pp

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X		regedit.exe /s appboost.reg	"Added by the APPIX.D WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run and HKCU\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank. The Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file ""appboost.reg"" is located in %Windir%"
	Note the filename has a ""0"" rather than an upper case ""o"""
ME"	"MS Java Applets for Windows NT	X	javaapplets.exe
Y	3capplnk	3capplnk.exe	US Robotics Modem driver
U	A Verizon App	VERIZO~1.EXE	"Part of Verizon Online Support Manager"
Y	a-winpoet-service	winpppoverethernet.exe	"WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion
X	Aapp	adprot.exe	"AdBlaster adware"
Y	AccelerometerSysTrayApplet	AccelerometerSt.exe	HP 3D DriveGuard uses a digital accelerometer protects your disk drive by parking and halting I/O requests if you drop your PC or if you move your PC with the display lid closed
X	Access Control App	winsto.exe	"Added by the AGENT.DGO TROJAN!"
U	ACROMOUSE	ACROMAPP.exe	"Related to ACROMOUSE Laser mouse control"
X	Adobe Acrobat Distiller Application	acrotray.exe	"Added by the RANDEX.DFJ WORM!"
X	AdRotator.Application	[path to csrss.exe]	"Added by the SMALL-AQ TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	AdRotator.Application	services.exe	"FakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in an ""Inetsrv"" subfolder"
U	AEFltrs Application	AESTFltr.exe	"Part of the XP installation of the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
X	agent	ppl.exe	"Added by the DREF-U VIRUS!"
U	Agere SoftModem Messaging Applet	AGRSMMSG.exe	Installed with the drivers for internal software modems based upon Lucent/Agere Systems chipsets - required if you use the SoftModem Assistant to configure the modem
?	AidemHotKey	KEYAPP.EXE	"Keyboard related"
U	Alarm Manager	Alarmapp.exe	Palm alarm event reminder that coordinates what is on your Palm with settings on your desktop
U	Aluria's Pop-Up Stopper	eps.exe	Aluria Pop-Stopper
U	AlwaysReady Power Message APP	ARPWRMSG.EXE	"""Away Mode"" feature added with Update Rollup 2 for Windows XP Media Center Edition 2005 that allows the computer to appear off to the user while it continues to perform tasks that do not require user input
X	Antivirus	SPP.exe	"Spyware Preventer rogue security software - not recommended
X	Antivirus Protection Services	ccapp2.exe	"Added by the RBOT.EXI WORM!"
X	App*32.exe [ = random char]	App*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	App.EXEName	[path to worm]	"Added by the BODIRU WORM!"
X	ApPache System	ApPache.exe	"Added by the RBOT-YP BACKDOOR!"
U	Appcon	vAppCon.exe	"Vital Application Console - part of POS-partner 2000 point-of-sale software from Vital. This is the taskbar icon and is enabled at startup by the "Auto-start when OS starts" option. Required for a connection to be established"
X	appconn	appconn.exe	"Added by the CARGAO WORM!"
U	AppExtender	AppExtCB.exe	"Loads the Confimax add-in for popular E-mail programs to confirm E-mails have been sent and received"
X	appis.exe	appis.exe	"Added by the AGENT-BC TROJAN!"
N	AppleSyncNotifier	AppleSyncNotifier.exe	"From WinPatrol PLUS by BillP Studios - ""This file installs with iTunes and is used when syncing your iPhone
X	AppletINIT	INITIATE.EXE	"Added by the AGOBOT.XV TROJAN!"
Y	Application	mdmsetsp.exe	"Aztech Labs modem driver"
X	Application	csrss.exe	"Added by the BEAGLE.EG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Application Adapter	abvsvc.exe	"Added by the CHECKOUT WORM!"
U	Application Explorer	Naldesk.exe	"Novell Zenworks Application Explorer Executable. ""For almost all users the Novell ZENworks agent (either Application Launcher or Application Explorer) will be run via the user's login script on each successful login. ZENworks is used to periodically deliver software updates and is also used to install the remote management components."""
U	Application Explorer	NalView.exe	"Application Explorer - file manager type access to Novell Application Launcher for installing and updating network residing applications"
X	Application Explorer	appexplr.exe	"Added by the AGENT-NMO TROJAN!"
X	Application In System	Snxmsh.exe	"Added by the AGENT-LNV TROJAN!"
N	Application Launcher	Application Launcher.exe	"System Tray access to the Sony Ericsson PC Suite and HTC Sync mobile phone management utilities. Run manually via the Start Menu (or optional desktop shortcut) before connecting the phone"
X	Application Layer Browser	abgsvc.exe	"Added by the ULPM.FX TROJAN!"
X	Application Layer Gateway Service	algs.exe	"Added by the LINKBOT.M WORM!"
X	Application Layer Scheduler	agtsvc.exe	"Added by the IRCBOT.BJJ BACKDOOR!"
X	Application Layer Services	avrsvc.exe	"Added by the IRCBOT.BJM BACKDOOR!"
X	Application Manager	acnsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Application Manager	apnsvc.exe	"Added by the SMALLTRO.FN TROJAN!"
X	ApplicationProtocolRun	smsbvl32.exe	"Added by the IRCBOT-CX TROJAN!"
U	AppPlus	AppPlus.exe	"AppPlus - ""menu bar or tray launcher that docks to your desktop
U	AT&T Self Support Tool	matcli.exe	"AT&T Resolution Assistant. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	ATI Task Application	Atitkad.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display
N	ATI Task Application (Atikey)	Atitask.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display
U	ATSpooler	AppsTraka.exe	"DeskTopScout keystroke logger/monitoring program - remove unless you installed it yourself!"
N	AudioCommander Application	AudioCommander.exe	"System Tray access to the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
U	Bart Station	PPCOLink.exe	Dialer for PeoplePC ISP
U	BayMgr	DockApp.exe	Hot-swappable drive management on laptops allowing you to change drives without closing down Windows. Only required if you frequently swap bay devices
U	BestSync 2008	BestSyncApp.exe	"System Tray access to BestSync® 2008 from Risefly Software - ""a professional utility for synchronizing files between your local folders and Network Drives
X	bin32hpu	ppstub.exe	"PrecisionPop adware"
X	Blah service	CCAPPS32.EXE	"Added by the RBOT.TV WORM!"
N	BLSTAPP	blstapp.exe	Puts access to Creative's BlasterControl in the System Tray
U	blueyonder Instant Support Tool	matcli.exe	"Blueyonder Instant Support Tool. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	Bsoft lppt01	Bsoft.exe	"RapidBlaster variant (in a ""BelmontSoft"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
U	btbb_wcm_McciTrayApp	McciTrayApp.exe	"System tray access to Motive's Broadband 2.0 configuration and repair utility"
U	CallCenter Main Application	V3calmcp.exe	"""V3 Inc. CallCenter is a free 32-bit
?	CameraApplicationLauncher	CameraApplicationLaunchpadLauncher.exe	"Supports the integrated webcam on IBM/Lenovo Thinkpad notebooks. What does it do and is it required?"
