any number of files or folders. It is very useful to keep your personal data from others"". Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows 2K/XP"
U	ahfprog	ahfp.exe	"Advanced Hide Folders - ""is powerful security program that allows you to hide any number of files or folders. It is very useful to keep your personal data from others"". Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows 2K/XP"
X	AhorreMemoria	SysRep.exe	"AhorreMemoria rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
U	Ai Gear Help	GearHelp.exe	"Included with some ASUS motherboards (such as the Maximus Extreme & Striker II Extreme)
U	Ai Nap	AiNap.exe	"Included with some ASUS motherboards (such as the Maximus Extreme & Striker II Extreme)
?	AidemHotKey	KEYAPP.EXE	"Keyboard related"
U	Alarm Manager	Alarmapp.exe	Palm alarm event reminder that coordinates what is on your Palm with settings on your desktop
?	Alcom PCL Capture	FMW_PCAP.EXE	"??"
U	allSnap	allSnap.exe	"""allSnap is a small system tray app that makes all top level windows automatically align like they do in programs such as Winamp or Photoshop"""
X	AntiKeep	AntiKeep.exe	"AntiKeep rogue security software - not recommended
X	AntiKeep.exe	AntiKeep.exe	"AntiKeep rogue security software - not recommended
U	AntiPopUp	AntiPopUp.exe	"AntiPopUp for IE - pop-up stopper"
X	Antispyware PRO XP	asproxp.exe	"AntiSpyware Pro XP rogue spyware remover - not recommended
X	Antivirus	SPP.exe	"Spyware Preventer rogue security software - not recommended
X	Antivirus Agent Pro	aap.exe	"Antivirus Agent Pro rogue security software - not recommended
X	AntivirusXP.exe	AntivirusXP.exe	"Antivirus XP Pro rogue security software - not recommended
Y	aol	avp.exe	"AOL's Active Virus Shield (by Kaspersky) - found in an AOLActive Virus Shield sub-directory"
X	App.EXEName	[path to worm]	"Added by the BODIRU WORM!"
Y	Application	mdmsetsp.exe	"Aztech Labs modem driver"
X	aqadcup.exe	aqadcup.exe	"Added by the AGENT.BG WORM!"
X	ashDip.exe	ashDip.exe	"Added by the DROPR-CZ TROJAN!"
Y	ashDisp	ashDisp.exe	"System Tray access to and notifications for avast! Antivirus - giving left-click access to the On-Access Scanner
X	ashDsp.exe	ashDsp.exe	"Added by a variant of the SDBOT WORM!"
?	AsusStartupHelp	AsRunHelp.exe	"Unknown ASUS motherboard utility. What does it do and is it required?"
N	ASWDP	ASWDP.exe	"MLS Pulse - real estate software. Keeps the home buyer/seller continually informed on the status of his/her local/regional real estate market"
X	AtiPanel	atip.exe	"Added by the TACTSLAY.U TROJAN!"
X	Audio Device Manager	winfp.exe	"Added by the IRCBOT-XS WORM!"
X	Audio Device Manager	WNDXP.exe	"Added by the IRCBOT.AJL BACKDOOR!"
U	Auto EPSON Stylus CX3700 Series on X	E_FATIACP.EXE	"Epson Status Monitor 3 for the Stylus CX3700 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4500 Series on X	E_FATI9AP.EXE	"Epson Status Monitor 3 for the Stylus CX4500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX5500 Series on X	E_FATICAP.EXE	"Epson Status Monitor 3 for the Stylus CX5500 Series printer - for monitoring printer status
X	Auto Update	AUP.exe	Added by an unididentified WORM or TROJAN!
N	AUTOPROP	REGPROP.EXE WMPADDIN.DLL	"Both the files are in the MS Office/Bots/FP_WMP directory. Apparently
U	Autoroute SMTP	AutoSmtp.exe	"Autoroute SMTP - ""automatic switching between SMTP servers depending on what network you are currently working in."" You need to have two Internet service providers"
N	AUXXTRAY	au30setp.exe	System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel
Y	avast!	ashDisp.exe	"System Tray access to and notifications for avast! Antivirus - giving left-click access to the On-Access Scanner
Y	avast! Antivirus	ashDisp.exe	"System Tray access to and notifications for avast! Antivirus - giving left-click access to the On-Access Scanner
Y	AVK Mail Checker	AVKPop.exe	"eXtendia AVK AntiVirus email checker"
Y	avp	avp.exe	"Kaspersky anti-virus and AOL's Active Virus Shield (by Kaspersky) - found in either a Kaspersky or AOL sub-directory"
X	avp	avp.exe	"Detected by Kaspersky as the ALPHABET.B TROJAN!"
X	avp	win.tmp.exe [ is a number]	Added by a variant of the ALPHABET TROJAN!
X	AvSer	sysup.exe	"Added by the SERFLOG.B WORM!"
N	B'sCLiP	BSCLIP.exe	CD recording utility that comes with a lot of CDR/CDRW drives and isn't required
U	Back2zip	Back2zip.exe	"Back2zip is a simple and elegant backup solution which uses the industry's most powerful ZIP and ZIP-64 technologies to constantly monitor your documents and make sure that they are always properly backed up"
U	Banpopup by Pratik	Banpopup.exe	Banpopup - popup killer
U	BayMgr	DockApp.exe	Hot-swappable drive management on laptops allowing you to change drives without closing down Windows. Only required if you frequently swap bay devices
U	Bayswap	bayswap.exe	Hot-swappable drive management on Compaq Notebooks which allows you to swap drives without closing down Windows. Only required if you frequently swap bay devices
X	BeschermingsTool	SysRep.exe	"BeschermingsTool
U	BestSync 2008	BestSyncApp.exe	"System Tray access to BestSync® 2008 from Risefly Software - ""a professional utility for synchronizing files between your local folders and Network Drives
X	BF4P	bf4p.exe	"Added by the IRCBOT.GEN WORM!"
N	BHOCop	BHOCop.exe	"PC Magazine's
?	BIOVCIP	BIOVCIP.exe	"??"
U	BitDefender_P2P_Startup	BitDefender_P2P_Startup.exe	"Bitdefender anti-virus for P2P clients - no longer supported at the BitDefender website"
X	blah service	smnp.exe	"Added by the RBOT.IZ WORM!"
N	BLSTAPP	blstapp.exe	Puts access to Creative's BlasterControl in the System Tray
X	Boarddata	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are often located in %System%"
N	BsCLiP	BSCLIP.exe	CD recording utility that comes with a lot of CDR/CDRW drives and isn't required
U	btbb_wcm_McciTrayApp	McciTrayApp.exe	"System tray access to Motive's Broadband 2.0 configuration and repair utility"
N	BudgetSip	BudgetSip.exe	"BudgetSip - internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X	BugsDestroyer	SysRep.exe	"BugsDestroyer rogue system error and cleaning utility - not recommended
U	CallCenter Main Application	V3calmcp.exe	"""V3 Inc. CallCenter is a free 32-bit
U	CallCenter Printer Interface	V3faxecp.exe	"""V3 Inc. CallCenter is a free 32-bit
N	Capture Express 2000	capexp.exe	"Capture Express - screen capture utility"
Y	ccApp	ccApp.exe	"Part of earlier versions of Norton AntiVirus - Auto-protect and E-mail check will not function without this"
X	CdnCtr	cdnup.exe	"CNNIC Update pest"
X	chcp.exe	chcp.exe	"Added by the SDBOT.BMH BACKDOOR!"
X	CleanPCTool	SysRep.exe	"CleanPCTool rogue system error and cleaning utility - not recommended
X	cleansweep.exe	cleansweep.exe	"Added by the AGENT-NEU TROJAN!"
U	CleanTemp	CleanTemp.exe	"CleanTemp - deletes the contents of the TEMP directory when Windows starts and then closes - using no memory"
Y	CleanUp	CleanUp.exe	"Utility that only runs once after installing the drivers for Analog Devices SoundMax integrated soundcards to clean-up the files no longer required once the installation is complete. Other programs/drivers may use the same filename for the same purpose. In this case
?	CleanupProgram	cleanup.exe	"Sony Vaio related - what does it do and is it required? Located in a C:\Sonysys folder"
X	CleanupTool	SysRep.exe	"CleanupTool rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
N	Client Access Help Update	cwbinhlp.exe	"Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
X	Client Update	wup.exe	"Added by the OPANKI.O WORM!"
N	COM-IP	COMIP.EXE	COM-IP Virtual Modem Driver (COM-IP Creates a Fake Serial Port that allows you to use older DOS Based Communications Programs over Telnet. Type atdt host.domain.com instead of atdt 5551212)
X	combop.exe	combop.exe	"Added by the BOWFEED-A TROJAN!"
Y	Common Client	ccApp.exe	"Part of earlier versions of Norton AntiVirus - Auto-protect and E-mail check will not function without this"
X	CommonService	winup.exe	"Added by the DLOADR-BJJ TROJAN!"
Y	COMODO Firewall Pro	cfp.exe	"Comodo Firewall Pro"
N	CompaqSystray	cpqpscp.exe	Compaq System Tray icon
X	ConfidentUser	SRP.exe	ConfidentUser rogue system error and cleaning utility - not recommended
X	Configuration Loader	ldasp.exe	"Added by the AGOBOT.BH WORM!"
X	Configuration Loader	wump.exe	"Added by the AGOBOT-BU BACKDOOR!"
N	CONNECTAUTrayApp	CONNECTAUTrayApp.exe	"System Tray access to change update settings for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
U	Cookie Cop 2	CookieCop.exe	"
U	CostAware	niIPCApp.exe	"NetInternals CostAware - download quota measuring tool"
X	cpntmgc	wincomp.exe	"Added by the WINTRIM.A TROJAN!"
X	CPU Idle	cpuidlexp.exe	"Added by the AGOBOT-BW WORM!"
U	Cpu Level Up help	CpuLevelUpHelp.exe	"Included with some ASUS motherboards (such as the Maximus Extreme & Striker II Extreme)
X	cpyt	hidep.exe	"Added by the MIRJACK-A TROJAN!"
X	CRSSXP SysInfo	crssxp.exe	"Added by a variant of the SDBOT TROJAN!"
X	ctfmon	WinUP.exe	"Added by the BANKER-VV TROJAN!"
X	cthelp	cthelp.exe	"Added by the SDBOT TROJAN!"
