sc

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X	*MSConfig32	aecache.exe	"Detected by F-Secure as the OBFUSCATED.GP TROJAN!"
X	*windows update	wsctl.exe	"Added by the SPYBOT.PR WORM!"
X	*windows update	wscxt.exe	"Added by the RBOT.AOS WORM!"
X	.mscdr	lassa.exe	"Added by the WEBUS.C TROJAN!"
X	.mscdr	lsvchost.exe	"Added by the WEBUS.D TROJAN!"
X	.mscdsr	lsvchost.exe	"Added by the BDOOR-CR BACKDOOR!"
X	.mscsbl	svhost.exe	"Added by the CMQ TROJAN!"
X	1	lsass.scr	"Added by the BANCOS.V TROJAN!"
X	1	svchost.scr	"Added by the BANCOS.X TROJAN!"
U	1455 Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX1455 multifunction printer
U	2335dn Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Dell 2335 multifunction laser printer
U	3170 Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung CLX3170 multifunction laser printer
X	32.exe	nvscv32.exe	"Added by the AGENT-LOL TROJAN!"
X	3D Text	3D Text.scr	"Added by the JERMY.A WORM!"
U	4x26 Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX4x26 multifunction laser printers
U	4x28 Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX4x28 multifunction laser printers
U	6200 Scan2PC	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung CLX6200 multifunction laser printer
U	aaLDISCN32	LDISCN32.EXE	"LANDesk® Management Suite software component"
?	ab EazyScheduler	ezsched.exe	"??"
U	Acronis Scheduler Helper	schedhlp.exe	"Part of Acronis True Image backup software. Co-operates with the ""schedul2.exe"" service to perform backup/restore tasks correctly. Required if you want to use True Image to do some real backup/restore tasks - not if you only want to explore/mount images"
U	Acronis Scheduler2 Service	schedhlp.exe	"Part of Acronis True Image - backup software. Co-operates with the ""schedul2.exe"" service to perform backup/restore tasks correctly. Required if you want to use True Image to do some real backup/restore tasks - not if you only want to explore/mount images"
X	ActiveScan Antivirus	ActiveScan.exe	"Added by the RBOT-FKQ WORM!"
X	ActiveScript32	nod.exe	"Added by the SOHANA-AJ WORM!"
X	ActiveSync	wcescom32.exe	"Added by the MANCSYN-E TROJAN!"
X	Administrator	svchost.scr	"Added by the NOVACAL TROJAN!"
X	Adobe	sysconfig.exe	Added by an unidentified WORM or TROJAN!
U	AdsCleaner	AdsCleaner.exe	"""AdsCleaner is a powerful ad blocking software designed to stop ads (block banners ad
X	AdwareKiller_schedules	schedules.exe	"EAdwareKiller rogue spyware remover - not recommended
Y	AirPlusCFG	AirPlusCFG.exe	"Driver and configuration utility for a number of wireless routers and adapters from D-Link"
X	Alive SYstem	scchost.exe	"Added by the TOFDROP-B TROJAN!"
X	Alive SYstem	scchostc.exe	"Added by the TOFDROP-B TROJAN!"
X	All Sea screen saver	TaskTray.exe	"Free screensaver
N	ALU Scheduler Service	ALUSchedulerSvc.exe	Symantec LiveUpdate scheduler for programs such as Norton AV or Internet Security
X	Anti-Virus Update Scheduler	[path to trojan]	"Added by the SPAMMIT-A TROJAN!"
X	Anti-Virus Update Scheduler	winsp3.exe	"Malware - detected by Kaspersky as the AGENT.FP TROJAN!"
X	Anti-Virus Update Scheduler V1.39.12R	[path to trojan]	"Added by the HEPLANE or STAPREW.B TROJANS! - different filenames have been spotted; examples: msvc.exe
X	antispy	scan.exe	"IE AntiVirus rogue security software - not recommended
X	AntiVir	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	Antivirusscherm	pgs.exe	"Antivirusscherm
U	AOL Spyware Protection	AOLSP Scheduler.exe	AOL's spyware protection program
X	Application Layer Scheduler	agtsvc.exe	"Added by the IRCBOT.BJJ BACKDOOR!"
X	ASC-AntiSpyware	WinCleaner.exe	"WinCleaner 2009 rogue security software - not recommended
X	ASC-AntiSpyware	WinAntivirus.exe	"Win Antivirus Vista/XP rogue security software - not recommended
X	asc32	asc 2.1.exe	"AntiSpyCheck rogue spyware remover - not recommended
X	asccacA	asacsqgl.exe	"Added by the MULTIDRP.AA TROJAN!"
N	ASE Scheduler	ASE Scheduler.exe	"Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU
?	ASUS Camera ScreenSaver	ASScrProlog.exe	"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
?	ASUS Screen Saver Protector	ASScrPro.exe	"Either a valid program on some ASUS laptops - such as the F3 and F5 series or unsafe
N	ATI Scheduler	Atisched.exe	Component that remains resident in memory and automatically launches the ATI VIDEO PLAYER at a user selected time and date. Delete the shortcut in the Start -> Programs -> Startup folder as well. Functions could re-enable the program to load at start-up and re-introduce the shortcut. Try it and see
X	AttuneDiscovery	attune_di.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	Auto File System Conversion Utility	scricon.exe	"Added by the SDBOT.EYB WORM!"
X	Auto Scroll Loader	ASCRLL.EXE	"Added by the SPYBOT-T WORM!"
X	Auto Updater	asclt.exe	"Added by the SLINBOT.CJ BACKDOOR!"
X	AutoDiscovery/AutoPurge (ADAP) Service	wmiadapi.exe	"Added by the RBOT.FLT WORM!"
X	Autoloaderaproposclient	Apropos_Client_Loader.exe	"AproposMedia adware"
X	Autoloaderaproposclient	cxtpls_loader.exe	"AproposMedia adware"
X	autoMe	wscript.exe solution.vbs	"Added by the VBS.SASAN WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""solution.vbs"" file is found in %Windir%"
X	autoMe	wscript.exe samok.vbs	"Added by the SAMOK-A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""samok.vbs"" file is located in %Windir%"
X	AUTORUN_VAL	asc 2.1.exe	"AntiSpyCheck rogue spyware remover - not recommended
X	AutoVirusProtection	ciscv.exe	"Added by a variant of the RBOT WORM!"
Y	avast! Web Scanner	Ashwebsv.exe	"Web scanning part of avast! Antivirus. Starts via a registry ""Run"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
X	AVG AntiVirus Scanner	avgscnx.exe	"Added by the SILLYFDC.BBE WORM! Note - this is not a legitimate AVG entry"
X	avidrv	drvsc.exe	"Detected by Kaspersky as the AGENT.PH TROJAN!"
X	avscan	avscan.exe	"Added by the SILLYFDC.BCR WORM! The file is in the users %Temp% directory"
X	AVScan	winav.exe	Unidentfied rogue security software
X	AvScan	avscan.exe	"Antivirus System PRO and Spyware Protect 2009 rogue security software. The file is located in %ProgramFiles%\<rogue name>"
X	avscan	Usbconeted.exe	"Added by the PROVIS-A TROJAN!"
Y	AVSCHED32	AVSched32.exe	"AntiVir® PersonalEdition Classic - antivirus"
Y	AVSchedScan	SCHSC9X.EXE	"Command Antivirus related"
X	AVScheduler	AVSCHSVC.EXE	"Part of the WinAntiVirus Pro 2005 rogue security software when installed in Win98/Me - not recommended
U	AwaySch	AwaySch.EXE	"Part of the IBM ThinkVantage Productivity Center. ""The Away Manager application allows you preselect and run routine tasks to maintain your system's performance"""
U	AXIS Print System DriverScanner	DriverScanner.exe	"Part of AXIS Print System from AXIS Communications - ""adds printer discovery
N	B'sCLiP	BSCLIP.exe	CD recording utility that comes with a lot of CDR/CDRW drives and isn't required
U	Backup NOW! Scheduler	Schdlr32.exe	"Scheduled backups for the NTI Backup Now archiving utility. If a backup job has been scheduled
U	BackupExecScheduler	besch.exe	"Veritas ""Back Up My PC"" software"
N	bascstray	BascsTray.exe	Broadcom Advanced Control Suite - for modems and set top boxes based upon Broadcom chipsets. Not required unless you have networking problems
U	Battery Scope	batmgr.exe	Monitors battery levels on a notebook/laptop PC
X	BatzBack	BatzBack.scr	"Added by the BACKZAT WORM!"
X	Bcvsrv32	msc32.exe	"Added by the AGOBOT.AKD WORM!"
U	Belkin F5D8073 N Wireless ExpressCard Adapter Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8073 N Wireless ExpressCard Adapter"
X	BeschermingsTool	SysRep.exe	"BeschermingsTool
Y	BitDefender Scan Server	bdss.exe	"BitDefender antivirus"
X	BlockScanner	BlockScanner.exe	"BlockScanner rogue security software - not recommended. A member of the WiniGuard family"
X	boby	csrs.scr	"Added by the BANCBAN-PC TROJAN!"
X	boby	netburn.scr	"Added by the BANCBAN-OX TROJAN!"
X	boby.	Isass.scr	"Added by the BANCBAN-OH TROJAN!"
X	BootsCfg	wscript.exe [path] Date.POP.vbs	"Added by the KUULLIO WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbs	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe [path] All Users.vbe	"Added by the SPILTRON WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	BootsCfg	wscript.exe Install.log.vbs	"Added by the YPSAN.E WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""Install.log.vbs"" file is located in %System%"
X	BrowserUpdateSched	[random filename]	"ZenoSearch adware"
N	BsCLiP	BSCLIP.exe	CD recording utility that comes with a lot of CDR/CDRW drives and isn't required
X	Bymer.Scanner	Wininit.exe	"Added by the BYMER WORM!"
X	Bymer.Scanner	Msinit.exe	"Added by the BYMER WORM!"
U	Calendarscope	cs.exe	"Calendarscope calendar software"
?	CardScan AutoSync	CSyncCfg.exe	"Related to the CardScan business card reader range of products. May be related to synchronization with E-mail software and mobile devices (see here)?"
X	CAS Client	casclient.exe	"CasinoClient adware"
X	CashToolbar	MSCStat.exe	"Added by the DOWNLOADER-MY TROJAN!"
X	CFDStart	WinMuschi.exe	"WINMUSCHI dialler"
X	CGI Firewall Script	CGIAGENT.EXE	"Added by the BROPIA-U WORM!"
X	Checkdisk	mscas.exe	"Added by the VAGON-A TROJAN!"
X	CheckScan32	regload16.exe	"Added by the AEBOT.K WORM!"
U	CHIPDRIVEPinManager	sokscmpn.exe	"ChipDrive Smartcard software"
U	CHIPDRIVESmartcardManager	SCMgr.exe	"ChipDrive Smartcard software"
X	Cisco Systems	[path to worm]	"Added by the AUTORUN.UHR WORM!"
U	Cisco Systems VPN Client	ipsecdialer.exe	"Cisco VPN Client - lets local users gain Administrator privileges on the operating system"
U	Cisco Systems VPN Client	vpngui.exe	"Sets up IPSec communications for Cisco's VPN Client"
X	Client for Microsoft Networks	msclient32.exe	"Added by the SDBOT-BXQ WORM!"
X	ClientMan1	mscman.exe	"ClientMan parasite variant"
N	Clik Status Monitor	toolsclickstat.exe	Part of Iomega Tools to let you know whether an Iomega PocketZip (nee Clik) removable drive cartridge is installed
X	ClrSchLoader	[path to file]	"ClearSearch adware"
X	cmrst	cmrst.scr	"Added by the DLOADER-FP TROJAN!"
X	COM Service	mscom32.com	"Added by the BEASTY.H TROJAN!"
N	Compaq Computer Corp SCCenter Module	SCCENTER.EXE	For Compaq PC's. Part of Backweb
X	Compaq32 Service Drivers	msconfig32.exe	"Added by the SDBOT-ADC WORM!"
N	CompaqSystray	cpqpscp.exe	Compaq System Tray icon
U	ComproSchedulerDTV	ComproSchedulerDTV.exe	"VideoMate TV tuner and capture card - scheduler"
X	Config Loader	scvhost.exe	"Added by the GAOBOT.AE or GAOBOT.AO WORMS!"
X	Configuration Driver	scghost.exe	"Added by the SDBOT-DLA WORM!"
X	Configuration Loader	syscfg32.exe	"Added by the SDBOT.B BACKDOOR!"
X	Configuration Loader	scvhost.exe	"Added by the AGOBOT-AAE and SDBOT.AR WORMS!"
X	Configuration Loader	svschost.exe	"Added by the SDBOT-NS WORM!"
X	Configuration Loader	scvh0st.exe	"Added by the AGOBOT-AX WORM!"
X	Configuration Loading Service	wscel.exe	"Added by the SDBOT-WJ WORM!"
X	Configurations Asclt	asclt.exe	"Added by the SDBOT-MX WORM!"
X	ConfLoader	sysconf16.exe	"Added by the SDBOT-FB TROJAN!"
N	CONNECTAuto Update	CONNECTScheduler.exe	"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
N	CONNECTScheduler	CONNECTScheduler.exe	"Automatic update scheduler for the Sony CONNECT Player originally supplied with their range of USB or hard disk based MP3 players and used in conjunction with the CONNECT Music store download service - now replaced by SonicStage CP"
X	conscorr	conscorr.exe	"VX2.Transponder parasite updater/installer related"
X	Core System Hardware	syscorehd.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	CPCmscl0ck	CPCmsclock.ExE	"Added by the IRCFLOOD.BF TROJAN!"
?	CQSCP2PS	CQSCP2PS.EXE	"""Compaq printer utility which is required in the startup menu in order to make the printer work correctly"". Is it actually required?"
?	CQSCP2PSERVER	CQSCP2PS.EXE	"""Compaq printer utility which is required in the startup menu in order to make the printer work correctly"". Is it actually required?"
N	CreativeDiscNotifier	CTNOTIFY.EXE	"For Creative Soundblaster Live! series soundcards. Detects when you insert a CD-ROM
?	CreativeTaskScheduler	CTSched.exe	"Creative Task Scheduler. What does it do and is it required?"
X	Crnsava	scrnsave.pif	"Added by the SDBOT-ZV WORM!"
X	cronos	MARCO!.SCR	"Added by the OPASERV.G WORM!"
X	CS	tsc.exe	"Cyber Security rogue security software - not recommended
U	csc	csc.exe	Command line compiler for Microsoft C# it gets installed with the .NET SDK
X	cscripts	cscripts.exe	"Added by the BDOOR-AAP BACKDOOR!"
X	CSCRS Value	cscrs.exe	"Added by the RBOT-AAA WORM!"
X	CSCRS Value Check	MsPMSPSd.exe	"Added by a variant of the SDBOT WORM!"
X	csrsc	csrsc.exe	"Added by an unidentified VIRUS
Y	CSScheduleCheck	SCHWIZEX.EXE	"Part of ConfigSafe - lets you identify changes to the registry
X	CTFMON	wscript.exe /E:vbs winjpg.jpg	"Added by the RUNAUTO.F WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""winjpg.jpg"" file is located in %System%"
X	CTFMON	wscript.exe /E:vbs regedit.sys	"Added by the VBSAUTO-A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""regedit.sys"" file is located in %System%"
?	CTSched	CTSched.exe	"Creative Task Scheduler. What does it do and is it required?"
N	cursor	Screendragon_VS_Taskbar.exe	"ScreenDragon video player"
?	Cwcdschk.exe	Cwcdschk.exe	"IBM Thinkpad related?"
Y	D-Link AirPlus XtremeG	AirPlusCFG.exe	"D-Link AirPlus Xtreme G wireless access point driver and configuration utility"
Y	D-Link D-Link Wireless 108G DWA-120	AirPlusCFG.exe	D-Link DWA-120 Wireless 108G USB adapter driver and configuration utility
Y	D-Link D-Link Wireless 108G DWA-520	AirPlusCFG.exe	D-Link DWA-520 Wireless 108G desktop adapter driver and configuration utility
Y	D-Link RangeBooster G WDA-2320	AirPlusCFG.exe	"D-Link WDA-2320 RangeBooster G desktop adapter driver and configuration utility"
Y	D-Link RangeBooster G WUA-2340	AirPlusCFG.exe	"D-Link WUA-2340 RangeBooster G USB adapter driver and configuration utility"
X	dark	imgst.scr	"Added by the BANCOS.U TROJAN!"
