NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77

78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

• "Y" - Normally leave to run at start-up
• "N" - Not required - typically infrequently used tasks that can be started manually if necessary
• "U" - User's choice - depends whether a user deems it necessary
• "X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
• "?" - Unknown

	Startup Name	Process Name	Details
X		system32.exe	"Added by the AGOBOT-KU WORM! Note - has a blank entry under the Startup Item/Name field"
Inc."	"Miramar Systems	U	atmsg.exe
X	(Default)	Systrsy.exe	"Added by the CDTRAY TROJAN! Note - this malware actually changes the value data of the ""(Default)"" key in HKLM\Run in order to force Windows to launch it at boot. The name field in MSConfig may be blank"
X	*WindowsAudio	systemupd.exe	"Added by the AGENT-TH WORM!"
U	00THotkey	system32THotkey.exe	"For Toshiba Satellite notebook series to use the front buttons
U	2wSysTray	2portalmon.exe	"2Wire Homeportal user interface"
Y	AccelerometerSysTrayApplet	AccelerometerSt.exe	HP 3D DriveGuard uses a digital accelerometer protects your disk drive by parking and halting I/O requests if you drop your PC or if you move your PC with the display lid closed
X	ActiveDesktop	systray32.exe	"Added by the DABOOM WORM!"
?	ADSLSYSTEMTRAY	SystemtrayV100B.exe	"Apparently Annex A ADSL modem related. What does it do and is it required?"
X	Advanced Protection System	advpsys.exe	"Added by a variant of the RBOT WORM!"
U	Advanced SystemCare 3	AWC.exe	"Advanced SystemCare from IObit - ""helps protect
N	AGEIA PhysX SysTray	TrayIcon.exe	"System Tray access to display properties for AGEIA PhysX graphics cards. Unless you change your desktop resolution
X	Alive SYstem	scchost.exe	"Added by the TOFDROP-B TROJAN!"
X	Alive SYstem	scchostc.exe	"Added by the TOFDROP-B TROJAN!"
X	ApPache System	ApPache.exe	"Added by the RBOT-YP BACKDOOR!"
X	Application In System	Snxmsh.exe	"Added by the AGENT-LNV TROJAN!"
N	ATI CATALYST System Tray	CLI.exe SystemTray	"System Tray access to ATI's Catalyst™ Control Center. Note that this has ""SystemTray"" appended to CLI.exe in the ""Command"" column of MSCONFIG. Not required to run the control center - which is available via a right-click on the desktop"
X	AttuneSystray	attune_st.exe	"Aveo Attune automated helpdesk software - adware/spyware"
X	Auto File System Conversion Utility	scricon.exe	"Added by the SDBOT.EYB WORM!"
X	auto repair system	qualityx.exe	"Added by an unidentified WORM or TROJAN - probably a SPYBOT variant"
Y	AVG Anti-Virus system	avgcc.exe	"System Tray access to and notifications for the 7.* series of anti-virus products from AVG Technologies. If this entry is disabled
Y	AVG Anti-Virus System	avgemc.exe	"E-mail scanner for the 7.* series of anti-virus products from AVG Technologies. This process scans incoming and outgoing E-mails for viruses and other malware. From version 7.1 onwards this entry only appears in 9x/Me as a startup entry
Y	AVG Anti-Virus System	avgw.exe	"This entry is included with the 7.* series of anti-virus products from AVG Technologies. Once installed (or on first run for a different user) it runs the configuration sequence to set up the product and doesn't run on subsequent restarts"
X	AVSystemCare	pgs.exe	"AVSystemCare rogue security software - not recommended. There are number of variants in this family sharing the same filename and user interface - see here"
U	AXIS Print System DriverScanner	DriverScanner.exe	"Part of AXIS Print System from AXIS Communications - ""adds printer discovery
U	AXIS Print System DriverServer	DriverServer.exe	"Part of AXIS Print System from AXIS Communications - ""adds printer discovery
U	AXIS Print System TrayIcon	TrayIcon.exe	"System Tray access to AXIS Print System from AXIS Communications - ""adds printer discovery
N	bbSysTray	bbSysTray.exe	"Philips CD-RW related - ""the 'Blue Button' feature gives users the chance to receive convenient online support for their possible device problems or questions"""
X	Bcvsrv32	system2.exe	"Added by the AGOBOT-PU BACKDOOR!"
U	beidsystemtray	beidsystemtray.exe	"Related to Belgium Identity Card card reader"
X	Blocker System611 Monitoring	PopUpBlocker611.exe	"Added by the RBOT.BLJ WORM!"
X	C:WINDOWSsystem32SetupCmd.exe	SetupCmd.exe	"Detected by Kaspersky as the AGENT.AAW TROJAN!"
X	Call Function System32	sddriver.exe	"Added by a variant of the SDBOT TROJAN!"
X	Ci Servs	SysTuwin.exe	"Added by the AGENT-NIQ TROJAN!"
X	Cisco Systems	[path to worm]	"Added by the AUTORUN.UHR WORM!"
U	Cisco Systems VPN Client	ipsecdialer.exe	"Cisco VPN Client - lets local users gain Administrator privileges on the operating system"
U	Cisco Systems VPN Client	vpngui.exe	"Sets up IPSec communications for Cisco's VPN Client"
X	cmsound	vcsystem.exe	"Added by the TCXMEDI-D downloader TROJAN!"
X	cmss	system.exe	"Added by a variant of the RBOT WORM!"
X	cmssSystemProcess	csmss.exe	"Added by the AGENT-CO TROJAN!"
X	cmssSystemProcess	mcsmss.exe	"Added by the PROXYSER-F TROJAN!"
X	cmssSystemProcess	csms.exe	"Added by the AGENT-Y TROJAN!"
X	CMSystem	CMSystem.exe	"CASClient adware"
X	Coldlife -icmp	Systray.exe	"Added by the FLOOD.AV TROJAN! Note - this is not the legitimate systray.exe process"
X	COM+ Event System	DRWTSN16.EXE	"Added by the LOVGATE.AB WORM!"
X	COM+ EventSystem Services	ECSERVER.EXE	"Added by a variant of the SDBOT WORM!"
X	COM+ System Application	lsas.exe	"Added by the AGOBOT-MO WORM!"
X	COM+ System Applications	lsas.exe	"Added by the AGOBOT.SE WORM!"
X	COM++ System	exploier.exe	"Added by the LOVGATE.Z WORM!"
X	COM++ System	suchost.exe	"Added by the LOVGATE-F WORM!"
X	COM++ System	svchost.exe...	"Added by a variant of the LOVGATE WORM!"
X	Command	system.exe	"Added by the GATECRASH.A or GATECRASH.B TROJANS!"
X	Compaq Service Drivers	systeminfos.exe	"Added by the SDBOT-XC WORM!"
X	Compaq Service Drivers	NtKernelSystem.exe	"Added by a variant of the SDBOT WORM!"
N	CompaqSystray	cpqpscp.exe	Compaq System Tray icon
X	Configuration Loader	System.exe	"Added by the GAOBOT.AO WORM!"
X	Configuration Loader	systemry.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Content List Management Subsystem	clmss.exe	"Added by the SPYBOT-EL WORM!"
X	Control Panel	System.exe	"Added by the DANI TROJAN!"
X	Controlled Resource System Service	crss.exe	"Added by the AGOBOT.GH WORM!"
X	ControlPanel	"systemctrl.exe internet.dll	LoadNetworkProfile"
X	Core System Hardware	syscorehd.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Creates stractures for system management	stacture.exe	"Added by the SDBOT-DHS WORM!"
X	CrisysTec Sentry	Sentry.exe	"CrisysTec Sentry rogue privacy program - not recommended"
X	D SYSTEM	dd.exe	"Added by the MYTOB-FN WORM!"
X	Data	System.dat.vbs	"Added by the BISCUIT.A WORM!"
X	Dcom System Patch	Microsoft.exe	"Added by the RANDEX.MS WORM!"
X	Default System Research	vhchost.exe	"Added by the TARNO.I TROJAN!"
X	Device IO System	deviceio.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Device Management	wnsystem.exe	"Added by the AGOBOT-LH WORM!"
N	DiskeeperSystray	DkIcon.exe	"DisKeeper defragmentation software - can be started manually"
X	Distributed File System	Dfsvc.exe	"Added by the MYFIP.A or MYFIP.K WORMS!"
X	Distributed File System	kernel32dll.exe	"Added by the MYFIP-C or MYFIP.K WORMS!"
X	Distributed File System	blade.exe	"Added by the MYFIP.AC WORM!"
X	Distributed File System	win.exe	"Added by the MYFIP.AB WORM!"
U	DLink System Tray	dlnetst.exe	"Related to D-Link DGE-530T PCI card for servers and workstations"
X	DriverPath	system32.exe	"Added by the PRORAT-S TROJAN!"
X	DriveSystem	maxpaynowti1.exe	"Added by the TIBS.AZT TROJAN!"
X	DSystemDriver	windrv.exe	"Added by the DELF.WG TROJAN!"
U	eanth_system_patcher	sys_alert.exe	"eAcceleration Stop-Sign security software related. Previously not recommended
N	eMusicClient Systray	eMusicClient.exe	"eMusic MP3 download software"
X	explorer	system.exe	"Added by the AGENT-FI TROJAN!"
X	EXPLORER MICROSOFT SYSTEM	explore.exe	"Added by a variant of the RBOT WORM!"
N	Extender Resource Monitor	RMSysTry.exe	"Related to Windows Media Center from Microsoft"
X	FDD SYSTEM	Fdd.exe	"Added by the MYTOB-FO WORM!"
X	File System	taskmqrs.exe	"Added by a variant of the TOXBOT/CODBOT WORM!"
X	File System	taskmqr.exe	"Added by the RBOT.BWQ WORM!"
X	File System Service	wmiprvsc.exe	"Added by the AGOBOT-HZ TROJAN!"
X	Firewall Sp2 system	sys32Conf.exe	"Added by the RBOT-ABT WORM!"
X	Firewall Update System1	WinedowsUpdater1.exe	"Added by the RBOT-ARU WORM!"
N	FoneSyncSystemTray	FoneSyncSystemTray.exe	System Tray icon for Nokia FoneSync utility for the 7160/7190 mobiles. Useful to send data from/to the cell phone and the computer. You can use it to backup data or even to input data through the computer keyboard (which naturally is much more comfortable). Run manually when required
X	Gate Personal Firewall	Systpl.exe	"Added by the RBOT.ADC WORM"
X	Generic Host Process2 System Backup	scvhost2.exe	"Added by the RBOT-BAH WORM!"
X	Generic Host Process326a System Backup	scvhost326a.exe	"Added by a variant of the SDBOT WORM!"
X	german.exe	winsystems.exe	"Added by the BAGLEDl-AE TROJAN!"
X	gwiz	ntsystem.exe	"Added by the NITWIZ.A TROJAN!"
N	hcsystray	hc_tray.exe	"Kuma Notifier for the Shootout! game from the History Channel. ""It lets you know whenever there's a new episode that's been released or an announcement from the Kuma team. Just click it to get up-to-the-minute game and event information"""
X	HMI PowerSystem	hmisvc32.exe	"Added by the RANDEX.CZZ WORM!"
X	HTML Help System	hhs.pif	"Added by the RBOT-ATB WORM!"
X	HTML32 Help System	hhs32.pif	"Added by the RBOT-ATE WORM!"
X	Hwp	system_wc.exe	"Eziin adware"
X	IISADMINS	systems.exe	"Added by the AGOBOT.U WORM!"
N	iIWiper	Systemwiper.exe	"System Wiper from iI Software - allows you to clear the history of your activites from you computer. Run manually on a regular basis"
X	Intel system tool	hookdump.exe	"Added by the SPYRE-H TROJAN!"
X	Intel system tool	winnook.exe	"Added by the SPYRE-C TROJAN!"
X	Intel system tool	svehost.exe	"Added by the AGENT-EBT TROJAN!"
X	Intel system works	iis.exe	"Added by the RBOT.QGA WORM!"
X	InterceptedSystem	[path to worm]	"Added by the ANACON-B WORM!"
X	InternalSystray	Kazza.exe	"Added by the OPTIXPRO.12.C BACKDOOR! Note - unlike the valid KaZaA executable
X	Internat	systray.exe	"Added by the ALADINZ.P TROJAN! Note - this is not the legitimate systray.exe process. If you right-click on the real systray.exe the ""Properties"" reveal it to be a Microsoft file"
X	Internet Services	systemdev.exe	"Added by the SDBOT-PW WORM!"
X	ioroxxo microsoft sux	system32.exe	"Added by a variant of the RBOT WORM!"
X	isystem	isystem.exe	"Added by the CHORUS-A TROJAN! Searchforfree browser hijacker"
X	java	system.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	kernel system daemon	ACTIVAT0R.exe	"Added by the RANDEX.AW WORM!"
X	Kernell	systems.exe	"Added by the TARNO.C TROJAN!"
X	LibreSystem	SysRep.exe	"LibreSystem
X	load	Systemfile.dll.vbs	"Added by an unidentified WORM or TROJAN! See here"
X	LocalSystem	svchost.exe	"EHU adware. Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
U	LogMeIn GUI	LogMeInSystray.exe	"RemotelyAnywhere is a remote administration and remote control solution for Windows. It allows access to the host computer via the network (the LAN
?	lycosInside	Lyc_SysTray.exe	"Lycos eMail related - what does it do and is it required?"
X	M1cr0s0ft S3rcurity	systemconfig.exe	"Added by the RBOT.BKB WORM!"
X	Mcafee Antivirus Monitoring System326	VSStatmn326.exe	"Added by a variant of the SDBOT WORM!"
X	Mcafee Antivirus Monitoring System32mn	VSStatmn32.exe	"Added by a variant of the RBOT WORM!"
X	Media service	SYSTEM64.EXE	"Added by the RBOT.QV WORM!"
X	Messenger91	messengersystem.exe	"Added by the RBOT-FPF WORM!"
X	Micosoft Startup	systall.exe	"Added by the SDBOT-GM BACKDOOR!"
