srv

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
U	12Ghosts TrayProtect	12srvc.exe	"12Ghosts TrayProtect - ""Hide tray icons
U	1Srv32	SpyAgent4.exe	"SpyTech SpyAgent monitoring software. "Spy software that allows you to monitor EVERYTHING users do on your PC.""
Y	acEventServ	acevtsrv.exe	"ActivCard Gold from ActivIdentity
U	AltoMB_service	AltoMBsrv.exe	"Alto Memory Booster from Alto Software - boost the computers performance via more intelligent and efficient memory management. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
?	Apmsrv9x	APMSRV9X.EXE	"Intel AnyPoint Wireless II Home Network related. Now discontinued. What does it do and is it required?"
X	ASocksrv	SocksA.exe	"Added by the VB.CBW WORM!"
X	asp-srvc	asp-srvc.exe	"Added by the AGOBOT-KG WORM!"
Y	Aureal A3D Interactive Audio	sa3dsrv.exe	For Aureal based 3D soundcards. A3D sound features won't work with this disabled
Y	avgfwsrv	AVGFWSRV.EXE	"Integrated firewall for the 7.* series of anti-virus products from AVG Technologies. Protects the users computer from outside attacks
Y	AvMaiSrv	Avmaisrv.exe	"Part of Avast! anti-virus software - E-mail scanner"
X	AVPSrv	AVPSrv.exe	"Added by the ONLINE-GEN TROJAN!"
X	AVSTRT	navpsrvc.exe	"Added by the FORBOT-EF WORM!"
X	BatSrv	batserv2.exe	"Detected by Kaspersky as the LOCKSY.M WORM!"
X	Bcvsrv32	bcvsrv32.exe	"Added by the GAOBOT.BQJ WORM!"
X	Bcvsrv32	he3.exe	"Added by the AGOBOT.AKB WORM!"
X	Bcvsrv32	msxml22.exe	"Added by the AGOBOT.AKH WORM!"
X	Bcvsrv32	msc32.exe	"Added by the AGOBOT.AKD WORM!"
X	Bcvsrv32	msbvd32.exe	"Added by the AGOBOT-SR WORM!"
X	Bcvsrv32	system2.exe	"Added by the AGOBOT-PU BACKDOOR!"
Y	BDOESRV	bdoesrv.exe	"Bitdefender 8 antivirus and firewall"
N	BPServer	G6FTPSrv.exe	"BulletProof FTP Server"
X	catsrv	catsrv.exe	"Added by the PAPLOK TROJAN!"
N	CDANTSRV	CDANTSRV.exe	"C-Dilla License Management software. Used for any program that uses C-dilla Protection
N	CISrvr Program	CISRVR.EXE	Related to internet setup on Compaq PC's
X	Classes	srv.exe	"""Switch"" premium rate adult content dialler variant"
X	Classes	srv2.exe	"""Switch"" premium rate adult content dialler variant"
X	CLI Services	clisrv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Client Server Run Time Proccess	csrsrv.exe	"Added by a variant of the SDBOT WORM!"
X	Clip Servicer	clipsrvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Clip Srv	clipsv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
N	Clipbook Service	Clipsrv.exe	"Supports Windows XP ClipBook Viewer
N	Clipsrv	Clipsrv.exe	"Supports Windows XP ClipBook Viewer
X	ClipSrv	clipserv.exe	"Added by the SDBOT-AAV and SDBOT-AFE WORMS!"
X	ClipSrv	CLIPBRD3D.EXE	"Added by the MOFEI-D WORM!"
U	CMPDPSRV	CMPDPSRV.EXE	"Printer Driver Plus from ViewAhead Technology (formerly DeviceGuys
X	Configuration Loader	msgcfgsrv.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	CoreSrv	coresrv.exe	"Some IRC trojans/worms use this - see here for more information"
U	Creata Mail	JMSrvr.exe	"Creata_Mail. Smileys
X	csrvss	csrvss.exe	"Added by a variant of the SDBOT TROJAN!"
?	CTPDPSRV	CTPDPSRV.EXE	"Compaq A3000 printer driver (in the %System%\spool\DRIVERS\W32\X86 folder). Is it required?"
?	cttdpsrv	cttdpsrv.exe	"??"
U	DigiSrv	DigiSrv.exe	"Related to camera software from DigitalDreams"
X	drmsrv32	stmhosts.exe	"Added by the AGENT.AGWU TROJAN!"
X	dxmsrv	dxmsrv.exe	Added by an unidentified WORM or TROJAN!