N	Camio Viewer x	IXApplet.exe	Image viewing program that comes with digital cameras. Shows pictures that are in the camera before downloading them. "x" in the name is the version
Y	ccApp	ccApp.exe	"Part of earlier versions of Norton AntiVirus - Auto-protect and E-mail check will not function without this"
X	ccApp	[random filename]	"Added by the OBSORB TROJAN! Note the random filename compared to the valid Norton AntiVirus"
X	ccApp	WMADZ.EXE	"Added by the RBOT-LJ WORM!"
X	ccApp	.EXE	"Added by the RBOT-LJ WORM!"
X	ccApp	gcasServ.exe	"Added by a variant of the RBOT WORM! Do not confuse with the Microsoft AntiSpyware executable of the same name"
X	ccApp	example.exe	"TwoSeven spyware"
X	ccAppr	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccAppr	expIorer.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccAppr	outIook.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccAppr	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccApps	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
X	ccApps	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	ccApps	N/A	"Added by the KANGAROO-A TROJAN!"
X	ccApps	ccApps.exe	"Added by the KANGAROO-B WORM!"
X	ccpApps	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	ccpApps	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
Y	CleanUp	mcappins.exe	Used by older versions of McAfee internet security related products to clean up installation files that are no longer required once the product is installed. This entry will normally only appear once the product has been installed before the system is rebooted
?	CleanupProgram	cleanup.exe	"Sony Vaio related - what does it do and is it required? Located in a C:\Sonysys folder"
U	Client Access API Daemon	cwbappcd.exe	"IBM iSeries Client Access
X	CMAPP	cmappclient.exe	"CasClient adware - also detected as the CMAPP TROJAN!"
X	cmssapp	iexplore_.exe	"Added by the BANCBAN-CQ TROJAN!"
X	cmssapp	iexplore.exe	"Added by the BANCBAN-GF TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	Cobian Backup 7 Application	CobBU.exe	"Cobian Backup 7 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (NT/2K/XP). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
X	COM+ System Application	lsas.exe	"Added by the AGOBOT-MO WORM!"
X	COM+ System Applications	lsas.exe	"Added by the AGOBOT.SE WORM!"
X	ComcastSUPPORT	tgkill.exe	Comcast (the cable folks who are replacing @home in some parts of the USA) have struck a deal with Tioga to provide an "enhanced" support and self-repairing tool. This is "beta" at present and was made available to download by mistake at present. Remove via Start -> Settings -> Add/Remove Programs
Y	Common Client	ccApp.exe	"Part of earlier versions of Norton AntiVirus - Auto-protect and E-mail check will not function without this"
X	ComPlus Applications	twain.exe	"Added by the AGENT.AQO TROJAN!"
X	configuration	apphost.exe	"Added by the SDBOT-VP WORM!"
N	CONNECTAUTrayApp	CONNECTAUTrayApp.exe	"System Tray access to change update settings for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
U	Copperhead	razerhid.exe	"Razer Copperhead gaming mouse driver - required if you use the additional features and programmed keys/macros"
N	Corel Desktop Application Director	dadx.exe	The Desktop Application Director (DAD) gives you easy access to all Corel applications - x represents ther version number. Available via Start -> Programs
U	CostAware	niIPCApp.exe	"NetInternals CostAware - download quota measuring tool"
?	CPortPatch	cppatch.exe	"CPortPatch is a utility is required for Dell laptops that are using a docking station. Is it needed though?"
X	cppc	[path to trojan]	"Added by the VB-NV BACKDOOR!"
Y	DadApp	dadapp.exe	""DadApp is the SW utility that controls the programmable buttons on Dell Laptops. Not required
U	DellSupport	DSAgnt.exe	Dell Support Agent offers additional support and update features for your Dell computer or laptop
U	DellSupportCenter	sprtcmd.exe /P DellSupportCenter	"Dell Support Center (provided by SupportSoft
U	DeltaIITaskbarApp	DeltaIITray.exe	"System Tray access to the Delta Control Panel for the M-Audio Delta series of PCI audio cards"
U	DetectorApp	DetectorApp.exe	"Related to Roxio MyDVD (was Sonic) DVD authoring software"
X	DialUp Network Application	Rnaap.exe	"Added by a variant of the SDBOT WORM!"
N	DMISLAPP	DMISLAPP.exe	"DMI (Desktop Management Interface) Service Layer for Intel TokenExpress network card software. DMI support for the Intel network card managed through the Desktop Management Interface. See here for more information"
U	Don't Panic Pop-Up Stopper	dpps2.exe	"Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group"
U	dpps2	dpps2.exe	"Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group"
N	DwlClient	support.exe	Download manager for Dell support alerts
X	dwqblwppx.exe	[random].exe	"Okcashbackmall adware"
U	EanthologyApp	EANTHO~1.EXE	"eAcceleration Stop-Sign security software related. Previously not recommended
U	EanthologyApp	eanthology.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
X	Edzy AntiVirus	dppsfa.exe	"Added by a variant of the RBOT WORM!"
U	EOUApp	EOUWiz.exe	Intel ProSET Wireless related - provides additional configuration options for these devices
U	eTrust PestPatrol Active Protection	PPActiveDetection.exe	"PestPatrol real-time protection feature. ""Stops spyware before it infects your system"""
X	EventApplicationCmd	smschk.exe	"Added by the IRCBOT-AO TROJAN!"
U	EZSMART App	ezsmart.exe	EZ-S.M.A.R.T. hard drive monitoring software from StorageSoft - appears to be no longer supported
U	F-PROT Antivirus Tray application	FProtTray.exe	"System Tray access to F-PROT Antivirus"
?	fgl23DoubleScreenHooks	f23happ.exe	"Related to the now discontinued ATI Fire GL3 graphics card. What does it do and is it required?"
X	File Mapping Services	hp-1003.exe	"Added by the RBOT.FAN WORM!"
N	filehippo.com	UpdateChecker.exe	"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
N	FileHippo.com Update Checker	UpdateChecker.exe	"Checks for new releases available in the popular FileHippo.com repository for any software you may already have installed on your computer. Run manually when required"
U	FingerPrintSoftware	fpapp.exe	Supports the fingerprint reader on selected IBM/Lenovo Thinkpad notebooks
X	Floppy Master	[path to trojan]	"Added by the ZONIT-F TROJAN!"
N	GhostStartTrayApp	GhostStartTrayApp.exe	"System Tray access to Norton Ghost - added from the 2003 version"
X	GoogleUpdater3	GoogleMapper.exe	"Added by the ROUTROBOT WORM!"
U	Gravis Appawareloader	dbserver.exe	"Looks like it's associated with Gravis game controllers and the Keyset Manager
U	Gravis Xperience Driver Support	Grxp4exe.exe	"Driver for Gravis game controllers such as the Eliminator Aftershock. Must be loaded if you run the supplied application software for the controller to be recognized. Start it manually via a shortcut if not used"
Y	GuardGui Application	GuardGui.exe	"System Tray access to the main user interface for Ashampoo® AntiVirus from Ashampoo GmbH & Co. KG."
