xp

NEW HijackThis automated log analyzer! Get your logs analyzed INSTANTLY!

Page

If you're not finding what you're looking for please go to this forum and submit a new startup entry.

Key:

"Y" - Normally leave to run at start-up
"N" - Not required - typically infrequently used tasks that can be started manually if necessary
"U" - User's choice - depends whether a user deems it necessary
"X" - Definitely not required - typically viruses, spyware, adware and "resource hogs"
"?" - Unknown

	Startup Name	Process Name	Details
X		iexpl0re.exe	"Added by the RBOT-SD WORM! Note - has a blank entry under the Startup Item/Name field"
NT	"Ms Java for Windows 98	ME & XP"	X
NT	"Ms Java for Windows 98	XP & ME"	X
X	"Vaganza-XPloit-[User Name]"""	[user name].exe	"Added by the GAVGENT.A WORM!"
X	$sys$cmp	$sys$xp.exe	"Added by the RYKNOS.B TROJAN! Attempts to utilize the Sony Rootkit A.K.A. SecurityRisk.First4DRM security risk to hide itself on the compromised computer"
X	$WindowsRegKey%update	IEXPLORE.EXE	"Added by the RBOT-EZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	0utlook Express	****.exe [ = random char]	"Added by the RBOT-CC WORM! Note the first letter is actually the digit ""0"" and not a capital ""o"""
X	10Base-T	explore.exe	"Added by the AGOBOT-IJ WORM!"
X	456655	explorer.exe	"Added by the BIFROSE-DE TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	@	iexpl0res.exe	"Added by the RBOT.AEX WORM!"
U	AcerNotebookManager	almxptray.exe	System Tray access on some Acer Notebooks to give faster access to system settings
X	AdobeReaderPro	msnxpsp.exe	"Added by the RBOT-ASK or RBOT-AUS WORMS!"
X	Agent Explorer	[random filename]	Unidentified adware
X	ALG.EXE	iexplorer .exe	"Added by the DEMOTRY-B WORM!"
U	Another Internet Explorer Popup Killer	aiepk2.exe	"Another IE Popup Killer - pop-up stopper"
X	Antispyware PRO XP	asproxp.exe	"AntiSpyware Pro XP rogue spyware remover - not recommended
X	AntiSpywareExpert	ase.exe	"AntiSpywareExpert rogue security software - not recommended
X	AntiSpywareXP 2009	AntiSpywareXP2009.exe	"AntiSpywareXP 2009 rogue spyware remover - not recommended
Y	AntiVir XP	AVwin.exe	"AntiVir® PersonalEdition Classic - antivirus"
X	Antivirus	iexpl0res.exe	Added by an unidentified WORM or TROJAN!
X	Antivirus	xpa.exe	"Xpert Antivirus Enterprise rogue security software - not recommended
X	AntivirusXP.exe	AntivirusXP.exe	"Antivirus XP Pro rogue security software - not recommended
X	APIClass	lexplore_.exe	"Added by the MSNOPT-A TROJAN!"
U	Application Explorer	Naldesk.exe	"Novell Zenworks Application Explorer Executable. ""For almost all users the Novell ZENworks agent (either Application Launcher or Application Explorer) will be run via the user's login script on each successful login. ZENworks is used to periodically deliver software updates and is also used to install the remote management components."""
U	Application Explorer	NalView.exe	"Application Explorer - file manager type access to Novell Application Launcher for installing and updating network residing applications"
X	Application Explorer	appexplr.exe	"Added by the AGENT-NMO TROJAN!"
X	AtxBrw	Iexplor.exe	"""Pop Marketing"" adware"
X	Audio Device Manager	WNDXP.exe	"Added by the IRCBOT.AJL BACKDOOR!"
X	AudioMan	Explorer.sm1	"Added by the HUPIGON.IFZ BACKDOOR!"
X	av	expressav.exe	"Express Antivirus 2009 rogue security software - not recommended
X	Avira Anti-Virus Pro 2008	explorear.exe	Added by an unidentified WORM or TROJAN!
X	avptask	expl0rer.exe	"Added by the AGENT.JJO TROJAN!"
X	AXPDefender	AXPDefender.exe	"Advanced XP Defender rogue security software - not recommended
X	AXPFixer	AXPFixer.exe	"AdvancedXPFixer rogue security software - not recommended
U	Belkin F5D8073 N Wireless ExpressCard Adapter Utility	Belkinwcui.exe	"Wireless configuration utility for the Belkin F5D8073 N Wireless ExpressCard Adapter"
X	BIOS XP Loader	[random filename]	"Added by the RBOT-IC WORM!"
U	Boost XP Service	bxservice.exe	"Boost XP from Systweak - WinXP tweaking utility"
X	bxproxy	bxproxy.exe	"Added by the BXPROXY TROJAN!"
X	bxproxy	[random].dll	"SoftStop rogue security software - not recommended"
X	C:WINDOWSIEXPLOR.EXE	IEXPLOR.EXE	"""Pop Marketing"" adware"
N	Capture Express 2000	capexp.exe	"Capture Express - screen capture utility"
X	ccAppr	expIorer.exe	"Added by the TACTSLAY.A TROJAN!"
X	ccreg	explorer.exe	"Added by the ZCREW BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	ccRegVfY	expIorer.exe	"Added by the TACTSLAY.A TROJAN!"
U	CD-DVD Lock for Win95/98/Me/2k/XP	CDVAgent.exe	"Loads CD-DVD Lock from Ixis Research
N	CIJxP2PSERVER	CIJxP2PS.EXE	"Compaq printer utility which is required in order to make the printer work correctly - "x" depends upon the model
?	Client Access Express Welcome	cwbwlwiz.exe	"Welcome wizard launcher - Part of IBM's iSeries (nee As/400) Client Access - communications suite that allows desktop
X	cmssapp	iexplore_.exe	"Added by the BANCBAN-CQ TROJAN!"
X	cmssapp	iexplore.exe	"Added by the BANCBAN-GF TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	COM++ System	exploier.exe	"Added by the LOVGATE.Z WORM!"
X	Config Loadation	iEEexplore.exe	"Added by the SDBOT.H TROJAN!"
X	Config Loadatiorin	I3Explorer.exe	"Added by the SDBOT.H TROJAN!"
X	Config Loader2	explores.exe	"Added by the GAOBOT.BT WORM!"
X	Configuration	explorer32.exe	"Added by the SDBOT-ML WORM!"
X	Configuration Loaded	iexploree.exe	"Added by the SDBOT-KC WORM!"
X	Configuration Loader	IEXPL0RE.EXE	"Added by the SDBOT BACKDOOR! Note the number ""0"" in the filename"
X	Configuration Loader	lexplore.exe	"Added by the RBOT-AGX WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	Configuration Loader	IEXPLORE.EXE	"Added by the SDBOT-KW WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Configuration Loader	explore.exe	"Added by the GAOBOT.GW WORM!"
X	Configuration Loadr	iexplore.exee	Added by an unidentified WORM or TROJAN!
X	CPU Idle	cpuidlexp.exe	"Added by the AGOBOT-BW WORM!"
X	CRSSXP SysInfo	crssxp.exe	"Added by a variant of the SDBOT TROJAN!"
U	cryptoexpert	cexpert.exe	"CryptoExpert from SecureAction Research. Advanced on the fly encryption system"
X	CSNetManagerXp	isass.exe	"Added by the HIDER-O TROJAN!"
N	CursorXP	CursorXP.exe	"CursorXP from Stardock - tool for creating mouse cursors"
X	Debugger	explorer32dbg.exe	"Added by the CWS-M TROJAN!"
X	Debugger	iexplore_dbg.exe	"Added by the CWS-M TROJAN!"
X	Default	explore.vbs	"Added by the ALLEM WORM!"
X	Default web browser	IexpIore.exe	"Added by the OBLIVION.B TROJAN! Note - do not confuse "IexpIore.exe" with "iexplore.exe" (Internet Explorer)
X	DELXP Protocol	delxp.exe	"Added by a variant of the SDBOT WORM!"
X	directx	Sqlexploit.exe	"Added by the SDBOT.D TROJAN!"
X	DivX Player	DivXPlayer.exe	"Added by a variant of the RBOT WORM!"
X	DIVX Video Player	DIVXPloyer.exe	Added by an unidentified WORM or TROJAN!
X	dllhostxp.exe	dllhostxp.exe	Browser hijacker and adware downloader
X	Drivers for Internet Explorer	accesweb.exe	"Added by the STARTPAGE.FW TROJAN!"
X	DriveSystem	maxpaynowti1.exe	"Added by the TIBS.AZT TROJAN!"
U	DVD Device Lock for Win95/98/Me/2k/XP	DDLAgent.exe	"Loads Hide and Protect any Drives - which ""can be used to restrict read or write access to removable media devices such as CD
X	Dynamic Dns Binary	winxp34.exe	"Added by a variant of the RBOT WORM!"
X	exp1orer.exe	exp1orer.exe	"Added by the DLOAD-FG TROJAN! Notice the digit ""1"" used in both the startup entry and filename
X	Expatch	[random filename]	"Added by the PWSLMIR-G TROJAN!"
X	expcrt	[random filename]	"Added by a variant of the SLAPER TROJAN!"
X	ExpertAntivirus	ExpertAntivirus.exe	"ExpertAntivirus rogue security software - not recommended
X	EXPL0RE.EXE	EXPL0RE.EXE	"Added by the POPNO-A TROJAN! Note that the filename is spelled using the digit ""0"" instead of the uppercase letter ""o"""
X	Expl0rer soft	expl0rer.pif	"Added by the RBOT-AQR WORM!"
X	expler	Updadv.exe	"Added by the QQPASS-N TROJAN!"
X	Explkw	expup.exe	Keywords hijacker
X	explord.exe	explord.exe	"Added by the DLOADR-AYW TROJAN!"
X	explore	explore.exe	"Added by any number of VIRUSES
X	Explore	Explorer.exe	"Added by the IRC.FLOOD.G BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Explore	explore.exe	Adult content dialler
X	Explore	PLORE.EXE	"Added by the FORBOT-P WORM!"
X	explore manager	explore.exe	"Added by the DONBOMB.A TROJAN!"
X	explore.exe	Explore.exe	"Added by the GRAYBIRD.G TROJAN!"
X	exploreff.exe	exploreff.exe	"Added by the FINFANSE TROJAN!"
X	explorep.exe	explorep.exe	"Added by the LINEAG-I TROJAN!"
