svc

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X		svchost.exe	"Added by the DELF-UX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%. Note - has a blank entry under the Startup Item/Name field"
X	.mscdr	lsvchost.exe	"Added by the WEBUS.D TROJAN!"
X	.mscdsr	lsvchost.exe	"Added by the BDOOR-CR BACKDOOR!"
X	.nvsvc	smss.exe	"Added by the IRCBOT-FP TROJAN! Note - this is not the legitimate smss.exe process which should not normally figure in Msconfig/Startup!"
X	.nvsvcb	smssb.exe	"Added by the BOXED.CG TROJAN!"
X	.svchost	CSRSS.EXE	"Added by the WEBUS.F TROJAN! Note - this worm replaces the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	1	svchost.scr	"Added by the BANCOS.X TROJAN!"
X	333	svchost.exe	"Added by the JD-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Syswm1i"" directory"
X	?ekio Startups	?nksvc32.exe	"Added by the AGOBOT-OV WORM where ? is a random character"
X	ActiveXUpdate	svcss.exe	"Added by a variant of the DEDLER.C TROJAN!"
X	Administrator	svchost.scr	"Added by the NOVACAL TROJAN!"
X	alpha	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
N	ALU Scheduler Service	ALUSchedulerSvc.exe	Symantec LiveUpdate scheduler for programs such as Norton AV or Internet Security
X	amircivil	svchost.exe�	"Added by the AMIRECIVEL WORM!"
X	Anti Spam Service	spamsvc.exe	"Added by the MYTOB-BK WORM!"
X	AntiClicker	SVCHST32.EXE	"Added by the CBH TROJAN!"
X	Antivir	svchst.exe	"Added by the RAGRUK-A TROJAN!"
X	apisvc.exe	apisvc.exe	"Added by a variant of the LAMEBOT TROJAN!"
X	Application Adapter	abvsvc.exe	"Added by the CHECKOUT WORM!"
X	Application Layer Browser	abgsvc.exe	"Added by the ULPM.FX TROJAN!"
X	Application Layer Scheduler	agtsvc.exe	"Added by the IRCBOT.BJJ BACKDOOR!"
X	Application Layer Services	avrsvc.exe	"Added by the IRCBOT.BJM BACKDOOR!"
X	Application Manager	acnsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Application Manager	apnsvc.exe	"Added by the SMALLTRO.FN TROJAN!"
X	asussvc	asussvc.exe	"Added by the AGENT-FPB TROJAN!"
X	aupd	symcsvc.exe	"Added by the ABWIZ.D TROJAN!"
X	aupd	sysvcs.exe	"Added by the ABWIZ.C TROJAN!"
X	aupd	sywsvcs.exe	"Added by the ORSE-M TROJAN!"
X	ausvc	ausvc.exe	"Added by the AUTOUPDER TROJAN!"
X	Auto Update	svchost.exe	"Added by the DUMARDI-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Auto Updates	svchost.exe	"Added by the CHEUKO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
?	AutoShutdown	pssvc.exe	"Utility to fix vCard Export in MS Outlook 2000 - although why are these together?"
X	AvG	svchost323.exe	"Added by the RBOT-ZA WORM!"
X	AVScheduler	AVSCHSVC.EXE	"Part of the WinAntiVirus Pro 2005 rogue security software when installed in Win98/Me - not recommended
X	bab	svchst32.exe	"Added by the AGENT.Q TROJAN!"
X	Backup Service	backup.svc	Unidentified adware
X	beta	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
X	boot_reg	svchot.exe	"Added by the BANCBAN-BQ TROJAN!"
X	Bot Loader	svchostt.exe	"Added by the GAOBOT.ALV WORM!"
X	Browser Help Svc	BHSV.EXE	"Added by the RBOT-AVQ WORM!"
X	BSVCHOST	SVCH0ST.EXE	"Added by the VOXOM TROJAN! Notice the digit ""0"" in the filename rather than the upper case ""o"""
U	Cadenza	CdzSvc.exe	"Cadenza mNotes for Palm and Pocket PC enables users to access Lotus Notes on their mobile devices"
X	CashToolbar	svchost.exe	"BrowserAid/CashToolbar adware! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	ccAppr	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccAppr	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
Y	CcPxySvc	CCPXYSVC.exe	"Part of Norton's AntiVirus 2003
X	ccRegVfY	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccRegVfY	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccSvcHst.exe	ccSvcHst.exe	"Added by the SDBOT-DIW WORM!"
X	CDriver	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
X	clfmon	nvsvca32.exe	"Added by the TACTSLAY.E TROJAN!"
X	Clipsvc	clipsv.exe	"Added by the BLACKHOLE.F BACKDOOR!"
?	CLMLServer for HP TouchSmart	CLMLSvc.exe	"Found on the HP Touchsmart range of desktops and notebooks. What does it do and is it required?"
U	CognizanceTS	"rundll32.exe [path] AsTsVcc.dll	RegisterModule"
X	COM++ System	svchost.exe...	"Added by a variant of the LOVGATE WORM!"
X	Compaq Service Drivers	msnsvc.exe	"Added by the RBOT.BKT WORM!"
X	Compaq Service Drivers	winsvc.exe	"Added by the SDBOT-AGD WORM!"
X	Config Loader	svchosl.exe	"Added by the GAOBOT.P WORM!"
X	Config Loader	svchost2.exe	"Added by the AGOBOT.XE WORM!"
X	Configuration Loader	svchost.exe	"Added by the PARADROP-A WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Configuration Loader	svchost2.exe	"Added by the AGOBOT.JR WORM!"
X	Configuration Loading	svchos1.exe	"Added by the GAOBOT.DK WORM!"
X	ControlPanel	"svcc.exe internat.dll	LoadKeyboardProfile"
X	CPQHotKeys	hotkeysvc.exe	"Added by the RBOT-XA WORM!"
X	cprocsvc	cproc.exe	Added by MSIL.AGENT.C TROJAN!
X	CRC Value Verifier	svchost32.exe	"Added by the RBOT-OA WORM!"
X	CT Control Settings	CTSVCCD.EXE	"Added by the RBOT-YS WORM!"
X	CTFMON.EXE	svchost.exe	"Added by the JUEGO-B WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	DCfssvc	dcfssvc.exe	"Associated with digital cameras and can cause problems which disappear if disabled. If this program is unchecked in startup
U	dcfssve	dcfssvc.exe	"Associated with digital cameras and can cause problems which disappear if disabled. If this program is unchecked in startup
X	DDriver	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
X	defragsys	svchost.exe	"Added by the BIFROSE-TH TROJAN! Note - this is not the legitimate svchost.exe process which should normally figure in Msconfig/Startup!"
X	DirectX9	svchost32.exe	"Added by the RBOT.AQG WORM!"
X	Disk Defragmentation Loader	pmsvcr.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Disk Essensial Tools	detsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Disk Panel Configuration	dpcsvc.exe	"Added by the IRCBOT.BSQ BACKDOOR!"
X	Disk Panel Setup	npcsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Distributed File System	Dfsvc.exe	"Added by the MYFIP.A or MYFIP.K WORMS!"
X	Dll Link	svchoist.exe	"Added by the AUTOSKY WORM!"
X	Dll Link	svchost.exe	"Added by the AUTOSKY WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Favourites folder"
X	DLLService32	dllsvc32.exe	"Added by the AGOBOT.VX WORM!"
X	Dmsvc32	Dmsvc32.exe	"Added by the AGOBOT.ABU WORM!"
X	DNS Service	dnssvc.exe	"Added by the DELBOT-Z WORM!"
X	DriverCheck	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	DriverDB	svcmdx32.exe	"Added by the BERPI TROJAN!"
X	DriverLoad	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	Dvx	wsxsvc.exe	"Delfin Media Viewer or ""Promulgate"" adware variant"
X	erthgdr	svc.exe	"Added by the BEAGLE.BN or BEAGLE.BP WORM!"
X	erthgdr2	svc23.exe	"Added by the BAGLE.CG WORM!"
X	EUP Service	eupsvc.exe	"Added by the DELBOT-Q WORM!"
N	evntsvc	evntsc.exe	"Application Scheduler installed along with RealOne Player. Once installed
X	F-Secure 2005	svchost.exe	"Added by the BIFROSE-CH TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	FamilyKeyLogger	cisvc.exe	"Family Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Located in %ProgramFiles%\FamilyKeyLogger"
X	Fast Home	svcnvt.exe	"Detected by Kaspersky as the DELF.KS TROJAN! This file may be found in the System folder on 9x machines
X	Fast Search	svcnv.exe	"Homepage
X	Fast start	svcnt.exe	"Adware - detected by Kaspersky as a variant of the FAVADD TROJAN!"
X	FastStart	svcnut.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
X	FastStart	svcnut32.exe	"Browser hijacker - a variant of the STARTPAGE.L TROJAN!"
X	fegoze	SVCH0ST.EXE	"Added by the GRAYBIRD.D VIRUS! Note - the filename has the digit 0 rather then the uppercase ""o"""
X	Fen Startups	fensvc32.exe	"Added by the RANDEX.CCF WORM!"
X	Fenio Startups	fnesvc32.exe	"Added by the AGOBOT-OS BACKDOOR!"
X	FHStart	shdocsvc.exe	"Added by the WINHOUND TROJAN!"
?	FLSVCI	FLSVCI.exe	"??"
X	France	svchost.exe	"Added by the MIMAIL.L WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	FSH	svcnva.exe	Identified by Ewido Security Suite (Ewido is now part of AVG Technologies) as the DELF.KA TROJAN!
X	fstsvc	"rundll32.exe fstsvc.dll	start"
X	gamma	svchost.exe	"Added by a variant of the DELF.IT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The location of this file varies"
X	Gekio Startups	gnksvc32.exe	"Added by the AGOBOT.AFJ WORM!"
X	Generic host proccess for windows	SVCHOSTS.EXE	"Added by the SPYBOT-GQ WORM!"