N	CTxfiHlp	CTXFIHLP.EXE	Added by the installation of a Creative Labs X-Fi sound card. This particular process provides the help functionality for your card
N	CursorXP	CursorXP.exe	"CursorXP from Stardock - tool for creating mouse cursors"
N	cwbinhlp	cwbinhlp.exe	"Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
X	d9fw5i91p	d9fw5i91p.exe	"Added by the AGENT-GIW BACKDOOR!"
Y	DadApp	dadapp.exe	""DadApp is the SW utility that controls the programmable buttons on Dell Laptops. Not required
N	Dap	DAP.exe	"Download Accelerator Plus from Speedbit. Download manager for resuming downloads
X	delsaap	delsaap.exe	"NCase adware"
?	DelTmp	DelTemp.exe	"Added to the startup list after installing a Creative SoundBlaster Audigy soundcard. Deletes temporary files once an installation is complete?"
X	DELXP Protocol	delxp.exe	"Added by a variant of the SDBOT WORM!"
X	desktop	desktop.exe	"Added by the SDBOT.MD WORM!"
X	Desktop Search	desktop.exe	"iSearch adware"
N	deskup	deskup.exe	Adds Iomega Zip drive icons to the desktop
U	DetectorApp	DetectorApp.exe	"Related to Roxio MyDVD (was Sonic) DVD authoring software"
N	Dialog Helper	PDDLGHLP.EXE	"Dialog Helper from PowerDesk Pro by Ontrack. Helps with the standard Open and Save As dialog boxes by showing recently used files and folders. Available via Start -> Programs"
X	DialUp Network Application	Rnaap.exe	"Added by a variant of the SDBOT WORM!"
N	Digital Dashboard	devgulp.exe	For Compaq PC's. Loads Digital Dashboard options
N	DiscoverDeskshop	Deskshop.exe	"Discover Deskshop - single use ""virtual"" credit card"
X	DiskRetter	SysRep.exe	"DiskRetter
X	Display	backup.exe	"Added by the BRONTOK-CR WORM!"
X	dllhelp	dllhelp.exe	"Added by the STARTPAGE.DQ hijacker"
X	dllhelp	dllhlp.exe	"Added by the Downloader-HI TROJAN!"
X	dllhostxp.exe	dllhostxp.exe	Browser hijacker and adware downloader
U	DLPSP	DLPSP.EXE	Dell laser printer status monitor
X	Dluxjp	Dluxjp.exe	"Added by the DLUCA.D TROJAN!"
N	DMISLAPP	DMISLAPP.exe	"DMI (Desktop Management Interface) Service Layer for Intel TokenExpress network card software. DMI support for the Intel network card managed through the Desktop Management Interface. See here for more information"
X	DokterFix	SysRep.exe	"DokterFix
U	Don't Panic	dontpanicdemodp.exe	"30-day trial version of Don't Panic privacy software from Panicware. "Clean up Internet tracks and quickly hide personal documents with this privacy suite.""
U	Don't Panic!	DP.EXE	"Don't Panic! privacy software from Panicware. ""Clean up Internet tracks and quickly hide personal documents with this privacy suite"""
N	Download Accelerator Plus 5.0	DAP.exe	"Download Accelerator Plus from Speedbit. Download manager for resuming downloads
N	DownloadAccelerator	DAP.EXE	"Download Accelerator Plus from Speedbit. Download manager for resuming downloads
?	DragDrop	DragDrop.exe	"??"
X	DRan posessor	DAP.exe	"Added by a variant of the SDBOT WORM!"
X	DsmSer	sysup.exe	"Added by the SERFLOG.B WORM!"
Y	DSndUp	DSndUp.exe	"Utility that only runs once after installing the drivers for Analog Devices SoundMax integrated soundcards. It's exact purpose is unknown at the present time but from the filename it's probably used to configure the default or generic speaker arrangement for the system it's used on"
X	Dump	Dump.exe	"Added by the ZIMUSE WORM!"
X	dumprep	dump.exe	"Added by the CODOX-A WORM!"
X	Dynamic DHCP	dydhcp.exe	"Added by the RINBOT.B TROJAN!"
N	Eapcisetup	sbsetup.exe	Rockwell RipTide soundcard application software. Sound works without it
U	Efpap.exe	Efpap.exe	"Easy File & Folder Protector. Deny access to certain files and folders
X	element furth	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are often located in %System%\vert"
X	elitemedia	elitemediapop.exe	"Added by the LOWZONE-BB TROJAN! Also known as Elitebar/EliteToolbar/EliteSidebar adware"
N	EnigmaPopupStop	EnigmaPopupStop.exe	"Part of Enigma SpyHunter - not recommended
U	EPSON Stylus CX2900 Series	E_FATIBFP.EXE	"Epson Status Monitor 3 for the Stylus CX2900 Series printer - for monitoring printer status
U	EPSON Stylus CX3700 Series	E_FATIACP.EXE	"Epson Status Monitor 3 for the Stylus CX3700 Series printer - for monitoring printer status
U	EPSON Stylus CX3900 Series	E_FATIBEP.EXE	"Epson Status Monitor 3 for the Stylus CX3900 Series printer - for monitoring printer status
U	EPSON Stylus CX4500 Series	E_FATI9AP.EXE	"Epson Status Monitor 3 for the Stylus CX4500 Series printer - for monitoring printer status
U	EPSON Stylus CX5500 Series	E_FATICAP.EXE	"Epson Status Monitor 3 for the Stylus CX5500 Series printer - for monitoring printer status
U	EPSON Stylus CX6500 Series	E_FATI9EP.EXE	"Epson Status Monitor 3 for the Stylus CX6500 Series printer - for monitoring printer status
U	EPSON Stylus CX8300 Series	E_FATICEP.EXE	"Epson Status Monitor 3 for the Stylus CX8300 Series printer - for monitoring printer status
U	EPSON Stylus CX9300F Series	E_FATICFP.EXE	"Epson Status Monitor 3 for the Stylus CX9300F Series printer - for monitoring printer status
U	EPSON Stylus Photo RX430 Series	E_FATI9CP.EXE	"Epson Status Monitor 3 for the Stylus Photo RX430 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX530 Series	E_FATIAGP.EXE	"Epson Status Monitor 3 for the Stylus Photo RX530 Series printer - for monitoring printer status
U	EPSON TX100 Series	E_FATIEDP.EXE	"Epson Status Monitor 3 for the TX100 Series printer - for monitoring printer status
X	ErrClean	SysRep.exe	"ErrClean rogue system error and cleaning utility - not recommended. There are number of variants in this family sharing the same filename and user interface - see here"
X	ErreurChasseur	SysRep.exe	"ErreurChasseur
N	ESFTP	esftp.exe	"ESftp - FTP client for transfering files between a local PC and another remote computer"
X	ethernet	airftp.exe	"Added by a variant of the SDBOT WORM!"
X	ethernet	msftp.exe	"Added by the SDBOT.BXJ WORM!"
X	Explkw	expup.exe	Keywords hijacker
X	explorep.exe	explorep.exe	"Added by the LINEAG-I TROJAN!"
X	Explorer	shellexp.exe	"Added by the AGENT-ZY TROJAN!"
U	EZEJMNAP	EzEjMnAp.Exe	"EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
N	FastTrack Accelerator	SPEED UP.EXE	"FastTrack Accelerator - ""speedup"" utility for programs that use the FastTrack network such as KaZaA Media Desktop
X	FCHelp	FCHelp.exe	"Added by either FCHelp adware or a variant of it"
X	fddddHOME	dxxatp.exe	"Added by the RANKY.AA TROJAN!"
U	FerrariWallPaper	FerrariWP.exe	Calendar that replaces the default desktop background image. It comes with every Acer Ferrari 3000 laptop. Also downloadable for members of www.ferrari.com
X	FestPlattenCleaner	SysRep.exe	"FestPlattenCleaner
?	fgl23DoubleScreenHooks	f23happ.exe	"Related to the now discontinued ATI Fire GL3 graphics card. What does it do and is it required?"
X	fGQEGqHOME	gwwgtp.exe	"Added by the RANKY.J TROJAN!"
X	FHPage	shdochp.exe	"Added by the WINHOUND TROJAN!"
U	FingerPrintSoftware	fpapp.exe	Supports the fingerprint reader on selected IBM/Lenovo Thinkpad notebooks
U	FirewallStartup	Firewallstartup.exe	"Innovative Startup Firewall - ""designed to protect your computer from programs that install themselves in the StartUp area of your Windows without asking for your approval. Innovative StartUp Firewall will help you keep your computer clean
U	FJTWAIN Setup	FjtwSetup.exe	Fujitsu scanner utility
Y	FP Loader	loadfp.exe	"FoolProof Security - PC security software from SmartStuff"
U	Fresh Desktop	freshdesktop.exe	"Fresh Desktop is a utility that lets you manage vast collections of wallpapers for your desktop with ease. When run on bootup it changes the desktop wallpaper at startup or at specified intervals"
N	Fromine WinPopup	winpopup.exe	Instant Messenger program
U	fsp	fsp.exe	"Folder Shield - hide entire directories and thus prevent access by anyone else to your personal files and documents"
U	FtLnSOP_setup	FtLnSOP.exe	Fujitsu scanner utility
X	Generic Host Process for WinXP Services	mshelp.exe	"Added by the AGENT-GQP TROJAN!"
X	GenericHostXP	WinLoaderXP.exe	"Added by the BDOOR-ACX BACKDOOR!"
N	GhostStartTrayApp	GhostStartTrayApp.exe	"System Tray access to Norton Ghost - added from the 2003 version"
U	Google Desktop	GoogleDesktop.exe	"Google Desktop - ""a desktop search application that provides full text search over your email
U	Google Desktop Search	GoogleDesktop.exe	"Google Desktop - ""a desktop search application that provides full text search over your email
X	Google service	Googlesetup.exe	"Added by the IRCBOT-RJ WORM!"
U	GoogleDesktop	GoogleDesktop.exe	"Google Desktop - ""a desktop search application that provides full text search over your email
?	gramdate	2Stop.exe	"??"
X	hagent	avp.exe	"Added by the ""Herman Agent"" remote access TROJAN!"
X	HardDriveGuard	SysRep.exe	"HardDriveGuard rogue system error and cleaning utility - not recommended
X	HataDuzelticisi	SysRep.exe	"HataDuzelticisi
?	HDhelp	tbhdhelp.exe	"Associated with Philips Edge series soundcards. Is it required?"
