random

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	(Default)	[random filename].exe	"Added by the BLACKMAL WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run and HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	*MS Setup	[random filename]	"Virtumondo adware
X	*WinLogon	[trojan path] ren time:[random number]	"Added by the VUNDO TROJAN!"
X	*wuauclt.exe	w***.exe [ = random char]	"Added by a variant of the RBOT-UG WORM! Note - * in the filename represents a random char; variants spotted: wxmct.exe
X	0utlook Express	****.exe [ = random char]	"Added by the RBOT-CC WORM! Note the first letter is actually the digit ""0"" and not a capital ""o"""
X	180ClientStubInstall	*****.tmp [ = random digit/char]	"180Solutions adware related"
X	Aceu	[random filename]	"PurityScan adware"
X	Add*.exe [ = random char]	Add*.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Add*32.exe [ = random char]	Add*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Additional Guard	WI[random characters].exe	"Additional Guard rogue security software - not recommended
X	Adobe Acrobat Reader CFG	[random filename]	"Added by a variant of the RBOT WORM!"
X	Agent Browser	[random filename]	Added by the PPdoor.M-bdr backdoor TROJAN!
X	Agent Explorer	[random filename]	Unidentified adware
X	AIM Instant Message Cookies	[random filename]	"Added by the RBOT-AFV WORM!"
X	Anti-Virus	[random filename].exe	"Added by the CAPROBAD-A TROJAN!"
X	antiware	elite*32.exe [* = random char]	"Added by the DLOADER-HW TROJAN!"
X	AOL Messenger	[random filename]	"Added by an unidentified VIRUS
X	Api*.exe [ = random char]	Api*.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Api*32.exe [ = random char]	Api*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	App*32.exe [ = random char]	App*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	ara-key	[random filename]	"Added by the ANTINNY WORM!"
X	Atl*.exe [ = random char]	Atl*.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Atl*32.exe [ = random char]	Atl*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Avril Lavigne - Muse	[random filename]	"Added by the AVRIL-A WORM!"
X	BackUp Windows 2009	[random].exe	"Added by the AGENT-LUJ TROJAN!"
X	BIOS XP Loader	[random filename]	"Added by the RBOT-IC WORM!"
X	Bnexe	[random filename]	"Added by the KITRO.D (or ARGEN.A) WORM!"
X	BrowserUpdateSched	[random filename]	"ZenoSearch adware"
X	bxproxy	[random].dll	"SoftStop rogue security software - not recommended"
X	Cassandra	[10 to 14 random char]THD.EXE	"Added by the KREPPER-AI TROJAN!"
X	ccApp	[random filename]	"Added by the OBSORB TROJAN! Note the random filename compared to the valid Norton AntiVirus"
X	center	[random name]32.exe	"Added by the BOFRA.A WORM!"
X	checkrun	elite**32.exe [ = random char]	"EliteBar adware"
X	CleanUp Antivirus	CU[random characters].exe	"Cleanup Antivirus rogue security software - not recommended
X	cof.updit	[random filename]	"Added by a variant of the SDBOT WORM!"
X	Content connector	[random filename].exe	"Added by the DIALER-Y TROJAN! Note - uses a random filename and random folders. Usually the folder containing the file is a Temp folder"
X	Control handler	**********.exe [ = random char]	"CoolWebSearch parasite variant"
X	Control handler	[10 to 14 random char]THD.EXE	"Added by the KREPPER-AI TROJAN!"
X	Cr*.exe [ = random char]	Cr*.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Cr*32.exe [ = random char]	Cr*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	crmssrlt	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	Cryptographic Service	*****.exe [ = random char]	"Added by the KORGO.W or KORGO.X or KORGO.AB WORMS!"
X	ctfmon32	[random filename].exe	"Added by the RBOT-GSN WORM!"
X	cyberfree.exe	***.dat [ = random char]	Unidentified adware
X	D3*.exe [ = random char]	D3*.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	D3*32.exe [ = random char]	D3*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Danton*	[random filename]	"Added by the DANTON TROJAN! where * = random number"
X	ddivmwa	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	dll services	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	dllcvss	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	dm**.exe [ = random char]	dm**.exe [ = random char]	"Wareout - malware masquerading as a spyware and dialer remover"
X	dm[3 random letters].exe	dm[3 random letters].exe	"Added by the RUINDEM TROJAN!"
X	DRam prmaessor	[random filename]	"Added by the RBOT.CSG WORM!"
X	DRam prosesor	[random filename]	"Added by the SPYBOT.EE WORM!"
X	DRam prosessor	[random filename]	"Added by the RBOT.CSG WORM!"
X	dwqblwppx.exe	[random].exe	"Okcashbackmall adware"
X	dwqblwpvl.exe	[random].exe	"Okcashbackmall adware"
X	dwqblwrsq.exe	[random].exe	"Okcashbackmall adware"
X	Dx	sys.exe [ = random number]	"Added by the DEXTER.A WORM!"
X	educational writer	[random filename]	"Added by the RBOT-LZ WORM!"
X	Efata	[random 5 characters].exe	"Added by the FLUKAN-D WORM!"
X	Enterprise Suite	WE[random characters].exe	"Enterprise Suite rogue security software - not recommended
X	etbrun	elit**32.exe [ = random char]	"EliteBar adware"
X	example	[random filename].exe	"Added by the NUCLEAR BACKDOOR! Note - this trojan file is located in %Windir%\NR"
X	Expatch	[random filename]	"Added by the PWSLMIR-G TROJAN!"
X	expcrt	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	ExploreUpdSched	[random filename]	"ZenoSearch adware"
X	Fire Wall services	[random filename]	"Added by the IRCBOT-QY WORM!"
X	Fire Well service	[random].exe	"Added by the RBOT-FJU WORM!"