U	HotkeyApp	HotkeyApp.exe	"Programmable keys on Acer
U	HP AutoIndexer	hppautoindexer.exe	"Installed by HP multi-function printer driver software
X	HP Desktop	ccappms.exe	"Added by the SDBOT-TG WORM!"
U	HP Instant Support	matcli.exe	""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	HP Laser Jet Director	hppdirector.exe	"System Tray icon that opens various functions such as copy
N	HP Parallel Port Test	hppt.exe	Associated with a HP ScanJet scanner
X	HP Photo Manager	HPPhotoManager.exe	"Added by the SDBOT.AXU WORM!"
U	HP SchedIndexer	hppschedindexer.exe	"Installed by HP multi-function printer driver software
Y	hpppt	hpppt.exe	Related to the drivers for HP ScanJet scanners
Y	hpppta	HPPPTA.exe	HP parallel port driver for certain hardware
X	HpPrinter	hpserver.exe	"Added by the CMJSPY-W TROJAN!"
N	HPPROPTY	HPPROPTY.EXE	"HP LaserJet Toolbox"
U	HPPWRSAV	HPPWRSAV.EXE	"Power save related for HP Scanners. Many users have complained of system freezes with it running but it stops the light from remaining on all the time. Try www.hp.com
Y	iamapp	iamapp.exe	"AtGuard personal firewall engine. As Atguard was bought by Symantec some time ago
U	IBM ThinkPad EasyEject Support Application	EzEjMnAp.Exe	"EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
U	IMOL	IMOLApp.exe	"IncrediMail for Office Outlook Add-On"
X	Internet Application Driver	expIorer.exe	"Added by the IRCBOT-WK TROJAN!"
N	IPPDetect	IPP4Detect.exe	"Part of Presto! Mr.Photo - ""an ideal program for creating
?	iPrint LPT Redirector	nipplpte.exe	"Related to Novell iPrint - ""a printing solution that enables you to send documents to printers located throughout the Net."" Is it required?"
X	iSecurity applet	"rundll32.exe iSecurity.cpl	SecurityMonitor"
X	Java applet	javaup.exe	"Added by the SDBOT-ACF WORM!"
X	Java Application	vssmf32.exe	"Added by the SPIGOT BACKDOOR!"
N	KAZAA	[path] kpp.exe [path] kazaalite.kpp	"System Tray access to later versions of the Kazaa Lite P2P file sharing utility - namely the K++ and Resurrection variants. Kazaa Lite is the unauthorized modification of the original Kazaa Media Desktop - with the malware removed"
Y	KB926239	"rundll32.exe apphelp.dll	ShimFlushCache"
X	KernellApps	csrss.exe	"Added by the BANCBAN-AC TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""System"" subfolder"
X	KernellApps	lexplore.exe	"Added by the BANCBAN-BS TROJAN! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	KernellApps	svshosti.exe	"Added by the BANCBAN-V TROJAN!"
X	KernellApps32	smss.exe	"Added by the BANCBAN-AN TROJAN! Note - this is not the legitimate smss.exe process which should not normally figure in Msconfig/Startup!"
X	KIT3	hpprintqueue.exe	"Added by the ADCLICK-DS TROJAN!"
X	KnowledgeBase GUI	wppewafaj.exe	"Added by the RBOT-GRZ WORM!"
U	KN_PanelApp	PanelApp.exe	"KnowledgePanel online survey software"
U	LaunApp	LaunApp.exe	Part of Acer Launch Manager - programmable keys on such laptops as the TravelMate 610
N	Launch Application	LaunchApplication.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
Y	LaunchApp	Alaunch	"Part of Acer eRecovery - ""a powerful utility that does away with the need for recovery disks provided by the manufacturer
N	LaunchApplication	LaunchApplication.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
N	lexpps	lexpps.exe	"For Lexmark printers. From Lexmark: "This enables bi-directional printing over a peer to peer network. If the printer is connected directly to your PC
U	LManager	HotkeyApp.exe	"Programmable keys on Acer
X	Logitech Desktop	ApPache.exe	"Added by the RBOT-YP WORM!"
Y	LogitechRegisterVideoApplications	InstallHelper.exe	Entry added when you install versions of the Logitech QuickCam webcam software and used to register video applications that can use the webcam on the first reboot after installing the software
X	LowVersionSupport	[filename]	"Added by the LASTRAS TROJAN!"
U	LtcyCfgApply	LtcyCfg.exe	"PCI Latency Tool - ""Utility to set PCI Latency and possibly prevent game stutter or improve FPS"" for older AGP/PCI graphics cards"
U	LyraHD2TrayApp	LYRAHD2TrayApp.exe	Related to RCA Lyra MP3 Player
U	MacDrive application	MacDrive.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
U	MAFWTaskbarApp	MAFWTray.exe	Drivers for the M-Audio Firewire Audiophile - Interface
X	MalwareStopper	MalwareStopper.exe	"Malware Stopper rogue security software - not recommended"
Y	McAfee Application Installer	mcappins.exe	Used by older versions of McAfee internet security related products to clean up installation files that are no longer required once the product is installed. This entry will normally only appear once the product has been installed before the system is rebooted
Y	mcappins	mcappins.exe	Used by older versions of McAfee internet security related products to clean up installation files that are no longer required once the product is installed. This entry will normally only appear once the product has been installed before the system is rebooted
X	MediaPipe P2P Loader	mpp2pl.exe	"MediaPipe peer-to-peer file swapping program also reported as a hijacker"
U	MemoryZipperPlus	memzip.exe	"Memory Zipper Plus - ""optimizes the memory management of your system and boost-up its performance amazingly!"""
X	Micro Process	appconf.exe	Added by an unidentified WORM or TROJAN!
X	MICROSFT ANTIVIRUS UPDATE SUPPORT	[random 10-letter filename].EXE	"Added by the RBOT-AQA WORM!"
X	MICROSFT ANTIVIRUS UPDATE SUPPORT	MSGUPDATED.EXE	"Added by the RBOT-APZ WORM!"
X	MICROSFT MX UPDATE SUPPORT	taskmngrs.exe	"Added by the RBOT-AUZ WORM!"
X	MICROSFT MX UPDATE SUPPORT	winmx32.EXE	"Added by the IRCBOT-FD WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	[random filename]	"Added by the RBOT-ASM or RBOT-AUW WORMS!"
X	MICROSFT RAMA UPDATE SUPPORT	MSN32.EXE	"Added by the RBOT-AWJ WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	mtakthmyn.EXE	"Added by the RBOT-AUJ WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	MSGUPDAT32.EXE	"Added by the RBOT-BBB WORM!"
X	Microsft Security Monitor Process	mssmppp.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsft Security Monitor Process	mssmpp.exe	"Added by the SDBOT-DJW WORM!"
X	Microsoft	lsass.ppf	"Added by the RBOT-GAA WORM!"
X	Microsoft (C) HTML Application host	[random filename]	"Added by the RBOT-YB WORM!"