U	explorer	explorer.exe	"Starts Windows Explorer. Unless this has been manually added to startups or added by another program it could be a virus such as PE_BISTRO or DVLDR or MYDOOM.C. Note that it is also not the explorer.exe task/service you'll see when via CTRL+ALT+DEL"
X	explorer	wscript.exe [filename]	"Sneaky way to start any VBS script. Many viruses use VBS files. Note that wscript.exe is a legitimate Microsoft file used to launch script files and shouldn't be deleted"
X	Explorer	shellexpl.exe	"Added by the SHELDOR TROJAN!"
X	explorer	expl32.exe	"Added by the RATSOU TROJAN!"
X	Explorer	[path to worm]	"Added by the AUTEX WORM!"
X	Explorer	shellexp.exe	"Added by the AGENT-ZY TROJAN!"
X	EXPLORER	EXPL0RER.EXE	"Added by the BEASTDO-Y TROJAN! Note the ""0"" in the filename rather than upper case ""o"""
X	EXPLORER	sys.exe	"Added by the SILLYFDC-A TROJAN!"
X	Explorer	config_.com	"Added by the FLOPPY-D WORM!"
X	Explorer	drv.exe	"Added by the SMALL-FD TROJAN!"
X	explorer	[path to trojan]	"Added by the AGENT-EU TROJAN!"
X	explorer	explorer.exe	"Added by the KEYLOG-AK TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%\service"
X	EXPLORER	EXPLORER.exe	"Added by the NETHIEF-P TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%\ShellExt"
X	explorer	explorer.exe	"Added by the BLOCKEY-A TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%\config"
X	explorer	Yinstall.exe	"PurityScan/Clickspring adware"
X	Explorer	Windows Explorer.exe	"Added by the SILLYFDC-I WORM!"
X	Explorer	explorar.vbs	"Added by the DESKTO-A WORM!"
X	Explorer	TXP1atform.exe	"Added by the FUJACKS.CA VIRUS!"
X	explorer	system.exe	"Added by the AGENT-FI TROJAN!"
X	Explorer	msrstart.exe	"Added by the SOPICLICK TROJAN!"
X	explorer	main.vbe	"Added by the SHUSH-A WORM!"
X	Explorer 2238	[path to trojan]	"Added by the AGENT-CPI TROJAN!"
X	Explorer Loader	explr32.exe	"Added by the AGOBOT.N WORM!"
X	Explorer Loader	explorerl.exe	"Added by the SDBOT-ADI WORM!"
X	Explorer lptt01	explorer.exe	"RapidBlaster variant (in a ""explorer"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here.Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually!"
X	EXPLORER MICROSOFT SYSTEM	explore.exe	"Added by a variant of the RBOT WORM!"
X	Explorer ml097e	explorer.exe	"RapidBlaster variant (in a ""explorer"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here.Note - this is not the legitimate Windows Explorer (explorer.exe) which would not normally appear in Msconfig/Startup unless you added it manually!"
X	Explorer soft	explorer.pif	"Added by the RBOT-APK WORM!"
X	Explorer soft	explorer.com	"Added by the RBOT-ARM WORM!"
X	Explorer Updater	IEXPLORE.exe	"Added by the SDBOT-WO WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	explorer.exe	explorer.exe	"Added by the AGENT-EW or PWS-CY TROJANS! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	explorer.exe	explorer.exe	"Added by the DELF-ACL TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the Program Files folder"
X	Explorer.exe	csrss.exe	"Added by the JUEGO-B WORM! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %AppData%\Microsoft"
X	Explorer32	Expl32.exe	"Added by the HACKTACK.B TROJAN!"
X	Explorer32	explorer6s4.exe	Added by the Downloader.Win32.Small.biq TROJAN!
X	Explorer32	efsdfgxg.exe	"Added by the CLICKER-Y TROJAN!"
X	Explorer5	config_.com	"Added by the VB.CBG WORM!"
X	Explorer6.1.EXE	Explorer.exe	Added by the MYDOOM.B WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually!
X	explorerf.exe	explorerf.exe	"Added by the AGENT-GDZ TROJAN!"
X	ExplorerRun	conime.exe	"Added by the DLDR-G TROJAN! Note - this is not the legitimate Console IME process of the same filename which is located in %System%. This one is located in %Temp%"
X	ExplorerTask	explorer.exe	"Added by the ZCREW-B BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in the ""Fonts"" sub-folder"
X	ExploreUpdSched	[random filename]	"ZenoSearch adware"
X	exporet	winset.exe	"Added by the QQPASS-I TROJAN!"
U	Express ClickYes	ClickYes.exe	"""Express ClickYes is a handy tool that runs in the system tray automatically clicks the Yes button for the Outlook Security security prompt
X	filename process	explore.exe	"Added by the AGOBOT-QN WORM!"
X	FireExplore Update	FireExplore.exe	"Added by a variant of the RBOT WORM!"
X	Firefox Plugin Manager	firefoxpgm.exe	Added by the MSNPHOTO.E WORM!
U	Firefox Preloader	FirefoxPreloader.exe	"Firefox Preloader - ""a utility that is designed to load parts of Mozilla Firefox into memory before it is used to improve the its startup time"". Even on fast machines Firefox can take a while to load"
U	FreeRAM XP	FreeRAM XP Pro *.exe	"FreeRAM XP Pro - memory optimizer where * represents the version. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
U	FreeRAM XP	FreeRAM XP Pro.exe	"FreeRAM XP Pro - memory optimizer. MS MVPs (Most Valued Professional) recommend not using memory managers with Win98/SE/ME. See this article and make up your own mind"
X	Generic Host Process for WinXP Services	mshelp.exe	"Added by the AGENT-GQP TROJAN!"
X	GenericHostXP	WinLoaderXP.exe	"Added by the BDOOR-ACX BACKDOOR!"
X	google Intrenet Explorer	google.pif	"Added by the RBOT-ARA WORM!"
U	Gravis Xperience Driver Support	Grxp4exe.exe	"Driver for Gravis game controllers such as the Eliminator Aftershock. Must be loaded if you run the supplied application software for the controller to be recognized. Start it manually via a shortcut if not used"
X	HelpExp.exe	HelpExp.exe	"Attune HelpExpress - spyware. Disable and uninstall - see here"
U	hfxp	hfxp.exe	"Hide Folders XP - hide your folders so only you can view them"
N	HGTXPEI	FirstReboot.exe	Herucles Audio tool for the Hercules Game Theater XP soundcard. Available via Start -> Settings -> Control Panel
U	Hide and Protect any Drives for Win95/98/Me/2k/XP	HPDAgent.exe	"Loads Hide and Protect any Drives - which allows you to ""Protect Hard drive
X	HLL Data Parameter	hllcxpa.exe	"Added by the RBOT.AFG WORM!"
N	HP Info Express	??	"On HP PCs
X	hri	iexpl0re.exe	"Added by the DLOADER.MAQ TROJAN! Note the number ""0"" in the filename"
X	IE configure	explorer.exe	"Added by the LINEAGE-C TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually!"
X	IECheck	xpssl.exe	"Added by the TIRBOT-E WORM!"
X	IEDriver	xplore.exe	"IeDriver adware variant"
X	IEexplorer AUpdate	IEexplore32.exe	"Added by the RBOT-GRE WORM!"
X	IELoader32	iexplore32.exe	"Added by the SPEX or SPEX.B WORMS!"
X	IESet	IExplorer.dll	"Added by the PWS-BLUEDIT TROJAN!"
X	iestart	iexp1orer.exe	"Added by the NEMOG.C TROJAN!"
X	IEXPL0RER	IEXPL0RER.EXE	"Added by the AGOBOT-QL WORM!
X	iexplo	iexplor.exe	"Added by the SIDEA TROJAN!"
X	IExploer	svshosts.exe	"Added by the IRCBOT.BT TROJAN!"
X	Iexploit	Iexploit.html	"Added by the INKER.B WORM!"
X	iexplor.exe	iexplor.exe	"Added by an unidentified WORM or TROJAN! See here"
X	Iexplore	iexplore.exe	"Added by the BOXER TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	IEXPLORE	iexplore.exe	"Added by the APHEXDOOR TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	IExplore	IEXPLORE.EXE	"Added by the DLOADER-YZ TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in a ""Custom"" subfolder"
X	IEXPLORE	IEXPLORE.EXE	"Added by the BANKER-BWE TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	iExplore Ini	ie4uini.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Iexplore Services	iexplore.exe	"Added by the LITHIUM BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup!"
X	IEXPLORE.EXE	[path to trojan]	"Added by the BANCOS-CJ TROJAN!"
X	IEXPLORE.EXE	goot.exe	"Added by the BIFROSE-C TROJAN!"
X	IExplorer	Iexplor32.exe	"Added by the BDOOR-BY BACKDOOR!"
X	IExplorer	IExplorer.EXE	"Added by the BANCOS-CH TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	IEXPLORER	msiecfg.exe	"Added by the BDOOR-JU BACKDOOR or BANCBAN-IP TROJAN!"
X	Iexplorer	explorer.exe	"Added by the ZAPCHAS-AC TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	iexplorer lptt01	iexplorer.exe	"RapidBlaster variant (in a ""iexplorer"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	iexplorer ml097e	iexplorer.exe	"RapidBlaster variant (in a ""iexplorer"" folder in Program Files). Recommended you use RapidBlaster Killer to uninstall - see here"
X	Iexplorer.exe	Iexplorer.exe	"Added by the BANCBAN-EN TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	IExplorer32 Java Scripting	IExplore32b.exe	"Added by the RBOT.ABO WORM!"
X	IExplorer32c Java Scripting	IExplore32cb.exe	"Added by the RBOT.ABN WORM!"
X	IExplorer6 Java Scripting	IExplore326.exe	"Added by a variant of the SDBOT WORM!"
X	IExplorer7 Java Scripting	IExplore327.exe	"Added by a variant of the SDBOT WORM!"
X	Iexplorerr.exe	Iexplorerr.exe	"Added by the BANKER-EUT TROJAN! The file is located in %Windir%\Sun\Java\Deployment\logs"
X	Iexplorerr.exe	Iexplorerr.exe	"Added by the BANKER.AOVZ TROJAN! The file is located in %Windir%\msagent\gf"
X	IExplorerService	WinSock.exe	"Added by the AGENT.KIU TROJAN!"
X	iExpresser	iexpresser.exe	"Added by the SLENFBOT.AP WORM!"