X	FiresWallservices	[random].exe	"Added by the RBOT-FJT WORM!"
X	G4G	[random filename]	Detected as Trojan-Downloader.Win32.VB.fki
X	Ghost Relay	[random filename]	"Added by the DNSCHANG.EK TROJAN!"
X	GlobalSCAPE	[random filename]	"Added by the RBOT-AYM WORM!"
X	Google Earth	[random filename]	"Added by the RBOT-AXK TROJAN!"
X	GPLv3	[random name].dll	"Vundo adware"
X	grgtgvgb.exe	[random].exe	"Added by the AGENT-EBF TROJAN!"
X	HDAudio Driver 1.0	[random filename].exe	"Added by the TEADOOR-D TROJAN!"
X	HDAudio Driver 2.0	[random filename].exe	"Added by the TEADOOR-E TROJAN!"
X	hdlpscom	[8 random letters].exe	"Added by the RBOT-FUL WORM!"
X	hpsysconf1	[random filename]	"Added by a variant of the VIVIA.A TROJAN!"
X	icccomp	[8 random letters].exe	"Added by the ZHELATIN.EQ WORM!"
X	idlesam	[8 random letters].exe	"Added by the ZHELATIN.EQ WORM!"
X	idmlssp	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	IE*.exe [ = random char]	IE*.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	IE*32.exe [ = random char]	IE*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	ieupdate	MCP**.exe [** = random char]	"Added by the ASOXY TROJAN!"
X	ieupdate	[random filename]	"Added by the AGENT-C BACKDOOR!"
X	ifperx	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	InetChk	ms[random value].exe	"Added by the AGENT-IRL TROJAN!"
X	Intranet Explorer	[random filename]	"Added by the POEBOT.DK BACKDOOR!"
X	IP*.exe [ = random char]	IP*.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	IP*32.exe [ = random char]	IP*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Ipod Help	[9 random letters].exe	"Added by a variant of the RBOT WORM!"
X	ist service uninstall	[random filename]	"ISTBar adware related"
X	ivHost	[6 random letters].exe	"Added by a variant of the SPYBOT WORM! See examples here and here"
X	Java*.exe [ = random char]	Java*.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Java*32.exe [ = random char]	Java*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	jcidls	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	JVM0.12	[random filename]	"Added by the TEADOOR-A TROJAN!"
X	JVM0.14	[random filename]	"Added by the TEADOOR-B TROJAN!"
X	jysyqm	[random filename]	"ZenoSearch adware"
X	Kadoc	[random filename].exe	"Added by the STAPREW TROJAN!"
X	kalvsys	kalv***.exe [ = random char]	"EliteBar adware"
X	kalvsys	kalv**32.exe [ = random char]	"EliteBar adware"
X	KavSvc	*****.exe reg_run [ = random char]	"Added by the QOOLOGIC TROJAN!"
X	kavsvc	[random 6 char filename]	"Added by the QOOLOGIC TROJAN! Uses random file names (examples: nzkklz.exe
X	Kazaa Download Accelerator Updater (required)	regsvr32 kdp***.dll [ = random char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	kdmsx	[8 random letters].exe	"Added by the SDBOT.AIJ BACKDOOR!"
X	kern64dll	[random filename]	"Added by the TARNO.J TROJAN!"
X	klop	[random].tmp	"Found with Trojan.Win32.StartPage.aw. Possibly a variant of the AGENT-WQ TROJAN!"
X	Live PC Care	LP[random characters].exe	"Live PC Care rogue security software - not recommended
X	loader32	sys***.exe [*** = random digit]	"Added by the DOMCOM TROJAN!"
X	LoadOrderVerification	[random filename]	"Added by the TRON.A TROJAN!"
U	Logon Loader Random	LogonLoader.exe	"Logon Loader - customize boot & login screens"
X	Malware Cleaner	[random numbers].exe	"Malware Cleaner rogue security software - not recommended
X	Managment Service	[random filename]	Added by the RBOT.BIS TROJAN!
X	mb2np	[random filename]	Added by the IRCBOT.TJ WORM!
X	MbarInstall	[random filename]	"Mirar adware"
X	mceipww	[8 random letters].exe	"Added by the ZHELATIN.EQ WORM!"
X	MDM Rock 4	[8 random letters].exe	"Added by the SDBOT.CHG BACKDOOR!"
X	Members area	*****.exe [ = random digit]	Premium rate adult content dialer
X	MemoryManager	[random name].dll	Virtumondo adware related
X	Mfc*.exe [ = random char]	Mfc*.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Mfc*32.exe [ = random char]	Mfc*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Mickey Mouse Cereal	[random filename].exe	"Added by the RANKY.Q TROJAN!"
X	MicroLoad	[random filename]	"Added by the DARBY WORM!"
X	MICROSFT ANTIVIRUS UPDATE SUPPORT	[random 10-letter filename].EXE	"Added by the RBOT-AQA WORM!"
X	MICROSFT RAMA UPDATE SUPPORT	[random filename]	"Added by the RBOT-ASM or RBOT-AUW WORMS!"
X	Microsft Upgraed	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	Microsft Windows Adapter 5.1.3013	[random filename]	"Added by the SMALL.HIT TROJAN!"
X	Microsoft (C) HTML Application host	[random filename]	"Added by the RBOT-YB WORM!"
X	Microsoft (R) Windows Protocol Deployment Manager	[random].tmp	Added by an unidentified WORM or TROJAN!
X	Microsoft ADservice	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Anti-Spy	[random filename]	"Added by a variant of the SDBOT WORM!"
X	Microsoft Core Support	[random filename]	"Added by a variant of the RBOT TROJAN!"
X	Microsoft Corporation	[random filename]	"Added by various VIRUSES
X	Microsoft Diagnostic	[random filename]	"Added by the ACEBOT TROJAN!"