X	Micr Update System	upwin.exe	"Added by the SDBOT.YS WORM!"
X	Microsofot x386 System Monitor	system32.exe	"Added by the WOOTBOT.M WORM!"
X	Microsoft	system32.exe	"Added by the IRCBOT-ZZ WORM!"
X	Microsoft boot system cfg32	actboost.exe	"Added by the BROPIA.R WORM!"
X	Microsoft Client/Server Runtime Server Subsystem	csrs.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Client/Server Runtime Server Subsystem	csrssa.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft DLL Extensions	SystemDll.exe	"Added by the RBOT-ADV WORM!"
X	Microsoft Explorer2	system.exe	"Added by the IRCBOT.BS TROJAN!"
X	Microsoft Help System	mshelp32.exe	"CoolWebSearch parasite variant"
X	Microsoft Internal AntiVirus Systems	dIlhost.exe	"Added by the RBOT-AEV WORM!"
X	Microsoft Intrenet Explorer	Soundsyst.exe	"Added by the RBOT-AQU WORM!"
X	Microsoft IPC	system.exe	"Added by the NULLBOT TROJAN!"
X	Microsoft IT Update	winsyst32.exe	"Added by the RBOT-FC WORM!"
X	MicroSoft Legal Syst3m32	Syst3m32.exe	"Added by the RBOT.UYL WORM!"
X	Microsoft Macro Protection Subsystems	msmacroprotxz.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Macro Protection Subsystems	Msmacroprot32.exe	"Added by the RBOT.KN WORM!"
X	Microsoft Network	Networksystem.exe	"Added by the SDBOT-AAI WORM!"
X	Microsoft Redirect	systen.exe	"Added by the BANCOS-FO TROJAN!"
X	Microsoft Security System	mssecsys.exe	"Added by the IRCBOT-WJ TROJAN!"
X	Microsoft Service Drivers	System.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Session Manager Subsystem	smss.exe	"Added by the KALEL-D WORM! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup!"
X	Microsoft System	msupdtm.exe	"Added by the SPYBOT.PKC WORM!"
X	Microsoft System	mssys32.exe	"Added by the PETTICK.A WORM!"
X	Microsoft System	sys.exe	"Added by the RBOT.AKI WORM!"
X	Microsoft System	winamp1.exe	"Added by the SDBOT-UF WORM!"
X	Microsoft System Administration	system.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	Microsoft System Backup	[random filename]	"Added by the RBOT-AGM WORM!"
X	Microsoft System Checkup	Cool.exe	"Added by the DONK.B WORM!"
X	Microsoft System Checkup	Wnetlib.exe	"Added by the DONK.C WORM!"
X	Microsoft System Checkup	dbnetlib.exe	"Added by the DONK.L WORM!"
X	Microsoft System Checkup	Keymgr.exe	"Added by the DONK.M WORM!"
X	Microsoft System Checkup	inetman.exe	"Added by the DONK.O WORM!"
X	Microsoft System Checkup	ntsysmgr.exe	"Added by the DONK.S WORM!"
X	Microsoft System Checkup	ntsysman.exe	"Added by the SDBOT-QW WORM!"
X	Microsoft System Checkup	libsysmgr.exe	"Added by the SDBOT-CAF WORM!"
X	Microsoft System Checkup	sysmgr.exe	"Added by the SDBOT-OO TROJAN!"
X	Microsoft System Checkup	netapi32.exe	"Added by the DONK-E WORM!"
X	Microsoft System Checkup	wnetmgr.exe	"Added by the DONK.Q WORM!"
X	Microsoft System Checkup	libsys32.exe	"Added by the SDBOT-ACK WORM!"
X	Microsoft System Checkup	netlogin32.exe	"Added by the SDBOT-GN BACKDOOR!"
N	Microsoft System Configuration Utility	msconfig.exe	Entry that appears when you uncheck an item in the MSConfig Startup group and will disappear if on the next reboot you select the option to not be reminded that you are running in Selective Startup mode. Located in %System% (98/Me/Vista) or %Windir%\PCHealth\HelpCtr\Binaries (XP)
X	Microsoft System Debug	services32.exe	"Added by the RBOT.AKH WORM!"
X	Microsoft System DLL Services Configuration	windir32.exe	"Added by the SDBOT-ACY TROJAN!"
X	Microsoft System File	svchots.exe	"Added by the RBOT.BYU WORM!"
X	Microsoft System Firewall 2006.2	msmsgr.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft System Firewall 2006.2	msnmsgr.exe	"Added by a variant of the SDBOT WORM! Note - this is not the valid MSN Messenger (now Windows Live Messenger) utility which is located in either %ProgramFiles%\MSN Messenger or %ProgramFiles%\Windows Live\Messenger. This one is located in %System%"
X	Microsoft System Firewall 2006.2	reg32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft System Init	mtmnr0.exe	"Added by the SDBOT.BR TROJAN!"
X	Microsoft System Monitor	monsys.exe	"Added by the IRCBOT-YV TROJAN!"
X	Microsoft System Monitor	system.exe	"Added by the IRCBOT.AUT BACKDOOR!"
X	Microsoft System NT	svhost.exe	"Added by the SDBOT.COU WORM!"
X	Microsoft System Restore Configuration	CBRSS.EXE	"Added by a variant of the SPYBOT WORM!"
X	Microsoft System Saver	[path to worm]	"Added by the RBOT.BSK WORM!"
X	Microsoft System Security Agent	MSTSA.EXE	"Added by the RBOT.CCM WORM!"
X	Microsoft System Service	dnservice.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft System Service	taskmgr1.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft System Service	winIogon2.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft System Service Device	mssdh.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft System Services	msnmgsr.exe	"Added by the KELVIR.K WORM!"
X	Microsoft System Services	msmsgr.exe	"Added by the RBOT-ZH WORM!"
X	Microsoft System Update	sysupdate.exe	"Added by the SDBOT.DG WORM!"
X	Microsoft system Value	sys57.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft System32 Update	cmsrg.exe	"Added by the RBOT-GN WORM!"
X	MICROSOFT UNPACCKER SYSTEM	unpak32.exe	"Added by a variant of the RBOT WORM!"
X	MICROSOFT UNPACK SYSTEM	winrarx.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update	systemi32.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Update	system32.exe	"Added by the RBOT.IS WORM!"
X	Microsoft Update	system.exe	"Added by a variant of the RBOT WORM! See here"
X	Microsoft Update	winsyst.exe	"Added by the RBOT-DL WORM!"
X	Microsoft Update 23	NtKernelSystem.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Loaders 2006	winusersystem32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Update Machine	system03.exe	"Added by the RBOT-NM WORM!"
X	Microsoft Update Machine	systemll.exe	"Added by the RBOT-JT WORM!"
X	Microsoft Update Machine	Systemnt.exe	"Added by the RBOT.DA WORM!"
X	Microsoft Update Machine	systemse.exe	"Added by the RBOT-BD WORM!"
X	Microsoft Update Machine	system.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update Machine	ntsystem.exe	"Added by the RBOT.GF WORM!"
X	Microsoft Update Machine	systemi.exe	"Added by the BUZUS.JKU TROJAN!"
X	Microsoft update service	systemm.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Updates	systemc32.exe	"Added by the RBOT-GR WORM!"
X	Microsoft Windows 128bit Subsystem	system12.exe	"Added by the RANCK-CZ TROJAN!"
N	Microsoft Windows Desktop Search System Tray	WindowsSearch.exe	System Tray access to Windows Desktop Search for XP from Microsoft - which adds additional search options including a search box on the Taskbar. This version (3.0.1) also includes the Windows Search (WSearch) service which indexes files and e-mails items so you can quickly find words and phrases. Disabling this entry does not affect the normal operation and this is the Windows Defender entry
N	Microsoft Windows Search System Tray	WindowsSearch.exe	"System Tray access to Windows Search 4.0 for XP from Microsoft - which adds additional search options including a search box on the Taskbar. This version also includes the Windows Search (WSearch) service which indexes files and e-mails items so you can quickly find words and phrases. Disabling this entry does not affect the normal operation"
X	Microsoft Windows Session Manager Subsystem	smss.exe	"Added by the PROXYSER-R TROJAN! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Microsoft Windows System	srwhost.exe	"Added by the RBOT-AWU WORM!"
X	Microsoft Windows System	syshost.exe	"Added by the RBOT-ASW WORM!"
X	Microsoft Windows System	System.exe	"Added by the VB.KV WORM!"
X	Microsoft Windows System Kernel	kernel32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Windows System Service Manager	winsvc.exe	"Added by the SPYBOT.LR WORM!"
X	Microsoft Windows Updating System	msresource.exe	"Added by the RBOT-EAM WORM!"
X	Microsoft Winsock32 System	winsock32.exe	"Added by the SPYBOT.AKKC WORM!"
X	Microsoft Xp Systems loader	winsystem32xp.exe	"Added by the KELVIR.W WORM!"
X	Microsoft Xp Systems loaders	win32xpsys.exe	"Added by the SPYBOT.NYT WORM!"
X	Microsoft xpsp2	Networksystem.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft's System Module	Sysmodule.exe	"Added by the BDOOR-FJ BACKDOOR!"
X	Microsoft(R) System Manager	sysmgr.exe	"Added by the AGENT.QTR TROJAN!"
X	Microsoftkeysd	systemproc.exe	"Added by the FORBOT-BI WORM!"
X	Microsoftkeysd	systemwin32s.exe	"Added by the WOOTBOT.CO WORM!"
X	Microsoft© System Mapper	SysMap.exe	"Added by the MAPSY TROJAN!"
U	Microsoft® Windows® Operating System	Sidebar.exe	"Windows Sidebar is a pane on the side of the Microsoft Windows Vista desktop where you can keep your gadgets organized and always available. In Windows 7 this feature is known as Desktop Gadgets and each gadget can be placed anywhere on the desktop. If the file isn't located in %ProgramFiles%\Windows Sidebar or you're using other versions of Windows it could be part of the Searchcentrix hijacker"
N	Microsoft® Windows® Operating System	"RunDLL32.exe ehuihlp.dll	BootMediaCenter"
N	Microsoft® Windows® Operating System	p2phost.exe	"Signs a user into the People Near Me feature at login in Windows 7 and Vista. People Near Me enables you to use certain peer-to-peer (P2P) programs on a network - that ""identifies people nearby who are using computers and allows those people to send you invitations for programs such as Windows Meeting Space. They can only invite you to participate in programs that are installed on your computer."" Available via Start → Control Panel"
U	Microsoft® Windows® Operating System	ehTray.exe	"Media Center Tray Applet - part of Windows Media Center on XP MCE
N	Microsoft® Windows® Operating System	"rundll32.exe oobefldr.dll	ShowWelcomeCenter"
N	Microsoft® Windows® Operating System	stikynot.exe	"Microsoft Sticky Notes - virtual sticky notes tool from Windows Vista. This implementation of the popular yellow ""Post-It"" tool is part of the Tablet PC features and allows you to enter either handwriting (via a pen or mouse) or record a voice note. AVailable via Start → All Programs"
U	Microsoft® Windows® Operating System	WMPNSCFG.exe	"Network sharing tool for Windows Media Player 11 for XP & Vista. When using WMP 11 on home network you can choose to share your favorite music
X	microsystem	snddrv.exe	"Added by the VB.AXG TROJAN!"
X	Micrsoft DerSystem	uqieelpb.exe	"Added by the RBOT-GRI WORM!"
X	MMSystem	"rundll32.exe mmsystem.dll	RunDll32"
X	Mozillacorp	system.exe	"Added by the SILLYFDC WORM!"
X	MS Domain Name System	MSWDNS32.exe	"Added by the RBOT-GKY WORM!"
X	MS Security	systm.pif	"Added by the RBOT-AQN WORM!"
X	MS System Call Function	msscf32.exe	"Added by the RBOT-GBZ WORM!"
X	Ms System Config	Mscfg.exe	"Added by the SDBOT-CCR WORM!"
X	Ms System Config	pcedit.exe	"Added by a variant of the SDBOT WORM!"
X	MS System Security	mswin32.pif	"Added by the RBOT-AOX WORM!"
X	MS Windows System Alert	MSWSA32.exe	"Added by the RBOT-BFN WORM!"
X	MSControl31	winnsyst.exe	"Added by the RBOT.CFY WORM!"
X	MSkernel32	System.exe 4820	"Added by the TUXDER BACKDOOR!"
X	msn	system32.exe	"Added by the KITRO.A WORM!"
X	MSN	systems.exe	Identified as a variant of the Backdoor.PosionIvy keylogging malware
X	MSN Messanger	System.exe	"Added by the IRCBOT-AFX TROJAN!"
X	msoft-updater23	slssystem.exe	"Added by the RBOT-ASR WORM!"
X	MSPP System Update 64	wiaadmgr.exe	"Detected by Kaspersky as the RANKY.GEN TROJAN!"
X	MsSystem	msdos.exe	"Adult content downloader - see here"
X	MsSystem	mssys.exe	"Added by the VANTA.A TROJAN!"
X	MSSYSTEM	svcsys.exe	"Added by the FATOOS-C TROJAN!"
X	MsUpdater System	udpsys32.exe	"Added by the RBOT.AAA WORM!"
X	MSWindowsUpdate	Systern.exe	"Added by the RBOT-AFD WORM!"
U	MytekSystrayExePath	MyTekSystray.exe	"MyTek system tray - web site providing computer tech support in Australia"
X	NAMEDPIPE SYSTEM	namedpipe.exe	"Added by the MYTOB-FH TROJAN!"
X	NAV Agent	systems.exe	"Added by the TARNO.C TROJAN! Note - this is not the valid Norton Antivirus entry of the same name"
X	NBT System alias	[path] repcale.exe [path] beird.exe	"Added by a variant of the RANDON.AN WORM!"
X	NET protection system	netst.exe	"Added by the RIZO.A TROJAN!"
X	Network Translation System Service	ntss.exe	"Added by the UNPDOOR TROJAN!"
X	New Anti Virus	System.exe	"Added by the BRONTOK-CH WORM!"