X	Generic Host Process	svchost.exe	"Added by the DLOADER-NX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Generic Host Process for Win32 Services	winsvc.exe	"Added by the SDBOT-O WORM!"
X	Generic Host Process for Win32 Services	winsvc32.exe	"Added by the SDBOT-P WORM!"
X	Generic Host Process for Win32 Services	lspsvc.exe	"Added by the MUMU.C WORM!"
X	Generic Host Process for Win32 Services	SPSVC.EXE	"Added by the SDBOT.DA WORM!"
X	Generic Host Process for Win32 Services	svchost32.exe	"Added by the AGOBOT.ALH WORM!"
X	Generic Service Process	regsvc32.exe	"Added by the GAOBOT.UJ or GAOBOT.UL WORMS!"
X	Generic Service Process	nvsvc.exe	"Added by the AGOBOT.BY WORM! Note - this is not the valid NVIDIA Driver Helper Service and is located in %System%"
X	Generic Services Process	regsvc32.exe	"Added by the GAOBOT.SY WORM!"
X	Gmsvc32	gmsvc32.exe	"Added by the AGOBOT.ABN WORM!"
X	GNP Generic Host Process	svchost.exe	"Added by the ZAPCHAS-F BACKDOOR! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
U	GoToMyPC	g2svc.exe	"ExpertCity GoToMyPc logon - web-based remote-access solution that allows individuals and companies to register their computers online and then securely access those computers from any web browser"
X	hdlfoe df98ndf	svchots.exe	"Added by a variant of the RBOT WORM!"
X	Hekio Startups	Hnksvc32.exe	"Added by the AGOBOT-QE WORM!"
X	hellfire	svchost.exe	"Added by the LEOX.D TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	HMI PowerSystem	hmisvc32.exe	"Added by the RANDEX.CZZ WORM!"
X	HML PowerSource	hmlsvc32.exe	"Added by the SDBOT-XL WORM!"
X	HMV PowerSource	hmusvc32.exe	"Added by the SDBOT-YW WORM!"
X	HOI Services	holsvc32.exe	"Added by the AGOBOT-SF WORM!"
X	Host Process	svchost.exe	"Added by the IRCBOT.AGF BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in the Fonts directory"
X	HostSVC syse	HostSVC.exe	"Added by the RBOT-ANZ WORM!"
X	HPl Services	hmlsvc32.exe	"Added by the AGOBOT-SI WORM and variants!"
X	HQI Services	hqisvc32.exe	"Added by the AGOBOT-RO WORM!"
X	HQI Services	hqlsvc32.exe	"Added by the AGOBOT-RP WORM!"
X	Hrn_qtv	hrnsvc32.exe	"Added by the SDBOT-AET WORM!"
X	I just want to say I love Milko and I need a drink	svchost.exe	"Added by the CHIKO WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\Administrator\Local Settings\Application Data"
X	I/O Controllers	svcnet.exe	"Added by the TIBIK-B TROJAN!"
U	Ibmpmsvc	ibmpmsvc.exe	"Power management driver for IBM laptops. Provides support for the use of four keys on the thinkpad keyboard with blue key tops - Fn
X	igfxtras	svchots.exe	"Added by the AUTORUN-AIW WORM!"
X	ine	svchosts.exe	"Added by the RBOT.BNL WORM!"
U	IntelZeroConfig	ZCfgSvc.exe	"Zero Config MFC Application
X	Internet Config	svchosts.exe	"Added by the SDBOT TROJAN!"
X	Internet Service	intersvc.exe	"Added by the SPYBOT-DE WORM!"
X	Internet Services	Netsvc.exe	"Added by the MYTOB.MN WORM!"
X	IPConfig	svcxnv32.exe	"Added by the HACARMY.E TROJAN!"
X	IPConfig	svcxnw32.exe	"Added by a variant of the HACARMY.E TROJAN!"
N	ISSI EZUpdate Service	issimsvc.exe	Part of IBM Global Services - used internally by IBM for automatic updating of software and Microsoft patching
Y	ISSVC	ISSVC.exe	Part of Norton Internet Security Suite
X	IST Service	istsvc.exe	"ISTBar adware"
X	Java Update	svchost.exe.exe	"Added by the AGENT-LBS TROJAN!"
X	jiahus	svchqs.exe	"Added by the WOWPWS-AL TROJAN!"
X	JvcHost	jvcsvc32.exe	"Added by the AGOBOT-AIU WORM!"
X	kaa	SVCHHS.exe	"Added by the AGENT-JKP TROJAN!"
X	KAVPersonal	svchost.exe	"Added by the LINEAGE-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
Y	kavsvc	kavsvc.exe	"Kaspersky antivirus"
X	KavSvc	*****.exe reg_run [ = random char]	"Added by the QOOLOGIC TROJAN!"
X	kavsvc	[random 6 char filename]	"Added by the QOOLOGIC TROJAN! Uses random file names (examples: nzkklz.exe
X	Kernel32	svchosts.exe	Added by an unidentified WORM or TROJAN!
X	Kernel32	svchost.exe	"Added by an unidentified WORM or TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %System%\drivers"
Y	KPFWSvc.EXE	KPFWSvc.EXE	"KingSoft Personal Firewall"
X	KYK Control Settings	KYSVCXD.EXE	"Added by a variant of the RBOT WORM!"
X	load	svchsot.exe	"Added by the GWGHOST-O TROJAN!"
N	LoadMSvcmm	msvcmm32.exe	"Auto-update for Movielink - internet movie rental System Tray access"
X	LocalSystem	svchost.exe	"EHU adware. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	Logical Disk Detection	mrisvc.exe	"Added by the IRCBOT.AOW BACKDOOR!"
X	LTM2	SVCHOST32.exe	"Added by the LITMUS.203B TROJAN!"
X	LTM2	SVCHOST�.exe	"Added by the DROPPERFL.A TROJAN!"
X	ltssvc	"rundll32.exe ltssvc.dll	start"
X	MainStart	svcmfte32.exe	"Added by the STINX-A TROJAN!"
X	MapiDrv	mpisvc.exe	"Added by the MIPSIV TROJAN!"
X	mapisvc32	mapisvc32.exe	"Added by the KX VIRUS and also recognised by Symantec as FPAI adware"
X	Master	svcghost.exe	"Added by the IRCBOT.RB TROJAN!"
Y	McAfee Managed Desktop Agent	MYAGTSVC.EXE	"Part of the now obsolete McAfee Managed VirusScan anti-virus and anti-spyware security tool for small businesses. Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows NT/2K/XP"
U	Media Manager Indexer	AIRSVCU.EXE	"Part of MS Visual InterDev
X	Messenger Sharing Control	mnwsvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Micr0s0ft Upd4t4z	svchost32.exe	"Added by the RBOT.ALF WORM!"
X	Micrcoft Exploerer	svchose.exe	"Added by the RBOT-ASL WORM!"
X	microsoft	svchost.exe	"Added by the ASTEF or RESPAN WORMS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	Microsoft	svchost.exe	"Added by the ADUYO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft	msvchost.exe	"Added by the RBOT-GAW WORM!"
X	Microsoft (R) Windows Configuration Backup Service	svchost.exe	"Added by the RANKY.X TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in either a ""config""
X	Microsoft Agent	svch0st.exe	"Added by the VB-DRO WORM!"
X	Microsoft Corp	svchost.exe	"Added by the PUSHBOT.QD WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Corp. Host Services	svchosl.exe	"Added by the RBOT-FMZ WORM!"
X	Microsoft Corporation Svchost Service	mssvc.exe	"Added by a variant of the SDBOT WORM! See here"
X	Microsoft Corporation Svchost Service	mswsc.exe	Added by the AGENT.MAB TROJAN!
X	Microsoft Device Manager	svcswin.exe	"Added by the IRCBOT-YH TROJAN!"
X	Microsoft DLL Host Service	svcdllhst.exe	"Added by the AGENT.EAK TROJAN!"
X	Microsoft dll Host Service	svchost.exe	"Added by the RBOT.BMS BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft DLL Service	svcdll.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Genetic Procress	svchost.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Genuine Logon	svchost.exe	"Added by the SDBOT.EXT WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Help	svchosl.exe	"Added by the AGENT-GPX TROJAN!"
X	Microsoft Help SVC	msnmngr.exe	"Added by the SDBOT-PQ WORM!"
X	Microsoft Initialization Service	initsvc.exe	"Added by the IRCBOT.AXK BACKDOOR!"
X	Microsoft Internet Explorer	svchost.exe	"Added by the IRCBOT-AK TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	Microsoft Internet Explorer	svchosts.exe	"Added by the BANCBAN-U TROJAN!"
X	Microsoft Internet Explorer	_svchost.exe	"Added by the TINY.LX TROJAN!"
X	Microsoft IT Update	svchsst.exe	"Added by the RBOT-DH WORM!"
X	Microsoft Kinetik Svc	msftksvc.exe	"Added by the AGENT.AGDO TROJAN!"
X	Microsoft MSUPDATE	SpoolSvc.exe	"Added by the SXTB-A TROJAN!"
X	Microsoft Netview	mssvc32.exe	"Added by an unidentified VIRUS
X	Microsoft Network Host	svc0host.exe	"Added by the SDBOT-AEN WORM!"
X	Microsoft Network Services Controller	mmsvc32.exe	"Added by the NANPY-A WORM!"
X	Microsoft Office	msvcp.exe	"Added by the AGENT-XK TROJAN!"
X	Microsoft Outlook Express Protocol	svchst.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Registro	svchostt.exe	"Added by the BANCOS-DH TROJAN!"
X	Microsoft Security Monitor Process	svcchost.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Service	winsvc.exe	"Added by the SPYBOT-DB WORM!"