X	Microsoft Application Center	mappc.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Application Manager	msapl32.exe	"Added by the BROPIA-AE TROJAN!"
X	Microsoft Buffer App	msbuffer.exe	"Added by the SLINBOT.NQ BACKDOOR!"
X	Microsoft Core Support	MSxUP32.exe	"Added by the RBOT-ANR WORM!"
X	Microsoft Core Support	[random filename]	"Added by a variant of the RBOT TROJAN!"
X	Microsoft Datalog Application	msdata.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Help Support	mshelp32.exe	"Addded by the KELVIR-BF WORM!"
X	Microsoft Map PC	mappc.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Mapped PC	mappedpc.exe	"Added by a variant of the RBOT WORM!"
U	Microsoft Media Center Tray Applet	ehTray.exe	"Media Center Tray Applet - part of Windows Media Center on XP MCE
X	Microsoft Server Applacations	msnmsg.exe	"Added by the AGOBOT.BBM WORM!"
X	Microsoft Server Applacations	wuauct1.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Server Applacations	lsasss.exe	"Added by the RBOT-AQQ WORM!"
X	Microsoft Server Applacations	Q8See.exe	"Added by the SPYBOT.GEN3 TROJAN!"
X	Microsoft Server Applacations	cli.exe	"Added by the RBOT-GAQ WORM!"
X	Microsoft Server Application	Sound.exe	"Added by the RBOT-NE WORM!"
X	Microsoft SpA Service	msapps.exe	"Added by the RBOT-VI WORM!"
X	Microsoft Support	sys32ms.exe	"Added by the RBOT-AHI WORM!"
X	microsoft support	svchostt.exe	"Added by the AGOBOT.AWN WORM!"
X	Microsoft Visual Application	vpcrtf.exe	"Added by the IRCBOT-XJ TROJAN!"
U	Microsoft Windows Media Player Network Sharing Service Configuration Application	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	Microsoft Windows Update Application	wuap.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Winsock Wrapper	ws2_32s.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft X Update	wuamkoppnp.exe	"Added by the RBOT-ANI WORM!"
X	Microsoft� System Mapper	SysMap.exe	"Added by the MAPSY TROJAN!"
X	Microsot NT Support	[random filename].exe	"Added by the RBOT-CTI WORM!"
N	Mobile Connectivity Suite	Application Launcher.exe	"System Tray access to the HTC Sync mobile phone management utility for models including the Hero
X	MonAppli	[random filename]	"Added by the DELF.IF TROJAN! The most common filenames are isys32.exe & msnmsg.exe"
X	mppdds	mppdds.exe	"Added by the PWS-AKZ TROJAN!"
X	mppds	mppds.exe	"LEGMIR.AQZ spyware"
U	MPSExe	mscifapp.exe	McAfee.com Privacy Service - "combines personal identifiable information (PII) protection with online advertisement blocking and content filtering"
X	MS Java Applets for Windows NT & XP	javaapplet.exe	"Added by the RBOT.BHG WORM!"
X	MS Java Service Wrapper Windows NT & XP	wrapper.exe	"Added by the VANEBOT-D WORM!"
X	MS USB 2.0 Windows Support	msusb32.exe	"Added by a variant of the RBOT WORM!"
X	msappts32	msappts32.exe	"Added by the ELBURRO-A TROJAN!"
?	MSCRMStartup	Microsoft.Crm.Application.Hoster.exe	"Related to Microsoft Dynamics CRM integrated solutions for Financial
X	MSN File & Folder Sharing App	msnfileshare.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Msn Update SUPPORT	[random filename]	"Added by the RBOT-BPS WORM!"
N	msnappau	msnappau.exe	"Updater for the MSN toolbar that can be downloaded onto IE. Calls home every day or so to ""update"" the toolbar"
N	msnsyslog	msnappm.exe	"Related to Messenger Applications. When you uninstall the trial version the msnappm keeps saying (You have xx days left) this is adware and it very annoying"
X	MSPP System Update 64	wiaadmgr.exe	"Detected by Kaspersky as the RANKY.GEN TROJAN!"
X	My App	SMSSvc.exe	"Added by the NEGASMS.A TROJAN!"
X	Myapp	[filename]	"Added by the FATEE.B WORM!"
X	Myapp	service.exe	Homepage hijacker
X	MyVBApp	SysNT.exe	"ReferAd adware"
X	MyVBApp	install.exe	"Detected as Generic Downloader.s by McAfee
X	MyVBApp	setup.exe	"Detected by Kaspersky as the VB.KB TROJAN! File location is in the root folder (i.e.
X	navapp	navapp.exe	"NavExcel adware variant"
X	NDIS Adapter	servenxpp.exe	"Added by the FORBOT-GP WORM!"
X	NetApp	winserv.exe	"Added by the SHADOWTHIEF TROJAN!"
N	NetAppel	NetAppel.exe	"NetAppel - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
U	NetShow Powerpoint Helper	NSPPTHLP.EXE	"If disabled
X	Network Service	MccTrayApp.exe	Added by an unidentified WORM or TROJAN!
U	nmapp	nmapp.exe	"Pure Networks ""Network Magic eliminates common frustrations and saves time by simplifying and automating set up
Y	NMSSupport	IntelHCTAgent.exe	"Network monitor for Intel® Hub Connect Technology"
N	Nokia Tray Application	NclTray.exe	"Part of Nokia PC Suite version 5 - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" Monitors ports to see if a phone has been connected and provides System Tray access to the Connection Manager (and other PC Suite components if a phone is connected). Available via the Control Panel as ""Nokia Connection Manager"""
N	NokiaPCSuiteTray	LaunchApplication.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
X	Norton Auto-Protect	ccApp.exe	"Added by the AKHER.D WORM! Note - for the valid Norton AV entry the filename is ""navapexe"". This is also not the valid Norton AV file with the same filename"
X	Norton Protect	npprotect.exe	"Added by the RBOT-WW WORM!"
X	NT LM Security Support Provider	WinNTLM.exe	"Added by a variant of the SDBOT WORM!"
X	ntfyapp	ntfyapp.exe	"Added by the ZHELATIN WORM!"
X	nVidia Application Drivers	nvidiav32.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Office_app	msnmrgs.exe	Added by a variant of the VBBANC-A TROJAN!
U	OmniPass	scureapp.exe	"OmniPass from Softex Inc. - secure password management software"
N	OneNote 2007 Screen Clipper and Launcher	ONENOTEM.EXE	"System Tray access to MS Office OneNote 2007 - an electronic notebook that allows you to create free-form notes
X	p2snetis	comippwa.exe	"Added by the SPAMTOO-AL TROJAN!"