U	NMPSystray	NMPSystray.exe	"System Tray access to NotesMedic from Cassetica Software Inc. - which ""contains a suite of Tools that make life easier when using Lotus Notes"""
X	Norman Worl System Ability	nwcss32.exe	"Added by the DELF.IO TROJAN!"
X	Norton System	csrs.scr	"Added by the BANLOA-AFM TROJAN!"
N	Norton System Doctor	Sysdoc32.exe	"Norton Disk Doctor from Norton Utilities. Automatically runs at start-up
N	Norton SystemWorks	cfgwiz.exe	Norton System Works configuration wizard. Reportedly a resource hog. Many users find they can live without loading it
X	Nortons AV SYSTEM	scvchost.exe	"Added by a variant of the RBOT WORM!"
X	Nortons AVS Systems	arse.exe	"Added by the RBOT.AWY WORM!"
N	NSystemMonitor	Symmon.exe	Norton Uninstall Deluxe - monitors programs being installed and logs them for removing later. Available via Start -> Programs for manual logging
X	Nt System Protocol	ntsystem.exe	"Added by the RBOT.DSB TROJAN!"
X	NT Windows System Manager Loader	csrlss.exe	"Added by the AGOBOT.OX WORM!"
X	NTFSS Microsoft System	filees.exe	"Added by the RBOT.GAB WORM!"
X	NTFSS MICROSOFT SYSTEM	filess.exe	"Added by the RBOT.AXZ WORM!"
X	NTmessageSystem	loadnewmessage.exe	"Added by the HIDAGENT-B WORM!"
X	NTSF Microsoft System	fylez.exe	"Added by a variant of the RBOT WORM!"
X	NTSF MICROSOFT SYSTEM	wntsf.exe	"Added by the RBOT.ATC WORM!"
X	NTSF MICROSOFT SYSTEM	fufffy.exe	"Added by the RBOT-AEL WORM!"
X	NTSF MICROSOFT SYSTEM	ntssf.exe	"Added by a variant of the RBOT WORM!"
X	NTSF MICROSOFT SYSTEM	scvhost.exe	"Added by a variant of the RBOT WORM!"
X	NTSF MICROSOFT SYSTEM	winsis32.exe	"Added by a variant of the RBOT WORM!"
X	NTSF MICROSOFT SYSTEM	marya.exe	"Added by the RBOT-AXY WORM!"
X	NTSF MICROSOFT SYSTEM	sysman.exe	"Added by the RBOT.EDP WORM!"
X	nVidia System Drivers	nvsys32.exe	"Added by an unidentified WORM or TROJAN! See here"
U	NVIDIA System Monitor	NVMonitor.exe	"NVIDIA System Monitor - part of NVIDIA System Tools. Utility for monitoring and logging system statistics (such as temperatures
U	NVidia System Utility	NVSystemUtility.exe	"NVidia System Utility - older version of the NVIDIA nTune utilty for monitoring and modifying the settings (such as temperatures
?	NVRotateSysTray	nvsysrot.dll	"Related to NVIDIA nView Control Panel. What does it do and is it required?"
X	NVSystem32	nvscv32.exe	"Added by the AGOBOT-NO WORM!"
X	Offica Monitor Secura Systeme	winxp_sp3.exe	"Added by a variant of the RBOT WORM!"
X	Office Monitor Secure Systema	absecure32.exe	"Added by the RBOT.FPW WORM!"
X	Olive System	Szchost.exe	"Added by the MERCURYCAS.A TROJAN!"
U	Omega ASIO Control Panel	ASIOSysTray.exe	"System Tray access to the control panel for the Lexicon Omega ASIO (Audio Streaming I/O) desktop recording studio"
N	PaperQuote System Tray Icon	PQTRAY.EXE	PaperQuote is a "wallpaper" changer with daily quotes that are either for inspiration or motivation
X	PaSystem	pasystem.exe	"Targetsaver adware variant"
Y	PASystemTray	PASystemTray.exe	"Related to Panda Security Software - part of Panda Administrator 3"
X	PCSecureSystem	pgs.exe	"PCSecureSystem rogue security software - not recommended. A member of the AVSystemCare family"
X	PHIME2OO2ASyst	[path to trojan]	"Added by the DBDOOR-B TROJAN!"
X	PIC SYSTEM	picx.exe	"Added by the MYTOB.LL WORM!"
X	PIPE SYSTEM	pipe.exe	"Added by the MYTOB-FF WORM!"
X	Popup Blocker System	PopUpBlocker.exe	"Added by a variant of the RBOT WORM!"
X	Popup Blocker System326a Monitoring	PopUpBlocker6a.exe	"Added by the RBOT.AUH WORM!"
X	Popup Blocker System8 Monitoring	PopUpBlocker8.exe	"Added by a variant of the RBOT WORM!"
X	Printer Spooler Subsystem	spoolss.exe	"Added by a variant of the RBOT WORM! Note - this is not the legitimate Windows spoolss.exe process which is always located in %System% and should not figure in Msconfig/Startup!"
X	PrintMngr	system.exe	Added by an unidentified TROJAN!
X	PrintSpoolSv	System.exe	"Added by the BDOOR-S BACKDOOR!"
X	Protection System	psystem.exe	"Protection System rogue security software - not recommended
U	PWSActivePrint_5	ActivePrintSystem.exe	"ActivePrint from Pocket Watch LLC - ""Windows Mobile users are given the invaluable capability of printing from their mobile devices to any Windows 2000/XP/2003/Vista compatible printer without the necessity of wireless hardware"""
X	RAX SYSTEM	scrigz.exe	"Added by the MYTOB.KR WORM!"
U	RCSystem	DLLML.exe RCSystem	"Related to Creative DLL Module Loader for the Sound Blaster X-Fi (and maybe others). This program is non-essential process to the running of the system
X	RCSystemTray	MaxRCSystemTray.exe	"Max Registry Cleaner rogue registry cleaner - not recommended
N	RealJukeboxSystray	tsystray.exe	System Tray icon for RealJukebox
X	Recoveru system	svchast.exe	"Added by a variant of the LINEAGE-AV TROJAN!"
X	Recoveru systems	svchost.exe	"Added by the SMALL.DDX TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Temp%"
X	Recycle Bin Handler 2005	system.exe	"Added by the BDOOR-HO BACKDOOR!"
X	reg run	Systen.exe	"Added by the BANCOS-BS TROJAN!"
X	Registry Checkup System326a Monitor	Winregs326a.exe	"Added by a variant of the SDBOT WORM!"
X	Registry System	Regsys.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Registry System16 Checkup Monitor	SystemReg16.exe	"Added by a variant of the RBOT WORM!"
X	Registry System166 Checkup Monitor	SystemReg166.exe	"Added by a variant of the RBOT WORM!"
U	Remote Data Backups	CBSysTray.exe	"System Tray access to Remote Data Backups online system/data backup utility"
U	Remote Data Backups TaskBar Icon	CBSysTray.exe	"System Tray access to Remote Data Backups online system/data backup utility"
X	Remote Event System	resmsvc.exe	"Added by the IRCBOT.YF BACKDOOR!"
X	Remote System Protection	"rundll32.exe [random].dll	HUI_proc"
X	ReparateurDeSysteme	SysRep.exe	"ReparateurDeSysteme
X	ruin	system32.exe	"Added by the DELF-JM TROJAN!"
X	Rundllsystem32	Rundllsystem32.exe	"Added by the NETDEVIL.B TROJAN!"
X	Runtime Server Subsystem	csrss.exe	"Added by the IRCBOT-XV WORM!"
U	SafeHouseSystemTray	SDWTRAY.EXE	"SafeHouse ""Personal Privacy"" system tray icon - PP protects and hides your private and personal photos
Y	SafeSpace	SafeSpaceSysTray.exe	"Part of SafeSpace (from Artificial Dynamics) which ""protects computers from Internet malware infection without the need for signature updates or regular maintenance"""
X	SBR2009F	SystemBooster2009.exe	"SystemBooster2009 rogue system suite - not recommended
X	Secure System	integitor.exe	"Added by the AGOBOT.ACI WORM!"
X	Security System	securesys.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	server	system.exe	"Added by the METHS-A TROJAN!"
X	Service System	kernels32.exe	"Added by the BANCOS-DA TROJAN!"
X	Service System	windowsXP.exe	"Added by the BANCOS-EL TROJAN!"
X	Service System	kgbfsm344.exe	"Added by the BANCOS-FS TROJAN!"
X	Service System	wernell87.exe	"Added by the BANCOS-FJ TROJAN!"
X	Servicos	System.exe	"Added by the BANCOS-BCM TROJAN!"
X	Session Manager Subsystem	smssa.exe	"Added by the RBOT-AGS WORM!"
X	shellsystem	shellsystem.exe	"Added by the UPCHAN TROJAN!"
N	SigmatelSysTrayApp	stsystra.exe	System tray program for the Sigmatel Audio sound card. Often found on Dell computers
N	SigmatelSysTrayApp	sttray.exe	System tray program for the Sigmatel Audio sound card. Often found on Dell computers
X	Sms System32	SmsSystem32.exe	Unidentified malware
U	SMSystemAnalyzer	SMSystemAnalyzer.exe	"Part of the Iolo System Mechanic optimization tool"
X	Sound System	WinSound1.exe	"Added by an unidentified VIRUS
U	SpokeSysTray	SpokeSysTray.exe	"Spoke Software client application. Spoke ""uses data in your e-mail and other enterprise information systems to discover the existing relationships of people in your enterprise. It then builds a private
X	Spooler Subsystem	spoolsub.exe	"Added by the SDBOT-ABG TROJAN!"
X	Spooler SubSystem App	spoolsvc.exe	"Added by the POEBOT-J WORM!"
X	Spooler SubSystem App	spooIsv.exe	"Added by the LINKBOT.M WORM!"
X	Spooler SubSystem App	spoolv.exe	"Added by the SDBOT-BN WORM!"
X	Spooler SubSystem Application	localsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	netsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	spoolsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcadmin.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcman.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	svcrun.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	tcpsvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler SubSystem Application	websvc.exe	"Added by the DLOADER-NY TROJAN!"
X	Spooler Subsystem Application	smss.exe	"Added by the IRCBOT-ZO TROJAN! Note - the legitimate smss.exe process should not normally figure in Msconfig/Startup!"
X	SpoolerSubSystemProcess	SpooI32.exe	"Added by the EHKS.21 keylogger! Note - the ""I"" between ""o"" and ""3"" is a capital ""i"" not a lower case ""L"""
X	SpySpotter System Defender	Defender.exe	"SpySpotter rogue spyware remover - not recommended
X	ssgrate.exe	system.exe	"Added by the MITGLIEDER.C TROJAN!"
X	ssgrate.exe	winsystems.exe	"Added by the BAGLEDL-J TROJAN!"
N	StacSysTray	StacSysTray.exe	System Tray control panel for SigmaTel C-Major on-board audio - as used on some Dell and Packard Bell PCs
X	StartReplySystem	loadnewmessage.exe	"Added by the HIDAGENT-B WORM!"
X	Sygate Personal Firewall	system32.exe	"Added by the RBOT.VI WORM!"
N	SymTray - Norton SystemWorks	SYMTRAY.EXE	"Keeps all System Tray icons for Norton SystemWorks together to reduce clutter. SystemWorks includes Norton Anti-Virus
X	Syntax Script	systacq.exe	"Added by the SDBOT.AI WORM!"
X	SYS1	system.exe	"Added by the SILLYFDC-AP WORM!"
X	Sysgate Personal Firewall	syst3ms.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Sysmon	SystemMonitor.exe	"Added by the NUJAMA-A WORM!"
X	Sysmppcvppp	SysTdSvr.dll	"Generic2.PQG adware"
X	sysPersonalFirewall	system.exe	"Added by the WOOTBOT.FH WORM!"
X	SysProtect	System.exe	"Added by the NETSPY TROJAN!"
X	SysService32l	systask32l.exe	"Added by the THEUG WORM!"
X	SysStrt	systemc.exe	"Added by the AGOBOT-QA TROJAN!"
X	syst	syst.exe	"Added by the DUMB.A ""Joke"" virus"
X	Systam13	f1r5st83.exe	"Added by the IRCBOT-YM WORM!"
X	Systam13	exp.exe	"Added by the RBOT.ESD BACKDOOR!"
X	Systam13	first.exe	"Added by the RBOT.GND BACKDOOR!"
X	Systam13	resx.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Systam13	speedwin.exe	"Added by the RBOT.GVH BACKDOOR!"
X	System	run322.exe	"Added by the LANFILT TROJAN!"
X	System	system.exe	Added by various WORMS and TROJANS!
X	system	regedit -s system.dll	Homepage hijacker
X	system	systemsearch.hta	Jetseeker.com hijacker
X	System	dcomx.exe	"Added by the CIREBOT TROJAN!"
X	system	Explorer.exe	"Added by the GRAYBIRD BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	System	YPager.exe	"Added by the JUNTADOR.K TROJAN! Note - this is not the older version of Yahoo! Messenger which shares the same filename and is located on %ProgramFiles%\Yahoo!\Messenger"
X	system	outlook.exe	"Added by the MIMAIL.Q WORM! Note that the valid Microsoft Outlook executeable is located in %ProgramFiles%\Microsoft Office\Office whereas this one is located in %Windir%"
X	System	Atira.exe	"Added by the KOTIRA VIRUS!"
X	SYSTEM	lsas.exe	"Added by the SPYBOT.CJ WORM!"
X	System	kernels32.exe	"Added by the DLOADER-FC TROJAN!"
U	System	sysctrl.exe	"Added by WinGuardian. Note - this commercial keylogger is no longer made or sold by Webroot but older copies may still be in existance
X	System	csrss.exe	"Added by the LDPINCH.E TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System	SVCHOST.EXE	"Added by the LDPINCH-AU TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	system	lsasse.exe	"Added by the RBOT-YL WORM!"
X	System	systray.exe	"Added by the PISABOY-A TROJAN! Note - this is not the legitimate systray.exe process"
X	System	abcdefg.exe	"Added by the HARWIG-B WORM!"