X	Microsoft Service 32	mssvc32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Service Host Manager	32svchost.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Service Host Process	svchost.exe	"Added by the KRYNOS.B WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Help"
X	Microsoft Service Manager	winsvc.exe	"Added by a variant of the RBOT WORM! See here"
X	Microsoft Service Pack2.1	svchost2.exe	"Added by the RBOT.ASN BACKDOOR!"
X	Microsoft Spool Svc	spoolsvc32.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	microsoft support	svchostt.exe	"Added by the AGOBOT.AWN WORM!"
X	Microsoft SVC	mssvc.exe	"Added by the BIFROSE-UQ TROJAN!"
X	Microsoft Svchost local services	winoem.exe	"Added by the RBOT-FPE WORM!"
X	Microsoft Svchost local services	nzm23.exe	"Added by the RBOT-GMC WORM!"
X	Microsoft Svchost local services	msnserver.exe	"Added by the RBOT-GPM WORM!"
X	Microsoft Synchronization Manager	svchosts.exe	"Added by the SDBOT-LM WORM!"
X	Microsoft System File	svchots.exe	"Added by the RBOT.BYU WORM!"
X	Microsoft TCP/IP Connection Monitor	svchost32.exe	"Added by the RBOT.KS WORM!"
X	Microsoft Telecoms Center	svcchost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	snlogsvc.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	WINSVC32.EXE	"Added by the RBOT.CU WORM!"
X	Microsoft Updating Client	websvc.exe	"Added by the RBOT.AQ WORM!"
X	Microsoft usnsvc Service	usnsvc.exe	"Added by a variant of the KOBOT-C WORM!"
U	Microsoft Webserver	svctrl.exe	Personal web server program which enables you to create and host a web server from your computer. Not required for most people
X	Microsoft Windows SVCHOST	SVCHOST.exe	"Added by the VB.KV WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Microsoft Windows System Service Manager	winsvc.exe	"Added by the SPYBOT.LR WORM!"
X	Microsoft Windows Update	svchos.exe	"Added by the SDBOT.AC WORM!"
X	Microsoft Windows Update	svcshost.exe	"Added by the FORBOT-CF WORM!"
X	Microsoft Windows XP Configuration Loader	m32svco.exe	"Added by the SDBOT.WORM!.48548 WORM!"
X	Microsoft Winsock Service	msusvc.exe	"Added by the RBOT-ANS WORM!"
X	Microsong	svchosts11.exe	"Added by the SDBOT-EV WORM!"
X	Microszoft Update Mach1nezs	svchst.exe	"Added by the RBOT-ED WORM!"
X	Mircosoft DNS Service	svchost.exe	"Added by the IRCBOT-AK TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	Mircrosoft Svchost32	svchost32.exe	"Added by the RBOT-AZW WORM!"
X	Mmgsvc	mmgsvc.exe	Mmgsvc spyware
X	mnsvc	mnsvc.exe	"Added by the AUTOUPDER TROJAN!"
X	mnsvcsp	mnsvcsp.exe	"Added by an unidentified VIRUS
X	Modem	locatesvc.exe	"Added by a variant of the SPYBOT WORM!"
X	Monitoring Service	svchost.exe	"Added by the CONE.C WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\tasks"
N	Movielink Manager Uninstall	msvcmm32.exe	"Auto-update for Movielink - internet movie rental System Tray access"
X	MP Services	mpsvc.exe	"Added by the WOOTBOT.EQ WORM!"
X	mptsgsvc.exe	mptsgsvc.exe	"Hacker Tool - detected by DiamondCS TDS-3 anti-trojan as ""HackTool.Win32.Hidd.j"""
X	MQT Svc	mqtsvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	mrsvctr	mrsvctr.exe	"Added by a variant of the SDBOT WORM!"
X	MS Config Loader	svchos1.exe	"Added by the AGOBOT.R WORM!"
X	MS Config Loader	svcrhost.exe	"Added by a variant of the RBOT WORM!"
X	msclean	msvchost.exe	"Added by the OPANKI-Q WORM!"
X	msconfig38	mssvcc.exe	"Added by the RBOT-BJV WORM!"
X	mscsvc.exe	mscsvc.exe	"Added by the BANCOS.T TROJAN!"
X	mset	svchost.exe	"Added by the BIZEX-F TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""mset"" sub-directory"
X	Msgsvc32	[worm filename]	"Added by the NAUTICAL-A WORM!"
X	MsgSvcMgr32	cmdzxdll.exe	"Added by the RBOT-AEK WORM!"
X	MSMsgSvc	MSMSGSVC.exe	"Browser hijacker
X	msn	msnsvc.exe	"Added by a variant of the SDBOT WORM!"
X	MSN	svchost.exe	"Added by the PUSHBOT.FA WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	MSN Service	msnsvc.exe	"Added by the SLENFBOT.EG WORM!"
X	MSN User Service	msnsvc.exe	"Added by the SLENFBOT.NS WORM!"
X	MSN User Svc	msnusnsvc.exe	"Added by the IRCBOT.AVV BACKDOOR!"
X	msnager32	svchostt.exe	"Added by the WOMANIZ.E TROJAN!"
X	MsnExplorer	SVCHST.EXE	"Added by the BDOOR-EB BACKDOOR!"
N	MSNIA	MSNIASVC.EXE	Added with MSN version 9. Resets certain internet settings upon bootup and can't be disabled via MSCONFIG
X	MsnMessengerSvc	msnmsgr.exe	"Added by a variant of the RBOT WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	MSRegSvc	regsvc32.exe	Homepage hijacker that changes your homepage to an adult content site
X	Mss VC	mssvc.exe	"Added by the OPANKI.AB WORM!"
X	mssvc	[path to trojan]	"Added by the PSK TROJAN!"
X	MSSVC	svcsys.exe	"Added by the FATOOS-C TROJAN!"
Y	MSSVC.EXE	MSSVC.EXE	"StealthDisk - hides folders
X	mssvc32	mssvc32.exe	"Added by the AGOBOT-ME WORM!"
X	MSSYSTEM	svcsys.exe	"Added by the FATOOS-C TROJAN!"
X	MStask	svchost.exe	"Added by the LDPINCH-BV TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	MSTaskbar 32	tbsvc32.exe	"Added by the RBOT.BQZ WORM!"
X	MSUpdate	svchosthlp.exe	"Added by the BLASTER.T WORM!"
X	Msupdate	svchosts.exe	"Added by a variant of the TACTSLAY TROJAN!"
X	Msupdate	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	Msupdate	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	msvc32	msvc32.exe	"ClientMan parasite variant"
X	msvc32	msvc32.exe	"Added by the AGOBOT-NT WORM!"
X	msvcav	msvcav.exe	"Added by the AGENT-ACR TROJAN!"
X	msvcc	msvchost.exe	"Added by the XOMBE TROJAN!"
X	msvcc25	svcchost.exe	"Added by a variant of the SDBOT WORM!"
X	msvcc25	salvage.exe	"Added by a variant of the SDBOT WORM!"
X	msvcc25	svcchost.exe	"Added by the SDBOT-CSE WORM!"
X	msvccc66	svcchosst.exe	"Added by the RBOT-GLS WORM!"
X	msvccc66	dload.exe	"Added by a variant of the RBOT WORM!"
X	msvchost	msvchost.exe	"Added by the IRCBOT-AV WORM!"
X	MsvcService	msvcs.exe	"Added by the RBOT-RK WORM!"
X	MsWindows SysDate	sysmsvc.exe	"Added by the SPYBOT.FCD WORM!"
X	My App	SMSSvc.exe	"Added by the NEGASMS.A TROJAN!"
Y	MyCIO Agent Service	myagtsvc.exe	"Part of the now obsolete McAfee VirusScan ASaP online anti-virus and anti-spyware security tool for small businesses. Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows NT/2K/XP"
X	MySLScan	msvc32.exe	"Added by the FORBOT-EH WORM!"
X	mysvcig38	mysvcc.exe	"Added by the RBOT-FOU WORM!"
X	mysvcig38	recsl.exe	"Added by a variant of the RBOT-FOU WORM!"
X	nano	svchost.exe	"Added by the NANO-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	NDIS Adapter	svchosttt.exe	"Added by the WOOTBOT.AN WORM!"
X	netc	svc.exe	"Added by the VESLORUKI.DWK TROJAN!"
X	NetService	ntsvc.exe	"Added by the QQPASS-DU TROJAN!"
X	netservices	svchostn.exe	"Added by the SDBOT.GI WORM!"
X	NetStart	svchost.exe	"Added by the MKAR-A VIRUS! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""NETSTART"" subfolder"
X	Network Administration Service	rsvc32.exe	"Added by the RBOT.ABH WORM!"
X	Network maneger	svchost.exe	"Added by the AGENT.BX BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Network Security	secsvc.exe	"Added by the RBOT-ALX WORM!"
X	Network Security XP	nvsvc86.exe	"Added by the RBOT-GUI WORM!"
X	Network Service	svchost.exe	"Added by the STARTPA-CC TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Network Service Manager	netsvc.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
U	niSvcLoc	niSvcLoc.exe	"Related to National Instruments Corp. LabView"
?	NMSSvc	NMSSVC.EXE	NIC Management Service - diagnostics program for Intel Pro family network cards
Y	NMSVC	nmSvc.exe	"Covenant Eyes - surveillance software that creates records of everything people do on a computer
U	NNSvc	nnsvc.exe	"Net Nanny internet filter. Starts via a registry ""RunServices"" key on Windows 98/Me and as a service on Windows 2K/XP/Vista"
X	nodriver	SVCHOST.EXE	"Added by the SPYBOT-Z BACKDOOR! Note - this is not the legitimate svchost.exe process which should normally figure in Msconfig/Startup!"
X	Norton Live Updater	Cavapsvc.exe	"Added by the GAOBOT.AO WORM!"
X	Norton Live Updater	Avapsvc.exe	"Added by the AGOBOT-BG BACKDOOR!"
U	Norton Program Scheduler	NPSsvc.exe	"Installed on a Windows system where the Windows Task Scheduler isn't used as part of the OS (Win95
X	Norton protect	nvsvc.exe	"Added by a variant of the RBOT WORM!"