X	Microsoft DirktorWin	[random filename]	"Added by the SPYBOT.GEN3 TROJAN!"
X	MicroSoft Getway Dire	[random filename]	"Added by the IRCBRUTE.AM WORM!"
X	MicroSoft Getway mqbol	[12 random letters].exe	"Added by the RBOT.GBA WORM!"
X	Microsoft IT Update	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Locals 332	[random filename]	"Added by the RBOT-KU WORM!"
X	Microsoft Security GManagers	[random filename]	"Added by a variant of the SDBOT WORM!"
X	Microsoft Security Monitor Process	[random filename]	"Added by variants of the RBOT WORM! See here"
X	Microsoft Security Panagers	[random filename]	"Added by the RBOT-AIG WORM!"
X	microsoft software	***.exe [ = random char]	Added by an unidentified WORM or TROJAN!
X	Microsoft System Backup	[random filename]	"Added by the RBOT-AGM WORM!"
X	Microsoft Tray	[random filename]	"Added by the DELF.BZ TROJAN!"
X	Microsoft Update Loader	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft Updote	[random filename]	"Added by the RBOT-ARC WORM!"
X	Microsoft UpToDate Driver (32-bits)	[random filename].exe	"Added by the SPYBOT.LXJ WORM!"
X	Microsoft Windows Updata	[5 random letters].exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update XP64	*******.exe [ = random char]	"Added by a variant of the RBOT WORM!"
X	Microsoft WinSound	[random filename]	"Added by a variant of the RBOT WORM!"
X	Microsoft-software	***.exe [ = random char]	"Added by a variant of the RBOT WORM!"
X	Microsoft.exe	[random].exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsofts Security Manager	**.exe [** = random char]	"Added by the RBOT-WH TROJAN!"
X	Microsot NT Support	[random filename].exe	"Added by the RBOT-CTI WORM!"
X	mmsddlx	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	mobiswing	[random].exe	"Mobis adware"
X	MonAppli	[random filename]	"Added by the DELF.IF TROJAN! The most common filenames are isys32.exe & msnmsg.exe"
X	Monitor Test	[random filename]	"Added by the SDBOT-NC WORM!"
X	ms window update	*****.exe [ = random character]	"Added by a variant of the RBOT WORM!"
X	ms************* [* = random digit]	ms************.exe [ = random digit]	"WINBO adware"
X	Ms*.exe [ = random char]	Ms*.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Ms*32.exe [ = random char]	Ms*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	MS-HTML	[random filename]	"Added by the LATINUS.15 TROJAN!"
X	MSKCES32	[random filename]	"Added by the CLONER TROJAN!"
X	msmc	ms***.exe [ = random char]	"ClientMan parasite variant"
X	MSMSGNER	[4-8 random letters].exe	"Added by the FOWLDO-GEN TROJAN!"
X	MSN 9.0 Plus	[random letters].exe	"Added by the RBOT-ALY WORM!"
X	Msn Update SUPPORT	[random filename]	"Added by the RBOT-BPS WORM!"
X	MSPQFile	MSA***.TMP [ = random char]	Homepage hijacker
X	MSServer	"Rundll32.exe [random].dll	#1"
X	mswspl	[random filename]	"Added by the SMALL.IQ TROJAN!"
X	My Security Engine	MS[random characters].exe	"My Security Engine rogue security software - not recommended
X	My Security Wall	MS[random characters].exe	"My Security Wall rogue security software - not recommended
X	MyAccessMedia	tmp*.exe [ = random char/digit]	"My AccessMedia toolbar related
X	Narrator	*****.exe [ = random char]	"Added by the QOOLOGIC TROJAN!"
X	NAV Auto Update	[random filename]	"Added by the SPYBOT-E WORM!"
X	NAVNet	**.tmp [ = random digit]	Unidentified adware
X	Net*.exe [ = random char]	Net*.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Net*32.exe [ = random char]	Net*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	NETVISIONAdulti	[random filename]	"Trafficadvance dialer"
X	Network Host Service	[random]32.exe	"Added by the RBOT-BAB WORM!"
X	Network Security Guard	*********.exe [ = random char]	"CoolWebSearch parasite variant"
X	No Credit Card	plugin-[random].exe	Adult content pop-up dialler
X	nssysconf	[random filename]	"Added by the VIVIA.A TROJAN!"
X	Nt*.exe [ = random char]	Nt*.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Nt*32.exe [ = random char]	Nt*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	NvCpl	[random filename]	"Added by the AGOBOT-APJ WORM!"
X	Nvid	[8 random charachters]	Unidentified adware
X	nvviddrv32	[random filename]	"Added by the RBOT-HT BACKDOOR!"
X	orderShell	order***.exe [ = random char]	"Added by the DLOADR-UN TROJAN!"
X	order_Shell	order_***.exe [ = random letter]	"Added by the AGENT.ARO TROJAN!"
X	Outlook Express Config	****.exe [ = random char]	"Added by a variant of the RBOT WORM!"
X	passcxd	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	PC Live Guard	PC[random characters].exe	"PC Live Guard rogue security software - not recommended
X	PCShield	regsvr32 sfg_***.dll [ = random char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	Plasdll service	[random filename]	"Added by a variant of the SDBOT WORM!"
X	pnpsvc_lock	*****.exe [ = random digit]	Browser hijacker
X	Popup Blocker Updater	regsvr32 veev***.dll [ = random char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	PostBootReminder	[random filename]	Added by and unidentified WORM or TROJAN!
X	Prein	APP***.tmp [ = random char or digit]	Unidentified adware
X	Program Access Service	[10 random letters].exe	"Added by the RBOT.GJJ WORM!"
X	prompt drive	[random filename]	"Added by the SDBOT.AMF WORM!"
X	proses	[5 random letters].exe	"Added by a variant of the RBOT WORM!"