Y	ffprsrv	ffprsrv.exe	"File and Folder Privacy - is a ""system security utility you can use to password-protect or hide your files and folders with a click of mouse. The program will always prompt to enter your access password when protection is enabled and a user is trying to access a protected file or folder"". If this entry is disabled
Y	ffprsrv.exe	ffprsrv.exe	"File and Folder Privacy - is a ""system security utility you can use to password-protect or hide your files and folders with a click of mouse. The program will always prompt to enter your access password when protection is enabled and a user is trying to access a protected file or folder"". If this entry is disabled
Y	ffpsrv	ffpsrv.exe	"File & Folder Protector - ""great easy-to-use password-protected security utility lets you password-protect certain files and folders
Y	ffpsrv.exe	ffpsrv.exe	"File & Folder Protector - ""great easy-to-use password-protected security utility lets you password-protect certain files and folders
N	Fpx	mnmsrvc.exe	Remote Desktop Sharing service part of Microsoft's Netmeeting allowing users to share items on their screens across remote locations
?	FSDPSRV	FSDPSRV.exe	"??"
X	gaSrv	gaSrv.exe	"Detected by Panda as the DOWNLOADER.ALQ TROJAN! Adware downloader"
X	gaSrve	gaSrve.exe	"Detected by Panda as the DOWNLOADER.ALQ TROJAN! Adware downloader"
X	Generic Service Process	srvhost.exe	"Added by the AGOBOT-FX WORM!"
Y	hffsrv	hffsrv.exe	"Hide Files & Folders - ""great easy-to-use password-protected security utility working at Windows kernel level you can use to password-protect certain files and folders
Y	hffsrv.exe	hffsrv.exe	"Hide Files & Folders - ""great easy-to-use password-protected security utility working at Windows kernel level you can use to password-protect certain files and folders
X	HijSrv32	hijsrv.exe	"Added by the BANKGERM-D TROJAN!"
X	Hostname Manager Server	host32srv.exe	"Added by a variant of the RBOT WORM!"
X	HostSrv	sachostx.exe	"Added by the LOOKSKY.H WORM! Drops multiple files in %System%"
X	HostSrv	sachostx.exe	"Added by the LOOKSKY.A or LOOKSKY.F or LOOKSKY.G WORMS!"
X	HostSrv	sachostx.exe...	"Added by the LOOKSKY.E WORM!"
?	hp Silent Service	HpSrvUI.exe	"HP related"
?	IaNvSrv	IaNvSrv.exe	"Related to the option ROM part of the Intel® Matrix Storage Manager. Located in %ProgramFiles%\Intel\Intel Matrix Storage Manager\OROM\aNvSrv. What does it do and is it required?"
X	imwinsrvc	acpmonsrv.exe	"Added by the SLAPER.E TROJAN!"
X	Instant Access	mwsrvacc.exe	"InstantAccess premium rate adult content dialer"
X	Instant Access	linewsrv.exe	"InstantAccess premium rate adult content dialer variant"
X	Internat	msgsrv32.exe	"Added by the NYRUBOT-A BACKDOOR! Note - this is not the legitimate msgsvr32.exe process on a Win9x/Me system which should not appear in MSConfig/startup!"
X	Internet Server	inetsrv.exe	"Added by the STARTPA-EM TROJAN!"
Y	Internet Sharing Server	iss_srvr.exe	"Intel AnyPoint internet sharing software. Now discontinued"
X	johkjh	srvd.exe	"Added by a variant of the SLAPER TROJAN!"
X	johnj315	srvc.exe	"Added by a variant of the MAILBOT-BI TROJAN!"
X	johnj3155	srvcc.exe	"Added by a variant of the MAILBOT-BI TROJAN!"
X	johnj3cd	srvdc.exe	"Added by a variant of the SLAPER TROJAN!"
X	Ksrv32	Ksrv32.exe	"Added by the AGOBOT-PI WORM!"
X	layersldm	hostplsrvc.exe	"Added by a variant of the SDBOT WORM!"
X	LEMSRV	lemsrv.exe	"Added by the IRCBOT-TC TROJAN!"
X	Live update monitor	srvany32.exe	"Added by the AGOBOT.AFM WORM!"
?	lmpdpsrv	lmpdpsrv.exe	"Related to a Lexmark printer/scanner. Printer sharing server? Is it required?"
X	Local runole service	srvc32.exe	"Added by the SMALL-DP TROJAN!"
X	lsa Services	lsa2srv.exe	"Added by the TAME-C WORM!"