U	Panasonic HotKey Manager	HKEYAPP.EXE	HotKey management for Panasonic rugged mobile PCs
N	Paperport	runppdrv.exe	"Loads the drivers associated with monitoring scanner status associated with PaperPort software. Can be a resource hog - see here"
N	PaperPort PTD	pptd40nt.exe	"Part of Nuance (ScanSoft) PaperPort - ""scan
N	PC Suite	LaunchApplication.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
N	PC Suite for Smartphones	Application Launcher.exe	"System Tray access to the Sony Ericsson PC Suite mobile phone management utility for some models
U	PCLEPCI	ppe.exe	"Pinnacle Systems PCI Performance Enhancer. "This tool helps to increase the PCI Busmaster performance of all Pinnacle PCI boards.""
N	PCSuiteTrayApplication	TrayApplication.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
N	PCSuiteTrayApplication	LaunchApplication.exe	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
N	PCSuiteTrayApplication	TRAYAP~1.EXE	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
N	PCSuiteTrayApplication	LAUNCH~1.EXE	"System Tray access to Nokia PC Suite - which ""is a free PC software product that allows you to connect your Nokia device to a PC and access mobile content as if the device and the PC were one."" This allows you (amongst other options) to backup your devices contents to your PC
Y	PCTAVApp	PCTAV.exe	"System Tray access to PC Tools AntiVirus from PC Tools - which ""provides world-leading protection against viruses
U	pdfFactory Dispatcher v1	fppdis1a.exe	"FinePrint pdfFactory Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory printer. Version 1.x of the software. ""pdfFactory products offer a unique approach to PDF creation that is simpler
U	pdfFactory Dispatcher v2	fppdis2a.exe	"FinePrint pdfFactory Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory printer. Version 2.x of the software. ""pdfFactory products offer a unique approach to PDF creation that is simpler
U	pdfFactory Pro Dispatcher v1	fppdis1.exe	"FinePrint pdfFactory Pro Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory PRO printer. Version 1.x of the software. ""pdfFactory products offer a unique approach to PDF creation that is simpler
U	pdfFactory Pro Dispatcher v3	fppdis3a.exe	"FinePrint pdfFactory Pro Dispatcher - background task which handles the creation of PDF files when you print to the FinePrint pdfFactory Pro printer. Version 3.x of the software. ""pdfFactory products offer a unique approach to PDF creation that is simpler
N	PDIBM Application	pdibm.exe	"Part of the IBM customized version of SafeGuard PrivateDisk from Utimaco - which provides secure area of hard disk where files and folders are encrypted. This entry loads the associated IBM wizard to create the initial secure area once the program has been installed and will no longer be loaded (but remains as a startup entry) once it is completed"
N	PerfectPrint	pfppop70.exe	Print engine used by Corel WordPerfect 7 and Presentations 7
U	PestPatrol Control Center	PPControl.exe	"PestPatrol Control Terminal - utility that launched PestPatrol features such as PPMemCheck and CookiePatrol before CA's acquisition"
X	PoliceAV	xppolice.exe	"XP Police Antivirus rogue security software - not recommended
U	POP Peeper	POPPeeper.exe	"POP_Peeper from Mortal Universe Software Entertainment ""is an email notifier that runs in your Windows task bar and alerts you when you have new email on your POP3
U	Pop-Up Stopper	dpps2.exe	"Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group"
X	PopUp Stopper	NO POPUP.EXE	"Added by the SPYBOT-DC WORM!"
X	popuppers	newpop63.exe	"Medload adware"
X	popuppers64	a64sddd.exe	"Popuppers adware
X	popuppers65	[path to file]	"Medload adware"
U	PopUpStopperCompanion	PSComp.exe	"PopupStopper Companion popup blocker"
U	PopUpStopperFreeEdition	PSFREE.EXE	"Panicware's Pop-Up Stopper - free limited features version"
U	PopUpStopperProfessional	PopUpStopperProfessional.exe	"Panicware's Pop-Up Stopper - paid for version"
U	PowerPanel Personal Edition User Interaction	pppeuser.exe	"CyberPower PowerPanel Personal Edition UPS Monitoring & Control Software - ""is included with CyberPower's products. This exclusive software allows control and monitoring of your UPS to provide protection for your computer system
X	pp	pp12.exe	"Added by the DWNLDR-HXV TROJAN!"
X	pp	pp2.exe	"Added by a variant of the KOOBFACE WORM!"
U	PP Gamma	ppgamma.exe	"Profile Prism software that allows monitor calibration and can generate ICC profiles for digital cameras"
N	PP****usb	FBDirect.exe	"Software that monitors the status of a Visioneer OneTouch scanner button and allows you to scan
U	PP2000 Instaupdate	PPInupdt.exe	Protector Plus anti-virus software - instant update program for virus data updates. Not required if you regularly update virus data manually
Y	PP2000 Real Time Scan	PPVstop.exe	Protector Plus anti-virus software - real time scanner
Y	PP2000 Taskbar Control	PPTbc.exe	Protector Plus anti-virus software - system tray access
N	PP3100b	flatbed.exe	"Twain driver for the Visioneer PaperPort 3100b scanner that allows you to scan
U	ppass	Antispy.exe	"AntiSpy firewall - ""program designed to combat against various types of intrusion and monitoring programs currently in use or presently being developed worldwide"""
U	PPControl	PPControl.exe	"PestPatrol Control Terminal - utility that launched PestPatrol features such as PPMemCheck and CookiePatrol before CA's acquisition"
U	PPCRunonce	PPCRunOnce.exe	"Related to PeoplePC ISP software - may display advertising
U	PPHIDPAD	pphidpad.exe	"PenPower Chinese handwriting recognition software"
U	PPK Setup(Server)	SEServe.exe	"Programmable Power Key on Sony Vaio laptops. "Using the Programmable Power Key (PPK) button
N	ppmate	ppmate.exe	"PPMate - free tool for streaming online TV via P2P (peer-to-peer)"
U	PPMemCheck	ppmemcheck.exe	"PPMemCheck - used to be part of PestPatrol before CA's acquisition"
N	PPort10reminder	Ereg.exe ereg.ini	"Registration reminder for PaperPort version 10 from Scansoft (now Nuance)"
N	PPort11reminder	Ereg.exe Ereg.ini	"Registration reminder for PaperPort version 11 from Scansoft (now Nuance)"
N	PPort12reminder	Ereg.exe Ereg.ini	"Registration reminder for PaperPort version 12 from Nuance"
N	PPort9reminder	Ereg.exe ereg.ini	"Registration reminder for PaperPort version 9 from Scansoft (now Nuance)"
X	PPPOEO	pingppac.exe	"Added by the SPYBOT.KHC WORM!"
X	PPPOEOE	winlite.exe	"Added by the RBOT-AAN WORM!"
N	PProTray	pprotray.exe	Part of the power professional program. Loads the System Tray control
?	PPScheduler	PPScheduler.exe	"Part of Nuance (ScanSoft) PaperPort - ""scan
U	PPSVC	[path to file]	"PC Police surveillance software that logs keystrokes
U	PPSYS	ppsys.exe	"PC Police commercial keystroke logger. Uninstall this software if you did not install it yourself"
N	pptd40nt	pptd40nt.exe	"Part of Nuance (ScanSoft) PaperPort - ""scan
U	PPUpdate	ppupdater.exe	"PPUpdater - updater that used to be part of PestPatrol before CA's acquisition"
N	PPWWebCap	PPWebCap.exe	"PaperPort" software associated with scanners
X	Prein	APP***.tmp [ = random char or digit]	Unidentified adware
?	PreloadApp	hphprld.exe	"HP PhotoSmart printers related. What does it do and is it required?"
