NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

• "Y" - Normally leave to run at start-up
• "N" - Not required - typically infrequently used tasks that can be started manually if necessary
• "U" - User's choice - depends whether a user deems it necessary
• "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
• "?" - Unknown

	Startup Name	Process Name	Details
X		system32.exe	"Added by the AGOBOT-KU WORM! Note - has a blank entry under the Startup Item/Name field"
Inc."	"Miramar Systems	U	atmsg.exe
X	$sys$cmp	$sys$xp.exe	"Added by the RYKNOS.B TROJAN! Attempts to utilize the Sony Rootkit A.K.A. SecurityRisk.First4DRM security risk to hide itself on the compromised computer"
X	$sys$crash	$sys$sonyTimer.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$crash	$sys$sos$sys$.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$crash	$sys$WeLoveMcCOL.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$drv	$sys$drv.exe	"Added by the RYKNOS TROJAN! Attempts to utilize the Sony Rootkit A.K.A. SecurityRisk.First4DRM security risk to hide itself on the compromised computer"
X	$sys$momomomochin	$sys$sonyTimer.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$momomomochin	$sys$sos$sys$.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$momomomochin	$sys$WeLoveMcCOL.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$umaiyo	$sys$sonyTimer.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$umaiyo	$sys$sos$sys$.exe	"Added by the WELOMOCH TROJAN!"
X	$sys$umaiyo	$sys$WeLoveMcCOL.exe	"Added by the WELOMOCH TROJAN!"
X	(Default)	Systrsy.exe	"Added by the CDTRAY TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	(Default)	syspol.exe	"Added by the DREMN-B TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKCU\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	*WindowsAudio	systemupd.exe	"Added by the AGENT-TH WORM!"
?	.NET config	sysmon32.exe	"??"
U	00THotkey	system32THotkey.exe	"For Toshiba Satellite notebook series to use the front buttons
X	1029BB4B-16A9-4E77-AA3D-96930BD68EEC	sysockeu.exe	"Added by the FAKEALERT-AH TROJAN!"
X	1234klsjdc uiar924c af	sysvtypkbjx.exe	"Added by the FAKEALERT-AM TROJAN!"
X	2177F056-0AA6-4D6C-A944-13F71F341C29	sysokuaw.exe	"Added by the FAKEALERT-AH TROJAN!"
U	2wSysTray	2portalmon.exe	"2Wire Homeportal user interface"
X	756349DC-6D9E-4F2A-9B24-269661F073C3	sysoghcx.exe	"Added by the FAKEALERT-AH TROJAN!"
X	7X29C2X78Y	syss_.exe	"Added by the AGENT-GMS TROJAN!"
X	852EBF20-A95D-4F1F-B9C2-B2CD24350F3E	sysodkcs.exe	"Added by the FAKEALERT-AH TROJAN!"
X	@	sysload.exe	"Added by the DELF-EL TROJAN!"
X	@	winsys32.exe	"Added by the DELF.CP BACKDOOR! Note that the entry under the Startup Item/Name field my be blank"
X	AAMSFree702	sys.exe	Added by the BACKDOOR-CPC TROJAN!
Y	AccelerometerSysTrayApplet	AccelerometerSt.exe	HP 3D DriveGuard uses a digital accelerometer protects your disk drive by parking and halting I/O requests if you drop your PC or if you move your PC with the display lid closed
?	Acer Empowering Technology Monitor	SysMonitor.exe	"Part of Acer Empowering Technology. What does it do and is it required?"
X	ActiveDesktop	systray32.exe	"Added by the DABOOM WORM!"
X	AdminSoft	sysfile.vbs	"Added by the STARGRUB-A WORM!"
X	Adobe	sysconfig.exe	Added by an unidentified WORM or TROJAN!
X	Adobe	sysbat32.exe	"Added by the LOWZONES.T TROJAN!"
X	AdobeReaderPros	sysmsn.exe	"Added by the RBOT-BGH WORM!"
?	ADSLSYSTEMTRAY	SystemtrayV100B.exe	"Apparently Annex A ADSL modem related. What does it do and is it required?"
X	AdUpdater	sysupudt.exe	Unidentified adware downloader/updater
X	Advanced Protection System	advpsys.exe	"Added by a variant of the RBOT WORM!"
U	Advanced SystemCare 3	AWC.exe	"Advanced SystemCare from IObit - ""helps protect
N	AGEIA PhysX SysTray	TrayIcon.exe	"System Tray access to display properties for AGEIA PhysX graphics cards. Unless you change your desktop resolution
X	Agent	alsys.exe	"Added by the DREF-V VIRUS!"
X	AhorreMemoria	SysRep.exe	"AhorreMemoria rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
X	Alive SYstem	scchost.exe	"Added by the TOFDROP-B TROJAN!"
X	Alive SYstem	scchostc.exe	"Added by the TOFDROP-B TROJAN!"
X	aouei	sysrtmvs.exe	"Chivio dialer"
X	ApPache System	ApPache.exe	"Added by the RBOT-YP BACKDOOR!"
X	Application In System	Snxmsh.exe	"Added by the AGENT-LNV TROJAN!"
N	ATI CATALYST System Tray	CLI.exe SystemTray	"System Tray access to ATI's Catalyst™ Control Center. Note that this has ""SystemTray"" appended to CLI.exe in the ""Command"" column of MSCONFIG. Not required to run the control center - which is available via a right-click on the desktop"
X	AttuneSystray	attune_st.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	aupd	sysvcs.exe	"Added by the ABWIZ.C TROJAN!"
X	Auto File System Conversion Utility	scricon.exe	"Added by the SDBOT.EYB WORM!"
X	auto repair system	qualityx.exe	"Added by an unidentified WORM or TROJAN - probably a SPYBOT variant"
X	Auto Updat	WindowsSys32.exe	"Added by a variant of the FORBOT WORM!"
X	Auto updat	SysDebug.exe	"Added by the FORBOT-BA WORM!"
U	AutoSys	autosys.exe	"Winguardian surveillance software. Uninstall this software unless you put it there yourself"
Y	AVG Anti-Virus system	avgcc.exe	"System Tray access to and notifications for the 7.* series of anti-virus products from AVG Technologies. If this entry is disabled
Y	AVG Anti-Virus System	avgemc.exe	"E-mail scanner for the 7.* series of anti-virus products from AVG Technologies. This process scans incoming and outgoing E-mails for viruses and other malware. From version 7.1 onwards this entry only appears in 9x/Me as a startup entry
Y	AVG Anti-Virus System	avgw.exe	"This entry is included with the 7.* series of anti-virus products from AVG Technologies. Once installed (or on first run for a different user) it runs the configuration sequence to set up the product and doesn't run on subsequent restarts"
X	avnort	formatsys.exe	"Added by the SERFLOG.A WORM!"
X	AvSer	sysup.exe	"Added by the SERFLOG.B WORM!"
X	AVSystemCare	pgs.exe	"AVSystemCare rogue security software - not recommended. There are number of variants in this family sharing the same filename and user interface - see here"
U	AXIS Print System DriverScanner	DriverScanner.exe	"Part of AXIS Print System from AXIS Communications - ""adds printer discovery
U	AXIS Print System DriverServer	DriverServer.exe	"Part of AXIS Print System from AXIS Communications - ""adds printer discovery
U	AXIS Print System TrayIcon	TrayIcon.exe	"System Tray access to AXIS Print System from AXIS Communications - ""adds printer discovery
X	bal	SYSMONMS.EXE	"Added by the FAKEALERT TROJAN!"
N	bbSysTray	bbSysTray.exe	"Philips CD-RW related - ""the 'Blue Button' feature gives users the chance to receive convenient online support for their possible device problems or questions"""
X	Bcvsrv32	system2.exe	"Added by the AGOBOT-PU BACKDOOR!"
U	beidsystemtray	beidsystemtray.exe	"Related to Belgium Identity Card card reader"
X	BeschermingsTool	SysRep.exe	"BeschermingsTool
X	BeSys	[path to file]	"BeSys adware"
X	blah service	winsysengine.exe	"Added by the RBOT-KI WORM!"
X	blah service	evosys.exe	"Added by a variant of the RBOT WORM!"
X	Blocker System611 Monitoring	PopUpBlocker611.exe	"Added by the RBOT.BLJ WORM!"
X	boler.exe	syser.exe	"Added by the RBOT-AYS WORM!"
X	BugsDestroyer	SysRep.exe	"BugsDestroyer rogue system error and cleaning utility - not recommended
X	C:WINDOWSsystem32SetupCmd.exe	SetupCmd.exe	"Detected by Kaspersky as the AGENT.AAW TROJAN!"
X	Call Function System32	sddriver.exe	"Added by a variant of the SDBOT TROJAN!"
U	ChicoSys	webtmr.exe	"Child Control parental control software"
X	Ci Servs	SysTuwin.exe	"Added by the AGENT-NIQ TROJAN!"
X	Cisco Systems	[path to worm]	"Added by the AUTORUN.UHR WORM!"
U	Cisco Systems VPN Client	ipsecdialer.exe	"Cisco VPN Client - lets local users gain Administrator privileges on the operating system"
U	Cisco Systems VPN Client	vpngui.exe	"Sets up IPSec communications for Cisco's VPN Client"
X	CleanPCTool	SysRep.exe	"CleanPCTool rogue system error and cleaning utility - not recommended
X	CleanupTool	SysRep.exe	"CleanupTool rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
X	CmeSYS	CMEsys.exe	"Part of Gator advertising spyware - see here for removal instructions. Please note that Claria Corporation no longer support GAIN-Supported software - see here"
X	Cmmon32Sys	cmmon32.exe	Added by the SMALL.CL TROJAN!
X	cmsound	vcsystem.exe	"Added by the TCXMEDI-D downloader TROJAN!"
X	cmss	system.exe	"Added by a variant of the RBOT WORM!"
X	cmssSystemProcess	csmss.exe	"Added by the AGENT-CO TROJAN!"
X	cmssSystemProcess	mcsmss.exe	"Added by the PROXYSER-F TROJAN!"
X	cmssSystemProcess	csms.exe	"Added by the AGENT-Y TROJAN!"
X	CMSystem	CMSystem.exe	"CASClient adware"
X	Coldlife -icmp	Systray.exe	"Added by the FLOOD.AV TROJAN! Note - this is not the legitimate systray.exe process"
X	COM+ Event System	DRWTSN16.EXE	"Added by the LOVGATE.AB WORM!"
X	COM+ EventSystem Services	ECSERVER.EXE	"Added by a variant of the SDBOT WORM!"
X	Com+ Sys	csrs.exe	"Added by the FORBOT-BT WORM!"
X	COM+ System Application	lsas.exe	"Added by the AGOBOT-MO WORM!"
X	COM+ System Applications	lsas.exe	"Added by the AGOBOT.SE WORM!"
X	COM++ System	exploier.exe	"Added by the LOVGATE.Z WORM!"
X	COM++ System	suchost.exe	"Added by the LOVGATE-F WORM!"
X	COM++ System	svchost.exe...	"Added by a variant of the LOVGATE WORM!"
X	Command	system.exe	"Added by the GATECRASH.A or GATECRASH.B TROJANS!"
X	Compaq Service Drivers	systeminfos.exe	"Added by the SDBOT-XC WORM!"
X	Compaq Service Drivers	NtKernelSystem.exe	"Added by a variant of the SDBOT WORM!"
X	Compaq Service Drivers	ntsys32.exe	"Added by the RBOT.CIW WORM!"
N	CompaqSystray	cpqpscp.exe	Compaq System Tray icon
X	Config Loader	sysldr32.exe	"Added by the GAOBOT WORM!"
X	Config Loader	SYSMGR.EXE	"Added by the AGOBOT.C WORM!"
X	Config Loadr	winsys32.exe	"Added by the AGOBOT-HN WORM!"
X	Configuration	ntsys32.exe	"Added by the SDBOT-LN WORM!"
X	Configuration Loader	syscfg32.exe	"Added by the SDBOT.B BACKDOOR!"
X	Configuration Loader	System.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	sysinfo.exe	"Added by the GAOBOT.FQ WORM!"
X	Configuration Loader	systemry.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Configuration Loader	WinSys32ys.exe	"Added by the SDBOT.BCS WORM!"
X	Configuration Loader Service	Winsys32.exe	"Added by the RBOT-YV WORM!"
X	ConfLoader	sysconf16.exe	"Added by the SDBOT-FB TROJAN!"
X	Connector	SYS.EXE	"Nunci premium rate dialer"
X	Content List Management Subsystem	clmss.exe	"Added by the SPYBOT-EL WORM!"
X	Control Panel	System.exe	"Added by the DANI TROJAN!"
X	Controlled Resource System Service	crss.exe	"Added by the AGOBOT.GH WORM!"
X	ControlPanel	"systemctrl.exe internet.dll	LoadNetworkProfile"
X	Core System Hardware	syscorehd.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
?	CORESYS	coresys.exe	"??"
X	Creates stractures for system management	stacture.exe	"Added by the SDBOT-DHS WORM!"
X	CrisysTec Sentry	Sentry.exe	"CrisysTec Sentry rogue privacy program - not recommended"
X	CRSSXP SysInfo	crssxp.exe	"Added by a variant of the SDBOT TROJAN!"
X	CTFMON	wscript.exe /E:vbs regedit.sys	"Added by the VBSAUTO-A WORM! Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted. The ""regedit.sys"" file is located in %System%"
X	Ctfmon	wmisys.exe	"Added by the IRCBOT-ADS WORM!"
U	CTsysVol	CTSYSVOL.exe	Creative sound card volume controls
X	cvmsyslpd	sdservss.exe	"Added by the MAILBOT-BY TROJAN!"
X	D SYSTEM	dd.exe	"Added by the MYTOB-FN WORM!"
X	Data	System.dat.vbs	"Added by the BISCUIT.A WORM!"
X	Dcom System Patch	Microsoft.exe	"Added by the RANDEX.MS WORM!"
X	Default System Research	vhchost.exe	"Added by the TARNO.I TROJAN!"
X	defragsys	svchost.exe	"Added by the BIFROSE-TH TROJAN! Note - this is not the legitimate svchost.exe process which should normally figure in Msconfig/Startup!"
X	Device IO System	deviceio.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Device Management	wnsystem.exe	"Added by the AGOBOT-LH WORM!"
N	DiskeeperSystray	DkIcon.exe	"DisKeeper defragmentation software - can be started manually"
X	DiskRetter	SysRep.exe	"DiskRetter
X	Distributed File System	Dfsvc.exe	"Added by the MYFIP.A or MYFIP.K WORMS!"
X	Distributed File System	kernel32dll.exe	"Added by the MYFIP-C or MYFIP.K WORMS!"
X	Distributed File System	blade.exe	"Added by the MYFIP.AC WORM!"
X	Distributed File System	win.exe	"Added by the MYFIP.AB WORM!"
U	DLink System Tray	dlnetst.exe	"Related to D-Link DGE-530T PCI card for servers and workstations"
X	DokterFix	SysRep.exe	"DokterFix
X	DrefIW	SysDrefIWv2.exe	"Added by the DREF-C WORM!"
X	DrefIW	SysDref.exe	"Added by the DREF-D WORM!"
X	DriverPath	system32.exe	"Added by the PRORAT-S TROJAN!"
X	DriveSystem	maxpaynowti1.exe	"Added by the TIBS.AZT TROJAN!"
X	drvsys.exe	drvsys.exe	"Added by the BEAGLE.W WORM!"
X	drvsyskit	hidr.exe	"Added by the BAGLE.HR WORM!"
X	drvsyskit	hldrrr.exe	"Added by the BAGLE.QU TROJAN!"
X	DsmSer	sysup.exe	"Added by the SERFLOG.B WORM!"
X	dstiosys	plsitctl.exe	"Added by the MAILBOT-BX TROJAN!"
X	DSystemDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
X	Dx	sys*.exe [* = random number]	"Added by the DEXTER.A WORM!"
U	eanth_critical_update_alert	sys_alert.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
U	eanth_system_patcher	sys_alert.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
U	EasyLinkAdvisor	LinksysAgent.exe	"Linksys EasyLink Advisor - ""the free application that provides and easy way to setup
X	EasySearchBar	ESBUpdate.exe	EasySearchBar adware downloader
X	easyServ	Server.exe	"Added by the EASYSERV TROJAN!"
X	EasySpywareCleaner	EasySpywareCleaner.exe	"EasySpywareCleaner rogue spyware remover - not recommended
U	EasySync Pro	XCPCMenu.exe	"""IBM® Lotus® EasySync® Pro is a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - 3CmPlm	AutoDet.exe	"3Com Palm PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - LtNts4	NtsAgent.exe	"Lotus Notes 4 specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - PocketPC	AUTODE~1.EXE	"Windows Mobile Pocket PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
U	EasySync Pro - PocketPC	AutoDetect.exe	"Windows Mobile Pocket PC specific translator for IBM® Lotus® EasySync® Pro - ""a personal productivity solution that provides data synchronization between your IBM Lotus Notes® desktop and handheld devices running PalmOS and Windows CE/Pocket PC operating systems"""
N	eMusicClient Systray	eMusicClient.exe	"eMusic MP3 download software"
X	Enumerate Service	wsys.exe	"Added by the MANIFEST TROJAN!"
X	ErrClean	SysRep.exe	"ErrClean rogue system error and cleaning utility - not recommended. There are number of variants in this family sharing the same filename and user interface - see here"
X	ErreurChasseur	SysRep.exe	"ErreurChasseur
?	ESSNDSYS	ESSNDSYS.EXE	"Related to an ESS based soundacard. Is it required?"
X	EXPLORER	sys.exe	"Added by the SILLYFDC-A TROJAN!"
X	explorer	system.exe	"Added by the AGENT-FI TROJAN!"
X	EXPLORER MICROSOFT SYSTEM	explore.exe	"Added by a variant of the RBOT WORM!"
N	Extender Resource Monitor	RMSysTry.exe	"Related to Windows Media Center from Microsoft"
X	FDD SYSTEM	Fdd.exe	"Added by the MYTOB-FO WORM!"
X	FestPlattenCleaner	SysRep.exe	"FestPlattenCleaner
X	File System	taskmqrs.exe	"Added by a variant of the TOXBOT/CODBOT WORM!"
X	File System	taskmqr.exe	"Added by the RBOT.BWQ WORM!"
X	File System Service	wmiprvsc.exe	"Added by the AGOBOT-HZ TROJAN!"
X	Firewall Controls	sys32.exe	"Added by the SDBOT-DGI WORM!"
X	Firewall Sp2 system	sys32Conf.exe	"Added by the RBOT-ABT WORM!"
X	Firewall Update System1	WinedowsUpdater1.exe	"Added by the RBOT-ARU WORM!"
N	fkSysMon	fksysmon.exe	"fkWrae SysMon - system monitor - ""displays the current memory consumption
N	FoneSyncSystemTray	FoneSyncSystemTray.exe	System Tray icon for Nokia FoneSync utility for the 7160/7190 mobiles. Useful to send data from/to the cell phone and the computer. You can use it to backup data or even to input data through the computer keyboard (which naturally is much more comfortable). Run manually when required
X	Gate Personal Firewall	Systpl.exe	"Added by the RBOT.ADC WORM"
X	Generic Host Process2 System Backup	scvhost2.exe	"Added by the RBOT-BAH WORM!"
X	Generic Host Process326a System Backup	scvhost326a.exe	"Added by a variant of the SDBOT WORM!"
X	german.exe	winsystems.exe	"Added by the BAGLEDl-AE TROJAN!"
X	Gestionnaire de disques universel	sysoobe.exe	"Added by the TOADER-A TROJAN!"
?	GrdSys32	GrdSys32.exe	"X-Stream ISP software. Offers free Net access funded by on-screen ads. Is it required or can you create your own dial-up networking connection to use on demand?"
X	gwiz	ntsystem.exe	"Added by the NITWIZ.A TROJAN!"
X	HardDriveGuard	SysRep.exe	"HardDriveGuard rogue system error and cleaning utility - not recommended
X	HataDuzelticisi	SysRep.exe	"HataDuzelticisi
N	hcsystray	hc_tray.exe	"Kuma Notifier for the Shootout! game from the History Channel. ""It lets you know whenever there's a new episode that's been released or an announcement from the Kuma team. Just click it to get up-to-the-minute game and event information"""
X	HMI PowerSystem	hmisvc32.exe	"Added by the RANDEX.CZZ WORM!"
U	HookSys	HookSys.exe	"SurfinGuard Pro from Finjan - internet protection software
X	HostSVC syse	HostSVC.exe	"Added by the RBOT-ANZ WORM!"
X	HOT FIX	windsys2.exe	"Added by the AGOBOT.AOI BACKDOOR!"
X	HP Service Drivers	hdsys.exe	"Added by the SDBOT-ZE WORM!"
X	hpsysconf1	[random filename]	"Added by a variant of the VIVIA.A TROJAN!"
U	hpsysdrv	hpsysdrv.exe	"This item keeps track of how many times the system has been recovered and the times of the first and last recoveries done on the system. Leaving unchecked will sometimes prevent the Keyboard Manager program from detecting that the computer is an HP. Since this program/driver was only made to run on HP
U	hsys	HSYS.EXE	"Keylogger Express keystroke logger/monitoring program - remove unless you installed it yourself!"
X	HTML Help System	hhs.pif	"Added by the RBOT-ATB WORM!"