X	Public Microsoft ODBC	ODBC32.exe [ = random char]	"Added by the MASLAN.D WORM!"
X	qbotd	[random filename]	"Added by the BOTTEN TROJAN!"
X	Quicktime Task	[random filename]	"Trafficadvance dialer"
X	random	random.exe	"Added by the DLOADER-KM TROJAN!"
X	Random Interface Network	rst.exe	"Added by the DELBOT-P WORM!"
X	Random Interface Network Manager	rinsv.exe	"Added by the DELBOT-L WORM!"
X	Random Unique ID	[worm filename]	"Added by the XROVE-A WORM!"
X	RandomWin32	mgnwin32.exe	"Added by the SDBOT-DV WORM!"
X	Reactor3	[random name]32.exe	"Added by the BOFRA.A WORM!"
X	Reactor5	[random name]32.exe	"Added by the BOFRA.D WORM!"
X	Reactor6	[random name]32.exe	"Added by the BOFRA.C WORM!"
X	Reactor7	[random name]32.exe	"Added by the BOFRA.B WORM!"
X	Reactor8	[random name]32.exe	"Added by the BOFRA.E WORM!"
X	Reactor9	[random name]32.exe	"Added by the BOFRA.E WORM!"
U	Registry	class0117[random].exe	"Blackbox captures emails and chat logs
X	Remote System Protection	"rundll32.exe [random].dll	HUI_proc"
X	reszrv	[8 random letters].exe	"Added by a variant of the SDBOT WORM! See here"
X	Rhino	[random name]32.exe	"Added by the BOFRA.A WORM!"
X	rmalt	[random filename]	"Added by the CLICKER-CS TROJAN! Filenames spotted inlcude Setup.exe
X	romahere2	***********.exe [ = random char]	"SuperSpider hijacker - a CoolWebSearch parasite variant. Also detected as the KREPPER-AE TROJAN!"
X	romahere3	***********.exe [ = random char]	"SuperSpider hijacker - a CoolWebSearch parasite variant. Also detected as the KREPPER-AE TROJAN!"
X	RPC Service	[random filename]	"Added by the BDOOR-AAD BACKDOOR!"
X	RSPC Driver	[random filename].exe	"Added by the RBOT-SN WORM!"
X	RSPC Driver D	[random filename]	"Added by a variant of the RBOT WORM!"
X	rtkernsw	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	Rundll	rundll32.exe [random filename].dll	"Added by the MYTOB.IG WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The random DLL file is found in %System%"
X	runner1	retadpu[random digits].exe	"Added by the SMALL.CTV TROJAN!"
X	SafeGuard Popup Updater (required)	regsvr32 sfg***.dll [ = random char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	SafeGuard Popup Updater (required)	regsvr32 PDF***.dll [ = random char]	"SafeguardProtect/Veevo hijacker. Note that regsvr32.exe is a legitimate Microsoft file used to register and unregister OLE controls and shouldn't be deleted. The random DLL file is found in %System%"
X	Sdk*.exe [ = random char]	Sdk*.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Sdk*32.exe [ = random char]	Sdk*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	secure	[random].exe	"DealHelper adware"
X	Security Antivirus	SA[random characters].exe	"Security Antivirus rogue security software - not recommended
X	Security Guard	SG[random characters].exe	"Security Guard rogue security software - not recommended
X	Security Master AV	SM[random characters].exe	"Security Master AV rogue security software - not recommended
X	Service Defender	[random filename]	"Added by a variant of the ZLOB TROJAN! See here"
X	Service Pack 1	[random filename]	"Added by the VXGAME.Z TROJAN! Note - the filename is random - see the link. Typical examples are vexg6ame4.exe
X	SfKg6wIP	[random filename]	Identified as a variant of the TrojanDownloader.Matcash malware
X	SfKg6wIPu	[random filename]	Identified as a variant of the TrojanDownloader.Matcash malware
X	Shell	Explorer.exe [path] ibm[RANDOM 5 DIGIT NUMBER].exe	"Added by the ANSERIN TROJAN! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files"
X	shellbn	[random].dll	"SoftStop rogue security software - not recommended"
X	Smart Virus Eliminator	SM[random characters].exe	"Smart Virus Eliminator rogue security software - not recommended
X	SM[random]	[random].exe	"Malware Protector 2008 rogue security software - not recommended
X	soft2	*******.exe [ = random digit]	"Added by the KARDPHISHER TROJAN!"
X	spoolsv.exe	[random filename]	"Added by the RBOT-JB WORM!"
X	sws.exe	[random filename]	"Haldex type adult content dialler"
X	Symantec Autoscan	[random filename]	"Added by the RBOT-AJO WORM!"
X	sys************* [* = random digit]	sys************.exe [ = random digit]	"WINBO adware"
X	Sys*.exe [ = random char]	Sys*.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Sys*32.exe [ = random char]	Sys*32.exe [ = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Sys29	win**32.exe [ = random char]	"EliteBar adware"
X	SysA	win**32.exe [ = random char]	"EliteBar adware"
X	SysStart	[random filename]	"ZenoSearch adware"
X	System backup	[random filename]	"Added by the ADMINCASH.B TROJAN! Note - multiple different file names have been spotted
X	System CPL manager	[random filename]	"Added by the RBOT-SR WORM!"
X	System Defender	WS[random characters].exe	"System Defender rogue security software - not recommended
X	System Services	[random file name]	"Added by a variant of the RBOT WORM!"
X	System Update	[random filename]	"Added by the KORGO.W or KORGO.X WORMS!"
X	System Update	[random filename]	"Added by the SOROMO-A TROJAN!"
X	System32Check	[random].exe	"Added by the CHAST-A TROJAN!"
X	SystemManager	[random filename]	"Added by the SETTEC ROOTKIT!"