X	System	cber.exe	Added by an unidentified TROJAN!
X	System	serwin.exe	"Added by the LDPINCH-BN TROJAN!"
X	System	svchîst.exe	"Added by the LDPINCH-BF TROJAN!"
X	System	system.exe (74295303)	"Added by the VB-IU WORM!"
X	System	WINL0G0N.EXE	"Added by the BANCOS-DB TROJAN!"
X	System	wumgrd32.exe	"Added by a variant of the RBOT WORM!"
X	System	SPOOLSU.EXE	"Added by the BANKER-FC TROJAN!"
X	System	system23.exe	"Added by the LEBREAT-D WORM!"
X	System	windowsps.exe	"Added by a variant of the RBOT WORM!"
X	SYSTEM	d.exe	"Added by the MYTOB.LP WORM!"
X	System	inetinfo.exe	"Added by the PARDROP-A TROJAN!"
X	system	services.exe	"Added by the DELF-LQ TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\HELP"
X	SYSTEM	VSSMON.exe	"Added by the RBOT-AWW TROJAN!"
X	SYSTEM	wiinlogon.exe	"Added by the RBOT-AVG WORM!"
X	System	kernels64.exe	"Added by the VIXUP-S TROJAN!"
X	system	lsass.exe	"Added by the SATILOLER.B TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\System"
X	System	smss.exe	"Added by the AGENT.EP BACKDOOR! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System	winupd.exe	"Added by a variant of the SDBOT WORM!"
X	system	messenger.exe	Added by an unidentified WORM or TROJAN!
X	System	kernels1118.exe	"Added by a variant of the SDBOT WORM!"
X	System	wsscntfy.exe	"Added by a variant of the SDBOT WORM!"
X	SYSTEM	windmupdr.exe	"Added by a variant of the RBOT WORM!"
X	system	svcr.exe	"Added by the SPYONE TROJAN!"
X	System	kernels88.exe	"Added by the TIBS-PP TROJAN!"
X	System	kernels8.exe	"Added by the TIBS.AI TROJAN!"
X	System	OeApi.vbs	"Added by the AGUI WORM!"
X	System	Updaterun.exe	"Added by the QQHELP-DX TROJAN!"
X	System	Zap.exe	"Added by the MSNVB-D WORM!"
X	System	BrO_AcT.exe	"Added by the SILLYFDC-AL WORM!"
X	System	Juegs.exe	"Added by the CULLER-C WORM!"
X	System	kernel8.exe	"Added by the DLOADR-AOL TROJAN!"
X	System	kernelwind32.exe	"Added by the VXIDL.FT TROJAN!"
X	System	Xsfr.exe	"Added by the CULLER-D WORM!"
X	System	kernelwind64.exe	"Added by the DLOADER.DJD TROJAN!"
X	SYSTEM	SystemFile.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	system	ssclie.exe	"Added by the AGENT.LW BACKDOOR!"
X	system	Winhelp.exe	"Added by the IMAUT.CN WORM!"
X	system	kernel32.ini	"Added by the SILLYFDC.CJ WORM!"
X	System	testtestt.exe	"Added by the DWNLDR-ZLC TROJAN!"
X	system	Microsoft Office.exe	"Added by the BANCBAN-LH TROJAN!"
X	System	IEXPL0RE.EXE	"Added by the VB.KS WORM! Note the number ""0"" in the filename"
X	system	sysnet.exe	"Added by the VETOR-J WORM!"
X	system	systemdb.exe	"Barracuda Antivirus and Security Central rogue security software - not recommended
X	System	winipck.exe	"Added by the RBOT-TK WORM!"
X	System	krln32.exe	"Malware installed by different rogue security software including SpyKillerPro"
X	system	system64.exe	"Added by the BANCBAN-PP TROJAN!"
X	System	antivirus.vbe	"Added by the AUTORUN-AYI WORM!"
X	SYSTEM	RUNDLL16.exe	"Added by the DELF-EW BACKDOOR!"
X	System	systemz.exe	"Added by the VILSEL-B TROJAN!"
X	System 64 Driver for Games	sys64dvr.exe	"Added by the SDBOT TROJAN!"
X	System Analyzer	lsass32.exe	"Added by the SDBOT.CNI WORM!"
X	System Applications Profile	sap.exe	"Added by the RBOT-QF WORM!"
X	System Auth	system52.exe	"Identified as a variant of the Win32:Rizo-E malware"
X	System Backup	msystem.exe	Adult content dialler
X	System backup	[random filename]	"Added by the ADMINCASH.B TROJAN! Note - multiple different file names have been spotted
X	System Backup	sysbcp32.exe	"Added by the AGOBOT-NP BACKDOOR!"
X	System Backup Services	backups32.exe	"Added by a variant of the RBOT WORM!"
X	System Boot Check	sysload3.exe	"Added by the FUBALCA WORM!"
X	System Boot Loader	sysboot32.exe	"Added by the SDBOT.PG WORM!"
X	System Buffer Application	buffer32.exe	"Added by the SDBOT-UD WORM!"
X	System Cache	SysCache.exe	"Added by an unidentified VIRUS
X	System CGI Manager	syscgmgr.exe	"Added by an unidentified WORM or TROJAN! See here"
U	System Check	"Rundll32.exe SysDll32.dll	SystemCheck"
X	system check	updater.exe	Unidentified adware downloader
X	System Check	win_klr32.exe	"Added by the DELF-DRA WORM!"
X	System Checking	wasul.exe	"Added by the RBOT.BHM WORM!"
X	System Config	BF3.EXE	"Added by the SPYBOT-DT WORM!"
X	System Config	sysloadcnf.exe	"Added by a variant of the SDBOT WORM! See here"
X	System Config Boot	syscgboot.exe	"Added by the AGENT.VWU TROJAN!"
X	System Config Manager	crss.exe	"Added by the AGOBOT.GH WORM!"
X	System Config Manager	smssl.exe	"Added by the AGOBOT-ZJ WORM!"
X	System Configuration	iexplore.exe	"Added by the RANDEX.AD WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	System Configuration	syscfg32.exe	"Added by the MYTOB.EA WORM!"
X	System Configurator32	SYSTEMCFG.EXE	"Added by the AGOBOT-KS WORM!"
X	system configure	svchost.exe	"Added by the LINEAGE-C TROJAN! Note - this is not the legitimate svchost.exe process which should not normally figure in Msconfig/Startup!"
X	System Core Memory	syscoremem.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	System CPL manager	[random filename]	"Added by the RBOT-SR WORM!"
X	System CSRSS Patch	scrtkfg.exe	"Added by the RBOT-ADA WORM!"
X	System Database administration	systemDA.exe	"Added by the DERDERO.B WORM!"
X	System Database Administration Support Process	sysdasp.exe	"Added by the DERDERO.C WORM!"
X	System DataBase Root	sysdbroot.exe	"Added by the QHOST-W TROJAN!"
X	System DB Manager	sysdbmg.exe	"Added by an unidentified WORM or TROJAN! See here"
X	System Defender	WS[random characters].exe	"System Defender rogue security software - not recommended
X	System Device	devices.exe	"Added by the AGENT.AFIF WORM!"
X	System Device Version	systemdv.exe	"Added by a variant of the RBOT WORM!"
X	System Diagnostics	sysdiag32.exe	"Added by the SDBOT.GEN TROJAN!"
N	System DLF	cpqdiaga.exe	Compaq Diagnostic record system utility which allow you to view information about your computer's hardware and software configuration. Available via Start -> Programs
U	System DLL Resources	sysdll.exe	"SnapKey is a surveillance software program that records all keyboard activities. Uninstall this software unless you put it there yourself"
X	System Doctor Free	systemdoc.exe	"SystemDoctor rogue security software - not recommended
X	System Document Application	nmod.exe	"Added by the SDBOT-ABB WORM!"
X	System Document Application	msdocument.exe	"Added by the RANDEX.COX WORM!"
X	System Document Application	wins.exe	"Added by the SDBOT.AUB WORM!"
X	System Document Application	winsvc32.exe	"Added by the SDBOT-VA WORM!"
X	System Download Manager	SysMgr.exe	"Added by the RBOT.CIG WORM!"
X	System driver	Messenger.exe	"Added by the WOOTBOT.GI WORM!"
X	System Drivers	wingmt.exe	"Added by the SDBOT-MG WORM!"
X	System Drivers	cpsq32.exe	"Added by the SDBOT.AXH WORM!"
X	System Drivers	sysdrv32.exe	"Added by the AGOBOT-ZX WORM!"
X	System Efficiency Monitor	mscedit32.exe	"Added by the SDBOT.P TROJAN!"
X	System Efficiency Monitor	mscommand.exe	"Added by the KWBOT.P WORM!"
X	System Efficiency Monitor	msedit32.exe	"Added by the STEPH-B WORM!"
X	System Efficiency Monitor	svchostx.exe	"Added by the KWBOT.E WORM!"
X	System Error Notification	senr32.exe	"Added by the POISON-BT TROJAN!"
X	System Event Manager	secsvc.exe	"Added by the RBOT.BMY WORM!"
X	System Executable DLL Library	EXECDLL32.exe	"Added by the RANDEX.AZ WORM!"
X	System Failure Statistic	cnstat.exe	"Added by the RBOT-LF WORM!"
X	System File Drivers	nvsysvc32.exe	"Added by the AGOBOT.WJ WORM!"
X	System File Startup	sys32.exe	"Added by the RBOT.OTL WORM!"
U	System Files Updater	System Files Updater.exe	"System Files Updater from Flyakiteosx ""will transform the look of an ordinary Windows XP system to resemble the look of Mac OS X"""
X	system firewall	makeini32.exe	"Added by the AGOBOT-PS WORM!"
X	System Firewall	sysfirewall.exe	"Added by the AGOBOT-ACY WORM!"
X	System Firewalls	commandprompt32.exe	"Added by the RBOT.BJT WORM!"
X	System Guard	mhguard.exe	"Added by the RBOT-AGU WORM!"
X	System Handler	LSASS.EXE	"Added by the NIMOS WORM! Note - this is not the legitimate lsass.exe process
X	system handler	srvhandle.exe	"Added by the REDPLUT VIRUS!"
X	System handler	Pandawas.exe	"Added by the BHARAT.A WORM!"
X	System Host	scvhost.exe	"Added by a variant of the RBOT WORM!"
X	System Host Manager	syshost.exe	"Added by the BANWORM-C WORM!"
X	System Host Service	svchost.exe	"Added by the CONE.F WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\tasks"
X	System Information Manager	Navcpe.exe	"Added by the SDBOT-QB WORM!"
X	System Information Manager	Msbb.exe	"Added by the SLINBOT.YR BACKDOOR!"
X	System Information Manager	iexplore.exe	"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	System Information Manager	mslog.exe	"Added by the DELF.AKO TROJAN!"
X	System Information Manager	no.exe	"Added by the SPYBOT.NO WORM!"
X	System Information Manager	syspass.exe	"Added by the SDBOT-MO WORM!"
X	System Information Manager	win.exe	"Added by the SDBOT-MU WORM!"
X	System Information Manager	windowsNt.com	"Added by the SDBOT-ND WORM!"
X	System Init	systeminit.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	System Initialization	msmsgri32.exe	"Added by the RANDEX.D WORM or ROXY or ROXY.B TROJANS!"
X	System Initialization	payload.dat	"Added by the RANDEX.D WORM or ROXY or ROXY.B TROJANS!"
X	System IP	systemip.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	System Kernal Support	system.exe	"Added by the SDBOT.BWV WORM!"
X	System Kernel	lsass.exe	"Added by the VBBOT-G TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
U	System LifeGuard Scheduler	Slsched.exe	"System LifeGuard scheduler"
X	System Loader	systems.exe	"Added by the AGOGBOT-FI WORM!"
X	System Loader	syscfg.exe	"Added by the AGOBOT-BS BACKDOOR!"
X	System Loaderap	syst19b.exe	"Added by the AGOBOT-AT BACKDOOR!"
X	System Log Event	csrss32.exe	"Added by the AGOBOT-JI WORM!"
X	System Management Service	smsc.exe	"Added by the RBOT-ANN WORM!"
X	System Manager	svchost.exe	"Added by the BANKER-AE TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	system manager	System.exe	"Added by the FORBOT-BO WORM!"
X	System Manager	winsrv32.exe	Added by an unidentified WORM or TROJAN!
X	System Manager	sysmng.exe	"Added by the TAME-C WORM!"
X	System Manager	sysmgr.exe	"Added by the IRCBOT.AGW BACKDOOR!"
X	System Manager	User Documents.exe	"Added by the VB.GF VIRUS!"
X	System Manager	sysmngr.exe	"Added by the IRCBOT.BAQ BACKDOOR!"
X	System Manager	ncvs32.exe	"Added by a variant of the IRCBOT BACKDOOR!"
X	System Manager Updates	winsvc.exe	"Added by the AGOBOT.AEM WORM!"
U	System Mechanic Popup Blocker	PopupBlocker.exe	"Popup blocker part of Iolo System Mechanic utility suite"
U	System Mechanic Popup Stopper	Popupstopper.exe	"Popup stopper part of Iolo System Mechanic utility suite"
N	System Mechanic Professional Update [Incinerator.dll]	SysMech4.exe /REREG: [path] Incinerator.dll	"Iolo System Mechanic ""Incinerator"" feature securely deletes files and folders from your PC so they can never be recovered again"
U	System Mechanic Startup Guard	StartupGuard.exe	"System Mechanic Startup Guard protects the Window's startup locations from being modified by viruses
X	SYSTEM MESSAGER	wmisg.exe	"Added by the MYTOB.ES WORM!"
X	System Messaging Queue	SMCSS.EXE	"Added by a variant of the RBOT WORM!"
X	System Messenger	SYSMSG32.EXE	"Added by the SPYBOT-DK WORM!"
X	System Messenger32	systgmgr32.exe	"Added by the SDBOT.DF WORM!"
X	System Microsoft Core	smc.exe	"Added by the RIZO.A TROJAN!"