X	HTML32 Help System	hhs32.pif	"Added by the RBOT-ATE WORM!"
X	Hwp	system_wc.exe	"Eziin adware"
X	I am not Ranky. I am eTunnel!	winsys.exe	Added by an unidentified WORM or TROJAN!
X	Iehelper	syslaunch.exe	Outwar adware downloader
X	IISADMINS	systems.exe	"Added by the AGOBOT.U WORM!"
N	iIWiper	Systemwiper.exe	"System Wiper from iI Software - allows you to clear the history of your activites from you computer. Run manually on a regular basis"
X	Image Remote Players	sysvn.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	InSysSecure	InSysSecure.exe	"InSysSecure rogue security software - not recommended
X	Intel system tool	hookdump.exe	"Added by the SPYRE-H TROJAN!"
X	Intel system tool	winnook.exe	"Added by the SPYRE-C TROJAN!"
X	Intel system tool	svehost.exe	"Added by the AGENT-EBT TROJAN!"
X	Intel system works	iis.exe	"Added by the RBOT.QGA WORM!"
X	InteliSys	smss.exe	"Advertisingvision adware. Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	InterceptedSystem	[path to worm]	"Added by the ANACON-B WORM!"
X	Internal Memory File	sysintmemory.exe	"Added by the RBOT-GKT WORM!"
X	InternalSystray	Kazza.exe	"Added by the OPTIXPRO.12.C BACKDOOR! Note - unlike the valid KaZaA executable
X	Internat	systray.exe	"Added by the ALADINZ.P TROJAN! Note - this is not the legitimate systray.exe process. If you right-click on the real systray.exe the ""Properties"" reveal it to be a Microsoft file"
X	Internet Explorer Sys32	isys32.exe	"Added by the IRCBOT-ADA WORM!"
X	internet service	syscfg32.exe	"Added by the RBOT-QS WORM!"
X	Internet Services	systemdev.exe	"Added by the SDBOT-PW WORM!"
X	intranet	SYS32CFG.EXE	"Added by the SPYBOT-DW WORM!"
X	IntSys1	[path to trojan]	"Added by the BANLOA-ASE TROJAN!"
X	ioroxxo microsoft sux	system32.exe	"Added by a variant of the RBOT WORM!"
N	iSysCleaner	iSysCleaner.exe	"iSysCleaner - a simple tool that searches for junk files on your computer and allows you to delete them. Simple cleaning maintenance can be done by the user"
X	isystem	isystem.exe	"Added by the CHORUS-A TROJAN! Searchforfree browser hijacker"
X	java	system.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	kalvsys	kalv****.exe [* = random char]	"EliteBar adware"
X	kalvsys	kalv***32.exe [* = random char]	"EliteBar adware"
X	kernel system daemon	ACTIVAT0R.exe	"Added by the RANDEX.AW WORM!"
X	kernel32sys.dll	IEXPLORER.exe	"Added by the RBOT-MK WORM!"
X	Kernel32_sysdamper	sysdamp.exe	"Added by an unidentified WORM or TROJAN! See here"
X	KernelCheck	sys****.exe [* = digit]	Added by an unidentified TROJAN!
X	Kernell	systems.exe	"Added by the TARNO.C TROJAN!"
X	key	sysxp.exe	"Added by the BEAGLE.AB WORM!"
X	key	sys_xp.exe	"Added by the BEAGLE.AC WORM!"
U	Kodak EasyShare software	EasyShare.exe	Software bundled with Kodak digital cameras to manage the connection between the PC and the Camera. Can be started manually
X	l44sys**	freecell	"Added by the VBS.LIDO WORM - where ** is a number between 1 and 12"
X	l44sys**	iexplore	"Added by the VBS.LIDO WORM - where ** is a number between 65 and 76"
X	l44sys**	winmine	"Added by the VBS.LIDO WORM - where ** is a number between 33 and 44"
X	LasErma	Ermasys32.exe	"Added by the LERMA-A WORM!"
U	LELA	Linksys EasyLink Advisor.exe	"System Tray access to Linksys EaasyLink Advisor - which ""is designed to set up your home network. LELA can locate computers
X	LibreSystem	SysRep.exe	"LibreSystem
X	Linksys Modem Drivers	linksys.exe	Added by the IRCBOT.VD WORM!
X	load	Systemfile.dll.vbs	"Added by an unidentified WORM or TROJAN! See here"
?	load=	cfgsys32.exe	"??"
X	loader32	sys*****.exe [***** = random digit]	"Added by the DOMCOM TROJAN!"
X	loadwin	winsys.exe	"Added by the QQPASS-J TROJAN!"
X	LocalSystem	svchost.exe	"EHU adware. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
U	LogMeIn GUI	LogMeInSystray.exe	"RemotelyAnywhere is a remote administration and remote control solution for Windows. It allows access to the host computer via the network (the LAN
X	Lookup_Sys	lookupsys.exe	P04n trojan
X	LowRiskFileTypes	sysguard.exe	"Added by the FAKEAV-UY TROJAN!"
X	ltwob	formatsys.exe	"Added by the SERFLOG.A WORM!"
?	lycosInside	Lyc_SysTray.exe	"Lycos eMail related - what does it do and is it required?"
X	M1cr0s0ft S3rcurity	systemconfig.exe	"Added by the RBOT.BKB WORM!"
X	Mcafee Antivirus Monitoring System326	VSStatmn326.exe	"Added by a variant of the SDBOT WORM!"
X	Mcafee Antivirus Monitoring System32mn	VSStatmn32.exe	"Added by a variant of the RBOT WORM!"
X	Media Player	Sysdll.exe	"Added by the BANKER-BR TROJAN!"
X	Media Player	Sysnet.exe	"BANKER.MW spyware"
X	Media service	SYSTEM64.EXE	"Added by the RBOT.QV WORM!"
X	Messenger	ntsubsys.exe	"Added by the SDBOT.BGE WORM!"
X	Messenger91	messengersystem.exe	"Added by the RBOT-FPF WORM!"
U	MGSysCtrl	MGSysCtrl	Part of the System Control Manager for MSI notebooks - displays animations for hot key commands (such as turning the wirelss card on/off)
X	Micosoft Startup	syscall.exe	"Added by the SDBOT-JI WORM!"
X	Micosoft Startup	systall.exe	"Added by the SDBOT-GM BACKDOOR!"
X	Micr Update System	upwin.exe	"Added by the SDBOT.YS WORM!"
X	Microsofot x386 System Monitor	system32.exe	"Added by the WOOTBOT.M WORM!"
X	Microsoft	system32.exe	"Added by the IRCBOT-ZZ WORM!"
X	Microsoft	winsys32.exe	"Added by the RBOT-GSQ WORM!"
X	Microsoft boot system cfg32	actboost.exe	"Added by the BROPIA.R WORM!"
X	Microsoft Client/Server Runtime Server Subsystem	csrs.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Client/Server Runtime Server Subsystem	csrssa.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Conf Ldr	sysconf.exe	"Added by a variant of the SDBOT TROJAN!"
X	Microsoft DLL Extensions	SystemDll.exe	"Added by the RBOT-ADV WORM!"
X	Microsoft Driver Setup	sysmngsr322.exe	"Added by the BUZUS-AS TROJAN!"
X	Microsoft Explorer2	system.exe	"Added by the IRCBOT.BS TROJAN!"
X	Microsoft Help System	mshelp32.exe	"CoolWebSearch parasite variant"
X	Microsoft IIS	syshost.exe	"Added by the FRANCETTE WORM!"
X	Microsoft Internal AntiVirus Systems	dIlhost.exe	"Added by the RBOT-AEV WORM!"
X	Microsoft Internet Explorer	crsys32.exe	"Added by the RBOT.UZ WORM!"
X	Microsoft Internet Explorer	sysini.exe	"Added by the DELF-LN TROJAN!"
X	Microsoft Intrenet Explorer	Soundsyst.exe	"Added by the RBOT-AQU WORM!"
X	Microsoft IPC	system.exe	"Added by the NULLBOT TROJAN!"
X	Microsoft IT Update	winsyst32.exe	"Added by the RBOT-FC WORM!"
X	MicroSoft Legal Syst3m32	Syst3m32.exe	"Added by the RBOT.UYL WORM!"
X	Microsoft Macro Protection Subsystems	msmacroprotxz.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Macro Protection Subsystems	Msmacroprot32.exe	"Added by the RBOT.KN WORM!"
X	Microsoft Network	Networksystem.exe	"Added by the SDBOT-AAI WORM!"
X	Microsoft RDLL	sysconf32.exe	"Added by a variant of the SDBOT TROJAN!"
X	Microsoft Redirect	systen.exe	"Added by the BANCOS-FO TROJAN!"
X	Microsoft Router Manager	linksys.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Security Monitor Process	winsys32.exe	"Added by the VIRUT.N VIRUS!"
X	Microsoft Security Monitor Process	winsyss32.exe	"Added by the RBOT.AEU BACKDOOR!"
X	Microsoft Security System	mssecsys.exe	"Added by the IRCBOT-WJ TROJAN!"
X	Microsoft Service 32	sysddm32.exe	"Added by the SDBOT.AKC WORM!"
X	Microsoft Service Drivers	System.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Session Manager Subsystem	smss.exe	"Added by the KALEL-D WORM! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup!"
X	Microsoft Software	sysinfo33.exe	"Added by the RBOT.LS WORM!"
X	Microsoft Startup Manager	sysservice.exe	"Added by the AVALANEC TROJAN!"
X	Microsoft Support	sys32ms.exe	"Added by the RBOT-AHI WORM!"
X	MicroSoft sys32	sysmsgr32.exe	"Added by a variant of the SPYBOT WORM! See here"
X	MicroSoft sys3s1	h4ckn3t.exe	"Added by the RBOT.QTY WORM!"
X	Microsoft System	msupdtm.exe	"Added by the SPYBOT.PKC WORM!"
X	Microsoft System	mssys32.exe	"Added by the PETTICK.A WORM!"
X	Microsoft System	sys.exe	"Added by the RBOT.AKI WORM!"
X	Microsoft System	winamp1.exe	"Added by the SDBOT-UF WORM!"
X	Microsoft System Administration	system.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft System Backup	[random filename]	"Added by the RBOT-AGM WORM!"
X	Microsoft System Checkup	Cool.exe	"Added by the DONK.B WORM!"
X	Microsoft System Checkup	Wnetlib.exe	"Added by the DONK.C WORM!"
X	Microsoft System Checkup	dbnetlib.exe	"Added by the DONK.L WORM!"
X	Microsoft System Checkup	Keymgr.exe	"Added by the DONK.M WORM!"
X	Microsoft System Checkup	inetman.exe	"Added by the DONK.O WORM!"
X	Microsoft System Checkup	ntsysmgr.exe	"Added by the DONK.S WORM!"
X	Microsoft System Checkup	ntsysman.exe	"Added by the SDBOT-QW WORM!"
X	Microsoft System Checkup	libsysmgr.exe	"Added by the SDBOT-CAF WORM!"
X	Microsoft System Checkup	sysmgr.exe	"Added by the SDBOT-OO TROJAN!"
X	Microsoft System Checkup	netapi32.exe	"Added by the DONK-E WORM!"
X	Microsoft System Checkup	wnetmgr.exe	"Added by the DONK.Q WORM!"
X	Microsoft System Checkup	libsys32.exe	"Added by the SDBOT-ACK WORM!"
X	Microsoft System Checkup	netlogin32.exe	"Added by the SDBOT-GN BACKDOOR!"
N	Microsoft System Configuration Utility	msconfig.exe	Entry that appears when you uncheck an item in the MSConfig Startup group and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode. Located in %System% (98/Me/Vista) or %Windir%\PCHealth\HelpCtr\Binaries (XP)
X	Microsoft System Debug	services32.exe	"Added by the RBOT.AKH WORM!"
X	Microsoft System DLL Services Configuration	windir32.exe	"Added by the SDBOT-ACY TROJAN!"
X	Microsoft System File	svchots.exe	"Added by the RBOT.BYU WORM!"
X	Microsoft System Firewall 2006.2	msmsgr.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft System Firewall 2006.2	msnmsgr.exe	"Added by a variant of the SDBOT WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Microsoft System Firewall 2006.2	reg32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft System Init	mtmnr0.exe	"Added by the SDBOT.BR TROJAN!"
X	Microsoft System Monitor	monsys.exe	"Added by the IRCBOT-YV TROJAN!"
X	Microsoft System Monitor	system.exe	"Added by the IRCBOT.AUT BACKDOOR!"
X	Microsoft System NT	svhost.exe	"Added by the SDBOT.COU WORM!"
X	Microsoft System Restore Configuration	CBRSS.EXE	"Added by a variant of the SPYBOT WORM!"
X	Microsoft System Saver	[path to worm]	"Added by the RBOT.BSK WORM!"
X	Microsoft System Security Agent	MSTSA.EXE	"Added by the RBOT.CCM WORM!"
X	Microsoft System Service	dnservice.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft System Service	taskmgr1.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft System Service	winIogon2.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft System Service Device	mssdh.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft System Services	msnmgsr.exe	"Added by the KELVIR.K WORM!"
X	Microsoft System Services	msmsgr.exe	"Added by the RBOT-ZH WORM!"
X	Microsoft System Update	sysupdate.exe	"Added by the SDBOT.DG WORM!"
X	Microsoft system Value	sys57.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft System32 Update	cmsrg.exe	"Added by the RBOT-GN WORM!"
X	Microsoft Telecoms Center	xpfilesys.exe	Added by the RBOT.BCJ TROJAN!
X	MICROSOFT UNPACCKER SYSTEM	unpak32.exe	"Added by a variant of the RBOT WORM!"
X	MICROSOFT UNPACK SYSTEM	winrarx.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	sys32cfg.exe	"Added by the RBOT.DR WORM!"
X	Microsoft Update	winsys32.exe	"Added by the RBOT.BD WORM!"
X	Microsoft Update	systemi32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update	winsys.exe	"Added by the RBOT-GV WORM!"
X	Microsoft Update	sys.exe	"Added by the RBOT-AJ WORM!"
X	Microsoft Update	system32.exe	"Added by the RBOT.IS WORM!"
X	Microsoft Update	system.exe	"Added by a variant of the RBOT WORM! See here"
X	Microsoft Update	winsyst.exe	"Added by the RBOT-DL WORM!"
X	Microsoft Update 23	NtKernelSystem.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Loaders 2006	winusersystem32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update Machine	system03.exe	"Added by the RBOT-NM WORM!"
X	Microsoft Update Machine	systemll.exe	"Added by the RBOT-JT WORM!"
X	Microsoft Update Machine	Systemnt.exe	"Added by the RBOT.DA WORM!"
X	Microsoft Update Machine	systemse.exe	"Added by the RBOT-BD WORM!"
X	Microsoft Update Machine	system.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	ntsystem.exe	"Added by the RBOT.GF WORM!"
X	Microsoft Update Machine	systemi.exe	"Added by the BUZUS.JKU TROJAN!"
X	Microsoft update service	systemm.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Updater	winsys32.exe	"Added by the RBOT.RL WORM!"
X	Microsoft Updaters	sysconfigs.exe	"Added by the RBOT-DF TROJAN!"
X	Microsoft Updates	systemc32.exe	"Added by the RBOT-GR WORM!"
X	Microsoft Updating	syswr.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Updating Machine	sysc0de.exe	"Added by the RBOT.RB WORM!"
X	Microsoft uptime Service	sysuptime.exe	"Added by the RBOT-ACG WORM!"
X	Microsoft Windows 128bit Subsystem	system12.exe	"Added by the RANCK-CZ TROJAN!"
N	Microsoft Windows Desktop Search System Tray	WindowsSearch.exe	System Tray access to Windows Desktop Search for XP from Microsoft - which adds additional search options including a search box on the Taskbar. This version (3.0.1) also includes the Windows Search (WSearch) service which indexes files and e-mails items so you can quickly find words and phrases. Disabling this entry does not affect the normal operation and this is the Windows Defender entry
N	Microsoft Windows Search System Tray	WindowsSearch.exe	"System Tray access to Windows Search 4.0 for XP from Microsoft - which adds additional search options including a search box on the Taskbar. This version also includes the Windows Search (WSearch) service which indexes files and e-mails items so you can quickly find words and phrases. Disabling this entry does not affect the normal operation"
X	Microsoft Windows Service	winsys.exe	"Added by the RBOT-ADP WORM!"
X	Microsoft Windows Session Manager Subsystem	smss.exe	"Added by the PROXYSER-R TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Windows System	srwhost.exe	"Added by the RBOT-AWU WORM!"
X	Microsoft Windows System	syshost.exe	"Added by the RBOT-ASW WORM!"
X	Microsoft Windows System	System.exe	"Added by the VB.KV WORM!"
X	Microsoft Windows System Kernel	kernel32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows System Service Manager	winsvc.exe	"Added by the SPYBOT.LR WORM!"
X	Microsoft Windows Update	syssinfos.exe	"Added by the RBOT-FWR WORM!"
X	Microsoft Windows Updating System	msresource.exe	"Added by the RBOT-EAM WORM!"
X	Microsoft Winsock32 System	winsock32.exe	"Added by the SPYBOT.AKKC WORM!"
X	Microsoft WinUpdate	syslx32.exe	"Added by an unidentified VIRUS
X	Microsoft WinUpdate	syswin32.exe	"Added by the RBOT-HO WORM!"
X	Microsoft Wxdate	Syswu32.exe	"Added by the SPYBOT.HZ WORM!"
X	Microsoft Xp Systems loader	winsystem32xp.exe	"Added by the KELVIR.W WORM!"
X	Microsoft Xp Systems loaders	win32xpsys.exe	"Added by the SPYBOT.NYT WORM!"
X	Microsoft xpsp2	Networksystem.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft's System Module	Sysmodule.exe	"Added by the BDOOR-FJ BACKDOOR!"
X	Microsoft(R) System Manager	sysmgr.exe	"Added by the AGENT.QTR TROJAN!"
X	Microsoft32	win32sys.exe	Added by an unidentified WORM or TROJAN!
X	MicrosoftCorp	sysdiag64.exe	"Added by a the AUTOINF-AB WORM!"
X	MicrosoftDriverService32	drsys32.exe	"Added by the IRCBOT.AKX BACKDOOR!"
X	Microsoftkeysd	systemproc.exe	"Added by the FORBOT-BI WORM!"
X	Microsoftkeysd	systemwin32s.exe	"Added by the WOOTBOT.CO WORM!"
X	MicrosoftNAPC	sysdiag64.exe	"Added by a the AUTOINF-AB WORM!"
X	MicrosoftSys	SPOOLSYS.exe	"Added by the TARNO.N TROJAN!"
X	MicrosoftUpdate	syshelper.exe	"Added by the WOOTBOT.AC WORM!"
X	MicrosoftUpdates	syshelped.exe	"Added by the FORBOT-AZ WORM!"
X	MicrosoftValue	syscnfg.exe	"Added by an unidentified VIRUS
X	Microsoftvirus	sysoverload.exe	"Added by the FORBOT-AL WORM!"
X	Microsoft© System Mapper	SysMap.exe	"Added by the MAPSY TROJAN!"
U	Microsoft® Windows® Operating System	Sidebar.exe	"Windows Sidebar is a pane on the side of the Microsoft Windows Vista desktop where you can keep your gadgets organized and always available. In Windows 7 this feature is known as Desktop Gadgets and each gadget can be placed anywhere on the desktop. If the file isn't located in %ProgramFiles%\Windows Sidebar or you're using other versions of Windows it could be part of the Searchcentrix hijacker"
N	Microsoft® Windows® Operating System	"RunDLL32.exe ehuihlp.dll	BootMediaCenter"
N	Microsoft® Windows® Operating System	p2phost.exe	"Signs a user into the People Near Me feature at login in Windows 7 and Vista. People Near Me enables you to use certain peer-to-peer (P2P) programs on a network - that ""identifies people nearby who are using computers and allows those people to send you invitations for programs such as Windows Meeting Space. They can only invite you to participate in programs that are installed on your computer."" Available via Start → Control Panel"
U	Microsoft® Windows® Operating System	ehTray.exe	"Media Center Tray Applet - part of Windows Media Center on XP MCE
N	Microsoft® Windows® Operating System	"rundll32.exe oobefldr.dll	ShowWelcomeCenter"
N	Microsoft® Windows® Operating System	stikynot.exe	"Microsoft Sticky Notes - virtual sticky notes tool from Windows Vista. This implementation of the popular yellow ""Post-It"" tool is part of the Tablet PC features and allows you to enter either handwriting (via a pen or mouse) or record a voice note. AVailable via Start → All Programs"
U	Microsoft® Windows® Operating System	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	microsystem	snddrv.exe	"Added by the VB.AXG TROJAN!"
X	Micrsoft DerSystem	uqieelpb.exe	"Added by the RBOT-GRI WORM!"
X	mlibsysmc	comzcinc.exe	"Added by the SDBOT-CXS WORM!"
X	MMC	inisys.exe	"Added by the OSCABOT-I WORM!"
?	mmsys	recover.exe	"??"
X	MMSystem	"rundll32.exe mmsystem.dll	RunDll32"
X	ModularConfig	syscnfg.exe	"Added by an unidentified VIRUS
X	Modulo 00FE0F01 Host Internet	syschost.exe	"Added by the DELF-KW TROJAN!"