X	systwtray	twitty.exe [ = random digits]	"Added by the KOOBFACE.C WORM!"
X	syswin.txt	[3 random letters].exe	"Added by a variant of the SPYBOT WORM! See here"
X	TaskReg	[random filename]	"Added by the CBLAD WORM!"
X	TA_Start	[random filename]	"Zeno Think-Adz adware"
X	Telnet24	[random filename]	"Added by the RBOT-ARD WORM!"
X	TempCom	[randomname].com	"Added by the TRAXG WORM!"
X	Think-Adz	[random filename]	"Zeno Think-Adz adware"
X	Tok-Cirrhatus-1959	[random].exe	"Added by the BRONTOK-CF WORM!"
X	Tok-Cirrhatus-[4 random digits]	br[4 random digits]on.exe	"Added by the BRONTOK-M WORM!"
X	ttool	[random numbers].exe	"Added by the BCKDR-QII BACKDOOR! The filename seen most often is ""9129837.exe"""
X	updatesched	[random filename]	"ZenoSearch adware"
X	UpdateWin	[random filename]	"Added by the IRCBOT.AZW BACKDOOR!"
X	UpdSys	[random filename]	Added by the BJ TROJAN!
X	USB Driver4	UpdateXP.exe [ = random digit]	"Added by a variant of the SDBOT WORM!"
X	ValueS0ft	[random filename]	"Added by a variant of the SPYBOT WORM! See here"
X	ValueX	[random filename]	"Added by the IRCBOT.EE TROJAN!"
X	vbcdtm	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	vbe	[random name].vbe	"Added by the UISGON-A WORM!"
X	VbouncerDL	VbouncerInner***.exe [ = random char]	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
X	version	[random].exe	"DealHelper adware"
X	Video Process	[random filename]	"Added by the RBOT-LM WORM!"
X	Virtual CD v6	[random].exe	"Added by the RBOT-AZV WORM!"
X	Virus Doctor	Vdoc[random].exe	"Virus Doctor rogue security software - not recommended
X	Virus Protector	[random].exe	"Virus Protector rogue security software - not recommended
X	Volcano Security Suite	VS[random characters].exe	"Volcano Security Suite rogue security software - not recommended
X	Voltage Manager	[random filename]	"Added by the DREFFORT WORM!"
X	vxcxcvfck	[random filename]	"Added by the RANCK-AZ TROJAN! The most common example is ""sbsvsd.exe"" located in %System%"
X	w02db700.dll	[random filename]	"ZenoSearch adware"
X	W32Load	[random filename].scr	"Added by the CASPID WORM!"
X	WAPI	wts*.exe [ = random char]	"PurityScan adware"
X	WCPS	Wint*.exe [ = random char]	"PurityScan adware"
X	web	*****.exe [ = random char]	"Added by a variant of the EASTO.A TROJAN!"
X	Web Service	[random filename].exe	"Added by the ADMINCASH TROJAN!"
X	WebRun	[random filename]	"Added by the ADWARELOADER TROJAN!"
X	wescmv	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	WiFix service	[random filename]	"Added by a variant of the SDBOT WORM!"
X	Wiinamp	[random].exe	"Added by the IRCBOT-OH TROJAN!"
X	Win Prosess0r	[random filename]	"Added by the RBOT-BIT WORM!"
X	WIN prosessor16	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	Win Secure Update	[random filename]	"Added by the RBOT-AGI WORM!"
X	win************* [* = random digit]	win************.exe [ = random digit]	"WINBO adware"
X	Win32system	[random filename]	"Added by the DDV.B WORM!"
X	Win32SystemMonitor	**.exe [ = random char]	Browser hijacker
X	Window service	[random filename]	"Added by the RBOT-ACH WORM!"
X	Windows (random character)	diskcheck.exe	"Added by the SINGU.B TROJAN!"
X	Windows Additional Guard	WI[random characters].exe	"Windows Additional Guard rogue security software - not recommended
X	Windows ASN Service	[random filename]	"Added by the AGOBOT-TC WORM!"
X	Windows Compliant	[random filename]	"Added by the RBOT-IR WORM!"
X	Windows Data Server	[random name].exe	"Added by the SPYBOT-DS WORM!"
X	Windows Enterprise Suite	WE[random characters].exe	"Windows Enterprise Suite rogue security software - not recommended
X	Windows ExpIorer	[random filename]	"Added by the RBOT-AKO WORM!"
X	Windows haz Layer	[5 random letters].exe	"Added by a variant of the RBOT WORM!"
X	Windows Live Messenger	[random].exe	"Added by the RBOT-GVL WORM!"
X	Windows LoL Layer	[random filename].exe	"Added by the RBOT-GMD WORM!"
X	Windows Media Player	[random filename]	"Added by a variant of the RBOT WORM!"
X	Windows Media Player Update	[random filename]	"Added by the RBOT-ET WORM!"
X	Windows Media SP.2.37	[random filename]	"Added by the LEMIR.C TROJAN!"
X	Windows Microsoft Service	[random filename]	"Added by the AGENT-HCD TROJAN!"
X	Windows Microsoft Services	[8 random letters].exe	"Added by the KOLAB.AW WORM!"
X	Windows NTFS Volume Manage	[6 random letters].exe	"Added by the RBOT.EDL BACKDOOR!"
X	Windows PC Defender	WP[random characters].exe	"Windows PC Defender rogue security software - not recommended
X	Windows Print Monitor Daemon	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	Windows Protection Suite	WI[random characters].exe	"Windows Protection Suite rogue security software - not recommended
X	Windows Registry Name	[random filename]	"Added by the RBOT-AEB WORM!"
X	Windows Secure Layer	[random filename]	"Added by the RBOT.DRF WORM!"
X	Windows Secure talal32	[7 random letters].exe	"Added by the RBOT.HTP TROJAN!"