X	dark	imgrt.scr	"Added by the BANCBAN-FH TROJAN!"
X	dark	csrs.scr	"Added by the BANCBAN-GT or BANCBAN-GU TROJANS!"
U	Dell DataSafe Scheduler	DataSafeOnlineScheduler.exe	"Scheduler for Dell DataSafe™ Online which ""helps protect your music
N	DellSC	dellsc.exe	Dell Solution Center - web-based troubleshooting tools and educational offerings
X	DescargaBromas	"rundll32.exe MSA64CHK.dll	DllMostrar"
?	Description of Shortcuts	*.exe	"* seems to be a sequence of alphanumerics that can be different
X	Desktop	"rundll32.exe msconfd.dll	Restore ControlPanel"
N	Desktop Service Centre	DSC.exe	OptusNet DSL or Dial-Up connection software
U	DeviceDiscovery	hpotdd01.exe	"Detection of new imaging
N	Disc Detector	CtNotify.exe	"For Creative sound cards. Detects when you insert a CD
?	disc detector	qnetquestnotifty.exe	"??"
?	discoveg	discoveg.exe	"??"
?	DISCover	DISCover.exe	"Related to DISCover Drop from Digital Interactive Systems Corporation. What does it do and is it required?"
N	DiscoverDeskshop	Deskshop.exe	"Discover Deskshop - single use ""virtual"" credit card"
U	DiscUpdateManager	DiscUpdMgr.exe	"Disc Update Manager for Digital interactive's DISCover Console. Provider of on-demand video games"
N	DiscUpdateManager	DiscUpdateMgr.exe	"DISCover from Digital Interactive Systems Corporation Inc. ""The company's patented Drop 'n' Play technology provides a simple
U	DiscWizardMonitor.exe	DiscWizardMonitor.exe	"Seagate DiscWizard - hard disk utility for Seagate's SATA and PATA (IDE) drives"
X	Distributed Link Tracking	ascvt.exe	"Added by the AGOBOT-GH BACKDOOR!"
X	dlcipscl	dcpavss.exe	"Added by the MAILBOT-CB TROJAN!"
N	DMAScheduler	DMAScheduler.exe	"Related to DigitalMedia Plus Archiver. This program is non-essential process to the running of the program
X	DnsCache	Wscript.exe dns_cache.vbs	"Added by the AUTORUN-AWI WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""dns_cache.vbs"" file is located in %System%"
X	DNSCacheBoost	dnsping.exe	"Added by the DNSBUST-A TROJAN!"
X	dnscleaner	dnscleaner.exe	"CoolWebSearch parasite variant"
N	Drag-to-Disc	DrgToDsc.exe	"System Tray access to Roxio Drag-to-Disc - part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools. ""Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically"". Not required for Roxio to work properly and available via the Start menu"
X	DRam prosessor	plscd.exe	"Added by the RBOT.CYA WORM!"
N	DrgToDsc	DrgToDsc.exe	"System Tray access to Roxio Drag-to-Disc - part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools. ""Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically"". Not required for Roxio to work properly and available via the Start menu"
X	Driver32	Scam32.exe	"Added by the SIRCAM WORM!"
U	DriverMagicLogon	dmschedule.exe	"Part of DriverMagic - ""the easiest way to locate device drivers"""
Y	Drwebscheduler	Drwebscd.exe	"DrWeb antivirus related - scheduler that allows you to manage an automatic launch of applications
U	DS Clock	dsclock.exe	"Digital desktop clock including synchronization with atomic servers - see here"
U	dscactivate	dsca.exe	Dell Support Agent offers additional support and update features for your Dell computer or laptop
X	DVAScvssdfa	AsSDdwd.exe	"Added by the LIOTEN.IP TROJAN!"
?	EDFcsn	discfcsn.exe	"Related to Hewlett-Packard's Discovery Agent. What does it do and is it required?"
X	ehSched	ehSched.exe	"Added by the SDBOT-DHF WORM!"
U	ELBERTRicoh_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Ricoh MFP Type 104 multifunction printer
U	ELBERT_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX-5x30 Series multifunction printers
U	Electron Microscope	EMIII.exe	"Electron Microscope or EM - is a program used to track Stanford's distributed computing program client called Folding at Home
Y	EmailScan	mcvsescn.exe	Related to McAfee AntiVirus suite - used to automatically scan incoming e-mails
X	ERScw	ERScw.exe	"Part of the ErrorSafe rogue system error and cleaning utility - not recommended"
Y	eScan Monitor	AVKWCTL9X.EXE	"MicroWorld eScan antivirus"
U	eScan Scheduler	avkserv.exe	"MicroWorld eScan antivirus scheduler"
U	eScan Updater	Trayicos.exe	"MicroWorld eScan antivirus updater - allows users to automatically download updates and set the auto time interval for downloads"
X	EScorcher	escorcher.exe	"Part of eScorcher anti-virus software - responsible for performing virus checks and deletions. Used to collect information about the user and therefore treated as spyware - now the web-site is dead"
X	EventApplicationCmd	smschk.exe	"Added by the IRCBOT-AO TROJAN!"
N	evntsvc	evntsc.exe	"Application Scheduler installed along with RealOne Player. Once installed
X	ExeName32	Warm.scr	"Added by the SCOLD WORM!"
X	explorer	wscript.exe [filename]	"Sneaky way to start any VBS script. Many viruses use VBS files. Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	ExploreUpdSched	[random filename]	"ZenoSearch adware"
X	EYORE	Notepad.scr	"Added by the GIMLET-A WORM!"
?	fgl23DoubleScreenHooks	f23happ.exe	"Related to the now discontinued ATI Fire GL3 graphics card. What does it do and is it required?"
X	File System Service	wmiprvsc.exe	"Added by the AGOBOT-HZ TROJAN!"
X	FileManager32	Wscript.exe ChkMgr32.vbs	"Added by the NOTUP.A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""ChkMgr32.vbs"" file is located in %System%"
X	FileSoft	Wscript.exe UpdataFiles.vbs	"Added by the SST.B WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""UpdataFiles.vbs"" file is located in %Windir%"
X	FireWire Service	nvscv32.exe	"Added by a variant of the SDBOT WORM!"
U	FRISK FP-Scheduler	F-Sched.exe	"Scheduler for F-Prot anitvirus software. Leave enabled unless you scan manually on a regular basis"
N	FSCBoss	FSCBoss.exe	Free Store Club shop online software
N	FSScrCtl	FSScrCtl.exe	Screen saver control applet used by the "Stardust Screen Saver Toolkit" and "SolidWorks Screen Saver"
U	Ftpqueue	Ftpsched.exe	"Part of WS_FTP Pro from Ipswitch. Queueing facility for scheduling FTP transfers"
N	Gadwin PrintScreen	PrintScreen.exe	"Gadwin PrintScreen - utility to capture
X	game	patcher.scr	"Added by the PSW-ED TROJAN!"
X	gcasServ	realsched.exe	"Added by a variant of the TACTSLAY.A TROJAN! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name"
X	Generic Host Process	SCHOST.EXE	"Added by the RBOT-NC WORM!"
X	Generic Host Process for Win Services	mscvs.exe	"Added by a variant of the SDBOT WORM!"
X	Generic Host Process For Win32 Services	mtsc32.exe	"Added by the VB-CPL TROJAN!"
X	Generic Host Process2 System Backup	scvhost2.exe	"Added by the RBOT-BAH WORM!"
X	Generic Host Process326a System Backup	scvhost326a.exe	"Added by a variant of the SDBOT WORM!"
X	gescw	gescw.exe	"Part of BeschermingsTool
X	GlobalSCAPE	[random filename]	"Added by the RBOT-AYM WORM!"
X	gremier	wscript.exe gpremier.vbs	"Added by the GPREMIER WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""gpremier.vbs"" file is located in %System%"
U	GroupWise PDA Connect - ScheduleSync	SCHEDU~1.EXE	"ScheduleSync specific translator for the GroupWise PDA Connect PDA synchronisation utility from Novell"
?	Gscbc	Gscbc.exe	"??"
X	gtydf	iisca.exe	"Added by the CLAGGER-BB TROJAN!"
X	gtydf	iscca.exe	"Added by the DWNLDR-GTK TROJAN!"
U	H/PC Connection Agent	WCESCOMM.EXE	"Connection manager for Microsoft ActiveSync - mobile device synchronization software for Windows XP (and earlier)
X	hdlpscom	[8 random letters].exe	"Added by the RBOT-FUL WORM!"
X	help	help.scr	"Added by the BANCOS-BBU TROJAN!"
X	Helper	eschlp.exe	"Added by the BLASTER.T WORM!"
?	HerculesCamService	CamService.exe	"Related to the Hercules Dualpix HD Webcam. What does it do and is it required?"
U	HijackThis startup scan	HijackThis.exe	"""HijackThis is a free utility which quickly scans your Windows computer to find settings that may have been changed by spyware
N	Home Theater SchSvr	SchSvr.exe	"WinScheduler is installed with Home Theater Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
U	HotKeysCmds	hkcmd.exe	"Hot Key handler for Intel desktop and mobile motherboard chipsets with integrated graphics. With this enabled
X	HotKeysCmds	[path to worm]	"Added by the PAHATIA-A WORM!"
U	HP Health Check Schedule	HPHC_Scheduler.exe	HP Health Check Scheduler from Hewlett-Packard
?	HP IDScheduler	HPIDSCHD.exe	"HP Instant Delivery Scheduler"
N	HP JetDiscovery	HPJETDSC.EXE	HP JetAdmin software which monitors printing jobs on a network environment
N	HP Precision Scan	hpmdlbwx.exe	HP multifunction scanner software. Available from HP Office Jet R Toolbox so not required
U	hp psc 2000 Series	hpobnz08.exe	System Tray icon indicating when the printer is ready. Can be started manually with HP Director but takes time to start
U	HP ScanPatch	HPScanFix.exe	"Program that starts up and automatically fixes earlier versions of the Scanjet 5100c software. If a Scanjet 5100C scanner is not going to be used
N	HP ScanPicture	hpsplmwa.exe	HP multifunction scanner software. Available from HP Office Jet R Toolbox so not required
U	HP SchedIndexer	hppschedindexer.exe	"Installed by HP multi-function printer driver software
N	HP software update	HPWuSchd2.exe	HP software updates. If a shortcut doesn't exist create your own and run it manually
N	HP software update	HPWuSchd.exe	"HP software updates. If a shortcut doesn't exist
N	HPAiODevice(hp psc 900 series) -1	hpobrt07.exe	"Installed with a Hewlett Packard 900 series colour printer
N	hpfsched	hpfsched.exe	HPFSCHED is a small TSR that will remind you to clean the cartridges in your DeskJet from time to time in order to keep print quality high. It can be removed from the run line in win.ini if you do not want that feature
U	HPSCANMonitor	hpsjvxd.exe	HP scanning software that enables you to scan images from your scanner. Needed if you're using the scanner
?	hpScannerFirstBoot	scannerfb.exe	"HP scanner related"
X	hpsysconf1	[random filename]	"Added by a variant of the VIVIA.A TROJAN!"
X	icq lite	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	icrosoft Visual	plscx.exe	"Added by the RBOT-AYO WORM!"
X	IE-Security	iescan.exe	"IE-Security rogue spyware remover - not recommended
X	IE-Security	wdscan.exe	"IE-Security rogue spyware remover - not recommended
X	IExplorer32 Java Scripting	IExplore32b.exe	"Added by the RBOT.ABO WORM!"
X	IExplorer32c Java Scripting	IExplore32cb.exe	"Added by the RBOT.ABN WORM!"
X	IExplorer6 Java Scripting	IExplore326.exe	"Added by a variant of the SDBOT WORM!"
X	IExplorer7 Java Scripting	IExplore327.exe	"Added by a variant of the SDBOT WORM!"
U	IJNetworkScanUtility	CNMNSUT.EXE	Network utility available for some Canon scanners and multifunction devices. Allows the device to see computers on a network and those computers running the utility to control scanning via the Control Panel on the scanner - which saves you having to run back and forth between the scanner and your computer
U	ImScInst	ImScInst.exe	"Microsoft's Input Method Editor which is used to both display and enable the input of characters from East Asian and Right-to-left (e.g. Arabic) languages in e-mails
U	ImScInst.exe	ImScInst.exe	"Microsoft's Input Method Editor which is used to both display and enable the input of characters from East Asian and Right-to-left (e.g. Arabic) languages in e-mails
?	insCOA5	insCOA5.exe	"??"
X	Intel Service Drivers	msconfig16.exe	"Added by the MSCONFIG16 TROJAN!"
X	internet service	syscfg32.exe	"Added by the RBOT-QS WORM!"
N	Intervideo WinScheduler	WinScheduler.exe	"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
N	Intervideo WinScheduler	SchSvr.exe	"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
X	Intranet	schost.exe	"Added by the RBOT.SV BACKDOOR!"
U	Inventory Scan	LDISCN32.EXE	"LANDesk® Management Suite software component"
N	Iomega Backup Scheduler	dtiom98.exe	"Used by Iomega drives. Details of its purpose can be found here. Available via Start -> Programs"
U	IRIS_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung CLX-3160 Series multifunction laser printer
U	IRIS_XRX_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Xerox Phaser 6110MFP multifunction laser printer
X	IsassRenascimento	Issas.exe	"Added by the BANKER.GAX TROJAN!"
X	iscch	iscch.exe	"Added by the LCPRANK-A WORM!"
N	issch	issch.exe	"InstallShield is used by a number of software producers to install their programs and manage software updates. This entry runs scheduled searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis"
N	ISUSScheduler	issch.exe	"InstallShield is used by a number of software producers to install their programs and manage software updates. This entry runs scheduled searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis"
N	iSysCleaner	iSysCleaner.exe	"iSysCleaner - a simple tool that searches for junk files on your computer and allows you to delete them. Simple cleaning maintenance can be done by the user"
N	Java(TM) Platform SE 6	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
N	Java(TM) Platform SE 6 U*	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now. U* represents the update version
N	Java(TM) Platform SE Auto Updater 2 0	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
X	java-plugin	javasctp.exe	"Added by the VB.AMX TROJAN!"
X	Javascript	jscript.exe	"Added by the DELBOT-AD WORM!"
X	JavaScript Debugging Service	JsDbgMan.exe	"Added by the DERDERO.E WORM!"
X	JavaScriptMsxrs	Msxrs.exe	"Added by the VB.BL WORM!"
X	JavaUpdateSched	jusched32.exe	"Added by the BCKDR-CKB BACKDOOR!"
Y	JetAdmin Discovery Indicator	HPJETDSC.EXE	"HP JetAdmin software for HP JetDirect Print Servers. HPJETDSC.EXE is the file necessary for the JetAdmin Discovery Indicator (paper airplane in the taskbar). It gets launched automatically through the registry
X	Jnskdfmf9eldfd	csrssc.exe	"Added by the AGENT.EBC TROJAN!"
N	jusched	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
X	jusched	[path to trojan]	"Added by the BANKER-BWR TROJAN!"
X	jusched	jusched.exe	"Added by the BANKER-BOV TROJAN! Note that this is not the legitimate Sun Microsystems file (of the same name) which is usually located in %Program Files%\Java\version number\bin. This one is located in %System%"
X	KAVPersonal90	wscntfy.exe	"Added by the BANKER-FZ TROJAN!"
X	Kvsc3	Kvsc3.exe	"Added by the PWS-ANM TROJAN!"