X	Norton Service Process	navapsvc.exe	"Added by the AGOBOT-GV WORM! Note - this is not the valid Norton Anti-Virus service which has the same file and is located in %ProgramFiles%\Norton AntiVirus. This one is located in %System%"
X	Norton Update	winsvc.exe	"Added by the AGOBOT.ALP WORM!"
X	NortonVPlus	svchost.exe	"Added by the ROAMER-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Nsv	nsvsvc.exe	"Delfin Promulgate adware"
X	nsvcin	n20050308.exe	"Delfin Media Viewer adware related"
X	NT MICROSOFT SVCD	ntvsvcd.exe	"Added by a variant of the RBOT WORM!"
X	NT Services	ntsvc.exe	"Added by the AGOBOT.VJ WORM!"
X	ntupdate	dnsvc.exe	"Added by the SDBOT-TC WORM!"
X	ntuser	svchost.exe	"Added by the POLYCRYP.DY TROJAN!"
X	NvClipRsv	svchost.exe	"Added by the DUMARU-K WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	NvCplDmn	NAVSVC.EXE	"Added by an unidentified VIRUS
X	Nvidia Control Daemon	nksvc32.exe	Added by an unidentified WORM or TROJAN!
X	Nvidia Control Panel	ncsvc32.exe	"Added by an unidentified VIRUS
X	nVidia Display Driver	nvsvc64.exe	"Added by the IRCBOT-YK WORM! Note - this is not related to any nVidia based graphics card"
X	Nvidia Startup Manager	ksvc32.exe	"Added by the AGENT-IWD TROJAN!"
N	NvSvc	nvsvc.exe	"NVIDIA Driver Helper Service - installed when you change from the WDM drivers to nVidia's latest versions but not requied. Extreme shutdown delays can be encountered with this service active
X	nvsvc	nvsvc.exe	"Added by the BANKER-HQ TROJAN! Note - this is not the valid NVIDIA Driver Helper Service and is located in %System%"
X	NVSVC	nvsvc.exe	"Added by the AGOBOT.ALX WORM! Note - this is not the valid NVIDIA Driver Helper Service and is located in %System%"
U	NvSvc	"RUNDLL32.EXE nvsvc.dll	nvsvcStart"
U	nvsvc16	nvsvc16.exe	"MySuperSPy surveillance software. Uninstall this software unless you put it there yourself"
X	nvsvca32	nvsvca32.exe	"Added by the TACTSLAY.E TROJAN!"
X	nvsvca32	clfmon.exe	"Added by the TACTSLAY.E TROJAN!"
X	nxgsvc	"rundll32.exe nxgsvc.dll	start"
X	Office Monitor	nvsvc86.exe	"Added by the IRCBOT.BVO BACKDOOR!"
X	Office Monitor Word Exel R	svch.exe	"Added by the DWNLDR-GWW TROJAN!"
X	OfficeAgent	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	OfficeAgent	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	OfficeGuardUI	svcss.exe	"Added by the DEDLER-C TROJAN!"
U	On screen display	TPOSDSVC.exe	"Supports the hotkeys on IBM/Lenovo ThinkPad notebooks - displays the result of the using of function keys on the desktop screen. For example
X	Online Service	svchost.exe	"Added by the HOSTIDEL.B or HOSTIDEL.C or TARNO.B TROJANS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	P0w3rF1Y	svchost.exe	"Added by the BDOOR-MM BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Pcsv	pcsvc.exe	"Delfin Media Viewer or ""Promulgate"" adware"
U	PD0620 STISvc	P0620Pin.dll	Creative Technology Ltd installation plug-in related
X	PDA Commander	stisvc32.exe	"Added by the AGOBOT-TX WORM!"
X	Perfomance Settings	svchost.exe	"Added by the TOFGER-AP TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
Y	PGPSDKSVC	pgpsdkserv.exe	"PGPsdkServ.exe is the new SDK service which is responsible for performing all PGP key management and cryptographic functions. This functionality was moved into a service to allow multiple modules simultaneous read/write access to the keyrings
X	Photoshop	svchost.exe	"Added by the CDOPEN-E TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%"
X	PK Services	pksvc.exe	"Added by the FORBOT-BW WORM!"
X	pnpsvc_lock	*****.exe [ = random digit]	Browser hijacker
X	pnpsvc_lock	startsvs.exe	Browser hijacker
X	PolicyRun	svchost.exe	"Added by the SILLYFDC-AW WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	PowerManager	svchost.exe	"Added by the JEEFO VIRUS! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	PPSVC	[path to file]	"PC Police surveillance software that logs keystrokes
X	Print Scheduler	usnsvc.exe	"Added by a variant of the KOBOT-C WORM!"
X	Print Spooler	spoolsvc32.exe	"Added by the SDBOT.BB TROJAN!"
X	Processor	svchost.exe	"Added by the AGENT-KIR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in the root directory (i.e. C:\ or D:\)"
X	ProtocolDiskChk	svcvlw32.exe	"Added by the STINX-Y TROJAN!"
X	PService	svcnow32.exe	"Added by the SPYBOT-DJ TROJAN!"
Y	PSIMSVC	PSIMSVC.exe	"Part of Panda Antivirus and Internet Security"
X	QTSvc	msocfg.exe	Premium rate adult content dialler
X	QTSvc	navchk.exe	Premium rate adult content dialler
X	QTSvc	shman.exe	Premium rate adult content dialler
X	QTSvc	ssvr.exe	Premium rate adult content dialler
X	Ravshell	svch0st.exe	"Added by the NSPM.PU TROJAN! Notice the digit ""0"" in the filename rather than the lower case ""O"""
X	ravtask	svch0st.exe	"Added by the LINEAG-AIN TROJAN!"
X	Recoveru system	svchast.exe	"Added by a variant of the LINEAGE-AV TROJAN!"
X	Recoveru systems	svchost.exe	"Added by the SMALL.DDX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
U	reg2.0	SVCH0ST.EXE	"eSpyNow surveillance software. Uninstall this software unless you put it there yourself. Note - the filename has the digit 0 rather then the uppercase ""o"""
X	regedit	svchost.exe ccRegVfy	"Added by the HOTWORD.B TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is also located in %System% but has a space at the beginning of the filename"
U	RegHelp	svchosts.exe	"SpyGraphica spy software - ""Stealth monitoring of ALL PC or Network Activity with DVD-like playback. EVERY keystroke can be e-mailed in a detailed activity report every 15 minutes...anywhere in the world."""
X	Registry Service	regsvc.exe	"Added by the IRCBOT-ZM BACKDOOR!"
X	Regsvc	regsv.exe	Added by an unidentified TROJAN!
X	regsvc	sysd	"Sys Detective+ spyware"
X	regsvc32	regsvc32.exe	Homepage hijacker that changes your homepage to an adult content site
X	Remote Access Adapter	rvasvc.exe	"Added by the IRCBOT.BIF BACKDOOR!"
X	Remote Access Domain	rswsvc.exe	"Added by the IRCBOT.BFA TROJAN!"
X	Remote Access Monitor	rpgsvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Remote Access Tool	rwosvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Remote Event System	resmsvc.exe	"Added by the IRCBOT.YF BACKDOOR!"
X	Remote Services Manager	msrmsvc.exe	"Added by the SLENFBOT.AJ WORM!"
X	Remote Storage Access	rmasvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Remote Terminal Task	rtsbsvc.exe	"Added by the IRCBOT.AUZ BACKDOOR!"
X	renascimento	svchost.exe	"Added by the BANKER.GAX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Help"
X	reseurce	svchost.exe	"Added by the LINEAGE-FV TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Restore Operation	svchots.exe	"Added by a variant of the RBOT WORM!"
X	Run Services as Application	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Run Services as Application	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	run=	svcinit.exe	"CoolWebSearch parasite variant"
Y	RunCA	InvokeSvc3.exe	Wireless-G USB Wireless Network Adapter related - would appear to be required
X	rundll32	svchs0t.exe	"Added by the PWSTEAL-E TROJAN!"
X	Runner	svchost.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	RunServices	runsvc32.exe	"Added by the AGOBOT.QJ WORM!"
X	runsvc	runsvc.exe	"Added by the SMALL-CF TROJAN!"
X	S0undMan	svch0st.exe	"Added by the LOVGATE.AB WORM! Note - the filename has the digit 0 rather then the uppercase ""o"""
X	Savsvc	"rundll32.exe savsvc.dll	start"
X	ScheduIr	svchst.exe	"Added by a variant of the SDBOT WORM!"
X	Scheduler	svcrhost.exe	"Added by the TACTSLAY.A TROJAN!"
X	Scheduler	svcshost.exe	"Added by the TACTSLAY.A TROJAN!"
X	Scheduler	svchst.exe	"Added by the TACTSLAY.B TROJAN!"
X	scrsvc	scrsvc.exe	"Added by the AGENT-DS TROJAN!"
U	sds20	svchost.exe	"InlookExpress logs keystrokes and captures screenshots. If you didn't install this yourself remove it. Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in C:\sds20"
X	secsvc32	secsvcnt.exe	"Added by the GLOBAL PATROL TROJAN!"
X	Security Service	secsvc.exe	"Added by the RBOT-GGF WORM!"
X	Service Client	winsvcli.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Service Host	svchost.exe	"Added by the TORVEL WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Service Host	svchost.exe	"Added by the DAOSER-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %System%\Services\{C922CCC4-CF61-4589-A0D1-828160704853}"
X	Service Host	svchost.exe	"Added by the DAOSER-C TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %System%\Services\[random]"
X	Service Host	svchosts.exe	"PornCleanser spyware"
X	Service Host Driver	svchost.exe	"Added by the HITON TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Service Host Process	spoolsvc.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	Service Process	SVCHOST.EXE	"Added by the DARKER WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Service Process	svchost.exe	"Added by the DCMBOT-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""config"" subfolder"
X	Service Update Client	svcupdcli.exe	"Added by an unidentified WORM or TROJAN! See here"
X	ServiceHost	svch0st.exe	"Added by the VB.HE VIRUS!"