X	Windows Security Service	[random file name]	"Added by the RBOT-ALV WORM!"
X	Windows Security Suite	WI[random characters].exe	"Windows Security Suite rogue security software - not recommended
X	Windows Servce Agent	[random filename]	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Servcesc	[9 random letters].exe	"Added by a variant of the SDBOT WORM! See here"
X	Windows Service Ag3nt	[6 random letters].exe	"Added by the SDBOT.EZX TROJAN!"
X	Windows Service Agccnt	[random].exe	"Added by the SDBOT-DHL WORM!"
X	Windows Service Agent	[random filename].exe	"Added by the IRCBOT-XE TROJAN!"
X	Windows Service Agent	[3 random letters].exe	"Added by the AGENT.AMEB TROJAN - see examples here and here"
X	Windows Service Agnts	[8 random letters].exe	"Added by the SDBOT.BCQ WORM!"
X	Windows Service alge	[random filename]	"Added by the RBOT.GJO TROJAN!"
X	Windows Service oi worms	[6 random letters].exe	"Added by the SYSTEMHI.OS TROJAN!"
X	Windows Services Aganters	[10 random letters].exe	"Added by the RBOT.CUN WORM!"
X	Windows Services alges2	[8 random letters].exe	"Added by a variant of the RBOT WORM!"
X	Windows Serviece Agents	[8 random letters].exe	"Added by the AGENT.BHR TROJAN!"
X	Windows Standard Securty	[random 3-letter filename]	"Added by the RBOT-ALF WORM!"
X	Windows System Defender	WS[random characters].exe	"Windows System Defender rogue security software - not recommended
X	Windows System Security Monitor	[4 random letters].exe	"Added by the PINKTON.A WORM!"
X	Windows System Suite	WS[random characters].exe	"Windows System Suite rogue security software - not recommended
X	Windows update 2005	[random filename]	"Added by the RBOT.ARP WORM!"
X	Windows Update Checker	[random filename]	Adware downloader trojan
X	Windows Update V6	[random filename]	"Added by the RBOT-KT WORM!"
X	WindowsReg% update	[random filename].exe	"Added by the RBOT-HH WORM!"
X	WindowsRegistration	[random filename]	"Added by the RBOT-NO WORM!"
X	WindowsRegKey Autoupdate	[random filename]	"Added by a variant of the RBOT WORM!"
X	WindowsRegKey upd4te2d4te	********.exe [ = random char]	"Added by the RBOT.XQ WORM!"
X	WindowsRegKey update	[random filename]	"Added by the RBOT.QT WORM!"
X	WindowsService	[random name].dll	"Added by the VUNDO-X TROJAN!"
X	windowsupdate	RPC[RANDOM CHARACTERS].exe	"Added by the IRCBOT.B TROJAN!"
X	Winds Sers Agts	[5 random letters].exe	"Added by a variant of the RBOT WORM!"
X	WinDSNX	Win***.exe [ = random char]	"Added by the DSNX TROJAN!"
X	WinFixer service	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	Wink*.exe	Wink.exe [ = random char]	"Added by a variant of the KLEZ WORM!"
X	WinLoader	[random filename]	"Added by variants of the SUBSEVEN TROJAN!"
X	WinMedia	msupd*****.exe [= random digit]	Added by the INJECT.163 TROJAN!
X	WinNetDDE	[random characters].exe	"Added by the NETDEPIX.B TROJAN!"
X	WinSecure	[random].exe	"Added by the AGENT-LR TROJAN!"
X	Winsock2 driver	[random filename]	"Added by members of the SPYBOT family of WORMS! Note - the random filename is located in %System%"
X	Winsvr	msupd*****.exe [= random digit]	Added by the INJECT.163 TROJAN!
X	Winsvr	[random filename].exe	"Added by the ADCLICK-DK TROJAN!"
X	winsync	*****.exe reg_run [ = random char]	"Added by a variant of the QOOLOGIC TROJAN!"
X	WINT	wcp***.exe [ = random char]	"PurityScan adware"
X	WINT	wcp*.exe [ = random char]	"PurityScan adware"
X	winupd	"RUNDLL32.EXE [random value].dll	_mainRD"
X	winupdt	RUNDLL32.EXE [random.dll]	"Added by the MABUT.A WORM! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The random DLL file is found in the Windows or Winnt folder"
X	WinUPPD.exe	[random filename]	Added by an unidentified WORM/TROJAN!
X	Winz Firewall	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	win_[4 random char][4 random num]	[4 random char][4 random num].exe	"Added by the BANCOS.C TROJAN!"