X	Mozillacorp	system.exe	"Added by the SILLYFDC WORM!"
X	Mp3 Loader	Sysdata.EXE	"Added by the AVETTE-A VIRUS!"
X	MS DLL Library Manager	dllsys64.exe	"Added by the RANKY TROJAN!"
X	MS Domain Name System	MSWDNS32.exe	"Added by the RBOT-GKY WORM!"
X	MS Security	systm.pif	"Added by the RBOT-AQN WORM!"
X	MS SyS Restore	sysrestore.exe	"Added by the RBOT.XM WORM!"
X	MS Sys Security	mswin.pif	"Added by the RBOT-APJ WORM!"
X	MS System Call Function	msscf32.exe	"Added by the RBOT-GBZ WORM!"
X	Ms System Config	Mscfg.exe	"Added by the SDBOT-CCR WORM!"
X	Ms System Config	pcedit.exe	"Added by a variant of the SDBOT WORM!"
X	MS System Security	mswin32.pif	"Added by the RBOT-AOX WORM!"
X	MS Update	syshost.exe	"Added by the EVAMAN-F WORM!"
X	MS Updates	syshosts.exe	"Added by the MYDOOM.Y WORM!"
X	MS Windows System Alert	MSWSA32.exe	"Added by the RBOT-BFN WORM!"
X	MSControl31	winnsyst.exe	"Added by the RBOT.CFY WORM!"
X	MSCORE	syscnfg.exe	"Added by an unidentified VIRUS
X	MSDLL	syscnfg.exe	"Added by an unidentified VIRUS
X	msgserv_	Syss.exe	"Added by the FANTA TROJAN!"
X	Msgtray	sys16.exe	Added by an unknown VIRUS!
X	MSkernel32	System.exe 4820	"Added by the TUXDER BACKDOOR!"
X	msn	system32.exe	"Added by the KITRO.A WORM!"
X	MSN	systems.exe	Identified as a variant of the Backdoor.PosionIvy keylogging malware
X	MSN Messanger	System.exe	"Added by the IRCBOT-AFX TROJAN!"
X	msndrvsys	msndrvsys.exe	"Added by the BROGGER-D TROJAN!"
N	msnsyslog	msnappm.exe	"Related to Messenger Applications. When you uninstall the trial version the msnappm keeps saying (You have xx days left) this is adware and it very annoying"
X	MSNSysRestore	pc32.exe	Added by a variant of the MASTAK VIRUS!
X	msoft-updater23	mssysstems.exe	"Added by the RBOT-ATU WORM!"
X	msoft-updater23	slssystem.exe	"Added by the RBOT-ASR WORM!"
X	MSPP System Update 64	wiaadmgr.exe	"Detected by Kaspersky as the RANKY.GEN TROJAN!"
X	MSSVC	svcsys.exe	"Added by the FATOOS-C TROJAN!"
X	mssys	mssys.exe	"Added by the MYSS.B TROJAN!"
X	mssysint	Iexplore .exe	"Added by the PWSTEAL.ABCHLP and PSPIDER.310.B TROJANS! Note - this is not the legitimate Internet Explorer (iexplore.exe) process as there is a space before the "".exe"""
X	mssysint	comime.exe	"Added by the NETSNAKE-I TROJAN!"
X	mssyslanhelper	msmsgri32.exe	"Added by the RANDEX.D WORM!"
X	MsSystem	msdos.exe	"Adult content downloader - see here"
X	MsSystem	mssys.exe	"Added by the VANTA.A TROJAN!"
X	MSSYSTEM	svcsys.exe	"Added by the FATOOS-C TROJAN!"
X	MsUpdater System	udpsys32.exe	"Added by the RBOT.AAA WORM!"
X	MsVBdll	sys32dll.exe	"Added by the AIMDES.B or AIMDES.C WORMS!"
X	MSWindows SysCl	mscl32.exe	"Added by the RBOT.AHI WORM!"
X	MsWindows SysDate	sysmsvc.exe	"Added by the SPYBOT.FCD WORM!"
X	MSWindows Syspg	mspg32.exe	"Added by the RBOT-TB WORM!"
X	MSWindowsUpdate	Systern.exe	"Added by the RBOT-AFD WORM!"
X	msys lptt01	msys.exe	"RapidBlaster variant (in a ""Msyss"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Msys32	morfitwebentrance.exe	"Morfit ADjectPager - ""uses home page rental technology for generating revenues"". Homepage hi-jacker that re-defines your IE or Netscape start page as http://www.web-entrance.com/. Any installed application including this must be un-installed before you can reset your homepage"
X	MSysDrv	msdrv.exe	Added by the VB.WF TROJAN!
N	MutexServiceEx	Sys32Smm.exe	"Webroot Sofware's discontinued ""Privacy Master"""
X	mvsyswina	acsysiom.exe	"Added by a variant of the SDBOT WORM!"
U	MytekSystrayExePath	MyTekSystray.exe	"MyTek system tray - web site providing computer tech support in Australia"
X	MyVBApp	SysNT.exe	"ReferAd adware"
X	NAMEDPIPE SYSTEM	namedpipe.exe	"Added by the MYTOB-FH TROJAN!"
X	NAV Agent	systems.exe	"Added by the TARNO.C TROJAN! Note - this is not the valid Norton Antivirus entry of the same name"
X	navman_20	sysnav32.exe	"Hijacker
X	NBT System alias	[path] repcale.exe [path] beird.exe	"Added by a variant of the RANDON.AN WORM!"
N	Nero PhotoShow Media Manager	mssysmgr.exe	"Nero rebranded version of Simple Star's PhotoShow photo editing and organizing software
X	NET protection system	netst.exe	"Added by the RIZO.A TROJAN!"
X	Network Translation System Service	ntss.exe	"Added by the UNPDOOR TROJAN!"
X	New Anti Virus	System.exe	"Added by the BRONTOK-CH WORM!"
X	NI.USYP	SysProtectScannerInstall.exe	"Installer for the SysProtect rogue security software
U	NMPSystray	NMPSystray.exe	"System Tray access to NotesMedic from Cassetica Software Inc. - which ""contains a suite of Tools that make life easier when using Lotus Notes"""
X	Nod32 Runtime	sysregi.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	NoooH	sys.exe	"Added by the ALNUH WORM!"
X	Nord	nordsys.exe	"Added by the DREF-S WORM!"
X	Norman Worl System Ability	nwcss32.exe	"Added by the DELF.IO TROJAN!"
X	Norton AntiVirus Sys	NAVsys32.exe	"Added by a variant of the WOOTBOT WORM!"
X	Norton System	csrs.scr	"Added by the BANLOA-AFM TROJAN!"
N	Norton System Doctor	Sysdoc32.exe	"Norton Disk Doctor from Norton Utilities. Automatically runs at start-up
N	Norton SystemWorks	cfgwiz.exe	Norton System Works configuration wizard. Reportedly a resource hog. Many users find they can live without loading it
X	Nortons AV SYSTEM	scvchost.exe	"Added by a variant of the RBOT WORM!"
X	Nortons AVS Systems	arse.exe	"Added by the RBOT.AWY WORM!"
X	nsdriver	nssys32.exe	"NetShagg adware"
X	nssysconf	[random filename]	"Added by the VIVIA.A TROJAN!"
U	nsys	nsys.exe	"NetSpy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	nsys32	nsys32.exe	"Added by the AGOBOT-SU WORM!"
N	NSystemMonitor	Symmon.exe	Norton Uninstall Deluxe - monitors programs being installed and logs them for removing later. Available via Start -> Programs for manual logging
X	NT Logging Service	Syslog32.exe	"Added by the DONK.B WORM and variants!"
X	Nt System Protocol	ntsystem.exe	"Added by the RBOT.DSB TROJAN!"
X	NT Windows System Manager Loader	csrlss.exe	"Added by the AGOBOT.OX WORM!"
X	NTFSS Microsoft System	filees.exe	"Added by the RBOT.GAB WORM!"
X	NTFSS MICROSOFT SYSTEM	filess.exe	"Added by the RBOT.AXZ WORM!"
X	NTmessageSystem	loadnewmessage.exe	"Added by the HIDAGENT-B WORM!"
X	NTSF Microsoft System	fylez.exe	"Added by a variant of the RBOT WORM!"
X	NTSF MICROSOFT SYSTEM	wntsf.exe	"Added by the RBOT.ATC WORM!"
X	NTSF MICROSOFT SYSTEM	fufffy.exe	"Added by the RBOT-AEL WORM!"
X	NTSF MICROSOFT SYSTEM	ntssf.exe	"Added by a variant of the RBOT WORM!"
X	NTSF MICROSOFT SYSTEM	scvhost.exe	"Added by a variant of the RBOT WORM!"
X	NTSF MICROSOFT SYSTEM	winsis32.exe	"Added by a variant of the RBOT WORM!"
X	NTSF MICROSOFT SYSTEM	marya.exe	"Added by the RBOT-AXY WORM!"
X	NTSF MICROSOFT SYSTEM	sysman.exe	"Added by the RBOT.EDP WORM!"
X	Ntsysv	ntsysv.exe	"Added by the MIFENG-E TROJAN!"
X	nVidia Display Drivers (x86)	nvsys86.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	nVidia System Drivers	nvsys32.exe	"Added by an unidentified WORM or TROJAN! See here"
U	NVIDIA System Monitor	NVMonitor.exe	"NVIDIA System Monitor - part of NVIDIA System Tools. Utility for monitoring and logging system statistics (such as temperatures
U	NVidia System Utility	NVSystemUtility.exe	"NVidia System Utility - older version of the NVIDIA nTune utilty for monitoring and modifying the settings (such as temperatures
?	NVRotateSysTray	nvsysrot.dll	"Related to NVIDIA nView Control Panel. What does it do and is it required?"
X	NVSystem32	nvscv32.exe	"Added by the AGOBOT-NO WORM!"
X	nxosys	"rundll32.exe nxosys.dll	start"
X	OD	SYSCNTR.EXE	HotVideo dialler
X	Offica Monitor Secura Systeme	winxp_sp3.exe	"Added by a variant of the RBOT WORM!"
X	Office Monitor Secure Systema	absecure32.exe	"Added by the RBOT.FPW WORM!"
X	Olive System	Szchost.exe	"Added by the MERCURYCAS.A TROJAN!"
U	Omega ASIO Control Panel	ASIOSysTray.exe	"System Tray access to the control panel for the Lexicon Omega ASIO (Audio Streaming I/O) desktop recording studio"
X	Outwar	syslaunch.exe	Outwar adware downloader
N	PaperQuote System Tray Icon	PQTRAY.EXE	PaperQuote is a "wallpaper" changer with daily quotes that are either for inspiration or motivation
X	PaSystem	pasystem.exe	"Targetsaver adware variant"
Y	PASystemTray	PASystemTray.exe	"Related to Panda Security Software - part of Panda Administrator 3"
X	PCCleaner	SysCleaner.exe	"PCCleaner rogue cleaning utility - not recommended
X	PCHEasySearch	STUpdate.exe	PCH EasySearch bar
X	PCSecureSystem	pgs.exe	"PCSecureSystem rogue security software - not recommended. A member of the AVSystemCare family"
X	PCToolPro	SysRep.exe	"PCToolPro rogue system error and cleaning utility - not recommended
X	PHIME2OO2ASyst	[path to trojan]	"Added by the DBDOOR-B TROJAN!"
N	PhotoShow Deluxe Media Manager	mssysmgr.exe	"Simple Star PhotoShow Deluxe photo editing and organizing software
X	PIC SYSTEM	picx.exe	"Added by the MYTOB.LL WORM!"
X	PIPE SYSTEM	pipe.exe	"Added by the MYTOB-FF WORM!"
N	Piracy	SysUtil.exe	"Software Piracy Alert feature bundled with PGWare software. Cries foul when it detects an 'illegal' version. The alerts are reported to disappear as soon as the software is correctly registered. There are privacy issues though: ""The Software includes a feature that assigns a unique order number to GameGain based on purchase information. The Software reports this number to us via the internet either when you run the Software or enter the registration number
X	Popup Blocker System	PopUpBlocker.exe	"Added by a variant of the RBOT WORM!"
X	Popup Blocker System326a Monitoring	PopUpBlocker6a.exe	"Added by the RBOT.AUH WORM!"
X	Popup Blocker System8 Monitoring	PopUpBlocker8.exe	"Added by a variant of the RBOT WORM!"
U	PPSYS	ppsys.exe	"PC Police commercial keystroke logger. Uninstall this software if you did not install it yourself"
X	printer	sysprinter.exe	"Added by the SMALL.ZY TROJAN!"
X	Printer Spooler Subsystem	spoolss.exe	"Added by a variant of the RBOT WORM! Note - this is not the legitimate Windows spoolss.exe process which is always located in %System% and should not figure in Msconfig/Startup!"
X	PrintMngr	system.exe	Added by an unidentified TROJAN!
X	PrintSpoolSv	System.exe	"Added by the BDOOR-S BACKDOOR!"
U	PrnSys Executable	PrnSys.exe	"Print screen utility bundled with some HP printer software - not required
X	ProtectingTool	SysRep.exe	"ProtectingTool rogue system error and cleaning utility - not recommended
X	Protection System	psystem.exe	"Protection System rogue security software - not recommended
X	ProtejaseuDrive	SysRep.exe	"ProtejaseuDrive rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
X	ProtezioneSoft	SysRep.exe	"ProtezioneSoft
U	PWSActivePrint_5	ActivePrintSystem.exe	"ActivePrint from Pocket Watch LLC - ""Windows Mobile users are given the invaluable capability of printing from their mobile devices to any Windows 2000/XP/2003/Vista compatible printer without the necessity of wireless hardware"""
X	RAX SYSTEM	scrigz.exe	"Added by the MYTOB.KR WORM!"
U	RCSystem	DLLML.exe RCSystem	"Related to Creative DLL Module Loader for the Sound Blaster X-Fi (and maybe others). This program is non-essential process to the running of the system
X	RCSystemTray	MaxRCSystemTray.exe	"Max Registry Cleaner rogue registry cleaner - not recommended
N	RealJukeboxSystray	tsystray.exe	System Tray icon for RealJukebox
X	Recoveru system	svchast.exe	"Added by a variant of the LINEAGE-AV TROJAN!"
X	Recoveru systems	svchost.exe	"Added by the SMALL.DDX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
X	Recycle Bin Handler 2005	system.exe	"Added by the BDOOR-HO BACKDOOR!"
X	reg run	Systen.exe	"Added by the BANCOS-BS TROJAN!"
X	RegCleaner	SYSio32.exe	"Added by an unidentified VIRUS
X	Registry Checkup System326a Monitor	Winregs326a.exe	"Added by a variant of the SDBOT WORM!"
X	Registry System	Regsys.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Registry System16 Checkup Monitor	SystemReg16.exe	"Added by a variant of the RBOT WORM!"
X	Registry System166 Checkup Monitor	SystemReg166.exe	"Added by a variant of the RBOT WORM!"
X	Registry Value Name	syswinxp.exe	"Added by the RBOT.BTZWORM!"
X	RegistryMonitor	sysfade.exe	"Added by the SYSFADE TROJAN!"
X	REGMSYS	[path to file]	"Added by the LOWZONE-AX TROJAN!"
X	regsvc	sysd	"Sys Detective+ spyware"
X	Reg_WFT	Regsysw.com	"Added by the WILSEF VIRUS!"
X	Reg_WFT	Regsysw.exe	"Added by the WILSEF.A WORM!"
U	Remote Data Backups	CBSysTray.exe	"System Tray access to Remote Data Backups online system/data backup utility"
U	Remote Data Backups TaskBar Icon	CBSysTray.exe	"System Tray access to Remote Data Backups online system/data backup utility"
X	Remote Event System	resmsvc.exe	"Added by the IRCBOT.YF BACKDOOR!"
X	Remote Procedure Call	winsysrpc.exe	"Added by the SDBOT-PS WORM!"
X	Remote System Protection	"rundll32.exe [random].dll	HUI_proc"
X	ReparateurDeSysteme	SysRep.exe	"ReparateurDeSysteme
X	rollbk	sysup.exe	"Added by the SERFLOG.B WORM!"
X	ruin	system32.exe	"Added by the DELF-JM TROJAN!"
X	run	winsys32.exe	"Added by the DELF.CP BACKDOOR!"
U	run=	ramsys.exe	"Advanced Startup Manager from Rays Lab"
X	RunDLL34	syscnfg.exe	"Added by an unidentified VIRUS
X	Rundllsystem32	Rundllsystem32.exe	"Added by the NETDEVIL.B TROJAN!"
U	RunSysd32	RunSysd32.exe	DesktopShield2000 by Stéphane Groleau. Locks the desktop at bootup so that users cannot bypass the Windows screensaver password. Only essential if using the program and is an optional setting. It can be disabled from within
X	Runtime Server Subsystem	csrss.exe	"Added by the IRCBOT-XV WORM!"
X	SafeHardDrive	SysRep.exe	"SafeHardDrive rogue system error and cleaning utility - not recommended
U	SafeHouseSystemTray	SDWTRAY.EXE	"SafeHouse ""Personal Privacy"" system tray icon - PP protects and hides your private and personal photos
X	SafePCTool	SysRep.exe	"SafePCTool rogue system error and cleaning utility - not recommended
Y	SafeSpace	SafeSpaceSysTray.exe	"Part of SafeSpace (from Artificial Dynamics) which ""protects computers from Internet malware infection without the need for signature updates or regular maintenance"""
X	SafeSys	SafeSys.exe	"Added by the AUTORUN.DMI WORM!"
X	SBR2009F	SystemBooster2009.exe	"SystemBooster2009 rogue system suite - not recommended
U	ScanSys32	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
X	SchijfBewaker	SysRep.exe	"SchijfBewaker
X	sck121	helpsyss.exe	Added by a variant of the MAILBOT TROJAN!
X	sdxsys32	sdxsys32.exe	"Added by the BROGGER-A TROJAN!"
U	Secsys	Secsys.exe	"UltraSoft Key Interceptor surveillance software - uninstall this unless you put it there yourself!"
X	Secure System	integitor.exe	"Added by the AGOBOT.ACI WORM!"
X	security service	syss.exe	Added by an unidentified WORM or TROJAN!
X	Security System	securesys.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	serpe	formatsys.exe	"Added by the SERFLOG.A WORM!"
X	server	system.exe	"Added by the METHS-A TROJAN!"
X	Service	SYSNT.exe	"Added by the CHA TROJAN!"
X	Service System	kernels32.exe	"Added by the BANCOS-DA TROJAN!"
X	Service System	windowsXP.exe	"Added by the BANCOS-EL TROJAN!"
X	Service System	kgbfsm344.exe	"Added by the BANCOS-FS TROJAN!"
X	Service System	wernell87.exe	"Added by the BANCOS-FJ TROJAN!"
X	Services	sys.exe	"Added by a Proxy Trojan variant"
X	Services	sysamp.exe	"Added by a variant of the SDBOT WORM!"
X	Services	prosys32.exe	Added by an unidentified WORM or TROJAN!
X	Servicos	System.exe	"Added by the BANCOS-BCM TROJAN!"
X	Session Manager Subsystem	smssa.exe	"Added by the RBOT-AGS WORM!"
X	Setting	sysweb.exe	"Added by the SDBOT.GEN TROJAN!"
X	Shell	Explorer.exe winsys32.exe	"Added by the DELF.CP BACKDOOR! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The ""winsys32.exe"" file is located in %Windir%"
X	Shell	Explorer.exe kbdsys.exe	"Added by the DAPROSY WORM! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The ""kbdsys.exe"" file is located in %AppData%\Microsoft\Keyboard"
X	shellsystem	shellsystem.exe	"Added by the UPCHAN TROJAN!"
X	SicherheitsTool	SysRep.exe	"SicherheitsTool
N	SigmatelSysTrayApp	stsystra.exe	System tray program for the Sigmatel Audio sound card. Often found on Dell computers
N	SigmatelSysTrayApp	sttray.exe	System tray program for the Sigmatel Audio sound card. Often found on Dell computers
N	Simple Star PhotoShow Media Manager	mssysmgr.exe	"Simple Star PhotoShow photo editing and organizing software
X	Sistem Services	syspool.exe	"Added by the AGOBOT-GF WORM!"
U	SmpcSys	SmpSys.exe	"""Set Up My PC"" utility supplied with some Packard Bell computers"
X	Sms System32	SmsSystem32.exe	Unidentified malware
X	SMSERIALWORKSTARTER	comsysobj.exe	"Added by the FAKEALERT-AH TROJAN! Installed with the SpyBurner spyware remover - which is not recommended
X	smsys	Explorer.exe	"Added by the CLICKER-C BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in a ""Template"" subfolder"
X	smsys	vi.exe	Adult content dialler
U	SMSystemAnalyzer	SMSystemAnalyzer.exe	"Part of the Iolo System Mechanic optimization tool"
U	SoloSysCheck	Syscheck.exe	"Solo antivirus System Integrity Check - Monitors system registry
X	SolutionReg	SysRep.exe	"SolutionReg rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
X	Sound System	WinSound1.exe	"Added by an unidentified VIRUS
U	SpokeSysTray	SpokeSysTray.exe	"Spoke Software client application. Spoke ""uses data in your e-mail and other enterprise information systems to discover the existing relationships of people in your enterprise. It then builds a private
X	Spooler Subsystem	spoolsub.exe	"Added by the SDBOT-ABG TROJAN!"