X	ServiceHst	svcnost.exe	"Added by the AGOBOT-RS WORM!"
X	services	Svchosts.exe	"Added by the SDBOT-N TROJAN!"
X	Services	svchost.exe	"Added by the REPER-B WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Services Administrator	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Administrator	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Services Host	svchost32.exe	"Added by the AGOBOT-TG WORM!"
X	Services host	svchost.com	"Added by the RBOT-EU WORM!"
X	Services Managers	svcmanager.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	SES Service	sesvc.exe	"Added by the SDBOT-CZU WORM!"
X	Setup experation	svchost.exe	"Added by the TOFGER-AW TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	SheduIer	svchst.exe	Premium rate adult content dialler
X	Shell	Explorer.exe svchost.exe	"Added by the DOYORG BACKDOOR! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The legitimate svchost.exe process is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Shell	svchost.exe	"Added by the GOLDSPY-B TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Shell API32	svcnet.exe	"Added by the TIBICK.C WORM!"
X	shoket	svchs0t.exe	"Added by the WOWPWS-E TROJAN!"
X	SiS Dns	dnssvc.exe	"Added by the DLOADER-UE TROJAN!"
X	SiS Mpc Service	mpcsvc.exe	"Added by the CIADOOR-CJ TROJAN!"
U	SMS Client Service	clisvc95.exe	"When the SMS Client service starts on a domain controller
X	SMSvc32	smsvc32.exe	"Added by the AGOBOT-OL WORM!"
X	SNP Generic Host Process	svchost.exe	"Added by the ZAPCHAS-O TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	Socket Utility	svchostz.exe	"Added by the DAEMONI-E TROJAN!"
X	Sound Volume	svchosI.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	sp2svc	sp2svc.exe	"Added by a variant of the RBOT WORM!"
X	SPOOL Configuration	spoolsvc.exe	"Added by the SDBOT-KD WORM!"
X	Spooler SubSystem App	spoolsvc.exe	"Added by the POEBOT-J WORM!"
X	Spooler SubSystem Application	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler Subsytem App	spoolsvc.exe	"Added by the SDBOT-MM WORM!"
X	spoolsv	svchost.exe	"Added by the DLOADER-FI TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\HELP"
X	spoolsvc	spoolsvc.exe	"Added by the DROPPER-AT TROJAN!"
Y	SR Agent	AGENTSVC.EXE	"Related to Secure Resolutions - desktop virus protection"
U	Srv32Win	Svchost.exe	"Realtime-Spy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	Srvce Pack Updte	svcpack.exe	"Added by a variant of the RBOT WORM!"
X	SSL	svchost.exe	"Added by an unidentified VIRUS
X	ssvchost	ssvchost.exe	"Added by the HELIOS.B TROJAN!"
X	Start It Upping	svchosets.exe	"Added by a variant of the RBOT WORM!"
X	Start Page	svcnt32.exe	"Homepage hijacker
X	Start Upping	SVCHOSTES.EXE	"Added by the RBOT-NB WORM!"
X	Start Uppings	svcchosts.exe	"Added by the SDBOT.VY WORM!"
X	Starting up	wvsvc.exe	"Added by the RBOT-NF WORM!"
X	startkey	svcmgr.exe	"Added by the HIPPER-B TROJAN!"
X	startkey	svchost32.exe	"Added by a variant of the SDBOT WORM!"
X	startkey	svchost.exe	"Added by the AGENT-FPL TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	STOPzilla Service	SZNTSVC.EXE	"StopZilla! - pop-up killer"
X	Svc	svc.exe	"ClientMan parasite variant"
U	SVC	svchost.exe	"ElfSpy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	svc	expseny.exe	"Added by the PWS-ANG TROJAN!"
X	SVC Service	svcinit.exe	"Added by the SINIT TROJAN!"
X	SVC Service	svcinit.exe	"CoolWebSearch parasite variant"
X	SVC Service	svcpack.exe	"CoolWebSearch Svcinit parasite variant"
X	SVC Service	svc32.pif	"Added by the RBOT-ASC WORM!"
X	SVC Socks	mstaskm.exe	"CoolWebSearch parasite variant"
X	svc32	svc32.exe	Identified as a variant of the Banker-EQC/DLoader.GPJI malware
X	svcdata.exe	svcdata.exe	"Added by the SPYBOT.ZIF WORM!"
X	Svced	Svced.exe	"Added by the DELF.F TROJAN!"
X	SvcH0st	msexploren.exe	"Added by the BACKDOOR-CGZ TROJAN!"
X	SvcH0st	SHCH.EXE	"Added by the BDOOR-EB BACKDOOR!"
X	SvcH0st	SVCHST.EXE	"Added by the BDOOR-EB BACKDOOR!"
X	SvcH0st	WINAGENT.EXE	"Added by the BDOOR-EB BACKDOOR!"
X	SVCH0ST	spoo1sv.exe	"Added by the VB-HF TROJAN!"
X	SVCH0ST	SVCH0ST.EXE	"Added by the VB-IK TROJAN! Note - the filename has the digit 0 rather then the uppercase ""o"""
X	SvcH0st	msnexploren.exe	"Added by the TACTSLAY.B TROJAN!"
X	SvcH0st	sdhch.exe	"Added by the TACTSLAY.B TROJAN!"
X	SVCH0ST.EXE	SVCH0ST.EXE	"Added by the BANCBAN-HT TROJAN!"
X	SVCH0TS	sp00lvs.exe	"Added by the LINEAGE-AZ TROJAN!"
X	svchast	svchast.exe	"Added by the LINEAGE-AV TROJAN!"
X	svchctrl	svchctrl.exe	"Added by the COBFINN TROJAN!"
X	svchos	svchos.exe	"Added by the EZIBOT-B TROJAN!"
X	svchosd	[path to trojan]	"Added by the BANCOS-BCX TROJAN!"
X	SVCHOSI	SVCHOSI.EXE	"Added by the VBBOT-AA WORM!"
X	SVCHOST	svchost.exe	"System1060 homepage hi-jacker. Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\System1060"
X	svchost	svchost.exe	"Added by many TROJANS amd WORMS
X	SVCHOST	mrowyekdc.exe	"Added by the GOTORM WORM!"
X	svchost	Svch0st.exe	"Added by the GRAYBIRD and GRAYBIRD.B TROJANS! Note - the filename has the digit 0 rather then the uppercase ""o"""
X	svchost	[path to trojan]	"Added by the HAZZER TROJAN!"
X	svchost	ADMAGIC.EXE	"Added by the SMIBAG WORM!"
X	Svchost	winhost.exe	"Added by the LOLAWEB.A TROJAN!"
X	Svchost	svchost.exe	"Added by the MOZE-A WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	SVCHOST	var.txt.exe	"Added by the LDPINCH.C TROJAN!"
X	Svchost	svchosl.pif	"Added by the INZAE.A or INZAE.B WORMS!"
X	svchost	[path] SETUP.EXE	"Added by the SETCLO WORM!"
X	SVCHOST	scvhost.exe	"Added by the MYTOB.E or MYTOB.G WORMS!"
X	SVCHOST	taskgmr.exe	"Added by the MYTOB.F or MYTOB.H WORMS!"
X	svchost	olehelp.exe	"Added by the BOOKMARKER.G TROJAN!"
X	SVCHOST	updater32.exe	"Added by the RANTS.A WORM!"
X	SVCHOST	SPOOLSV.EXE	"Added by the BAITAP-A WORM! Note - this is not the legitimate spoolsv.exe which is always located in %System%. This one is located in %Windir%"
X	SvcHost	svchost32.exe	"Added by the AGOBOT-TM WORM!"
X	svchost	svchost.exe	"Added by the BANCBAN-HL TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\config"
X	SVCHOST	MDM.EXE	"Added by the LCJUMP-A WORM! Note - this is not the legitimate Machine Debug Manager (mdm.exe) process which is located in %ProgramFiles%\Common Files\Microsoft Shared\VS7Debug (98/Me/XP/Vista) or %System% (Me only). This one is located in %Windir%"
X	svchost	[path to explorer.exe]	"Added by the UNREAL-A TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually!"
X	svchost	rundll16.exe	"Added by the STARTPA-PB TROJAN!"
X	Svchost	svchost.exe	"Added by the ADCLICK-AM TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Internet Explorer"
X	svchost	svchost.exe	"Added by the BDOOR-ES BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Microsoft"" subfolder"
X	svchost	svchost.exe	"Added by the DLOADER-EV TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%"
X	svchost	winhelp.exe	"Added by the GAOBOT.GEN!POLY WORM!"
X	Svchost	svchots.exe	"Added by the RBOT.ADK WORM!"
X	svchost	ying.exe	"Constructor VC2000 malware"
X	svchost	inetinfo.scr	"Added by the ODELUD WORM!"
X	SVCHOST	svchost64.exe	"Added by the STARTP-G TROJAN!"
X	svchost	svchost.com	"Added by the BANLOA-ABL TROJAN!"
X	svchost	win.exe	"Added by the VBSAUTO-A WORM!"
U	svchost	svchost.exe	"Infine Keylogger surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup. This one is located in an ""svc"" subfolder"
X	svchost	logon.exe	"Added by the SLEGON WORM!"
X	svchost	svcst.exe	"Added by the AGENT-LIL WORM!"
X	svchost	svchost.exe	"Added by the VB-EOK TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""MsDtds"" sub-directory"
X	svchost	windowsrx.exe	"Added by the AGOBOT-MZ WORM!"
X	SVCHOST	SERVlCES.EXE	"Added by the DELF-LF BACKDOOR! Note that the filename has a lower case ""L"" in place of an upper case ""i"""
X	svchost Agent	svchost.exe	"Added by the AUTORUN-DB WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""28463"" sub-folder"
X	svchost connection monitor	svchost32.exe	"Added by a variant of the SDBOT WORM!"