X	Print Hp Tray	hpprint.exe	"Added by the RBOT-GWE WORM!"
N	PtUDFApp	PtUDFApp.exe	"Sony abCD program
X	qappsrvc32.exe	qappsrvc32.exe	"Detected by Kaspersky as the WEBBER.M TROJAN!"
Y	RapApp	RAPAPP.EXE	"Application protection component of BlackICE PC Protection (was Defender) firewall
X	Realplayer Codec Support	realsched.exe	"Added by the AGOBOT-AAD WORM! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name"
X	Registry Loader	winhlpp32.exe	"Added by the GAOBOT.AO WORM!"
U	Remote Access	rnaapp.exe	"Dial-up networking application - not normally found in the startup locations. It runs when you connect to the net via this method (ie
U	RevoTaskbarApp	RevoTask.exe	Control Application for M-Audio Revolution 7.1 sound card. The sound card will function without it - but changes to speaker setup and sound modification (Bass/Treble etc) will not be available
U	RivaTuner	RivaTunerWrapper.exe	"RivaTuner is a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This startup entry is for Vista and can appear twice - with registry key names of ""RivaTuner"" and ""RivaTunerStartupDaemon"" respectively. Both load the main application (RivaTuner.exe). The former minimizes it to the System Tray and is primarily required only if you want to use the ""Launcher"" or monitoring options. The latter applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
U	RivaTuner Application	RivaTuner.exe	"RivaTuner is a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This startup entry is for XP and can appear twice - with registry key names of ""RivaTuner"" and ""RivaTunerStartupDaemon"" respectively. The former minimizes it to the System Tray and is primarily required only if you want to use the ""Launcher"" or monitoring options. The latter applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
U	RivaTunerStartupDaemon	RivaTunerWrapper.exe	"Part of RivaTuner - a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This entry is for Vista and loads the main application (RivaTuner.exe) to apply overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
U	RivaTunerWrapper Application	RivaTunerWrapper.exe	"RivaTuner is a tweaking utility for NVIDIA (and to a lesser extent AMD/ATI) chipset based graphics cards. This startup entry is for Vista and can appear twice - with registry key names of ""RivaTuner"" and ""RivaTunerStartupDaemon"" respectively. Both load the main application (RivaTuner.exe). The former minimizes it to the System Tray and is primarily required only if you want to use the ""Launcher"" or monitoring options. The latter applies overclocking changes to clocks and memory (for example) at startup and then exits. See the FAQ for more information"
X	Run Services as Application	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	websvc.exe	"Added by the DLOADER-NY TROJAN!"
?	run=	LXBTppls.exe	"Reportedly part of Lexmark printer software - what does it do and is it required?"
X	runapp	icqchk.exe	"Added by the BOMKA TROJAN!"
X	Runapp32	Runapp32.exe	"Added by the NEODURK TROJAN!"
N	S3apphk	S3apphk.exe	A tool installed alongside the drivers for your S3 video output device. It is not necessary but should be allowed to run unless it is causing problems
X	sapp	sapp.exe	"NCase adware"
U	SBC Self Support Tool	matcli.exe	"matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	scApp	scApp.exe	"Added by the STANDO-E WORM!"
X	scApp	suchost.exe	"Added by the ACNATT.A WORM!"
X	scApp	wmiprvse.exe	"Added by the SILLYFDC-AW WORM!"
U	SCDEmuApp.exe	SCDEmuApp.exe	"Related to PowerISO - CD/DVD image file processing tool"
U	scheduler_proxy Application	scheduler_proxy.exe	"Found on IBM/Lenovo ThinkCentre/ThinkStation desktops and Thinkpad notebooks. Included with versions of ThinkVantage System Update (for software updates)
N	ScrapPad	Scrappad.exe	"ScrapPad allows you to quickly and easily record notes
Y	SDTray	SDTrayApp.exe	"System Tray access to an older version of Spyware Doctor antispyware from PC Tools"
X	Security Center	AppControl.exe	"Added by the SDBOT.CFT WORM!"
X	SernellApp.pcx	csrss.exe	"Added by the BANCBAN-BJ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""D5133"" subfolder"
Y	Server Application for MFP Server	ServoApp.exe	"Multi Function Printer (MFP) Server Agent for Belkin's Wirless G All-in-One Print Server and ZyXEL's NPS-520"
X	ServicesLog	ccapp32.exe	"Added by the RBOT-AMX WORM!"
Y	Sharing and Mapping Software	DShmap.exe	"Intel AnyPoint internet sharing software. Now discontinued"
X	Shockwave Support	FlashPlayer.exe	"Added by the DELF-DRA WORM!"
N	SigmatelSysTrayApp	stsystra.exe	System tray program for the Sigmatel Audio sound card. Often found on Dell computers
N	SigmatelSysTrayApp	sttray.exe	System tray program for the Sigmatel Audio sound card. Often found on Dell computers
U	SIPPS	SIPPS.exe	Web.de Internet phone utility
U	SiS (R) Compatible Super VGA SiSTray application	sistray.exe	System Tray access to display settings for Silicon Integrated Systems (SiS) based graphics chipsets. Located in %System%
X	sman	app**.tmp [ = digit]	Unidentified adware
X	SmansaApp	winlogon.exe	"Added by the ROMARIO-A WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
N	Smapp	Smtray.exe	"System Tray icon for Analog Devices SoundMax integrated soundcards. Sound properties can be accessed through the Start Menu or Control Panel"
U	SMax4PNP Application	SMax4PNP.exe	"Analog Devices SoundMax integrated soundcard utility. Brings up the SoundMAX Control Panel when it detects if new audio devices (such as microphones
X	SmileyApp	stbapp.exe	"DoubleD adware"
U	SMS Application Launcher	LAUNCH32.EXE	"Microsoft Systems Management Server - used to manage computers on a network remotely"
X	snapple	snapple.exe	"Added by the FORBOT-EG WORM!"
N	Snappy Fax	sf4.exe	"Snappy Fax desktop fax program with an extensive set of features - version 4"
?	Snappy Fax Printer Agent	sfpagent.exe	"Related to the Snappy Fax desktop fax program. What does it do and is it required?"
?	Snappy Fax Printer virtual printer agent	sfpagent.exe	"Related to the Snappy Fax desktop fax program. What does it do and is it required?"