X	Spooler SubSystem App	spoolsvc.exe	"Added by the POEBOT-J WORM!"
X	Spooler SubSystem App	spooIsv.exe	"Added by the LINKBOT.M WORM!"
X	Spooler SubSystem App	spoolv.exe	"Added by the SDBOT-BN WORM!"
X	Spooler SubSystem Application	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler Subsystem Application	smss.exe	"Added by the IRCBOT-ZO TROJAN! Note - the legitimate smss.exe process should not normally figure in Msconfig/Startup!"
X	SpoolerSubSystemProcess	SpooI32.exe	"Added by the EHKS.21 keylogger! Note - the ""I"" between ""o"" and ""3"" is a capital ""i"" not a lower case ""L"""
X	SpySpotter System Defender	Defender.exe	"SpySpotter rogue spyware remover - not recommended
U	Srv32Win	sysdiag.exe	"SpyAgent surveillance software. Uninstall this software unless you put it there yourself"
X	ssate.exe	winsys.exe	"Added by the BEAGLE.K WORM!"
X	ssgrate.exe	system.exe	"Added by the MITGLIEDER.C TROJAN!"
X	ssgrate.exe	sysdoor.exe	"Added by the MITGLIEDER.N TROJAN!"
X	ssgrate.exe	winsystems.exe	"Added by the BAGLEDL-J TROJAN!"
N	StacSysTray	StacSysTray.exe	System Tray control panel for SigmaTel C-Major on-board audio - as used on some Dell and Packard Bell PCs
X	StartReplySystem	loadnewmessage.exe	"Added by the HIDAGENT-B WORM!"
X	StartupOption	loadsysdisk.exe	"Added by the HIDAGENT-B WORM!"
X	StorageProtector	SysRep.exe	"StorageProtector rogue system error and cleaning utility - not recommended
X	SvcSys	[path to file]	"Added by the BANCOS.Z TROJAN!"
X	Svcsys Registry Manager	svcsysreg.exe	"Detected by Kaspersky as the AGENT.CV TROJAN!"
X	svcsys32	svcsys32.exe	"Added by the AGOBOT-LL WORM!"
X	svhoost	checksys.exe	Added by a downloader TROJAN of Chinese origin!
U	SWClient	swsys.exe	"ActivMonAgent keyboard logger/monitoring program - remove unless you installed it yourself"
X	swingsys	SWINGSYS.EXE	"Added by the BANCOS-CX TROJAN!"
X	Sygate Personal Firewall	system32.exe	"Added by the RBOT.VI WORM!"
X	Sygate Personal Firewall	sysgut.exe	"Added by the SDBOT.WM WORM!"
X	Sygate Personal Firewall	sys.exe	"Added by the RBOT-ZC WORM!"
X	Sygate Personal Firewall	syserror.exe	"Added by the RBOT.UC WORM!"
N	SymTray - Norton SystemWorks	SYMTRAY.EXE	"Keeps all System Tray icons for Norton SystemWorks together to reduce clutter. SystemWorks includes Norton Anti-Virus
X	Syntax Script	systacq.exe	"Added by the SDBOT.AI WORM!"
X	sys	regedit /s sys.reg	"Raxmus adware. Note that the Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file ""sys.reg"" is located in %Windir%"
X	sys	regedit sysdllwm.reg	"CoolWebSearch parasite variant - also detected as the FEMAD-L TROJAN!"
X	sys	Fonts.exe	"Added by the AUTORUN.BUK WORM!"
X	sys	rundll32.exe	"Added by the LINEAG-G TROJAN! Note - this is not the legitimate rundll32.exe process
X	Sys Ren	SysRen.exe	"Part of FlashEnhancer adware"
X	sys************* [* = random digit]	sys*************.exe [* = random digit]	"WINBO adware"
X	Sys**.exe [* = random char]	Sys**.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Sys**32.exe [* = random char]	Sys**32.exe [* = random char]	"CoolWebSearch/HomeSearch adware - for examples
X	Sys-Stat	wuapdxe.exe	"Added by the SDBOT.HK WORM!"
X	sys008	sys008.exe	"Hijacker
X	sys009	sys009.exe	"Added by the STARTPA-ZB TROJAN!"
X	SYS1	system.exe	"Added by the SILLYFDC-AP WORM!"
X	SYS1	explorar.exe	"Added by the SILLYFDC.BDJ WORM!"
X	SYS2	bad1.exe	"Added by the SILLYFDC-AP WORM!"
X	sys201	sys209.exe	"Added by the STARTPA-ZY TROJAN!"
X	Sys29	win***32.exe [* = random char]	"EliteBar adware"
X	SYS3	bad2.exe	"Added by the SILLYFDC-AP WORM!"
X	sys32	SYS32.EXE	"Added by the FLUX.E BACKDOOR! The file is located in %System%"
X	sys32	sysx32.exe	"Added by the KVEX-A VIRUS!"
X	Sys32	Sys32.exe	"Added by the AUTORUN-KL WORM! The file is located in %Windir%"
U	sys32cmd	sys32win.exe	"Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	sys32dll	sys32dll.exe	"Added by the AIMDES.B WORM!"
U	sys32sql	sys32win.exe	"Active Keylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	sys32_nov	sys32_nov.exe	"Added by the AGENT-LAX TROJAN!"
X	sys33	sys33.exe	"Added by the AGOBOT-WJ WORM!"
X	SYS4	bad3.exe	"Added by the SILLYFDC-AP WORM!"
X	sys64_nov	sys64_nov.exe	"Added by the MUTANT.FKA TROJAN!"
X	SysA	win***32.exe [* = random char]	"EliteBar adware"
U	SysAgent	SysAgent.exe	SYSagent - small utility for retrieving all the hardware and software information required by anyone administering a machine and/or the network it's a part of
X	SysAI	SysAI.exe	"AproposMedia adware"
X	sysalgg	sysalgg.exe	"Added by the TIBS.BF WORM!"
X	Sysanalysing	myrvc.exe	"Added by the AUTORUN-RD WORM!"
X	SysAntivirus 2009	sysav.exe	"SysAntivirus 2009 rogue security software - not recommended
X	SysATW	sysatw.exe	"Added by the VANEBOT-AM WORM!"
X	sysav	winav.exe	"WinPC Antivirus rogue security software - not recommended
U	SysBkup	[path to file]	"Keyspy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	SysBoot	syskernel.exe	"Added by the AUTORUN-EY WORM!"
U	Sysbot	sysbot.exe	"Spector - spying (or monitoring) software to record internet activity"
X	syscfg	syscfg32.exe	"Added by the KWBOT.S WORM!"
X	syscfg34.exe	syscfg34.exe	"Added by the ELECTRON WORM!"
X	Syscheck	win.hta	Browser hijacker
X	syscheck	iexplorer.exe	Added by the AGENT.DM TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe)
U	SysCheck32	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
X	SysCleaner	SysCleaner.exe	"SysCleaner rogue cleaning utility - not recommended
X	sysclx	ntldrt.exe	"Added by the JLOK-A WORM!"
X	syscm	Syscm.exe	"Vanish adware"
X	SysCom	msnmsgr.exe	"Added by the BANK-AF TROJAN! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%MSN Messenger or %ProgramFiles%Windows LiveMessenger. This one is located in %Windir%\system"
?	SysComp	mssdnl.com	"Unknown but suspect as *.com are not usually run at start up and the name isn't recognized"
X	syscon	syscon.exe	"Added by the APRILCONE.A WORM!"
X	syscon lptt01	syscon.exe	"RapidBlaster variant (in a ""Syscon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	syscon ml097e	syscon.exe	"RapidBlaster variant (in a ""Syscon"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	sysconfig	iexplorer.exe	"Added by the CULT.C WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	SysConfig	syscfg35.exe	"Added by the KAZMOR.C WORM!"
X	SysConfig	wincfg32.exe	"Added by the SDBOT.ZD WORM!"
U	Sysconfig	Stealth KeySpy.exe	"StealthKeySpy - keystroke logger/monitoring program - remove unless you installed it yourself!"
X	sysconfig32	sysconfig32.exe	"Added by the AGENT-MSP TROJAN!"
X	Syscpy	Syscpy.exe	"Firewall-bypassing
X	SysCtl	sysctl.exe	"Added by the AOK TROJAN!"
X	Sysctrls	procdll.exe	"Added by the WEEDBOTZ.14 TROJAN!"
X	Sysctrls	winupdate.exe	Added by an unidentified WORM or TROJAN!
X	Sysctrls	mscntrl.exe	"Added by the KOLABC.BB WORM!"
X	Sysctrls	Sysctrls.exe	"Added by the AGENT.AWZ TROJAN!"
X	Sysctrls	win32dll.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Sysctrls32	sevchost.exe	"Added by the RBOT.ADF BACKDOOR!"
X	SysCVMS.exe	SysCVMS.exe	"Added by the SMALL.CBA TROJAN!"
X	sysdat.dll	sysdat.dll.exe	Added by the NISHICA 1.1 TROJAN!
X	SysData	[path to file]	"Added by the RANCK-BA TROJAN!"
X	SysDefence.exe	SysDefence.exe	"SysDefence rogue security software - not recommended
X	SysDefenders	SysDefenders.exe	"SysDefenders rogue security software - not recommended
X	SysDepannage	SysRep.exe	"SysDepannage
X	SysDeskqqfx	qqfx.exe	"Added by the QQPASS.H TROJAN!"
X	SysDeskqqfx	Runddll32.exe	"Added by the CHANGGAME TROJAN!"
X	SysDesktop	fswanQQ.exe	"Added by the QQSEND-A TROJAN!"
X	sysdiag64.exe	sysdiag64.exe	"Added by a the AUTOINF-AB WORM!"
X	sysdir	winrun.exe	"Added by the WINBUR.B WORM!"
X	sysdll	windll.exe	"Added by the AUTORUN.ECT WORM!"
X	sysdll	[trojan filename]	"Added by the HUGESOT TROJAN!"
X	Sysdpt	sysdpt.exe	"CRYPT trojan downloader"
X	sysdxvid	sysdxvid.exe	"Added by the DLUCA-S TROJAN!"
X	sysemls	sysem.exe	"Added by a variant of the SDBOT WORM!"
X	SysEQ	svclgx32.exe	"Added by the IRCBOT-AC TROJAN!"
X	sysfbtray	bill102.exe	"Added by the VB-ENI TROJAN!"
X	sysfbtray	bill106.exe	"Added by the MDROP-CLV TROJAN!"
X	sysfiler	sysfiler.exe	"Added by the RETSAM TROJAN!"
X	SYSfit	SYSfit.exe	"AdShooter adware variant"
X	sysflg32	sysflg32.exe	"Added by a variant of the CRYPTER.C TROJAN!"
X	sysformat	sysformat.exe	"Added by the BAGLE-BK WORM!"
X	sysfrcx	sysfrcx.exe	"Added by the KEYLOG-SCLOG TROJAN!"
X	sysftray2	bolivar19.exe	"Added by the KOOBFACE.I WORM!"
X	Sysgate Personal Firewall	syst3ms.exe	"Added by a variant of the IRCBOT TROJAN!"
X	sysguard	sysguard.exe	"Added by the FAKEAV-KI TROJAN!"
X	sysguardn	s	"Spyware Protect 2009 rogue spyware remover - not recommended
X	syshelp	syshelp.exe	"Added by the LOVGATE.C WORM!"
X	syshost	syshost.exe	"Added by the VB-DVZ TROJAN!"
X	sysin	[path to file]	"Added by the DSRC-A TROJAN!"
X	sysinfo	sysinfo.exe	"Added by the BEDRILL TROJAN!"
X	sysinfo.exe	sysinfo.exe	"Added by the BEAGLE.V WORM!"
X	SysInit	svchost.exe	"Added by the STARTPA-BD TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files"
X	SysInit	wininit32.exe	"Added by the XABOT WORM!"
X	sysinit	services.exe	"Added by the NEWLFRM-A TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %System%\golumm"
X	Sysino	lsess.exe	"Added by the FORBOT-BF WORM!"
X	sysint16	sysint16.exe	"Added by the CRYPTER.A TROJAN!"
X	sysinter	ADIRSS.EXE	"Added by the AGENT.JVJ TROJAN!"
X	Syskey	sysinit.exe	"Added by the BEAGLE.AX WORM!"
X	sysldtray	ld02.exe	"Added by the KOOBFACE.BG WORM!"
X	sysldtray	ld03.exe	"Added by the KOOBFACE.CA WORM!"
X	sysldtray	ld11.exe	"Added by the KOOBFACE.JG WORM!"
X	sysLDtray	ld08.exe	"Added by the AGENT-JSV TROJAN!"
X	sysldtray	ld09.exe	"Added by the AGENT-KFI TROJAN!"
X	sysldtray	ld10.exe	"Added by the FAKEAV-UD TROJAN!"
X	sysldtray	ld12.exe	"Added by the KOOBFACE.V WORM!"
X	sysldtray	ld01.exe	"Added by the KOOBFACE.I WORM!"
X	sysldtray	ld15.exe	"Added by the AGENT-LNH TROJAN!"
X	sysldtray	ld04.exe	"Added by the KOOBFACE WORM!"
X	sysldtray	ld06.exe	"Added by the KOOBFACE WORM!"
X	sysldtray	ld07.exe	"Added by the KOOBFACE WORM!"
X	sysldtray	ld14.exe	"Added by the VIRUT.CE VIRUS!"
X	sysldtray	ld16.exe	"Added by the AGENT-MMO TROJAN!"
X	Syslib	Syslib.exe	Adult content related downloader trojan
X	SysLive	SysLive.exe	"Added by the EXPICHU WORM!"
X	Syslog lptt01	Syslog.exe	"RapidBlaster variant (in a ""Syslog"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Syslog ml097e	Syslog.exe	"RapidBlaster variant (in a ""Syslog"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	syslogin.exe	syslogin.exe	"Added by the BAGZ-B WORM!"
X	syslogon	syslogon.exe	"Added by the SPYBOT-EP WORM!"
X	SysMain	buff.exe	"Added by the AGENT-ECW TROJAN!"
U	Sysman	Sysman.exe	"KeyTrap is a surveillance software program that records all keyboard activities. Uninstall this software unless you put it there yourself"
X	SysManager	Manager.EXE	"Added by the DAGGER.140 TROJAN!"
X	sysme	sysme.exe	"Added by the PSW_STEALER_C TROJAN!"
X	sysmem	mmsete.exe	"Added by the NOPIR.C WORM!"
X	sysmem	outlookrem.exe	"Added by the NOPIR-C WORM!"
X	SysMemory manager	mdms.exe	"Added by the CIMUZ-D TROJAN!"
U	SysMetrix	SysMetrix.exe	"SysMetrix - skinnable clock and metering application. It monitors and reports on a great number of statistics"
X	sysMett1	explorer.exe	"Added by the LEGMIR-Y TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %ProgramFiles%"
X	sysmini	sysmini.exe	"Added by the ADLOAD.DD TROJAN!"
X	sysmngr32	sys64mnger.exe	"Added by a variant of the RBOT WORM!"
X	sysmntrc	sysmntrc.exe	"Added by the BANCOS-FX TROJAN!"
X	sysmod	sysmod.exe	"Added by the SPYBOT-DU WORM!"
X	sysmon	sysmon.exe	"Added by the BIZEX WORM!"
X	Sysmon	rpcmon.exe	"Added by the RANDEX.ATX WORM!"
X	sysmon	sysmon44.exe	"Added by a variant of the BACKDOOR-CBA TROJAN!"
X	SysMon	wowexece.exe	"Added by the MULAN-A TROJAN!"
X	Sysmon	SystemMonitor.exe	"Added by the NUJAMA-A WORM!"
X	Sysmon	msnmssgs.exe	"Added by the SDBOT.FK WORM!"
X	sysmon12	[various filenames]	"Wareout - malware masquerading as a spyware and dialer remover"
X	SysmonLog	mslog.exe	"Added by the AGENT.AOV TROJAN!"
X	sysmonnt	sysmonnt.exe	"SearchPounder sends keywords typed into HTML forms and popular Internet search engines to a remote server"
X	SysMonXP	SysMonXP.exe	"Added by the NETSKY.Q WORM!"
X	Sysmppcvppp	SysTdSvr.dll	"Generic2.PQG adware"
X	sysmss	sysems.exe	"Added by a variant of the SLAPER TROJAN!"
X	sysnate	sysnate.exe	"Added by the MEDIAS TROJAN!"
X	Sysnet	snuninst.exe	Unidentified adware
X	sysnet	sysnet.exe	"CasClient adware - also detected as the CMAPP TROJAN!"
X	sysobj.exe	sysobj.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	SysOps	SysOps	"Added by the MSNCORRUPT TROJAN!"
X	syspare	syspare.exe	"Added by the BIFROSE-AN TROJAN!"
X	syspath	drv.exe	"Added by the SOBER WORM!"
X	sysPersonalFirewall	msnmssgr.exe	"Added by a variant of the RBOT WORM!"
X	sysPersonalFirewall	system.exe	"Added by the WOOTBOT.FH WORM!"
X	sysPersonalFirewall	tskm0nitor.exe	"Added by the SDBOT.APC WORM!"
U	SysPilot	fdxxl.exe	"G Data ""PC Spion"". PC monitoring and surveilling software
X	sysPnP	bootconf.exe	"Homepage hijacker
X	SysPnP	"rundll32 setupapi	InstallHinfSection [varies] oemsyspnp.inf"
Y	SysPool	Mssvc.exe	"StealthDisk - hides folders
X	SysPool	MSSVC32.EXE	"Added by the BANCBAN-IO TROJAN!"
X	SySPower	[path to trojan]	"Added by the BANCBAN-OC TROJAN!"
X	SysProtect	System.exe	"Added by the NETSPY TROJAN!"
X	SysProtect	syp.exe	"SysProtect rogue security software
X	SysProtect	USYP.exe	"SysProtect rogue security software
X	SysProtect Free	USYP.exe	"SysProtect rogue security software
X	SysProtector	SysProtector.exe	"SysProtector rogue security software - not recommended
X	syspw32.exe	syspw32.exe	"Added by the APPFLET.A WORM!"
X	Sysqq	LSESS.exe	"Added by the FORBOT-BF WORM!"
X	Sysqq	weiba.exe	"Added by the DELF-CFX TROJAN!"
X	SysR	sysmd.exe	"Ulubione adult content dialer"
X	SysReg	SysReg.exe	"Added by the CHEKIN TROJAN!"
X	SysReg	SysReg.exe	"SearchSeekFind textual marketing foistware"
X	Sysres	Sysres.exe	"Added by the LOGMOD.A TROJAN!"
X	SysRes	TASKMANAGER.exe	"Added by the ELIPTER.A or ELIPTER.B WORMS!"
X	SysRes	WWE DIVAS.exe	"Added by the ELIPTER.D WORM!"
X	SysRes	IExpIore .exe	"Added by the ELITPER.E WORM!"
X	sysrest32.exe	sysrest32.exe	"Added by the AGENT-GIN TROJAN!"
X	sysrestore32.exe	sysrestore32.exe	"Unknown malware detected by McAfee - see here"
X	Syss	ehuupdate.exe	"EHU adware"
X	SysScan	bvt.exe	"Added by the AUTOUPDER TROJAN!"
X	SysSearch	Regedit.exe -s pcsearch.reg	"Added by the STARTPAGE-FN TROJAN! Note that regedit.exe is a legitimate Microsoft file and shouldn't be deleted. The ""pcsearch.reg"" file is located in %Windir%"
X	SysSearch	Regedit.exe -s sysreg.reg	"Added by the STARTPA-ME TROJAN! Note that regedit.exe is a legitimate Microsoft file and shouldn't be deleted. The ""sysreg.reg"" file is located in %Windir%"
U	SysSense	SysSense.exe	"""SysSense is your personal desktop Google AdSense monitor. It keeps your current Google AdSense information in the Windows system tray"". Google AdSense account required"
X	sysser	[path to file]	"Added by the RAHACK WORM!"
X	SysService	SysService.exe	"Added by the BDFORM-A BACKDOOR!"
U	SysService	SERVICES.EXE	"NSKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	SysService32	SysService32.exe	"Added by the KINDAL VIRUS!"
X	SysService32	ln32k.dll	"Added by the KINDAL VIRUS!"
X	SysService32l	systask32l.exe	"Added by the THEUG WORM!"
X	SysServices	SERVICES.EXE	"Added by the DELF-EY TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	SYSsfitb	SYSsfitb.exe	"AdShooter adware"
X	SySSL	sysl.exe	"Added by the RBOT-CKH WORM!"
X	SySSL	syssl.exe	"Added by the RBOT-DAA WORM!"
X	SysStart	[random filename]	"ZenoSearch adware"
X	SysStart	syswin.exe 1	"Added by the AUTORUN-EY WORM!"
X	SysStrt	systemc.exe	"Added by the AGOBOT-QA TROJAN!"
X	syst	syst.exe	"Added by the DUMB.A ""Joke"" virus"
X	Systam13	f1r5st83.exe	"Added by the IRCBOT-YM WORM!"
X	Systam13	exp.exe	"Added by the RBOT.ESD BACKDOOR!"