X	lsass	lsasrv.exe	"Added by the MYDOOM.AG or MYDOOM.AS or MYDOOM.AU WORMS!"
X	LTM2	MSGSRV32.EXE	"Added by the LITMUS.A BACKDOOR! Note - this is not the legitimate msgsvr32.exe process on a Win9x/Me system which should not appear in MSConfig/startup! This one is located in %Windir%\Litmus"
X	LTM2	MPGSRV32.EXE	"Added by the LITMUS.201 TROJAN!"
X	LTM2	MSGSRV320.EXE	"Added by the LITMUS.C TROJAN!"
X	Memory Allocation Services	cisrv.exe	"Added by the IRCBOT.FC BACKDOOR!"
X	Microsoft	netsrv.exe	"Added by the RBOT-GOS WORM!"
X	Microsoft Client Pc	spoolsrv.exe	"Added by the RBOT-AQM WORM!"
X	Microsoft Driver Setup	mslsrv32.exe	"Added by the SDBOT-DPF TROJAN!"
X	Microsoft Int Service	MsIntSrv.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Services	lssrv.exe	"Added by the RBOT.CW WORM!"
X	Microsoft Services	lsrv.exe	"Added by the RBOT-BK WORM!"
X	Microsoft Spool Server for Win32	spoolsrv.exe	"Added by the RANDEX.H WORM!"
X	Microsoft Task Manager Daemon	spoolsrv.exe	"Added by the SDBOT.FLL WORM!"
X	Microsoft Update Server	mssrv.exe	"Added by an unidentified VIRUS
X	Microsoft Video Capture Controls	MSsrvs32.exe	"Added by the SDBOT-AAK WORM!"
X	MicroSoft Visual SP2	igfxsrvc32.exe	"Added by the SDBOT.GAV WORM!"
X	Microsoft Windows Updater	TMNTSrv.exe	"Added by a variant of the RBOT WORM!"
X	MicrosoftPersonalFirewall	spoolsrv.exe	"Added by the WOOTBOT.DO BACKDOOR!"
X	Microsofts Service	lcsrv16.exe	"Added by a variant of the RBOT WORM!"
X	Msgsrv16	Msgsrv16.exe	"Added by the DELF family of TROJANS!"
Y	MSGSRV32.exe	msgsrv32.exe	"Windows 32-bit VxD Message Server. For more information on its function and why it's needed
U	MSKServerExe	MSKSrvr.exe	"Part of McAfee Spamkiller"
X	MsMsgSrv	msmsgsrv.exe	"Added by the CQO TROJAN!"
X	MSN Servicer	msnsrv.exe	"Added by a variant of the IRCBOT TROJAN!"
X	MSNPluginSrvcs	p6.exe	"Added by the SDBOT.AKJ or RBOT-VJ WORMS!"
X	MSNPluginSrvcs	sagate.exe	"Added by the SDBOT.AKJ WORM!"
X	MSPluginSrvc	p3.exe	"Added by the RBOT-WV WORM!"
X	Mss Serv	msssrv.exe	"Added by the SLENFBOT.AA WORM!"
X	mssdbsrv	msupdtck.exe	Added by a variant of a password stealing TROJAN!
X	MSUpdSrv	msupdsrv.exe	"Browser hijacker
X	msvsrv32	msvsrv32.exe	"Added by the AGOBOT-KM WORM!"
X	MSWinSrv	MSWinSrv.exe	"Added by the MTRON TROJAN!"
X	MSWinSrv32	MSWinSrv32.exe	"Added by the MTRON-B TROJAN!"
U	mynsw	wntsrv.exe	"Net Screen Watcher surveillance software. Uninstall this software unless you put it there yourself"
X	NC1565	winntsrv -l -p10001 -d -e cmd.exe -L	"Added by the NEWLEY-A WORM!"
X	NetBiosSrvc	HPSrvPrt.exe	"Added by the SDBOT-COL WORM!"
X	NTsrv.exe	NTsrv.exe	"Added by a variant of the SERVU-O TROJAN!"