X	SVCHOST Generic application	svchost.exe	"Added by the DAEMONI-K TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	svchost Netware Manager	svchost.exe	"Added by the EXVID.A WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	SVCHost Protocol32	scvhost32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Svchost Service	svchost.exe	"Added by the VB-DVQ WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\help"
X	Svchost Windows Remote Services	svhost.exe	"Added by the IRCBOT-IV WORM!"
X	svchost.exe	svchost32.exe	"CoolWebSearch Svchost32 parasite variant"
X	SVCHOST.EXE	SVCHOST.EXE	"Added by the WRMSCAN-A TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	svchost.exe	[path to executeable]	"Added by the BANKER-MO TROJAN!"
X	svchost.exe	svchost.exe	"Added by the ZAPCHAS-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	svchost.exe	swchost.exe	"Added by the SADELPHI-A TROJAN!"
X	svchost.exe	svchost.exe	"Added by the VIRUT.CF WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""3361"" subfolder"
X	SVCHOST.EXE	svchost.exe	"Added by the SILLYFDC.BBI WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Conf"" sub-directory"
X	svchost.exe	svcnost.exe	"Added by the MISLEAD-A TROJAN!"
X	svchost1	svchost1.exe	"Added by the AGOBOT.ZZ WORM!"
X	SVCHost2	svchost2.exe	"Added by the RBOT.BLC WORM!"
X	SvcHost32	svchost32.exe	"Added by the MIMAIL.I or MIMAIL.J WORMS!"
X	svchost32.exe	svchost32.exe	"Added by the ASSASIN.20B BACKDOOR!"
X	svchost64	svchost64.exe	Added by the SDBOTER.G VIRUS!
X	svchosta	svchosta.exe	"Added by the SNIFFER-I TROJAN!"
X	svchostb	svchostb.exe	"Added by the SNIFFER-J TROJAN!"
X	SvcHostDHCP	svchost32.exe	"Added by the ASSASIN.20B BACKDOOR!"
X	svchostdll.scr	svchostdll.scr	"Added by the BANCBAN-FM TROJAN!"
X	SvcHosto	v1rg1n.exe	"Added by the AGOBOT-TK WORM!"
X	svchostr	svchostr.exe	Added by an unidentified WORM or TROJAN!
X	svchosts	svchosts.exe	"Added by the BANCBAN-DC or BANKER-ED TROJANS!"
X	Svchosts	SCVHOST.EXE	"Added by the AGOBOT-RQ BACKDOOR!"
X	svchosts.exe	svchosts.exe	"Added by the AGOBOT-JN WORM!"
X	svchosts.scr	svchosts.scr	"Added by the BANCBAN-DQ TROJAN and variants!"
X	SVCHOT	SVCHOT.exe	"Added by the QQROB-U TROJAN!"
X	svchst	svchst.exe	"Added by the KBROY-C TROJAN!"
X	svcinfo	svcinfo.exe	"Added by the CRYPTER.A TROJAN!"
X	Svclhost	svcchost.exe	Added by an unidentified WORM or TROJAN!
X	SvcManager	restore3.exe	"Added by the AGENT-DSS TROJAN!"
X	SvcManager	[path to trojan]	"Added by the ZALON-A BACKDOOR!"
X	SvcManager	mdmex2.exe	"Added by the ZALON-B BACKDOOR!"
U	svcmon	svcmon.exe	"PersonInspect surveillance software. Uninstall this software unless you put it there yourself"
X	Svcnost.exe	svcnost.exe	"Added by the SELEX.B WORM!"
X	Svconr	Svconr.exe	"WaveRevenue-lBann adware"
X	Svcphpwin	sslphp32.exe	"Added by the AGOBOT-ABR WORM!"
X	svcroot	svcroot.exe	"Added by the KEYLOG-AC TROJAN!"
X	svcroot	xffanl.exe	"Added by the AGENT-BMF TROJAN!"
X	svcshare	winampXP.exe	"Added by the FUJACKS-J VIRUS!"
X	svcshare	spoclsv.exe	"Added by the FUJACKS-A VIRUS!"
X	svcshare	CTMONTv.exe	"Added by the FUJACKS-AJ WORM!"
X	svcshare	nvscv32.exe	"Added by the FUJACKS-Z WORM!"
X	SvcSys	[path to file]	"Added by the BANCOS.Z TROJAN!"
X	Svcsys Registry Manager	svcsysreg.exe	"Detected by Kaspersky as the AGENT.CV TROJAN!"
X	svcsys32	svcsys32.exe	"Added by the AGOBOT-LL WORM!"
X	svctask	svctask.exe	"Added by the CHUCKYB-A TROJAN!"
X	svcwinprocess32	[path to worm]	"Added by the UPERING WORM!"
X	Svshost Update Service	svcbind.exe	"Added by the MYTOB.LH WORM!"
X	Sygate Personal Firewall	svchots.exe	"Added by the RBOT.ABT WORM!"
Y	Symantec Core LC	symlcsvc.exe	"Part of Norton AntiVirus 2004. What does it do?"
U	Symantec PIF AlertEng	PIFSvc.exe	"Symantec LiveUpdate Notice Service"
X	Symantec Security Addon	nvsvc.exe	"Added by a variant of the AGOBOT/GAOBOT WORM! Note - do NOT confuse with the legitimate NVIDIA Driver Helper Service file of the same name as described here"
X	SysEQ	svclgx32.exe	"Added by the IRCBOT-AC TROJAN!"
X	SysInit	svchost.exe	"Added by the STARTPA-BD TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files"
Y	SysPool	Mssvc.exe	"StealthDisk - hides folders
X	SysPool	MSSVC32.EXE	"Added by the BANCBAN-IO TROJAN!"
X	System	SVCHOST.EXE	"Added by the LDPINCH-AU TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System	svch�st.exe	"Added by the LDPINCH-BF TROJAN!"
X	system	svcr.exe	"Added by the SPYONE TROJAN!"
X	system configure	svchost.exe	"Added by the LINEAGE-C TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	System Document Application	winsvc32.exe	"Added by the SDBOT-VA WORM!"
X	System Efficiency Monitor	svchostx.exe	"Added by the KWBOT.E WORM!"
X	System Event Manager	secsvc.exe	"Added by the RBOT.BMY WORM!"
X	System File Drivers	nvsysvc32.exe	"Added by the AGOBOT.WJ WORM!"
X	System Host Service	svchost.exe	"Added by the CONE.F WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\tasks"
X	System Manager	svchost.exe	"Added by the BANKER-AE TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System Manager Updates	winsvc.exe	"Added by the AGOBOT.AEM WORM!"
X	System Power Managment	svcnost.exe	"Added by the DREF-I WORM!"
X	System Process	svchost.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System Restore	svcnet.exe	"Added by the TIBICK WORM!"
X	SYSTEM service helper	svchelper.exe	"Added by the MONKBD-A WORM!"
X	System Services	svcsenes.exe	"Added by a variant of the RBOT WORM!"
X	System Services	svcsenes32a.exe	"Added by the RBOT-AFG WORM!"
X	System Update2	svchost.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	System Updated	svchoes.exe	"Added by the RBOT-ASF WORM!"
X	System32	svchost.exe	"Added by the ZAPCHAS-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	SystemCheck	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	SystemDriverCheck	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	SystemDriverLoad	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	SystemReg	svchost.exe	"Added by the DEWIN.E BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Systems	svch0st.exe	"Added by the MYDOOM.BI WORM!"
X	Systems	spoolsvc.exe	"Added by the DLOADR-SW TROJAN!"
X	sys_up1	svchostsys.exe	"Added by the MULTIDR-FL TROJAN!"
U	SZMsgSvc.exe	SZMsgSvc.exe	"StopZilla! - pop-up killer"
X	Task Alert	cmosvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Task Commander	regsvc32.exe	"Added by the AGOBOT-RX WORM!"
X	Task Manager	svchost.exe	"Added by the SOHANA-P WORM! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Task Monitoring Service	svchost.exe	"Added by the CONE.D WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\tasks"
X	Task Scheduler Engine	schedsvc32.exe	"Added by the RBOT-ASJ WORM!"
X	Taskbar Service	taskbar.svc	Unidentified adware
X	Tcp Application Manager	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Tcp Application Manager	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	TCP Internet Services	TCPSVC32.EXE	"Added by the SPYBOT.X TROJAN!"
X	TCP Monitoring	LanNSvc.exe	"Added by the RANDEX.AAS WORM!"
X	tcpipsvc.exe	tcpipsvc.exe	"Added by the AGOBOT-PG WORM!"
U	THCS	svchost.exe	"AllMonitor surveillance software. Uninstall this software unless you put it there yourself. Note - this is not the svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup. This one is located in a ""drivers\imon"" subfolder"
N	TkBell.Exe	evntsvc.exe	"Application Scheduler installed along with RealOne Player. Once installed
N	TkBellExe	evntsvc.exe	"Application Scheduler installed along with RealOne Player. Once installed
X	Torrent Management Service	TMANAGESVC.EX	"Added by a variant of the IRCBOT TROJAN!"
U	TPHOTKEY	TPOSDSVC.exe	"Supports the hotkeys on IBM/Lenovo ThinkPad notebooks - displays the result of the using of function keys on the desktop screen. For example
U	TPOSDSVC	TPOSDSVC.exe	"Supports the hotkeys on IBM/Lenovo ThinkPad notebooks - displays the result of the using of function keys on the desktop screen. For example
U	TPOSDSVC.exe	TPOSDSVC.exe	"Supports the hotkeys on IBM/Lenovo ThinkPad notebooks - displays the result of the using of function keys on the desktop screen. For example
X	Trkwks	trkwksvc.exe	"Added by the IRCBOT.AW WORM!"