X	Helper	eschlp.exe	"Added by the BLASTER.T WORM!"
X	HelpExp.exe	HelpExp.exe	"Attune HelpExpress - spyware. Disable and uninstall - see here"
U	hfxp	hfxp.exe	"Hide Folders XP - hide your folders so only you can view them"
X	hgqhp.exe	hgqhp.exe	"Added by the FLUSH.F TROJAN!"
X	hhtnsn	rnxntup.exe	"Added by a variant of the ORCU.B TROJAN!"
?	HomeCentre WakeUp	LGWAKEUP.EXE	"Associated with the no longer supported Xerox HomeCentre printer/scanner"
X	host	help.exe	IESearchToolbar parasite. Identified by Ewido Security Suite (Ewido is now part of AVG Technologies) as the DELF.LF TROJAN!
U	HotkeyApp	HotkeyApp.exe	"Programmable keys on Acer
U	HPBootOp	HPBootOp.exe	"""HP Boot Optimizer intelligently and dynamically launches software during startup
Y	HpLamp	HPLAMP.EXE	HP Scanner Utility that controls your scanners light bulb. Needed if it's switched on
U	HWSetup	HWSetup.exe hwSetUP	"""Toshiba Hardware Setup is the Toshiba configuration management tool available through Windows."" Allows the user to change BIOS
Y	iamapp	iamapp.exe	"AtGuard personal firewall engine. As Atguard was bought by Symantec some time ago
?	Iap	iap.exe	"Possibly part of Dell OpenManage Client Instrumentation - software that allows remote management application programs to access information about
U	IBM ThinkPad EasyEject Support Application	EzEjMnAp.Exe	"EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
Y	ICF	mfp.exe	"McAfee Family Protection - which 'is easy-to-use and built to empower parents to say ""yes"" to their children's online interests while protecting them as they learn and explore' and ""protects children of all ages from exposure to inappropriate content
U	iDesktop	idesktop.exe	"Immersion TouchWare Desktop software for devices such as the Logitech iFeel Mouse"
U	IDriveE Startup	IDrvieEStartup.exe	"IDrive from Pro Softnet Corporation - free full featured online backup up to 2GB with the option of paying for more storage space and managing multiple accounts"
X	IECheck	mssvp.exe	"Added by the TIRBOT-G WORM!"
U	IMOL	IMOLApp.exe	"IncrediMail for Office Outlook Add-On"
X	IMwire	imwireup.exe	"SafeSurfing adware variant"
?	InstallNAIProduct	SETUP.EXE	"Could be related to Network Associates Inc who own the McAfee VirusScan product amongst others. This was found in a directory called "VSC". Could it be an installation that failed and "SETUP.EXE" was left to run at startup as an error?"
X	Installs SP2	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are located in %System%\qpalsp"
X	Intel system tool	hookdump.exe	"Added by the SPYRE-H TROJAN!"
X	Internet	nteusodp.exe	"Added by the RBOT-GFJ WORM!"
X	Internet Content Publisher	ICP.EXE	"Added by the RBOT-UD WORM!"
X	Internet Explorer	http.exe	"Added as part of a new potential CWS infection
N	InterVoip	InterVoip.exe	"InterVoip - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
U	Iomega Automatic Backup	ibackup.exe	"Iomega Automatic Backup - automatic backups for use with Iomega portable HDD"
U	Iomega Automatic Backup 1.0.1	ibackup.exe	"Iomega Automatic Backup - automatic backups for use with Iomega portable HDD"
U	Iomega ImIconXP	imiconxp.exe	"Iomega REV System Software - allows your Iomega REV drive to interact with the operating system via the Iomega REV UDF file system
X	IP	IP.EXE	"Added by the AGOBOT-QO WORM!"
U	iProtectYou	ip.exe	"iProtectYou - internet filtering/parental control and network monitoring software"
X	ir_ftp	ir_ftp.exe	"Added by the IRFTP TROJAN!"
X	ir_ftp	irwftp.exe	"Added by the BANCOS.H TROJAN!"
U	ISHelp	help.exe	"ISpy is a security risk that logs keystrokes and captures screenshots. If you didn't install this yourself uninstall it"
X	ISPSERVICE	wintmp.exe	"Added by the IRCBOT.GP BACKDOOR!"
N	IsReminder	ISPopup.exe	"Related to GuardWare iShield - this is the registration reminder for the trial version
X	Java applet	javaup.exe	"Added by the SDBOT-ACF WORM!"
X	java-plugin	javasctp.exe	"Added by the VB.AMX TROJAN!"
Y	JMB36X Configure	JMRaidSetup.exe	"JMB36x series RAID configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers"
U	JussDropUtility	JussDrop.exe	"Related to DropShots Inc. A subscription based service for family to connect
N	JustVoip	JustVoip.exe	"JustVoip - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
U	Kalibump	Kalibump.exe	"Used with the now unsupported Kali software for on-line gaming. This is used to automatically bump up the priority of WinProxy to GREATLY improve game speed when using a SOCKS proxy"
Y	kav	avp.exe	"Kaspersky anti-virus and AOL's Active Virus Shield (by Kaspersky) - found in either a Kaspersky or AOL sub-directory"
N	KAZAA	[path] kpp.exe [path] kazaalite.kpp	"System Tray access to later versions of the Kazaa Lite P2P file sharing utility - namely the K++ and Resurrection variants. Kazaa Lite is the unauthorized modification of the original Kazaa Media Desktop - with the malware removed"
X	KeepCop	KeepCop.exe	"KeepCop rogue security software - not recommended
X	KeepCop.exe	KeepCop.exe	"KeepCop rogue security software - not recommended
X	Kernel32_sysdamper	sysdamp.exe	"Added by an unidentified WORM or TROJAN! See here"
X	key	sysxp.exe	"Added by the BEAGLE.AB WORM!"
X	key	sys_xp.exe	"Added by the BEAGLE.AC WORM!"
X	key	winxp.exe	"Added by the BEAGLE.AG WORM!"
N	Keyboard Customizer	TpKmapAp.exe	"Part of the Keyboard Customizer Utility for IBM/Lenovo Thinkpad notebooks. This is the main user interface for the utility but it doesn't normally seem to be running if enabled at startup. Also
U	keymap	keymap.exe	System Tray utility and background task used by games produced by Kesmai (published by Interactive Magic) and which enables you to program keys to do specific actions during the game
U	Kill Popup	KillPopup.exe	"KillPopup - pop-up stopper"
U	KN_PanelApp	PanelApp.exe	"KnowledgePanel online survey software"
Y	KPDrv4XP	KPDrv4XP.exe	MediaKey USB Keypad Driver
Y	KTPWare	ktp.exe	Related to KTP Ware TSR Enhancements from ELANTECH
U	LaCie Backup	LaCieBackup.exe	"LaCie '1-Click' backup software for their range of mobile hard drives"
X	LAN	dhcp.exe	"Added by the RBOT-GYI WORM!"
X	lanbrup	lanbrup.exe	"SafeSurfing adware"
?	LanzarL2007	[path] setup.exe	"??"
U	LaunApp	LaunApp.exe	Part of Acer Launch Manager - programmable keys on such laptops as the TravelMate 610
U	LaunchAp	LaunchAp.exe	"Programmable keys on Acer
N	lcfep	lcfep.exe	"Tivoli 'TME' System Tray icon - ""'lcfep' is the program that displays statistics about the Endpoint. Apparently stopping/removing this process has no impact on the Endpoint itself which will continue to function normally"""
U	LgWDskTp	LgWDskTp.exe	"Logitech Wireless Desktop mouse and keyboard software. There is an icon for this program on the taskbar next to the clock"
X	LibreSystem	SysRep.exe	"LibreSystem
?	LifeCam	LifeExp.exe	"Related to Microsoft's LifeCam series of webcams. What does it do and is it required?"
?	LifeExp	LifeExp.exe	"Related to Microsoft's LifeCam series of webcams. What does it do and is it required?"
U	LManager	HotkeyApp.exe	"Programmable keys on Acer
X	Loaders	HeIp.exe	"Added by the SDBOT-ADB WORM!"
N	Logitech Wakeup	lgwakeup.exe	Loads at startup and monitors the scanner. When a document is inserted in the scanner the wakeup program feeds the document a fraction of a inch into the scanner and then it launches the control center software. From the control center you can select whether to fax or copy or print the scanned documents. If you uncheck the Logitech wakeup software from the startup it no longer launches the control center or feeds the document a fraction of an inch. You can manually launch the control center software via Start ->Programs and still be able to scan images
Y	Look 'n' Stop	looknstop.exe	"Look 'n' Stop personal firewall"
N	Lotus Organizer EasyClip	easyclip.exe	""The Easy Clip icon automates the collection of information from sources such as e-mail to create an Organizer address
X	LotusHlp	LotusHlp.exe	"Added by the WINKO.AO WORM!"
N	LowRateVoip	LowRateVoip.exe	"LowRateVoip - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X	lup	lup.exe	"Added by the IRCBOT_GEN WORM!"
Y	Lusetup	LUSetup.exe	"Symantec LiveUpdate installer - required to install a new version of the application. Will only run once
U	LyraHD2TrayApp	LYRAHD2TrayApp.exe	Related to RCA Lyra MP3 Player
U	Malware Sweeper	MalSwep.exe	"Malware Sweeper - ""Protects the user from malicious malware and monitors the sanity of the running programs"""
U	McAfee Backup	McAfeeDataBackup.exe	"McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
U	McAfee Backup and Restore	McAfeeDataBackup.exe	"McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
U	McAfee Data Backup	McAfeeDataBackup.exe	"McAfee Data Backup (now Online Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
Y	McAfee Family Protection	mfp.exe	"McAfee Family Protection - which 'is easy-to-use and built to empower parents to say ""yes"" to their children's online interests while protecting them as they learn and explore' and ""protects children of all ages from exposure to inappropriate content
X	McAfee Online virus Scanner	avp.exe	"Added by the RBOT-GCV WORM! Not to be confused with Kaspersky anti-virus and AOL's Active Virus Shield (by Kaspersky) - found in either a Kaspersky or AOL sub-directory"
U	McAfeeDataBackup	McAfeeDataBackup.exe	"McAfee Online Backup (formerly Data Backup) - ""takes the hassle out of manually backing up all of your valuable digital files - from Microsoft Outlook email and contacts to treasured family photos"". Available as a stand-alone product or included in Internet Security and Total Protection"
X	MCAFEEIPS	setup.exe	"Added by the WHITEWELL TROJAN!"
