NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

• "Y" - Normally leave to run at start-up
• "N" - Not required - typically infrequently used tasks that can be started manually if necessary
• "U" - User's choice - depends whether a user deems it necessary
• "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
• "?" - Unknown

Fatal error: Maximum execution time of 30 seconds exceeded in /home/iamnotag/domains/iamnotageek.com/public_html/startup/search.php on line 252

	Startup Name	Process Name	Details
X	ools.exe	tools.exe	"FastFind adware variant"
X		system32.exe	"Added by the AGOBOT-KU WORM! Note - has a blank entry under the Startup Item/Name field"
X		svchost.exe	"Added by the DELF-UX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%. Note - has a blank entry under the Startup Item/Name field"
X		MSPF.EXE	"Added by a variant of the SDBOT WORM! This file is located in the Winnt or Windows folder. Note - has a blank entry under the Startup Item/Name field"
X		dllvirtual.js	"Added by the DADOBRA-IW TROJAN! Note - has a blank entry under the Startup Item/Name field"
X		ajsha5.exe	"Added by the SPYBOT-NX WORM! Note - has a blank entry under the Startup Item/Name field"
X		regedit.exe /s appboost.reg	"Added by the APPIX.D WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run and HKCU\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank. The Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file ""appboost.reg"" is located in %Windir%"
	Note the filename has a ""0"" rather than an upper case ""o"""
Y	!1_ProcessGuard_Startup	procguard.exe	"DiamondCS ProcessGuard security software - stops malicious worms and trojans from being executed silently in the background
Y	!AVG Anti-Spyware	avgas.exe	"System Tray access to and notifications for AVG Anti-Spyware 7.5. This has now been superseded by AVG Anti-Virus which includes Anti-Spyware"
Consume	"Consumer Input Rewarded with MyPoints	U	"ConsumerInputRewardedwithMyPoints
Consume	"Consumer Input Rewarded with MyPoints	U	"ConsumerInputRewardedwithMyPoints
Inc."	"Machine Works	X	aecces.exe
Inc."	"Microsoft Associates	X	iexplorer.exe
Inc."	"Microsoft NetMeeting Associates	X	NetMeeting.exe
Inc."	"Miramar Systems	U	atmsg.exe
ME"	"MS Java Applets for Windows NT	X	javaapplets.exe
NT	"Ms Java for Windows 98	ME & XP"	X
NT	"Ms Java for Windows 98	XP & ME"	X
XP & ME	"MS Java for Windows NT	X	xpjavams.exe
Version	"NVIDIA Compatible Windows Vista Display driver	U	"RUNDLL32.EXE NvCpl.dll
Version	"NVIDIA Compatible Windows7 Display driver	U	"RUNDLL32.EXE NvCpl.dll
Version	"NVIDIA Driver Helper Service	U	"RUNDLL32.EXE nvsvc.dll
Mass"	"Telechips	U	patch.exe
please	"This is a virus	X	bigbadvirus.exe
X	"Vaganza-XPloit-[User Name]"""	[user name].exe	"Added by the GAVGENT.A WORM!"
X	$sys$cmp	$sys$xp.exe	"Added by the RYKNOS.B TROJAN! Attempts to utilize the Sony Rootkit A.K.A. SecurityRisk.First4DRM security risk to hide itself on the compromised computer"
X	$sys$crash	$sys$sonyTimer.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$crash	$sys$sos$sys$.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$crash	$sys$WeLoveMcCOL.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$drv	$sys$drv.exe	"Added by the RYKNOS TROJAN! Attempts to utilize the Sony Rootkit A.K.A. SecurityRisk.First4DRM security risk to hide itself on the compromised computer"
X	$sys$momomomochin	$sys$sonyTimer.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$momomomochin	$sys$sos$sys$.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$momomomochin	$sys$WeLoveMcCOL.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$umaiyo	$sys$sonyTimer.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$umaiyo	$sys$sos$sys$.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$umaiyo	$sys$WeLoveMcCOL.exe	"Added by the WELOMOCH TROJAN!"
U	$Volumouse$	volumouse.exe	"Volumouse from Nirsoft. ""Provides you a quick and easy way to control the sound volume on your system - simply by rolling the wheel of your wheel mouse"""
X	$WindowsRegKey%update	IEXPLORE.EXE	"Added by the RBOT-EZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
?	%cmpmixtitle%	%cmpmixstr%	"Possibly related to C-Media Mixer Control panel?"
N	%FP%012-L2TP fts.exe	fts.exe	012.Net.il Israeli ISP software front-end
N	%FP%1776 Internet fts.exe	fts.exe	1776 Internet US ISP software ISP software front-end
N	%FP%AIRTEL fts.exe	fts.exe	"Bharti Airtel Broadband - Indian ISP software front-end"
N	%FP%Barak013 fts.exe	fts.exe	Barak013 Israeli ISP software front-end
N	%FP%Friendly fts.exe	fts.exe	Friendly ISP software front-end
Y	'Ashampoo AntiSpyWare 2 Guard'	AntiSpyWare2Guard.exe	"Part of Ashampoo® AntiSpyWare 2 from Ashampoo GmbH & Co. KG. This part is the realtime monitor that looks for changes on the users system such as BHO
X	(*)API Machine	winSOCKS.exe	"Homepage hijacker
X	(Default)	Shania.vbs	"Added by the SHANIA BACKDOOR! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	spolsvr2.exe	"Added by the EVILSOCK.10 TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	winbas12.exe	"Adware
X	(Default)	Systrsy.exe	"Added by the CDTRAY TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	llsass.exe	"Added by the PROXY-GG TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	syspol.exe	"Added by the DREMN-B TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKCU\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	msarti.com	"Added by the SILLYFDC.CJ WORM! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\..\Policies\Explorer\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	msnupdate.exe	"Added by the RBOT-GWT BACKDOOR! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run & HKLM\RunServices in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(L4r1$$4) (4nt1) (V1ruz)	SP00Lsv32.pif	"Added by the ASSIRAL.B WORM!"
X	*Bandook	msdll.exe	"Added by an unidentified TROJAN - see here"
X	*Intelli Mouse Pro Version 2.0B*	ncsjapi32.exe	"Added by the BUZUS-O WORM!"
X	*JanisRuckenbrodII	janis.com	"Added by the POPS WORM!"
X	*Microsoft Update	ctxma.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	cxma.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wstcl.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wucxt.exe	"Added by the STMU TROJAN!"
X	*Microsoft Update	wuytc.exe	"Added by the STMU TROJAN!"
X	*MS Setup	[random filename]	"Virtumondo adware
X	*MSConfig32	aecache.exe	"Detected by F-Secure as the OBFUSCATED.GP TROJAN!"
Y	*Restore	rstrui.exe	Part of Windows System Restore and added as a RunOnce registry entry. Leave alone
X	*Security Center	secctr.exe	"Added by the SDBOT.BRO WORM!"
Y	*StateMgr	statemgr.exe	Windows ME default for System Restore. Do NOT disable!
X	*windows update	wrauclt.exe	"Added by the RBOT-QU WORM!"
X	*windows update	wuanclt.exe	"Added by the RBOT-PG WORM!"
X	*windows update	wuaucrlt.exe	"Added by the SPYBOT.HUR WORM!"
X	*windows update	wuraclt.exe	"Added by the RBOT-PO WORM!"
X	*windows update	wurauclt.exe	"Added by the RBOT-SY WORM!"
X	*windows update	wsctl.exe	"Added by the SPYBOT.PR WORM!"
X	*windows update	wkmst.exe	"Added by the SDBOT.AVD WORM!"
X	*windows update	wscxt.exe	"Added by the RBOT.AOS WORM!"
X	*windows update	waurclt.exe	"Added by a variant of the RBOT WORM!"
X	*windows update	wuaruclt.exe	"Added by the RBOT-TF WORM!"
X	*Windows [filename] Checker	[filename]	"Added by the KEDEBE-B WORM!"
X	*WindowsAudio	systemupd.exe	"Added by the AGENT-TH WORM!"
X	*winstats	winstats.exe	"Added by the GARGAFX TROJAN!"
X	-=+(L4r1$$4)+=-(4nt1)-=+(V1ru$)=-+	ISASS.exe	"Added by the ASSIRAL.B WORM!"
X	.mscdr	lassa.exe	"Added by the WEBUS.C TROJAN!"
X	.mscdr	lsvchost.exe	"Added by the WEBUS.D TROJAN!"
X	.mscdsr	lsvchost.exe	"Added by the BDOOR-CR BACKDOOR!"
X	.mscsbl	svhost.exe	"Added by the CMQ TROJAN!"
X	.msfupdate	msveup.exe	"Added by the ALLOCUP.A WORM!"
X	.mssecure	mssecure.exe	"Added by the DDOS_BOXED.X TROJAN!"
?	.NET config	sysmon32.exe	"??"
X	.NET.	msnmgnr.exe	"Added by the DELF.AYF WORM!"
X	.norton	rchost.exe	"Added by the BOXED-H TROJAN!"
X	.nvsvc	smss.exe	"Added by the IRCBOT-FP TROJAN! Note - this is not the legitimate smss.exe process which should not normally figure in Msconfig/Startup!"
X	.nvsvcb	smssb.exe	"Added by the BOXED.CG TROJAN!"
X	.Prog	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
X	.svchost	CSRSS.EXE	"Added by the WEBUS.F TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	.TEXTCONV	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	.TEXTCONV	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	.WMAudio	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	.WMAudio	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
N	/s	N/A	"Related to the Dell OEM version of the Sound Blaster Audigy 2 sound card. If this item is listed and checked in startup
X	000hpdllhos	hpdllhost.exe	"LZIO.com adware downloader"
U	000StTHK	000StTHK.exe	"Toshiba Hot key functionality for the function keys (Fn-Esc
X	007-Anti-Spyware.exe	007-Anti-Spyware.exe	"007 Anti-Spyware rogue security software - not recommended"
?	00DSKSVR00	desksaver.exe saskda	"Part of Advanced Desktop Shield
U	00DSKSVR01	desksaver.exe tray	"System Tray access to Advanced Desktop Shield
U	00ERSRRRNKY	eraser.exe	"Part of Evidence Exterminator
?	00notify33	NetBrowser.exe	"Part of Best Network Security
?	00saskda	newlock.exe saskda	"Part of Access Manager
U	00THotkey	system32THotkey.exe	"For Toshiba Satellite notebook series to use the front buttons
X	0utlook Express	*****.exe [* = random char]	"Added by the RBOT-CC WORM! Note the first letter is actually the digit ""0"" and not a capital ""o"""
X	1	lsass.scr	"Added by the BANCOS.V TROJAN!"
X	1	svchost.scr	"Added by the BANCOS.X TROJAN!"
N	1&1 EasyLogin	EasyLogin.exe	"1&1 EasyLogin - quick access to webhost 1&1's Control Panel
X	1-sukarno	sukarno.exe	"Added by the BRONTOK-CR WORM!"
U	101Clips	101Clips.exe	"101Clips - ""the simplest of all multi-clipboard programs. Just have it running minimized and it captures everything you cut or copy from other programs. It keeps the last 25"""
X	1029BB4B-16A9-4E77-AA3D-96930BD68EEC	sysockeu.exe	"Added by the FAKEALERT-AH TROJAN!"
X	10Base-T	explore.exe	"Added by the AGOBOT-IJ WORM!"
X	1111swapmgr.exe	1111swapmgr.exe	"Added by the BDOOR-IC BACKDOOR!"
X	1234klsjdc uiar924c af	sxgnsvuxct.exe	"Added by the FAKEALERT-AM TROJAN!"
X	1234klsjdc uiar924c af	sysvtypkbjx.exe	"Added by the FAKEALERT-AM TROJAN!"
X	123Monitor	SpywareFreeMonitor.exe	"1-2-3 Spyware Free rogue spyware remover - not recommended
U	12Ghosts Backup	12backup.exe	"12Ghosts Backup - ""Automatic Backups
U	12Ghosts Clip	12clip.exe	"12Ghosts Clip - ""Screen shots made easy"""
U	12Ghosts JustAWindow	12window.exe	"12Ghosts JustAWindow - ""Cover annoying ads
U	12Ghosts Popup-Killer	12popup.exe	"12Ghosts Popup-Killer"
U	12Ghosts SaveLayout	12autosl.exe	"12Ghosts SaveLayout - ""Always (always!) keep the layout of your desktop icons"""
U	12Ghosts SetColor	12color.exe	"12Ghosts SetColor - ""Change your desktop icon text colors
U	12Ghosts ShowTime	12showtime.exe	"12Ghosts Showtime - ""Enhance the clock in your tray with font formatting
U	12Ghosts Synchronize	12sync.exe	"12Ghosts Synchronize - ""Sync PC clock with an atomic clock over the Internet"""
U	12Ghosts Tower	12tower.exe	"12Ghosts Tower - ""Quickly access and manage all Ghosts (included in all packages)"""
U	12Ghosts TrayProtect	12srvc.exe	"12Ghosts TrayProtect - ""Hide tray icons
U	12Ghosts Wash	12wash.exe	"12Ghosts Wash - ""Protect your privacy
U	1455 Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX1455 multifunction printer
X	180adsolution	180adsolution.exe	"180solutions adware"
X	180ClientStubInstall	stubinstaller****.exe [* = digit]	"180Solutions adware related"
X	180ClientStubInstall	[path to trojan]	"180Solutions adware related"
X	180ClientStubInstall	******.tmp [* = random digit/char]	"180Solutions adware related"
X	180sa	180sa.exe	"180Search adware"
U	1A:MacVisionTrayMonitor	TrayMonitor.exe	"Part of MacVision by Jeff Bargmann - an discontinued program that makes your PC's desktop look and feel incredibly like that of a Macintosh OS8 computer. Handler that puts the icons that are in your system tray into the MacVision taskbar
Y	1A:Stardock MCP	mcpserver.exe	"Master Control Program for Stardock apps
Y	1A:Stardock TrayMonitor	TrayServer.exe	For monitoring tray icons - if disabled icons will not be displayed in ObjectBar or DesktopX
?	1CmailS	NETMAIL.EXE	"??"
U	1Srv32	SpyAgent4.exe	"SpyTech SpyAgent monitoring software. "Spy software that allows you to monitor EVERYTHING users do on your PC.""
U	1Win32Cfg	SpyBuddy.exe	"SpyBuddy from ExploreAnywhere
X	1WinCfg32	WebMailSpy.exe	"WebMailSpy spyware"
X	2-suharto	suharto.exe	"Added by the BRONTOK-CR WORM!"
X	2020Downloader	mssvr.exe	"2020Search Toolbar"
X	2177F056-0AA6-4D6C-A944-13F71F341C29	sysokuaw.exe	"Added by the FAKEALERT-AH TROJAN!"
U	2335dn Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Dell 2335 multifunction laser printer
X	27	slsorve.exe	"Added by the SLSORVE-A TROJAN!"
X	27	csrss32.exe	"Added by the SLSORVE-D TROJAN!"
X	27	msm32.exe	"Added by the SLSORVE-E TROJAN!"
X	2k6 updatz	crss3.exe	"Added by the RBOT-CPD WORM!"
X	2Search	main.exe	"2Search adware"
X	2thousandbuck	[path to file]	"Added by the RANKY.L TROJAN!"
U	2wSysTray	2portalmon.exe	"2Wire Homeportal user interface"
X	3.8853E+11	AutomaticUpdates.exe	"Added by the SDBOT-DEN WORM!"
U	3170 Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung CLX3170 multifunction laser printer
X	32-bit Thunking service	thunk32.exe	"Added by the DERDERO.A WORM!"
X	32.exe	nvscv32.exe	"Added by the AGENT-LOL TROJAN!"
X	333	svchost.exe	"Added by the JD-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Syswm1i"" directory"
Y	36X Raid Configurer	JMRaidSetup.exe	"JMB36x series RAID configuration utility from JMicron Technology for their PCI Express to SATA II and PATA Host Controllers"
?	39ELTFH25Z8SKF	Ezg1q5.exe	"Seems to be associated with software by Resplendence SP ?"
Y	3cpipe-USRpdA	USRmlnkA.exe	Modem driver files from US Robotics
X	3D Text	3D Text.scr	"Added by the JERMY.A WORM!"
N	3dfx Task Manager	3dfxMan.exe	System Tray application for 3dfx Voodoo 3/4/5 functions. Available via Start -> Programs
Y	3dfx Tools	3dfxCmn.dll	Updates the registry with information that can't be held for Voodoo 3/4/5 series graphics cards. Important for owners of these cards
Y	3dfxv2ps.dll	3dfxv2ps.dll	Updates the registry with info that can't be held for 3dfx Voodoo 2 video cards. Important for owners of these cards
?	3Dlabs Taskbar Display Manager	3DLman.exe	"3DLabs graphics driver related. System Tray access to display settings?"
U	3DLabsHelperDemon	3dldemon.exe	"Directly from the programs author ""It is a tiny program that is installed by the Permedia2/3 and probably other Oxygen-series cards. Normally it sits in the background doing nothing at all (sleeping on a semaphore)
Y	3DMouse.EXE	3DMouse.EXE	Dritek System Inc. 3D Mouse driver
X	3d_sound	3d_sound.exe	"Added by the RIADOS-A TROJAN!"
X	3P_UDEC_IA	IAInstall.exe	"Installer for the Internet Antivirus and Internet Antivirus Pro rogue security software - not recommended
X	4-gusdur	gusdur.exe	"Added by the BRONTOK-CR WORM!"
U	4oD	KHost.exe	"Verisign Kontiki Delivery Management System - Windows-based client software that enables secure delivery of content to users' desktops"
U	4x26 Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX4x26 multifunction laser printers
U	4x28 Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX4x28 multifunction laser printers
X	5-1-61-96	members-area.exe	Adult content dialler
X	6-susilo b	sby.exe	"Added by the BRONTOK-CR WORM!"
U	6200 Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung CLX6200 multifunction laser printer
X	666	Ska.exe	"Added by the PIPES TROJAN!"
X	678	lsas32.exe	"Added by the SLSORVE-B TROJAN!"
X	756349DC-6D9E-4F2A-9B24-269661F073C3	sysoghcx.exe	"Added by the FAKEALERT-AH TROJAN!"
X	7X29C2X78Y	syss_.exe	"Added by the AGENT-GMS TROJAN!"
U	802.11b+g USB Wireless LAN Utility	ZDWlan.exe	802.11b+g USB Wireless LAN Utility
U	802.11g MIMO Wireless Utility	RaUI.exe	"Wireless configuration utility for Railink 802.11g MIMO based products"
U	802.11g Wireless Adatper	Monitor.exe	"Related to wireless card (802.11) adapter/standard. System Tray icon that provides a shortcut to ""Wireless Connection Status"" and allows to turn WL on and off. Supplier unknown. Adapter is miss-spelled"
X	852EBF20-A95D-4F1F-B9C2-B2CD24350F3E	sysodkcs.exe	"Added by the FAKEALERT-AH TROJAN!"
X	9UmxQPSiTJMbA	NVUKZ.exe	"Added by the AGENT-LMN TROJAN!"
Y	9xadiras	9xadiras.exe	"Allied Telesyn AT series router/modem related - apparently required"
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Controller (and maybe othe.html" title="Access Controller (and maybe othe">Access Controller (and maybe othe
	Access Lock (and maybe others) -.html" title="Access Lock (and maybe others) -">Access Lock (and maybe others) -
	Access Lock (and maybe others) -.html" title="Access Lock (and maybe others) -">Access Lock (and maybe others) -
X	?ekio Startups	?nksvc32.exe	"Added by the AGOBOT-OV WORM where ? is a random character"
X	@	sysload.exe	"Added by the DELF-EL TROJAN!"
X	@	regedit -s win.dll	"Added by the SEEKER.K TROJAN! Note that regedit is the the legitimate Windows Registry Editor and shouldn't be deleted. The ""win.dll"" file is located in %Windir%"
X	@	iexpl0res.exe	"Added by the RBOT.AEX WORM!"
X	@	wincms.exe	"Added by the RBOT.CBR WORM!"
X	@	winsys32.exe	"Added by the DELF.CP BACKDOOR! Note that the entry under the Startup Item/Name field my be blank"
X	a	jesse.exe	"Added by the MELO-A WORM!"
X	a	MsSvrdll.vbs	"Added by the MUTAFROG!INF WORM!"
X	A New Windows Updater	w32NTupdt.exe	"Added by the MYTOB.BM WORM!"
Y	a-squared	a2guard.exe	"System Tray access to and Anti-Malware Guard feature of Emsisoft Anti-Malware from Emsi Software GmbH - which provides ""comprehensive PC protection against viruses
Y	a-squared	a2adguard.exe	"System Tray access to and Background Guard feature of Emsisoft Anti-Dialer from Emsi Software GmbH - which provides ""provides a complete defense against Dialers"""
Y	a-squared Anti-Dialer	a2adguard.exe	"System Tray access to and Background Guard feature of Emsisoft Anti-Dialer from Emsi Software GmbH - which provides ""provides a complete defense against Dialers"""
Y	a-winpoet-service	winpppoverethernet.exe	"WinPoET is the industry's first Windows-based PPP over Ethernet client. Developed by iVasion
U	A1000 Settings Utility	cpqa1000.exe	"Compaq A1000 Print Fax All-in-One copy scan printer software. Required in the Startup in order to scan
?	a2dservice	a2dservice.exe	"Related to the Air2Data Wireless HISA (High-Speed Internet Access) service. What does it do and is it required?"
N	AAATraySaver	TraySaver.exe	"System Tray management utility from Mike Lin which allows you to hide
U	aaLDISCN32	LDISCN32.EXE	"LANDesk® Management Suite software component"
U	aaLDTaskCompletion	amclient.EXE	"LANDesk® Management Suite software component"
X	AAMSFree702	Avengine.com	"Added by the DELF.LJ TROJAN!"
X	AAMSFree702	sys.exe	Added by the BACKDOOR-CPC TROJAN!
X	AASSKK2	LSASS.EXE	"Added by the SILLYFDC.BDB WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %AppData%"
?	ab EazyScheduler	ezsched.exe	"??"
X	abass	abass.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
U	Absolute Shield	dseraser.exe	"Absolute Shield Evidence Eliminator - internet history eraser"
U	Absolute StartUp monitor	ASMon.exe	"Absolute Startup - startup monitor from F-Group Software"
U	AbsoluteShield Internet Eraser	cseraser.exe	"AbsoluteShield Internet Eraser - ""protects your privacy by cleaning up all the tracks of your Internet and computer activities"""
X	ABsr	absr.exe	"Added by the AUTOUPDER TROJAN!"
X	absr	mwsvm.exe	"SeekSeek search hijacker related - see here"
X	abtu	mp3serch.exe	"Loads the executable for Lop.com - final version"
X	abtu	lopsearch.exe	"Loads the executable for Lop.com - beta version"
U	Abyssus	razerhid.exe	"Razer Abyssus gaming mouse driver - required if you use the additional features and programmed keys/macros"
U	AbyssWebServer	abyssws.exe	"Abyss web server"
X	Ac97Sound	snddrv.exe	"Added by the VB.AXG TROJAN!"
Y	AccelerometerSt	AccelerometerSt.exe	HP 3D DriveGuard uses a digital accelerometer protects your disk drive by parking and halting I/O requests if you drop your PC or if you move your PC with the display lid closed
Y	AccelerometerSysTrayApplet	AccelerometerSt.exe	HP 3D DriveGuard uses a digital accelerometer protects your disk drive by parking and halting I/O requests if you drop your PC or if you move your PC with the display lid closed
U	Access Connections	ACTray.exe	"System Tray access to the ThinkVantage Access Connections connectivity-assistant program for IBM/Lenovo ThinkPad or 3000 Family notebook computers - ""allowing users to seamlessly switch between wired and wireless environments
X	Access Control App	winsto.exe	"Added by the AGENT.DGO TROJAN!"
N	Access IBM Message Center	ibmmessages.exe	"""The Access IBM Message Center displays messages to inform you about helpful software that may be pre-installed on your PC. The Message Center can also provide messages about new updates available from the IBM Support Center to keep your computer current"""
N	Access Ramp Monitor	armon32.exe	"Monitors your progress on the internet; hang-ups
X	Access WebControl	[path to file]	"Added by the PPDOOR-M TROJAN!"
U	AccessManager	AccessMgr.exe	"Part of SmartPipes SecureSite software. ""SecureSite enables rapid turnup and enhanced administration of VPNs. It automates and simplifies tasks for VPN design and policy management
X	AccessMedia P2P Loader	amp2pl.exe	"My AccessMedia toolbar related
U	AccessoriesPlus	clockplus.exe	"Clock Plus
N	AccessRamp Monitor01	ARMon32a.exe	"From a visitor ""Just wanted to provide you with some info on Access Ramp software installed with Verizon DSL accounts in those areas that use the Winpoet PPPoE software. The Access Ramp TSRs are installed as part of IP Insight software (can't remember the software maker). You can decline to install IP Insight during Winpoet setup
N	AccessRampLAN01	ARUpld32.exe	"Version of the AccessRamp Monitor01 entry for LAN connections - a history uploader. The key in turning it off is a file named ARUCfg32.exe. This file (ARUCfg32.exe) does not show up in the startup process. If you have this file
Y	accrdsub	accrdsub.exe	"ActivIdentity ActivClient - security software from ActivIdentity Corporation which ""enables organizations to secure workstations with smart cards and smart USB tokens while enforcing strong authentication for desktop access and network login"""
N	AccuWeather.com® Desktop	AccuWeatherDesktop.exe	"Desktop weather from AccuWeather"
N	AccuWeatherDesktopAlerts	AccuWeatherDesktopAlerts.exe	"Weather alerts for AccuWeather.com Desktop which ""provides you with the most accurate
N	ACDSee	ACDSee8Pro.exe	"ACDSee 8 photo software. Organize
?	Ace bows	Ace bows.exe	"??"
U	Acer Assist Launcher	launcher.exe	"Acer Assist - program that provides information about new updates or notices from Acer"
?	Acer Empowering Technology Monitor	SysMonitor.exe	"Part of Acer Empowering Technology. What does it do and is it required?"
U	Acer ePresentation HPD	ePresentation.exe	"Part of Acer Empowering Technology. Allows you to manage both internal and external displays"
N	Acer Product Registration	ACE1.exe	Acer Product Registration - remove when registration is completed
X	Acess2007a	access2007a.exe	"Added by the GAOBOT.PQA WORM!"
Y	acEventServ	acevtsrv.exe	"ActivCard Gold from ActivIdentity
U	AClntUsr	AClntUsr.exe	"Altiris AClient Service Windows Tray Icon"
X	acocash	fastdown.exe	Adult content dialler
X	acocash	FASTFOWN.EXE	Adult content dialler
U	Acombo3dmouse	Acombo3d.exe	Mouse driver - required if you use non-standard Windows driver features
U	acoustic	acoustic.exe	"Control panel program for Philips Acoustic Edge soundcard. Not required unless changed settings aren't retained"
U	Acrobat Assistant	AcroTray.exe	"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
U	Acrobat Assistant 7.0	Acrotray.exe	"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
U	Acrobat Assistant 8.0	Acrotray.exe	"Essential for creating PDF files with Adobe Acrobat and Acrobat Distiller. For Win9x/Me systems you can run this file manually beforehand. For WinXP systems this file must run at startup. Hence the ""U"" recommendation"
N	Acrobat Speed Launch	acrobat_sl.exe	"Speeds up the time it takes to load Adobe's Acrobat PDF creation and management tool. From version 7.0 onwards"
U	ACROMOUSE	ACROMAPP.exe	"Related to ACROMOUSE Laser mouse control"
U	Acronis Popup Blocker	"RunDll32.exe [path] Blocker.dll	Run"
U	Acronis Scheduler Helper	schedhlp.exe	"Part of Acronis True Image backup software. Co-operates with the ""schedul2.exe"" service to perform backup/restore tasks correctly. Required if you want to use True Image to do some real backup/restore tasks - not if you only want to explore/mount images"
U	Acronis Scheduler2 Service	schedhlp.exe	"Part of Acronis True Image - backup software. Co-operates with the ""schedul2.exe"" service to perform backup/restore tasks correctly. Required if you want to use True Image to do some real backup/restore tasks - not if you only want to explore/mount images"
U	Acronis True Image	TimounterMonitor.exe	"Part of Acronis True Image backup software. Monitor for the backup archive explorer for moving and viewing files within an archive"
N	Acronis True Image Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
N	Acronis TrueImage Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
N	Acronis*True*Image Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
U	AcronisTimounterMonitor	TimounterMonitor.exe	"Part of Acronis True Image backup software. Monitor for the backup archive explorer for moving and viewing files within an archive"
N	AcronisTrueImage Monitor	TrueImageMonitor.exe	"Part of Acronis True Image - backup software. Can be disabled without affecting TrueImage"
X	Active Bit Station	abs.exe	"Added by the MYTOB.BZ WORM!"
U	Active Desktop Calendar	ADC.EXE	"XemiComputers Active Desktop Calendar"
X	Active Security	asecurity.exe	"Active Security rogue security software - not recommended
U	Active shield	Activeshield.exe	"Active Shield is ""an heuristic screen that actively protects your computer from trojans
X	ActiveDesktop	systray32.exe	"Added by the DABOOM WORM!"
X	ACTIVEDS	ACTIVEDS.EXE	"Added by the OPASERV.T WORM!"
N	ActiveEyes	ActiveEyes.exe	"ActiveEyes from TFI Technology is a small utility that you can use to liven up your desktop. It follows your mouse around and can tell you how far your cursor has travelled or point out where the cursor is. It's small
U	ActiveKeys.AAB635BD7D054a37A576	akeys.exe	"""Active Keys is a powerful yet easy-to-use tool for creating and managing keyboard shortcuts for any system action"""
U	ActivePlus	activeplus.exe	"Interactive Agents Plugin for Messenger Plus! (MSN Messenger add-on)"
X	ActiveScan Antivirus	ActiveScan.exe	"Added by the RBOT-FKQ WORM!"
X	ActiveScript32	nod.exe	"Added by the SOHANA-AJ WORM!"
Y	ActiveShield	mcvsshld.exe	"ActiveShield - background scanner for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online which scans files in the background as and when they are accessed
N	ActiveSpeed	AS.exe	"Ascentive ActiveSpeed internet optimizer - not recommended
X	ActiveSync	wcescom32.exe	"Added by the MANCSYN-E TROJAN!"
N	ActiveWords	AWMonitor.exe	"ActiveWords from ActiveWord Systems
X	ActiveX File Registration Service	filereg.exe	"Added by the RBOT-DVD WORM!"
X	ActiveX Streamer	msgfix.exe	"Added by the SDBOT.NQ WORM!"
X	ActiveXUpdate	svcss.exe	"Added by a variant of the DEDLER.C TROJAN!"
N	ActivSurf	backweb*****.exe	Packard Bell ActivSurf - automatically detects an internet connection and downloads any available updates
U	ACU_QSB	ACU.exe	"Atheros wireless Client Utility"
U	Ad Arrest	adarrest.exe	"Ad Arrest IE popup killer from GameFools"
X	AddClass	AddClass.exe	"CoolWebSearch Addclass parasite variant"
X	AddClass	[Installation_Path]	"Added by the STARTPAGE.F hijacker"
X	AddClass	[path to trojan]	"Added by the SECDL-A TROJAN!"
X	AdDestroyer	AdDestroyer.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
X	Additional Guard	WI[random characters].exe	"Additional Guard rogue security software - not recommended
X	ADDITIONAL Services	pkgadd.exe	"Added by a variant of the IRCBOT TROJAN!"
X	AddrPlus3	[path] stup.exe [path] Adplus.dll Rundll32	"TCent adware"
Y	adi DSndUp	DSndUp.exe	"Utility that only runs once after installing the drivers for Analog Devices SoundMax integrated soundcards. It's exact purpose is unknown at the present time but from the filename it's probably used to configure the default or generic speaker arrangement for the system it's used on"
X	aDir	adirss.exe	"Added by the SPAMSRV-E TROJAN!"
Y	Adiras	Adiras.exe	ADSL USB modem related
X	adlhidp	psncc32.exe	"Added by the SLAPER.AI TROJAN!"
X	Admilli Service	AdmilliServ.exe	Windupdates adware variant
X	Administrator	svchost.scr	"Added by the NOVACAL TROJAN!"
X	Administrator	winlogon.exe	"Added by the RUBBLE-C WORM! Note - this is not the legitimate winlogon.exe process
X	Administrator di Dago	Dago.exe	"Added by the PUNYA-B WORM!"
X	AdminSoft	sysfile.vbs	"Added by the STARGRUB-A WORM!"
X	Adobe	sysconfig.exe	Added by an unidentified WORM or TROJAN!
X	Adobe	sysbat32.exe	"Added by the LOWZONES.T TROJAN!"
N	Adobe Acrobat	Reader_sl.exe	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
X	Adobe Acrobat Distiller Application	acrotray.exe	"Added by the RANDEX.DFJ WORM!"
N	Adobe Acrobat Speed Launcher	acrobat_sl.exe	"Speeds up the time it takes to load Adobe's Acrobat PDF creation and management tool. From version 7.0 onwards"
X	Adobe Flash Player	AdobeFP.exe	"Added by the AUTORUN-BBP WORM!"
N	Adobe Reader Speed Launch	Reader_sl.exe	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
N	Adobe Reader Speed Launch	READER~1.EXE	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
N	Adobe Reader Speed Launcher	Reader_sl.exe	"Speeds up the time it takes to load the Adobe Reader PDF document reader. ""The Speed Launcher quickly opens and closes all of the files that Acrobat or Adobe Reader will use when the application starts. Opening and closing the files allows your virus protection software to check these programs and add them to its list of safe files"" - see here. Not required for Adobe Reader to function properly"
U	Adobe Reader Synchronizer	AdobeCollabSync.exe	"Adobe Synchronizer - installed along with Adobe Reader 8.x. ""Synchronizer is a small application that runs in the background
U	Adobe Version Cue CS2	VersionCueCS2Tray.exe	"File manager that's part of Adobe Creative Suite 2 - ""find files fast
X	AdobeA	adobes.exe	"Added by the FLOOD.BA TROJAN!"
X	AdobeFonts	fonts.hta	Browser hijacker - redirecting to Hugesearch.net
X	AdobeReader	msni.exe	"Added by the RBOT.DAO TROJAN!"
X	AdobeReaderPro	msnxpsp.exe	"Added by the RBOT-ASK or RBOT-AUS WORMS!"
X	AdobeReaderPro	msnserve.exe	"Added by the SDBOT-AKH WORM!"
X	AdobeReaderPro	svxhost.exe	"Added by a variant of the RBOT WORM - see here"
X	AdobeReaderPro	winslog.exe	"Added by a variant of the RBOT WORM!"
X	AdobeReaderPro	lxlfsprrj.exe	"Added by the RBOT.BDZ BACKDOOR!"
X	AdobeReaderPro	cbdzfrsl.exe	"Added by the RBOT.AZQ BACKDOOR!"
X	AdobeReaderPro	subset.exe	"Added by the RBOT.OCU WORM!"
X	AdobeReaderPro	spoolss.exe	"Added by the SDBOT-AKZ WORM!"
X	AdobeReaderPro	lssas.exe	"Added by the RBOT-CLB WORM!"
X	AdobeReaderPro	msnservex.exe	"Added by the RBOT.AKM BACKDOOR!"
X	AdobeReaderPro	msnsrcdv.exe	"Added by the INJECT-H WORM!"
X	AdobeReaderPro	chkdisk.exe	"Added by the RBOT-BDV WORM!"
X	AdobeReaderPro	service.exe	"Added by the RBOT-BCA WORM!"
X	AdobeReaderProfessional	msx64.exe	"Added by the RBOT-GAT WORM!"
X	AdobeReaderPros	sysmsn.exe	"Added by the RBOT-BGH WORM!"
N	AdobeVersionCue	VersionCueTray.exe	"""An exclusive feature of the Adobe® Creative Suite
?	Adobe_ID0EYTHM	VERSIO~2.EXE	"Part of an Adobe product. What does it do and is it required?"
X	adodemaster	adodemaster.exe	"Downloader of Korean origin
X	Adope File Manager	lsasv.exe	Added by an unidentified WORM or TROJAN!
N	ADQuickAccess	Adtray.exe	After Dark for Windows. Screen saver creation program produced before screen savers became integrated into Win95
X	AdRotator.Application	[path to csrss.exe]	"Added by the SMALL-AQ TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	AdRotator.Application	services.exe	"FakeMessage/AdRotator adware. Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in an ""Inetsrv"" subfolder"
X	ADS Adware Remover	ADS Adware Remover.exe	"ADS Adware Remover
X	AdsAlert	AdsAlert.exe	"AdsAlert rogue security software - not recommended"
X	AdsBlocker	stopAds.exe	"AdsBlocker - detected by NOD32 as DIALER.DW!"
U	AdsCleaner	AdsCleaner.exe	"""AdsCleaner is a powerful ad blocking software designed to stop ads (block banners ad
U	ADService	ADService.exe	"Part of Active Disk from Iomega - allows software applications to be run directly from an Iomega Zip® disk. Required if you wish the applications to launch on insertion of a disk. Appears as a service in XP/Vista and under the ""RunServices"" registry key in Win98/ME"
U	AdsGone	Adsgone.exe	"AdsGone - pop-up stopper"
N	ADSL Diagnostic Tools	mapiicon.exe	System tray access to ADSL modem diagnostic tools. Available via Start -> Programs
?	ADSLSYSTEMTRAY	SystemtrayV100B.exe	"Apparently Annex A ADSL modem related. What does it do and is it required?"
Y	AdslTaskBar	"rundll32.exe stmctrl.dll	TaskBar"
X	AdslTaskBars	taskmng.exe	"Added by the RBOT-AXZ WORM!"
?	ADSL_A2	A2Installed	"Associated with an Integrated Telecom Express (ITeX) ADSL driver installation. What does it do and is it required?"
Y	ADSMTray	ADSMTray.exe	ASUS Data Security Manager provides password protected data encryption on ASUS notebooks
U	adsnwe	adsnwe.exe	"EmailSpyMonitor E-mail surveillance software. Uninstall this software unless you put it there yourself"
U	adsnwk	adsnwk.exe	"Keylogger Spy Monitor keystroke logger/monitoring program - remove unless you installed it yourself!"
U	adsnws	adsnws.exe	"ScreenSpyMonitor surveillance software. Uninstall this software unless you put it there yourself"
U	adsnwy	adsnwy.exe	"Yahoo! Messenger Spy Monitor - ""spyware program that records Yahoo! Instant Messenger information on the computer and saves it to a log file"". Uninstall this software unless you put it there yourself"
U	aDSProcMngr	aDSProcMngr.exe	"Part of PC Tools Disk Suite from PC Tools - which ""is an all-in-one hard-disk management utility that integrates disk optimization
Y	ADSS	ADSS.exe	"ADSS is part of Access Denied security and privacy software (Access Denied Security Server) that monitors power status and provides some other services for Screen Guard. Important to keep its running while using Access Denied"
X	adstartup	automove.exe	"Adlogix adware variant"
X	Adstartup	Adstartup.exe	"Adlogix adware"
X	AdStatus Service	AdStatServ.exe	"WindUpdates AdStatus Service adware"
U	AdSubtract	adsub.exe	"AdSubtract blocks ads
X	Adtools Service	AdTools.exe	"Windupdates Adware"
X	AdUpdater	sysupudt.exe	Unidentified adware downloader/updater
U	ADUserMon	ADUserMon.exe	"Part of Active Disk from Iomega - allows software applications to be run directly from an Iomega Zip® disk. Required if you wish the applications to launch on insertion of a disk"
X	Advanced Protection System	advpsys.exe	"Added by a variant of the RBOT WORM!"
X	Advanced Spyware Remover	Asr.exe	"Advanced Spyware Remover rogue spyware remover - not recommended
X	Advanced Spyware Remover Pro	Asr.exe	"Advanced Spyware Remover rogue spyware remover - not recommended
U	Advanced SystemCare 3	AWC.exe	"Advanced SystemCare from IObit - ""helps protect
X	Advanced Tool Checks	advchks.exe	"Added by a variant of the RBOT WORM!"
N	Advanced Tools Check	ADVCHK.EXE	Checks when you install a new version of a Norton product that you have uninstalled all previous versions. Serves as a reminder if you forget
U	Advanced Uninstaller PRO Installation Monitor	monitor.exe	"Innovative Solutions Advanced Uninstaller PRO - ""easy-to-use suite for uninstalling applications and keeping your computer fast
X	AdvancedPrivacySuite	APS.exe	"AdvancedPrivacySuite rogue privacy program - not recommended
X	AdVantage Setup	AdVantageSetup.exe	"MeMedia.Advantage adware - optionally installed with older versions of the DAEMON Tools Lite CD emulation tool (if you don't uncheck the ""DAEMON Tools sponsor ad module"" option during install) and possibly others"
U	Advertising Killer	Akiller.exe	"Advertising Killer - popup stopper"
X	Adware Punisher	AdwarePunisher.exe	"Adware Punisher rogue spyware remover - not recommended
X	Adware Punisher Monitor	AdwarePunisher_monitor.exe	"Adware Punisher rogue spyware remover - not recommended
X	Adware Spy	AdwareSpy.exe	"AdwareSpy rogue adware remover - not recommended
X	AdwareKiller_schedules	schedules.exe	"EAdwareKiller rogue spyware remover - not recommended
X	AdwareSpy	AdwareSpy4.exe	"AdwareSpy rogue adware remover - not recommended
X	Adwarz Spy Remover	ADWARZ.EXE	"Added by the SPYBOT-EV WORM!"
U	AEFltrs Application	AESTFltr.exe	"Part of the XP installation of the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
?	Aeiwlsta.exe	Aeiwlsta.exe	"IBM High Rate Wireless LAN Adapter driver. Is it required?"
X	AERVICESN	AERVICESN.exe	"Added by the RANDON-AO WORM!"
U	AESTFltr	AESTFltr.exe	"Part of the XP installation of the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
?	AeXSWDUsr	AeXSWDUsr.exe	"Altiris Express NS Client Manager software. Is it required?"
X	afmsmsgs	afmsmsgs.exe	"Added by the DLOADR-CUX TROJAN!"
X	afskfask8	fsfjasj8.exe	"Added by the ONLINEG-L TROJAN!"
N	AGEIA PhysX SysTray	TrayIcon.exe	"System Tray access to display properties for AGEIA PhysX graphics cards. Unless you change your desktop resolution
X	Agent	alsys.exe	"Added by the DREF-V VIRUS!"
X	Agent Browser	[random filename]	Added by the PPdoor.M-bdr backdoor TROJAN!
X	agentsvr	agentsvr.exe	"Detected by Kaspersky as Monker.A adware. Note - do not confuse with the Microsoft Agent Server application of the same name as described here - the legitimate file will always be located in the Windows\Msagent folder"
U	Agere SoftModem Messaging Applet	AGRSMMSG.exe	Installed with the drivers for internal software modems based upon Lucent/Agere Systems chipsets - required if you use the SoftModem Assistant to configure the modem
U	AGRSMMSG	AGRSMMSG.exe	Installed with the drivers for internal software modems based upon Lucent/Agere Systems chipsets - required if you use the SoftModem Assistant to configure the modem
N	AGSatellite	AGSatellite.exe	Program from AudioGalaxy that lets you download some MP3s from their server. Available via Start -> Programs
Y	AHNSD	AhnSD.exe	"AhnLab V3 antivirus updater - leave enabled unless you manually update on a regular basis"
X	AhorreMemoria	SysRep.exe	"AhorreMemoria rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
X	ahost	ahost.exe	"Added by a variant of the SDBOT WORM!"
X	Ahst	iebs.exe	"PurityScan adware"
U	Ai Quicker Help	AsRc.exe	"ASUS DH Remote media portal launcher for their Digital Home range of motherboards that are designed for users to control the computer at a distance away
X	AIM Instant Message Cookies	[random filename]	"Added by the RBOT-AFV WORM!"
X	Aim Quick Start	Aim.exe	"Added by the FORBOT-BB WORM! Note - this is not the popular AOL Instant Messenger utility"
X	AIM95 Startup	aim95.exe	"Added by the AGOBOT.AEE WORM!"
N	AIMster	??	Peer to Peer (P2P) file sharing client that runs over the AOL Instant Messenger network. Available via Start -> Programs
N	AIMWDInstall	AIMWDInstall.exe	"Version of the WildTangent on-line games installer that came with versions of AOL Instant Messenger. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case"
Y	Aiptek Graphics Tablet (USB)	atwtusb.exe	USB interface for Aiptek Graphics Tablet (USB)
?	Air2Data	a2dservice.exe	"Related to the Air2Data Wireless HISA (High-Speed Internet Access) service. What does it do and is it required?"
Y	AirPlusCFG	AirPlusCFG.exe	"Driver and configuration utility for a number of wireless routers and adapters from D-Link"
U	AirPort Base Station Agent	APAgent.exe	"Airport Base Station Agent utility for Apple's AirPort wi-fi basestations. ""Wireless solution for home
X	AKEYNAME	WinServ.exe	"Added by the EVILBOT.C TROJAN!"
U	akeys	akeys.exe	"""Active Keys is a powerful yet easy-to-use tool for creating and managing keyboard shortcuts for any system action"""
X	akgkagaksad9	fsakfask9.exe	"Added by the ONLINEG-M TROJAN!"
N	Album Fast Start	ABMTSR.EXE	"Scanner software
N	Alcohol Soft Development Team	axcmd.exe	"Part of Alcohol 120% - ""a powerful Windows CD and DVD burning software that makes it easy to create backups of DVDs and CDs. In addition
X	aldefr ere service	tay0x.exe	"Added by the RBOT-XS WORM!"
U	AlfaClock Classic	AlfaClock.exe	"AlfaClock Free Edition from AlfaSoft Research Labs - ""enhances your taskbar clock (tray clock) with fully customizable clock display
N	Alias SketchBook Snapshot	ALIASS~2.EXE	Screen-capture utility for Alias Sketchbook
N	AlienAutopsy	Test_BS.exe	"Alienware computer technical support software"
Y	ALiSndMgr	ALiSndMg.exe	ALi AC97 Sound driver
?	AliUSBfix	GREENMK.exe	"May be realted to a USB 2.0 PCI card - the IOgear GIC220OU?"
X	Alive SYstem	scchost.exe	"Added by the TOFDROP-B TROJAN!"
X	Alive SYstem	scchostc.exe	"Added by the TOFDROP-B TROJAN!"
X	alkasr	?????.exe	"Added by the BALKART TROJAN!"
U	All Aboard Status	stswin.exe	"All Aboard! Internet Connection Sharing status icon"
X	All Sea screen saver	TaskTray.exe	"Free screensaver
X	All Sea web link	FWLink.exe	"Free screensaver
X	Allopassw	[path to trojan]	"Added by the RANKY.CU TROJAN!"
U	AllSeeingEye	ase.exe	"All-Seeing_Eye security software - ""monitors everything that takes place on your computer
U	allSnap	allSnap.exe	"""allSnap is a small system tray app that makes all top level windows automatically align like they do in programs such as Winamp or Photoshop"""
U	ALLTEL DSL Check-up Center	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	ALM	csrss32.exe	"Added by the ANACON-D VIRUS!"
U	Alogserv	Alogserv.exe	"From McAfee VirusScan for logging scanning activities. In some cases
U	ALPass	ALPass.exe	"ALPass password manager"
X	alpha	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
Y	Alps Electric USB Server	Monserv.exe	"Alps Electric USB Server - required according to this article"
U	AlpsPoint	Apoint.exe	Touchpad software for laptop PC's. For instance it is found on the Panasonic and Sony Vaio machines and allows part of the touchpad to be used for document or Web-page scrolling. Required for proper functioning of the pointing software but not required for the laptop to work
U	ALServ	ALServ.exe	Utility that enables a user to control the volume and surround sound and select Pro Logic/Stereo on 2 satellite speakers and subwoofer of old Altec Lansing speaker systems. The right-side speaker has 4 controls on top providing same functionality
X	alt CTRL Shift	et3rd.exe	"Added by the SDBOT-RH BACKDOOR!"
X	Altnet	points manager.exe	"Altnet TopSearch adware"
X	AltnetPointsManager	points manager.exe	"Altnet TopSearch adware"
U	AltoMB_service	AltoMBsrv.exe	"Alto Memory Booster from Alto Software - boost the computers performance via more intelligent and efficient memory management. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
U	ALTOOLS	AccessL.exe	"ALTools family of PC utilities"
X	AltPayments	AltPayments.exe	"WeirdOnTheWeb adware"
N	ALU Scheduler Service	ALUSchedulerSvc.exe	Symantec LiveUpdate scheduler for programs such as Norton AV or Internet Security
N	Aluria Security Center	SecurityCenter.exe	"Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU
U	Aluria's Pop-Up Stopper	eps.exe	Aluria Pop-Stopper
N	Aluria's Spyware Eliminator	ASE.exe	"Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU
U	AlwaysOnTopMaker	AlwaysOnTopMaker.exe	"Always On Top Maker - utilty to enable an application to always be displayed ""on top"" of others on the desktop"
U	AlwaysReady Power Message APP	ARPWRMSG.EXE	"""Away Mode"" feature added with Update Rollup 2 for Windows XP Media Center Edition 2005 that allows the computer to appear off to the user while it continues to perform tasks that do not require user input
X	AmazingTens	AmazingTens.exe	Premium rate adult content dialler
N	AME_CSA	"rundll32 amecsa.cpl	RUN_DLL"
U	AmIcoSinglun	AmIcoSinglun.exe	"Single LUN Icon Utility - System Tray access/notification for card readers using controllers from Alcor Micro which incorporate Single LUN
X	Amie Release V6.9D	services.exe	"Added by the VB-EAN TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	amircivil	svchost.exe…	"Added by the AMIRECIVEL WORM!"