X	Systam13	first.exe	"Added by the RBOT.GND BACKDOOR!"
X	Systam13	resx.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Systam13	speedwin.exe	"Added by the RBOT.GVH BACKDOOR!"
X	System	run322.exe	"Added by the LANFILT TROJAN!"
X	System	system.exe	Added by various WORMS and TROJANS!
X	system	regedit -s system.dll	Homepage hijacker
X	system	systemsearch.hta	Jetseeker.com hijacker
X	System	dcomx.exe	"Added by the CIREBOT TROJAN!"
X	system	Explorer.exe	"Added by the GRAYBIRD BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	System	YPager.exe	"Added by the JUNTADOR.K TROJAN! Note - this is not the older version of Yahoo! Messenger which shares the same filename and is located on %ProgramFiles%\Yahoo!\Messenger"
X	system	outlook.exe	"Added by the MIMAIL.Q WORM! Note that the valid Microsoft Outlook executeable is located in %ProgramFiles%\Microsoft Office\Office whereas this one is located in %Windir%"
X	System	Atira.exe	"Added by the KOTIRA VIRUS!"
X	SYSTEM	lsas.exe	"Added by the SPYBOT.CJ WORM!"
X	System	kernels32.exe	"Added by the DLOADER-FC TROJAN!"
U	System	sysctrl.exe	"Added by WinGuardian. Note - this commercial keylogger is no longer made or sold by Webroot but older copies may still be in existance
X	System	csrss.exe	"Added by the LDPINCH.E TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System	SVCHOST.EXE	"Added by the LDPINCH-AU TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	system	lsasse.exe	"Added by the RBOT-YL WORM!"
X	System	systray.exe	"Added by the PISABOY-A TROJAN! Note - this is not the legitimate systray.exe process"
X	System	abcdefg.exe	"Added by the HARWIG-B WORM!"
X	System	cber.exe	Added by an unidentified TROJAN!
X	System	serwin.exe	"Added by the LDPINCH-BN TROJAN!"
X	System	svchîst.exe	"Added by the LDPINCH-BF TROJAN!"
X	System	system.exe (74295303)	"Added by the VB-IU WORM!"
X	System	WINL0G0N.EXE	"Added by the BANCOS-DB TROJAN!"
X	System	wumgrd32.exe	"Added by a variant of the RBOT WORM!"
X	System	SPOOLSU.EXE	"Added by the BANKER-FC TROJAN!"
X	System	system23.exe	"Added by the LEBREAT-D WORM!"
X	System	windowsps.exe	"Added by a variant of the RBOT WORM!"
X	SYSTEM	d.exe	"Added by the MYTOB.LP WORM!"
X	System	inetinfo.exe	"Added by the PARDROP-A TROJAN!"
X	system	services.exe	"Added by the DELF-LQ TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\HELP"
X	SYSTEM	VSSMON.exe	"Added by the RBOT-AWW TROJAN!"
X	SYSTEM	wiinlogon.exe	"Added by the RBOT-AVG WORM!"
X	System	kernels64.exe	"Added by the VIXUP-S TROJAN!"
X	system	lsass.exe	"Added by the SATILOLER.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\System"
X	System	smss.exe	"Added by the AGENT.EP BACKDOOR! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System	winupd.exe	"Added by a variant of the SDBOT WORM!"
X	system	messenger.exe	Added by an unidentified WORM or TROJAN!
X	System	kernels1118.exe	"Added by a variant of the SDBOT WORM!"
X	System	wsscntfy.exe	"Added by a variant of the SDBOT WORM!"
X	SYSTEM	windmupdr.exe	"Added by a variant of the RBOT WORM!"
X	system	svcr.exe	"Added by the SPYONE TROJAN!"
X	System	kernels88.exe	"Added by the TIBS-PP TROJAN!"
X	System	kernels8.exe	"Added by the TIBS.AI TROJAN!"
X	System	OeApi.vbs	"Added by the AGUI WORM!"
X	System	Updaterun.exe	"Added by the QQHELP-DX TROJAN!"
X	System	Zap.exe	"Added by the MSNVB-D WORM!"
X	System	BrO_AcT.exe	"Added by the SILLYFDC-AL WORM!"
X	System	Juegs.exe	"Added by the CULLER-C WORM!"
X	System	kernel8.exe	"Added by the DLOADR-AOL TROJAN!"
X	System	kernelwind32.exe	"Added by the VXIDL.FT TROJAN!"
X	System	Xsfr.exe	"Added by the CULLER-D WORM!"
X	System	kernelwind64.exe	"Added by the DLOADER.DJD TROJAN!"
X	SYSTEM	SystemFile.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	system	ssclie.exe	"Added by the AGENT.LW BACKDOOR!"
X	system	Winhelp.exe	"Added by the IMAUT.CN WORM!"
X	system	kernel32.ini	"Added by the SILLYFDC.CJ WORM!"
X	System	testtestt.exe	"Added by the DWNLDR-ZLC TROJAN!"
X	system	Microsoft Office.exe	"Added by the BANCBAN-LH TROJAN!"
X	System	IEXPL0RE.EXE	"Added by the VB.KS WORM! Note the number ""0"" in the filename"
X	system	sysnet.exe	"Added by the VETOR-J WORM!"
X	system	systemdb.exe	"Barracuda Antivirus and Security Central rogue security software - not recommended
X	System	winipck.exe	"Added by the RBOT-TK WORM!"
X	System	krln32.exe	"Malware installed by different rogue security software including SpyKillerPro"
X	system	system64.exe	"Added by the BANCBAN-PP TROJAN!"
X	System	antivirus.vbe	"Added by the AUTORUN-AYI WORM!"
X	SYSTEM	RUNDLL16.exe	"Added by the DELF-EW BACKDOOR!"
X	System	systemz.exe	"Added by the VILSEL-B TROJAN!"
X	System 64 Driver for Games	sys64dvr.exe	"Added by the SDBOT TROJAN!"
X	System Analyzer	lsass32.exe	"Added by the SDBOT.CNI WORM!"
X	System Applications Profile	sap.exe	"Added by the RBOT-QF WORM!"
X	System Auth	system52.exe	"Identified as a variant of the Win32:Rizo-E malware"
X	System Backup	msystem.exe	Adult content dialler
X	System backup	[random filename]	"Added by the ADMINCASH.B TROJAN! Note - multiple different file names have been spotted
X	System Backup	sysbcp32.exe	"Added by the AGOBOT-NP BACKDOOR!"
X	System Backup Services	backups32.exe	"Added by a variant of the RBOT WORM!"
X	System Boot Check	sysload3.exe	"Added by the FUBALCA WORM!"
X	System Boot Loader	sysboot32.exe	"Added by the SDBOT.PG WORM!"
X	System Buffer Application	buffer32.exe	"Added by the SDBOT-UD WORM!"
X	System Cache	SysCache.exe	"Added by an unidentified VIRUS
X	System CGI Manager	syscgmgr.exe	"Added by an unidentified WORM or TROJAN! See here"
U	System Check	"Rundll32.exe SysDll32.dll	SystemCheck"
X	system check	updater.exe	Unidentified adware downloader
X	System Check	win_klr32.exe	"Added by the DELF-DRA WORM!"
X	System Checking	wasul.exe	"Added by the RBOT.BHM WORM!"
X	System Config	BF3.EXE	"Added by the SPYBOT-DT WORM!"
X	System Config	sysloadcnf.exe	"Added by a variant of the SDBOT WORM! See here"
X	System Config Boot	syscgboot.exe	"Added by the AGENT.VWU TROJAN!"
X	System Config Manager	crss.exe	"Added by the AGOBOT.GH WORM!"
X	System Config Manager	smssl.exe	"Added by the AGOBOT-ZJ WORM!"
X	System Configuration	iexplore.exe	"Added by the RANDEX.AD WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	System Configuration	syscfg32.exe	"Added by the MYTOB.EA WORM!"
X	System Configurator32	SYSTEMCFG.EXE	"Added by the AGOBOT-KS WORM!"
X	system configure	svchost.exe	"Added by the LINEAGE-C TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	System Core Memory	syscoremem.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	System CPL manager	[random filename]	"Added by the RBOT-SR WORM!"
X	System CSRSS Patch	scrtkfg.exe	"Added by the RBOT-ADA WORM!"
X	System Database administration	systemDA.exe	"Added by the DERDERO.B WORM!"
X	System Database Administration Support Process	sysdasp.exe	"Added by the DERDERO.C WORM!"
X	System DataBase Root	sysdbroot.exe	"Added by the QHOST-W TROJAN!"
X	System DB Manager	sysdbmg.exe	"Added by an unidentified WORM or TROJAN! See here"
X	System Defender	WS[random characters].exe	"System Defender rogue security software - not recommended
X	System Device	devices.exe	"Added by the AGENT.AFIF WORM!"
X	System Device Version	systemdv.exe	"Added by a variant of the RBOT WORM!"
X	System Diagnostics	sysdiag32.exe	"Added by the SDBOT.GEN TROJAN!"
N	System DLF	cpqdiaga.exe	Compaq Diagnostic record system utility which allow you to view information about your computer's hardware and software configuration. Available via Start -> Programs
U	System DLL Resources	sysdll.exe	"SnapKey is a surveillance software program that records all keyboard activities. Uninstall this software unless you put it there yourself"
X	System Doctor Free	systemdoc.exe	"SystemDoctor rogue security software - not recommended
X	System Document Application	nmod.exe	"Added by the SDBOT-ABB WORM!"
X	System Document Application	msdocument.exe	"Added by the RANDEX.COX WORM!"
X	System Document Application	wins.exe	"Added by the SDBOT.AUB WORM!"
X	System Document Application	winsvc32.exe	"Added by the SDBOT-VA WORM!"
X	System Download Manager	SysMgr.exe	"Added by the RBOT.CIG WORM!"
X	System driver	Messenger.exe	"Added by the WOOTBOT.GI WORM!"
X	System Drivers	wingmt.exe	"Added by the SDBOT-MG WORM!"
X	System Drivers	cpsq32.exe	"Added by the SDBOT.AXH WORM!"
X	System Drivers	sysdrv32.exe	"Added by the AGOBOT-ZX WORM!"
X	System Efficiency Monitor	mscedit32.exe	"Added by the SDBOT.P TROJAN!"
X	System Efficiency Monitor	mscommand.exe	"Added by the KWBOT.P WORM!"
X	System Efficiency Monitor	msedit32.exe	"Added by the STEPH-B WORM!"
X	System Efficiency Monitor	svchostx.exe	"Added by the KWBOT.E WORM!"
X	System Error Notification	senr32.exe	"Added by the POISON-BT TROJAN!"
X	System Event Manager	secsvc.exe	"Added by the RBOT.BMY WORM!"
X	System Executable DLL Library	EXECDLL32.exe	"Added by the RANDEX.AZ WORM!"
X	System Failure Statistic	cnstat.exe	"Added by the RBOT-LF WORM!"
X	System File Drivers	nvsysvc32.exe	"Added by the AGOBOT.WJ WORM!"
X	System File Startup	sys32.exe	"Added by the RBOT.OTL WORM!"
U	System Files Updater	System Files Updater.exe	"System Files Updater from Flyakiteosx ""will transform the look of an ordinary Windows XP system to resemble the look of Mac OS X"""
X	system firewall	makeini32.exe	"Added by the AGOBOT-PS WORM!"
X	System Firewall	sysfirewall.exe	"Added by the AGOBOT-ACY WORM!"
X	System Firewalls	commandprompt32.exe	"Added by the RBOT.BJT WORM!"
X	System Guard	mhguard.exe	"Added by the RBOT-AGU WORM!"
X	System Handler	LSASS.EXE	"Added by the NIMOS WORM! Note - this is not the legitimate lsass.exe process
X	system handler	srvhandle.exe	"Added by the REDPLUT VIRUS!"
X	System handler	Pandawas.exe	"Added by the BHARAT.A WORM!"
X	System Host	scvhost.exe	"Added by a variant of the RBOT WORM!"
X	System Host Manager	syshost.exe	"Added by the BANWORM-C WORM!"
X	System Host Service	svchost.exe	"Added by the CONE.F WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\tasks"
X	System Information Manager	Navcpe.exe	"Added by the SDBOT-QB WORM!"
X	System Information Manager	Msbb.exe	"Added by the SLINBOT.YR BACKDOOR!"
X	System Information Manager	iexplore.exe	"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	System Information Manager	mslog.exe	"Added by the DELF.AKO TROJAN!"
X	System Information Manager	no.exe	"Added by the SPYBOT.NO WORM!"
X	System Information Manager	syspass.exe	"Added by the SDBOT-MO WORM!"
X	System Information Manager	win.exe	"Added by the SDBOT-MU WORM!"
X	System Information Manager	windowsNt.com	"Added by the SDBOT-ND WORM!"
X	System Init	systeminit.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	System Initialization	msmsgri32.exe	"Added by the RANDEX.D WORM or ROXY or ROXY.B TROJANS!"
X	System Initialization	payload.dat	"Added by the RANDEX.D WORM or ROXY or ROXY.B TROJANS!"
X	System IP	systemip.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	System Kernal Support	system.exe	"Added by the SDBOT.BWV WORM!"
X	System Kernel	lsass.exe	"Added by the VBBOT-G TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	System LifeGuard Scheduler	Slsched.exe	"System LifeGuard scheduler"
X	System Loader	systems.exe	"Added by the AGOGBOT-FI WORM!"
X	System Loader	syscfg.exe	"Added by the AGOBOT-BS BACKDOOR!"
X	System Loaderap	syst19b.exe	"Added by the AGOBOT-AT BACKDOOR!"
X	System Log Event	csrss32.exe	"Added by the AGOBOT-JI WORM!"
X	System Management Service	smsc.exe	"Added by the RBOT-ANN WORM!"
X	System Manager	svchost.exe	"Added by the BANKER-AE TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	system manager	System.exe	"Added by the FORBOT-BO WORM!"
X	System Manager	winsrv32.exe	Added by an unidentified WORM or TROJAN!
X	System Manager	sysmng.exe	"Added by the TAME-C WORM!"
X	System Manager	sysmgr.exe	"Added by the IRCBOT.AGW BACKDOOR!"
X	System Manager	User Documents.exe	"Added by the VB.GF VIRUS!"
X	System Manager	sysmngr.exe	"Added by the IRCBOT.BAQ BACKDOOR!"
X	System Manager	ncvs32.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	System Manager Updates	winsvc.exe	"Added by the AGOBOT.AEM WORM!"
U	System Mechanic Popup Blocker	PopupBlocker.exe	"Popup blocker part of Iolo System Mechanic utility suite"
U	System Mechanic Popup Stopper	Popupstopper.exe	"Popup stopper part of Iolo System Mechanic utility suite"
N	System Mechanic Professional Update [Incinerator.dll]	SysMech4.exe /REREG: [path] Incinerator.dll	"Iolo System Mechanic ""Incinerator"" feature securely deletes files and folders from your PC so they can never be recovered again"
U	System Mechanic Startup Guard	StartupGuard.exe	"System Mechanic Startup Guard protects the Window's startup locations from being modified by viruses
X	SYSTEM MESSAGER	wmisg.exe	"Added by the MYTOB.ES WORM!"
X	System Messaging Queue	SMCSS.EXE	"Added by a variant of the RBOT WORM!"
X	System Messenger	SYSMSG32.EXE	"Added by the SPYBOT-DK WORM!"
X	System Messenger32	systgmgr32.exe	"Added by the SDBOT.DF WORM!"
X	System Microsoft Core	smc.exe	"Added by the RIZO.A TROJAN!"
U	System Monitor	SYSMON.EXE	"Comes with some Aopen motherboards. Monitors CPU temp
X	System Monitor	Sysmon16.exe	"Added by the SDBOT TROJAN!"
X	System Monitoring	cute.exe	"Added by the RAHIWI.A WORM!"
X	System Monitoring	Mooks.EXE	"Added by the BHARAT.A WORM!"
X	System Monitoring	lsass.exe	"Added by the BRONTOK-BS WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X	System MScvb	mscvb32.exe	"Added by the SOBIG.C WORM!"
X	System Net	sys32.exe	"Added by the FORBOT-FX WORM!"
X	System Net Database	sysnd.exe	"Added by the RBOT-AAW WORM!"
X	System Networking	sysnet.exe	"Added by the RBOT.API WORM!"
X	System Power Managment	svcnost.exe	"Added by the DREF-I WORM!"
X	System Presets	[temp name].exe	"Added by the HOSTINF-A WORM!"
X	System Process	csrss.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System Process	lsass.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System Process	svchost.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System Process	CSRSR.exe	"Added by the AGOBOT-SQ WORM!"
X	System Process Analization	sysproc.exe	"Added by a variant of the RBOT WORM!"
X	System Process Analization Thread	system.exe	"Added by a variant of the RBOT WORM!"
X	System Profile	Regsrv.exe	"Added by a variant of the OPTIX TROJAN!"
X	System Protector	lsascs.exe	"System Protector rogue security software - not recommended
X	System RAID Manager	raid64.exe	"Added by the AGENT-NNZ TROJAN!"
X	System Reboot	rebootsys.exe	"Added by the RBOT-WU WORM!"
X	System Redirect	sysbho.exe	"Downloader trojan
X	System Registry Manager	sysrgmgr.exe	"Added by an unidentified WORM or TROJAN! See here"
X	System Restore	svcnet.exe	"Added by the TIBICK WORM!"
X	System Restore Data	[path] repcale.exe [path] beird.exe	"Added by the RANDON.AN WORM! Both files are located in %System%\frbyjed"
X	System Scanner	system.exe	"Added by the AGOBOT-DI BACKDOOR!"
X	System Security Checker	ssc.exe	"Added by the IRCBOT-WI TROJAN!"
X	System Security Updaters	vsmons.exe	"Added by the RBOT-OW WORM!"
X	System Service	MSREXE.EXE	"Added by the AML TROJAN!"
X	system service	spoolcrv.cpl	Added by the INSPIR.11 TROJAN!
X	System Service	systems.exe	"Added by the AGOBOT.VZ WORM!"
X	System Service	coderxt.exe	"Added by the RBOT-ALD WORM!"
X	System Service	exp0lrer.exe	"Added by a variant of the RBOT WORM!"
X	System Service	servicent.exe	"Added by the RBOT-AJI WORM!"
X	System service	system.exe	"Added by the BANCOS.AA TROJAN!"
X	System Service	msnwindows.exe	"Added by the SPYBOT.YCL WORM!"
X	System Service	servicez.exe	"Added by the RBOT-AOY WORM!"
X	System Service	msnxpexe.exe	"Added by the RBOT-AUA WORM!"
X	System Service	teskmangr.exe	"Added by the RBOT-AUV WORM!"
X	System Service	backup.exe	Added by the PACKBOT.AA WORM!
X	System Service	serious.exe	"Added by the RBOT-FMV WORM! Note - deactivates the Microsoft Internet Connection Firewall (ICF)"
X	System Service	b4db0yz.exe	"Added by the RBOT-CLO WORM!"
X	SYSTEM service helper	svchelper.exe	"Added by the MONKBD-A WORM!"
X	SYSTEM service helper	syshelp.exe	"Added by a variant of the MONKBD-A WORM!"
X	System Service Manager	lsmas.exe	"Added by the AGOBOT-IK BACKDOOR!"
X	System Service Manager	norton.exe	"Added by the GAOBOT.AJE WORM!"
X	System Service Manager Device	svho.exe	"Added by the RBOT.GCG BACKDOOR!"
X	System service**	pokapoka**.exe	"EliteBar adware - where ** represents the numbers 61 to 79"
X	System service78	[path to file]	"Added by the ELITEBAR-T and ELITEBAR-U TROJANS!"
X	System service79	[path to file]	"Added by the ELITEBAR-V TROJAN!"
X	System Services	[random file name]	"Added by a variant of the RBOT WORM!"
X	System Services	connection.exe	Added by an unidentified WORM or TROJAN!
X	System Services	svcsenes.exe	"Added by a variant of the RBOT WORM!"
X	System Services	svcsenes32a.exe	"Added by the RBOT-AFG WORM!"
X	System Services	ssms.exe	"Added by a variant of the RBOT WORM!"
X	System Services Monitor	server.exe	"Bifrost malware"
X	System Servlce	live.exe	"Added by the IRCBOT-GX WORM!"
X	System Session Manager	smss.exe	"Added by the KALEL-E WORM! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup!"
X	System settings	burndl32.exe	"Added by the SDBOT-ZO WORM!"
X	System Setup	rpcxcmod.exe	Added by an unidentified WORM or TROJAN!
X	System Soap Pro	soap.exe	"System Soap Pro internet cleaning software. Bundles foistware like Httper and Zipclix - best avoided"
X	system spool	syspools.exe	"Added by the DREF-T WORM/VIRUS!"
X	System Spooler Subsystem	lssas.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
U	System startup	charmapx.exe	Only required if using an oriental language
X	System Startup	Voltio.exe	"Added by the RBOT.NJ WORM!"
X	System Startup	kimochi.exe	"Added by a variant of the RBOT WORM!"
X	System Startup	sys.exe	"Added by a variant of the IRCBOT TROJAN!"
X	System Startup Manager	smcss.exe	"Added by the RBOT.AMD WORM!"
X	System Stats	SystemStats.exe	"Added by a variant of the WOOTBOT WORM!"