X	MCX Update	wisp.exe	"Added by the RBOT-AQH WORM!"
X	mdwmdmsp	mdwmdmsp.exe	"Adware - detected by Kaspersky as the AGENT.AM TROJAN!"
X	MediaXPServicePack	mxpsp.exe	"Added by the SDBOT.CDT WORM!"
U	MemoryZipperPlus	memzip.exe	"Memory Zipper Plus - ""optimizes the memory management of your system and boost-up its performance amazingly!"""
N	MenuSnap	MenuSnap.exe	"MenuSnap from Rietta Solutions. Utility that re-orders your Start Menu items alphabetically. You may not want this utility if you're able to do this manually by selecting Start -> Programs and right-clicking and choosing "Sort by Name" if availabe"
Y	mfp	mfp.exe	"McAfee Family Protection - which 'is easy-to-use and built to empower parents to say ""yes"" to their children's online interests while protecting them as they learn and explore' and ""protects children of all ages from exposure to inappropriate content
N	MGA_CD_Install	mgasetup.exe	Matrox Millennium video driver. Not required once drivers installed
X	Microsft Security Monitor Process	mssmppp.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsft Security Monitor Process	mssmpp.exe	"Added by the SDBOT-DJW WORM!"
X	Microsoft	WinSecUp.exe	"Added by the RBOT-GPL WORM!"
X	Microsoft CP Web Manager	webcp.exe	"Added by the IRCBOT.HP TROJAN!"
X	Microsoft CPXP Protocol	cpxp.exe	"Added by the RBOT.ATP WORM!"
X	Microsoft Development Services	msdevelop.exe	"Added by the RBOT-FWS WORM!"
X	Microsoft Directx push	directxpushup.exe	"Added by a variant of the RBOT-GHT WORM!"
X	Microsoft Document	krisp.exe	"Added by the SDBOT-RQ WORM!"
X	Microsoft EXPLOREXP Protocol	explorexp.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft HDCP for NT	msdhcp.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft IDCN	mshe1p.exe	Added by an unidentified TROJAN!
X	Microsoft Internet Dumping Protocol	inetdump.exe	"Added by the IRCBOT.BLL BACKDOOR!"
X	Microsoft Java Virtual Machine	msjavarxp.exe	"Added by the FORBOT-DL WORM!"
X	Microsoft LAN32 Protocol	lanXp.exe	"Added by the RBOT-SS WORM!"
X	Microsoft Machine	temp.exe	"Added by the RBOT-FSQ WORM!"
X	Microsoft Memory Dumping Protocol	memdump.exe	"Added by the IRCBOT.BJK BACKDOOR!"
X	Microsoft Office	msvcp.exe	"Added by the AGENT-XK TROJAN!"
X	Microsoft OfficeXP	officeXP.exe	"Added by the KILLAV.MA WORM!"
X	Microsoft sdk temp	sdktemp.exe	"Added by the RBOT-ANP WORM!"
X	Microsoft Security Management	winamp.exe	"Added by a variant of the RBOT WORM! Note - this is NOT the popular Winamp media player which resides in a ""Winamp"" subdirectory of the Program Files directory"
X	Microsoft Security Manager	winamp.exe	"Added by the RBOT.TU WORM! Note - this is NOT the popular Winamp media player which is located in %ProgramFiles%\Winamp. This one is located in %System%"
X	Microsoft Security Monitor Process	mssmp.exe	"Added by the RBOT-FUB WORM!"
X	Microsoft Security Monitor Process	mnsmp.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Security Monitor Process	msmp.exe	"Added by the RBOT.GKQ WORM!"
X	Microsoft Security Monitor Process	mmp.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft Service Pack	WindowsSP.exe	"Added by the RBOT-RF WORM!"
X	Microsoft Synchronization Manager	mircup.exe	"Added by the SDBOT.BQD WORM!"
X	Microsoft U	wuamkopxp.exe	"Added by the RBOT-AHC WORM!"
X	Microsoft Update	mediap.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	winamp.exe	"Added by a variant of the RBOT WORM! Note - this is NOT the popular Winamp media player"
X	Microsoft Update	wuamkop.exe	"Added by the RBOT-AFI WORM!"
X	Microsoft Update Machine	windowsup.exe	"Added by the RBOT-FV WORM!"
X	Microsoft Updaters Pros	WINDLL32XP.EXE	Added by the SPYBOTTER.GEN VIRUS!
X	Microsoft Win Update	WinUP.exe	"Added by the RBOT-BPR WORM!"
X	Microsoft Windows Media Player	wimp.exe	"Added by the RBOT-FN WORM!"
X	Microsoft Windows Update Application	wuap.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft X Update	wuamkoppnp.exe	"Added by the RBOT-ANI WORM!"
X	Microsoft Xp Systems loader	winsystem32xp.exe	"Added by the KELVIR.W WORM!"
X	Microsofts media	wingtp.exe	"Added by the RBOT-VO WORM!"
X	Microsofts MediaScope	winmep.exe	"Added by the RBOT-WB WORM!"
X	Microsoft� System Mapper	SysMap.exe	"Added by the MAPSY TROJAN!"
U	Mini-XP	Mini-XP.exe	"Minimizer-XP from Totalidea Software - adds an additional button in the top right-corner of any application window to allow you to quickly minimize it to the System Tray. No longer available from the author but still available from download sites such as Download.com"
X	MiniPortRt	miniport_mp.exe	"Malware - see here"
?	MM Install	setup.exe	"Possibly Money Manager from Moneysoft?"
X	mnsvcsp	mnsvcsp.exe	"Added by an unidentified VIRUS
U	Mobipocket Web Companion	webcomp.exe	"Related to Mobipocket eBook Reader"
N	MoneyStartUp	Money Startup.exe	Microsoft Money
N	mozilla_cleanup	xpicleanup.exe	"Firefox Mozilla cleans up after installation. It is invoked on a restart after installation
U	MplSetup	MplSetup.exe	Used by Ricoh network printers to enable network printing from the client
U	MPSExe	mscifapp.exe	McAfee.com Privacy Service - "combines personal identifiable information (PII) protection with online advertisement blocking and content filtering"
X	mqbkup	mqbkup.exe	"Added by the OPASERV.K WORM!"
X	MSAgentXP	MSAgentXP.exe	Identified by Ewido Security Suite (Ewido is now part of AVG Technologies) as the REQLOOK.C TROJAN!
X	MSDN for Windows NT & WinXP	msdnxp.exe	"Added by the IRCBOT-PE WORM!"
X	MSDNN	help.exe	"Added by the AGENT-GBK TROJAN!"
X	MSIdll	winmp.exe	"Added by a variant of the RBOT WORM!"
X	MSN	iTuneshelp.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	MSN Messenger	msnmsxp.exe	"Added by the AGOBOT-O WORM!"
X	Msn Patch	msndp.exe	"Added by the RBOT.AAI WORM!"
X	Msn Startup	msnstartup.exe	"Added by the ARBOT.AA WORM!"
X	MSPRO32	pnp.exe	"Added by the ZOTOB.O WORM!"
X	MSREGIT	Msgp.exe	"Added by the KRYPGHOS.13 TROJAN!"
U	MSRegScan	SGP.exe	"SpyGator surveillance software. Uninstall this software unless you put it there yourself"
X	MSUpdate	svchosthlp.exe	"Added by the BLASTER.T WORM!"
X	MSWindowsUpdate	mswinup.exe	"Added by a variant of the SDBOT WORM!"
X	MS_SETUP.EXE	MS_SETUP.EXE	"Added by the CHARGE TROJAN!"
N	MWSnap	MWSnap.exe	"MWSnap - screen capture utility. Start manually when required"
X	MyCashbag	uccbp.exe	"MyCashbag adware"
X	MyVBApp	setup.exe	"Detected by Kaspersky as the VB.KB TROJAN! File location is in the root folder (i.e.
X	NAV Auto Updates	csrssp.exe	"Added by a variant of the SDBOT WORM!"
X	navapp	navapp.exe	"NavExcel adware variant"
X	navp.exe	navp.exe	"Added by the AGOBOT-OE WORM!"
X	NDIS Adapter	servenxpp.exe	"Added by the FORBOT-GP WORM!"
X	NDIS Adapter	Servenxp.exe	"Added by the SPYBOT.LY WORM!"
X	Netbios Helper	nbthlp.exe	"Added by the BANKER.Y TROJAN!"
U	NetShow Powerpoint Helper	NSPPTHLP.EXE	"If disabled
X	Network protocol service	wintcp.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Network Service	MccTrayApp.exe	Added by an unidentified WORM or TROJAN!
X	netzip	svzip.exe	"Added by the DELF.ZWL TROJAN!"
N	NetZIPFolders	nzfprop.exe	"
X	Newsgroup lptt01	newsgroup.exe	"RapidBlaster variant (in a ""newsgroup"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Newsgroup ml097e	newsgroup.exe	"RapidBlaster variant (in a ""newsgroup"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
U	nmapp	nmapp.exe	"Pure Networks ""Network Magic eliminates common frustrations and saves time by simplifying and automating set up
X	Norton Auto-Protect	ccApp.exe	"Added by the AKHER.D WORM! Note - for the valid Norton AV entry the filename is ""navapexe"". This is also not the valid Norton AV file with the same filename"
X	nortonp	nortonp.exe	"Added by the JD-A TROJAN!"
U	Notebook Maximizer	maximizer_startup.exe	Toshiba Notebook Maximizer software - adjust settings to save battery power and increase efficiency
U	NoticeP.exe	NoticeP.exe	"Part of iSync which allows ""you to transfer songs from any music downloading software to your iTunes® library"". The trial version displays advertisements which disappear if you purchase the software"
X	np	upnp.exe	"Added by the YABE.AE TROJAN!"
X	NTdhcp	NTdhcp.exe	"Added by the QQROB-C TROJAN!"
Y	NTFSCLUP	NTFSCLUP.EXE	"Part of ConfigSafe- ""checks if an ntfssos restore has been performed since it was last run. It exits immediately after running. 99+% of the time it will only execute about a dozen instructions before exiting"""
X	ntfyapp	ntfyapp.exe	"Added by the ZHELATIN WORM!"
X	NvCpl	windowsp.exe	"Added by a variant of the SDBOT WORM!"