U	AMO_Taskplaner.exe	AMO_Taskplaner.exe	"Part of Ashampoo® Magical Optimizer from Ashampoo GmbH & Co. KG - which removes stagnant and unnecessary hard drive files
U	AMO_TA~1	AMO_Taskplaner.exe	"Part of Ashampoo® Magical Optimizer from Ashampoo GmbH & Co. KG - which removes stagnant and unnecessary hard drive files
U	AMSG	Amsg.exe	"Part of the IBM ThinkVantage Productivity Center. ""The Message Center sends automatic notification on ThinkVantage Technologies integrated with your system. Once you're online"""
X	amsgupdate	ams.exe	Added by a variant of the MAILBOT TROJAN!
N	AMSN	amsn.exe	"aMSN Messenger is a multiplatform MSN messenger clone"
X	amsn	amsn.exe	"Added by the BANKER-BNZ TROJAN!"
X	Andware Defence	Zsoft32.exe	"Added by the GAOBOT.OO WORM!"
X	angeleyes	msdll.exe	"Added by the VB.PI TROJAN!"
X	animalss	animalss.exe	"Added by the AGOBOT-VE WORM!"
Y	ANIWZCS2Service	WZCSLDR2.exe	"ALPHA Networks wireless driver"
?	ANIWZCSService	WZCSLDR.exe	D-Link wireless PCI adapter related. In some cases reported to cause excessive CPU activity
N	Announcements	Annclist.exe	MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it
U	Anonymizer Total Net Shield	AnonTns.exe	"Anonymizer Total Net Shield - ID protection and privacy software"
Y	ANONYMIZER_SPYWAREKILLER	SpyWareKiller.exe	"Anonymizer Spyware Killer
Y	ANONYMIZER_SPYWAREKILLER	AnonAntiSpyware.exe	"Anonymizer Anti-Spyware - now discontinued"
X	ansjava	[path to worm]	"Added by the RANDON-AN WORM!"
X	Anskya	PYSKY.NET.exe	"Added by the DLOADER-MW TROJAN!"
X	Answer Problem	dSAFsqs.exe	"Added by the SDBOT-SC WORM!"
U	AnswerTool	AnswerTool.exe	"AnswerTool - save your E-mail replies in AnswerTool
X	Anti	Isass.exe	"Added by the BROPIA.K WORM!"
X	Anti Spam Service	spamsvc.exe	"Added by the MYTOB-BK WORM!"
X	Anti-Virus	vpms.exe	"Added by a variant of the SLAPER TROJAN!"
X	Anti-Virus	[random filename].exe	"Added by the CAPROBAD-A TROJAN!"
X	Anti-Virus Product Sync	[unprintable character][3 characters]log.exe	"Added by the KEDEBE.D WORM!"
X	Anti-Virus Update Scheduler	[path to trojan]	"Added by the SPAMMIT-A TROJAN!"
X	Anti-Virus Update Scheduler	winsp3.exe	"Malware - detected by Kaspersky as the AGENT.FP TROJAN!"
X	Anti-Virus Update Scheduler V1.39.12R	[path to trojan]	"Added by the HEPLANE or STAPREW.B TROJANS! - different filenames have been spotted; examples: msvc.exe
X	AntiClicker	SVCHST32.EXE	"Added by the CBH TROJAN!"
X	antihost	ahr.exe	"Added by the BANCBAN-QJ TROJAN!"
X	AntiMalwareSuite	AMS.exe	"AntiMalwareSuite rogue security software - not recommended
X	AntiSpionage	pgs.exe	"AntiSpionage
X	AntiSpionagePro	pgs.exe	"AntiSpionagePro
X	antispy	ANTIVIR.exe	"IE AntiVirus rogue security software - not recommended
X	antispy	ANTIVIRUS.exe	"IE AntiVirus rogue security software - not recommended
X	antispy	ieav.exe	"IE AntiVirus rogue security software - not recommended
X	antispy	scan.exe	"IE AntiVirus rogue security software - not recommended
X	AntiSpy2008	AntiSpy2008.exe	"Antispy 2008 rogue spyware remover - not recommended
X	AntiSpyBoss	asb32.exe	"AntiSpyBoss rogue security software - not recommended
X	AntiSpyCheck	AntiSpyCheck.exe	"AntiSpyCheck rogue spyware remover - not recommended
X	AntiSpyCheck 2.1	AntiSpyCheck 2.1.exe	"AntiSpyCheck rogue spyware remover - not recommended
X	AntiSpyCheck 2.1.0	AntiSpyCheck.exe	"AntiSpyCheck rogue spyware remover - not recommended
X	AntiSpyControl	pgs.exe	"AntiSpyControl rogue security software - not recommended
X	AntiSpyGolden	AntiSpyGolden 5.1.exe	"AntiSpyGolden rogue spyware remover - not recommended"
X	AntiSpyGolden 5.1	AntiSpyGolden 5.1.exe	"AntiSpyGolden rogue spyware remover - not recommended"
X	AntiSpyGuard	AntiSpyGuard.exe	"AntiSpyGuard rogue security software - not recommended
X	AntiSpyKit	AntiSpyKit 5.3.exe	"AntiSpyKit rogue spyware remover - not recommended
X	AntiSpyKit 5.2	AntiSpyKit 5.2.exe	"AntiSpyKit rogue spyware remover - not recommended
X	AntiSpyKit 5.3	AntiSpyKit 5.3.exe	"AntiSpyKit rogue spyware remover - not recommended
X	AntiSpyMon	AntiSpyMon.exe	"Antispyware Protector rogue security software - not recommended"
X	antispysoldier	antispysoldier.exe	"AntiSpyware Soldier rogue spyware remover - not recommended
X	AntispySpider	antispyspider.exe	"AntiSpySpider rogue spyware remover - not recommended
X	AntispyStorm	AntispyStorm.exe	"AntispyStorm rogue security software - not recommended
X	AntiSpyware	AntiSpyware.exe	"AntiSpywareApp rogue spyware remover - not recommended
X	AntiSpyware Pro	AntiSpyware Pro.exe	"AntiSpyware Pro 2009 rogue spyware remover - not recommended
X	Antispyware PRO XP	asproxp.exe	"AntiSpyware Pro XP rogue spyware remover - not recommended
X	Antispyware-2008.exe	Antispyware-2008.exe	"AntiSpyware 2008 rogue security software - not recommended
Y	AntiSpyWare2Guard	AntiSpyWare2Guard.exe	"Part of Ashampoo® AntiSpyWare 2 from Ashampoo GmbH & Co. KG. This part is the realtime monitor that looks for changes on the users system such as BHO
X	AntiSpyware3000.exe	antispyware.exe	"AntiSpyware 3000 rogue spyware remover - not recommended
X	AntiSpywareBot	AntiSpywareBot.exe	"AntiSpywareBot rogue spyware remover - not recommended
X	AntiSpywareControl	pgs.exe	"AntiSpywareControl rogue security software - not recommended
X	AntispywareD	AntispywareD.exe	"AntiSpywareDeluxe rogue security software - not recommended
X	AntiSpywareExpert	ase.exe	"AntiSpywareExpert rogue security software - not recommended
X	AntiSpywareGuard	asg.exe	"AntiSpywareGuard rogue spyware remover - not recommended
X	AntiSpywareMaster	asm.exe	"AntiSpywareMaster rogue security software - not recommended
X	AntiSpywareShield	AntiSpywareShield.exe	"AntiSpywareShield rogue security software - not recommended
X	AntiSpywareSuite	pgs.exe	"AntiSpywareSuite rogue security software - not recommended. A member of the AVSystemCare family"
X	AntiSpywareXP 2009	AntiSpywareXP2009.exe	"AntiSpywareXP 2009 rogue spyware remover - not recommended
X	AntiSpyZone	AntiSpyZone.exe	"AntiSpyZone rogue spyware remover - not recommended"
X	AntiSpyZone 4.5	AntiSpyZone 4.5.exe	"AntiSpyZone rogue spyware remover - not recommended"
X	AntiSpyZone 4.6	AntiSpyZone 4.6.exe	"AntiSpyZone rogue spyware remover - not recommended"
X	AntiSpyZone 4.9	AntiSpyZone 4.9.exe	"AntiSpyZone rogue spyware remover - not recommended"
X	AntiSpyZone 5.1	AntiSpyZone 5.1.exe	"AntiSpyZone rogue spyware remover - not recommended"
X	AntiSpyZone 5.4	AntiSpyZone 5.4.exe	"AntiSpyZone rogue spyware remover - not recommended"
X	AntiVer2008	pgs.exe	"AntiVer2008
X	AntiVermeans	AntiVermeans.exe	"Variant of the Antivermins rogue security software - not recommended
X	AntiVermins	AntiVermins.exe	"Antivermins rogue security software - not recommended
X	AntiVermins 3.0	AntiVermins 3.0.exe	"Antivermins rogue security software - not recommended
X	AntiVermins 3.3	AntiVermins 3.3.exe	"Antivermins rogue security software - not recommended
X	AntiVerminser	AntiVerminser.exe	"Variant of the Antivermins rogue security software - not recommended
X	AntiVerminsPro	AntiVerminspro.exe	"Antivermins rogue security software - not recommended
X	antiviirus	antiviirus.exe	Added by a variant of the AGENT.KEU TROJAN!
X	Antivir	svchst.exe	"Added by the RAGRUK-A TROJAN!"
X	AntiVir	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	AntiVir	smss.exe	"Added by the DWNLDR-GWE TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%"
X	Antivirus	av.exe	"Added by the SINKIN TROJAN! Resets IE start page to realphx.com"
X	Antivirus	maja.exe	"Added by the NETSKY.H WORM!"
X	Antivirus	iexpl0res.exe	Added by an unidentified WORM or TROJAN!
X	AntiVirus	kaspery.exe	"Added by a variant of the RBOT WORM!"
X	AntiVirus	AntiVirus.exe	"Added by the BANKER-EHB TROJAN!"
X	Antivirus	Antvrs.exe	"AntiVirus 2008 rogue security software - not recommended
X	Antivirus	avm.exe	"Antivirus Master rogue security software - not recommended
X	Antivirus	vav.exe	"Vista Antivirus 2008 rogue security software - not recommended
X	Antivirus	aav.exe	"Advanced Antivirus rogue security software - not recommended
X	ANTIVIRUS	AVS.exe	"Antivirus Sentry rogue security software - not recommended
X	ANTIVIRUS	microAV.exe	"Micro Antivirus 2009 rogue security software - not recommended
X	Antivirus	MSA.exe	"MS Antivirus rogue security software - not recommended
X	ANTIVIRUS	UltraAV.exe	"Ultra Antivirus 2009 rogue security software - not recommended
X	Antivirus	xpa.exe	"Xpert Antivirus Enterprise rogue security software - not recommended
X	Antivirus	SPP.exe	"Spyware Preventer rogue security software - not recommended
X	Antivirus	sav.exe	"System Antivirus 2008 rogue security software - not recommended
X	Antivirus	uav.exe	"Ultimate Antivirus 2008 rogue security software - not recommended
X	Antivirus	wav.exe	"Windows Antivirus 2008 rogue security software - not recommended
X	Antivirus 2009	av2009.exe	"AntiVirus'09 rogue security software - not recommended
X	Antivirus 2009 plus	Antivirus 2009 plus.exe	"AntiVirus Plus rogue security software - not recommended
X	Antivirus Agent Pro	aap.exe	"Antivirus Agent Pro rogue security software - not recommended
X	Antivirus Installer	[path to trojan]	"Added by the BADGENT-A TROJAN!"
X	Antivirus PC 2009	avpc2009.exe	"Antivirus PC 2009 rogue security software - not recommended
X	Antivirus Pro 2009	AntivirusPro2009.exe	"AntiVirus Plus rogue security software - not recommended
X	Antivirus Pro 2010	AntivirusPro_2010.exe	"Antivirus Pro 2010 rogue security software - not recommended
X	AntiVirus Process	virprot.exe	"Added by a variant of the SDBOT WORM!"
X	Antivirus Protection Services	ccapp2.exe	"Added by the RBOT.EXI WORM!"
X	AntiVirus Update	updates.exe	"Added by the RBOT-JF WORM!"
X	AntiVirus Update	antivirus.exe	"Added by the RBOT-IF WORM!"
X	Antivirus Updates	avupdchk.exe	"Added by the AGOBOT-IP WORM!"
X	Antivirus-2008.exe	Antivirus-2008.exe	"Antivirus 2008 rogue security software - not recommended. Detected by Sophos as the FAKEAV-BK TROJAN!"
X	antivirus-2008pro.exe	antivirus-2008pro.exe	"Antivirus 2008 PRO rogue security software - not recommended. Detected by Sophos as the FAKEAV-AW TROJAN!"
X	Antivirus-Golden	Antivirus-Golden.exe	"Antivirus-Golden rogue security software - not recommended"
X	Antivirus.exe	Antivirus.exe	"Antivirus rogue security software - not recommended
X	Antivirus2008y	antvrs.exe	"AntiVirus 2008 rogue security software - not recommended
X	antivirus32	antivirus.exe	"Added by the SPYBOT.KAI WORM!"
X	AntivirusBEST	Installer.exe	"Installer for the AntivirusBEST rogue security software - not recommended. Removal instructions here"
X	AntivirusBEST	abest.exe	"AntivirusBEST rogue security software - not recommended
X	AntivirusDoc	AntivirusDoc.exe	"AntivirusDoc rogue security software - not recommended
X	AntivirusFiable	pgs.exe	"AntivirusFiable
X	AntivirusForAll	pgs.exe	"AntivirusForAll rogue security software - not recommended
X	AntivirusGold	AntivirusGold.exe	"AntivirusGold rogue security software - not recommended
X	AntivirusGold 5.1	AntivirusGold 5.1.exe	"AntivirusGold rogue security software - not recommended
X	AntiVirusLab2009	AntiVirusLab2009.exe	"Antivirus Lab 2009 rogue security software - not recommended
X	AntivirusOrdi	pgs.exe	"AntivirusOrdi
X	AntivirusPCPakke	pgs.exe	"AntivirusPCPakke
X	AntivirusPCSuite	pgs.exe	"AntivirusPCSuite rogue security software - not recommended
X	Antiviruspertutti	pgs.exe	"Antiviruspertutti rogue security software - not recommended. A member of the AVSystemCare family"
X	AntiVirusPro	AntiVirusPro.exe	"Anti Virus Pro rogue security software - not recommended"
X	AntiVirusProMFC	Antivirus Pro.exe	"AntiVirus Pro rogue security software - not recommended"
?	AntiVirusProtection	qumk.exe	"??"
X	AntivirusProtection	antivirusprotection.exe	"Antivirus Protection rogue security software - not recommended
X	Antivirusscherm	pgs.exe	"Antivirusscherm
X	AntivirusXP.exe	AntivirusXP.exe	"Antivirus XP Pro rogue security software - not recommended
X	AntiVirus_ProNET	AntiVirus_Pro.exe	"AntiVirusPro rogue security software - not recommended
X	AntiVituS	Base.exe	"Added by the BAS.A WORM!"
U	AntiWindowsMessenger	AntiMsMsg.exe	"Anti-Windows_Messenger is a small application that prevents Windows Messenger from remaining resident in memory"
X	AntiWorm2008	pgs.exe	"AntiWorm2008 rogue security software - not recommended. A member of the AVSystemCare family"
U	AnVir Security Suite	AnVir.exe	"AnVir Security Suite - ""is a tool that controls everything running on computer and provides Windows enhancements that help in every-day work"". Monitors and manages startup programs
U	AnVir Task Manager	AnVir.exe	"AnVir Task Manager - ""is a tool that controls everything running on computer and provides Windows enhancements that help in every-day work"". Monitors and manages startup programs
U	AnVir Task Manager Free	AnVir.exe	"AnVir Task Manager Free - ""is a tool that controls everything running on computer and provides Windows enhancements that help in every-day work"". Monitors and manages startup programs
U	AnVir Task Manager Pro	AnVir.exe	"AnVir Task Manager Pro - ""is a tool that controls everything running on computer and provides Windows enhancements that help in every-day work"". Monitors and manages startup programs
U	anvshell	anvshell.exe	System Tray tool for ASUS video cards. If disabled you lose all the ASUS specific video card options in Control Panel -> Display Properties -> Advanced as well as the System Tray shortcuts toolbar
U	Any To-Do List	anytodo.exe	"Any To-Do List ""the ultimate software solution to keep yourself organized and reminded"""
X	Aol Configuration Loader	aimsng.exe	"Added by the SDBOT-XE WORM!"
N	AOL Fast Start	AOL.exe	"Fast Start loads the AOL integrated email
X	AOL Instant Messanger	aim.exe	"Added by the SDBOT-YT WORM! Note - this is not the popular AOL Instant Messenger utility"
X	AOL Instant Messengar	aol.exe	"Added by the AGOBOT-FN WORM!"
X	AOL Instant Messenger	AlM.EXE	"Added by unidentified malware. Note - there ia a lower case ""L"" between the A and M in the filename"
X	Aol Instant Messenger	aolmsg.exe	"Added by the KELVIR.AL WORM!"
X	AOL Instant Messenger	aimsgr.exe	"Added by the IRCBOT.N TROJAN!"
X	AOL Instant Messenger 7.213	aim9283.exe	"Added by the SDBOT-ZF WORM!"
X	AOL Instant Messenger dll runtime	MSAOL32dll.exe	"Added by the RBOT-ATA WORM!"
X	Aol Instant Messenger Fix	aolfix.exe	"Added by the SDBOT-ABJ WORM!"
X	AOL Messenger	[random filename]	"Added by an unidentified VIRUS
X	AOL Messenger	aolmsngr.exe	"Added by the SDBOT-JF WORM!"
X	AOL Messenger Optimized	AOLOpt.exe	"Added by the AOLOPT TROJAN!"
N	AOL Service Libraries	AOLSoftware.exe	"Quoted from AOL Beta Team
X	AOL Services Hosts	aolserviceshosts.exe	Added by an unidentified WORM or TROJAN!
U	AOL Spyware Protection	AOLSP Scheduler.exe	AOL's spyware protection program
U	AOL TopSpeedMonitor	aoltsmon.exe	"AOL's TopSpeed ""web-acceleration technology speeds up your web-browsing experience by storing and reusing elements of web pages that you visit
Y	AolAcsDaemon1	Acsd.exe	"AOL Connectivity Service - automatically restores the connection to AOL should you lose it while online. Negates having to go through the procedure of signing back on manually. This version is obsolete and has been replaced by AOLACSD.EXE so update your version of AOL. Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
Y	AolAcsDaemon1	AOLACSD.EXE	"AOL Connectivity Service - automatically restores the connection to AOL should you lose it while online. Negates having to go through the procedure of signing back on manually. Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
X	AOLRegKey32	AOREGSVR512.EXE	"Unidentified malware - see here"
?	AOLSAV	AOLAgent.exe	"AOL ISP related. What does it do and is it required?"
N	AOLSoftware	AOLSoftware.exe	"Quoted from AOL Beta Team
X	AOLSPYWAREREMOVER32	AOLSPYWARECLEANER32.EXE	"Added by the SPYBOT-HJ WORM!"
X	AOLStart	AOLStart.exe	"Added by the KRAIMER.12 TROJAN!"
X	aouei	sysrtmvs.exe	"Chivio dialer"
Y	APC UPS Status	Display.exe	"APC PowerChute® Personal Edition status icon"
X	APcSafe	APcSafe.exe	"APcSafe rogue security software - not recommended
X	APcSecure	APcSecure.exe	"APcSecure rogue security software - not recommended
U	APC_SERVICE	mainserv.exe	"APC PowerChute® Personal Edition - ""safe system shutdown software with sophisticated power management functions."" Appears as a service in XP/Vista and under the ""RunServices"" registry key in Win98"
X	APIClass	lexplore_.exe	"Added by the MSNOPT-A TROJAN!"
X	APIMon	msreg.exe	"Added by the DROPPER.Z TROJAN!"
X	apisvc.exe	apisvc.exe	"Added by a variant of the LAMEBOT TROJAN!"
?	Apmsrv9x	APMSRV9X.EXE	"Intel AnyPoint Wireless II Home Network related. Now discontinued. What does it do and is it required?"
X	ApPache System	ApPache.exe	"Added by the RBOT-YP BACKDOOR!"
X	appis.exe	appis.exe	"Added by the AGENT-BC TROJAN!"
N	AppleSyncNotifier	AppleSyncNotifier.exe	"From WinPatrol PLUS by BillP Studios - ""This file installs with iTunes and is used when syncing your iPhone
Y	Application	mdmsetsp.exe	"Aztech Labs modem driver"
X	Application	csrss.exe	"Added by the BEAGLE.EG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Application Adapter	abvsvc.exe	"Added by the CHECKOUT WORM!"
U	Application Explorer	Naldesk.exe	"Novell Zenworks Application Explorer Executable. ""For almost all users the Novell ZENworks agent (either Application Launcher or Application Explorer) will be run via the user's login script on each successful login. ZENworks is used to periodically deliver software updates and is also used to install the remote management components."""
X	Application In System	Snxmsh.exe	"Added by the AGENT-LNV TROJAN!"
X	Application Layer Browser	abgsvc.exe	"Added by the ULPM.FX TROJAN!"
X	Application Layer Gateway Service	algs.exe	"Added by the LINKBOT.M WORM!"
X	Application Layer Scheduler	agtsvc.exe	"Added by the IRCBOT.BJJ BACKDOOR!"
X	Application Layer Services	avrsvc.exe	"Added by the IRCBOT.BJM BACKDOOR!"
X	Application Manager	acnsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Application Manager	apnsvc.exe	"Added by the SMALLTRO.FN TROJAN!"
X	ApplicationProtocolRun	smsbvl32.exe	"Added by the IRCBOT-CX TROJAN!"
U	AppPlus	AppPlus.exe	"AppPlus - ""menu bar or tray launcher that docks to your desktop
Y	APVXDWIN	ClShield.exe	"""Panda ClientShield with TruPrevent is designed for companies that want the best protection for their workstations. It protects against viruses and other known and unknown threats including spam
X	apyginapygin	simenu.exe	"Added by the SDBOT.BTR WORM!"
U	AQ3HelperStartUp	AQ3HEL~1.EXE	"ScreenScenes ""Aquatica Water Worlds"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	arcaderockstar	arcaderockstar32.exe	"Arcade Rockstar (now Gamevance) - free arcade games and prize tournaments. The program itself is clean
N	ArcSoft Connect	ACDaemon.exe	"Used to serve notice of product information and updates when running ArcSoft products such as TotalMedia
N	ArcSoft Connection Service	ACDaemon.exe	"Used to serve notice of product information and updates when running ArcSoft products such as TotalMedia
N	ARCSolo Recovery	N/A	Backup software by Computer Associates - no longer supported
U	Arctosa	razerhid.exe	"Razer Arctosa gaming keyboard driver - required if you use the additional features and programmed keys/macros"
N	ares	ares.exe	"""Ares is a free open source file sharing program that enables users to share any digital file including images
N	areslite	AresLite.exe	"""Ares is a free open source file sharing program that enables users to share any digital file including images
X	argq32	csrss_32.exe	"Added by the RBOT-CPM WORM!"
X	aromis	aromis.exe	"Added by the NUWAR.JQ WORM!"
U	Arovax AntiSpyware	arovaxantispyware.exe	"Part of Arovax AntiSpyware from Arovax
Y	Arovax Shield	ArovaxShield.exe	"Part of Arovax Shield from Arovax
U	arovaxantispyware	arovaxantispyware.exe	"Part of Arovax AntiSpyware from Arovax
Y	ArovaxShield	ArovaxShield.exe	"Part of Arovax Shield from Arovax
U	ARPWRMSG	ARPWRMSG.EXE	"""Away Mode"" feature added with Update Rollup 2 for Windows XP Media Center Edition 2005 that allows the computer to appear off to the user while it continues to perform tasks that do not require user input
?	AS00 Gear511	Gear511.exe	"Software for Netgear wireless network cards. Unknown whether it is required for the wireless card to run but does not seem to be a resource hog. Not required for laptop to run if the wireless network card will not be used. Is it at all required?"
N	AS00_Gear511	Gear511.exe	Netgear wireless LAN configuration utility
U	AS00_WN511B	WN511B.exe	"Netgear RangeMax NEXT wireless adapter configuration utility"
?	AS00_WPN511	WPN511.exe	"NetgearRev MFC Application - software for Netgear wireless network cards - what does it do and is it required in startup?"
X	asam	asam.exe	"Added by the FAKEAV-BGU TROJAN!"
X	ASC-AntiSpyware	WinCleaner.exe	"WinCleaner 2009 rogue security software - not recommended
X	ASC-AntiSpyware	WinAntivirus.exe	"Win Antivirus Vista/XP rogue security software - not recommended
X	asc32	asc 2.1.exe	"AntiSpyCheck rogue spyware remover - not recommended
X	asccacA	asacsqgl.exe	"Added by the MULTIDRP.AA TROJAN!"
X	ASDd	ASDd.exe	"AntiSpywareDeluxe rogue security software - not recommended
X	ASDPLUGIN	dsldbaccess.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	canada.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	france.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	fullgames.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	100171be.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	100176br.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	adult1.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	Austria.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	belgium_nm.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	czech.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	dbaccess.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	dslgeaccess.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	Finland.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	geaccess.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	mexico.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	netherlands.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	turkey.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	uk_nm.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	Xadult1.exe	"AsdPlug premium rate adult content dialer"
X	ASDPLUGIN	temp532.exe	"AsdPlug premium rate adult content dialer"
X	asdsaxcxz13	dasxcsx13.exe	"Added by the LEGMIR-ARF TROJAN!"
X	asdx	xwinrpc32.exe	"Added by the AGOBOT.VO WORM!"
N	ASE Scheduler	ASE Scheduler.exe	"Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU
Y	Ashampoo AntiSpyWare 2	AntiSpyWare2Guard.exe	"Part of Ashampoo® AntiSpyWare 2 from Ashampoo GmbH & Co. KG. This part is the realtime monitor that looks for changes on the users system such as BHO
Y	Ashampoo AntiSpyWare 2 Guard	AntiSpyWare2Guard.exe	"Part of Ashampoo® AntiSpyWare 2 from Ashampoo GmbH & Co. KG. This part is the realtime monitor that looks for changes on the users system such as BHO
Y	Ashampoo AntiVirus Service	GuardGui.exe	"System Tray access to the main user interface for Ashampoo® AntiVirus from Ashampoo GmbH & Co. KG."
U	Ashampoo Core Tuner	ct.exe	"Ashampoo® Core Tuner from Ashampoo GmbH & Co. KG - a utility which helps you to get the most out of a multi-processor (or dual core) computer. ""For instant results you just need to select Auto-Optimize to optimize all the programs you are running or Boost to give more power to a single program"". This entry loads Core Tuner with Windows (required if you use any optimized profiles) and gives System Tray access"
Y	Ashampoo FireWall	FireWall.exe	"Ashampoo® Firewall FREE from Ashampoo GmbH & Co. KG"
Y	Ashampoo FireWall PRO	FireWall.exe	"Ashampoo® Firewall PRO from Ashampoo GmbH & Co. KG"
U	Ashampoo HDD Control Guard	HDDControlGuard.exe	"Part of Ashampoo® HDD Control from Ashampoo GmbH & Co. KG - a hard drive monitoring utility which also incorporates defragmentation and cleaners for browsing history and unnecessary files. This entry loads the Ashampoo HDD Control Guard component on startup which runs in the background and monitors the hard drives and provides System Tray access"
U	Ashampoo Magical Defrag	aDefragCtrl.exe	"System Tray access to the main user interface for Ashampoo® Magical Defrag from Ashampoo GmbH & Co. KG - which ""runs in the background as a service
U	Ashampoo Magical Optimizer Taskplaner	AMO_TA~1.EXE	"Part of Ashampoo® Magical Optimizer from Ashampoo GmbH & Co. KG - which removes stagnant and unnecessary hard drive files
U	Ashampoo Magical Optimizer Taskplaner	AMO_Taskplaner.exe	"Part of Ashampoo® Magical Optimizer from Ashampoo GmbH & Co. KG - which removes stagnant and unnecessary hard drive files
N	ashampoo Magical UnInstall	MagicalUnInstall.exe	"Ashampoo® Magical UnInstall from Ashampoo GmbH & Co. KG - which monitors each new program installation
U	Ashampoo PopUpBlocker	PopUpKiller.exe	"Ashampoo popup blocker
N	ashampoo UnInstaller Watcher	UIWatcher.exe	"Part of the Ashampoo® UnInstaller series from Ashampoo GmbH & Co. KG - including UnInstaller Platinum 2
Y	ashAvast	ashAvast.exe	"Part of Avast antivirus"
X	ashcap	servirsess.exe	"SpySure spyware"
X	ashDip.exe	ashDip.exe	"Added by the DROPR-CZ TROJAN!"
Y	ashDisp	ashDisp.exe	"System Tray access to and notifications for avast! Antivirus - giving left-click access to the On-Access Scanner
X	ashDsp.exe	ashDsp.exe	"Added by a variant of the SDBOT WORM!"
X	ASHLT	Ashlt.exe	"Ashlt adware"
Y	ashMaiSv	ashmaisv.exe	"E-mail scanning part of avast! Antivirus. Starts via a registry ""Run"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
X	Asia	easm.exe	"PurityScan adware"
X	Asicfc	icfca.exe	"Added by the AGENT.AAJE WORM!"
U	AsioReg	regsvr32.exe ctasio.dll	"ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality"
U	AsioThk32Reg	rregsvr32.exe ctasio.dll	"ASIO (Audio Stream In/Out) drivers for the SoundBlaster Audigy 2 series soundcards - for recording and home project studios. Required if you use this functionality"
U	ASK	rundll32.exe [path] ASK.dll rdl	"Stealth Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	asl	Aslru.exe	"Added by the BANCOS-CU TROJAN!"
U	ASM	ASMonitor.exe	"Active Security Monitor from AOL - helps you determine how vulnerable your PC is to computer viruses
U	Asmw Soft Popups Burner	popups burner.exe	"Popup blocker
X	asnconsole	msasn.exe	"Added by the RBOT.EVU TROJAN!"
X	ASocksrv	SocksA.exe	"Added by the VB.CBW WORM!"
X	asp-srvc	asp-srvc.exe	"Added by the AGOBOT-KG WORM!"
X	ASP.NET State Service	csrss.exe	"Added by the DLOADER-QI TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	ASP.NET State Service	crsass.exe	"Added by the BANLOAD-M TROJAN!"
X	ASP.NET State Service	servicos..exe	"Added by the DADOBRA-I TROJAN!"
N	asp4tray	asp4tray.exe	System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel
?	AspireService	AspireService.exe	"Found on Acer laptops
Y	AspireTimeMachine	acertmb.exe	"System recovery software supplied with some Acer notebook PCs. Similar to GoBack and the restore program in WinXP
X	ASpyC	ASpyC.exe	"AntiSpyCheck rogue spyware remover - not recommended
X	asr64_ldm.exe	asr64_ldm.exe	"Added by the Dr. Guard rogue security software - not recommended
X	asrupdate.exe	asrupdate.exe	"Added by the VB.ATZ TROJAN!"
X	Ass and titties	CMD32.EXE	"Added by the SDBOT-GG BACKDOOR!"
X	assistse	ASSISTSE.EXE	"CnsMin (Chinese Keywords) hijacker related"
X	AST	AST	"Added by the VB.AH TROJAN!"
X	AST	AST.exe	"AutoStarter parasite"
U	ASTART	astart.exe	ASUS TweakEnable - restores manually changed settings for ASUS based video cards such as overclocking. Only required if you use non-standard settings
X	AStart	AStart	"Added by the VB.AH TROJAN!"
N	asTray	Astray.exe	"Voyetra Audio Station - part of Voyetra's Ultimate MP3 & CD Manager. MP3 and digital music jukebox/organizer"
N	Astro	Astro.exe	Checks for updates to Quicken on a system reboot
X	Astrum	Astrum.exe	"Astrum Antivirus Pro rogue security software - not recommended
X	asus	asus.exe	"Added by the RBOT-OC WORM!"
?	ASUS Camera ScreenSaver	ASScrProlog.exe	"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
N	ASUS Live Update	ALU.exe	ASUS Live Update utility for their motherboards
N	ASUS Probe	AsusProb.exe	ASUS video card fan/thermal monitor - only required if you overclock your card or live in a hot area
?	ASUS Screen Saver Protector	ASScrPro.exe	"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
U	ASUS SmartDoctor	VGAProbe.exe	ASUS video card fan/thermal monitor
U	ASUS TweakEnable	astart.exe	ASUS TweakEnable - restores manually changed settings for ASUS based video cards such as overclocking. Only required if you use non-standard settings
?	AsusACPIServer	AsAcpiSvr.exe	"Part of the ACPI driver for the Asus Eee PC range. What does it do and is it required?"
U	AsusEPCMonitor	AsEPCMon.exe	"Part of the ACPI driver for the Asus Eee PC range. Manages the Fn function keys and ""on screen display"""
N	ASUSGamerOSD	GamerOSD.exe	"GamerOSD by ASUSTek - for ""real-time overclocking
N	ASUSKey	V38SHELL.EXE	System tray Icon for quickly changing video modes
?	AsusStartupHelp	AsRunHelp.exe	"Unknown ASUS motherboard utility. What does it do and is it required?"
X	asussvc	asussvc.exe	"Added by the AGENT-FPB TROJAN!"
U	AsusTray	AsTray.exe	"Part of the ACPI driver for the Asus Eee PC range. Watches the sensors of the motherboard such as power and temperature"
U	asustweakenable	ATweak.exe	ASUS TweakEnable - restores manually changed settings for ASUS based video cards such as overclocking. Only required if you use non-standard settings
N	ASUSWebStorage	ASUSWSDashBoard.exe	"System Tray access to ASUS Webstorage online backup and sharing utility which is pre-installed on some ASUS systems or available for free (with 1GB available) for others. Disable unless you want to automatically backup and sync your files every time your system starts"
N	AsusWSDashBoard	ASUSWSDashBoard.exe	"System Tray access to ASUS Webstorage online backup and sharing utility which is pre-installed on some ASUS systems or available for free (with 1GB available) for others. Disable unless you want to automatically backup and sync your files every time your system starts"
N	ASWDP	ASWDP.exe	"MLS Pulse - real estate software. Keeps the home buyer/seller continually informed on the status of his/her local/regional real estate market"
X	ASWnk	aswnk.exe	Adult content dialler
U	AT&T Self Support Tool	matcli.exe	"AT&T Resolution Assistant. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	atf.exe	pgs.exe	"Part of the PCSecureSystem rogue security software - not recommended. A member of the AVSystemCare family"
X	atf_reinstall	atf.exe	"Part of the AVSystemCare rogue security software - not recommended. See here"
X	ATI Active Graphics Card Monitor	atievx.exe	"Added by the IRCBOT-TL WORM!"
X	ATI AS Filter	msnse.exe	"Added by the RBOT-CCY WORM! Note - modifies the HOSTS file by appending numerous lines
N	ATI CATALYST System Tray	CLI.exe SystemTray	"System Tray access to ATI's Catalyst™ Control Center. Note that this has ""SystemTray"" appended to CLI.exe in the ""Command"" column of MSCONFIG. Not required to run the control center - which is available via a right-click on the desktop"
U	ATI Desktop Component	ATIPTAXX.EXE	"Installed with the drivers for some ATI based discrete graphics cards and on-board/mobile chipsets. Provides System Tray access to display settings (including desktop resolution
X	ATI Display	ATIDisplay.exe	"Added by the BDOOR-AFH BACKDOOR!"
X	ATI Display Driver	atixd.exe	"Added by the RBOT-FOV WORM!"
X	Ati Display Settings	atividx.exe	"Added by the RBOT-GAS WORM!"
N	ATI GART Set-up Utility	Atigart.exe	"Program that checks the motherboard chipset and determines which GART driver bundle to install on ATI video cards. If you have one
N	ATI Scheduler	Atisched.exe	Component that remains resident in memory and automatically launches the ATI VIDEO PLAYER at a user selected time and date. Delete the shortcut in the Start -> Programs -> Startup folder as well. Functions could re-enable the program to load at start-up and re-introduce the shortcut. Try it and see
N	ATI Task Application	Atitkad.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display
N	ATI Task Application (Atikey)	Atitask.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display
U	ATI Technologies Inc. HydraVision Desktop Manager	HydraDM.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is the HYDRAVISION Desktop Manager - which ""customizes the behaviour of windows and dialog boxes
U	ATI Technologies Inc. HydraVision Viewport	HydraMD.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is HYDRAVISION MultiDesk - which ""creates
X	ATI Technology Startup	techstart.exe	"Added by the RBOT-AEU WORM!"
X	ATI Video Driver Controls	[path to worm]	"Added by the SDBOT-DDS WORM!"
N	ATICCC	CLIStart.exe	Puts the ATI Catalyst™ Control Center Icon/Shortcut on the System Tray - available via Start → Programs
X	AtiDisplayDrv	atidrvxx.exe	"Added by the RBOT-VZ WORM!"
N	Atikey	Atitask.exe	System Tray access and key-combo shortcuts to common display functions on ATI video cards. Can be run from Start -> Settings -> Control Panel -> Display
U	ATISmart	ati2s9ag.exe	"ATI's ""SMARTGART""
U	AtiSound	csrss.exe	"WinSpy surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""ComRoot"" subfolder"
X	atisrc2	windfind.exe	"Added by the WINDFIND-A TROJAN!"
U	AtiTrayTools	atitray.exe	ATI Tray Tools - allows quick access to ATI graphics card settings
X	atiupdate	msshed32.exe	Added by the DELF.EP downloader TROJAN!
U	ATKOSD2	ATKOSD2.exe	"On-screen display utility bundled with laptops from ASUS. If this utility is not installed then you will not be able to properly use other AsusTek utilities such as Splendid and Power Gear"
N	ATnotes	atnotes.exe	Loads the ATnotes program for virtual sticky notes for your desktop. Available via Start -> Programs
U	Atomic Time Synchronizer	TimeSync.exe	"TimeSync - lets you synchronize your computer's clock with any internet atomic clock"
U	AtomSync	atomsync.exe	"AtomSync - ""this NTP client synchronizes your PC clock with an internet atomic time server or with a time server on your LAN"""
U	ATSpooler	AppsTraka.exe	"DeskTopScout keystroke logger/monitoring program - remove unless you installed it yourself!"
U	ATTBroadbandUpdate	SAUpdate.exe	"Big Brother from Quest Software. System and network monitor"
X	AttuneDiscovery	attune_di.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	AttuneSystray	attune_st.exe	"Aveo Attune automated helpdesk software - adware/spyware"
Y	atwtusb	atwtusb.exe	USB interface for Aiptek Graphics Tablet (USB)
X	AUDIO	SOUND.exe	"Added by the PLOYB-A TROJAN!"
X	Audio Device Manager	sfhgj.exe	"Added by the IRCBOT-ZA BACKDOOR!"
N	AudioCommanderVista	AudioCommander.exe	"System Tray access to the AudioCommander user interface for Andrea USB devices - including features such as noise cancellation
X	AudioMan	Explorer.sm1	"Added by the HUPIGON.IFZ BACKDOOR!"
X	audlmne32	dcmsxe.exe	"Added by the MAILBOT-CF TROJAN!"
X	Audoi Device Loader	smssv.exe	"Added by the AGOBOT-ZY WORM!"
X	augmsg	AUGMSG.EXE	"Added by the SPYBOT-CO WORM!"
X	auloadplx	mplprogsm.exe	"Added by the SLAPER.K TROJAN!"
X	AUNPS2	"RUNDLL32 AUNPS2.DLL	_Run@16"
X	aupd	symcsvc.exe	"Added by the ABWIZ.D TROJAN!"
X	aupd	sysvcs.exe	"Added by the ABWIZ.C TROJAN!"
X	aupd	sywsvcs.exe	"Added by the ORSE-M TROJAN!"
Y	Aureal A3D Interactive Audio	sa3dsrv.exe	For Aureal based 3D soundcards. A3D sound features won't work with this disabled
U	Auslogics BoostSpeed	boostspeed.exe	"System Tray access to Auslogics BoostSpeed system optimization utility - which allows you to ""Start programs faster. Speed up computer start time. Increase Internet speed
U	Auslogics BoostSpeed 4	boostspeed.exe	"System Tray access to Auslogics BoostSpeed 4 system optimization utility - which ""Start programs faster. Speed up computer start time. Increase Internet speed
X	ausvc	ausvc.exe	"Added by the AUTOUPDER TROJAN!"
X	Auth Starter Ident	startauth.exe	"Added by the RBOT-WP WORM!"
X	Auto CD-ROM Startup	cdaccess.exe	"Added by the SPYBOT.BLA WORM!"
U	Auto EPSON PictureMate Deluxe on X	E_FATI9TA.EXE	"Epson Status Monitor 3 for the PictureMate Deluxe compact photo printer - for monitoring printer status
U	Auto EPSON Stylus C45 Series on X	E_S4I3T1.EXE	"Epson Status Monitor 3 for the Stylus C45 Series printer - for monitoring printer status
U	Auto EPSON Stylus C48 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C48 Series printer - for monitoring printer status
U	Auto EPSON Stylus C48 Series on X	E_S4I091.EXE	"Epson Status Monitor 3 for the Stylus C48 Series printer - for monitoring printer status
U	Auto EPSON Stylus C60 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C60 Series printer - for monitoring printer status
U	Auto EPSON Stylus C62 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C62 Series printer - for monitoring printer status
U	Auto EPSON Stylus C64 Series on X	E_S4I2C1.EXE	"Epson Status Monitor 3 for the Stylus C64 Series printer - for monitoring printer status
U	Auto EPSON Stylus C82 Series on X	E_S0HIC1.EXE	"Epson Status Monitor 3 for the Stylus C82 Series printer - for monitoring printer status
U	Auto EPSON Stylus C84 Series on X	E_S4I2D1.EXE	"Epson Status Monitor 3 for the Stylus C84 Series printer - for monitoring printer status
U	Auto EPSON Stylus C87 Series on X	E_FATIABL.EXE	"Epson Status Monitor 3 for the Stylus C87 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3200 on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus CX3200 printer - for monitoring printer status
U	Auto EPSON Stylus CX3500 Series on X	E_FATI9 BL.EXE	"Epson Status Monitor 3 for the Stylus CX3500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3600 Series on X	E_FATI9BE.EXE	"Epson Status Monitor 3 for the Stylus CX3600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3700 Series on X	E_FATIACP.EXE	"Epson Status Monitor 3 for the Stylus CX3700 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX3800 Series on X	E_FATIACA.EXE	"Epson Status Monitor 3 for the Stylus CX3800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4200 Series on X	E_FATIAEA.EXE	"Epson Status Monitor 3 for the Stylus CX4200 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4500 Series on X	E_FATI9AP.EXE	"Epson Status Monitor 3 for the Stylus CX4500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4600 Series on X	E_FATI9AA.EXE	"Epson Status Monitor 3 for the Stylus CX4600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX4800 Series on X	E_FATIADA.EXE	"Epson Status Monitor 3 for the Stylus CX4800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX5000 Series on X	E_FATIBVA.EXE	"Epson Status Monitor 3 for the Stylus CX5000 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX5400 on X	E_S4I2G1.EXE	"Epson Status Monitor 3 for the Stylus CX5400 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX5500 Series on X	E_FATICAP.EXE	"Epson Status Monitor 3 for the Stylus CX5500 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6000 Series on X	E_FATIBIA.EXE	"Epson Status Monitor 3 for the Stylus CX6000 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6400 on X	E_S4I2L1.EXE	"Epson Status Monitor 3 for the Stylus CX6400 printer - for monitoring printer status
U	Auto EPSON Stylus CX6600 Series on X	E_FATI9EE.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX6600 Series on X	E_FATI9EA.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX7400 Series on X	E_FATICDA.EXE	"Epson Status Monitor 3 for the Stylus CX7400 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX7800 Series on X	E_FATIAFA.EXE	"Epson Status Monitor 3 for the Stylus CX7800 Series printer - for monitoring printer status
U	Auto EPSON Stylus CX9400Fax Series on X	E_FATICFA.EXE	"Epson Status Monitor 3 for the Stylus CX9400Fax Series printer - for monitoring printer status
U	Auto EPSON Stylus D78 Series on X	E_FATIBGE.EXE	"Epson Status Monitor 3 for the Stylus D78 Series printer - for monitoring printer status
U	Auto EPSON Stylus D88 Series on X	E_FATIABE.EXE	"Epson Status Monitor 3 for the Stylus D88 Series printer - for monitoring printer status
U	Auto EPSON Stylus DX3800 Series on X	E_FATIACE.EXE	"Epson Status Monitor 3 for the Stylus DX3800 Series printer - for monitoring printer status
U	Auto EPSON Stylus DX4800 Series on X	E_FATIADE.EXE	"Epson Status Monitor 3 for the Stylus DX4800 Series printer - for monitoring printer status
U	Auto EPSON Stylus DX6000 Series on X	E_FATIBIE.EXE	"Epson Status Monitor 3 for the Stylus DX6000 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo 1400 Series on X	E_FATIBUA.EXE	"Epson Status Monitor 3 for the Stylus Photo 1400 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo 820 Series on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo 820 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R1800 on X	E_FATI9LA.EXE	"Epson Status Monitor 3 for the Stylus Photo R1800 printer - for monitoring printer status
U	Auto EPSON Stylus Photo R200 Series on X	E_S4I2H1.EXE	"Epson Status Monitor 3 for the Stylus Photo R200 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R200 Series on X	E_S4I0H2.EXE	"Epson Status Monitor 3 for the Stylus Photo R200 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R220 Series on X	E_FATIAIE.EXE	"Epson Status Monitor 3 for the Stylus Photo R220 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R2400 on X	E_FATI9SA.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	Auto EPSON Stylus Photo R2400 on X	E_FATI9SE.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	Auto EPSON Stylus Photo R260 Series on X	E_FATIBNA.EXE	"Epson Status Monitor 3 for the Stylus Photo R260 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R280 Series on X	E_FATICKA.EXE	"Epson Status Monitor 3 for the Stylus Photo R280 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R300 Series on X	E_S4I2F1.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R300 Series on X	E_S4I0F2.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R320 Series on X	E_FATI9FA.EXE	"Epson Status Monitor 3 for the Stylus Photo R320 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R340 Series on X	E_FATIAJE.EXE	"Epson Status Monitor 3 for the Stylus Photo R340 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo R800 on X	E_FATI9YE.EXE	"Epson Status Monitor 3 for the Stylus Photo R800 printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX420 Series on X	E_FATI9CE.EXE	"Epson Status Monitor 3 for the Stylus Photo RX420 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX500 on X	E_S4I2K1.EXE	"Epson Status Monitor 3 for the Stylus Photo RX500 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX600 on X	E_S4I2M1.EXE	"Epson Status Monitor 3 for the Stylus Photo RX600 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX680 Series on X	E_FATICJA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX680 Series printer - for monitoring printer status
U	Auto EPSON Stylus Photo RX700 Series on X	E_FATI9IA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX700 Series printer - for monitoring printer status
U	Auto EPSON Stylus Pro 7600 on X	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Pro 7600 printer - for monitoring printer status
X	Auto File System Conversion Utility	scricon.exe	"Added by the SDBOT.EYB WORM!"
X	auto repair system	qualityx.exe	"Added by an unidentified WORM or TROJAN - probably a SPYBOT variant"
U	Auto Run Software for Photo Frame	PhotoManager.exe	"Management software for Philips digital PhotoFrame range. Used to edit photos and transfer them directly from a PC via a USB cable. Start manually when you connect the device"
X	Auto Scroll Loader	ASCRLL.EXE	"Added by the SPYBOT-T WORM!"
X	Auto Start	dosin.exe	"Added by the SDBOT-GO BACKDOOR!"
X	Auto Start	sndvol32.exe	"Added by the SLINBOT.AX BACKDOOR!"
X	Auto Start	windos.exe	"Added by the SLINBOT.BO BACKDOOR!"
U	Auto Switch	TASKBAR.exe	Related to 2-port Bitronics AutoSwitch kit from Belkin
X	Auto Updat	WindowsSys32.exe	"Added by a variant of the FORBOT WORM!"
X	Auto updat	crcss.exe	"Added by the SDBOT.AAG WORM!"
X	Auto updat	SysDebug.exe	"Added by the FORBOT-BA WORM!"
X	Auto Update	svchost.exe	"Added by the DUMARDI-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Auto Updater	asclt.exe	"Added by the SLINBOT.CJ BACKDOOR!"
X	Auto Updates	svchost.exe	"Added by the CHEUKO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Auto WinUpdate	taskmrg.exe	"Added by the RBOT-AFA WORM!"
X	AutoAdministrator	SERVICES.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Root%\Application Data\WINDOWS"
N	AutoCAD	acstart17.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
N	AutoCAD Startup Accelerator	acstart16.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
N	AutoCAD Startup Accelerator	acstart17.exe	"Preloads part of AutoCAD into disk cache at startup to speed up the launch of the main program when needed. Not required as most AutoCAD users tend to either open the program once and leave it open or open it occasionally to check drawings"
X	AutoDiscovery/AutoPurge (ADAP) Service	wmiadapi.exe	"Added by the RBOT.FLT WORM!"
X	autoload	spooll.exe	"Added by the SILLYFDC WORM!"
X	autoload	windowsupdate.exe	"Added by the POLYCRYP.DY TROJAN!"
X	autoload	spool.exe	"Added by the AGENT-GSG TROJAN!"
X	Autoloaderaproposclient	Apropos_Client_Loader.exe	"AproposMedia adware"
X	Autoloaderaproposclient	cxtpls_loader.exe	"AproposMedia adware"
N	AutoMate Task Service	automate.exe	"Task scheduler for Unisyn Automate 4 task automation/macro running software. Available via a desktop shortcut or Start → Programs"
X	Automated Windows Updates	wauclt.exe	"Added by the GAOBOT.AJD WORM!"
X	Automatic Microsoft Windows Updater	suchost.exe	"Added by the RBOT-EQ WORM!"
X	Automatic Updates	algs.exe	"Added by the IRCBOT-AAM TROJAN!"
X	Automatic Windows Updater	Update.exe	"Added by the GAOBOT.AO WORM!"