X	System Support	syscfg.exe	"Added by the RBOT-AGQ WORM!"
X	System Support	system32.exe	"Added by the RBOT-AHA WORM!"
X	System Support	syssql.exe	"Added by the RBOT-AUH WORM!"
X	System Support	torrent.exe	"Added by a variant of the RBOT WORM!"
X	System Task Manager	taskmrg.exe	"Added by a variant of the SPYBOT WORM! See here"
X	System Terminal	SYSTEM2.EXE	"Added by the SPYBOT-BZ TROJAN!"
X	System time updator	CSysTime.exe	"Added by the RANDEX.S WORM!"
X	system tool	sysguard.exe	"Antivirus System Pro rogue security software - not recommended
X	System Toolkit	Systools.exe	"Added by the RONOPER-G WORM!"
X	System Tray	msccn32.exe	"Added by the SOBIG.B WORM! Warning - spreading via infected E-mail attachments with the sender address faked as support@microsoft.com! Note - this is not the legitimate systray.exe process"
X	System Tray	systray.exe	"Added by the FAN-A WORM! Note - the valid Microsoft systray.exe is normally located in %System% and will only run at startup on Win9x/Me systems. This one is located in %Windir%"
X	System Tray Monitor	tray.exe	"Added by the RBOT.UXR WORM!"
X	System Tray Services	spooles32.exe	"Added by the AGOBOT.ZH WORM!"
X	System Tray32	SysTray32.exe	"Added by the REPAD WORM!"
X	System Unix	syscfg32.exe	"Added by the RBOT-ZD WORM!"
X	system updata	updata.exe	"Added by the LINEAGE-C TROJAN!"
X	System Update	[filename].exe	"CoolWebSearch parasite variant"
X	System Update	[random filename]	"Added by the KORGO.W or KORGO.X WORMS!"
X	System Update	wupdmgr.exe	"Added by the SOROMO-A TROJAN!"
X	System Update	[random filename]	"Added by the SOROMO-A TROJAN!"
X	System Update	wauluclt.exe	"Added by the SDBOT.EF WORM!"
X	System Update	[path to trojan]	"Added by the AUTOTROJ-D TROJAN!"
X	System Update	mssetupconf.exe	"Added by the RBOT.DLC WORM!"
X	System Update Application	msbuffer.exe	"Added by the SDBOT.AFF WORM!"
X	System Update Service	wmiprvsa.exe	"Added by the AGOBOT-RG TROJAN!"
X	System Update Service	winupd32.exe	"Added by the ADTODA-A TROJAN!"
X	System Update Service	system.pif	"Added by the RBOT-ALL WORM!"
X	System Update Service	update.pif	"Added by the SPYBOT.WOE WORM!"
X	System Update Service	wmiprvsv.exe	"Added by the AGOBOT.YG WORM!"
X	System Update Service	csrss32.exe	"Added by the AGOBOT-HI WORM!"
X	System Update2	explorer.exe	"Added by the AUTOTROJ-C TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	System Update2	services.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	System Update2	svchost.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	System Update2	system.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	taskman.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	taskmon.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate Win98/Me file of the same name which is located in %Windir% as this version is located in %System%. It is not normally found on a WinXP system"
X	System Update2	update.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	webcheck.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	wininet.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	winlogon.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate winlogon.exe process
X	System Update2	winspool.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	wupdmgr.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Updated	svchoes.exe	"Added by the RBOT-ASF WORM!"
X	System Updater Machine	crhwss.exe	"Added by the CIADOOR-DQ TROJAN!"
X	System Updater Machine	system.exe	"Added by the CIADOOR.GN BACKDOOR!"
X	System Updater Process	wmiprvsw.exe	"Added by the AGOBOT-IL WORM!"
X	System Updater Service	wmiprvsw.exe	"Added by the GAOBOT.AFC WORM!"
X	System Updates	winsci.exe	"Added by a variant of the RBOT WORM!"
X	System Updates	szwi.exe	"Added by the RBOT-AXE WORM!"
X	System Updates	unve.exe	"Added by the RBOT-AWG TROJAN!"
X	System Updates	wmkl.exe	"Added by the RBOT-AYJ WORM!"
X	System Updates 4	mssysfix.exe	"Added by the RBOT-ADU WORM!"
X	System Updates Manager	winserv32.exe	"Added by the AGOBOT-AGA WORM!"
X	System Updates Service	updates.pif	"Added by the RBOT-AMA WORM!"
X	System Uptime Server	SYSENTRY.EXE	"Added by the RBOT.LK WORM!"
X	System Uptime Server	SYSENTRY32.EXE	"Added by the RBOT.LK WORM!"
X	system xp	acdsee demo.exe	"Added by the SALGA.A WORM!"
X	System-Config	msptmf32.com	"Added by the LIOTEN.FA WORM!"
X	System-Service	EXPLORER.SCR	"Added by the BENJAMIN.A WORM! KaZaA file-sharing users beware!"
X	System-Stat	systats.exe	"Added by the SDBOT.RA WORM!"
X	system.	system..exe	"Added by the OPTIXPRO.13.C TROJAN!"
X	system...	system...exe	"Added by the OPTIXPRO.13.C TROJAN!"
X	System.exe	System.exe	Added by various WORMS and TROJANS!
X	system.exe	system.exe	"Added by the JAMPORK.E WORM!"
X	system.exe	system.exe	"Added by a variant of the IRCBOT BACKDOOR! Located in %WINDIR%\pchealth\helpctr\binaries"
X	System132	Csrtss.exe	"Added by the LANFILT-I TROJAN!"
X	system16	system16.exe	"Added by the BANCBAN-OB BACKDOOR!"
X	system23	notPad.exe	"Added by the ESTEEMS.D TROJAN!"
X	System32	system.exe	"Added by the BUSHTRO122 TROJAN!"
X	System32	System32.exe	Added by any number of WORMS or TROJANS!
U	System32	sysdiag.exe	"SpyAgent surveillance software. Uninstall this software unless you put it there yourself"
X	System32	"system32	1.exe"
X	system32	NeT-BoT.exe	"Added by the AGOBOT-LJ WORM!"
X	System32	lsasss.exe	"Added by the RBOT-XW WORM!"
X	System32	crsvvc.exe	"Added by the RBOT.BLY WORM!"
X	system32	QQGame.exe	"Added by the QQPASS-AC TROJAN!"
X	System32	[worm filename]	"Added by the NAUTICAL-A WORM!"
X	System32	winds32.exe	"Added by the DWNLDR-HFY TROJAN!"
X	System32	csrss.exe	"Added by the SILLYFDC WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	system32	lowinplay.exe	"Added by the VB.FVJ TROJAN!"
U	System32	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
X	System32	svchost.exe	"Added by the ZAPCHAS-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	System32 PCI Manager	syspci32.exe	"Added by the RBOT-AFR WORM!"
X	System32 Runtime StartUp	sysrs.exe	"Added by the AGOBOT.ANW WORM!"
X	System32 Spool	winint.exe	"Added by the FORBOT-N WORM!"
X	System32 TCP Manager	systcpm.exe	"Added by a variant of the RBOT WORM!"
X	System32 TCP Manager	systerm.exe	"Added by the RBOT.AFD WORM!"
X	System32 Temp Service	systmp.exe	"Added by the RBOT-AET WORM!"
X	System32-Driver	csrs32.exe	"Added by the SDBOT-CP BACKDOOR!"
X	system32.dll	systeminit.exe	"CoolWebSearch parasite variant - re-directing to your-search.info"
X	system32.dll	sysdll32.exe	"CoolWebSearch parasite variant. Redirecting to wholeworldmarket.com
X	system32.exe	services32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	system32.exe	system32.exe	"Added by the GRAYBIRD.P TROJAN!"
X	System32BLSJ Agent	System32BLSJ.exe	"Added by the MDROP-BPT TROJAN!"
X	System32Check	[random].exe	"Added by the CHAST-A TROJAN!"
X	System32Dll	DLL32SYS.EXE	"Added by the SPYBOT-CZ WORM!"
X	System32Ex	System32Ex.exe	"Added by the IRCCONTACT TROJAN!"
U	System32kfvw	sysdiag.exe	"SpyAgent surveillance software. Uninstall this software unless you put it there yourself"
X	System32Root	Gadu-Gadu.exe	"Added by a variant of the IRCBOT TROJAN! Note - doe not confuse with the Polish language Instant Messaging client also called Gadu-Gadu"
X	system32WXBP Agent	system32WXBP.exe	"ARDAMAX.HR spyware"
X	System33	FB_PNU.EXE	"Added by the NICHELLO-A WORM!"
X	system34.exe	system34.exe	"Added by the DWNLDR-FXY TROJAN!"
X	System4224411	Virus	"Added by the CAGER.A WORM!"
X	System4224411	Systemdll.exe	"Added by the YUSUFALI-B WORM!"
X	system43.exe	system43.exe	"Added by a variant of the SDBOT WORM!"
X	System51616	msnmsgesser.exe	"Added by a variant of the PUSHBOT WORM! A family of worms that spread using MSN Messenger"
X	System64	inet.exe	"Added by the DENGLE-A TROJAN!"
X	SystemAdministration	Wincmp32.exe	"Added by the ASYLUM TROJAN!"
U	SystemAgent	Sage.exe	"""Microsoft Plus! System Agent automatically tunes your system
X	SystemArmor	SystemArmor.exe	"SystemArmor rogue security software - not recommended
X	SystemB	MessengerStopper.exe	"MessStopper adware"
X	systemb	systemb.exe	"Added by a variant of the IRCBOT TROJAN!"
X	SystemBackup	mtx.exe	"Added by the MTX VIRUS/WORM!"
X	SystemBackup	MicroLog.exe	"Added by the MICROLOG.A TROJAN!"
X	SystemBooster2009	sbr_updater.exe	"SystemBooster2009 rogue system suite - not recommended
?	SystemBoot	ladies.htm	"Unknown but sounds very suspicious??"
X	SystemBoot	Mshta.exe ...filename.hta	Adult content dialler
X	SystemBoot	services.exe	"Added by the SOBER-Q TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Help\Help"
X	Systemboot	msnsngr.exe	"Added by a variant of the RBOT WORM!"
X	SystemCheck	Systemcheck.exe	"Added by the LAVITS WORM!"
X	SystemCheck	services.exe	"Added by the SOBER-M WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Config\system"
X	SystemCheck	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	SystemCheck	SysCheckBop32.exe	"WINBO adware"
U	Systemcheck	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
X	SystemChecker	Syschk.exe	"Added by the GALIL.F WORM!"
X	SystemCleaner	Clean2.exe	"Added by the AUTORUN-AZE WORM!"
X	SystemCleanerPRO	sysclpro.exe	"SystemCleanerPro rogue security software - not recommended
X	SystemCONF98i	SystemCONF98i.exe	"Added by the GLITCH TROJAN!"
X	SystemCop	SystemCop.exe	"SystemCop rogue security software - not recommended
X	SystemData	MBlocker.exe	"Messenger Blocker rogue security software - not recommended"
X	SystemDebug	Sysdeb32.exe	"Added by the SYSBUG TROJAN!"
X	SystemDefender	SystemDefender.exe	"SystemDefender rogue spyware remover - not recommended
X	SystemDevic	devic.exe	"Added by the MIMBOT.A WORM!"
X	SystemDll	SystemDll.exe	"Added by the LOXOSCAM TROJAN!"
X	systemdll.dll	winsys32.exe	"Added by the DELF.CP BACKDOOR!"
X	systemdll32.exe	systemdll32.exe	"Added by the FEUTEL-F TROJAN!"
X	SystemDoctor 2006 Free	sd2006.exe	"SystemDoctor rogue security software - not recommended
X	SystemDoctor Free	systemdoc.exe	"SystemDoctor rogue security software - not recommended
X	SystemDrive	maxpaynow1.exe	"Added by the TIBS.BKU TROJAN!"
X	SystemDriver	csrss.exe	"Added by the ASCETIC.B TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\addins\explorer"
X	SystemDriverCheck	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	SystemDriverLoad	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	systemdrv	ms32sys.exe	"Added by an unidentified WORM or TROJAN - most likely GAOBOT variant"
X	SystemEmergency	[various filenames]	"CoolWebSearch Smartsearch parasite variant"
X	SystemErrorFixer	SysRep.exe	"SystemErrorFixer rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
X	SystemExplorer	explore.exe	"Homepage hijacker - file located in the ""Services"" folder in Common Files"
X	Systemey	systemey.exe	"Added by the SLINBOT.JF BACKDOOR!"
X	SystemFighter	SystemFighter.exe	"SystemFighter rogue security software - not recommended
X	SystemFile	SystemFile.exe	"Added by the DULLDOOR-A TROJAN!"
X	SystemFTP	VSENMB.exe	"Malware (ie
X	SystemGent	CVT.exe	"Added by the BRONTOK-H WORM!"
X	systemguard	systemguard.exe	"System Guard 2009 rogue security software - not recommended
?	SystemGuardAlerter	SystemGuardAlerter.exe	"Part of the Iolo System Mechanic maintenance software. What does it do?"
X	SystemGuardCenter	SystemGuardCenter.exe	"System Guard Center rogue security suite - not recommended
X	SystemHelp	"RUNDLL32.EXE SystemHper.dll	Install"
X	SystemInit	iservc.exe	"Added by the FIZZER WORM!"
X	systeminit	systeminit.exe	"Added by the SILLYFDC-AN WORM!"
X	Systemiom Updater	Systemiom.exe	"Added by the SPYBOT.TY WORM!"
X	SystemIron	SystemIron.exe	"SystemIron rogue security software - not recommended
X	systemkernal.exe	systemkernal.exe	"Added by the AGENT-KPQ TROJAN!"
U	SystemKey	rundll32.exe [path] SystemKey.dll rdl	"Stealth Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	SystemLoad32	sysload32.exe	"Added by the MIMAIL.E WORM!"
X	SystemLoader	sysldr32.exe	"Added by the DOWNLDR-NS TROJAN!"
X	SystemManager	Sysman32.exe	"Added by the DOWNLOADER-BW.B TROJAN!"
X	SystemManager	[random filename]	"Added by the SETTEC ROOTKIT!"
X	SystemMap32	Netisp32.vbs	"Added by the REDIST.C WORM!"
X	SystemMD	md.exe	Homepage hijacker
X	SystemMessenger	rundll32.exe [path] SystemMessenger.dll	"Stealth Chat Monitor spyware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	SystemMgr	Ir32_a.exe	"Added by the MAGANIA-OU TROJAN!"
X	SystemMigration	WinMedia.exe	"Added by the KELVIR.EI WORM!"
X	SystemMonitor	Sysmon32.exe	"Added by the AIDID.A WORM!"
X	SystemNetwork	NETSERV.EXE	Added by the NETCONTROL VIRUS!
X	SystemNetwork	sysnet.exe	"Added by a variant of the RBOT WORM!"
X	SystemNT	SystemNT.exe	"Added by the PWSVB-EG TROJAN!"
X	SystemOPsv	scrtvc32.exe	"Added by a variant of the SPYBOT WORM!"
X	SystemOptimizer2008	main.exe	"SystemOptimizer2008 rogue optimization utility - not recommended
X	SystemOrdnare	SysRep.exe	"SystemOrdnare
X	SystemProcEvent	[trojan filename]	"Added by the IRCBOT.I TROJAN! Filenames used are csrwnd.exe
X	systemr	d11host.exe	"Added by the VB-GX TROJAN!"
X	systemr	gedit.exe	"Added by the ADCLICK-AQ TROJAN!"
?	SystemReg	PROCES.EXE	"??"
X	SystemReg	svchost.exe	"Added by the DEWIN.E BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	SystemReg	WINREG.EXE	"Added by the DEWIN.A TROJAN!"
X	Systems	scchost.exe	"Added by the DAEMOZ.A TROJAN!"
X	Systems	svch0st.exe	"Added by the MYDOOM.BI WORM!"
X	Systems	Systems.exe	"Added by the BANKBOA-A TROJAN!"
X	Systems	itDDD.exe	"Added by the DLOADER-PP TROJAN!"
X	Systems	sescmgr.exe	"Added by the DWNLDR-GAH TROJAN!"
X	Systems	spoolsvc.exe	"Added by the DLOADR-SW TROJAN!"
X	Systems	sysmon.exe	"Added by the VIXUP-BI WORM!"
X	Systems Backups	windrives.exe	"Added by the AGOBOT-RB WORM!"
X	Systems Restart	slchost.exe	"Added by the MULTIDROP.C TROJAN!"
X	Systems Restart	spchost.exe	Added by an unidentified WORM or TROJAN!
X	Systems Restart	"Rundll32.exe beem.dll	DllRegisterServer"
X	Systems Restart	"Rundll32.exe snim.dll	DllRegisterServer"
X	Systems Restart	"Rundll32.exe zolk.dll	DllRegisterServer"
X	Systems Restart	"Rundll32.exe boln.dll	DllRegisterServer"
X	Systems Service	drivex.exe	"Added by a variant of the RBOT WORM!"
X	systems usb driver	Windows2.exe	"Added by a variant of the RBOT WORM!"
U	Systems.exe	Systems.exe	"Keyboard Spectator - monitoring software that creates records of everything people do on a computer
U	systems.exe	systems.exe	"KGBSpy is a commercial surveillance software program. It logs keystrokes
U	SystemSafe	Syssafe.exe	"System Safety Monitor - system monitoring tool with additional application firewalling"
X	SYSTEMSars32	csrss.exe	"Added by the AHLEM.A WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	SystemSAS	System32.exe	"Added by the KWBOT.C WORM!"
X	systemscroot	systembin.exe	"Added by a variant of the RBOT WORM!"
X	SystemSearch	regedit.exe -s ie.reg	"Installs a Seachxl.com browser page hijack. Note that the Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file ""ie.reg"" is located in the root folder (ie
X	SystemSearch	regedit.exe -s sys.reg	"Installs a i--search.com browser page hijack. Note that the Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file ""sys.reg"" is located in %Windir%"
X	SystemSecurity	zprot32.exe	"Added by the AGENT-FK TROJAN!"
X	SystemService	msocfg.exe	Premium rate adult content dialler
X	SystemService	navchk.exe	Premium rate adult content dialler
X	SystemService	qservice.exe	Premium rate adult content dialler
X	SystemService	shman.exe	Premium rate adult content dialler
U	SystemService	nsserver.exe	"NiceSpy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	SystemSettingf	TRUG.vbs	"Added by the TRUG.B MACRO!"
U	SystemSuite Task Manager	MXTASK.EXE	"vcom (nee Ontrack) SystemSuite - PC maintenance and security. Use the program's configuration options to enable only the parts you want running all the time - such as Virusscanner Pro"
X	SystemSv12	newmaxxsv234.exe	"Added by the TIBS-TS TROJAN!"
X	SystemSv121	n2ewma1xxsv234.exe	"Added by the TIBS.TJ TROJAN!"
X	SystemTasks	filez.exe	Adult content dialler
X	SystemTasks	sexypicz.exe	Adult content dialler
X	SystemTasks	loaded.exe	Adult content dialler
X	SystemTools	kernels32.exe	"Added by the DLOADER-FC TROJAN!"
X	SystemTools	kernels1118.exe	"Added by the SMALL.DGK TROJAN!"
X	SystemTools	kernels8.exe	"Added by the FNG TROJAN!"
X	SystemTools	kernels88.exe	"Added by the TIBS-PP TROJAN!"
X	SystemTools	testtestt.exe	"Added by the DWNLDR-ZLC TROJAN!"
X	Systemtra	Systra.exe	"Added by the LOVGATE-W WORM!"
X	SystemTra	CDPlay.EXE	"Added by the LOVGATE.Z WORM!"
X	SystemTra	Video.EXE	"Added by the LOVGATE.E WORM!"
U	SystemTray	SysTray.Exe	"For Win9x/Me - System Tray Services. Provides the Volume Control
X	SystemTray	SystemTray.exe	"Added by the BIGFOOT TROJAN! Note - this is not the legitimate systray.exe process"
X	SystemTray	SysTray.exe	"Added by the ALADINZ.P TROJAN! Note - this is not the legitimate systray.exe process. If you right-click on the real systray.exe the ""Properties"" reveal it to be a Microsoft file"
X	SystemTray	lsvhostwinlk.exe	"Added by a variant of the SPYBOT WORM!"
X	SystemTray	mssgl2.exe	"Added by a variant of the IRCBOT TROJAN!"
X	SystemTray	wekls4.exe	"Added by a variant of the IRCBOT TROJAN!"
X	SystemTray	Windowsupd.exe	"Added by a variant of the IRCBOT TROJAN!"
X	SystemTray Monitor	SysTraymon.exe	"Added by a variant of the SPYBOT WORM! See here"
U	SystemTraySD	SDSystemTray.exe	"Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here"
U	SystemTraySR	SRSystemTray.exe	"Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here"
X	SystemTuner	SystemTuner.exe	"System Tuner rogue system suite - not recommended
N	SystemUpd	SystemUpd.exe	"Updater for Swapoo.com
X	SystemUpdate	Negdo.exe	"Added by the CULLER-C WORM!"
X	SystemUpdate	Xeyu.exe	"Added by the CULLER-D WORM!"
X	SystemVeteran.exe	SystemVeteran.exe	"SystemVeteran rogue security software - not recommended
X	systemw32	systemw32.exe	"Added by a variant of the RBOT WORM!"