Y	oeprsrv	oeprsrv.exe	"Outlook Express Privacy - which ""lets you control access to Outlook Express and its email message database. When you enable protection
Y	oeprsrv.exe	oeprsrv.exe	"Outlook Express Privacy - which ""lets you control access to Outlook Express and its email message database. When you enable protection
Y	oepsrv	oepsrv.exe	"Outlook Express Protector from Ixis Research
Y	oepsrv.exe	oepsrv.exe	"Outlook Express Protector from Ixis Research
Y	oessrv	oessrv.exe	"Outlook Express Security - which is used ""to control access to Outlook Express and its databases. When it is active
Y	oessrv.exe	oessrv.exe	"Outlook Express Security - which is used ""to control access to Outlook Express and its databases. When it is active
X	oe_drop_spam	oesrv.exe	"Dropspam adware"
X	OnSrvr	OnSrvr.exe	OnWebMedia adware
U	Panda Antispam Server Service	PasSrv.exe	"AntiSpam part of an older version of Panda Internet Security"
Y	Panda Preventium+ Service	PREVSRV.EXE	"Part of the 2004 & 2005 versions of Panda Antivirus and Internet Security"
U	pdp Server	ctpdpsrvr.exe	Included and setup with the drivers for my Compaq A3000 all-in-one printer/scanner - maybe for networking. Works fine without it - but may be needed when used over a network
U	PDVDDXSrv	PDVDDXSrv.exe	"Remote Control background application for Cyberlink's PowerDVD DX - a Dell specific version of their standard PowerDVD product. Enables you to use a remote control with your DVD drive if your drive came with one. Not required if you don't have a remote control
X	Personal Firwall	ptmedsrv.exe	"Added by the SDBOT.XY WORM!"
?	PFW_PullSrv	PULL.EXE	"Personal Firewall related?"
X	Pluto! Pager	srvhandle.exe	"Added by the REDPLUT VIRUS!"
X	Pmedia	winsrvc.exe	"Internet marketing sofware from Permissioned Media Inc as used in E-Card FriendGreetings foistware - see here. Treated by Trend as the FRIENDGRT.B WORM!"
X	POP	PopSrv***.exe	"PeopleonPage foistware
X	popsrv146	popsrv146.exe	"AproposMedia adware"
X	qappsrvc32.exe	qappsrvc32.exe	"Detected by Kaspersky as the WEBBER.M TROJAN!"
X	Reg Service	REGSRV32.EXE	"Added by the RBOT.ZW WORM!"
X	REGEDIT	Regsrv32.com	"Added by the SOUTHGHOST WORM!"
X	reggsdg	spoolsrv.exe	"Added by the SDBOT-DI WORM!"
X	Registry Server	regsrv32.exe	"Added by the RBOT-GM WORM!"
X	Registry Service	REGSRV32.EXE	"Added by a variant of the RBOT WORM!"
X	RegScan	DLLSRV32.EXE	"Added by the AGOBOT.AEW WORM!"
X	regsrv	regsrv.exe	"Added by the OPTIXPRO.11 TROJAN!"
X	regsrv	scvhost.exe	"Added by the AGOBOT.E WORM!"
X	RegSrv64D	RegSrv64D.exE	"Added by the WINKO.AO WORM!"
X	regsrvc	regsrvc.exe	"Added by the STOPED-A TROJAN!"
X	rsrvmon.exe	rsrvmon.exe	"Added by the AGENT.NY TROJAN!"
N	Sa3dsrv	Sa3dsrv.exe	For Aureal based 3D soundcards. A3D sound features won't work with this disabled
X	ScanRegistry	nsrvnt.exe	"Added by the NERTE TROJAN! Not to be confused with the real ScanRegistry - which is a vital Windows file. This version has the executable as nsrvnt.exe not scanregw.exe"
X	Scvsrv32	scvsrv32.exe	"Added by the AGOBOT-PM BACKDOOR!"
X	Server Registry	regsrv32.exe	"Added by the VB-EJD TROJAN!"
X	Services DLL Loader	srvdll.exe	"Added by the SLENFBOT.ZS WORM!"
X	smcserv	winsrv.exe	"Added by the AGOBOT-OU WORM!"
X	smsrv	smsrv.exe	"Added by the AGOBOT-SX WORM!"
?	sndsrvc	SNDSRVC.EXE	"Part of Norton Personal Firewall and Norton Internet Security - what does it do and is it required?"
X	Spool Manager	spoolsrv.exe	"Added by the BANKER-FR TROJAN!"
X	Spooler Service	Spoolsrv.exe	"Added by the JOINER.C1 TROJAN!"
X	spoolsrv.exe	spoolsrv.exe	Added by an unidentified WORM or TROJAN! Located in %System%
X	srv	winlogon.exe	"Added by the SILLYFDC.BCA WORM! Note - this is not the legitimate winlogon.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%\Local Settings\Application Data"
X	Srv Host	srvhost.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Srv RPCrom	NClienti386.exe	"Added by the WATSOON.A TROJAN!"