U	igfxpers	igfxpers.exe	"Installed with the graphics drivers for Intel desktop and mobile motherboard chipsets with integrated graphics. It's purpose or function isn't known at present but testing with it disabled would appear to indicate it isn't required - hence the recommended ""U"" status"
U	Intel(R) Common User Interface	igfxpers.exe	"Installed with the graphics drivers for Intel desktop and mobile motherboard chipsets with integrated graphics. It's purpose or function isn't known at present but testing with it disabled would appear to indicate it isn't required - hence the recommended ""U"" status"
X	Internet Application Driver	expIorer.exe	"Added by the IRCBOT-WK TROJAN!"
X	Internet Exploere Services	urlmon32.dll.exe	"Added by the EVIAN.C WORM!"
X	Internet Explore Microsoft	lEXPLORE.EXE	"Added by the RBOT-AOF WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	Internet Explorer	iexplorer.exe	"Added by the LORSIS WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Internet Explorer	IEXPLORE.EXE	"Added by the RBOT-EY WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Internet Explorer	IExplorer.exe	"Added by the NETHIEF-O BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Internet Explorer	http.exe	"Added as part of a new potential CWS infection
X	Internet Explorer	iexpiore.exe	"Added by the RBOT-AZC WORM!"
X	Internet Explorer	IEPLORE32.EXE	"Added by the AGOBOT-CU WORM!"
X	Internet Explorer	twain.exe	"Added by the AGENT.BEA TROJAN!"
X	Internet Explorer Agent	iexplorer.exe	"Added by the AGENT-BH TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Internet Explorer Auto-Update	updt32v5.exe	"Added by the SPYBOT-AB BACKDOOR!"
X	Internet Explorer Configuration	IEXPLORE.EXE	"Added by the SDBOT-UL WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Internet Explorer Security	iexplore.pif	"Added by the RBOT-ALQ WORM!"
X	Internet Explorer Sys32	isys32.exe	"Added by the IRCBOT-ADA WORM!"
X	Internet Explorer Updater	lexbac.exe	"Added by the DOWNLOAD TROJAN!"
X	Internet Explorer Updater	iexplorer.exe	"Added by the REUR.B WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Internet Explorer6	IEexplore.exe	"Added by the RBOT.AGC WORM. Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Internet Explorer6.0	IEXPLORE.EXE	"Added by the RBOT.ENZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Internet Security Service	expllorer.exe	"Added by the REFROSO.AFF TROJAN!"
X	InternetExplorer2	windows.exe	"Added by the SDBOT-CZP WORM!"
X	InternetExplorer32	iexplore32.exe	"Added by the RBOT-GRA WORM!"
X	Internet_Explorer	microsoft.exe	"Added by the BANKER-EUQ TROJAN!"
X	Internet_Explorer.exe	Internet_Explorer.exe	"Added by the BANKER-END TROJAN!"
X	Intespention	IEXPLORE.exe	"Added by the FORBOT-FL WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Intranet Explorer	[random filename]	"Added by the POEBOT.DK BACKDOOR!"
U	Iomega ImIconXP	imiconxp.exe	"Iomega REV System Software - allows your Iomega REV drive to interact with the operating system via the Iomega REV UDF file system
X	irwftp	iexplorer.exe	"Added by the BANKER-AN TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	ixplore	ixplore.exe	"Added by the SDBOT-CY TROJAN!"
X	ixplores	ixplores.exe	"Added by the SDBOT-CE WORM!"
X	ixproxy	[path to trojan]	"Added by the XORPIX-A TROJAN!"
X	Java Runtimes	iexplore.exe	"Added by the KILLAV.B WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This file is located in a %Windir%\Java\Java folder"
X	Jufualt	winxp2.exe	"Added by the SDBOT-AAB WORM!"
X	kernel32sys.dll	IEXPLORER.exe	"Added by the RBOT-MK WORM!"
X	KernellApps	lexplore.exe	"Added by the BANCBAN-BS TROJAN! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	key	sysxp.exe	"Added by the BEAGLE.AB WORM!"
X	key	sys_xp.exe	"Added by the BEAGLE.AC WORM!"
X	key	winxp.exe	"Added by the BEAGLE.AG WORM!"
U	klp	explorer.exe	"ComSurveilSys keystroke logger/monitoring program - remove unless you installed it yourself!"
Y	KPDrv4XP	KPDrv4XP.exe	MediaKey USB Keypad Driver
X	l44sys**	iexplore	"Added by the VBS.LIDO WORM - where ** is a number between 65 and 76"
X	lexplore	lexplore.exe	"Added by the BROPIA WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
N	lexpps	lexpps.exe	"For Lexmark printers. From Lexmark: "This enables bi-directional printing over a peer to peer network. If the printer is connected directly to your PC
?	LifeCam	LifeExp.exe	"Related to Microsoft's LifeCam series of webcams. What does it do and is it required?"
?	LifeExp	LifeExp.exe	"Related to Microsoft's LifeCam series of webcams. What does it do and is it required?"
X	Limpet	explorer16.exe	"Added by the RBOT-AJD WORM!"
X	lnternet Explorer	AMSNDMGR.EXE	"Added by the KWBOT.R WORM! Note that the ""l"" is a lower case ""L"" and not an upper case ""I"""
X	lnternet Update	lExplore.exe	"Added by the RBOT-GRH WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	load	explorer.exe	"Added by the LINEAGE-OZ TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	load	WinExplorer.exe	"Added by the VB.EIW WORM!"
X	Loadab1	explorer.exe	"Added by the LINEAGE-AJ TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %ProgramFiles%"
X	loadMecq0	explorer.exe	"Added by the MUMUBOY.C TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %ProgramFiles%"
X	loadMect1	explorer.exe	"Added by the LINEAGE-L TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %ProgramFiles%"
X	LSA Shell (Export Version)	LSASS.exe	"Added by the AHKER.K WORM and variants. Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Macromedia Drive	Iexplor32.exe	"Added by a variant of the RBOT WORM!"
X	Media Player Update	xpsp1mfh.exe	"Added by a variant of the RBOT WORM!"
X	Media-XP-Service-Pack3	msnzx.exe	"Added by the SDBOT-ACW WORM!"
U	Mediafour XPlay Tray Notification Icon	Xptryicn.exe	"Mediafour Xplay - allows you to use an Apple iPod digital music player with a PC running Windows. If not used regularily start manually before connecting the iPod"
U	Mediafour XPlay Tray Notification Icon	Xptryicn.exe	"Xplay 2 from Mediafour Corporation - ""expands what you can do with any iPod
X	MediaXPServicePack	mxpsp.exe	"Added by the SDBOT.CDT WORM!"
X	Messenger Explorer	m41n.exe	"Added by the SDBOT-SA BACKDOOR!"
X	Micrcoft Exploerer	spoolsal.exe	"Added by the RBOT-AKK WORM!"
X	Micrcoft Exploerer	svchose.exe	"Added by the RBOT-ASL WORM!"
X	MicroCQ0	explorer.exe	"Added by the LINEAGE-AK TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %ProgramFiles%"
X	Microft Exploerer	spoolsac.exe	"Added by the RBOT-AMD WORM!"
X	Micromedia Flash Update	xptxt.exe	"Added by the RBOT-GAB WORM!"
X	Microsoft	iexplore.exe	"Added by the QQROB-R TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Microsoft	Explorerr.exe	"Added by the IRCBOT-WG TROJAN!"
X	Microsoft	Explorer.exe	"Added by a variant of the RBOT WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft ALGXP Protocol	alg32.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Automatic Updater	Explorer.exe	"Added by the RBOT-SG WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft CPXP Protocol	cpxp.exe	"Added by the RBOT.ATP WORM!"
X	Microsoft Dev	iexplorer32.exe	"Added by a variant of the AGOBOT/GAOBOT WORM!"
X	Microsoft Directx push	directxpushup.exe	"Added by a variant of the RBOT-GHT WORM!"
X	Microsoft Explorer	svapache.exe	"Added by the RBOT-VR WORM!"
X	Microsoft Explorer	explorer.scr	"Added by the RBOT-ADH WORM!"
X	Microsoft Explorer	explorer.pif	"Added by the SDBOT-ACX WORM!"
X	Microsoft Explorer	explorer.exe	"Added by the POEBOT-LY WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft Explorer Service	msexplore.exe	"Added by the IRCBOT.AYB BACKDOOR!"
X	Microsoft explorer Update	internal.exe	Added by an unidentified WORM or TROJAN!
X	Microsoft Explorer(64)	explorer64.exe	"Added by the SPYBOT-R WORM!"
X	Microsoft Explorer2	system.exe	"Added by the IRCBOT.BS TROJAN!"
X	Microsoft Explorer2	nome.exe	"Added by the RANDEX.AA WORM!"
X	Microsoft Explorer2	bitchbot.exe	"Added by the SDBOT.EV WORM!"
X	Microsoft EXPLOREXP Protocol	explorexp.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft IE	Iexplore.exe	"Added by the FORBOT-AG WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Microsoft Inc.	iexplorer.exe	"Added by the LOVGATE.E WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Microsoft Inc.	iexplorer.exe...	"Added by the LOVGATE.AO WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Microsoft Inet Xp..	teekids.exe	"Added by the BLASTER.C WORM!"
X	Microsoft Internet	expl0rer.exe	"Added by a variant of the SPYBOT WORM!"
X	Microsoft Internet Exp	iiexplorer.exe	"Added by the RBOT-KX WORM!"
X	Microsoft Internet Explorer	iexplore.exe	"Added by the POEBOT-J WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Microsoft Internet Explorer	iexplorer.exe	"Added by the SDBOT-XN WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Microsoft Internet Explorer	crsys32.exe	"Added by the RBOT.UZ WORM!"
X	Microsoft Internet Explorer	movies.exe	"Added by the BANCOS-DZ TROJAN!"
X	Microsoft Internet Explorer	svzhost.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Internet Explorer	mccagent.exe	"Added by the DLOADER-UD TROJAN!"
X	Microsoft Internet Explorer	sysini.exe	"Added by the DELF-LN TROJAN!"
X	Microsoft Internet Explorer	svchost.exe	"Added by the IRCBOT-AK TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""drivers"" subfolder"
X	Microsoft Internet Explorer	lEXPLORE.EXE	"Added by the RBOT-AMM WORM! Note - the executable is spelt with a lower case ""L"" rather than an lower or upper case ""i"" which is the case with Internet Explorer"
X	Microsoft Internet Explorer	svchosts.exe	"Added by the BANCBAN-U TROJAN!"
X	Microsoft Internet Explorer	[path to trojan]	"Added by the BANCBAN-AS TROJAN!"