N	Automatically launches the United Devices Agent when you start your computer	UD.EXE	The United Devices Agent can recycle your PC's unused resources and use them to perform valuable scientific and medical research without disturbing your usual computer use - similar to SETI@home but for medical research. Available via Start > Programs
X	autoMe	wscript.exe solution.vbs	"Added by the VBS.SASAN WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""solution.vbs"" file is found in %Windir%"
X	autoMe	wscript.exe samok.vbs	"Added by the SAMOK-A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""samok.vbs"" file is located in %Windir%"
X	AutoProtect	AutoProtect.vbs	"Added by the KILLBAT-C WORM!"
X	autorepair	dexs.exe	"Added by a variant of the SDBOT WORM!"
U	Autoroute SMTP	AutoSmtp.exe	"Autoroute SMTP - ""automatic switching between SMTP servers depending on what network you are currently working in."" You need to have two Internet service providers"
X	autorun	sxs.exe	"Added by the SMALLVBS-A WORM!"
X	AutoRun	allrs.exe	"Added by the MUDROP.LJ TROJAN!"
X	AUTORUN_VAL	AntiSpyCheck 2.1.exe	"AntiSpyCheck rogue spyware remover - not recommended
X	AUTORUN_VAL	asc 2.1.exe	"AntiSpyCheck rogue spyware remover - not recommended
?	AutoShutdown	pssvc.exe	"Utility to fix vCard Export in MS Outlook 2000 - although why are these together?"
U	AutoSizer	AUTOSIZER.EXE	"AutoSizer - utility that automatically maximizes windows when they're opened"
N	AutoSpell	autospel.exe	"AutoSpell - spell checker (version 6.*)"
N	AutoSpell 5	ASWATC32.EXE	"AutoSpell - spell checker"
U	AutoSys	autosys.exe	"Winguardian surveillance software. Uninstall this software unless you put it there yourself"
X	autoupdate	"rundll32 SUPDATE.DLL	SHStart"
X	AutoUpdate	smss.exe	"Added by WINSPY.88! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\debug64"
X	Autoupdate Service	kaka.exe	"Added by the SYMPE-B TROJAN!"
X	Autoupdate Service	[path to trojan]	"Added by the AGENT-CB TROJAN!"
X	AutoUpdate32	services.exe	"Added by WINSPY.88! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\debug64"
X	AutoVirusProtection	ciscv.exe	"Added by a variant of the RBOT WORM!"
N	AUXXTRAY	au30setp.exe	System Tray application for Aureal Vortex based soundcards. Can be run manually via Start -> Settings -> Control Panel
X	AV	UPDATE-28062004.exe[25 blank spaces].vbs	"Added by the MIDFIN WORM!"
X	av	expressav.exe	"Express Antivirus 2009 rogue security software - not recommended
X	AV AntiSpyware	ava.exe	"AV AntiSpyware rogue security software - not recommended
X	AV Industry	patch31345.exe	"Added by the MYDOOM.AD WORM!"
X	AV7	antivirus7.exe	"Antivirus7 rogue security software - not recommended
X	AVantivirus	Avconsol.exe	"Added by the MSNVB-D WORM!"
X	avast	troyan.exe	"Added by the SMALL.CZ TROJAN!"
Y	Avast!	ashServ.exe	"Main part of avast! Antivirus - including the resident protection
Y	avast!	ashDisp.exe	"System Tray access to and notifications for avast! Antivirus - giving left-click access to the On-Access Scanner
Y	avast! Antivirus	ashDisp.exe	"System Tray access to and notifications for avast! Antivirus - giving left-click access to the On-Access Scanner
Y	avast! Web Scanner	Ashwebsv.exe	"Web scanning part of avast! Antivirus. Starts via a registry ""Run"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
Y	Avast32	Astart32.exe	"Part of Avast! anti-virus software"
U	AvconsoleEXE	Avconsol.exe	From McAfee VirusScan up to version 4.x and Dr Solomon's VirusScan. Used to schedule regular scans. If you don't have scans scheduled you don't need it
X	AveoAttune	atmdlusr.exe	"Aveo Attune automated helpdesk software - adware/spyware"
U	AVFX Engine	StartFX.exe	"Advanced Video FX - supported by a number of Creative Web Cameras. ""Have more fun by adding a wide range of special effects and backgrounds to your video chat with Advanced Video FX"""
X	AvG	svchost323.exe	"Added by the RBOT-ZA WORM!"
Y	AVG Anti-Spyware	avgas.exe	"System Tray access to and notifications for AVG Anti-Spyware 7.5. This has now been superseded by AVG Anti-Virus which includes Anti-Spyware"
Y	AVG Anti-Virus system	avgcc.exe	"System Tray access to and notifications for the 7.* series of anti-virus products from AVG Technologies. If this entry is disabled
Y	AVG Anti-Virus System	avgemc.exe	"E-mail scanner for the 7.* series of anti-virus products from AVG Technologies. This process scans incoming and outgoing E-mails for viruses and other malware. From version 7.1 onwards this entry only appears in 9x/Me as a startup entry
Y	AVG Anti-Virus System	avgw.exe	"This entry is included with the 7.* series of anti-virus products from AVG Technologies. Once installed (or on first run for a different user) it runs the configuration sequence to set up the product and doesn't run on subsequent restarts"
X	Avg Antivirus	icpldrvx.exe	"Added by the BANKER.BYU TROJAN!"
X	AVG AntiVirus Scanner	avgscnx.exe	"Added by the SILLYFDC.BBE WORM! Note - this is not a legitimate AVG entry"
X	AVG AntiVirus Updater	avgwusv.exe	"Added by the SILLYFDC.BAX WORM! Note - this is not a legitimare AVG entry"
X	AVG Grisoft Updater	updater.exe	"Added by the AGOBOT-OT WORM!"
Y	AVG IDS	AVGIDSUI.exe	"System Tray access to and notifications for AVG Identity Protection - identity theft prevention which is available as a stand-alone product or included with AVG Internet Security. ""Always-on identity theft prevention for Windows from one of the world's most trusted security companies. Shop and ensure safe surfing of the web
U	AVG Internet Security	avgtray.exe	"System Tray access to and notifications for the range of internet security products from AVG Technologies - including Internet Security
Y	AVG7_AMSVR	AVGAMSVR.EXE	"This is the AVG7 Alert Manager for the 7.* series of anti-virus products from AVG Technologies. It is essential for both scheduled activities (such as automatic updates and scans) and for displaying alerts and reports via the Control Center (avgcc.exe). Appears in 9x/Me as a startup entry and as a service in 2K and higher"
Y	avgamsvr.exe	Avgamsvr.exe	"This is the AVG7 Alert Manager for the 7.* series of anti-virus products from AVG Technologies. It is essential for both scheduled activities (such as automatic updates and scans) and for displaying alerts and reports via the Control Center (avgcc.exe). Appears in 9x/Me as a startup entry and as a service in 2K and higher"
Y	avgas	avgas.exe	"System Tray access to and notifications for AVG Anti-Spyware 7.5. This has now been superseded by AVG Anti-Virus which includes Anti-Spyware"
Y	avgfwsrv	AVGFWSRV.EXE	"Integrated firewall for the 7.* series of anti-virus products from AVG Technologies. Protects the users computer from outside attacks
Y	AVGIDS	AVGIDSUI.exe	"System Tray access to and notifications for AVG Identity Protection - identity theft prevention which is available as a stand-alone product or included with AVG Internet Security. ""Always-on identity theft prevention for Windows from one of the world's most trusted security companies. Shop and ensure safe surfing of the web
Y	AVGIDSUI	AVGIDSUI.exe	"System Tray access to and notifications for AVG Identity Protection - identity theft prevention which is available as a stand-alone product or included with AVG Internet Security. ""Always-on identity theft prevention for Windows from one of the world's most trusted security companies. Shop and ensure safe surfing of the web
Y	avgmsvr.exe	avgmsvr.exe	"AVG Anti-Virus 7.0 related"
Y	Avgserv9.exe	Avgserv9.exe	"Background monitoring and scanning for the 6.* (and maybe earlier) series of anti-virus products from AVG Technologies when running on 9x/Me. Loaded from the ""RunServices"" registry key"
X	avidrv	drvsc.exe	"Detected by Kaspersky as the AGENT.PH TROJAN!"
X	Avira Anti-Virus Pro 2008	explorear.exe	Added by an unidentified WORM or TROJAN!
Y	AvMaiSrv	Avmaisrv.exe	"Part of Avast! anti-virus software - E-mail scanner"
X	AVManager	csrss.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
X	avnort	formatsys.exe	"Added by the SERFLOG.A WORM!"
X	avnort	msmbw.exe	"Added by the SERFLOG.A WORM!"
X	avnort	serbw.exe	"Added by the SERFLOG.A WORM!"
X	avp	win*.tmp.exe [* is a number]	Added by a variant of the ALPHABET TROJAN!
X	AVP-SE	avp-32.exe	"Added by the AGOBOT.FS WORM!"
X	avpl	Antivirus.exe	"AntiVirus Plasma rogue security software - not recommended
X	avpms	avpms.exe	"Added by the ONLINEGAMES.CPV TROJAN!"
X	AVPSrv	AVPSrv.exe	"Added by the ONLINE-GEN TROJAN!"
X	avptask	[path to trojan]	"Added by the NOFERE-G TROJAN!"
X	avptask	expl0rer.exe	"Added by the AGENT.JJO TROJAN!"
X	Avptask	rund1132.exe	"Added by the AGENT.PKZ TROJAN!"
X	Avril Lavigne - Muse	[random filename]	"Added by the AVRIL-A WORM!"
X	avrlabs	avrlabs.exe	"VirusResponse Lab 2009 rogue security software - not recommended"
X	avscan	avscan.exe	"Added by the SILLYFDC.BCR WORM! The file is in the users %Temp% directory"
X	AVScan	winav.exe	Unidentfied rogue security software
X	AvScan	avscan.exe	"Antivirus System PRO and Spyware Protect 2009 rogue security software. The file is located in %ProgramFiles%\<rogue name>"
X	avscan	Usbconeted.exe	"Added by the PROVIS-A TROJAN!"
Y	AVSCHED32	AVSched32.exe	"AntiVir® PersonalEdition Classic - antivirus"
Y	AVSchedScan	SCHSC9X.EXE	"Command Antivirus related"
X	AVScheduler	AVSCHSVC.EXE	"Part of the WinAntiVirus Pro 2005 rogue security software when installed in Win98/Me - not recommended
X	AVSeguro	pgs.exe	"AVSeguro
X	AvSer	dsm.exe	"Added by the SERFLOG.B WORM!"
X	AvSer	msmpatch.exe	"Added by the SERFLOG.B WORM!"
X	AvSer	svosm.exe	"Added by the SERFLOG.B WORM!"
X	AvSer	sysup.exe	"Added by the SERFLOG.B WORM!"
X	avserve.exe	avserve.exe	"Added by the SASSER WORM!"
X	avserve2.exe	avserve2.exe	"Added by the SASSER.B or SASSER.C WORMS!"
X	avserve3.exe	avserve3.exe	"Added by the SASSER.G WORM!"
U	AVStation premium	AVStation agent.exe	"Related to Samsung AV Station - instant playback of music
X	AVSTRT	navpsrvc.exe	"Added by the FORBOT-EF WORM!"
X	AVSystemCare	pgs.exe	"AVSystemCare rogue security software - not recommended. There are number of variants in this family sharing the same filename and user interface - see here"
?	AVWLPSTA	AVWLPSTA.exe	"PRISM Status Tray Applet - but what is it for and is it required?"
Y	avx communicator	xcommsur.exe	"Anti-virus part of BitDefender virus scanner/firewall"
?	Avxnews	??	"??"
U	AwaySch	AwaySch.EXE	"Part of the IBM ThinkVantage Productivity Center. ""The Away Manager application allows you preselect and run routine tasks to maintain your system's performance"""
N	awhost32	awhost32.exe	"Part of Symantec's pcAnywhere remote PC management software. Provides an automatic startup of the client PC in host mode in conjuction with a host-definition file
X	Awoa	smmo.exe	"PurityScan adware"
?	AWUSGSTA	AWUSGSTA.exe	"Reportedly related to a USB Wifi Adapter - is it required at startup?"
U	awxDTools	"awxDTools.dll	awxRegisterDll"
U	AXIS Print System DriverScanner	DriverScanner.exe	"Part of AXIS Print System from AXIS Communications - ""adds printer discovery
U	AXIS Print System DriverServer	DriverServer.exe	"Part of AXIS Print System from AXIS Communications - ""adds printer discovery
U	AXIS Print System TrayIcon	TrayIcon.exe	"System Tray access to AXIS Print System from AXIS Communications - ""adds printer discovery
U	AzMixerSel	AzMixerSel.exe	"Related to Realtek_Azalia Mixer Selector"
N	B'sCLiP	BSCLIP.exe	CD recording utility that comes with a lot of CDR/CDRW drives and isn't required
X	b3d	BDEsecureinstall.exe	"B3d Projector foistware - periodically trys to access the internet. (1) Uninstall it via Start -> Settings -> Control Panel -> Add/Remove Programs. (2) Remove the BDEsecureinstall.exe if still present in the ""System"" directory. (3) Disable and ideally delete it from the registry. (4) Remove the ""BDE"" directory and all its contents"
X	b99	msmm.exe	"ClientMan parasite variant"
X	bab	svchst32.exe	"Added by the AGENT.Q TROJAN!"
N	Babylon Translator	Babylon.exe	"""Babylon-Pro is a powerful information tool that instantly provides relevant information
X	Back Updates	Uninstall.log.vbs	"Added by the YPSAN.D WORM!"
X	Background Intelligent Transfer Service	[path] rundll32.exe	"Added by the VB-ZD TROJAN! Note - this is not the legitimate rundll32.exe process
U	BackgroundSwitcher	bgswitch.exe	"Originally included with Microsoft's XP PowerToys (but now withdrawn - see here
U	BackgroundSwitcher	BackgroundSwitcher.exe	"John's Background Switcher (or JBS for short) periodically changes the background image on your computer (like every hour or every day) to something interesting"
U	Backup NOW! Scheduler	Schdlr32.exe	"Scheduled backups for the NTI Backup Now archiving utility. If a backup job has been scheduled
X	Backup One	smbguard.exe	"Added by the SDBOT-MI WORM!"
X	Backup Service	backup.svc	Unidentified adware
X	BackUp Windows 2009	[random].exe	"Added by the AGENT-LUJ TROJAN!"
U	BackupExecScheduler	besch.exe	"Veritas ""Back Up My PC"" software"
N	BacsTray	BacsTray.exe	Broadcom Advanced Control Suite - for modems and set top boxes based upon Broadcom chipsets. Not required unless you have networking problems
X	BagleAV	csrss.exe	"Added by the NETSKY.AB WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Bakra	IEHost.EXE	"Added by the MULTIDR-AH TROJAN!"
X	bal	SYSMONMS.EXE	"Added by the FAKEALERT TROJAN!"
X	bargains	bargains.exe	"BargainBuddy adware"
X	bargains	bargainbuddy.exe	"BargainBuddy adware"
X	BaRloNdDiLhep	services.exe	"Added by the AUTORUN.DIB WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~� subfolder"
?	Bart Station	station.sbrt	"Related to PeoplePC ISP. May be a dialler for dial-up accounts?"
U	Bart Station	PPCOLink.exe	Dialer for PeoplePC ISP
N	bascstray	BascsTray.exe	Broadcom Advanced Control Suite - for modems and set top boxes based upon Broadcom chipsets. Not required unless you have networking problems
X	BastioneAntivirus	pgs.exe	"BastioneAntivirus
X	Bat	secure2.bat	"Added by the ZCREW.C TROJAN!"
X	BatSrv	batserv2.exe	"Detected by Kaspersky as the LOCKSY.M WORM!"
U	Battery Scope	batmgr.exe	Monitors battery levels on a notebook/laptop PC
Y	batterymiser	batterymiser.exe	"Battery Miser power management utility for LG Notebooks"
Y	BatteryMiser 5	BatteryMiser5.exe	"Battery Miser 5 power management utility for LG Notebooks"
X	BatzBack	BatzBack.scr	"Added by the BACKZAT WORM!"
U	BAUSB	BAUSB.exe	"Boston Acoustics Audio
U	Bayden SlickRun	sr.exe	"""SlickRun is a floating command line utility for Windows. It gives you almost instant access to any program or website. SlickRun allows you to create command aliases (known as MagicWords)
U	Bayswap	bayswap.exe	Hot-swappable drive management on Compaq Notebooks which allows you to swap drives without closing down Windows. Only required if you frequently swap bay devices
U	Bayswap2	TbUpdate.exe	Hot-swappable drive management on Compaq Notebooks which allows you to swap drives without closing down Windows. Only required if you frequently swap bay devices
N	BBC Alerts	BBC_Alerts.exe	"BBC Alerts - ""You can now have all the latest news and sports headlines delivered straight to your desktop with the new BBC Alerts service"""
U	BBC News alerts	skinkers.exe	"BBC News Desktop Alerts service - see here. Desktop alert and breaking news e-mail services let you find out about all the latest news as it happens"
N	bbSysTray	bbSysTray.exe	"Philips CD-RW related - ""the 'Blue Button' feature gives users the chance to receive convenient online support for their possible device problems or questions"""
Y	BCMDMMSG	bcmdmmsg.exe	BCM voicemodem driver. Required for dial-up if you have one of these modems
Y	BCMSMMSG	BCMSMMSG.exe	BCM voicemodem driver. Required for dial-up if you have one of these modems
U	BCSSync	BCSSync.exe	"Part of SharePoint Server 2010 which is part of the Microsoft Office 2010 suite. ""Business Connectivity Services (BCS) uses a cache to store a copy of the external data required by the BCS solutions deployed on the Office client. A process called BCSSync.EXE runs on the client and provides automatic cache refresh and data synchronization of the entity instances."" For more information - see here"
X	Bcvsrv32	bcvsrv32.exe	"Added by the GAOBOT.BQJ WORM!"
X	Bcvsrv32	he3.exe	"Added by the AGOBOT.AKB WORM!"
X	Bcvsrv32	msxml22.exe	"Added by the AGOBOT.AKH WORM!"
X	Bcvsrv32	msc32.exe	"Added by the AGOBOT.AKD WORM!"
X	Bcvsrv32	msbvd32.exe	"Added by the AGOBOT-SR WORM!"
X	Bcvsrv32	system2.exe	"Added by the AGOBOT-PU BACKDOOR!"
X	bdfger	gggasw.exe	"Added by the SDBOT-RT WORM!"
Y	BDNewsAgent	bdnagent.exe	"BitDefender antivirus - updater"
Y	BDOESRV	bdoesrv.exe	"Bitdefender 8 antivirus and firewall"
U	BDRegion	brs.exe	"Part of Cyberlink's PowerDVD version 8 - removes the Blu-ray region on a DVD"
Y	BDSwitchAgent	bdswitch.exe	"Bitdefender 8 antivirus and firewall"
N	BearShare	bearshare.exe	"BearShare file sharing client. Versions known to include spyware - see here"
X	Beawver	saqevre.exe	"Added by a variant of the RANKY TROJAN!"
X	BedreigingsMonitoor	pgs.exe	"BedreigingsMonitoor rogue security software - not recommended. A member of the AVSystemCare family"
X	Beegees Update	beegees.exe	"Added by the SDBOT-ADK WORM!"
U	BeFaster	befaster3.exe	"BeFaster internet connection optimization tool"
X	begins	0.exe	"Added by the MYTOB-HE WORM!"
U	beidsystemtray	beidsystemtray.exe	"Related to Belgium Identity Card card reader"
U	Belgacom	sprtcmd.exe /P Belgacom	"Self-help support tool for Belgacom broadband users (provided by SupportSoft
U	Belkin F5D8013 N Wireless Notebook Card Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8013 N Wireless Notebook Card"
U	Belkin F5D8053 N Wireless USB Adapter Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8053 N Wireless USB Adapter"
U	Belkin F5D8073 N Wireless ExpressCard Adapter Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8073 N Wireless ExpressCard Adapter"
U	Belkin Wireless G Notebook Card Client Utility	Belkinwcui.exe	Wireless configuration utility for the Belkin F5D701F Wireless G Notebook Card
U	Belkin Wireless USB Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D7050 Wireless G USB Adapter"
U	Belkin Wireless Utility	Belkinwcui.exe	"Wireless configuration utility for some Belkin cards such as the F5D7000 Wireless G Desktop Card"
U	BellSouthAlertManager.exe	BellSouthAlertManager.exe	"Related to BellSouth Alert Manager"
?	Belsta.exe	Belsta.exe	"Configuration tool for Belkin wireless network cards. Required to change the card's configuration. Is it required for correct operation once the confuiguration is changed?"
X	BeschermingsTool	SysRep.exe	"BeschermingsTool
U	BestCrypt Auto Open	BestCrypt.exe	"BestCrypt from Jetico
X	BestPopUpKiller	BestPopupKiller.exe	"Popup killer by Swanksoft - not recommended
X	BestsellerAntivirus	pgs.exe	"BestsellerAntivirus rogue security software - not recommended
U	BestSync 2008	BestSyncApp.exe	"System Tray access to BestSync® 2008 from Risefly Software - ""a professional utility for synchronizing files between your local folders and Network Drives
X	BeSys	[path to file]	"BeSys adware"
X	beta	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
Y	BGNewsAgent	bgnewsag.exe	"BullGuard antivirus updater"
N	bgsmsnd	bgsmsnd.exe	Printer driver to generate PDF files from any program
U	BI1HelperStartUp	BI1HEL~1.EXE	"ScreenScenes ""Beach Islands"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	BIE	"Rundll32.exe [path] BDSrHook.dll	Rundll32"
N	BigDog303	VM303_STI.EXE	"Vmicro webcam USB utility - allows the webcam to initiate data transfer to a program. Create a shortcut and start it manually when needed"
N	BigDog305	VM305_STI.EXE	"Vmicro webcam USB utility - allows the webcam to initiate data transfer to a program. Create a shortcut and start it manually when needed"
?	BigDogPath	VM_STI.EXE	"Bundled with some software for digital cameras that use a USB connection - what does it do and is it required?"
X	BigfileSearch	BigfileSearch.exe	"BigfileSearch adware. File located in %Program Files%\BigfileSearch"
X	bigoris	bigoris.exe	"Added by the DORF-AZ TROJAN!"
Y	BigPondWirelessBroadbandCM	BigPond_CM.exe	"Related to BigPond_Wireless_Broadband Service by Telstra"
X	BillGatesLoh.exe	BillGatesLoh.exe	"Added by the AGENT-FZO TROJAN!"
X	bin32hpu	ppstub.exe	"PrecisionPop adware"
N	Bing Bar	mswinext.exe	"Bing Bar - the latest incarnation of the MSN Toolbar from version 5.* onwards. This entry loads the toolbar into memory at start-up before you open your internet browser. Not required - it will load with the browser and remains in memory after the browser is closed"
X	bingdian	Bingdian.vbs	"Added by the BINGD WORM!"
?	Bingo Charm	charms.exe	"Some kind of screen icon kind of like desk flag
U	Biomenu	menusw.exe	"Related to Sony VAIO - passwords
X	Bios	Bios32.exe	"Added by an unidentified VIRUS
X	bios	bios.exe	"Added by the BANCBAN-PW TROJAN!"
X	BIOS XP Loader	[random filename]	"Added by the RBOT-IC WORM!"
X	BIOS1	BIOS1.EXE	"Added by the OPASERV.T WORM!"
?	BisonHK	BisonHK.exe	"Related to a Bison webcam - which is used on notebooks from a number of manufacturers including Acer
Y	BisonInst0402	BR040286.exe	"Driver for integrated notebook webcams from Bison Electronics Inc - such as the Acer Crystal Eye"
Y	BitDefender 2009	IEShow.exe	"Anti-phishing component of BitDefender internet security products. Anti-phishing prevents sensitive data such as usernames
Y	BitDefender Antiphishing Helper	IEShow.exe	"Anti-phishing component of BitDefender internet security products. Anti-phishing prevents sensitive data such as usernames
X	BitDefender Antivirus	BITDEFENDERX.EXE	"Added by a variant of the SPYBOT WORM!"
Y	BitDefender Communicator	xcommsvr.exe	"BitDefender antivirus"
U	BitDefender for MSN Messenger	msnmon.exe	"Bitdefender anti-virus for MSN Messenger - no longer supported at the BitDefender website"
U	BitDefender for Yahoo! Messenger	yahmon.exe	"Bitdefender anti-virus for Yahoo! Messenger - no longer supported at the BitDefender website"
Y	BitDefender Scan Server	bdss.exe	"BitDefender antivirus"
Y	BitDefender Virus Shield	vsserv.exe	"BitDefender antivirus"
U	BitDefender_P2P_Startup	BitDefender_P2P_Startup.exe	"Bitdefender anti-virus for P2P clients - no longer supported at the BitDefender website"
N	BJ Printer Status Monitor	Cjstsr.exe	Canon BJ printer status monitor
N	BJ Status Monitor 5xx	CJSTRxx.EXE	Canon printer status monitor - where "xx" is different depending upon the version. Not required as you can check the printer status via My Computer -> Printers
U	blads	blads.exe	"A Tweak-XP component
X	blah service	winupdate.exe	"Added by the GAOBOT.BIA WORM!"
X	blah service	winsysengine.exe	"Added by the RBOT-KI WORM!"
X	blah service	internet.exe	"Added by a variant of the RBOT WORM!"
X	blah service	smnp.exe	"Added by the RBOT.IZ WORM!"
X	blah service	msnmsgrr.exe	"Added by the RBOT.PZ WORM!"
X	blah service	tazkmgr.exe	"Added by the RBOT.UA WORM!"
X	blah service	FaLeH.exe	"Added by the RBOT-AES WORM!"
X	blah service	microsoft.exe	"Added by a variant of the RBOT WORM!"
X	blah service	evosys.exe	"Added by a variant of the RBOT WORM!"
X	blah service	win32.exe	"Added by the RBOT-AXO WORM!"
X	Blah service	CCAPPS32.EXE	"Added by the RBOT.TV WORM!"
X	blah services	iczw.exe	"Added by the RBOT-GMP WORM!"
X	blahh service	msengine.exe	"Added by a variant of the RBOT WORM!"
X	blahx service	msnjompa.exe	"Added by the SDBOT.AML WORM!"
X	Blank AntiViri	AUT0EXEC.BAT StartUp	"Added by the BRONTOK-CJ WORM!"
?	BlazeServoTool	MediaDetector.exe	"Related to BlazeDVD from BlazeVideo - which ""is leading powerful and easy-to-use DVD player software."" What does it do and is it required?"
X	BLMessagingIntegration	blengine.exe	"BuddyLinks adware"
U	BlockAds	blads.exe	"A Tweak-XP component
X	BlockDefense	BlockDefense.exe	"BlockDefense rogue security software - not recommended
X	Blocker System611 Monitoring	PopUpBlocker611.exe	"Added by the RBOT.BLJ WORM!"
X	BlockScanner	BlockScanner.exe	"BlockScanner rogue security software - not recommended. A member of the WiniGuard family"
U	blsloader	blsloader.exe	"BellSouth ISP Internet Tools"
X	blss	blss.exe	"Added by the BLARUL TROJAN!"
N	BLSTAPP	blstapp.exe	Puts access to Creative's BlasterControl in the System Tray
N	Blubster	Blubster.exe	"Related to Blubster Music sharing service"
X	Blue Service	[path to trojan]	"Added by the BANCOS-BCW TROJAN!"
U	BlueSoleil	BLUESO~1.EXE	"BlueSoleil Bluetooth wireless manager from IVT Corporation"
U	BlueSpace NE	BlueSpaceNE.exe	"""BlueSpace NE is a utility program used to run the Bluetooth function on VAIO computers that support the Bluetooth function or on VAIO computers connected to the Bluetooth USB adapter"". Shortcut available via Start -> Programs"
U	Bluetooth Connection Assistant	LBTWiz.exe	"Bluetooth connection manager for Logitech based bluetooth wireless products"
U	BluetoothAuthenticationAgent	"rundll32.exe irprops.cpl
U	BluetoothAuthenticationAgent	"rundll32.exe bthprops.cpl
U	blueyonder Instant Support Tool	matcli.exe	"Blueyonder Instant Support Tool. ""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	BMail Installation	FTP_back.exe	"Part of iMesh - a file sharing system. Reported by Norton AntiVirus as a trojan. Once deleted does not prevent file sharing working. Older versions of iMesh re-instate this but the newer versions do not"
X	BMN	strpmon.exe	"Part of CleanPCTool
U	BMO MasterCard Wallet	EWALLET.EXE	"The wallet conveniently stores billing
U	BO1HelperStartUp	BO1HEL~1.EXE	"ScreenScenes ""Butterfly Oasis"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	BO1HelperStartUp	Bo1helper.exe	"ScreenScenes ""Butterfly Oasis"" screensaver. The freeware version comes with GAIN branded ads (pop-ups and others). ScreenScenes do however offer you the option of doing away with the ads by purchasing the screensaver for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	Boarddata	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are often located in %System%"
X	boby	csrs.scr	"Added by the BANCBAN-PC TROJAN!"
X	boby	netburn.scr	"Added by the BANCBAN-OX TROJAN!"
X	boby.	Isass.scr	"Added by the BANCBAN-OH TROJAN!"
Y	BOCleanautostart	Boclean.exe	"NSClean's BOClean anti-trojan software"
U	Boingo Wireless Utility	Icon###XXX#X#.exe	"Starts the Boingo Wireless utility
X	boler.exe	syser.exe	"Added by the RBOT-AYS WORM!"
U	bombshel	BOMB32.EXE	Part of McAfee Nuts & Bolts. Protects your Windows system from application failure and crashes - similar to Norton Crashguard. Your choice - may cause problems
X	BONZI Task Switcher	Taskswitch.exe	"Added by the SPYBOT.DTR WORM!"
X	BookedSpace	"RunDLL32.EXE bs2.dll	DllRun"
N	BookMarkSink	syncit.exe	Bookmark synchronization utility
N	BookMarkSync	syncit.exe	"Sync2IT BookMarkSync - ""real-time automatic synchronization service that allows you to access your bookmarks
N	BookMarkSync2It	sync2it.exe	"Sync2IT BookMarkSync - ""real-time automatic synchronization service that allows you to access your bookmarks
U	Boost XP Service	bxservice.exe	"Boost XP from Systweak - WinXP tweaking utility"
U	BoostSpeed	boostspeed.exe	"System Tray access to Auslogics BoostSpeed 4 system optimization utility - which ""Start programs faster. Speed up computer start time. Increase Internet speed
X	Boot Server	bootserver.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Boot Service	bootservice.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Boot Service	bootsv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	BootCfg	Install.log.vbs	"Added by the YPSAN.D WORM!"
X	BootClean	smartdrv.exe	"Added by the LURKA-A VIRUS!"
X	BootLoader	BootLoader.exe.vbs	"Added by the WATERWORKS WORM!"
?	Boots Insert Detect	InsDetect.exe	"Part of Boots Picture Suite. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
X	BootsCfg	wscript.exe [path] Date.POP.vbs	"Added by the KUULLIO WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbs	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbe	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe Install.log.vbs	"Added by the YPSAN.E WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""Install.log.vbs"" file is located in %System%"
X	bootsec	NAVSSE.exe	"Added by the FORBOT-CY WORM!"
Y	BootSkin Startup Jobs	BootSkin.exe	"Stardock BootSkin is a program that allows users to change their Windows 2000 and Windows XP boot screens"
U	BootStatus	BOOTST~1.EXE	"Visual Basic program that pops up a small window on startup telling you how many times the machine has been booted that day. Once you exit it
X	boot_reg	svchot.exe	"Added by the BANCBAN-BQ TROJAN!"
X	BortMedVirus	pgs.exe	"BortMedVirus rogue security software - not recommended. A member of the AVSystemCare family"
N	Bose Wave/PC Monitor	wavepcmonitor.exe	"System Tray access for this system (more info on the system here). Available via Start -> Programs"
X	BossIdea	winlogin.exe	"Added by the LINEAGE-I TROJAN!"
?	Boston	Boston.exe	"Part of the Boston Acoustics USB speaker systems. What does it do and is it required?"
X	Bot Loader	svchostt.exe	"Added by the GAOBOT.ALV WORM!"
X	Bouncer RunStartup	bouncer.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
X	Bouncer RunStartup	LiveUpdate.exe	"Virtual Bouncer - malware from Spyware Labs. It is distributed by the same bundling and drive-by download techniques as the parasites it claims to remove
X	boy lovers of bsd	ilikeboys.exe	"Added by the MYTOB.LY WORM!"
U	bpcpost.exe	bpcpost.exe	MS TV Viewer Post Setup Program. Part of MS WebTV for Windows. Used to display TV on your PC via a compatible video card with in-built tuner (such as ATI All-In-Wonder). If you don't use it - uninstall it
X	BPCv2 re	bpc2 re inst.exe	"BroadcastPC adware variant"
N	BPServer	G6FTPSrv.exe	"BulletProof FTP Server"
X	Brasil	Brasil.exe	"Added by the OPASERV.E WORM!"
X	Brasil	BRASIL.PIF	"Added by the OPASERV.E WORM!"
X	BrasilOld	[worm filename]	"Added by the OPASERV.P WORM!"
X	brastk	brastk.exe	"Added by the DORF-BV TROJAN!"
X	Brave-Sentry	BraveSentry.exe	"BraveSentry rogue security software - not recommended
X	BraveSentry	BraveSentry.exe	"BraveSentry rogue security software - not recommended
Y	Bredbandsbolaget	servicecenter.exe	"Related to the Brebband Swedish Broadband provider"
Y	Brindys BriTray	BRITRAY.EXE	"Main process for the following applications: GEDEX
U	Broadcom Wireless Manager UI	bcmntray.exe	"Related to Broadcom Network Adapters for additional configuration options for these devices. Should not be terminated unless suspected to be causing problems"
N	Broadcom Wireless Manager UI	wltray.exe	System tray access to wireless LAN card configuration options
X	Bron-Spizaetus	CVT.exe	"Added by the RONTOKBRO WORM!"
X	Bron-Spizaetus	norBtok.exe	"Added by the RONTOKBRO.B WORM!"
X	Bron-Spizaetus	[path to file]	"Added by the BRONTOK-F WORM!"
X	Bron-Spizaetus	bronstab.exe	"Added by the RONTOKBRO.C WORM!"
X	Bron-Spizaetus	eksplorasi.exe	"Added by the RONTOKBRO.J WORM!"
X	Bron-Spizaetus	ElnorB.exe	"Added by the RONTOKBRO.D WORM!"
X	Bron-Spizaetus	sempalong.exe	"Added by the BRONTOK-E WORM!"
X	Bron-Spizaetus	RakyatKelaparan.exe	"Added by the BRONTOK-J or BRONTOK-L WORMS!"
X	Bron-Spizaetus-5118REPM	komodo-6321422.exe	"Added by the BRONTOK-R WORM!"
X	Bron-Spizaetus-cfgmktoq	bbm-qotkmgfc.exe	"Added by the BRONTOK-M WORM!"
X	Bron-Spizaetus-cfgmmnru	bbm-urnmmgfc.exe	"Added by the BRONTOK-N WORM!"
X	BrowseProxy	FindService.exe	"Actual Names (AdvSearch) Internet Keywords parasite"
X	browser	msgaol.exe	"Added by the TACTSLAY.C TROJAN!"
X	browser	s_menu.exe	"Added by the TACTSLAY.C TROJAN!"
X	browser	browse.exe	"Added by the TACTSLAY.C TROJAN!"
X	browser	deamon.exe	"Added by the TACTSLAY.C TROJAN!"
X	browser aid	browseraid.exe	"BrowserAid/BrowserPal foistware"
X	Browser Help Svc	BHSV.EXE	"Added by the RBOT-AVQ WORM!"
Y	Browser Hijack Blaster	bhblaster.exe	"Browser Hijack Blaster - protects your system from browser hijackers and spyware that alters your IE settings. Now replaced by SpywareGuard"
U	Browser Launcher	Commandr.exe	Logitech internet keyboard "Commander" software - loads the software for the shortcut keys on the keyboard. Not required unless you want to use the short cut keys
X	Browser Pal	adblck.exe	"BrowserAid/BrowserPal foistware"
U	Browser Sentinel	BrowserSentinel.exe	"Browser Sentinel - notifies you if a program wants to penetrate into Internet explorer
X	BrowserUpdateSched	[random filename]	"ZenoSearch adware"
N	BrowserWebCheck	loadwc.exe	Checks to make sure that IE is still your default browser
X	BS Mediaplayer	bsplyr.exe	"Added by the RBOT-OU WORM!"
N	BS Player	bsplayer.exe	"BSplayer - A video player used to play avi
N	BsCLiP	BSCLIP.exe	CD recording utility that comes with a lot of CDR/CDRW drives and isn't required
?	BsMnt	BsMnt.exe	"Related to a Bison webcam - which is used on notebooks from a number of manufacturers including Acer
X	Bsoft lppt01	Bsoft.exe	"RapidBlaster variant (in a ""BelmontSoft"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
N	bsplayer	bsplayer.exe	"BSplayer - a video player used to play avi
X	BsRte	MemoteXZZ.exe	"Added by the AUTORUN-AJU WORM!"
X	BSserver	FileKan.exe	"Added by the VB.CBW WORM!"
X	BSVCHOST	SVCH0ST.EXE	"Added by the VOXOM TROJAN! Notice the digit ""0"" in the filename rather than the upper case ""o"""
X	Bsx3	"RunDLL32.EXE bs3.dll	DllRun"
U	BT Broadband Basic Help	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	BT Broadband Desktop Help	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
U	BtcMaestro	KMaestro.exe	Multimedia keyboard manager. Required if you use the multimedia keys
?	btinst	btinst.exe	"Associated with an Anycom bluetooth wireless card. What does it do and is it required?"
X	btmsre.exe	btmsre.exe	"Added by the SDBOT.AM WORM!"
?	BTSETBOOTKEY	BTSetBootKey.exe	"Related to a USB Bluetooth adaptor. What does it do and is it required?"
U	BtStart	btstart.exe	"Broadcom (formerly WIDCOMM) Bluetooth Connectivity Software"
Y	BTUSRBDG	BtUsrBdg.exe	"Used with a Mitsumi USB Bluetooth adaptor (and maybe others)"
Y	BTUSRBDGF	BtUsrBdg.exe	"Used with a Mitsumi USB Bluetooth adaptor (and maybe others)"
N	BudgetSip	BudgetSip.exe	"BudgetSip - internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
U	BUFFALO Power Save Utility for HD	HDManage.exe	"Power Save utility for Buffalo backup hard discs"
X	BugsDestroyer	SysRep.exe	"BugsDestroyer rogue system error and cleaning utility - not recommended
U	bugwatcher service	bugwatcher.exe	"
X	BuildLab	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
X	BuildLabs	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	BuildLabs	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
U	Bulldog Service	upsd.exe	Belkin's Bulldog Plus control software which runs under Windows 95 or later and monitors the UPS (Uninterrupted Power Supply) via a serial or USB link
N	BulletProof FTP Server	bpftpserver.exe	"BulletProof FTP Server"
Y	BullGuard XComm	XCOMMSVR.EXE	"Part of Bullguard antivirus"
X	BullsEye	bargains.exe	"BargainBuddy adware"
X	BullsEye Network	bargains.exe	"BargainBuddy adware"
?	BullsEye Tracker	BeTrack.exe	Bullseye - intelligent research assistant
X	buohxqtfswb	gcjydr.exe	"Added by the AGENT-NRC TROJAN!"
X	buritos	buritos.exe	Identified as a variant of the Downloader.FraudLoad.C malware
U	Button Server	bttnserv.exe	"Found on a Compaq PC
X	BVWORSFM	bvworsfm.exe	"Added by the DLUCA-AD TROJAN!"
X	Bwddwss	[path to trojan]	"Added by the RANKY.BD TROJAN!"
X	bxsx5	"RunDLL32.EXE bsx5.dll	DllRun"
X	bxxs5	"RunDLL32.EXE bxxs5.dll	dllrun"
X	Bymer.Scanner	Wininit.exe	"Added by the BYMER WORM!"
X	Bymer.Scanner	Msinit.exe	"Added by the BYMER WORM!"
U	BySoft FreeRAM	FreeRAM.exe	"""Bysoft FreeRAM is a program that frees up ram manually or automatically. It shows current memory status
U	c32cs2	c32cs2.exe	"Cyber Sentinel - internet filtering software"
U	C:Program Filesdfjdkjfdkjfldjfdfjdkjfdkjfldjfwinlogin.exe	CritProc.exe	"KeyProwler keystroke logger/monitoring program - remove unless you installed it yourself!"
U	C:Program FilesNetMeterNetMeter.exe	NetMeter.exe	"""Net Meter is a small
X	C:WINDOWSasam.exe	asam.exe	"Added by the PEACOMM.E TROJAN!"
X	C:WINDOWSIEXPLOR.EXE	IEXPLOR.EXE	"""Pop Marketing"" adware"
X	C:WINDOWSsystem32SetupCmd.exe	SetupCmd.exe	"Detected by Kaspersky as the AGENT.AAW TROJAN!"
X	C:WINDOWSWinTask.exe	WinTask.exe	"""Pop Marketing"" adware"
X	CABCInstall	CABCInstall.exe	"Ignite Technologies (was CABC) content delivery software"
X	Cable Modem Adapter	WindowsSec.exe	"Added by the WOOTBOT.A WORM!"
U	CacheBoost	trayicon.exe	"CacheBoost ""optimizes the System Cache-Management of Windows XP/2000/NT and Windows .Net Servers
U	CacheSentry Pro	CacheSentry Pro.exe	"""CacheSentry Pro is a program that takes over the management of the Internet Explorer (and AOL) web browser cache"""
N	CACStarter	cacstart.exe	Cash A Check - check writing software
U	Caddais BackupOnDemand	BODMon.exe	"Caddais BackupOnDemand - "runs in the background and monitors your important files for changes. Within seconds of changing
U	Cadenza	CdzSvc.exe	"Cadenza mNotes for Palm and Pocket PC enables users to access Lotus Notes on their mobile devices"
U	CADS	cads.exe	"Cyber Sentinel - internet filtering software"
U	CafeStation	CafeStation.exe	"""CafeSuite is the solution for your internet cafe. Our software provides you with ameans to control the workstations
X	caidiysetup	diynetsetupuni.exe	"DIYNet adware"
Y	CAISafe	isafe.exe	"Part of Computer Associates eTrust EZ Antivirus"
U	CaISSDT	caissdt.exe	"Computer Associates Dashboard Tray applet"
N	Cal Reminder Shortcut	calrem.exe	Produces a pop-up reminder of events scheduled using the MS Office Calendar
X	calc	"rundll32.exe [path] ntuser.dll	_IWMPEvents@0"
X	Calc Microsoft Windows	wincalc.exe	Added by an unidentified WORM or TROJAN!
U	Calendarscope	cs.exe	"Calendarscope calendar software"
X	Call Function System32	sddriver.exe	"Added by a variant of the SDBOT TROJAN!"
U	Camera Assistant Software	traybar.exe	Camera Assistant Software utility for Toshiba laptops - allows you to take pictures with and control the integrated WebCam
U	CameraAssistant	CameraAssistant.exe	"Entry added when you install versions of the Logitech QuickCam webcam software and used to configure and tweak your webcam settings. Includes support for the Quick Assistant - which launches when a video application (such as video conferencing in an instant messaging client) accesses to camera so you can quickly fine tune face tracking and zoom
U	Canary	canary-std.exe	"Canary keystroke logger/monitoring program - remove unless you installed it yourself!"
X	candynet	Taskmsg.exe	"Added by the RBOT-NA WORM!"
U	Canon MultiPASS Status Monitor	monitr32.exe	Cannon Multi-Pass status monitor - your choice
?	Canon PC1200 iC D600 iR1200G Status Window	CAPM1LAK.EXE	"Cannon printer related - is it required in startup?"
N	Canon Printer Monitor BJCxxx	Cjstlst.exe	Trayicon for Canon printer. xxx denotes model. Available via Start -> Programs
U	CanonSolutionMenu	CNSLMAIN.exe	"
Y	capfasem	capfasem.exe	"CA Personal Firewall - part of the CA Internet Security Suite"
X	CaptionMgr32	crssr.exe	"Added by the ZAR.A WORM!"
N	Capture Express 2000	capexp.exe	"Capture Express - screen capture utility"
U	CaptureAssistant	CaptureAssistant.exe	"Capture Assistant ""is a convenient and easy-to-use text and graphics capture tool"". It allows you to capture text
?	CardScan AutoSync	CSyncCfg.exe	"Related to the CardScan business card reader range of products. May be related to synchronization with E-mail software and mobile devices (see here)?"
U	carpserv	carpserv.exe	"Associated with Zoltrix and Conexant modems - enables the internal modem speaker
X	CARPserver	CARPserver.exe	"Added by the BANKER-AN TROJAN!"
U	CARPservice	carpserv.exe	"Associated with Zoltrix and Conexant modems - enables the internal modem speaker
X	CAS Client	casclient.exe	"CasinoClient adware"
X	Cas2Stub	cas2stub.exe	"CasinoClient adware"
U	CasAgnt	CasAgnt.exe	Program by Extended Systems which allows you to sync your Casio PDA with your PC
X	Casdvqwa	bmqnzkg.exe	"Added by the RANDEX.BE WORM!"
X	caseyvideo	caseyvideo.exe	Malware causing adult content popups
X	caseyvideo[*] [* = digit]	caseyvideo[*].exe [* = digit]	Malware causing adult content popups
X	CashBack	cashback.exe	"Part of eXact Advertising Software
X	CashFiesta	Cashfiesta.exe	"CASHFIESTA.A pay-per-surf adware"
N	Cashsurfers Cashbar Navigator	Cashbar.Exe	"Cashsurfers CashBar Navigator - ""The CashBar rotates banner advertisements once per minute and provides you with access to up to date special offers and deals"""
X	CashToolbar	MSCStat.exe	"Added by the DOWNLOADER-MY TROJAN!"
X	CashToolbar	svchost.exe	"BrowserAid/CashToolbar adware! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Casino Royale	jamesbond.exe	"Added by the RBOT-FZO WORM!"
X	Cassandra	[10 to 14 random char]THD.EXE	"Added by the KREPPER-AI TROJAN!"
X	Cassandra	cassandra.exe	"SuperSpider hijacker - a CoolWebSearch parasite variant. Also detected as a variant of the KREPPER TROJAN!"
X	CasStub	casstub.exe	"Added by the CASS-A TROJAN!"
X	Catalyst Control Centre	atixvdm.exe	"Added by the RBOT.DMW TROJAN!"
X	catsrv	catsrv.exe	"Added by the PAPLOK TROJAN!"
Y	CAVS	CAVS.exe	"Cheyenne (now eTrust) antivirus"
X	CAZNOVAS	CAZNOVAS.exe	"Added by the CAZNO TROJAN!"
X	cbvcs	urretnd.exe	"Added by the FRETHOG-C WORM!"
U	CBWHost	CBWHost.exe	"Required for Bitware to answer incoming faxes
?	CBWUser	CBWDial.exe	"Associated with Bitware that integrates fax
X	ccApp	gcasServ.exe	"Added by a variant of the RBOT WORM! Do not confuse with the Microsoft AntiSpyware executable of the same name"
X	ccAppr	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccAppr	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccApps	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
X	ccApps	winlogon.exe	"Added by the NEVEG.A WORM! Note - this is not the legitimate winlogon.exe process
X	ccApps	N/A	"Added by the KANGAROO-A TROJAN!"
X	ccApps	ccApps.exe	"Added by the KANGAROO-B WORM!"
X	ccctp	HistoryJMTi.exe	"Added by the GANBATE.A WORM!"
U	CCD Manager	DDS.EXE	"Project Labs Century CD manager for their CD/DVD storage device"
N	Ccdecode	"rundll32.exe streamci	StreamingDeviceSetup"
Y	CCDoctorLogonTesting	ccdoctor.exe	"Checks your system to make sure it's configured properly for running IBM Rational ClearCase
X	ccpApps	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
X	ccpApps	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
Y	CcPxySvc	CCPXYSVC.exe	"Part of Norton's AntiVirus 2003
X	ccRegVfY	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccRegVfY	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccrss	msdtc.exe	"Added by the STAP-C WORM!"
Y	ccSetMgr	ccSetMgr.exe	"Part of Norton AntiVirus 2004. What does it do?"
X	ccStart	ccStart.exe	"Added by the AGOBOT-IR WORM!"
X	ccStart	ccInfo.exe	"Added by the AGOBOT-GQ BACKDOOR!"
X	ccSvcHst.exe	ccSvcHst.exe	"Added by the SDBOT-DIW WORM!"
X	ccsvit.exe	ccsvit.exe	"Added by the STARTPA-HP TROJAN!"
U	ccWasher	aolwasher.exe	"Webroot Cache & Cookie Washer - cleaning browser tracks
U	CCWC7s	stealth.exe	"Moleculesoft Cache
N	CD Storage Master	cdstorager.exe	"CD Storage Master - a program designed to catalog CD information
N	CDANTSRV	CDANTSRV.exe	"C-Dilla License Management software. Used for any program that uses C-dilla Protection
U	CDLoader	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
X	cdmmslpo	klpllsm.exe	"Added by the TEDIJINI-A TROJAN!"
X	cdoosoft	herss.exe	"Added by the SILLYFDC.BCT WORM!"
X	cdoosoft	olhrwef.exe	"Added by the AUTORUN-AAG WORM!"
X	CDriver	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
X	cds	cds.exe	"Added by the SPYMON TROJAN!"
X	CDSpeed.exe	CDSpeed.exe	"Added by the IRCBOT.AEX BACKDOOR!"
X	CentralProcessor	taskimgr.exe	"Added by the BANCOS.J TROJAN!"
?	CEPA	wsot.exe	"??"
U	CertificateRegistration	SafeSignCertReg.exe	SafeSign Certificate Registration Utility for Microsoft Crypto applications
Y	CertStoreInit	CertStoreInit	"Aladdin eToken authentication and password management"
N	CesarFTP FTP Server	server.exe	"CesarFTPd - FTP server"
X	cesmain.dll	"Rundll32.exe [path] cmail.dll	Rundll32"
X	CFDStart	WinMuschi.exe	"WINMUSCHI dialler"
X	cfgboost	cfgboot.exe	Added by an unidentified WORM or TROJAN!