U	System Monitor	SYSMON.EXE	"Comes with some Aopen motherboards. Monitors CPU temp
X	System Monitor	Sysmon16.exe	"Added by the SDBOT TROJAN!"
X	System Monitoring	cute.exe	"Added by the RAHIWI.A WORM!"
X	System Monitoring	Mooks.EXE	"Added by the BHARAT.A WORM!"
X	System Monitoring	lsass.exe	"Added by the BRONTOK-BS WORM! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in Documents and Settings\<User>\Local Settings\Application Data\WINDOWS"
X	System MScvb	mscvb32.exe	"Added by the SOBIG.C WORM!"
X	System Net	sys32.exe	"Added by the FORBOT-FX WORM!"
X	System Net Database	sysnd.exe	"Added by the RBOT-AAW WORM!"
X	System Networking	sysnet.exe	"Added by the RBOT.API WORM!"
X	System Power Managment	svcnost.exe	"Added by the DREF-I WORM!"
X	System Presets	[temp name].exe	"Added by the HOSTINF-A WORM!"
X	System Process	csrss.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System Process	lsass.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System Process	svchost.exe	"Added by the ADCLICK-AG TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	System Process	CSRSR.exe	"Added by the AGOBOT-SQ WORM!"
X	System Process Analization	sysproc.exe	"Added by a variant of the RBOT WORM!"
X	System Process Analization Thread	system.exe	"Added by a variant of the RBOT WORM!"
X	System Profile	Regsrv.exe	"Added by a variant of the OPTIX TROJAN!"
X	System Protector	lsascs.exe	"System Protector rogue security software - not recommended
X	System RAID Manager	raid64.exe	"Added by the AGENT-NNZ TROJAN!"
X	System Reboot	rebootsys.exe	"Added by the RBOT-WU WORM!"
X	System Redirect	sysbho.exe	"Downloader trojan
X	System Registry Manager	sysrgmgr.exe	"Added by an unidentified WORM or TROJAN! See here"
X	System Restore	svcnet.exe	"Added by the TIBICK WORM!"
X	System Restore Data	[path] repcale.exe [path] beird.exe	"Added by the RANDON.AN WORM! Both files are located in %System%\frbyjed"
X	System Scanner	system.exe	"Added by the AGOBOT-DI BACKDOOR!"
X	System Security Checker	ssc.exe	"Added by the IRCBOT-WI TROJAN!"
X	System Security Updaters	vsmons.exe	"Added by the RBOT-OW WORM!"
X	System Service	MSREXE.EXE	"Added by the AML TROJAN!"
X	system service	spoolcrv.cpl	Added by the INSPIR.11 TROJAN!
X	System Service	systems.exe	"Added by the AGOBOT.VZ WORM!"
X	System Service	coderxt.exe	"Added by the RBOT-ALD WORM!"
X	System Service	exp0lrer.exe	"Added by a variant of the RBOT WORM!"
X	System Service	servicent.exe	"Added by the RBOT-AJI WORM!"
X	System service	system.exe	"Added by the BANCOS.AA TROJAN!"
X	System Service	msnwindows.exe	"Added by the SPYBOT.YCL WORM!"
X	System Service	servicez.exe	"Added by the RBOT-AOY WORM!"
X	System Service	msnxpexe.exe	"Added by the RBOT-AUA WORM!"
X	System Service	teskmangr.exe	"Added by the RBOT-AUV WORM!"
X	System Service	backup.exe	Added by the PACKBOT.AA WORM!
X	System Service	serious.exe	"Added by the RBOT-FMV WORM! Note - deactivates the Microsoft Internet Connection Firewall (ICF)"
X	System Service	b4db0yz.exe	"Added by the RBOT-CLO WORM!"
X	SYSTEM service helper	svchelper.exe	"Added by the MONKBD-A WORM!"
X	SYSTEM service helper	syshelp.exe	"Added by a variant of the MONKBD-A WORM!"
X	System Service Manager	lsmas.exe	"Added by the AGOBOT-IK BACKDOOR!"
X	System Service Manager	norton.exe	"Added by the GAOBOT.AJE WORM!"
X	System Service Manager Device	svho.exe	"Added by the RBOT.GCG BACKDOOR!"
X	System service**	pokapoka**.exe	"EliteBar adware - where ** represents the numbers 61 to 79"
X	System service78	[path to file]	"Added by the ELITEBAR-T and ELITEBAR-U TROJANS!"
X	System service79	[path to file]	"Added by the ELITEBAR-V TROJAN!"
X	System Services	[random file name]	"Added by a variant of the RBOT WORM!"
X	System Services	connection.exe	Added by an unidentified WORM or TROJAN!
X	System Services	svcsenes.exe	"Added by a variant of the RBOT WORM!"
X	System Services	svcsenes32a.exe	"Added by the RBOT-AFG WORM!"
X	System Services	ssms.exe	"Added by a variant of the RBOT WORM!"
X	System Services Monitor	server.exe	"Bifrost malware"
X	System Servlce	live.exe	"Added by the IRCBOT-GX WORM!"
X	System Session Manager	smss.exe	"Added by the KALEL-E WORM! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup!"
X	System settings	burndl32.exe	"Added by the SDBOT-ZO WORM!"
X	System Setup	rpcxcmod.exe	Added by an unidentified WORM or TROJAN!
X	System Soap Pro	soap.exe	"System Soap Pro internet cleaning software. Bundles foistware like Httper and Zipclix - best avoided"
X	system spool	syspools.exe	"Added by the DREF-T WORM/VIRUS!"
X	System Spooler Subsystem	lssas.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
U	System startup	charmapx.exe	Only required if using an oriental language
X	System Startup	Voltio.exe	"Added by the RBOT.NJ WORM!"
X	System Startup	kimochi.exe	"Added by a variant of the RBOT WORM!"
X	System Startup	sys.exe	"Added by a variant of the IRCBOT TROJAN!"
X	System Startup Manager	smcss.exe	"Added by the RBOT.AMD WORM!"
X	System Stats	SystemStats.exe	"Added by a variant of the WOOTBOT WORM!"
X	System Support	syscfg.exe	"Added by the RBOT-AGQ WORM!"
X	System Support	system32.exe	"Added by the RBOT-AHA WORM!"
X	System Support	syssql.exe	"Added by the RBOT-AUH WORM!"
X	System Support	torrent.exe	"Added by a variant of the RBOT WORM!"
X	System Task Manager	taskmrg.exe	"Added by a variant of the SPYBOT WORM! See here"
X	System Terminal	SYSTEM2.EXE	"Added by the SPYBOT-BZ TROJAN!"
X	System time updator	CSysTime.exe	"Added by the RANDEX.S WORM!"
X	system tool	sysguard.exe	"Antivirus System Pro rogue security software - not recommended
X	System Toolkit	Systools.exe	"Added by the RONOPER-G WORM!"
X	System Tray	msccn32.exe	"Added by the SOBIG.B WORM! Warning - spreading via infected E-mail attachments with the sender address faked as support@microsoft.com! Note - this is not the legitimate systray.exe process"
X	System Tray	systray.exe	"Added by the FAN-A WORM! Note - the valid Microsoft systray.exe is normally located in %System% and will only run at startup on Win9x/Me systems. This one is located in %Windir%"
X	System Tray Monitor	tray.exe	"Added by the RBOT.UXR WORM!"
X	System Tray Services	spooles32.exe	"Added by the AGOBOT.ZH WORM!"
X	System Tray32	SysTray32.exe	"Added by the REPAD WORM!"
X	System Unix	syscfg32.exe	"Added by the RBOT-ZD WORM!"
X	system updata	updata.exe	"Added by the LINEAGE-C TROJAN!"
X	System Update	[filename].exe	"CoolWebSearch parasite variant"
X	System Update	[random filename]	"Added by the KORGO.W or KORGO.X WORMS!"
X	System Update	wupdmgr.exe	"Added by the SOROMO-A TROJAN!"
X	System Update	[random filename]	"Added by the SOROMO-A TROJAN!"
X	System Update	wauluclt.exe	"Added by the SDBOT.EF WORM!"
X	System Update	[path to trojan]	"Added by the AUTOTROJ-D TROJAN!"
X	System Update	mssetupconf.exe	"Added by the RBOT.DLC WORM!"
X	System Update Application	msbuffer.exe	"Added by the SDBOT.AFF WORM!"
X	System Update Service	wmiprvsa.exe	"Added by the AGOBOT-RG TROJAN!"
X	System Update Service	winupd32.exe	"Added by the ADTODA-A TROJAN!"
X	System Update Service	system.pif	"Added by the RBOT-ALL WORM!"
X	System Update Service	update.pif	"Added by the SPYBOT.WOE WORM!"
X	System Update Service	wmiprvsv.exe	"Added by the AGOBOT.YG WORM!"
X	System Update Service	csrss32.exe	"Added by the AGOBOT-HI WORM!"
X	System Update2	explorer.exe	"Added by the AUTOTROJ-C TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	System Update2	services.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup!"
X	System Update2	svchost.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	System Update2	system.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	taskman.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	taskmon.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate Win98/Me file of the same name which is located in %Windir% as this version is located in %System%. It is not normally found on a WinXP system"
X	System Update2	update.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	webcheck.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	wininet.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	winlogon.exe	"Added by the AUTOTROJ-C TROJAN! Note - this is not the legitimate winlogon.exe process
X	System Update2	winspool.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Update2	wupdmgr.exe	"Added by the AUTOTROJ-C TROJAN!"
X	System Updated	svchoes.exe	"Added by the RBOT-ASF WORM!"
X	System Updater Machine	crhwss.exe	"Added by the CIADOOR-DQ TROJAN!"
X	System Updater Machine	system.exe	"Added by the CIADOOR.GN BACKDOOR!"
X	System Updater Process	wmiprvsw.exe	"Added by the AGOBOT-IL WORM!"
X	System Updater Service	wmiprvsw.exe	"Added by the GAOBOT.AFC WORM!"
X	System Updates	winsci.exe	"Added by a variant of the RBOT WORM!"
X	System Updates	szwi.exe	"Added by the RBOT-AXE WORM!"
X	System Updates	unve.exe	"Added by the RBOT-AWG TROJAN!"
X	System Updates	wmkl.exe	"Added by the RBOT-AYJ WORM!"
X	System Updates 4	mssysfix.exe	"Added by the RBOT-ADU WORM!"
X	System Updates Manager	winserv32.exe	"Added by the AGOBOT-AGA WORM!"
X	System Updates Service	updates.pif	"Added by the RBOT-AMA WORM!"
X	System Uptime Server	SYSENTRY.EXE	"Added by the RBOT.LK WORM!"
X	System Uptime Server	SYSENTRY32.EXE	"Added by the RBOT.LK WORM!"
X	system xp	acdsee demo.exe	"Added by the SALGA.A WORM!"
X	System-Config	msptmf32.com	"Added by the LIOTEN.FA WORM!"
X	System-Service	EXPLORER.SCR	"Added by the BENJAMIN.A WORM! KaZaA file-sharing users beware!"
X	System-Stat	systats.exe	"Added by the SDBOT.RA WORM!"
X	system.	system..exe	"Added by the OPTIXPRO.13.C TROJAN!"
X	system...	system...exe	"Added by the OPTIXPRO.13.C TROJAN!"
X	System.exe	System.exe	Added by various WORMS and TROJANS!
X	system.exe	system.exe	"Added by the JAMPORK.E WORM!"
X	system.exe	system.exe	"Added by a variant of the IRCBOT BACKDOOR! Located in %WINDIR%\pchealth\helpctr\binaries"
X	System132	Csrtss.exe	"Added by the LANFILT-I TROJAN!"
X	system16	system16.exe	"Added by the BANCBAN-OB BACKDOOR!"
X	system23	notPad.exe	"Added by the ESTEEMS.D TROJAN!"
X	System32	system.exe	"Added by the BUSHTRO122 TROJAN!"
X	System32	System32.exe	Added by any number of WORMS or TROJANS!
U	System32	sysdiag.exe	"SpyAgent surveillance software. Uninstall this software unless you put it there yourself"
X	System32	"system32	1.exe"
X	system32	NeT-BoT.exe	"Added by the AGOBOT-LJ WORM!"
X	System32	lsasss.exe	"Added by the RBOT-XW WORM!"
X	System32	crsvvc.exe	"Added by the RBOT.BLY WORM!"
X	system32	QQGame.exe	"Added by the QQPASS-AC TROJAN!"
X	System32	[worm filename]	"Added by the NAUTICAL-A WORM!"
X	System32	winds32.exe	"Added by the DWNLDR-HFY TROJAN!"
X	System32	csrss.exe	"Added by the SILLYFDC WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	system32	lowinplay.exe	"Added by the VB.FVJ TROJAN!"
U	System32	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
X	System32	svchost.exe	"Added by the ZAPCHAS-V TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	System32 PCI Manager	syspci32.exe	"Added by the RBOT-AFR WORM!"
X	System32 Runtime StartUp	sysrs.exe	"Added by the AGOBOT.ANW WORM!"
X	System32 Spool	winint.exe	"Added by the FORBOT-N WORM!"
X	System32 TCP Manager	systcpm.exe	"Added by a variant of the RBOT WORM!"
X	System32 TCP Manager	systerm.exe	"Added by the RBOT.AFD WORM!"
X	System32 Temp Service	systmp.exe	"Added by the RBOT-AET WORM!"
X	System32-Driver	csrs32.exe	"Added by the SDBOT-CP BACKDOOR!"
X	system32.dll	systeminit.exe	"CoolWebSearch parasite variant - re-directing to your-search.info"
X	system32.dll	sysdll32.exe	"CoolWebSearch parasite variant. Redirecting to wholeworldmarket.com
X	system32.exe	services32.exe	"Added by a variant of the IRCBOT TROJAN!"
X	system32.exe	system32.exe	"Added by the GRAYBIRD.P TROJAN!"
X	System32BLSJ Agent	System32BLSJ.exe	"Added by the MDROP-BPT TROJAN!"
X	System32Check	[random].exe	"Added by the CHAST-A TROJAN!"