X	Microsoft Internet Explorer	msngrt.exe	"Added by the SDBOT-GU BACKDOOR!"
X	Microsoft Internet Explorer	_svchost.exe	"Added by the TINY.LX TROJAN!"
X	Microsoft Internet Explorer Manager	ie.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Microsoft Internet Explorer Update	ieupdate.exe	"Added by the SHEUR.MH TROJAN!"
X	Microsoft Intrenet Explorer	goaw.pif	"Added by the RBOT-API WORM!"
X	Microsoft Intrenet Explorer	Soundsyst.exe	"Added by the RBOT-AQU WORM!"
X	Microsoft Intrenet Explorer	cnsg.pif	"Added by the RBOT-ARO WORM!"
X	Microsoft Intrenet Explorer	wcumrg.exe	"Added by the SDBOT-AFD WORM!"
X	Microsoft Java Virtual Machine	msjavarxp.exe	"Added by the FORBOT-DL WORM!"
X	Microsoft LAN32 Protocol	lanXp.exe	"Added by the RBOT-SS WORM!"
X	Microsoft Machine	winxp43.exe	"Added by the RBOT-IA WORM!"
X	Microsoft Machine Script	iexplorersis.exe	"Added by the RBOT-CMH WORM!"
X	Microsoft Messenger XP	MSMSN32.exe	"Added by the RBOT-ZP WORM!"
X	Microsoft Neser Experience	nese.exe	"Added by the RBOT-YH WORM!"
X	Microsoft OfficeXP	officeXP.exe	"Added by the KILLAV.MA WORM!"
X	Microsoft Outlook Express Protocol	svchst.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Synchronization Manager	explorer.exe	"Added by the SDBOT-AEA WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft Telecoms Center	xpfilesys.exe	Added by the RBOT.BCJ TROJAN!
X	Microsoft U	wuamkopxp.exe	"Added by the RBOT-AHC WORM!"
X	Microsoft Update	xpupdate.exe	"Added by the RBOT-QE WORM!"
X	Microsoft Update	explorer.exe	"Added by the RBOT.AEU BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft Update 32	explore32.exe	"Added by the SPYBOT.CYM WORM!"
X	Microsoft Update 32	winitXP32.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Update 32	explorer.exe	"Added by the RBOT-ARF WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Microsoft Update Drivers	explorers.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Update Machine	expl0rer.exe	"Added by the SDBOT.OK WORM!"
X	Microsoft Update Machine	Winmsixp32.exe	"Added by the RBOT.DN WORM!"
X	Microsoft Update Machine	winxpini.exe	"Added by the RBOT-OB WORM!"
X	Microsoft Updaters Pros	WINDLL32XP.EXE	Added by the SPYBOTTER.GEN VIRUS!
X	Microsoft Windows	explorar.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows (D)	iexplore.exe	Identified as a variant of the TrojanSpy.Agent malware
X	Microsoft Windows Communicator for NT/XP	wincomm.exe	"Added by the RBOT.ATH WORM!"
X	Microsoft Windows Expl0rer	expl0rer.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Windows Explorer	iexplorer.exe	"Added by a variant of the RBOT WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Microsoft Windows Explorer	explorewin.exe	"Added by the IRCBOT.WORM.212480.H WORM!"
X	Microsoft Windows Express	Microsoft Update	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Windows Express	websploit.exe	"Added by a variant of the SPYBOT WORM! See here"
X	Microsoft Windows Express	windowslogonb.exe	"Added by the SDBOT.ABOO WORM!"
X	Microsoft Windows Update XP64	*******.exe [ = random char]	"Added by a variant of the RBOT WORM!"
X	Microsoft Windows Update XP64	updatexp64.exe	"Added by the SDBOT-AIM WORM!"
X	Microsoft Windows Update XP64	Lcuninst.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Update XP64	mzhxlixm.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft Windows Updates	explorer32.exe	"Added by the SDBOT.VQ WORM!"
X	Microsoft Windows XP Configuration Loader	m32svco.exe	"Added by the SDBOT.WORM!.48548 WORM!"
X	Microsoft Windows XP/2K Explorer	winexplorer.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Microsoft Xp Systems loader	winsystem32xp.exe	"Added by the KELVIR.W WORM!"
X	Microsoft Xp Systems loaders	win32xpsys.exe	"Added by the SPYBOT.NYT WORM!"
X	Microsoft XPSP Protocol	xp386.exe	"Added by a variant of the RBOT WORM!"
X	Microsoft xpsp2	Networksystem.exe	"Added by a variant of the SDBOT WORM!"
X	Microsoft xpsp2	xpsp2.exe	"Added by the SDBOT-YQ WORM!"
X	Microsofts Updatez	exploirez.exe	"Added by a variant of the RBOT WORM!"
X	MicrosoftServiceManager	EXPLORERE.EXE	"Added by the YAHA.AB WORM!"
X	MicrosoftXP Service Pack 2	servicepack2.exe	"Added by the RBOT.EMC WORM!"
X	Microsoft�	iexplore.exe	"Added by the IRCBOT-ACO TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%\dllcache"
X	Micrsoft Internet Explorer	IEXPL0RE.EXE	"Added by the RBOT-AQV WORM! Note the number ""0"" in the filename"
X	Micsoft-Published-Software	explrer.exe	"Added by the RBOT-GFL WORM!"
U	Mini-XP	Mini-XP.exe	"Minimizer-XP from Totalidea Software - adds an additional button in the top right-corner of any application window to allow you to quickly minimize it to the System Tray. No longer available from the author but still available from download sites such as Download.com"
X	Miscrosoft Windows Explorer	IEEXPLORER.exe	Reported as the SDBOT.YX WORM!
X	MMB2	explorer.exe	Added by an unidentified WORM or TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%
X	mmxp2passion.exe	mmxp2passion.exe	"MediaMotor adware"
N	Money Express	moneyexpress.exe	Part of MS Money. Available via Start -> Programs
N	MoneyAgent	money express.exe	Part of MS Money. Available via Start -> Programs
N	MoneyAgent	mnyexpr.exe	Microsoft Money
X	Monitor	explor.exe	"Added by the AGOBOT-EF BACKDOOR!"
N	mozilla_cleanup	xpicleanup.exe	"Firefox Mozilla cleans up after installation. It is invoked on a restart after installation
N	MPXTray	mpxptray.exe	"Windows Media Player PowerToy which is run from the taskbar. It can be used to hide Windows Media Player (when in use) and choose various standard buttons (play/pause
X	MS Explorer	mexplore.exe	"Added by the YAHA.AE WORM!"
X	MS Internet Explore	MSIEx.exe	"Added by a variant of the RBOT WORM!"
X	MS Java Applets for Windows NT & XP	javaapplet.exe	"Added by the RBOT.BHG WORM!"
X	MS Java for Windows XP & NT	javanet.exe	"Added by the VANEBOT-A WORM!"
X	MS Java Service Wrapper Windows NT & XP	wrapper.exe	"Added by the VANEBOT-D WORM!"
X	Ms Java Update For Windows NT/XP	msijavaupdt32.exe	"Added by the RANDEX.AF WORM!"
X	MS MSN Menssenger 7.0	MSEXPORT.exe	"Added by a variant of the SDBOT WORM!"
X	MS Unix Binary	outlookexpressupdate.exe	"Added by the RBOT-YU WORM!"
X	Ms Update WinServices NT/XP	winservnt32.exe	"Added by the VANEBOT-G WORM!"
X	MSAgentXP	MSAgentXP.exe	Identified by Ewido Security Suite (Ewido is now part of AVG Technologies) as the REQLOOK.C TROJAN!
X	MsAudio	explorer.exe	"Added by the LEGMIR-BY TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	MSDN for Windows NT & WinXP	msdnxp.exe	"Added by the IRCBOT-PE WORM!"
X	msjava service	xpcd.exe	"Added by the SDBOT.VM WORM!"
X	msmsgs.exe	IEXPLORE.EXE	"Added by the VB.FQX TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	MSN Explorer	msnexplorer.exe	"Added by the AGENT-CAX TROJAN!"
X	MSN Explorer	explorer..exe	"Dropper for the Ciadoor.cb TROJAN!"
X	Msn Messenge	IExplorer.exe	"Added by the DELF-LL TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	MSN Messenger	IExplorer.exe	"Added by the BANKER-EU TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	MSN Messenger	explorer..exe	"Dropper for the Ciadoor.cb TROJAN!"
X	MSN Messenger	msnmsxp.exe	"Added by the AGOBOT-O WORM!"
X	MsnExplorer	winagent.exe	"Added by the BDOOR-EQ BACKDOOR!"
X	MsnExplorer	MSEXPLOREN.EXE	"Added by the BDOOR-EB BACKDOOR!"
X	MsnExplorer	SHCH.EXE	"Added by the BDOOR-EB BACKDOOR!"
X	MsnExplorer	SVCHST.EXE	"Added by the BDOOR-EB BACKDOOR!"
X	MsnExplorer	msnexploren.exe	"Added by the TACTSLAY.B TROJAN!"
X	MsnExplorer	sdhch.exe	"Added by the TACTSLAY.B TROJAN!"
X	MSNS PLUS XP2	msdupd.exe	"Added by the RBOT-BCE WORM!"
U	mspwr	pupxpman.exe	"Related to Ashampoo's PowerUp XP"
U	mspwr	PuXpMan2.exe	"System Tray access to the Ashampoo® PowerUp XP Platinum 2 tweaking utility from Ashampoo GmbH & Co. KG - which includes (amongst others) one-click tuning
X	MSSQL for Windows NT & XP	mssqlsnt.exe	"Added by a variant of the SDBOT WORM!"
X	MSStartOptimizer	Iexpres.exe	"Added by the DASMIN-E TROJAN!"
X	mssysint	Iexplore .exe	"Added by the PWSTEAL.ABCHLP and PSPIDER.310.B TROJANS! Note - this is not the legitimate Internet Explorer (iexplore.exe) process as there is a space before the "".exe"""
X	Msupdate	expIorer.exe	"Added by the TACTSLAY.A TROJAN!"
X	ms_anti_spywarebxp	mwfirebpx.exe	"Added by the SURILA-D TROJAN!"
X	ms_anti_spywarebxp	mwfibpx.exe	"Added by the SURILA-J TROJAN!"
X	myMh2	iexpl0re.exe	"Added by the AGENT.HWE TROJAN! Note the number ""0"" in the filename"
X	mysoft	winexplor.exe	"Browser hijacker
X	Name	Iexplorer0.exe	"Added by the THREADSYS TROJAN!"