U	CFi ShellToys Utility Manager	CFiShlMan.exe	"Manager for CFi ShellToys from Cool Focus International Ltd - which ""puts all the tools you need right where you need them - just a click away on your context menu. Right-click one or more files or folders
?	cFosDNT	cFosDNT.exe	"cFos DSL Modem driver related. What does it do and is it required?"
?	cFosInst_Check	cfosinst.exe	"cFos DSL Modem driver related. What does it do and is it required?"
U	cFosSpeed	cFosSpeed.exe	"cFos Software Internet acceleration program related. Note - may be necessary for the software to work properly"
U	CFSServ.exe	CFSServ.exe	Belongs to Toshiba's configfree utility and searches for Wireless Devices
X	cftmon	sfcmonit.exe	Added by a variant of the AGENT.ERG TROJAN!
X	cftmon	WindowsUpdate.exe	"Added by the AGENT.AQK BACKDOOR!"
X	cftmon32	taskmgr*.exe [* = number]	"Added by the SOWSAT.C and SOWSAT.J WORMS!"
X	CGI Firewall Script	CGIAGENT.EXE	"Added by the BROPIA-U WORM!"
U	CGServer	cgserver.exe	"Associated with an Eicon Networks ISDN or ADSL modem. Call Guard Server (CGserver) watches your modem and blocks incoming or outgoing calls. You need cgard.exe (from Startmenu) to configure cgserver with rules and telephone numbers. Good against unwanted dialer programs"
X	Cgtask Services	cgtask.exe	"Added by the LALA.B TROJAN!"
X	change-me-now	msgfix1.exe	"Added by the SDBOT.ZD WORM!"
U	ChangeICON	SPMSMON.EXE	Card reader related program. Note - may cause problems with My Computer loading at startup. Disabling through MsConfig seems to solve the problem
?	ChangeLines	chngline.exe	"??"
X	ChansonsMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
Y	Charter High-Speed Security Suite	fspex.exe	"Charter High-Speed Security Suite - security software in collaboration with F-Secure"
U	ChatStat	ChatStat.exe	"ChatStat from ChatStat Technologies
X	che32	che.ocx.vbs	"Added by the ADENU-B VIRUS!"
U	cheatmonitor	start.exe	"CheatMonitor surveillance software. Uninstall this software unless you put it there yourself"
N	Check for One Touch Update	wiseupdt.exe	Checks for updates for Visioneer OneTouch scanners
N	Check for TWS Updates	WiseUpdt.exe	Interactive Brokers - check for update to their standalone Java-based trading platform
U	Check Messenger	cmesseng.exe	Check Messenger from Qchex.com - program that helps you manage the activity of your Qchex account. Qchex appear to be no longer in buisness
N	CheckCustomWorksUpdate	CheckCWupdate.exe	"Update checker
X	Checkdisk	mscas.exe	"Added by the VAGON-A TROJAN!"
X	CheckFaultKernel	mswdm.exe	"Added by the SMALL-CSK TROJAN!"
Y	CheckMsgPlus	"MsgPlusH.dll	VerifyInstallation"
X	checkrun	elitelsj32.exe	"Added by the MULTIDR-ER TROJAN!"
X	CheckScan32	regload16.exe	"Added by the AEBOT.K WORM!"
U	ChicoSys	webtmr.exe	"Child Control parental control software"
X	china11msn	CHINA11MSN.EXE	"Added by the ENVID.O WORM!"
X	Chinagnq	vasdd.exe	"Added by the SDBOT-SE WORM!"
U	ChineseStar	cstar.exe	Chinese language support software
U	CHIPDRIVEPinManager	sokscmpn.exe	"ChipDrive Smartcard software"
U	CHIPDRIVESmartcardManager	SCMgr.exe	"ChipDrive Smartcard software"
X	CHK Disker	chkdsker.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	ChkDisk	chk_disk.exe	Added by an unidentified WORM or TROJAN!
X	chkdsk	autoexec.bat	"Added by the ANPES WORM!"
X	chostsv	chostsv.exe	"Added by the BANPAES.C TROJAN!"
N	Christmas Music Player	TTEST6.EXE	"Christmas Music Player brings the music of the Christmas Holiday to your desktop"
?	ChromeMark	keysh.exe	"Related to this. Don't know what keysh.exe does though and if it's required"
X	Ci Servs	SysTuwin.exe	"Added by the AGENT-NIQ TROJAN!"
X	Ci Svr	cisvr.exe	"Added by the IRCBOT.AWN BACKDOOR!"
X	CiaBackdoor	msldr.com	Added by a VIRUS!
X	cihost.exe	cihost.exe	"Added by the LINST TROJAN!"
N	CIJxP2PSERVER	CIJxP2PS.EXE	"Compaq printer utility which is required in order to make the printer work correctly - "x" depends upon the model
X	CirebonPunya	XXrocks.exe	"Added by the BHARAT.A WORM!"
X	Cisco Systems	[path to worm]	"Added by the AUTORUN.UHR WORM!"
U	Cisco Systems VPN Client	ipsecdialer.exe	"Cisco VPN Client - lets local users gain Administrator privileges on the operating system"
U	Cisco Systems VPN Client	vpngui.exe	"Sets up IPSec communications for Cisco's VPN Client"
N	CISrvr Program	CISRVR.EXE	Related to internet setup on Compaq PC's
X	Cissi	Cissi.exe	"Added by the CISSI.A WORM!"
U	CitiUCS	CitiUCS.exe	"Citibank Virtual Account Numbers - ""With this free service for Citi cardmembers
Y	Cjstcom	Cjstcom.exe	Canon printer BJ status language monitor
X	Classes	int1.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	intl.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	run_21.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	srv.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	srv2.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	MSTAR2.EXE	"""Switch"" premium rate adult content dialler variant"
X	Classes	mstart.exe	"""Switch"" premium rate adult content dialler variant"
U	CLCLSet	CLCL.exe	CLCL clipboard caching utility
N	Clean Access Agent	CCAAgent.exe	"Cisco Clean Access Agent from Cisco Systems
X	Clean up	service.exe	"Added by the AGENT-FPY TROJAN!"
?	CleanEasyImg	cleanall.exe	"??"
X	CleanPCTool	SysRep.exe	"CleanPCTool rogue system error and cleaning utility - not recommended
U	CleanSweep Smart Sweep- Internet Sweep	Csinsm32.exe	Automatic logging of installs from Norton CleanSweep - available via Start -> Programs
N	CleanSweep Useage Watch	CSUSEM32.EXE	Quarterdeck/Norton CleanSweep component - tracks how often you use files and alerts you to files that have not been used for a specified period of time
X	cleansweep.exe	cleansweep.exe	"Added by the AGENT-NEU TROJAN!"
N	Cleanup	ONICTASK.EXE	"Internet Cleanup from Allume Systems (used to be by OnTrack) - cleans up tracks left by browsing the internet"
Y	CleanUp	mcappins.exe	Used by older versions of McAfee internet security related products to clean up installation files that are no longer required once the product is installed. This entry will normally only appear once the product has been installed before the system is rebooted
X	CleanUp Antivirus	CU[random characters].exe	"Cleanup Antivirus rogue security software - not recommended
X	CleanupTool	SysRep.exe	"CleanupTool rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
X	clean_service	clean_service.cmd	"Added by the REFAZ WORM!"
U	CleverKeys	CK.exe	"CleverKeys - ""is free software that provides instant access to definitions at Dictionary.com
X	clfmon	nvsvca32.exe	"Added by the TACTSLAY.E TROJAN!"
X	CLI Services	clisrv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
N	ClickSight Launcher	cs.exe	"Launcher for the ClickSight® marketing tool from ClickStream Technologies - which ""is a patented data-collection technology that helps independent software vendors understand the current and future usage of their product"""
X	ClickTheButton	csrss.exe	"ClickTheButton adware. Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
U	Client Access API Daemon	cwbappcd.exe	"IBM iSeries Client Access
N	Client Access Check Version	cwbckver.exe	"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
?	Client Access Express Welcome	cwbwlwiz.exe	"Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
N	Client Access Help Update	cwbinhlp.exe	"Client Access Help Registry Update Function - part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
N	Client Access Service	CwbSvStr.Exe	"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
U	Client Access Taskbar	cwbuitsk.exe	"IBM iSeries Client Access taskbar
X	Client Agent	photes.exe	"Added by the PPDOOR-P TROJAN!"
?	Client agent for ARCserve	W95AGENT.EXE	"Part of Brightstor ARCserve Backup from Computer Associates. What does it do and is it required?"
X	Client for Microsoft Networks	msclient32.exe	"Added by the SDBOT-BXQ WORM!"
N	Client Security Solution	cssauth.exe	"Part of Thinkvantage Client Security Solution for Lenovo ThinkPad notebooks and ThinkCentre desktops. Once configured via the associated setup screens this loads via winlogon.exe (and loads the password manager) and therefore disabling this entry has no effect"
X	Client Server Control Process	[path to trojan]	"Added by the AGENT-HR TROJAN!"
X	Client Server Run Time Proccess	csrsrv.exe	"Added by a variant of the SDBOT WORM!"
X	Client Server Runtime	[path to worm]	"Added by the POEBOT-KR WORM!"
X	Client Server Runtime Process	csrsss.exe	"Added by the SDBOT-LD WORM!"
X	Client Server Runtime Process	csrs.exe	"Added by the LINKBOT.M WORM!"
X	Client Server Runtime Process	smmss.exe	"Backdoor TROJAN! Possible SDBOT-GEN variant"
X	ClientMan1	mscman.exe	"ClientMan parasite variant"
N	Clik Status Monitor	toolsclickstat.exe	Part of Iomega Tools to let you know whether an Iomega PocketZip (nee Clik) removable drive cartridge is installed
X	Clip Service Manager	clipmg.exe	"Added by the DELF.DXJ TROJAN!"
X	Clip Servicer	clipsrvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Clip Srv	clipsv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
N	Clipbook Service	Clipsrv.exe	"Supports Windows XP ClipBook Viewer
N	Clipsrv	Clipsrv.exe	"Supports Windows XP ClipBook Viewer
X	ClipSrv	clipserv.exe	"Added by the SDBOT-AAV and SDBOT-AFE WORMS!"
X	ClipSrv	CLIPBRD3D.EXE	"Added by the MOFEI-D WORM!"
X	Clipsvc	clipsv.exe	"Added by the BLACKHOLE.F BACKDOOR!"
N	CLISTART	CLIStart.exe	Puts the ATI Catalyst™ Control Center Icon/Shortcut on the System Tray - available via Start → Programs
X	clkhost	[path to trojan]	"Added by the WIXUD-B TROJAN!"
?	CLMLServer for HP TouchSmart	CLMLSvc.exe	"Found on the HP Touchsmart range of desktops and notebooks. What does it do and is it required?"
?	clnwall	"rundll.exe setupx.dll	InstallHinfSection ..delwall.inf"
X	clock	[various filenames]	"LiveChat Adware - known file names include: mssetup.exe
X	Clock Manager	amsngr.exe	"Added by the SDBOT-XM TROJAN!"
X	ClockSync	Sync.exe	"ClockSync - synchronizes your system clock with an internet time server. It's by WhenU
U	ClockWise	CLOCKWISE.EXE	"ClockWise - produced by R J Software - a time utility. It is a schedueler not only for dates
?	Clotusorgreg0	prtStart.exe [path] Orgprt.exe	"IBM Lotus SmartSuite related. In a LotusOrgReg folder. Unclear what exactly it does?"
X	ClrSchLoader	[path to file]	"ClearSearch adware"
X	CLSID	com.exe	Adult content dialler
X	CLSID	dll.exe	Adult content dialler
X	CLSID	msgplus.exe	Adult content dialler
X	CLSID	plugin.exe	Adult content dialler
X	CLSID	sed.exe	Adult content dialler
X	CLSID	msgplus.exe	Premium rate adult content dialer. Note - this is NOT the MSN Messenger 'MessengerPlus' extension
X	CLSRSS	LSACS.EXE	"Added by the SILLYFDC-X WORM!"
X	cls_pack.exe	cls_pack.exe	"Added by the Malware Defense rogue security software. Also detected as the FAKEAV-AQB TROJAN!"
?	CM-SmWizard	SmWizard.exe	"SmartWizard MFC Application - associated with C-Media who produce audio chipsets commonly used for on-board sound on motherboards. What does it do and is it required?"
X	cmd32	configs.exe	"Hijacker
X	cmdbcs	cmdbcs.exe	"Added by the LINEAG-GKW TROJAN!"
X	cmds	vtsqn.dll	"Added by a variant of the VUNDO TROJAN!"
X	CmdShell.exe	CmdShell.exe	"Added by the BCKDR-QHY BACKDOOR!"
X	CmeSYS	CMEsys.exe	"Part of Gator advertising spyware - see here for removal instructions. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
U	CMGShieldUI	CMGShieldUI.exe	"UI for CMG (CREDANT Mobile Guardian) Shield from Credant Technologies. ""The CMG Shield resides on devices and external media to enforce security policies even if the device is disconnected from the network."" Used to protect sensitive corporate on laptops
X	Cmmon32Sys	cmmon32.exe	Added by the SMALL.CL TROJAN!
X	cmonitor	startupmon.exe	"SystemDoctor rogue security software - not recommended
X	cmonitor	pasmon.exe	"SystemDoctor rogue security software - not recommended
U	CMPDPSRV	CMPDPSRV.EXE	"Printer Driver Plus from ViewAhead Technology (formerly DeviceGuys
X	Cmpnt	Devices2.exe	"Added by the TOMPAI-D TROJAN!"
X	Cmpnt	mainsv.exe	"Added by the TOMPAI-C TROJAN!"
X	cmrsf	cmrsf.exe	"Added by the DELF-HU TROJAN!"
X	cmrss	cmrss.exe	"Added by the DELF.DU TROJAN!"
X	cmrss	crmss.exe	"Added by the DLOADER-EK TROJAN!"
X	cmrss	[path to trojan]	"Added by the DLOADER-QQ TROJAN!"
X	cmrst	cmrst.exe	"Added by the BANCOS.S TROJAN!"
X	cmrst	cmrst.scr	"Added by the DLOADER-FP TROJAN!"
X	cms	iserver.exe	"Added by the DLOADER-WK TROJAN!"
X	CMSally	callmesally.exe	"Added by the CASAL.A TROJAN!"
U	CMSETTINGS	ctmn.exe	"Part of NetNanny
X	cmsound	vcpdll.exe	"Added by the TCXMEDI-D downloader TROJAN!"
X	cmsound	vcsystem.exe	"Added by the TCXMEDI-D downloader TROJAN!"
X	cmss	system.exe	"Added by a variant of the RBOT WORM!"
X	cmssapp	iexplore_.exe	"Added by the BANCBAN-CQ TROJAN!"
X	cmssapp	iexplore.exe	"Added by the BANCBAN-GF TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	cmssSystemProcess	csmss.exe	"Added by the AGENT-CO TROJAN!"
X	cmssSystemProcess	mcsmss.exe	"Added by the PROXYSER-F TROJAN!"
X	cmssSystemProcess	csms.exe	"Added by the AGENT-Y TROJAN!"
X	CMSystem	CMSystem.exe	"CASClient adware"
X	CnsMax	Internat.exe	"Added by the POINTEX TROJAN! Note - the real internat.exe resides in %windir%\system (where %windir% is the Windows directory - C:\Windows or C:\Winnt) whereas this version resides in %windir%"
X	CnsMin	"Rundll32.exe [path] CNSMIN.DLL	Rundll32"
Y	CnxAdslL	CnxAdslL.exe	"DLink
N	CnxDslTaskBar	CnxDslTb.exe	Connexant DSL Taskbar as used on Acess Runner and Samsung AHT-E310 ADSL modems
U	Cobian Backup Boletus	Cobian.exe	"Cobian Backup 10 - a multi-threaded backup program which makes backup copies of your file and folders (in compressed or uncompressed form) to another location. This entry appears if you choose to install the program as a startup application rather than the default service on an NT based OS (XP/Vista/7). If you don't have regularly scheduled backups then choose the startup option and run it manually when required"
U	Codename Dashboard	dashboard.exe	"Codename: Dashboard - "an application that resides at the side of your screen. Built on the Microsoft .NET Framework
?	COEMsgDisplay	COEMsgDisplay.exe	"Part of HP's PC Common Operating Environment (PC COE) project. Located in %ProgramFiles%\Hewlett-Packard\PC COE. What does it do and is it required?"
U	CognizanceTS	"rundll32.exe [path] AsTsVcc.dll	RegisterModule"
X	Coldlife -icmp	Systray.exe	"Added by the FLOOD.AV TROJAN! Note - this is not the legitimate systray.exe process"
N	CollaborationHost	p2phost.exe	"Signs a user into the People Near Me feature at login in Windows 7 and Vista. People Near Me enables you to use certain peer-to-peer (P2P) programs on a network - that ""identifies people nearby who are using computers and allows those people to send you invitations for programs such as Windows Meeting Space. They can only invite you to participate in programs that are installed on your computer."" Available via Start → Control Panel"
X	COM Service	mscom32.com	"Added by the BEASTY.H TROJAN!"
X	COM Service	msynvr.com	"Added by the BEASTY.G TROJAN!"
X	COM Service	msjclh.com	"Added by the BEASTY.E TROJAN!"
X	COM Service	msdrce.com	"Added by the BEASTY.I TROJAN!"
X	COM Service	msflyx.com	"Added by the BEASTDO-O TROJAN!"
X	COM Service	mskwda.com	"Added by the AGENT-JIX TROJAN!"
X	COM+ Event System	DRWTSN16.EXE	"Added by the LOVGATE.AB WORM!"
X	COM+ EventSystem Services	ECSERVER.EXE	"Added by a variant of the SDBOT WORM!"
X	Com+ Sys	csrs.exe	"Added by the FORBOT-BT WORM!"
X	COM+ System Application	lsas.exe	"Added by the AGOBOT-MO WORM!"
X	COM+ System Applications	lsas.exe	"Added by the AGOBOT.SE WORM!"
X	COM++ System	exploier.exe	"Added by the LOVGATE.Z WORM!"
X	COM++ System	suchost.exe	"Added by the LOVGATE-F WORM!"
X	COM++ System	svchost.exe...	"Added by a variant of the LOVGATE WORM!"
U	com.codeode.cactusspamfilter	cactusspamfilter.exe	"Cactus Spam - free easy-to-use spam blocker"
X	Comcast Network	ribiva.exe	"Added by a variant of the IRC TROJAN!"
X	ComcastSUPPORT	tgkill.exe	Comcast (the cable folks who are replacing @home in some parts of the USA) have struck a deal with Tioga to provide an "enhanced" support and self-repairing tool. This is "beta" at present and was made available to download by mistake at present. Remove via Start -> Settings -> Add/Remove Programs
U	COMDRV32	svdhost.exe	"Orvell Monitoring 2003 surveillance software. Uninstall this software unless you put it there yourself. Note - asks for permission to contact the IP address of http://www.protectcom.com/"
X	Command	system.exe	"Added by the GATECRASH.A or GATECRASH.B TROJANS!"
U	Command WorkStation 4	cws 4.exe	"EFI's Command WorkStation makes ""managing demanding workflows easier by centralizing job management. The software automatically identifies the Fiery servers on the network and offers customization options for displaying information"" - for high-end print environments"
X	Common Files	twain.exe	"Added by the AGENT.BEA TROJAN!"
N	CommonSDK	RoxWatchTray9.exe	"System Tray access to managing the ""Watched Folders""
X	CommonService	winup.exe	"Added by the DLOADR-BJJ TROJAN!"
Y	Communications_Helper	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
Y	Communications_Helper.exe	Communications_Helper.exe	"Entry added when you install versions of the Logitech QuickCam webcam software. Used to interface your webcam with third party chat and voice programs such as instant messaging clients and Skype. Also
N	Compaq Computer Corp SCCenter Module	SCCENTER.EXE	For Compaq PC's. Part of Backweb
?	Compaq Computer Security	"Rundll32.exe SECURE32.CPL	Service"
N	Compaq Connections	COMPAQ~1.EXE	"See here - ""messaging service that automatically sends you support information
N	Compaq Connections	BackWeb-1940576.exe	"See here - ""messaging service that automatically sends you support information
N	Compaq Connections	Compaq Connections.exe	"See here - ""messaging service that automatically sends you support information
X	Compaq Drivers	F1rewalls.exe	"Added by the SDBOT-WD WORM!"
N	Compaq Internet Setup	inetwizard.exe	For Compaq PC's. Runs Compaq internet setup wizard and offers you to signup from ISP list
X	Compaq Jes Drivers	winjes.exe	"Added by the SDBOT-XR WORM!"
U	Compaq Knowledge Center	silent.exe & matcli.exe	""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	Compaq Message Server	COMPAQ-RBA.EXE	"Applies to the CPQBootPerfDB entry as well. These files generate some kind of server or servlet that attempts to connect with Compaq online. They are like Trojans
X	Compaq Service Drivers	systeminfos.exe	"Added by the SDBOT-XC WORM!"
X	Compaq Service Drivers	compq.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	navapqwa.exe	"Added by the SDBOT.BBQ WORM!"
X	Compaq Service Drivers	amsn.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	compqs.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	msnt.exe	"Added by the SDBOT.CQL WORM!"
X	Compaq Service Drivers	NtKernelSystem.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	wincmd.exe	"Added by the RBOT.ATV WORM!"
X	Compaq Service Drivers	wind32.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	winmsn.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	compaq.exe	"Added by the SDBOT-AFU WORM!"
X	Compaq Service Drivers	msnsvc.exe	"Added by the RBOT.BKT WORM!"
X	Compaq Service Drivers	ntsys32.exe	"Added by the RBOT.CIW WORM!"
X	Compaq Service Drivers	winsvc.exe	"Added by the SDBOT-AGD WORM!"
X	Compaq Service Drivers 32	compq32.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivrs	copq.exe	"Added by a variant of the RBOT WORM!"
X	Compaq Services Drivers	ndt32.exe	"Added by the RBOT.CQZ WORM!"
X	Compaq Sound Drivers For WINDOWS	sounddr.exe	"Added by the SDBOT-XG WORM!"
X	Compaq32 Service Drivers	ms32.exe	"Added by the SDBOT.BWH WORM!"
X	Compaq32 Service Drivers	msconfig32.exe	"Added by the SDBOT-ADC WORM!"
X	Compaq32 Service Drivers	msnt32.exe	"Added by the RBOT.BVF WORM!"
X	Compaqs Service Driver	copypad32.exe	"Added by the SDBOT.CSO WORM!"
X	Compaqs Service Drivers	compqs.exe	"Added by a variant of the SDBOT WORM!"
N	CompaqSystray	cpqpscp.exe	Compaq System Tray icon
X	Compatibility Service Process	regsvs.exe	"Added by the GAOBOT.YN WORM!"
X	Compd Service Drivrs	codq.exe	"Added by a variant of the SDBOT WORM!"
X	ComPlus Applications	twain.exe	"Added by the AGENT.AQO TROJAN!"
U	ComproSchedulerDTV	ComproSchedulerDTV.exe	"VideoMate TV tuner and capture card - scheduler"
U	CompuSpy	CompuSpy.exe	"CompuSpy surveillance software. Uninstall this software unless you put it there yourself"
U	CompuSpy KeyLogger	cswin2008.exe	"CompuSpy surveillance software. Uninstall this software unless you put it there yourself"
X	Computing Technologie Firewall	lsauth.exe	"Added by the SDBOT-WX WORM!"
N	COMSMDEXE	comsmd.exe	3Com tray icon
X	ComStart	Trojan Guarder.exe	"TrojanGuarder rogue security software - not recommended"
X	ComTry Web Searcher	wstray.exe	Comtry MP3 Downloader related - spyware
X	ConfidentSurf	GDC.exe	"ConfidentSurf rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	ConfidentUser	SRP.exe	ConfidentUser rogue system error and cleaning utility - not recommended
X	Config	service.exe	"Added by the ISRAZ.B WORM!"
X	Config	WinService32.exe	"Added by the CRUTCHA-A TROJAN!"
X	Config	TaskUpdate.exe	"Added by the MDROP-BRO TROJAN!"
X	Config Loader	svchosl.exe	"Added by the GAOBOT.P WORM!"
X	Config Loader	sysldr32.exe	"Added by the GAOBOT WORM!"
X	Config Loader	scvhost.exe	"Added by the GAOBOT.AE or GAOBOT.AO WORMS!"
X	Config Loader	svhost.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Config Loader	svchost2.exe	"Added by the AGOBOT.XE WORM!"
X	Config Loader	SYSMGR.EXE	"Added by the AGOBOT.C WORM!"
X	Config Loader for Microsoft Windows	mwincfg32.exe	"Added by the AGOBOT.BD WORM!"
X	Config Loader2	explores.exe	"Added by the GAOBOT.BT WORM!"
X	Config Loadr	winsys32.exe	"Added by the AGOBOT-HN WORM!"
U	ConfigSafe	CFGSAFE.EXE	"ConfigSafe - lets you identify changes to the registry
U	ConfigSafe	AUTOCHK.EXE	"ConfigSafe - lets you identify changes to the registry
N	ConfigServices	Config.exe	Part of initial setup on a Compaq PC
X	configsetup	configsetup32.exe	"Added by the AGOBOT-AFP WORM!"
X	configuration	apphost.exe	"Added by the SDBOT-VP WORM!"
X	Configuration	ntsys32.exe	"Added by the SDBOT-LN WORM!"
X	Configuration	msgfixs.exe	"Added by the SDBOT-NN WORM!"
X	Configuration Driver	scghost.exe	"Added by the SDBOT-DLA WORM!"
X	Configuration File	Winset32.exe	Added by the FLUX.101 TROJAN!
X	Configuration Loaded	lssas.exe	"Added by a variant of the SDBOT WORM!"
X	Configuration Loader	syscfg32.exe	"Added by the SDBOT.B BACKDOOR!"
X	Configuration Loader	service5.exe	"Added by the GAOBOT.AF WORM!"
X	Configuration Loader	lfass.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	sycfg34.exe	"Added by the GAOBOT.AN WORM!"
X	Configuration Loader	dosrun32.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Service.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	Servicess.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sw32.exe	"Added by the AGOBOT.BQ WORM!"
X	Configuration Loader	System.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sysinfo.exe	"Added by the GAOBOT.FQ WORM!"
X	Configuration Loader	microsoft.exe	"Added by the GAOBOT.JB WORM!"
X	Configuration Loader	svhst.exe	"Added by the GAOBOT.YC WORM!"
X	Configuration Loader	msgfix.exe	"Added by the GAOBOT.AUS or SDBOT.J or SDBOT-QG WORMS!"
X	Configuration Loader	msnss.exe	"Added by the GAOBOT.AUS WORM!"
X	Configuration Loader	MSTasks.exe	"Added by the LOADCFG or SDBOT TROJANS!"
X	Configuration Loader	systemry.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	ccSort.exe	"Added by the AGOBOT.SR WORM!"
X	Configuration Loader	smss32.exe	"Added by the AGOBOT.MB WORM!"
X	Configuration Loader	seru32.exe	"Added by the SDBOT-VR WORM!"
X	Configuration Loader	botss.exe	"Added by the SDBOT-XS WORM!"
X	Configuration Loader	ldasp.exe	"Added by the AGOBOT.BH WORM!"
X	Configuration Loader	msgcfgsrv.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	smsai.exe	"Added by the SDBOT-YE WORM!"
X	Configuration Loader	svupdate.exe	"Added by the RANDEX.DXP WORM!"
X	Configuration Loader	crcss.exe	"Added by the AGOBOT.ADG WORM!"
X	Configuration Loader	scvhost.exe	"Added by the AGOBOT-AAE and SDBOT.AR WORMS!"
X	Configuration Loader	svchost.exe	"Added by the PARADROP-A WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Configuration Loader	svchost2.exe	"Added by the AGOBOT.JR WORM!"
X	Configuration Loader	mouse.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	msg.exe	"Added by the SDBOT.BT WORM!"
X	Configuration Loader	ahnhst.exe	"Added by the AGOBOT.MX WORM!"
X	Configuration Loader	msnmsgr.exe	"Added by the SDBOT-SO WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Configuration Loader	svschost.exe	"Added by the SDBOT-NS WORM!"
X	Configuration Loader	WinSys32ys.exe	"Added by the SDBOT.BCS WORM!"
X	Configuration Loader	asnclt32.exe	"Added by the AGOBOT-EB BACKDOOR!"
X	Configuration Loader	soundconf.exe	"Added by the AGOBOT-MH WORM!"
X	Configuration Loader	mservs.exe	"Added by the SDBOT-NM WORM!"
X	Configuration Loader	msgfixy.exe	"Added by the SLINBOT.QW BACKDOOR!"
X	Configuration Loader	scvh0st.exe	"Added by the AGOBOT-AX WORM!"
X	Configuration Loader	msrun.exe	"Added by the AGOBOT-Y WORM!"
X	Configuration Loader Service	Winsys32.exe	"Added by the RBOT-YV WORM!"
X	Configuration Loader Service	devl32.exe	"Added by the SDBOT-XY WORM!"
X	Configuration Loading	svchos1.exe	"Added by the GAOBOT.DK WORM!"
X	Configuration Loading Service	wscel.exe	"Added by the SDBOT-WJ WORM!"
X	Configuration Servecie	sewins.exe	"Added by the SDBOT-COH WORM!"
X	Configuration Service	suchost.exe	"Added by the TREB TROJAN!"
X	Configuration Services	mswords.exe	"Added by the SDBOT-YM WORM!"
X	Configurations Asclt	asclt.exe	"Added by the SDBOT-MX WORM!"
X	ConfigVir	services.exe	"Added by the AUTORUN-DV WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ~A~m~B~u~R~a~D~u~L~ subfolder"
X	ConfLoader	sysconf16.exe	"Added by the SDBOT-FB TROJAN!"
X	conmswf	conrnbne.exe	"Added by the SDBOT-DEX WORM!"
U	Connect Kasamba	Kasamba.exe	"""Finding the expert help that you need is easy on Kasamba. With more than 30
N	CONNECTAuto Update	CONNECTScheduler.exe	"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
X	Connector	SYS.EXE	"Nunci premium rate dialer"
X	Connector	sms.EXE	"Added by the ExDial-B premium rate adult content dialer"
N	CONNECTScheduler	CONNECTScheduler.exe	"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
X	Cons	consol32.exe	"Hijacker - redirects to an adult content portal
X	conscorr	conscorr.exe	"VX2.Transponder parasite updater/installer related"
X	Console de Gerenciamento Microsoft	csrss.exe	"Unidentified malware! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Level4"" subfolder"
X	Console de Gerenciamento Microsoft	csrss.exe	"Added by the BANCBAN-ET TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Central de Segurança"" subfolder"
U	Consumer Input	ConsumerInput.exe	"Consumer Input Toolbar. Opt-in market research monitoring you browsing habits - see the FAQ"
X	Content List Management Subsystem	clmss.exe	"Added by the SPYBOT-EL WORM!"
X	Content Service	winserv[LETTER].exe	"PurityScan adware"
X	ContentDownload	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	ContentEraser	GDC.exe	"ContentEraser rogue privacy tool - not recommended
X	ContentService	winservn.exe	"PurityScan adware - see here"
U	ContentTransferWMDetector.exe	ContentTransferWMDetector.exe	"Part of Sony's Content Transfer Software which ""provides an easy way to transfer music
X	ContinueInstall	bpsinstall.exe	"BrowserAid/BrowserPal foistware"
X	ContraVirus	ContraVirusPro.exe	"ContraVirus rogue security software - not recommended
X	ContraVirus	ContraVirus.exe	"ContraVirus rogue security software - not recommended
X	Control handler	ahjinst.exe	"CoolWebSearch parasite variant"
N	control panel	smctrlw.exe	System Tray icon for a Silicon Motion LynxEM based PCI Graphics Card
X	Control Panel	System.exe	"Added by the DANI TROJAN!"
X	control panel software service	cprs.exe	"Added by the RBOT-FPI WORM!"
X	Controladores	[path to trojan]	"Added by the TELEFO-A TROJAN!"
X	Controlled Resource System Service	crss.exe	"Added by the AGOBOT.GH WORM!"
X	ControlPanel	"host32.exe internat.dll	LoadKeyboardProfile"
X	ControlPanel	"systemctrl.exe internet.dll	LoadNetworkProfile"
X	ControlPanel	"svcc.exe internat.dll	LoadKeyboardProfile"
X	ControlServiceMgr	csmsv.exe	"Added by the AGENT-XC TROJAN!"
U	Cool Desk	cdesk.exe	"Cool Desk is a virtual desktops manager. "Ever you wished to have several screens on your computer? Cool Desk creates up to 9 virtual desktops and offers you to have different windows on each of them". Not required but may be of use to you"
X	CoolDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	CoolMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	CoolSwitch	taskswitch.exe	ALT+TAB replacement Powertoy for Windows XP - enhances the graphics displayed when you want to switch between programs running full-screen
X	coolwebprogram	clrssn.exe	"CoolWebSearch Smartsearch parasite variant"
N	Copernic Desktop Search	DesktopSearch.exe	"Copernic Desktop Search - ""Easily search your entire hard drive in less than a second to pinpoint the right file
U	Copernic Desktop Search 2	DesktopSearchService.exe	"Copernic Desktop Search - search agent"
U	CopernicPerUserTaskMgr	CopernicPerUserTaskMgr.exe	Automatic tasking feature of Copernic Pro multi-search engine tool
X	Core Process Aplication	ccapl.exe	"Added by the QHOSTS.G TROJAN!"
X	Core Process Aplication x16	ccapl16.exe	"Added by the SPYBOT.AFT WORM!"
X	Core Process Aplication x32	ccapl32.exe	"Added by the SRAMLER.E TROJAN!"
X	Core System Hardware	syscorehd.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Coreguard Antivirus 2009	Coreguard 2009.exe	"Coreguard Antivirus 2009 rogue security software - not recommended
N	Corel Colleagues & Contacts Reminders	cffrem.exe	"Corel Colleagues & Contracts - all-in-one organizer for scheduling meetings
N	Corel Desktop Application Director	dadx.exe	The Desktop Application Director (DAD) gives you easy access to all Corel applications - x represents ther version number. Available via Start -> Programs
N	Corel Family & Friends reminders	CFFREM.EXE	"Corel Family & Friends - all-in-one calender
N	Corel Registration	Remind32.exe	If you don't want to register Corel products and be reminded about it every 2 weeks disable it
N	Corel Registration Reminder	Remind32.exe	If you don't want to register Corel products and be reminded about it every 2 weeks disable it
N	Corel Reminder	NAVBROWSER.EXE	If you don't want to register Corel products and be reminded about it every 2 weeks disable it
N	Corel Reminder	NAVBrowser.exe	Registration reminder for CorelDRAW 10
N	CorelMedia FoldersIndexer8	MFindexer.exe	Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office
N	CorelMedia FoldersIndexer8	MFINDE~1.EXE	Part of CorelDraw bundles for indexing media files - similar to "fast find" in MS Office
X	CoreSrv	coresrv.exe	"Some IRC trojans/worms use this - see here for more information"
?	CORESYS	coresys.exe	"??"
X	Corporate Microsoft Update	uptask.exe	"Added by the RBOT-GVB WORM!"
X	cosine	cosine.exe	"Added by the RBOT-SW WORM!"
U	CostAware	niIPCApp.exe	"NetInternals CostAware - download quota measuring tool"
X	Counterstrike Service Agent	czrzns.exe	"Added by the MEDBOT.AR WORM!"
N	Country Select	pctptt.exe	"Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell
N	CountrySelection	pctptt.exe	"Country selection for a PCtel HSP56 based modem. Often found in OEM (Dell
?	Coupon Offers	??	"??"
?	CPA9P2PSERVER	CPA9P2PS.exe	"Found on a Compaq Presario but what is it?"
X	CPCmscl0ck	CPCmsclock.ExE	"Added by the IRCFLOOD.BF TROJAN!"
X	cpl	msgaol.exe	"Added by the TACTSLAY.C TROJAN!"
X	cpl	s_menu.exe	"Added by the TACTSLAY.C TROJAN!"
X	cpl	browse.exe	"Added by the TACTSLAY.C TROJAN!"
X	cpntmgc	simcss.exe	"Added by the MAGICON.A TROJAN!"
X	cpntmgc	winmgts.exe	"Added by the WINTRIM-B TROJAN!"
U	CPQEASYACC	cpqeadm.exe	For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
U	CPQEASYACC	StartEAK.exe	"Easy Access Button Support for Compaq PCs. Allows the use of programmable keys on multimedia keyboards. Required if you use the additional keys"
U	CPQEASYACC	STARTDRV.exe	For Compaq PC's. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
X	CPQHotKeys	hotkeysvc.exe	"Added by the RBOT-XA WORM!"
U	CPQInet Runtime Service	CpqInet.exe	"For Compaq PC's. Allows AOL and Compuserve to use the Easy Access buttons for the internet. Is not required if you don't use the ISP providers"
U	cpqns	cpqnpcss.exe	Related to Compaq.Net - not required if you don't use that
N	Cpqset	Cpqset.exe	Default settings software in Hewlett Packard notebook
Y	CPQSTUTFIX	stutfix.exe	"For Compaq PC's. Fixes audio stutter problems for ESS Maestro soundcards. You can download it here. This is a Compaq originated file and has been verified as free from viruses by McAfree/Norton"
X	cprocsvc	cproc.exe	Added by MSIL.AGENT.C TROJAN!
X	CPU Windows Status	cpustats.exe	"Added by a variant of the RBOT WORM!"
X	Cpusave	Cpusave.exe	"Added by the GEMA TROJAN!"
X	Cpusave32	Cpusave32.exe	"Added by the GEMA TROJAN!"
X	CPVHOST Settings	cpvhost.exe	"Added by a variant of the SDBOT TROJAN!"
?	CQSCP2PS	CQSCP2PS.EXE	"""Compaq printer utility which is required in the startup menu in order to make the printer work correctly"". Is it actually required?"
?	CQSCP2PSERVER	CQSCP2PS.EXE	"""Compaq printer utility which is required in the startup menu in order to make the printer work correctly"". Is it actually required?"
U	cracked_windows1	cracked_windows1.exe	"Cracked Windows popup killer"
X	crash0001	restorecrashwin32.bat	"Added by the AGENT-ZC TROJAN!"
X	CrashDump	[path to trojan]	"Added by the DROPPER.EAT TROJAN!"
N	CrazyTalk Serve	"rundll32.exe CrazyTalk.dll	DIIServeMediaFile"
U	CRBroadCasting	CRBroadCasting.exe	"CardReader2 from On Track Inovations Ltd. USB Card Reader"
X	CRC Value Verifier	crsss32.exe	"Added by a variant of the RBOT WORM!"
X	CRC Value Verifier	Crsss64.exe	"Added by the RBOT-NY WORM!"
X	CRC Value Verifier	svchost32.exe	"Added by the RBOT-OA WORM!"
X	CRC Value Verifier	crsss.exe	"Added by the SPYBOT.UK WORM!"
X	Crc32stats Dependencies	Crc32stats.exe	"Added by the MYTOB.GT WORM!"
X	CRCSS	crcss.exe	"Added by the IRCBOT-TH WORM!"
U	Creata Mail	JMSrvr.exe	"Creata_Mail. Smileys
X	Create A Monster	createAMonster.exe	"Kudd.com CreateAMonster. Reportedly stealth installed and Look2Me adware related"
X	Creates stractures for system management	stacture.exe	"Added by the SDBOT-DHS WORM!"
X	Creative Audio Drivers	creative.exe	"Added by the RBOT-FKR WORM!"
U	Creative MediaSource Go	CTCMSGo.exe	"Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
U	Creative MediaSource Go	CTCMSGoU.exe	"Creative MediaSource Go! is a combination of a short-cut bar and launcher for the Creative MediaSource™ player/organizer - which ""enables you to manage your entire digital music collection on both your computer and your Creative portable music player effortlessly"""
N	Creative PCI Audio Configuration Utility	starter.exe	"System Tray icon to configure a Creative Soundblaster PCI soundcard. Not required and re-instates itself when un-checked. Try one of the solutions on this special page. Similar to EnsoniqMixer"
N	Creative Software Update	AutoUpdate.exe	Auto-updater for Creative Labs software
N	CreativeDiscNotifier	CTNOTIFY.EXE	"For Creative Soundblaster Live! series soundcards. Detects when you insert a CD-ROM
?	CreativeTaskScheduler	CTSched.exe	"Creative Task Scheduler. What does it do and is it required?"
X	CrisysTec Sentry	Sentry.exe	"CrisysTec Sentry rogue privacy program - not recommended"
X	Critical Error Safe32	GetWaylayer32.exe	Added by the RBOT.IAL WORM!
X	crmssrlt	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	Crnsava	scrnsave.pif	"Added by the SDBOT-ZV WORM!"
X	cronos	MARCO!.SCR	"Added by the OPASERV.G WORM!"
X	CrossMenu	CrossMenu	Toshiba CrossMenu Utility - allows the user to create their own menus
U	CrossMenu	CrossMenu.exe	Toshiba CrossMenu Utility - allows the user to create their own menus
X	crs	crs.exe	"Added by the AGOBOT-TJ WORM!"
X	crsmons	iomssls.exe	"Added by the BACKDR-AU TROJAN!"
X	CRSS	CRSS.exe	"Added by the AGOBOT-RM WORM!"
X	CRSS	lssas.exe	Added by an unidentified WORM or TROJAN!
X	crsss	crsss.exe	"Added by the AUTORUN.FM WORM!"
X	CRSSXP SysInfo	crssxp.exe	"Added by a variant of the SDBOT TROJAN!"
X	Crusty	dmcpl.exe	"Added by the RUSTY WORM!"
X	Cryptographic Service	******.exe [* = random char]	"Added by the KORGO.W or KORGO.X or KORGO.AB WORMS!"
?	Crystal 3D Audio Control	CWD3DSND.EXE	"Crystal 3D Audio sound driver. Is it required?"
X	CS	tsc.exe	"Cyber Security rogue security software - not recommended
X	CS Update	copy /Y [path] ActivationManager.dll.upd [path] ActivationManager.dll	Added by an unidentified malware
N	csaRem	spqmdmui.exe	Compaq modem country selection
Y	CSAV_CheckViruses	vchk.exe	"Command Antivirus related"
U	csc	csc.exe	Command line compiler for Microsoft C# it gets installed with the .NET SDK
X	cscripts	cscripts.exe	"Added by the BDOOR-AAP BACKDOOR!"
X	CSCRS Value	cscrs.exe	"Added by the RBOT-AAA WORM!"
X	CSCRS Value Check	MsPMSPSd.exe	"Added by a variant of the SDBOT WORM!"
X	Csec	cs.exe	"Cyber Security rogue security software - not recommended
N	csecwiz	csecwiz.exe	"Setup wizard for the Client Security Software for IBM\Lenovo notebooks. This entry only runs once
X	cserv32	cserv32.exe	"Added by the STRATION.EC WORM!"
X	CsimPlayer	CsimPlayer.exe	"Added by the KOOBFACE-AD WORM!"
U	CSINJECT.EXE	CSINJECT.EXE	"Part of Quarterdeck/Norton CleanSweep. ""Csinject must be loaded in order for Smart Sweep to automatically monitor installations and properly track registry changes"""
X	csm Win Updates	csm.exe	"Added by the ZOTOB.B WORM!"
X	CSNetManagerXp	isass.exe	"Added by the HIDER-O TROJAN!"
X	csoftok	softok.exe	"Added by the QQPASS.G TROJAN!"
X	csos	csos.exe	"Added by the SDBOT-DFE WORM!"
X	csrcs	csrcs.exe	"Added by the AGENT-HUA TROJAN!"
X	csrs	csrs.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	csrsc	csrsc.exe	"Added by an unidentified VIRUS
X	CSRSS	CSRSS.EXE	"Search page hijacker
X	Csrss	csrss.exe	"Added by the CHOD WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a random subfolder"
X	csrss	csrss.exe	"Added by the KEYLOG-AQ KEYLOGGER! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	csrss	csrss.exe	"Added by the CHODE-J WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a random subfolder"
X	csrss	msmsgs.exe	"Added by the CHODE-J BACKDOOR! Note - this malware uses MSN Messenger (which is located in %Program Files%\Messenger) in the background to propogate itself"
X	csrss	nwiz.exe	"Added by the CHODE-J WORM!"
U	csrss	csrss.exe	"BeyondKeylog surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the same file as the csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Supremtec"
X	Csrss	CSRSS.EXE	"Added by the PUNYA-B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in C:\Documents and Settings\Administrator\Local Settings\Application Data\WINDOWS"
X	csrss	ssms.exe	Added by an unidentified malware
X	Csrss Host	csrhost.exe	"Added by the IRCBOT.BIZ WORM!"
X	CSRSS Loader	csrsss.exe	"Added by the AGOBOT.TX WORM!"
X	csrss.exe	csrss.exe	"Added by the DALBUG WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	csrssLevel4	csrss.exe	"Unidentified malware! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Level4"" subfolder"
X	CSRSSU	CSRSSU.exe	"CoolWebSearch parasite variant - hijacking to Slawsearch.com. Also detected as the CWS-E TROJAN!"
X	CSRSSW	CSRSSW.EXE	"Added by the CWS-F TROJAN!"
X	CSRSWIN	[trojan filename]	"Added by the WINSHELL.50 TROJAN!"
X	CSRSX	[trojan filename]	"Added by the WINSHELL.50.B TROJAN!"
X	csrvss	csrvss.exe	"Added by a variant of the SDBOT TROJAN!"
U	CSS Server	CSSServer.exe	"ComSpySysSvr surveillance software. Uninstall this software unless you put it there yourself"
N	cssauth	cssauth.exe	"Part of Thinkvantage Client Security Solution for Lenovo ThinkPad notebooks and ThinkCentre desktops. Once configured via the associated setup screens this loads via winlogon.exe (and loads the password manager) and therefore disabling this entry has no effect"
N	cssauthe	cssauthe.exe	"Part of Thinkvantage Client Security Solution for IBM/Lenovo ThinkPad notebooks and ThinkCentre desktops. Once configured via the associated setup screens this loads via winlogon.exe (and loads the password manager) and therefore disabling this entry has no effect"
Y	CSScheduleCheck	SCHWIZEX.EXE	"Part of ConfigSafe - lets you identify changes to the registry
X	cssrs	cssrs.exe	"Added by the BANCBAN-DW TROJAN!"
X	cssrss.exe	cssrss.exe	"Malware installed by different rogue security software including SpyKillerPro"
X	csss	Csss.exe	"Added by the BALICK TROJAN!"
U	CSS_Central	CSS_1631.EXE	"CSS Communication Agent (95 Host) from Command Software Systems (now Authentium). ""CSS Central™ provides administrators with a powerfully proactive tool to effectively manage and maintain the anti-virus strategy from a centralized console"""
X	CSV10P1	CSP001.exe	"ClearSearch adware"
X	CSV10P70	CSv10P070.exe	"ClearSearch adware"
X	CSV7P26	CSV7P26.exe	"ClearSearch adware"
X	CSV7P70	CSV7P070.exe	"ClearSearch adware"
X	CSV7P91	CSV7P91.exe	"ClearSearch adware"
U	csvdea	csvdea.exe	"SpyArsenalLog surveillance software. Uninstall this software unless you put it there yourself"
X	csvhost.exe	csvhost.exe	"Added by the CIMUZ-BD TROJAN!"
X	CT Control Settings	CTSVCCD.EXE	"Added by the RBOT-YS WORM!"
X	ctfmen	cssrs.exe	"Added by the STARTP-DC TROJAN!"
X	ctfmon	taskmgr32*.exe [* = number]	"Added by the SOWSAT.B WORM!"
X	ctfmon	WinConst.exe	"Added by the ASSASIN-G TROJAN!"
X	ctfmon	msnmsgr.exe	"Added by the BDOOR-JV BACKDOOR! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	CTFMON	wscript.exe /E:vbs winjpg.jpg	"Added by the RUNAUTO.F WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""winjpg.jpg"" file is located in %System%"
X	CTFMON	wscript.exe /E:vbs regedit.sys	"Added by the VBSAUTO-A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""regedit.sys"" file is located in %System%"
X	Ctfmon	wmisys.exe	"Added by the IRCBOT-ADS WORM!"
X	ctfmon.exe	msupdate32.exe	"Spy Sheriff/SpywareNO malware
X	CTFMON.EXE	svchost.exe	"Added by the JUEGO-B WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	ctfmon32	taskmgr32*.exe [* = digit]	"Added by the SOWSAT.C WORM!"
X	CTFMONSS	CTFMONSS.EXE	"Added by the CWS-F TROJAN!"
X	ctfmoon	microsoftconfigurator.exe	"Added by the DELF-ALS TROJAN!"
X	ctfnom.exe	SVOHOST.exe	"Added by the DIGIDOR-A TROJAN!"
X	ctfnom.exe	OSRSS.exe	"Added by the DLOADER-UQ TROJAN!"
X	CTHELPER	svhost.exe	"Added by the SDBOT-RZ WORM!"
?	CTPDPSRV	CTPDPSRV.EXE	"Compaq A3000 printer driver (in the %System%\spool\DRIVERS\W32\X86 folder). Is it required?"
?	CTSched	CTSched.exe	"Creative Task Scheduler. What does it do and is it required?"
N	CTStartup	CTEaxSpl.exe	Splash screen with sound on every boot up. Installed with a Sound Blaster Audigy soundcard
U	CTSVolFE	CTSVolFE.exe	Creative Labs Mixer applet for the Sound Blaster Audigy
U	CTSVolFE.exe	CTSVolFE.exe	Creative Labs Mixer applet for the Sound Blaster Audigy
N	CTSyncU.exe	CTSyncU.exe	"Creative Sync Manager - synchronizes music tracks on your computer with your player"
U	CTsysVol	CTSYSVOL.exe	Creative sound card volume controls
?	cttdpsrv	cttdpsrv.exe	"??"