X	SystemWarrior	SystemWarrior.exe	"SystemWarrior rogue security software - not recommended
U	SystemWeb	rundll32.exe [path] SystemWeb.dll rdl	"StealthWeblog surveillance software. Uninstall this software unless you put it there yourself! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	SystemWideHook for Windows NT	%WinHook32.exe	"Added by the MYDOOM.AC WORM!"
X	SystemWindows	scvhost.exe	"Added by the SILLYFDC-CG WORM!"
U	SystemWizard Sniffer	Sniffer.exe	"SystemWizard for Win98/ME from SystemSoft - diagnoses and solves hardware and software problems on a PC"
X	SystemX	nzm.exe	"Added by a variant of the RBOT WORM!"
X	systemx32	systemx32.exe	"Added by a variant of the RBOT WORM!"
X	systemyom Updater	systemyom.exe	"Added by a variant of the IRCBOT TROJAN!"
X	SYSTEMZ Patch	SYSZ.exe	"Added by the ALADINZ.P TROJAN!"
U	System_Messages	pprsen.exe	"TerminatorX - ""offers an easy and effective method of stopping users running predetermined file sharing programs like KaZaA
X	systen32.exe	systen32.exe	"Added by the DLOADR-AQP TROJAN!"
X	Systes	jrdtifkkxbbsa.exe	"Added by the RBOT-ADC WORM!"
X	Systesms.exe	systesms.exe	"Added by the RBOT-HI WORM!"
U	Systest	Systest.exe	"Clean Space internet evidence eliminator"
X	SysteZ	d1.exe	"Added by the MSNDIABLO.A WORM!"
X	systhread	winkernal.exe	"Added by the LIAMED WORM!"
X	systhread	HELLO.EXE	"Added by the WINKER.F BACKDOOR!"
X	SysTime	systime.exe	"CoolWebSearch parasite variant - also detected as the STARTPA-FL TROJAN!"
X	Systmesy	Systmesy.exe	"Added by the RBOT-KQ WORM!"
X	SYSTMON.EXE	SYSTMON.EXE	"Added by the SILLY-H WORM!"
X	Systoan32	systoan.exe	"Added by an unidentified VIRUS
X	systr	SYSERVER.exe	"Added by the VB-DQY WORM!"
X	systr2	SERVICE.exe	"Added by the VB-DQY WORM!"
?	systr32	systr32.exe	"??"
X	systrans	[path to trojan]	"Added by the STARTPA-GZ TROJAN!"
X	systrasx	CONSOLES.EXE	"Added by the SDBOT-NW WORM!"
?	systrax	systrax.exe	"??"
X	Systray	Systray_.Exe	"Added by the KERGEZ.A WORM!"
X	Systray	[filename.exe]	"Winfavorites adware"
X	SYSTRAY	UNMT.EXE	"Added by the DLOADER-LQ TROJAN!"
X	SysTray	SysTray.Exe	"Added by the BANCBAN-JV TROJAN! Note - this is not the legitimate systray.exe process from Win9x/Me systems which would appear in the Name/Startup Item field as SystemTray in the registry ""Run"" keys and MSConfig. If you right-click on the real systray.exe the ""Properties"" reveal it to be a Microsoft file"
X	SysTray	Snnpapi.exe	Added by an unidentified TROJAN!
X	Systray	w32explorer.exe	"Added by the RBOT-AJY WORM!"
X	Systray	SteFanie.vbs	"Added by the STEFAN WORM! Note - make sure you check the hyperlink as this one copies it's self to numerous dirves and folders"
X	Systray	KAT.vbs	"Added by the SOAD-D WORM!"
X	SysTray	svhost.exe	"Added by the RAJILO-A WORM!"
X	SysTray	system.exe	"Added by the DELF.E TROJAN!"
X	systray	system234.exe	"Added by the AUTORUN.AEV WORM!"
U	systray	winlogin.exe	"KidControl surveillance software. Uninstall this software unless you put it there yourself"
U	systray	systray.exe	Dell Mobile Broadband wireless configuration utility - located in %ProgramFiles%\Dell\Dell Mobile Broadband
X	Systray driver	systray.exe	"Added by the MUTEBOT TROJAN! Note - this is not the legitimate systray.exe process"
X	SystrayServices	Msxpw.exe	"Added by the CITOR WORM!"
U	SYSTRAYX	SysTrayX.EXE	"""SystrayX helps you hide some of the less used icons from the system tray (the hidden icons can still be seen and used in the special SysTrayX menu but will no longer permanently take precious space from your system tray)"""
X	systree	systree.exe	"Added by the BANCOS.L TROJAN!"
X	Systry	[path to worm]	"Added by the AUTEX WORM!"
X	Systryt	[path to worm]	"Added by the AUTEX WORM!"
X	SystUphes	algesetp.exe	"Added by the QQPASS-AM TROJAN!"
U	Systweak Ad and Popup Blocker	adblock.exe	"Ad and popup blocker part of Advanced System Optimizer from Systweak"
U	Systweak Memory Optimizer	memtuneup.exe	"Part of SysTweak Advanced System Optimizer"
X	systwtray	twitty**.exe [** = random digits]	"Added by the KOOBFACE.C WORM!"
X	sysu	sysu.exe	"Dynamic Desktop Media adware - see here"
X	sysug32.exe	sysug32.exe	Added by an unidentified TROJAN or WORM!
X	SysUpd	Sysupd.exe	"VirtuMonde adware"
X	sysupdate	cmman32.exe	"Added by a variant of the SDBOT WORM!"
X	SysUtils	smss.exe	"Added by the AUTORUN-AWW WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %UserProfile%"
X	Sysvupex	Sysvupex.exe	"Added by the MEDIAS TROJAN!"
X	sysvx	sysvx_.exe	"Added by the LOOSKY-BX TROJAN!"
U	SysW8	csta.exe	"Clean Space internet evidence eliminator"
U	SYSWB6	SYSWB6.exe	"Part of We-Blocker - gives parents the opportunity to monitor their children's Internet access and provide them with age-appropriate content
X	SysWin	SysWin.exe	"Added by the IRCCONTACT TROJAN!"
X	syswin	v6.exe	"Added by the AGENT-ECM TROJAN!"
X	syswin.txt	[3 random letters].exe	"Added by a variant of the SPYBOT WORM! See here"
X	syswin32	syswin32.exe	"Added by a variant of the SPYBOT WORM!"
X	Syswindow	Syswindow.exe	"Added by the COW TROJAN!"
X	SysWy	rundll32.exe	"Added by the LINEAGE-JH TROJAN! Note - this is not the legitimate rundll32.exe process
X	sysX3	sys22.exe	"Added by the RANTS.C WORM!"
X	sysygm32	syscxd32.exe	"Added by the IRCBOT-PC TROJAN!"
X	sysygm64	winrxd64.exe	"Added by the IRCBOT-RK TROJAN!"
X	SYS_CLEAN	Service.exe	"Added by the FLOPCOPY WORM!"
X	Sys_Run	ghost.exe	"Added by the LINEAGE-N TROJAN!"
X	sys_Runtt1	explorer.exe	"Added by the LINEAGE-M TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %ProgramFiles%"
X	sys_up1	svchostsys.exe	"Added by the MULTIDR-FL TROJAN!"
X	Tapisys	tss.exe	Added by the SMALL TROJAN!
X	Task Debugger	sysdll.exe	"Added by the RBOT-CQ WORM!"
X	Taskbar System	tasksys.exe	"Added by a variant of the SDBOT WORM!"
X	Taskman	sysdate.exe	"Added by the SILLYFDC.BCQ WORM!"
X	Taskman	sysdrv.exe	"Added by the AGENT-LRB TROJAN!"
X	Taskmgr	system.exe	"Added by the PAKES.G TROJAN!"
X	tasksys	tasksys.vbs	"Added by the BYRON WORM!"
Y	ThinkVantage Active Protection System	TpShocks.exe	"Part of the Active Protection System found on some IBM/Lenovo Thinkpad models - including the T
X	this free	winsyst.exe	"Added by the MADAG.A WORM!"
X	toolsicuro	SysRep.exe	"ToolSicuro
X	Topic Tilesys	Tilesys.com	"Added by a variant of the RBOT WORM!"
X	Torrent Management Service	system32.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	transys	"rundll32.exe transys.dll	start"
X	Tray manager system	traysys.exe	"Added by the RIZO.A TROJAN!"
?	tsyssmon	tsyssmon.exe	"Found in a Toshiba\sysstability directory"
X	TSystem	[trojan filename]	"Added by the NSYS-A TROJAN!"
X	TurBo	System.Trubo.vbs	"Added by the AUTOM-C WORM!"
X	Tweak System	Genderowo.exe	"Added by the SILLYFDC WORM!"
X	Ultimate System Guard	MainFAVProj.exe	"Ultimate System Guard rogue security software - not recommended
X	Ulubione	sys****.exe	"Ulubione adware"
X	Update	Sysupd.exe	Added by the SLACKBOT VIRUS!
X	update mon sys	updaterar.exe	"Added by a variant of the RBOT WORM!"
X	updateWins	systrey.exe	"Added by the RANDON WORM!"
X	UpdSys	[random filename]	Added by the BJ TROJAN!
X	USB 2.0 Driver	Winsys32.exe	"Added by the AGOBOT-QM WORM!"
X	USB 2.0 Driver	winsystem.exe	"Added by the AGOBOT-QS WORM!"
X	userd	systems.com	"Added by the OUTLAW-A WORM!"
X	UserSystem	[filename]	"CoolWebSearch Smartsearch parasite variant. Also detected as the SEARCH-A TROJAN!"
X	usrgtway.exe	syswrun4x.exe	"Added by the MITGLIEDER.E TROJAN!"
X	UtilisateurSur	SysRep.exe	"UtilisateurSur
X	Video Process	sysconf.exe	"Added by the GAOBOT.GEN!POLY or GAOBOT.UM or GAOBOT.ADX WORMS!"
X	Video Process	ntsystm.exe	"Added by the GAOBOT.ZX WORM!"
X	Video Processor	msconfsys88.exe	"Added by the AGOBOT-QG WORM!"
X	Video Services	sys32.exe	"Added by the AGOBOT.PS WORM!"
X	VirusScanner	mnsys.exe	"Added by the SDBOT-AFQ WORM!"
X	vtmesys	netcxcfm.exe	"Added by a variant of the RBOT-GNA WORM!"
X	vtmesys	netlprto.exe	"Added by the RBOT-GNA WORM!"
X	W32SYS	w32sys.exe	"Added by the JAMBU-A WORM!"
X	Wardo	syslaunch.exe	"Added by the ADCLICKER.G TROJAN!"
Y	Warning: do not remove it! (system)	cfpsys.exe	"Folder Password Protect - a program that lets you set a password on folders of your choice"
X	wcsys	wcsys.exe	"Added by the KEYLOG-AP TROJAN!"
X	WDNS SYSTEM	nibie.exe	"Added by the MYTOB-BY WORM!"
X	WDNS SYSTEM	skybotx.exe	"Added by the MYTOB-BY WORM!"
X	WDNS SYSTEM	wdns33.exe	"Added by the MYTOB-BY WORM!"
X	Win CPU	sysin.pif	"Added by the RBOT-AXL WORM!"
X	Win Update	SysUpdate.exe	"Added by the AGOBOT-TN WORM!"
X	WIN USB 2.0	usbsystem.exe	Added by an unidentified WORM of TROJAN!
X	Win32	system32.vbs	"Added by the SWERUN VIRUS!"
X	Win32	sysmon.exe	"Added by the MYTOB-HQ TROJAN!"
X	Win32 Driver	sysmls.exe	"Added by the MYTOB.JH WORM!"
X	Win32 System Kernel	winservice.exe	"Added by the SDBOT.KIN WORM!"
X	win32 system server	winserver.exe	"Added by the DERMON-A TROJAN!"
X	Win32 System Spool	spoolsvc.exe	"Added by the SDBOT.UK WORM!"
X	Win32 USB2 Driver	sys32.exe	"Added by the WOOTBOT.X WORM!"
X	Win32 USB2 Driver	sys32snd.exe	"Added by the FORBOT-AN WORM!"
X	Win32 USB2 Driver	syscfg32.exe	"Added by the FORBOT-R WORM!"
X	win32beta	win32sys4.exe	"Added by the BANKER-DA TROJAN!"
X	win32ini	systroy.exe	"Added by the IRC.ALADINZ.C TROJAN!"
X	win32serv	systemdevices.exe	"Added by a variant of the PUSHBOT WORM! A family of worms that spread using MSN Messenger"
X	Win32system	[random filename]	"Added by the DDV.B WORM!"
X	Win32System	win32s.exe	"Added by the MYDOOM.V WORM!"
X	Win32SystemMonitor	***.exe [* = random char]	Browser hijacker
X	Win32SysV	xin.exe	"Added by the FORBOT-EO WORM!"
X	WIN32WN	system_wc.exe	"Eziin adware"
X	wincfg	syscnfg.exe	"Added by an unidentified VIRUS
X	Wind River Systems	vxworks.exe	"Added by the ACKANTTA WORM! Note that this is not related to the VxWorks platform from Wind River"
U	WINDLL	WSYS.EXE	"STARR key logger. "It logs almost everything that goes through the box. It logs all key strokes
X	WinDLL (sysx32.dll)	"rundll32.exe sysx32.dll	start"
X	windllsys32.exe	windllsys32.exe	"Added by a variant of the MITGLIE-A TROJAN!"
X	windows	system copy.exe	"Added by the SALGA.A WORM!"
X	Windows	system.exe	"Added by the SPYBOT.OBB WORM!"
X	windows	VBSyS.vbs	"Added by the ROCK-D WORM!"
X	Windows Activate System	syssv.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows applications server	SysShield.exe	"Added by the unregistered version of Personal Anti Malware rogue security software - not recommended
X	Windows Audio System	nndsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows backup	systemss.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Bootup	Systemwks32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Config	SSYS.EXE	"Added by the SPYBOT-DA WORM!"
X	Windows Config System	config.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Configuration	wsys32.exe	"Added by the GAOBOT.FB WORM!"
X	Windows Configuration System	IExplore.exe	"Added by the RBOT-DDG WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows DLL Loader	SYSCFG16.EXE	"Added by the DOMWIS-N WORM!"
X	Windows DLL Services	system.exe	"AGENT.H spyware"
X	Windows Drive Compatibility	System32Driver32.exe	"Added by the SUPOVA.Z WORM!"
X	Windows Explorer	system32.exe	"Added by the RBOT-AJH WORM!"
X	Windows Explorer	system.exe	"Added by the STIRAUT WORM!"
X	Windows Explorer Services	exploresys.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows File Migration Wizard	HIMENSYST.EXE	"Added by the RBOT-EMO WORM!"
X	Windows File System Frame	ntframe.exe	Added by an unidentified WORM or TROJAN!
X	Windows Fixes Systems	elite.exe	"Added by the MYTOB.EG WORM!"
?	Windows Help System	Help.pif	"??"
X	Windows Hijack Protection System	commngr.exe	"Added by a variant of the AGENT-FYD TROJAN!"
X	Windows HTML file reader	Sysconf32.exe	"Added by the NOOMY.A WORM!"
X	WINDOWS ID SYSTEM	wID32.exe	"Added by the MYTOB.LN WORM!"
X	Windows Identify	sysays.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Windows Kernel System Service	wkssvr.exe	"Added by a variant of the RANDEX.GEL WORM!"
X	Windows Loader	SysUpdate.exe	"Added by a variant of the SDBOT WORM!"
X	WINDOWS MANAGEMENT SYSTEM	wm1exe.exe	"Added by the RBOT-VT WORM!"
X	Windows Messanger Control Center	winsys.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Netsystem Layer	Netsystem.exe	"Added by the RBOT.BEI WORM!"
X	Windows Networking	winsys32.exe	"Added by the GAOBOT.FL WORM!"
X	Windows Nivedia Driver	sysMGT.exe	"Added by a variant of the RBOT WORM!"
X	Windows Rescue System	winsto.exe	"Added by the SUURCH.CG TROJAN!"
X	windows run	system.exe	"Added by the ICPASS-A WORM!"
X	Windows Secure Messaging System	msnmsgrsrvc.exe	"Added by the RBOT-RE WORM!"
X	Windows Security Center Notification Applsee	sysecurex.exe	"Added by a variant of the RBOT-GKX WORM!"
X	Windows Server Drivers	syssrv.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows Services	winsysdll.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services	winsyssrv.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Services Ink Platform Tablet Input Subsystem	wsiptis.exe	"Added by the RBOT.APC WORM!"
X	Windows Session Manager Subsystem	smss.exe	"Added by the KALEL-B WORM! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup!"
X	Windows Startup	Winsys32.exe	"Added by the RBOT.AAB WORM!"
X	Windows Startup 32 Bits	sysrun32.exe	Added by a variant of the DARKSUN TROJAN!
X	Windows Subsys	winload.exe	"Added by the NETSPREE.C WORM!"
X	Windows SysNotify	mssecc.exe	"Added by the AGENT-GFR TROJAN!"
X	WINDOWS SYSTEM	beta.exe	"Added by the MYTOB.DF WORM!"
X	WINDOWS SYSTEM	dcomuser.exe	"Added by the MYTOB.EO WORM!"
X	WINDOWS SYSTEM	lf66prc.exe	"Added by the MYTOB.GC WORM!"
X	WINDOWS SYSTEM	msdev32.exe	"Added by the MYTOB.EH WORM!"
X	WINDOWS SYSTEM	nec.exe	"Added by the MYTOB-L WORM and variants!"
X	WINDOWS SYSTEM	nibie.exe	"Added by the MYTOB-BY WORM!"
X	WINDOWS SYSTEM	ninfoie.exe	"Added by the MYTOB-EP WORM!"
X	WINDOWS SYSTEM	skybot.exe	"Added by the MYTOB-CX WORM!"
X	WINDOWS SYSTEM	skybotx.exe	"Added by the MYTOB-BY WORM!"
X	WINDOWS SYSTEM	smoc.exe	"Added by the MYTOB.FU WORM!"
X	WINDOWS SYSTEM	smsc.exe	"Added by the MYTOB-BR WORM!"
X	WINDOWS SYSTEM	test.exe	"Added by the MYTOB.DJ WORM!"
X	WINDOWS SYSTEM	test2.exe	"Added by the MYTOB.DJ WORM!"
X	WINDOWS SYSTEM	test3.exe	"Added by the MYTOB.DV WORM!"
X	WINDOWS SYSTEM	wdns33.exe	"Added by the MYTOB-BY WORM!"
X	WINDOWS SYSTEM	win.exe.exe	"Added by the MYTOB.FA WORM!"
X	WINDOWS SYSTEM	winaup.exe	"Added by the MYTOB-DN WORM!"
X	WINDOWS SYSTEM	winligon.exe	"Added by the MYTOB.EP WORM!"
X	WINDOWS SYSTEM	winmon.exe	"Added by the MYTOB.GB WORM!"
X	WINDOWS SYSTEM	winNTsys32.exe	"Added by the MYTOB-DM WORM!"
X	WINDOWS SYSTEM	winsvc32.exe	"Added by the MYTOB.HH WORM!"
X	Windows System	WINSYS.exe	"Added by the RBOT-AEF WORM!"
X	WINDOWS SYSTEM	winsys33.exe	"Added by the MYTOB.EK WORM!"
X	WINDOWS SYSTEM	winvnc.exe	"Added by the MYTOB.EU WORM!"
X	WINDOWS SYSTEM	winxpserv.exe	"Added by the MYTOB-BQ WORM!"
X	WINDOWS SYSTEM	xxx.exe	"Added by the MYTOB.CZ WORM!"
X	Windows System	winsys32.exe	"Added by the MYTOB-IS WORM!"
X	WINDOWS SYSTEM	skybot.exe	"Added by the MYTOB.JU WORM!"
X	WINDOWS SYSTEM	botzor.exe	"Added by the ZOTOB WORM!"
X	WINDOWS SYSTEM	gothica.exe	"Added by the MYTOB.HU WORM!"
X	WINDOWS SYSTEM	msnl.exe	"Added by the MYTOB.IK WORM!"
X	WINDOWS SYSTEM	per.exe	"Added by the ZOTOB.C WORM!"
X	WINDOWS SYSTEM	twunk_65.exe	"Added by the MYTOB-EG WORM!"
X	WINDOWS SYSTEM	servce.exe	"Added by the MYTOB-EI WORM!"
X	WINDOWS SYSTEM	servises.exe	"Added by the ZOTOB-I WORM!"
X	WINDOWS SYSTEM	xpupdate.exe	"Added by the ZOTOB-G WORM!"
X	WINDOWS SYSTEM	expI0rer.exe	"Added by the MYTOB-FI WORM! Note the upper case ""i"" and number ""0"" in the filename"
X	WINDOWS SYSTEM	msn32.exe	"Added by the MYTOB-FX WORM!"
X	WINDOWS SYSTEM	sky.exe	"Added by the MYTOB.LB WORM!"
X	WINDOWS SYSTEM	Win32IMAPSVR.exe	"Added by the MYTOB-FQ or MYTOB-FU WORMS!"
X	WINDOWS SYSTEM	winsvc.exe	"Added by the MYTOB.LM WORM!"
X	WINDOWS SYSTEM	mswins.exe	"Added by the MYTOB.DP WORM!"