U	LANDeskInventoryClient	LDIScn32.exe	"LANDesk® Management Suite software component"
U	Laplink PDASync 3.1 - ScheduleSync	ScheduleSync.exe	"Laplink PDASync for ScheduleSync - PDA synchronisation utility"
U	LapLink scheduler	Llsched.exe	Utility that automatically performs file transfers as unattended background operations
U	LidPolicy	pwrschem.exe	A utility for configuring certain HP notebook models to enter Standby mode when the lid is closed only when running on battery
N	LifeScape Media Detector	PicasaMediaDetector.exe	"Media detector for Picasa's automatic photo organizer"
N	Lightscribe	LightScribeControlPanel.exe	"System Tray access to the LightScribe Control Panel for CD/DVD writers based upon HP's LightScribe laser-etching process - which allows you to burn a label straight onto specially coated blank disks. Part of the main LightScribe System Software (LSS)"
N	LightScribe Control Panel	LightScribeControlPanel.exe	"System Tray access to the LightScribe Control Panel for CD/DVD writers based upon HP's LightScribe laser-etching process - which allows you to burn a label straight onto specially coated blank disks. Part of the main LightScribe System Software (LSS)"
N	LightScribeControlPanel	LightScribeControlPanel.exe	"System Tray access to the LightScribe Control Panel for CD/DVD writers based upon HP's LightScribe laser-etching process - which allows you to burn a label straight onto specially coated blank disks. Part of the main LightScribe System Software (LSS)"
X	load	ctftpscr32.exe	"Added by the AGENT-FPN TROJAN!"
X	Load-Guard	Wscript.exe LGuarg.exe.vbs	"Added by the YENO.B and YENO.C WORMS! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""LGuarg.exe.vbs"" file is located in %Windir%"
?	load=	WINOSCFG.EXE	"Could it be something to do with configuring Windows on a new PC from an OEM supplier?"
X	LoadPowerScheme	rundll32.exe powerprof.dll CheckPowerProfile	"Ulubione adult content dialer. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
U	Logan_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX-4500 Series multifunction printer
X	Login Screen Saver	login.scr	"Added by the RBOT-AVN WORM!"
Y	Logoff	SCTUINotify.exe	"Part of Windows SteadyState
X	LTM2	winscan.exe	"Added by the LITMUS-B TROJAN!"
Y	LXBSCATS	"rundll32 [path] LXBStime.dll	_RunDLLEntry@16"
X	Macromedia Flash Update	scvhost.exe	"Added by a variant of the RBOT WORM!"
N	Macrovision Update Service	issch.exe	"InstallShield is used by a number of software producers to install their programs and manage software updates. This entry runs scheduled searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis"
U	MagicDisc	MagicDisc.exe	"MagicISO - ""very helpful utility designed for creating and managing virtual CD drives and CD/DVD discs"""
Y	MailScan Dispatcher	Launch.exe	"MicroWorld MailScan Dispatcher splits each e-mail message into various components such as the header
X	Malware Scanner	MalScr.exe	"Malware Scanner rogue security software - not recommended
U	Maple_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung CLX-216x Series multifunction printers
X	Mascro soft SDK updates2	SDKrepair2.exe	"Added by the SDBOT.BXM WORM!"
U	Matrix Screen Locker	matrix.exe	"Matrix Screen Locker is a system tray application that allows for quick and secure PC lock when you wish. The screen does a ""matrix style"" scrolling characters effect when the lock is running"
X	MatrixScreen	[filename]	"Added by the MATRIXSCREEN TROJAN!"
X	MatrixScreenSaver	mss.exe	Unidentified malware
U	MaxBackSchedule	maxbackservice.exe	Backup scheduler for the Maxtor (now Seagate) range of external hard drives - part of Maxtor Quick Start
X	Mcafee Anti Scan	NortonScn.exe	"Added by a variant of the RBOT WORM!"
X	McAfee Online virus Scanner	avp.exe	"Added by the RBOT-GCV WORM! Not to be confused with Kaspersky anti-virus and AOL's Active Virus Shield (by Kaspersky) - found in either a Kaspersky or AOL sub-directory"
X	McAfee Online Virus Scanner	nzm.exe	"Added by the IRCBOT.XV WORM!"
Y	McAfee VirusScan	mcmnhdlr.exe	"Part of older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online. When Windows boots it checks whether a virus scan is necessary before you do anything with your PC. Typically
Y	McAfee VirusScan	mcvsshld.exe	"ActiveShield - background scanner for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online which scans files in the background as and when they are accessed
Y	McAfee VirusScan	oasclnt.exe	"On-access real-time scanner for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online which scans files for malware as you access
X	Mcafee VirusScan Manager	mvcsvm.exe	"Added by the SILLYFDC.BBV TROJAN!"
X	McAfeeScanPlus	McAfeeScanPlus.exe	"Added by the MEPCOD TROJAN! This trojan file does not belong to any McAfee Antivirus Software and is found in the Windows or Winnt folder"
Y	McAfeeVirusScanService	Avsynmgr.exe	"From McAfee VirusScan version 5.x. Runs VirusScan System Tray (Vsstat.exe)
Y	McAfeeWebscanX	WebScanX.exe	"From McAfee VirusScan up to version 4.x. Provides functionality for VShield Download Scan and Internet Filter modules. Enables internet scanning. Guards against malicious ActiveX programs
X	Mcaffe Antivirus	Mcafeescn.exe	"Added by a variant of the SPYBOT WORM!"
X	MCX Updte	scorti.exe	"Added by the RBOT-ARP WORM!"
X	Media Software UPdater	sscs.exe	"Added by the RBOT-ABE WORM!"
X	mediapluscash.exe	mediapluscash.exe	"MediaGateway adware"
X	MemScanner	MemScanner.exe	"Part of Enigma SpyHunter - not recommended
Y	Messenger	SCANMSG.EXE	"AntiVirus Quick Heal - virus protection"
U	MessengerDiscovery	MessengerDiscovery.exe	"MessengerDiscovery is a MSN Messenger add-on - adding over 70 new features. Now superseded by MessengerDiscovery Live - with support added for Windows Live"
U	MFP1815_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Dell Laser MFP 1815 multifunction printer
U	MGSysCtrl	MGSysCtrl	Part of the System Control Manager for MSI notebooks - displays animations for hot key commands (such as turning the wirelss card on/off)
X	Mi7sft sdce	scorti.exe	"Added by the RBOT.ELC WORM!"
X	Micosoft Startup	syscall.exe	"Added by the SDBOT-JI WORM!"
X	Micro CRC Protocol	scrc32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft	rtvcscan.exe	"Added by the RBOT-GGU WORM!"
X	Microsoft	schost.exe	"Added by the RBOT.FEH BACKDOOR!"
U	Microsoft ActiveSync	WCESCOMM.EXE	"Connection manager for Microsoft ActiveSync - mobile device synchronization software for Windows XP (and earlier)
X	Microsoft Client	msclient.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Conf Ldr	sysconf.exe	"Added by a variant of the SDBOT TROJAN!"
X	Microsoft Config	msconf.exe	"Added by the RBOT.PV WORM!"
X	Microsoft Config	MSCONF.EXE	"Added by the RBOT-LG WORM!"
X	Microsoft Config 32	msconfigx32.exe	Reported as the MSCONFIGX32 TROJAN! Possible Rbot variant
X	Microsoft Config 32bit	mscnfg32.exe	"Added by the RBOT-Z WORM!"
X	Microsoft Config Loader	msconfig32.exe	"Added by the AGOBOT.XX WORM!"
X	Microsoft Config Loader	msconf32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Configoration Service	msconfigs.exe	"Added by the RBOT-ETT WORM!"
X	Microsoft Configuewe	msconfiguwe.exe	"Added by the SDBOT-BPK WORM!"
X	Microsoft Configuration	msconfig32.exe	"Added by the SDBOT.MQ WORM!"
X	Microsoft Corporation Svchost Service	mswsc.exe	Added by the AGENT.MAB TROJAN!
X	Microsoft CSRSS Service	nsmscrs.exe	"Added by the RBOT-BPT WORM!"
X	Microsoft Cvrt	mscvrt32.exe	"Added by an unidentified VIRUS
X	Microsoft Device Manager	mscmtl32.exe	"Added by the AGENT.BMQ BACKDOOR!"
X	Microsoft Digital Clock	msclock.exe	"Added by the NACKBOT-D WORM!"
X	Microsoft DirectX	PDSched.exe	"Added by the SDBOT.CN WORM!"
X	Microsoft Disk Scanner	scansdisk.exe	"Added by the WOOTBOT.DT WORM!"
X	Microsoft DLL Verifier	mscon.exe	"Added by the SDBOT.EAH WORM!"
X	Microsoft Drivers	WSconf.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Explorer	explorer.scr	"Added by the RBOT-ADH WORM!"
X	Microsoft Java Virtual Machine	MsConfiG.exe	"Added by the FORBOT-DV WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting"
X	Microsoft Java Virtual Machine	winscr32.exe	"Added by a variant of the WOOTBOT WORM!"
X	Microsoft LSASS386 Protocol	scvhost32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft machine	scvhost.exe	"Added by the RBOT.AEU TROJAN!"
X	Microsoft machine	arcpack.scr.exe	"Added by the RBOT.ADF BACKDOOR!"
X	Microsoft Machine Script	iexplorersis.exe	"Added by the RBOT-CMH WORM!"
X	Microsoft Manage Services	schost.exe	"Added by the SLENFBOT.B WORM!"
X	Microsoft MediaScope	winmes.exe	"Added by the RBOT-XU WORM!"
X	Microsoft Office Studio	scvhvst.exe	"Added by the RANDEX.CST WORM!"
X	Microsoft RDLL	sysconf32.exe	"Added by a variant of the SDBOT TROJAN!"
X	Microsoft Restore	scrgrd.exe	"Added by the SPYBOT.BR WORM!"
X	Microsoft Scanreg	microsoftscanreg.exe	"Added by the FRANRIV.A WORM!"
X	Microsoft SCVHOST32 Protocol	scvhost32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Services	bsc32.exe	"Added by the BDOOR-AW BACKDOOR!"
X	Microsoft Synchronization Manager	netscape.exe	"Added by the RANDEX.AE WORM!"
X	Microsoft Synchronization Manager	screen.exe	"Added by the SDBOT-ACO WORM!"
N	Microsoft System Configuration Utility	msconfig.exe	Entry that appears when you uncheck an item in the MSConfig Startup group and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode. Located in %System% (98/Me/Vista) or %Windir%\PCHealth\HelpCtr\Binaries (XP)
X	Microsoft TCP Service	scvhost.exe	"Added by the AGOBOT-L WORM!"
X	Microsoft Update	mvsc.exe	"Added by the SPYBOT.DAZ WORM!"
X	Microsoft Update	ascdl.exe	"Added by the GAOBOT.SY WORM!"
X	Microsoft Update	msconfg.exe	"Added by the RBOT.H WORM!"
X	Microsoft Update	winscv.exe	"Added by the RBOT-BH WORM!"
X	Microsoft Update	scvhost.exe	"Added by the RBOT-AEM WORM!"
X	Microsoft Update 32	mscnfg.exe	"Added by the RBOT-ALM WORM!"
X	Microsoft Update 64 BIT	schvost.exe	"Added by the RBOT.CAU WORM!"
X	Microsoft Update Machine	scvhost.exe	"Added by the RBOT-GS WORM!"
X	Microsoft Update Manager	scvhost.exe	"Added by the AGOBOT.AXJ WORM!"
X	Microsoft Update Manager	scvideo.exe	"Added by the SDBOT-CVP TROJAN!"
X	Microsoft Updater	msconsole.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Updaters	sysconfigs.exe	"Added by the RBOT-DF TROJAN!"
X	Microsoft Updating Machine	sysc0de.exe	"Added by the RBOT.RB WORM!"
X	Microsoft Visual Studio	plscdksxg.exe	"Added by the RBOT-AWV WORM!"
X	Microsoft Windows Client Firewall	msclt.exe	"Added by the VANEBOT-F WORM!"
U	Microsoft Windows Media Player Network Sharing Service Configuration Application	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	Microsoft Windows Security	wscndrives.exe	"Added by the RBOT-AJK WORM!"
X	Microsoft Windows Updata	scvhost.exe	"Added by the RBOT.CEM BACKDOOR!"
X	Microsoft Windows Update	scvvhost.exe	"Added by the FORBOT-DH WORM!"
X	Microsoft Windows Update	sccvhost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update	scrhost.exe	"Added by the RBOT-AOW WORM!"
X	Microsoft Winsock	mswinsck.exe	"Added by the RBOT-ANK WORM!"
Y	MicrosoftAntiSpywareCleaner	gcASCleaner.exe	"Microsoft Antipsyware - now superseded by Microsoft's Windows Defender"
X	MicroSoftRun	MSCOMM.dll	"Added by the AGENT-DJG TROJAN!"
X	Microsofts MediaScope	winmep.exe	"Added by the RBOT-WB WORM!"
X	Microsofts MediaScope	winmedplay.exe	"Added by a variant of the RBOT WORM!"
X	MicrosoftValue	syscnfg.exe	"Added by an unidentified VIRUS
U	Microsoft� Windows� Operating System	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
U	Microtek Scanner Finder	ScannerFinder.exe	Monitors whether a scanner is present. Provided with Microtek scanners
X	Mircosoft Sockets SP2	mssck.exe	"Added by the MYTOB.ET WORM!"
X	Miscrosoft Windows Explorer	IEEXPLORER.exe	Reported as the SDBOT.YX WORM!
X	ModularConfig	syscnfg.exe	"Added by an unidentified VIRUS
X	Modulo 00FE0F01 Host Internet	syschost.exe	"Added by the DELF-KW TROJAN!"
N	Mozilla Quick Launch	Netscp6.exe	Netscape 6 and Mozilla browsers
U	MPSExe	mscifapp.exe	McAfee.com Privacy Service - "combines personal identifiable information (PII) protection with online advertisement blocking and content filtering"
X	mqadscp3	mqadscp3.exe	"Added by the STRATION.CX WORM!"
U	MRU-Blaster Scheduler	scheduler.exe	"Scheduler for MRU-Blaster - ""a program made to do one large task - detect and clean MRU (most recently used) lists on your computer"""
X	MS Config v12	mscfg12.exe	"Added by the AGOBOT.YP WORM!"
X	MS Config v13	mscfg13.exe	"Added by the AGOBOT.YQ WORM!"
X	Ms configsu	msconfigsu.exe	"Added by a variant of the SDBOT WORM!"
X	MS Configuration Utility	msconfig32.exe	"Added by the WOOTBOT.DY WORM!"
X	MS Microsoft Socket Deamon	MSSCKD32.exe	"Added by a variant of the RBOT WORM!"
X	MS Screen Saver	scrsave.scr	"Added by the RBOT-AGT WORM!"
X	MS Service Drivers	winscv.exe	"Added by the SDBOT-COG WORM!"
X	MS System Call Function	msscf32.exe	"Added by the RBOT-GBZ WORM!"
X	Ms System Config	Mscfg.exe	"Added by the SDBOT-CCR WORM!"
X	MS Updates	mscache.exe	Spyware web downloader
X	MS Windows Update	scguard.exe	"Added by the RBOT-YZ WORM!"
X	MS-patch	msconfig32.exe	"Added by the RBOT-AUF WORM!"
Y	MSASCui	MSASCui.exe	"Main user interface for Microsoft's Windows Defender on XP/Vista - which ""helps protect your computer against pop-ups
X	msavsc.exe	msavsc.exe	"Added by the AGENT.ANQ TROJAN!"
X	msbsc	[path to trojan]	"Added by the BANKER-DF TROJAN!"
X	msc	msc.exe	"MaCatte Antivirus 2009 rogue security software - not recommended
X	msccrt	msccrt.exe	"Added by the PWS-ALA TROJAN!"
X	mscheck	rundll32.exe wincheck071008.dll mymain	"Added by the AGENT.ADXI TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""wincheck071008.dll"" file is located in %System%"
X	mschkdf.exe	mschkdf.exe	"Added by a variant of the SDBOT WORM!"
X	MSChoExE	suge.exe	"Added by a variant of the RBOT WORM!"
?	msci	mcinfo.exe	"McAfee Internet Security related. What does it do and is it required?"
X	msclac	msclac.exe	"Added by the SDBOT-JM WORM!"
X	msclean	msvchost.exe	"Added by the OPANKI-Q WORM!"
X	mscman	mscman.exe	"ClientMan parasite variant"
X	mscms	mscms.exe	"Added by the AGENT-MS TROJAN!"