X	CueX44_stil_here	WINLOGON.EXE	"Added by the PUNYA-A WORM! Note - this is not the legitimate winlogon.exe process
X	Current Security Config	csecure.exe	"Added by the RBOT-AMO WORM!"
X	Current32	msnpla.exe	"Added by the SDBOT-DIS WORM!"
N	CurseClient	CurseClient.exe	"CurseClient add-on manager for World of Warcraft and Warhammer Online games"
N	cursor	Screendragon_VS_Taskbar.exe	"ScreenDragon video player"
U	CursorGizmo	CursorGizmo.exe	"Cursor Gizmo - cursor management utility"
N	CursorXP	CursorXP.exe	"CursorXP from Stardock - tool for creating mouse cursors"
U	Customizer2000	logon.exe	"Automatic logon feature of Customizer 2000 - ""a special utility which is designed to optimize Win9x/ME performance. The program lets you explore the many hidden settings in Windows
X	cvhnykzx	keepSafe.exe	"Added by the KILLAV.KAX TROJAN!"
X	cvmsyslpd	sdservss.exe	"Added by the MAILBOT-BY TROJAN!"
N	cwbsvstr	cwbsvstr.exe	"Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
?	Cwcdschk.exe	Cwcdschk.exe	"IBM Thinkpad related?"
X	cwingllib	atllsimm.exe	"Added by a variant of the SDBOT WORM!"
X	cybansos	cyban.exe	"Added by the TATERF-V WORM!"
U	Cyber Trio	showmode.exe	"From G-Tek Technologies. Allows you to set the PC in one of three modes
U	Cyber-Defender 2003	uwcdsvr.exe	"
N	Cyber-shot Viewer Media Check Tool	SPUVolumeWatcher.exe	"Part of the Sony Picture Uility software supplied with Sony Cyber-shot digital cameras. Automatically invokes an import process if the camera is connected and has media on it"
N	Cyber-shot Viewer Media Check Tool	SPUVOL~1.EXE	"Part of the Sony Picture Utility software supplied with Sony Cyber-shot digital cameras. Automatically invokes an import process if the camera is connected and has media on it"
N	Cyberlink PowerCinema 3.0	PCMService.exe	"Part of Cyberlink's PowerCinema - which can be used to watch movies
U	CypressLinkMon	CypressLinkMon.exe	"Related to CypressViewer from Siemens that ""allows ACUSON Cypress cardiovascular system PLUS users to store
X	D SYSTEM	dd.exe	"Added by the MYTOB-FN WORM!"
Y	D-Link Air USB Utility	AirCFG.exe	D-Link Air USB wireless driver and configuration utility
N	D-Link AirPlus DWL-650+ Utility	WLANMON.exe	D-Link Air Plus Wireless PC modem connection monitor
Y	D-Link AirPlus G	AirGCFG.exe	D-Link Airplus G wireless router driver and configuration utility
Y	D-Link AirPlus G Wireless Utility	AirPlus.exe	"D-Link AirPlus G wireless configuration and monitoring utility"
Y	D-Link AirPlus XtremeG	AirPlusCFG.exe	"D-Link AirPlus Xtreme G wireless access point driver and configuration utility"
Y	D-Link D-Link RangeBooster N DWA-140	AirNCFG.exe	"D-Link DWA-140 RangeBooster N USB adapter driver and configuration utility"
Y	D-Link D-Link Wireless 108G DWA-120	AirPlusCFG.exe	D-Link DWA-120 Wireless 108G USB adapter driver and configuration utility
Y	D-Link D-Link Wireless 108G DWA-520	AirPlusCFG.exe	D-Link DWA-520 Wireless 108G desktop adapter driver and configuration utility
Y	D-Link D-Link Wireless G DWA-110	AirGCFG.exe	D-Link DWA-110 Wireless G USB adapter driver and configuration utility
Y	D-Link D-Link Wireless G DWA-510	AirGCFG.exe	D-Link DWA-510 Wireless G desktop adapter driver and configuration utility
Y	D-Link D-Link Wireless N Dual Band DWA-160	AirNCFG.exe	"D-Link DWA-160 Xtreme N Dual Band USB adapter driver and configuration utility"
Y	D-Link D-Link Wireless N DWA-130	AirNCFG.exe	"D-Link DWA-130 Wireless N USB adapter driver and configuration utility"
Y	D-Link RangeBooster G WDA-2320	AirPlusCFG.exe	"D-Link WDA-2320 RangeBooster G desktop adapter driver and configuration utility"
Y	D-Link RangeBooster G WUA-2340	AirPlusCFG.exe	"D-Link WUA-2340 RangeBooster G USB adapter driver and configuration utility"
Y	D-Link Wireless G WDA-1320	AirGCFG.exe	"D-Link WDA-1320 Wireless G desktop adapter driver and configuration utility"
Y	D-Link Wireless G WUA-1340	AirGCFG.exe	"D-Link WUA-1340 Wireless G USB adapter driver and configuration utility"
N	DAEMON Tools	daemon.exe	"Older version of Daemon Tools Lite from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
N	DAEMON Tools Lite	daemon.exe	"Older version of Daemon Tools Lite from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
N	DAEMON Tools Lite	DTlite.exe	"Daemon Tools Lite from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
N	DAEMON Tools Pro	DTAgent.exe	"System Tray access to DAEMON Tools Pro from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
N	DAEMON Tools Pro Agent	DTProAgent.exe	"System Tray access to an older version of DAEMON Tools Pro from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
N	DAEMON Tools Pro Agent	DTAgent.exe	"System Tray access to DAEMON Tools Pro from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
N	DAEMON Tools-1033	daemon.exe	"Older version of Daemon Tools Lite from DT Soft Ltd - used to create an image of a CD/DVD/Blu-ray disc and mount the created image-file (.iso
X	Daily Weather Forecast	weather.exe	"Added by the DLOADER-IP TROJAN!"
X	DamedWare Services	dwdrce.exe	"Added by the RBOT-AOJ WORM!"
X	dark	imgst.scr	"Added by the BANCOS.U TROJAN!"
X	dark	imgrt.scr	"Added by the BANCBAN-FH TROJAN!"
X	dark	csrs.scr	"Added by the BANCBAN-GT or BANCBAN-GU TROJANS!"
X	DarkDevil.Grasiele.BR	Grasiele.VBS	"Added by the LEMBRA WORM!"
X	DarKNesS LsasS	LsasS23.exe	Added by an unidentified WORM or TROJAN!
X	DASDS VSAVdjs	dsabdw.exe	"Added by the SDBOT-RE WORM!"
?	DashBarState	dashIE	"??"
?	DashIE	N/A	"Could be related to "Dash Power Shopping" tool bar in IE?"
X	daskaskfsak6	dsfids6.exe	"Added by the ONLINEG-J TROJAN!"
X	daskgfkkcx15	dasdsaads15.exe	"Added by the ONLINEG-Q TROJAN!"
X	dasxdads	fsdqd.exe	"Added by the GAOBOT.BIQ WORM!"
X	Data	System.dat.vbs	"Added by the BISCUIT.A WORM!"
X	data	msngs.exe	"Added by the RBOT-ADQ WORM!"
X	Data File	vdehost.exe	"Added by the SDBOT-DOS TROJAN!"
N	Data LifeGuard LifeLine Lite installer	DLGLI.EXE	"Backweb installer - see here"
X	Data Restore Service	prq8.exe	"Added by the KELVIR.AI WORM!"
X	DATABASE MySql	[path] repcale.exe [path] beird.exe	"Added by the RANDON-AL WORM! Both files are often located in %System%\qsws"
N	DataCaching	FlashKsk.exe	"SmartMedia Card management from the installation of a SanDisk reader for a camera's SmartMedia card and also adds the "Unplug and Eject Hardware" System Tray icon"
N	DataViz Inc Messenger	DvzIncMsgr.exe	"Installed with DataViz ""Documents to Go"" software"
N	DataViz Messenger	DvzMsgr.exe	"DataViz Documents to Go - "allows you to use your Word
X	dbar_starter	starter.exe	"Deskbar adware - adds a search bar to your Windows taskbar which performs searches on www.w-w-w-dot-com.com"
U	DBISQL9	dbisqlg.exe	"Related to SQL Anywhere from Sybase. A comprehensive package providing data management and data exchange technologies"
N	dbserv	dbserv.exe	Database Server for Norton Ghost on Win2k Pro. Ghost works fine when it is disabled
X	dc2k5	SVIQ.EXE	"Added by the COIDUNG-A WORM!"
X	DC6	dc6_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	DC6_Check	uwasdc.exe	"Part of the WinAntiSpyware 2006 and WinAntiSpyware 2007 rogue spyware removers - not recommended"
X	DC6_check	dc6_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
U	DCfssvc	dcfssvc.exe	"Associated with digital cameras and can cause problems which disappear if disabled. If this program is unchecked in startup
U	dcfssve	dcfssvc.exe	"Associated with digital cameras and can cause problems which disappear if disabled. If this program is unchecked in startup
X	DCOM Server	[path to trojan]	"Added by the AGENT-CCQ BACKDOOR!"
X	Dcom System Patch	Microsoft.exe	"Added by the RANDEX.MS WORM!"
X	dcsm	dcsm.exe	"Part of the PrivacyProtector and DriveCleaner rogue security tools"
U	ddoctorv2	sprtcmd.exe /P ddoctorv2	"Comcast Desktop Doctor (provided by SupportSoft
X	DDriver	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
X	DealHelperBrwsr	dhbrwsr.exe	"DealHelper adware"
X	Debug	SMSS.exe	"DreamAd adware. Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	DeeEnEs	DeeEnEs.exe	"DeeEnEs - automatically updates a dynamic IP address when it changes"
X	Default	explore.vbs	"Added by the ALLEM WORM!"
X	Default	mtask.vbe	"Added by the ALLEM WORM!"
X	default	shell32.exe	"Added by the BINGHE TROJAN!"
U	default	mskbw.exe	"PC Surveillance PRO surveillance software. Uninstall this software unless you put it there yourself"
X	Default System Research	vhchost.exe	"Added by the TARNO.I TROJAN!"
X	Default web browser	IexpIore.exe	"Added by the OBLIVION.B TROJAN! Note - do not confuse "IexpIore.exe" with "iexplore.exe" (Internet Explorer)
X	Default_Search_URL	http://find.naupoint.com	"Naupoint browser hijacker"
X	DefensaAntiMalware	pgs.exe	"DefensaAntiMalware
X	Defense Center	defcnt.exe	"Defense Center rogue security software - not recommended
X	DefenseNetSurfage	GDC.exe	"DefenseNetSurfage rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
X	defragsys	svchost.exe	"Added by the BIFROSE-TH TROJAN! Note - this is not the legitimate svchost.exe process which should normally figure in Msconfig/Startup!"
U	DefragTaskBar	defragTaskBar.exe	"System Tray access to Ashampoo® Magical Defrag 2 from Ashampoo GmbH & Co. KG - which ""works is similar to a screensaver. Whenever the computer is idle the program cuts in automatically and starts cleaning up your hard disk"""
U	defragTaskBar.exe	defragTaskBar.exe	"System Tray access to Ashampoo® Magical Defrag 2 from Ashampoo GmbH & Co. KG - which ""works is similar to a screensaver. Whenever the computer is idle the program cuts in automatically and starts cleaning up your hard disk"""
X	DelayLoad	msprint.exe	"Added by a variant of the Win32.Agent.ryo malware - see here"
N	DelayShred	ShrCL.EXE	McAfee Shredder - not required at startup. You can run it manually via McAfee Security Center
?	delcab	deltreew.exe C:cabs	"??"
U	DeleteHistoryFree	dhf.exe	"Delete History Free - ""Privacy protection software for deleting Internet surfing and other computer activity tracks from your PC"""
U	Dell DataSafe Scheduler	DataSafeOnlineScheduler.exe	"Scheduler for Dell DataSafe™ Online which ""helps protect your music
U	Dell PanelMgr	SSMMgr.exe	"Monitors ink levels
N	Dell QuickSet	quickset.exe	Dell taskbar icon allowing you to quickly change settings
N	Dell Wireless Manager UI	wltray.exe	System tray access to wireless LAN card configuration options
N	DellSC	dellsc.exe	Dell Solution Center - web-based troubleshooting tools and educational offerings
U	DellSupport	DSAgnt.exe	Dell Support Agent offers additional support and update features for your Dell computer or laptop
U	DellSupportCenter	sprtcmd.exe /P DellSupportCenter	"Dell Support Center (provided by SupportSoft
?	DellTransferAgent	TransferAgent.exe	"Found on Dell computers. What does it do and is it required?"
X	delmsbb	delmsbb.exe	"180Search adware"
X	delsaap	delsaap.exe	"NCase adware"
?	delstart	delstart.exe	"Reportedly part of BT ISP software - what does it do and is it required in startup?"
X	delsubmit	"rundll32.exe advpack.dll	DelNodeRunDLL32 submit.exe"
U	DeltaIITaskbarApp	DeltaIITray.exe	"System Tray access to the Delta Control Panel for the M-Audio Delta series of PCI audio cards"
X	DeluxeCommunications	Dxc.exe	"Deluxe Communications adware - successor to SurfSideKick"
X	Deneca	Virus salvado	"Added by the DELUZ VIRUS!"
X	Depassx	Xfsa.exe	"Added by the SDBOT-SK WORM!"
U	DepFrez	frzstate.exe	"Deep Freeze from Faronics Coporation. ""Freezes"" the current software configuration so that an a re-boot all changes made refer back to their original settings. Not required for most users - more likely to be used by system administrators
X	deryheruxc	keepSafe.exe	"Added by the KILLAV.KAX TROJAN!"
X	DescargaBromas	"rundll32.exe MSA64CHK.dll	DllMostrar"
?	Description of Shortcuts	*.exe	"* seems to be a sequence of alphanumerics that can be different
X	Desire	desires.exe	Adult content dialler
?	desk-top-service	desk-top-service.exe	"??"
X	DeskAd Service	DeskAdServ.exe	"DeskAd.Service adware"
N	DeskColor	DESKCOLOR.EXE	Provides transparent icon text backgrounds and coloured icon text
N	Deskflag	Deskflag.exe	"DeskFlag - animated USA flag on the desktop"
X	DeskMateAutoUpdate	DeskMateAutoUpdate.exe	"DeskMates: Virtual scantily clad girls enhance your desktop. BargainBuddy adware related"
U	deskmech	deskmech.exe	"Part of Desktop Maestro from PC Tools - which ""combines the features of our award winning products
U	desksaver	desksaver.exe	"Part of Advanced Desktop Shield
U	DeskSaver	DeskSaver.exe	"DeskSaver from Headway Creative - utility that allows you ""to backup and to restore the icons position easily on the Windows desktop"". The Pro version also includes a ""Taskbar Economizer"" which minimizes an open window to the System Tray instead of the taskbar. Located in %ProgramFiles%\Headway Creative\DeskSaver"
U	DeskSaver Pro	DeskSaver.exe	"DeskSaver Pro from Headway Creative - utility that allows you ""to backup and to restore the icons position easily on the Windows desktop"". Includes a ""Taskbar Economizer"" which minimizes an open window to the System Tray instead of the taskbar. Located in %ProgramFiles%\Headway Creative\DeskSaver"
U	desksaver.exe	desksaver.exe	"Part of Advanced Desktop Shield
U	Desksite CMA	cma.exe	"DeskSite CMA siftware - ""retrieves new content from the DeskSite Data Center"""
U	DeskSlide	DeskSlide.exe	"""DeskSlide is utility for automating wallpaper changes on your desktop"""
U	DeskSpace	deskspace.exe	"DeskSpace desktop management utility from Otaku Software Pty Ltd - which ""gives you more space for your windows and icons. You can eliminate desktop clutter by arranging your windows and icons across up to six desktops
X	Desktop	"rundll32.exe msconfd.dll	Restore ControlPanel"
X	desktop	desktop.exe	"Added by the SDBOT.MD WORM!"
X	Desktop	Desktop.com	"Added by the VB-DRN WORM!"
X	desktop	desktop.ini.vbs	"IE-Title malware"
N	Desktop Architect	DATRAY.EXE	"Desktop theme manager available
Y	Desktop Armor	DesktopArmor.exe	"Desktop Armor from Headlight Software - ""watches dozens and dozens of important settings on your computer and warns you if any program has changed them"" including those made by malware"
U	Desktop Calendar	Desktop Calendar.exe	"Desktop Calendar - ""Desktop Calendar is a highly customizable calendar program that turns your desktop into a traditional wall calendar
X	Desktop Defender 2010	Desktop Defender 2010.exe	"Desktop Defender 2010 rogue security software - not recommended
U	Desktop iCalendar	Calendar.exe	"Older version of Desktop iCalendar/Desktop iCalendar Lite by Desksware which include support for Google Calendar and add weather
U	Desktop iCalendar	Desktop iCalendar Lite.exe	"Desktop iCalendar Lite by Desksware - ""is a free desktop calendar for Windows. It allows you to manage your events
U	Desktop iCalendar	Desktop iCalendar.exe	"Desktop iCalendar by Desksware - ""is a handy desktop calendar for Windows. It stays on your desktop and shows the days of the current month. It can sync with your Google Calendar
U	Desktop iCalendar Lite	Desktop iCalendar Lite.exe	"Desktop iCalendar Lite by Desksware - ""is a free desktop calendar for Windows. It allows you to manage your events
U	Desktop iCalendar Lite.exe	Desktop iCalendar Lite.exe	"Desktop iCalendar Lite by Desksware - ""is a free desktop calendar for Windows. It allows you to manage your events
U	Desktop iCalendar.exe	Desktop iCalendar.exe	"Desktop iCalendar by Desksware - ""is a handy desktop calendar for Windows. It stays on your desktop and shows the days of the current month. It can sync with your Google Calendar
U	Desktop Maestro	deskmech.exe	"Part of Desktop Maestro from PC Tools - which ""combines the features of our award winning products
U	Desktop Maestro Vista Tray	RMTray.exe	"Part of Desktop Maestro from PC Tools - which ""combines the features of our award winning products
N	Desktop Plant	AZARE10S.PLT	"Vritual plant from here - this version is an Azalea
X	Desktop Search	desktop.exe	"iSearch adware"
X	Desktop Security 2010	Desktop Security 2010.exe	"Desktop Security 2010 rogue security software - not recommended
N	Desktop Service Centre	DSC.exe	OptusNet DSL or Dial-Up connection software
N	Desktop Weather	THE WEATHER CHANNEL.exe	"Desktop Weather by The Weather Channel - provides current temperature
N	Desktop Weather 3	THE WEATHER CHANNEL.exe	"Desktop Weather 3 by The Weather Channel - provides current temperature
N	Desktop Weather 3	THEWEA~1.EXE	"Desktop Weather 3 by The Weather Channel - provides current temperature
Y	DesktopArmor	DesktopArmor.exe	"Desktop Armor from Headlight Software - ""watches dozens and dozens of important settings on your computer and warns you if any program has changed them"" including those made by malware"
U	DesktopIconToy	DesktopIconToy.exe	"""Desktop Icon Toy is an easy to use desktop icon enhancement tool
U	DesktopMaestro	deskmech.exe	"Part of Desktop Maestro from PC Tools - which ""combines the features of our award winning products
U	DesktopMaestro	RMTray.exe	"Part of Desktop Maestro from PC Tools - which ""combines the features of our award winning products
N	desktopmgr	desktopmgr.exe	"Synchronisation manager for the cradles for the Research In Motion range of wireless handhelds
X	DesktopUpdate	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	DesktopX	DESKTOPX.EXE	"A program that replaces the regular Desktop and Taskbar
N	deskup	deskup.exe	Adds Iomega Zip drive icons to the desktop
U	desp2k	desp2k.exe	"Part of the Turbo Analyzer tool from LightComm Brazil Telecom that analyzes and corrects ADSL configurations"
X	destroyb11	destroyb11.exe	"Added by the DELF-KO TROJAN!"
X	Deus Cleaner	DCleaner.exe	"Deus Cleaner rogue system cleaner utility - not recommended"
X	devenv	smvss.exe	"Added by the DEDLER-G TROJAN!"
X	Device Configuration Loader	msdvc32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Device IO System	deviceio.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Device Management	wnsystem.exe	"Added by the AGOBOT-LH WORM!"
X	Device Security	dvcsecure.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Device Security Driver	devicesec.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Device Security Manager	dvcsecure.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
U	DeviceDiscovery	hpotdd01.exe	"Detection of new imaging
U	Devices	olesvr.exe	"Salfeld Child Control - parental control software"
X	DfqwSfS	ffsqsd.exe	"Added by the SDBOT-SH WORM!"
X	dgtstart	dgtstart.exe	"DigitalNames.g adware"
X	DHCP	smss.exe	"Added by the WINSPY.AG TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\display"
X	DHCP Server	regsvr.exe	"Added by the RBOT-PR WORM!"
X	DHCP32	services.exe	"Added by the WINSPY.AG TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\display"
X	Diagnostic	diagnostic.exe	"Added by the ALPHA-C TROJAN!"
X	Diagnostic Agent	diagent.exe	"Added by the AGOBOT-CW WORM!"
X	Dialer	"rundll32.exe MSA32CHK.dll	Reg"
U	Dialgo SDK	PhoneAnswer.exe	"Dialgo Wave Modem ActiveX - ""Telephone Answering Machine for scripting your own professional call center business scripts using a voice modem. Features Caller-ID
N	Dialog Box Assistant	OSDEx.exe	"Dialog Box Assistant from Duality Software. Helps with the standard Open and Save As dialog boxes by showing recently used files and folders"
X	DIECOX	csrss.exe	"Added by a variant of the ATM.GEN TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Diesel	Recalculate.exe	"Added by the LAZAR TROJAN!"
X	DigiD	DigitalSound.exe	Adware downloader
U	Digisoft AntiDialer	AntiDialer.exe	"Digisoft AntiDialer"
U	DigiSrv	DigiSrv.exe	"Related to camera software from DigitalDreams"
N	Digital Dashboard	devgulp.exe	For Compaq PC's. Loads Digital Dashboard options
X	DigitalNames	DigitalNamesStart.exe	"DigitalNames spyware variant"
N	DigitalWizard	ISWizard.exe	"InstallShield's DigitalWizard - free
U	DIGServices	DIGServices	Created by Disney but licensed to ESPN for watching videos
N	DIGServices	DIGServices.exe	Created by Disney but licensed to ESPN for watching videos
N	DIGStream	digstream.exe	"DIGStream Cache Manager - part of ESPN Motion and Disney Motion that periodically check for new videos and indication they're available in the System Tray. Starting ESPN Motion/Disney Motion starts digstream automatically"
U	Dimension	Dimension.exe	"Dimension - a program which lets you customize MSN messenger such as adding animated and coloured nicknames
U	Dimension4	d4.exe	"Dimension 4 - network time synchronization freeware - starts-up
X	Dinst	dinst.exe	"IMIServer/IEPlugin adware"
X	Direct settings	sdchost.exe	"Added by the DAEMONI-I TROJAN!"
Y	Directory Opus Desktop Dblclk	dopusrt.exe	"Directory Opus - an advanced file manager. ""Directory Opus goes beyond the simple file manager metaphor
X	directs.exe	directs.exe	"Added by the BEAGLE.O or BEAGLE.R or BEAGLE.S or BEAGLE.T WORMS!"
U	DIRECTVDSL	Directvdsl.exe	Starts DirectTV DSL modem at boot up. Can also be started manually
X	directx	Sqlexploit.exe	"Added by the SDBOT.D TROJAN!"
X	DirectX Driver	stdhost.exe	"Added by the SDBOT.GVJ BACKDOOR!"
X	DirectX For Microsoft Windows	dtxservice.exe	"Added by the PROGENT TROJAN!"
X	DirectX for Microsoft Windows	Fservice.exe	"Added by the PRORAT TROJAN!"
X	DirectX for Microsoft Windows	Sservice.exe	"Added by the PRORAT TROJAN!"
X	DirectX For Microsoft® Windows	fservice.exe	"Added by the PRORAT-P TROJAN!"
X	DirectX For Microsoft® Windows	fservice.exe	"Added by the PRORAT-L TROJAN!"
X	DirectX shell driver	[path to trojan]	"Added by the MARKTMAN-B TROJAN!"
X	Directx Startup Drivers	direct.exe	"Added by the RBOT.UXL WORM!"
X	DirectX64	DirectXset.exe	"Added by the BROWNEY.A WORM!"
X	DirectX9	svchost32.exe	"Added by the RBOT.AQG WORM!"
?	Disable EHCI	nousb20.exe	"??"
X	DisableKeybaord	"Rundll32.exe Keyboard	Disable"
X	DisableMouse	"Rundll32.exe Mouse	Disable"
N	Disc Detector	CtNotify.exe	"For Creative sound cards. Detects when you insert a CD
?	disc detector	qnetquestnotifty.exe	"??"
?	discoveg	discoveg.exe	"??"
?	DISCover	DISCover.exe	"Related to DISCover Drop from Digital Interactive Systems Corporation. What does it do and is it required?"
N	DiscoverDeskshop	Deskshop.exe	"Discover Deskshop - single use ""virtual"" credit card"
U	DiscUpdateManager	DiscUpdMgr.exe	"Disc Update Manager for Digital interactive's DISCover Console. Provider of on-demand video games"
N	DiscUpdateManager	DiscUpdateMgr.exe	"DISCover from Digital Interactive Systems Corporation Inc. ""The company's patented Drop 'n' Play technology provides a simple
U	DiscWizardMonitor.exe	DiscWizardMonitor.exe	"Seagate DiscWizard - hard disk utility for Seagate's SATA and PATA (IDE) drives"
X	Disk Check	chkdsk32.exe	"Added by the IM TROJAN!"
U	Disk Cleaner	DiskCleaner.Exe	"Hard disk management part of TuneUp Utilities from TuneUp Distribution GmbH"
X	Disk Defragmentation Loader	pmsvcr.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Disk Essensial Tools	detsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Disk Keeper	[path to trojan]	"Added by the SMALL-VE TROJAN!"
X	Disk Keeper	SECURITY.EXE	"Daosearch adware"
X	Disk Manager	diskver.exe	"Added by the RBOT.AQT WORM!"
X	Disk Master	[trojan name]	"Added by the DISTER TROJAN! - a spam relayer"
X	Disk Panel Configuration	dpcsvc.exe	"Added by the IRCBOT.BSQ BACKDOOR!"
X	Disk Panel Setup	npcsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	DiskCheck	msdarkend.exe	Added by an unidentified WORM or TROJAN!
N	DiskeeperSystray	DkIcon.exe	"DisKeeper defragmentation software - can be started manually"
X	diskinf	diskinf.exe	"Added by the CRYPTER.A TROJAN!"
?	DISKMON.EXE	DISKMON.EXE	"??"
N	Disknag	disknag.exe	Dell program that reminds you to make your backup diskettes
X	DiskRetter	SysRep.exe	"DiskRetter
X	Diskstart	Code.exe	Adult content dialler
X	Diskstart	cat.exe	MS-Connect dialler
X	Diskstart	hit.exe	Adult content dialler
X	Diskstart	Snt.exe	Adult content dialler
U	DiskSuite	aDSProcMngr.exe	"Part of PC Tools Disk Suite from PC Tools - which ""is an all-in-one hard-disk management utility that integrates disk optimization
U	Disk_Monitor	Disk_Monitor.exe	"Multi-media
X	disnisa	disnisa.exe	"Added by the DORF-AE WORM!"
X	Dispatcher	dispatcher.exe	"Added by the DLOADR-AS TROJAN!"
X	dispenter	dispenter.exe	"Added by the AGENT-MKK TROJAN!"
U	display	The_Eye.exe	"ComSpySysSvr surveillance software. Uninstall this software unless you put it there yourself"
X	Display	backup.exe	"Added by the BRONTOK-CR WORM!"
X	Display Drivers	cssrs.exe	"Added by the AGOBOT.FX WORM!"
N	Display Settings	hptasks.exe	"Allows for the adjustment of the display for LCD screen
U	DisplayFusion	DisplayFusion.exe	"DisplayFusion from Binary Fortress Software - ""is a fantastic application that can make your dual monitor (or triple monitor or more) life much
N	DisplayTrayIcon	TrayIcon.exe	"System Tray access to display properties for ABIT graphics cards. Unless you change your desktop resolution
U	Disspy	disspy.exe	"Disspy spyware detection and removal software"
X	Dist-FBGeneve	GDC.exe	"NettoyeurDePC French rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
N	Distiller Assistant 3.01	DISTASST.EXE	From Adobe. Creates PDF universal files for Acrobat Reader. Available via Start -> Programs
X	Distributed File System	Dfsvc.exe	"Added by the MYFIP.A or MYFIP.K WORMS!"
X	Distributed File System	kernel32dll.exe	"Added by the MYFIP-C or MYFIP.K WORMS!"
X	Distributed File System	blade.exe	"Added by the MYFIP.AC WORM!"
X	Distributed File System	win.exe	"Added by the MYFIP.AB WORM!"
X	Distributed Link Tracking	ascvt.exe	"Added by the AGOBOT-GH BACKDOOR!"
U	distributed.net client	DNETC.EXE	"Dsitributed computing projects client from Distributed.net where numerous computers are used to share a projects workload - similar to SETI@Home and Folding@Home. Also prone to being distributed by viruses"
N	DiTask.exe	DiTask.exe	"Associated with an Eicon Networks ISDN or ADSL modem. System Tray icon which shows you the status of your lines (free
?	Dixons Insert Detect	InsDetect.exe	"Part of Dixons Picture Suite. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
X	djdsdvqwa	vjdhdg.exe	"Added by the SDBOT-EF BACKDOOR!"
N	DJRegFix	regedit /s c:hpdjregfix.reg	"DJRegFix showed up first in WinME as a ""clever"" way to ensure that all Hewlett-Packard DeskJet printers actually worked with WinME - since most were having major problems. This ""utility"" adds the functionality and compatibility HP forgot to add in its WinME drivers"
?	DJSNetCN	DJSNetCN.exe	"""Symantec Licensing Detect Internet Connection""
Y	DkService	DkService.exe	"From Executive Software's Diskeeper defragmenting utility - a replacement for Windows Disk Defragmenter. It's recommended to leave this enabled
Y	dla	tfswctrl.exe	"Drive letter access to a UDF packet writer for CD-RW - from HP
N	dlbcserv	dlbcserv.exe	Related to Dell Photo Printers and provides additional configuration options for these devices
Y	DLBTCATS	"rundll32 [path] DLBTtime.dll	_RunDLLEntry@16"
Y	DLBUCATS	"rundll32 [path] DLBUtime.dll	_RunDLLEntry@16"
Y	DLBXCATS	"rundll32 [path] DLBXtime.dll	_RunDLLEntry@16"
Y	DLCCCATS	"rundll32 [path] DLCCtime.dll	_RunDLLEntry@16"
Y	DLCDCATS	"rundll32 [path] DLCDtime.dll	_RunDLLEntry@16"
Y	DLCFCATS	"rundll32 [path] DLCFtime.dll	_RunDLLEntry@16"
Y	DLCGCATS	"rundll32 [path] DLCGtime.dll	_RunDLLEntry@16"
Y	DLCICATS	"rundll32 [path] DLCItime.dll	_RunDLLEntry@16"
X	dlcipscl	dcpavss.exe	"Added by the MAILBOT-CB TROJAN!"
Y	DLCJCATS	"rundll32 [path] DLCJtime.dll	_RunDLLEntry@16"
Y	DLCQCATS	"rundll32 [path] DLCQtime.dll	_RunDLLEntry@16"
Y	DLCXCATS	"rundll32 [path] DLCXtime.dll	_RunDLLEntry@16"
X	dlhost	dlhost.exe	"Added by the EXPHOOK-A TROJAN!"
X	DLINK dfe drivers for Windows NT	windfe.exe	"Added by the RANDEX.AK WORM!"
U	DLink System Tray	dlnetst.exe	"Related to D-Link DGE-530T PCI card for servers and workstations"
X	Dll Boot Loader on Startup (do not remove this)	[various filenames]	Added by an unidentified TROJAN!
X	Dll Link	svchoist.exe	"Added by the AUTOSKY WORM!"
X	Dll Link	svchost.exe	"Added by the AUTOSKY WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Favourites folder"
X	DLL Service Manager	[path to worm]	"Added by the RPCBOT.F TROJAN!"
X	dll services	[random filename].exe	"Added by a variant of the SDBOT WORM!"
X	DLL32	dllhost.dll	"Added by the SUCLOVE.A WORM!"
X	dllcvss	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	DLLHost	dllhst.exe	"Added by the DELBOT-AC WORM!"
X	DllHost	dllhost.exe	"Added by the PROSTI.AA BACKDOOR! Note - this is not the legitimate dllhost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Inf"
X	dllhostxp.exe	dllhostxp.exe	Browser hijacker and adware downloader
X	DllLoader	lssas.exe	"Added by the BDOOR-JE BACKDOOR!"
X	DLLService32	dllsvc32.exe	"Added by the AGOBOT.VX WORM!"
U	DLPSP	DLPSP.EXE	Dell laser printer status monitor
X	dlsp2mx	dlsp2mx.exe	"Added by the MPB-B DIALER! An uninstall option can be accessed via the Add or Remove Programs dialog in the Windows Control Panel. The software is listed as ""dlsp2mx"""
X	Dm Hr	lpns.exe	"Added by the IRCBOT.WORM.61673 WORM!"
N	DMAScheduler	DMAScheduler.exe	"Related to DigitalMedia Plus Archiver. This program is non-essential process to the running of the program
N	DMISL	DMISL.EXE	"DMI (Desktop Management Interface) Service Layer for Intel TokenExpress network card software. DMI support for the Intel network card managed through the Desktop Management Interface. See here for more information"
N	DMISLAPP	DMISLAPP.exe	"DMI (Desktop Management Interface) Service Layer for Intel TokenExpress network card software. DMI support for the Intel network card managed through the Desktop Management Interface. See here for more information"
X	Dmsvc32	Dmsvc32.exe	"Added by the AGOBOT.ABU WORM!"
X	dm[3 random letters].exe	dm[3 random letters].exe	"Added by the RUINDEM TROJAN!"
X	DM_server	dmserver.exe	"Comet Cursor adware"
X	dm_service	[path to file]	"Added by the MITGLIEDER.P TROJAN!"
X	dnam	d140113.a.Stub.EXE	"Added by the STUB_A TROJAN!"
Y	DNE Binding Watchdog	"rundll dnes.dll	DnDneCheckBindings"
Y	DNE DUN Watchdog	"rundll dnes.dll	DnDneCheckDUN13"
X	DNS	mc-58-12-0000080.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-58-12-0000093.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-110-12-0000079.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-58-12-0000120.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	mc-58-12-0000140.exe	"Shorty adware - also detected as the AGENT.FD TROJAN!"
X	DNS	[worm filename]	"Added by the BCKDR-CQG BACKDOOR!"
X	DNS Config service	win32.exe	"Added by the RBOT-TL WORM!"
X	Dns Resolver	dnsrslve.exe	"Added by the RBOT-WS WORM!"
X	DNS Service	dnsresolver.exe	"Added by the RBOT-PQ WORM!"
X	DNS Service	dnssvc.exe	"Added by the DELBOT-Z WORM!"
?	DNS2GoClient	dns2goclient.exe	"DNS2Go is a Domain Name System that will make your computer accessible anytime
N	DNS7reminder	Ereg.exe Ereg.ini	"Registration reminder for versions of Nuance (ScanSoft) Dragon NaturallySpeaking"
X	DnsCache	Wscript.exe dns_cache.vbs	"Added by the AUTORUN-AWI WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""dns_cache.vbs"" file is located in %System%"
X	DNSCacheBoost	dnsping.exe	"Added by the DNSBUST-A TROJAN!"
X	dnscleaner	dnscleaner.exe	"CoolWebSearch parasite variant"
X	DNSE	DNSE.exe	"Part of rogue security tools
X	Doctor Antivirus 2008	antvr.exe	"Doctor Antivirus 2008 rogue security software - not recommended
X	Doggy Style	MsPMSPSd.exe	"Added by the SDBOT-AAP WORM!"
X	DOGStart	GSDOGST.EXE	"Added by an unidentified VIRUS
X	DokterFix	SysRep.exe	"DokterFix
X	Domain Name Resolve Service	dnsresolver.exe	"Added by the KIMAN.A WORM!"
X	DomPlayer Service	wakeservice.exe	"DomPlayer adware"
U	Don't Panic Pop-Up Stopper	dpps2.exe	"Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group"
X	Dontworry	mysaym.exe	"Added by the SDBOT-RC WORM!"
U	Dopus	dopus.exe	"Directory Opus - a file manager from GPSoft"
N	DoroServer	DoroServer.exe	"Doro PDF Writer from The SZ Development. All what you need for creating pdf files"
X	dos	dos64.exe	Adware downloader trojan
X	Dos Prompt Loader	cygwin.exe	"Added by the SDBOT-VV WORM!"
?	Dosbat	??	"??"
U	DoubleDesktop	dd.exe	"""DoubleDesktop is a smart and elegant system tray utility that effectively doubles the width of your Windows desktop"""
X	Dowmingzu	Dowmingzu.dll.vbs	"Added by the SOLOW-E WORM!"
N	Download Accelerator Plus 5.0	DAP.exe	"Download Accelerator Plus from Speedbit. Download manager for resuming downloads
X	Download Plus	DownloadPlus.exe	"DownloadPlus adware"
X	DownloadLegalMusic	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	DownloadMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	DownloadsAndMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	downs	downs.exe	"Added by the BCKDR-MNR TROJAN!"
Y	DPAS	DPASNT.exe	"DefenderPro AntiSpy spyware remover - now incorporated Defender Pro 15-in-1 and 5-in-1"
Y	DPASUpdate	DPASAutoUpdate.exe	"Automatic updates for DefenderPro AntiSpy spyware remover - now incorporated Defender Pro 15-in-1 and 5-in-1"
Y	DPCProxyLoadOnStartup	dpcstart.exe	"DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access"
Y	Dpcstart	dpcstart.exe	"DirecWay from DirectTV (now HughesNet) - satellite based high-speed internet access"
X	dpnsvr32	dpnsvr32.exe	"Added by the AOLPASS-B TROJAN!"
U	dpps2	dpps2.exe	"Pop-Up Stopper Companion from Panicware. Pop-up blocker integrated into the IE toolbar. Note that the Pro version doesn't load in startup as it is installed as an Internet Explorer toolbar. Can cause problems with IE if you use WinXP and uninstall Service Pack 1. Uninstalling the software leaves it in the startup group"
X	dps	dps.exe	"SmartestSearch parasite - poses as a foistware
X	DR service	[path to worm]	"Added by the RBOT-CZT WORM!"
N	Drag-to-Disc	DrgToDsc.exe	"System Tray access to Roxio Drag-to-Disc - part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools. ""Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically"". Not required for Roxio to work properly and available via the Start menu"
X	DRam Monitor 23	tskman3.exe	"Added by a variant of the RBOT WORM!"
X	DRam prmaessor	[random filename]	"Added by the RBOT.CSG WORM!"
X	DRam prosesor	[random filename]	"Added by the SPYBOT.EE WORM!"
X	DRam prosessor	[random filename]	"Added by the RBOT.CSG WORM!"
X	DRam prosessor	plscd.exe	"Added by the RBOT.CYA WORM!"
X	DRam prosessor	HWAPI.exe	"Added by a variant of the RBOT WORM! Note - this is not the McAfee HackerWatch process which has the same filename"
X	DRam prosessor	WindowsUpdate.exe	"Added by the RBOT-BBZ WORM!"
X	DRam prosessor	msupdate.exe	"Added by the DELF-FAW TROJAN!"
X	DRam prosessor	winupl.exe	"Added by the RBOT-BCQ WORM!"
X	DRan posessor	DAP.exe	"Added by a variant of the SDBOT WORM!"
X	DrAntispy	DrAntispy.exe	"DrAntiSpy rogue security software - not recommended"
X	DrCache	MSTDC.EXE	"Added by the BDOOR-JM BACKDOOR!"
X	dreams	server.exe	"Added by a variant of the SDBOT WORM!"
X	DrefIW	SysDrefIWv2.exe	"Added by the DREF-C WORM!"
X	DrefIW	SysDref.exe	"Added by the DREF-D WORM!"
N	DrgToDsc	DrgToDsc.exe	"System Tray access to Roxio Drag-to-Disc - part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools. ""Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically"". Not required for Roxio to work properly and available via the Start menu"
U	DriveIcons	DriveIcon.exe	"Drive Icons from Realtek - shows a specific icon for each card type for their card reader controllers"
X	Driver32	Scam32.exe	"Added by the SIRCAM WORM!"
X	DriverCheck	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	DriverDB	svcmdx32.exe	"Added by the BERPI TROJAN!"
X	DriverLoad	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
U	DriverMagicLogon	dmschedule.exe	"Part of DriverMagic - ""the easiest way to locate device drivers"""
N	DriverMax	devices.exe	"DriverMax from Innovative Solutions - ""a new tool that allows you to download the latest driver updates for your computer. No more searching for rare drivers on discs or on the web or inserting one installation CD after the other"""
X	DriverModule	csrnvrt.exe	"Added by the IRCBOT.I TROJAN!"
X	DriverPath	system32.exe	"Added by the PRORAT-S TROJAN!"
X	Drivers for Internet Explorer	accesweb.exe	"Added by the STARTPAGE.FW TROJAN!"
X	Drives swap	AV1i.exe	"Anti-Virus Number-1 rogue security software - not recommended
N	DriveSelect	driveselect.exe	"DVD X Copy XPress by 321 Studios. Creates a pop-up at Windows startup that asks for the DVD drive to be selected. Available via Start -> Programs"
X	DriveSystem	maxpaynowti1.exe	"Added by the TIBS.AZT TROJAN!"
U	dRMON SmartAgent	SmartAgt.exe	"Part of the network monitoring program group for 3Com NIC cards. See here for more info"
X	drmsrv32	stmhosts.exe	"Added by the AGENT.AGWU TROJAN!"
X	Drmupgds	Drmupgds.exe	"Maxfiles adware"
X	DropSpam Lifestyle	dslifestyle.exe	"Dropspam adware"
?	DrvListnr	DrvListnr.exe	"Analog Devices SoundMAX soundcard related. What does it do and is it required?"
U	drvlsnr	drvlsnr.exe	Compaq/ADI SoundMAX integrated digital audio controller related. May solve a problem if your sound cuts out unexpectedly
X	DrvStart	HPMedia.exe	"Added by the BANCBAN-QE TROJAN!"
X	drvsys.exe	drvsys.exe	"Added by the BEAGLE.W WORM!"
X	drvsyskit	hidr.exe	"Added by the BAGLE.HR WORM!"
X	drvsyskit	hldrrr.exe	"Added by the BAGLE.QU TROJAN!"
X	drv_st_key	hidn.exe	"Added by the BEAGLE.FF WORM!"
X	DrWatson	drwatson_.exe	"Added by the LOHAV-S TROJAN!"
X	DrWatson	drwatson_32.exe	"Added by the LOHAV-S TROJAN!"
X	DrWeb Antivirus	DRWEBAV.EXE	Added by an unidentified WORM or TROJAN!
Y	Drwebscheduler	Drwebscd.exe	"DrWeb antivirus related - scheduler that allows you to manage an automatic launch of applications
X	DR_S	DR_S.exe	"IstBar adware"
X	ds	ds.exe	"Added by the SPYMON TROJAN!"
U	DS Clock	dsclock.exe	"Digital desktop clock including synchronization with atomic servers - see here"
X	dS35DLL	ffqca.exe	"Added by the SDBOT-KV WORM!"
X	dsa	dsa.exe	Homepage hijacker - redirecting to downseek.com
X	DSAcass	[path to file]	"Added by the RANKY.M TROJAN!"
X	dsadlsa14	dsakfsak14.exe	"Added by the ONLINEG-P TROJAN!"
X	DSB	DSB.exe	"EnergyPlugin adware"
U	dscactivate	dsca.exe	Dell Support Agent offers additional support and update features for your Dell computer or laptop
X	dsd	zz.exe	"Added by the RBOT-FOX WORM!"
N	DSentry	DSentry.exe	"Anti-spyware from Dell. Seems that after Dell found out certain applications being installed from DVD's would report back information about what customers were watching
X	dsfghjgj	keepSafe.exe	"Added by the KILLAV.KAX TROJAN!"
X	dsgb	lcsass.exe	"Added by the AGENT.TGZ BACKDOOR!"
X	Dsi	dp-******.exe	Added by an unidentified adware where ****** are random characters
X	Dsi	dp-him.exe	"Added by the MULTIDR-AH TROJAN!"
X	Dskcompat	Dskcompat.exe	"Added by the GEMA TROJAN!"
U	DSKEY	DsKey.exe	"Part of PC PhoneHome - ""secretly sends an invisible email message to an email address of your choice containing the physical location of your computer every time you get an Internet connection"". Security software from Brigadoon Security Group for tracking down lost/stolen computers"
X	DSKEY	[path to trojan]	"Added by the STARTER-G TROJAN!"
N	DSL Monitor	spdstrm.exe	Comes with Efficient Networks DSL Modems. Little red/green/yellow flashing icon in system tray
Y	DSLagentexe	DSLagent.exe	"Used in conjunction with USB connected ADSL modems from Eicon Networks (as used by BT for its Broadband internet service for example). Required for a permanent ADSL connection"
Y	dslmon	dslmon.exe	Sagem DSL modem related. Apparently needed to detect the modem
U	DSLSTATEXE	dslstat.exe	System tray connection status for ADSL modems from Eicon Networks (as used by BT Broadband for example)
X	DsmSer	dsm.exe	"Added by the SERFLOG.B WORM!"
X	DsmSer	msmpatch.exe	"Added by the SERFLOG.B WORM!"
X	DsmSer	svosm.exe	"Added by the SERFLOG.B WORM!"
X	DsmSer	sysup.exe	"Added by the SERFLOG.B WORM!"
Y	DSndUp	DSndUp.exe	"Utility that only runs once after installing the drivers for Analog Devices SoundMax integrated soundcards. It's exact purpose is unknown at the present time but from the filename it's probably used to configure the default or generic speaker arrangement for the system it's used on"
X	DsplObjects	windspl.exe	"Added by the BEAGLE.DN WORM!"
X	DSS	dssagent.exe	"Registration reminder for Mattel Interactive (Broderbund) applications and games. Spyware as it sends encrypted emails about the system back to the originators of the program. Also a resource hog. See here for more info"
X	DSS	[path to trojan]	"Added by the DSSDOOR-C TROJAN!"
X	DSService	dmrss.exe	"Added by the AGOBOT-XX WORM!"
?	DSSSGENS	dssagens.exe	"??"
X	dstiosys	plsitctl.exe	"Added by the MAILBOT-BX TROJAN!"
X	DSystemDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
U	DT 11Mbps WLAN PC Card Station	DTCARDMonitor.exe	11Mbps PC Card based wireless LAN connection monitor - possibly from Deutsche Telekom
U	DT 11Mbps WLAN USB Station	DTUSBMonitor.exe	11Mbps USB based wireless LAN connection monitor - possibly from Deutsche Telekom
U	DT Task	DTHtml.exe	"Display Tune from Portrait Displays
U	DualCoreCenter	StartUpDualCoreCenter.exe	"Unified control center for overclocking both the graphics card and the CPU
?	Duane Reade Insert Detect	InsDetect.exe	"Part of Duane Read Picture Suite & Digital Image Pack. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
N	Dulux WeatherShield WeatherDesk	weather.exe	"Dulux WeatherShield WeatherDesk - latest weather information from across Australia"
X	Dumeter Services	dumeter.exe	"Added by the SDBOT-AEQ WORM!"
X	dumprep	spoolc.exe	"Detected by Kaspersky as a variant of the AGENT.CXF TROJAN!"
X	DUN_SERVICES3	dun3.exe	"Added by the SOKIRON TROJAN!"
X	Duwee wong Cerbon	Cirebons.exe	"Added by the BHARAT.A WORM!"
X	DVAScvssdfa	AsSDdwd.exe	"Added by the LIOTEN.IP TROJAN!"
N	DVD@ccess	DVDAccess.exe	"Part of DVD Studio Pro from Apple Inc. - ""The DVD@CCESS feature allows you to add additional interactivity to your DVD title when it is played on a computer"""
U	DVDBitSet	DVDBitSet.exe	DVD+RW Drive/Disc Compatibility Setting. Installed with HP DVD+RW drives to enhance compatibility with existing readers. You can also set a DVD+RW default drive write mode which is always used
N	DVDSentry	DSentry.exe	"Anti-spyware from Dell. Seems that after Dell found out certain applications being installed from DVD's would report back information about what customers were watching
N	DVDXGhost	DVDGhost.EXE	"DVD Ghost - ""utility to make your software DVD players and DVD copy/backup softwares restriction-free
X	dvsfss	fbsfsdrs.exe	"Added by the SDBOT-QA WORM!"
U	DVSync	dvsync.exe	DVSync is the program that allows you to synchronize your daVinci's PDA's data with your Personal Information Manager on the PC
X	Dvx	wsxsvc.exe	"Delfin Media Viewer or ""Promulgate"" adware variant"
N	DW4	DesktopWeather.exe	"Desktop Weather 4 by The Weather Channel - provides current temperature
N	DW6	DesktopWeather.exe	"Desktop Weather 6 by The Weather Channel - provides current temperature
N	DwlClient	support.exe	Download manager for Dell support alerts
X	dwqblwrsq.exe	[random].exe	"Okcashbackmall adware"
N	dwStart	FireWall.exe	"The Shield firewall from pcsecurityshield.com. Not recommended by some (see here) and there are better free alternatives out there such as Zone Alarm. Located in %ProgramFiles%\PCSecurityShield\The Shield Firewall"
X	DW_Start	rwwnw64d.exe	Identified as a variant of the AdWare.Win32.ZenoSearch.am malware
X	Dx	sys*.exe [* = random number]	"Added by the DEXTER.A WORM!"