X	System32Dll	DLL32SYS.EXE	"Added by the SPYBOT-CZ WORM!"
X	System32Ex	System32Ex.exe	"Added by the IRCCONTACT TROJAN!"
U	System32kfvw	sysdiag.exe	"SpyAgent surveillance software. Uninstall this software unless you put it there yourself"
X	System32Root	Gadu-Gadu.exe	"Added by a variant of the IRCBOT TROJAN! Note - doe not confuse with the Polish language Instant Messaging client also called Gadu-Gadu"
X	system32WXBP Agent	system32WXBP.exe	"ARDAMAX.HR spyware"
X	System33	FB_PNU.EXE	"Added by the NICHELLO-A WORM!"
X	system34.exe	system34.exe	"Added by the DWNLDR-FXY TROJAN!"
X	System4224411	Virus	"Added by the CAGER.A WORM!"
X	System4224411	Systemdll.exe	"Added by the YUSUFALI-B WORM!"
X	system43.exe	system43.exe	"Added by a variant of the SDBOT WORM!"
X	System51616	msnmsgesser.exe	"Added by a variant of the PUSHBOT WORM! A family of worms that spread using MSN Messenger"
X	System64	inet.exe	"Added by the DENGLE-A TROJAN!"
X	SystemAdministration	Wincmp32.exe	"Added by the ASYLUM TROJAN!"
U	SystemAgent	Sage.exe	"""Microsoft Plus! System Agent automatically tunes your system
X	SystemArmor	SystemArmor.exe	"SystemArmor rogue security software - not recommended
X	SystemB	MessengerStopper.exe	"MessStopper adware"
X	systemb	systemb.exe	"Added by a variant of the IRCBOT TROJAN!"
X	SystemBackup	mtx.exe	"Added by the MTX VIRUS/WORM!"
X	SystemBackup	MicroLog.exe	"Added by the MICROLOG.A TROJAN!"
X	SystemBooster2009	sbr_updater.exe	"SystemBooster2009 rogue system suite - not recommended
?	SystemBoot	ladies.htm	"Unknown but sounds very suspicious??"
X	SystemBoot	Mshta.exe ...filename.hta	Adult content dialler
X	SystemBoot	services.exe	"Added by the SOBER-Q TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Help\Help"
X	Systemboot	msnsngr.exe	"Added by a variant of the RBOT WORM!"
X	SystemCheck	Systemcheck.exe	"Added by the LAVITS WORM!"
X	SystemCheck	services.exe	"Added by the SOBER-M WORM! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Config\system"
X	SystemCheck	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	SystemCheck	SysCheckBop32.exe	"WINBO adware"
U	Systemcheck	sb32mon.exe	"Part of the SpyBuddy keystroke logger/monitoring program - see here. Remove unless you installed it yourself!"
X	SystemChecker	Syschk.exe	"Added by the GALIL.F WORM!"
X	SystemCleaner	Clean2.exe	"Added by the AUTORUN-AZE WORM!"
X	SystemCleanerPRO	sysclpro.exe	"SystemCleanerPro rogue security software - not recommended
X	SystemCONF98i	SystemCONF98i.exe	"Added by the GLITCH TROJAN!"
X	SystemCop	SystemCop.exe	"SystemCop rogue security software - not recommended
X	SystemData	MBlocker.exe	"Messenger Blocker rogue security software - not recommended"
X	SystemDebug	Sysdeb32.exe	"Added by the SYSBUG TROJAN!"
X	SystemDefender	SystemDefender.exe	"SystemDefender rogue spyware remover - not recommended
X	SystemDevic	devic.exe	"Added by the MIMBOT.A WORM!"
X	SystemDll	SystemDll.exe	"Added by the LOXOSCAM TROJAN!"
X	systemdll.dll	winsys32.exe	"Added by the DELF.CP BACKDOOR!"
X	systemdll32.exe	systemdll32.exe	"Added by the FEUTEL-F TROJAN!"
X	SystemDoctor 2006 Free	sd2006.exe	"SystemDoctor rogue security software - not recommended
X	SystemDoctor Free	systemdoc.exe	"SystemDoctor rogue security software - not recommended
X	SystemDrive	maxpaynow1.exe	"Added by the TIBS.BKU TROJAN!"
X	SystemDriver	csrss.exe	"Added by the ASCETIC.B TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\addins\explorer"
X	SystemDriverCheck	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	SystemDriverLoad	svchost.exe	"Added by the DELF-KR TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""DriverLoad"" sub-directory of the Root folder (C:\)
X	systemdrv	ms32sys.exe	"Added by an unidentified WORM or TROJAN - most likely GAOBOT variant"
X	SystemEmergency	[various filenames]	"CoolWebSearch Smartsearch parasite variant"
X	SystemErrorFixer	SysRep.exe	"SystemErrorFixer rogue system error and cleaning utility - not recommended. A member of the ErrClean family"
X	SystemExplorer	explore.exe	"Homepage hijacker - file located in the ""Services"" folder in Common Files"
X	Systemey	systemey.exe	"Added by the SLINBOT.JF BACKDOOR!"
X	SystemFighter	SystemFighter.exe	"SystemFighter rogue security software - not recommended
X	SystemFile	SystemFile.exe	"Added by the DULLDOOR-A TROJAN!"
X	SystemFTP	VSENMB.exe	"Malware (ie
X	SystemGent	CVT.exe	"Added by the BRONTOK-H WORM!"
X	systemguard	systemguard.exe	"System Guard 2009 rogue security software - not recommended
?	SystemGuardAlerter	SystemGuardAlerter.exe	"Part of the Iolo System Mechanic maintenance software. What does it do?"
X	SystemGuardCenter	SystemGuardCenter.exe	"System Guard Center rogue security suite - not recommended
X	SystemHelp	"RUNDLL32.EXE SystemHper.dll	Install"
X	SystemInit	iservc.exe	"Added by the FIZZER WORM!"
X	systeminit	systeminit.exe	"Added by the SILLYFDC-AN WORM!"
X	Systemiom Updater	Systemiom.exe	"Added by the SPYBOT.TY WORM!"
X	SystemIron	SystemIron.exe	"SystemIron rogue security software - not recommended
X	systemkernal.exe	systemkernal.exe	"Added by the AGENT-KPQ TROJAN!"
U	SystemKey	rundll32.exe [path] SystemKey.dll rdl	"Stealth Keylogger keystroke logger/monitoring program - remove unless you installed it yourself! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	SystemLoad32	sysload32.exe	"Added by the MIMAIL.E WORM!"
X	SystemLoader	sysldr32.exe	"Added by the DOWNLDR-NS TROJAN!"
X	SystemManager	Sysman32.exe	"Added by the DOWNLOADER-BW.B TROJAN!"
X	SystemManager	[random filename]	"Added by the SETTEC ROOTKIT!"
X	SystemMap32	Netisp32.vbs	"Added by the REDIST.C WORM!"
X	SystemMD	md.exe	Homepage hijacker
X	SystemMessenger	rundll32.exe [path] SystemMessenger.dll	"Stealth Chat Monitor spyware. Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	SystemMgr	Ir32_a.exe	"Added by the MAGANIA-OU TROJAN!"
X	SystemMigration	WinMedia.exe	"Added by the KELVIR.EI WORM!"
X	SystemMonitor	Sysmon32.exe	"Added by the AIDID.A WORM!"
X	SystemNetwork	NETSERV.EXE	Added by the NETCONTROL VIRUS!
X	SystemNetwork	sysnet.exe	"Added by a variant of the RBOT WORM!"
X	SystemNT	SystemNT.exe	"Added by the PWSVB-EG TROJAN!"
X	SystemOPsv	scrtvc32.exe	"Added by a variant of the SPYBOT WORM!"
X	SystemOptimizer2008	main.exe	"SystemOptimizer2008 rogue optimization utility - not recommended
X	SystemOrdnare	SysRep.exe	"SystemOrdnare
X	SystemProcEvent	[trojan filename]	"Added by the IRCBOT.I TROJAN! Filenames used are csrwnd.exe
X	systemr	d11host.exe	"Added by the VB-GX TROJAN!"
X	systemr	gedit.exe	"Added by the ADCLICK-AQ TROJAN!"
?	SystemReg	PROCES.EXE	"??"
X	SystemReg	svchost.exe	"Added by the DEWIN.E BACKDOOR! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	SystemReg	WINREG.EXE	"Added by the DEWIN.A TROJAN!"
X	Systems	scchost.exe	"Added by the DAEMOZ.A TROJAN!"
X	Systems	svch0st.exe	"Added by the MYDOOM.BI WORM!"
X	Systems	Systems.exe	"Added by the BANKBOA-A TROJAN!"
X	Systems	itDDD.exe	"Added by the DLOADER-PP TROJAN!"
X	Systems	sescmgr.exe	"Added by the DWNLDR-GAH TROJAN!"
X	Systems	spoolsvc.exe	"Added by the DLOADR-SW TROJAN!"
X	Systems	sysmon.exe	"Added by the VIXUP-BI WORM!"
X	Systems Backups	windrives.exe	"Added by the AGOBOT-RB WORM!"
X	Systems Restart	slchost.exe	"Added by the MULTIDROP.C TROJAN!"
X	Systems Restart	spchost.exe	Added by an unidentified WORM or TROJAN!
X	Systems Restart	"Rundll32.exe beem.dll	DllRegisterServer"
X	Systems Restart	"Rundll32.exe snim.dll	DllRegisterServer"
X	Systems Restart	"Rundll32.exe zolk.dll	DllRegisterServer"
X	Systems Restart	"Rundll32.exe boln.dll	DllRegisterServer"
X	Systems Service	drivex.exe	"Added by a variant of the RBOT WORM!"
X	systems usb driver	Windows2.exe	"Added by a variant of the RBOT WORM!"
U	Systems.exe	Systems.exe	"Keyboard Spectator - monitoring software that creates records of everything people do on a computer
U	systems.exe	systems.exe	"KGBSpy is a commercial surveillance software program. It logs keystrokes
U	SystemSafe	Syssafe.exe	"System Safety Monitor - system monitoring tool with additional application firewalling"
X	SYSTEMSars32	csrss.exe	"Added by the AHLEM.A WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	SystemSAS	System32.exe	"Added by the KWBOT.C WORM!"
X	systemscroot	systembin.exe	"Added by a variant of the RBOT WORM!"
X	SystemSearch	regedit.exe -s ie.reg	"Installs a Seachxl.com browser page hijack. Note that the Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file ""ie.reg"" is located in the root folder (ie
X	SystemSearch	regedit.exe -s sys.reg	"Installs a i--search.com browser page hijack. Note that the Windows registry editor (regedit.exe) is a legitimate Microsoft file located in %Windir% and shouldn't be deleted. The file ""sys.reg"" is located in %Windir%"
X	SystemSecurity	zprot32.exe	"Added by the AGENT-FK TROJAN!"
X	SystemService	msocfg.exe	Premium rate adult content dialler
X	SystemService	navchk.exe	Premium rate adult content dialler
X	SystemService	qservice.exe	Premium rate adult content dialler
X	SystemService	shman.exe	Premium rate adult content dialler
U	SystemService	nsserver.exe	"NiceSpy keystroke logger/monitoring program - remove unless you installed it yourself!"
X	SystemSettingf	TRUG.vbs	"Added by the TRUG.B MACRO!"
U	SystemSuite Task Manager	MXTASK.EXE	"vcom (nee Ontrack) SystemSuite - PC maintenance and security. Use the program's configuration options to enable only the parts you want running all the time - such as Virusscanner Pro"
X	SystemSv12	newmaxxsv234.exe	"Added by the TIBS-TS TROJAN!"
X	SystemSv121	n2ewma1xxsv234.exe	"Added by the TIBS.TJ TROJAN!"
X	SystemTasks	filez.exe	Adult content dialler
X	SystemTasks	sexypicz.exe	Adult content dialler
X	SystemTasks	loaded.exe	Adult content dialler
X	SystemTools	kernels32.exe	"Added by the DLOADER-FC TROJAN!"
X	SystemTools	kernels1118.exe	"Added by the SMALL.DGK TROJAN!"
X	SystemTools	kernels8.exe	"Added by the FNG TROJAN!"
X	SystemTools	kernels88.exe	"Added by the TIBS-PP TROJAN!"
X	SystemTools	testtestt.exe	"Added by the DWNLDR-ZLC TROJAN!"
X	Systemtra	Systra.exe	"Added by the LOVGATE-W WORM!"
X	SystemTra	CDPlay.EXE	"Added by the LOVGATE.Z WORM!"
X	SystemTra	Video.EXE	"Added by the LOVGATE.E WORM!"
U	SystemTray	SysTray.Exe	"For Win9x/Me - System Tray Services. Provides the Volume Control
X	SystemTray	SystemTray.exe	"Added by the BIGFOOT TROJAN! Note - this is not the legitimate systray.exe process"
X	SystemTray	SysTray.exe	"Added by the ALADINZ.P TROJAN! Note - this is not the legitimate systray.exe process. If you right-click on the real systray.exe the ""Properties"" reveal it to be a Microsoft file"
X	SystemTray	lsvhostwinlk.exe	"Added by a variant of the SPYBOT WORM!"
X	SystemTray	mssgl2.exe	"Added by a variant of the IRCBOT TROJAN!"
X	SystemTray	wekls4.exe	"Added by a variant of the IRCBOT TROJAN!"
X	SystemTray	Windowsupd.exe	"Added by a variant of the IRCBOT TROJAN!"
X	SystemTray Monitor	SysTraymon.exe	"Added by a variant of the SPYBOT WORM! See here"
U	SystemTraySD	SDSystemTray.exe	"Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here"
U	SystemTraySR	SRSystemTray.exe	"Spyware Detector - spyware remover. Initially not recommended due to false positives but the later versions have since improved - see here"
X	SystemTuner	SystemTuner.exe	"System Tuner rogue system suite - not recommended
N	SystemUpd	SystemUpd.exe	"Updater for Swapoo.com
X	SystemUpdate	Negdo.exe	"Added by the CULLER-C WORM!"