X	Navegate	iiexplorer.exe	"Added by the BANCBAN-OP TROJAN!"
X	NDIS Adapter	servenxpp.exe	"Added by the FORBOT-GP WORM!"
X	NDIS Adapter	Servenxp.exe	"Added by the SPYBOT.LY WORM!"
X	Network Security XP	nvsvc86.exe	"Added by the RBOT-GUI WORM!"
X	nternet Explorer	iexplore.exe	"Added by the FORBOT-CT WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	ntxp2	ntxp2.exe	"Added by the VB-API TROJAN!"
X	NvCplDaemon	Xplorer.exe	"Added by the ORBINA-A WORM!"
X	NvXplDeamon	xstyles.exe	Added by the SMALL.AJ VIRUS!
U	nxpclient	sprtcmd.exe /P nxpclient	"NetExpert - ""India's first ever automated Broadband care technology."" Identifies and automatically fixes typical problems that may occur with your high-speed internet service"
X	Offica Monitor Secura Systeme	winxp_sp3.exe	"Added by a variant of the RBOT WORM!"
X	Office Startup	Exploer.exe	"Added by the GAOBOT.BV WORM! Note the different filename to the valid MS Office entries"
X	OfficeAgent	expIorer.exe	"Added by the TACTSLAY.A TROJAN!"
X	OFFICEXP	OFFICEXP.exe	"Added by the WOOTBOT.HE WORM!"
X	OneMoreKey	xpa.exe	"XP Antivirus rogue security software - not recommended"
X	OPTIMIZER	iexplore.exe	"Added by the EVEVINC BACKDOORNote - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	OPTIMIZER	iexplore.exe	"Added by the EVIVINC BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Outlook Express	msinm.exe	"Added by a variant of the RBOT WORM!"
X	Outlook Express Config	****.exe [ = random char]	"Added by a variant of the RBOT WORM!"
X	Outlook Express Protocol	look.exe	"Added by the RBOT-ACS WORM!"
X	Outlook Mail Services	express.exe	"Added by the RBOT.CJN WORM!"
X	pcc	explcrer.exe	"Added by the AGENT-FW BACKDOOR!"
X	PcEXPLODE	specialfile.exe	"Added by the RBOT.RH WORM!"
N	pdexplo	PDEXPLO.EXE	"PowerDesk Pro by PowerDesk Pro by Ontrack. Enhanced desktop and file manager. Available via Start -> Programs"
U	Persistence	igfxpers.exe	"Installed with the graphics drivers for Intel desktop and mobile motherboard chipsets with integrated graphics. It's purpose or function isn't known at present but testing with it disabled would appear to indicate it isn't required - hence the recommended ""U"" status"
N	Photo Express Calendar Checker SE	CALCHECK.EXE	"If you create multiple Weekly/Monthly/Yearly calendars to use as your wallpaper
U	PhotoExplosionCalCheck	calcheck.exe	"Calendar management feature of Nova Development's Photo Explosion"
U	PhraseExpress	phrase.exe	"""PhraseExpress organizes your frequently used text phrases and allows pasting them into any application"""
X	PoliceAV	xppolice.exe	"XP Police Antivirus rogue security software - not recommended
U	Power2GoExpress	Power2GoExpress.exe	"Power2GoExpress - all media disc burning software"
Y	PrevxPro	SAGUI.exe	"PrevX Home intrusion prevention software"
X	print sharing	[path] hidden32.exe [path] explorer.exe	"Added by the ZCREW.B BACKDOOR! Note - the legitimate Windows Explorer (explorer.exe) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually!"
X	Program in Windows	IEXPLORE.exe	"Added by the LOVGATE.AB WORM!"
X	Protection	IExplore .exe	"Added by the ELIPTER.D WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process as there is a space before the "".exe"""
U	PuXpMan2	PuXpMan2.exe	"System Tray access to the Ashampoo® PowerUp XP Platinum 2 tweaking utility from Ashampoo GmbH & Co. KG - which includes (amongst others) one-click tuning
U	PwrUpManager	PuXpMan2.exe	"System Tray access to the Ashampoo® PowerUp XP Platinum 2 tweaking utility from Ashampoo GmbH & Co. KG - which includes (amongst others) one-click tuning
U	PwrupTweakMe	PUPXPTWK.EXE	"Ashampoo's PowerUp XP is a ""tool for fine-tuning your Windows NT4
?	Qexplo	Qexplo.exe	"??"
U	RAM Idle Professional	RAM_XP.exe	"RAM Idle LE - ""A smart memory management program that will keep your computer running better
X	ravshell	expl0rer.exe	"Added by the DLOADER.MAR TROJAN!"
X	Ravshell	explore3.exe	"Added by the PAKES.HZ TROJAN!"
X	Ravshell	IEXPLORER.EXE	"Added by the AGENT.URZ TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	ravshell	1explore.exe	"Added by the DLOADER.MJF TROJAN!"
X	ravshell	iexpl0re.exe	"Added by the NOFERE-A TROJAN! Note the number ""0"" in the filename"
X	ravtask	iexpl0re.exe	"Added by the AGENT.AIR BACKDOOR! Note the number ""0"" in the filename"
X	RavTimer	explores.exe	"Added by the HOMEY-A TROJAN!"
X	RavTimeXP	[worm filename]	"Added by the WULLIK.B WORM!"
X	RavTimeXP	Virus	"Added by the CAGER.A WORM!"
X	RavTimXP	[worm filename]	"Added by the WULLIK.B WORM!"
X	RBOT v2 with NetAPI exploit traded with billgates I gave my mother Greetz - OG - Bluehell Irc Server	glossary.exe	"Added by the VANEBOT-J WORM!"
X	RealDownload Express	npnzdad.exe	Advertising spyware
U	RegClean Expert Scheduler	RCHelper.exe	"""Registry Clean Expert scans the Windows registry and finds incorrect or obsolete information in the registry. By fixing these obsolete information in Windows registry
U	RegClean Expert Scheduler	RCScheduler.exe	"""Registry Clean Expert scans the Windows registry and finds incorrect or obsolete information in the registry. By fixing these obsolete information in Windows registry
X	regdiit	winxp.exe	"Added by the RUNAUTO.F WORM!"
X	Registry Value Name	syswinxp.exe	"Added by the RBOT.BTZWORM!"
X	Registry Value Name	enzxp.exe	"Added by the RBOT-BAJ WORM!"
X	RegistryMonitor1	igfxpers.exe	"Added by the DELF-EZZ TROJAN! Note - this is not the legitimate Intel graphics driver which has the same filename"
X	RegMutex	lexplore_.exe	"Added by the MSNOPT-A TROJAN!"
N	Reminder	Remind_XP.exe	HP-specific program that reminds users to create System Recovery CDs. Once they use the Recovery CD Creator (Start -> PC Help & Tools -> Recovery CD Creator) to make the recovery CDs the entry will remove itself from the startup list
N	Remind_XP	Remind_XP.exe	HP-specific program that reminds users to create System Recovery CDs. Once they use the Recovery CD Creator (Start -> PC Help & Tools -> Recovery CD Creator) to make the recovery CDs the entry will remove itself from the startup list
U	RetroExpress	RetroExpress.exe	"EMC (was Dantz) Retrospect Express - backup software for external hardware storage devices"
X	rforce	EXP1ORER.EXE	"Added by the DROPPER.KN TROJAN! Note the number ""1"" in the filename rather than letter ""L"". It also drops another file named DEVICEMAP.SYS which is the ROOTKIT.O TROJAN!"
X	RpcLocator	explorer.exe	"Added by the RBOT-GSA WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	rx	explore.exe	"Added by the ZHENGTU-A TROJAN!"
X	s9201	av2008xp.exe	"Antivirus 2008 XP rogue security software - not recommended
X	s9201	as2008xp.exe	"AntiSpyware XP 2008 rogue spyware remover - not recommended
X	s9201	asproxp.exe	"AntiSpyware Pro XP rogue spyware remover - not recommended
N	sc	scrubxp.exe	"ScrubXP - utility that deletes safe to remove files
X	ScheduIr	msexploren.exe	"Added by a variant of the SDBOT WORM!"
X	Scheduler	expIorer.exe	"Added by the TACTSLAY.A TROJAN!"
X	Scheduler	msnexploren.exe	"Added by the TACTSLAY.B TROJAN!"
X	scvhost loader	ixplore.exe	"Added by the SDBOT-CY TROJAN!"
X	SecureExpertCleaner	sec.exe	"Secure Expert Cleaner rogue privacy program - not recommended
X	Security Antivirus Xp 1	inetfor.exe	"Added by the SDBOT.BAV WORM!"
X	Service Monitor	winxpser.exe	"Added by the RBOT-BDF WORM!"
X	Service System	windowsXP.exe	"Added by the BANCOS-EL TROJAN!"
X	Services	iexplore.exe	"Added by the MOGI WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Services	iexplorer.exe	Added by an unidentified WORM or TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe)
X	Services	iexploler.exe	"Added by the RANCK-LT TROJAN!"
X	Services	iexpolere.exe	"Added by the RANCK.LU TROJAN!"
X	Setup experation	svchost.exe	"Added by the TOFGER-AW TROJAN! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Shell	Explorer.exe sound_drive16.exe	"Added by the GP BACKDOOR! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The ""sound_drive16.exe"" file is located in %System%"
X	Shell	"Explorer.exe	msmsgs.exe"
X	Shell	Explorer.exe svchost.exe	"Added by the DOYORG BACKDOOR! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The legitimate svchost.exe process is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	shell	explorer.exe	"Added by the KAKKEYS TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Shell	Explorer.exe iexplore.exe	"Added by the KIPIS-U WORM! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The legitimate Internet Explorer (iexplore.exe) is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%\Microsoft"
X	Shell	Explorer.exe winupdate.exe	"Added by the AGENT-FD TROJAN! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The ""winupdate.exe"" file is located in %System%"
X	Shell	Explorer.exe [path] ibm[RANDOM 5 DIGIT NUMBER].exe	"Added by the ANSERIN TROJAN! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files"
X	Shell	Explorer.exe winsys32.exe	"Added by the DELF.CP BACKDOOR! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The ""winsys32.exe"" file is located in %Windir%"
X	Shell	explorer.exe msbnc.exe	"Added by the AGENT-PL BACKDOOR! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The ""msbnc.exe"" file is located in %System%"
X	Shell	Explorer.exe kbdsys.exe	"Added by the DAPROSY WORM! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The ""kbdsys.exe"" file is located in %AppData%\Microsoft\Keyboard"
X	Shell	Explorer.exe init32m.exe	"Added by the DLSW-B TROJAN! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The ""init32m.exe"" file is located in %System%"
X	Shell	Explorer.exe smssnt.exe	"Added by the AGOBOT.EE TROJAN! Note - do not delete the legitimate Windows Explorer (explorer.exe) which is located in %Windir% and can be used to launch other files. The ""smssnt.exe"" file is located in %System%"
X	Shell32	iexplore.exe	"Added by the IRCBOT-AY BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Shell32	explorer.exe	"Added by the SDBOT-NF WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	ShellRun	lexplore_.exe	"Added by the MSNOPT-A TROJAN!"