U	mscn	mscn.exe	Part of the SafeChildNet internet filtering program - required if you use it
X	Mscnt	mscnt.exe	"Added by the DLUCA-C TROJAN!"
X	Mscolour	mscolour.exe	"Added by the GEMA TROJAN!"
X	MSCommX	mscommx.exe	"Added by a variant of the RBOT WORM!"
X	Msconf32	Msconf32.exe	"Added by the AGOBOT-NR WORM!"
X	MSCONFG32.EXE	MSCONFG32.EXE	"Added by the OPTIX.04.C TROJAN!"
N	MSConfig	msconfig.exe	Entry that appears when you uncheck an item in the MSConfig Startup group and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode. Located in %System% (98/Me/Vista) or %Windir%\PCHealth\HelpCtr\Binaries (XP)
X	MSConfig	MSCONFIG32.EXE	"Added by the SPYBOT.B WORM!"
X	msconfig	msconfig.exe	"CoolWebSearch MSConfig parasite variant. Note - this overwrites the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting"
X	msconfig	msconfig.exe	"Added by the WINUR WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting. This one is located in c:\winrun"
X	msconfig	wins.exe	"Added by the RBOT.PF WORM!"
X	MSConfig	MSCONFIG35.EXE	"Added by a variant of the SPYBOT WORM!"
X	msconfig	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	msconfig	winlog.exe	"Added by the IRCBOT-TJ TROJAN!"
X	Msconfig	icpldrvx.exe	"Added by the BANLOAD.BFT TROJAN!"
X	msconfig	msconfig.com	"Added by the IRCBOT-SM WORM!"
X	msconfig	msconfig.bat	"Added by the PAHATIA.B WORM!"
X	MSConfig	lssas.exe	"Added by the AUTORUN.CEY WORM!"
X	MSConfig	xwpwqf.exe	"Added by the AGENT-NEW TROJAN!"
X	Msconfig lptt01	msconfig.exe	"RapidBlaster variant (in a ""msconfig"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Windows Msconfig which has the same executable name"
X	MSConfig Manager	msupdate.exe	"CoolWebSearch parasite variant"
X	Msconfig ml097e	msconfig.exe	"RapidBlaster variant (in a ""msconfig"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here. Note - this is not the valid Windows Msconfig which has the same executable name"
X	msconfig service	MSupdate32.exe	"Added by a variant of the SPYBOT WORM!"
X	msconfig.	msconf.exe	"Added by the BUZUS-AY WORM!"
X	msconfig.exe	proxy.exe	Added by a variant of the AGENT.AH downloader TROJAN!
X	msconfig.exe	uline.exe	Added by a variant of the AGENT.AH downloader TROJAN!
X	msconfig38	mssvcc.exe	"Added by the RBOT-BJV WORM!"
X	MSConfig45	MSConfig45.exe	"Added by the SDBOT.OJ TROJAN!"
X	MSConfigr	jdbgmrg.exe	"Added by the DASMIN.C TROJAN! Note - this is not the valid JDBGMGR.EXE file - see here"
N	MSConfigReminder	msconfig.exe	Entry that appears when you uncheck an item in the MSConfig Startup group and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode. This particular entry is specific only to 98/Me and is located in %System%
X	MsConfigs	MsConfigs.exe	"Added by the ALCAN.A WORM!"
X	MSConfigs	RUNDLL64.dll.vbs	"Added by the WEKODE-B WORM!"
X	msconfigurator	ctfsdk.exe	"Added by the DELF-ALS TROJAN!"
X	MSControl28	crsss.exe	"Added by the SPYBOT.AJX WORM!"
X	MSControl31	winnsyst.exe	"Added by the RBOT.CFY WORM!"
X	MSControl3d1	isasse.exe	"Added by the RBOT.CGU WORM!"
X	MSCORE	syscnfg.exe	"Added by an unidentified VIRUS
?	MSCRMStartup	Microsoft.Crm.Application.Hoster.exe	"Related to Microsoft Dynamics CRM integrated solutions for Financial
X	Mscsgs	MSCSGS.EXE	"Added by the ZEZER WORM!"
X	Mscsgs32	MSCSGS32.EXE	"Added by the ZEZER WORM!"
X	mscsvc.exe	mscsvc.exe	"Added by the BANCOS.T TROJAN!"
X	msctfg32	msctfg32.exe	"Added by the RBOT-TJ WORM!"
X	msctrl.exe	msctrl.exe	"Microsoft Security Adviser rogue security software - not recommended"
X	Msctrl32	Msctrl32.scr	"Added by the REDIST WORM!"
X	MSCVT	MSCVT.exe	"Added by the SLIDESHOW WORM!"
X	msdev	msconfig.exe	"Added by the AGOBOT.AAU WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting"
X	MSDLL	syscnfg.exe	"Added by an unidentified VIRUS
X	msm	msm.scr	"Added by the BANKER-EHJ TROJAN!"
X	msmc	mscpbo.exe	"ClientMan parasite variant"
X	MSN	scvhost.exe	"Added by the IRCBOT-ZW WORM!"
X	MSN	msscomd.exe	"Added by a variant of the SPYBOT WORM! See here"
X	MSN Manager	mscmgr.exe	Unidentified malware - causes multiple browser windows to open
X	MSN Update	mscon.exe	"Added by the RBOT-QA WORM!"
X	msnmsg.exe	mscmd32.exe	Added by a variant of the AGENT.AH TROJAN!
X	msnsched2	msnsched2.exe	"Added by the SPYBOT.NNT WORM!"
X	msnscr.exe	msnscr.exe	"Added by the CERTIF-P TROJAN!"
X	msnToolbaar	msnmsgesc.exe	"Added by the RBOT.BMF WORM!"
U	MSPY2002	ImScInst.exe	"Microsoft's Input Method Editor which is used to both display and enable the input of characters from East Asian and Right-to-left (e.g. Arabic) languages in e-mails
U	MSRegScan	SGP.exe	"SpyGator surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	SSDemo.exe	"SupremeSpy surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	ETNKL.exe	"ComKeylogger surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	KSPDemo.exe	"KeyStalker PRO surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	DDSSDemo.exe	"SystemSleuth surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	ESP+.exe	"ESP surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	ESPDemo.exe	"Eye Spy Pro surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	SBPDemo.exe	"SpyBoss Pro surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	YEKPND.exe	"EyeCandy Computer Monitor surveillance software. Uninstall this software unless you put it there yourself"
U	MSRegScan	YKPND.exe	"YKPMD surveillance software. Uninstall this software unless you put it there yourself"
X	msscan.exe	msscan.exe	"Microsoft Security Adviser rogue security software - not recommended"
U	MSSCDL	MSSCDLL.exe	"SpyCapture keystroke logger/monitoring program - remove unless you installed it yourself!"
X	MSService_v1.0	realsched.exe	"EHU adware. Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name"
X	mssoul	msmscc2.exe	"Added by the DAPIZL.A banker WORM! (A ""banker worm"" is designed to pillage banking information and send it back to the perpetrators!)"
X	mssoul	msmscc.exe	"Added by the BANCOS.HKT TROJAN!"
X	MSStartOptimizer	SCVHOST.EXE	"Added by the DASMIN-E TROJAN!"
X	mstsdsc.exe	mstsdsc.exe	"Added by the CIMUZ-CD TROJAN!"
X	MSVersion	clrschp038.exe	"Added by the POPMON.A TROJAN! - also known as PopMonster adware"
X	msvsc32	msdev.exe	"Added by the RBOT-GJ WORM!"
X	MSWindows SysCl	mscl32.exe	"Added by the RBOT.AHI WORM!"
U	MVRescue	mvrescue	Related to Multivision Computers back up/restore program. Multivision Computers ceased operating in 2004
U	mwavscan	mwavscan.com	"MicroWorld Anti Virus Toolkit is a free anti-virus scanner that runs on-demand. You can choose to scan your entire system
X	My Web Search Bar Search Scope Monitor	m3SrchMn.exe	"MyWebSearch parasite"
X	MyDailyHoroscope	MYDAIL~1.EXE	"MyDailyHoroscope foistware"
X	MyDailyHoroscope	MyDailyHoroscope.exe	"MyDailyHoroscope foistware"
X	MySLScan	msvc32.exe	"Added by the FORBOT-EH WORM!"
X	Natal	Natal.scr	"Added by the OPASERV.AE WORM!"
X	NAV Scan Service	NAVSCAN32.EXE	"Added by the SDBOT.VG WORM!"
X	NavAgent32	SCardSvr32.Exe	"Added by the MOFEI.B WORM!"
U	Naviscope	naviscope.exe	"Naviscope is a multipurpose browser enhancement that can speed up Web searches
X	NavScan	[filename]	"Added by the OBSORB TROJAN!"
X	NAVSCAN32.EXE	NAVSCAN32.exe	"Added by the SDBOT-DO WORM!"
X	NAVSCANNER32	NAVSCANNER32.EXE	"Added by the RBOT.QC WORM!"
U	NBKeyScan	NBKeyScan.exe	"This tool comes with a special version of Nero BackItUp for some external harddisks. Controls two buttons on the drive - one button power off the drive and the other directly calls Nero BackItUp to make a quick backup"
X	Net Command Senter	nvscvse.exe	"Added by the IRCBOT!DF6280E5 VIRUS!"
U	Netscape	InstallService.exe	Related to Netscape installation
N	Netscape Messenger	NETSCAPE.EXE	"In Netscape 6 (I know for sure with 6.2.1
N	Netscp6	Netscp6.exe	Netscape 6
U	NetScreen-Remote	SafeCfg.exe	"NetScreen Remote VPN client software"
X	NeuerSchild	pgs.exe	"NeuerSchild
X	NI.USYP	SysProtectScannerInstall.exe	"Installer for the SysProtect rogue security software
X	NI.UWFX5	WinFixer2005ScannerInstall.exe	"WinFixer 2005 web installer - ""foistware""
Y	NOD32POP3	Pop3scan.exe	"POP3 E-mail part of Eset's NOD32 virus-scanner"
X	Norton Antiviral Scanner	navscnr.exe	"Added by the DELBOT-K WORM!"
U	Norton Program Scheduler	nsched32.exe	"Installed on a Windows system where the Windows Task Scheduler isn't used as part of the OS (Win95
U	Norton Program Scheduler	NPSsvc.exe	"Installed on a Windows system where the Windows Task Scheduler isn't used as part of the OS (Win95
?	Norton Program Scheduler Event Checker	npscheck.exe	"Part of Norton Anti-Virus. What does it do? Apparently it can safely be disabled without causing problems. Can also be listed as NPS Event Checker"
X	Norton System	csrs.scr	"Added by the BANLOA-AFM TROJAN!"
X	Nortons AV SYSTEM	scvchost.exe	"Added by a variant of the RBOT WORM!"
U	NovastorSchedulerd	SCHENGD.EXE	NovaStor NovaBACKUP Scheduler - back-up utility. If you don't have regularly scheduled back-ups you don't need it
?	NPS Event Checker	npscheck.exe	"Part of Norton Anti-Virus. What does it do? Apparently it can safely be disabled without causing problems. Can also be listed as Norton Program Scheduler Event Checker"
X	NSCheck	NSCHECK.EXE	"MarketScore parasite - ActiveX control used to download premium-rate dialers"
X	nscntrl	nscntrl.exe	"Added by the DLOAD-DC TROJAN!"
X	nssysconf	[random filename]	"Added by the VIVIA.A TROJAN!"
X	NT Printing Service	spoolsc.exe	"Added by the BUZUS-K WORM!"
Y	NTFSCLUP	NTFSCLUP.EXE	"Part of ConfigSafe- ""checks if an ntfssos restore has been performed since it was last run. It exits immediately after running. 99+% of the time it will only execute about a dozen instructions before exiting"""
U	NTI Backup NOW! Scheduler	Schdlr32.exe	"Scheduled backups for the NTI Backup Now archiving utility. If a backup job has been scheduled
X	NTSF MICROSOFT SYSTEM	scvhost.exe	"Added by a variant of the RBOT WORM!"
X	ntvdscm	ntvdscm.exe	"Added by the SCKEYLOG-I TROJAN!"
X	NvCplScan	msc32.exe	"Added by the FORBOT-DD WORM!"
X	NvCplScan	winasp.exe	"Added by the FORBOT.BZ WORM!"
X	NvCplScan	nvsc32.exe	"Added by the BROPIA.N WORM!"
X	NvCplScan	kav32.exe	"Added by the FORBOT-EW WORM!"
X	NvCplScan	netstat32.exe	"Added by the SDBOT.BRL WORM!"
X	NvCplScan	dllmanager.exe	"Added by the FORBOT.R WORM!"
X	NVSystem32	nvscv32.exe	"Added by the AGOBOT-NO WORM!"
Y	OASClnt	oasclnt.exe	"On-access real-time scanner for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online which scans files for malware as you access
X	OD	SYSCNTR.EXE	HotVideo dialler
Y	OfficeScan95	pccwin97.exe	"Trend Micro antivirus OfficeScan"
Y	OfficeScanNT Monitor	pccntmon.exe	"Trend Micro OfficeScan Antivirus real-time scan monitor"
U	OmniPass	scureapp.exe	"OmniPass from Softex Inc. - secure password management software"
U	On Screen Display	OSD.EXE	"By Netropa for HP and other brands. Same group as KBD MediaCenter & Touch Manager. Pressing a "hot key" on such a keyboard brings a corresponding panel on the screen for volume
U	On screen display	TPOSDSVC.exe	"Supports the hotkeys on IBM/Lenovo ThinkPad notebooks - displays the result of the using of function keys on the desktop screen. For example
N	OneNote 2007 Screen Clipper and Launcher	ONENOTEM.EXE	"System Tray access to MS Office OneNote 2007 - an electronic notebook that allows you to create free-form notes
X	only23	SCVHOST.exe	"Added by the BCKDR-PUQ BACKDOOR!"
X	OpenApizs	zrscbm.exe	"Added by the AGENT.RLH TROJAN!"
U	OpScheduler	OpScheduler.exe	"Part of Nuance (was Scansoft) OmniPage Pro document conversion software"
N	OptusNet Desktop Service Centre	DSC.exe	OptusNet DSL or Dial-Up connection software
U	osCheck	osCheck.exe	"Part of Norton Antivirus. Initiates a quick scan (at startup) of the portions of the OS Symantec currently (as defined by the most recent updates downloaded onto the host computer) thinks are most susceptible to infection. This scan is not necessary for proper operation of Norton Antivirus"
U	P3000x_S2P	ScanToPc.exe	Dell Laser MFP 1600N network application for scanning files to the PC
U	Pagis Schedule Monitor	Monitor.exe	Scheduler for the Pagis scanning suite from Scansoft (now Nuance)
N	Pagis Scheduler	Monitor.exe	Scheduler for the Pagis scanning suite from Scansoft (now Nuance)
U	Panasonic Communications Utility	Mfpscdl.exe	"Port manager for Panasonic Panafax fax_machines"
U	Panda Scheduler	pavsched.exe	"Scheduler for older versions of Panda Antivirus. Required if you have scans scheduled on a regular basis"
U	PandaScheduler	pavsched.exe	"Scheduler for older versions of Panda Antivirus. Required if you have scans scheduled on a regular basis"
X	passcxd	[random filename]	"Added by a variant of the SLAPER TROJAN!"
U	PBKScheduler	PBKScheduler.exe	"Scheduler for CyberLink PowerBackup - archiving/backup utility"
U	PC Pitstop Optimize Scheduler	PCPOptimize.exe	"Scheduler for the Optimize system optimization utility from PC Pitstop"
X	PC Scout	pcscout.exe	"PC Scout rogue security software - not recommended
N	PC SpeedScan Pro	PCSpeedScan.exe	"Ascentive PC SpeedScan Pro registry optimizer - not recommended
X	PCCleaner	SysCleaner.exe	"PCCleaner rogue cleaning utility - not recommended
N	PCHealth	pchschd.exe	"This is a ""scheduler"" and does not turn off PC Health. For more information refer here"
X	PDASCAN	pdascan.exe	"Added by the AGOBOT-QY WORM!"
X	Personal Computer	scvhost.exe	"Added by the RBOT-AJE WORM!"