X	SystemUpdate	Xeyu.exe	"Added by the CULLER-D WORM!"
X	SystemVeteran.exe	SystemVeteran.exe	"SystemVeteran rogue security software - not recommended
X	systemw32	systemw32.exe	"Added by a variant of the RBOT WORM!"
X	SystemWarrior	SystemWarrior.exe	"SystemWarrior rogue security software - not recommended
U	SystemWeb	rundll32.exe [path] SystemWeb.dll rdl	"StealthWeblog surveillance software. Uninstall this software unless you put it there yourself! Note that rundll32.exe is a legitimate Microsoft file used to launch DLL file types and shouldn't be deleted"
X	SystemWideHook for Windows NT	%WinHook32.exe	"Added by the MYDOOM.AC WORM!"
X	SystemWindows	scvhost.exe	"Added by the SILLYFDC-CG WORM!"
U	SystemWizard Sniffer	Sniffer.exe	"SystemWizard for Win98/ME from SystemSoft - diagnoses and solves hardware and software problems on a PC"
X	SystemX	nzm.exe	"Added by a variant of the RBOT WORM!"
X	systemx32	systemx32.exe	"Added by a variant of the RBOT WORM!"
X	systemyom Updater	systemyom.exe	"Added by a variant of the IRCBOT TROJAN!"
X	SYSTEMZ Patch	SYSZ.exe	"Added by the ALADINZ.P TROJAN!"
U	System_Messages	pprsen.exe	"TerminatorX - ""offers an easy and effective method of stopping users running predetermined file sharing programs like KaZaA
X	systen32.exe	systen32.exe	"Added by the DLOADR-AQP TROJAN!"
X	Systes	jrdtifkkxbbsa.exe	"Added by the RBOT-ADC WORM!"
X	Systesms.exe	systesms.exe	"Added by the RBOT-HI WORM!"
U	Systest	Systest.exe	"Clean Space internet evidence eliminator"
X	SysteZ	d1.exe	"Added by the MSNDIABLO.A WORM!"
X	systhread	winkernal.exe	"Added by the LIAMED WORM!"
X	systhread	HELLO.EXE	"Added by the WINKER.F BACKDOOR!"
X	SysTime	systime.exe	"CoolWebSearch parasite variant - also detected as the STARTPA-FL TROJAN!"
X	Systmesy	Systmesy.exe	"Added by the RBOT-KQ WORM!"
X	SYSTMON.EXE	SYSTMON.EXE	"Added by the SILLY-H WORM!"
X	Systoan32	systoan.exe	"Added by an unidentified VIRUS
X	systr	SYSERVER.exe	"Added by the VB-DQY WORM!"
X	systr2	SERVICE.exe	"Added by the VB-DQY WORM!"
?	systr32	systr32.exe	"??"
X	systrans	[path to trojan]	"Added by the STARTPA-GZ TROJAN!"
X	systrasx	CONSOLES.EXE	"Added by the SDBOT-NW WORM!"
?	systrax	systrax.exe	"??"
X	Systray	Systray_.Exe	"Added by the KERGEZ.A WORM!"
X	Systray	[filename.exe]	"Winfavorites adware"
X	SYSTRAY	UNMT.EXE	"Added by the DLOADER-LQ TROJAN!"
X	SysTray	SysTray.Exe	"Added by the BANCBAN-JV TROJAN! Note - this is not the legitimate systray.exe process from Win9x/Me systems which would appear in the Name/Startup Item field as SystemTray in the registry ""Run"" keys and MSConfig. If you right-click on the real systray.exe the ""Properties"" reveal it to be a Microsoft file"
X	SysTray	Snnpapi.exe	Added by an unidentified TROJAN!
X	Systray	w32explorer.exe	"Added by the RBOT-AJY WORM!"
X	Systray	SteFanie.vbs	"Added by the STEFAN WORM! Note - make sure you check the hyperlink as this one copies it's self to numerous dirves and folders"
X	Systray	KAT.vbs	"Added by the SOAD-D WORM!"
X	SysTray	svhost.exe	"Added by the RAJILO-A WORM!"
X	SysTray	system.exe	"Added by the DELF.E TROJAN!"
X	systray	system234.exe	"Added by the AUTORUN.AEV WORM!"
U	systray	winlogin.exe	"KidControl surveillance software. Uninstall this software unless you put it there yourself"
U	systray	systray.exe	Dell Mobile Broadband wireless configuration utility - located in %ProgramFiles%\Dell\Dell Mobile Broadband
X	Systray driver	systray.exe	"Added by the MUTEBOT TROJAN! Note - this is not the legitimate systray.exe process"
X	SystrayServices	Msxpw.exe	"Added by the CITOR WORM!"
U	SYSTRAYX	SysTrayX.EXE	"""SystrayX helps you hide some of the less used icons from the system tray (the hidden icons can still be seen and used in the special SysTrayX menu but will no longer permanently take precious space from your system tray)"""
X	systree	systree.exe	"Added by the BANCOS.L TROJAN!"
X	Systry	[path to worm]	"Added by the AUTEX WORM!"
X	Systryt	[path to worm]	"Added by the AUTEX WORM!"
X	SystUphes	algesetp.exe	"Added by the QQPASS-AM TROJAN!"
U	Systweak Ad and Popup Blocker	adblock.exe	"Ad and popup blocker part of Advanced System Optimizer from Systweak"
U	Systweak Memory Optimizer	memtuneup.exe	"Part of SysTweak Advanced System Optimizer"
X	systwtray	twitty**.exe [** = random digits]	"Added by the KOOBFACE.C WORM!"
X	Taskbar System	tasksys.exe	"Added by a variant of the SDBOT WORM!"
X	Taskmgr	system.exe	"Added by the PAKES.G TROJAN!"
Y	ThinkVantage Active Protection System	TpShocks.exe	"Part of the Active Protection System found on some IBM/Lenovo Thinkpad models - including the T
X	this free	winsyst.exe	"Added by the MADAG.A WORM!"
X	Torrent Management Service	system32.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Tray manager system	traysys.exe	"Added by the RIZO.A TROJAN!"
X	TSystem	[trojan filename]	"Added by the NSYS-A TROJAN!"
X	TurBo	System.Trubo.vbs	"Added by the AUTOM-C WORM!"
X	Tweak System	Genderowo.exe	"Added by the SILLYFDC WORM!"
X	Ultimate System Guard	MainFAVProj.exe	"Ultimate System Guard rogue security software - not recommended
X	updateWins	systrey.exe	"Added by the RANDON WORM!"
X	USB 2.0 Driver	winsystem.exe	"Added by the AGOBOT-QS WORM!"
X	userd	systems.com	"Added by the OUTLAW-A WORM!"
X	UserSystem	[filename]	"CoolWebSearch Smartsearch parasite variant. Also detected as the SEARCH-A TROJAN!"
X	Video Process	ntsystm.exe	"Added by the GAOBOT.ZX WORM!"
Y	Warning: do not remove it! (system)	cfpsys.exe	"Folder Password Protect - a program that lets you set a password on folders of your choice"
X	WDNS SYSTEM	nibie.exe	"Added by the MYTOB-BY WORM!"
X	WDNS SYSTEM	skybotx.exe	"Added by the MYTOB-BY WORM!"
X	WDNS SYSTEM	wdns33.exe	"Added by the MYTOB-BY WORM!"
X	WIN USB 2.0	usbsystem.exe	Added by an unidentified WORM of TROJAN!
X	Win32	system32.vbs	"Added by the SWERUN VIRUS!"
X	Win32 System Kernel	winservice.exe	"Added by the SDBOT.KIN WORM!"
X	win32 system server	winserver.exe	"Added by the DERMON-A TROJAN!"
X	Win32 System Spool	spoolsvc.exe	"Added by the SDBOT.UK WORM!"
X	win32ini	systroy.exe	"Added by the IRC.ALADINZ.C TROJAN!"
X	win32serv	systemdevices.exe	"Added by a variant of the PUSHBOT WORM! A family of worms that spread using MSN Messenger"
X	Win32system	[random filename]	"Added by the DDV.B WORM!"
X	Win32System	win32s.exe	"Added by the MYDOOM.V WORM!"
X	Win32SystemMonitor	***.exe [* = random char]	Browser hijacker
X	WIN32WN	system_wc.exe	"Eziin adware"
X	Wind River Systems	vxworks.exe	"Added by the ACKANTTA WORM! Note that this is not related to the VxWorks platform from Wind River"
X	windows	system copy.exe	"Added by the SALGA.A WORM!"
X	Windows	system.exe	"Added by the SPYBOT.OBB WORM!"
X	Windows Activate System	syssv.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Audio System	nndsvc.exe	"Added by a variant of the IRCBOT TROJAN! See here"
X	Windows backup	systemss.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows Bootup	Systemwks32.exe	"Added by a variant of the RBOT WORM!"
X	Windows Config System	config.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Configuration System	IExplore.exe	"Added by the RBOT-DDG WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows DLL Services	system.exe	"AGENT.H spyware"
X	Windows Drive Compatibility	System32Driver32.exe	"Added by the SUPOVA.Z WORM!"
X	Windows Explorer	system32.exe	"Added by the RBOT-AJH WORM!"
X	Windows Explorer	system.exe	"Added by the STIRAUT WORM!"
X	Windows File Migration Wizard	HIMENSYST.EXE	"Added by the RBOT-EMO WORM!"
X	Windows File System Frame	ntframe.exe	Added by an unidentified WORM or TROJAN!
X	Windows Fixes Systems	elite.exe	"Added by the MYTOB.EG WORM!"
?	Windows Help System	Help.pif	"??"
X	Windows Hijack Protection System	commngr.exe	"Added by a variant of the AGENT-FYD TROJAN!"
X	WINDOWS ID SYSTEM	wID32.exe	"Added by the MYTOB.LN WORM!"
X	Windows Kernel System Service	wkssvr.exe	"Added by a variant of the RANDEX.GEL WORM!"
X	WINDOWS MANAGEMENT SYSTEM	wm1exe.exe	"Added by the RBOT-VT WORM!"
X	Windows Netsystem Layer	Netsystem.exe	"Added by the RBOT.BEI WORM!"
X	Windows Rescue System	winsto.exe	"Added by the SUURCH.CG TROJAN!"
X	windows run	system.exe	"Added by the ICPASS-A WORM!"
X	Windows Secure Messaging System	msnmsgrsrvc.exe	"Added by the RBOT-RE WORM!"
X	Windows Services Ink Platform Tablet Input Subsystem	wsiptis.exe	"Added by the RBOT.APC WORM!"
X	Windows Session Manager Subsystem	smss.exe	"Added by the KALEL-B WORM! Note - this is not the legitimate smss.exe process which should NOT appear in Msconfig/Startup!"
X	WINDOWS SYSTEM	beta.exe	"Added by the MYTOB.DF WORM!"
X	WINDOWS SYSTEM	dcomuser.exe	"Added by the MYTOB.EO WORM!"
X	WINDOWS SYSTEM	lf66prc.exe	"Added by the MYTOB.GC WORM!"
X	WINDOWS SYSTEM	msdev32.exe	"Added by the MYTOB.EH WORM!"
X	WINDOWS SYSTEM	nec.exe	"Added by the MYTOB-L WORM and variants!"
X	WINDOWS SYSTEM	nibie.exe	"Added by the MYTOB-BY WORM!"
X	WINDOWS SYSTEM	ninfoie.exe	"Added by the MYTOB-EP WORM!"
X	WINDOWS SYSTEM	skybot.exe	"Added by the MYTOB-CX WORM!"
X	WINDOWS SYSTEM	skybotx.exe	"Added by the MYTOB-BY WORM!"
X	WINDOWS SYSTEM	smoc.exe	"Added by the MYTOB.FU WORM!"
X	WINDOWS SYSTEM	smsc.exe	"Added by the MYTOB-BR WORM!"
X	WINDOWS SYSTEM	test.exe	"Added by the MYTOB.DJ WORM!"
X	WINDOWS SYSTEM	test2.exe	"Added by the MYTOB.DJ WORM!"
X	WINDOWS SYSTEM	test3.exe	"Added by the MYTOB.DV WORM!"
X	WINDOWS SYSTEM	wdns33.exe	"Added by the MYTOB-BY WORM!"
X	WINDOWS SYSTEM	win.exe.exe	"Added by the MYTOB.FA WORM!"
X	WINDOWS SYSTEM	winaup.exe	"Added by the MYTOB-DN WORM!"
X	WINDOWS SYSTEM	winligon.exe	"Added by the MYTOB.EP WORM!"
X	WINDOWS SYSTEM	winmon.exe	"Added by the MYTOB.GB WORM!"
X	WINDOWS SYSTEM	winNTsys32.exe	"Added by the MYTOB-DM WORM!"
X	WINDOWS SYSTEM	winsvc32.exe	"Added by the MYTOB.HH WORM!"
X	Windows System	WINSYS.exe	"Added by the RBOT-AEF WORM!"
X	WINDOWS SYSTEM	winsys33.exe	"Added by the MYTOB.EK WORM!"
X	WINDOWS SYSTEM	winvnc.exe	"Added by the MYTOB.EU WORM!"
X	WINDOWS SYSTEM	winxpserv.exe	"Added by the MYTOB-BQ WORM!"
X	WINDOWS SYSTEM	xxx.exe	"Added by the MYTOB.CZ WORM!"
X	Windows System	winsys32.exe	"Added by the MYTOB-IS WORM!"
X	WINDOWS SYSTEM	skybot.exe	"Added by the MYTOB.JU WORM!"
X	WINDOWS SYSTEM	botzor.exe	"Added by the ZOTOB WORM!"
X	WINDOWS SYSTEM	gothica.exe	"Added by the MYTOB.HU WORM!"
X	WINDOWS SYSTEM	msnl.exe	"Added by the MYTOB.IK WORM!"
X	WINDOWS SYSTEM	per.exe	"Added by the ZOTOB.C WORM!"
X	WINDOWS SYSTEM	twunk_65.exe	"Added by the MYTOB-EG WORM!"
X	WINDOWS SYSTEM	servce.exe	"Added by the MYTOB-EI WORM!"