X	dxdiag diagnose	msidxdia.exe	"Added by a variant of the RBOT WORM!"
X	dxdiags.exe	dxdiags.exe	"Added by the CERTIF-G TROJAN!"
X	dxmsrv	dxmsrv.exe	Added by an unidentified WORM or TROJAN!
X	Dxsty	Dxsty.exe	"Added by the GEMA TROJAN!"
X	Dynamic Dns Binary	dynitora.exe	"Added by the RBOT-WT WORM!"
X	Dynamic Dns Binary	CMD16.EXE	"Added by the RBOT-XM WORM!"
X	Dynamic Dns Binary	winxp34.exe	"Added by a variant of the RBOT WORM!"
X	Dynamic Dns Binary	WinHelpcfn.exe	"Added by a variant of the RBOT WORM!"
U	DynDNS Updater	DynDNS.exe	"Dynamic DNS IP address updater tool
N	DynDNS-Updater Traytool	ddutray.exe	"DynDNS updater tray icon - allows easy configuration of the Dynamic DNSSM service. Can be run manually"
X	DynHttp Dns Binary	dynizari.exe	"Added by a variant of the RBOT WORM!"
U	DynSite	DynSite.exe	"DynSite - dynamic DNS client
U	Dynu Basic Client	dynubas.exe	"Dynu online dynamic IP update client. Useful when using a dial up modem"
?	DZKillMe	DZSAVEME.EXE	"??"
N	E-Color Registration	SonnReg.exe	"Registration for Colorific® and 3Deep® monitor calibration sofware from E-Color. Now superseded by ColorWizzard™ and 3DxWizzard™"
X	E-nrgyPlus	E-nrgyPlus.exe	"Energyplus - tracks internet activity including websites visited and queries made at popular search engines. This information along with some system information is sent to a remote site"
U	e-Surveiller Station	estation.exe	"ESurveiller - surveillance software. Uninstall this software unless you put it there yourself"
N	E6TaskPanel	TaskPanl.exe	"Earthlink Task Panel - part of Earthlink TotalAccess 2003 internet access software. Quick access to internet
U	eabconfg.cpl	EabServr.exe	Easy Access Buttons control panel on Compaq laptops. Only required if you use the extra keys
?	Eac_rnvdl	ANTIVIRUS_INSTALL.EXE	"??"
Y	EAFRCliStart	EAFRCliStart.exe	"Related to Encryption Anywhere hard disk encryption products from GuardianEdge"
U	eanthology_install.exe	eanthology_install.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
U	eanth_critical_update_alert	sys_alert.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
U	eanth_system_patcher	sys_alert.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
N	Eapcisetup	sbsetup.exe	Rockwell RipTide soundcard application software. Sound works without it
N	EAPCISETUP	wizard.exe	Part of the Creative Sounblaster PIC Installation Wizard. Probably left as a result of a failed installation
N	Easy CD Creator	RoxAssist.exe	"Roxio Assistant is designed to correct engine initialization errors in Easy CD & DVD Creator 6. If the engine does not initialize
U	Easy Key	easykey.exe	For programming of the built-in functions keys on some laptops (and maybe desktops). Required if these are used
N	Easy Start Button	esb.exe	Provides functionality on certain laptops that have additional keys. Not required unless you use the extra keys
U	Easy-PrintToolBox	BJPSMAIN.EXE	A utility to launch the applications that are bundled with a Canon bubblejet printer
X	EasyAV	EasyAV.exe	"Added by the NETSKY.S or NETSKY.T WORMS!"
X	EasyDates	EasyDates.exe	Premium rate adult content dialler
X	EasyDates_gb	EasyDates_gb.exe	"""Edate-A"" premium rate adult content dialler"
X	EasyDates_nl	EasyDates_nl.exe	Adult content dialler
U	EasyKey	easykey.exe	For programming of the built-in functions keys on some laptops (and maybe desktops). Required if these are used
U	EasyKeyboardLogger	EasyKeyboardLogger.exe	"EasyKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself!"
U	EasyLinkAdvisor	LinksysAgent.exe	"Linksys EasyLink Advisor - ""the free application that provides and easy way to setup
X	EasyMessage	em2.exe	"180solutions adware"
N	EasyNetwork	McENUI.exe	"McAfee's EasyNetwork user interface - ""enables secure file sharing
X	EasySearchBar	ESBUpdate.exe	EasySearchBar adware downloader
X	easyServ	Server.exe	"Added by the EASYSERV TROJAN!"
X	EasySpywareCleaner	EasySpywareCleaner.exe	"EasySpywareCleaner rogue spyware remover - not recommended
U	EasySync Pro	XCPCMenu.exe	"""IBM® Lotus® EasySync® Pro is a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - 3CmPlm	AutoDet.exe	"3Com Palm PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - LtNts4	NtsAgent.exe	"Lotus Notes 4 specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - PocketPC	AUTODE~1.EXE	"Windows Mobile Pocket PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - PocketPC	AutoDetect.exe	"Windows Mobile Pocket PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasyTuneIII	EasyTune.exe	Tuning (overclocking) utility for Gigabyte motherboards. Shortcut available
U	EasyTuneIV	ET4Tray.exe	Tuning (overclocking) utility for Gigabyte motherboards. Shortcut available
U	EasyTuneV	GUI.exe	Tuning (overclocking) utility for Gigabyte motherboards. Shortcut available
X	easywww	easywww2.exe	"Added by an unidentified VIRUS
X	EbatesMoeMoneyMaker	wjview ...Code	"Ebates adware"
X	EbatesMoeMoneyMaker0	EbatesMoeMoneyMaker0.exe	"Ebates adware"
X	ebmmm	ebatesmmmv.exe	"Ebates adware"
U	eDataSecurity Loader	eDSloader.exe	"Part of Acer Empowering Technology. ""Acer eDataSecurity Management is a handy file encryption utility that protects files from being accessed by unauthorized persons
?	EDFcsn	discfcsn.exe	"Related to Hewlett-Packard's Discovery Agent. What does it do and is it required?"
U	EDRestore	??	"Set Point from Easy Desk Software - ""small utility that automatically sets System Restore points for WinME/XP"""
X	EDxMC110	Isass.exe	"Added by the VB-NIA WORM!"
X	Edzy AntiVirus	dppsfa.exe	"Added by a variant of the RBOT WORM!"
X	Efata	[random 5 characters].exe	"Added by the FLUKAN-D WORM!"
X	efaxs lptt01	efaxs.exe	"RapidBlaster variant (in a ""efaxs"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	efaxs ml097e	efaxs.exe	"RapidBlaster variant (in a ""efaxs"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
U	EFI Hot Folders	hffw.exe	"""EFI Hot Folders improves productivity by simplifying the printing of PostScript and PDF files into a select
N	EgisTecLiveUpdate	EgisUpdate.exe	"Software updater for biometric and data encryption products from EgisTec Inc"
X	ehSched	ehSched.exe	"Added by the SDBOT-DHF WORM!"
U	Eicon NetworksLAN_DAEMON	watch.exe	"Associated with an Eicon Networks ISDN or ADSL modem. Watch protocols your connection with numbers and duration. You need callvu.exe (from Start Menu) to see your connection statistics. You can manually start watch.exe before you go online. Needs diinfo.exe (started by DiTask) to work correctly which can be started manually"
X	eKerberos	eKerberos.exe	"eKerberos rogue security software - not recommended"
U	ELBERTRicoh_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Ricoh MFP Type 104 multifunction printer
U	ELBERT_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX-5x30 Series multifunction printers
U	Electron Microscope	EMIII.exe	"Electron Microscope or EM - is a program used to track Stanford's distributed computing program client called Folding at Home
X	element furth	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are often located in %System%\vert"
X	ELNKProxy	smproxy.exe	"Surfmonkey adware"
U	ELSA WINman Suite	Winmsuit.exe	"Allows you to totally customize your ELSA graphics card settings
Y	ElsaCapiCtl	Rcapi.exe	"Assumed to stand for Remote Common Application Programming Interface (RCAPI)
U	ELSAChipGuard	elsavect.exe	"ChipGuard for ELSA graphics cards - monitoring solution which monitors both the GPU temperature and fan speed
U	ELSBLaunch	ELSBLaunch.exe	"EarthLink SpamBlocker"
U	eMachines eBoard	Eboard.exe	eMachines multimedia keyboard manager. Required if you use the extra keys
Y	EmailScan	mcvsescn.exe	Related to McAfee AntiVirus suite - used to automatically scan incoming e-mails
X	eMakeSV	EMAKESV.EXE	"""Switch"" adult content dialer"
X	eMakeSV	EMAKE2B.EXE	"""Switch"" adult content dialer"
U	EMBASSY Trust Suite Secure Update	AutoUpdate.exe	"Updates for Wave Systems Corp. Embassy Trust Suite - ""delivers advanced levels of security to the client PC using the TPM security chip found on most enterprise PCs today"""
X	eMCryT Sh3ars Panagers	[path to worm]	"Added by the RBOT-AWI WORM!"
X	eMessenger	emsn.exe	"Added by the RBOT.AHO BACKDOOR!"
U	Emouse	Emouse.exe	"Genius mouse driver - required if you use non-standard Windows driver features"
X	empin	e121307.Stub.exe	"Delfin Media Viewer adware related"
Y	Emsisoft Anti-Malware	a2guard.exe	"System Tray access to and Anti-Malware Guard feature of Emsisoft Anti-Malware from Emsi Software GmbH - which provides ""comprehensive PC protection against viruses
X	emsw.exe	emsw.exe	"Attune HelpExpress - spyware. Disable and uninstall - see here"
N	eMuleAutoStart	emule.exe	"eMule - ""one of the biggest and most reliable peer-to-peer file sharing clients around the world. Thanks to it's open source policy many developers are able to contribute to the project
N	eMusicClient Systray	eMusicClient.exe	"eMusic MP3 download software"
N	EN4060C Taskbar	en4060ct.exe	Comes with Efficient Networks DSL Modems. Little red/green/yellow flashing icon in system tray
X	enBrowser	[name of file]	"WINBO adware"
?	encapsulated command tool	wintr.com	"??"
N	Encarta Dictionary Quickshelf	QSHLFED.EXE	"Provides quick access to Encarta's Dictionary features?"
U	Encompass_ENCMONTR	ENCMONTR.EXE	Optional simple browser from Yahoo (Encompass)
?	ENCSurf	surfboard.exe	"??"
N	Energizer FileSaver	Energizer FileSaver.exe	"Energizer FileSaver - UPS back-up utility for Energizer UPS products. From their Tech Support staff this is known to have a memory leak since it's release - with no fix planned! It will grab 2-5 handles per second and crash the average system in less than 3 days - therefore not recommended"
U	enginecs2	enginecs2.exe	"Cyber Sentinel - internet filtering software"
N	EnigmaPopupStop	EnigmaPopupStop.exe	"Part of Enigma SpyHunter - not recommended
?	ENSApServer2_0	APSERVER.EXE	"Intel AnyPoint Wireless II Home Network related. Now discontinued. What does it do and is it required?"
?	ENSMIX32.EXE	ENSMIX32.EXE	"Sound card driver. Is it required?"
U	EnsoniqMixer	starter.exe	"Puts the Ensoniq mixer in system tray. From Ensoniq Technologies ""Our mixer is a critical part of the soundcard as it fixes sound problems and replaces the MS mixer which can no longer be used"". If you find you don't need it - try one of the solutions on this special page. Similar to Creative PCI Audio Configuration Utility"
U	Entbloess 2	Entbloess2.exe	"Related to Window-Switcher (now Reflex Vision) - it allows you to see previews of all your open applications via a single keystroke in a manner similar to Apple's Exposé
U	Enterprise Harmony	rsMenu.exe	"Enterprise Harmony 99 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000"
U	Enterprise Harmony '99	rsMenu.exe	"Enterprise Harmony 99 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000"
X	Enterprise Suite	WE[random characters].exe	"Enterprise Suite rogue security software - not recommended
X	EntraOcio	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	Enumerate Service	wsys.exe	"Added by the MANIFEST TROJAN!"
U	EPGServiceTool	EPGClient.exe	"Electronic Programme Guide (EPG) for the WinTV range of TV Tuners from Hauppauge"
U	EPGServiceTool	EPGCLI~1.EXE	"Electronic Programme Guide (EPG) for the WinTV range of TV Tuners from Hauppauge"
U	EPoXUSDM	USDM.EXE	"EPoX Universal Serial Data Monitor - a diagnostics tool that shows Temps
N	ePrint 3.0 Service	EPRINT3.EXE	"LEADTOOLS ePrint file conversion software - ""convert any file to and from over 150 document and image formats including searchable PDF
N	ePrint 4.0 Service	EPRINT4.EXE	"A component of the ""LEADTOOLS ePrint File Conversion Software - Convert ANY file to and from over 150 document and image formats including searchable PDF
N	EPS	e_srcv02.exe	"According to the Epson info: ""Use this utility to automatically check for errors and also check the level of ink remaining."" This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check"
N	EPS	e_srcv03.exe	"According to the Epson info: ""Use this utility to automatically check for errors and also check the level of ink remaining."" This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check"
X	Epsilon Squared	vmmreg32.exe	"Added by the AGENT.MVC TROJAN!"
N	EPSON Background Monitor	STMS.EXE	Supposed to keep an Epson printer ready for quick printing. Users report little difference whether it is on or not
U	EPSON CardMonitor	EPSON CardMonitor1.0.exe	Monitors the PCMCIA memory card slot on EPSON cameras and printers and launches PhotoStarter or PhotoPrint
U	EPSON PictureMate Deluxe	E_FATI9TA.EXE	"Epson Status Monitor 3 for the PictureMate Deluxe compact photo printer - for monitoring printer status
U	EPSON Status Monitor 3	E_[various].EXE	"Epson Status Monitor 3 for their range of printer and AIO devices - for monitoring printer status
N	EPSON Status Monitor 3 Environment Check	e_srcv03.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check	e_srcv02.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check 2	e_srcv03.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
N	EPSON Status Monitor 3 Environment Check 2	e_srcv02.exe	According to the Epson info: "Use this utility to automatically check for errors and also check the level of ink remaining." This utility can also be started on demand when about to print as follows: File menu > Print to bring up the print dialog box. Click on the Properties button which will bring up a display with 4 tabs. Click the Utility tab to get a list of utilities that can be executed including the Status Monitor 3 Environment Check
U	EPSON Stylus C120 Series	E_FATICCA.EXE	"Epson Status Monitor 3 for the Stylus C120 Series printer - for monitoring printer status
U	EPSON Stylus C40 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C40 Series printer - for monitoring printer status
U	EPSON Stylus C41 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C41 Series printer - for monitoring printer status
U	EPSON Stylus C42 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C42 Series printer - for monitoring printer status
U	EPSON Stylus C43 Series	E_S08IC1.EXE	"Epson Status Monitor 3 for the Stylus C43 Series printer - for monitoring printer status
U	EPSON Stylus C43 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C43 Series printer - for monitoring printer status
U	EPSON Stylus C44 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C44 Series printer - for monitoring printer status
U	EPSON Stylus C45 Series	E_S4I3T1.EXE	"Epson Status Monitor 3 for the Stylus C45 Series printer - for monitoring printer status
U	EPSON Stylus C46 Series	E_S4I0T1.EXE	"Epson Status Monitor 3 for the Stylus C46 Series printer - for monitoring printer status
U	EPSON Stylus C48 Series	E_S4I091.EXE	"Epson Status Monitor 3 for the Stylus C48 Series printer - for monitoring printer status
U	EPSON Stylus C60 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C60 Series printer - for monitoring printer status
U	EPSON Stylus C61 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C61 Series printer - for monitoring printer status
U	Epson Stylus C62 Series	E-S0BIC1.EXE	"Epson Status Monitor 3 for the Stylus C62 Series printer - for monitoring printer status
U	EPSON Stylus C62 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C62 Series printer - for monitoring printer status
U	EPSON Stylus C63 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C63 Series printer - for monitoring printer status
U	EPSON Stylus C64 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C64 Series printer - for monitoring printer status
U	EPSON Stylus C64 Series	E_S4I2C1.EXE	"Epson Status Monitor 3 for the Stylus C64 Series printer - for monitoring printer status
U	EPSON Stylus C66 Series	E_S4I0S2.EXE	"Epson Status Monitor 3 for the Stylus C66 Series printer - for monitoring printer status
U	EPSON Stylus C67 Series	E_FATIAAL.EXE	"Epson Status Monitor 3 for the Stylus C67 Series printer - for monitoring printer status
U	Epson Stylus C82 Series	E_S0HIC1.EXE	"Epson Status Monitor 3 for the Stylus C82 Series printer - for monitoring printer status
U	EPSON Stylus C82 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C82 Series printer - for monitoring printer status
U	EPSON Stylus C84 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C84 Series printer - for monitoring printer status
U	EPSON Stylus C84 Series	E_S4I2D1.EXE	"Epson Status Monitor 3 for the Stylus C84 Series printer - for monitoring printer status
U	EPSON Stylus C87 Series	E_FATIABL.EXE	"Epson Status Monitor 3 for the Stylus C87 Series printer - for monitoring printer status
U	EPSON Stylus CX2900 Series	E_FATIBFP.EXE	"Epson Status Monitor 3 for the Stylus CX2900 Series printer - for monitoring printer status
U	EPSON Stylus CX3100	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus CX3100 printer - for monitoring printer status
U	EPSON Stylus CX3200	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus CX3200 printer - for monitoring printer status
U	EPSON Stylus CX3500 Series	E_FATI9 BL.EXE	"Epson Status Monitor 3 for the Stylus CX3500 Series printer - for monitoring printer status
U	EPSON Stylus CX3600 Series	E_FATI9BE.EXE	"Epson Status Monitor 3 for the Stylus CX3600 Series printer - for monitoring printer status
U	EPSON Stylus CX3700 Series	E_FATIACP.EXE	"Epson Status Monitor 3 for the Stylus CX3700 Series printer - for monitoring printer status
U	EPSON Stylus CX3800 Series	E_FATIACA.EXE	"Epson Status Monitor 3 for the Stylus CX3800 Series printer - for monitoring printer status
U	EPSON Stylus CX3900 Series	E_FATIBEP.EXE	"Epson Status Monitor 3 for the Stylus CX3900 Series printer - for monitoring printer status
U	EPSON Stylus CX4200 Series	E_FATIAEA.EXE	"Epson Status Monitor 3 for the Stylus CX4200 Series printer - for monitoring printer status
U	EPSON Stylus CX4500 Series	E_FATI9AP.EXE	"Epson Status Monitor 3 for the Stylus CX4500 Series printer - for monitoring printer status
U	EPSON Stylus CX4600 Series	E_FATI9AA.EXE	"Epson Status Monitor 3 for the Stylus CX4600 Series printer - for monitoring printer status
U	EPSON Stylus CX4700 Series	E_FATIADL.EXE	"Epson Status Monitor 3 for the Stylus CX4700 Series printer - for monitoring printer status
U	EPSON Stylus CX4800 Series	E_FATIADA.EXE	"Epson Status Monitor 3 for the Stylus CX4800 Series printer - for monitoring printer status
U	EPSON Stylus CX5000 Series	E_FATIBVA.EXE	"Epson Status Monitor 3 for the Stylus CX5000 Series printer - for monitoring printer status
U	EPSON Stylus CX5400	E_S4I2G1.EXE	"Epson Status Monitor 3 for the Stylus CX5400 printer - for monitoring printer status
U	EPSON Stylus CX5500 Series	E_FATICAP.EXE	"Epson Status Monitor 3 for the Stylus CX5500 Series printer - for monitoring printer status
U	EPSON Stylus CX6000 Series	E_FATIBIA.EXE	"Epson Status Monitor 3 for the Stylus CX6000 Series printer - for monitoring printer status
U	EPSON Stylus CX6500 Series	E_FATI9EP.EXE	"Epson Status Monitor 3 for the Stylus CX6500 Series printer - for monitoring printer status
U	EPSON Stylus CX6600 Series	E_FATI9EE.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	EPSON Stylus CX6600 Series	E_FATI9EA.EXE	"Epson Status Monitor 3 for the Stylus CX6600 Series printer - for monitoring printer status
U	EPSON Stylus CX7000F Series	E_FATIBKA.EXE	"Epson Status Monitor 3 for the Stylus CX7000F Series printer - for monitoring printer status
U	EPSON Stylus CX7400 Series	E_FATICDA.EXE	"Epson Status Monitor 3 for the Stylus CX7400 Series printer - for monitoring printer status
U	EPSON Stylus CX7800 Series	E_FATIAFA.EXE	"Epson Status Monitor 3 for the Stylus CX7800 Series printer - for monitoring printer status
U	EPSON Stylus CX8300 Series	E_FATICEP.EXE	"Epson Status Monitor 3 for the Stylus CX8300 Series printer - for monitoring printer status
U	EPSON Stylus CX8400 Series	E_FATICEA.EXE	"Epson Status Monitor 3 for the Stylus CX8400 Series printer - for monitoring printer status
U	EPSON Stylus CX9300F Series	E_FATICFP.EXE	"Epson Status Monitor 3 for the Stylus CX9300F Series printer - for monitoring printer status
U	EPSON Stylus CX9400Fax Series	E_FATICFA.EXE	"Epson Status Monitor 3 for the Stylus CX9400Fax Series printer - for monitoring printer status
U	EPSON Stylus D68 Series	E_FATIAAE.EXE	"Epson Status Monitor 3 for the Stylus D68 Series printer - for monitoring printer status
U	EPSON Stylus D78 Series	E_FATIBGE.EXE	"Epson Status Monitor 3 for the Stylus D78 Series printer - for monitoring printer status
U	EPSON Stylus D88 Series	E_FATIABE.EXE	"Epson Status Monitor 3 for the Stylus D88 Series printer - for monitoring printer status
U	EPSON Stylus DX3800 Series	E_FATIACE.EXE	"Epson Status Monitor 3 for the Stylus DX3800 Series printer - for monitoring printer status
U	EPSON Stylus DX4000 Series	E_FATIBEE.EXE	"Epson Status Monitor 3 for the Stylus DX4000 Series printer - for monitoring printer status
U	EPSON Stylus DX4400 Series	E_FATICAE.EXE	"Epson Status Monitor 3 for the Stylus DX4400 Series printer - for monitoring printer status
U	EPSON Stylus DX4800 Series	E_FATIADE.EXE	"Epson Status Monitor 3 for the Stylus DX4800 Series printer - for monitoring printer status
U	EPSON Stylus DX5000 Series	E_FATIBVE.EXE	"Epson Status Monitor 3 for the Stylus DX5000 Series printer - for monitoring printer status
U	EPSON Stylus DX6000 Series	E_FATIBIE.EXE	"Epson Status Monitor 3 for the Stylus DX6000 Series printer - for monitoring printer status
U	EPSON Stylus DX7000F Series	E_FATIBKE.EXE	"Epson Status Monitor 3 for the Stylus DX7000F Series printer - for monitoring printer status
U	EPSON Stylus DX7400 Series	E_FATICDE.EXE	"Epson Status Monitor 3 for the Stylus DX7400 Series printer - for monitoring printer status
U	EPSON Stylus DX8400 Series	E_FATICEE.EXE	"Epson Status Monitor 3 for the Stylus DX8400 Series printer - for monitoring printer status
U	EPSON Stylus Photo 1400 Series	E_FATIBUA.EXE	"Epson Status Monitor 3 for the Stylus Photo 1400 Series printer - for monitoring printer status
U	EPSON Stylus Photo 2200	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo 2200 printer - for monitoring printer status
U	EPSON Stylus Photo 825	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo 825 printer - for monitoring printer status
U	EPSON Stylus Photo 925	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo 925 printer - for monitoring printer status
U	EPSON Stylus Photo R1800	E_FATI9LA.EXE	"Epson Status Monitor 3 for the Stylus Photo R1800 printer - for monitoring printer status
U	EPSON Stylus Photo R200 Series	E_S4I0H2.EXE	"Epson Status Monitor 3 for the Stylus Photo R200 Series printer - for monitoring printer status
U	EPSON Stylus Photo R220 Series	E_S6I2I1.EXE	"Epson Status Monitor 3 for the Stylus Photo R220 Series printer - for monitoring printer status
U	EPSON Stylus Photo R220 Series	E_FATIAIE.EXE	"Epson Status Monitor 3 for the Stylus Photo R220 Series printer - for monitoring printer status
U	EPSON Stylus Photo R240 Series	E_FATIAHE.EXE	"Epson Status Monitor 3 for the Stylus Photo R240 Series printer - for monitoring printer status
U	EPSON Stylus Photo R2400	E_FATI9SA.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	EPSON Stylus Photo R2400	E_FATI9SE.EXE	"Epson Status Monitor 3 for the Stylus Photo R2400 printer - for monitoring printer status
U	EPSON Stylus Photo R260 Series	E_FATIBNA.EXE	"Epson Status Monitor 3 for the Stylus Photo R260 Series printer - for monitoring printer status
U	EPSON Stylus Photo R280 Series	E_FATICKA.EXE	"Epson Status Monitor 3 for the Stylus Photo R280 Series printer - for monitoring printer status
U	EPSON Stylus Photo R285 Series	E_FATICKE.EXE	"Epson Status Monitor 3 for the Stylus Photo R285 Series printer - for monitoring printer status
U	EPSON Stylus Photo R300 Series	E_S4I2F1.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	EPSON Stylus Photo R300 Series	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	EPSON Stylus Photo R300 Series	E_S4I0F2.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	EPSON Stylus Photo R320 Series	E_FATI9FA.EXE	"Epson Status Monitor 3 for the Stylus Photo R320 Series printer - for monitoring printer status
U	EPSON Stylus Photo R340 Series	E_FATIAJE.EXE	"Epson Status Monitor 3 for the Stylus Photo R340 Series printer - for monitoring printer status
U	EPSON Stylus Photo R380 Series	E_FATIBOA.EXE	"Epson Status Monitor 3 for the Stylus Photo R380 Series printer - for monitoring printer status
U	EPSON Stylus Photo R800	E_FATI9YE.EXE	"Epson Status Monitor 3 for the Stylus Photo R800 printer - for monitoring printer status
U	EPSON Stylus Photo RX420 Series	E_FATI9CE.EXE	"Epson Status Monitor 3 for the Stylus Photo RX420 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX430 Series	E_FATI9CP.EXE	"Epson Status Monitor 3 for the Stylus Photo RX430 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX500	E_S4I2K1.EXE	"Epson Status Monitor 3 for the Stylus Photo RX500 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX530 Series	E_FATIAGP.EXE	"Epson Status Monitor 3 for the Stylus Photo RX530 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX600	E_S4I2M1.EXE	"Epson Status Monitor 3 for the Stylus Photo RX600 printer - for monitoring printer status
U	EPSON Stylus Photo RX640 Series	E_FATIAME.EXE	"Epson Status Monitor 3 for the Stylus Photo RX640 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX680 Series	E_FATICJA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX680 Series printer - for monitoring printer status
U	EPSON Stylus Photo RX700 Series	E_FATI9IA.EXE	"Epson Status Monitor 3 for the Stylus Photo RX700 Series printer - for monitoring printer status
U	EPSON Stylus Pro 4000	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Pro 4000 printer - for monitoring printer status
U	EPSON Stylus Pro 7600	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus Pro 7600 printer - for monitoring printer status
U	EPSON Stylus SX200 Series	E_FATIEFE.EXE	"Epson Status Monitor 3 for the Stylus SX200 Series printer - for monitoring printer status
U	EPSON SX100 Series	E_FATIEDE.EXE	"Epson Status Monitor 3 for the SX100 Series printer - for monitoring printer status
U	EPSON TX100 Series	E_FATIEDP.EXE	"Epson Status Monitor 3 for the TX100 Series printer - for monitoring printer status
U	EPSON WorkForce 30 Series	E_FATIEEA.EXE	"Epson Status Monitor 3 for the WorkForce 30 Series printer - for monitoring printer status
U	EPSON WorkForce 500 Series	E_FATIEQA.EXE	"Epson Status Monitor 3 for the WorkForce 500 Series printer - for monitoring printer status
U	EPSON WorkForce 600 Series	E_FATIEKA.EXE	"Epson Status Monitor 3 for the WorkForce 600 Series printer - for monitoring printer status
U	EpsonPhotoStarter	EPSON_PhotoStarter.exe	Only needed if you want to make full use of the capabilities of an Epson printer that included this
X	eraseplg	eraseplg.exe	"Added by the GENOME.AQUV TROJAN!"
U	Eraser	eraser.exe	"Eraser - ""an advanced security tool for Windows which allows you to completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns"". This entry starts the Scheduler with Windows and provides a System Tray icon for on-demand access. Located in %ProgramFiles%\Eraser"
U	eraser	eraser.exe	"Part of Evidence Exterminator
U	eraser.exe	eraser.exe	"Part of Evidence Exterminator
Y	eRecoveryService	check.exe	"Now part of Acer Empowering Technology. ""Acer eRecovery Management is a powerful utility that does away with the need for recovery disks provided by the manufacturer
U	eRecoveryService	Monitor.exe	"Part of Acer Empowering Technology. ""Acer eRecovery Management is a powerful utility that does away with the need for recovery disks provided by the manufacturer
U	eRecoveryService	eRAgent.exe	"Part of Acer Empowering Technology. ""Acer eRecovery Management is a powerful utility that does away with the need for recovery disks provided by the manufacturer
X	eros.exe	eros.exe	Adult content dailler
X	ErrClean	SysRep.exe	"ErrClean rogue system error and cleaning utility - not recommended. There are number of variants in this family sharing the same filename and user interface - see here"
X	ErreurChasseur	SysRep.exe	"ErreurChasseur
X	Error Safe	ers.exe	"ErrorSafe rogue system error and cleaning utility - not recommended"
X	Error Safe Free	uers.exe	"ErrorSafe rogue system error and cleaning utility - not recommended"
X	ErrorSafe	ers.exe	"ErrorSafe rogue system error and cleaning utility - not recommended"
X	ErrorSafeFree	UERS.exe	"ErrorSafe rogue system error and cleaning utility - not recommended"
X	ERS	ers_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	ERScw	ERScw.exe	"Part of the ErrorSafe rogue system error and cleaning utility - not recommended"
X	ERS_check	ers_startupmon.exe	"Part of the WinAntiVirus Pro 2006 rogue security software - not recommended
X	ERS_Check	uwasers.exe	"Part of the WinAntiSpyware 2006 and WinAntiSpyware 2007 rogue spyware removers - not recommended"
X	erthgdr	svc.exe	"Added by the BEAGLE.BN or BEAGLE.BP WORM!"
X	erthgdr2	svc23.exe	"Added by the BAGLE.CG WORM!"
?	ERTS0749	ERTS0749.exe	"IBM Warranty Notification - presumably it's a reminder to either register or that warranty is about to expire?"
U	ES Current Services	[FILE NAME].exe	"123Keylogger surveillance software. Uninstall this software unless you put it there yourself"
Y	eSafe Protect	ESPWatch.exe	"eSafe from Aladdin - internet security for gateway and E-mail servers"
U	ESB	esb.exe	Easy Start Button - provides functionality on certain laptops that have additional keys. Not required unless you use the extra keys
Y	eScan Monitor	AVKWCTL9X.EXE	"MicroWorld eScan antivirus"
U	eScan Scheduler	avkserv.exe	"MicroWorld eScan antivirus scheduler"
U	eScan Updater	Trayicos.exe	"MicroWorld eScan antivirus updater - allows users to automatically download updates and set the auto time interval for downloads"
X	EScorcher	escorcher.exe	"Part of eScorcher anti-virus software - responsible for performing virus checks and deletions. Used to collect information about the user and therefore treated as spyware - now the web-site is dead"
N	ESFTP	esftp.exe	"ESftp - FTP client for transfering files between a local PC and another remote computer"
U	eSnips	ClientGW.exe	"eSnips Client Gateway from eSnips"
X	Esoh	Esoh123.exe	"Added by the AGOBOT.FF WORM!"
X	Especial	Deneca.bat	"Added by the DELUZ VIRUS!"
X	Esph	ortu.exe	"PurityScan adware"
N	ESPN BottomLine	bline.exe	"ESPN BottomLine. ""You can dock the BottomLine to the top or bottom of your screen or drag it around on your desktop
?	ESS Daemon	Essd.exe	"Related to an ESS based soundacard. Is it required?"
?	essapm	essapm.exe	"ESS Solo soundcard driver. Is it required?"
Y	Essdc	essdc.exe	Related to an ESS Solo soundcard. Seems as though it's required
?	ESSNDSYS	ESSNDSYS.EXE	"Related to an ESS based soundacard. Is it required?"
Y	ESSOLO	ESSOLO.exe	Sound card driver that re-instates itself every time it's removed
Y	esspk	esspk.exe	ESS Technology modem speaker driver file. Required to get on-line with this modem
U	EssSpkPhone	essspk.exe	"ESS Technologies Call waiting
?	eSupInit	eSupCmd.exe	"Related to SupportSoft (aka Support.com) ""Real-Time Service Management software"". What does it do and is it required?"
X	Esutityde	osutityde.exe	"Added by the SDBOT.BQD WORM!"
X	ETB Tester	etbtest.exe	"Added by the RBOT-ABR WORM!"
X	ethernet	msnger.exe	"Added by a variant of the SDBOT WORM!"
X	ethernet	msftp.exe	"Added by the SDBOT.BXJ WORM!"
X	ethernet adapter	csrmss.exe	"Added by a variant of the RBOT WORM!"
X	Ethernet Driver	cmsrrs.exe	"Added by a variant of the RBOT WORM!"
X	Ethernet Drivers	smrrs.exe	"Added by the RBOT-AAK WORM!"
X	Ethernet Drivers	ethernet.exe	"Added by the GAOBOT.CEZ WORM!"
Y	eTrust EZ Firewall	efpeadm.exe	"eTrust EZ Firewall"
U	eTrust PestPatrol Active Protection	PPActiveDetection.exe	"PestPatrol real-time protection feature. ""Stops spyware before it infects your system"""
X	eTrust Realtime Monitor	realmon.exe	"Added by the LAZAR.B TROJAN!"
Y	eTrustCIPE	ezdsmain.exe	eTrust EZ Deskshield from Computer Associates. Protects against malicious email attachments and unauthorized use of email by detecting and blocking unusual behavior
X	EUP Service	eupsvc.exe	"Added by the DELBOT-Q WORM!"
N	Event Planner Reminders	PLNRNote.exe	Part of Sierra/Hallmark Card Studio - System Tray notification of events such as birthdays and anniversaries that you've scheduled with the customizable Event Planner
N	Event Planner Reminders Tray Icon	PLNRnote.exe	Part of Sierra/Hallmark Card Studio - System Tray notification of events such as birthdays and anniversaries that you've scheduled with the customizable Event Planner
X	EventApplicationCmd	smschk.exe	"Added by the IRCBOT-AO TROJAN!"
U	EVENTLISTENER	EvLstnr.exe	Used with a Nikon digital camera to recognize when the camera is plugged in
?	EverioService	EverioService.exe	"Related to the Cyberlink software supplied with JVC's Everio camcorders. What does it do and is it required?"
U	EVGAPrecision	EVGAPrecision.exe	"EVGA Precision overclocking utility - ""allows you to fine tune your EVGA graphics card for the maximum performance possible
N	evntsvc	evntsc.exe	"Application Scheduler installed along with RealOne Player. Once installed
U	EVOLOSTA	EVOLOSTA.EXE	"Evolo Status Monitor for wireless network cards. Allows a user to enter a specific access-point mode SSID
U	Evoluent Mouse Manager	EvoMouExec.exe	"Mouse manager for Evoluent VertcialMouse"
U	EvtMgr6	Setpoint.exe	"Logitech SetPoint control software for their range of wired and wireless keyboards and pointing devices (mice
U	EW Message Server	msg32.exe	Conexant (older versions are Brooktree) Wavestream Message Server - associated with Conexant based audio devices
N	eWare Startup	iWareStart.exe	"eWare iWare task bar. Not required"
Y	ewido anti-spyware	ewido.exe	"System Tray access to and notifications for Ewido Anti-Spyware 4.0. Ewido is now part of AVG Technologies so this has been superseded by AVG Anti-Virus which includes Anti-Spyware"
X	Ewth	tasn.exe	"PurityScan adware"
?	Excite Private Messenger Pipe	x8impipe.exe	"??"
N	ExciteAssistantEXE	ASSISTANT.EXE	"With Excite Assistant
X	ExecUser	ExecUser.exe	"Added by a variant of the RBOT WORM!"
?	Execute	delfolders.exe	"??"
X	ExeName32	Warm.scr	"Added by the SCOLD WORM!"
X	ExFilter	"Rundll32.exe [path] cdnspie.dll	ExecFilter"
?	exgiwsl	exgiwsl.exe	"??"
X	ExpertAntivirus	ExpertAntivirus.exe	"ExpertAntivirus rogue security software - not recommended
X	Expl0rer soft	expl0rer.pif	"Added by the RBOT-AQR WORM!"
X	explorer	wscript.exe [filename]	"Sneaky way to start any VBS script. Many viruses use VBS files. Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	Explorer	shellexpl.exe	"Added by the SHELDOR TROJAN!"
X	Explorer	shellexp.exe	"Added by the AGENT-ZY TROJAN!"
X	EXPLORER	sys.exe	"Added by the SILLYFDC-A TROJAN!"
X	explorer	Yinstall.exe	"PurityScan/Clickspring adware"
X	Explorer	Windows Explorer.exe	"Added by the SILLYFDC-I WORM!"
X	Explorer	explorar.vbs	"Added by the DESKTO-A WORM!"
X	explorer	system.exe	"Added by the AGENT-FI TROJAN!"
X	Explorer	msrstart.exe	"Added by the SOPICLICK TROJAN!"
X	EXPLORER MICROSOFT SYSTEM	explore.exe	"Added by a variant of the RBOT WORM!"
X	Explorer soft	explorer.pif	"Added by the RBOT-APK WORM!"
X	Explorer soft	explorer.com	"Added by the RBOT-ARM WORM!"
X	Explorer.exe	csrss.exe	"Added by the JUEGO-B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %AppData%\Microsoft"
X	Explorer32	explorer6s4.exe	Added by the Downloader.Win32.Small.biq TROJAN!
X	Explorer32	efsdfgxg.exe	"Added by the CLICKER-Y TROJAN!"
X	ExplorerTask	explorer.exe	"Added by the ZCREW-B BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the ""Fonts"" sub-folder"
X	ExploreUpdSched	[random filename]	"ZenoSearch adware"
X	exporet	winset.exe	"Added by the QQPASS-I TROJAN!"
U	Express ClickYes	ClickYes.exe	"""Express ClickYes is a handy tool that runs in the system tray automatically clicks the Yes button for the Outlook Security security prompt
U	Exshow95	EXSHOW95.exe	Support software for some of the Kensington mice. Provides access to extra features like those available with enhanced Logitech and MS devices
N	Extender Resource Monitor	RMSysTry.exe	"Related to Windows Media Center from Microsoft"
X	External Dependencies	External.exe	"Added by the MYTOB.EC WORM!"
X	Extra Antivirus	ExtraAV.exe	"Extra Antivirus rogue security software - not recommended
U	ExtraDNS	ExtraDNS.exe	"ExtraDNS - DNS configuration tool"
X	EYORE	Notepad.scr	"Added by the GIMLET-A WORM!"
N	EZDesk	EZDESK.EXE	"Utility that remembers icon locations for each user and resolution. Available here"
Y	ezPS_Px	ezSP_PxEngine.exe	"Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings"
Y	ezPS_Px	ezSP_Px.exe	"Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings"
Y	ezShieldProtector for Px	ezSP_Px.exe	"Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings"
Y	ezShieldProtector for Px	ezSP_PxEngine.exe	"Engine that allows PrimoDVD from Veritas (was Prassi) and Drag'n Drop CD from Easy Systems (and maybe others) to record and protects against other software overwriting the settings"
U	EZSMART App	ezsmart.exe	EZ-S.M.A.R.T. hard drive monitoring software from StorageSoft - appears to be no longer supported
U	E_S10IC2	E_S10IC2.EXE	"Epson Status Monitor 3 for the Stylus C44 Series printer - for monitoring printer status
U	E_S23	E_SICN03.exe	"Epson printer status monitor - for checking ink levels
U	E_S4I2F1	E_S4I2F1.EXE	"Epson Status Monitor 3 for the Stylus Photo R300 Series printer - for monitoring printer status
U	E_S4I2G1	E_S4I2G1.EXE	"Epson Status Monitor 3 for the Stylus CX5400 printer - for monitoring printer status
U	E_SOEIC1	E_SOEIC1.exe	"Epson Status Monitor 3 - for monitoring printer status
U	E_S[numbers]	[path] E_[various].EXE [path] E_S[numbers].tmp	"Temporary entry related to Epson Status Monitor 3 for their range of printer and AIO devices - for monitoring printer status
U	F-PROT Antivirus Tray application	FProtTray.exe	"System Tray access to F-PROT Antivirus"
X	F-Secure 2005	svchost.exe	"Added by the BIFROSE-CH TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
Y	F-Secure 2006	fspex.exe	"F-Secure Anti-Virus automatic updater"
X	F-Secure Gatekeeper	[malware name].exe	"Added by the NUWAR.AXQ WORM!"
U	F-Secure Management Agent	FSMA32.EXE	"F-Secure antivirus - F-Secure Policy Manager provides tools for administering F-Secure software products"
Y	F-Secure Manager	FSM32.EXE	"F-Secure antivirus - carry out scheduled virus scans automatically"
Y	F-Secure Startup Wizard	FSSW.EXE	"F-Secure antivirus"
Y	F-Secure TNB	TNBUtil.exe	"F-Secure antivirus"
Y	F-StopW	F-StopW.exe	"F-Prot anti-virus background scanner by F-Risk Software"
?	f23mxins	f23mxins	"Related to the now discontinued ATI Fire GL3 graphics card. What does it do and is it required?"
X	f2install.exe	f2install.exe	"Added by the IEFEAT-I TROJAN!"
X	f73cdc8ee94e	btsendto.exe	Associated with mysearchnow.com/searchbar.html
U	Fabrik Ultimate Backup Status	fabrikhomestat.exe	"Status monitor for Fabrik Ultimate Backup from Fabrik Inc. ""No matter what happens to the drive on your desk - a spilled drink
X	FaltCheck	allps.exe	"Added by the AGENT.RAP TROJAN!"
U	FamilyKeyLogger	cisvc.exe	"Family Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Located in %ProgramFiles%\FamilyKeyLogger"
X	Fantasia injector	wincfg.exe	"Added by the AGOBOT.US WORM!"
X	farkrish	farkrish.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X	Fash	Fash.exe	Unidentified adware
X	faslkakj11	kjgagklj11.exe	"Added by the LEGMIE-ARE TROJAN!"
N	fast	fast.exe	Installs as part of Windows XP PowerToys as an option for very-fast user switching (allowing a keystoke to switch users instead of using the login screen). It is only used for the hot-key switch and yet it hogs 1.5 megs of memory in two separate processes (one run by the user & one by the system). Optional install in PowerToys
X	fast	A-fast.exe	"A-fast Antivirus rogue security software - not recommended
X	Fast Antivirus 2009	FastAV.exe	"Fast Antivirus rogue security software - not recommended
N	FAST Defrag	FAST2.EXE	"FastDefrag defragmenting software"
X	Fast Home	svcnvt.exe	"Detected by Kaspersky as the DELF.KS TROJAN! This file may be found in the System folder on 9x machines
X	Fast Search	svcnv.exe	"Homepage
X	Fast start	Ntut.exe	"Adware - deteced by Kaspersky as the FAVADD.I TROJAN!"
X	Fast start	svcnt.exe	"Adware - detected by Kaspersky as a variant of the FAVADD TROJAN!"
U	FastCache	fc.exe	"FastCache from AnalogX - speeds up browsing by resolving DNS requests locally"
X	FastDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	fastsmell	fastsmell.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
X	FastStart	ntnut32.exe	"Added by the STARTPAGE.L TROJAN!"
X	FastStart	svcnut.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
X	FastStart	svcnut32.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
N	FastTrack Accelerator	SPEED UP.EXE	"FastTrack Accelerator - ""speedup"" utility for programs that use the FastTrack network such as KaZaA Media Desktop
X	FASTTRACKNETVISION	NETVISION.exe	"DialCar-Z premium rate dialer"
U	FastTVSync	FastTVSync.exe	"Part of InterVideo (now Corel) DVD Copy - ""fast DVD copying and file conversion software. In just three steps
N	FastUser	fast.exe	Installs as part of Windows XP PowerToys as an option for very-fast user switching (allowing a keystoke to switch users instead of using the login screen). It is only used for the hot-key switch and yet it hogs 1.5 megs of memory in two separate processes (one run by the user & one by the system). Optional install in PowerToys
N	FastUsr	fast.exe	Installs as part of Windows XP PowerToys as an option for very-fast user switching (allowing a keystoke to switch users instead of using the login screen). It is only used for the hot-key switch and yet it hogs 1.5 megs of memory in two separate processes (one run by the user & one by the system). Optional install in PowerToys
X	Fat32 Microsoft	fat32.exe	"Added by the RBOT-EL WORM!"
U	FavoriteSync	FavoriteSync.exe	"FavoriteSync keeps the same set of Internet Explorer Favorites on several computers in sync"
U	FaxCenterServer	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software. Incorporated into software by Lexmark
U	FaxCenterServer4_in_1	fm3032.exe	"FaxMan integrates complete fax send and receive support into Windows applications without requiring additional fax software. Incorporated into software by Lexmark
U	FaxCtrl.exe	ASMediaProxyServer.exe	"Part of Avaya's Contact Center Express - ""a multi-channel
?	FBI	FBISM.exe	"Compaq related but what does it do?"
X	FBSearch	FastBrowserSearchProtection.exe	"Fast Browser Search/Search Guard Plus parasite - installed with ""Make the Web Better"" applications such as My Web Tattoo
X	FBSearch	SearchGuardPlus.exe	"Fast Browser Search/Search Guard Plus parasite - installed with ""Make the Web Better"" applications such as My Web Tattoo
X	FBSSA	ie3sh.exe	"Fast Browser Search/Search Guard Plus parasite - installed with ""Make the Web Better"" applications such as My Web Tattoo
X	Fdaemon security	fsecur.exe	"Added by the SDBOT.KXO WORM!"
X	FDD SYSTEM	Fdd.exe	"Added by the MYTOB-FO WORM!"
X	Fdr Command Module	sp2.exe	"Added by the SDBOT.WP WORM!"
U	FD_SAP	FD.exe	Reported to be the autopassword program from the Sony Microvault thumb drive
X	fegoze	SVCH0ST.EXE	"Added by the GRAYBIRD.D VIRUS! Note - the filename has the digit 0 rather then the uppercase ""o"""
U	Fellowes Proxy	R3proxy.exe	Installed with Fellowes EasyPoint mouse software. Not necessary for normal functioning of Fellowes mice but it is necessary to use the extended features of all Fellowes mice
X	Fen Startups	fensvc32.exe	"Added by the RANDEX.CCF WORM!"
X	Fenio Startups	fnesvc32.exe	"Added by the AGOBOT-OS BACKDOOR!"
X	FestPlattenCleaner	SysRep.exe	"FestPlattenCleaner
X	FestplattenReiniger	GDC.exe	"FestplattenReiniger
X	ff	svhost32.exe	"Added by the LINEAG-AFF TROJAN!"
X	ffeqfqs	dqddss.exe	"Added by the SDBOT-SG WORM!"
X	ffeqOME	vcvsav.exe	"Added by the RANKY.AB TROJAN!"
X	ffis	ffisearch.exe	"iSearch adware"
Y	ffprsrv	ffprsrv.exe	"File and Folder Privacy - is a ""system security utility you can use to password-protect or hide your files and folders with a click of mouse. The program will always prompt to enter your access password when protection is enabled and a user is trying to access a protected file or folder"". If this entry is disabled
Y	ffprsrv.exe	ffprsrv.exe	"File and Folder Privacy - is a ""system security utility you can use to password-protect or hide your files and folders with a click of mouse. The program will always prompt to enter your access password when protection is enabled and a user is trying to access a protected file or folder"". If this entry is disabled
Y	ffpsrv	ffpsrv.exe	"File & Folder Protector - ""great easy-to-use password-protected security utility lets you password-protect certain files and folders
Y	ffpsrv.exe	ffpsrv.exe	"File & Folder Protector - ""great easy-to-use password-protected security utility lets you password-protect certain files and folders
?	fgl23DoubleScreenHooks	f23happ.exe	"Related to the now discontinued ATI Fire GL3 graphics card. What does it do and is it required?"
X	FHPage	shdochp.exe	"Added by the WINHOUND TROJAN!"
X	FHStart	shdocsvc.exe	"Added by the WINHOUND TROJAN!"
U	Fhtisxk	fhtisxk.exe	XtraKeys keystroke logger/monitoring program - remove unless you installed it yourself!
U	FieldForms Sync	SyncService.exe	"Resco FieldForms. A solution for building of mobile forms that can be viewed or filled in on the run
X	FiendlyType	csrss.exe	"Added by the WEBUS TROJAN! Note - this is not the legitimate csrss.exe process which should not normally figure in Msconfig/Startup!"
?	file indexing service	msfindfile.exe	"New version of MS FindFast and still a resource hog?"
X	File Mapping Services	hp-1003.exe	"Added by the RBOT.FAN WORM!"
X	File System	taskmqrs.exe	"Added by a variant of the TOXBOT/CODBOT WORM!"
X	File System	taskmqr.exe	"Added by the RBOT.BWQ WORM!"
X	File System Service	wmiprvsc.exe	"Added by the AGOBOT-HZ TROJAN!"
X	File-Sharing Wizard	shwizard.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	FileManager32	Wscript.exe ChkMgr32.vbs	"Added by the NOTUP.A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""ChkMgr32.vbs"" file is located in %System%"
X	filename process	kerneldll.exe	"Added by the AGOBOT-PO WORM!"
X	filename process	explore.exe	"Added by the AGOBOT-QN WORM!"
X	filename process	Rundil16.exe	"Added by the GAOBOT.ZX WORM!"