X	WINDOWS SYSTEM	mtrnqs.exe	"Added by the MYTOB.IG WORM!"
X	WINDOWS SYSTEM	logic.exe	"Added by the MYTOB.IC WORM!"
X	WINDOWS SYSTEM	ctech.exe	"Added by the MYTOB-KD WORM!"
X	WINDOWS SYSTEM	efefefe.exe	"Added by the MYTOB-KH WORM!"
X	WINDOWS SYSTEM	svchost2.exe	"Added by the MYTOB.OZ WORM!"
X	WINDOWS SYSTEM	skybot.exe	"Added by the MYTOB.EB WORM!"
X	WINDOWS SYSTEM	wupdate.exe	"Added by the MYTOB-HT WORM!"
X	Windows System	system.exe	"Added by the MYTOB-GN WORM!"
X	Windows System 32	winsys_32.exe	"Added by the RBOT-FTR WORM!"
X	Windows System 32-Bat Service	win32bat.exe	"Added by the MYTOB.FI WORM!"
X	Windows System Backup	SysBackup.exe	Unidentified malware
X	WINDOWS SYSTEM By FEnR	windasz-updote.exe	"Added by the MYTOB.LR WORM!"
X	WINDOWS SYSTEM Cleaner	h3.exe	"Added by the MYTOB.EQ WORM!"
X	WINDOWS SYSTEM CLEANER	iexplore.exe	"Added by the MYTOB.ET WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows System Configuration	SYSCFG16.EXE	"Added by the WISDOOR-K TROJAN!"
X	Windows System Configuration	Passcfg16.exe	"Added by the DOMWIS-E TROJAN!"
X	Windows System Configuration	Winfrw.exe	"Added by the SOLUFINA TROJAN or the DOMWIS-J WORM!"
X	Windows System Configuration	wincfg.exe	"Added by the AGOBOT.OP WORM!"
X	Windows System Configuration	WINCFG32.EXE	"Added by the AGOBOT-TE WORM!"
X	Windows System Configuration	WinNeth.exe	"Added by the RETHE-A WORM!"
X	Windows System Configuration	nether.exe	"Added by the OPANKI-AB WORM!"
X	Windows System Configuration	WINSYS32.exe	"Added by the SDBOT.AXK WORM!"
X	Windows System Defender	WS[random characters].exe	"Windows System Defender rogue security software - not recommended
X	WINDOWS SYSTEM Dns	windsns.exe	"Added by the MYTOB.EY WORM!"
X	WINDOWS SYSTEM DNSPOOL	hbmail.exe	"Added by the MYTOB.FW WORM!"
X	Windows System Drivers	sysretain.exe	"Added by the SLENFBOT.BY WORM!"
X	Windows System File	cmxp.exe	"Added by the SPYBOT.KHO WORM!"
X	WINDOWS SYSTEM FILE	winload.exe	"Added by the MYTOB.DK WORM!"
X	Windows System Gateway	SPOOLER.EXE	"Added by a variant of the RBOT WORM!"
X	Windows System Guard	egun.exe	"Added by the AGENT-NHY TROJAN!"
X	Windows System Guard	msdn.exe	"Added by the FAKEAV-BJD TROJAN!"
X	Windows System Guard	msng.exe	"Added by the EGGDROP-BO WORM!"
X	Windows System Guard	msns.exe	"Added by the DWNLDR-IGD TROJAN!"
X	Windows System Init	winit32.exe	"Added by a variant of the RBOT WORM!"
X	Windows System Manager	winsystem.exe	"Added by the RBOT-AN WORM!"
X	Windows System Manager	CRSL.EXE	"Added by the SDBOT.MG WORM!"
X	Windows System Manager	sysconf.exe	"Added by the MYTOB.AL WORM!"
X	Windows System Manager	smsc.exe	"Added by a variant of the RBOT WORM!"
X	Windows System Manager	crssm.exe	"Added by the RBOT-AFH WORM!"
X	WINDOWS SYSTEM MANAGER	spoolsvc.exe	"Added by the MYTOB-LY WORM!"
X	Windows System Manager	winsysmgr.exe	"Added by the IRCBOT.BJG BACKDOOR!"
X	Windows System Manager Loader	smsls.exe	"Added by the AGOBOT.TF WORM!"
X	Windows System Manager Proc	winsmc.exe	"Added by the RBOT.JH WORM!"
X	WINDOWS SYSTEM MEMORY LOADER	memloader.exe	"Added by the MYTOB-IN WORM!"
X	WINDOWS SYSTEM mscdvvs	mscdvvs.exe	"Added by the MYTOB.MD WORM!"
X	windows system notepad	wnpsm.exe	"Added by a variant of the RBOT WORM!"
X	Windows System Restore Configuration	Sblhost.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows System Restorer	SystemRestorer.exe	"Added by the DULOAD.C WORM!"
X	WINDOWS SYSTEM SCALPE	scalpe91.exe	"Added by the MYTOB-HI WORM!"
X	Windows System Security	winmp.exe	"Added by the RBOT.IV WORM!"
X	Windows System Security	sys32.pif	"Added by the RBOT-AOL WORM!"
X	Windows System Security Monitor	[4 random letters].exe	"Added by the PINKTON.A WORM!"
X	Windows System Serivce	winserv.exe	"Added by the RBOT.ACA WORM!"
X	windows system service	winsock.exe	"Added by the RBOT-MR WORM!"
X	Windows System Service	wnuserv.exe	"Added by the SPYBOT.ANDM WORM!"
X	Windows System Service	[worm filename]	"Added by the RBOT.XG WORM!"
X	Windows System Suite	WS[random characters].exe	"Windows System Suite rogue security software - not recommended
U	Windows System Tray	msni.exe	"Iambigbrother monitoring software"
X	Windows System Tray	swhost.exe	"Added by an unidentified VIRUS
X	WINDOWS SYSTEM UPDATE	xDcc.exe	"Added by the MYOTB-EH WORM!"
X	Windows System Update Tools	upds.exe	"Added by the VANBOT.CX BACKDOOR!"
X	Windows System-Control Drivers	syscontrl.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows System32	windowsp.exe	"Added by the MYTOB.GD WORM!"
X	Windows System32	winsys32.exe	"Added by the SDBOT-AHS WORM!"
X	Windows System32	clsas32.exe	"Added by the RBOT-AZO WORM!"
X	Windows System32	explorer.exe	"Added by the OPANKI-V WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is also copied to %System%"
X	Windows System32	System32.exe	"Added by the SDBOT-ALI WORM!"
X	Windows SYSTEM32	Realplayer.exe	"Added by the SPYBOT.ZH WORM!"
X	Windows System32	wingrd32.exe	"Added by a variant of the RBOT WORM!"
X	Windows System32	windows32.exe	"Added by the RBOT-FPB WORM!"
X	Windows System32 Driver	clsass32.exe	"Added by the SDBOT-AGG WORM!"
X	Windows System32 Kernel	system32.exe	"Added by the SDBOT-AAT WORM!"
X	Windows SystemDll	SYSTEMDLL.EXE	"Added by the AGOBOT-LP WORM!"
X	WINDOWS SYSTEMn	servicces.exe	"Added by the MYTOB-EL WORM!"
X	Windows Systemnmg	stagmr.exe	"Added by the MYTOB.S WORM!"
X	Windows Systems16	winjews16.exe	"Added by the SDBOT-CXT WORM!"
X	Windows SYStry	spoolsvr.exe	"Added by the SDBOT.GN BACKDOOR!"
X	Windows SYStry	systry.exe	"Added by the SDBOT-E WORM!"
X	Windows Task Service (32-bits)	tasksys.exe	"Added by the DREFIR.D WORM!"
X	Windows Taskbar System	tasksys.exe	"Added by a variant of the SDBOT WORM!"
X	Windows TM	windowssys32.exe	"Added by a variant of the RBOT WORM!"
X	Windows TM	WinxSys.exe	"Added by a variant of the RBOT WORM!"
X	Windows TM	Syss.exe	"Added by the RBOT.ADF BACKDOOR!"
X	Windows Update	sysdrv.exe	"Added by the AGENT-IYE TROJAN!"
X	Windows Update 32	slsys.exe	"Added by the FORBOT-FT WORM!"
X	Windows Update Check	syslodr.exe	"Added by the SMALL.LU TROJAN!"
X	Windows Update Firewall System	ctfmoom.exe	"Added by the RBOT-GAN WORM!"
X	Windows Update Firewall System	winmsfw.exe	"Added by the RBOT-EEO WORM!"
X	Windows Update Firewall System	ctfmom.exe	"Added by the SPYBOT.ANDM WORM!"
X	Windows Update Service 2004/2005	systemupdate.exe	"Added by the RBOT-JE WORM!"
X	Windows Update Software	system.exe	"TOFGER.BX spyware"
X	Windows Update System	mswins.exe	"Added by the IRCBOT.DN WORM!"
X	Windows Update System Shell	svhostcs32.exe	"Added by the RBOT-AAZ WORM!"
X	Windows Updater	sdsys.exe	"Added by the FORBOT-JG WORM!"
X	Windows Version Service	sysvers.exe	"Added by the SLENFBOT.IF WORM!"
X	Windows Version Service	sysvers32.exe	"Added by the SLENFBOT.HZ WORM!"
X	Windows-System	System32.exe	"Added by the LOGPOLE.C WORM!"
X	Windows32	system.exe	Unknown malware
X	WindowsAgent	sysexhook.exe	"Added by the GOP keyboard logger/TROJAN!"
X	WindowsAudio	systemupd.exe	"Added by the AGENT-TH WORM!"
X	WindowsFileSystem	winsfs32.exe	"Added by the RBOT-FMQ WORM!"
X	WindowsFileSystem	cidaemon32.exe	"Added by the RBOT-FSP WORM!"
X	WindowsRegKey update	winsys.exe	"Added by the RBOT-JY WORM!"
X	WindowsRegKeys update	winsysi.exe	"Added by the SDBOT.WE WORM!"
X	WindowsSystem32	asper.exe	"Added by the AGENT-EFP TROJAN!"
X	WindowsSystem32	svchosts.exe	"Added by the AGENT-EDA TROJAN!"
X	WindowsSystem32	[path to worm]	"Added by the SDBOT-DFG WORM!"
X	WindowsSystem32	msnmssgr.exe	"Added by the AGENT.ALY BACKDOOR!"
X	WindowsSystem32	msn_kilo.exe	"Added by the AGENT.ALY BACKDOOR!"
X	WindowsSystem32	msnmgaer.exe	"Added by the AGENT.ALY BACKDOOR!"
X	Windows_Protect	winsystem.exe	"Added by a variant of the RBOT WORM!"
X	windtbs	winsysvc	"Added by the AGOBOT-NH WORM!"
X	winlogon	system.exe	Added by a variant of the DELF.CNS TROJAN!
X	WinMessenger	syshost.exe	"Added by the OPANKI-E WORM!"
X	WINOWS SYSTEM	winnt.exe	"Added by the MYTOB.ID WORM!"
X	WinPCDoctor	SysRep.exe	"WinPCDoctor rogue system error and cleaning utility - not recommended
X	winphonics7536	vbsystem35.exe setups.exe vb.vb	"Added by a variant of the MUTIN-C TROJAN!"
X	winreg_32	sysdll.exe	"Added by the DLOADER-IJ TROJAN!"
X	Winsk system Loader	winsk.exe	"Added by the AGOBOT-IZ WORM!"
X	Winsock2 driver	sysreq.exe	"Added by the SPYBOT-CC WORM!"
X	Winsock2 driver	SYSTEM32.EXE	"Added by the SPYBOT-EG WORM!"
X	Winsock2 driver	ntsys32.exe	"Added by the SPYBOT-DD WORM!"
X	Winsock32 driver	system32.exe	"Added by the IRCBOT-VT TROJAN!"
X	WinSP	[path] REGEDIT.EXE -s [path] sysreg.reg	"Added by the STARTPA-ME TROJAN!"
X	WinsSystem	syssmss.exe	"Added by the DELF.IG TROJAN!"
X	winsupdatesysmngr64	winsys64mnger.exe	"Added by the RBOT-BAG WORM!"
U	Winsys	Winsys.exe	"Win-Spy keyboard logger/monitoring software - remove unless you installed it yourself"
X	WINSYS	[path to trojan]	"Added by the GOLDPLAY TROJAN!"
X	winsys	syschost.exe	Added by an unidentified TROJAN!
X	WinSys	winmgmt.com	"Added by the VB.EIW WORM!"
X	WinSys	system.exe	"Added by the DAPROSY WORM!"
X	WinSys32	Winsys32.exe	"Added by the CIGIVIP TROJAN or RECKUS WORM!"
X	winsys32 Driver	winsys32.exe	"Added by the LOONY-O TROJAN!"
U	WinSysAppMon	WinSysRM.exe	"Home & Family Content Filter related. See here"
X	winsysban	[path to trojan]	"Added by the CLICKER-CD TROJAN!"
U	WinSysCheck	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
X	winsyslog lptt01	winsyslog.exe	"RapidBlaster variant (in a ""Winsyslog"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	WinSysM	371662M.exe	"Added by the WINKO.AO WORM!"
X	WinSysModule	[path to trojan]	"Added by the AGENT-DIQ TROJAN!"
X	WinSysStartUpWKbLw	TaskSystemDll.Exe	"Added by the BACKZAT.G WORM!"
X	WinSyst32	winsyst32.exe	"Added by the MORB WORM!"
X	WinSystem	winsystem.exe	"Added by the WHITEBAIT WORM!"
U	WinSystem	WinSystems.exe	"CMKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	Winsystem	Freevideo5.EXE	"Added by the AGENT.FZS WORM!"
X	winsystem.sys	smss.exe	"Added by the SOBER.K WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\msagent\win32 and note the space at the beginning of the ""Startup Item"" field"
X	WinSystems	winsystems16.exe	"Added by the SDBOT-CZT WORM!"
X	winsystems25	winsystems.exe	"Added by the RBOT-CNZ WORM!"
X	winsysupd	[path to trojan]	"Added by the STARTPA-NI TROJAN!"
X	WinSysW	371662L.exe	"Added by the WINKO.AO WORM!"
X	WINTASK	sys32.exe	"Added by the MYTOB.K WORM!"
X	WinUpdate	updsys.exe	"Added by a variant of the RBOT WORM!"
X	winupdate2846	vbsystem35.exe msvbrun.exe	"Added by a variant of the MUTIN-C TROJAN!"
X	winzSystam	xly.exe	"Added by a variant of the SDBOT WORM!"
X	Win_api_driver	system.exe	"Added by the REVIRD TROJAN!"
X	WLWin	WINSYS.EXE	"Added by the NAVER.A WORM!"
X	WMSDOS-ServicePack2	cmd.exe /c C:WMSDOS.sys	"Detected by Bitdefender as the DELF.OFC TROJAN! See here. Note that cmd.exe is a legitimate Microsoft file normally located in %System% and shouldn't be deleted"
X	wmsys32	wmsys32.exe	"Added by the BANPAES.B TROJAN!"
X	Working System Analyzer	syswork.exe	"Added by the FORBOT-FZ WORM!"
U	wssys	wssys.exe	"WebPI logs keystrokes and captures screenshots. If you didn't install this yourself remove it"
U	wsys.exe	wsys.exe	"SpyloPCMonitor - surveillance software. Uninstall this software unless you put it there yourself"
U	X1 System Tray	X1Systray.exe	"Part of X1's Enterprise Desktop Search Resource Center. An enterprise desktop search engine"
X	XP System	systemxp.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	XPsys	XPsys.exe	"Added by the DELF-KQ TROJAN!"
X	xpsystem	y.exe	"CoolWebSearch parasite variant"
X	Xpsystem	SERVICES.EXE	"Added by the DAEMOZ.A TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %System%\SERVICES"
X	xpsystem	services.exe	"CoolWebSearch parasite variant. Note - this is not the legitimate services.exe process
X	xpsystem	MSXMIDI.EXE	"CoolWebSearch parasite variant
X	xp_system	[filename]	"Added by the BOOKMARKER.J TROJAN! The file is located in %Windir%\inet20004"
X	xp_system	winlogon.exe	"Added by the KREPPER-G TROJAN! - a CoolWebSearch parasite variant. Note - this is not the legitimate winlogon.exe
X	xp_system	services.exe	"Added by the KREPPER-N TROJAN and variants! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The one is located in a %Windir%\inet***** - where ***** varies dependent upon the variant
X	xxcm	sys.exe	"Added by the KRISWORM-A WORM!"
X	Yahoo Messengger	system3_.exe	"Added by the AUTORUN-AOA WORM!"
X	yemarvd	sysmon.exe	"Added by the AGENT-CH TROJAN!"
X	YZH.SYS	YZH.exe	"Added by the PHILIS.C VIRUS!"
X	Zone system	szchost.exe	"Added by the MULTIDR-AC TROJAN!"
X	Zonesoft Cleaner	rnsys.exe	"Added by a variant of the SDBOT WORM!"
X	[Entry name]	System.exe	"Added by the NETHIEF-N TROJAN!"
X	[random characters]	systs.exe	"Added by the AGENT-GDC TROJAN!"
X	[random]	[random]sysguard.exe	"Antivirus Soft
X	[various names]	NSYSCPLSTR.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	prgsys0984.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	scanSYS.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	sysconf16.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	SysEntry.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	sysmon12.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	syspanel.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	SysSupport.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	[various names]	SYSTRAV.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	_SystemBoot	services.exe	"Added by the SOBER-Q TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Help\Help"
X	_SystemDriver	csrss.exe	"Added by the ASCETIC.B TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\addins\explorer"
X	_System_Run	_svchost_.exe	"Added by the LINEAGE-Z TROJAN!"
X	_winsystem.sys	smss.exe	"Added by the SOBER.K WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\msagent\win32"
X	{05CD0D77-4947-4a56-94FA-0DF0DC644D7B}	sysqyzwud.exe	"Added by the FAKEALERT-AM TROJAN!"
X	{157627A6-2A10-4aa1-B97F-90B8DC6F24AC}	sysqkmwfedz.exe	"Added by the FAKEALERT-AH TROJAN!"
X	{2C70168B-97CE-4f31-B85D-1FEC5002721D}	sysavxjgdu.exe	"Added by the FAKEALERT-AM TROJAN!"
X	{2C70168B-97CE-4f31-B85D-1FEC5002721D}	sysawpbkvnq.exe	"Added by the FAKEALERT-AH TROJAN!"
X	{2C70168B-97CE-4f31-B85D-1FEC5002721D}	sysxhtcwbse.exe	"Added by the FAKEALERT-AM TROJAN!"
X	{42562052-EE17-4197-82C7-91CB2E4B0666}	sysrswva.exe	"Added by the FAKEALERT-AH TROJAN!"
X	{78B578D7-BCE1-4d83-9CD4-195BC34D8CB3}	syspyukrazv.exe	"Added by the FAKEALERT-AH TROJAN!"
X	{78B578D7-BCE1-4d83-9CD4-195BC34D8CB3}	syssfzvakqg.exe	"Added by the FAKEALERT-AM TROJAN!"
X	{7DD4A7AC-A3F1-4495-884A-7947C5B89108}	sysahbecjh.exe	"Added by the FAKEALERT-AM TROJAN!"
X	{9754B85A-3B34-4969-BE1F-CD03227E9470}	syszweuas.exe	"Added by the FAKEALERT-AM TROJAN!"
X	{9754B85A-3B34-4969-BE1F-CD03227E9470}	sysatjsicj.exe	"Added by the FAKEALERT-AM TROJAN!"
X	{A4C928E8-0ABA-4fd3-83DF-23BE54ADF9A4}	sysqrnxstju.exe	"Added by the FAKEALERT-AM TROJAN!"
X	{B081DB1F-4EE6-4021-9DD4-8B300F0D636D}	syssngbeh.exe	"Added by the FAKEALERT-AH TROJAN!"
X	{B3B48B54-C0EC-4705-8EE8-1981AEF656A7}	sysjcyrq.exe	"Added by the FAKEALERT-AH TROJAN!"
X	{BAAA759D-56F0-428c-B8DA-827EA3B08C2C}	sysawechod.exe	"Added by the FAKEALERT-AH TROJAN!"
X	{C2220120-1C24-4a79-BA7A-DDCBFC209DB3}	sysfbdgv.exe	"Added by the FAKEALERT-AM TROJAN!"
X	{C599792D-C6D9-461d-93CA-B48BFF8E37B1}	sysfdyev.exe	"Added by the FAKEALERT-AM TROJAN!"
X	{DD651081-A909-45ad-BD71-2335B0ADE043}	sysutrnez.exe	"Added by the FAKEALERT-AH TROJAN!"
X	{DD651081-A909-45ad-BD71-2335B0ADE043}	sysabmpmfr.exe	"Added by the FAKEALERT-AH TROJAN!"
X	{DD651081-A909-45ad-BD71-2335B0ADE043}	sysnxcphmgy.exe	"Added by the FAKEALERT-AH TROJAN!"
X	{E4785213-3EFE-4c26-A9B4-332440E31F6F}	sysrxmfdksp.exe	"Added by the FAKEALERT-AH TROJAN!"
X	{F758F78B-0885-490e-AA3C-4A38D28B0240}	sysyeabdgfp.exe	"Added by the FAKEALERT-AM TROJAN!"