U	Snippet	SnippingTool.exe	"The Snipping Tool (part of the Experience Pack for Tablet PC) allows you to easily ""cut out"" anything on screen and share it with other people. The whole screen becomes an ""inkable"" surface that you can add comments to and mark up however you like. You can then save that annotated image to use later
U	SoftickPPP	PPPGate.exe	"Softick PPP is a Microsoft Windows driver that allows to establish PPP session between Palm powered devices and Microsoft Windows desktop computer"
N	Sony Auto Update Tray Application	CONNECTAUTrayApp.exe	"System Tray access to change update settings for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
N	Sony Ericsson PC Suite	Application Launcher.exe	"System Tray access to Sony Ericsson PC Suite which ""connects your phone to your computer and expands the capabilities of your phone"". Run manually via the Start Menu (or optional desktop shortcut) before connecting the phone"
U	SpamMonitor Application	SpamMonitor.Exe	"System Tray access to Spam Monitor from PC Tools - which ""is an easy-to-use spam filter that detects and isolates unsolicited junk mail sent to your mailbox. Designed for computer users
X	Spooler SubSystem App	spoolsvc.exe	"Added by the POEBOT-J WORM!"
X	Spooler SubSystem App	spooIsv.exe	"Added by the LINKBOT.M WORM!"
X	Spooler SubSystem App	spoolv.exe	"Added by the SDBOT-BN WORM!"
X	Spooler SubSystem Application	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler Subsystem Application	smss.exe	"Added by the IRCBOT-ZO TROJAN! Note - the legitimate smss.exe process should not normally figure in Msconfig/Startup!"
X	Spooler Subsytem App	spoolsvc.exe	"Added by the SDBOT-MM WORM!"
?	SPP	run.exe	"??"
X	spp	regedit -s spp.reg	"IE search hijacker - changes the default search to h**p://www.hotsearchbox.com/ie/. Note that the Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file ""spp.reg"" is located in the root folder (ie
?	sppbridge	sppbridge.exe	"Associated with an Anycom bluetooth wireless card on laptops - used for printing to portable printers for example. Is it required or can it be started manually? "
U	SpyStopper	spystopper.exe	"SpyStopper - blocks intrusive spyware
Y	SRS Applet	SrsTray.Exe	S3 Sonic Vibes sound card drivers - if disabled you loose sound
X	Start It Upping	svchosets.exe	"Added by a variant of the RBOT WORM!"
X	Start Upping	taskmrg.exe	"Added by the RBOT-MA WORM!"
X	Start Upping	SVCHOSTES.EXE	"Added by the RBOT-NB WORM!"
X	Start Upping	taksmgr.exe	"Added by the RBOT-QK WORM!"
X	Start Upping	mcrt32.exe	"Added by a variant of the SPYBOT WORM!"
X	Start Upping	windupds.exe	"Added by the SDBOT.AFH WORM!"
X	Start Upping	windupdts.exe	"Added by a variant of the RBOT WORM!"
X	Start Upping	xdcc.exe	"Added by the SPYBOT.OY WORM!"
X	Start Upping	spoolnt.exe	"Added by the RBOT-TM WORM!"
X	Start Upping	iexplorerupdt.exe	"Added by the RBOT-RR WORM!"
X	Start Uppings	svcchosts.exe	"Added by the SDBOT.VY WORM!"
X	Start Uppings	mssupdate.exe	"Added by a variant of the RBOT WORM!"
U	Status Monitor CLJ1500	HPPOUMUI.exe	"Status monitor for the HP Color LaserJet 1500 printer from Hewlett-Packard - for monitoring printer status
X	StreamAppliance	wuauclt14.exe	"Added by the RBOT-GMB WORM!"
X	StreamAppliance	wuauclt16.exe	"Added by the RBOT-GME WORM!"
X	support-reverse-smileys	[trojan filename]	"Added by the LITEBOT TROJAN!"
U	Support.com Scheduler and Command Dispatcher	tgcmd.exe	"Part of software from SupportSoft (aka Support.com) provided to manufacturers and ISPs that allows them to offer on-line support - to update drivers
X	supporter5	supporter5.exe	"Part of eScorcher anti-virus software- responsible for updates of new virus bases each time you logon to the web. Used to collect information about the user and therefore treated as spyware - now the web-site is dead"
X	SVCHOST Generic application	svchost.exe	"Added by the DAEMONI-K TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	syelimS-esreveR-troppuS	[filename]	"Added by the LITBOT.C TROJAN!"
X	Symantec	ccapp.exe	"Added by the REATLE WORM! Note - this is not a Symantec file"
X	Symantec Configuration Loader	ccApp32.exe	"Added by the AGOBOT-EE WORM!"
X	Symantec Service	ccApp.exe	"Added by the AKHER.D WORM! Note - this is also not the valid Norton AV file with the same filename"
U	SymmTime Application	GeTTime.exe	"SymmTime from Symmetricon - freeware utility that ""synchronizes your PC clock to Coordinated Universal Time (UTC)
X	SymRun	ccApps.exe	"Added by the KAGEN-A TROJAN!"
X	Sysmppcvppp	SysTdSvr.dll	"Generic2.PQG adware"
X	System Applications Profile	sap.exe	"Added by the RBOT-QF WORM!"
X	System Buffer Application	buffer32.exe	"Added by the SDBOT-UD WORM!"
X	System Database Administration Support Process	sysdasp.exe	"Added by the DERDERO.C WORM!"
X	System Document Application	nmod.exe	"Added by the SDBOT-ABB WORM!"
X	System Document Application	msdocument.exe	"Added by the RANDEX.COX WORM!"
X	System Document Application	wins.exe	"Added by the SDBOT.AUB WORM!"
X	System Document Application	winsvc32.exe	"Added by the SDBOT-VA WORM!"
X	System Kernal Support	system.exe	"Added by the SDBOT.BWV WORM!"
U	System Mechanic Popup Stopper	Popupstopper.exe	"Popup stopper part of Iolo System Mechanic utility suite"
X	System Support	syscfg.exe	"Added by the RBOT-AGQ WORM!"
X	System Support	system32.exe	"Added by the RBOT-AHA WORM!"
X	System Support	syssql.exe	"Added by the RBOT-AUH WORM!"
X	System Support	torrent.exe	"Added by a variant of the RBOT WORM!"
X	System Update Application	msbuffer.exe	"Added by the SDBOT.AFF WORM!"
X	SystemB	MessengerStopper.exe	"MessStopper adware"
U	System_Messages	pprsen.exe	"TerminatorX - ""offers an easy and effective method of stopping users running predetermined file sharing programs like KaZaA
N	Taskbar++	TaskbarPP.exe	"Taskbar++ is a software that allows you to sort (move) the buttons of the Windows taskbar by Drag & Drop"
X	Tcp Application Manager	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	tcpippui	tcpippui.exe	"Added by the RBOT-APS WORM!"
X	tcpippui32	tcpippui32.exe	"Added by the RBOT-ART WORM!"
U	TelstraClear Broadband Support	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	TimeSyncApp	TimeSynchronize.exe	"DealHelper adware"
N	Toshiba TEMPO	Toshiba.Tempo.UI.TrayApplication.exe	"TEMPO is a software service developed by Toshiba. It will advise you on how to fine-tune the performance of your notebook and keep you informed of the latest Toshiba software and driver updates as soon as they are released. It does this by delivering various types of alerts into a special TEMPO inbox area on your notebook PC"
U	TPP Auto Loader	Tppaldr.exe	"Installed with DataStor's (and some other manufacturers) USB 2.0 based external DVD
X	TrayX	winppr32.exe	"Added by the SOBIG.F WORM!"