X	NvCplDeamon	nvdisp.exe	"Added by the PEEPVIE-I TROJAN!"
X	NvCplScan	winasp.exe	"Added by the FORBOT.BZ WORM!"
Y	Nwpopup	Nwpopup.exe	"Broadcast message handler part of Novell Netware that displays server
X	OFFICEXP	OFFICEXP.exe	"Added by the WOOTBOT.HE WORM!"
X	olehelp	olehelp.exe	"Added by the BOOKMARKER.D or BOOKMARKER.G TROJANS!"
N	OmgStartup	omgstartup.exe	Sony program called OpenMG Jukebox - player and music organizer
U	OmniPass	scureapp.exe	"OmniPass from Softex Inc. - secure password management software"
X	once	help.exe	IESearchToolbar parasite. Identified by Ewido Security Suite (Ewido is now part of AVG Technologies) as the DELF.LF TROJAN!
U	Oops!Backup	OopsBackup.exe	"Oops!Backup backup software by Altaro - ""not only allows you to bring back lost
U	OopsBackup	OopsBackup.exe	"Oops!Backup backup software by Altaro - ""not only allows you to bring back lost
U	OopsBackup.Manager	OopsBackup.exe	"Oops!Backup backup software by Altaro - ""not only allows you to bring back lost
U	Operator	xtmop.exe	Fax/Phone answering facility for Extreem Machine - as supplied with the old Diamond SupraExpress modems. No longer supported
X	Osus	rrup.exe	"PurityScan adware"
U	OutlookOnDesktop	OutlookDesktop.exe	"""Outlook On the Desktop is a program that displays Outlook as a transparent
X	p	p.exe	"Added by the AGENT-U TROJAN!"
U	Panasonic HotKey Manager	HKEYAPP.EXE	HotKey management for Panasonic rugged mobile PCs
X	PC-Checkup	PCCheckUp.exe	"Installed by SpeedItUp without permission
X	PCPrivacyDefender Freeware	UPSPDAP.exe	"PCPrivacyDefender rogue privacy program - not recommended
X	PCToolPro	SysRep.exe	"PCToolPro rogue system error and cleaning utility - not recommended
X	PCTurboPro	pctp.exe	"PcTurboPro rogue system optimization tool - not recommended
X	Performs peer to peer connection	WinPTTP.exe	"Added by the RBOT-GMI WORM!"
X	PestTrap	PestTrap.exe	"PestTrap rogue spyware remover - not recommended
U	Petit Larousse 2001	HIPL2000Popup.exe	Popup dictionary tool
U	Phase One Media Reader	DCIMImp.exe	"Phase One Media Reader Capture images"
U	PHIME2002A	TINTSETP.EXE	"Microsoft's Input Method Editor for Asian languages which is used to both display and enable the input of characters in e-mails
U	PHIME2002ASync	TINTSETP.EXE	"Microsoft's Input Method Editor for Asian languages which is used to both display and enable the input of characters in e-mails
U	PNSetup	PNSetup.exe	"PopNot - pop-up killer"
U	Pop-Up_Blocker	Popup.exe	"A Tweak-XP component
Y	Pop3trap.exe	Pop3trap.exe	"Part of Trend Micro web-security products - PC-cillin 2000
X	PopUp Stopper	NO POPUP.EXE	"Added by the SPYBOT-DC WORM!"
U	PopUpStopperCompanion	PSComp.exe	"PopupStopper Companion popup blocker"
N	PowerStrip	powerstrip.exe	"PowerStrip is a Video Mode Editor to allow special Refresh Rates and Tweaking of Video Settings"
N	PowerStrip	PSTRIP.EXE	"PowerStrip is a Video Mode Editor to allow special Refresh Rates and Tweaking of Video Settings"
Y	PP2000 Real Time Scan	PPVstop.exe	Protector Plus anti-virus software - real time scanner
N	PPWWebCap	PPWebCap.exe	"PaperPort" software associated with scanners
X	Presto TuneUp	PrestoTuneUp.exe	"Presto TuneUp rogue optimization utility - not recommended
X	PrivacyProtector Free	UPRP.exe	"PrivacyProtector rogue privacy tool - not recommended
?	ProgramWindow	more comp.exe	"??"
X	ProtectingTool	SysRep.exe	"ProtectingTool rogue system error and cleaning utility - not recommended
X	ProtejaseuDrive	SysRep.exe	"ProtejaseuDrive rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
X	ProtezioneSoft	SysRep.exe	"ProtezioneSoft
Y	ProxyCap	ProxyCap.exe	"""ProxyCap enables you to tunnel Internet applications through HTTP
X	PSD Tools Channel	ChannelUp.exe	"BuddyLinks adware"
N	Ptsnoop	Ptsnoop.exe	"These descriptions I've come across - all valid as far as I can see :- (1) Program installed with some modems that monitors the COM ports for the modem driver. Not required from what I've read - may need a registry edit to get rid of it (2) Backdoor trojan virus that copies itself as PTSNOOP.EXE -see here for more info(3) Apparently the people who put it out claim it's a driver for a Voice modems (don't know who they are though - Ed) Note: If using AOL and you disable this you may lose your connection or lock up (4) Can also be an older Logitech scanner program. Remove from the Win.ini tab under Load='path'PTSNOOP and the System.ini tab under drivers='path'ptrtkr.drb. Can cause parallel port conflicts big time dragging system resources way down when a conflict exists (5) Allows audio monitoring of modem phone dialling tones and can be useful if you have connection problems (6) Karen Kenworthy's Snooper - ""logs the start and stop time of all programs run under Windows"""
N	PtUDFApp	PtUDFApp.exe	"Sony abCD program
U	pyrobatchftp	pyrobatchftp.exe	"""PyroBatchFTP lets you transfer files to/from FTP/SFTP servers in an automatic and unattended way through a simple to learn batch/script language"""
U	pyrobatchftp.exe	pyrobatchftp.exe	"""PyroBatchFTP lets you transfer files to/from FTP/SFTP servers in an automatic and unattended way through a simple to learn batch/script language"""
U	PyroTrans	pyrobatchftp.exe	"""PyroBatchFTP lets you transfer files to/from FTP/SFTP servers in an automatic and unattended way through a simple to learn batch/script language"""
X	qbkupdbs	mqbkup.exe	"Added by the OPASERV.K WORM!"
?	QUBCity	qtp.exe	"??"
U	QuickPassword	agquickp.exe	Smart card-based authentication and digital signature client software
U	RAM Idle Professional	RAM_XP.exe	"RAM Idle LE - ""A smart memory management program that will keep your computer running better
Y	RapApp	RAPAPP.EXE	"Application protection component of BlackICE PC Protection (was Defender) firewall
?	rav_temp.exe	rav_temp.exe	"??"
?	Realpopup	Realpopup.exe	"RealPopup - "Replaces old winpopup with a full featured freeware tool which remains stable and simple as its predecessor""
N	Reclip	reclip.exe	"Reclip Popup Clipboard manager"
X	recover.bmp.exe	Rundll.exe	"Added by the ANAFTP-01 TROJAN! Note - this is NOT the Win9x/Me system file of the same name as described here"
X	regdiit	winxp.exe	"Added by the RUNAUTO.F WORM!"
X	Registry Value Name	syswinxp.exe	"Added by the RBOT.BTZWORM!"
X	Registry Value Name	enzxp.exe	"Added by the RBOT-BAJ WORM!"
X	RegistryChk	winbackup.exe	"Added by the MERTIAN WORM!"
N	RemHelp	Remhelp.exe	BT Voyager ADSL Modem Help related
N	Reminder	Remind_XP.exe	HP-specific program that reminds users to create System Recovery CDs. Once they use the Recovery CD Creator (Start -> PC Help & Tools -> Recovery CD Creator) to make the recovery CDs the entry will remove itself from the startup list
N	Remind_XP	Remind_XP.exe	HP-specific program that reminds users to create System Recovery CDs. Once they use the Recovery CD Creator (Start -> PC Help & Tools -> Recovery CD Creator) to make the recovery CDs the entry will remove itself from the startup list
U	Remote Access	rnaapp.exe	"Dial-up networking application - not normally found in the startup locations. It runs when you connect to the net via this method (ie
U	Remote Data Backups	COBackup.exe	"Remote Data Backups online system/data backup utility"
X	ReparateurDeSysteme	SysRep.exe	"ReparateurDeSysteme
U	Restart WSC Setting	wscrestp.exe	"WinStart Commander - part of Ultra WinCleaner Utility Suite. Starts Windows faster and controls hidden programs to boost performance and prevent system slow downs and crashes"
U	RestoreDesktop	RestoreDesktop.exe	"Softwarium Restore Desktop ""is a Windows Context Menu addition that automatically saves and restores the icons' positions on the Windows desktop after a resolution change"""
X	richup	richup.exe	"SafeSurfing adware"
?	RjLyraInstaller	setup.exe	"??"
X	rollbk	sysup.exe	"Added by the SERFLOG.B WORM!"
X	Run	help.exe	IESearchToolbar parasite. Identified by Ewido Security Suite (Ewido is now part of AVG Technologies) as the DELF.LF TROJAN!
N	run=	lxdboxcp.exe	Lexmark DOS-Printing Control Program for the Lexmark 2050. Only required if you need to print from DOS
?	run=	wallflip.exe	"Desktop wallpaper changer?"
N	runAP	runAP.exe	"Not required but what is it?"
X	ryiixhp	ryiixhp.exe	"Added by the IRCBOT-ABR BACKDOOR!"
?	S3TRAYHP	S3trayhp.exe	"S3 Video driver related. What does it do and is it required?"
U	S3Trayp	S3trayp.exe	S3 display configuration taskbar utility for S3 chipset based graphics cards. Can be run from Start-> Settings -> Control Panel -> Display
X	s9201	av2008xp.exe	"Antivirus 2008 XP rogue security software - not recommended
X	s9201	as2008xp.exe	"AntiSpyware XP 2008 rogue spyware remover - not recommended
X	s9201	asproxp.exe	"AntiSpyware Pro XP rogue spyware remover - not recommended
X	saap	saap.exe	"180solutions adware"
X	SafeHardDrive	SysRep.exe	"SafeHardDrive rogue system error and cleaning utility - not recommended
X	SafePCTool	SysRep.exe	"SafePCTool rogue system error and cleaning utility - not recommended
X	SafeStrip	SafeStrip.exe	"SafeStrip rogue security software - not recommended
X	sapp	sapp.exe	"NCase adware"
X	SaveKeep	SaveKeep.exe	"SaveKeep rogue security software - not recommended
X	SBMPOP	SBMPop.exe	SearchByMedia adware
N	sc	scrubxp.exe	"ScrubXP - utility that deletes safe to remove files
X	scApp	scApp.exe	"Added by the STANDO-E WORM!"