X	WINDOWS SYSTEM	servises.exe	"Added by the ZOTOB-I WORM!"
X	WINDOWS SYSTEM	xpupdate.exe	"Added by the ZOTOB-G WORM!"
X	WINDOWS SYSTEM	expI0rer.exe	"Added by the MYTOB-FI WORM! Note the upper case ""i"" and number ""0"" in the filename"
X	WINDOWS SYSTEM	msn32.exe	"Added by the MYTOB-FX WORM!"
X	WINDOWS SYSTEM	sky.exe	"Added by the MYTOB.LB WORM!"
X	WINDOWS SYSTEM	Win32IMAPSVR.exe	"Added by the MYTOB-FQ or MYTOB-FU WORMS!"
X	WINDOWS SYSTEM	winsvc.exe	"Added by the MYTOB.LM WORM!"
X	WINDOWS SYSTEM	mswins.exe	"Added by the MYTOB.DP WORM!"
X	WINDOWS SYSTEM	mtrnqs.exe	"Added by the MYTOB.IG WORM!"
X	WINDOWS SYSTEM	logic.exe	"Added by the MYTOB.IC WORM!"
X	WINDOWS SYSTEM	ctech.exe	"Added by the MYTOB-KD WORM!"
X	WINDOWS SYSTEM	efefefe.exe	"Added by the MYTOB-KH WORM!"
X	WINDOWS SYSTEM	svchost2.exe	"Added by the MYTOB.OZ WORM!"
X	WINDOWS SYSTEM	skybot.exe	"Added by the MYTOB.EB WORM!"
X	WINDOWS SYSTEM	wupdate.exe	"Added by the MYTOB-HT WORM!"
X	Windows System	system.exe	"Added by the MYTOB-GN WORM!"
X	Windows System 32	winsys_32.exe	"Added by the RBOT-FTR WORM!"
X	Windows System 32-Bat Service	win32bat.exe	"Added by the MYTOB.FI WORM!"
X	Windows System Backup	SysBackup.exe	Unidentified malware
X	WINDOWS SYSTEM By FEnR	windasz-updote.exe	"Added by the MYTOB.LR WORM!"
X	WINDOWS SYSTEM Cleaner	h3.exe	"Added by the MYTOB.EQ WORM!"
X	WINDOWS SYSTEM CLEANER	iexplore.exe	"Added by the MYTOB.ET WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows System Configuration	SYSCFG16.EXE	"Added by the WISDOOR-K TROJAN!"
X	Windows System Configuration	Passcfg16.exe	"Added by the DOMWIS-E TROJAN!"
X	Windows System Configuration	Winfrw.exe	"Added by the SOLUFINA TROJAN or the DOMWIS-J WORM!"
X	Windows System Configuration	wincfg.exe	"Added by the AGOBOT.OP WORM!"
X	Windows System Configuration	WINCFG32.EXE	"Added by the AGOBOT-TE WORM!"
X	Windows System Configuration	WinNeth.exe	"Added by the RETHE-A WORM!"
X	Windows System Configuration	nether.exe	"Added by the OPANKI-AB WORM!"
X	Windows System Configuration	WINSYS32.exe	"Added by the SDBOT.AXK WORM!"
X	Windows System Defender	WS[random characters].exe	"Windows System Defender rogue security software - not recommended
X	WINDOWS SYSTEM Dns	windsns.exe	"Added by the MYTOB.EY WORM!"
X	WINDOWS SYSTEM DNSPOOL	hbmail.exe	"Added by the MYTOB.FW WORM!"
X	Windows System Drivers	sysretain.exe	"Added by the SLENFBOT.BY WORM!"
X	Windows System File	cmxp.exe	"Added by the SPYBOT.KHO WORM!"
X	WINDOWS SYSTEM FILE	winload.exe	"Added by the MYTOB.DK WORM!"
X	Windows System Gateway	SPOOLER.EXE	"Added by a variant of the RBOT WORM!"
X	Windows System Guard	egun.exe	"Added by the AGENT-NHY TROJAN!"
X	Windows System Guard	msdn.exe	"Added by the FAKEAV-BJD TROJAN!"
X	Windows System Guard	msng.exe	"Added by the EGGDROP-BO WORM!"
X	Windows System Guard	msns.exe	"Added by the DWNLDR-IGD TROJAN!"
X	Windows System Init	winit32.exe	"Added by a variant of the RBOT WORM!"
X	Windows System Manager	winsystem.exe	"Added by the RBOT-AN WORM!"
X	Windows System Manager	CRSL.EXE	"Added by the SDBOT.MG WORM!"
X	Windows System Manager	sysconf.exe	"Added by the MYTOB.AL WORM!"
X	Windows System Manager	smsc.exe	"Added by a variant of the RBOT WORM!"
X	Windows System Manager	crssm.exe	"Added by the RBOT-AFH WORM!"
X	WINDOWS SYSTEM MANAGER	spoolsvc.exe	"Added by the MYTOB-LY WORM!"
X	Windows System Manager	winsysmgr.exe	"Added by the IRCBOT.BJG BACKDOOR!"
X	Windows System Manager Loader	smsls.exe	"Added by the AGOBOT.TF WORM!"
X	Windows System Manager Proc	winsmc.exe	"Added by the RBOT.JH WORM!"
X	WINDOWS SYSTEM MEMORY LOADER	memloader.exe	"Added by the MYTOB-IN WORM!"
X	WINDOWS SYSTEM mscdvvs	mscdvvs.exe	"Added by the MYTOB.MD WORM!"
X	windows system notepad	wnpsm.exe	"Added by a variant of the RBOT WORM!"
X	Windows System Restore Configuration	Sblhost.exe	"Added by a variant of the SPYBOT WORM!"
X	Windows System Restorer	SystemRestorer.exe	"Added by the DULOAD.C WORM!"
X	WINDOWS SYSTEM SCALPE	scalpe91.exe	"Added by the MYTOB-HI WORM!"
X	Windows System Security	winmp.exe	"Added by the RBOT.IV WORM!"
X	Windows System Security	sys32.pif	"Added by the RBOT-AOL WORM!"
X	Windows System Security Monitor	[4 random letters].exe	"Added by the PINKTON.A WORM!"
X	Windows System Serivce	winserv.exe	"Added by the RBOT.ACA WORM!"
X	windows system service	winsock.exe	"Added by the RBOT-MR WORM!"
X	Windows System Service	wnuserv.exe	"Added by the SPYBOT.ANDM WORM!"
X	Windows System Service	[worm filename]	"Added by the RBOT.XG WORM!"
X	Windows System Suite	WS[random characters].exe	"Windows System Suite rogue security software - not recommended
U	Windows System Tray	msni.exe	"Iambigbrother monitoring software"
X	Windows System Tray	swhost.exe	"Added by an unidentified VIRUS
X	WINDOWS SYSTEM UPDATE	xDcc.exe	"Added by the MYOTB-EH WORM!"
X	Windows System Update Tools	upds.exe	"Added by the VANBOT.CX BACKDOOR!"
X	Windows System-Control Drivers	syscontrl.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows System32	windowsp.exe	"Added by the MYTOB.GD WORM!"
X	Windows System32	winsys32.exe	"Added by the SDBOT-AHS WORM!"
X	Windows System32	clsas32.exe	"Added by the RBOT-AZO WORM!"
X	Windows System32	explorer.exe	"Added by the OPANKI-V WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is also copied to %System%"
X	Windows System32	System32.exe	"Added by the SDBOT-ALI WORM!"
X	Windows SYSTEM32	Realplayer.exe	"Added by the SPYBOT.ZH WORM!"
X	Windows System32	wingrd32.exe	"Added by a variant of the RBOT WORM!"
X	Windows System32	windows32.exe	"Added by the RBOT-FPB WORM!"
X	Windows System32 Driver	clsass32.exe	"Added by the SDBOT-AGG WORM!"
X	Windows System32 Kernel	system32.exe	"Added by the SDBOT-AAT WORM!"
X	Windows SystemDll	SYSTEMDLL.EXE	"Added by the AGOBOT-LP WORM!"
X	WINDOWS SYSTEMn	servicces.exe	"Added by the MYTOB-EL WORM!"
X	Windows Systemnmg	stagmr.exe	"Added by the MYTOB.S WORM!"
X	Windows Systems16	winjews16.exe	"Added by the SDBOT-CXT WORM!"
X	Windows SYStry	spoolsvr.exe	"Added by the SDBOT.GN BACKDOOR!"
X	Windows SYStry	systry.exe	"Added by the SDBOT-E WORM!"
X	Windows Taskbar System	tasksys.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Update Firewall System	ctfmoom.exe	"Added by the RBOT-GAN WORM!"
X	Windows Update Firewall System	winmsfw.exe	"Added by the RBOT-EEO WORM!"
X	Windows Update Firewall System	ctfmom.exe	"Added by the SPYBOT.ANDM WORM!"
X	Windows Update Service 2004/2005	systemupdate.exe	"Added by the RBOT-JE WORM!"
X	Windows Update Software	system.exe	"TOFGER.BX spyware"
X	Windows Update System	mswins.exe	"Added by the IRCBOT.DN WORM!"
X	Windows Update System Shell	svhostcs32.exe	"Added by the RBOT-AAZ WORM!"
X	Windows-System	System32.exe	"Added by the LOGPOLE.C WORM!"
X	Windows32	system.exe	Unknown malware
X	WindowsAudio	systemupd.exe	"Added by the AGENT-TH WORM!"
X	WindowsFileSystem	winsfs32.exe	"Added by the RBOT-FMQ WORM!"
X	WindowsFileSystem	cidaemon32.exe	"Added by the RBOT-FSP WORM!"
X	WindowsSystem32	asper.exe	"Added by the AGENT-EFP TROJAN!"
X	WindowsSystem32	svchosts.exe	"Added by the AGENT-EDA TROJAN!"
X	WindowsSystem32	[path to worm]	"Added by the SDBOT-DFG WORM!"
X	WindowsSystem32	msnmssgr.exe	"Added by the AGENT.ALY BACKDOOR!"
X	WindowsSystem32	msn_kilo.exe	"Added by the AGENT.ALY BACKDOOR!"
X	WindowsSystem32	msnmgaer.exe	"Added by the AGENT.ALY BACKDOOR!"
X	Windows_Protect	winsystem.exe	"Added by a variant of the RBOT WORM!"
X	winlogon	system.exe	Added by a variant of the DELF.CNS TROJAN!
X	WINOWS SYSTEM	winnt.exe	"Added by the MYTOB.ID WORM!"
X	winphonics7536	vbsystem35.exe setups.exe vb.vb	"Added by a variant of the MUTIN-C TROJAN!"
X	Winsk system Loader	winsk.exe	"Added by the AGOBOT-IZ WORM!"
X	Winsock2 driver	SYSTEM32.EXE	"Added by the SPYBOT-EG WORM!"
X	Winsock32 driver	system32.exe	"Added by the IRCBOT-VT TROJAN!"
X	WinsSystem	syssmss.exe	"Added by the DELF.IG TROJAN!"
X	WinSys	system.exe	"Added by the DAPROSY WORM!"
X	WinSysStartUpWKbLw	TaskSystemDll.Exe	"Added by the BACKZAT.G WORM!"
X	WinSyst32	winsyst32.exe	"Added by the MORB WORM!"
X	WinSystem	winsystem.exe	"Added by the WHITEBAIT WORM!"
U	WinSystem	WinSystems.exe	"CMKeyLogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	Winsystem	Freevideo5.EXE	"Added by the AGENT.FZS WORM!"
X	winsystem.sys	smss.exe	"Added by the SOBER.K WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\msagent\win32 and note the space at the beginning of the ""Startup Item"" field"
X	WinSystems	winsystems16.exe	"Added by the SDBOT-CZT WORM!"
X	winsystems25	winsystems.exe	"Added by the RBOT-CNZ WORM!"
X	winupdate2846	vbsystem35.exe msvbrun.exe	"Added by a variant of the MUTIN-C TROJAN!"
X	winzSystam	xly.exe	"Added by a variant of the SDBOT WORM!"
X	Win_api_driver	system.exe	"Added by the REVIRD TROJAN!"
X	Working System Analyzer	syswork.exe	"Added by the FORBOT-FZ WORM!"
U	X1 System Tray	X1Systray.exe	"Part of X1's Enterprise Desktop Search Resource Center. An enterprise desktop search engine"
X	XP System	systemxp.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	xpsystem	y.exe	"CoolWebSearch parasite variant"
X	Xpsystem	SERVICES.EXE	"Added by the DAEMOZ.A TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %System%\SERVICES"
X	xpsystem	services.exe	"CoolWebSearch parasite variant. Note - this is not the legitimate services.exe process
X	xpsystem	MSXMIDI.EXE	"CoolWebSearch parasite variant
X	xp_system	[filename]	"Added by the BOOKMARKER.J TROJAN! The file is located in %Windir%\inet20004"
X	xp_system	winlogon.exe	"Added by the KREPPER-G TROJAN! - a CoolWebSearch parasite variant. Note - this is not the legitimate winlogon.exe
X	xp_system	services.exe	"Added by the KREPPER-N TROJAN and variants! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The one is located in a %Windir%\inet***** - where ***** varies dependent upon the variant
X	Yahoo Messengger	system3_.exe	"Added by the AUTORUN-AOA WORM!"
X	Zone system	szchost.exe	"Added by the MULTIDR-AC TROJAN!"
X	[Entry name]	System.exe	"Added by the NETHIEF-N TROJAN!"
X	[random characters]	systs.exe	"Added by the AGENT-GDC TROJAN!"
X	[various names]	SYSTRAV.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	_SystemBoot	services.exe	"Added by the SOBER-Q TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\Help\Help"
X	_SystemDriver	csrss.exe	"Added by the ASCETIC.B TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\addins\explorer"
X	_System_Run	_svchost_.exe	"Added by the LINEAGE-Z TROJAN!"
X	_winsystem.sys	smss.exe	"Added by the SOBER.K WORM! Note - this is not the legitimate smss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%\msagent\win32"