X	ShellRun32	iexplore.exe	"Added by the IRCBOT-AY BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
N	shicoxp	shicoxp.exe	Installed with the drivers for multi card readers of various brands. To differentiate between the various card slots on multi slot readers the shicoxp.exe file assigns and loads unique drive icons for the various card slots that are displayed in Windows Explorer
X	slide	Iexplore.exe	"Added by the GASLIDE TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup!"
N	SmartBarXP	SmartBarXP.exe	"SmartBarXP is a bar that runs down the side of your screen
X	smsys	Explorer.exe	"Added by the CLICKER-C BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in a ""Template"" subfolder"
U	SoundMAXPnP	SMax4PNP.exe	"Analog Devices SoundMax integrated soundcard utility. Brings up the SoundMAX Control Panel when it detects if new audio devices (such as microphones
X	sp2fwxp	sp2fwxp.exe	Added by the SMALL.ABW TROJAN!
X	Spam Blocker for Outlook Express	SBInst.exe	"Hotbar adware"
U	SpeedswitchXP	SpeedswitchXP.exe	"SpeedswitchXP is a CPU frequency control for notebooks running Windows XP"
X	Start Upping	iexplorerupdt.exe	"Added by the RBOT-RR WORM!"
X	Start Xp Setup	msxp.exe	"Added by the RBOT.AKK WORM!"
X	starter	iexplore.exe	"Added by the FORBOT-DU WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	startkey	explore32.exe	"Added by the BDOOR-MT BACKDOOR!"
X	startkey	explorer.exe	"Added by the BCKDR-MLD BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	startkey	winampXP.exe	"Added by the BIFROSE-OY TROJAN!"
U	StyleXP	StyleXP.exe	"StyleXP allows you customize the way WinXP looks. If disabled via msconfig it re-instates itself at reboot
X	Sun Java Console for Windows NT & XP	jconsole.exe	"Added by the VANEBOT-C WORM!"
X	Sustem	explorer.exe	"Added by an unidentified VIRUS
X	SustemUpdate	explorer.exe	"Added by an unidentified VIRUS
X	svc	expseny.exe	"Added by the PWS-ANG TROJAN!"
X	SvcH0st	msexploren.exe	"Added by the BACKDOOR-CGZ TROJAN!"
X	SvcH0st	msnexploren.exe	"Added by the TACTSLAY.B TROJAN!"
X	svchost	[path to explorer.exe]	"Added by the UNREAL-A TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually!"
X	svcshare	winampXP.exe	"Added by the FUJACKS-J VIRUS!"
?	Sxplog	sxpstub.exe	"Part of CA Unicenter Software Delivery - manage software across various systems
X	Sygate Personal Firewall	winxpstat.exe	"Added by a variant of the RBOT WORM!"
X	Symantec Antivirus professional	xplrer.exe	"Added by a variant of the FORBOT WORM!"
X	SYS1	explorar.exe	"Added by the SILLYFDC.BDJ WORM!"
X	syscheck	iexplorer.exe	Added by the AGENT.DM TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe)
X	sysconfig	iexplorer.exe	"Added by the CULT.C WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	sysMett1	explorer.exe	"Added by the LEGMIR-Y TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %ProgramFiles%"
X	SysMonXP	SysMonXP.exe	"Added by the NETSKY.Q WORM!"
X	SysRes	IExpIore .exe	"Added by the ELITPER.E WORM!"
X	Systam13	exp.exe	"Added by the RBOT.ESD BACKDOOR!"
X	system	Explorer.exe	"Added by the GRAYBIRD BACKDOOR! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	System	IEXPL0RE.EXE	"Added by the VB.KS WORM! Note the number ""0"" in the filename"
X	System Configuration	iexplore.exe	"Added by the RANDEX.AD WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	System Information Manager	iexplore.exe	"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	System Service	exp0lrer.exe	"Added by a variant of the RBOT WORM!"
X	System Service	msnxpexe.exe	"Added by the RBOT-AUA WORM!"
X	System Update2	explorer.exe	"Added by the AUTOTROJ-C TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	system xp	acdsee demo.exe	"Added by the SALGA.A WORM!"
X	System-Service	EXPLORER.SCR	"Added by the BENJAMIN.A WORM! KaZaA file-sharing users beware!"
X	SystemDrive	maxpaynow1.exe	"Added by the TIBS.BKU TROJAN!"
X	SystemExplorer	explore.exe	"Homepage hijacker - file located in the ""Services"" folder in Common Files"
X	Systray	w32explorer.exe	"Added by the RBOT-AJY WORM!"
X	SystrayServices	Msxpw.exe	"Added by the CITOR WORM!"
X	sys_Runtt1	explorer.exe	"Added by the LINEAGE-M TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %ProgramFiles%"
X	Syzmy3	exp1orer.exe	"Added by the LINEAG-AIO TROJAN! Note the number ""1"" in the filename"
X	SyztMy	expiorer.exe	"Added by the LINEAG-AIN TROJAN!"
X	taskmgr	explorer.exe	"Added by the ZAPCHAS-AC TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
U	TaskSwitchXP	TaskSwitchXP.exe	"""TaskSwitchXP from NTWind Software. Advanced task management utility that picks up where the standard Windows Alt Tab switcher leaves off. It provides the same functionality
X	TCPXP Update	tcpxp.exe	"Added by the RBOT-UL WORM!"
X	Telephony Provider	Iexplore.exe	"Added by the FORBOT-DF BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	The Service Pack Loader	spxp.exe	"Added by the RBOT-BYM WORM!"
U	TurboExplorer	TE.exe	"Web accelerator - ""TurboExplorer 2.x is a real-time web surfing accelerator specifically designed for Internet Explorer 4/5 to achieve a faster and more effective approach to the internet"". Only needed if you find it improves web browsing"
X	TURXP Protocol	sps32.exe	"Added by a variant of the SDBOT WORM!"
U	Tweak-xp	Tweak-xp.exe	"Main program for Tweak-XP - a WinXP tweaking utility"
X	Twunk_32exp.exe	Twunk_32exp.exe	"Added by the FAKEAV-BDZ TROJAN!"
U	UCmore XP - The Search Accelerator	"rundll32.exe UCMTSAIE.dll	DllShowTB"
N	Ulead Photo Express Calendar Checker	calcheck.exe	"If you create multiple Weekly/Monthly/Yearly calendars to use as your wallpaper
N	Ulead Photo Express x.0 Calendar	calcheck.exe	"Ulead Calendar Checker - part of Ulead Photo Express
X	Update Explorer	iexploreupd.exe	"Added by a variant of the RBOT WORM!"
X	Update Windows	EXPLORE.EXE	"Added by a variant of the SDBOT WORM!"
X	Update Windows	EXPLORE.EXE	"Added by a variant of the SDBOT WORM!"
X	UpdateXpSp	MS045-XP2.exe	"Added by the IRCBOT.NY TROJAN!"
X	USB 2.0 Driver	updateXPSPC.exe	"Added by the AGOBOT-RJ WORM!"
X	USB 2.0 Driver	updateXP.exe	"Added by the AGOBOT-QP WORM!"
X	USB 2.0 Driver	UpdateXPSP.exe	"Added by the AGOBOT-QD WORM!"
X	USB Driver4	UpdateXP.exe [ = random digit]	"Added by a variant of the SDBOT WORM!"
Y	Vade Retro Outlook Express	Vaderetro_oe.exe	"Vade Retro anti-spam software for Outlook Express from GOTO software products"
X	Video	explored.exe	"Added by the GAOBOT.RF WORM!"
X	Video Services	explore.exe	"Added by the GAOBOT.GL WORM!"
U	VirtualExpander	VirtualExpander.exe	"Micro Vault Virtual Expander from Sony for their range of USB memory sticks. This software will compress your data to virtually store about 3 times as much data"
X	VMware Tools	Xplorer.exe	"Added by the AUTOIT.K TROJAN!"
X	Vsample	winxpsock.exe	"Added by the SDBOT.BLK WORM!"
X	whxpin service	ssvsol.exe	"Added by a variant of the SDBOT WORM!"
X	Widnows Xp Web scan	xpscan.exe	"Added by a variant of the SDBOT WORM!"
X	win-xp	nvsc32.exe	"Added by the BROPIA.N WORM!"
X	win-xp	winis.exe	"Added by the BROPIA.N WORM!"
X	Win32 Explorer	Explorer32.exe	"StartPa-MN homepage hijacker"
X	Win32 NDIS Driver	xpndis.exe	"Added by a variant of the RBOT WORM!"
X	Win32 USB Driver	winxpinit.exe	"Added by the SDBOT.AA TROJAN!"
X	Win32.Exploit.mzH	mzrun.exe	"Added by the PAINTER TROJAN!"
X	WinAmpAgent	Msexploren.exe	"Added by the BDOOR-EB BACKDOOR! Note - this is NOT the popular Winamp media player which has a different filename"
X	WinAmpAgent	msnexploren.exe	"Added by the TACTSLAY.B TROJAN!"
X	Window	explore.exe	"Added by the GAOBOT.ADW WORM!"
X	Windows	explorer.exe	"Added by the POEBOT-J WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	windows	iexplore.exe	"Added by the RBOT-UM WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows Backup Configuration	IEXPLORER.exe	"Added by the GAOBOT.AZ WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Windows Communicator for NT/XP	osndyrn.exe	"Added by the SDBOT-CPK WORM! Note - can terminate AV related processes"
X	Windows Configuration System	IExplore.exe	"Added by the RBOT-DDG WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows DLL Verifier	xptl.exe	"Added by a variant of the RBOT WORM!"
X	Windows Driver	winxpdriver.exe	"Added by the WOOTBOT.EE WORM!"
X	Windows ExpIorer	[random filename]	"Added by the RBOT-AKO WORM!"
X	Windows Explorer	[filename].exe	"Added by the SDBOT TROJAN!"
X	Windows Explorer	Lsas.exe	"Added by the GAOBOT.AO WORM!"