X	Files Driver	sdphost.exe	"Added by the SDBOT-DKZ WORM!"
X	Files Driver	sfdhost.exe	"Added by the AGOBOT-AJC BACKDOOR!"
X	FileSoft	Wscript.exe UpdataFiles.vbs	"Added by the SST.B WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""UpdataFiles.vbs"" file is located in %Windir%"
U	FilmLoop	FilmLoopService.exe	"Related to FilmLoop - a photocasting network. Share your pictures with your family and friends"
N	Find Fast	Findfast.exe	From older versions of MS Office - searches disk drives for Office file types and creates an index to make opening them easier. When indexing is in progress it can use lots of CPU time and memory - especially on slower/older machines
Y	Find Virus Launch Program	fvlaunch.exe	"Part of Dr. Solomon's Antivirus"
X	findfast	findfast.exe	"Added by the DLOADER.PFR TROJAN! Note - the is not the legitimate file of the same name installed with older versions of MS Office"
X	findfast.exe	findfast.exe	Identified as the RUNDIS.A TROJAN! Note - the is not the legitimate file of the same name installed with older versions of MS Office
U	FinePrint Dispatcher v4	fpdisp4a.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 4.x of the software. ""FinePrint saves ink
U	FinePrint Dispatcher v4	fpdisp4.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 4.x of the software. ""FinePrint saves ink
U	FinePrint Dispatcher v5	fpdisp5a.exe	"FinePrint Dispatcher - handles the spooling of print jobs to the FinePrint printer. Version 5.x of the software. ""FinePrint saves ink
N	FineReader7NewsReaderPro	AbbyyNewsReader.exe	"ABBYY FineReader OCR software - version 7"
U	FingerPrintSoftware	fpapp.exe	Supports the fingerprint reader on selected IBM/Lenovo Thinkpad notebooks
X	Fire Wall services	[random filename]	"Added by the IRCBOT-QY WORM!"
X	Fire Wall services	wnlmzsfhobi.exe	"Added by the IRCBOT-QY WORM!"
X	Fire Well service	[random].exe	"Added by the RBOT-FJU WORM!"
X	FireFox Service Drivers	ssmss.exe	"Added by a variant of the SDBOT WORM!"
X	FireFox Startup Drivers	wuaclt.exe	"Added by the RBOT.BYX WORM!"
X	FiresWallservices	[random].exe	"Added by the RBOT-FJT WORM!"
X	Firevall Administrating	rndll.exe	"Added by the PUSHBOT-B WORM!"
X	Firewall	SP2 UPDATE.exe	"Added by the ELITPER.E WORM!"
X	firewall	spoolsv.exe	"Added by the DIZAN.F VIRUS!"
X	Firewall Administrating	infocard.exe	"Added by the AUTORUN-AYV WORM! Note - this is not the valid InfoCard Service which is part of the .NET Framework from Microsoft and uses the same filename"
X	Firewall auto setup	winlogon.exe	"Added by the AGENT-EDB TROJAN! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
X	Firewall auto setup	[path to trojan]	"Added by the AGENT-GLY TROJAN!"
X	Firewall Controls	sys32.exe	"Added by the SDBOT-DGI WORM!"
X	Firewall Sp2 system	sys32Conf.exe	"Added by the RBOT-ABT WORM!"
X	Firewall Update System1	WinedowsUpdater1.exe	"Added by the RBOT-ARU WORM!"
X	Firewall Updater	msnupdateit.exe	"Added by the RBOT-AAQ WORM!"
X	FirewallActivies	csrss.exe	"Added by the BANKER-AQ TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""3041"" subfolder"
U	FirewallStartup	Firewallstartup.exe	"Innovative Startup Firewall - ""designed to protect your computer from programs that install themselves in the StartUp area of your Windows without asking for your approval. Innovative StartUp Firewall will help you keep your computer clean
X	FirewallSvr	FirewallSvr.exe	"Added by the NETSKY.X or NETSKY.Y WORMS!"
X	FireWire Driver	samx.exe	"Added by the SDBOT.AE WORM!"
X	FireWire Service	nvscv32.exe	"Added by a variant of the SDBOT WORM!"
X	FireWire Services	nvcsv32.exe	"Added by a variant of the SPYBOT WORM!"
X	First Home Page	http://find.naupoint.com	"Naupoint browser hijacker"
?	First Principle Group	fpg.exe	"Related to the E-Players Card from First Principle Group"
X	FIX	WinFIX1.0.vbs	"Added by the GORMLEZ-A WORM!"
Y	Fix-it	mxtask.exe	"Part of Ontrack's Fix-it Utilities Suite. Loads a System Tray icon that lets you access the full program. Needed if you run the crash guard
X	fjdslssdfd	mat2.exe	"Added by the SLAPEW.C TROJAN!"
U	FJTWAIN Setup	FjtwSetup.exe	Fujitsu scanner utility
N	FJUPDNV_Chitose	fjdvrupd.exe	Driver update for a Fujitsu Siemens Lifebook laptop
X	FKS v2.0	msngr.exe	Added by an unidentified WORM or TROJAN!
N	fkSysMon	fksysmon.exe	"fkWrae SysMon - system monitor - ""displays the current memory consumption
X	Flash Driver	[path to trojan]	"Added by the AGENT.CWVT TROJAN!"
X	Flash Media	%%%%%.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Flash Media	%%%.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Flash Media	[path to trojan]	"Added by the IRCBOT.AUR TROJAN!"
X	Flash Media	^ ^^^ %% % ^% ^%%^ %^ .exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Flash Media	^^% ^ %%% %^%%%^%%^%^% % ^^%% % %^^^^ ^%%^%% .exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Flash Media	^^^^^.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Flash Media	^^^^^^.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Flash Media	services.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
X	Flash Media	zrpk��'�'%''msn'�%'fix''.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Flash Media	% ^% ^^^ %^% %% ^ ^ %%% ^% %^ % %^^.exe	"Added by a variant of the IRCBOT BACKDOOR! Note the space at the beginning of the filename"
X	Flash Media	^%%^%%%^% %^ ^ .exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Flash Media	%^^%^^% %^^^^ .exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Flash Media	^%^^^%% ^ ^ %^^^^^ %^ ^%^^ ^%^^^^^ %^ ^^^%^%%.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Flash Media	%^% ^ %^%% ^ % ^%%^^ %^^%^%^ ^%% %^.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Flash Media	%%%%%%^^ ^ .exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Flash Media	skxs��'�'%''msn'�%'fix''.exe	"Added by the AGENT.ZOY TROJAN!"
X	Flash Media	^ %%^%^%.exe	"Added by the FLUSH.A TROJAN! Note the space at the beginning of the filename"
X	Flash Media	%% % ^^ % %% ^%^^ ^^^ % ^%% ^ ^.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note the space at the beginning of the filename"
X	Flash Media	^ ^ % ^ % % ^ ^ ^%% ^% %%^^.exe	"Added by the IRCBOT.BAW BACKDOOR!"
X	Flash Player2	[path to worm]	"Added by the IRCBOT.PD WORM!"
?	FLASH32	#NAME?	"??"
X	Flash32	FLASH32.COM	"Added by the STARTER-F TROJAN!"
U	FlashEnc	FlashEnc.exe	"Supplied with EasyDisk USB pen devices. The utility manages the encryption and compressed folders options. It will create these folders if running on the USB key without permission
N	Flashget	FlashGet.exe	"FlashGet download manager"
X	Flashget Download Manager	Flashget.exe	"Added by the RBOT-AGZ WORM!"
X	FlashGuard	FlashGuard.exe	"Added by the AUTOIT.AL WORM!"
U	FlashMute	FlashMute.exe	"""FlashMute is a tool which allows you to mute/unmute Flash Movies loaded in a browser exclusively
N	FlashPath Monitor	SDSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
N	FlashPath Monitor	FLSHSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
N	FlashPath Status	SDSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
N	FlashPath Status	FLSHSTAT.EXE	System Tray icon that you can't get rid of - and does not need to run!. Tells you the battery status in the floppy disk adapter for the smartmedia cards. Available via Start -> Programs
X	Flashy Bot	Flashy.exe	"Added by the GLUPZY.A WORM!"
X	Flash_Player_Install	ying.exe	"Constructor VC2000 malware"
U	FLMBROWSERMOUSE	mouse32A.exe	Mouse utility for a Trust brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
U	FLMLABTECMOUSE	mouse32A.exe	Mouse utility for a Labtec brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
U	FLMMEDIONMOUSE	mouse32a.exe	Mouse utility for a Medion branded Fellowes mouse
U	FLMOFFICE4DMOUSE	moffice.exe	Mouse utility for a Labtec brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
U	FLMOFFICE4DMOUSE	mouse32a.exe	Mouse utility for a Micro Innovations brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
U	FLMTRUSTKB	KbdAp32A.exe	Keyboard utility for a Trust brand keyboard. If you disable this entry you will not be able to use any of the keyboard hotkeys or other non-standard functions on the keyboard
U	FLMTRUSTMOUSE	mouse32a.exe	Mouse utility for a Trust brand (and possibly others) mouse. If you disable this entry you will not be able to use any of the non-standard functions of the mouse
X	Floppy Master	[path to trojan]	"Added by the ZONIT-F TROJAN!"
X	flps	flps.vbs	"Added by the BYRON WORM!"
?	FLSVCI	FLSVCI.exe	"??"
Y	FltProcess	msinet.exe	"Part of Cyber Patrol internet filtering software to restrict access to certain types of material on the internet. It can be disabled but do not ask how it's done"
X	FlyswatDesktop	flydesk.exe	Advertising spyware
X	fmnwebassist	fmnwebassist.exe	Adware popup generator
U	FMStart	Fmstart.exe	"GFI FAXmaker - native fax connector for Microsoft Exchange Server or for networks
X	FMSZ	fmsz.exe	"Added by the FMSZ TROJAN!"
X	fnmwebassist	fnmwebassist.exe	"WinPL adware"
?	Focus	Focus.exe	"ISDN configuration wizard?"
X	Folder Service	wssdtu.exe	"Added by the MANIFEST TROJAN!"
U	FolderShare	FolderShare.exe	"""FolderShare allows you to create a private peer-to-peer network that will help you to synchronize files across multiple devices and access or share files with colleagues and friends"""
N	FoneSyncSystemTray	FoneSyncSystemTray.exe	System Tray icon for Nokia FoneSync utility for the 7160/7190 mobiles. Useful to send data from/to the cell phone and the computer. You can use it to backup data or even to input data through the computer keyboard (which naturally is much more comfortable). Run manually when required
X	FontsLoader	ldfnt32.hta	Unidentified malware
Y	FoolProofSweep	??	"Part of FoolProof Security PC security software from SmartStuff"
N	Forbes	ForbesAlerts.exe	Forbes Business News Alerts - displays business news headlines in a little window on the screen
X	ForceShow	"rundll32.exe QaBar.dll	ForceShowBar"
U	Fortis Secure Layer Config	cseinst.exe	Fortis Bank Home Banking part. Installed during the installation of the software necessary to run the Home Banking. According to Fortis Bank this will not in any way be harmful to the system or relay system information
X	fotos	fotos.exe	"Added by the BANKER-FP TROJAN!"
N	FotoStation Easy AutoLaunch	FotoStation Easy AutoLaunch.exe	Installed with a Nikon digital camera. Used to collect photos uploaded from camera program NkVwMon.exe. If your camera is not connected (via USB port) you do not need this program loaded either
X	foxwudy9912	service.exe	"Added by the BANCOS-BT TROJAN!"
N	fpassist	fpassist.exe	"Part of FreePDF (was FreePDF XP) - a utility used to create Adobe compatible PDF files from virtually any Windows application. This executable needs to be running when you want to send a printer output to a PDF file via the FreePDF virtual printer"
N	Fpx	mnmsrvc.exe	Remote Desktop Sharing service part of Microsoft's Netmeeting allowing users to share items on their screens across remote locations
X	fqor	stub_113_4_0_4_0.exe	"TargetSaver adware"
X	Framework Windows	frmwrk32.exe	"Added by the FAKEAV-KS TROJAN!"
X	France	svchost.exe	"Added by the MIMAIL.L WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
N	Fraps	FRAPS.EXE	"Fraps® by Beepa Pty Ltd - is ""a universal Windows application that can be used with games using DirectX or OpenGL graphic technology"". It can show how many Frames Per Second (FPS) you are getting
?	Free Downloads Monitor	fdcmon.exe	"??"
X	free-save	[path to risk]	"Freesave security risk that tracks and sends browser information and visited websites on the computer. Uninstall this software unless you put it there yourself"
X	FreeAttention	eqsefeqe.exe	Added by an unidentified WORM or TROJAN!
N	Freebie Notes	FreebieNotes.exe	"Freebie Notes by Power Soft - create electronic notes (stickers)"
X	FreeMP3download	"rundll32.exe MSA64CHK.dll	DllMostrar"
N	FreePDF Assistant	fpassist.exe	"Part of FreePDF (was FreePDF XP) - a utility used to create Adobe compatible PDF files from virtually any Windows application. This executable needs to be running when you want to send a printer output to a PDF file via the FreePDF virtual printer"
N	FreePDF_Assistant	fpassist.exe	"Part of FreePDF (was FreePDF XP) - a utility used to create Adobe compatible PDF files from virtually any Windows application. This executable needs to be running when you want to send a printer output to a PDF file via the FreePDF virtual printer"
X	freestyle	lockx.exe	"Added by the RBOT-ATH WORM!"
U	freesurfer	fs20.exe	"EMS Free Surfer mk II - pop-up stopper"
X	freexstyle	lockbar.exe	"Added by the LOXBOT.D WORM!"
X	freexstyle	lockbr.exe	"Added by the LOXBOT.C WORM!"
X	freinst	pgs.exe	"Part of the AVSystemCare rogue security software and other members of this family. See here for more examples"
U	Fresh Desktop	freshdesktop.exe	"Fresh Desktop is a utility that lets you manage vast collections of wallpapers for your desktop with ease. When run on bootup it changes the desktop wallpaper at startup or at specified intervals"
N	freshclam	freshclam.exe	"Auto update agent of the open source Clamwin virus scanner"
?	frguk	shdrkmck.exe	"??"
?	FridaysInHellInstaller	FridaysInHellInstaller.exe	"??"
X	FriendlyType	lsass.exe	"Added by the WEBUS.B TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	FriendlyTypeName	services.exe	"Added by the NEVEG.B or NEVEG.C WORMS! Note - this is not the legitimate services.exe process
N	FriendlyWebQuick-Launch	SELFCERT.EXE	selfcert.exe is a stand alone program for creating your own digital certificates for macros - the .exe is installed as an extra basically by clicking on MS Office in add/remove programs and selecting remove - also I would do away with the FriendlyWebQuickLaunchBar as well
U	FRISK FP-Scheduler	F-Sched.exe	"Scheduler for F-Prot anitvirus software. Leave enabled unless you scan manually on a regular basis"
?	FRITZ!DSL Startcenter	StCenter.exe	"FRITZ! ISP software ""StartCenter"" User interface that allows you to manage
X	Frsk	frsk.exe	Unidentified adware downloader trojan
Y	frxmxins	frxmxins.exe	ATI 3D Studio MAX/VIZ driver
X	FS Agent	fagent.exe	"Added by the VOLVER-B TROJAN!"
X	FS6519	FS6519.dll.vbs	"Added by the SOLOW.B WORM!"
Y	fsaa	fsaa.exe	"F-Secure antivirus Authentication Agent - creates and stores private keys used by a client to access servers"
N	FSCBoss	FSCBoss.exe	Free Store Club shop online software
?	FSDPSRV	FSDPSRV.exe	"??"
X	fsdsft	[path to backdoor]	"Added by the RANKY.S BACKDOOR!"
X	FSH	svcnva.exe	Identified by Ewido Security Suite (Ewido is now part of AVG Technologies) as the DELF.KA TROJAN!
U	fsp	fsp.exe	"Folder Shield - hide entire directories and thus prevent access by anyone else to your personal files and documents"
Y	fspr	FolderShield.exe	"Folder Shield - hide personal files and folders"
N	FSScrCtl	FSScrCtl.exe	Screen saver control applet used by the "Stardust Screen Saver Toolkit" and "SolidWorks Screen Saver"
U	fsserv	fserv.exe	"Farsighter Server - monitors a remote computer invisibly by streaming video to a viewer on your computer. You will know exactly what is happening on the remote computer as you see it in real-time"
U	fssui	fsui.exe	"System Tray access to and notifications from Windows Live Family Safety - optionally installed as part of Windows Live Essentials. ""With Family Safety
U	fssui	fssui.exe	"System Tray access to and notifications from Windows Live OneCare Family Safety - part of the Live OneCare range and now superseded by Windows Live Family Safety which is part of Windows Live Essentials. Allows you to decide how your kids experience the Internet by limiting searches
X	fstsvc	"rundll32.exe fstsvc.dll	start"
U	fsui	fsui.exe	"System Tray access to and notifications from Windows Live Family Safety - optionally installed as part of Windows Live Essentials. ""With Family Safety
X	FSW	FSW.exe	"FreeScratchAndWin parasite"
U	FSWebServer	fsws.exe	"Easy File Sharing Web Server is a Windows program that allows you to host a secure peer-to-peer and web-based file sharing system without any additional software or services"
U	FtLnSOP_setup	FtLnSOP.exe	Fujitsu scanner utility
U	FTMSFLT(USB)	FTMSFLTU.EXE	Fujitsu's Touch Panel Message Notifier
X	FTP FOR WINDOWS	ftpwin32.exe	"Added by a variant of the RBOT WORM!"
U	Ftpqueue	Ftpsched.exe	"Part of WS_FTP Pro from Ipswitch. Queueing facility for scheduling FTP transfers"
?	FtpServer.exe	FtpServer.exe	"Part of the Sharpdesk from Sharp Electronics. ""A desktop-based
X	FU	FUvirus.exe	"Added by the VB-EJC TROJAN!"
X	Fucker	fucker.vbs	"Added by the CATCHER-A WORM!"
U	Fujitsu Hotkey Utility	IndicatorUty.exe	"Fujitsu Hotkey Utility displays icons on the screen when you use hotkeys on a Fujitsu Siemens Lifebook
U	Fujitsu Menu	FjMnuIco.exe	"From the ""Fujitsu Menu"" tray icon you have instant access to the Control Panel
X	fukerservice	fukerz.exe	"Added by a variant of the RBOT WORM!"
N	FusionHdtvTray	FusionHdtvTray.exe	"FusionTrayAgent - main executable for DVICO FusionHDTV software. It adds an icon to system tray that allows you to easily access Fusion HDTV software"
U	FusionRC	FusionRC.exe	"Remote control manager for DVICO FusionHDTV"
U	FusionRemote	FusionRc.exe	"Remote control manager for DVICO FusionHDTV"
N	FusionTrayAgent	FusionHdtvTray.exe	"FusionTrayAgent - main executable for DVICO FusionHDTV software. It adds an icon to system tray that allows you to easily access Fusion HDTV software"
N	fwrastrc	fwrastrc.exe	Dial-up software for Friendly Technologies/1NationOnLine free ISP
U	fwservice	fwservice	"eAcceleration Stop-Sign security software related. Previously not recommended
X	fzg	svhost32.exe	"Added by the DLOADER.BDK TROJAN!"
X	G0mez	G0mez.vbs	"Added by the GORMLEZ-A WORM!"
X	G3	GSMedia3.exe	"Malware downloader - detected by Kaspersky as the VB.UX TROJAN!"
U	G6FTP Server Tray Monitor	G6FTPTray.exe	"System Tray monitoring tool for Gene6 FTP Server - ""an advanced FTP server software for Windows developed specifically for security and high performance requirements"""
?	GACService	GACService.exe	"Related to a Gemplus product. What does it do and is it required?"
X	gadkgak12	fsafsakx12.exe	"Added by the ONLINEG-N TROJAN!"
N	Gadwin PrintScreen	PrintScreen.exe	"Gadwin PrintScreen - utility to capture
X	game	shit.exe	Added by the Netclap Gold backdoor TROJAN!
X	game	patcher.scr	"Added by the PSW-ED TROJAN!"
X	Game House	GameHouse.exe	"Added by the DELF-DRA WORM!"
N	GameDrive	GDTask.exe	"GameDrive from FarStone - virtual CD/DVD drive emulator that allows you to run your PC games without the disc. Available via Start → Programs"
X	Games Acceleration	svshost.exe	"EasySearch adware"
X	Games Acceleration	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Games Acceleration	svshost1.exe	"Added by the DLOADR-AWD TROJAN!"
X	Games toolbar	rundll32.exe [path] tbGame.dll DllShowTB	"Topconverting.com/180Search ""Games Toolbar"" adware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
N	GameSpot	kontiki.exe	"Kontiki Delivery Manager - Windows-based client software that enables secure delivery of content to users' desktops"
X	gamma	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
U	GammaHotKeys	setgamma.exe	"Part of the RadeonTweaker program for adjusting ATI Radeon graphics cards. Allows you to adjust the gamma (or brightness) when playing a full-screen game without switching back to the desktop"
X	gangsta	gangsta.exe	"Added by the RIMA.A BACKDOOR!"
U	GARO Status Monitor	cnwism.exe	Print monitor for certain Canon printers
X	gaSrv	gaSrv.exe	"Detected by Panda as the DOWNLOADER.ALQ TROJAN! Adware downloader"
X	gaSrve	gaSrve.exe	"Detected by Panda as the DOWNLOADER.ALQ TROJAN! Adware downloader"
X	Gate Personal Firewall	Systpl.exe	"Added by the RBOT.ADC WORM"
N	Gateway Extended Warranty	GWCares.exe	Gateway Extended Warranty reminder
X	Gay_Sexy_**	Gay_Sexy_**.exe	Premium rate adult content dialler (where * is a random char)
U	GazelDisplay	gsyno.exe	"BT Digital Access USB - Gazel ISDN installation System Tray icon"
Y	GBSpaceMan	SpaceMan.exe	"GreenBorder - secure your browsing activities on the internet"
X	gcasDtServ	gcasDtServ.exe	Added by an unidentified WORM or TROJAN. Note - this is not related to Microsoft Antispyware which has a process bearing the same name which doesn't appear as a startup
Y	gcasServ	gcasServ.exe	"Giant Antipsyware - now superseded by Microsoft's Windows Defender"
X	gcasServ	realsched.exe	"Added by a variant of the TACTSLAY.A TROJAN! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name"
N	GCS	GrabClipSave.exe	"GrabClipSave screen capture tool"
X	gdagdgajs	bbsbw.exe	"Added by the SDBOT-QX WORM!"
N	Gearbox	confsvr.exe	"NTL's Gearbox software for configuring internet connections with their NTLWorld software - does a similar job to the Internet Connection Wizard which can be used instead using the dial-up details available here"
N	GEARsec	gearsec.exe	Installed by Apple Quicktime package - iPod®/iTunes® CDRW support. Can be disabled if you only require Quicktime player
X	Gekio Startups	gnksvc32.exe	"Added by the AGOBOT.AFJ WORM!"
N	GemStRmW	GemStRmW.exe	"For a GemPlus smart card reader. If it doesn't start automatically when you insert the smart card
U	Gene USB Monitor	USBMonit.exe	Monitors USB ports for insertion of Sandisk USB flashdrives
X	General Antivirus	GenAvir.exe	"General Antivirus rogue security software - not recommended
X	Generic host proccess for windows	SVCHOSTS.EXE	"Added by the SPYBOT-GQ WORM!"
X	Generic Host Process	SCHOST.EXE	"Added by the RBOT-NC WORM!"
X	Generic Host Process	svchost.exe	"Added by the DLOADER-NX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Generic Host Process	camacttiv.exe	"Detected by AVG as the CIADOOR.13 TROJAN!"
X	Generic Host Process	lsassw.exe	"Added by the AGOBOT-N WORM!"
X	Generic Host Process for Win Services	mscvs.exe	"Added by a variant of the SDBOT WORM!"
X	Generic Host Process for Win32 Service	svlhost.exe	"Added by the WOOTBOT.EX WORM!"
X	Generic Host Process for Win32 Service	rpchost.exe	"Added by the IRCBOT.DCN WORM!"
X	Generic Host Process for Win32 Services	ntspcv.exe	"Added by the SDBOT.S TROJAN!"
X	Generic Host Process for Win32 Services	intspvc.exe	"Added by the DINFOR.D WORM!"
X	Generic Host Process for Win32 Services	winsvc.exe	"Added by the SDBOT-O WORM!"
X	Generic Host Process for Win32 Services	bazzi.exe	"Added by the AHKER.E WORM!"
X	Generic Host Process for Win32 Services	winsvc32.exe	"Added by the SDBOT-P WORM!"
X	Generic Host Process for Win32 Services	lspsvc.exe	"Added by the MUMU.C WORM!"
X	Generic Host Process for Win32 Services	SPSVC.EXE	"Added by the SDBOT.DA WORM!"
X	Generic Host Process for Win32 Services	svchost32.exe	"Added by the AGOBOT.ALH WORM!"
X	Generic Host Process for Win32 Services	svñhîst.exe	"Added by the DLOADER.AK TROJAN!"
X	Generic Host Process for Win32 Services	winlogon.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Generic Host Process For Win32 Services	mtsc32.exe	"Added by the VB-CPL TROJAN!"
X	Generic Host Process for WinXP Services	mshelp.exe	"Added by the AGENT-GQP TROJAN!"
X	Generic Host Process2 System Backup	scvhost2.exe	"Added by the RBOT-BAH WORM!"
X	Generic Host Process326a System Backup	scvhost326a.exe	"Added by a variant of the SDBOT WORM!"
X	Generic Host Service	lshost.exe	"Added by the RBOT.LU WORM!"
X	Generic Service Process	regsvc32.exe	"Added by the GAOBOT.UJ or GAOBOT.UL WORMS!"
X	Generic Service Process	serv1ces.exe	"Added by the AGOBOT-JK WORM!"
X	Generic Service Process	nvsvc.exe	"Added by the AGOBOT.BY WORM! Note - this is not the valid NVIDIA Driver Helper Service and is located in %System%"
X	Generic Service Process	srvhost.exe	"Added by the AGOBOT-FX WORM!"
X	Generic Service Process	regsvr32.exe	"Added by the AGOBOT-AGD WORM!"
X	Generic Service Process	SRCHOST.EXE	"Added by the AGOBOT-DG WORM!"
X	Generic Services Process	regsvc32.exe	"Added by the GAOBOT.SY WORM!"
X	GenericHostXP	WinLoaderXP.exe	"Added by the BDOOR-ACX BACKDOOR!"
Y	Genie USB Monitor	USBmonitor.exe	Port monitor for an external USB hard drive. Required to enable access to the drive
X	Genius Mose Driver	svghost.exe	"Added by a variant of the SPYBOT WORM! See here"
X	genserv path	sdqdqg.exe	"Added by the SDBOT-RF WORM!"
X	Geography TX 1.0 NT	CompuSpeed.vbs	"Added by the NEWLEY-A WORM!"
X	Gerenciamento de arquivos do Windows	Winmod32.exe	"Added by the DLOADER-WG TROJAN!"
X	german.exe	winsystems.exe	"Added by the BAGLEDl-AE TROJAN!"
X	german.exe	wintems.exe	"Added by the BAGLE-AS TROJAN!"
X	gescw	gescw.exe	"Part of BeschermingsTool
X	Gestionnaire de disques universel	sysoobe.exe	"Added by the TOADER-A TROJAN!"
N	Get Smile	getsmile.exe	Puts smilie faces in your E-mail. Run manually when required
X	Get-Torrent Service	wakeservice.exe	Get-Torrent bittorrent client - Installs LOP adware
X	GetitAll	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	GetMP3	"rundll32.exe MSA64CHK.dll	DllMostrar"
X	GetTheMusic	"rundll32.exe MSA64CHK.dll	DllMostrar"
U	Getting started with MacDrive	MDGetStarted.exe	"MacDrive 7 from Mediafour Corporation - ""enables anyone using Windows Vista
X	Ghost Antivirus	GhostAV.exe	"Ghost Antivirus rogue security software - not recommended
X	Ghost Relay	[random filename]	"Added by the DNSCHANG.EK TROJAN!"
U	GhostSecuritySuite	gss.exe	"Ghost Security Suite - protect the registry from unauthorized reading and modification and other tools"
N	GhostStartService	GhostStartService.exe	"Required to run the Windows based wizard in Norton Ghost - added from the 2003 version. Will start automatically when you run the wizard"
N	GhostStartTrayApp	GhostStartTrayApp.exe	"System Tray access to Norton Ghost - added from the 2003 version"
Y	GhostSurfDelSatellite	DeleteSatellite.exe	"Part of SpyCatcher spyware remover from Tenebril. Prevents rogue programs from sending personal information to a remote user via the Internet. If you use SpyCatcher with real time scanning
U	Giganews Accelerator	GiganewsAccelerator.exe	"Giganews Accelerator from Giganews
Y	Gilat SOM Enumerator	dllhost.exe	For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system
X	gimmygames	[path to trojan]	"Added by the DLOADR-LN TROJAN!"
X	gimmysmileys	gimmysmileys.exe	"GimmySmileys adware"
?	GisdnLog	gisdnlog.exe	"BT Digital Access USB"
U	Glass2k	Glass2k.exe	""Glass2k is a small little program that allows Win2K/XP users to make any window transparent""
X	Global Startup	WinDash.EXE	"Detected by Kaspersky as the VB.Q WORM!"
X	GlobalSCAPE	[random filename]	"Added by the RBOT-AYM WORM!"
X	Glock Suite 1.1	glock32.exe	"Added by the TINY.GV TROJAN!"
X	GLSetIT32	msiexec16.exe	"Added by the OPTIX PRO TROJAN!"
X	GLSetIT32	isass.exe	"Added by a variant of the OPTIX PRO TROJAN!"
X	GLSetT32	smsiexec.exe	"Added by the OPTIX-D TROJAN!"
X	GMedia2	GSM2.exe	"Malware downloader - detected by Kaspersky as the VB.UX TROJAN!"
X	GMedia2	GSMedia3.exe	"Malware downloader - detected by Kaspersky as the VB.UX TROJAN!"
Y	Gmouse	Gmouse.exe	Amouse mouse driver - required if you use non-standard Windows driver features
X	Gmsvc32	gmsvc32.exe	"Added by the AGOBOT.ABN WORM!"
U	Gnetmous	gnetmous.exe	"Genius mouse driver - required if you use non-standard Windows driver features"
U	GNETMOUSE	gnetmouse.exe	"Genius mouse driver - required if you use non-standard Windows driver features"
X	GNP Generic Host Process	svchost.exe	"Added by the ZAPCHAS-F BACKDOOR! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Go And Start	svdll32.exe	"Added by the RBOT.AI BACKDOOR!"
X	Go!Zilla Monster Downloads	Go.exe	Download manager for resuming downloads and choosing multiple download locations. Advertising spyware
U	GoBack Polling Service	GBPoll.exe	"Roxio's (nee Adaptec) GoBack software which allows you to revert back to a previously working state on you hard drive if you install a new program and your system goes faulty - performing the same functions with extra features as System Restore on WinMe/XP systems. Disable before running Scandisk or Defrag. Not required for WinMe/XP users
X	GoldenAntiSpy	pgs.exe	"GoldenAntiSpy rogue security software - not recommended. A member of the AVSystemCare family"
U	Goldensoft_MndlSvr	MndlSvr.exe	"Goldensoft CD Ghost related - turns a computer into a 200X-speed CD-ROM tower. Working from the hard drive
X	Golum	services.exe	"Added by the GOLUM.A TROJAN! Note - this is not the legitimate services.exe process
X	golumm	services.exe	"Added by the DLOADER-ET TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""golumm"" subfolder"
U	Google Desktop	GoogleDesktop.exe	"Google Desktop - ""a desktop search application that provides full text search over your email
U	Google Desktop Search	GoogleDesktop.exe	"Google Desktop - ""a desktop search application that provides full text search over your email
N	Google Earth Viewer	GOOGLEMAPS.EXE	"Google Earth ""combines satellite imagery
U	Google Quick Search Box	GoogleQuickSearchBox.exe	"Part of Google Toolbar (from version 6 onwards) for IE. The Quick Search Box sits between the ""Start"" button and Quick Launch toolbar and ""lets you easily search both your computer and the Web from a slick-looking search box that comes up only when you need it"""
X	Google service	Googlesetup.exe	"Added by the IRCBOT-RJ WORM!"
X	Google Service FR	GO0GLEFREE.EXE	"Added by a variant of the SPYBOT WORM!"
U	GoogleDesktop	GoogleDesktop.exe	"Google Desktop - ""a desktop search application that provides full text search over your email
U	GoogleQuickSearchBox	GoogleQuickSearchBox.exe	"Part of Google Toolbar (from version 6 onwards) for IE. The Quick Search Box sits between the ""Start"" button and Quick Launch toolbar and ""lets you easily search both your computer and the Web from a slick-looking search box that comes up only when you need it"""
U	GoToMyPC	g2svc.exe	"ExpertCity GoToMyPc logon - web-based remote-access solution that allows individuals and companies to register their computers online and then securely access those computers from any web browser"
U	GoTrusted	GoTrusted Secure Tunnel.exe	"""GoTrusted is the fast
X	GotSmiley	GotSmiley.exe	"GotSmiley - ad supported program that provides the user with smileys for use in emails. Not recommended. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	govurarope	"Rundll32.exe retasevo.dll	s"
?	gramdate	2Stop.exe	"??"
X	Graphic Driver	smss32.exe	"Added by a variant of the RBOT WORM!"
X	Graphics	_default.pif	"Added by the AUTOSKY WORM!"
X	Graphics adapter service	windll.exe	"Added by the ATNAS.A WORM!"
U	Gravis Appawareloader	dbserver.exe	"Looks like it's associated with Gravis game controllers and the Keyset Manager
U	Gravis Xperience Driver Support	Grxp4exe.exe	"Driver for Gravis game controllers such as the Eliminator Aftershock. Must be loaded if you run the supplied application software for the controller to be recognized. Start it manually via a shortcut if not used"
?	GrdSys32	GrdSys32.exe	"X-Stream ISP software. Offers free Net access funded by on-screen ads. Is it required or can you create your own dial-up networking connection to use on demand?"
X	GreasyPalmUpdate	GreasyPalmUpdate.exe	"SearchFast adware"
X	GreatDownloads	"rundll32.exe MSA64CHK.dll	DllMostrar"
N	Greetings Workshop	GWREMIND.EXE	You really want to be reminded about somebody's birthday at the expense of resources?
X	gremier	wscript.exe gpremier.vbs	"Added by the GPREMIER WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""gpremier.vbs"" file is located in %System%"
X	grinders	grinders.exe	"Added by a variant of the Storm/Nuwar/Zhelatin WORM! See here for an example"
N	Grokster	Grokster.exe	"Grokster Peer-To-Peer File Sharing program"
U	GroupWise PDA Connect - 3CmPlm	AutoDet.exe	"3Com Palm PC specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
U	GroupWise PDA Connect - GrpWse	Agnt.exe	"GroupWise PDA Connect PDA synchronisation utility - from Novell"
U	GroupWise PDA Connect - PocketPC	AUTODE~1.EXE	"Windows Mobile Pocket PC specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
U	GroupWise PDA Connect - ScheduleSync	SCHEDU~1.EXE	"ScheduleSync specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
X	GsAds	gms2.exe	"PacerD_Media/Pacimedia.com adware"
?	Gscbc	Gscbc.exe	"??"
X	gshp	zzgshp.vbs	Homepage hi-jacker
N	Gsiconexe	Gsicon.exe	"ADSL modem monitor from Eicon Networks (as used by BT for its Broadband internet service for example). Can safely be disabled without affecting the connection - all this does is give an indication of connectivity and access to the diagnostic facilities"
?	GsiFinal	"rundll32 gspndll.dll	postInstall final"
?	GSISETUP	[path] GsiInst.exe INSTALL [path] V205Res 13	"BT Voyager ADSL modem related - what does it do and is it required?"
N	GSOrganizer	GSOrganizer.exe	"GoldenSection Organizer (now WinOrganizer - personal information manager)"
X	gssomatic	gssomatic.exe	"Searchcentrix hijacker"
Y	gStart	gStart.exe	gStart GPS software from Garmin
X	GStartup	GMT.exe	"Gator spyware component - see here. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	gsv	gsv.exe	Added by the ROBAL 1.0 backdoor TROJAN!
X	GT15J4R49V	cpuserv.exe	Identified as a variant of the Trojan.Win32.Radi.gu malware
X	gtydf	iisca.exe	"Added by the CLAGGER-BB TROJAN!"
X	gtydf	iscca.exe	"Added by the DWNLDR-GTK TROJAN!"
U	Guardian PC Security Tools	Pfft.exe	"Boomerang Software's Guardian PC Security Tools - now rebranded as the eXtendia Security Suite"
X	GuardPcs.exe	GuardPcs.exe	"GuardPcs rogue security software - not recommended
X	guarnset	guarnset.exe	"Adlogix adware"
X	GustavVED	[filename].exe	"Added by the OPASERV.H WORM!"
X	gwiz	ntsystem.exe	"Added by the NITWIZ.A TROJAN!"
N	GWMDMMSG	GWMDMMSG.exe	Used with internal modems on Gateway and vprMatrix PCs. This is the "GTW modem messaging applet" and is not required for the modem to work correctly
X	G_Host	gHost.exe	"Added by the AUTOIT-BP WORM!"
X	G_Server.exe	G_Server.exe	"Added by the FEUTEL-C TROJAN!"
X	G_Server1.2.exe	G_Server1.2.exe	"Added by the GRAYBIRD-Z TROJAN!"
U	H/PC Connection Agent	WCESCOMM.EXE	"Connection manager for Microsoft ActiveSync - mobile device synchronization software for Windows XP (and earlier)
X	h4te Service Drivers	h4te.exe	"Added by a variant of the RBOT WORM!"
X	hachimitsu-lemon	hachimitsu-lemon.exe	"Added by the HACHILEM TROJAN!"
U	HalifaxHowardCluster	skinkers.exe	"""Howard the Weatherman"" desktop client from Halifax by Skinkers - marketing/messaging tool. Leave enabled if you want to receive messages"
N	Hard Disk Sentinel	HDSentinel.exe	"Hard Disk Sentinel - a multi-OS hard disk drive monitoring application. Its goal is to find
X	HardDriveGuard	SysRep.exe	"HardDriveGuard rogue system error and cleaning utility - not recommended
X	Hardware Monitor Service	mshms.exe	"Added by the WOLLF-A TROJAN!"
U	Hardware Sensors Monitor	hmonitor.exe	Utility to monitor fan speed and temperatures - similar to Motherboard Monitor. Only required if you're concerned about your system temperature - typically for "overclocked" systems
X	Hardware Shell Detection	WinHSD.exe	"Added by a variant of the RBOT WORM!"
U	Harmony 98 - CasioOrg	CasAgnt.exe	"Enterprise Harmony 98 for CASIO - synchronization software for use with Microsoft® Outlook 97/98/2000"
X	HataDuzelticisi	SysRep.exe	"HataDuzelticisi
U	Hawking Wireless Utility	HWU8DD.exe	"Wireless management utility for the HWU8DD Hi-Gain™ USB Wireless-G Dish Adapter from Hawking Technologies
X	Hbinst	Hbinst.exe	"Hotbar adware"
U	HControlUser	HControlUser.exe	Hotkeys on an ASUS Notebook. Only required if you use the additional keys
N	hcsystray	hc_tray.exe	"Kuma Notifier for the Shootout! game from the History Channel. ""It lets you know whenever there's a new episode that's been released or an announcement from the Kuma team. Just click it to get up-to-the-minute game and event information"""
N	HDAShCut	HDAShCut.exe	High definition audio page shortcut for Realtek audio devices - not required
X	hdlfoe df98ndf	svchots.exe	"Added by a variant of the RBOT WORM!"
X	hdlpscom	[8 random letters].exe	"Added by the RBOT-FUL WORM!"
X	HDriveSweeper	HDriveSweeper.exe	"HDriveSweeper rogue privacy program - not recommended
X	Hekio Startups	Hnksvc32.exe	"Added by the AGOBOT-QE WORM!"
X	HELLBOT TEST	1hellbot.exe	"Added by the MYDOOM.BO WORM!"
X	hellfire	svchost.exe	"Added by the LEOX.D TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	hellodolly	shost.exe	"Added by the YODO WORM!"
X	helloserv	helloserv.exe	"Added by the ZHELATI.BHA WORM!"
X	help	help.scr	"Added by the BANCOS-BBU TROJAN!"
X	Help	lshost.exe	Identified as a variant of the Trojan-Clicker.Win32.Delf.aro malware
X	Help Temp Files	netreg.exe	"Added by the FORBOT-EM WORM!"
X	Help Temp Files	emp32.exe	"Added by the FORBOT-EC WORM!"
U	HelpCenter	sprtcmd.exe /P HelpCenter	"Self-help support tool for BellSouth's FastAccess® DSL (now owned by AT&T) broadband service (provided by SupportSoft
U	HelpCenter4.1	sprtcmd.exe /P HelpCenter4.1	"Self-help support tool for BellSouth's FastAccess® DSL (now owned by AT&T) broadband service (provided by SupportSoft
X	Helper	eschlp.exe	"Added by the BLASTER.T WORM!"
X	HELPER	Netherlands.exe	"AsdPlug premium rate adult content dialer variant"
X	HELPER	sweden.exe	"AsdPlug premium rate adult content dialer variant"
X	helpmanager	spoler.exe	"Added by the RANDEX.J WORM!"
X	heomstool	heomstool.exe	"Added by the HEOMS TROJAN!"
Y	HEProtect	HSockPE.exe	"Part of the AntiSpam function of the HAURI ViRobot Desktop internet security suite"
?	HerculesCamService	CamService.exe	"Related to the Hercules Dualpix HD Webcam. What does it do and is it required?"
X	hErcUnes	softhost.exe	"Added by the GARROCH WORM!"
U	Hermes Messenger	DGDRHE~1.EXE	"A LAN messenger alternative to WinPopUp - Digital Dreams Software"
X	HF Security	hfsecure.exe	"Added by the AGOBOT-TI WORM!"
X	hfdtubvnx	keepSafe.exe	"Added by the KILLAV.KAX TROJAN!"
Y	hffsrv	hffsrv.exe	"Hide Files & Folders - ""great easy-to-use password-protected security utility working at Windows kernel level you can use to password-protect certain files and folders
Y	hffsrv.exe	hffsrv.exe	"Hide Files & Folders - ""great easy-to-use password-protected security utility working at Windows kernel level you can use to password-protect certain files and folders
X	hgkytwe	keepSafe.exe	"Added by the KILLAV.KAX TROJAN!"
N	HGTXPEI	FirstReboot.exe	Herucles Audio tool for the Hercules Game Theater XP soundcard. Available via Start -> Settings -> Control Panel
X	hhtnsn	rnxntup.exe	"Added by a variant of the ORCU.B TROJAN!"
U	Hide and Protect any Drives for Win95/98/Me/2k/XP	HPDAgent.exe	"Loads Hide and Protect any Drives - which allows you to ""Protect Hard drive
X	HideRun.exe	Hiderun.exe and svhost.exe and pro.gif	"Added by the BOOHOO WORM!"
X	HideStyle	Ante Browse Trust.exe	"IE toolbar taking you to Lop.com. If the exe is running
U	Hidetools Spy Monitor	wmispe.exe	"HideTools Spy Monitor surveillance software. Uninstall this software unless you put it there yourself"
U	hidserv	hidserv.exe	"This is the Human Interface Device Server for Win98SE/2000/Me/XP
X	Hidup_Susah	Pembantu.exe	"Added by the SILLYFDC.BDM WORM!"
X	hid_start	gzmrotate.dll	"AdRotator/IconAds adware"
U	High Definition Audio Property Page Shortcut	CHDAudPropShortcut.exe	"Realtek audio card related. Probably adds the odd feature to one of the ""Sounds"" Control Panel applet tabs - doesn't appear to be required"
N	High Definition Audio Property Page Shortcut	HDAShCut.exe	High definition audio page shortcut for Realtek audio devices - not required
U	High Definition Audio Property Page Shortcut	CHDAudPropShortcut.exe	"Realtek audio card related. Probably adds the odd feature to one of the ""Sounds"" Control Panel applet tabs - doesn't appear to be required"
Y	HighPoint ATA RAID Management Software	raidman.exe	"HighPoint RAID management - hard disk striping/mirroring utility for increased performance and reliability. See here for more information on RAID"
X	Highspeeddownloader	SetupClickHere.EXE	"Homepage hijacker
U	HijackThis	HijackThis.exe	"""HijackThis is a free utility which quickly scans your Windows computer to find settings that may have been changed by spyware
U	HijackThis startup scan	HijackThis.exe	"""HijackThis is a free utility which quickly scans your Windows computer to find settings that may have been changed by spyware
X	HijSrv32	hijsrv.exe	"Added by the BANKGERM-D TROJAN!"
X	HistoriaLout.	GDC.exe	"HistoriaLout. rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
N	HistoryKill	histkill.exe	"HistoryKill removes your web surfing path by removing the URL drop-list history
U	Hitman Pro SurfRight Helper	srhelper.exe	"Hitman Pro - a utility to start a number of Security Protection software. They can be started individualy"
X	HKCU	server.exe	"Added by the AGENT-NLT TROJAN!"
X	HKLM	server.exe	"Added by the AGENT-NLT TROJAN!"
X	HKLMRun	windowsupdate.exe	"Added by the FORBOT-BJ WORM (where HKLM\Run represents HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run)!"
X	HKLM\Run	svhost.exe	"Added by the FORBOT-AO BACKDOOR (where HKLM\\Run represents HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run)!"
U	hkserv	HKserv.exe	Keyboard manager program required to use programmable power and function keys on some laptops such as the Sony PCG R505TS
U	hkss	hkss.exe	Compaq HotKey Support - multimedia keyboard support
X	HLcleanup	hlsetup2.exe	"LinkReplacer/FFinder adware"
X	HMI PowerSystem	hmisvc32.exe	"Added by the RANDEX.CZZ WORM!"
X	HML PowerSource	hmlsvc32.exe	"Added by the SDBOT-XL WORM!"
X	HMV PowerSource	hmusvc32.exe	"Added by the SDBOT-YW WORM!"
X	ho2stdll.exe	ho2stdll.exe	"Added by the BANKER-HO TROJAN!"
X	HOI Services	holsvc32.exe	"Added by the AGOBOT-SF WORM!"
N	Holiday Lights	Holiday Lights.exe	"Holiday Lights from Tiger Technologies. Festive desktop enhancement that adds lights. Available via Start -> Programs"
X	Hollaback	slvhosts.exe	"Added by the SDBOT.BMO WORM!"
X	Home Antivirus 2010	HomeAntivirus2010.exe	"Home Antivirus 2010 rogue security software - not recommended
N	Home Theater SchSvr	SchSvr.exe	"WinScheduler is installed with Home Theater Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
X	HomeAntivirus 2009	HomeAntivirus2009.exe	"HomeAntivirus 2009 rogue security software - not recommended
X	homepage.monitor.exe	isamonitor.exe	"Added by the ZLOB.MEDIA-CODEC TROJAN! This purports to be a Windows Media Player upgrade (with names such as ""iCodecPack""
U	Hook99startup	hk2re.exe	""Hook99 enables the user to customize the start button. You can change or remove the text and replace the Windows flag on button with icon of your choice. Supports Windows icons
U	HookSys	HookSys.exe	"SurfinGuard Pro from Finjan - internet protection software
X	Host	N/A	"Added by the POPDIS or STARTPAGE.F TROJANS!"
X	host	help.exe	IESearchToolbar parasite. Identified by Ewido Security Suite (Ewido is now part of AVG Technologies) as the DELF.LF TROJAN!
X	Host Process	mame.exe	"Added by the RBOT-APO WORM!"
X	Host Process	svchost.exe	"Added by the IRCBOT.AGF BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in the Fonts directory"
X	Host Process for Windows Tasks	taskhost.exe	"Added by the BREDO-AI WORM! Note - this is not the valid Windows 7 process which has the same filename and the file description is also ""Host Process for Windows Tasks"". It is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	hostdll.exe	hostdll.exe	"Added by the BANKER-BO TROJAN!"
U	HostManager	AOLHostManager.exe	"Manages a component essential to the operation of most current AOL software. If you remove it from startup it will load when IE is launched
N	HostManager	AOLSoftware.exe	"Quoted from AOL Beta Team
X	Hostname Manager Server	host32srv.exe	"Added by a variant of the RBOT WORM!"
X	Hostren.exe	Hostren.exe	"Added by PWS.BANKER.F
X	hostserv	hostserv.exe	"Added by the RBOT.BPZ WORM!"
X	hostserv	wiz98.exe	"Added by a variant of the SDBOT WORM!"
U	HostsFileMgr	winHostsEdit.exe	"AdBin from Gilmore Software Development. An easy solution to managing your Window's hosts file"
U	HostsMan	hm.exe	"""HostsMan is a freeware application that lets you manage your Hosts file with ease"". It is mainly intended to block specific domains (mostly advertising servers) by redirecting them to localhost
X	HostSrv	sachostx.exe	"Added by the LOOKSKY.H WORM! Drops multiple files in %System%"
X	HostSrv	sachostx.exe	"Added by the LOOKSKY.A or LOOKSKY.F or LOOKSKY.G WORMS!"
X	HostSrv	sachostx.exe...	"Added by the LOOKSKY.E WORM!"
X	HostSVC syse	HostSVC.exe	"Added by the RBOT-ANZ WORM!"
U	Hot Corners	Hotc.exe	"Hot Corners - ""lets you quickly activate or disable your screen saver by moving the mouse into a given corner of the screen"""
X	HOT FIX	E0chis.exe	"Added by the HUPIGON.JTY TROJAN!"
X	HOT FIX	windsys2.exe	"Added by the AGOBOT.AOI BACKDOOR!"
X	Hot Inside	Hottest Story Ever.exe	"Added by the BHARAT.A WORM!"