X	tsvcin	n20050308.exe	"Delfin Media Viewer adware related"
X	UltimateServices	ultsvcs.exe	"Added by the AGENT-LGT TROJAN!"
X	Universal USB Service	svchost32.exe	"Added by the KELVIR.R WORM!"
X	Update	svchost.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	updater	wisvc.exe	"Added by the ORSE-A TROJAN!"
X	UPNP	upnpsvc.exe	"Added by the CLOMP-B TROJAN!"
X	UPNPService	WinSVCservice.exe	"Added by the AGOBOT.UN WORM!"
Y	UrtSvcExe	Urt95Svc.exe	"""Cisco Secure URT is a virtual LAN (VLAN) assignment service that enhances LAN security by actively identifying and authenticating users and then associating them only to their specific network services and resources"""
X	USB controller	Svcmm32.exe	SvcMM backdoor parasite downloader
X	USB Host Service	usbsvc.exe	"Added by the RBOT-GG WORM!"
X	useful-soft	svchst.exe	"Added by the STARTPA-HH TROJAN!"
X	User Services	usersvc.exe	"Added by the REVCUSS.A TROJAN!"
X	User Services	usrsvc.exe	"Added by the IRCBOT.SN WORM!"
X	User Sharing Services	usnsvc.exe	"Added by a variant of the KOBOT-C WORM!"
X	usnsvc.exe	usnsvc.exe	"Added by the SPYBOT.AMD WORM!"
X	utasvc	"rundll32.exe utasvc.dll	start"
X	valuename	svchosts.exe	"Added by a variant of the SDBOT WORM!"
X	Vekio Startups	Pnksvc32.exe	"Added by the AGOBOT.AJG WORM!"
X	Video Driver	svchost.exe	"Added by an unidentified WORM or TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Video Process	netsvcs.exe	"Added by the AGOBOT.LH WORM!"
X	Video Process	Nivopsvc.exe	"Added by the AGOBOT-GT WORM!"
X	Video Process	Navapsvcc.exe	"Added by the SPYBOT-CW WORM!"
X	virtual-machine	svchosts.exe	"Added by the RBOT-US WORM!"
X	Volume Shadow Configuration	vbmsvc.exe	"Added by the SLENFBOT.DH WORM!"
X	Volume Shadow Manager	vbcsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
Y	WanMPSvc	WanMPSvc.exe	"An AOL component
X	WCPC	wintsvcc.exe	"PurityScan adware"
?	Webcam Go Sti Service Application	wbcgosvc.exe	"Control software for the portable Creative Webcam Go digital camera/PC web cam. What does it do and is it required?"
X	Win32 Driver	svchosts.exe	"Added by the FORBOT-FD WORM!"
X	Win32 Secure	msconfigsvc.exe	"Added by a variant of the SDBOT WORM!"
X	Win32 Svchosts Driver	svchosts.exe	"Added by the FORBOT-FO WORM!"
X	Win32 System Spool	spoolsvc.exe	"Added by the SDBOT.UK WORM!"
X	Win32 Update	svchosts.exe	"Added by a variant of the SDBOT WORM!"
X	win32 update service	svchostt.exe	"Added by a variant of the SDBOT WORM!"
X	Win32 USB2 Driver	svchosting.exe	"Added by the FORBOT-J or SDBOT.HU WORM!"
X	WinAmpAgent	svchst.exe	"Added by the BDOOR-EB BACKDOOR! Note - this is NOT the popular Winamp media player which has a different filename"
X	WinAntivirus	AVSVC.EXE	"Part of the WinAntiVirus Pro 2005 rogue security software when installed in Win98/Me - not recommended
U	WinAppLog	svchost.exe	"StingKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	WinDLL (svc.exe)	"rundll32.exe svc.exe	start"
X	WinDLL (svchost.dll)	"rundll32.exe svchost.dll	start"
X	window2	ssvchost.exe	"Added by the IRCBOT.H TROJAN!"
X	windows	svchost.exe	"Added by the SLOMIRC-A WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows .Net Manager	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows .Net Manager	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Audio Components	nncsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Audio Control	ppnsvc.exe	"Added by the HAM TROJAN!"
X	Windows Audio Layer	narsvc.exe	"Added by the IRCBOT.AFT BACKDOOR!"
X	Windows Audio Panel	nppsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Audio Startup	nndsvc.exe	"Added by the IRCBOT-AAE TROJAN!"
X	Windows Audio System	nndsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Computer Browser	bcwsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Console	wkssvc.exe	"Added by the SDBOT-DJX WORM!"
X	Windows Console Component	wrasvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Console Norms	wnbsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Console Source	wnbsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Database	wiinsvc.exe	"Added by the AGOBOT-RU WORM!"
X	Windows Default Configuration	svchost.exe	"Added by the DLOADER-U TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Windows DLL Services	winsvc32.exe	"Added by the RBOT-ZF WORM!"
X	Windows DLL Services	svchost.exe	"AGENT.H spyware. Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	Windows Driver Adapter	svchost.exe	"Added by the ANTINNY-K WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	Windows driver update	dmsvc32.exe	"Added by the SDBOT-GP BACKDOOR!"
X	Windows Event Detection	wecsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Event Provider	wposvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Event Section	sntsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Executer	svchostie.exe	"Added by the EGGDROP.V BACKDOOR!"
X	Windows FileSharing Service	mcwsvc.exe	"Added by the IRCBOT.AJF BACKDOOR!"
X	Windows Firewall	svchost.exe	"Added by the PROXY-HT TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Firewall Service	wfsvc.exe	"Added by the IRCBOT-YL WORM!"
X	Windows Generic Services	winsvc32.exe	"Added by the AGOBOT-ZF BACKDOOR!"
X	Windows Global Init	ngpsvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Help Manager	svchost32.exe	"Added by the RBOT-OZ WORM!"
X	Windows Host Device	hostsvc.exe	"Added by the ZOOTY-A WORM!"
X	Windows Host Service	svchoste.exe	"Added by the KELVIR.BF WORM!"
X	Windows Host Service	svchosts32.exe	"Added by the KELVIR.AW WORM!"
X	Windows Internet Manager	svchost.exe	"Added by the IRCBOT-AAC TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Local Services	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Local Services	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Logical Adapter	wsrsvc.exe	"Added by the IRCBOT.ARU BACKDOOR!"
X	Windows Logical Connection	wcnsvc.exe	"Added by the VIRUT.AO VIRUS!"
X	Windows Logon Procedure	Svchoste.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Logon Procedure	Svchosta.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Messanger Control Center	svchosl.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Messenger Connect	wmdsvc.exe	"Added by the SLENFBOT.S WORM!"
X	Windows Messenger Fileshare	wivsvc.exe	"Added by the SILLYIM WORM!"
X	Windows Messenger Panel	wbcsvc.exe	"Added by the IRCBOT.ADA BACKDOOR!"
X	Windows Messenger Share	wmssvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Messenger Starter	wmvsvc.exe	"Added by the DELF.DAX TROJAN!"
X	Windows Network Logon	npesvc.exe	"Added by the AGENT.ERZ TROJAN!"
X	Windows Network Session	nspsvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows NT Service Name	svchcst.exe	"Added by the RBOT-NV WORM!"
X	Windows Protected Storage	npssvc.exe	"Added by the IRCBOT.AUL BACKDOOR!"
X	Windows Registry Scan	svcdll.exe	"Added by the RBOT-TP WORM!"
X	Windows Security Manager	svchost.exe	"Added by the ANTINNY.AX WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Microsoft"" subfolder"
X	Windows Security Survy	svchosl.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Service	WINSVC.EXE	"Added by the SPYBOT-DH TROJAN!"
X	Windows Service	svchost.exe	"Added by the SPYBOT-AW TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	Windows Service Host	svchost.exe	"Added by the CONE.B WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Service Host	svchost.exe	"Added by the KALEL-C WORM! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	Windows Service Management	svcmngmt.exe	"Added by the AGOBOT-NM WORM!"
X	Windows Service Manager	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	svcmgr32.exe	"Added by the OSCABOT-D WORM!"
X	Windows Service Manager	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Service Manager	initsvc.exe	"Added by the RBOT-BWT WORM!"
X	Windows Service Pack2	svchhost.exe	"Added by a variant of the RBOT WORM!"
X	Windows Service Threads	svcthreading.exe	"Added by the SHEUR.AUM TROJAN!"
X	Windows Service Threads	svcthreads.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services	svchosts.exe	"Added by the AGOBOT-KL TROJAN!"
X	Windows Services	winsvc32.exe	"Added by the MYTOB-CB WORM!"
X	Windows Services	spoolsvc.exe	"Added by the SDBOT.CPZ WORM!"
X	Windows Services B-Runner	svcbrun.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services B-Runner	svcbrunner.exe	"Added by the IRCBOT.BYV BACKDOOR!"
X	Windows Services Certification	svccert.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services Guide	svcguide.exe	"Added by the SLENFBOT.KQ WORM!"
X	Windows Services Guide	svcguides.exe	"Added by the SHEUR.YS BACKDOOR!"
X	Windows Services Host	svchost.exe	"Added by the CONE or CONE.E WORMS! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	Windows Services Jog	svcjog.exe	"Added by the AGENT.ALWZ WORM!"
X	Windows Services Jog	svcjogg.exe	"Added by the AGENT.QAF WORM!"
X	Windows Services Joger	svcjoger.exe	"Added by the RBOT.CAT WORM!"
X	Windows Services Jogging	svcjogging.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services Joging	svcjoging.exe	"Added by the IRCBOT.AVI BACKDOOR!"
X	Windows Services Tower	svctowers.exe	"Added by the IRCBOT.AGJ BACKDOOR!"
X	Windows Services Tower	svctowing.exe	"Added by the SLENFBOT.LA WORM!"
X	Windows Services Update	svch0st.exe	"Added by a variant of the RBOT WORM! Note - the filename has the digit 0 rather then the uppercase ""o"""
X	Windows Stortup	svchost.exe	"Added by the TOGER-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	WINDOWS SVC	winsvc.exe	"Added by the MYTOB-EY WORM!"