U	SCDEmuApp.exe	SCDEmuApp.exe	"Related to PowerISO - CD/DVD image file processing tool"
X	SchijfBewaker	SysRep.exe	"SchijfBewaker
Y	SDTray	SDTrayApp.exe	"System Tray access to an older version of Spyware Doctor antispyware from PC Tools"
X	SearchNet_Up	ServeUp.exe	"SearchNet adware"
U	SecureItPro	Secureitpro470p.exe	"SecureIt Pro - lock your computer when you're not there
X	securw	Nctrup.exe	"Added by the NOPIR.A WORM!"
Y	Server Application for MFP Server	ServoApp.exe	"Multi Function Printer (MFP) Server Agent for Belkin's Wirless G All-in-One Print Server and ZyXEL's NPS-520"
X	Service System	windowsXP.exe	"Added by the BANCOS-EL TROJAN!"
X	Services	sysamp.exe	"Added by a variant of the SDBOT WORM!"
X	SETPOINT Logitech Inc	KHALMNP.exe	"Added by the RBOT-AAX WORM!"
N	setup	hphprld.exe ....setup.exe	HP DeskJet Setup - printers function normally without it
X	setup.exe	setup.exe	"Added by the GOLDUN-GB TROJAN!"
?	setuzp	setuzp.exe	"??"
Y	Sharing and Mapping Software	DShmap.exe	"Intel AnyPoint internet sharing software. Now discontinued"
N	shicoxp	shicoxp.exe	Installed with the drivers for multi card readers of various brands. To differentiate between the various card slots on multi slot readers the shicoxp.exe file assigns and loads unique drive icons for the various card slots that are displayed in Windows Explorer
X	SicherheitsTool	SysRep.exe	"SicherheitsTool
N	SigmaTel Audio	setup.exe	"Sigmatel audio driver"
X	sjduwiwx	rnxntup.exe	"Added by a variant of the ORCU.B TROJAN!"
X	Skype Startup	skyp.exe	"Added by the VANBOT-C WORM!"
U	Smart Connect Setup	SCSetup.exe	Appears on a Sony Vaio. Smart Connect Version 2.1 enables data transfer between Vaios via i.LINK cable. Smart Connect supports File and Printer Sharing for MS networks. You can copy files from your Vaio to another Vaio or print using a printer connected to a remote Vaio
X	Smart Defender PRO	smrtdefp.exe	"Smart Defender PRO rogue security software - not recommended
N	SmartBarXP	SmartBarXP.exe	"SmartBarXP is a bar that runs down the side of your screen
U	SMax4PNP	SMax4PNP.exe	"Analog Devices SoundMax integrated soundcard utility. Brings up the SoundMAX Control Panel when it detects if new audio devices (such as microphones
U	SMax4PNP Application	SMax4PNP.exe	"Analog Devices SoundMax integrated soundcard utility. Brings up the SoundMAX Control Panel when it detects if new audio devices (such as microphones
X	SmileyApp	stbapp.exe	"DoubleD adware"
Y	SoDA Startup	SodaStartup.exe	"Used by the IBM Rational SoDA project management tool. Unsure of it's actual purpose but it's recommended you leave it enabled if you use the software"
X	SoftCop	SoftCop.exe	"SoftCop rogue security software - not recommended
X	Software Soft Stop	Spyware Soft Stop.exe	"SoftStop rogue security software - not recommended"
X	SolutionReg	SysRep.exe	"SolutionReg rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
N	Sony Auto Update Tray Application	CONNECTAUTrayApp.exe	"System Tray access to change update settings for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
U	SoundMAXPnP	SMax4PNP.exe	"Analog Devices SoundMax integrated soundcard utility. Brings up the SoundMAX Control Panel when it detects if new audio devices (such as microphones
X	sp2fwxp	sp2fwxp.exe	Added by the SMALL.ABW TROJAN!
U	Spare Backup	SpareBackup.exe	"Spare Backup - ""Once Spare Backup is installed
N	SparVoip	SparVoip.exe	"SparVoip - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
U	SpeedItUp	SPEEDITUP.EXE	"Speed It Up - ""all in one Speed Booster designed to significantly increase the speed of your computer and boost your PC available memory"". Installs PC-Checkup and Search Defender (which is detected by DrWeb as the STARTPAGE.ORIGIN TROJAN) without permission"
U	SpeedswitchXP	SpeedswitchXP.exe	"SpeedswitchXP is a CPU frequency control for notebooks running Windows XP"
Y	SpkrCnfg	DSndUp.exe	"Utility that only runs once after installing the drivers for Analog Devices SoundMax integrated soundcards. It's exact purpose is unknown at the present time but from the filename it's probably used to configure the default or generic speaker arrangement for the system it's used on"
?	spstore	storesp.exe	"Softprobe - program designed to provide managers with an analysis of an individuals computer use who are under their supervision. This program is NOT related to Winpup"
U	Spyware Guard Control Panel	spywareguardcp.exe	"""SpywareGuard provides a real-time protection solution against spyware"""
X	Spyware Soft Stop	Spyware Soft Stop.exe	"SoftStop rogue security software - not recommended"
X	Spyware-Cop	Spyware-Cop.exe	"Spyware-Cop spyware remover - not recommended
X	SpywareSoftStop	SpywareSoftStop.exe	"SoftStop rogue security software - not recommended"
X	SpywareStop	SpywareStop.exe	"SpywareStop rogue spyware remover - not recommended
X	sqvynikp	sqvynikp.exe	Free_Scratch_Cards foistware
U	Start Network Scanner Tool	sdFTP.exe	"Part of
U	Start Up Cop	startcop.exe	"
X	Start Xp Setup	msxp.exe	"Added by the RBOT.AKK WORM!"
X	startkey	winampXP.exe	"Added by the BIFROSE-OY TROJAN!"
U	StartStop	STARTSTOP.EXE	"StartStop from TFI Technology - startup manager"
X	StorageProtector	SysRep.exe	"StorageProtector rogue system error and cleaning utility - not recommended
X	stup.exe	stup.exe	"Added by the QQROB.LE TROJAN!"
U	StyleXP	StyleXP.exe	"StyleXP allows you customize the way WinXP looks. If disabled via msconfig it re-instates itself at reboot
U	Sureshotpopupkiller	Stopthepop.exe	"Stop-the-Pop-Up popup blocker"
U	SurfHelper	SurfHelp.exe	"Related to SurfHelper - a free tool to remove popup windows
X	Susp	Susp.exe	"VX2.Transponder parasite updater/installer related"
X	svchost	[path] SETUP.EXE	"Added by the SETCLO WORM!"
X	svchost	olehelp.exe	"Added by the BOOKMARKER.G TROJAN!"
X	svchost	winhelp.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	svcshare	winampXP.exe	"Added by the FUJACKS-J VIRUS!"
?	SVM Pop	svmpop.exe	"??"
X	Swf32	_backup.exe	"Added by the SYMTEN WORM!"
X	Symantec	ccapp.exe	"Added by the REATLE WORM! Note - this is not a Symantec file"
X	Symantec Antivirus professional	winudp.exe	"Added by a variant of the WOOTBOT WORM! See here"
X	Symantec Service	ccApp.exe	"Added by the AKHER.D WORM! Note - this is also not the valid Norton AV file with the same filename"
X	SysDepannage	SysRep.exe	"SysDepannage
X	syshelp	syshelp.exe	"Added by the LOVGATE.C WORM!"
X	SysMonXP	SysMonXP.exe	"Added by the NETSKY.Q WORM!"
X	SysProtect	syp.exe	"SysProtect rogue security software
X	SysProtect	USYP.exe	"SysProtect rogue security software
X	SysProtect Free	USYP.exe	"SysProtect rogue security software
X	Systam13	exp.exe	"Added by the RBOT.ESD BACKDOOR!"
X	System	Zap.exe	"Added by the MSNVB-D WORM!"
X	system	Winhelp.exe	"Added by the IMAUT.CN WORM!"
X	System Applications Profile	sap.exe	"Added by the RBOT-QF WORM!"
X	System Database Administration Support Process	sysdasp.exe	"Added by the DERDERO.C WORM!"
X	System IP	systemip.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	System Service	backup.exe	Added by the PACKBOT.AA WORM!
X	SYSTEM service helper	syshelp.exe	"Added by a variant of the MONKBD-A WORM!"
X	System Soap Pro	soap.exe	"System Soap Pro internet cleaning software. Bundles foistware like Httper and Zipclix - best avoided"
X	System32 Temp Service	systmp.exe	"Added by the RBOT-AET WORM!"
X	system32WXBP Agent	system32WXBP.exe	"ARDAMAX.HR spyware"
X	SystemCop	SystemCop.exe	"SystemCop rogue security software - not recommended
X	SystemErrorFixer	SysRep.exe	"SystemErrorFixer rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
X	SystemOrdnare	SysRep.exe	"SystemOrdnare
X	SystUphes	algesetp.exe	"Added by the QQPASS-AM TROJAN!"
U	Systweak Memory Optimizer	memtuneup.exe	"Part of SysTweak Advanced System Optimizer"
U	TabletTip	tabtip.exe	This is the Tablet PC Input Panel for Windows XP Tablet PC Edition. This utility allows you to use a pen (in conjunction with a touchscreen or tablet) to enter text into a document or input field (such as a URL in a browser) using either handwriting or the on-screen keyboard. This utility is also included with Windows 7 and Vista but only appears to run at startup if using the XP Tablet PC version. This cannot be confirmed at present
U	TabletWizard	SPLSHWRP.EXE	Microsoft Tablet PC Component
?	Tango	Setup.exe	"Tango Broadband access software. Is it required?"