X	Universal Plug & Play devices	WinUPPD.exe	Added by an unidentified WORM/TROJAN!
X	Unix File Support	init3.exe	"Added by the RBOT-ZN WORM!"
U	Verizon Online Support Center	matcli.exe	""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	Vmlist	apphelps.dll	"Added by the ALAMNAHE.A VIRUS!"
U	Warning: do not remove it!	fpplock.exe	"Part of Folder Password Expert by ZQS Software Team - ""a software program to restrict access to the folders that contain your sensitive data"""
?	Webcam Go Sti Service Application	wbcgosvc.exe	"Control software for the portable Creative Webcam Go digital camera/PC web cam. What does it do and is it required?"
U	WebExRemoteAccessAgent	raagtapp.exe	"Related to Web Meetings from WebEx Communications
X	win ctl app	wuctl.exe	"Added by a variant of the SDBOT WORM!"
X	Win USB 2.0 USB Driver	HPPrint.exe	"Added by the SPYBOT.DNB WORM!"
X	WIN USB SUPPORT	grxsrv.exe	"Added by a variant of the RBOT WORM!"
X	Win Validation Application	DBExecCom.exe	"Added by the VBSILLY-A WORM!"
X	WinAmp Player	winampp.exe	"Added by the RBOT-AQI WORM! Note - this is NOT the popular Winamp media player which has a different filename"
X	Winapp	winpup32.exe	Produces popup ads to adult content sites
X	WinApp32	msapp.exe	"Added by the RSBOT TROJAN!"
U	WinAppLog	svchost.exe	"StingKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	wincmap	wincmapp.exe	"CasClient adware variant - also detected as the CMAPP TROJAN!"
X	Windows Application Layer	walg32.exe	"Added by the AGOBOT.ATN WORM!"
X	Windows Application Layer Gateway	walg32.exe	"Added by the AGOBOT-AAZ WORM!"
X	Windows applications server	SysShield.exe	"Added by the unregistered version of Personal Anti Malware rogue security software - not recommended
X	Windows Audio Control	ppnsvc.exe	"Added by the HAM TROJAN!"
X	Windows Audio Panel	nppsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows live Support	wlmsngr.exe	"Added by the RBOT-BKL WORM!"
X	Windows Logon Application	WinIogon.exe	"Added by the LINKBOT.M WORM!"
X	Windows Logon Application	logon.exe	"Added by the POEBOT-J WORM!"
X	Windows Logon Application	services.exe	"Added by the CIADOOR-L TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Logon Application	win32help.exe	"Added by the DELBOT-X WORM!"
X	Windows Logon Application	winlogon.exe	"Added by the POEBOT-KW WORM! Note - this is not the legitimate winlogon.exe process
X	Windows Logon Application	winamp.exe	"Added by the POEBOT-LR WORM! Note - this is NOT the popular Winamp media player which resides in a ""Winamp"" subdirectory of the Program Files directory"
X	Windows Logon Applicationedc	winlogon.exe	"Added by the DWNLDR-HGR TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%"
X	Windows Logon Applicatonedc	winlogon.exe	"Added by the VB-EBV TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%"
X	Windows Media AP	winmapp.exe	Added by an unidentified WORM or TROJAN!
X	Windows Media APP	wmapp.exe	Added by an unidentified WORM or TROJAN!
N	Windows Media Powerpoint Helper	NSPPTHLP.EXE	German software (comes with some Toshiba CD writers) that helps convert Powerpoint files to ASF (Streaming Media) files. Available via Start -> Programs
X	Windows NT Logon Application	winlogon.scr	"Added by the RBOT-ALP WORM!"
X	Windows Security Center Notification App	wscnfty.exe	"Added by a variant of the RBOT WORM!"
X	Windows Security Center Notification Appls	sxe.exe	"Added by the RBOT-GKX WORM!"
X	Windows Security Center Notification Applse	sxes.exe	"Added by the RBOT-GLR WORM!"
X	Windows Security Center Notification Applse	os.exe	"Added by a variant of the RBOT-GLR WORM!"
X	Windows Security Center Notification Applsee	sysecurex.exe	"Added by a variant of the RBOT-GKX WORM!"
X	Windows Service Supply	winsupply.exe	"Added by the SLENFBOT.CZ WORM!"
X	Windows Service Support Call	SVSS32.EXE	"Added by the RBOT-XQ WORM!"
X	Windows Software	hbsppe.exe	"Added by the RBOT-GLL WORM!"
X	Windows svchost	happy2008.exe	"Added by the PUSHBOT.AM WORM!"
X	Windows USB Driver Support	Windowsusb.exe	"Added by a variant of the SPYBOT WORM!"
Y	WinFaxAppPortStarter	wfxsnt40.exe	WinFax 10.0 and maybe earlier versions. Used to initiate the WinFax port to enable printing to the WinFax printer (send a fax) from any application.
X	winhlpp32.exe	winhlpp32.exe	"Added by the GAOBOT.SY WORM!"
Y	WinPoet	WinPPPoverEthernet.exe	"WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion
U	WinSysAppMon	WinSysRM.exe	"Home & Family Content Filter related. See here"
X	winter	happy.exe	"Added by the SDBOT-YF WORM!"
X	WinUPPD.exe	[random filename]	Added by an unidentified WORM/TROJAN!
X	Winxp update	Cappp.exe	"Added by the RBOT.DKO WORM!"
X	Winzip Application	winzip81.exe	"Added by the RBOT-BKZ WORM!"
X	win_supp00.exe	Win Const.exe	"Added by the ASSASIN-H TROJAN!"
N	WLAN Status Tray Applet	WLANSTA.EXE	System Tray icon for checking the status of a Wireless LAN
X	WMI Application Interface	wmiapi.exe	"Added by the SPYBOT.RBY WORM!"
?	WOOKIT	Shell.exe appLaunchClientZone.shl	"Related to the Wanadoo broadband ISP (now rebranded as Orange). What does it do and is it required?"
X	XP Protection Center	XPProtectionCenter.exe	"XP Protection Center rogue security software - not recommended
X	xpprotect	xpdeluxe.exe	"XP Protector Deluxe rogue security software - not recommended
N	Yankee Clipper III	YankClip.exe	"Yankee Clipper III - 'A super powerful Windows clipboard extender/memory - now in its third generation. Handles Pictures
N	YeppStudioAgent	SamsungMediaStudioAgent.exe	"Samsung Media Studio MP3 player file management software - see here for an example"
X	Your Protection	urpprot.exe	"Your Protection rogue security software - not recommended
X	[executed file name]	App.exe	"Added by the WAXPOW WORM!"
X	[various names]	AppMasterCenter.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	jopplerg.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	SysSupport.exe	"Wareout - malware masquerading as a spyware and dialer remover"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.