X	Personal Security Center Monitor	isc_ui.exe	"Added by the FAKEALERT TROJAN!"
U	Pop-Up_Scanner	Popupscn.exe	"Panicware popup blocker"
X	PopularScreensaversWallpaper	"rundll32 [path] F3SCRCTR.DLL	LES"
U	PopUpStopperCompanion	PSComp.exe	"PopupStopper Companion popup blocker"
X	Power Scan	powerscan.exe	"Foistware by Integrated Search Technologies - the people behind ISTBar adware"
N	PowerReg Scheduler	PowerReg Scheduler.exe	"PowerREGISTER from Leadertech. Registration reminder as used by Iomega
N	PowerReg Scheduler	PowerReg Scheduler V3.exe	"PowerREGISTER from Leadertech. Registration reminder as used by Iomega
N	PowerReg Scheduler V3	PowerReg Scheduler V3.exe	"PowerREGISTER from Leadertech. Registration reminder as used by Iomega
N	PowerReg SchedulerV2	PowerReg SchedulerV2.exe	"PowerREGISTER from Leadertech. Registration reminder as used by Iomega
N	PowerReg SchedulerV3	PowerReg SchedulerV3.exe	"PowerREGISTER from Leadertech. Registration reminder as used by Iomega
Y	PP2000 Real Time Scan	PPVstop.exe	Protector Plus anti-virus software - real time scanner
?	PPScheduler	PPScheduler.exe	"Part of Nuance (ScanSoft) PaperPort - ""scan
X	Print Scheduler	usnsvc.exe	"Added by a variant of the KOBOT-C WORM!"
N	Print Screen Deluxe	psdeluxe.exe	"Utility allows "Print Scrn" or "Print Screen" key to capture
X	printer	SpyAssaultScanner.exe	"SpyAssault spyware remover - not recommended
N	PrintScreen	UNWISE.EXE	"Gadwin PrintScreen - utility to capture
N	Printscreen 95	PRT95MIN.EXE	"Printscreen 95 - utility to capture
X	PrivacyScanner	pscan.exe	"Privacy Champion
X	PrnShare	Wscript.exe prn_share.vbs	"Added by the AUTORUN-AWI WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""prn_share.vbs"" file is located in %System%"
X	Prote��o de tela	ssmaze.scr	"Added by the BANCBAN-FB TROJAN!"
X	protect	protect.scr	"Added by the DLOADER-TQ TROJAN!"
X	prutsct	prutsct.exe	"Prutect malware from e2Give - attempts to shut down or tamper with a number of anti spyware applications
X	PSC main	sttool32.exe	"Added by the OBFUSCATED.EV TROJAN!"
X	PSCastor	PSCastor.exe	"Added by the PSCASTOR TROJAN!"
X	PSCMain	pscmain2.exe	"Added by the OBFUSCATED.EV TROJAN!"
N	PSIWin2.3 Connection Server	Psconsv.exe	Allows connectivity between a PC and a Psion device. Access can be gained from the Desktop or Start -> Programs
Y	QH Live Update Scheduler	UPSCHD.EXE	"Quick Heal Anti-Virus"
X	QQKAV	scvhsot.exe	"Added by the QQROB.ARQ WORM!"
Y	Quick Heal Startup Scan	QHSTRT32.EXE	"Quick Heal - virus scanner"
N	Quicken Scheduled Updates	bagent.exe	Quicken background downloading module
N	QuickFinder Scheduler	QFSCHD100.exe	Used in Corel 2002 & Corel Suite 7 - finds files faster by indexing your files (similar to Microsoft's Find Fast or Fast Search for its Office products)
N	QuickFinder Scheduler	QFSched.exe	Used in Corel 2002 & Corel Suite 7 - finds files faster by indexing your files (similar to Microsoft's Find Fast or Fast Search for its Office products)
N	QuickFinder Scheduler	QFSCHD110.EXE	"Used in Corel WordPerfect Office 11 - finds files faster by indexing your files (similar to Microsoft's Find Fast or Fast Search for its Office products). See here"
N	QuickFinder Scheduler	QFSCHD130.EXE	"Used in Corel WordPerfect Office X3 - finds files faster by indexing your files (similar to Microsoft's Find Fast or Fast Search for its Office products). See here"
U	Qwest 11n Wireless WPS Tool	WpsCenter.exe	Wireless configuration utility for the Qwest 11N 150MB USB wireless adapter
U	R2Plus_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX-4x20 Series multifunction printers
U	R2Ricoh_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Ricoh MFP Type 103 multifunction printer
X	RagesCamera	Ragesn.exe	"Added by the SDBOT.AHJ WORM!"
X	RasCon Remote Access Service Manager	rasmngr.exe	"Added by the SPYBOT.EM WORM!"
X	rasctrs	rasctrs.exe	"Hijacker
X	RAX SYSTEM	scrigz.exe	"Added by the MYTOB.KR WORM!"
U	RCScheduleCheck	RCSCHED.EXE	"Scheduler for VCOM's Recovery Commander - which ""can restore your non-booting system back to normal. It only takes a few minutes to get your system back up and running"""
X	real scheduler.hta	RealAudio.exe	"Added by the CEEGAR TROJAN! Note - this is not associated with the popular RealPlayer media player"
X	Realplayer Codec Support	realsched.exe	"Added by the AGOBOT-AAD WORM! Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name"
N	Realsched	realsched.exe	"Application Scheduler installed along with RealOne Player. Runs independently of RealOne Player
X	realtpsk	realsched.exe	"Chinese originated adware - detected by Panda as NewWeb. Note - this is not the legitimate RealOne Player (realsched.exe) application of the same name and this file is located in %System%"
N	RecShe	RecSche.exe	Recording scheduler for WatchTV Capture Card (TV Tuner card)
U	RegClean Expert Scheduler	RCHelper.exe	"""Registry Clean Expert scans the Windows registry and finds incorrect or obsolete information in the registry. By fixing these obsolete information in Windows registry
U	RegClean Expert Scheduler	RCScheduler.exe	"""Registry Clean Expert scans the Windows registry and finds incorrect or obsolete information in the registry. By fixing these obsolete information in Windows registry
X	Registry	wscript.exe ShakiraPics.jpg.vbs	"Added by the VBSWG.AQ WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""ShakiraPics.jpg.vbs"" file is located in %Windir%"
X	Registry Scanner	regscanr.exe	"Added by a variant of the OPTIX TROJAN!"
X	Regscan	regscanr.exe	"Added by the OPTIX-SE TROJAN!"
X	RegScan	DLLSRV32.EXE	"Added by the AGOBOT.AEW WORM!"
X	RegScan	Regscan.exe	"Added by the TALEX TROJAN!"
X	regsrv	scvhost.exe	"Added by the AGOBOT.E WORM!"
X	Reg_WFT	scanreg32.com	"Added by the SENNASPY-F TROJAN!"
N	reminder-ScanSoft Product Registration	remind32.exe	Registration reminder for ScanSoft products such as PaperPort
X	REMOVE ME	asclt.exe	"Added by the RANDEX-FC WORM!"
X	renascimento	svchost.exe	"Added by the BANKER.GAX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Help"
U	ResChanger2004	ResChanger2004.exe	EVGA graphic card utility providing easy access to display settings
U	Restart WSC Setting	wscrestp.exe	"WinStart Commander - part of Ultra WinCleaner Utility Suite. Starts Windows faster and controls hidden programs to boost performance and prevent system slow downs and crashes"
U	RetrieverScheduler	retrieverscheduler.exe	"80-20 Retriever from 80-20 - ""80-20 Retriever is a powerful personal search tool that encompasses email folders
N	RoxioDragToDisc	DrgToDsc.exe	"System Tray access to Roxio Drag-to-Disc - part of the Roxio Easy CD & DVD Creator and Easy Media Creator series of CD/DVD tools. ""Easily drag and drop files for burning to CD or DVD. Disc formatting and burning will happen automatically"". Not required for Roxio to work properly and available via the Start menu"
X	RPC	MSschost.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	rpc Win32	spoolscv.exe	"Added by a variant of the RBOT WORM!"
U	rscmpt	rscmpt.exe	"Required on the GeFroce 64 meg MX card to show the full 64 meg memory and appears to be a software memory emulator running under the Win2K - see here. High CPU useage results - hence the U status"
Y	rtvscn95	RTVSCN95.EXE	Real-time virus scanner component of Norton Anti-Virus Corporate Edition
X	Run MSupdt32	wscript MSupdt32.vbs	"Added by the CASER WORM!"
N	run=	hpfsched	HPFSCHED is a small TSR that will remind you to clean the cartridges in your DeskJet from time to time in order to keep print quality high. It can be removed from the run line in win.ini if you do not want that feature
X	run=	Celine.scr	"Added by the CELINE-A TROJAN!"
X	RunDLL34	syscnfg.exe	"Added by an unidentified VIRUS
N	sc	scrubxp.exe	"ScrubXP - utility that deletes safe to remove files
U	sc	sc.exe	"Watchdog 2.0 Software - monitoring program"
U	sc	run.exe	"All-In-One_SPY stealth monitoring software - allows monitoring and recording of all actions performed on a computer. It records all keystrokes
X	SC2	scprot4.exe	"Added by the AGENT.APP TROJAN!"
?	sc23exec	sc23exec.exe	"Possibly related to a digital camera"
Y	SC3300CC	SC3300CC.exe	SiPix digital camera Twain device driver
X	scain	s030109.Stub.exe	"Delfin Media Viewer adware related"
X	ScamDisk	SVOHOST.exe	"Added by the LEWOR.D WORM!"
X	scan	mscman.exe	"ClientMan parasite variant"
?	Scan Detector	Pmxdetect.exe	"Associated with PrimaScan scanners. Is it required?"
X	Scan Register	ssms.exe	"Added by the RBOT-AT WORM!"
?	Scan Wizard	button.exe	"Associated with Scan Wizard as supplied with Microtek scanners - see also the Scanner Detector and Sdetect entries. What does it do and is it required?"
U	Scan2pc	Scan2pc.exe	"Scan to PC application for the scanning function of multiple multifunction printers from Dell
X	ScanDisc	satan.exe	Added by the GREGSTAR TROJAN!
X	ScanDisk	ScanDisk.exe	"Added by the GANDA.A WORM! Note - this is not the valid ""ScanDisk"" Win9x/Me standard disk error checker"
X	scands32.exe	scands32.exe	"Added by a variant of the ADCLICKER TROJAN!"
X	Scandsk2	scandsk2.exe	"Added by the AGOBOT-PK WORM!"
X	scandskx.exe	scandskx.exe	"Added by the DLOADR-ARM TROJAN!"
?	ScanFile	??	"??"
Y	ScanInicio	Inicio.exe	"Part of Panda Antivirus. Responsible for scanning the boot sector of your disk and your memory at startup to check for viruses that try and load and act before your anti-virus is fully operational. It only adds a fraction of a second to start-up time and is worth leaving active"
N	Scanner Detector	SDetect.exe	"ScanSuite Scanner Detector - part of ScanWizard
Y	Scanner File Utility	NsCatCom.exe	"Kycocera Mita network copier/printer/scanner process to dump scanned documents onto a workstation"
?	ScanPanel	ScanPanel.exe	"Trust Easy Webscan scanner related - what does it do and is it required?"
X	Scanreg	[filename]	"Added by the QQPASS.E TROJAN!"
X	ScanRegistry	nsrvnt.exe	"Added by the NERTE TROJAN! Not to be confused with the real ScanRegistry - which is a vital Windows file. This version has the executable as nsrvnt.exe not scanregw.exe"
X	ScanRegistry	scanregv.exe	"Added by the MASTERLOCK TROJAN!. Not to be confused with the real ScanRegistry - which is a vital Windows file. This version has the executable as scanregv.exe not scanregw.exe"
Y	ScanRegistry	Scanregw.exe	Scans the Win98/Me system registry and makes back-ups at start-up - important should the registry become corrupt. Located in %windir%
X	ScanRegistry	Scanregw.exe	"Added by the STATOR WORM! Note - this is not legitimate ScanRegistry entry - which is a vital Windows file. The executable ""Scanregw.exe"" is located in %System%. Runs from the registry RunServices key as opposed to the Run key"
X	ScanRegistry	N/A	"Added by the DINOXI or DINOXI.B WORMS!"
X	ScanRegistry	scanregw.exe	"Added by the NYXEM-D WORM! Note - do not confuse this with the legitimate Windows process scanregw.exe which is always found in the Windows folder on Win9x/ME machines. This worm file is found in %System%"
X	ScanRegistry	update.exe	"Added by the DWNLDR-FZY TROJAN!"
N	ScanSoft OmniPage SE 4.0-reminder	Ereg.exe ereg.ini	"Registration reminder for Ominpage SE version 4 from Scansoft (now Nuance)"
N	ScanSoft PaperPort 7 Registration Reminder	NAVBrowser.EXE	"Registration reminder for PaperPort 7 from Scansoft (now Nuance)"
N	ScanSoft PDF Professional 4-reminder	Ereg.exe Ereg.ini	"Registration reminder for PDF Converter Professional version 4 from Scansoft (now Nuance)"
X	ScanSpyware	Scanner.exe	"ScanSpyware rogue security software - not recommended
X	ScanSpyware v3.2	Scanner.exe	"ScanSpyware rogue security software - not recommended
X	ScanSpyware v3.5	Scanner.exe	"ScanSpyware rogue security software - not recommended
U	ScanSys32	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
X	scApp	scApp.exe	"Added by the STANDO-E WORM!"
X	scApp	suchost.exe	"Added by the ACNATT.A WORM!"
X	scApp	wmiprvse.exe	"Added by the SILLYFDC-AW WORM!"
N	SCardSvr	scardsvr.exe	Related to SmartCard readers and sometimes uses lots of system resources
X	SCardSvr	SCardSvr32.Exe	"Added by the MOFEI.B WORM!"
U	SCDEmuApp.exe	SCDEmuApp.exe	"Related to PowerISO - CD/DVD image file processing tool"
U	Schdlr32	Schdlr32.exe	"Scheduled backups for the NTI Backup Now archiving utility. If a backup job has been scheduled
X	scheck45	scheck45.exe	Related to unknown malware - hidden installer associated with it
X	schedl	schedl.exe	"Added by the VB-DVW WORM!"
U	schedm	schedm.exe	"Part of Antivir PersonalEdition Classic anti-virus"
X	ScheduIe	nrchk.exe	Premium rate adult content dialler
X	ScheduIr	msexploren.exe	"Added by a variant of the SDBOT WORM!"
X	ScheduIr	shch.exe	"Added by a variant of the SDBOT WORM!"
X	ScheduIr	svchst.exe	"Added by a variant of the SDBOT WORM!"
X	ScheduIr	winagent.exe	"Added by a variant of the SDBOT WORM!"
U	Schedule	Schedule.exe	"Scheduler for Mercury Ez View TV Tuner Card"
N	Scheduled Maintenance	Scheduled_Maintenance.exe	"Scheduler for Iolo System Mechanic tweaking utility. It can cleans your registry and deletes temporary files at defined intervals. Available via Start -> Programs"
X	Scheduler	expIorer.exe	"Added by the TACTSLAY.A TROJAN!"
X	Scheduler	MSMSGS.EXE	"Added by the HOSTBANK-A TROJAN! Note - this particular msmsgs.exe file is located in %System%\Config and should not be mistaken for the MSN Messenger file of the same name which is located in %Program Files%\Messenger"
X	Scheduler	outIook.exe	"Added by the TACTSLAY.A TROJAN!"
X	Scheduler	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	Scheduler	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	Scheduler	winagent.exe	"Added by the TACTSLAY.B TROJAN!"
U	Scheduler	Scheduler daemon.exe	"Tenebril GhostSurf or SpyCatcher related scheduler - you can schedule daily
X	Scheduler	msnexploren.exe	"Added by the TACTSLAY.B TROJAN!"
X	Scheduler	sdhch.exe	"Added by the TACTSLAY.B TROJAN!"
X	Scheduler	svchst.exe	"Added by the TACTSLAY.B TROJAN!"
X	Scheduler Service	wsass.exe	"Added by the LIOTEN.KX WORM!"