X	Srv32	Srv32.exe	"Added by the OPASERV.J WORM!"
X	Srv32 spool service	runsrv32.exe	"Topantispyware.com malware - detected by Kaspersky as the SPYRE.B TROJAN!"
X	Srv32 spool service	spoolsrv32.exe	"Added by the SPYRE-B TROJAN!"
X	Srv32 spool service	[path to trojan]	"Added by the DLOADER-LB TROJAN!"
X	Srv325	Srv325.exe	"Added by the AGOBOT-PR WORM!"
X	Srv32Old	[worm filename].PIF	"Added by the OPASERV.J WORM!"
U	Srv32Win	SpyAgent4.exe	"SpyAgent - monitoring software that creates records of everything people do on a computer
U	Srv32Win	Svchost.exe	"Realtime-Spy keystroke logger/monitoring program - remove unless you installed it yourself!"
U	Srv32Win	sysdiag.exe	"SpyAgent surveillance software. Uninstall this software unless you put it there yourself"
U	srv32win	win16dll.exe	"Screenspy captures screenshots silently. If you didn't install this yourself remove it"
X	Srvce Pack Updte	svcpack.exe	"Added by a variant of the RBOT WORM!"
X	srvexc.exe	srvexc.exe	"Added by the SERVSAX TROJAN!"
X	srvhost	srvhost.exe	"Added by the LIVUP.A BACKDOOR!"
U	srvprc	srvprc.exe	"ActMon surveillance software. Uninstall this software unless you put it there yourself"
N	SSDPSRV	ssdpsrv.exe	"Simple Service Discovery Protocol (SSDP) and General Event Notification Architecture (GENA) services for network plug and play functionality. Starts up a web server on port 5000. Used by Universal Plug and Play (for network device discovery). To remove this program
U	Start Service	upssrv.exe	"Cyber Power PowerPanelPlus software. ""During a power failure the system automatically saves and closes open files within the battery backup time and safely powers down your computer"""
X	stisrv	stisrv.exe	"Added by the RBOT.BQF WORM!"
X	Sygate Personal Firewall	MSNSRV32.exe	"Added by a variant of the RBOT WORM!"
X	system handler	srvhandle.exe	"Added by the REDPLUT VIRUS!"
X	System Manager	winsrv32.exe	Added by an unidentified WORM or TROJAN!
X	System Profile	Regsrv.exe	"Added by a variant of the OPTIX TROJAN!"
Y	ThpSrv	thpsrv.exe	Toshiba Hard Drive Protection Utility - moves the Hard Drive head to a safe position in case of shock or vibration to reduce the risk of damage that could be caused by head-to-disk contact
U	TMESRV.EXE	TMESRV11.EXE	Toshiba utility related to inserting and removing a laptop from a docking station. Not required if you don't use a docking station
U	TMESRV.EXE	TMESRV21.EXE	Toshiba utility related to inserting and removing a laptop from a docking station. Not required if you don't use a docking station
U	TMESRV.EXE	TMESRV31.EXE	Toshiba utility related to inserting and removing a laptop from a docking station. Not required if you don't use a docking station
U	TMESRV31	TMESRV31.EXE	Toshiba utility related to inserting and removing a laptop from a docking station. Not required if you don't use a docking station
U	TMExLogon	TMESRV.EXE	Toshiba utility related to inserting and removing a laptop from a docking station. Not required if you don't use a docking station
X	Tmntsrv32	Tmntsrv32.exe	"Added by the STARTPAGE.O TROJAN!"
?	ToPassSrv	Pktopass.exe	"Related to Caere Pagekeeper scanning software (now taken over by Scansoft)
U	TrackpointSrv	daemon.exe	"Supports the ""pointer stick"" in lieu of a mouse on an IBM ThinkPad laptop. Necessary for the ""scroll"" button to work"
U	TrackpointSrv	tp4serv.exe	Supports the "pointer stick" in lieu of a mouse on an IBM ThinkPad laptop. Necessary for the "scroll" button to work
U	TrackPointSrv	tp4mon.exe	"Supports the ""pointer stick"" in lieu of a mouse on an IBM ThinkPad laptop. Necessary for the ""scroll"" button to work"
X	tsrv	t2serv.exe	"Added by the WAREZOV.AT WORM!"
X	tsrv	tsrv.exe	"Added by the WAREZOV.W WORM!"