X	WNSA	wnsts*.exe [ = random char]	"PurityScan adware"
X	WNSC	wnsin*.exe [ = random char]	"PurityScan adware"
X	WNSI	wnscp*.exe [ = random char]	"PurityScan adware"
X	WNST	wnsapi*.exe [ = random char]	"PurityScan adware"
X	wpxmls	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	WTSS	wapi*.exe [ = random char]	"PurityScan adware"
X	xswdmse	[8 random letters].exe	"Added by a variant of the SPYBOT WORM! See here"
X	yahoo!	"rundll32.exe [random]don.dll	Set"
X	zcseacrt	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	Zeno	[random filename]	"ZenoSearch adware"
X	zonealarm	[random filename]	"Added by an unidentified VIRUS
X	Z_Start	[random filename]	"ZenoSearch adware"
X	[12 random characters]	avifile5.exe	"IeDriver adware variant"
X	[12 random characters]	bootvid4.exe	"IeDriver adware variant"
X	[12 random characters]	browser8.exe	"IeDriver adware variant"
X	[12 random characters]	atitvo32.exe	"IeDriver adware variant"
X	[12 random characters]	autodisc.exe	"IeDriver adware variant"
X	[12 random characters]	cabview1.exe	"IeDriver adware variant"
X	[12 random characters]	advpack1.exe	"IeDriver adware variant"
X	[12 random characters]	batmeter.exe	"IeDriver adware variant"
X	[12 random characters]	bidispl2.exe	"IeDriver adware variant"
X	[12 random characters]	asferror.exe	"IeDriver adware variant"
X	[12 random characters]	catsrvps.exe	"IeDriver adware variant"
X	[12 random characters]	admparse.exe	"IeDriver adware variant"
X	[12 random characters]	audiosrv.exe	"IeDriver adware variant"
X	[12 random characters]	bootvid2.exe	"IeDriver adware variant"
X	[12 random characters]	cmpbk321.exe	"IeDriver adware variant"
X	[12 random characters]	ADPTIF67.exe	"IeDriver adware variant"
X	[12 random characters]	asycfilt.exe	"IeDriver adware variant"
X	[12 random characters]	ati2dvag.exe	"IeDriver adware variant"
X	[12 random characters]	atl91036.exe	"IeDriver adware variant"
X	[12 random characters]	blackbox.exe	"IeDriver adware variant"
X	[12 random characters]	browser5.exe	"IeDriver adware variant"
X	[12 random characters]	bthserv1.exe	"IeDriver adware variant"
X	[12 random characters]	camocx28.exe	"IeDriver adware variant"
X	[12 random characters]	CAMOCX74.exe	"IeDriver adware variant"
X	[12 random characters]	capesnpn.exe	"IeDriver adware variant"
X	[14 random numbers]	mradll.exe	"Green AV rogue security software - not recommended
X	[14 random numbers]	rwg.exe	"Green AV rogue security software - not recommended
X	[3 random char]srv32	[3 random char]srv.exe	"Added by the BANCOS.N TROJAN!"
X	[3-4 random letters]	nslookup.exe	"PurityScan adware. Not to be confused with the legitimate nslookup.exe which is found in the System32 folder"
X	[3-4 random letters]Srv32	[path to file]	"Added by the BANCSADE-A TROJAN!"
X	[32 random hex numbers]	tsc.exe	"Total Security rogue security software - not recommended
X	[32 random hex numbers]	badware-protector.exe	"Badware Protector rogue security software - not recommended
X	[32 random numbers]	av2009.exe	"AntiVirus 2009 rogue security software - not recommended
X	[32 random numbers]	av360.exe	"Antivirus 360 rogue security software - not recommended
X	[32 random numbers]	AVS.exe	"Antivirus Sentry rogue security software - not recommended
X	[32 random numbers]	xpa.exe	"XP Antivirus rogue security software - not recommended"
X	[32 random numbers]	total.exe	"Total Antivirus rogue security software - not recommended
X	[random characters]	securewinload32x.exe	"Added by the OPTIXP-N TROJAN!"
X	[random characters]	rsbmsc.exe	"Detected by AntiVir antivirus as the BDS/Agent.adt TROJAN!"
X	[random characters]	_default[random].pif	"Added by the BRONTOK-AI WORM and variants!"
X	[random characters]	j[random].exe	"Added by the BRONTOK-AI WORM and variants!"
X	[random characters]	sv[random].exe	"Added by the BRONTOK-AI WORM and variants!"
X	[random characters]	yesbron.com	"Added by the BRONTOK-AI WORM and variants!"
X	[random characters]	systs.exe	"Added by the AGENT-GDC TROJAN!"
X	[random characters]	xvassdf.exe	"Added by the AUTORUN-BAD WORM!"
X	[random filename]	slk8x2peu.exe	"QuickLinks adware"
X	[random names]	eee2.exe	"MediaMotor adware"
X	[random name]	wincpu.exe	"Added by an unidentified VIRUS
X	[random name]	m?dtc.exe	"PurityScan adware"
X	[random name]	ping.exe	"PurityScan adware. Note - do not confuse with the Microsoft utility of the same name as described here"
X	[random name]	CXTPLS_LOADER.EXE	"AproposMedia adware"
X	[random name]	??plorer.exe	"PurityScan adware"
X	[random name]	?hkdsk.exe	"PurityScan adware"
X	[random name]	?hkntfs.exe	"PurityScan adware"
X	[random name]	l?gonui.exe	"PurityScan adware"
X	[random name]	m?iexec.exe	"PurityScan adware"
X	[random name]	r?gsvr32.exe	"PurityScan adware"
X	[random name]	t?skmgr.exe	"PurityScan adware"
X	[random name]	w?auboot.exe	"PurityScan adware"
X	[random name]	w?auclt.exe	"PurityScan adware"
X	[random name]	w?crtupd.exe	"PurityScan adware"
X	[random name]	w?wexec.exe	"PurityScan adware"
X	[random name]	??erinit.exe	"PurityScan adware"
X	[random name]	d?dplay.exe	"PurityScan adware"
X	[random name]	n?tepad.exe	"PurityScan adware"
X	[random name]	??chost.exe	"PurityScan adware"
X	[random name]	??oolsv.exe	"PurityScan adware"
X	[random name]	??xplore.exe	"PurityScan adware"
X	[random name]	r?ndll32.exe	"PurityScan adware"
X	[random name]	se?vices.exe	"PurityScan adware"
X	[random name]	w?nlogon.exe	"PurityScan adware"
X	[random name]	w?nword.exe	"PurityScan adware"
X	[random name]	??anregw.exe	"PurityScan adware"
X	[random name]	?ttrib.exe	"PurityScan adware"
X	[random name]	j?vaw.exe	"PurityScan adware"
X	[random name]	l?ass.exe	"PurityScan adware"
X	[random name]	m?config.exe	"PurityScan adware"
X	[random name]	n?lookup.exe	"PurityScan adware"
X	[random name]	n?pdb.exe	"PurityScan adware"
X	[random name]	??ool32.exe	"PurityScan adware"
X	[random name]	??rss.exe	"PurityScan adware"
X	[random name]	??rvices.exe	"PurityScan adware"
X	[random name]	?ti2evxx.exe	"PurityScan adware"
X	[random name]	d?xplore.exe	"PurityScan adware"
X	[random name]	chkdsk.exe	"PurityScan adware. Note - the legitimate Windows chkdsk.exe will always be located in %System% and will NOT figure among the startups!"