X	SchedulerMgr	navchk.exe	Premium rate adult content dialer
U	scheduler_monitor	init_scheduler.exe	"Scheduler for ReaConverter advanced image converter"
U	scheduler_proxy Application	scheduler_proxy.exe	"Found on IBM/Lenovo ThinkCentre/ThinkStation desktops and Thinkpad notebooks. Included with versions of ThinkVantage System Update (for software updates)
X	Scheduling Agent	Scheduler.exe	"Added by the SUBWOOFER TROJAN! Note - this is not the real MS Scheduling agent as the executable is incorrect"
X	SchedulingAgant	MMTASK.EXE	"Added by the YAB.A TROJAN! Not the valid MusicMatch Jukebox which has the same filename"
U	SchedulingAgent	mstask.exe	"MS Scheduling Agent in Win98/Me/2K - displayed as a box with a stopwatch in the System Tray that is only needed if you have regular scheduled disk defragmenting
U	SchedulingAgent	mstinit.exe	"MS Scheduling Agent in WinNT - displayed as a box with a stopwatch in the System Tray that is only needed if you have regular scheduled disk defragmenting
X	SchedulingAgent	N/A	"Added by the DINOXI or DINOXI.B WORMS!"
X	SchedulingAgent	mstask.exe	Added by unidentified MALWARE! Note - this is not the MS Scheduling Agent in Win98/Me/2K. This one also loads via the HKLM\RunServices registry key but is located in %System% on a WinXP machine - where a file of that name does not normally exist
X	SchedulingAgent	mstasks.exe	"Added by the MSIC BACKDOOR!"
X	SchijfBewaker	SysRep.exe	"SchijfBewaker
X	SchijfControleur	GDC.exe	"SchijfControleur Dutch rogue privacy tool - not recommended. A member of the PCPrivacyTool family"
U	Schmaili	Schmaili.exe	"Schmaili - insert animated smilies into your e-mail"
X	schost	[path to trojan]	"Added by the TJSERV.D TROJAN!"
N	SchSvr	SchSvr.exe	"WinScheduler is installed with Home Theater or WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
Y	SCHWIZEX	SCHWIZEX.EXE	"Part of ConfigSafe - lets you identify changes to the registry
X	sck121	helpsyss.exe	Added by a variant of the MAILBOT TROJAN!
N	sclauncher	sclauncher.exe	"SimpleCenter digital media player/manager that supports the iPod
X	sclick	sclick.exe	"Added by the FAKEALERT TROJAN!"
X	ScManager	scman.exe	"Added by the FORBOT-CW WORM!"
X	scopedll	scopedll.exe	"Added by a variant of the CRYPTER.C TROJAN!"
N	Scotia OnLine Recovery	etdirrcv.exe	"Scotia OnLine Security Software provided by Entrust for
N	Scotia OnLine Security v. Recovery	etdirrcv.exe	"Scotia OnLine Security Software provided by Entrust for
X	Scr	scr.scr	"Added by the OPASERV.T WORM!"
N	ScrapPad	Scrappad.exe	"ScrapPad allows you to quickly and easily record notes
X	scrbmk	[path to trojan]	"Added by the DLOADER-VP TROJAN!"
U	Screen Calendar	scrcal.exe	"Screen Calendar allows you to create custom desktop wallpapers with built in active calendar and scheduler"
U	Screen Guard	launch.exe	"Part of Access Denied security and privacy software"
U	Screen Guard Message Scan	sgms.exe	"Part of Access Denied security and privacy software"
X	Screen Saver	scrnsaver.scr	"Added by the RBOT-AGP WORM!"
N	Screen Saver Control	FSScrCtl.exe	Installs as part of the Hubble Space Telescope screen saver (and possibly others). Lets you control your installed screensavers from a System Tray icon
N	ScreenHunter 4.0 Free	ScreenHunter.exe	"""ScreenHunter 4.0 Free is a completely free screen capture software for you to easily take screenshots"""
N	ScreenPrint32	ScreenPrint32.exe	"ScreenPrint32 screen capture software - can be launched manually"
X	ScreenSaverPlus	"rundll32.exe MSA64CHK.dll	DllMostrar"
?	screxe	scruser2k.exe	"??"
?	script	script.bat	"Maybe associated with DOS on a Win9x machine"
Y	ScriptBlocking	SBServ.exe	"Update to Norton AntiVirus 2001. Detects certain types of script-based viruses without the need for specific virus definitions - such as JavaScript and VBScript. This will help protect you from these viruses even before virus definitions are available. Note - some users complain of problems once the update is installed - refer here for more information"
Y	ScriptSentry	Scriptsentry.exe	"Script Sentry from Jason's Toolbox. Blocks malicious scripts and allows safe scripts to run. Only required if you want it to check the file associations it guards at startup. It will function regardlessly"
U	Scroll-In-Mouse V2.0	SCROLL.EXE	"Toolkit for the Lynx-3D Net scroll mouse from QTronix. Required if you use the special features"
X	scroller	fpapli.exe	"CoolWebSearch parasite variant"
X	scrss	scrss.exe	"Added by the HACDEF-R TROJAN!"
X	scrsvc	scrsvc.exe	"Added by the AGENT-DS TROJAN!"
X	ScrSvr	ScrSvr.exe	"Added by the OPASERV WORM!"
X	ScrSvrOld	[worm filename]	"Added by the OPASERV WORM!"
Y	Scsi	Scsi.exe	SCSI Miniport driver
X	scssrr.exe	Services.exe	"Added by the VB-EMX TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	sctrlmgr	sescmgr.exe	"Added by a variant of the DWNLDR-GAH TROJAN!"
Y	SCTUINotify	SCTUINotify.exe	"Part of Windows SteadyState
X	scvhost	svzhost.exe	"Added by a variant of the SPYBOT WORM!"
U	scvhost	scvhost.exe	"Wiretap surveillance software. Uninstall this software unless you put it there yourself"
X	scvhost	scvhost.exe	"Added by the AGOBOT-LI WORM!"
X	scvhost loader	ixplore.exe	"Added by the SDBOT-CY TROJAN!"
X	scvhost.exe	scvhost.exe	"Added by the LOHAV-N TROJAN!"
X	Scvsrv32	scvsrv32.exe	"Added by the AGOBOT-PM BACKDOOR!"
X	SdScans**	stup_tmp.#32	"Added by the SDSCAN.A TROJAN - where ** are random upper case letters"
X	SearchAndDestroyScheduler	SearchAndDestroy.exe	"Search And Destroy rogue security software - see here and here"
X	SearchEnhancement	scbar.exe	"SCBar foistware"
U	SecondChance	sctray.exe	"Power Quest Second Chance. Sets checkpoints for saving a backup copy of the registry to a disk so you can restore it if you have a crash"
U	SecurDisc	NBHGui.exe	"Part of the Nero multimedia suite backup function - ""Recover your data quickly and easily and create discs that are password protected. SecurDisc technology gives you peace of mind"""
N	SecureClean4RegManager	scregmanager4.exe	"WhiteCanyon SecureClean 4 disk cleaner - clean hard drive data
N	SecureClean4Tray	sctray4.exe	"WhiteCanyon SecureClean 4 disk cleaner - clean hard drive data
N	SecureCleanIEClean	SCIEClean.exe	"SecureClean - scans your system for hidden temporary files
X	Security Mechanic	lsascs.exe	"Security Mechanic rogue security software - not recommended
X	Security Patch	scmss.exe	"Added by the RBOT-ZW WORM!"
X	SecurityScanner	ss2008.exe	"Security Scanner 2008 rogue security software - not recommended
X	Server Registry	regscr32.exe	"Added by the BIFROSE-ZB TROJAN!"
N	Service Connection	sccenter.exe	For Compaq PC's. Part of Backweb
X	Service Control Manager	scm.exe	"Added by the AGOBOT-GD BACKDOOR!"
X	Service Scheduler	scheduler.exe	"Added by the AGOBOT-PH WORM!"
X	Services	scks32.exe	"Added by a Proxy Trojan variant"
X	Services Host	Scchost.exe	"Added by the DONK WORM!"
U	Session Client	sescli.exe	"SurfSpy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	Shell	smsc.exe	"Added by the BANCBAN-OY TROJAN!"
X	ShellN	isca.exe	"Added by the IBILL.Z TROJAN!"
X	SichererSchutz	pgs.exe	"SichererSchutz
N	SipDiscount	SipDiscount.exe	"SipDiscount - internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
U	siscolor	color.exe	Probably on-board graphics related based upon the SiS chipsets. Has been seen on ASUS motherboards with SiS chipsets and known to cause conflicts if you choose another graphics card and disable the on-board
X	sixer566	sscc.exe	Added by an unidentified WORM or TROJAN!
Y	SkyBlaster Scheduler	SSFSch.exe	For Gilat Communications internet satellite systems - associated with SkyBlaster modem. Required if you have this system
X	SkynetRevenge	winlogon.scr	"Added by the NETSKY.AA WORM!"
N	Smart Card Service	ScardSvr.exe	"For Smart Card readers. Known to cause problems
U	Smart Connect Monitor	SCMon.exe	Appears on a Sony Vaio. Smart Connect Version 2.1 enables data transfer between Vaios via i.LINK cable. Smart Connect supports File and Printer Sharing for MS networks. You can copy files from your Vaio to another Vaio or print using a printer connected to a remote Vaio
U	Smart Connect Setup	SCSetup.exe	Appears on a Sony Vaio. Smart Connect Version 2.1 enables data transfer between Vaios via i.LINK cable. Smart Connect supports File and Printer Sharing for MS networks. You can copy files from your Vaio to another Vaio or print using a printer connected to a remote Vaio
N	SmsDiscount	SmsDiscount.exe	"SmsDiscount - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
N	Software Manager	issch.exe	"InstallShield is used by a number of software producers to install their programs and manage software updates. This entry runs scheduled searches for and performs any updates to supported installed software so you're always working with the most current version. Manually check for software updates for installed programs on a regular basis"
U	SolidWorks Task Scheduler Engine	swBOEngine.exe	"Task scheduler for SolidWorks 3D CAD software"
U	SoloSchedule	Solocfg.exe	"Scheduler for Solo Antivirus. Leave enabled unless you scan manually on a regular basis"
U	SoloSysCheck	Syscheck.exe	"Solo antivirus System Integrity Check - Monitors system registry
X	some	scit.exe	"Added by the ZLOB.MEDIA-CODEC TROJAN! This purports to be a Windows Media Player upgrade (with names such as ""iCodecPack""
X	Sonic RecordNow!	smsc.exe	"Added by a variant of the SDBOT WORM!"
X	Spees1	speedy.scr	"Added by the OPASERV.Y WORM!"
X	SPINX	Wscript.exe OXNEY.B.VBS	"Added by the YENO.B and YENO.C WORMS! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""OXNEY.B.VBS"" file is located in %System%"
X	spoolsv	scvhosts.exe	"Added by the SMALL-AW TROJAN!"
X	Spore.b	Scmhlpr.vbs	"Added by the SORPE.B WORM!"
X	Spy Protector	lsascs.exe	"Spy Protector rogue security software - not recommended
U	SpyCop ScanCheck	MAIN.EXE	"SpyCop surveillance software detection - checks to see when your machine was last scanned and if it was more than a week asks if you want to scan"
X	SpyOnThisScanner	SpyOnThis.exe	"SpyOnThis rogue spyware remover - not recommended"
U	Spyware Begone	freescan.exe	"Spyware BeGone - spyware remover. Previously not recommended
N	Spyware Scanner	AseScanner.exe	"Aluria Software's spyware removal tool - we can't really recommend this product as Aluria have recently partnered with WhenU
U	Spyware Vanisher	FreeScanner.exe	"Spyware Vanisher - spyware remover. Previously not recommended
X	spywarescanner	spywarescanner.exe	"Spyware Scanner 2008 rogue security software - not recommended
N	SQL Server	scm.exe	SQL Server Service Control Manager. Available via Start -> Programs
X	SQUpdatesChecker	uc.exe	"Xupiter SQWire toolbar related. Use Spybot S&D
?	srePostpone	"rundll32.exe [path] srescan.dll	DoSpecialAction"
U	SRS Audio Sandbox	SRSSSC.exe	"SRS Audio Sandbox ""provide amazing audio immersion and maximum thump for a personalized audio experience!"""
U	SSC Service Utility	ssc_serv.exe	"SSC Service Utility is a printer utility for refilled Epson cartridges"
U	SSCFBTN.EXE	SSCFBTN.EXE	"Samsung smarthru software
Y	sscRun	SSCRun.exe	AOL's firewall
Y	SSC_UserPrompt	UsrPrmpt.exe	"Part of Symantec's AntiVirus suite and comes usually with a product update
U	Start Network Scanner Tool	sdFTP.exe	"Part of
X	Starter	scvhosting.exe	"Added by the SDBOT.RU WORM!"
X	starter	scvhostingg.exe	"Added by the FORBOT-FB WORM!"
X	startkey	scvhost.exe	"Added by the BIFROSE-PM TROJAN!"
U	Startup Manager Scanner	StartupMonitor.exe	"Startup-Mechanic Startup monitor - offers boot protection of your PC from harmful trojans
Y	Startup Scan	Sensor.EXE	"AntiVirus Quick Heal - scheduling agent"
?	StatusClient	StatusClient.exe	Part of Hewlett Packard network printer drivers
?	StatusClient 2.6	StatusClient.exe	Part of Hewlett Packard network printer drivers
X	strmsnmgrs	msnxmsgrsc.exe	"Added by the SDBOT.JDR WORM!"
X	strmsnmsgrs	msnmsgrsc.exe	"Added by a variant of the RBOT WORM!"
X	STV	winscrne.exe	"Added by a variant of the SDBOT WORM!"
X	SunJavaSched	ccEvtMngr.exe	"Added by the SDBOT-YP WORM!"
X	SunJavaSched Updater	avamx.exe	"Added by the RBOT-ABJ WORM!"
N	SunJavaUpdateSched	jusched.exe	"Checks with Sun's Java updates site to see if newer Java versions are available. Either visit the Java download page or click on Start → Control Panel → Java → Update → Update Now"
X	SunJavaUpdateSched	scvhost.exe	"Added by the SDBOT-AVX WORM!"
X	SunJavaUpdateSched	javamx.exe	"Added by the SDBOT-WI WORM!"
X	SunJavaUpdateSched10	jushed.exe	"Added by the ACKANTTA.F WORM!"
X	SunJavaUpdateSched132	jschd.exe	"Added by the AUTORUN-AQY WORM!"
X	SunJavaUpdateSched16	jvshed.exe	"Added by the ACKANTTA.G WORM!"
X	SunJavaUpdatSched	spoolsv.exe	"Added by the BANCBAN-NP TROJAN! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %ProgramFiles%\MSN Messenger"
U	Support.com Scheduler and Command Dispatcher	tgcmd.exe	"Part of software from SupportSoft (aka Support.com) provided to manufacturers and ISPs that allows them to offer on-line support - to update drivers
U	SurfChoice	SCMan.exe	"SCMan is a utility that can control services on WinNT from the command line. This utility can create
N	suScheduler	UCLauncher.exe	"Scheduler for versions of ThinkVantage System Update (for software updates) found on IBM/Lenovo ThinkCentre/ThinkStation desktops and Thinkpad notebooks"
X	SVCHOST	scvhost.exe	"Added by the MYTOB.E or MYTOB.G WORMS!"
X	svchost	inetinfo.scr	"Added by the ODELUD WORM!"
X	SVCHost Protocol32	scvhost32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	svchostdll.scr	svchostdll.scr	"Added by the BANCBAN-FM TROJAN!"
X	Svchosts	SCVHOST.EXE	"Added by the AGOBOT-RQ BACKDOOR!"
X	svchosts.scr	svchosts.scr	"Added by the BANCBAN-DQ TROJAN and variants!"
X	svcshare	nvscv32.exe	"Added by the FUJACKS-Z WORM!"
X	SwiftCleaner	SwiftCleanerScanner.exe	"SwiftCleaner rogue cleaning utility - not recommended
U	SybaseCentral43	scjview.exe	"Related to SQL Anywhere from Sybase. A comprehensive package providing data management and data exchange technologies"
X	Symantec Autoscan	[random filename]	"Added by the RBOT-AJO WORM!"