N	TwkSCardSrv	SCardS32.Exe	Used with Towitoko SmartCard Readers for card recognition
U	ukl	wmpusrvc.exe	"Ultimate Keylogger surveillance software. Uninstall this software unless you put it there yourself"
X	User Servicer	usnsrvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	User Sharing Server	usnsrv.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Userfile Sharing Serv	usnsrv.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Userinterface Reporter	srv32.exe	"ISTBar adware"
U	USIUDF_Eject_Monitor	USISrv.exe	"Added by Ulead DVD Moviefactory. This program monitors your DVD or CD drives and alerts when you eject the media or have no media present"
X	VgaDriver	RsrVga32.exe	"Added by the KEYLOG-AH TROJAN!"
U	VPCUserServices	VMUSrvc.exe	"Part of ""DOS Virtual Machine Additions"" for Microsoft Virtual PC
N	vspdfprsrv.exe	vspdfprsrv.exe	"Visage PDF Printer"
X	vsrv32	vsrv32.exe	"Added by the AGOBOT.AIF WORM!"
X	WIN USB SUPPORT	grxsrv.exe	"Added by a variant of the RBOT WORM!"
X	win32	winsrv32.exe	"Added by the ADUENT TROJAN! Acts as a hi-jacker redirecting to Surferbar.com and adult content sites"
X	Win32	msnsrv.exe	"Added by a variant of the SDBOT WORM!"
X	windll	windotnetsrv.exe	"Added by the AUTORUN-ANO WORM!"
X	Windows DLL Tracker	spoolsrv.exe	"Added by a variant of the WOOTBOT WORM!"
X	Windows Manager	winsrv.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Windows PNP Server	pnpsrv.exe	"Added by the RBOT-AKM WORM!"
X	Windows Secure Messaging System	msnmsgrsrvc.exe	"Added by the RBOT-RE WORM!"
X	Windows Server Drivers	syssrv.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Service Utitity	winsrvc.exe	"Added by the RBOT-ASI WORM!"
X	Windows Services	avsrv32.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Windows Services	winsyssrv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Spool Server	spoolsrv.exe	"Added by the SDBOT-ACT WORM!"
X	Windows SpoolaPrint Service	spoolasrv.exe	"Added by the SDBOT-AYD WORM!"
X	Windows Spooler	SPOOLSRV.EXE	"Added by the SPYBOT.P WORM!"
X	Windows SpoolPrint Service	spoolersrv.exe	"Added by the SDBOT-ZT WORM!"
X	Windows Spoolsrv Service	spoolmsv.exe	"Added by the SDBOT-ZS WORM!"
X	windows spoolsrv service	spoolssv.exe	"Added by the SDBOT-AWV WORM!"
X	Windows SpooltPrint Service	spooltsrv.exe	"Added by the SDBOT-AYE WORM!"
X	Windows Streams Server	localsrv.exe	"Added by the SDBOT.LN WORM!"
X	Windows Time Server	TimeSRV.exe	"Added by the SPYBOT.DNC WORM!"
X	Windows Update	livesrvs.exe	"Added by a variant of the RBOT WORM!"
X	WinMsrv32	WinMsrv32.exe	"Added by the GAOBOT.AFJ WORM!"
X	winregsrv	winregsrv.exe	"Added by the SYNRG TROJAN!"
X	WinSrv	kn0x.exe	"Added by the HOBBIT.F WORM!"
X	WinSrv	SHIZZLE.EXE	"Added by the HOBBIT.C WORM!"
X	Winsrv	winsrv.exe	"Added by the OPASERV.T WORM!"
X	winsrv	winsrv.exe	"Added by the NETSNAK-B TROJAN!"
X	winsrv3	services.exe	"Added by the NAFBOT-A TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	WMI Performance Adapter Services	wmiapsrvs.exe	"Added by the RBOT.COU BACKDOOR!"
X	wmisrv	wmisrv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	wsrv32	wsrv32.exe	"Detected by Kaspersky as the AGENT.EP TROJAN!"
X	xxsrSrv32	xxsrsrv.exe	"Added by the BANCSDE-E TROJAN!"
X	[12 random characters]	catsrvps.exe	"IeDriver adware variant"
X	[12 random characters]	audiosrv.exe	"IeDriver adware variant"
X	[3 random char]srv32	[3 random char]srv.exe	"Added by the BANCOS.N TROJAN!"
X	[3-4 random letters]Srv32	[path to file]	"Added by the BANCSADE-A TROJAN!"
X	[executed file name]	Regsrv32.com	"Added by the SOUTHGHOST WORM!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.