X	[random name]	dvdplay.exe	"PurityScan adware"
X	[random name]	spoolsv.exe	"PurityScan adware. Note - this is not the legitimate spoolsv.exe which is always located in %System%"
X	[random name]	w?aclt.exe	"PurityScan adware"
X	[random name]	wucrtupd.exe	"PurityScan adware. Do not confuse with the legitimate Windows Critical Update Notification (wucrtupd.exe) process"
X	[random name]	charmapnt.exe	"Added by the BANCOS-DR TROJAN!"
X	[random name]	n?tdde.exe	"PurityScan adware"
X	[random name]	r?gedit.exe	"PurityScan adware"
X	[random name]	r?ndll.exe	"PurityScan adware"
X	[random name]	scanregw.exe	"PurityScan adware. Note - do not confuse this with the legitimate Windows process scanregw.exe which is always found in the Windows folder on Win9x/ME machines"
X	[random name]	wuauboot.exe	"PurityScan adware. Note - do not confuse with the legitimate wuauboot.exe process which should not figure in Msconfig/Startup!"
X	[random name]	w?nspool.exe	"PurityScan adware"
X	[random name]	svchost.exe	"Added by the BANCBAN-JC TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\config"
X	[random name]	[random name].dll	"SearchNet adware"
X	[random name]	iexpl0ra.exe	"Added by the ULPM.BD TROJAN!"
X	[random name]	rundl13a.exe	"Added by the GAMPASS-L TROJAN!"
X	[random name]	Servere.exe	"Added by the LEGMIR-AQM TROJAN!"
X	[random name]	twain_32.exe	"Added by the AGENT.AM TROJAN! Note - example names include ""XviD""
X	[random name]	explore3.exe	"Added by the DELF.FAN TROJAN!"
X	[random name]	taskmngr.exe	"Added by the AGOBOT-CB WORM!"
X	[random name]	netdde.exe	"PurityScan adware. Do not confuse with the legitimate Network DDE - DDE Communication (netdde.exe) process which is always located in %System% and should not figure in Msconfig/Startup!"
X	[random name]	chkntfs.exe	"PurityScan adware. Do not confuse with the legitimate NTFS Volume Maitenance Utility (chkntfs.exe) process which is always located in %System% and should not figure in Msconfig/Startup!"
X	[random name]	notepad.exe	"PurityScan adware. Note - this is not Windows Notepad which has the same executable name"
X	[random name]	services.exe	"PurityScan adware. Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	[random name]	ntvdm.exe	"PurityScan adware. Do not confuse with the legitimate ntvdm.exe process which is always located in %System% and should not figure in Msconfig/Startup!"
X	[random name]	msiexec.exe	"PurityScan adware. Do not confuse with the legitimate Windows® Installer (msiexec.exe) process which is always located in %System% and should not figure in Msconfig/Startup!"
X	[random name]	userinit.exe	"PurityScan adware. Do not confuse with the legitimate Userinit Logon Application (userinit.exe) process which is always located in %System% and should not figure in Msconfig/Startup!"
X	[random name]	regedit.exe	"PurityScan adware. Note - this is not the valid Windows registry editor which resides in %Windir% and will not figure in Msconfig/Startup!"
X	[random name]	wuauclt.exe	"PurityScan adware. Note - this is not the legitimate wuauclt.exe process
X	[random name]	?ervices.exe	"PurityScan adware"
X	[random name]	s?chost.exe	"PurityScan adware"
X	[random name]	c?rss.exe	"PurityScan adware"
X	[random name]	mrgdll.exe	"Nortel Antivirus rogue security software - not recommended"
X	[random name]	wox.exe	"Nortel Antivirus rogue security software - not recommended"
X	[random number]	"rundll32.exe shell32.dll	Control_RunDLL [random number].cpl"
X	[random number]	explorer.exe	"Added by the KEYLOG-AN TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%\service"
X	[Randomly chosen existing folder name]	_autorun.exe	"Added by the ANTINNY-L WORM!"
X	[Randomly chosen existing folder name]	_cfg.exe	"Added by the ANTINNY-L WORM!"
X	[Randomly chosen existing folder name]	_config.exe	"Added by the ANTINNY-L WORM!"
X	[Randomly chosen existing folder name]	_env.exe	"Added by the ANTINNY-L WORM!"
X	[Randomly chosen existing folder name]	_loader.exe	"Added by the ANTINNY-L WORM!"
X	[Randomly chosen existing folder name]	_login.exe	"Added by the ANTINNY-L WORM!"
X	[Randomly chosen existing folder name]	_setup.exe	"Added by the ANTINNY-L WORM!"
X	[Randomly chosen existing folder name]	_start.exe	"Added by the ANTINNY-L WORM!"
X	[random]	lsass.scr	"Added by the BANCBAN-CW TROJAN!"
X	[random]	svchost.scr	"Added by the BANCBAN-CY TROJAN!"
X	[random]	[random]tssd.exe	"Antivirus Suite and AntiSpyware Soft rogue security software - not recommended
X	[random]	[random]sysguard.exe	"Antivirus Soft
X	[random]	[random]sftav.exe	"Antivirus Soft rogue security software - not recommended
X	_pnd_Panda Antivirus	_pnd_****.exe [ = random char/digit]	Added by the AGENT.NAK TROJAN!

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.