U	Hot Key Kbd 2690 Daemon	SK2690DM.EXE	Multi-function keyboard driver. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
U	Hot Key Kbd 9910 Daemon	SK9910DM.exe	Multi-function keyboard driver. Allows the use of programmable keys on mulimedia keyboards. Required if you use the additional keys
X	Hotbar	Hbinst.exe	"Hotbar adware"
X	HotbarSA	HotbarSA.exe	"Hotbar adware"
X	hotefix	msnmanegers.exe	"Added by the IRCBRUTE.AS TROJAN!"
X	hotfix	msnnmaneger.exe	"Added by the WOOTBOT.AF WORM!"
X	Hotfix Updat	svdhost32.exe	"Added by the GAOBOT.ZW WORM!"
U	HotKeysCmds	hkcmd.exe	"Hot Key handler for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
X	HotKeysCmds	[path to worm]	"Added by the PAHATIA-A WORM!"
N	HotSync Manager	hotsync.exe	Installed when connecting a Palm HotSync cradle up to a USB port. The Blue and Red Arrow Icon that enables Palm / Handspring Synchronizing. Available via Start → Programs
X	Hot_Kiss	Hot_Kiss.exe	Adult content dialler
X	Hot_Tarts	Hot_Tarts.exe	Adult content dialler
X	Hot_Tarts_**	Hot_Tarts_**.exe	Premium rate adult content dialer (where * is a random char)
X	Hot_Tarts_Au	Hot_Tarts_Au.exe	Premium rate adult content dialler
X	Hot_Tarts_mc	Hot_Tarts_mc.exe	"HotTarts adult content dialer"
U	HoverDesk	HoverDesk.exe	"HoverDesk - desktop replacement software"
N	hp center UI	ShadowBar.exe	"User Interface for HP Center - see here"
X	HP Deskjet	HP_DeskJet_500.exe	"Added by the FORBOT-DA WORM!"
X	HP Desktop	ccappms.exe	"Added by the SDBOT-TG WORM!"
U	HP Display Settings	hpdisply.exe	"Sets default display settings. Unchecking this item has been reported to cure a ""Problem sending command to keyboard"" error message"
U	HP Health Check Schedule	HPHC_Scheduler.exe	HP Health Check Scheduler from Hewlett-Packard
?	HP IDScheduler	HPIDSCHD.exe	"HP Instant Delivery Scheduler"
N	HP Image Zone Fast Start	hpqthb08.exe	"Improves the startup time of HP Image Zone. If you disable it
N	HP Info Express	??	"On HP PCs
U	HP Instant Support	matcli.exe	""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
N	HP Internet Center	SURFBRD.EXE	Loads the HP Internet center surfboard on startup. HP Internet Center allows you to customize the multimedia keys on the fly without having to go the Control Panel --> Keyboards to change them
N	HP JetDiscovery	HPJETDSC.EXE	HP JetAdmin software which monitors printing jobs on a network environment
N	HP JetSpeed Autostart	AUTOSTART.EXE	Autostart executable for the old multiplayer game HP Jetspeed
U	HP Laser Jet Director	hppdirector.exe	"System Tray icon that opens various functions such as copy
?	HP Network Registry Agent	hpnra.exe	"??"
?	HP OfficeJet Series xxx Startup	HPOSTR03.EXE	"xxx represents the series number - such as 700. What does it do and it it required?"
?	HP OfficeJet Series xxx Startup	HPOstr05.exe	"xxx represents the series number - such as 700. What does it do and it it required?"
N	HP Parallel Port Test	hppt.exe	Associated with a HP ScanJet scanner
N	HP Photosmart Premier Fast Start	hpqthb08.exe	"Improves the startup time of HP Image Zone. If you disable it
?	HP Port Resolver	hpbpro.exe	"??"
N	HP Precision Scan	hpmdlbwx.exe	HP multifunction scanner software. Available from HP Office Jet R Toolbox so not required
N	HP Presentation Ready	PresRdy.exe	HP Omnibook related: "Press a dedicated button above the keyboard and the system will instantly load your presentation software and change the screen resolution to match your display device"
U	hp psc 2000 Series	hpobnz08.exe	System Tray icon indicating when the printer is ready. Can be started manually with HP Director but takes time to start
U	HP ScanPatch	HPScanFix.exe	"Program that starts up and automatically fixes earlier versions of the Scanjet 5100c software. If a Scanjet 5100C scanner is not going to be used
N	HP ScanPicture	hpsplmwa.exe	HP multifunction scanner software. Available from HP Office Jet R Toolbox so not required
U	HP SchedIndexer	hppschedindexer.exe	"Installed by HP multi-function printer driver software
X	HP Service Drivers	hdsys.exe	"Added by the SDBOT-ZE WORM!"
?	hp Silent Service	HpSrvUI.exe	"HP related"
N	HP Simple Trax	Hpcron.exe	Supplied with HP CD-RW drives - stores information about CD contents on your hard drive. Available via Start -> Programs or Desktop Icon
N	HP software update	HPWuSchd2.exe	HP software updates. If a shortcut doesn't exist create your own and run it manually
N	HP software update	HPWuSchd.exe	"HP software updates. If a shortcut doesn't exist
N	HP Status	hpstatus.exe	HP Printer Status and Alerts
?	HP Status Server	hpboid.exe	"Copied during installation of HP Inkjet Printer Drivers in Win2K/XP. What does it do and is it required?"
X	HP Update Assistant	HPAware.exe	Added by the MRO TROJAN!
N	HP Updates	??	"On HP PCs
?	HP Visualize Init	HpVisIni.exe	"HP Visualize software related. What does it do and is it required?"
U	HPADVISOR	HPAdvisor.exe	HP Total Care Advisor - a suite of help and hardware check programs to help you check the health of your PCs
?	HPAiODevice(hp officejet g series)	hpoavn07.exe	"HP Printer related
N	HPAiODevice(hp psc 900 series) -1	hpobrt07.exe	"Installed with a Hewlett Packard 900 series colour printer
X	hpdeskjet	hpdeskjet.exe	"Added by the GENOME.AQUV TROJAN!"
U	HPDJ Taskbar Utility	hpztsb01.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb02.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb04.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb05.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb07.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb09.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb06.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb08.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb03.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb10.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb11.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb12.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	HPDJ Taskbar Utility	hpztsb13.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
N	hpfsched	hpfsched.exe	HPFSCHED is a small TSR that will remind you to clean the cartridges in your DeskJet from time to time in order to keep print quality high. It can be removed from the run line in win.ini if you do not want that feature
U	HPGamesActiveMenu	ActiveMenu.exe	Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
N	hpgs2wnd	hpgs2wnd.exe	"Share-to-Web - HP-created software and Internet-based application that enables easy uploading and sharing of photos via affiliated photo-sharing Web sites. Available via Start → Programs"
X	Hphome	hphome.js	Homepage hijacker
?	hpjsiroute	hpjsira.exe	"Related to HP laserjet printers and IP addresses. An IP address is appended to the name field - ie "hpjsiroute192.168.1.2""
X	HPl Services	hmlsvc32.exe	"Added by the AGOBOT-SI WORM and variants!"
U	HPLaptopGamesActiveMenu	ActiveMenu.exe	Wild Tangent demo games that come with some HP computers. Unchecking it can prevent the games from running occasionally. Note that WildTanget's privacy policy used to state that they also collect and share individuals information but this is no longer the case
Y	HPLJ Config	SetConfig.exe	Connects system to networked HP printer.
X	HpPrinter	hpserver.exe	"Added by the CMJSPY-W TROJAN!"
U	HPPWRSAV	HPPWRSAV.EXE	"Power save related for HP Scanners. Many users have complained of system freezes with it running but it stops the light from remaining on all the time. Try www.hp.com
?	hpqSRMon	hpqSRMon.exe	"Related to HP Digital Imaging products. What does it do and is it required?"
U	HPSCANMonitor	hpsjvxd.exe	HP scanning software that enables you to scan images from your scanner. Needed if you're using the scanner
?	hpScannerFirstBoot	scannerfb.exe	"HP scanner related"
X	hpSdwxmark	Gaddw.exe	"Added by the SDBOT-RB WORM!"
N	hpsjbmgr	hpsjbmgr.exe	"HP ScanJet Button Manager. It allows users of the HPScanJet scanners to indicate what the buttons on the scanner will do automatically if pushed. Not required at startup
N	HPStart	hpstart.wsf	This a script used by HP that runs the first time one of their computers is started. Can't imagine why it would be starting up after the first boot
X	hpsysconf1	[random filename]	"Added by a variant of the VIVIA.A TROJAN!"
U	hpsysdrv	hpsysdrv.exe	"This item keeps track of how many times the system has been recovered and the times of the first and last recoveries done on the system. Leaving unchecked will sometimes prevent the Keyboard Manager program from detecting that the computer is an HP. Since this program/driver was only made to run on HP
X	hptools	hptools.exe	"Added by a variant of the SDBOT WORM!"
X	hptools	microsoft.exe	"Added by a variant of the SDBOT WORM!"
N	HPU	ProvenTactics.exe	"Proven Internet Marketing software"
U	hpWirelessAssistant	HP Wireless Assistant.exe	The HP Wireless Assistant is a user application that provides a way to control the enablement of individual wireless devices (such as Bluetooth or WLAN devices) and that shows the state of the radios for these wireless devices
U	hpWirelessAssistant	HPWAMain.exe	Wireless application bundled with HP computers that allows you to control different settings on the computer's wireless devices such as Bluetooth and WLAN
N	HPZTS04	hpzts04.exe	Hewlett Packard printer toolbox shortcut that resides in the system tray
U	hpztsb02	hpztsb02.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	hpztsb04	hpztsb04.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	hpztsb05	hpztsb05.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	hpztsb07	hpztsb07.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	hpztsb09	hpztsb09.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
U	hpztsbol	hpztsbol.exe	HP System Tray utility which allows diagnostic and maintainance of your HP Deskjet series printer
X	HQI Services	hqisvc32.exe	"Added by the AGOBOT-RO WORM!"
X	HQI Services	hqlsvc32.exe	"Added by the AGOBOT-RP WORM!"
U	HREF.OCX	regsvr32.exe ....HREF.OCX	"HREF.OCX is an ActiveX control developed by xFX JumpStart and used to provide HTML-alike clickable links on Windows-based programs such as PopUpKiller"
X	Hrn_qtv	hrnsvc32.exe	"Added by the SDBOT-AET WORM!"
X	Hservice	msservice.exe	"Added by the AUTORUN-KL WORM!"
X	hsim	isearch.exe	Unidentified malware
X	hsim	sexgame.exe	Unidentified malware
X	hsim	toolbar.exe	Unidentified malware
U	HSLAB Logger	logger.exe	"HSLABLogger logs user activity and Internet activity. The gathered information can be sent to a predetermined email address. If you didn't install this yourself uninstall it"
U	HSON	HSON.exe	Toshiba HotStart button support for instant-on entertainment on their laptops
U	HSTrans	hstrans.exe	"Homescan Internet Transporter - part of ACNielson Homescan. Recognizes when the ACNielsen Homescan Scanner is attached to the computer and allows it to transmit scanner information to ACNielsen"
?	HsuGuiControl	HsuGuiControl.exe	"Part of the Starband Internet satellite client. What does it do and is it required?"
U	hsys	HSYS.EXE	"Keylogger Express keystroke logger/monitoring program - remove unless you installed it yourself!"
X	HTML Help System	hhs.pif	"Added by the RBOT-ATB WORM!"
X	HTML32 Help System	hhs32.pif	"Added by the RBOT-ATE WORM!"
X	htssv32.exe	htssv32.exe	"Added by a variant of the SDBOT TROJAN!"
X	HTTP Tunneling Server	mstunnel.exe	"Added by the RBOT.EDL WORM!"
X	httpd	msgaol.exe	"Added by the TACTSLAY.C TROJAN!"
X	httpd	s_menu.exe	"Added by the TACTSLAY.C TROJAN!"
X	httpd	browse.exe	"Added by the TACTSLAY.C TROJAN!"
X	https-ssl	https.exe	"Added by the MOEGA.D WORM!"
U	HughesNet Tools	matcli.exe	"""matcli.exe is a motive Assistant Command line interface that gathers information about your system's identity like your name email address
X	huigezi	HgzServer.exe	"Added by the GRAYBIRD.C TROJAN!"
X	huigezi	SP00LSV.EXE	"Added by the GRAYBIRD.J BACKDOOR! Note the digit ""0"" in the command"
X	Hvewsveqmg	ANACON.EXE	"Added by the NACO.A WORM!"
Y	HWinst	N/A	For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out
X	Hwp	system_wc.exe	"Eziin adware"
X	hws	hws.exe	"Added by the STARTPA-CT TROJAN!"
U	HWSetup	HWSetup.exe hwSetUP	"""Toshiba Hardware Setup is the Toshiba configuration management tool available through Windows."" Allows the user to change BIOS
X	hxadsec	[path to trojan]	"Added by the ADCLICK-AP TROJAN!"
U	HydarVisionDesktopManager	desk95.exe	"ATI's HydraVision desktop management software
U	HydraVisionDesktopManager	desk98.exe	ATI/Appian HydraVision Desktop Manager software - monitors and regulates window and dialog box placement according to user preferences when using a multi monitor setup
U	HydraVisionDesktopManager	HydraDM.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is the HYDRAVISION Desktop Manager - which ""customizes the behaviour of windows and dialog boxes
U	HydraVisionViewport	viewport.exe	ATI/Appian HydraVision Desktop Manager software - monitors and regulates window and dialog box placement according to user preferences when using a multi monitor setup
U	HydraVisionViewPort	HydraMD.exe	"Part of HYDRAVISION - ATI's software for managing mutliple displays and virtual desktops. This is HYDRAVISION MultiDesk - which ""creates
X	Hyper Files	phfhost.exe	"Added by the AGENT-JQO TROJAN!"
X	Hyper Start	instantmsgrs.exe	"Added by the RBOT-NH WORM!"
X	I am not Ranky. I am eTunnel!	msyervice.exe	Added by an unidentified WORM or TROJAN!
X	I am not Ranky. I am eTunnel!	winsys.exe	Added by an unidentified WORM or TROJAN!
X	I am not Ranky. I am eTunnel!	disney.exe	Added by an unidentified WORM or TROJAN!
X	I just want to say I love Milko and I need a drink	svchost.exe	"Added by the CHIKO WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\Administrator\Local Settings\Application Data"
X	I/O Controllers	svcnet.exe	"Added by the TIBIK-B TROJAN!"
?	I81SHELL	I81SHELL.exe	"Appears to be related to drivers for an Intel 810 graphics chipset on an ASUS motherboard"
X	Iamnacho On Irc.MusIrc.com Is a Homosexual!	XBox64.exe	"Added by the RANDEX.Y WORM!"
?	IaNvSrv	IaNvSrv.exe	"Related to the option ROM part of the Intel® Matrix Storage Manager. Located in %ProgramFiles%\Intel\Intel Matrix Storage Manager\OROM\aNvSrv. What does it do and is it required?"
U	ias	ias.exe	"InvisibleASpy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	IASHLPR	IASHLPR.EXE	"Added by the OPASERV.T WORM!"
Y	IBM Client Security	certtool.exe	"Part of Client Security Software for IBM\Lenovo notebooks. If you have configured the software via the associated wizard this will need to be running if you want to mount password protected areas of the disk (created with SafeGuard PrivateDisk)
N	IBM Client Security Software	csecwiz.exe	"Setup wizard for the Client Security Software for IBM\Lenovo notebooks. This entry only runs once
Y	IBM Password Manager	pwmgr.exe	"Part of Client Security Software for IBM\Lenovo notebooks - IBM® Client Security Password Manager ""enables you to manage your sensitive and easy-to-forget login information
U	IBM ThinkPad EasyEject Support Application	EzEjMnAp.Exe	"EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
N	IBM ThinkPad EasyEject Tray Utility	EZEJTRAY.EXE	"System Tray access to the EasyEject Utility for IBM/Lenovo Thinkpad notebooks. Quote: ""The IBM ThinkPad EasyEject Utility makes removing multiple devices from your computer faster and easier by enabling you to stop more than one device at once
U	IBM TrackPoint Accessibility Features	tp4ex.exe	"Supports accessibility features for the TrackPoint stick and associated buttons on IBM/Lenovo ThinkPad notebooks. If features such as ""Click Sound""
?	IBM Warranty Notification	ERTS0749.exe	"IBM Warranty Notification - presumably it's a reminder to either register or that warranty is about to expire?"
N	ibmmessages	ibmmessages.exe	"""The Access IBM Message Center displays messages to inform you about helpful software that may be pre-installed on your PC. The Message Center can also provide messages about new updates available from the IBM Support Center to keep your computer current"""
U	Ibmpmsvc	ibmpmsvc.exe	"Power management driver for IBM laptops. Provides support for the use of four keys on the thinkpad keyboard with blue key tops - Fn
U	IBMUltraBayHotSwapCPLLoader	IBMBAY2N.EXE	Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops
?	IBMUltraBayHotSwapSound	IBMBAYSN.EXE	"Supports hot swapping in Thinkpad UltraBay Option on IBM ThinkPad laptops. Is it needed though - does it just play a sound?"
X	Ibs	ibs.exe	"Added by the HIDEDIAL-B TROJAN!"
U	IBWin Background process	IBackground.exe	"IBackup for Windows"
X	icasServ	icasServ.exe	"Browser hijacker
X	icccomp	[8 random letters].exe	"Added by the ZHELATIN.EQ WORM!"
N	ICH Synth	eusexe.exe	"Sound related and can be disabled without affecting performance although advanced sound features may be sacrificed. May be related to Compaq PC's with "SoundMAX integrated Digital Audio" (Analog Devices Inc.) devices"
X	ICManagement	msic32.exe	"Added by the MSIC BACKDOOR!"
U	ICONDESK	ICONDESK.EXE	Small utility which will allow you the option of hiding or showing your desktop icons
X	iConfigLoader	DIIhost.exe	"Added by the GAOBOT.AO WORM!"
N	Iconsaver	Iconsaver.exe	"IconSaver is a desktop icon manager"
X	ICQ	ICQNET.vbs	"Added by the GORMLEZ-A WORM!"
X	ICQ Chat Service	icqjdhs.exe	"Added by a variant of the RBOT WORM!"
X	icq lite	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	ICQ Lite Messenger	ICQLITE.EXE	"Added by an unidentified VIRUS
X	ICQ Messenger 2002	ICQ2002.exe	"Added by the SDBOT-ABL WORM!"
N	ICQ Plus	vplus.exe	"ICQ Plus is a freeware utility makes your ICQ skinnable (change the look). Available via Start -> Programs"
X	ICQMsn	[path to trojan]	"Added by the RANCK-AH TROJAN! The most common example is ""cbfks.exe"" located in %System%"
X	icrosof Avps32 Control	av32.pif	"Added by the RBOT-AVC WORM!"
X	icrosoft Visual	plscx.exe	"Added by the RBOT-AYO WORM!"
X	icrosoft Visual InterDevc	zvslmqb.exe	"Added by the RBOT-AYP WORM!"
X	icrosoft Windows DLL Services Configuration	poker3.exe	"Added by the SDBOT-AER WORM!"
X	icrosoftf Avpx Control	avpx.exe	"Added by the RBOT-AYN WORM!"
U	ICSDCLT	"rundll32.exe Icsdclt.dll	ICSClient"
N	ICServer	Icserver.exe	Intel Intercast viewer software. Gives access to selected internet pages which are broadcasted by several TV stations
Y	ICSMGR	ICSMGR.EXE	Monitors DNS and DHCP requests for ICS (Internet Connection Sharing). Needed if you're sharing the internet on various computers
X	ICU-Sucker	Service32.exe	"Added by the ILLNOTIFIER.D TROJAN!"
N	IC_KEY_3	spvic.exe	"Instant Chess related"
U	iDesktop	idesktop.exe	"Immersion TouchWare Desktop software for devices such as the Logitech iFeel Mouse"
X	idlesam	[8 random letters].exe	"Added by the ZHELATIN.EQ WORM!"
X	idmlssp	[random filename]	"Added by a variant of the SLAPER TROJAN!"
U	IDriveE Startup	IDrvieEStartup.exe	"IDrive from Pro Softnet Corporation - free full featured online backup up to 2GB with the option of paying for more storage space and managing multiple accounts"
X	IDTemplates	IDTemplate.exe	"Added by the BRONTOK-H WORM!"
X	IE Menu Extension toolbar	rundll32.exe [path] tbextn.dll DllShowTB	"Topconverting.com/180Search ""IEMenuExtension"" toolbar. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	IE Runtimes	winis.exe	"Added by the RBOT-ADZ TROJAN!"
X	IE-Security	iescan.exe	"IE-Security rogue spyware remover - not recommended
X	IE-Security	wdscan.exe	"IE-Security rogue spyware remover - not recommended
X	IE6	wkstmg.exe	"Added by a variant of the SDBOT WORM!"
X	IE6	ssmss.exe	"Added by the GAOBOT.DXO WORM!"
X	IE6	winsnt.exe	"Added by the RBOT-GOV WORM!"
X	IEACCESS	temp532.exe	"AsdPlug premium rate adult content dialer variant"
X	IEACCESS	surfya.exe	"
X	IECheck	MSDTCs.exe	"Added by the TIRBOT-D WORM!"
X	IECheck	xpssl.exe	"Added by the TIRBOT-E WORM!"
X	IECheck	mssvp.exe	"Added by the TIRBOT-G WORM!"
X	IEFeatures	IEFeatures.exe	"Added by the POPMON.A TROJAN! - also known as PopMonster adware"
X	IEFeatures	Internetfeatures.exe	"Added by the POPMON.A TROJAN! - also known as PopMonster adware"
X	Iehelper	syslaunch.exe	Outwar adware downloader
X	Iesar	Iesar.exe	Browser hijacker - redirecting to an adult web page
X	Iesearch.exe	Iesearch.exe	"LookNSearch adware"
U	IEServer	IEServer.exe	"HB Screen Spy surveillance software. Uninstall this software unless you put it there yourself"
X	IEService.exe	IEService.exe	"FastFind adware variant"
X	IESet	IExplorer.dll	"Added by the PWS-BLUEDIT TROJAN!"
X	iesetupi.exe	iesetupi.exe	"Added by a variant of the RBOT WORM!"
Y	IEShow	IEShow.exe	"Anti-phishing component of BitDefender internet security products. Anti-phishing prevents sensitive data such as usernames
X	iestart	iexp1orer.exe	"Added by the NEMOG.C TROJAN!"
N	ietsr	ietsr.exe	"IEClean by Kevin McAleavy - cookie manager
X	ieupdates	ieupdates.exe	"Added by a number of TROJANS such as DWNLDR-HGI and AGENT-HGA and the Antivirus 2009 rogue security software - see here"
X	IEWinserv	winserv.exe	"Added by the BANKER-MY TROJAN!"
X	IExploer	svshosts.exe	"Added by the IRCBOT.BT TROJAN!"
X	Iexplore Services	iexplore.exe	"Added by the LITHIUM BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup!"
X	IEXPLORER	msiecfg.exe	"Added by the BDOOR-JU BACKDOOR or BANCBAN-IP TROJAN!"
X	IExplorer32 Java Scripting	IExplore32b.exe	"Added by the RBOT.ABO WORM!"
X	IExplorer32c Java Scripting	IExplore32cb.exe	"Added by the RBOT.ABN WORM!"
X	IExplorer6 Java Scripting	IExplore326.exe	"Added by a variant of the SDBOT WORM!"
X	IExplorer7 Java Scripting	IExplore327.exe	"Added by a variant of the SDBOT WORM!"
X	IExplorerService	WinSock.exe	"Added by the AGENT.KIU TROJAN!"
X	iExpresser	iexpresser.exe	"Added by the SLENFBOT.AP WORM!"
U	IFSplash.exe	IFSplash.exe	I-FORCE driver for force feedback steering wheel
U	IFXSPMGT	ifxspmgt.exe	"Part of the Infineon Security Platform Software - which supports the on-board TPM security device included with some laptops from suppliers such as Acer
U	igfxpers	igfxpers.exe	"Installed with the graphics drivers for Intel desktop and mobile motherboard chipsets with integrated graphics. It's purpose or function isn't known at present but testing with it disabled would appear to indicate it isn't required - hence the recommended ""U"" status"
X	igfxtras	svchots.exe	"Added by the AUTORUN-AIW WORM!"
X	igsex2x	igsex2x.exe	"NewDial premium rate adult content dialler"
X	IISADMINS	systems.exe	"Added by the AGOBOT.U WORM!"
X	iisvers	iisvers.exe	Added by an unidentified TROJAN or adware
N	iIWiper	Systemwiper.exe	"System Wiper from iI Software - allows you to clear the history of your activites from you computer. Run manually on a regular basis"
Y	IJ75P2PSERVER	IJ75P2PS.EXE	Printer utility which is required in order to make the printer work correctly
U	IJNetworkScanUtility	CNMNSUT.EXE	Network utility available for some Canon scanners and multifunction devices. Allows the device to see computers on a network and those computers running the utility to control scanning via the Control Panel on the scanner - which saves you having to run back and forth between the scanner and your computer
Y	IKE Service 95	IKEService.exe	"Associated with PGP. The PGP Tray can be disabled
U	iKeyWorks	IKEYMAIN.EXE	"A4Tech wireless keyboard driver and utility"
X	ilasss	lsass.exe	"Added by the INJECT-GZ TROJAN! Note - the legitimate lsass.exe process should not normally figure in Msconfig/Startup!"
N	iLike	ilikesidebar.exe	"iLike Sidebar for iTunes and Windows Media Player"
X	ilortgdg	keepSafe.exe	"Added by the KILLAV.KAX TROJAN!"
N	iM Start Center	iM_Tray.exe	Installed with the Sound Blaster Audigy range of soundcards. A radio tuner installed if the user chooses during installation. Available via Start -> Programs -> iM Networks -> iM Radio Tuner
Y	Image & Restore	IMAGE32.exe	"Part of McAfee Nuts & Bolts. Image/Restore can recover from drives that have been accidentally formatted or completely erased
X	Image Remote Players	sysvn.exe	"Added by a variant of the IRCBOT BACKDOOR!"
N	Image Transfer	SonyTray.exe	Sony Image Transfer software provides direct image transfer from your digital camera to a PC - can be started manually
U	ImageDrive-{hex numbers}	ImageDrive.exe	"Nero ImageDrive from Ahead - virtual CD/DVD drive software"
X	ImagePath	taskbarmngr.exe	"Added by the SDBOT-XB WORM!"
X	IMClass	Svhosl.exe	Added by an unidentified WORM or TROJAN!
X	imcssl	xmliwvug.exe	"Added by the SLAPER.U TROJAN!"
N	Imesh	??	"Imesh is a file sharing system"
N	Imesh Auto Update	??	"Update check for the Imesh file sharing system. Turn the update off under ""options"""
N	ImgStart	ImgStart.exe	"Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs"
N	ImgTask	Imgtask.exe	"Related to the WalletPix digital photo album. ""On some computers
X	IMJPMIG8.2	msime82.exe	"Added by the VB-CYG WORM!"
X	IMJPMIG8.2	msime80.exe	"Added by the VB-CYJ TROJAN!"
X	ImMsn	timed.exe	"Added by the WEBDOR.AK TROJAN!"
X	IMprocess	IM-svr.EXE	"IMNames adware"
U	ImScInst	ImScInst.exe	"Microsoft's Input Method Editor which is used to both display and enable the input of characters from East Asian and Right-to-left (e.g. Arabic) languages in e-mails
U	ImScInst.exe	ImScInst.exe	"Microsoft's Input Method Editor which is used to both display and enable the input of characters from East Asian and Right-to-left (e.g. Arabic) languages in e-mails
U	IMStart	IMStart.exe	"InterMute security software related"
X	imwinsrvc	acpmonsrv.exe	"Added by the SLAPER.E TROJAN!"
X	imxecs	vbrun70sp4.exe	"Added by the AGOBOT.ALA WORM!"
N	InControl Desktop Manager	DMHKEY.EXE	For Diamond Multimedia video cards. Allows System Tray access to desktop utilities such as screen resolution. Available via Start -> Programs
X	Index Service	dllhost32.exe	"Added by the AGOBOT.CH WORM!"
U	Index Washer	WashIdx.exe	"Window Washer from Webroot Software. Useful utility that deletes safe to remove files
N	IndexSearch	IndexSearch.exe	"Part of Nuance (ScanSoft) PaperPort - ""scan
U	IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}	NMIndexStoreSvr.exe	"Indexing service that catalogs all the media on your computer so that the files are available to all of the programs in the Nero suite of applications"
X	ine	svchosts.exe	"Added by the RBOT.BNL WORM!"
X	INET	inetsync.exe	"Meplex adware"
X	Inet DataBase	Inetdbs.exe	"Added by the QEDS WORM!"
X	InetChk	ms[random value].exe	"Added by the AGENT-IRL TROJAN!"
X	InetMSN	msnet.exe	"Added by a variant of the SDBOT TROJAN!"
X	InetServices	wsock32.exe	"Added by the WOCK32-A TROJAN!"
X	infamous.exe	wmplayer.exe	Added by unknown malware. WMPLAYER.EXE is stored in the location and uses the same name as Windows Media Player but that valid Windows program doesn't load at startup
X	InfeStop	InfeStopRemover.exe	"InfeStop rogue spyware remover - not recommended
X	info	smss.exe	"Added by the VB.EIW WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %System%\inetsrv"
U	Info Select	is.exe	"Info Select from Micro Logic - personal information manager"
U	InfoPenMSN	InfoPenIM.exe	"InfoPenMSN is a MSN Messenger plugin that allows you to send data written/drawn by hand"
X	infus	infus.exe	Adult content dialler
X	Initial Page	install.exe	EasySearch browser hijack installer
X	inixs	minix32.exe	"Added by the AGENT.CKQX TROJAN!"
X	injob	injobs.exe	"Added by the BINJO TROJAN!"
X	Inom	snmoo.exe	"Added by the RBOT-DPM WORM!"
U	InoTask	InoTask.exe	"Scheduled scans and signature updates for eTrust Antivirus/InoculateIT version 6 virus scanners from Computer Associates. Leave enabled unless you manually update signatures or perform routine scans. If enabled it can result in high CPU useage when performing updates"
X	iNotice	iservice.exe	Added by a variant of an MSN worm that tries to lure people to an infected site by using nude pictures and videos
?	insCOA5	insCOA5.exe	"??"
X	Insider	Insider.exe	"Added by the AGENT.KMC TROJAN!"
U	InstaAlert	InstaAlert.exe	"""Kayako InstaAlert allows you to receive realtime alerts whenever a ticket gets updated under the assigned departments. The application displays popups as and when the tickets are created or replied to allowing you to answer your customer requests and issues promptly"""
X	Instafinder	instafinder.exe	"TopSearch.D adware"
X	InstaFinderK	InstaFinderK inst.exe	"InstaFinder adware"
X	Install	Install.exe	"Added by the BANCBAN-HG TROJAN!"
X	Install part II	updates.exe	"Added by the RELFEERWORM!"
?	Install Pending Files	sifxinst.exe	"Uninstall program for Lanovation's Prism Deploy and Prism Pack adminstrators software deployement tools. For specific information see here. Is it required?"
x	install32	install32.exe	"Added by the NUCLEAR.DG BACKDOOR!"
N	InstallAurealDemos	InstallAurealDemos.js	Used to initialize the Aureal A3D demos InstallShield wizard
U	InstallBuddy	Ibtna.exe	"InstallBuddy - automatically translates and installs your desktop documents
X	InstallCleaner	InstallCleaner.exe	"Added by the ANYHOMB.F TROJAN!"
X	Installed shell32.dll	Office.exe...	"Added by the LOVGATE.AO WORM!"
X	Installed shell32.dll	Office.exe	"Added by the LOVGATE.E WORM!"
X	Installer	dial.exe	"Malware - detected by Kaspersky as the AGENT.MM TROJAN!"
?	InstallNAIProduct	SETUP.EXE	"Could be related to Network Associates Inc who own the McAfee VirusScan product amongst others. This was found in a directory called "VSC". Could it be an installation that failed and "SETUP.EXE" was left to run at startup as an error?"
X	InstallProgram	[path to trojan]	"Added by the AGENT-HHU TROJAN!"
X	InstallProvider	newsoftware2007install.exe	"Part of WinAntiVirusPro 2007 and Privacy Protector rogue security software (and possibly others) - not recommended"
X	Installs SP2	[path] repcale.exe [path] palsp.exe	"Added by a variant of the RANDON.AN WORM! Both files are located in %System%\qpalsp"
X	Installs SP4	[path] repcale.exe [path] p0rd.exe	"Added by the RANDON-AK WORM! Both files are located in %System%\ekrlgc"
U	Installstub	installstub.exe	"Tool for Outlook and Outlook Express from Plaxo for organising and keeping contacts organised and updated and providing online access to your contacts and access from PDA or mobile phone"
X	Instance 001	[path to worm]	"Added by the ALASROU-A WORM!"
X	Instant Access	"rundll32.exe EGDHTML_1023.dll	InstantAccess"
X	Instant Access	"rundll32.exe eg_auth_****.dll	InstantAccess [**** = digits]"
X	Instant Access	"rundll32.exe EGCOMLIB_****.dll	InstantAccess [**** = digits]"
X	Instant Access	"rundll32.exe EGCOMSERVICE_****.dll	InstantAccess [**** = digits]"
X	Instant Access	"rundll32.exe p2esocks_****.dll	InstantAccess [**** = digits]"
X	Instant Access	mwsrvacc.exe	"InstantAccess premium rate adult content dialer"
X	Instant Access	linewsrv.exe	"InstantAccess premium rate adult content dialer variant"
X	Instant Buzz Daemon	IBDaemon.exe	"Instant Buzz adware"
X	Instant Messenger Service	imservice.exe	"Detected by Kaspersky as the HEUR TROJAN!"
X	instant messengers	instantmsgtr.exe	"Added by the AGOBOT-PC BACKDOOR!"
N	Instant Update Center	reminder.exe	"Event reminder for calendar dates
U	Instant Wireless Configuration Utility	WUSB11cfg.exe	"Utility used by the LINKSYS LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
U	Instant Wireless Configuration Utility	WPC11Cfg.exe	"Utility used by the LINKSYS wireless USB Adapter (WUSB11) and indicates when a wireless access connection is made by a screen colour change. Also used for configuration"
N	InstantAccess	INSTAN~1.EXE	From TextBridge Pro 9.0 OCR scanner software. Available via Start -> Programs
U	InstantDrive	InstantDrive.exe	"Pinnacle Systems (ex VOB) InstantDrive - creates a virtual CD-ROM drive on the computer's hard drive. Part of InstantCD/DVD burning software"
X	InstantPleasure	instantpleasure.exe	Adult content dialler
X	InstantPleasureXXX	instantpleasurexxx.exe	Adult content dialler
N	InstantTray	PCLETray.exe	"Pinnacle InstantCD/DVD disc creation software. Tray icon enabling a pop-up menu that lets you call up any of Instant CD/DVD's tools with one click. Can be started manually"
X	instit	instit.bat	"Added by the OPASERV.H WORM!"
X	instit	INSTIT.BAT	"Added by the OPASERV.K WORM!"
?	InstUtlR.exe	InstUtlR.exe	"??"
X	InSysSecure	InSysSecure.exe	"InSysSecure rogue security software - not recommended
X	Intec Service Drivers	msmsgrs.exe	"Added by the SDBOT-ADN WORM!"
X	Intec Service Drivers	[path to worm]	"Added by the RBOT-GLU WORM!"
X	Intec Service Drivers	wing32.exe	"Added by the RBOT.HAZ WORM!"
X	Intec Service Drivers	msmsgredss.exe	"Added by the SDBOT-AGL WORM!"
X	Intec Services Driverrs	winrvc.exe	"Added by a variant of the SDBOT WORM!"
X	Intec Services Drivers	msupdate22e.exe	"Added by the RBOT-CGC WORM!"
X	Intel Audio Studio V2.0	fmideploy.exe	Detected by VBA32 as the BIFROSE.ADR TROJAN!
X	Intel Driver	csrs.exe	"Added by a variant of the SDBOT WORM!"
U	Intel File Transfer	xfr.exe	Part of Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicating between the core server and managed clients
X	Intel Management Services v32	mstime32.exe	"Added by the AUTORUN-AYG WORM!"
U	Intel PDS	pds.exe	Intel Ping Discovery Service (PDS). Part of Intel's LANDesk Management Suite 6 and the Common Base Agent (CBA) - used for communicating between the core server and managed clients. Will start the dial-up if installed and enabled
X	Intel Physical Routine 1.2A	stnetlib.exe	"Added by the BACKDR-AS BACKDOOR!"
N	Intel PROSet Tray Icon	promon.exe	System Tray icon for Intel PRO series ethernet adapters giving access to the diagnostic features
X	Intel Service Drivers	msconfig16.exe	"Added by the MSCONFIG16 TROJAN!"
X	Intel system tool	hookdump.exe	"Added by the SPYRE-H TROJAN!"
X	Intel system tool	winnook.exe	"Added by the SPYRE-C TROJAN!"
X	Intel system tool	svehost.exe	"Added by the AGENT-EBT TROJAN!"
X	Intel system works	iis.exe	"Added by the RBOT.QGA WORM!"
U	Intel(R) Common User Interface	igfxtray.exe	"System Tray access to display settings for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
U	Intel(R) Common User Interface	hkcmd.exe	"Hot Key handler for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
U	Intel(R) Common User Interface	igfxpers.exe	"Installed with the graphics drivers for Intel desktop and mobile motherboard chipsets with integrated graphics. It's purpose or function isn't known at present but testing with it disabled would appear to indicate it isn't required - hence the recommended ""U"" status"
N	IntelAudioStudio	IntelAudioStudio.exe	"""Intel Audio Studio combines Intel® High Definition audio hardware features with Sonic Focus* Audio Refinement and Dolby* technologies to provide you with a comprehensive tool that puts you in control of your audio experience"". Audio utility supplied with some Intel motherboards"
X	InteliSys	smss.exe	"Advertisingvision adware. Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Intelli Mouse Pro Version 2.0B	ncsjapi32.exe	"Added by the BUZUS-O WORM!"
X	Intelprc	Aas3lovu.exe	"Added by the SILLYFDC-CG WORM!"
Y	IntelWireless	ifrmewrk.exe	Associated with the Intel PRO/Set Wireless software
U	IntelZeroConfig	ZCfgSvc.exe	"Zero Config MFC Application
?	Intense Registry Service	IntEdReg.exe /CHECK	"Intense Educational Ltd - Language Office Software. Is it required?"
X	InterceptedSystem	[path to worm]	"Added by the ANACON-B WORM!"
X	Internal	regedit.exe /s c[month number]	"Added by the FORTNIGHT.D TROJAN! Note that the Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file ""c[month number]"" is located in %Windir%
X	Internal Memory File	sysintmemory.exe	"Added by the RBOT-GKT WORM!"
X	InternalSystray	Kazza.exe	"Added by the OPTIXPRO.12.C BACKDOOR! Note - unlike the valid KaZaA executable
X	Internat	systray.exe	"Added by the ALADINZ.P TROJAN! Note - this is not the legitimate systray.exe process. If you right-click on the real systray.exe the ""Properties"" reveal it to be a Microsoft file"
X	Internat	msgsrv32.exe	"Added by the NYRUBOT-A BACKDOOR! Note - this is not the legitimate msgsvr32.exe process on a Win9x/Me system which should not appear in MSConfig/startup!"
X	internct	WinSocks5.exe	"Added by the GRAYBIRD.F TROJAN!"
X	internet	smss.exe	"Added by the MIFENG-K TROJAN! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup!"
X	Internet	nteusodp.exe	"Added by the RBOT-GFJ WORM!"
X	internet	winsas32.exe	"Added by a variant of the SDBOT WORM!"
X	internet	lsass.exe	"Added by the DSPY-A TROJAN! Note - this is not the legitimate lsass.exe process which should not normally figure in Msconfig/Startup!"
X	Internet	alm7tas.exe	"Added by a variant of the RBOT WORM!"
X	Internet	wins.exe	"Added by the RBOT.AAYF WORM!"
U	Internet Answering Machine	IAMNET~1.EXE	"From Callwave. It offers a free utility to monitor your incoming phonecalls if you only have a single telephone line for internet access"
U	Internet Answering Machine	IAM.exe	"From Callwave - offers a free utility to monitor your incoming phonecalls if you only have a single telephone line for internet access"
X	Internet Antivirus	IAvir.exe	"Internet Antivirus rogue security software - not recommended
X	Internet Antivirus Pro	IAPro.exe	"Internet Antivirus Pro rogue security software - not recommended
X	Internet Config	svchosts.exe	"Added by the SDBOT TROJAN!"
X	Internet Connection Wizard	stisvsq.exe	"EasySearch adware"
X	Internet Connection Wizard	stisvsq1.exe	"Added by the DLOADR-AWD TROJAN!"
X	Internet Content Publisher	ICP.EXE	"Added by the RBOT-UD WORM!"
U	Internet Disk Cleaner	CLEARH~1.EXE	"""Internet Disk Cleaner from Elongsoft ""protects your privacy by cleaning up all Internet tracks and past computer activities"""
X	Internet download manager service	idman.exe	"Added by the RBOT-BMS WORM!"
X	Internet Exploere Services	urlmon32.dll.exe	"Added by the EVIAN.C WORM!"
X	Internet Explore Microsoft	lEXPLORE.EXE	"Added by the RBOT-AOF WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	Internet Explorer Security	iexplore.pif	"Added by the RBOT-ALQ WORM!"
X	Internet Explorer Sys32	isys32.exe	"Added by the IRCBOT-ADA WORM!"
X	Internet Firewall Layer	tsqla.exe	"Added by a variant of the SPYBOT WORM!"
U	Internet History Eraser	HERASER.exe	"Internet History Eraser - deletes your browsing tracks"
X	Internet Loader1	MSInstall61.exe	"Added by the KWBOT.B WORM!"
X	Internet Mail and News	msqdevl.exe	"EasySearch adware"
X	Internet Mail and News	[path to trojan]	"Added by the SMUTSRCH-A TROJAN!"
X	Internet Mail and News	msqdevl1.exe	"Added by the DLOADR-AWD TROJAN!"
X	Internet Security 2010	IS2010.exe	"Internet Security 2010 rogue security software - not recommended
X	Internet Security Service	msq32.exe	"Added by the RBOT-GFP WORM!"
X	Internet Security Service	msq23.exe	"Added by the RBOT-GQL WORM!"
X	Internet Security Service	msql23.exe	"Added by the RBOT-GML WORM!"
X	Internet Security Service	mysqlwin32.exe	"Added by the RBOT.UX TROJAN!"
X	Internet Security Service	expllorer.exe	"Added by the REFROSO.AFF TROJAN!"
X	Internet Send	More log.exe	Unidentfied adware
X	Internet Server	inetsrv.exe	"Added by the STARTPA-EM TROJAN!"
X	Internet Service	intersvc.exe	"Added by the SPYBOT-DE WORM!"
X	internet service	syscfg32.exe	"Added by the RBOT-QS WORM!"
X	internet service	ssvhost.exe	"Added by a variant of the RBOT WORM!"
X	internet service	svho0st98.exe	"Added by the RBOT.EAT WORM!"
X	Internet Services	systemdev.exe	"Added by the SDBOT-PW WORM!"
X	Internet Services	internet.exe	"Added by the MYTOB.BT WORM!"
X	Internet Services	interserv.exe	"Added by the RBOT.BNT WORM!"
X	Internet Services	Netsvc.exe	"Added by the MYTOB.MN WORM!"
X	INTERNET SERVISES	winz32.exe	"Added by the KWBOT.Z WORM!"
Y	Internet Sharing Server	iss_srvr.exe	"Intel AnyPoint internet sharing software. Now discontinued"
X	Internet Suspention	story.exe	"Added by the WOOTBOT.HV WORM!"
N	Internet Sweeper	Sweeper.exe	"Internet Sweeper - removes unnecessart left over files after browsing the internet"
X	Internet Washer Pro	iw.exe	"Internet Washer manages temporary browser files
X	internet.exe	yinyin3345.vbs	"Added by the YINI MACRO!"
N	InternetCalls	InternetCalls.exe	"InternetCalls - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X	InternetExplorer2	windows.exe	"Added by the SDBOT-CZP WORM!"
X	InternetGetConnectedState	winupdate.exe	"Added by the SDBOT-JN WORM!"
X	InternetGetConnectedStateEx	winupdate.exe	"Added by the SDBOT-JN WORM!"
X	InternetShield	INTERN~1.EXE	"InternetShield rogue security software - not recommended
X	InternetShield	InternetShield.exe	"InternetShield rogue security software - not recommended
U	InternetSpy	InternetSpy.exe	"Internet Spy - freeware keylogger that tracks all visited websites including the date and exact time these sites were visited. The information is stored in a file that may be accessed by the person who knows where it is saved. Remove unless you installed it yourself!"
X	InternetWasherPro	iw.exe	"Internet Washer manages temporary browser files
X	Internet_Explorer	microsoft.exe	"Added by the BANKER-EUQ TROJAN!"
X	INTERNET_SERVISES	winz32.exe	"Added by the SDBOT.Q TROJAN!"
U	InternodeUsage	mum.exe	Australian ISP's free monthly download meter
X	Inters Configuration Loader	RCL0ADERS.exe	"Added by the SDBOT-KX WORM!"
X	Intersoft Msngr	intersoftmsngr.exe	"Added by the AGOBOT-NW WORM!"
N	InterTrust Quick Start	it_cpq~1.exe	"InterTrust offers something known as Digital Rights Management to control legal software download and other E-commerce related business"
N	Intervideo WinScheduler	WinScheduler.exe	"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
N	Intervideo WinScheduler	SchSvr.exe	"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
X	Intespention	IEXPLORE.exe	"Added by the FORBOT-FL WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	intranet	SYS32CFG.EXE	"Added by the SPYBOT-DW WORM!"
X	Intranet	schost.exe	"Added by the RBOT.SV BACKDOOR!"
N	Introducing Media Manager	SPLASHA.EXE	"MS Media Manager tour. Not required"
N	Introduction-Registration	??	"For Compaq PC's. Should only run first time
X	IntSys1	[path to trojan]	"Added by the BANLOA-ASE TROJAN!"
Y	Intuit SyncManager	IntuitSyncManager.exe	"Synchronizes local Intuit Quickbooks data with online data - ""Use the Intuit Sync Manager to find the status of your latest QuickBooks data sync
U	Inventory Scan	LDISCN32.EXE	"LANDesk® Management Suite software component"
Y	iolo AntiVirus	ioloAV.exe	"iolo AntiVirus"
Y	iolo Personal Firewall	ioloFW.exe	"iolo Personal Firewall"
U	Iolo Task Agent	Task_Agent.exe	"Iolo System Mechanic Task Agent. Scheduled maintenance"
N	iolo Utility Bar	SMUtilityBar.exe	"Iolo System Mechanic Utility Bar - can be launched manually"
N	Iomega Backup Scheduler	dtiom98.exe	"Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs"
U	Iomega Disk Icons	IMGICON.EXE	"Displays Iomega icons in Explorer/My Computer
U	Iomega Drive Icons	IMGICON.EXE	"Displays Iomega icons in Explorer/My Computer
?	Iomega QuickSync	Quicksync.exe	"??"
N	Iomega Startup Options	IMGSTART.EXE	"Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs"
X	ioroxxo microsoft sux	system32.exe	"Added by a variant of the RBOT WORM!"
X	IP Packet Redirect Service	ipredirect.exe	"Added by the FORBOT.SM WORM!"
X	IP Stack	ipstack.exe	"Added by the AGOBOT.CW WORM!"
X	IPC Spool Manager	wnmgre.exe	"Added by the SDBOT-ZC WORM!"
X	IPC Spool Manager	winspec.exe	"Added by the SDBOT-BLU WORM!"
X	IPConfig	svcxnv32.exe	"Added by the HACARMY.E TROJAN!"
X	IPConfig	svcxnw32.exe	"Added by a variant of the HACARMY.E TROJAN!"
X	IPConfig	ipconfigs.exe	"Added by the HACARMY.C BACKDOOR!"
?	IPHSend	IPHSend.exe	"AOL related. What does it do and is it required?"
N	IPInSightLAN 01	IPClient.exe	"IP Insight is a Quality of Service monitor and diagnostic tool that isn't required - see here for more information. Included with services from BellSouth
N	IPInSightMonitor 01	IPMon32.exe	"IP Insight is a Quality of Service monitor and diagnostic tool that isn't required - see here for more information. Included with services from BellSouth
Y	IPinst	N/A	For Gilat Communications internet satellite systems. Gilat rescue (Satellite system restore). Required if you have this system. Can cause a BSOD (blue screen of death) if left out
X	IPLog Security	iplogsec.exe	"Added by the IRCBOT.GP BACKDOOR!"
?	iPlusAgent2	iAgent2.exe	"Related to iriver portable media products. What does it do and is it required?"
X	Ipnuker	Ipnuker.vbs	"Added by the INKER.B WORM!"
X	Ipod Help	[9 random letters].exe	"Added by a variant of the RBOT WORM!"
X	iPOD USB Driver	IPODUSB.EXE	"Added by a variant of the RBOT WORM!"
X	iPod USB Service	iPODService.exe	"Added by a variant of the RBOT WORM! Do not confuse with the Apple iPod process of the same name. The legitimate iPod file will always be located in the %ProgramFiles%\iPod\bin folder and is implemented as a system service
X	IPOT Service Drivers	compaq.exe	"Added by a variant of the FUROOTKIT TROJAN!"
X	IPOT USB Service DRIVER	hpsebc087.exe	"Added by the SDBOT-WA WORM!"
X	IPOT USB Service DRV32	hpsebc08.exe	"Added by the SDBOT-WH WORM!"
X	IPSEC Configuration	wsupdate.exe	"Added by the AGOBOT-IQ WORM!"
X	iPSec7	ipsec7.exe	"Added by the AGENT.AHVR TROJAN!"
U	ipsecdialer	IPSECD~1.EXE	"Cisco VPN Client - lets local users gain Administrator privileges on the operating system"