X	Windows svchost	avserv.exe	"Added by the PUSHBOT.FM WORM!"
X	Windows svchost	ctfmon32.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows svchost	happy2008.exe	"Added by the PUSHBOT.AM WORM!"
X	Windows svchost	service.exe	"Added by the PUSHBOT.DU WORM!"
X	Windows svchost	serviceaaa.exe	"Added by the PUSHBOT.ER WORM!"
X	Windows svchost	servicean.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows svchost	svchost.exe	"Added by the IRCBOT-ZQ WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows svchost	ups.exe	"Added by the PUSHBOT.A WORM!"
X	Windows svchost	upss.exe	"Added by the PUSHBOT.GJ WORM!"
X	Windows svchost	serviceam.exe	"Added by the PUSHBOT.EY WORM!"
X	Windows svchost	svchostx.exe	"Added by the PUSHBOT.CC WORM!"
X	Windows Svchost Authority	slsass.exe	"Added by the RBOT-UA WORM!"
X	Windows Svshost Service Update 32	svcsshost32.exe	"Added by the FORBOT-GD WORM!"
X	WINDOWS SYSTEM	winsvc32.exe	"Added by the MYTOB.HH WORM!"
X	WINDOWS SYSTEM	winsvc.exe	"Added by the MYTOB.LM WORM!"
X	WINDOWS SYSTEM	svchost2.exe	"Added by the MYTOB.OZ WORM!"
X	WINDOWS SYSTEM MANAGER	spoolsvc.exe	"Added by the MYTOB-LY WORM!"
X	Windows Taskmanager	svchost.exe	"Added by the IMBOT.AC WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Taskmanager	wdtsvc.exe	"Added by the PUSHBOT.AU WORM!"
X	Windows Terminal Manager	rmbsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Tracking Client	ctwsvc.exe	"Added by the AGENT-GMB TROJAN!"
X	Windows UDP Control Center	wksvcsc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows UDP Control Services	wksvcsc.exe	"Added by the ANTIAV-C TROJAN!"
X	Windows Update	svchosts.exe	"Added by the FRUCTA TROJAN!"
X	Windows Update	usnsvc.exe	"Added by the KOBOT-C WORM!"
X	Windows Update Host	winupsvc.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update services	wins32svcs.exe	"Added by a variant of the RBOT WORM!"
X	Windows Update Svc	rundll32.exe xpupdate.dll	"ContraVirus rogue security software - not recommended
X	Windows USB v3	wsvc.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Video Acquisition (WVA)	wvsvc.exe	"Added by the AGOBOT.YM WORM!"
X	Windows Video Component	wvcsvc.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Video Input	viwsvc.exe	"Added by the SLENFBOT.GS WORM!"
X	Windows Virus Scanner	winvsvc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Volume Control	ongsvc.exe	"Added by the SLENFBOT.DZ WORM!"
X	Windows Web Services	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Web Services	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Windows Workstation Service	wkssvc.exe	"Added by the IRCBOT-AAI WORM!"
X	Windows Workstation Service (32-bits)	wkssvc32.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Xp Service Pack 2	svchost.exe	"Added by the XPLOS-A TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	WindowsDiskEvt	svcsvh32.exe	"Added by the NANINF.D TROJAN!"
X	WindowsExplorer	svchost.exe	"Messenger Blocker rogue security software - not recommended. Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\System"
X	WindowsFirewallSvc	winsvcup.exe	"Added by a variant of the SDBOT WORM!"
X	WindowsIPRelay	winipsvc.exe	"Added by the IRCBOT-AAA WORM!"
X	WindowsRegKey update	svchoosts.exe	"Added by the RBOT.ADB WORM!"
X	WindowsRegKey update	svchostc.exe	"Added by the RBOT.IF WORM!"
X	WindowsServicesStartup	svchost.exe	"Added by the ECUP WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
X	WindowsSystem32	svchosts.exe	"Added by the AGENT-EDA TROJAN!"
X	WindowsUpdate	svchost.exe	"Added by the ASTEF or RESPAN WORMS or AGENT-V TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	WindowsUpdate	svchost.exe	"Added by the BDOOR-IK BACKDOOR! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	WindowsUpdate	svchostw.exe	"Added by the COBFINN_B TROJAN!"
X	WindowsUpdatem2	svchost.exe	"Added by an unidentified WORM or TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	WindowsUpdatesvchostss	svchostss.exe	"Added by the AGENT-HZ TROJAN!"
X	WindowsXPserv	svcnxp32.exe	"Addee by the NANINF-A TROJAN!"
X	windtbs	winsysvc	"Added by the AGOBOT-NH WORM!"
X	winimage	wvsvc.exe	"Added by the RBOT.TX WORM!"
X	Winlogon Shell	Explorer.exe svchost.exe	"Added by the KIPIS.M WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""1032"" sub-folder"
X	winnsvc	msvc.exe	"Added by the PWS.O TROJAN!"
X	winreg_32	svchosst.exe	"Added by the BANCOS-CE TROJAN!"
X	WINRUN	svchost32.exe	"Added by the MYTOB-AI WORM!"
X	winservice	svchost.exe	"Added by the CVK BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""services"" sub-folder"
U	WinService32	svchost.exe	"007 Spy Software - ""stealthy monitoring program which allows you to secretly track all activities of computer users and automatically deliver logs to you via Email or FTP"""
X	winsock	svch0st.exe	"Added by the SAGE-A WORM! Note - the filename has the digit 0 rather then the uppercase ""o"""
X	Winsock2 driver	svchorsst.exe	"Added by the SPYBOT-EE WORM!"
X	Winsock32driver	svchhost.exe	"Added by the HACKARMY.I TROJAN!"
X	WinSvc16.exe	WinSvc16.exe	"Added by the SDBOT.FQ TROJAN!"
X	winsvc32	winsvc32.exe	"Added by the IRCBOT-AEG WORM!"
X	winsvc32.exe	winsvc32.exe	"Added by the GREPAGE TROJAN!"
X	WinUp	svchost.exe	"Added by the SILLY.BR WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This file is located in a ""4350"" sub-folder"
X	WinUpdate	svchots.exe	"Added by the SMALL.GXJ TROJAN!"
X	Winupdatee	winsvcc.exe	"Added by the AGENT.AN TROJAN!"
X	Win_Library	INISvc.exe	"Added by the ANARCH WORM!"
X	WksSVC	EXPLORER.exe	"Added by the MYTOB-BW WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	wlinles	svchost.exe	"Added by the LIJI-A WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in the ""spool"" sub-folder"
X	WN Services	wnsvc.exe	"Added by the KBBOT-A TROJAN!"
X	wnddrv	svchost.exe	"Added by an unidentified TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	WPSVC Services	wpnsc.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	ws2 32	svchst.exe	"Added by the VOKEN-A TROJAN!"
X	WSAConfiguration	svchostt.exe	"Added by the AGOBOT.ZT WORM!"
X	WSAConfiguration	csrsvcs.exe	"Added by the AGOBOT.VI WORM!"
X	WSAConfiguration	svchostx.exe	"Added by the AGOBOT-JV BACKDOOR!"
X	wscsvc.exe	wscsvc.exe	"Added by a password stealing BANKER TROJAN!"
X	wscsvc32.exe	wscsvc32.exe	"Antivirus rogue security software - not recommended
X	wsock32	svchost.exe	"Added by the HORST-A WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	WSSVC	smsc.exe	"Added by the AUTORUN-AGA WORM!"
X	WSVCHO	svhost.exe	"Added by the SPYBOT-OQ WORM!"
U	WSVCS	SERVICES.EXE	"WSLogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	WTSC	wapisvcc.exe	"PurityScan adware"
X	WudfSvc	WudfSvc.exe	"Added by the SHEUR.BBB TROJAN!"
X	wupd	symcsvc.exe	"Added by the ABWIZ.C TROJAN!"
X	wupdate	wisvccz.exe	"Added by the ORSE-B TROJAN!"
Y	WUSB54GS	InvokeSvc3.exe	Wireless-G USB Wireless Network Adapter related - would appear to be required
Y	WUSB54Gv2	InvokeSvc3.exe	Wireless-G USB Wireless Network Adapter related - would appear to be required
X	xor	svchost.exe	"Added by the XORDOOR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""xor"" subfolder"
X	Yahoo Messenger	svchost32.exe	"Added by the SOHANA-P WORM!"
U	Zcfgsvc	ZCfgSvc.exe	"Zero Config MFC Application
U	ZCfgSvc.exe	ZCfgSvc.exe	"Zero Config MFC Application
X	Zekio Startups	znksvc32.exe	"Added by the AGOBOT-AGI WORM!"
X	ZNN	znnsvc.exe	"Added by the SDBOT-DAA WORM!"
X	Zone Labs Client Ex	svchost.exe	"Added by the NETSKY.F WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	zSecurity Service	szsvc.exe	"Added by the SDBOT-DAB WORM!"
X	zztp	svchost.exe	"Added by the TANNICK.B TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	[filename]	svchost.scr	"Added by the BANKER-CC TROJAN!"
X	[original filename]	svchost.scr	"Added by the BANCBAN-CX TROJAN!"
X	[random name]	svchost.exe	"Added by the BANCBAN-JC TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\config"
X	[random]	svchost.scr	"Added by the BANCBAN-CY TROJAN!"
X	[trojan name]	svchost.exe	"Added by the BANCBAN-CI TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	[various names]	svchostss.exe	"Added by a variant of the RBOT WORM!"
X	_svchost.con	svchost.com	"Added by the ERKEZ.C WORM!"
X	_System_Run	_svchost_.exe	"Added by the LINEAGE-Z TROJAN!"
X	{357AA41A-B7A8-4632-A27D-5B980B25CF43}	[path to svchost.exe]	"Added by the SMALL-AQ TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.