X	Windows Explorer	olecom32.exe	Added by an unidentified WORM or TROJAN!
X	Windows Explorer	EEXPLORER.EXE	"Added by a variant of the SPYBOT WORM!"
X	Windows Explorer	explorer.exe	"Added by the POEBOT-J WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Windows Explorer	explorer.pif	"Added by the RBOT-AID WORM!"
X	Windows Explorer	system32.exe	"Added by the RBOT-AJH WORM!"
X	Windows Explorer	explorer32.exe	"Added by a variant of the SDBOT WORM!"
X	Windows Explorer	Windows Explorer.EXE	"Added by the VB-EBA WORM!"
X	Windows Explorer	system.exe	"Added by the STIRAUT WORM!"
X	Windows Explorer Key	explorer.exe	"Added by the IRCBOT-YB WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Windows Explorer Services	exploresys.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	Windows Explorer Shell	Winexec32.exe	"Added by the REDIST.B WORM!"
X	Windows Explorer SP2	csrss.exe	"Added by the BANKER-DM TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""JavaBeans"" subfolder"
X	Windows Explorer Update Build 1142	EXPLORER32.EXE	"Added by the KaZaA based KWBOT or KWBOT.Y WORMS!"
X	Windows Explorer-3212	WINRE16.EXE	"Added by the HARDOC WORM!"
X	Windows Explorer.exe	Explorer.exe	"Added by the FALTER-A TROJAN! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Windows Express	pci32b.exe	"Added by the BUZUS.C TROJAN!"
X	Windows File XP Manager	wfdmgr.exe	"Added by the SDBOT.XD TROJAN!"
X	Windows Internet Explorer 6	firefox.exe	"Added by the SPYBOT.ANA WORM! Note - this is not the Mozilla Firefox web browser which is always located in %ProgramFiles%\Mozilla Firefox. This file is found in %System%"
X	windows Live Messenger	iexplore.exe	"Added by the BCKDR-QTS BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Login	explored.exe	"Added by the GAOBOT.SY WORM!"
X	Windows MSN2 XP	swchost.exe	"Added by the KOLAB.AA WORM!"
X	Windows Network Controller	WinxPupd.exe	"Added by the FORBOT-DK WORM!"
X	Windows Registry Express Loader	regexpress.exe	"Added by the FORBOT-CJ WORM!"
X	Windows Registry XP	winxptdl.exe	"Added by the IRCBOT.AUN WORM!"
X	Windows service	iexpl0rer.exe	"Added by the SDBOT.RO WORM!"
X	Windows Service XP	XpFirewall.exe	"Added by the MYTOB.AM WORM!"
X	Windows Services	Explorer.exe	"Added by the SDBOT-WT WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Windows Services	iexplore.exe	"Added by the RBOT-WE WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	WINDOWS SYSTEM	winxpserv.exe	"Added by the MYTOB-BQ WORM!"
X	WINDOWS SYSTEM	xpupdate.exe	"Added by the ZOTOB-G WORM!"
X	WINDOWS SYSTEM	expI0rer.exe	"Added by the MYTOB-FI WORM! Note the upper case ""i"" and number ""0"" in the filename"
X	WINDOWS SYSTEM CLEANER	iexplore.exe	"Added by the MYTOB.ET WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows System File	cmxp.exe	"Added by the SPYBOT.KHO WORM!"
X	Windows System32	explorer.exe	"Added by the OPANKI-V WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is also copied to %System%"
X	Windows Taskmanager	iexplorer.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	Windows Taskmanager	taskxphost.exe	"Added by the PUSHBOT.BI WORM!"
X	Windows Update	iexplorere.exe	"Added by the GAOBOT.AP WORM!"
X	Windows Update	XPLoogNT.exe	"Added by the BANCD-B TROJAN!"
X	Windows Update	explored.exe	"Added by the GAOBOT.MF WORM!"
X	Windows update	explore.exe	"Added by the GAOBOT.AL WORM!"
X	windows update configurator	explore.exe	"Added by the SDBOT.RY BACKDOOR!"
X	Windows update loader	xpupdate.exe	"Malware installed by different rogue security software including SpyKillerPro. Also detected as the BRAVE-A TROJAN!"
X	Windows Update Svc	rundll32.exe xpupdate.dll	"ContraVirus rogue security software - not recommended
X	Windows Updater	iexplorerrs.exe	"Added by the RBOT-TN WORM!"
X	Windows Updater Servc	xpuupdate.exe	"ContraVirus rogue security software - not recommended
X	Windows USB Control Driver	iexplore.exe	"Added by a variant of the IRCBOT BACKDOOR! See here. Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	Windows Vista Corparation Agent Services	winxp_sp3.exe	"Added by a variant of the IRCBOT TROJAN!"
X	Windows Vista Transformation	IEXPLORE.exe	"Added by the FORBOT-GV WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	Windows Workstation Service	explore.exe	Added by unknown malware
X	Windows Xp	nortonguard.exe	"Added by the MYTOB-DZ WORM!"
X	Windows xp	Wins.exe	"Added by the RBOT.VH BACKDOOR!"
X	Windows XP Automatic Update	wXPupdate.exe	"Added by the RBOT-AFC WORM!"
X	Windows Xp Service Pack 2	svchost.exe	"Added by the XPLOS-A TROJAN! Note - this is not the legitimate svchost.exe process which should NOT appear in Msconfig/Startup!"
X	Windows XP SP2 KeyGen	Windows XP SP2 KeyGen.exe	"Added by the TIBICK-C WORM!"
X	Windows-XP-Service-Pack	xpspz.exe	"Added by the SDBOT-AAC WORM!"
X	WindowsExplorer	csrss.exe	"Messenger Blocker rogue security software - not recommended. Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\System"
X	WindowsExplorer	svchost.exe	"Messenger Blocker rogue security software - not recommended. Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\Common Files\System"
X	WindowsRegKey update XP	windexv1.exe	"Added by the RBOT-ABM WORM!"
X	WindowsUpdate renew	iexplore.exe	"Added by the AGENT.QG TROJAN! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %Windir%"
X	WindowsXP Module	DirectX3D.exe	"Malware
X	WindowsXp Security	spool.exe	"Added by the RBOT-GRK WORM!"
X	WindowsXP Update	windowsxpupdate.exe	"Added by the RBOT-PB WORM!"
X	WindowsXPserv	svcnxp32.exe	"Addee by the NANINF-A TROJAN!"
X	Windowz Update V2.0	Explorer.exe	"Added by the YODO WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	Windws Configuration Loader	LEXPLORE.exe	"Added by the SODABOT WORM!"
X	WinEx	lexplore_.exe	"Added by the MSNOPT-A TROJAN!"
X	Winlogon Shell	Explorer.exe svchost.exe	"Added by the KIPIS.M WORM! Note - this is not the legitimate svchost.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""1032"" sub-folder"
U	winmatrix.exe	WinMatrixXP.exe	"WinMatrix XP - wallpaper replacement that shows different matrix effects (including flowing matrix codes from 'The Matrix' movie) on your desktop"
X	winnt DNS ident	iexplorer.exe	"Added by a variant of the RBOT WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	winnt DNS ident	windowxp.exe	"Added by a variant of the RBOT WORM!"
Y	WinPatrol Explorer	WinPatrolEx.exe	"Part of WinPatrol"
X	winprofile	iexpiore.exe	Added by a variant of the MONCHER WORM!
X	WinProfile	iexpIore.exe	"Added by the CHUM-C TROJAN!"
X	WinReg32 service	holqdnoxpmeu.exe	"Added by a variant of the SDBOT WORM!"
X	WinSig	NetXP.exe	"Added by the BANKER-FN TROJAN!"
X	Winsock2 driver	IEXPLORE .EXE	"Added by the SPYBOT-AU WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) process as there is a space before the "".exe"""
X	Winsock32driver	sp2XPupdate.exe	"Added by the HACKARMY.S TROJAN!"
X	Winsock32driver	winXPupdate.exe	"Added by the HACKARMY.9728 TROJAN!"
X	winsockdriver	iexplor.exe	"Added by the BLATIC.A WORM!"
X	WinStar	IEXPL0RE.exe	"Added by the WOSRIST A TROJAN!"
X	WINTASK	msmgrxp.exe	"Added by the MYTOB.AQ WORM!"
X	WINTASK	iexplorer.exe	"Added by the MYTOB-CH WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	WINTASKS	winxpro.exe	"Added by the MYTOB.EZ WORM!"
N	Wintime Wtxpload	Wxpload.exe Wintime	"Part of the software to support a Dexxa USB graphics tablet. From a visitor - "This gets started anyway when you plug in the USB connector for the graphics tablet
X	WinUPD32	explorer.exe	"Added by an unidentified VIRUS
X	Winupdate Service	winxp.exe	"Added by the SPYBOT.IR WORM!"
X	winupdateconn_	Explorer.EXE	"Added by the COMBRA-B WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	WinVNC	iexplorer.exe	"Added by the EVIVINC BACKDOOR! Note - this is not the legitimate Internet Explorer (iexplore.exe)"
X	winXP	33.exe	"Added by the ANPES WORM!"
X	WinXP	plugin1.exe	Added by the Downloader-JW TROJAN!
X	WinXP	csrss.exe	"Added by the BANCOS-AG TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\WinXP\Tools"
X	winxp	winxp.exe	"Added by the BRONTOK-DN WORM!"
X	WinXP fix	[path to file]	"Added by the RANKY.P TROJAN!"
X	WinXP Processor Generator v1.2	intspnsr32.exe	"Added by the SDBOT.LP WORM!"
X	Winxp update	Cappp.exe	"Added by the RBOT.DKO WORM!"
X	WinXp Updater	winxp32.exe	"Added by the RBOT-HG WORM!"
X	WinXP-98	CSRSS.exe	"Added by the BANKER-DS TROJAN! Note - this is not the legitimate csrss.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %ProgramFiles%\WinXP-98\Tools"
X	winxpdll32.exe	winxpdll32.exe	Added by a variant of the SMALL downloader TROJAN!
X	WinXPHome	plugin2.exe	"Added by the malicious INOR.T SCRIPT!"
U	WinXPLoad	"Rundll32 LoadDll	LoadExe WinXPLoad.exe"
X	WinXProtector	WinXProtector.exe	"WinXProtector rogue security software - not recommended
X	WinXPService	lsass.exe	"Added by the ZAPCHAS-AS TROJAN! Note - this is not the legitimate lsass.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in a ""Lavan"" subfolder"
X	WinXPService	taksmgr.exe	Identified as a variant of the IRC/Flood.tool malware
X	WinXPService	Tskdbg.exe	"Added by the MDROP-BPQ TROJAN!"