U	Task Catcher	tasktrap.exe	"Real-time monitor for Task Catcher from BillP Studios - which ""allows you to efficiently monitor programs running on your computer without slowing you down or hogging all your memory. Task Catcher will block unwanted programs from running and restart your favorite programs if they are disabled or crash"". If the program isn't registered the monitor will initially load and then close at start-up. If registered it will continue to run and optional System Tray access will also be available"
U	Task Catcher Monitor	tasktrap.exe	"Real-time monitor for Task Catcher from BillP Studios - which ""allows you to efficiently monitor programs running on your computer without slowing you down or hogging all your memory. Task Catcher will block unwanted programs from running and restart your favorite programs if they are disabled or crash"". If the program isn't registered the monitor will initially load and then close at start-up. If registered it will continue to run and optional System Tray access will also be available"
U	Task Catcher Real-Time Detector	tasktrap.exe	"Real-time monitor for Task Catcher from BillP Studios - which ""allows you to efficiently monitor programs running on your computer without slowing you down or hogging all your memory. Task Catcher will block unwanted programs from running and restart your favorite programs if they are disabled or crash"". If the program isn't registered the monitor will initially load and then close at start-up. If registered it will continue to run and optional System Tray access will also be available"
X	TASK SETUP	tasksetup.exe	"Added by the RBOT-YR WORM!"
N	Taskbar++	TaskbarPP.exe	"Taskbar++ is a software that allows you to sort (move) the buttons of the Windows taskbar by Drag & Drop"
U	TaskSwitchXP	TaskSwitchXP.exe	"""TaskSwitchXP from NTWind Software. Advanced task management utility that picks up where the standard Windows Alt Tab switcher leaves off. It provides the same functionality
U	tasktrap	tasktrap.exe	"Real-time monitor for Task Catcher from BillP Studios - which ""allows you to efficiently monitor programs running on your computer without slowing you down or hogging all your memory. Task Catcher will block unwanted programs from running and restart your favorite programs if they are disabled or crash"". If the program isn't registered the monitor will initially load and then close at start-up. If registered it will continue to run and optional System Tray access will also be available"
X	TB_setup	tb_setup.exe	"HuntBar hijacker
X	TCPIP Protocol	mstcpip.exe	"Added by the SDBOT-LR WORM!"
X	TCPXP Update	tcpxp.exe	"Added by the RBOT-UL WORM!"
X	The Service Pack Loader	spxp.exe	"Added by the RBOT-BYM WORM!"
U	ThinkPad EasyEject Utility	EzEjMnAp.Exe	"EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
N	TimeUp	Timeup.exe	"TimeUp - internet online timer"
U	TINTSETP	TINTSETP.EXE	"Microsoft's Input Method Editor for Asian languages which is used to both display and enable the input of characters in e-mails
N	Tivoli	LCFEP.EXE	"Tivoli 'TME' System Tray icon - ""'lcfep' is the program that displays statistics about the Endpoint. Apparently stopping/removing this process has no impact on the Endpoint itself which will continue to function normally"""
?	TlcR	avp.exe	"??"
?	TomcatStartup	hpbpsttp.exe	"Apache Tomcat web server
?	TomcatStartup 2.5	hpbpsttp.exe	"Apache Tomcat web server
X	ToolbarInstall	MirarSetup.exe	"Mirar adware"
X	toolsicuro	SysRep.exe	"ToolSicuro
X	topat	zlip.exe	"Added by the FLOOD-IG TROJAN!"
U	TPFNF7	TPFNF7SP.exe	Presentation Director for IBM/Lenovo Thinkpad notebooks - which allows you to create and quickly select between various single and multiple display options via the Fn+F7 key combination
U	TPFNF7SP	TPFNF7SP.exe	Presentation Director for IBM/Lenovo Thinkpad notebooks - which allows you to create and quickly select between various single and multiple display options via the Fn+F7 key combination
N	TpKmapAp	TpKmapAp.exe	"Part of the Keyboard Customizer Utility for IBM/Lenovo Thinkpad notebooks. This is the main user interface for the utility but it doesn't normally seem to be running if enabled at startup. Also
N	TPKMAPHELPER	TpKmapAp.exe	"Part of the Keyboard Customizer Utility for IBM/Lenovo Thinkpad notebooks. This is the main user interface for the utility but it doesn't normally seem to be running if enabled at startup. Also
U	TPWAUDAP	TpWAudAp.exe	Provides support for volume changes via hotkeys on IBM/Lenovo Thinkpad notebooks
X	Trojan	TrojanS_P.exe	"Added by the AGENT-CQ TROJAN!"
X	TrustCop	TrustCop.exe	"TrustCop rogue security software - not recommended
U	TurboTop	TurboTop.exe	"TurboTop - make any window ""Always on top"""
N	TVWakeup	tvwakeup.exe	MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it
U	Tweak-xp	Tweak-xp.exe	"Main program for Tweak-XP - a WinXP tweaking utility"
U	Tweaki4PU	twksup.exe	"""Tweaki puts several Windows utilities into one easy to use program while adding hundreds of additional tweaks not found in other system tweakers"""
X	Twunk_32exp.exe	Twunk_32exp.exe	"Added by the FAKEAV-BDZ TROJAN!"
N	ucstartup	ucstartup.exe	"IBM Update Connector - old auto updater feature for IBM machines that connects to IBM to see if there are any new drivers
N	ucstartup.exe	ucstartup.exe	"IBM Update Connector - old auto updater feature for IBM machines that connects to IBM to see if there are any new drivers
N	UC_Start	ucstartup.exe	"IBM Update Connector - old auto updater feature for IBM machines that connects to IBM to see if there are any new drivers
X	Update ver 1.0	Swap.exe	"Added by the SWAP-C WORM!"
N	Updates from HP	Updates from HP.exe	Automatically detects an internet connection and downloads any available updates
X	upnp	upnp.exe	"Added by the DLOADR-YT WORM!"
X	UpTimes service	WinUp.exe	"Added by the RBOT-AKB WORM!"
N	URLMAP	Urlmap.exe	"Installed by MS Money
X	USB 2.0 Driver	updateXP.exe	"Added by the AGOBOT-QP WORM!"
X	USB 2.0 Driver	UpdateXPSP.exe	"Added by the AGOBOT-QD WORM!"
Y	USBPNP	USBPNP.exe	SiPix digital camera Twain USB driver
N	USBTA	usbtapnp.exe	"System Tray access for the BeWAN Gazel 128 USB ISDN adapter"
?	USBToolTip	USBTip.exe	"Related to Pinnacle Systems Inc. What does it do and is it required?"
X	UtilisateurSur	SysRep.exe	"UtilisateurSur
X	Video Display	VDISP.EXE	"Added by the AGOBOT-KE WORM!"
X	Video Process	winasp.exe	"Added by the AGOBOT-IS WORM!"
X	Virus Sweeper	VSweep.exe	"Virus Sweeper rogue security software - not recommended
U	VisualTooltip	VisualToolTip.exe	"Related to VisualTooltip. Shows a thumbnail of a window by placing the mouse cursor over a button on the taskbar"
X	vmnetdhcp	vmnetdhcp.exe	"Added by the DWNLDR-GTC TROJAN!"
N	VoipCheap	VoipCheap.exe	"VoipCheap - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
N	Vortex Tray	asp4setp.exe	System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel
N	VortexTray	au30setp.exe	System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel
N	VortexTray	asp4setp.exe	System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel
N	VTrayp	VTtrayp.exe	Part of S3 Graphics Controllers - S3 Screentoys Helper
X	w32sup	w32sup.exe	Adult content dialler
X	w7zip	w7zip.exe	"Added by the BANCBAN-QB TROJAN!"
X	WA6PM_Check	udcwap.exe	"Part of the DriveCleaner rogue security software - not recommended
X	WA6PV_Check	udcwap.exe	"Part of the DriveCleaner rogue security software - not recommended
U	wait4IP	wait4IP.exe	"Packard Bell net2Plug allows you to network PCs anywhere in your house"
N	WarReg_PopUp	WarReg_PopUp.exe	Acer warranty registration popup
N	WaveTop Launcher	WaveTop.exe	"WaveTop - ""Get push content from TV without an Internet connection"" - now possibly a defunct system in the US included as an optional part of WebTV in Win98"
X	WCheckUp	WCheckUp.exe	"Barok keylogger and password stealer"
X	WeatherStudio Desktop	WeatherStudio Desktop.exe	"WeatherStudio adware"
U	Web2Pop	Web2Pop.exe	"Web2Pop allows you to retrieve your web-based accounts messages to read them in your favorite e-mail client"
Y	web3trap	web3trap.exe	"PC-Cillin 2000 anti-virus software → ActiveX filter. Guards against malicious ActiveX programs
U	WebExRemoteAccessAgent	raagtapp.exe	"Related to Web Meetings from WebEx Communications
Y	WebTrap.exe	WebTrap.exe	"Part of Trend Micro web-security products - PC-cillin 2000 and Virus Buster 2001. Checks web-sites for malicious Java and ActiveX elements in a similar way to McAfee WebScanX. A few users find it infuriating"
N	WFGStartup	WFGStartup.exe	"
X	Wifi Setup	wifisetup.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Win FTP	wintftp.exe	"Added by the SDBOT-KE WORM!"
X	Win WinAmp	winamp.exe	"Added by the RBOT.AGF WORM! Note - this is NOT the popular Winamp media player which resides in a ""Winamp"" subdirectory of %ProgramFiles%. This file is located in %System%"
X	win32	WinSetup.exe	"Added by the EVILBOT.B TROJAN!"
X	Win32	arsetup.exe	Added by the SPAZBOX.A TROJAN!
X	Win32 Configuration	dllhelp.exe	"Added by the SDBOT.UL WORM!"
X	Win32 Help32 Service	win32help.exe	"Added by the DELBOT-U WORM!"
X	Win32 NDIS Driver	Ndistcp.exe	"Added by the WOOTBOT.EU WORM!"
X	win32serv	servicesetup.exe	"Added by a variant of the PUSHBOT WORM! A family of worms that spread using MSN Messenger"
X	Winahlp.exe	Winahlp.exe	"Added by a variant of the VAGRNOCKER TROJAN!"
X	winallap	winallap.exe	"Added by the DELF.E TROJAN!"
X	Winamp	winamp.exe	"Added by the AGOBOT.XI WORM! Note - this is NOT the popular Winamp media player"
N	Winamp	winamp.exe	"Winamp media player. Resides in a ""Winamp"" subdirectory of the Program Files directory"
X	Winamp Agent	winamp.exe	"Added by a variant of the RBOT WORM! Note - this is NOT the popular Winamp media player. The valid filename for the Winamp Agent is ""winampa.exe"" - see here"
X	Winamp Media Player	winamap.exe	"Added by the SDBOT.ACJM BACKDOOR!"