X	SymantecFilterCheck	bsyys.scr	"Added by the BANLOAD.DZC TROJAN!"
X	Syntax Script	systacq.exe	"Added by the SDBOT.AI WORM!"
X	Syntax Script	saskatcw.exe	"Added by the SDBOT-TE WORM!"
X	syscfg	syscfg32.exe	"Added by the KWBOT.S WORM!"
X	syscfg34.exe	syscfg34.exe	"Added by the ELECTRON WORM!"
X	Syscheck	win.hta	Browser hijacker
X	syscheck	iexplorer.exe	Added by the AGENT.DM TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe)
U	SysCheck32	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
X	SysCleaner	SysCleaner.exe	"SysCleaner rogue cleaning utility - not recommended
X	sysclx	ntldrt.exe	"Added by the JLOK-A WORM!"
X	syscm	Syscm.exe	"Vanish adware"
X	SysCom	msnmsgr.exe	"Added by the BANK-AF TROJAN! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%MSN Messenger or %ProgramFiles%Windows LiveMessenger. This one is located in %Windir%\system"
?	SysComp	mssdnl.com	"Unknown but suspect as *.com are not usually run at start up and the name isn't recognized"
X	syscon	syscon.exe	"Added by the APRILCONE.A WORM!"
X	syscon lptt01	syscon.exe	"RapidBlaster variant (in a ""Syscon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	syscon ml097e	syscon.exe	"RapidBlaster variant (in a ""Syscon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	sysconfig	iexplorer.exe	"Added by the CULT.C WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	SysConfig	syscfg35.exe	"Added by the KAZMOR.C WORM!"
X	SysConfig	wincfg32.exe	"Added by the SDBOT.ZD WORM!"
U	Sysconfig	Stealth KeySpy.exe	"StealthKeySpy - keystroke logger/monitoring program - remove unless you installed it yourself!"
X	sysconfig32	sysconfig32.exe	"Added by the AGENT-MSP TROJAN!"
X	Syscpy	Syscpy.exe	"Firewall-bypassing
X	SysCtl	sysctl.exe	"Added by the AOK TROJAN!"
X	Sysctrls	procdll.exe	"Added by the WEEDBOTZ.14 TROJAN!"
X	Sysctrls	winupdate.exe	Added by an unidentified WORM or TROJAN!
X	Sysctrls	mscntrl.exe	"Added by the KOLABC.BB WORM!"
X	Sysctrls	Sysctrls.exe	"Added by the AGENT.AWZ TROJAN!"
X	Sysctrls	win32dll.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Sysctrls32	sevchost.exe	"Added by the RBOT.ADF BACKDOOR!"
X	SysCVMS.exe	SysCVMS.exe	"Added by the SMALL.CBA TROJAN!"
X	SysScan	bvt.exe	"Added by the AUTOUPDER TROJAN!"
U	System	sysctrl.exe	"Added by WinGuardian. Note - this commercial keylogger is no longer made or sold by Webroot but older copies may still be in existance
X	System	wsscntfy.exe	"Added by a variant of the SDBOT WORM!"
X	system	ssclie.exe	"Added by the AGENT.LW BACKDOOR!"
X	System Cache	SysCache.exe	"Added by an unidentified VIRUS
X	System CGI Manager	syscgmgr.exe	"Added by an unidentified WORM or TROJAN! See here"
X	System Config Boot	syscgboot.exe	"Added by the AGENT.VWU TROJAN!"
X	System Configuration	syscfg32.exe	"Added by the MYTOB.EA WORM!"
X	System Core Memory	syscoremem.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	System CSRSS Patch	scrtkfg.exe	"Added by the RBOT-ADA WORM!"
X	System Efficiency Monitor	mscedit32.exe	"Added by the SDBOT.P TROJAN!"
X	System Efficiency Monitor	mscommand.exe	"Added by the KWBOT.P WORM!"
X	System Host	scvhost.exe	"Added by a variant of the RBOT WORM!"
U	System LifeGuard Scheduler	Slsched.exe	"System LifeGuard scheduler"
X	System Loader	syscfg.exe	"Added by the AGOBOT-BS BACKDOOR!"
X	System Management Service	smsc.exe	"Added by the RBOT-ANN WORM!"
X	System MScvb	mscvb32.exe	"Added by the SOBIG.C WORM!"
X	System Protector	lsascs.exe	"System Protector rogue security software - not recommended
X	System Scanner	system.exe	"Added by the AGOBOT-DI BACKDOOR!"
X	System Security Checker	ssc.exe	"Added by the IRCBOT-WI TROJAN!"
X	System Support	syscfg.exe	"Added by the RBOT-AGQ WORM!"
X	System Tray	msccn32.exe	"Added by the SOBIG.B WORM! Warning - spreading via infected E-mail attachments with the sender address faked as support@microsoft.com! Note - this is not the legitimate systray.exe process"
X	System Unix	syscfg32.exe	"Added by the RBOT-ZD WORM!"
X	System Updates	winsci.exe	"Added by a variant of the RBOT WORM!"
X	System-Service	EXPLORER.SCR	"Added by the BENJAMIN.A WORM! KaZaA file-sharing users beware!"
X	SystemCheck	SysCheckBop32.exe	"WINBO adware"
X	SystemChecker	Syschk.exe	"Added by the GALIL.F WORM!"
X	SystemCleanerPRO	sysclpro.exe	"SystemCleanerPro rogue security software - not recommended
X	SystemOPsv	scrtvc32.exe	"Added by a variant of the SPYBOT WORM!"
X	Systems	scchost.exe	"Added by the DAEMOZ.A TROJAN!"
X	Systems	sescmgr.exe	"Added by the DWNLDR-GAH TROJAN!"
X	systemscroot	systembin.exe	"Added by a variant of the RBOT WORM!"
X	SystemWindows	scvhost.exe	"Added by the SILLYFDC-CG WORM!"
X	sysygm32	syscxd32.exe	"Added by the IRCBOT-PC TROJAN!"
X	Task Scheduler Engine	schedsvc32.exe	"Added by the RBOT-ASJ WORM!"
X	Taskschd	TRAYWND.EXE	"Added by the LITMUS.002 TROJAN!"
U	TaskScheduler	TaskSch.exe	"ProSeries accounting software related"
X	Terminal Services	mstscc.exe	"Added by the SDBOT-CZW WORM!"
U	TEscKey	TEscKey.exe	Toshiba Escape Key handler. Enables you to program and use the <FN><Esc> key combination to perform a specific function
?	Tesco Insert Detect	InsDetect.exe	"Part of Tesco Picture Suite. Detects a digital camera is plugged into a USB port or when a memory card with photos is inserted?"
N	Tesco.net	"rundll32 [path] RyDial.dll	QuickStart"
N	The Assistant	eSched.exe	"Related to WinTotal from a la mode inc. FormFiller for appraisers"
X	Time Zone Synchronization	wscript zshell.js	"Added by the NETDEX-A TROJAN!"
N	TkBell.Exe	realsched.exe	"Application Scheduler installed along with RealOne Player. Once installed
N	TkBellExe	realsched.exe	"Application Scheduler installed along with RealOne Player. Once installed
N	TOSCDSPD	toscdspd.exe	"Related to Toshiba laptop CD/DVD drivers. This is a non-essential process. Disabling or enabling this is down to user preference"
X	TotalSecure2009	scan.exe	"Total Secure 2009 rogue security software - not recommended
U	TotRecSched	TotRecSched.exe	"Scheduler for Total Recorder - allows automatic recording of a show at a given time for later playback or you can use the scheduler as an alarm"
U	TPKBDLED	TpScrLk.exe	IBM Thinkpad utility for displaying the Scroll Lock status on the System Tray - for Thinkpad's that don't have a Scroll Lock LED
U	Tpscrex	Tpscrex.exe	"Lenovo (IBM) ThinkPad hotkey related"
U	TpScrLk	TpScrLk.exe	IBM Thinkpad utility for displaying the Scroll Lock status on the System Tray - for Thinkpad's that don't have a Scroll Lock LED
U	TpScrLk.exe	TpScrLk.exe	IBM Thinkpad utility for displaying the Scroll Lock status on the System Tray - for Thinkpad's that don't have a Scroll Lock LED
N	Transcode360	Transcode360Tray.exe	"Designed for WinXP Media Center Edition 2005 and the Xbox 360
Y	TrendMicro OfficeScan NT	TMLISTEN.EXE	Virus scanner
U	TrojanScanner	Trjscan.exe	"Trojan Remover from Simply Super Software. Scans for an removes trojan viruses where anti-virus software may have not detected or removed"
X	TS	tsc.exe	"Total Security rogue security software - not recommended
U	TSClientMSIUninstaller	tscuinst.vbs	"Related to Terminal Services Client Remote Desktop Connection Software from Microsoft"
X	ttool	scvc.exe	"Added by the BCKDR-OWM BACKDOOR!"
U	TV Scheduler	TVSCHL.EXE	"ProLink PlayTVpro TV tuner software scheduler"
U	TvrSchedule	Schedule.exe	"Scheduler for Mercury Ez View TV Tuner Card"
U	TVT Scheduler Proxy	scheduler_proxy.exe	"Found on IBM/Lenovo ThinkCentre/ThinkStation desktops and Thinkpad notebooks. Included with versions of ThinkVantage System Update (for software updates)
U	Tweak UI 1.33 deutsch	"RUNDLL32.EXE TWEAKUI.CPL	TweakMeUp"
N	TwkSCardSrv	SCardS32.Exe	Used with Towitoko SmartCard Readers for card recognition
X	UERScw	UERScw.exe	"Part of the ErrorSafe rogue system error and cleaning utility - not recommended"
X	ugescw	ugescw.exe	"Part of the ErrClean rogue system error and cleaning utility and other members of this family. See here for more examples"
U	UniSc	Unisc.exe	McAfee UnInstaller
X	upascw	upascw.exe	"PersonalAntiSpy rogue spyware remover - not recommended
X	Update Checker	scvhost.exe	"Added by the AGENT-DSF TROJAN!"
X	Update Install	Schost.exe	"Added by the GAOBOT.AO WORM!"
X	updatesched	[random filename]	"ZenoSearch adware"
X	ushli	sscbltqu.exe	Obtained from an MP3 search list site. Also generates random processes on reboot
X	Ussi	wnscpit.exe	"PurityScan adware"
X	vcmicrec	msccsed.exe	"Added by the MAILBOT-CE TROJAN!"
X	VelocidadSimple	scrmain.exe	VelocidadSimple rogue optimization utility - not recommended
X	Video Process	sysconf.exe	"Added by the GAOBOT.GEN!POLY or GAOBOT.UM or GAOBOT.ADX WORMS!"
X	Video Processor	msconfsys88.exe	"Added by the AGOBOT-QG WORM!"
X	Virscanner	smss.exe	"Added by the DWNLDR-GWE TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	Virtual Access Scheduler	VASCHD32.EXE	The scheduler for mail and usenet tool
X	Virtual CD v6	grplscd.exe	"Added by the RBOT-AXV WORM!"
X	Virus Scan	virscana.exe	"Added by an unidentified VIRUS
X	VirusCheckII	AVIRCHK.EXE	"Added by the DASMIN TROJAN!"
X	VirusRescue	VirusRescue.exe	"VirusRescue rogue security software - not recommended"
Y	VirusScan Online	mcvsshld.exe	"ActiveShield - background scanner for older versions of McAfee VirusScan and the now obsolete McAfee VirusScan Online which scans files in the background as and when they are accessed
?	VirusScanMSC	VsStat.exe	"Part of McAfee VirusScan. System Tray application as with previous versions (were also VsStat.exe)
X	VirusScanner	mnsys.exe	"Added by the SDBOT-AFQ WORM!"
X	VirusSchlacht	pgs.exe	"VirusSchlacht
X	Virus_Scanner	Virus_Cleaner.exe	"Added by the PANOL WORM!"
N	Vistascan	vistascan.exe	"Included in VistaScan are VistaAccess and VistaShuttle. VistaAccess gives you quick and easy access to scanning functions right from your desktop. For Windows users
N	VoipDiscount	VoipDiscount.exe	"VoipDiscount - free internet telephony utility using the VoIP (Voice over Internet Protocol). Call online friends for free and regular phones either for free (limited use) or low rates. One of a number provided by Betamax - the others generally have different rate plans. Similar to the more popular Skype"
X	Vprocess	scvtw32.exe	"Added by the AGOBOT-FR BACKDOOR!"
Y	VrBootScan	VRBScan.exe	"Boot scan feature of the HAURI ViRobot series of internet security products. HAURI's ViRobot engine is included in those used by VirusTotal
Y	VrSchedule	Vrres.exe	"Part of the HAURI ViRobot series of internet security products. HAURI's ViRobot engine is included in those used by VirusTotal
X	vscan	joke.vbs	"Added by the ROOKIE-A TROJAN!"
X	vscanner	spooll32.exe	"Added by the OPTIXPRO.10 TROJAN!"
X	vschost	vschosts.exe	"Added by the VIPSY-A TROJAN!"
X	vschost	vschost.exe	"Added by the AGENT.QK BACKDOOR!"
X	W32.Scran	Scran.exe	"Added by the NARCS WORM!"
X	w32alanis	mope.scr	"Added by the SINALA WORM!"
X	W32Load	[random filename].scr	"Added by the CASPID WORM!"
X	W32Tc	WTC32.scr	"Added by the VOTE.D or VOTE.K WORMS!"
U	Watson Subscriber for SENS Network Notifications	dwtrig20.exe	"Used to launch Microsoft Error Reporting (DW20.exe) - if
U	WCESCOMM	WCESCOMM.EXE	"Connection manager for Microsoft ActiveSync - mobile device synchronization software for Windows XP (and earlier)
N	Weatherscope	Weatherscope.exe	"WeatherScope - ""displays your current local temperature in the system tray of your computer (near the clock) whenever you are online!"" Not recommended as it bundles GAIN adware. You can get the adware free version for a whopping $30. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
N	Webposition Gold 2	wpsche~1.exe	"Scheduler for Web Position Gold - utility to help optimize the position of web-sites in search engines"
U	WebScan	DEFSCANGUI.EXE	"eAcceleration Stop-Sign security software related. Previously not recommended
U	webscan	stopsignav.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
Y	WebScanX	WebScanX.exe	"From McAfee VirusScan up to version 4.x. Provides functionality for VShield Download Scan and Internet Filter modules. Enables internet scanning. Guards against malicious ActiveX programs
X	wescmv	[random filename]	"Added by a variant of the SLAPER TROJAN!"
U	Whitney2_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX-4725 Series photocopier
U	WHITNEY2_XRX_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Xerox Phaser 3200MFP multifunction laser printer
U	WhitneyXerox_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Xerox WorkCentre PE220 Series multifunction laser printer
U	WHITNEY_S2P	Scan2pc.exe	Scan to PC application for the scanning function of the Samsung SCX-4x21 Series multifunction printers
X	wiascr	wiascr.exe	"Added by the AGENT.AM TROJAN! Note - example names include ""XviD""
X	Widnows Xp Web scan	xpscan.exe	"Added by a variant of the SDBOT WORM!"
X	Win startup	mscfg32.exe	"Added by the SPYBOT-AE WORM!"
X	win-xp	nvsc32.exe	"Added by the BROPIA.N WORM!"
X	win32	Shakira_1997_Part_1_.Mpeg_.scr	"Added by the MYLIFE.N WORM!"
X	Win32 Cnfg32	msconfgh.exe	"Added by the MYTOB.NB WORM!"
X	Win32 Secure	msconfigsvc.exe	"Added by a variant of the SDBOT WORM!"
X	Win32 USB2 Driver	smsc.exe	"Added by the SDBOT.FO WORM!"
X	Win32 USB2 Driver	syscfg32.exe	"Added by the FORBOT-R WORM!"
X	Win32G	Scandisk.com	"Added by the ESTRELLA TROJAN!"
X	Winamp Agent	cvscc.exe	"Added by the AGOBOT-GK WORM!"