X	WinXPService	ctfmon.exe	"Added by a variant of the IRCBOT BACKDOOR! Note - this is not the legitimate ctfmon.exe process associated with alternate text inputs which is always located in %System%. This one is located in a ""ctf"" sub-folder"
X	WinXPService	mirc.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	WinXPService	nero.exe	"Added by the IRCFLOOD.AG BACKDOOR! Note - this is not the Nero CD/DVD burning software by Ahead Software which is normally located in %ProgramFiles%\Ahead\Nero. This file is found in %System%"
X	WinXPService	taksmgr.exe	"Added by the KIRSUN.A BACKDOOR! The file is located in %System%"
X	WinXPService	taksmgr.exe	"Added by the KIRSUN.A BACKDOOR! The file is located in the root directory
X	WinXPService	wacult.exe	"Added by the KIRSUN.A BACKDOOR! The file is located in %Windir%\Fonts"
X	WinXPService	wacult.exe	"Added by the KIRSUN.A BACKDOOR! The file is located in %System%\mnut"
X	WinXpUpdate32	WinXpUpdate32.exe	"Added by the AGENT.YWL WORM!"
X	winxpusbd	winxp64.exe	"Added by a variant of the RBOT WORM!"
X	WksSVC	EXPLORER.exe	"Added by the MYTOB-BW WORM! Note - the legitimate Windows Explorer (same filename) is located in %Windir% and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%"
X	wnxpupdate	spvspool.exe	"Added by the DABORA.B WORM!"
X	wnxupdate	updatexp.exe	"Added by the COMBRA-G WORM!"
X	Wxp4	Norton Update.exe	"Added by the ERKEZ.D WORM!"
N	WXProcMgr Module	WXprocMgr.exe	"TVTonic from Wavexpress - ""enjoy 3 full-screen
X	xp	winis.exe	"Added by the RBOT-WO WORM!"
X	Xp	p2pnetworking.exe	"Added by the SDBOT.XA WORM!"
X	XP Antispyware 2009	XP_AntiSpyware.exe	"XP AntiSpyware 2009 rogue spyware remover - not recommended
X	XP Antivirus	xpantivirus.exe	"XPAntivirus rogue security software - not recommended
X	XP Antivirus	xpa.exe	"XP Antivirus rogue security software - not recommended"
X	XP Cleaner	xpc.exe	"XP Cleaner rogue cleaning utility - not recommended
X	XP HOT FIS	kbx.exe	"Added by the FORBOT-GS WORM!"
X	XP Loader	loaderxp.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
X	XP Protection Center	XPProtectionCenter.exe	"XP Protection Center rogue security software - not recommended
X	XP SecurityCenter	XPSecurityCenter.exe	"XPSecurityCenter rogue security software - not recommended
X	XP Service Pack	xpservicepack.exe	"Added by the SDBOT.AQA WORM!"
X	xp service pack 2	xpsp2.exe	"Added by the RBOT-KW WORM!"
X	XP System	systemxp.exe	"Added by a variant of the IRCBOT BACKDOOR! See here"
U	XP Tools	xptools.exe	"XPTools - ""integrated suite of powerful PC Utilities to fix
X	XP-C300C3AC	XP-C300C3AC.EXE	"Added by the AUTORUN.EHW WORM!"
X	xp32win	xpupdater02.exe	"Added by the MOSUCK-A TROJAN!"
N	Xpadder	Xpadder.exe	"""Xpadder simulates the keyboard and mouse using your gamepad"""
?	XPAgent	XPAgent.exe	"Part of the IBM/XPoint Rapid Restore utility - normally located in %ProgramFiles%\XPOINT\AGENT folder. Appears as a service in XP/Vista and under the ""RunServices"" registry key in Win98. What does it do and is it required?"
X	XPAgent	XPAgent.exe	"Detected by Panda as the CLICKER.LE TROJAN! Do not confuse this with the IBM/XPoint Rapid Restore file which is normally located in %ProgramFiles%\XPOINT\AGENT folder. This one is found in %System%"
X	XPAntivirus	XPAntivirus.exe	"XPAntivirus rogue security software - not recommended
X	XpAspy	[path to trojan]	"Added by the DELF-WH BACKDOOR!"
?	xpcfg	xpcfg.exe	"??"
?	Xpclient	xpclient.exe	"Part of the IBM/XPoint Rapid Restore utility. What does it do and is it required?"
U	XPCMonitor	XPCMonitor.exe	"XPC Monitor Keylogger keystroke logger/monitoring program - remove unless you installed it yourself!"
X	XPCPHOST Settings	xpcphost.exe	"Added by a variant of the RBOT WORM!"
X	XPdefender	XPdefender.exe	"XPdefender rogue spyware remover - not recommended
X	XPGuard	XP-Guard.exe	"XP-Guard rogue security software - not recommended
X	xpiupdate	xpiupdate.exe	"Added by the RBOT-AAB WORM!"
U	xPlanetControl	xPlanetControl.exe	"Tool that displays a globe with current day/night zones and clouds on users desktop."
U	Xplay	XPlay.exe	"Xplay 3 from Mediafour Corporation - ""expands what you can do with any iPod
U	XPlay.exe	XPlay.exe	"Xplay 3 from Mediafour Corporation - ""expands what you can do with any iPod
X	Xplorer	Xplorer.exe	"Added by the AUTOIT-BP WORM!"
X	Xplorer	KHATRA.exe	"Added by the AUTOIT.K TROJAN!"
X	Xpnet	NetXp.exe	"Added by the BANCBAN-AT TROJAN!"
X	xpprotect	xpdeluxe.exe	"XP Protector Deluxe rogue security software - not recommended
X	XPShield	XP-Shield.exe	"XP-Shield rogue security software - not recommended
X	XPSoft	CVDAsDW.exe	"Added by the SDBOT-SY WORM!"
X	XPSP2 Firewall	xpsp2fw.exe	"Added by the SMALL-RN TROJAN!"
X	xpsp2install	xpsp2Update.exe	"Added by the AGENT-DPK BACKDOOR!"
X	xpsp2Update	xpsp2Update.exe	"Added by the AGENT-DPK BACKDOOR!"
X	xpstart	wini.exe	"Added by the PICRATE.A WORM!"
X	xpstat	winlogins.exe	"Added by the RBOT-AAR WORM!"
X	XPsys	XPsys.exe	"Added by the DELF-KQ TROJAN!"
X	xpsystem	y.exe	"CoolWebSearch parasite variant"
X	Xpsystem	SERVICES.EXE	"Added by the DAEMOZ.A TROJAN! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! This one is located in %System%\SERVICES"
X	xpsystem	services.exe	"CoolWebSearch parasite variant. Note - this is not the legitimate services.exe process
X	xpsystem	MSXMIDI.EXE	"CoolWebSearch parasite variant
X	xpupdate	updates.exe	"Added by the BROPIA.L WORM!"
X	XpyBurner	XpyBurner.exe	"XpyBurner rogue spyware remover - not recommended
X	xp_system	[filename]	"Added by the BOOKMARKER.J TROJAN! The file is located in %Windir%\inet20004"
X	xp_system	winlogon.exe	"Added by the KREPPER-G TROJAN! - a CoolWebSearch parasite variant. Note - this is not the legitimate winlogon.exe
X	xp_system	services.exe	"Added by the KREPPER-N TROJAN and variants! Note - this is not the legitimate services.exe process which is always located in %System% and should not normally figure in Msconfig/Startup! The one is located in a %Windir%\inet*** - where *** varies dependent upon the variant
X	Yahoo Messengger	IEXPLORERS.exe	"Added by the AUTOIT.DH TROJAN!"
U	Zero PoPup Killer XP	zpk_xp.exe	"Intelligent anti-pop-up software product by Ax-Soft"
X	Zonealarm	iexplore.exe	"Added by the FORBOT-CP WORM! Note - this is not the legitimate Internet Explorer (iexplore.exe) which is always located in %ProgramFiles%\Internet Explorer and should not normally figure in Msconfig/Startup! This one is located in %System%"
X	[32 random numbers]	xpa.exe	"XP Antivirus rogue security software - not recommended"
X	[original filename]	xphost.scr	"Added by the BANCBAN-HM TROJAN!"
X	[random name]	??xplore.exe	"PurityScan adware"
X	[random name]	d?xplore.exe	"PurityScan adware"
X	[random name]	iexpl0ra.exe	"Added by the ULPM.BD TROJAN!"
X	[random name]	explore3.exe	"Added by the DELF.FAN TROJAN!"
X	[random number]	explorer.exe	"Added by the KEYLOG-AN TROJAN! Note - the legitimate Windows Explorer (explorer.exe) is located in the Windows or Winnt folder and would not normally appear in Msconfig/Startup unless you added it manually! This one is located in %System%\service"
X	[various names]	expoler.exe	"Wareout - malware masquerading as a spyware and dialer remover"
X	_Cat3	msmsgrxp.exe	"Added by a variant of the SMALL-DT downloader TROJAN"
X	_explore manager	_explore.exe	"Added by the SPEXTA-C TROJAN!"
X	{2C70168B-97CE-4f31-B85D-1FEC5002721D}	sxpgknrwva.exe	"Added by the FAKEALERT-AM TROJAN!"
U	{914C5BF8-EEDD-4F3A-A8BE-34EE71CF1B29}	XPlay.exe	"Xplay 3 from Mediafour Corporation - ""expands what you can do with any iPod
X	{F758F78B-0885-490e-AA3C-4A38D28B0240}	sxpjbwvahn.exe	"Added by the FAKEALERT-AM TROJAN!"

DISCLAIMER: It is assumed that users are familiar with the operating system they are using and comfortable with making the suggested changes. I will not be held responsible if changes you make cause a system failure.

This is NOT a list of tasks/processes taken from Task Manager or the Close Program window (CTRL+ALT+DEL) but a list of startup applications, although you will find some of them listed via this method. Pressing CTRL+ALT+DEL identifies programs that are currently running - not necessarily at startup. For a list of tasks/processes you should try WinTasks 5 Standard/Professional from LIUtilities or the list at AnswersThatWork. Therefore, before ending a task/process via CTRL+ALT+DEL just because it has an "X" recommendation, please check whether it's in MSCONFIG or the registry first. An example would be "svchost.exe" - which doesn't appear in either under normal conditions but does via CTRL+ALT+DEL. If in doubt, don't do anything.