X	Winamp Media Player	winamp.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is NOT the popular Winamp media player which resides in a ""Winamp"" subdirectory of %ProgramFiles%"
X	WinAmp Player	winampp.exe	"Added by the RBOT-AQI WORM! Note - this is NOT the popular Winamp media player which has a different filename"
X	WinApp32	msapp.exe	"Added by the RSBOT TROJAN!"
X	wincmap	wincmapp.exe	"CasClient adware variant - also detected as the CMAPP TROJAN!"
X	WinDLL (tmp.exe)	"rundll32.exe tmp.exe	start"
X	WinDLL (wintmp.exe)	"rundll32.exe wintmp.exe	start"
U	Window Washer	wwDisp.exe	"Window Washer from Webroot Software. Useful utility that deletes safe to remove files
U	Windows Accelerators	setup.exe	"KeySpy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	Windows ARP Detectionc	nvudlsp.exe	"Added by the AGENT.LMW BACKDOOR!"
X	Windows Default Server	wfdmgrsp.exe	"Added by the IRCBOT.BCX BACKDOOR!"
X	Windows Desktop Controler	windesktop.exe	"Added by the SDBOT-XH WORM!"
X	Windows Dialup Service	dialup.exe	"Added by the AGOBOT.AAH WORM!"
X	Windows Guard Pro	WindowsGP.exe	"Windows Guard Pro rogue security software - not recommended
X	Windows Helper	winhelp.exe	"Added by the BANKER.APE TROJAN!"
X	Windows Login Folder	winzep.exe	"Added by the AGOBOT-TZ WORM!"
X	Windows Logon Application	win32help.exe	"Added by the DELBOT-X WORM!"
X	Windows Logon Application	winamp.exe	"Added by the POEBOT-LR WORM! Note - this is NOT the popular Winamp media player which resides in a ""Winamp"" subdirectory of the Program Files directory"
X	Windows Media AP	winmapp.exe	Added by an unidentified WORM or TROJAN!
X	Windows Media APP	wmapp.exe	Added by an unidentified WORM or TROJAN!
N	Windows Media Powerpoint Helper	NSPPTHLP.EXE	German software (comes with some Toshiba CD writers) that helps convert Powerpoint files to ASF (Streaming Media) files. Available via Start -> Programs
X	Windows Monitor	arsetup.exe	Added by the SPAZBOX.A TROJAN!
X	Windows PNP	winpnp.exe	"Added by the RBOT-AKN WORM!"
X	Windows Reverse Preperation	winrvp.exe	"Added by the SLENFBOT.CB WORM!"
X	Windows Reversed Virus Protection	winrsvp.exe	"Added by the SLENFBOT.HX WORM!"
X	Windows Runtime Help	win32hlp.exe	"Added by a variant of the AIMVISION TROJAN!"
X	Windows Secure Update	WinSecUp.exe	"Added by the RBOT-GCD WORM!"
X	Windows Service Agent	lcaqmsp.exe	"Added by the RBOT.WFR BACKDOOR!"
X	Windows Service Agent	WinTcpip.exe	"Added by the SPYBOT.AP WORM!"
X	Windows Services	winudp.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Startup	winstartup.exe	"GoHip foistware"
X	WINDOWS SYSTEM	winaup.exe	"Added by the MYTOB-DN WORM!"
X	Windows System Backup	SysBackup.exe	Unidentified malware
X	Windows System File	cmxp.exe	"Added by the SPYBOT.KHO WORM!"
X	Windows System Security	winmp.exe	"Added by the RBOT.IV WORM!"
X	Windows System32	windowsp.exe	"Added by the MYTOB.GD WORM!"
X	Windows TCP/IP	wintcp.exe	"Added by the AGOBOT-ZH WORM!"
X	Windows Temperate Services	wintmp.exe	"Added by the SLENFBOT.ZW WORM!"
X	Windows UDP	winudp.exe	"Added by the IRCBOT.GAT WORM!"
X	Windows Update	dllhostup.exe	"Added by the BANCBAN-NB TROJAN!"
X	WindowsBackup	WINDOWSBACKUP.EXE	"Added by the STANG WORM!"
X	WindowsFirewallSvc	winsvcup.exe	"Added by a variant of the SDBOT WORM!"
X	WindowsFY	wp.exe	"Part of a ""Security IGuard"" parasite infestation - also detected as DESKTOPHIJACK"
X	windowsmp	windowsmp.exe	"Added by the AUTORUN-DP WORM!"
X	WindowsRegKey update	Windowsup.exe	"Added by the SDBOT.PU WORM!"
X	WinFix service	rsswjzgp.exe	"Added by the RBOT-FAE WORM!"
U	WinFlip	WinFlip.exe	"WinFlip from Tokyo Downstairs - a 'Flip-3D' task switcher alternative to the standard Alt+Tab on Windows XP that adds the equivalent 'Aero' feature from Windows 7 and Vista. You can either click on the tray icon
U	WinFlip.exe	WinFlip.exe	"WinFlip from Tokyo Downstairs - a 'Flip-3D' task switcher alternative to the standard Alt+Tab on Windows XP that adds the equivalent 'Aero' feature from Windows 7 and Vista. You can either click on the tray icon
U	WinGuard Pro	wgp.exe	"Winguard Pro"
X	Winhelp	winhe1p.exe	"Added by the QQPASS.E TROJAN!"
X	WinHelp	WinHelp.exe	"Added by the LOVGATE.F WORM! Note - this file is located in %System% whereas the valid one is located in %Windir%"
X	winhlp.exe	winhlp.exe	"Added by the FORMGLIEDER TROJAN!"
X	winltmpv	wutop.exe	"Added by the TCXMEDI-C TROJAN!"
U	winmatrix.exe	WinMatrixXP.exe	"WinMatrix XP - wallpaper replacement that shows different matrix effects (including flowing matrix codes from 'The Matrix' movie) on your desktop"
X	winnt DNS ident	windowxp.exe	"Added by a variant of the RBOT WORM!"
X	Winnt DNS ident	windowsp.exe	"Added by the RBOT.BAL WORM!"
X	WinPCDoctor	SysRep.exe	"WinPCDoctor rogue system error and cleaning utility - not recommended
X	WinPop	winpop.exe	"Brudevic A adware"
N	WinPopup	WINPOPUP.EXE	"Intranet chat software provided by windows for chat on small networks. Handy little LAN messaging utility. Has been included in Windows since 95
X	WinSig	NetXP.exe	"Added by the BANKER-FN TROJAN!"
X	Winsock32driver	ZoneLockup.exe	"Added by the HACARMY.D TROJAN!"
X	WINTASK	msmgrxp.exe	"Added by the MYTOB.AQ WORM!"
X	Wintbp.exe	wintbp.exe	"Added by the ZOTOB.E WORM!"
X	winthelp	winthelp.exe	"Associated with the AdvancedCleaner rogue security software - see here. Removal instructions here"
X	Winupdate Service	winxp.exe	"Added by the SPYBOT.IR WORM!"
X	winxp	winxp.exe	"Added by the BRONTOK-DN WORM!"
X	Winxp update	Cappp.exe	"Added by the RBOT.DKO WORM!"
X	WinZap Check	winzbp.exe	"Added by the RBOT-AWZ WORM!"
X	winzip	winzip.exe	"Added by the RBOT.BDA WORM! Note - this is not part of the popular WinZip file compression utility"
X	winzip	ir_ftp.exe	"Added by the BANCBAN-S TROJAN!"
X	WinZip Update	WinZip.exe	"Added by a variant of the RBOT WORM! Note - this is not part of the popular WinZip file compression utility"
X	WMP Auto Update	WINMEDUP.EXE	"Added by the RBOT.CF WORM!"
X	wnxupdate	updatexp.exe	"Added by the COMBRA-G WORM!"
X	woopie	winamp.exe	"Added by the AGOBOT.XV WORM! Note - this is NOT the popular Winamp media player"
X	ws2help	ws2help.exe	"Added by a variant of the SMALL.AN TROJAN!"
X	WSock32 Protocol	wsock32p.exe	"Added by the SDBOT.M BACKDOOR!"
X	Wupftp	wupftp.exe	"Added by the AGOBOT.AKV WORM!"
X	xibquxs	rnxntup.exe	"Added by a variant of the ORCU.B TROJAN!"
X	xmnfuruwk	rnxntup.exe	"Added by the ORCU.B TROJAN!"
X	XP Loader	loaderxp.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	XP System	systemxp.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Xpnet	NetXp.exe	"Added by the BANCBAN-AT TROJAN!"
X	Xupiter Startup	XupiterStartup.exe	"Xupiter - adware and homepage hijacker. Use Spybot S&D
N	Yankee Clipper III	YankClip.exe	"Yankee Clipper III - 'A super powerful Windows clipboard extender/memory - now in its third generation. Handles Pictures
N	YOP	yop.exe	"Dashboard Module for SBC Yahoo! Online Protection"
U	Zero PoPup Killer XP	zpk_xp.exe	"Intelligent anti-pop-up software product by Ax-Soft"
X	ziphelp	ziphelp.exe	"CoolWebSearch parasite variant"
?	zzzCamlnSuitelll	setup.exe 46***	"??"
?	zzzhpsetup	setup.exe	"??"
X	[3-4 random letters]	nslookup.exe	"PurityScan adware. Not to be confused with the legitimate nslookup.exe which is found in the System32 folder"
X	[executed file name]	App.exe	"Added by the WAXPOW WORM!"
X	[random name]	n?lookup.exe	"PurityScan adware"
X	[Randomly chosen existing folder name]	_setup.exe	"Added by the ANTINNY-L WORM!"
X	[unknown]	WIN32OP.EXE	"Added by the SDBOT-U WORM!"
X	[unknown]	ADVAP.EXE	"Added by the SDBOT-W WORM!"
X	[various names]	_ctcp.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	MNTP.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	_Cat3	msmsgrxp.exe	"Added by a variant of the SMALL-DT downloader TROJAN"
X	{----**}	mrdsregp.exe	"Zenosearch adware
X	{E4785213-3EFE-4c26-A9B4-332440E31F6F}	sysrxmfdksp.exe	"Added by the FAKEALERT-AH TROJAN!"
X	{F758F78B-0885-490e-AA3C-4A38D28B0240}	sysyeabdgfp.exe	"Added by the FAKEALERT-AM TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.