X	WinAntiSpyware 2006 Scanner	was6.exe	"WinAntiSpyware 2006 rogue spyware remover - not recommended
U	WinBackup Scheduler	Wbsched.exe	"LIUtilities WinBackup scheduler - backup software"
X	wincfg	syscnfg.exe	"Added by an unidentified VIRUS
X	WinDLL (scvhost32.dll)	"rundll32.exe scvhost32.dll	start"
X	Windows 32 Rescue	win32resc.exe	"Added by the FORBOT-EU WORM!"
X	Windows Anti Virus Control Center	avrscan.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Anti Virus Control Center	winavscan.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows cfg	ascv.exe	"Added by the AGOBOT-SZ BACKDOOR!"
X	Windows Conf	windowsconf.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Configuration Loader	asclt.exe	"Added by the SDBOT-OA WORM!"
X	Windows Data Server	autodisc.exe	"Added by the SPYBOT-CB WORM!"
X	Windows Dcom2 Fix	mscom32.exe	"Added by the RBOT-QT WORM!"
Y	Windows Defender	MSASCui.exe	"Main user interface for Microsoft's Windows Defender on XP/Vista - which ""helps protect your computer against pop-ups
X	Windows DLL Loader	SYSCFG16.EXE	"Added by the DOMWIS-N WORM!"
X	Windows Driver Foundation	MTVSCMXT.EXE	"Added by a variant of the RBOT WORM!"
X	Windows Essensials	mvnesc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Firewalll	scvhost.exe	"Added by the RBOT-EK WORM!"
X	Windows Framework	scvh0st.exe	"Malware installed by different rogue security software including SpyKillerPro and the XP AntiVirus series"
X	Windows Helper	wsctnfy.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Host Service	scvhosts.exe	"Added by the SPYBOT.NLI WORM!"
X	Windows HTML file reader	Sysconf32.exe	"Added by the NOOMY.A WORM!"
X	Windows Image Acquisition (WIASC)	WIAcs.exe	"Added by the RIZO.A TROJAN!"
X	Windows Image Acquisition (WIASSC)	WIAcss.exe	"Added by the RIZO.A TROJAN!"
X	Windows JavaScript Daemon	Winjsd.exe	"Added by the WOOTBOT.AF WORM!"
X	Windows Loader Service	civsc.exe	"Added by a variant of the RBOT WORM!"
X	Windows Messenger 4.14	landisc.exe	"Added by the SDBOT-KR WORM!"
X	Windows MSConfig Startup Logger	winlog.exe	"Added by the RBOT.BCU WORM!"
X	Windows Network Service	Msconf32.exe	"Added by a variant of the RBOT WORM!"
X	Windows NT Logon Application	winlogon.scr	"Added by the RBOT-ALP WORM!"
X	Windows Performance Monitor	wmscupd.exe	"Added by the IRCBOT_GEN WORM!"
X	Windows Pool Manager	poolsc.exe	"Added by the OBOT.CH WORM!"
?	Windows Print Spooler	SCVHOSTS.EXE	"Suspicious due to the similarity to the valid ""svchost.exe"" file"
X	Windows Registry Scan	regscan32.exe	"Added by the RBOT.KE WORM!"
X	Windows Registry Scan	timeupdate.exe	"Added by the SPYBOT.JE WORM!"
X	Windows Registry Scan	svcdll.exe	"Added by the RBOT-TP WORM!"
X	Windows Registry Scan	regscan23.exe	"Added by a variant of the RBOT WORM!"
X	Windows Registry Scan	regscan.exe	"Added by the RBOT-HA WORM!"
X	Windows Registry Scan	winmedia.exe	"Added by the SPYBOT.GK WORM!"
X	Windows Rescue System	winsto.exe	"Added by the SUURCH.CG TROJAN!"
X	Windows SA	omniscient.exe	"BLAZEFIND adware"
X	Windows Scheduler	wmscheduler.exe	"Added by a variant of the SDBOT WORM! See here"
X	Windows Scheduler!	scheduler.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Screensaver	Service.exe	"Added by the KELVIR.P WORM!"
X	WINDOWS SCREENSAVER	ssaver.scr	"Added by the SDBOT-YZ WORM!"
X	Windows Secure Connection	winsc.exe	"Added by the SDBOT.BTN WORM!"
X	Windows Security	winscure.exe	"Added by the RBOT-BAF WORM!"
X	Windows Security Center Notification App	wscnfty.exe	"Added by a variant of the RBOT WORM!"
X	Windows Servcesc	[9 random letters].exe	"Added by a variant of the SDBOT WORM! See here"
X	Windows Server Client Verification Service	wscvs.exe	"Added by the AGENT.AWC TROJAN!"
X	Windows Service Agent	wmscc.exe	"Added by the RBOT-GQP WORM!"
X	Windows Service Host	scvhost.exe	"Added by the SDBOT.N TROJAN!"
X	Windows Service Host	schost.exe	"Added by the GAOBOT.AO WORM!"
X	Windows Services	scmsg.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Services	scvhoste.exe	"Added by the SPYBOT.OBZ WORM!"
X	Windows Services	smsc.exe	"Added by a variant of the SDBOT WORM!"
X	windows shellext.32	mschost.exe	"Added by the BLASTER.K WORM!"
X	Windows SQL management 1.33	scvhost.exe	"Added by the SPYBOT-OB WORM!"
Y	Windows SteadyState - Session Timer Notify (UI)	SCTUINotify.exe	"Part of Windows SteadyState
X	WINDOWS SYSTEM	smsc.exe	"Added by the MYTOB-BR WORM!"
X	Windows System Configuration	SYSCFG16.EXE	"Added by the WISDOOR-K TROJAN!"
X	Windows System Configuration	Passcfg16.exe	"Added by the DOMWIS-E TROJAN!"
X	Windows System Manager	sysconf.exe	"Added by the MYTOB.AL WORM!"
X	Windows System Manager	smsc.exe	"Added by a variant of the RBOT WORM!"
X	WINDOWS SYSTEM mscdvvs	mscdvvs.exe	"Added by the MYTOB.MD WORM!"
X	WINDOWS SYSTEM SCALPE	scalpe91.exe	"Added by the MYTOB-HI WORM!"
X	Windows System-Control Drivers	syscontrl.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Task Scheduler	asijdie.exe	Added by an unidentified WORM or TROJAN!
X	Windows Time Service Diagnostic Tool	winscrvs.exe	"Added by the RBOT.FTV BACKDOOR!"
X	Windows UDP Control Center	ehSched.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	scvhost.exe	"Added by the PUSHBOT.EH WORM!"
X	Windows UDP Control Center	winuscn32.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Center	wksvcsc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Services	wksvcsc.exe	"Added by the ANTIAV-C TROJAN!"
X	Windows Update	scvhost.exe	"Added by the SDBOT-XT WORM!"
X	Windows Update	msconfig32.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows Update	scrigz.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Update	winsc.exe	"Added by the BUZUS.RYI TROJAN!"
X	Windows Update	smsscr.exe	"Added by the BANKER-DK TROJAN!"
X	Windows Update Process	wmiprvsc.exe	"Added by the SDBOT-CB WORM!"
X	Windows Update Service	regscv.exe	"Added by the AGOBOT-AM BACKDOOR!"
X	Windows Virus Scanner	winvsvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	WindowsCRC	wscrc.exe	"Added by the SDBOT-VU WORM!"
X	WindowsCriticalUpdate	windows_critical_update.exe	"Added by the ASTEF or RESPAN WORMS!"
X	Winds Sersc Agts	rzrzncrtz.exe	"Added by the RBOT-GTV WORM!"
N	WinDVR SchSvr	SchSvr.exe	"WinScheduler is installed with WinDVD Remote Control for WinDVD from Intervideo. If you want to schedule recordings from your TV tuner card
U	WinFast Schedule	Wfwiz.exe	Leadtek WinFast TV tuner scheduler and remote control driver - required if you use the latter
U	WinFastDTV	DTVSchdl.exe	"Scheduler for WinFast DTV digital TV cards from Leadtek Research Inc"
X	WinHelp	realsched.exe	"Added by the LOVGATE-F WORM! Note - this is not the legitimate RealPlayer (realsched.exe) application of the same name. This one is located in %System%"
X	Winhlp32	Wscript.exe Msexec32.vbs	"Added by the GANT.B WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""Msexec32.vbs"" file is found in %System%"
X	WINLOGON	wscript.exe WINLOGON.vbs	"Added by the YSPAN.F WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""WINLOGON.vbs"" file is found in %System%"
X	Winlogon	scssrr.exe	"Added by the AGENT-LXB TROJAN!"
?	WinManager	schost.exe	"??"
X	Winmgr.exe	scvhost.exe	"Added by the AGOBOT.AFG WORM!"
X	winrun	msconfig.exe	"Added by the WINUR WORM! Note - this is not the legitimate msconfig.exe which should only appear in Msconfig/Startup if you leave the warning box unchecked after changing an Msconfig entry and rebooting. This one is located in c:\winrun"
X	WinScMngr	winsmc.exe	"Added by the SDBOT-BPZ WORM!"
X	Winsock Driver	nvscv32.exe	"Added by the AGOBOT-FD WORM!"
X	Winsock Driver	scvhost.exe	"Added by the RBOT.AEU BACKDOOR!"
X	Winsock2 driver	wincfg.scr	"Added by the SPYBOT-E TROJAN!"
X	Winsock2.dll	WINLODR.SCR	"Added by an unidentified VIRUS
X	Winsock32driver	win32server.scr	"Added by the HACARMY TROJAN!"
X	WinStart	Wscript.exe WinStart.vbs	"Added by the CIAN.C WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""WinStart.vbs"" file is located in %System%"
X	winsys	syschost.exe	Added by an unidentified TROJAN!
U	WinSysCheck	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
X	WINTASK DLL	jusched32.exe	"Added by the MYTOB.AI WORM!"
N	WinTOTAL Scheduler	guru.exe	WinTOTAL Real estate appraisal software related
X	winupdate	jusched.exe	"Added by the DWNLDR-FUX TROJAN! Note that this is not the legitimate Sun Microsystems file (of the same name) which is usually located in %Program Files%\Java\version number\bin. This one is located in %Windir%"
U	Wireless Connection Manager	wirelesscm.exe	"Wireless adapter configuration utility for D-Link's range"
X	Wlan Driver	avscan.exe	"Added by the WOOTBOT.DH WORM!"
X	WMI Standard Event Consumer - Scripting	scrcons32.exe	"Added by the RBOT-GRD WORM!"
X	WMI Standard Event Consumer - Scripting	scrcs.exe	"Added by a variant of the RBOT-GRD WORM!"
X	wmon	jusched.exe	"Added by the AGOBOT-OW WORM! Note that this is not the legitimate Sun Microsystems file (of the same name) which is usually located in %Program Files%\Java\version number\bin. This one is located in %System%"
U	WMPNSCFG	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	WNSC	wnsin*.exe [ = random char]	"PurityScan adware"
X	Wnsck2 driver	wlogf.exe	"Added by the SPYBOT-AF WORM!"
X	WNSI	wnscp*.exe [ = random char]	"PurityScan adware"
X	WOOZ	autodisc.exe	"Added by the AGENT-CPS TROJAN!"
U	Workstation Scheduler	wm95.exe	"Desktop Management Scheduler. Part of Novell's Netware Client. Schedueles NDS events. If events have been schedueled
X	WPSVC Services	wpnsc.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	wsc	mstdl.exe	"MaCatte Antivirus 2009 rogue security software - not recommended
U	WScheduler	WScheduler.exe	"Windows Scheduler - "schedule unattended running of applications
X	wscmgr	wscmgr.exe	"Added by the AUTORUN-AA WORM!"
X	wscnfty	wscnfty.exe	"Added by a variant of the RBOT WORM!"
X	wscntfys	wsscntfy.exe	"Added by the SDBOT-TN WORM!"
X	WSConfiguration	spoolsc.exe	"Added by the AGOBOT-HY WORM!"
X	wscript.exe	vabian.vbs	"Added by the VABI VIRUS!"
X	wscsvc.exe	wscsvc.exe	"Added by a password stealing BANKER TROJAN!"
X	wscsvc32.exe	wscsvc32.exe	"Antivirus rogue security software - not recommended
X	wsctf.exe	wsctf.exe	"Added by the JAMPORK.E WORM!"
X	Wsdata service	WSconf.exe	"Added by the SDBOT.ZU WORM!"
X	WSSVC	smsc.exe	"Added by the AUTORUN-AGA WORM!"
U	WTIndicator	SchedInd.exe	"WinTask - software that automates a variety of routine tasks quickly and simply"
X	WTSC	wapisvcc.exe	"PurityScan adware"
U	X4ALLNL	wdfsctl.exe	"XS4All Webdisk - web space management utility for the Dutch ISP"
U	XemiComputers Scheduler	Scheduler.exe	"Smooth Program Scheduler from XemiComputers ""will start any program you want at a scheduled time"""
U	XeroxScannerDaemon	XrxFTPLt.exe	"Xerox Scanner Daemon - driver for Xerox Scanner model fu621d"
?	XeroxScanUtility	xrxzipui.exe	"Associated with a Xerox multifunction and/or scanner. What does it do and is it required?"
U	XSC SIP Client	X-Lite.exe	"""CounterPath's X-Lite 3.0 is the market's leading free SIP based softphone available for download"". For VOIP and broadband users"
U	XTNDConnect PC - ScheduleSync	SCHEDU~1.EXE	"ScheduleSync specific translator for XTNDConnect PC - ""award-winning desktop-sync application that enables you to easily synchronize your contacts
X	Yahoo Messengger	SCVHOST.exe	"Added by the SOHANA-V WORM!"
X	Yahoo Messengger	SCVHSOT.exe	"Added by the HAKAG-A WORM!"
X	Yahoo Messengger	SCVVHSOT.exe	"Added by the SILLYFDC-AE WORM!"
X	Yahoo Messengger	SSCVIHOST.exe	"Added by the SOHANA-W WORM!"
X	Yahoo Messengger	SSCVIIHOST.exe	"Added by the SOHANA-Y WORM!"
X	Yahoo Messengger	scvhosts.exe	"Added by the SOHANNA-AH WORM!"
X	Yahoo Messengger	scvshosts.exe	"Added by the TRAX-A WORM!"
U	You've Got Pictures Screensaver	ygpsstra.exe	AOL You've Got Pictures Screensaver
X	zsmscc	rundll32.exe zsmscc071001.dll mymain	"Added by the GENETIK.KQ TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""zsmscc071001.dll"" file is found in %System%"
X	zsmscc	rundll32.exe mycc071208.dll mymain	"Added by the AGENT.FZK TROJAN! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted. The ""mycc071208.dll"" file is found in %System%"
U	ZSScheduler	zsscheduler.dll	"ZeroSpyware from FBM Software"
X	[12 random characters]	autodisc.exe	"IeDriver adware variant"
X	[32 random hex numbers]	tsc.exe	"Total Security rogue security software - not recommended
X	[filename]	svchost.scr	"Added by the BANKER-CC TROJAN!"
X	[original filename]	svchost.scr	"Added by the BANCBAN-CX TROJAN!"
X	[original filename]	xphost.scr	"Added by the BANCBAN-HM TROJAN!"
X	[random characters]	rsbmsc.exe	"Detected by AntiVir antivirus as the BDS/Agent.adt TROJAN!"
X	[random name]	scanregw.exe	"PurityScan adware. Note - do not confuse this with the legitimate Windows process scanregw.exe which is always found in the Windows folder on Win9x/ME machines"
X	[random]	lsass.scr	"Added by the BANCBAN-CW TROJAN!"
X	[random]	svchost.scr	"Added by the BANCBAN-CY TROJAN!"
X	[various names]	ActionScr.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	NsCplTray.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	NSYSCPLSTR.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	scanSYS.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	StatusCheck.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	sysconf16.exe	"Wareout - malware masquerading as a spyware and dialer remover"
Y	_AntiSpyware	MssCli.exe	"Part of McAfee AntiSpyware"
X	_ntrRescueService	_ntrrs.exe	"Added by the DLOADER-JV TROJAN!"
U	{1290A33C-85F5-4164-A1BE-7DD299D4986A}	PBKScheduler.exe	"Scheduler for CyberLink PowerBackup - archiving/backup utility"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.